...

11 files changed, 142 insertions, 111 deletions

diff --git a/os/core/audio.nix b/os/core/audio.nix
index 5b9607c..e677a90 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -25,20 +25,6 @@ in
           alsa.support32Bit = true;
           jack.enable = true;
           wireplumber.enable = true;
-
-          # wireplumber.extraConfig."10-force-input-awake" = {
-          #   "monitor.alsa.rules" = [
-          #     {
-          #       matches = [
-          #         { "node.name" = "~alsa_input.*HyperX.*"; }
-          #         { "node.name" = "~alsa_output.*HyperX.*"; }
-          #       ];
-          #       actions.update-props = {
-          #         "session.suspend-on-idle" = false;
-          #       };
-          #     }
-          #   ];
-          # };
         };
         playerctld.enable = true;
         spotifyd.enable = true;
@@ -50,14 +36,9 @@ in
       hardware.enableAllFirmware = true;
 
       environment.systemPackages = with pkgs; [
-        helvum
+        crosspipe
         alsa-utils
       ];
-
-      # boot.kernelParams = [ "usbcore.autosuspend=-1" ];
-      # boot.extraModprobeConfig = ''
-      #   options snd-usb-audio power_save=0
-      # '';
     })
 
     (lib.mkIf cfg.disable-devices.enable {
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index aae167e..6eca320 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -48,13 +48,6 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
-      signing = {
-        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
-        keyId = lib.mkOption {
-          type = lib.types.str;
-          description = "The GPG Key ID used to sign the boot files";
-        };
-      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -104,36 +97,7 @@ in
         default = cfg.grub.defaultEntry;
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
-
-        extraConfig = lib.mkIf cfg.grub.signing.enable ''
-          set check_signatures=enforce
-          terminal_input console
-          terminal_output console
-        '';
-
-        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
-          echo "Signing with keys from ${gpgHome}"
-
-          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
-
-          $SIGN_CMD /boot/grub/grub.cfg
-
-          for f in /boot/nixos/*; do
-            if [[ "$f" != *.sig ]]; then
-              $SIGN_CMD "$f"
-            fi
-          done
-        '';
       };
-      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
-    {
-      assertions = [
-        {
-          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
-          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
-        }
-      ];
-    }
   ];
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 4835cb8..d3021e4 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -6,18 +6,22 @@ in
   options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
   config = lib.mkIf cfg.enable {
     networking = {
-      useDHCP = lib.mkDefault true;
       networkmanager = {
         enable = true;
-        wifi.macAddress = "stable-ssid";
-        ethernet.macAddress = "stable-ssid";
+        wifi = {
+          macAddress = "random";
+          backend = "iwd";
+        };
+        ethernet.macAddress = "random";
+        dns = "systemd-resolved";
       };
       firewall = {
-        enable = true;
+        enable = false;
         allowedTCPPorts = [ ];
         allowedUDPPorts = [ ];
       };
     };
+    services.resolved.enable = true;
     systemd.services."NetworkManager-wait-online".enable = false;
   };
 }
diff --git a/os/core/security.nix b/os/core/security.nix
index bc2c41c..f1c41c2 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -21,21 +21,15 @@ in
       rtkit.enable = true;
     };
 
-    # systemd.user.services.polkit-gnome-authentication-agent-1 = {
-    #   description = "gnome-polkit-authentication-agent-1";
-    #   wantedBy = [ "graphical-session.target" ];
-    #   serviceConfig = {
-    #     Type = "simple";
-    #     ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-    #     Restart = "on-failure";
-    #     RestartSec = 1;
-    #     TimeoutStopSec = 10;
-    #   };
-    # };
-
     environment.systemPackages = with pkgs; [
       veracrypt
+
       bitwarden-desktop
+      keyguard
+
+      keepassxc
+      keepassxc-go
+      git-credential-keepassxc
     ];
   };
 }
diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index d41c116..a0cb1f4 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -12,12 +12,6 @@ in
   options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.rclone ];
-    services.tailscale = {
-      enable = true;
-      openFirewall = true;
-    };
-
     services.openssh = {
       enable = true;
       settings = {
diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix
new file mode 100644
index 0000000..8850795
--- /dev/null
+++ b/os/srv/i2p.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.os.srv.i2p;
+in
+{
+  options.os.srv.i2p.enable = lib.mkEnableOption "enables i2pd";
+
+  config = lib.mkIf cfg.enable {
+    services.i2pd = {
+      enable = true;
+      upnp.enable = true;
+      bandwidth = 1024;
+      ssu2 = {
+        enable = true;
+        # published = true;
+      };
+      reseed.verify = true;
+      # proto = {
+      #   socksProxy = {
+      #     enable = true;
+      #     port = 4445;
+      #   };
+      #   i2pControl.enable = true;
+      # };
+      yggdrasil.enable = true;
+    };
+  };
+}
diff --git a/os/srv/ollama.nix b/os/srv/ollama.nix
index 7a9bc78..3afc684 100644
--- a/os/srv/ollama.nix
+++ b/os/srv/ollama.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.os.srv.ollama;
 in
@@ -14,15 +19,9 @@ in
     services.ollama = {
       enable = true;
       package = pkgs.ollama-rocm;
-      
+      rocmOverrideGfx = "12.0.1";
       user = "ollama";
       models = "/models";
-      
-      syncModels = true;
-      loadModels = [
-        "deepseek-r1:14b"
-        "qwen3:14b"
-      ];
     };
   };
 }
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 40f9c74..fecb9df 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -23,17 +23,18 @@ in
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
       secrets = {
-        "syncthing/gui_password" = {
-          owner = username;
-          sopsFile = ../../secrets/oci.yaml;
+        "syncthing/gui_password".owner = username;
+        "syncthing/encryption/game-saves".owner = username;
+        "syncthing/encryption/keepass".owner = username;
+        "vpn/warp_private_key" = {
+          owner = "root";
+          group = "networkmanager";
+          mode = "0400";
+          restartUnits = [ "NetworkManager.service" ];
         };
         "obs/websocket_password".owner = username;
         root_password.neededForUsers = true;
         user_password.neededForUsers = true;
-        oracler_password = {
-          neededForUsers = true;
-          sopsFile = ../../secrets/oci.yaml;
-        };
       };
     };
 
diff --git a/os/srv/srv.nix b/os/srv/srv.nix
index 8ee895b..4edd742 100644
--- a/os/srv/srv.nix
+++ b/os/srv/srv.nix
@@ -12,5 +12,7 @@
     ./ollama.nix
     ./kdeconnect.nix
     ./monero.nix
+    ./vpn.nix
+    ./i2p.nix
   ];
 }
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index 332bb54..b350428 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -6,39 +6,34 @@
 }:
 let
   cfg = config.os.srv.syncthing;
+  syncDirs = lib.mapAttrsToList (_: folder: folder.path) config.services.syncthing.settings.folders;
 in
 {
   options.os.srv.syncthing.enable = lib.mkEnableOption "enables syncthing syncing";
   config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.rules = map (path: "d ${path} 0755 ${username} users -") syncDirs;
+
     services.syncthing = {
       enable = true;
-      user = "${username}";
+      user = username;
       dataDir = "/home/${username}/.local/share/syncthing";
       configDir = "/home/${username}/.config/syncthing";
-      guiPasswordFile = "/run/secrets/syncthing/gui_password";
+      guiPasswordFile = config.sops.secrets."syncthing/gui_password".path;
 
       settings = {
-        devices = {
-          "desktop" = {
-            id = "YGMWGOB-LTJUDM7-CY25MAF-NPE7J4J-KYRNPB5-ZHD5DBI-VNRAXI6-LIP2DQP";
-          };
-          "laptop" = {
-            id = "";
-          };
-          "thinkpad" = {
-            id = "";
-          };
-        };
+        devices."oci".id = "DQXGVDC-KGPM6RK-5NDEBJJ-R7PEWYZ-N6Z3WFZ-TSVJG5X-235SHG4-4BEJNQJ";
+
         folders = {
           "game-saves" = {
             path = "/home/${username}/.saves";
-            id = "shared-saves-v1";
+            id = "game-saves";
             devices = [
-              "desktop"
-              "laptop"
-              "thinkpad"
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/game-saves".path;
+                compression = "always";
+              }
             ];
-
             versioning = {
               type = "staggered";
               params = {
@@ -47,6 +42,22 @@ in
               };
             };
           };
+
+          "keepass" = {
+            path = "/home/${username}/.keepass";
+            id = "keepass";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/keepass".path;
+                compression = "metadata";
+              }
+            ];
+            versioning = {
+              type = "simple";
+              params.keep = "10";
+            };
+          };
         };
       };
     };
diff --git a/os/srv/vpn.nix b/os/srv/vpn.nix
new file mode 100644
index 0000000..28c7a9e
--- /dev/null
+++ b/os/srv/vpn.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.vpn;
+  netCfg = config.os.core.network;
+in
+{
+  options.os.srv.vpn.enable = lib.mkEnableOption "enables vpn stuff";
+
+  config = lib.mkIf (cfg.enable && netCfg.enable) {
+    networking.networkmanager.ensureProfiles = {
+      environmentFiles = [ config.sops.secrets."vpn/warp_private_key".path ];
+      profiles.cloudflare-warp = {
+        connection = {
+          id = "cloudflare-warp";
+          type = "wireguard";
+          interface-name = "wg0";
+          autoconnect = false;
+        };
+        wireguard = {
+          mtu = 1200;
+          private-key = "$WG_KEY";
+        };
+        "wireguard-peer.bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=" = {
+          endpoint = "engage.cloudflareclient.com:2408";
+          allowed-ips = "0.0.0.0/0;::/0;";
+        };
+        ipv4 = {
+          method = "manual";
+          address1 = "172.16.0.2/32";
+          dns = "1.1.1.1;1.0.0.1;";
+        };
+        ipv6 = {
+          method = "manual";
+          address1 = "2606:4700:110:84c7:36c4:e444:5efb:b108/128";
+          dns = "2606:4700:4700::1111;2606:4700:4700::1001;";
+        };
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      wgcf
+      wireguard-tools
+    ];
+  };
+}