chore: update flake.lock 2026-05-17

chore: begin updating zim updater
fix: update SHA hashes
2026-05-17 00:03:17 +00:00 · 2026-05-13 11:01:33 -05:00 · 2026-05-13 10:50:26 -05:00 · 2026-05-13 08:33:48 -05:00 · 2026-05-13 08:06:57 -05:00 · 2026-05-12 21:25:24 -05:00
144 changed files with 1886 additions and 2507 deletions
@@ -1,13 +1,13 @@
 name: Update flake.lock

-on:
+"on":
  schedule:
    - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
  workflow_dispatch:

 jobs:
  update-flake-lock:
-    runs-on: [bare-metal, nix-latest]
+    runs-on: nix-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -1,23 +0,0 @@
-stages:
-  - eval
-  - build
-  - push
-
-"Evaluate for builds":
-  stage: eval
-  tags:
-    - kubernetes
-  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
-  artifacts:
-    paths:
-      - gitlab-ci-continue.yml
-  script: nix run ".#gen-build" > gitlab-ci-continue.yml
-
-"Trigger builds":
-  stage: build
-  trigger:
-    include:
-      - artifact: gitlab-ci-continue.yml
-        job: "Evaluate for builds"
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
@@ -17,7 +17,7 @@ repos:
      - id: mixed-line-ending
      - id: trailing-whitespace
  - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
    hooks:
      - id: yamllint
        args:
@@ -30,8 +30,9 @@ repos:
              comments: false
              comments-indentation: false
              document-start: false
+              line-length: false
  - repo: https://github.com/NixOS/nixfmt
-    rev: v1.1.0
+    rev: v1.2.0
    hooks:
      - id: nixfmt-nix
  - repo: https://github.com/astro/deadnix
@@ -1,23 +1,32 @@
 {
-  lib,
  pkgs,
  top,
  ...
 }:
 let
-  builder-config = {
-    darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
-    darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
+  system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
+  builderConfig = top.nixunstable.lib.nixosSystem {
+    inherit system;
+    modules = [
+      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
+      {
+        virtualisation = {
+          host.pkgs = pkgs;
+          darwin-builder = {
+            workingDirectory = "/var/lib/darwin-builder";
+            hostPort = 22;
+          };
+        };
+      }
+    ];
  };
-  builder = arch: let
-    b = builder-config."darwin-${arch}-builder";
-  in {
-    command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
+  builder = {
+    command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
    serviceConfig = {
      KeepAlive = true;
      RunAtLoad = true;
-      StandardOutPath = "/var/log/builder-vm-${arch}.log";
-      StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
+      StandardOutPath = "/var/log/builder-vm-${system}.log";
+      StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
    };
  };
 in
@@ -32,23 +41,12 @@ in
    nerd-fonts.hack
  ];

-  #launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
+  launchd.daemons.darwin-builder = builder;

  nix = {
    enable = true;
-    buildMachines = [
-      {
-        hostName = "ssh-ng://builder@localhost";
-        system = "aarch64-linux";
-        maxJobs = 4;
-        supportedFeatures = [
-          "kvm"
-          "benchmarch"
-          "big-parallel"
-        ];
-      }
-    ];
    gc.interval.Hour = 3;
+    linux-builder.enable = true;
    settings.auto-optimise-store = false; # Darwin bugs?
  };

@@ -37,11 +37,4 @@ let
      ++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
    };
 in
-(
-  lib.genAttrs
-    (builtins.attrNames (builtins.readDir ./hosts))
-    (
-      name:
-      mac { inherit name; }
-    )
-)
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
@@ -31,6 +31,7 @@ in
      "bitwarden"
      "bruno"
      "chromium"
+      "claude"
      "dbeaver-community"
      "ghostty"
      "firefox"
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 let
  username = "greg";
 in
@@ -25,19 +25,17 @@
    },
    "buildbot": {
      "inputs": {
-        "flake-parts": "flake-parts",
-        "hercules-ci-effects": "hercules-ci-effects",
        "nixpkgs": [
          "nixunstable"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1775969270,
-        "narHash": "sha256-uu+DFoqMI2g2E+QE6EQfVc4g/jibNSnVobSUhxFr20o=",
+        "lastModified": 1778391342,
+        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "df9ff85cf20cedeae2f231dc2997d2e8ca5810cf",
+        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
        "type": "github"
      },
      "original": {
@@ -46,36 +44,12 @@
        "type": "github"
      }
    },
-    "charts": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "haumea": "haumea",
-        "nix-kube-generators": "nix-kube-generators",
-        "nixpkgs": "nixpkgs",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1776307304,
-        "narHash": "sha256-JrIt6c4GPl5V7JFMlv4E78JA+cOVV/akmP0MXCAd7cs=",
-        "owner": "nix-community",
-        "repo": "nixhelm",
-        "rev": "5194fa4b3f8a09d74978057cd9ef70b28a910543",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixhelm",
-        "type": "github"
-      }
-    },
    "colmena": {
      "inputs": {
        "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
        "stable": "stable"
      },
      "locked": {
@@ -121,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775037210,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "lastModified": 1777780666,
+        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
        "type": "github"
      },
      "original": {
@@ -152,6 +126,22 @@
      }
    },
    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
      "flake": false,
      "locked": {
        "lastModified": 1767039857,
@@ -169,17 +159,14 @@
    },
    "flake-parts": {
      "inputs": {
-        "nixpkgs-lib": [
-          "buildbot",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -190,14 +177,17 @@
    },
    "flake-parts_2": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -207,27 +197,6 @@
      }
    },
    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvimunstable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
      "inputs": {
        "nixpkgs-lib": [
          "nurpkgs",
@@ -249,24 +218,6 @@
      }
    },
    "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
      "locked": {
        "lastModified": 1659877975,
        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@@ -281,53 +232,6 @@
        "type": "github"
      }
    },
-    "haumea": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1685133229,
-        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
-        "owner": "nix-community",
-        "repo": "haumea",
-        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v0.2.2",
-        "repo": "haumea",
-        "type": "github"
-      }
-    },
-    "hercules-ci-effects": {
-      "inputs": {
-        "flake-parts": [
-          "buildbot",
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "buildbot",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1773550609,
-        "narHash": "sha256-neu7ixXHjV3LobVjOndkL97u+6UF6Yoh+CUnzX7kUBQ=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "554f6ed448ca74c00aa2371cde901ae1e73005b9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "type": "github"
-      }
-    },
    "hmunstable": {
      "inputs": {
        "nixpkgs": [
@@ -335,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776184304,
-        "narHash": "sha256-No6QGBmIv5ChiwKCcbkxjdEQ/RO2ZS1gD7SFy6EZ7rc=",
+        "lastModified": 1778954430,
+        "narHash": "sha256-oaNyOr05lblaQdtbkbN1wO0b2KLIL2O1LkmwDgdQp4I=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "3c7524c68348ef79ce48308e0978611a050089b2",
+        "rev": "26aaab785b0bab4af60a2c42b22760fa906ef22a",
        "type": "github"
      },
      "original": {
@@ -370,6 +274,45 @@
        "type": "github"
      }
    },
+    "minecraft": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1778039471,
+        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
+    "niks3": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1778839878,
+        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
+        "owner": "Mic92",
+        "repo": "niks3",
+        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "niks3",
+        "type": "github"
+      }
+    },
    "nix-github-actions": {
      "inputs": {
        "nixpkgs": [
@@ -393,11 +336,11 @@
    },
    "nix-hardware": {
      "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1778945272,
+        "narHash": "sha256-Aipz0UiBhE2a1FYJrNc2y+5vKWo5QVkhmaIJk3/ls+g=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "379c1f274f0fa354d012f0600806de54e79f29b5",
        "type": "github"
      },
      "original": {
@@ -406,53 +349,7 @@
        "type": "github"
      }
    },
-    "nix-kube-generators": {
-      "locked": {
-        "lastModified": 1762437901,
-        "narHash": "sha256-5yuJODagAq+aMXQAT2c0gfXKLqapmA6eUHR33jKNHuU=",
-        "owner": "farcaller",
-        "repo": "nix-kube-generators",
-        "rev": "810dcf792081790648ba9ae705b9a2286115ace8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "farcaller",
-        "repo": "nix-kube-generators",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
-      "locked": {
-        "lastModified": 1767767207,
-        "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
      "locked": {
        "lastModified": 1750134718,
        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
@@ -468,13 +365,43 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1776169885,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1778379128,
+        "narHash": "sha256-+yjPmoKsTqe/FQHriXzIfI0ELuEt3+1LXc0BE8nU/Yc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e361b0ff94723bc94283566dc2a13a46f07eaf5c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
        "type": "github"
      },
      "original": {
@@ -484,29 +411,61 @@
        "type": "github"
      }
    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1778491576,
+        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1766025857,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1777207419,
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      }
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1776169885,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
        "type": "github"
      },
      "original": {
@@ -518,18 +477,18 @@
    },
    "nixvimunstable": {
      "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
        "nixpkgs": [
          "nixunstable"
        ],
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1776350339,
-        "narHash": "sha256-Rl+tnpvdpf66e/3m+LPNzUoebV3jpiJz7oMxas8FB3I=",
+        "lastModified": 1778906310,
+        "narHash": "sha256-LqASEJRtLuKRBJd9051T1KMAEaYvsVrc6m64jhD6xbw=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "4f75992439d3d554a3681880510e4b645ca2d15b",
+        "rev": "06cace835d7ee727852ac789e3dcd42fc2fd360e",
        "type": "github"
      },
      "original": {
@@ -541,15 +500,15 @@
    },
    "nurpkgs": {
      "inputs": {
-        "flake-parts": "flake-parts_4",
-        "nixpkgs": "nixpkgs_3"
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1776350162,
-        "narHash": "sha256-iGEy0sg4EPO8yivJ6YweACEM3f18rLJfM7wjG/HCz8A=",
+        "lastModified": 1778975705,
+        "narHash": "sha256-DweZZ/JO7AxbQ9+caW8Jt8L5MtjMvVWpKDS+MAiWN8E=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "46a3451d51a24c20062a0db7c00201cdf1cc8e7a",
+        "rev": "25081c3d50352c88e7502e2a1c76fda8560b2b41",
        "type": "github"
      },
      "original": {
@@ -558,66 +517,18 @@
        "type": "github"
      }
    },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "charts",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "charts",
-          "uv2nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1763662255,
-        "narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "042904167604c681a090c07eb6967b4dd4dae88c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1764134915,
-        "narHash": "sha256-xaKvtPx6YAnA3HQVp5LwyYG1MaN4LLehpQI8xEdBvBY=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "2c8df1383b32e5443c921f61224b198a2282a657",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "agenix": "agenix",
        "buildbot": "buildbot",
-        "charts": "charts",
        "colmena": "colmena",
        "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
        "hmunstable": "hmunstable",
+        "minecraft": "minecraft",
+        "niks3": "niks3",
        "nix-hardware": "nix-hardware",
+        "nixpkgs-lib": "nixpkgs-lib_2",
        "nixunstable": "nixunstable",
        "nixvimunstable": "nixvimunstable",
        "nurpkgs": "nurpkgs",
@@ -707,41 +618,37 @@
        "type": "github"
      }
    },
-    "uv2nix": {
+    "treefmt-nix_2": {
      "inputs": {
        "nixpkgs": [
-          "charts",
+          "niks3",
          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "charts",
-          "pyproject-nix"
        ]
      },
      "locked": {
-        "lastModified": 1767701098,
-        "narHash": "sha256-CJhKZnWb3gumR9oTRjFvCg/6lYTGbZRU7xtvcyWIRwU=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "9d357f0d2ce6f5f35ec7959d7e704452352eb4da",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
        "type": "github"
      }
    },
    "vsext": {
      "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1776310443,
-        "narHash": "sha256-XQo/vlS6xak3iT3xS2Q3TUMbreeeqe+PR99feUoV0UQ=",
+        "lastModified": 1778902753,
+        "narHash": "sha256-4tgJmu6sc6F6y+igJfh+kG0t2U1T2cDwfhz5hC0W2Tg=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "3a6d0ea13d092493b285b9093b5ce81e79df5cee",
+        "rev": "5df06838c483ad33aa5fb1448b9ba9de665930a1",
        "type": "github"
      },
      "original": {
@@ -752,17 +659,17 @@
    },
    "wsl": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
        "nixpkgs": [
          "nixunstable"
        ]
      },
      "locked": {
-        "lastModified": 1776255237,
-        "narHash": "sha256-LQjlc0VEn55WAT4BiI8sIsokb/2FNlcbBD+Xr3MTE24=",
+        "lastModified": 1777732699,
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "9a8c2a85f1ffdcecfb0f9c52c5a73c49ceb43911",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
        "type": "github"
      },
      "original": {
@@ -13,9 +13,6 @@
      url = "github:nix-community/buildbot-nix";
      inputs.nixpkgs.follows = "nixunstable";
    };
-    charts = {
-      url = "github:nix-community/nixhelm";
-    };
    colmena.url = "github:zhaofengli/colmena";
    darwin = {
      url = "github:lnl7/nix-darwin/master";
@@ -26,7 +23,10 @@
      url = "github:nix-community/home-manager/master";
      inputs.nixpkgs.follows = "nixunstable";
    };
+    minecraft.url = "github:Infinidoge/nix-minecraft";
+    niks3.url = "github:Mic92/niks3";
    nix-hardware.url = "github:nixos/nixos-hardware";
+    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
    nixvimunstable = {
      url = "github:nix-community/nixvim/main";
      inputs.nixpkgs.follows = "nixunstable";
@@ -50,6 +50,7 @@
        top.nixvimunstable.overlays.default
        top.nurpkgs.overlays.default
        top.vsext.overlays.default
+        top.minecraft.overlay
      ];
      metadata = builtins.fromJSON (builtins.readFile ./network.json);
      systems = [
@@ -68,6 +69,7 @@
          };
        }
      );
+      lib' = import ./lib { inherit (top.nixunstable) lib; };
    in
    top.flake-parts.lib.mkFlake { inputs = top; } {
      inherit systems;
@@ -79,6 +81,7 @@
              nixpkgs = imported_packages.x86_64-linux;
              specialArgs = {
                inherit
+                  lib'
                  metadata
                  self
                  top
@@ -115,7 +118,7 @@

        nixosConfigurations = (
          import ./hosts {
-            inherit top metadata;
+            inherit top metadata lib';
            nixpkgs = imported_packages;
          }
        );
@@ -144,16 +147,17 @@
            pkgs = imported_packages.${system};
          };

-          packages = (import ./pkgs { inherit pkgs; });
+          packages = (import ./pkgs { inherit pkgs top; });

          checks = import ./checks.nix {
            inherit system top self';
-            inherit (pkgs) lib;
+            inherit (top.nixpkgs-lib) lib;
          };

          devShells = import ./shells.nix {
            inherit pkgs;
            inherit (top) colmena;
+            inherit (self') packages;
          };
        };
    };
@@ -1,24 +1,22 @@
 builds:
-  exclude:
-    - "homeConfigurations.*"
-    - "nixosConfigurations.*"
-    - "packages.*"
-    # bitwarden-cli package is broken on aarch64-darwin
-    - "packages.aarch64-darwin.img-bitwarden"
-    # kmod-31 is not a thing on Darwin
-    - "packages.aarch64-darwin.qemu-hook"
-    - "packages.aarch64-darwin.vfio_shutdown"
-    - "packages.aarch64-darwin.vfio_startup"
-    # This one is a bit of a beast and shouldn't take up Garnix time
-    - "packages.aarch64-darwin.zim"
-    # These are just images which I will build when
-    # I feel like it
-    - "devShells.*"
-  include:
-    - "packages.aarch64-darwin.*"
-    - homeConfigurations.exodus
-    - darwinConfigurations.MacBook-Pro
-    - darwinConfigurations.MacBook-Prolocal
-    - darwinConfigurations.li
-    - nixosConfigurations.builder-x86
-    - nixosConfigurations.builder-aarch
+  # Exclude most things, as I locally build x86_64-linux and aarch64-linux
+  - exclude:
+      - "homeConfigurations.*"
+      - "nixosConfigurations.*"
+      - "packages.*"
+      # These are just images which I will build when
+      # I feel like it
+      - "devShells.*"
+    include:
+      - "packages.aarch64-darwin.*"
+      - darwinConfigurations.MacBook-Pro
+      - darwinConfigurations.MacBook-Prolocal
+      - darwinConfigurations.li
+  # Some specific includes which are not specific enough to override the rules
+  # above, due to the intrepretation of the glob excludes, but which I still
+  # need included
+  - include:
+      # These are Mac homeConfigurations, which I do not have the infra
+      # to build at home
+      - homeConfigurations."gregory.hellings-mbp"
+      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis vm-gitlab]
+let servers = [isaiah jeremiah zeke genesis]

 def par-map [ items: list, c: closure ] {
  let results = $items | par-each -k $c
@@ -71,6 +71,8 @@ def dc [ $cmd: string = "sh" ] {

 def claude [ ] {
    unlock
+    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
+    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
    ^claude
 }

@@ -26,6 +26,7 @@
      nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
      r = "run0";
      updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
+      p = "${lib.getExe pkgs.podman-tui}";

      # General
      k = "kubectl";
@@ -5,7 +5,7 @@
  # This allows things like SSH in distrobox to read the config file just fine
  home.file.".ssh/config" = {
    target = ".ssh/config_source";
-    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
+    onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
  };
  programs.ssh = {
    enable = true;
@@ -38,11 +38,6 @@ def _ivr2(args):
    vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2

-def _glrestart(args):
-    sudo nixos-container run gitlab -- systemctl restart gitlab
-    sudo nixos-container run gitlab -- systemctl restart nginx
-aliases['glrestart'] = _glrestart
-
 def _aws_creds(args):
    $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
    $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")
@@ -10,7 +10,9 @@ let
    let
      inherit (metadata.hosts.${host}) system;
      pkgs = nixpkgs.${system};
-      username = if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
+      pkgs' = top.self.packages.${system};
+      username =
+        if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
    in
    top.hmunstable.lib.homeManagerConfiguration {
      inherit pkgs;
@@ -24,6 +26,7 @@ let
          host
          username
          metadata
+          pkgs'
          ;
        nixvim = top.nixvimunstable;
        gui = false;
@@ -31,8 +34,4 @@ let
      };
    };
 in
-(
-  lib.genAttrs
-    (builtins.attrNames (builtins.readDir ./hosts))
-    user
-)
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  lib,
  host ? "most",
  top,
@@ -38,7 +39,7 @@ in
      gh
      git
      gnupatch
-      hms
+      pkgs'.hms
      btop
      inetutils
      jq
@@ -46,7 +47,7 @@ in
      nix-prefetch
      nmap
      openssl
-      setup-ssh
+      pkgs'.setup-ssh
      tmux
      tree
      unzip
@@ -24,6 +24,7 @@
    minio-client
    mumble
    pre-commit
+    prismlauncher
    restic
    restic-browser
    tea
@@ -22,11 +22,11 @@
      home-manager
      python3Packages.ipython
      just
+      glab
      go
      gopls
      mariadb
      nixVersions.stable
-      pipenv-ivr
      pre-commit
      python311
      python3Packages.flake8
@@ -4,9 +4,11 @@
  ...
 }:
 let
-  python = pkgs.python312.withPackages (p: with p; [
-    ipython
-  ]);
+  python = pkgs.python312.withPackages (
+    p: with p; [
+      ipython
+    ]
+  );
 in
 {
  # Disables hitting local cache
@@ -27,17 +29,23 @@ in
      direnv
      home-manager
      just
+      mcp-grafana
      nixVersions.stable
+      podman
+      poetry
      pre-commit
-      (pulumi.withPackages (p: with p; [
-        pulumi-aws-native
-        pulumi-command
-        pulumi-go
-        pulumi-nodejs
-        pulumi-python
-      ]))
+      (pulumi.withPackages (
+        p: with p; [
+          pulumi-aws-native
+          pulumi-command
+          pulumi-go
+          pulumi-nodejs
+          pulumi-python
+        ]
+      ))
      python
      rustc
+      terraform
    ];
  };

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-
-{
-  greg.vscodium.enable = false;
-
-  home.packages = with pkgs; [ brew ];
-}
@@ -3,19 +3,24 @@
  lib,
  metadata,
  pkgs,
+  top,
  ...
 }:
 {
  imports = [
    ../modules/nix-conf.nix
+    top.niks3.nixosModules.niks3-auto-upload
  ];

+  age.secrets.niks3-api-token.file = ../secrets/niks3/api_token.age;
+
  console = {
    font = "Lat2-Terminus16";
    keyMap = "us";
  };

  environment.systemPackages = with pkgs; [
+    top.niks3.packages.${pkgs.stdenv.hostPlatform.system}.niks3
    agenix
    bitwarden-cli
    bmon
@@ -26,10 +31,9 @@
    efibootmgr
    findutils
    file
-    gcc-tune
    git
    gnupatch
-    hms # My own home manager switcher
+    top.self.packages.${pkgs.stdenv.hostPlatform.system}.hms # My own home manager switcher
    iperf
    killall
    nano
@@ -53,9 +57,25 @@

  # Network Manager pulls in too many deps
  networking = {
+    extraHosts =
+      let
+        onNetwork =
+          attr: _k: v:
+          (builtins.hasAttr attr v) && v.${attr} != null;
+        getIPs =
+          attr: domain:
+          (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
+            lib.filterAttrs (onNetwork attr) metadata.hosts
+          ));
+      in
+      builtins.concatStringsSep "\n" (
+        (getIPs "ts" "shire-zebra.ts.net")
+        ++ (getIPs "nebulaIp" "nebula.thehellings.com")
+        ++ (getIPs "nebulaIp" "nebula")
+        ++ (getIPs "ip" "thehellings.lan")
+      );
    search = [
-      "thehellings.lan"
-      "home"
+      "nebula.thehellings.com"
    ];
    networkmanager.enable = false;
  };
@@ -81,6 +101,12 @@
  # Enable the OpenSSH daemon for remote control
  services = {
    locate.enable = true;
+    niks3-auto-upload = {
+      enable = config.greg.nix.cache;
+      authTokenFile = config.age.secrets.niks3-api-token.path;
+      serverUrl = "http://hosea.nebula.thehellings.com:5751";
+      verifyS3Integrity = true;
+    };
    openssh = {
      enable = true;
      settings.X11Forwarding = true;
@@ -114,17 +140,23 @@
    };
  };

-  security.sudo.extraRules = [
-    {
-      users = [ "greg" ];
-      commands = [
+  security = {
+    sudo-rs = {
+      enable = true;
+      extraRules = [
        {
-          command = "ALL";
-          options = [ "NOPASSWD" ];
+          users = [ "greg" ];
+          commands = [
+            {
+              command = "ALL";
+              options = [ "NOPASSWD" ];
+            }
+          ];
        }
      ];
-    }
-  ];
+    };
+    sudo.enable = false;
+  };

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.greg = {
@@ -1,5 +1,6 @@
 {
  top,
+  lib',
  metadata,
  nixpkgs,
 }:
@@ -14,11 +15,17 @@ let
    }:
    let
      inherit (metadata.hosts.${name}) system;
+      pkgs' = top.self.packages.${system};
    in
    channel.lib.nixosSystem {
      pkgs = nixpkgs.${system};
      specialArgs = {
-        inherit metadata top;
+        inherit
+          metadata
+          top
+          lib'
+          pkgs'
+          ;
      };
      modules = [
        {
@@ -44,16 +51,6 @@ in
    })
  )
 )
-// (lib.genAttrs
-  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
-  (
-    name:
-    (unstable {
-      inherit name;
-      extraMods = [ ./vm/${name} ];
-    })
-  )
-)
 // {
  # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
  #nixos = wsl { name = "wsl"; };
@@ -62,26 +59,4 @@ in
  #  name = "wsl";
  #  system = "aarch64-linux";
  #};
-
-  builder-aarch = lib.nixosSystem {
-    system = "aarch64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
-
-  builder-x86 = lib.nixosSystem {
-    system = "x86_64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
 }
@@ -18,7 +18,11 @@

  boot = {
    loader = {
-      systemd-boot.enable = true;
+      systemd-boot = {
+        enable = true;
+        memtest86.enable = true;
+        netbootxyz.enable = true;
+      };
      efi.canTouchEfiVariables = true;
    };
    binfmt.emulatedSystems = [
@@ -39,10 +43,6 @@
      enable = true;
      tags = [ "mobile" ];
    };
-    runner = {
-      enable = true;
-      qemu = true;
-    };
  };

  hardware = {
@@ -2,48 +2,23 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).

-{ lib, pkgs, ... }:
-
-let
-  adblockUpdate = pkgs.writeShellApplication {
-    name = "adblock-update";
-    runtimeInputs = with pkgs; [
-      curl
-      gnused
-      systemd
-    ];
-    text = ''
-      curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
-      curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
-
-      # Custom domains that I need to preserve for some reason
-      for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
-       	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
-      done
-
-      systemctl restart dnsmasq
-    '';
-  };
-in
+{
+  top,
+  pkgs,
+  pkgs',
+  ...
+}:
 {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./networking.nix
+    top.minecraft.nixosModules.minecraft-servers
  ];

  greg = {
    home = true;
    gnome.enable = false;
-    nebula = {
-      enable = true;
-      # genesis IS the routing node for the home LAN — it does not route through itself.
-      # Override the module default (which points at genesis) to avoid a routing loop.
-      unsafeRoutes = [ ];
-      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
-      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
-      routesSubnet = "10.42.0.0/16";
-    };
    proxies = {
    };
  };
@@ -61,26 +36,120 @@ in
  };

  environment.systemPackages = with pkgs; [
-    create_ssl
+    pkgs'.create_ssl
    step-ca
  ];

  networking.hostName = "genesis"; # Define your hostname.

-  systemd = {
-    services.adblock-update = {
-      after = [ "network-online.target" ];
-      requires = [ "network-online.target" ];
-      script = lib.getExe adblockUpdate;
-      serviceConfig.Type = "oneshot";
-    };
-    timers.adblock-update = {
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      requires = [ "network-online.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Unit = "adblock-update.service";
+  services = {
+    minecraft-servers = {
+      enable = true;
+      eula = true;
+      openFirewall = true;
+
+      servers = {
+        maya = {
+          enable = true;
+          operators = {
+            Almec = {
+              bypassesPlayerLimit = true;
+              uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
+            };
+          };
+          package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
+
+          serverProperties = {
+            allow-flight = true;
+            motd = "Maya's Minecraft World";
+          };
+          whitelist = { };
+
+          jvmOpts = "-Xms4092M -Xmx4092M";
+
+          symlinks = {
+            mods = pkgs.linkFarmFromDrvs "mods" (
+              builtins.attrValues {
+                # Health info
+                appleskin = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
+                  hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
+                };
+                # Needed by survivalfly
+                balm = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
+                  hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
+                };
+                # Adds more diverse biomes
+                # https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
+                biomes = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
+                  hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
+                };
+                # Automation engines
+                # https://www.curseforge.com/minecraft/mc-mods/create
+                #create = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
+                #  hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
+                #};
+                fabric_api = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
+                  hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
+                };
+                # Required by biomes-o-plenty
+                # https://www.curseforge.com/minecraft/mc-mods/glitchcore
+                glitchcore = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
+                  hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
+                };
+                # Tooltips
+                # https://www.curseforge.com/minecraft/mc-mods/jade/
+                jade = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
+                  hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
+                };
+                # Gives info on crafting recipes
+                # https://www.curseforge.com/minecraft/mc-mods/jei
+                jei = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
+                  hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
+                };
+                # Machines
+                # https://www.curseforge.com/minecraft/mc-mods/mekanism
+                #mekanism = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
+                #  hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
+                #};
+                # Shows installed mods
+                modmenu = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
+                  hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
+                };
+                # Better storage engines
+                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
+                refined-storage = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/8032/790/refinedstorage-fabric-3.0.0-beta.8.jar";
+                  hash = "sha256-XY5I+sw5JlWnKK/hPUOJsk2gnmqH4Iygq+aooN27NJY=";
+                };
+                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
+                #storagedrawers = pkgs.fetchurl {
+                #url = "https://mediafilez.forgecdn.net/files/7352/799/StorageDrawers-fabric-1.21.11-20.0.0.jar";
+                #hash = "sha256-eBKCmAtjAhdAjOyLMRneu/NZnNt+orIezxPy6V8g/S8=";
+                #};
+                survivalfly = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
+                  hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
+                };
+                # Also needed by biomes
+                # https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
+                terrablender = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
+                  hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
+                };
+              }
+            );
+          };
+        };
      };
    };
  };
@@ -22,8 +22,6 @@

 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
-#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
-10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan

 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -37,7 +35,6 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
-100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home
@@ -1,7 +1,9 @@
 {
  config,
-  pkgs,
+  lib,
+  lib',
  metadata,
+  pkgs,
  ...
 }:
 let
@@ -9,7 +11,6 @@ let
  lanIP = metadata.hosts.${config.networking.hostName}.ip;
  iot = "enp2s0";
  iotIP = "192.168.66.250";
-  #routerIP = metadata.infra.gw;
  extraHosts = builtins.readFile ./net/hosts;

  proxyPort = 3128;
@@ -24,9 +25,20 @@ let
  ];
 in
 {
-  greg.tailscale = {
-    enable = true;
-    tags = [ "home" ];
+  greg = {
+    nebula = {
+      enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
+      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
+      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
+      routesSubnet = "10.42.0.0/16";
+    };
+    tailscale = {
+      enable = true;
+      tags = [ "home" ];
+    };
  };

  # Really, why do I still have to force-disable this crap?
@@ -84,33 +96,43 @@ in
    #########
    # dnsmasq config
    ########
-    dnsmasq = {
+    bind = {
      enable = true;
-      settings = {
-        domain = "thehellings.lan";
-        expand-hosts = true;
-        log-queries = true;
-        no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
-        addn-hosts = "/etc/adblock_hosts";
-        hostsdir = "/etc/hosts.d/";
-        server = dnsServers;
-      };
-    };
-
-    prometheus.exporters = {
-      dnsmasq.enable = true;
-      blackbox = {
-        enable = true;
-        openFirewall = true;
-        configFile = pkgs.writeText "blackbox.yml" ''
-          modules:
-            icmp:
-              prober: icmp
-              timeout: 5s
-              icmp:
-                preferred_ip_protocol: ip4
-        '';
-      };
+      cacheNetworks = [
+        metadata.infra.lan
+        metadata.infra.tailscale
+        metadata.infra.nebula
+        "127.0.0.0/8"
+      ];
+      zones =
+        let
+          makeZoneFile =
+            hosts: domain:
+            let
+              preamble = [
+                "$ORIGIN\t${domain}."
+                "$TTL\t1h"
+                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
+                "\tIN\tNS\t${config.networking.hostName}"
+              ];
+              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+            in
+            pkgs.writeText "${domain}" (
+              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+            );
+        in
+        lib.mapAttrs
+          (domain: net: {
+            master = true;
+            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+          })
+          {
+            "shire-zebra.ts.net" = "tailscale";
+            "nebula.thehellings.com" = "nebula";
+            nebula = "nebula";
+            "thehellings.lan" = "lan";
+            lan = "lan";
+          };
    };
  }; # End of services configuration

@@ -6,6 +6,7 @@
  config,
  metadata,
  pkgs,
+  top,
  ...
 }:
 let
@@ -19,11 +20,30 @@ in
    # Include the results of the hardware scan.
    ./arr.nix
    ./hardware-configuration.nix
+    top.niks3.nixosModules.niks3
  ];

-  age.secrets.grafana-secret-key = {
-    file = ../../../secrets/grafana-secret-key.age;
-    owner = "grafana";
+  age.secrets = {
+    cache-private-key = {
+      file = ../../../secrets/cache-private-key.age;
+      owner = "niks3";
+    };
+    grafana-secret-key = {
+      file = ../../../secrets/grafana-secret-key.age;
+      owner = "grafana";
+    };
+    niks3-access-key-id = {
+      file = ../../../secrets/niks3/access_key_id.age;
+      owner = "niks3";
+    };
+    niks3-api-token = {
+      file = ../../../secrets/niks3/api_token.age;
+      owner = "niks3";
+    };
+    niks3-secret-access-key = {
+      file = ../../../secrets/niks3/secret_access_key.age;
+      owner = "niks3";
+    };
  };

  # Bootloader
@@ -98,6 +118,7 @@ in
        ];
      };
    };
+    firewall.interfaces.nebula0.allowedTCPPorts = [ 5751 ];
    nameservers = [ metadata.infra.dns ];
  };

@@ -150,6 +171,27 @@ in
        analytics.reporting_enabled = false;
      };
    };
+    niks3 = {
+      enable = true;
+
+      apiTokenFile = config.age.secrets.niks3-api-token.path;
+      gc.enable = false;
+      httpAddr = "${metadata.hosts.hosea.nebulaIp}:5751";
+      nginx = {
+        enable = true;
+        domain = "hosea.nebula";
+        enableACME = false;
+        forceSSL = false;
+      };
+      s3 = {
+        accessKeyFile = config.age.secrets.niks3-access-key-id.path;
+        bucket = "niks3";
+        endpoint = "nas1.shire-zebra.ts.net:9000";
+        secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
+        useSSL = false;
+      };
+      signKeyFiles = [ config.age.secrets.cache-private-key.path ];
+    };
    prometheus.exporters.graphite.enable = true;
    # Configure keymap
    xserver.xkb = {
@@ -43,10 +43,6 @@
      tags = [ "home" ];
    };
    remote-builder.enable = true;
-    runner = {
-      enable = true;
-      qemu = true;
-    };
    gitea-runner = {
      enable = true;
      extraLabels = [ "bare-metal:host" ];
@@ -22,8 +22,6 @@ in
  ];

  age.secrets = {
-    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
-
    gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
    gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
    gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
@@ -95,11 +93,6 @@ in
      tags = [ "home" ];
    };
    remote-builder.enable = true;
-    runner = {
-      enable = true;
-      threads = 3;
-      qemu = true;
-    };
  };

  hardware = {
@@ -66,20 +66,4 @@
      immichUrl = "https://immich.shire-zebra.ts.net";
    };
  };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitlab-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/systemctl";
-          options = [ "NOPASSWD" ];
-        }
-        {
-          command = "/run/current-system/sw/bin/podman";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
 }
@@ -61,7 +61,7 @@ in
              (
                val:
                lib.nameValuePair "/_${val}" {
-                  proxyPass = "http://matrix.kubernetes";
+                  proxyPass = "https://matrix.shire-zebra.ts.net";
                }
              )
              [
@@ -13,7 +13,7 @@

  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
    appstoreEnable = true;
    hostName = "next.${config.networking.domain}";
    https = true;
@@ -24,7 +24,6 @@ in
  virtualisation.oci-containers = {
    backend = "podman";
    containers."homepage" = {
-      # needs explicit port to match what gitlab-runner sees when pulling
      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
      ports = [ "${homepage}:80" ];
    };
@@ -1,7 +1,12 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  pkgs',
+  ...
+}:

 {
-  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
+  environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];

  services.postgresql = {
    enable = true;
@@ -28,10 +28,6 @@
    };
    nebula.enable = true;
    remote-builder.enable = true;
-    runner = {
-      enable = true;
-      vbox = false;
-    };
    tailscale = {
      enable = true;
      tags = [ "home" ];
@@ -35,10 +35,11 @@
      device = "/dev/nvme0n1p1";
      fsType = "auto";
    };
-    #"/mnt/disk1" = {
-    #device = "/dev/disk/by-uuid/0bb64e76-8811-499a-b60e-cc97808f2b0e";
-    #fsType = "btrfs";
-    #};
+    "/mnt/disk1" = {
+      device = "/dev/disk/by-uuid/bd04e868-034e-46e8-84ae-cd7347448bbd";
+      fsType = "xfs";
+      options = [ "nofail" ];
+    };
  };

  swapDevices = [ ];
@@ -1,273 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  registryPort = 5000;
-  vpnIp = "100.117.28.111";
-in
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  age.secrets =
-    let
-      cfg = n: {
-        file = ../../../secrets/gitlab/${n}.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    in
-    {
-      gitlab-secret = cfg "secret";
-      gitlab-otp = cfg "otp";
-      gitlab-db = cfg "db";
-      gitlab-db-password = cfg "db-password";
-      gitlab-jws = cfg "jws";
-      gitlab-key = cfg "key";
-      gitlab-cert = cfg "cert";
-      gitlab-salt = cfg "salt";
-      gitlab-primary-key = cfg "primary-key";
-      gitlab-deterministic-key = cfg "deterministic-key";
-
-      minio_access_key_id = {
-        file = ../../../secrets/minio_access_key_id.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-      minio_secret_access_key = {
-        file = ../../../secrets/minio_secret_access_key.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    };
-
-  greg = {
-    backup.jobs.nas-backup = {
-      src = "/var/gitlab/state/backup/";
-      dest = "gitlab";
-    };
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "gitlab"; # Define your hostname.
-    firewall.allowedTCPPorts = [
-      80
-      registryPort
-    ];
-  };
-
-  services = {
-    gitlab = {
-      enable = true;
-      backup = {
-        keepTime = 288;
-        startAt = [ "03:00" ];
-      };
-      databaseHost = "postgres.kubernetes";
-      databaseName = "gitlab";
-      databaseUsername = "gitlab";
-      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
-      databaseCreateLocally = false;
-      extraConfig = {
-        registry.port = null;
-        gitlab = {
-          trustedProxies = [
-            "${vpnIp}/32" # The system itself
-            "100.109.86.8/32" # Public server's IP
-          ];
-        };
-        object_store = {
-          enabled = true;
-          proxy_download = true; # Tell them to reach out to object storage themselves!
-          connection = {
-            provider = "AWS";
-            endpoint = "http://s3.thehellings.lan:9000";
-            region = "us-east-1";
-            aws_access_key_id = {
-              _secret = config.age.secrets.minio_access_key_id.path;
-            };
-            aws_secret_access_key = {
-              _secret = config.age.secrets.minio_secret_access_key.path;
-            };
-            path_style = true; # True for MinIO
-            aws_signature_version = 2;
-          };
-          #storage_options = ...;
-          objects = builtins.listToAttrs (
-            builtins.map
-              (
-                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
-              )
-              [
-                "artifacts"
-                "ci_secure_files"
-                "dependency_proxy"
-                "external_diffs"
-                "lfs"
-                "packages"
-                "pages"
-                "terraform_state"
-                "uploads"
-              ]
-          );
-        };
-      };
-      host = "src.thehellings.com";
-      https = true;
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      port = 443;
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-    };
-
-    nginx = {
-      enable = true;
-      clientMaxBodySize = "25000m";
-      virtualHosts = {
-        "vm-gitlab.shire-zebra.ts.net" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = 443;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 10000m ;
-          '';
-        };
-        "registry" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = registryPort;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:4567/";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 25000m ;
-          '';
-          serverAliases = [
-            "vm-gitlab.shire-zebra.ts.net"
-          ];
-        };
-      };
-    };
-
-    openssh.enable = true;
-
-    postgresql.enable = true;
-
-    qemuGuest.enable = true;
-
-    redis.servers.gitlab = {
-      enable = true;
-    };
-
-    #resolved.enable = true;
-  };
-
-  # Do not start nginx until we have tailscaled up and running, so it can bind
-  # to the 100.* addresses
-  systemd = {
-    services = {
-      certRefresh =
-        let
-          script = pkgs.writeShellApplication {
-            name = "cert-refresh";
-            runtimeInputs = [ pkgs.tailscale ];
-
-            text = ''
-              cd /etc/certs
-              tailscale cert vm-gitlab.shire-zebra.ts.net
-              chown nginx ./*
-              systemctl reload nginx
-            '';
-          };
-        in
-        {
-          script = lib.getExe script;
-          serviceConfig = {
-            Type = "oneshot";
-            User = "root";
-          };
-        };
-
-      nginx = rec {
-        after = [ "network-online.target" ];
-        requires = [ "network-online.target" ];
-        wants = after;
-        serviceConfig = {
-          RestartMaxDelaySec = "30s";
-          RestartSteps = "5";
-        };
-      };
-      tailscaled.partOf = [ "network-online.target" ];
-    };
-
-    timers = {
-      "cert-refresh" = {
-        wantedBy = [ "cert-refresh.service" ];
-        timerConfig = {
-          OnCalendar = "monthly";
-          Persistent = true;
-        };
-      };
-    };
-  };
-  system.stateVersion = lib.mkForce "24.11";
-}
@@ -1,58 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # Bootloader.
-  boot = {
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "uhci_hcd"
-        "ehci_pci"
-        "ahci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    loader = {
-      efi.canTouchEfiVariables = true;
-      systemd-boot.enable = true;
-    };
-  };
-
-  fileSystems."/" = {
-    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1E6A-C3BB";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}
@@ -0,0 +1,24 @@
+{ lib, ... }:
+{
+  hostsByNet =
+    net: hosts:
+    let
+      netAttr =
+        {
+          lan = "ip";
+          nebula = "nebulaIp";
+          tailscale = "ts";
+        }
+        .${net};
+    in
+    lib.mapAttrsToList
+      (name: value: {
+        inherit name;
+        address = builtins.getAttr netAttr value;
+      })
+      (
+        lib.filterAttrs (
+          _host: settings: (builtins.hasAttr netAttr settings) && (builtins.getAttr netAttr settings) != null
+        ) hosts
+      );
+}
@@ -40,7 +40,7 @@ metadata:
        },
        {
          "path": "/mnt/disk1",
-          "allowScheduling": false,
+          "allowScheduling": true,
          "tags": ["hdd", "large"]
        }
      ]
@@ -21,9 +21,6 @@ spec:
    spec:
      containers:
        - name: bitwarden-cli
-          # Since my gitlab instance depends on the database hosted in k3s, and
-          # the database depends on this image, I need a way to bootstrap the
-          # system if # I am doing disaster recovery. And this is it.
          image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
          #image: >-
          #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest
@@ -1,32 +1,21 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
-  url: https://kubernetes.github.io/dashboard/
+  url: "https://kubernetes-sigs.github.io/headlamp/"
  interval: "24h"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
  interval: "24h"
  chart:
    spec:
-      chart: kubernetes-dashboard
+      chart: headlamp
      sourceRef:
        kind: HelmRepository
-        name: kubernetes-dashboard
+        name: headlamp
      interval: "24h"
-  values:
-    app:
-      settings:
-        global:
-          clusterName: Hellings Home
-          itemsPerPage: 25
-      ingress:
-        enabled: true
-        hosts:
-          - dashboard.shire-zebra.ts.net
-        ingressClassName: tailscale
@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dashboard-tailscale
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: headlamp
+      port:
+        number: 3001
+  tls:
+    - hosts:
+        - headlamp
@@ -4,3 +4,4 @@ resources:
  - namespace.yaml
  - chart.yaml
  - user.yaml
+  - ingress.yaml
@@ -1,89 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich
-spec:
-  imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
-  #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
-  #postgresUID: 1
-  instances: 1
-  storage:
-    size: 60Gi
-  primaryUpdateStrategy: unsupervised
-  postgresql:
-    shared_preload_libraries:
-      - vectors.so
-      - vchord.so
-
-  bootstrap:
-    recovery:
-      source: origin
-    # initdb:
-    #   database: immich
-    #   owner: immich
-    #   secret:
-    #     name: postgres-user-immich
-    #   dataChecksums: true
-    #   postInitApplicationSQL:
-    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
-    #     - SET search_path TO "$user", public, vectors;
-    #     - CREATE EXTENSION IF NOT EXISTS "cube";
-    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
-
-  externalClusters:
-    - name: origin
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: k3sbackup-objectstore
-          serverName: pgvector
-
-  managed:
-    roles:
-      - name: immich
-        ensure: present
-        comment: Immich DB user
-        login: true
-        superuser: true
-        passwordSecret:
-          name: postgres-user-immich
-
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: k3sbackup-objectstore
---
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-immich
-spec:
-  name: immich
-  owner: immich
-  cluster:
-    name: immich
-  extensions:
-    - name: vectors
-      ensure: present
-    - name: vectorchord
-      ensure: present
-    - name: cube
-      ensure: present
-    - name: earthdistance
-      ensure: present
---
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: immich-backup
-spec:
-  immediate: true # Create one when this is added to the cluster
-  schedule: "0 2 0 * * *" # 1AM, nightly
-  backupOwnerReference: self
-  cluster:
-    name: immich
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
@@ -14,14 +14,12 @@ spec:
      - 100.88.91.27 # dns?
      - 100.80.99.48 # exodus
      - 100.88.91.27 # genesis
-      - 100.117.28.111 # gitlab
      - 100.68.203.1 # hosea
      - 100.84.183.79 # isaiah
      - 100.102.186.39 # jeremiah
      - 100.90.74.19 # zeke
      - 100.115.57.8 # linode
      - 100.65.5.38 # matrix
-      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
@@ -4,8 +4,6 @@ resources:
  - namespace.yaml
  - secrets.yaml
  - postgres-cluster.yaml
-  - postgres-gitlab.yaml
  - postgres-pgadmin.yaml
  - postgres-matrix.yaml
-  - immich.yaml
  - ingress.yaml
@@ -11,13 +11,6 @@ spec:

  managed:
    roles:
-      - name: gitlab
-        ensure: present
-        comment: Gitlab user
-        login: true
-        superuser: false
-        passwordSecret:
-          name: postgres-user-gitlab
      - name: pgadmin
        ensure: present
        comment: PG Admin user
@@ -1,9 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-gitlab
-spec:
-  name: gitlab
-  owner: gitlab
-  cluster:
-    name: postgres
@@ -1,39 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: postgres-user-gitlab
-  namespace: db
-spec:
-  target:
-    name: postgres-user-gitlab
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: password
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
  name: postgres-user-matrix
  namespace: db
@@ -133,37 +99,3 @@ spec:
      remoteRef:
        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
        property: password
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgres-user-immich
-  namespace: db
-spec:
-  target:
-    name: postgres-user-immich
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: password
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.5.0"
+      version: "12.5.3"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default

    image:
-      tag: "1.25.4"
+      tag: "1.25.5"

    replicaCount: 1

@@ -76,4 +76,3 @@ spec:
                    secretKeyRef:
                      name: gitea-config
                      key: minio_secret
-
@@ -13,10 +13,10 @@ spec:
          USER={{ .dbuser }}
          PASSWD="""{{ .dbpass }}"""
        storage: |-
-          MINIO_ACCESS_KEY_ID={{ .minio_key }}
-          MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
-        minio_key: "{{ .minio_nas1_key }}"
-        minio_secret: "{{ .minio_nas1_secret }}"
+          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
+          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
+        #minio_key: "{{ .minio_nas1_key }}"
+        #minio_secret: "{{ .minio_nas1_secret }}"
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
@@ -1,64 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitlab-runner
-spec:
-  interval: "24h"
-  url: https://charts.gitlab.io
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: gitlab-runner
-      version: "0.83.1"
-      sourceRef:
-        kind: HelmRepository
-        name: gitlab-runner
-      interval: "1h"
-  dependsOn:
-    - name: external-secrets
-      namespace: external-secrets
-    - name: tailscae
-      namespace: tailscale
-  values:
-    crds:
-      create: true
-    includeCRDs: true
-    gitlabUrl: https://src.thehellings.com
-    runners:
-      secret: gitlab-runner
-    imagePullSecrets:
-      - name: image-pull-secrets
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    metrics:
-      enabled: true
-    extraEnv:
-      CACHE_TYPE: s3
-      CACHE_SHARED: "true"
-      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
-      CACHE_S3_INSECURE: "true"
-    extraEnvFrom:
-      PACKER_GITHUB_API_TOKEN:
-        secretKeyRef:
-          name: gitlab-runner
-          key: PACKER_GITHUB_API_TOKEN
-      CACHE_S3_SERVER_ADDRESS:
-        secretKeyRef:
-          name: gitlab-runner
-          key: CACHE_S3_SERVER_ADDRESS
-      CACHE_S3_ACCESS_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: username
-      CACHE_S3_SECRET_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: password
@@ -1,6 +0,0 @@
-namespace: gitlab-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-runner
@@ -1,101 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-fields
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-runner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        runner-registration-token: ""
-        runner-token: "{{ .runnerToken }}"
-        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
-        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
-  data:
-    - secretKey: runnerToken
-      remoteRef:
-        key: &key 53719920-b100-4355-8c80-b2f9002fad22
-        property: CI_SERVER_TOKEN
-    - secretKey: PACKER_GITHUB_API_TOKEN
-      remoteRef:
-        key: *key
-        property: PACKER_GITHUB_API_TOKEN
-    - secretKey: CACHE_S3_SERVER_ADDRESS
-      remoteRef:
-        key: *key
-        property: CACHE_S3_SERVER_ADDRESS
-        # Includes
-        # CI_SERVER_TOKEN
-        # PACKER_GITHUB_API_TOKEN
-        # CACHE_S3_SERVER_ADDRESS
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: s3-access
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: s3-access
-    deletionPolicy: Delete
-  data:
-    - secretKey: username
-      remoteRef:
-        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: image-pull-secrets
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: >-
-          {
-            "auths": {
-              "https://index.docker.io/v1/": {
-                "username": "{{ .user }}",
-                "password": "{{ .password }}",
-                "email": "greg.hellings@gmail.com",
-                "auth": "{{ .auth }}"
-              }
-            }
-          }
-  data:
-    - secretKey: user
-      remoteRef:
-        key: &key f560ae38-368c-4e58-898c-aeb90012d597
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
-    - secretKey: auth
-      sourceRef:
-        storeRef:
-          name: bitwarden-fields
-          kind: ClusterSecretStore
-      remoteRef:
-        key: *key
-        property: auth
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: "24h"
+  url: "https://charts.external-secrets.io/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: external-secrets
+      version: "2.3.0"
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+      interval: "1h"
+  values:
+    crds:
+      create: true
+    includeCRDs: true
+    webhook:
+      certManager:
+        enable: true
@@ -1,3 +1,6 @@
 resources:
+  - kyverno.yaml
+  - external-secrets.yaml
+  - tailscale.yaml
  - longhorn.yaml # Needed for storage
  - traefik.yaml
@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kyverno-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: "24h"
+  url: "https://kyverno.github.io/kyverno/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: kyverno
+      version: "3.7.1"
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+      interval: "1h"
+  values:
+    admissionController:
+      replicas: 3
+    backgroundController:
+      replicas: 3
+    cleanupController:
+      replicas: 2
+    reportsController:
+      replicas: 2
+    crds:
+      install: true
@@ -19,10 +19,15 @@ metadata:
  namespace: longhorn-system
 spec:
  interval: 10m
+  dependsOn:
+    - name: tailscale
+      namespace: tailscale
+    - name: kyverno
+      namespace: kyverno-system
  chart:
    spec:
      chart: longhorn
-      version: "1.10.2"
+      version: "1.11.1"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -1,3 +1,36 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: "24h"
+  url: "https://pkgs.tailscale.com/helmcharts"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: 10m
+  dependsOn:
+    - name: external-secrets
+      namespace: external-secrets
+  chart:
+    spec:
+      chart: tailscale-operator
+      version: "1.96.5"
+      sourceRef:
+        kind: HelmRepository
+        name: tailscale
+      interval: "1h"
+---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -32,9 +32,9 @@ spec:
        containers:
          main:
            image:
-              tag: v2.4.1
+              tag: v2.7.5
            env:
-              DB_HOSTNAME: immich-rw.db.svc.cluster.local
+              DB_HOSTNAME: immich-rw
              DB_DATABASE_NAME: immich
              DB_USERNAME:
                valueFrom:
@@ -0,0 +1,161 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: immich
+spec:
+  imageName: "ghcr.io/tensorchord/cloudnative-vectorchord:18"
+  #postgresUID: 1
+  instances: 1
+  storage:
+    size: 60Gi
+  primaryUpdateStrategy: unsupervised
+  postgresql:
+    shared_preload_libraries:
+      - vchord.so
+
+  bootstrap:
+    # Use these with the name "immich-1" to restore from the backups
+    recovery:
+      source: origin
+    # Use these two lines in order to restore from the other database,
+    # once it has restored from the WALs
+    #pg_basebackup:
+    #  source: restore
+    # Use this block to bootstrap the cluster, if you don't have backups.
+    # What are you doing without backups, you chump?!
+    # initdb:
+    #   database: immich
+    #   owner: immich
+    #   secret:
+    #     name: postgres-user-immich
+    #   dataChecksums: true
+    #   postInitApplicationSQL:
+    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
+    #     - SET search_path TO "$user", public, vectors;
+    #     - CREATE EXTENSION IF NOT EXISTS "cube";
+    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
+
+  externalClusters:
+    - name: origin
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: k3sbackup-objectstore
+          serverName: immich
+    - name: restore
+      connectionParameters:
+        host: immich-1-rw
+        user: streaming_replica
+        sslmode: verify-full
+      sslCert:
+        name: immich-1-replication
+        key: tls.crt
+      sslKey:
+        name: immich-1-replication
+        key: tls.key
+      sslRootCert:
+        name: immich-1-ca
+        key: ca.crt
+
+  managed:
+    roles:
+      - name: immich
+        ensure: present
+        comment: Immich DB user
+        login: true
+        superuser: true
+        passwordSecret:
+          name: postgres-user-immich
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: k3sbackup-objectstore
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-immich
+spec:
+  name: immich
+  owner: immich
+  cluster:
+    name: immich
+  extensions:
+    - name: vectors
+      ensure: present
+    - name: vectorchord
+      ensure: present
+    - name: cube
+      ensure: present
+    - name: earthdistance
+      ensure: present
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: k3sbackup-externalsecret
+spec:
+  target:
+    name: k3sbackup-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: password
+
+---
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: k3sbackup-objectstore
+spec:
+  configuration:
+    destinationPath: "s3://k3sbackup/postgres"
+    endpointURL: "http://chronicles.thehellings.lan:9000/"
+    s3Credentials:
+      accessKeyId:
+        name: k3sbackup-secret
+        key: username
+      secretAccessKey:
+        name: k3sbackup-secret
+        key: password
+    wal:
+      compression: gzip
+  retentionPolicy: "30d"
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: immich-backup
+spec:
+  immediate: false # Create one when this is added to the cluster
+  schedule: "0 2 0 * * *" # 1AM, nightly
+  backupOwnerReference: self
+  cluster:
+    name: immich
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
@@ -2,8 +2,9 @@ namespace: immich

 resources:
  - namespace.yaml
-  - chart.yaml
  - postgres-user-secret.yaml
+  - database.yaml
+  - chart.yaml
  - pvc.yaml
  - ingress.yaml
  - backup.yaml
@@ -7,7 +7,6 @@ resources:
  - mariadb-operator
  - databases
  - matrix
-  #- gitlab-runner
  - immich
  - monitoring
  - pinchflat
@@ -158,6 +158,8 @@ in
                  "https://thehellings.com"
                else
                  "https://kuma.shire-zebra.ts.net/";
+              "devtools.debugger.remote-enabled" = true;
+              "devtools.debugger.remote-port" = 9222;
              "doh-rollout.doorhanger-decision" = "UIDisabled";
              "doh-rollout.doneFirstRun" = true;
              "signon.rememberSignons" = false;
@@ -9,6 +9,7 @@
 let
  builderHosts = lib.filterAttrs (_n: v: (builtins.hasAttr "builder" v) && v.builder) metadata.hosts;
  cfg = config.greg.nix;
+  hostname = x: if cfg.cache then "${x}.shire-zebra.ts.net" else "${x}.thehellings.lan";
 in
 {
  options.greg.nix = {
@@ -22,7 +23,7 @@ in
    programs.ssh.extraConfig = builtins.concatStringsSep "\n" (
      lib.map (x: ''
        Host ${x}-builder
-          Hostname ${x}.shire-zebra.ts.net
+          Hostname ${hostname x}
          User remote-builder-user
      '') (lib.attrNames builderHosts)
    );
@@ -57,12 +58,18 @@ in
          "gregory.hellings"
        ]; # For home and for work machines
        substituters =
-          (if cfg.cache then [
-            #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas1.shire-zebra.ts.net:8080/default"
-          ] else [
-            "http://nas1.thehellings.lan:8080/default"
-          ])
+          (
+            if cfg.cache then
+              [
+                #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
+                "http://nas1.shire-zebra.ts.net:9000/niks3"
+                #"http://nas1.shire-zebra.ts.net:8080/default"
+              ]
+            else
+              [
+                "http://nas1.thehellings.lan:8080/default"
+              ]
+          )
          ++ [
            "https://ai.cachix.org"
            "https://nixpkgs-python.cachix.org"
@@ -72,6 +79,7 @@ in
            "https://nixhelm.cachix.org"
          ];
        trusted-public-keys = [
+          "niks3:8iztr/NACwYEK5O7JJtGFGuv+ho/cmwql8NeoCiXNto="
          #"chronicles.shire-zebra.ts.net:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
          "default:DTGxNijw2D8FrZJPT1pFTWcLqbt60tovL+9Z+VW0HRY="
          "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.greg.adblockUpdate;
+in
+{
+
+  options.greg.adblockUpdate = {
+    enable = lib.mkEnableOption "Enable auto-update of block list";
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.adblock-update = {
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        script = lib.getExe pkgs.adblockUpdate;
+        serviceConfig.Type = "oneshot";
+      };
+      timers.adblock-update = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Unit = "adblock-update.service";
+        };
+      };
+    };
+  };
+}
@@ -4,12 +4,12 @@

 {
  imports = [
+    ./adblock-update.nix
    ./albyhub.nix
    ./backup.nix
    ./ceph.nix
    ./db.nix
    ./gitea-runner.nix
-    ./gitlab-runner.nix
    ./gnome.nix
    ./home.nix
    ./kde.nix
@@ -45,22 +45,27 @@ in
        "debian-latest:docker://node:25-trixie"

        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"

        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-26.04:docker://ghcr.io/catthehacker/ubuntu:full-26.04"
        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"

        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-26.04:docker://ghcr.io/catthehacker/ubuntu:act-26.04"
        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"

        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-26.04:docker://ghcr.io/catthehacker/ubuntu:runner-26.04"
        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"

        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-26.04:docker://ghcr.io/catthehacker/ubuntu:rust-26.04"
        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"

@@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.greg.runner;
-  environmentVariables = {
-    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-    STORAGE_URL = "s3.thehellings.lan:9000";
-  };
-  runnerCfg = file: {
-    inherit environmentVariables;
-    authenticationTokenConfigFile = file;
-    executor = "shell";
-    limit = cfg.threads;
-  };
-in
-# We want exactly one of these to be true, but not both. Neither can both be false
-{
-  options.greg.runner = {
-    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
-
-    threads = lib.mkOption {
-      default = 5;
-      type = lib.types.int;
-      description = "The maximum number of concurrent jobs";
-    };
-
-    qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)";
-    vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)";
-  };
-
-  config = lib.mkIf cfg.enable ({
-    # assertions = [
-    #   {
-    #     assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox);
-    #     message = "You must enable exactly one of qemu or vbox";
-    #   }
-    # ];
-    # Shared configurations
-    age.secrets = {
-      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
-      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
-    };
-
-    services.gitlab-runner = {
-      enable = false;
-      settings.concurrent = cfg.threads;
-      services = {
-        qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path);
-        vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path);
-      };
-    };
-
-    systemd.services.gitlab-runner = {
-      serviceConfig = {
-        DevicePolicy = lib.mkForce "auto";
-        User = "root";
-        DynamicUser = lib.mkForce false;
-      };
-    };
-
-    users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg";
-
-    virtualisation = {
-      libvirtd = lib.mkIf cfg.qemu {
-        enable = true;
-        allowedBridges = [
-          "br0"
-          "virbr0"
-        ];
-        onBoot = "ignore"; # only restart VMs labeled 'autostart'
-      };
-      virtualbox.host = lib.mkIf cfg.vbox {
-        enable = true;
-        enableExtensionPack = true;
-      };
-    };
-  });
-}
@@ -2,14 +2,13 @@
  config,
  lib,
  pkgs,
-  top,
  ...
 }:
 let
  cfg = config.greg.kubernetes;
  cert-manager = pkgs.fetchurl {
-    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml";
-    sha256 = "0vx1nfyhl0rzb6psfxplq8pfp18mrrdk83n8rj2ph8q6r15vcih5";
+    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml";
+    sha256 = "sha256-HOEcrpEq3sxp5rtiNDX6/J7SFQX57/+YvXHXuA8B2x8=";
  };
  flux = pkgs.fetchurl {
    url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
@@ -86,43 +85,6 @@ in
    services = {
      k3s = {
        enable = true;
-        autoDeployCharts = {
-          external-secrets = {
-            inherit (top.charts.chartsMetadata.external-secrets.external-secrets) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.external-secrets.external-secrets.chart;
-            hash = "sha256-dPuUWthwN6L0jdAKRpkDtDedGyDUxUlJrwkvUNwLsrU=";
-            createNamespace = true;
-            targetNamespace = "external-secrets";
-            values = {
-              crds.create = true;
-              includeCRDs = true;
-            };
-          };
-          kyverno = {
-            inherit (top.charts.chartsMetadata.kyverno.kyverno) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.kyverno.kyverno.chart;
-            hash = "sha256-sNdFEupwfnYSo2iGqKwTadPtXfcbyM1kuisavpiGUyU=";
-            createNamespace = true;
-            targetNamespace = "kyverno-system";
-            values = {
-              admissionController.replicas = 3;
-              backgroundController.replicas = 3;
-              cleanupController.replicas = 2;
-              reportsController.replicas = 2;
-              crds.install = true;
-            };
-          };
-          tailscale = {
-            inherit (top.charts.chartsMetadata.tailscale.tailscale-operator) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.tailscale.tailscale-operator.chart;
-            hash = "sha256-BtZ24mCT2GMHE9iR+2xuIkB+4m1r2OC3WLkY3jC3i3I=";
-            createNamespace = true;
-            targetNamespace = "tailscale";
-          };
-        };
        extraFlags = [
          "--cluster-cidr=10.211.0.0/16"
          "--service-cidr=10.221.0.0/16"
@@ -138,7 +100,6 @@ in
          cert-manager.source = cert-manager;
          flux.source = flux;
          node-annotations.source = ../../manifests/auto/nodes.yaml;
-          operator-oauth.source = ../../manifests/auto/operator-oauth.yaml;
        };
        role = if cfg.agentOnly then "agent" else "server";
        serverAddr = lib.mkIf (
@@ -27,7 +27,7 @@ let
  nebulaDomain = "nebula.thehellings.com";
  # Linode's public address — used by all non-lighthouse hosts to reach it.
  # Override with greg.nebula.lighthouseAddr if the public IP ever changes.
-  defaultLighthouseAddr = "linode.${nebulaDomain}";
+  defaultLighthouseAddr = "thehellings.com";
 in
 {
  options.greg.nebula = {
@@ -54,7 +54,7 @@ with lib;

                target = mkOption {
                  type = types.str;
-                  description = ''The destination that is being proxied.'';
+                  description = "The destination that is being proxied.";
                  example = "http://localhost:8080";
                };

@@ -57,6 +57,7 @@ with lib;
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLOqwbp4hFYkiJpokh9i2RToa/6tQcwthDNQH69tyBF root@vm-matrix.thehellings.lan"
        # Mac
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBT5BFHQz1I5k/zkLQNLjL77EaqfdpRiF2Ci4eS9LMDK gregory.hellings@jude.thehellings.lan"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPVlMoN2pkKRRwKNuMbMczki5ybR34wvjdgDNlgR74Wh greg@gregs-MacBook-Pro-16-inch-Nov-2024"
      ];
      homeMode = "500";
      isNormalUser = true;
@@ -18,7 +18,6 @@ with lib;
        devices = {
          chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
          genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
-          gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE";
          linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
        };
        options = {
@@ -2,8 +2,11 @@
  "infra": {
    "dns": "10.42.1.5",
    "gw": "10.42.1.1",
+    "lan": "10.42.0.0/16",
    "netmask": "255.255.0.0",
-    "prefix": "16"
+    "nebula": "10.157.0.0/16",
+    "prefix": "16",
+    "tailscale": "100.64.0.0/10"
  },
  "hosts": {
    "chronicles": {
@@ -77,6 +80,10 @@
      "external": true,
      "system": "aarch64-darwin"
    },
+    "lithic": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
    "linode": {
      "ip": null,
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
@@ -85,13 +92,17 @@
      "tags": ["public", "server"],
      "nebulaIp": "10.157.0.1"
    },
+    "ivr": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
    "MacBook-Pro.local": {
      "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
    },
    "MacBook-Prolocal.local": {
      "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
    },
    "nas1": {
      "external": true,
@@ -102,13 +113,14 @@
      "external": true,
      "system": "x86_64-linux"
    },
+    "printer": {
+      "external": true,
+      "ip": "10.42.1.3"
+    },
    "proxmoxtemplate": {
      "external": true,
      "system": "x86_64-linux"
    },
-    "gitlab": {
-      "system": "x86_64-linux"
-    },
    "wsl": {
      "external": true,
      "system": "aarch64-linux"
@@ -10,7 +10,6 @@ final: prev:
      in
      {
        daikinone = cp ./daikinone.nix { };
-        xonsh-apipenv = cp ./xonsh-apipenv.nix { };
      }
    )
  ];
@@ -25,11 +24,9 @@ final: prev:
    withBDplus = true;
  };
  handbrake = prev.handbrake.override { libbluray = final.libbluray-custom; };
-  pipenv-ivr = prev.callPackage ./pipenv.nix { };
  OVMFFull = prev.OVMFFull.override {
    secureBoot = true;
    msVarsTemplate = true;
    tpmSupport = true;
  };
 }
-// (import ../pkgs { pkgs = prev; })
@@ -1,92 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-
-let
-
-  runtimeDeps =
-    ps:
-    with ps;
-    [
-      certifi
-      pysocks
-      setuptools
-      (pip.overridePythonAttrs {
-        dependencies = [ ps.pysocks ];
-      })
-      virtualenv
-      virtualenv-clone
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ];
-
-  pythonEnv = python3.withPackages runtimeDeps;
-
-in
-python3.pkgs.buildPythonApplication rec {
-  pname = "pipenv";
-  version = "2023.11.15";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "pypa";
-    repo = "pipenv";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-kxwyws22xJkqBy/hXXcAPHZR2NgZHbmwZr9vYqce434=";
-  };
-
-  env.LC_ALL = "en_US.UTF-8";
-
-  nativeBuildInputs = with python3.pkgs; [
-    installShellFiles
-    setuptools
-    wheel
-  ];
-
-  postPatch = ''
-    # pipenv invokes python in a subprocess to create a virtualenv
-    # and to call setup.py.
-    # It would use sys.executable, which in our case points to a python that
-    # does not have the required dependencies.
-    substituteInPlace pipenv/utils/virtualenv.py \
-      --replace "sys.executable" "'${pythonEnv.interpreter}'"
-  '';
-
-  propagatedBuildInputs = runtimeDeps python3.pkgs;
-
-  preCheck = ''
-    export HOME="$TMPDIR"
-  '';
-
-  nativeCheckInputs = with python3.pkgs; [
-    mock
-    pytestCheckHook
-    pytest-xdist
-    pytz
-    requests
-  ];
-
-  disabledTests = [
-    "test_convert_deps_to_pip"
-    "test_download_file"
-  ];
-
-  disabledTestPaths = [ "tests/integration" ];
-
-  postInstall = ''
-    installShellCompletion --cmd pipenv \
-      --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
-      --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
-      --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
-  '';
-
-  meta = with lib; {
-    description = "Python Development Workflow for Humans";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ berdario ];
-  };
-}
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  toPythonModule,
-  pipenv,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "xonsh-apipenv";
-  version = "0.6.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "greg-hellings";
-    repo = "xontrib-apipenv";
-    rev = version;
-    hash = "sha256-Wa8iev0ow1oh95tPCv5tAJUMBYiStWms8I31WbVcOok=";
-  };
-
-  dependencies = [ (toPythonModule pipenv) ];
-  build-system = [ setuptools ];
-
-  meta = with lib; {
-    description = "Auto pipenv support for Xonsh";
-    homepage = "https://github.com/greg-hellings/xontrib-apipenv";
-    license = licenses.mit;
-    maintainers = [ ];
-  };
-}
@@ -0,0 +1,21 @@
+{
+  writeShellApplication,
+  curl,
+  gnused,
+}:
+writeShellApplication {
+  name = "adblock-update";
+  runtimeInputs = [
+    curl
+    gnused
+  ];
+  text = ''
+    curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
+    curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
+
+    # Custom domains that I need to preserve for some reason
+    for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
+     	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
+    done
+  '';
+}
@@ -1,35 +1,37 @@
 {
  pkgs,
  system ? pkgs.stdenv.hostPlatform.system,
+  top,
  ...
 }:

 let
-  c = pkgs.callPackage;
+  c = pkgs.newScope packages;
+  packages = if system == "x86_64-linux" then (allSys // x86Linux) else allSys;
+  allSys = {
+    #default = iso;
+    #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
+    #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
+    aacs = c ./aacs.nix { };
+    adblock_update = c ./adblock_update.nix { };
+    brew = c ./homebrew.nix { };
+    create_ssl = c ./create_ssl.nix { };
+    gcc-tune = c ./gcc-tune.nix { };
+    #gen-build = c ./gen-build { };
+    hms = c ./hms { };
+    inject-darwin = c ./inject-darwin.nix { };
+    inject = c ./inject.nix { };
+    setup-ssh = c ./setup-ssh { };
+    upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
+  };
+  x86Linux = {
+    qemu-hook = c ./qemu-hook.nix { };
+    vfio_startup = c ./vfio_startup.nix { };
+    vfio_shutdown = c ./vfio_shutdown.nix { };
+  }
+  // (import ./zim {
+    inherit (top.nixpkgs-lib) lib;
+    inherit pkgs;
+  });
 in
-{
-  #default = iso;
-  #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
-  #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
-  aacs = c ./aacs.nix { };
-  brew = c ./homebrew.nix { };
-  create_ssl = c ./create_ssl.nix { };
-  gcc-tune = c ./gcc-tune.nix { };
-  #gen-build = c ./gen-build { };
-  hms = c ./hms { };
-  inject-darwin = c ./inject-darwin.nix { };
-  inject = c ./inject.nix { };
-  setup-ssh = c ./setup-ssh { };
-  upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
-}
-// (
-  if system == "x86_64-linux" then
-    {
-      qemu-hook = c ./qemu-hook.nix { };
-      vfio_startup = c ./vfio_startup.nix { };
-      vfio_shutdown = c ./vfio_shutdown.nix { };
-      zim = c ./zim.nix { };
-    }
-  else
-    { }
-)
+packages
@@ -1,72 +1,88 @@
 {
  "en": {
    "gutenberg": {
-      "name": "gutenberg_en_all_2023-08.zim",
-      "hash": "sha256-wWi0vTyMD/Es0w/jk9uyg4DN94080thPfT5uphEqbUc="
+      "name": "gutenberg_en_all",
+      "version": "2023-08",
+      "hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
    },
    "phet": {
-      "name": "phet_en_all_2025-03.zim",
-      "hash": "sha256-HT/gVNydkOitny6oUl2A+JvbFDGAIeb0h+xbMeQ2Rqs="
+      "name": "phet_en_all",
+      "version": "2025-03",
+      "hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
    },
    "wikibooks": {
-      "name": "wikibooks_en_all_maxi_2025-10.zim",
-      "hash": "sha256-zmcvrvGO+LEHt7x8/SoguBDODUyRXy9x5LUGAkS+fF8="
+      "name": "wikibooks_en_all_maxi",
+      "version": "2025-10",
+      "hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
    },
    "wikipedia": {
-      "name": "wikipedia_en_all_maxi_2025-08.zim",
-      "hash": "sha256-r7Cd0vjEb84Ftw+EwZSlqb8qhqm8WA3LAPdHAav7wrg="
+      "name": "wikipedia_en_all_maxi",
+      "version": "2026-02",
+      "hash": "sha256-vwhTv5TtjFNSTl7mcoi8SJiBm8nUlq8rP4UrZYir3Sc="
    },
    "wikisource": {
-      "name": "wikisource_en_all_maxi_2025-11.zim",
-      "hash": "sha256-jPHh/C20PARN6K7aPNw3k9fFHhpwzsREi/1o1DIISS4="
+      "name": "wikisource_en_all_maxi",
+      "version": "2025-11",
+      "hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
    },
    "wikiversity": {
-      "name": "wikiversity_en_all_maxi_2025-11.zim",
-      "hash": "sha256-0DaE2EUdHvaX3XqD3f0lwurSAaDZ4hEKtrMEutL5xt0="
+      "name": "wikiversity_en_all_maxi",
+      "version": "2025-11",
+      "hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
    },
    "wiktionary": {
-      "name": "wiktionary_en_all_nopic_2025-09.zim",
-      "hash": "sha256-EzrrruJQWY/3pP93WCTeCCfaPvpshqdkR0TFxVz7bEI="
+      "name": "wiktionary_en_all_nopic",
+      "version": "2025-09",
+      "hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
    }
  },
  "fr": {
    "gutenberg": {
-      "name": "gutenberg_fr_all_2025-10.zim",
-      "hash": "sha256-1gU7v//LYX/2LyIRjO02A1fWPQz9Y7Qt5ftgeazd3G8="
+      "name": "gutenberg_fr_all",
+      "version": "2025-10",
+      "hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
    },
    "phet": {
-      "name": "phet_fr_all_2025-03.zim",
-      "hash": "sha256-K56i55WPu5EMQHIrnnqhgJ32WozZ6oYD9X3IBytGA0A="
+      "name": "phet_fr_all",
+      "version": "2025-03",
+      "hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
    },
    "wikibooks": {
-      "name": "wikibooks_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-PQSdPbBHwK3IfFPH5GsKaxkNGTlZVJNJEI8gNioBl1U="
+      "name": "wikibooks_fr_all_maxi",
+      "version": "2025-09",
+      "hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
    },
    "wikipedia": {
-      "name": "wikipedia_fr_all_maxi_2025-06.zim",
-      "hash": "sha256-zzDhITMd1nRMYTUlvn56l4VBnpFuhiNrhhYMcrrBuOQ="
+      "name": "wikipedia_fr_all_maxi",
+      "version": "2025-06",
+      "hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
    },
    "wikisource": {
-      "name": "wikisource_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-2gEY5nTBecrmg61VJerxO4/oV7dZJmRgzLkqrcocW/0="
+      "name": "wikisource_fr_all_maxi",
+      "version": "2025-09",
+      "hash": "sha256-FdLYCjoT6Yk34AZKFND/NaBHNe+GzW9Ibpd6mVPWlxI="
    },
    "wikiversity": {
-      "name": "wikiversity_fr_all_maxi_2025-09.zim",
-      "hash": "sha256-4vOxYiX3TYht7ARY+PeCJ0ArVZZn9TeGtwCieqn3xUw="
+      "name": "wikiversity_fr_all_maxi",
+      "version": "2025-09",
+      "hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
    },
    "wiktionary": {
-      "name": "wiktionary_fr_all_nopic_2025-11.zim",
-      "hash": "sha256-oQS8DzKioceCER1p1oAvaS1gRooMLJLYnCqy1aLARi4="
+      "name": "wiktionary_fr_all_nopic",
+      "version": "2025-11",
+      "hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
    }
  },
  "ht": {
    "phet": {
-      "name": "phet_ht_all_2025-03.zim",
-      "hash": "sha256-UjC0REJ5d5wIKccutZADX74IxvZuF+CD/caVzZfHg9s="
+      "name": "phet_ht_all",
+      "version": "2025-03",
+      "hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
    },
    "wikipedia": {
-      "name": "wikipedia_ht_all_maxi_2025-09.zim",
-      "hash": "sha256-spT7EFXLnI0FWT9Vlvp7QEP0urntmQ2C+fQB5bVLoLE="
+      "name": "wikipedia_ht_all_maxi",
+      "version": "2026-04",
+      "hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
    }
  }
 }
@@ -0,0 +1,24 @@
+{ pkgs, lib, ... }:
+let
+  zimMetadata = builtins.fromJSON (builtins.readFile ./blobs.json);
+  oneZim =
+    sourceType: info:
+    pkgs.callPackage ./one_zim.nix {
+      inherit sourceType;
+      sourceName = info.name;
+      sourceHash = info.hash;
+      sourceVersion = info.version;
+    };
+  # Preserves structure in the blobs.json file, turning leaves into drvs
+  zimFileDrvs = builtins.mapAttrs (
+    _language: types: (builtins.mapAttrs (sourceType: info: oneZim sourceType info) types)
+  ) zimMetadata;
+  # Flattens leaf drvs into the structure that flake packages expects
+  zimFilePkgs = builtins.listToAttrs (
+    lib.mapAttrsToListRecursiveCond (_path: x: !(x ? "name")) (_path: drv: {
+      inherit (drv) name;
+      value = drv;
+    }) zimFileDrvs
+  );
+in
+zimFilePkgs
@@ -0,0 +1,33 @@
+{
+  sourceType,
+  sourceName,
+  sourceVersion,
+  sourceHash,
+
+  fetchurl,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "zim-${sourceType}-${sourceName}.zim";
+  version = sourceVersion;
+
+  src = (
+    fetchurl {
+      url = "https://download.kiwix.org/zim/${sourceType}/${sourceName}_${sourceVersion}.zim";
+      hash = sourceHash;
+    }
+    # fetchtorrent {
+    #   inherit (val) hash;
+    #   url = "https://download.kiwix.org/zim/${type}/${val.name}.torrent";
+    #   backend = "transmission";
+    #   postUnpack = "mkdir -p $downloadedDirectory/tmp; mv $downloadedDirectory/*.zim $downloadedDirectory/tmp";
+    # }
+  );
+  phases = [ "installPhase" ];
+  preferLocalBuild = true;
+  installPhase = ''
+    set -x
+    ln -s ${finalAttrs.src} $out
+  '';
+})
@@ -83,7 +83,7 @@ func getHash(ch chan result, file, category, language string) {
 	// TODO: Only call this if the file doesn't already have a hash
 	// in the existing file
 	fmt.Printf("Fetching hash for %s\n", file)
-	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s.torrent", BASE, category, file))
+	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
 		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
@@ -115,6 +115,7 @@ type result struct {

 type Zim struct {
 	Name string `json:"name"`
+	Version string `json:"version"`
 	Hash string `json:"hash"`
 }

@@ -1,38 +1,37 @@
 age-encryption.org/v1
-> ssh-ed25519 87huqg HqGj+5hXjRLJcrRMC3biBE8K9B/OAJj68gqTqg9ja1k
-K25Z2YGlWnUK02EUQmdNo0QM13apME/mc5w0gydrEDc
-> ssh-ed25519 8UnW5Q Pj4iDE8Q9FhzudZ341W+V2aaWuotfzOZzN18fRnPqh8
-kujFDr1mL/0YrsyoVpWQhkEwwjXr3l3AbbD2787z8zo
-> ssh-ed25519 UFfTmg Ga4FQrnrejoa6uSNDh0VMgB7ntPrp4Z2Ic8n5XCosHM
-cquCWegeBg6Mtv3/t5RAEmh66p6oHBlQvbuJMaZTB6g
-> ssh-ed25519 xNtnoA Mf9EJ6mB79mWBN383e8t/BZQVjB7mXuFKvhyJdT9GA0
-QnnrGVbZIHMDBS4ZZrj8BDwx6deSP10t2kLLzu2ewXs
-> ssh-ed25519 aY2AXA 0Lop9E46qiaGNrFTVbgg0O1yKbqwCFmG9pjssoclMUM
-I5lOVEogB8XV9pkyqmYcFojvZlAX31ADlMyHgDluxjY
-> ssh-ed25519 AQhf1g Ktn1BuWcwx0eJS0ZJugnRiTmvAht6ABOVzTDcw58HlM
-7Vm9rx9P+rXDvrxTQnxxpUBZbvNRgd6UafmzuG0ePwM
-> ssh-ed25519 mOmPfg VhUpDomkduEthbPGMr4bFpLqVcXgn3OrQojPjA+s8k4
-1nrS2JxDSSe6PvPRK9VNBh7RTMiFChSiM3xbCQAQw/4
-> ssh-ed25519 YJiRbw XVylSfHTRne3B5zWru6x+yhAPJEp9Jj27P0Y63Wp2SE
-APDEG5J9tBR1boxpsUBarSC8vN6q34KElRUK98fsQ+0
-> ssh-ed25519 0/WsKg FVXUmVyse3msAkDSkznhcUw5VYd4vwsKd9PCDBJwLiM
-hRIDpMGWWFu127Q/jvxr+ieSM7KQfNagqhUZUnTwJMM
-> ssh-ed25519 Nl/5yA qO4YJ4/gnfbLOdJFyGq1J4AJH5pMTPhR2IvEKMt4IlM
-Dyhj/RQQ3LxgJVc5drDdgw0cAJi1t3zCFnO1zWKaWIw
-> ssh-ed25519 GdLgCQ GyVGc/nK0Zu3/Gm76KRvXHwjdnRvoM+WuY/psFaIv2Y
-1O56ZsNvSBzhcFRPoIOyUCMQCGQYn3w5ES2AfGP75uw
-> ssh-ed25519 tOH/HQ wR3dxHjLSzkHIG/6UX45qiGFqX0cHA18/oEFatBthUc
-J/gpGWp8kOdmtFs9A65B68lsnD68gxfheiOZfp0AeI4
-> ssh-ed25519 FpzvfQ 0sdlOKrumgCJedenPUNY/QSIDmhrP3J077qZxTwvdQE
-DdWxilImsFB/XXgbZNYXEjSCoqmVd0vaTH7rhR73fsw
-> ssh-ed25519 kdPvzQ 9PxMQp7Y4Gh0V2uMa8K6SmldUhcqcBfYgVtMkzzzdAc
-sS8Fqm1p72IPOKNZfJKIJTxTLoNt3MQaOI6w8qYCTRo
-> ssh-ed25519 onmXpg Ig9ABzLLazyW4wxkUmq87XR7hmUt6l5/X0R9Zf2qBlE
-n3DO7o4NdWRefqEkexyIJLeOQ8w1q9QN+wIslQNXIF4
-> ssh-ed25519 CnhD0g wtGoi7CzfIAs8ezcIF7ecjTXshD96xG8ZLlhYYaM6HQ
-4hwG3V1Cf/iYDsNXT0RmzWJnW5kxnBWNvX3ECrP1/oE
-> ssh-ed25519 4ep2UA AKSh5d04251XgyZKKscIJjU7RSpKclMqO5qPTEMQygo
-wSyIxArdlbLafOKmUyrlUqOZQbF1PXZND/PAFYCjClU
--- DnRePhJDkX5QDmrkH5jiZkuljvOFaVm1BrqYMTDP3tg
-\bºîç:ý]3\ô<™rÔhÞ‰×‹|ÈFz.R{FEÝá<RòôœÊ'=ðY”v xˆ˜o½ßÌF
-q␍¤lî0¥ä»
+-> ssh-ed25519 87huqg LKhlbZI1BygDI8E4kkzhw0/Y1BfWnzekf/URa/Bma30
+uT7QzE8DPX8j3us7oNRKwu6hPUFpQosbcMRmMNgS/Gw
+-> ssh-ed25519 8UnW5Q dDAJI5EnPMIhs5H21wLT84GWhkROEJRXE1QVp1aOH38
+qZJt4Kip5qVZl9QoIFEXgrhtrlQEpbkfLarCgaHugj8
+-> ssh-ed25519 UFfTmg kbrSoge204JvRPBszhAfMewPM4oHg0HkF52BNeb9kx8
+E4ASRdn0pjF//GiFCjmRlgXRS2wiJxIXDFSjldMtTdQ
+-> ssh-ed25519 xNtnoA 7b9/Z/qUEmRnFCiCYzVGJVvxvV8onjZemSg6sllaDyA
+bQosZIGbaSsUqFO2JuRpIhm3FJd79JyYS43A9+zr+1w
+-> ssh-ed25519 aY2AXA m4gIzzAX8pkBHHzsSykIy24E6Kru/I4uNnjihKH3JHg
+S18CWIY5wNcR5PVkCqbjp1FJRrGxco6fdoykQeHhyX0
+-> ssh-ed25519 AQhf1g LBmvyUbKRLKtPGIEqt+NwOSrtGwlFt2zqgdmRDHu9n8
+zb8OnKRsJBEkH6eJ76mlKvJmtZ8NvVwVS9/0tsZlMUk
+-> ssh-ed25519 mOmPfg TuPbRMlX9eRATxSbv6v88TtzGhOKWn5FOkIg4xR6FH0
+NLNzJM/9r2jZ70Y2r5Hsc36gcRTSPw40Aabn/H7OE+4
+-> ssh-ed25519 YJiRbw bVMyOOgBcFFRNulym46YwKAIPlOkbQhmQAo9kl4dRx8
+5W2fIxGXCXbzULOismGg4NxE+VQ8LDEbODlJ0OpFMiI
+-> ssh-ed25519 Nl/5yA ydFS0bVjjDzymhQFaBJ3YqDREQDpVO6VzgS2MBtuOUo
+tNzj/85BiYe6th2N6A9ZkMSPKduwAIe/qnf2NVJiHOg
+-> ssh-ed25519 GdLgCQ wmfT7bCzwnkwEtn2mRnElIM75MmdRw+33MhSegSHJWk
+YHrCYB1wF1njNjzpIy3hKZ9l1cj7m5yicLuj71TvKr8
+-> ssh-ed25519 tOH/HQ z5/GMQOtkpMWwWdMXqxmf12MM84xkgXL/OLliq3RHh0
+mVhBt+uc7z/YkoIAyXTqBgv00cJOrZ0bsBP0lD9S24c
+-> ssh-ed25519 FpzvfQ D8N5JQ+3rGdSZIPmzlZqO5VpS90v6r99WMXtyUqCGiw
+A2SSvI4H5TRY13R/iOa60bCdc0zR6lUAHJVHfAUR5mQ
+-> ssh-ed25519 2UotMw eaM1Kkzw53Oq8lW0BFn3rqWFcTQaTz9jcDsULDg/fwU
+3QVYFrhKnvwWDpIdsyTp0amontUXePko8z8PeUub9EE
+-> ssh-ed25519 kdPvzQ 08LE8a24S5cvuK9DVWD2ta0GjJMNzUidmgYT4RfhQDA
+cRFH8vOr2y1/C9F2wZWV2deUxUpoL34IFRyOBHPYifI
+-> ssh-ed25519 onmXpg J5MKGIovNwv4FyTN4ofExlHV8qYzU/J9O3MI4tZYcTo
+iagT0Ypo8gTwvGpV66XNuNPedefx2S72q9hyeB2Rz/w
+-> ssh-ed25519 CnhD0g se/N4hrYxOiukByYzsIhxToceXNuBO7J7VmM4muJ3Dk
+cW+WW8iWjj3eXDqDO8aEON1ZH/+6AXQGAEXkLRbL3AI
+-> ssh-ed25519 4ep2UA uyjvubY39oSGeCNsX3/VIdM5CzNBlrnRpkF+YN5MBCo
+xiNuksI7olV5Db392Vjz/7uDNDIssGmI9bez6vSOXTk
+--- VsGbd8K7JzHe/eoYUeTMwcg/GrY9SXVzNxL4HZ23tKQ
+£_÷t/¢ªØËVÎÞ}7J'%?™Á‰Å0“¤¼^õ¿-„ÏÛ„äu4¥ù‹íäóü0!®ÝîËðMÜÅ·
@@ -1,37 +1,37 @@
 age-encryption.org/v1
-> ssh-ed25519 87huqg gv0jzWC7KtVxSEeepOckxiDwxN6VdPzYaXjZryNlUjE
-04mMQsL99xW+VbpELVdnWehgq/3u50l5f98ZFTscSwU
-> ssh-ed25519 8UnW5Q GzZDPqTzZNU5Dun3u7rSane+MXkDcbIM3TlEEJr7cUI
-Dh/3ObCIG56797AvmSh5yrUk+MWqjxJ42/b4i2smnos
-> ssh-ed25519 UFfTmg 7EWxx0WGxxAP2sErB6Rfteg2o1su5n1ELN7oCUsodEQ
-S5x8TAYvjxjtCJgmY4ttCxvoZDdHMxY2RbsAJ7DxfJY
-> ssh-ed25519 xNtnoA 9mPAgc7YI355QYNlTlJWmMhaScCNbCH9EofQcJJDeWk
-QSlYi9COKd5ZjkC7Qxp8IcmmVJifJ1qy70VnExASqBM
-> ssh-ed25519 aY2AXA JUIOcOAjshTPueqEo/GDXWzEubBt1JuMM4NLv89zfTA
-njcVfVgCmT374IdMqke8AWGyGcpCgpu5rGs2zrn/A2Y
-> ssh-ed25519 AQhf1g faN3428QM/K0P7o6nlPxT3lHlx88PBIWxw1mSN07zy8
-6G8FARubsbz7TtQWeQ5biww7XoXZrs0xDFdxKwyov/U
-> ssh-ed25519 mOmPfg b7LviVrLo50sU195qKNxtD6lEqq/QJBnHFkQ3WdKT2g
-USSSrAIA3v3Luzt2Kft6fpMx4fXHAPBtWQVAAliiV2o
-> ssh-ed25519 YJiRbw QjrEHQL9zx6pIR/HzrKyM94JF7efjkMo+ArkVOjkQlU
-MfUl5yYO/LtxrENlcw2KgzyJiLpd/Xk0CbEJicxgG0E
-> ssh-ed25519 0/WsKg ER1PXYwpONwb3U77qUoH2ZDFmfvRQ7SV8lkgHqRJQig
-MCRbKzFD72DdZwoVrV5DesMbNG6ikMlL5C6mTSVGtj8
-> ssh-ed25519 Nl/5yA XKaH3S150ZwHo4uyLwaBrn2od5v6MRvc0bOR83Sz5Ag
-RqQn4/jo122fZA1oujOkwe4gbnGfn5BK8CJXi42NsDM
-> ssh-ed25519 GdLgCQ XVrC/NooMQFg4bSPQ09avkJ2mwROHp8mYbBA7dWjSCs
-Q72VZnjs6Y574eRwheabzTW2GH8A2oEOEyk1Mkh+NzU
-> ssh-ed25519 tOH/HQ b55WhSZiczkXRQQTxAFBeN4HKyi2orpR+ikGiSyaonU
-woTljkdrDmI6iCwUnJ7i1kLdfH3QaZgkxxQ+Upik6/E
-> ssh-ed25519 FpzvfQ +kFO6lyChWKyGs1vN8XmRnp5wNUrOvKGAMtQB5gYJyQ
-xQbRbUfvk9Eoi/JLfzugHeUVbPGfFItkul33A7MVx3Y
-> ssh-ed25519 kdPvzQ dv1xr07TrUQRGwl6jbxMQlocvvYlTmyzyZpbRAU5rg0
-IYO9Af8yAxY5499AArmWCy1aV/ZB3w3deBS4OAHq+LY
-> ssh-ed25519 onmXpg 8cNof6Uwd2MpA3ydHLQHAQvFvl7Kk5moWMRD5qVFxGs
-hTMO0oPxHajokrzMIWB5ksbrVFcpQGo6Jje9FWoiPxE
-> ssh-ed25519 CnhD0g kqhzl+91aQ7CDRrXzrLPo+P5GuEOSF0MGQlfZESPJDA
-64xA1PirxldhnScyJ0njwaOMZ/EgPRm1hQzojJIa+84
-> ssh-ed25519 4ep2UA Zss5olMIbVxEJT8XdrFSrBOppplv8+x5ej3CktSUNDs
-ldPkN2iSBrU8M7WCZx+PlgUhEIZEoUmRWRgRHvG7+Dk
--- emzp8uRGi0GDRt9HS6E6NvmwB7LyI8mWED2Mof9KFrA
-WK çƒ¾ÄÆý;m7…%‘cl4‹8Wáå‡÷'›D} ýœ.x÷l»fGºj�«yàÈI2ˆ~h•YKè‚Ï¾†Ù‡ÅƒÉº…"VÕ"(HQ>åEAG€æx1
+-> ssh-ed25519 87huqg CsPCBXcVp7krsPi1k0WbjKFZxUzuZNJkkpOImMDWNns
+h6evECCNa5VGBe1dtbVwOBFBPkzwUKPFyVdQsTNMUXo
+-> ssh-ed25519 8UnW5Q 1pioLo4kA+RJ6r35H9FNCQ5LZqmYUmxZTVyTdD0o92Q
+4r/sOb3IcQElEJnKAgmYeHtubm1Hk/cdiY6gUI1GkHg
+-> ssh-ed25519 UFfTmg ruMzDG9lKKSHo2I1L/2wigVZs1Jhi6aTNmrr4zAyEiI
+3gsAmzM6fE8RL/fLL63pPIH75P9TW954nw11/JpU77M
+-> ssh-ed25519 xNtnoA eTZoJFu1SqUoUGPcdVDw/2wW82xvRiSCnAmQSZPQT2w
+Y9Cf+/h80vn2w6G9n+V4uNV7bj3tpOT1KWRKajM7d5k
+-> ssh-ed25519 aY2AXA c4MkdSio2FFkulOBKDSAG3Iq71ghRdw8/SQF0B98chY
+lvT+m2ey5+HqipuC7MrPQIKu8KrSsLHM0XRK8c0iS8w
+-> ssh-ed25519 AQhf1g vLig+8a5jPo3cQhdmQw/C/P1hgzKHiVkVwUTkMBNmTk
+N5ROr2EtHpTwti7NByDiR8R3pOQ/STwlIuNeY1pDA20
+-> ssh-ed25519 mOmPfg WcbxDQfraXfxkN1+IGaArpIHOmlUlhGjBijQt5ZYSxE
+6KHLewxXWwo8fVIuaTuY/T/igsI6CKqEl2tyM/gkn6g
+-> ssh-ed25519 YJiRbw IblKWpY9DeDSWDfvlEmNeWSV1lGdz9aHcv2oQVmKQFI
+qPcdGcA6Z7YaLL5umR8ZOKzOyNIUJVHRBpV5HyAJeqw
+-> ssh-ed25519 Nl/5yA wr0Q96yztc+Rf88q6ooiDHlKqpVdWPkRWApfJsc7uQc
+hQZTwZ36mkajMcSbxDsL+TtAezJIY+H+J7VaU1QOqEo
+-> ssh-ed25519 GdLgCQ LiwfxrAh9dLjMeo6FglQzvUQ3hfWRAZr2naADkB5/WM
+Bn4fnoqTvKPd73qi28NAgAN8AZl4EWcr9e/uhuUwVgI
+-> ssh-ed25519 tOH/HQ x35ypXVDI9C1wpquWxDUFYXYHxEsD2NJ0VIDosRONyE
+Aa5eZt98GQQZmKlBDzRC9KRyMCy2z1htSAsjKNGCuFw
+-> ssh-ed25519 FpzvfQ jlAbIzsWi8eX+PTKn100NaiSoezN1kXzZ3gWUOKfQVg
+NQARp2qsxIdSG3OLJyP33A97r6cBRaMSaneT8NBnhDI
+-> ssh-ed25519 2UotMw 53sXK937St2F3MzVIhmsjH6WeCSRdkpv4oFa2ZBaelI
+lNsjlQzS8Szj0FcAvrQno9rDO17iKDjMN7VwMLvIleE
+-> ssh-ed25519 kdPvzQ YdeMlv40jR9bFnXVjPJDpvCnqn091dCKAB60m4Obwgo
+vgPAO0evfCXQUX7Tu/G9ERUhLO3KiWXqpxIqATDl5vw
+-> ssh-ed25519 onmXpg mrDB6F061SjeYOZuUJVvZP8SzOVrFdpAAEfgPOzp608
+AzAEEHK6Q71YxPfiljl7ZCy0b3YBdSBMKORJd7Opkck
+-> ssh-ed25519 CnhD0g Ov3v97PyY79WoXUDAdvXEZvTE7ruIgDeXVz3jD5O1HY
+0rSmiqdxP6PgplxLkim4AJtKPcjn7OlkXpcu0BsI4s
+-> ssh-ed25519 4ep2UA bDGTw6Msbh9sOp66l1VKGrT53AlrPv+QG2T6ZJv1pDk
+WvHFJ3LIlpiuVhHUxY6egKifWNepzIB7Ls2R4Kx1Kng
+--- Ec6/6bQEn4GQOedrSzE+Yw1xRjQA34sj29Tr3zLFgZo
+NïP¢uGc!WcÝ¼¯£ \¼ìæ—K-©;]Ðu¹!,ó$#nŒ¶dZ‹«¦yž“-kX’BÕÙƒ°·ªc'‡Lò¯Fl�Ýªš6L‚nË¸n’Ý£f$ƒðÀ´ê
@@ -1,37 +1,37 @@
 age-encryption.org/v1
-> ssh-ed25519 87huqg iDDZb1/mBldfguf43wN0TSuqOXsEScH+aDZDKrVl9m0
-FSHO4h9Csu9lJqlNpsY3bcDt58eSUxi9ENr365lBvEs
-> ssh-ed25519 8UnW5Q TzreBNEiSrZEVSzdZCzm4J7BP0IJ0U3U+FdINlUvMRw
-X1SKp6T7YVTuqRD9ozJWl9wGLQS2XpL2SsP9JLHdoHo
-> ssh-ed25519 UFfTmg F2LDdqKDkBIHrvcT4lZs7fnpRVH83/Rxnt65ATqVETk
-did174XGfcJQNubK1B7W9F5+ZL4XDQfa7zb+3WXsd1g
-> ssh-ed25519 xNtnoA H/lAt2D/IK8qCWzTDh8hrm54OrO42ETYJIcOqYgF7Uo
-+yOkmOn65o1X5Mv5PiQhAhFDJ/R//6f96i7PslUsNYw
-> ssh-ed25519 aY2AXA N98Z0KfofoC/OOYyEhUnzQNMJIuKQN/n3t34/j7rHDQ
-sL2tca3lYlgrz8BE6cSbWyOL8/p3ocgpR75BmP14tpY
-> ssh-ed25519 AQhf1g w0czfp/ljjiS6a5SU/stgWSw1yIIxgxaEQAQPFUzrjE
-mdVPm1r9VTXvAaGS7Bajg/yiUE4Hv8UMF9dSsTTwEiA
-> ssh-ed25519 mOmPfg oh9DqeeAL5sFTB6baYe5QGcyZOi+/90kIltmTA/bpmE
-jA6K/lAEBjhSdgpoZ+qLlCtS0RpbyOMrETXtuvOxv4s
-> ssh-ed25519 YJiRbw 1dT8jG+xx1GNSISZdT7WAmaP2ltxkMKmPAGCde+ucRM
-gYae0N5DuZRZ4S7KufXlO5K6kC71YTGbEVx4p3oYBT8
-> ssh-ed25519 0/WsKg 5z5D+ckewk4cXzygfGrcPE4e01rDKo2yFU8MFzxjz34
-Su0ZzamKBmyALZ06iU/4fthHnaimTX+MZ7g+SMNCmYg
-> ssh-ed25519 Nl/5yA SpZyA5mzLrtF0TyAUnAf4pplmAda/ZkNP/2mW1VbhEQ
-HcHUXgrdd8MobLl2KonByGUg3xIF3LtJ8dfAjTMeubc
-> ssh-ed25519 GdLgCQ 9ty+jQ1QEmakbYfYRglH3aYRiWDlWVoyoAvr4mhaIhI
-AWurwo3gS/sqFYA2x43uf6bVQMPgIScTl3bO6rBTH2Q
-> ssh-ed25519 tOH/HQ xf9oXzcY8WhHKo0+igVMXftblQEgtsYRiQr2HIBvWDY
-ErehHTChNeBt8QL6LGduelH38xmH6g+EJ3HeLcGKfqI
-> ssh-ed25519 FpzvfQ WwI5B4bhYqUd+kyv/qfsdZF++vPwv0z/VHs1rLgA+EQ
-TbZcSqK++NDFivpCvDbVJsrgh99BlkTtrEaX8N7AyO0
-> ssh-ed25519 kdPvzQ SzDbjtauFcizhjnZfG4QWtU/OuAP6A3zAC5IU1bVgyI
-f6VAcC6ZJ/a/Iqy+nAQcR6QSIOxQ0w9rEV3Dl1AcgSc
-> ssh-ed25519 onmXpg 6N3pFYE/eAfEHSos6DJCqWj98lzh8eKWTX8cKqtr9BQ
-f8q/cHQ3+n49H5VP9/KERqJelasa34FZvBe6Suj0SR4
-> ssh-ed25519 CnhD0g gGrIh8bxCV52xGc83dGIUBvfSwVLW4Vg0iKlc9Gz+nI
-TjgGfOIDKMtha50mPumPHqgaITYRnuEXVfrBGmxzlVI
-> ssh-ed25519 4ep2UA TdsseBn5UGPnXtrChro0wf4IHMrudNTNYKzbRiG3AxE
-USm6bS3A3m8vUO3JY54dcTtODZAdZsJSbAuRD1y5Rt0
--- htoy3HVrfZj0Pfl6qkK8DCj+kARn6O8M/BhkXpLcu1E
-�º~\t¦Ü×a|Ä“ôá	�×¯QÊ¯w(˜ÔÃ.•SeJÜkÔ‹‹¹Ùâ·ùazµS&Í5Î7*›ÔKèfÌo«KT©5Å³0·Ý�Y˜\Ø£GE2‰Ký
+-> ssh-ed25519 87huqg ua9lzblqM2d0AmRbEj9c6p8LVBxNkYYr/vH5+HFoDEI
+Y08ot6KWTZdHXjYUsc2hcKnQlJBtcmE1oD5+OX86J80
+-> ssh-ed25519 8UnW5Q QW+RWL8RfOoPfZEb+m2XHNgvlUoLZqPSDjx6riMCXDk
+DyJSnhbUWRCMUWlHYnz/jbqBxazGXEaxe6/T6CNtvsc
+-> ssh-ed25519 UFfTmg XcNVYggkFQmj591cbFEpz0ishJgp90W1Eu1OWphmj1g
+3/GL+Q2euyXgcapUXDt8Mw5Q2+bbk2C2voQgGuTtiUU
+-> ssh-ed25519 xNtnoA CYfNyaWgYlM4oe/G2sI99gvldiKY9ScDsi7XPLnDTjU
+h07PCdnOUF4o6YggrJ27Cdc/Gb9cu5CE0cZegyqLiKc
+-> ssh-ed25519 aY2AXA NxBftj7RM1QeZ5Np3Mt/xsxZ12XMtgHh/foWN2uyyT8
+nXUQI/tjhtPSYH6GFDxw5oIQnrLrQHYfNpriXXqH5fg
+-> ssh-ed25519 AQhf1g 8BTUwRGn9xPBIO+Ez2viFtp1B0LzWR69Aer0B/OfhS0
+uKAkoOTpuyLFnqKPXgTPYBriaNCQZz/hwSLkUKypBwo
+-> ssh-ed25519 mOmPfg FNLltRffV5bNxipVpxAOkfviS/RKJfrZ1TBWIVSspHM
+ML0HeuZwms//wyIBfXspWQPLh/DSbl5YkcyHHJ4vZ/8
+-> ssh-ed25519 YJiRbw rgJDr6qSeN679l+aIfDuhonxcoGw1h5C+nVGS0ce3nE
+c5xynEMZNtHuPb3wc9d8QADay6Pgf5dhSw9jLw5jkjw
+-> ssh-ed25519 Nl/5yA /5IxJynZ+oP2iBZikH1dePktiwHrjYMSSeEn0wR4ywc
+My8esaXF11AgCEOeyNX+JRgLGuMlSPYGHqJIbxG3XWk
+-> ssh-ed25519 GdLgCQ zKBABsXQE98vU0BgEj5onnfHs/Ta9qWwMgKKPFI//n4
+h0cMTFqCZ3pON8JwZBfJz1E2HPWVEqH9fRc2ry59HaM
+-> ssh-ed25519 tOH/HQ oPtW9p3QZzva2unDORMZURJAl7VVbuGF91HCe+wbTzo
+9bTm0B3q1tFNVepL20MIU5hWUFK6uUn3781NDqhWkv8
+-> ssh-ed25519 FpzvfQ R4ZCZsgf2tlN4h07M6mzgR/lhaZnP7uyUxajO+oC+UE
+iJnJWKYrushgkegJPxw7M2aimtQ/dqOB31BHnMaFTm8
+-> ssh-ed25519 2UotMw eIow72TygjpYbhJLCqt2vm2X7bu3NjY6MFTOWjl+pgI
+2EgimzYzga4FW5c79N3ppEMVvREAmh5wx3lI8gh0/BU
+-> ssh-ed25519 kdPvzQ 5XbOccIDpMFKcCaBWFRWWCaUh3p1LBJ0ayolQroZeA4
+Jb+n0HeR3gDYizA0kta1TBvEiZryKlDwbuoa2u8PyKM
+-> ssh-ed25519 onmXpg PZR1T8ylkM55nGIBYiCroNWNTwBcEA5PZU1YWH3tsWA
+LsOHqiryBJkA7b463zyg3IToKy1Teo/miyPfENewGnQ
+-> ssh-ed25519 CnhD0g j8T3e67+tDXJFRsX/gC9qqQn6YGFxgAMwWsQ9vlDsGg
+KAOrCxfTTo4uB0EjrV6VwAx71hbrNiJuP6G8F9lOr2Q
+-> ssh-ed25519 4ep2UA wC0BaXPYM2iRPRBhQlOo2QRM0nX084cDp6brzKWjkzo
+wNBztDXiPi6K9q+HJRXsr56/nf6k/aQJQIEpVCjQjQE
+--- IsVY/KsFoTGubmdpOdoTI64+O40RJplehy026aS1RJc
+]ÌƒR…ÊYávŠ½²1ù\½LœÙkœ”“¡Q:ÙŸý6	š¶¥b»Ø*ÙIÝZ3ýAóQÆ%HÑ4Êða0,ìvÇåÙ÷ÄÄþ7�ð-
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
klaatu	68faf6b124	chore: update flake.lock 2026-05-17 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-gcc-tune Build done. Details buildbot/nix-build Build done. Details	2026-05-17 00:03:17 +00:00
Greg Hellings	e5e4a38cf1	chore: begin updating zim updater buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details Update manifest chart versions / update-manifests (push) Successful in 29s Details Update flake.lock / update-flake-lock (push) Successful in 2m49s Details	2026-05-13 11:01:33 -05:00
Greg Hellings	89faa7d97d	fix: update SHA hashes	2026-05-13 10:50:26 -05:00
Greg Hellings	fc4430e4f1	fix: system build fixes for new package setup	2026-05-13 08:33:48 -05:00
Greg Hellings	f735423d98	chore: make zims separate packages buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-exodus Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-jeremiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-zeke Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin.hm-gregs-MacBook-Pro-16-inch-Nov-2024 Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin.hm-ivr Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikipedia-wikipedia_ht_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-phet-phet_fr_all.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-phet-phet_en_all.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikiversity-wikiversity_fr_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikibooks-wikibooks_fr_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wiktionary-wiktionary_fr_all_nopic.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikiversity-wikiversity_en_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikibooks-wikibooks_en_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wiktionary-wiktionary_en_all_nopic.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-gutenberg-gutenberg_fr_all.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikisource-wikisource_en_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikisource-wikisource_fr_all_maxi.zim" Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikipedia-wikipedia_fr_all_maxi.zim" Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux."pkg-zim-wikipedia-wikipedia_en_all_maxi.zim" Build done. Details	2026-05-13 08:06:57 -05:00
Greg Hellings	985dd927c4	chore: move from attic to niks3 buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-05-12 21:25:24 -05:00
Greg Hellings	10d6f85b5e	chore: update pre-commit buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update manifest chart versions / update-manifests (push) Successful in 3s Details	2026-05-10 01:48:45 -05:00
Greg Hellings	85cdfce6a9	fix: use proper runs-on for updates	2026-05-10 01:47:34 -05:00
Greg Hellings	e62757cf1c	chore: add Ubuntu 26.04 to matrix	2026-05-10 01:42:28 -05:00
Greg Hellings	a1fb195bf4	chore: add podman-tui and other goodies buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Failing after 4s Details	2026-05-07 08:28:44 -05:00
Greg Hellings	9eb9fdec6c	chore: try allowing nix darwin builds buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Failing after 3s Details Update manifest chart versions / update-manifests (push) Successful in 4s Details	2026-04-30 17:18:36 -05:00
Greg Hellings	a8323e2396	fix: unstick macOS builds for libdrm missing buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 16:13:36 -05:00
Greg Hellings	855ab6e277	chore: try forcing build of linux-builder packages buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 16:08:23 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	4940550c62	chore: enable linux-builder on Mac buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 14:42:55 -05:00
Greg Hellings	258934a46b	chore: update Claude code usage	2026-04-30 14:42:29 -05:00
Greg Hellings	2476be3799	chore: make builder hostname more accessible buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 10:09:18 -05:00
Greg Hellings	08111e7a8a	chore: add ssh key to remote-builder config	2026-04-30 10:08:57 -05:00
Greg Hellings	99cc8efea0	chore: add builders to darwin baseline buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 09:43:46 -05:00
Greg Hellings	09198fda28	Merge branch 'main' of srcpub:greg/nixos	2026-04-30 09:40:34 -05:00
Greg Hellings	e16886c62c	chore: add mcp-grafana to li	2026-04-30 09:40:25 -05:00
Greg Hellings	c939d67cb6	chore: allow genesis to use its own DNS buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 16:11:20 -05:00
Greg Hellings	600aa885d4	chore: add minecraft server	2026-04-29 16:10:31 -05:00
Greg Hellings	8efd97599a	chore: remove exodus, which is x86 linux buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:20:04 -05:00
Greg Hellings	686df31049	chore: make garnix builds an array buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:14:55 -05:00
Greg Hellings	c3e3ca84a2	chore: cleanup unused packages on Darwin buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:02:12 -05:00
Greg Hellings	f8cc47614f	chore: remove unused genesis config bits buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin.pkg-adblock_update Build done. Details buildbot/nix-build Build done. Details Update flake.lock / update-flake-lock (push) Failing after 8s Details Update manifest chart versions / update-manifests (push) Successful in 4s Details	2026-04-24 18:56:10 -05:00
Greg Hellings	904754e059	fix: re-enable scheduling on Zeke disk replacement buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-24 06:46:29 -05:00
Greg Hellings	673f9b1f8b	chore: expose credentials to Claude buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-setup-ssh Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-jeremiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-linode Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-exodus Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-zeke Build done. Details buildbot/nix-build Build done. Details	2026-04-22 21:59:30 -05:00
Greg Hellings	993385f1db	chore: update flake pins	2026-04-22 21:59:16 -05:00
Greg Hellings	088c1a0033	chore: add new uuid for zeke buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-22 21:01:42 -05:00
Greg Hellings	fcba03f3d0	chore: update Gitea to latest. buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-22 20:36:03 -05:00
Greg Hellings	8ba503ca5d	chore: upgrade Immich db to PG 18	2026-04-21 16:22:21 -05:00
Greg Hellings	3b78dfec41	chore: add printer to network	2026-04-20 16:18:20 -05:00
Greg Hellings	8509fff746	chore: upgrade from dnsmasq to bind	2026-04-19 01:04:41 -05:00
Greg Hellings	fb4c6966af	chore: upgrade Nextcloud to 33 buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details Update manifest chart versions / update-manifests (push) Successful in 20s Details Update flake.lock / update-flake-lock (push) Failing after 15s Details	2026-04-17 16:01:36 -05:00
Greg Hellings	ec8c826565	chore: fix building buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-17 15:54:48 -05:00
Greg Hellings	e84e03cd05	chore: move charts into manifests	2026-04-17 15:43:57 -05:00