chore: re-enable linode gitea-runner

chore: point homepage to new registry url
chore: immich backup to Garage
2026-08-04 10:14:56 -05:00 · 2026-08-04 09:26:28 -05:00 · 2026-08-04 09:19:53 -05:00 · 2026-08-03 20:46:48 -05:00 · 2026-08-03 20:46:20 -05:00 · 2026-08-03 18:56:23 -05:00
139 changed files with 1880 additions and 2430 deletions
@@ -0,0 +1,51 @@
+name: Update zims pin
+
+"on":
+  schedule:
+    - cron: "0 2 1 * *"  # 0200 on the first of every month
+  workflow_dispatch:
+
+jobs:
+  update-flake-lock:
+    runs-on: nix-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Update flake.lock
+        run: nix run .#zim-updater -- --output pkgs/zim/blobs.json
+
+      - name: Create PR if changed
+        env:
+          GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
+          GITEA_URL: https://src.thehellings.com
+          REPO: greg/nixos
+        run: |
+          if git diff --quiet pkgs/zim/blobs.json; then
+            echo "blobs.json unchanged, nothing to do"
+            exit 0
+          fi
+
+          BRANCH="auto/update-zims-$(date +%Y%m%d)"
+          git config user.email "klaatu@thehellings.com"
+          git config user.name "klaatu"
+          git checkout -b "$BRANCH"
+          git add pkgs/zim/blobs.json
+          git commit -m "chore: update zim blobs.json $(date +%Y-%m-%d)"
+
+          # Push branch using token auth
+          git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
+          git push origin "$BRANCH"
+
+          # Create PR via Gitea API
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
+            -d "{
+              \"title\": \"chore: update zims $(date +%Y-%m-%d)\",
+              \"head\": \"$BRANCH\",
+              \"base\": \"main\",
+              \"body\": \"Automated monthly zims update.\\n\\nGenerated by Gitea Actions.\",
+              \"assignees\": [\"greg\"]
+            }"
@@ -1,12 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIByDCCAW+gAwIBAgIRANS+dPEH5Vqug7OWhCMmcx4wCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIxWhcNMzQwMjE3MjEyNzIxWjA2MREwDwYDVQQKEwhIZWxsaW5n
-czEhMB8GA1UEAxMYSGVsbGluZ3MgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0C
-AQYIKoZIzj0DAQcDQgAErZUhPfx5MpNbNVyqHDrIgUGnb6Hitl8hXlpH+kgjBzCi
-7I/+TQnl9Tc0VVNOFOYLOfBi7hV3/QudUtLGk0FKeaNmMGQwDgYDVR0PAQH/BAQD
-AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFMZR8LDd+hNy+TmtEHvt
-zRzXboh2MB8GA1UdIwQYMBaAFAlH11TwIFGB/K75qZ3e0S+fN3JUMAoGCCqGSM49
-BAMCA0cAMEQCIBxHK6r8pMX5hrTwYKRfMmRIt44m0KtNejA2T5t09hs+AiBfvmHb
-LfoE4qoC6NgpvXorAbx+O7xkem/9svF0Ob+RsA==
-----END CERTIFICATE-----
@@ -1,11 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIBoTCCAUagAwIBAgIRAL/1mvE8+73nRFGsvzaaVSAwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMISGVsbGluZ3MxGTAXBgNVBAMTEEhlbGxpbmdzIFJvb3QgQ0EwHhcN
-MjQwMjIwMjEyNzIwWhcNMzQwMjE3MjEyNzIwWjAuMREwDwYDVQQKEwhIZWxsaW5n
-czEZMBcGA1UEAxMQSGVsbGluZ3MgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABEgNBjlT/7gmzNp9vKJvGPJn9/IizuMGVpucdrN9+J1u1ABkLNRzj5p2
-g7s3e/BG+EJnnTf/2tuq3p/wPqmQkdujRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBQJR9dU8CBRgfyu+amd3tEvnzdyVDAK
-BggqhkjOPQQDAgNJADBGAiEA/uBclcFCOpkEgAeBAVurktYB82sMdIyyDGHcjlwi
-pvkCIQC2kuZ/nXRjibeIebQIVTBskQ1LxlLxnx7zNSjtr3kFfQ==
-----END CERTIFICATE-----
@@ -1,54 +0,0 @@
-services:
-  attic:
-    container_name: attic
-    image: ghcr.io/zhaofengli/attic:latest
-    command: ["-f", "/attic/server.toml"]
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    networks:
-      attic:
-      pgattic:
-    volumes:
-      - /mnt/all/configs/attic/server.toml:/attic/server.toml
-      - /mnt/all/containers/attic/data:/attic/storage
-    env_file:
-      - stack.env
-    depends_on:
-      pgattic:
-        condition: service_healthy
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
-        ]
-      interval: 15s
-      timeout: 10s
-      retries: 10
-      start_period: 15s
-    deploy:
-      resources:
-        reservations:
-          cpus: 1.0
-
-  pgattic:
-    container_name: pgattic
-    image: postgres:17.6-alpine
-    restart: unless-stopped
-    ports: []
-    networks:
-      pgattic:
-    volumes:
-      - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
-    env_file:
-      - stack.env
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-networks:
-  attic:
-  pgattic:
@@ -1,9 +0,0 @@
-services:
-  pinchflat:
-    image: ghcr.io/kieraneglin/pinchflat:latest
-    ports:
-      - "8945:8945"
-    volumes:
-      - "/mnt/all/configs/pinchflat:/config"
-      - "/mnt/all/video/yt:/downloads"
-    restart: unless-stopped
@@ -1,19 +0,0 @@
-# Demo of rest-server with prometheus and grafana
-version: "2"
-
-services:
-  restserver:
-    image: "restic/rest-server:0.14.0"
-    volumes:
-      - /mnt/all/backups:/data
-      - /mnt/all/configs/certs:/certs
-    environment:
-      OPTIONS: >-
-        --tls
-        --tls-cert /certs/nas1.shire-zebra.ts.net.crt
-        --tls-key /certs/nas1.shire-zebra.ts.net.key
-        --path /data
-        --prometheus
-        --debug
-    ports:
-      - "30248:8000"
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  top,
  ...
 }:
@@ -31,22 +32,51 @@ let
  };
 in
 {
-  environment.systemPackages = with pkgs; [
-    agenix
-    hms
-  ];
+  environment = {
+    launchDaemons = {
+      "limit.maxfiles.plist" = {
+        enable = true;
+        text = ''
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+          <dict>
+            <key>Label</key>
+            <string>limit.maxfiles</string>
+            <key>ProgramArguments</key>
+            <array>
+              <string>launchctl</string>
+              <string>limit</string>
+              <string>maxfiles</string>
+              <string>524288</string>
+              <string>524288</string>
+            </array>
+            <key>RunAtLoad</key>
+            <true/>
+          </dict>
+        </plist>
+        '';
+      };
+    };
+    systemPackages = with pkgs; [
+      agenix
+      pkgs'.hms
+      procps  # Includes tools like `watch`, `kill`, and `ps`
+    ];
+  };

  fonts.packages = with pkgs; [
    dejavu_fonts
    nerd-fonts.hack
  ];

-  launchd.daemons.darwin-builder = builder;
+  #launchd.daemons.darwin-builder = builder;

  nix = {
+    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
    enable = true;
    gc.interval.Hour = 3;
-    linux-builder.enable = true;
+    #linux-builder.enable = true;
    settings.auto-optimise-store = false; # Darwin bugs?
  };

@@ -19,6 +19,7 @@ let
      specialArgs = {
        inherit metadata top;
        inherit (top) self;
+        pkgs' = top.self.packages.${system};
      };
      modules = [
        {
@@ -11,6 +11,7 @@ in
    enable = true;
    brews = [
      "bitwarden-cli"
+      "colima"
      "direnv"
      "github-mcp-server"
      {
@@ -37,7 +38,6 @@ in
      "notion"
      "notunes"
      "onlyoffice"
-      "podman-desktop"
      "tabby"
      "zed"
    ];
@@ -25,19 +25,17 @@
    },
    "buildbot": {
      "inputs": {
-        "flake-parts": "flake-parts",
-        "hercules-ci-effects": "hercules-ci-effects",
        "nixpkgs": [
          "nixunstable"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1776626072,
-        "narHash": "sha256-NF6x9h74mrA0Acl1JHWwuSSrwzyTm3KyV8a85QUqTW0=",
+        "lastModified": 1783833875,
+        "narHash": "sha256-G+hRtNJ/Nnr6VFMQp2UZdx/ckJDR/RJoK0Fy/yx1/YY=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "f298855ee69709374a25ae9543ad11bd549d7b8b",
+        "rev": "147af587241e2af85399402da60a4f44fdb1e5d7",
        "type": "github"
      },
      "original": {
@@ -55,11 +53,11 @@
        "stable": "stable"
      },
      "locked": {
-        "lastModified": 1762034856,
-        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
+        "lastModified": 1783909498,
+        "narHash": "sha256-T9OfLPLuh1Bf1xojlpWXwooJ6IXapxvb8GM0p3YNy8g=",
        "owner": "zhaofengli",
        "repo": "colmena",
-        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
+        "rev": "76ba0daa542880b730faec81f4e87efcaa63bc57",
        "type": "github"
      },
      "original": {
@@ -97,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775037210,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "lastModified": 1784362797,
+        "narHash": "sha256-EP9b9b+OXDxHBPefFwMYCIaLq0fn3UkmrbfzbLUT7kQ=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "b4cccbd4bc299c1f71ae185b79c3cf99aa82805c",
        "type": "github"
      },
      "original": {
@@ -114,11 +112,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
@@ -161,17 +159,14 @@
    },
    "flake-parts": {
      "inputs": {
-        "nixpkgs-lib": [
-          "buildbot",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -182,14 +177,17 @@
    },
    "flake-parts_2": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -199,27 +197,6 @@
      }
    },
    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvimunstable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
      "inputs": {
        "nixpkgs-lib": [
          "nurpkgs",
@@ -241,42 +218,20 @@
      }
    },
    "flake-utils": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "hercules-ci-effects": {
      "inputs": {
-        "flake-parts": [
-          "buildbot",
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "buildbot",
-          "nixpkgs"
-        ]
+        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1776380511,
-        "narHash": "sha256-3A2B8k6YCuzt5pT/CQEltUghtE6heSlk2tMYkg/fUWI=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "4a80b7e95a298b7bb4418c0a2b55fe95a662c377",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
+        "owner": "numtide",
+        "repo": "flake-utils",
        "type": "github"
      }
    },
@@ -287,11 +242,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776904464,
-        "narHash": "sha256-sBUCj7/4d3Hoevpu3oQp8ccJNA1EDeVmFi1F8O6VJro=",
+        "lastModified": 1784407317,
+        "narHash": "sha256-iZrxHToDJWnvt+5LGAtvuQMTy1NZYlNEKbKaVtBJNcc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "667b3c47325441e6a444faaf405bba76ec70338a",
+        "rev": "39411a8e12a5526d992e65bc7e3dc9a4414d6713",
        "type": "github"
      },
      "original": {
@@ -326,14 +281,14 @@
      "inputs": {
        "flake-compat": "flake-compat_2",
        "nixpkgs": "nixpkgs_2",
-        "systems": "systems_2"
+        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1777001712,
-        "narHash": "sha256-9JX9msZU1NvHzjKM24PRorP76Ge8GBy6LAkJKA21mlY=",
+        "lastModified": 1784344393,
+        "narHash": "sha256-yAo2ZzSIdeBZg7cOKUpQxwflL+DRYN+1DMObZk2lP2Q=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "394d3bfd943458baf29e4798bc9b256d824a3bb9",
+        "rev": "7297d14c52ec8ef39c6aeff2c1818541fd030473",
        "type": "github"
      },
      "original": {
@@ -348,11 +303,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1778431771,
-        "narHash": "sha256-5cOjpGIdh1D3vsoOA8r21ACJBMulhg240MRaBNTbPLI=",
+        "lastModified": 1784016977,
+        "narHash": "sha256-TydDba3YD2u15uS0L+PDs7lMqPopnzWggljTKDqOCSw=",
        "owner": "Mic92",
        "repo": "niks3",
-        "rev": "2fd07c218b5575e30b7e62da56e6ddd6899f59db",
+        "rev": "b306808bf381e7e66e33de1e9446a1be0935f4e3",
        "type": "github"
      },
      "original": {
@@ -369,11 +324,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1729742964,
-        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "lastModified": 1737420293,
+        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
        "owner": "nix-community",
        "repo": "nix-github-actions",
-        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
        "type": "github"
      },
      "original": {
@@ -383,12 +338,15 @@
      }
    },
    "nix-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
      "locked": {
-        "lastModified": 1776830795,
-        "narHash": "sha256-PAfvLwuHc1VOvsLcpk6+HDKgMEibvZjCNvbM1BJOA7o=",
+        "lastModified": 1784310968,
+        "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "72674a6b5599e844c045ae7449ba91f803d44ebc",
+        "rev": "779c32a00155994c86cde8213a8dd4df139d4355",
        "type": "github"
      },
      "original": {
@@ -399,11 +357,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1750134718,
-        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
        "type": "github"
      },
      "original": {
@@ -415,11 +373,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
        "type": "github"
      },
      "original": {
@@ -430,11 +388,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1778379128,
-        "narHash": "sha256-+yjPmoKsTqe/FQHriXzIfI0ELuEt3+1LXc0BE8nU/Yc=",
+        "lastModified": 1783821755,
+        "narHash": "sha256-eMPX9S6MKPyUnaOgeRfrG7OKUiAlc1AlcRinMbSB0WA=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "e361b0ff94723bc94283566dc2a13a46f07eaf5c",
+        "rev": "228ab8523d81526e57a6ca342e1a919fb6d246a8",
        "type": "github"
      },
      "original": {
@@ -461,11 +419,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1777929473,
-        "narHash": "sha256-TpVPahLM+DGWN+L/k2okrIsrjTfKLjC1xVAy1zX4G0s=",
+        "lastModified": 1783978241,
+        "narHash": "sha256-7kK0Y/fIV2NTKArkd/eZGaFg+dEmgP8KDRsGK2vB5M4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "69710ea485067ba4ff64681ebde9bcc87f897dec",
+        "rev": "a8b81d3cc8d35af7bc98694696bea61ad4f8fca7",
        "type": "github"
      },
      "original": {
@@ -477,11 +435,40 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1783915482,
+        "narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784356753,
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
        "type": "github"
      },
      "original": {
@@ -491,52 +478,50 @@
        "type": "github"
      }
    },
-    "nixpkgs_5": {
+    "nixpkgs_7": {
      "locked": {
-        "lastModified": 1766025857,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "lastModified": 1777207419,
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      }
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
-        "owner": "nixos",
+        "lastModified": 1784700541,
+        "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=",
+        "owner": "geri1701",
        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "owner": "geri1701",
+        "ref": "lego-v5-acme-spike",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixvimunstable": {
      "inputs": {
-        "flake-parts": "flake-parts_3",
-        "nixpkgs": [
-          "nixunstable"
-        ],
-        "systems": "systems_3"
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_5",
+        "systems": "systems_4"
      },
      "locked": {
-        "lastModified": 1776830812,
-        "narHash": "sha256-L2q0bpa6evlzE4IfIQ7JWqhTAuINggUSIxMmOAxUsCg=",
+        "lastModified": 1784057377,
+        "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "53aad7a9aaadaec21d740117ba0f0531b9a9b3cd",
+        "rev": "07180a087e4a00720dc0731cbcd8dec796974381",
        "type": "github"
      },
      "original": {
@@ -548,15 +533,15 @@
    },
    "nurpkgs": {
      "inputs": {
-        "flake-parts": "flake-parts_4",
-        "nixpkgs": "nixpkgs_4"
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
-        "lastModified": 1776910402,
-        "narHash": "sha256-SvRshrmzz9SmiiflE+Ph2RQ2YJkmQRpluebVt94mHPQ=",
+        "lastModified": 1784417922,
+        "narHash": "sha256-19XZ56wJXArMKxjY25pKXkNp/FrYHGoo+HuQtW6teSM=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "b3ab759ea8da0d514dbbcb89e269fd59676a92ae",
+        "rev": "2c806d314605495dd7fd75b5950003a062e2b47a",
        "type": "github"
      },
      "original": {
@@ -571,7 +556,7 @@
        "buildbot": "buildbot",
        "colmena": "colmena",
        "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
        "hmunstable": "hmunstable",
        "minecraft": "minecraft",
        "niks3": "niks3",
@@ -586,16 +571,16 @@
    },
    "stable": {
      "locked": {
-        "lastModified": 1750133334,
-        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "lastModified": 1783625654,
+        "narHash": "sha256-pI1244/PJfTyKhlAr2QYQC55vR6UQdnGA0rJUgtO2IQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "rev": "a0230bd8d5cbd13893b2263918d396a2c7dd0407",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "release-26.05",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -645,6 +630,22 @@
        "type": "github"
      }
    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -653,11 +654,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -674,11 +675,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -689,14 +690,14 @@
    },
    "vsext": {
      "inputs": {
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1776828494,
-        "narHash": "sha256-gQ5+syn8ndyF/+c5g5ZpeAScNKhkTF4/63JsO2hqGHo=",
+        "lastModified": 1784343266,
+        "narHash": "sha256-EGkegdTz2n6ESyih8s3dUuPyJQWlYfPp7U41J05g8PY=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "ea6764d22ff5478f5db39ede57eeafc70d14e8e6",
+        "rev": "472a3e862c76c64ac3ad75a24d332cb5cdd5f1bb",
        "type": "github"
      },
      "original": {
@@ -713,11 +714,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776910211,
-        "narHash": "sha256-0ku3gW8bZ9TTpEU2fQw86oU6ZLT2vF6pacF+cLaf7VY=",
+        "lastModified": 1784058842,
+        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "4e6cad241baa0115a7aae8c55b04c166da4997c9",
+        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
        "type": "github"
      },
      "original": {
@@ -27,11 +27,9 @@
    niks3.url = "github:Mic92/niks3";
    nix-hardware.url = "github:nixos/nixos-hardware";
    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
-    nixvimunstable = {
-      url = "github:nix-community/nixvim/main";
-      inputs.nixpkgs.follows = "nixunstable";
-    };
-    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixvimunstable.url = "github:nix-community/nixvim/main";
+    #nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike";
    nurpkgs.url = "github:nix-community/NUR";
    vsext.url = "github:nix-community/nix-vscode-extensions";
    wsl = {
@@ -65,7 +63,10 @@
          config = {
            allowUnfree = true;
            allowUnfreePredicate = _: true;
-            permittedInsecurePackages = [ "ventoy-1.1.05" ];
+            permittedInsecurePackages = [
+              "ventoy-1.1.05"
+              "electron-39.8.10"
+            ];
          };
        }
      );
@@ -86,6 +87,7 @@
                  self
                  top
                  ;
+                pkgs' = top.self.packages.x86_64-linux;
              };
            };
          }
@@ -99,7 +101,7 @@
                {
                  deployment = {
                    inherit (v) tags;
-                    targetHost = v.ts;
+                    targetHost = if (v ? "nebulaIp") then v.nebulaIp else v.ts;
                    targetUser = "greg";
                  };
                }
@@ -20,3 +20,4 @@ builds:
      # to build at home
      - homeConfigurations."gregory.hellings-mbp"
      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
+      - homeConfigurations.ivr
@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis]
+let servers = [isaiah jeremiah zeke genesis hosea]

 def par-map [ items: list, c: closure ] {
  let results = $items | par-each -k $c
@@ -12,15 +12,55 @@ def --env unlock [] {
    }
 }

-def rebuild [] {
+def nebulaIps [] {
+    open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort
+}
+
+def localIps [] {
+    open /etc/nixos/network.json | get hosts | items { |h, e| $e.ip? } | where $it != null | sort
+}
+
+def genNebulaCert [ --ips: string, --name: string ] {
+    let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand
+    let private = $'~/SynologyDrive/nebula/($name).key' | path expand
+    let cert = $'/etc/nixos/secrets/nebula/($name).crt'
+    let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand
+    let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand
+
+    # Generate public key if there isn't one already
+    if ( not ($public | path exists) ) {
+        nebula-cert keygen -out-key $private -out-pub $public
+    }
+    # Clear old cert if there is one
+    if ( $cert | path exists) {
+        rm $cert
+    }
+
+    # Create and sign certs
+    (nebula-cert sign
+        -ca-crt $ca_cert
+        -ca-key $ca_key
+        -name $name
+        -networks $ips
+        -out-crt $cert
+        -in-pub $public
+    )
+
+    # Agenix update
+    cd /etc/nixos/secrets
+    cat $private | agenix -e $'nebula/($name).key.age'
+}
+
+
+def rebuild [ $target: string = "switch" ] {
    if (uname | get operating-system) == "Darwin" {
-        sudo darwin-rebuild switch
+        sudo darwin-rebuild $target
    } else {
        let hostname = uname | get nodename
        let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
        if $env.LAST_EXIT_CODE == 0 {
            nvd diff /run/current-system result
-            run0 result/bin/switch-to-configuration switch
+            run0 result/bin/switch-to-configuration $target
        } else {
            print "Error during build"
        }
@@ -35,7 +75,8 @@ def deploy [ $host: string, $build: string = "" ] {
    if $buildhost == "linode" or $buildhost == "genesis" {
        $buildhost = "isaiah"
    }
-    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
+    colmena apply --on $host
+    #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
 }

 def ff [ $file: string ] {
@@ -69,13 +110,6 @@ def dc [ $cmd: string = "sh" ] {
    }
 }

-def claude [ ] {
-    unlock
-    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
-    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
-    ^claude
-}
-
 if ("/usr/local/bin" | path exists) {
    $env.PATH = $env.PATH | append "/usr/local/bin"
 }
@@ -13,24 +13,25 @@
    includes = [ "config.local" ];
    enableDefaultConfig = false;

-    matchBlocks =
+    settings =
      let
        nas = {
-          user = "admin";
+          User = "admin";
        };
        owned = {
-          user = "greg";
+          User = "greg";
        };
      in
      {
        inherit nas;

        "*" = {
-          dynamicForwards = [ { port = 10240; } ];
-          serverAliveInterval = 60;
-          extraOptions = {
-            LogLevel = "error";
-            SetEnv = "TERM=xterm-256color";
+          DynamicForward = [ "10240" ];
+          ForwardAgent = "yes";
+          LogLevel = "error";
+          ServerAliveInterval = 60;
+          SetEnv = {
+            TERM = "xterm-256color";
          };
        };

@@ -41,46 +42,46 @@
        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;

        gh = {
-          user = "git";
-          hostname = "github.com";
+          User = "git";
+          Hostname = "github.com";
        };
        "src" = {
-          user = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          User = "git";
+          Hostname = "jeremiah.shire-zebra.ts.net";
+          Port = 32222;
        };
        srcpub = {
-          user = "git";
-          hostname = "src.thehellings.com";
-          port = 2222;
+          User = "git";
+          Hostname = "src.thehellings.com";
+          Port = 2222;
        };
        ivr = {
-          user = "git";
-          hostname = "gitlab.com";
+          User = "git";
+          Hostname = "gitlab.com";
        };

        "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
        };

        "*.thehellings.lan" = owned;
        "10.42.*" = owned;

        "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
-          user = "ghellings";
+          Hostname = "host.crosswire.org";
+          User = "ghellings";
        };

        fedpeople = {
-          hostname = "fedorapeople.org";
-          user = "greghellings";
+          Hostname = "fedorapeople.org";
+          User = "greghellings";
        };

        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
        };

-        "127.*".extraOptions = {
+        "127.*" = {
          PubkeyAcceptedAlgorithms = "+ssh-rsa";
          HostkeyAlgorithms = "+ssh-rsa";
        };
@@ -8,7 +8,6 @@
  home.packages =
    with pkgs;
    [
-      attic-client
      dig
      jqp
      kubernetes-helm
@@ -0,0 +1 @@
+{...}: {}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  greg = {
@@ -23,8 +23,12 @@
    mattermost-desktop
    minio-client
    mumble
+    nebula
+    nix-index
+    adoptopenjdk-icedtea-web
    pre-commit
    prismlauncher
+    rclone
    restic
    restic-browser
    tea
@@ -36,4 +40,13 @@
      settings.SKIP_HOST_UPDATE = true;
    };
  };
+  xdg.desktopEntries = {
+    prismlauncher = {
+      name = "Prism Launcher - Minecraft";
+      actions.minecraft = {
+        name = "Minecraft";
+        exec = lib.getExe pkgs.prismlauncher;
+      };
+    };
+  };
 }
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  lib,
  username,
  ...
@@ -20,6 +21,7 @@
      claude-code
      direnv
      home-manager
+      pkgs'.dockerCompat
      python3Packages.ipython
      just
      glab
@@ -36,18 +38,22 @@
      ".pip/pip.conf".text = ''
        [global]
        retries = 1
-        index-url = https://pypi.python.org/simple
+        index-url = https://pypi.python.org/
        extra-index-url =
-            https://pypidev.ivrtechnology.com/simple/
+            https://pypidev.ivrtechnology.com/
      '';
      ".config/uv/uv.toml".text = ''
        index-strategy = "unsafe-first-match"
        [[index]]
-        url = "https://pypidev.ivrtechnology.com/simple/"
+        url = "https://pypidev.ivrtechnology.com/"
        name = "pypidev"
        ignore-error-codes = [403]
      '';
    };
+    sessionVariables = {
+      BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
+      BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
+    };
    username = username;
    homeDirectory = "/Users/${username}";
  };
@@ -1,4 +0,0 @@
-{ ... }:
-
-{
-}
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  lib,
  ...
 }:
@@ -26,12 +27,17 @@ in
      ansible
      awscli2
      cargo
+      clippy
      direnv
+      docker
+      docker-compose
+      docker-buildx
+      go
      home-manager
      just
      mcp-grafana
+      nil
      nixVersions.stable
-      podman
      poetry
      pre-commit
      (pulumi.withPackages (
@@ -45,6 +51,7 @@ in
      ))
      python
      rustc
+      rustfmt
      terraform
    ];
  };
@@ -30,6 +30,7 @@ let
      modules = [
        {
          nixpkgs.hostPlatform = system;
+          networking.hostName = name;
        }
        # Imported ones
        top.agenix.nixosModules.default
@@ -0,0 +1,60 @@
+{
+  config,
+  metadata,
+  modulesPath,
+  ...
+}:
+{
+  # Then build nixosConfiguration.<host>.config.system.build.images.proxmox
+  # SCP that to /var/lib/vz/dumps on the Proxmox host
+  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
+  greg = {
+    home = true;
+    nebula.enable = true;
+  };
+  networking = {
+    defaultGateway = metadata.infra.gw;
+    nameservers = [ metadata.infra.dns ];
+    interfaces.ens18 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = metadata.hosts."${config.networking.hostName}".ip;
+          prefixLength = 16;
+        }
+      ];
+    };
+  };
+  virtualisation.diskSize = 20480; # Size in mebbibytes for the base disk image
+  # Use these instead of the above to run an LXC image
+  # The main reason I wouldn't use these is because Proxmox LXC does
+  # not seem to be well supported by either Nebula VPN or Tailscale,
+  # both of which I use for my mesh networking. If there isn't a need
+  # for the service to run on those networks, then by all means go ahead
+  # and use LXC!
+  # imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
+  # proxmoxLXC = {
+  #   manageNetwork = false;
+  #   privileged = true;
+  # };
+  # systemd.suppressedSystemUnits = [
+  #   "dev-mqueue.mount"
+  #   "sys-kernel-debug.mount"
+  #   "sys-fs-fuse-connections.mount"
+  # ];
+  nix.settings = {
+    sandbox = false;
+  };
+  services = {
+    fstrim.enable = false; # Let Proxmox host handle fstrim
+    openssh = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = true;
+        PermitEmptyPasswords = "yes";
+      };
+    };
+  };
+}
@@ -9,13 +9,9 @@
 {
  imports = [
    ./hardware-configuration.nix
-    top.nix-hardware.nixosModules.framework-11th-gen-intel
+    top.nix-hardware.nixosModules.framework-intel-core-ultra-series1
  ];

-  age.secrets = {
-    compose-attic.file = ../../../secrets/compose/attic.env.age;
-  };
-
  boot = {
    loader = {
      systemd-boot = {
@@ -62,6 +62,7 @@
          serverProperties = {
            allow-flight = true;
            motd = "Maya's Minecraft World";
+            online-mode = true;
          };
          whitelist = { };

@@ -128,8 +129,8 @@
                # Better storage engines
                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/8032/790/refinedstorage-fabric-3.0.0-beta.8.jar";
-                  hash = "sha256-XY5I+sw5JlWnKK/hPUOJsk2gnmqH4Iygq+aooN27NJY=";
+                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
+                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
                };
                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
                #storagedrawers = pkgs.fetchurl {
@@ -22,6 +22,7 @@ let
    #"1.0.0.1" # Cloudflare
    #"149.112.112.112" # Quad 9
    metadata.infra.gw # Currently using our UniFi router for DNS as well
+    "100.100.100.100"
  ];
 in
 {
@@ -115,16 +116,21 @@ in
                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                "\tIN\tNS\t${config.networking.hostName}"
              ];
-              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+              makeHost =
+                host:
+                [ "${host.name}\tIN\tA\t${host.address}" ]
+                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+                );
            in
            pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
            );
        in
        lib.mapAttrs
          (domain: net: {
            master = true;
-            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+            file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain;
          })
          {
            "shire-zebra.ts.net" = "tailscale";
@@ -1,70 +0,0 @@
-{
-  lib,
-  metadata,
-  pkgs,
-  ...
-}:
-let
-  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
-  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
-  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
-  getTS = get "ts" tps;
-  getIP = get "ip" ips;
-  whitelists = builtins.concatStringsSep "," (
-    [
-      "localhost"
-      "127.0.0.1"
-    ]
-    ++ getTS
-    ++ getIP
-  );
-in
-{
-  services = {
-    prowlarr = {
-      enable = true;
-      dataDir = "/arr/prowlarr";
-      openFirewall = true;
-    };
-    radarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    transmission = {
-      enable = true;
-      openPeerPorts = true;
-      openRPCPort = true;
-      package = pkgs.transmission_4;
-      settings = {
-        download-dir = "/arr/transmission/downloads";
-        rpc-bind-address = "0.0.0.0";
-        rpc-host-whitelist = whitelists;
-        rpc-host-whitelist-enabled = false;
-        rpc-whitelist = whitelists;
-        rpc-whitelist-enabled = false;
-        watch-dir-enabled = true;
-        watch-dir = "/arr/transmission/incoming";
-      };
-    };
-  };
-
-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "arr")
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-}
@@ -18,7 +18,6 @@ in
 {
  imports = [
    # Include the results of the hardware scan.
-    ./arr.nix
    ./hardware-configuration.nix
    top.niks3.nixosModules.niks3
  ];
@@ -186,7 +185,7 @@ in
      s3 = {
        accessKeyFile = config.age.secrets.niks3-access-key-id.path;
        bucket = "niks3";
-        endpoint = "nas1.shire-zebra.ts.net:9000";
+        endpoint = "nas1.shire-zebra.ts.net:30188";
        secretKeyFile = config.age.secrets.niks3-secret-access-key.path;
        useSSL = false;
      };
@@ -200,6 +199,25 @@ in
    };
  };

+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+
  # After first deploy: create a Grafana service account + API token for Klaatu
  # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
  age.secrets.grafana-api-token = {
@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  # Bootloader.
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/sda";
-    };
-  };
-}
@@ -1,28 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./boot.nix
-    ./filesystem.nix
-    ./location.nix
-    ./networking.nix
-    ./wiki.nix
-  ];
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Gregory Hellings";
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-    packages = with pkgs; [ ];
-  };
-}
@@ -1,13 +0,0 @@
-{ ... }:
-
-let
-in
-{
-  fileSystems."serve" = {
-    #device = "10.42.1.4:/volume1/icdm-mysql/";
-    #fsType = "nfs";
-    device = "/dev/sdb1";
-    fsType = "auto";
-    mountPoint = "/srv";
-  };
-}
@@ -1,53 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
-    fsType = "btrfs";
-    options = [ "subvol=@" ];
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
-    fsType = "ext4";
-  };
-
-  fileSystems."/var" = {
-    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
-    fsType = "btrfs";
-  };
-
-  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
@@ -1,15 +0,0 @@
-{ ... }:
-
-{
-  # Set your time zone.
-  time.timeZone = "America/Chicago";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Configure keymap in X11
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-}
@@ -1,63 +0,0 @@
-{ ... }:
-let
-  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
-in
-{
-  # If we have to do proxying in Bayonnais, we can start to work on that here
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-  networking = {
-    hostName = "icdm-root";
-    useDHCP = false;
-    defaultGateway = "10.42.1.1";
-    nameservers = [
-      "100.100.100.100"
-      "10.42.1.2"
-    ];
-    enableIPv6 = false;
-
-    interfaces = {
-      eno1.ipv4.addresses = [
-        {
-          address = "10.42.101.1";
-          prefixLength = 16;
-        }
-        {
-          address = "10.77.1.2";
-          prefixLength = 16;
-        }
-      ];
-    };
-    # Allow traffic through
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 53 ];
-      allowedUDPPorts = [
-        53
-        67
-      ];
-    };
-
-    extraHosts = "${dnsHosts}";
-  };
-
-  services.dnsmasq = {
-    enable = true;
-    settings = {
-      domain = "icdm.lan";
-      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
-      dhcp-option = [
-        "eno1,option:router,10.77.1.1"
-        "eno1,option:dns-server,10.77.1.2,1.1.1.1"
-        "eno1,option:domain-search,icdm.lan"
-      ];
-      expand-hosts = true;
-      log-dhcp = true;
-      log-queries = true;
-      # Upstream servers
-      server = [
-        "1.1.1.1"
-        "8.8.4.4"
-      ];
-    };
-  };
-}
@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-let
-  wikiHost = "wiki.icdm.lan";
-  kiwixport = 8080;
-in
-{
-  services.kiwix-serve = {
-    enable = true;
-    port = kiwixport;
-    library = {
-      inherit (pkgs) zim;
-    };
-  };
-
-  greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
-  networking.firewall.allowedTCPPorts = [ 80 ];
-}
@@ -88,6 +88,7 @@ in
      priority = 254;
    };
    nebula.enable = true;
+    proxies."buildbot.nebula.thehellings.com".target = "http://buildbot.nebula.thehellings.com:8010/";
    tailscale = {
      enable = true;
      tags = [ "home" ];
@@ -142,7 +143,7 @@ in
            updateOutputs = false;
          };
        };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "buildbot.nebula.thehellings.com:8010";
        evalMaxMemorySize = 8192;
        evalWorkerCount = 4;
        gitea = {
@@ -155,7 +156,7 @@ in
          webhookSecretFile = config.age.secrets.gitea-webhookSecret.path;
        };
        showTrace = true;
-        #webhookBaseUrl = "http://${config.networking.hostName}.shire-zebra.ts.net:8010";
+        #webhookBaseUrl = "http://${config.networking.hostName}.nebula.thehellings.com:8010";
        workersFile = config.age.secrets.gitea-buildbotWorkersFile.path;
      };
      worker = {
@@ -0,0 +1,76 @@
+{
+  config,
+  metadata,
+  modulesPath,
+  pkgs,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/virtualisation/proxmox-image.nix" ];
+  greg = {
+    home = true;
+    nebula.enable = true;
+    proxies =
+      let
+        tgt = {
+          target = "http://localhost:${config.services.uptime-kuma.settings.PORT}";
+          genAliases = false;
+        };
+      in
+      {
+        "kuma.nebula.thehellings.com" = tgt;
+        "kuma.thehellings.lan" = tgt;
+        "kuma.shire-zebra.ts.net" = tgt;
+      };
+  };
+  nix.settings = {
+    sandbox = false;
+  };
+  networking = {
+    defaultGateway = metadata.infra.gw;
+    nameservers = [ metadata.infra.dns ];
+    interfaces.ens18 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = metadata.hosts."${config.networking.hostName}".ip;
+          prefixLength = 16;
+        }
+      ];
+    };
+  };
+  proxmox.cloudInit.enable = false;
+  services = {
+    fstrim.enable = true;
+    mysql = {
+      enable = true;
+      ensureDatabases = [
+        config.services.uptime-kuma.settings.UPTIME_KUMA_DB_NAME
+      ];
+      ensureUsers = [
+        {
+          name = config.services.uptime-kuma.settings.UPTIME_KUMA_DB_USERNAME;
+          ensurePermissions = {
+            "uptimekuma.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+      package = pkgs.mariadb;
+    };
+    openssh = {
+      enable = true;
+      openFirewall = true;
+    };
+    uptime-kuma = {
+      enable = true;
+      settings = {
+        PORT = "3001"; # Default, but this allows us to explicitly use it elsewhere
+        UPTIME_KUMA_DB_TYPE = "mariadb";
+        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
+        UPTIME_KUMA_DB_NAME = "uptimekuma";
+        UPTIME_KUMA_DB_USERNAME = "uptimekuma";
+        UPTIME_KUMA_DB_PASSWORD = "uptimekuma";
+      };
+    };
+  };
+}
@@ -1,29 +1,63 @@
 {
  pkgs,
+  pkgs',
  lib,
  config,
  ...
 }:

+let
+  homepage = "127.0.0.1:30080";
+  nextcloudPort = 8080;
+  sshPort = 2222;
+in
 {
  imports = [
-    ./git.nix
    ./hardware-configuration.nix
-    ./podman.nix
-    ./matrix.nix
-    ./nextcloud.nix
-    ./nginx.nix
-    ./postgres.nix
  ];

+  age.secrets = {
+    acme.file = ../../../secrets/acme.age;
+    nextcloudadmin = {
+      file = ../../../secrets/nextcloudadmin.age;
+      owner = "nextcloud";
+    };
+  };
+
  environment.systemPackages = with pkgs; [
    bind
    graphviz
    nix-du
    pgloader
+    podman-compose
+    pkgs'.upgrade-pg-cluster
  ];

  greg = {
+    backup.jobs = {
+      nextcloud-bkup = {
+        src = "/var/lib/nextcloud";
+        dest = "nextcloud-backup";
+        pre = lib.getExe (
+          pkgs.writeShellApplication {
+            name = "nextcloud-backup-pre";
+            runtimeInputs = [ config.services.nextcloud.occ ];
+            text = "nextcloud-occ maintenance:mode --on";
+          }
+        );
+        post = lib.getExe (
+          pkgs.writeShellApplication {
+            name = "nextcloud-backup-post";
+            runtimeInputs = [ config.services.nextcloud.occ ];
+            text = "nextcloud-occ maintenance:mode --off";
+          }
+        );
+      };
+      greg-postgresql-backup = {
+        src = config.services.postgresqlBackup.location;
+        dest = "linode-postgres";
+      };
+    };
    gitea-runner = {
      enable = true;
      extraLabels = [
@@ -37,19 +71,22 @@
      enable = true;
      isLighthouse = true;
    };
-    proxies."immich.thehellings.com" = {
-      genAliases = false;
-      target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
-      ssl = true;
-    };
    tailscale.enable = true;
  };

  networking = {
-    networkmanager.enable = lib.mkForce false;
-    hostName = "linode";
    domain = "thehellings.com";
-    nameservers = [ "100.88.91.27" ];
+    firewall.allowedTCPPorts = [
+      sshPort
+      80
+      443
+    ];
+    hostName = "linode";
+    nameservers = [
+      "10.157.0.2"
+      "100.96.198.104"
+    ];
+    networkmanager.enable = lib.mkForce false;
  };

  programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
@@ -60,10 +97,242 @@
    "    UserKnownHostsFile /dev/null"
  ];

+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      dnsPropagationCheck = false;
+      dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53";
+      email = "greg.hellings@gmail.com";
+      extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only
+      #server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+    };
+    certs."thehellings.com" = {
+      dnsProvider = "linode";
+      environmentFile = config.age.secrets.acme.path;
+      extraDomainNames = [
+        "*.thehellings.com"
+      ];
+    };
+  };
+
  services = {
+
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            SLOG_LEVEL = "DEBUG";
+            TARGET = "http://git.k3s.nebula.thehellings.com";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          nbthread 4
+          maxconn 80
+          log /dev/log local0
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.nebula.thehellings.com:32222
+          server git-jeremiah jeremiah.nebula.thehellings.com:32222
+          server git-zeke zeke.nebula.thehellings.com:32222
+
+        frontend https
+          bind *:80
+          bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem
+
+          http-request redirect scheme https unless { ssl_fc }
+          http-request add-header X-Forwarded-Proto https
+
+          http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure
+
+          option http-server-close
+          option http-keep-alive
+
+          #option httplog
+          #declare capture response len 80
+          #http-response capture res.hdr(Location) id 0
+
+          use_backend git if { hdr(host) -i src.thehellings.com }
+          use_backend git if { req_ssl_sni -i src.thehellings.com }
+          use_backend next if { hdr(host) -i next.thehellings.com }
+          use_backend next if { req_ssl_sni -i next.thehellings.com }
+          use_backend matrix if { hdr(host) -i matrix.thehellings.com }
+          use_backend matrix if { req_ssl_sni -i matrix.thehellings.com }
+          use_backend web if { hdr(host) -i thehellings.com }
+          use_backend web if { req_ssl_sni -i thehellings.com }
+
+        backend git
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          http-request set-header Host git.k3s.nebula.thehellings.com
+          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-zeke zeke.nebula.thehellings.com:80
+
+        backend matrix
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          http-request set-header Host matrix.k3s.nebula.thehellings.com
+          server git-isaiah isaiah.nebula.thehellings.com:80
+          server git-jeremiah jeremiah.nebula.thehellings.com:80
+          server git-zeke zeke.nebula.thehellings.com:80
+
+        backend web
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          server web-container ${homepage}
+
+        backend next
+          log global
+          mode http
+          balance roundrobin
+          option accept-unsafe-violations-in-http-response
+          retries 3
+          option forwardfor
+          #http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2
+          server nextcloud 127.0.0.1:${builtins.toString nextcloudPort}
+      '';
+    };
+
    immich-public-proxy = {
      enable = true;
      immichUrl = "https://immich.shire-zebra.ts.net";
    };
+
+    logrotate = {
+      enable = true;
+      settings = {
+        postgresBackup = {
+          enable = true;
+          files = "${config.services.postgresqlBackup.location}/*.gz";
+        };
+        postgresLog = {
+          enable = true;
+          files = "/var/lib/postgresql/*/log/*.log";
+          compress = true;
+          compresscmd = "${pkgs.xz}/bin/xz";
+        };
+      };
+    };
+
+    nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud33;
+      appstoreEnable = true;
+      hostName = "localhost";
+      https = false;
+      config = {
+        adminpassFile = config.age.secrets.nextcloudadmin.path;
+        adminuser = "greg";
+        dbhost = "/run/postgresql";
+        dbtype = "pgsql";
+      };
+      settings = {
+        default_phone_region = "US";
+        overwriteprotocol = "http";
+        trusted_domains = [ "next.thehellings.com" ];
+        trusted_proxies = [
+          "localhost"
+          "127.0.0.1"
+        ];
+      };
+    };
+
+    # Move to :8080 so that we can run haproxy as the primary HTTP service
+    nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
+      {
+        addr = "127.0.0.1";
+        port = nextcloudPort;
+      }
+    ];
+
+    openssh.settings.PasswordAuthentication = false;
+
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_15;
+      checkConfig = true;
+      ensureDatabases = [ "nextcloud" ];
+      #initialScript = pkgs.writeText "create-matrix-db.sql" ''
+      #	CREATE ROLE "matrix-synapse" WITH LOGIN;
+      #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+      #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+      #'';  # These are done manually in order to set the LC_COLLATE values properly
+      ensureUsers = [
+        {
+          name = "nextcloud";
+          ensureDBOwnership = true;
+        }
+      ];
+      settings = {
+        log_connections = true;
+        log_statement = "all";
+        logging_collector = true;
+        log_filename = "postgresql.log";
+      };
+      identMap = ''
+        root root postgres
+      '';
+    };
+
+    postgresqlBackup = {
+      enable = true;
+      databases = [ "nextcloud" ];
+    };
+  };
+
+  systemd.services = {
+    haproxy = {
+      after = [
+        "nextcloud.service"
+        "network-online.target"
+      ];
+      wants = [
+        "nextcloud.service"
+        "network-online.target"
+      ];
+    };
+  };
+
+  users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ];
+
+  # Actually serve the content from here
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers."homepage" = {
+      image = "src.thehellings.com/greg/homepage:latest";
+      ports = [ "${homepage}:80" ];
+    };
+  };
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
  };
 }
@@ -1,122 +0,0 @@
-{ ... }:
-
-let
-  srcDomain = "src.thehellings.com";
-  sshPort = 2222;
-in
-{
-  greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
-    ssl = true;
-    genAliases = false;
-    extraConfig = ''
-      proxy_ssl_verify off;
-      proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Ssl on;
-      client_max_body_size 100000m;
-      # Ultimate AI Block List v1.7 20250924
-      # https://perishablepress.com/ultimate-ai-block-list/
-
-      if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") {
-        return 444;
-      }
-      if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") {
-        return 444;
-      }
-    '';
-  };
-  #greg.proxies."registry.thehellings.com" = {
-  #target = "https://gitea.shire-zebra.ts.net:5000";
-  #ssl = true;
-  #genAliases = false;
-  #extraConfig = ''
-  #proxy_set_header X-Forwarded-Proto https;
-  #proxy_set_header X-Forwarded-Ssl on;
-  #client_max_body_size 25000m;
-  #'';
-  #};
-
-  networking.firewall.allowedTCPPorts = [ sshPort ];
-
-  systemd.services = {
-    haproxy = {
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-    };
-  };
-
-  services.haproxy = {
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
-}
@@ -1,88 +0,0 @@
-# Registration of new users is disabled for the public, but I can create
-# them by the following commands:
-# nix run nixpkgs.matrix-synapse
-# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, lib, ... }:
-let
-  domain = "${config.networking.domain}";
-  fqdn = "matrix.${domain}";
-in
-{
-  services.nginx = {
-    virtualHosts = {
-      # Server the '.well-known' files to find the Matrix API server
-      "${domain}" = {
-        enableACME = true;
-        forceSSL = true;
-        # This is needed so that servers contacting hellings.com can find
-        # the actual application server at matrix.thehellings.com
-        locations."= /.well-known/matrix/server".extraConfig =
-          let
-            server = {
-              "m.server" = "${fqdn}:443";
-            };
-          in
-          ''
-            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON server}';
-          '';
-
-        locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" = {
-                "base_url" = "https://${fqdn}";
-              };
-              "m.identity_server" = {
-                "base_url" = "https://vector.im";
-              };
-            };
-          in
-          ''
-            add_header Content-Type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
-      };
-
-      # Reverse proxy in front of the actual Matrix server
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        extraConfig = ''
-          error_log /var/log/nginx/debug.log debug;
-        '';
-
-        # Not the appropriate place for the chat client
-        locations =
-          (builtins.listToAttrs (
-            builtins.map
-              (
-                val:
-                lib.nameValuePair "/_${val}" {
-                  proxyPass = "https://matrix.shire-zebra.ts.net";
-                }
-              )
-              [
-                "matrix"
-                "synapse"
-                "dendrite"
-              ]
-          ))
-          // {
-            "/".extraConfig = "return 404;";
-          };
-      };
-    };
-  };
-
-  # Open networking ports for the server
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [
-      80
-      443
-    ];
-  };
-}
@@ -1,58 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  age.secrets.nextcloudadmin = {
-    file = ../../../secrets/nextcloudadmin.age;
-    owner = "nextcloud";
-  };
-
-  services.nextcloud = {
-    enable = true;
-    package = pkgs.nextcloud33;
-    appstoreEnable = true;
-    hostName = "next.${config.networking.domain}";
-    https = true;
-    config = {
-      adminpassFile = config.age.secrets.nextcloudadmin.path;
-      adminuser = "greg";
-      dbhost = "/run/postgresql";
-      dbtype = "pgsql";
-    };
-    settings = {
-      default_phone_region = "US";
-      overwriteprotocol = "https";
-    };
-  };
-
-  services.nginx.virtualHosts."next.thehellings.com" = {
-    forceSSL = true;
-    enableACME = true;
-  };
-
-  # Otherwise nginx errors looking for the nextcloud sock file
-  systemd.services.nginx.after = [ "nextcloud.service" ];
-
-  greg.backup.jobs.nextcloud-bkup = {
-    src = "/var/lib/nextcloud";
-    dest = "nextcloud-backup";
-    pre = lib.getExe (
-      pkgs.writeShellApplication {
-        name = "nextcloud-backup-pre";
-        runtimeInputs = [ config.services.nextcloud.occ ];
-        text = "nextcloud-occ maintenance:mode --on";
-      }
-    );
-    post = lib.getExe (
-      pkgs.writeShellApplication {
-        name = "nextcloud-backup-post";
-        runtimeInputs = [ config.services.nextcloud.occ ];
-        text = "nextcloud-occ maintenance:mode --off";
-      }
-    );
-  };
-}
@@ -1,43 +0,0 @@
-{ ... }:
-let
-  homepage = "127.0.0.1:30080";
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "greg.hellings@gmail.com";
-  };
-
-  services.nginx = {
-    enable = true;
-
-    clientMaxBodySize = "25000m"; # To help with uploading container images
-    # If there are recommended settings, let's use them!
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-  };
-
-  # Actually serve the content from here
-  virtualisation.podman.enable = true;
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers."homepage" = {
-      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
-      ports = [ "${homepage}:80" ];
-    };
-  };
-  greg.proxies = {
-    "thehellings.com" = {
-      target = "http://${homepage}/";
-      ssl = true;
-      genAliases = false;
-    };
-    "doubles.thehellings.com" = {
-      target = "http://localhost:8081";
-      ssl = true;
-      genAliases = false;
-    };
-  };
-}
@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    podman-compose
-  ];
-
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-  };
-}
@@ -1,63 +0,0 @@
-{
-  config,
-  pkgs,
-  pkgs',
-  ...
-}:
-
-{
-  environment.systemPackages = [ pkgs'.upgrade-pg-cluster ];
-
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_15;
-    checkConfig = true;
-    ensureDatabases = [ "nextcloud" ];
-    #initialScript = pkgs.writeText "create-matrix-db.sql" ''
-    #	CREATE ROLE "matrix-synapse" WITH LOGIN;
-    #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
-    #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
-    #'';  # These are done manually in order to set the LC_COLLATE values properly
-    ensureUsers = [
-      {
-        name = "nextcloud";
-        ensureDBOwnership = true;
-      }
-    ];
-    settings = {
-      log_connections = true;
-      log_statement = "all";
-      logging_collector = true;
-      log_filename = "postgresql.log";
-    };
-    identMap = ''
-      root root postgres
-    '';
-  };
-
-  services.postgresqlBackup = {
-    enable = true;
-    databases = [ "nextcloud" ];
-  };
-
-  services.logrotate = {
-    enable = true;
-    settings = {
-      postgresBackup = {
-        enable = true;
-        files = "${config.services.postgresqlBackup.location}/*.gz";
-      };
-      postgresLog = {
-        enable = true;
-        files = "/var/lib/postgresql/*/log/*.log";
-        compress = true;
-        compresscmd = "${pkgs.xz}/bin/xz";
-      };
-    };
-  };
-
-  greg.backup.jobs.greg-postgresql-backup = {
-    src = config.services.postgresqlBackup.location;
-    dest = "linode-postgres";
-  };
-}
@@ -1,60 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{ pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-  ];
-
-  # Bootloader.
-  boot.loader = {
-    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
-  greg = {
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "proxmoxtemplate"; # Define your hostname.
-    # defaultGateway = {
-    #   address = " 10.42.1.2";
-    #   interface = "enp6s18";
-    # };
-    # interfaces = {
-    #   enp6s18 = {
-    #     ipv4.addresses = [
-    #       {
-    #         address = "10.42.1.8";
-    #         prefixLength = 16;
-    #       }
-    #     ];
-    #   };
-    # };
-    nameservers = [ "10.42.1.5" ];
-  };
-
-  services.qemuGuest.enable = true;
-
-  system.stateVersion = "24.11"; # Did you read the comment?
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.greg = {
-    isNormalUser = true;
-    description = "Greg Hellings";
-    extraGroups = [ "wheel" ];
-    packages = with pkgs; [ ];
-  };
-}
@@ -1,50 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7115-EFA6";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}
@@ -15,6 +15,7 @@
      (name: value: {
        inherit name;
        address = builtins.getAttr netAttr value;
+        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
      })
      (
        lib.filterAttrs (
@@ -1,79 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: donetick-config
-  namespace: donetick
-data:
-  # Value pulled from
-  # https://github.com/donetick/donetick/blob/main/config/selfhosted.yaml
-  selfhosted.yaml: |-
-    name: "selfhosted"
-    is_done_tick_dot_com: false
-    is_user_creation_disabled: false
-    telegram:
-      token: ""
-    pushover:
-      token: ""
-    database:
-      type: "sqlite"
-      migration: true
-      # these are only required for postgres
-      host: "secret"
-      port: 5432
-      user: "secret"
-      password: "secret"
-      name: "secret"
-    jwt:
-      secret: "This is really a secure JWT secret now!"
-      session_time: 168h
-      max_refresh: 168h
-    server:
-      port: 2021
-      read_timeout: 10s
-      write_timeout: 10s
-      rate_period: 60s
-      rate_limit: 300
-      cors_allow_origins:
-        - "http://localhost:5173"
-        - "http://localhost:7926"
-        # the below are required for the android app to work
-        - "https://localhost"
-        - "capacitor://localhost"
-      serve_frontend: true
-    logging:
-      level: "info"
-      encoding: "json"
-      development: false
-    scheduler_jobs:
-      due_job: 30m
-      overdue_job: 3h
-      pre_due_job: 3h
-    email:
-      host:
-      port:
-      key:
-      email:
-      appHost:
-    oauth2:
-      client_id:
-      client_secret:
-      auth_url:
-      token_url:
-      user_info_url:
-      redirect_url:
-      name:
-    # Real-time configuration
-    realtime:
-      enabled: true
-      sse_enabled: true
-      heartbeat_interval: 60s
-      connection_timeout: 120s
-      max_connections: 1000
-      max_connections_per_user: 5
-      event_queue_size: 2048
-      cleanup_interval: 2m
-      stale_threshold: 5m
-      enable_compression: true
-      enable_stats: true
-      allowed_origins:
-        - "*"
@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: donetick
-  namespace: donetick
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: donetick
-  template:
-    metadata:
-      labels:
-        app: donetick
-    spec:
-      containers:
-        - name: donetick
-          image: donetick/donetick
-          ports:
-            - containerPort: 2021
-              name: http
-          env:
-            - name: DT_ENV
-              value: "selfhosted"
-            - name: DT_SQLITE_PATH
-              value: "/data/donetick.db"
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: config
-          configMap:
-            name: donetick-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: donetick-data
@@ -1,15 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: donetick-tailscale
-  namespace: donetick
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: donetick
-      port:
-        number: 2021
-  tls:
-    - hosts:
-        - todo
@@ -1,9 +0,0 @@
-namespace: donetick
-
-resources:
-  - namespace.yaml
-  - configmap.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: donetick
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: donetick-data
-  namespace: donetick
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: donetick
-  namespace: donetick
-spec:
-  selector:
-    app: donetick
-  ports:
-    - name: http
-      port: 2021
-      targetPort: 2021
-      protocol: TCP
@@ -1,56 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitea
-spec:
-  interval: "24h"
-  url: https://dl.gitea.com/charts/
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitea-runner
-  namespace: gitea-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: actions
-      version: "0.0.4"
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-      interval: "1h"
-  values:
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    gitea:
-      instanceURL: https://src.thehellings.com
-      runnerToken:
-        existingSecret: gitea-runner
-        existingSecretKey: token
-    imagePullSecrets:
-      - name: image-pull-secrets
-    config:
-      runner:
-        labels:
-          # Ubuntu
-          - "ubuntu-22.04:docker://ubuntu:22.04"
-          - "ubuntu-24.04:docker://ubuntu:24.04"
-          - "ubuntu-24.10:docker://ubuntu:24.10"
-          # Fedora
-          - "fedora-41:docker://fedora:41"
-          - "fedora-42:docker://fedora:42"
-          # CentOS Stream
-          - "centos-stream-9:docker://quay.io/centos/centos:stream9"
-          - "centos-stream-10:docker://quay.io/centos/centos:stream10"
-          # Nix
-          - "nix:docker://nixos/nix:latest"
-          # ci-images (internal registry: src.thehellings.com/greg)
-          - "ci-builder:docker://src.thehellings.com/greg/builder:latest"
-          - "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
-          - "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
-          - "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
-          - "ci-immich:docker://src.thehellings.com/greg/immich:latest"
@@ -1,6 +0,0 @@
-namespace: gitea-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea-runner
@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-runner
-  namespace: gitea-runner
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: gitea-runner
-    creationPolicy: Owner
-  data:
-    - secretKey: token
-      remoteRef:
-        key: 11419680-5338-4f19-bdd9-b422007046af
-        property: password
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.5.3"
+      version: "12.7.0"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default

    image:
-      tag: "1.25.5"
+      tag: "1.27.1"

    replicaCount: 1

@@ -66,8 +66,8 @@ spec:
          APP_NAME: "Gitea: Greg's Cup of Git"
          RUN_MODE: dev
        server:
-          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://src.thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
          SSH_PORT: "2222"
        database:
          DB_TYPE: postgres
@@ -85,15 +85,15 @@ spec:
          DISABLE_REGISTRATION: "true"
        storage:
          STORAGE_TYPE: minio
-          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:30188"
          MINIO_BUCKET: gitea
-          MINIO_LOCATION: us-east-1
+          MINIO_LOCATION: garage
          # MINIO_ACCESS_KEY_ID: ""
          # MINIO_SECRET_ACCESS_KEY: ""
          MINIO_USE_SSL: "false"
          MINIO_INSECURE_SKIP_VERIFY: "true"
-        webhook:
-          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
+        security:
+          ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net,*.nebula.thehellings.com

      metrics:
        enabled: false
@@ -102,8 +102,8 @@ spec:

    persistence:
      enabled: true
-      storageClass: longhorn-default
-      size: "50Gi"
+      create: false
+      claimName: gitea-new

    # I will manage my Postgres externally
    postgresql:
@@ -18,12 +18,12 @@ spec:
          volumes:
            - name: gitea-data
              persistentVolumeClaim:
-                claimName: gitea-shared-storage
+                claimName: gitea-new
            - name: dump-staging
              emptyDir: {}
          initContainers:
            - name: gitea-dump
-              image: "gitea/gitea:1.25.4"
+              image: "gitea/gitea:1.27.1"
              command:
                - /bin/sh
                - "-c"
@@ -51,12 +51,12 @@ spec:
                - |
                  set -e
                  # Configure mc alias for MinIO
-                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:30188 \
                    "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
                  # Upload dump to backup-gitea bucket
                  DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
-                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
-                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
+                  mc cp "${DUMP_FILE}" "nas1/gitea-backup/$(basename ${DUMP_FILE})"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to gitea-backup"
                  # Set 30-day lifecycle on the bucket (idempotent)
                  mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
              volumeMounts:
@@ -69,10 +69,10 @@ spec:
                - name: MINIO_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
-                      name: gitea-config
+                      name: gitea-backup
                      key: minio_key
                - name: MINIO_SECRET_KEY
                  valueFrom:
                    secretKeyRef:
-                      name: gitea-config
+                      name: gitea-backup
                      key: minio_secret
@@ -12,3 +12,20 @@ spec:
  tls:
    - hosts:
        - gitea
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-direct
+spec:
+  rules:
+    - host: git.k3s.nebula.thehellings.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea-release-http
+                port:
+                  name: http
@@ -1,5 +1,32 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
+metadata:
+  name: gitea-backup
+spec:
+  target:
+    name: gitea-backup
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        minio_key: "{{ .minio_key }}"
+        minio_secret: "{{ .minio_secret }}"
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    # MinIO credentials
+    - secretKey: minio_key
+      remoteRef:
+        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dfb2f0c8-110d-4e96-83a7-b49c001c0897
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
  name: gitea-config
 spec:
@@ -21,23 +48,14 @@ spec:
    name: bitwarden-login
    kind: ClusterSecretStore
  data:
-    # MinIO credentials
-    - secretKey: minio_key
-      remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
-        property: username
-    - secretKey: minio_secret
-      remoteRef:
-        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
-        property: password
    # MinIO credentials for NAS1
    - secretKey: minio_nas1_key
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
        property: username
    - secretKey: minio_nas1_secret
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 33e8e4e0-eb90-484c-9ec9-b3a8018077a3
        property: password
    # Postgres credentials
    - secretKey: dbuser
@@ -27,7 +27,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: "1.11.1"
+      version: "1.11.3"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -141,6 +141,10 @@ spec:
                  number: 80
    - <<: *host
      host: longhorn.kubernetes
+    - <<: *host
+      host: longhorn.k3s.nebula.thehellings.com
+    - <<: *host
+      host: longhorn.k3s.thehellings.lan
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -33,24 +33,24 @@ spec:
        access-key: "{{ .minio_key }}"
        secret-key: "{{ .minio_secret }}"
        rclone.conf: |
-          [nas1minio]
+          [garage]
          type = s3
          provider = Minio
-          endpoint = http://nas1.shire-zebra.ts.net:9000
+          endpoint = http://nas1.shire-zebra.ts.net:30188
          access_key_id = {{ .minio_key }}
          secret_access_key = {{ .minio_secret }}
-          region = us-east-1
+          region = garage
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
  data:
    - secretKey: minio_key
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 8fce2750-aa62-4892-b90c-b49c001f494b
        property: username
    - secretKey: minio_secret
      remoteRef:
-        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        key: 8fce2750-aa62-4892-b90c-b49c001f494b
        property: password
 ---
 apiVersion: v1
@@ -128,7 +128,7 @@ spec:
                    --progress \
                    --transfers 4 \
                    --checkers 8 \
-                    /staging nas1minio:immich
+                    /staging garage:immich
              volumeMounts:
                - name: staging
                  mountPath: /staging
@@ -32,7 +32,7 @@ spec:
        containers:
          main:
            image:
-              tag: v2.7.5
+              tag: v3.1.0
            env:
              DB_HOSTNAME: immich-rw
              DB_DATABASE_NAME: immich
@@ -22,6 +22,8 @@ spec:
                name: immich-server
                port:
                  name: http
+    - <<: *host
+      host: immich.k3s.nebula.thehellings.com
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -10,7 +10,4 @@ resources:
  - immich
  - monitoring
  - pinchflat
-  - smokeping
-  - uptimekuma
-  - donetick
  - gitea
@@ -19,6 +19,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -33,6 +34,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: longhorn
@@ -11,6 +11,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: mariadb-operator
@@ -13,3 +13,20 @@ spec:
  tls:
    - hosts:
        - matrix
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-direct
+spec:
+  rules:
+    - host: matrix.k3s.nebula.thehellings.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dendrite
+                port:
+                  number: 8008
@@ -1,50 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: smokeping
-  labels:
-    app: smokeping
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: smokeping
-  template:
-    metadata:
-      labels:
-        app: smokeping
-    spec:
-      containers:
-        - name: smokeping
-          image: docker.io/linuxserver/smokeping:2.9.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: data
-              mountPath: /data
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: "America/Chicago"
-            #- name: MASTER_URL
-            #  value: "https://ping.shire-zebra.ts.net"
-            # SHARED_SECRET if you want to run a cluster
-            # CACHE_DIR if you need to explicitly state that
-      restartPolicy: Always
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: smokeping-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: smokeping-data
@@ -1,14 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: smokeping-tailscale
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: smokeping
-      port:
-        name: http
-  tls:
-    - hosts:
-        - ping
@@ -1,8 +0,0 @@
-namespace: smokeping
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: smokeping
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smokeping-config
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-default
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smokeping-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-default
-  resources:
-    requests:
-      storage: 25Gi
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: smokeping
-  labels:
-    app: smokeping
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: smokeping
@@ -1,38 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  interval: "24h"
-  url: "https://helm.irsigler.cloud"
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: uptime-kuma
-      sourceRef:
-        kind: HelmRepository
-        name: uptime-kuma
-      interval: "1h"
-  dependsOn:
-    - name: longhorn
-      namespace: longhorn-system
-    - name: mariadb-cluster
-      namespace: mariadb-operator
-  values:
-    volume:
-      storageClassName: longhorn-default
-    image:
-      tag: "2.0.2"
-    externalDatabase:
-      enabled: true
-      hostname: mariadb-cluster.mariadb-operator.svc.cluster.local
-      database: uptimekuma
-      existingSecret: uptimekuma-mariadb-password
@@ -1,15 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: uptime-kuma-tailscale
-  namespace: uptime-kuma
-spec:
-  ingressClassName: tailscale
-  defaultBackend:
-    service:
-      name: uptime-kuma
-      port:
-        number: 3001
-  tls:
-    - hosts:
-        - kuma
@@ -1,7 +0,0 @@
-namespace: uptimekuma
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml
-  - ingress.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: uptimekuma
@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: uptimekuma-mariadb-password
-spec:
-  target:
-    name: uptimekuma-mariadb-password
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/basic-auth
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  data:
-    - secretKey: username
-      remoteRef:
-        key: 4df95656-9f9c-4916-8e34-b3a200376365
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: 4df95656-9f9c-4916-8e34-b3a200376365
-        property: password
@@ -77,6 +77,7 @@ in

      programs.firefox = {
        enable = true; # (!pkgs.stdenv.hostPlatform.isDarwin);
+        configPath = if pkgs.stdenv.hostPlatform.isDarwin then "${config.home.homeDirectory}/Library/Application Support/Firefox" else "${config.xdg.configHome}/mozilla/firefox";
        package = pkgs.firefox-bin;
        policies = {
          DisableAppUpdate = true;
@@ -316,6 +316,26 @@
                name = "Buildbot";
                url = "http://jeremiah.shire-zebra.ts.net:8010/";
              }
+              {
+                name = "Garage WebUI";
+                url = "http://nas1.shire-zebra.ts.net:30186/";
+              }
+              {
+                name = "Garage RPC";
+                url = "http://nas1.shire-zebra.ts.net:30187/";
+              }
+              {
+                name = "Garage S3 API";
+                url = "http://nas1.shire-zebra.ts.net:30188/";
+              }
+              {
+                name = "Garage S3 Web";
+                url = "http://nas1.shire-zebra.ts.net:30189/";
+              }
+              {
+                name = "Garage Admin";
+                url = "http://nas1.shire-zebra.ts.net:30190/";
+              }
            ];
          }
          {
@@ -399,16 +419,24 @@
        name = "Media";
        bookmarks = [
          {
-            name = "Prowlarr";
-            url = "https://hosea.shire-zebra.ts.net:9696/";
+            name = "Flaresolverr";
+            url = "http://nas1.shire-zebra.ts.net:30098";
          }
          {
-            name = "Transmission";
-            url = "https://hosea.shire-zebra.ts.net:9091/";
+            name = "Prowlarr";
+            url = "http://nas1.shire-zebra.ts.net:30050/";
+          }
+          {
+            name = "Sonarr (TV)";
+            url = "http://nas1.shire-zebra.ts.net:30113/";
          }
          {
            name = "Radarr (Movies)";
-            url = "https://hosea.shire-zebra.ts.net:7878/";
+            url = "http://nas1.shire-zebra.ts.net:30025/";
+          }
+          {
+            name = "Deluge";
+            url = "http://nas1.shire-zebra.ts.net:30038/";
          }
        ];
      }
@@ -62,12 +62,12 @@ in
            if cfg.cache then
              [
                #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-                "http://nas1.shire-zebra.ts.net:9000/niks3"
+                "http://niks3.nas1.shire-zebra.ts.net:30189/"
                #"http://nas1.shire-zebra.ts.net:8080/default"
              ]
            else
              [
-                "http://nas1.thehellings.lan:8080/default"
+                "http://niks3.nas1.thehellings.lan:30189/"
              ]
          )
          ++ [
@@ -1,7 +1,6 @@
 {
  config,
  lib,
-  pkgs,
  ...
 }:

@@ -18,35 +17,9 @@ with lib;
  };

  config = mkIf cfg {
-    age.secrets.attic.file = ../../secrets/attic.age;
    networking.domain = "thehellings.lan";
    time.timeZone = "America/Chicago";

-    systemd.services.attic-client = {
-      enable = true;
-      description = "Attic client watch-store service";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "on-failure";
-        RestartSec = "5s";
-      };
-      preStart = ''
-        set -x
-        mkdir -p $XDG_CONFIG_HOME/attic
-        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
-      '';
-      script = "${pkgs.attic-client}/bin/attic watch-store --ignore-upstream-cache-filter default";
-      environment = {
-        XDG_CONFIG_HOME = "/var/lib/attic-client";
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d /var/lib/attic-client 0755 root root -"
-    ];
-
    # Open Prometheus exporter ports on LAN-connected hosts only.
    # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
    networking.firewall.allowedTCPPorts = [
@@ -14,6 +14,9 @@ let
    url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
    sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
  };
+  keepaliveIp = "10.42.5.1";
+  nebulaName = "k3s.nebula.thehellings.com";
+  nebulaIp = "10.157.100.1";
 in
 {
  options.greg = {
@@ -43,6 +46,13 @@ in
  };

  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.greg.nebula.enable;
+        message = "Configure Nebula for this host, first";
+      }
+    ];
+
    age.secrets = {
      bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
      dendrite_key.file = ../../secrets/dendrite_key.age;
@@ -95,6 +105,9 @@ in
          "--supervisor-metrics=true"
          "--tls-san ${config.networking.hostName}.thehellings.lan"
          "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
+          "--tls-san ${keepaliveIp}"
+          "--tls-san ${nebulaName}"
+          "--tls-san ${nebulaIp}"
        ];
        manifests = {
          cert-manager.source = cert-manager;
@@ -110,20 +123,37 @@ in
      keepalived = {
        enable = true;
        openFirewall = true;
-        vrrpInstances.kubernetes = {
-          interface = cfg.vipInterface;
-          priority = cfg.priority;
-          state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
-          virtualIps = [
-            {
-              addr = "10.42.5.1/16";
-              dev = cfg.vipInterface;
-            }
-          ];
-          virtualRouterId = 77;
-          extraConfig = ''
-            advert_int 1
-          '';
+        vrrpInstances = {
+          kubernetes = {
+            interface = cfg.vipInterface;
+            priority = cfg.priority;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${keepaliveIp}/16";
+                dev = cfg.vipInterface;
+              }
+            ];
+            virtualRouterId = 77;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
+          k3s-nebula = {
+            interface = "nebula0";
+            priority = 1;
+            state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
+            virtualIps = [
+              {
+                addr = "${nebulaIp}/16";
+                dev = "nebula0";
+              }
+            ];
+            virtualRouterId = 78;
+            extraConfig = ''
+              advert_int 1
+            '';
+          };
        };
      };
      openiscsi = {
@@ -9,11 +9,9 @@
    "tailscale": "100.64.0.0/10"
  },
  "hosts": {
-    "chronicles": {
-      "ip": "10.42.1.4",
-      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
-      "external": true,
-      "ts": "100.119.228.115"
+    "builder2": {
+      "ip": "10.42.1.17",
+      "system": "x86_64-linux"
    },
    "exodus": {
      "ip": null,
@@ -30,6 +28,15 @@
      "tags": ["router", "server"],
      "nebulaIp": "10.157.0.2"
    },
+    "gregory.hellings-mbp": {
+      "external": true,
+      "system": "aarch64-darwin",
+      "user": "gregory.hellings"
+    },
+    "gregs-MacBook-Pro-16-inch-Nov-2024": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
    "hosea": {
      "ip": "10.42.1.7",
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
@@ -38,10 +45,6 @@
      "tags": ["server"],
      "nebulaIp": "10.157.0.3"
    },
-    "icdm-root": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
    "isaiah": {
      "builder": true,
      "ip": "10.42.1.6",
@@ -56,12 +59,12 @@
      "external": true,
      "system": "x86_64-linux"
    },
-    "gregory.hellings-mbp": {
+    "ivr": {
      "external": true,
-      "system": "aarch64-darwin",
-      "user": "gregory.hellings"
+      "system": "aarch64-darwin"
    },
    "jeremiah": {
+      "aliases": ["buildbot"],
      "builder": true,
      "ip": "10.42.1.8",
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
@@ -71,14 +74,12 @@
      "tags": ["builder", "kube", "server"],
      "nebulaIp": "10.157.0.5"
    },
-    "joel": {
-      "external": true,
-      "ip": "10.42.0.4",
-      "ts": null
-    },
-    "gregs-MacBook-Pro-16-inch-Nov-2024": {
-      "external": true,
-      "system": "aarch64-darwin"
+    "kuma": {
+      "ip": "10.42.1.19",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIhr+LmYMOk4Hixxew2FiAvL8sycgQvnhK8PBGjfnkJb",
+      "system": "x86_64-linux",
+      "tags": ["server"]
    },
    "lithic": {
      "external": true,
@@ -92,10 +93,6 @@
      "tags": ["public", "server"],
      "nebulaIp": "10.157.0.1"
    },
-    "ivr": {
-      "external": true,
-      "system": "aarch64-darwin"
-    },
    "MacBook-Pro.local": {
      "external": true,
      "system": "aarch64-darwin"
@@ -104,23 +101,10 @@
      "external": true,
      "system": "aarch64-darwin"
    },
-    "nas1": {
-      "external": true,
-      "ip": "10.42.1.14",
-      "ts": "100.114.187.61"
-    },
    "nixos": {
      "external": true,
      "system": "x86_64-linux"
    },
-    "printer": {
-      "external": true,
-      "ip": "10.42.1.3"
-    },
-    "proxmoxtemplate": {
-      "external": true,
-      "system": "x86_64-linux"
-    },
    "wsl": {
      "external": true,
      "system": "aarch64-linux"
@@ -135,5 +119,57 @@
      "tags": ["builder", "kube", "server"],
      "nebulaIp": "10.157.0.6"
    }
+  },
+  "external": {
+    "chronicles": {
+      "ip": "10.42.1.4",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
+      "ts": "100.119.228.115",
+      "aliases": ["s3"]
+    },
+    "hermes": {
+      "ip": "10.42.1.18",
+      "mac": "BC:24:11:E4:72:AB",
+      "nebulaIp": "10.157.0.8",
+      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G",
+      "tags": ["server"]
+    },
+    "joel": {
+      "ip": "10.42.0.4"
+    },
+    "k3s": {
+      "aliases": ["*.k3s"],
+      "ip": "10.42.5.1",
+      "nebulaIp": "10.157.100.1"
+    },
+    "nas1": {
+      "aliases": ["*.nas1"],
+      "ip": "10.42.1.14",
+      "ts": "100.114.187.61"
+    },
+    "printer": {
+      "ip": "10.42.1.3"
+    },
+    "pve2": {
+      "ip": "10.42.1.15"
+    },
+    "pve2bmc": {
+      "ip": "10.42.6.2",
+      "mac": "00:25:90:4b:34:e8"
+    },
+    "pve3": {
+      "ip": "10.42.1.16"
+    },
+    "pve3bmc": {
+      "ip": "10.42.6.3",
+      "mac": "00:25:90:4a:dc:2e"
+    },
+    "pve4": {
+      "ip": "10.42.1.17"
+    },
+    "pve4bmc": {
+      "ip": "10.42.6.4",
+      "mac": "00:25:90:4a:d8:2e"
+    }
  }
 }
@@ -16,6 +16,15 @@ let
    adblock_update = c ./adblock_update.nix { };
    brew = c ./homebrew.nix { };
    create_ssl = c ./create_ssl.nix { };
+    dockerCompat =
+      pkgs.runCommand "docker-compat"
+        {
+          nativeBuildInputs = [ ];
+        }
+        ''
+          mkdir -p $out/bin
+          ln -s ${pkgs.podman}/bin/podman $out/bin/docker
+        '';
    gcc-tune = c ./gcc-tune.nix { };
    #gen-build = c ./gen-build { };
    hms = c ./hms { };
@@ -23,6 +32,7 @@ let
    inject = c ./inject.nix { };
    setup-ssh = c ./setup-ssh { };
    upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
+    zim-updater = c ./zim/updater.nix { };
  };
  x86Linux = {
    qemu-hook = c ./qemu-hook.nix { };
@@ -2,18 +2,18 @@
  "en": {
    "gutenberg": {
      "name": "gutenberg_en_all",
-      "version": "2023-08",
-      "hash": "sha256-OXmdHdsLZcW4nCUQsy7sMpUssS8NV7ztkCgS/nsISuw="
+      "version": "2025-11",
+      "hash": "sha256-AWd8jVVKHKssv9AgrJnryn3Wx0084NE/JmorpgPfryg="
    },
    "phet": {
      "name": "phet_en_all",
-      "version": "2025-03",
-      "hash": "sha256-ARuUzU2o17J2/ZedHc2acXl33dtHCbQJEb72UQUEm1Y="
+      "version": "2026-05",
+      "hash": "sha256-zAAq/X5rjQUiYmjMpBtWP5z3J2ZHJMmIxFKnxLAhOlA="
    },
    "wikibooks": {
      "name": "wikibooks_en_all_maxi",
-      "version": "2025-10",
-      "hash": "sha256-ONBh/ze1Fv2Ffm5b9vDzYS/i2cWSa4pM4MLZnozr2n8="
+      "version": "2026-04",
+      "hash": "sha256-wt7Zr+RkfCsFrOudMCYBADacu6IvPQDkZ6Y0VG2j9hA="
    },
    "wikipedia": {
      "name": "wikipedia_en_all_maxi",
@@ -22,40 +22,40 @@
    },
    "wikisource": {
      "name": "wikisource_en_all_maxi",
-      "version": "2025-11",
-      "hash": "sha256-p1Jio+PMTZVSLIDIOBeMG3acXJg83CwQM7zIWDUyozM="
+      "version": "2026-05",
+      "hash": "sha256-OA4b+U8mxpcX3fst6hrMyctucYTQOlG/b4qZDiVlcf4="
    },
    "wikiversity": {
      "name": "wikiversity_en_all_maxi",
-      "version": "2025-11",
-      "hash": "sha256-IG/gAUdc/vHRrIWGHhw8vMJdLWwqrNbfh+SiclQRIAI="
+      "version": "2026-05",
+      "hash": "sha256-8mZ1CSUcF4QnDIyN0M2KedQ4pcSUCmzHBlOm93MYpCE="
    },
    "wiktionary": {
      "name": "wiktionary_en_all_nopic",
-      "version": "2025-09",
-      "hash": "sha256-Ghcb60qeGaSJtTKQkJoMx/XucX7Lt1XY145lD3gHlMg="
+      "version": "2026-05",
+      "hash": "sha256-Dwiz+viVQt0zb077R9KQRgtUtxG9ixA/DeXAkCdD4rM="
    }
  },
  "fr": {
    "gutenberg": {
      "name": "gutenberg_fr_all",
-      "version": "2025-10",
-      "hash": "sha256-gLHxLXJNwwcxM/mZHtoJ8ojbGQ1fugxgni/+RXccwhU="
+      "version": "2026-01",
+      "hash": "sha256-sGn1TeKwBK0+Er5YOJWq6g0itEm4gIGvKxv/PW0DIao="
    },
    "phet": {
      "name": "phet_fr_all",
-      "version": "2025-03",
-      "hash": "sha256-CSboZNTIowLLhp1u9wkxH8xmu3LvQNx5q493AOYJRIc="
+      "version": "2026-05",
+      "hash": "sha256-bJmchFnaPcofE/hy3ZcRggMT9osHqXwLbwMLJ+cpF28="
    },
    "wikibooks": {
      "name": "wikibooks_fr_all_maxi",
-      "version": "2025-09",
-      "hash": "sha256-KHCc/73L5Bd9iZ47SRV6vpI8fVM1v9hk1TpEvTro2uo="
+      "version": "2026-07",
+      "hash": "sha256-csI+E5UFGi42BLGWWHxQhVr5KSihCFc53KGKwo557Ck="
    },
    "wikipedia": {
      "name": "wikipedia_fr_all_maxi",
-      "version": "2025-06",
-      "hash": "sha256-ve7Mbh96/ObNbV/KVNYZpfLN+HdWlJ7C5LItEdVkRH0="
+      "version": "2026-05",
+      "hash": "sha256-YUAbGzYYr+c2RQqGjHIF9XL1kNsxDgRKnHK1H7/PtDE="
    },
    "wikisource": {
      "name": "wikisource_fr_all_maxi",
@@ -64,25 +64,25 @@
    },
    "wikiversity": {
      "name": "wikiversity_fr_all_maxi",
-      "version": "2025-09",
-      "hash": "sha256-55fdtw/cRezq6nkRp6wuwkukBiqsQKdwh9QWVAgFcBI="
+      "version": "2026-05",
+      "hash": "sha256-nVDHtkWIOJkoiGixnA1zVR1QS58thjc12FJyagK3Ec0="
    },
    "wiktionary": {
      "name": "wiktionary_fr_all_nopic",
-      "version": "2025-11",
-      "hash": "sha256-P0CJptee5rDzccxyRDBzyRLuuFOcaLsJYi6DkBFUfIc="
+      "version": "2026-05",
+      "hash": "sha256-7UXByW2IIL0hec8RPT39jpg5IEGvRMD47hc4Y4vFkJs="
    }
  },
  "ht": {
    "phet": {
      "name": "phet_ht_all",
-      "version": "2025-03",
-      "hash": "sha256-bHrPzE8H7ptrP6r5wPlXSsXNlTiKxJ9KatABC4kwx+s="
+      "version": "2026-05",
+      "hash": "sha256-GiJ1jllhioyMYidQ7+Lcbdd9JN2yf04ZQgnO8XaGAqY="
    },
    "wikipedia": {
      "name": "wikipedia_ht_all_maxi",
-      "version": "2026-04",
-      "hash": "sha256-qUX0pKxIyNsWX4V6kNIsP4Z9nc6TDhwdDR0MmpDOQFs="
+      "version": "2026-07",
+      "hash": "sha256-InS9cMRaIv9ArlKVwKUypz56m4DgSR7Tl6XpSTMzH+o="
    }
  }
 }
@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"path/filepath"
+	"reflect"
 	"regexp"
 	"sort"
 	"strings"
@@ -17,27 +17,144 @@ import (

 const BASE = "https://download.kiwix.org/zim"

-func getTypes() []string {
-	return []string{
-		"phet",
-		"wikipedia",
-		"wiktionary",
-		"wikiversity",
-		"wikisource",
-		"wikibooks",
-		"gutenberg",
-		"ted",
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////  THE BLOB ITSELF /////////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Blobs struct {
+	En    Language `json:"en"`
+	Fr    Language `json:"fr"`
+	Ht    Language `json:"ht"`
+	dirty bool
+}
+
+func (b *Blobs) Populate() {
+	done := make(chan bool)
+	waitFor := 0
+	// Launch self-populating efforts
+	blobType := reflect.Indirect(reflect.ValueOf(b)).Type()
+	for f := range blobType.Fields() {
+		if f.IsExported() {
+			//fmt.Printf("%s:\tBeginning population efforts\n", f.Name)
+			waitFor += 1
+			go reflect.Indirect(reflect.ValueOf(b)).
+				FieldByName(f.Name).
+				Addr().
+				Interface().
+				(*Language).
+				Populate(strings.ToLower(f.Name), done)
+		}
+	}
+	// Wait until all languages are completed
+	for d := range done {
+		waitFor -= 1
+		if waitFor == 0 {
+			fmt.Println("Completed waiting for all languages")
+			close(done)
+			break
+		}
+		b.dirty = b.dirty || d
 	}
 }

-func getLanguages() []string {
-	return []string{
-		"ht",
-		"en",
-		"fr",
+/////////////////////////////////////////////////////////////////////////////
+//////////////////////// The Language ///////////////////////////////////////
+/////////////////////////////////////////////////////////////////////////////
+
+type Language struct {
+	Gutenberg   *Zim `json:"gutenberg,omitempty"`
+	Phet        *Zim `json:"phet,omitempty"`
+	Ted         *Zim `json:"ted,omitempty"`
+	Wikibooks   *Zim `json:"wikibooks,omitempty"`
+	Wikipedia   *Zim `json:"wikipedia,omitempty"`
+	Wikisource  *Zim `json:"wikisource,omitempty"`
+	Wikiversity *Zim `json:"wikiversity,omitempty"`
+	Wiktionary  *Zim `json:"wiktionary,omitempty"`
+	dirty       bool
+}
+
+func (l *Language) Populate(code string, done chan bool) {
+	childDone := make(chan bool)
+	waitFor := 0
+	languageType := reflect.Indirect(reflect.ValueOf(l)).Type()
+	l.dirty = false
+	for f := range languageType.Fields() {
+		if f.IsExported() {
+			ptrPtrZim := reflect.Indirect(reflect.ValueOf(l)).
+			    FieldByName(f.Name)
+			if ptrPtrZim.IsValid() && !ptrPtrZim.IsNil() {
+				waitFor += 1
+				go reflect.Indirect(ptrPtrZim).
+				    Addr().
+				    Interface().
+				    (*Zim).
+				    Populate(strings.ToLower(f.Name), code, childDone)
+			} else {
+				// TODO: Figure out how to set a value over the nil pointer
+				// of the field, so we can auto-detect when these are available
+				// in the future
+				// waitFor += 1
+				//z := &Zim{Name: f.Name, Version: "1999-01-01", Hash: ""}
+				//ptrPtrZim.Set(reflect.ValueOf(z))
+				//go z.Populate(strings.ToLower(f.Name), code, childDone)
+			}
+		}
+	}
+	// Wait until children are all done
+	for d := range childDone {
+		waitFor -= 1
+		if waitFor == 0 {
+			close(childDone)
+			break
+		}
+		l.dirty = l.dirty || d
+	}
+
+	//fmt.Printf("%s\tFinished populate\n", code)
+	done <- l.dirty
+}
+
+// ///////////////////////////////////////////////////////////////////////////
+// ////////////////////// A Single Zim ///////////////////////////////////////
+// ///////////////////////////////////////////////////////////////////////////
+type Zim struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Hash    string `json:"hash"`
+	dirty   bool
+}
+
+func (z *Zim) Populate(category string, language string, done chan bool) {
+	//fmt.Printf("%s:%s\tBeginning populate for\n", language, category)
+	// Look for a possible Zim file
+	links := getLinks(getPage(category))
+	link, err := getName(links, category, language)
+	if err != nil {
+		fmt.Printf("%s:%s\tNo zim found\n", language, category)
+		done <- false
+		return
+	}
+	//fmt.Printf("%s:%s\tFound link: %s\n", category, language, link)
+	// Extract name and version
+	re := regexp.MustCompilePOSIX("^([a-zA-Z_]+)_([0-9-]+)\\.zim$")
+	match := re.FindStringSubmatch(link)
+	if len(match) != 3 {
+		fmt.Printf("%s:%s Matches: %s", language, category, match)
+		os.Exit(1)
+	}
+	// Check if the name and version mismatch
+	if match[1] == z.Name && match[2] == z.Version {
+		fmt.Printf("Skipping existing hash: %s\n", link)
+		done <- false
+	} else {
+		z.Name = match[1]
+		z.Version = match[2]
+		// Fetch the Zim file, if it differs from what we currently have
+		z.UpdateHash(category)
+		done <- true
 	}
 }

+// Helper function to fetch the HTML of a given type page
 func getPage(t string) string {
 	page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t))
 	if err != nil {
@@ -48,6 +165,7 @@ func getPage(t string) string {
 	return string(pageBytes)
 }

+// Helper function to parse out all the links from the page
 func getLinks(page string) []string {
 	ret := []string{}

@@ -60,6 +178,7 @@ func getLinks(page string) []string {
 	return ret
 }

+// Helper function to get the most likely link for this particular entry
 func getName(links []string, t, lang string) (string, error) {
 	candidates := []string{}
 	prefix := fmt.Sprintf("%s_%s_all", t, lang)
@@ -79,44 +198,39 @@ func getName(links []string, t, lang string) (string, error) {
 	}
 }

-func getHash(ch chan result, file, category, language string) {
-	// TODO: Only call this if the file doesn't already have a hash
-	// in the existing file
-	fmt.Printf("Fetching hash for %s\n", file)
-	cmd := exec.Command( "nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
+// Helper function to get the hash value from the resulting link
+func (z *Zim) UpdateHash(category string) error {
+	file := fmt.Sprintf("%s_%s.zim", z.Name, z.Version)
+
+	// First fetch the file into our local Nix store
+	fmt.Printf("Fetching hash: %s\n", file)
+	cmd := exec.Command("nix-prefetch-url", fmt.Sprintf("%s/%s/%s", BASE, category, file))
 	out, err := cmd.Output()
 	if err != nil {
-		fmt.Printf("Error fetching hash for %s (category: %s, language: %s): %v\n", file, category, language, err)
+		fmt.Printf("%s: ERROR fetching hash: %v\n", file, err)
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			fmt.Printf("Command stderr: %s\n", string(exitErr.Stderr))
 		}
-		ch <- result{category, language, ""}
-		return
+		return errors.New("Error fetching file")
 	}
 	hash := strings.TrimSpace(string(out))
-	fmt.Printf("Successfully fetched hash for %s (category: %s, language: %s)\n", file, category, language)
-	ch <- result{category, language, hash}
-}
+	fmt.Printf("%s: Successfully fetched raw hash\n", file)
+	fmt.Printf("%s: Hash is: %s\n", file, hash)

-func outputIsValid(o map[string]map[string]Zim) bool {
-	for a := range o {
-		for b := range o[a] {
-			if o[a][b].Hash == "" {
-				return false
-			}
+	// Then, convert the hash to SRI
+	cmd2 := exec.Command("nix", "hash", "convert", "--to", "sri", hash, "--hash-algo", "sha256")
+	out2, err2 := cmd2.Output()
+	if err2 != nil {
+		fmt.Printf("%s: Error converting hash to SRI: %v\n", file, err)
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			fmt.Printf("%s: Command stderr: %s\n", file, string(exitErr.Stderr))
 		}
+		return errors.New("Error fetching file")
 	}
-	return true
-}
-
-type result struct {
-	category, language, hash string
-}
-
-type Zim struct {
-	Name string `json:"name"`
-	Version string `json:"version"`
-	Hash string `json:"hash"`
+	z.Hash = strings.TrimSpace(string(out2))
+	z.dirty = true
+	fmt.Printf("%s: Successfully convert hash to SRI: %s", file, out2)
+	return nil
 }

 func main() {
@@ -125,90 +239,31 @@ func main() {

 	// Determine the output file path
 	var outputPath string
-	if *outputFile != "" {
-		outputPath = *outputFile
-	} else {
-		// Get the directory where updater.go is located
-		execPath, err := os.Executable()
-		if err != nil {
-			// Fallback to current directory if we can't determine executable path
-			outputPath = "blobs.json"
-		} else {
-			dir := filepath.Dir(execPath)
-			outputPath = filepath.Join(dir, "blobs.json")
-		}
-	}
+	outputPath = *outputFile

 	fmt.Println("Writing file to ", outputPath)

 	// Read existing cache if it exists
-	cached := make(map[string]map[string]Zim)
+	var blobs Blobs
 	if data, err := os.ReadFile(outputPath); err == nil {
-		if err := json.Unmarshal(data, &cached); err != nil {
+		if err := json.Unmarshal(data, &blobs); err != nil {
 			fmt.Printf("Warning: could not parse existing cache file: %v\n", err)
 		} else {
 			fmt.Printf("Loaded existing cache from %s\n", outputPath)
 		}
+	} else {
+		fmt.Printf("Error reading file: %s", err)
+		os.Exit(1)
 	}
+	blobs.Populate()

-	output := make(map[string]map[string]Zim)
-	comms := make(chan result)
-	pendingHashes := 0
-
-	for _, t := range getTypes() {
-		page := getPage(t)
-		links := getLinks(page)
-		for _, lang := range getLanguages() {
-			if file, err := getName(links, t, lang); err == nil {
-				if _, ok := output[lang]; !ok {
-					output[lang] = make(map[string]Zim)
-				}
-
-				// Check if this file already exists in cache with same name
-				if cachedLang, ok := cached[lang]; ok {
-					if cachedEntry, ok := cachedLang[t]; ok && cachedEntry.Name == file {
-						// Reuse cached hash
-						fmt.Printf("Using cached hash for %s (category: %s, language: %s)\n", file, t, lang)
-						output[lang][t] = cachedEntry
-						continue
-					}
-				}
-
-				// File is new or name has changed, fetch hash
-				output[lang][t] = Zim{file, ""}
-				pendingHashes++
-				go getHash(comms, file, t, lang)
-			}
-		}
-	}
-
-	// Only wait for results if we actually spawned goroutines
-	if pendingHashes > 0 {
-		hashesReceived := 0
-		for r := range comms {
-			if entry, ok := output[r.language][r.category]; ok {
-				entry.Hash = r.hash
-				output[r.language][r.category] = entry
-			}
-			hashesReceived++
-			if hashesReceived >= pendingHashes {
-				close(comms)
-				break
-			}
-		}
-	}
-
-	// Verify all hashes are present
-	if !outputIsValid(output) {
-		fmt.Println("Warning: Some hashes are missing from the output")
-	}
-	ret, err := json.MarshalIndent(output, "", "  ")
+	ret, err := json.MarshalIndent(&blobs, "", "  ")
 	if err != nil {
 		fmt.Printf("Error marshaling JSON: %v\n", err)
 		os.Exit(1)
 	}

-	err = os.WriteFile(outputPath, ret, 0644)
+	err = os.WriteFile(outputPath, []byte(fmt.Sprintf("%s\n", ret)), 0644)
 	if err != nil {
 		fmt.Printf("Error writing to file %s: %v\n", outputPath, err)
 		os.Exit(1)
@@ -1,37 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 87huqg LKhlbZI1BygDI8E4kkzhw0/Y1BfWnzekf/URa/Bma30
-uT7QzE8DPX8j3us7oNRKwu6hPUFpQosbcMRmMNgS/Gw
-> ssh-ed25519 8UnW5Q dDAJI5EnPMIhs5H21wLT84GWhkROEJRXE1QVp1aOH38
-qZJt4Kip5qVZl9QoIFEXgrhtrlQEpbkfLarCgaHugj8
-> ssh-ed25519 UFfTmg kbrSoge204JvRPBszhAfMewPM4oHg0HkF52BNeb9kx8
-E4ASRdn0pjF//GiFCjmRlgXRS2wiJxIXDFSjldMtTdQ
-> ssh-ed25519 xNtnoA 7b9/Z/qUEmRnFCiCYzVGJVvxvV8onjZemSg6sllaDyA
-bQosZIGbaSsUqFO2JuRpIhm3FJd79JyYS43A9+zr+1w
-> ssh-ed25519 aY2AXA m4gIzzAX8pkBHHzsSykIy24E6Kru/I4uNnjihKH3JHg
-S18CWIY5wNcR5PVkCqbjp1FJRrGxco6fdoykQeHhyX0
-> ssh-ed25519 AQhf1g LBmvyUbKRLKtPGIEqt+NwOSrtGwlFt2zqgdmRDHu9n8
-zb8OnKRsJBEkH6eJ76mlKvJmtZ8NvVwVS9/0tsZlMUk
-> ssh-ed25519 mOmPfg TuPbRMlX9eRATxSbv6v88TtzGhOKWn5FOkIg4xR6FH0
-NLNzJM/9r2jZ70Y2r5Hsc36gcRTSPw40Aabn/H7OE+4
-> ssh-ed25519 YJiRbw bVMyOOgBcFFRNulym46YwKAIPlOkbQhmQAo9kl4dRx8
-5W2fIxGXCXbzULOismGg4NxE+VQ8LDEbODlJ0OpFMiI
-> ssh-ed25519 Nl/5yA ydFS0bVjjDzymhQFaBJ3YqDREQDpVO6VzgS2MBtuOUo
-tNzj/85BiYe6th2N6A9ZkMSPKduwAIe/qnf2NVJiHOg
-> ssh-ed25519 GdLgCQ wmfT7bCzwnkwEtn2mRnElIM75MmdRw+33MhSegSHJWk
-YHrCYB1wF1njNjzpIy3hKZ9l1cj7m5yicLuj71TvKr8
-> ssh-ed25519 tOH/HQ z5/GMQOtkpMWwWdMXqxmf12MM84xkgXL/OLliq3RHh0
-mVhBt+uc7z/YkoIAyXTqBgv00cJOrZ0bsBP0lD9S24c
-> ssh-ed25519 FpzvfQ D8N5JQ+3rGdSZIPmzlZqO5VpS90v6r99WMXtyUqCGiw
-A2SSvI4H5TRY13R/iOa60bCdc0zR6lUAHJVHfAUR5mQ
-> ssh-ed25519 2UotMw eaM1Kkzw53Oq8lW0BFn3rqWFcTQaTz9jcDsULDg/fwU
-3QVYFrhKnvwWDpIdsyTp0amontUXePko8z8PeUub9EE
-> ssh-ed25519 kdPvzQ 08LE8a24S5cvuK9DVWD2ta0GjJMNzUidmgYT4RfhQDA
-cRFH8vOr2y1/C9F2wZWV2deUxUpoL34IFRyOBHPYifI
-> ssh-ed25519 onmXpg J5MKGIovNwv4FyTN4ofExlHV8qYzU/J9O3MI4tZYcTo
-iagT0Ypo8gTwvGpV66XNuNPedefx2S72q9hyeB2Rz/w
-> ssh-ed25519 CnhD0g se/N4hrYxOiukByYzsIhxToceXNuBO7J7VmM4muJ3Dk
-cW+WW8iWjj3eXDqDO8aEON1ZH/+6AXQGAEXkLRbL3AI
-> ssh-ed25519 4ep2UA uyjvubY39oSGeCNsX3/VIdM5CzNBlrnRpkF+YN5MBCo
-xiNuksI7olV5Db392Vjz/7uDNDIssGmI9bez6vSOXTk
--- VsGbd8K7JzHe/eoYUeTMwcg/GrY9SXVzNxL4HZ23tKQ
-£_÷t/¢ªØËVÎÞ}7J'%?™Á‰Å0“¤¼^õ¿-„ÏÛ„äu4¥ù‹íäóü0!®ÝîËðMÜÅ·
@@ -1,37 +1,37 @@
 age-encryption.org/v1
-> ssh-ed25519 87huqg CsPCBXcVp7krsPi1k0WbjKFZxUzuZNJkkpOImMDWNns
-h6evECCNa5VGBe1dtbVwOBFBPkzwUKPFyVdQsTNMUXo
-> ssh-ed25519 8UnW5Q 1pioLo4kA+RJ6r35H9FNCQ5LZqmYUmxZTVyTdD0o92Q
-4r/sOb3IcQElEJnKAgmYeHtubm1Hk/cdiY6gUI1GkHg
-> ssh-ed25519 UFfTmg ruMzDG9lKKSHo2I1L/2wigVZs1Jhi6aTNmrr4zAyEiI
-3gsAmzM6fE8RL/fLL63pPIH75P9TW954nw11/JpU77M
-> ssh-ed25519 xNtnoA eTZoJFu1SqUoUGPcdVDw/2wW82xvRiSCnAmQSZPQT2w
-Y9Cf+/h80vn2w6G9n+V4uNV7bj3tpOT1KWRKajM7d5k
-> ssh-ed25519 aY2AXA c4MkdSio2FFkulOBKDSAG3Iq71ghRdw8/SQF0B98chY
-lvT+m2ey5+HqipuC7MrPQIKu8KrSsLHM0XRK8c0iS8w
-> ssh-ed25519 AQhf1g vLig+8a5jPo3cQhdmQw/C/P1hgzKHiVkVwUTkMBNmTk
-N5ROr2EtHpTwti7NByDiR8R3pOQ/STwlIuNeY1pDA20
-> ssh-ed25519 mOmPfg WcbxDQfraXfxkN1+IGaArpIHOmlUlhGjBijQt5ZYSxE
-6KHLewxXWwo8fVIuaTuY/T/igsI6CKqEl2tyM/gkn6g
-> ssh-ed25519 YJiRbw IblKWpY9DeDSWDfvlEmNeWSV1lGdz9aHcv2oQVmKQFI
-qPcdGcA6Z7YaLL5umR8ZOKzOyNIUJVHRBpV5HyAJeqw
-> ssh-ed25519 Nl/5yA wr0Q96yztc+Rf88q6ooiDHlKqpVdWPkRWApfJsc7uQc
-hQZTwZ36mkajMcSbxDsL+TtAezJIY+H+J7VaU1QOqEo
-> ssh-ed25519 GdLgCQ LiwfxrAh9dLjMeo6FglQzvUQ3hfWRAZr2naADkB5/WM
-Bn4fnoqTvKPd73qi28NAgAN8AZl4EWcr9e/uhuUwVgI
-> ssh-ed25519 tOH/HQ x35ypXVDI9C1wpquWxDUFYXYHxEsD2NJ0VIDosRONyE
-Aa5eZt98GQQZmKlBDzRC9KRyMCy2z1htSAsjKNGCuFw
-> ssh-ed25519 FpzvfQ jlAbIzsWi8eX+PTKn100NaiSoezN1kXzZ3gWUOKfQVg
-NQARp2qsxIdSG3OLJyP33A97r6cBRaMSaneT8NBnhDI
-> ssh-ed25519 2UotMw 53sXK937St2F3MzVIhmsjH6WeCSRdkpv4oFa2ZBaelI
-lNsjlQzS8Szj0FcAvrQno9rDO17iKDjMN7VwMLvIleE
-> ssh-ed25519 kdPvzQ YdeMlv40jR9bFnXVjPJDpvCnqn091dCKAB60m4Obwgo
-vgPAO0evfCXQUX7Tu/G9ERUhLO3KiWXqpxIqATDl5vw
-> ssh-ed25519 onmXpg mrDB6F061SjeYOZuUJVvZP8SzOVrFdpAAEfgPOzp608
-AzAEEHK6Q71YxPfiljl7ZCy0b3YBdSBMKORJd7Opkck
-> ssh-ed25519 CnhD0g Ov3v97PyY79WoXUDAdvXEZvTE7ruIgDeXVz3jD5O1HY
-+0rSmiqdxP6PgplxLkim4AJtKPcjn7OlkXpcu0BsI4s
-> ssh-ed25519 4ep2UA bDGTw6Msbh9sOp66l1VKGrT53AlrPv+QG2T6ZJv1pDk
-WvHFJ3LIlpiuVhHUxY6egKifWNepzIB7Ls2R4Kx1Kng
--- Ec6/6bQEn4GQOedrSzE+Yw1xRjQA34sj29Tr3zLFgZo
-NïP¢uGc!WcÝ¼¯£ \¼ìæ—K-©;]Ðu¹!,ó$#nŒ¶dZ‹«¦yž“-kX’BÕÙƒ°·ªc'‡Lò¯Fl�Ýªš6L‚nË¸n’Ý£f$ƒðÀ´ê
+-> ssh-ed25519 8UnW5Q MDrURGpcaqY6DVIURK6dJs7xKCGLtFS8+hH0UCRT7G4
+qsqMoWCrssVlJ2kP1cvP9+Fj+c07iFvbFs3Cs+RYVLM
+-> ssh-ed25519 UFfTmg lTHOOV5/G7IPaYWqrAwM9Nb75//N9O1wMDFSUtyo1gI
+kEWctDmQRHNzxMIwONsZo9EEIc/wkPxqX851BO6ohYo
+-> ssh-ed25519 xNtnoA lm6OHoKNa8wB1ML5lA/xl13Xp8WUSF2UY89bP8BZP0E
+iPDWUaoViQ7faVkUf2V1MQxrklAw8lJ2KXfJZTYN2X4
+-> ssh-ed25519 aY2AXA 4E8FsRsfsEKsLNVvBRTAoxghfex8omAQcy8NKzJ17kw
+uzZQp9nVfyVH3dz0UinqZjsZ0Kft7tPVSk1EkE6NvA8
+-> ssh-ed25519 AQhf1g rgcA2UeG0s75kSpok9+VR4ixNyZUqD+8ye1TJsMMA3Q
+rfM5/54WWHrnG1qfex57tGH97lbvKM+J6TGztYOrU+c
+-> ssh-ed25519 r/3ipA 7pNJRvOFO5v2nlMPbXP9oad6jp1pPAsByfiEhdCTAWI
+Vh+iyg2P6fvNWyCS+V4087zRf+pCIBj0jsPX0DtPp0c
+-> ssh-ed25519 mOmPfg 9WuzH4QasTe0NNcIf+XSremq5GuBZoKP+7t4MJNAFA0
+5E1Rbupw8IUnTuicTubXWmwkJ2xVg5K4BpkZCsUj5UU
+-> ssh-ed25519 YJiRbw msPFM69Tuy/luxASGVA8ey77vqtvXNy7ytf2VxQWNi8
+oD5vRs439A/YT5FxkSltl1Qf56NNhiKt17++vlFvwPA
+-> ssh-ed25519 Nl/5yA C3zn641k6eFQePbp2q7dwlIu7Iiw2aU5dmSrH2HCai4
+v1/XJRKIrIgHWfFtSDaFCvOKtcIR84abUZHPjaxP5bw
+-> ssh-ed25519 GdLgCQ ZztOWiw1ao1pvJ9REB/wBuxq00uyO+JAkIWjLUMueSc
+zXSv3MauG2E2el+Yv5oocTgDQjQ1fKXLpm6y2OTyIvw
+-> ssh-ed25519 tOH/HQ /eEgAf2KH1Zgd4yQf+kzyESkvPI8GKJC0MAJl+8+WD4
+H35T+ulGSCrWAuIsZs8ISRJRj2wqpRrOGlaoq9fnN5o
+-> ssh-ed25519 FpzvfQ dRq/NtT/TxJ/k9WlaMl/PrLTvPzkhV8LpF/LxjqjGmM
+LJN8xxnNF3EcMmXKdLhc70b2Y6n9qS3A5wdFXY6hUjw
+-> ssh-ed25519 2UotMw I+kJsu4GAflSfMjzE/8+vp6AZb88OpiCREuxfAnQPis
+hRu7IbLMdc3U+NQo1PDhc+O9uyd/wJZyPtfTv9z9TvI
+-> ssh-ed25519 kdPvzQ uOLSQFzsGSNg1HsiJLCYi2Lp8pasc7H/jhUBlf6b0zg
+KbUOl2WOsc6VuAC33SjEJS3tM3o82A3QO0bA9wd0rbA
+-> ssh-ed25519 onmXpg NKdAvcN3TStWYtQeLW1oEn7+shQuuNBndHaQRAU4f1o
+vCuDnPc3tayIwDbHJneLQNoENyfA6GRpQi6+OZ34Jjc
+-> ssh-ed25519 CnhD0g Co6fy3fm8BUi2qn+xBY1X33N2m40jEM7CJhSQcLokR0
+kwrOzTRiVe1aQH/P+ua3xZNgNRZh2pfQrQl2k2Y727Q
+-> ssh-ed25519 4ep2UA /f1HxU62FqhDJyJ9fPMKiqJdw1m/UjASKuYhY5Aq8D8
+tckIOvPq3Qid9Z5ud2v9syaed/h+3GrackXKZonDYEg
+--- FHj/yA6RDV1VYPsi84z5Y3NrbfVUthwdtuRWqiKC57Q
+Õ=Â7T÷Ü`6¦K./	¾¿àO	Ö¼‰R•Pá€K…2NYqWÖ¹£®ê0v{±µi'¢žÖVûÆ!+‘|ÎÕ0¿ŽšÆ¼ú´Ìi ½†Ä?Q�Žq¢2Ô5ÖÀéŽgÜ/c_
@@ -1,37 +1,37 @@
 age-encryption.org/v1
-> ssh-ed25519 87huqg OP0JAd66/SUS9oBMmOAUdDc+zLgKJ90OUrfO5fhf/zk
-YUlZvlaZF8o7BBPEYbxDeqiMmOnV3HdUUX3aUdhnPKk
-> ssh-ed25519 8UnW5Q VD5yOGQB6wS7ChQwaLFCEYEF5Yt6bCA7mHrytolI8WU
-Jphq2HxVsMJD79yZM1SlxpD5RuJnE05OfuH0aOIGPvk
-> ssh-ed25519 UFfTmg 1s7VkQEbq1L9BCAOVlCQ4NfPfwYjcqItN4PMatuSTjE
-EOj0rFqARHPeBRKP0chH5BJcr8lyLCFEBZ6wfAhYbbc
-> ssh-ed25519 xNtnoA CKFIZ8blJvm+vT2xJxBz5xzp4afsIU56Z5gP6cxba3Q
-scD+SuipcZkWT2WERFEnjwGdbA9XrXfsmIZ7r8bmM8U
-> ssh-ed25519 aY2AXA f6Mt6J6Iqdex7SP0ngYwFrQFOObwNx/kLp7QVsJkFVE
-KtF/G7BBmgg0eonne52KN/hRSfc7muRg+aqllcaGZTU
-> ssh-ed25519 AQhf1g sKGPNRD/rgVQj0/wModKct9dFOr1Nm20GJV44HLn7Es
-rr4SInqIn8tUamEBACummSzUvq6TK/Nnz4M2zHY6dRQ
-> ssh-ed25519 mOmPfg sGlYKhIISYka5/5mVBGoCwEUk2j+6tcYRiDBtvKosVI
-938SaOYsIjFpJZJAfRV9JWUoCQZ2nm6NGn0AE5RtlM4
-> ssh-ed25519 YJiRbw D58sw+Z+YuSoTg4pZeGOJcFCuRDVqA45R/r9MntQWB4
-fpV33ShLgn3XuPxD2EZ3CQ2WdSdqmCQyfVOmMCPl9zs
-> ssh-ed25519 Nl/5yA 7QHmS3lFG+cU8+Ik9iRvaXyf/vBPe7wa9sAYekQKB1c
-dHsGrtXNbt0+reajFztW8SlGuz+0PTMsWbtUMcTaF2U
-> ssh-ed25519 GdLgCQ c+IZuoQzLMbn6N44w/SsCGaeL9KxwIe1Yj1iHLj0TQw
-KzWUk7/C1xDxZXSu5YKFiwctg0k6Vee6PmudFUPoEq8
-> ssh-ed25519 tOH/HQ 0W8zyXYP6RzIBFfFZl3Z/b5IphG0OUZgJDgjvDC0FG0
-WojVazNzk2mlfUCsNnJFC+74nYCEjO1fp0pvsq7FHLA
-> ssh-ed25519 FpzvfQ mMziPqzzRrQDf0cYJS028icRScECfi8aCxPz3Xe/w1I
-1TzjHZYunhMmZCPMjam7LpvGtvw40hRuk0IlUUe45f0
-> ssh-ed25519 2UotMw v8kYr544AHHIv1C5HJb47sFYAhLLPANZ0r1nWLjYYmo
-Yr8QHe/V0LQJroyJncVabqS8m4YtF8mrMBMIaiZO7r0
-> ssh-ed25519 kdPvzQ 7Uv+ltj/EOX/jseUjGXAryi9r1w6uO39ao3yeH3z0V4
-oVp5cJCiDi/Lb6cH708QanulTNI7386GalxHfYiZQWY
-> ssh-ed25519 onmXpg nFhA0zvOJYDK8C7DNNIbJSi56UrjgHaXyhzQH+pNkmY
-Mrl7Urw2EJ/SIF+fnf4fqNMJ9QsF1YzKQLRIc4kPNPI
-> ssh-ed25519 CnhD0g slBtQIp3uM2x2NhUz+yt9z+4Y5IoGeohW03j/B0VSUU
-yY1IRFJEgtNuKG6nP05XOiwPUZXTFxOgttT1gXBMBcc
-> ssh-ed25519 4ep2UA Xe+tcFe77241jAAyj96ShjVsdCIA2ECNp72rJdefSj0
-ruNsQAjf3dGmIxV7qNYPQAPRTWi18UDNOAETfMBAd4s
--- FoB0CBe8heDBXHuPn056QFz6+RTC+AFPyRBewoI0cwo
-uú.(\û*0›UÝ†P€{CˆL9ÖÂ„ÕGèÏ‡±£9�e!‹–5)!¶j¸bÞ‘nmðÅ–b1_¨Ocþ–ÝsW¥¹6«Ðˆ Î†‹šÀ©è ˆŸÉ]tÇSìngç-ž„È`ò‘_ágÇœc‘$ÐH¾&úñwo[lÄƒcßÐrz½u{€öÌ<÷åDƒg�ç>8<#
+-> ssh-ed25519 8UnW5Q /cVdlKHdFUszYMCldfAZVCCHSt15HjcWFtz2TkiXyjY
+DWQdhHSYXFTHJG21uhDMlljeSqCKSriFtDW3LptRtK8
+-> ssh-ed25519 UFfTmg 4ezUQ1CrfVmPvm/B4twGSqbYgN5aOKe7TfOzJCwzJXQ
+MiEugBcdP9lcO/nP1mpuf7lhPXKbUUd9zVu0gmeXasU
+-> ssh-ed25519 xNtnoA I/664KfHWJsCcRxQC47dccXgl31HoxnUlt697f5cID4
+DwENqVKt4GxU+ynL99K0kIj/qeT+krZvPXZefbij11A
+-> ssh-ed25519 aY2AXA 6VlRolPP+GvsEzSNDtY6NtqsV/fCLwkKX2frsVx/e34
+tBlkTlDE/iEOhO0zfgto98hiJzS4pEzr29iuZXL9nnM
+-> ssh-ed25519 AQhf1g rjIeZ1pT0WmkWTxA27HfHLJRWNOSJXH1hWEFQaTWKk4
+4nPriRa628dVznIoL2Wqu7rC0h/34OCNgkrbqfewiZs
+-> ssh-ed25519 r/3ipA UsT9khxY0QbCgjsjVq6C8w1sAc14ldHA47QIZ/z2i1M
+DHf6CipFevIS+12XXO4hU8uFC9RtpDe8MZoTrdjM264
+-> ssh-ed25519 mOmPfg uVhT1cO1hfr9FF1vX01AVMfcuL4Fne8K21llW6MKAgc
+QJWSUgpSKCM8MionIw2uFM7sz0zrNhwPZUftDMQWfaU
+-> ssh-ed25519 YJiRbw Helxk3oufur9cbJSc5PLN6/LmIRCBQgD7WZqNyd292I
+9IKaKUkrJr/hWSq/+xIzYqbOqnxBBfVfBV6A+TEz/o
+-> ssh-ed25519 Nl/5yA QDrpal6sH+qykRk9RbmNJVuQZnq1fU2KD2DfADBQFQM
+XLPBHeipZz2TiS28SmQGsPikGyfhvCJCFPaFyMXtFz8
+-> ssh-ed25519 GdLgCQ EIEU+UNtsnnIDg9Cz/aUoCuLpgGysnpjMuzeWTHsMCM
+d6a83uoBqes28e0KTjxOulwhVPwdJ4K5dsBXAGSrDI
+-> ssh-ed25519 tOH/HQ ttYI97W+nqSunHhEHhaHrGPxIRmhKKyyHDgoFF6R5U4
+sf4VdWrsOTWfi7OUKET/OucniwkvctcyqP3eCqCI7E
+-> ssh-ed25519 FpzvfQ hJigNhU18mMxIlIx/NvuZc9bi45PplnROyyDRzEknSk
+b0aFC/vUi1CgRO3Dttodv3R/VBI5HJXk5eAb1PXY6rY
+-> ssh-ed25519 2UotMw 8IEuY5An4B2NPjSyawKN6YpRlutsOjZdYpmr3Zed6EQ
+R2PhWVN+HL+Cpa5UCeZnYDhUCDn+8wbvvHgWDyRWR4A
+-> ssh-ed25519 kdPvzQ xBmYNmttCwRBMQCyfvb16p2wuHrHwqtUo98RSRWiUCE
+oapGMLXigHx/anDaV2s9SZZosccqP1a8/2t/4yMLodM
+-> ssh-ed25519 onmXpg hH0VAFzTN3CezRdY9KhLkYlHnrlvCo/eHlvnuTzVtWQ
+vIyTINNw/pHL1gEl7MA4J7GvtL+8/oPjG86uDvET/jk
+-> ssh-ed25519 CnhD0g XBpQYVj4CX7Bv64cFxR3YevKKW5Oelt1uFoQCZVR4kQ
+prmdbQuuTNMikogdkdhED8g9oWUXPP5u3Jn3qbqq6Pg
+-> ssh-ed25519 4ep2UA S2PhUuDTrNBtZDdLUnnl6Ck0jAq+duWdhzAKtRNpuhQ
+dsEv7lSU0G6RAUBtqv7zg7nYt9vfTXzqvKjtTCgF0nk
+--- mNxL6onhO2/m3dfTuAosml1qIMtfUkNlucKPmG0t0so
+ï*Ò\¾©w+=)É2@ú?&M—w^;{‚G*?¹À÷n/™*ñ‚ð?×óÝ*¬ß1?�Z8(ld:�3óß¾•|ìÀßK½�eû g^Ðä{âFPš€òídCŒIHÔBé¢Mg¡¶Þ®�¿K•"¤w%ìW1GóÇ§<HK
Fž(àqf�xt¯1„/–
--- a/Show More
+++ b/Show More