chore: update flake.lock 2026-05-17

2026-05-17 00:03:17 +00:00
26 changed files with 246 additions and 276 deletions
@@ -1,6 +1,5 @@
 {
  pkgs,
  pkgs',
  top,
  ...
 }:
@@ -34,7 +33,7 @@ in
 {
  environment.systemPackages = with pkgs; [
    agenix
-    pkgs'.hms
+    hms
  ];
  fonts.packages = with pkgs; [
@@ -42,13 +41,12 @@ in
    nerd-fonts.hack
  ];
-  #launchd.daemons.darwin-builder = builder;
+  launchd.daemons.darwin-builder = builder;
  nix = {
    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
    enable = true;
    gc.interval.Hour = 3;
-    #linux-builder.enable = true;
+    linux-builder.enable = true;
    settings.auto-optimise-store = false; # Darwin bugs?
  };
@@ -19,7 +19,6 @@ let
      specialArgs = {
        inherit metadata top;
        inherit (top) self;
        pkgs' = top.self.packages.${system};
      };
      modules = [
        {
@@ -31,11 +31,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1780813292,
+        "lastModified": 1778391342,
-        "narHash": "sha256-auBqMf0ROzaSvdO6Ot/vxDzGswZs05sGYOZymi4/aAs=",
+        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "0c1190ae2c9518d7e7fb631c10a685e2fb83501e",
+        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
        "type": "github"
      },
      "original": {
@@ -95,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780795403,
+        "lastModified": 1777780666,
-        "narHash": "sha256-AkWx4Zt9pQbD/f82Z8N57+d0HGLN/rV3gdMKJTpBPKs=",
+        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "6a771120d607dcccb279a27d227650e324815c35",
+        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
        "type": "github"
      },
      "original": {
@@ -239,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780885330,
+        "lastModified": 1778954430,
-        "narHash": "sha256-aMA5oAq2Iv467U9s8YOb50DYQT9w0WJbyWqwlzHuLMs=",
+        "narHash": "sha256-oaNyOr05lblaQdtbkbN1wO0b2KLIL2O1LkmwDgdQp4I=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4fe95527cbe952713318ada8a4d122e1a6ab120f",
+        "rev": "26aaab785b0bab4af60a2c42b22760fa906ef22a",
        "type": "github"
      },
      "original": {
@@ -281,11 +281,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1780375694,
+        "lastModified": 1778039471,
-        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
+        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
+        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
        "type": "github"
      },
      "original": {
@@ -300,11 +300,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1780922506,
+        "lastModified": 1778839878,
-        "narHash": "sha256-/JsYspjkvMXmtcHjZ9o4+rznCuI5RxruJ228TQN5slY=",
+        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
        "owner": "Mic92",
        "repo": "niks3",
-        "rev": "1be2c7feaa5f5d99136e148cb9458971b31b5a88",
+        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
        "type": "github"
      },
      "original": {
@@ -335,15 +335,12 @@
      }
    },
    "nix-hardware": {
      "inputs": {
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1780310866,
+        "lastModified": 1778945272,
-        "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
+        "narHash": "sha256-Aipz0UiBhE2a1FYJrNc2y+5vKWo5QVkhmaIJk3/ls+g=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "4ed851c979641e28597a05086332d75cdc9e395f",
+        "rev": "379c1f274f0fa354d012f0600806de54e79f29b5",
        "type": "github"
      },
      "original": {
@@ -385,11 +382,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1780800655,
+        "lastModified": 1778379128,
-        "narHash": "sha256-eVQuIiDIy24NIAW+yEirKosWHFYAml6dghmevWgruBE=",
+        "narHash": "sha256-+yjPmoKsTqe/FQHriXzIfI0ELuEt3+1LXc0BE8nU/Yc=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "78afa8e310f34cba09443a5ef2fb47bfd21d294f",
+        "rev": "e361b0ff94723bc94283566dc2a13a46f07eaf5c",
        "type": "github"
      },
      "original": {
@@ -416,11 +413,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1780475387,
+        "lastModified": 1778491576,
-        "narHash": "sha256-JsufhU/MyfEEJMNmtmW0DY6LbOVIjjPS0zGQpHvgrBY=",
+        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c8560a2e8ad260841c482fe30731087b92f2223e",
+        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
        "type": "github"
      },
      "original": {
@@ -432,40 +429,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1767892417,
+        "lastModified": 1778869304,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
        "type": "tarball",
        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
      }
    },
    "nixpkgs_5": {
      "locked": {
        "lastModified": 1780747962,
        "narHash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_6": {
      "locked": {
        "lastModified": 1780749050,
        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
        "type": "github"
      },
      "original": {
@@ -475,7 +443,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
+    "nixpkgs_5": {
      "locked": {
        "lastModified": 1777207419,
        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
@@ -493,11 +461,11 @@
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1780749050,
+        "lastModified": 1778869304,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
        "type": "github"
      },
      "original": {
@@ -510,15 +478,17 @@
    "nixvimunstable": {
      "inputs": {
        "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": [
          "nixunstable"
        ],
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1780884186,
+        "lastModified": 1778906310,
-        "narHash": "sha256-ueTLp7DofvIZ0BXEWwi8AjP1cCsuEfO445dk6DtmfKc=",
+        "narHash": "sha256-LqASEJRtLuKRBJd9051T1KMAEaYvsVrc6m64jhD6xbw=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "82f2ec369eb597554a71ec82f33922d01b7dba8f",
+        "rev": "06cace835d7ee727852ac789e3dcd42fc2fd360e",
        "type": "github"
      },
      "original": {
@@ -531,14 +501,14 @@
    "nurpkgs": {
      "inputs": {
        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1780927127,
+        "lastModified": 1778975705,
-        "narHash": "sha256-bnqVaMBjXP9yXyn09Y+ffCh+xl15ukiFZKeR5ikXdZM=",
+        "narHash": "sha256-DweZZ/JO7AxbQ9+caW8Jt8L5MtjMvVWpKDS+MAiWN8E=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "537e92f6133a889617f03a84f4d2741c5662f61a",
+        "rev": "25081c3d50352c88e7502e2a1c76fda8560b2b41",
        "type": "github"
      },
      "original": {
@@ -614,16 +584,15 @@
    },
    "systems_3": {
      "locked": {
-        "lastModified": 1774449309,
+        "lastModified": 1681028828,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "ref": "future-26.11",
        "repo": "default",
        "type": "github"
      }
@@ -636,11 +605,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1775636079,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -657,11 +626,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1775636079,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -672,14 +641,14 @@
    },
    "vsext": {
      "inputs": {
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1780892930,
+        "lastModified": 1778902753,
-        "narHash": "sha256-YjT3Kf3tEdh6LK7YtW1d3DP02mH+Cf331Xt8CDuBg9s=",
+        "narHash": "sha256-4tgJmu6sc6F6y+igJfh+kG0t2U1T2cDwfhz5hC0W2Tg=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "ebd0101b03e316f3a62089335102d47e4bf65d5a",
+        "rev": "5df06838c483ad33aa5fb1448b9ba9de665930a1",
        "type": "github"
      },
      "original": {
@@ -696,11 +665,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780765279,
+        "lastModified": 1777732699,
-        "narHash": "sha256-md6QHmlIx40bQkun43M2eT8aav5GURGkXEMFwof6uZs=",
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "3e6d8af994e2a2d31af7a91863d7c0d6e278d951",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
        "type": "github"
      },
      "original": {
@@ -27,7 +27,10 @@
    niks3.url = "github:Mic92/niks3";
    nix-hardware.url = "github:nixos/nixos-hardware";
    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
-    nixvimunstable.url = "github:nix-community/nixvim/main";
+    nixvimunstable = {
      url = "github:nix-community/nixvim/main";
      inputs.nixpkgs.follows = "nixunstable";
    };
    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
    nurpkgs.url = "github:nix-community/NUR";
    vsext.url = "github:nix-community/nix-vscode-extensions";
@@ -62,10 +65,7 @@
          config = {
            allowUnfree = true;
            allowUnfreePredicate = _: true;
-            permittedInsecurePackages = [
+            permittedInsecurePackages = [ "ventoy-1.1.05" ];
              "ventoy-1.1.05"
              "electron-39.8.10"
            ];
          };
        }
      );
@@ -86,7 +86,6 @@
                  self
                  top
                  ;
                pkgs' = top.self.packages.x86_64-linux;
              };
            };
          }
@@ -20,4 +20,3 @@ builds:
      # to build at home
      - homeConfigurations."gregory.hellings-mbp"
      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
      - homeConfigurations.ivr
@@ -13,23 +13,25 @@
    includes = [ "config.local" ];
    enableDefaultConfig = false;
-    settings =
+    matchBlocks =
      let
        nas = {
-          User = "admin";
+          user = "admin";
        };
        owned = {
-          User = "greg";
+          user = "greg";
        };
      in
      {
        inherit nas;
        "*" = {
-          DynamicForward = [ "10240" ];
+          dynamicForwards = [ { port = 10240; } ];
-          ServerAliveInterval = 60;
+          serverAliveInterval = 60;
          extraOptions = {
            LogLevel = "error";
-          SetEnv = { TERM = "xterm-256color"; };
+            SetEnv = "TERM=xterm-256color";
          };
        };
        "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -39,46 +41,46 @@
        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
        gh = {
-          User = "git";
+          user = "git";
-          Hostname = "github.com";
+          hostname = "github.com";
        };
        "src" = {
-          User = "git";
+          user = "git";
-          Hostname = "jeremiah.shire-zebra.ts.net";
+          hostname = "jeremiah.shire-zebra.ts.net";
-          Port = 32222;
+          port = 32222;
        };
        srcpub = {
-          User = "git";
+          user = "git";
-          Hostname = "src.thehellings.com";
+          hostname = "src.thehellings.com";
-          Port = 2222;
+          port = 2222;
        };
        ivr = {
-          User = "git";
+          user = "git";
-          Hostname = "gitlab.com";
+          hostname = "gitlab.com";
        };
        "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          User = "gregory.hellings";
+          user = "gregory.hellings";
        };
        "*.thehellings.lan" = owned;
        "10.42.*" = owned;
        "host.crosswire.org crosswire" = {
-          Hostname = "host.crosswire.org";
+          hostname = "host.crosswire.org";
-          User = "ghellings";
+          user = "ghellings";
        };
        fedpeople = {
-          Hostname = "fedorapeople.org";
+          hostname = "fedorapeople.org";
-          User = "greghellings";
+          user = "greghellings";
        };
        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          User = "greghellings";
+          user = "greghellings";
        };
-        "127.*" = {
+        "127.*".extraOptions = {
          PubkeyAcceptedAlgorithms = "+ssh-rsa";
          HostkeyAlgorithms = "+ssh-rsa";
        };
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 {
  greg = {
@@ -36,13 +36,4 @@
      settings.SKIP_HOST_UPDATE = true;
    };
  };
  xdg.desktopEntries = {
    prismlauncher = {
      name = "Prism Launcher - Minecraft";
      actions.minecraft = {
        name = "Minecraft";
        exec = lib.getExe pkgs.prismlauncher;
      };
    };
  };
 }
@@ -1,6 +1,5 @@
 {
  pkgs,
  pkgs',
  lib,
  username,
  ...
@@ -21,7 +20,6 @@
      claude-code
      direnv
      home-manager
      pkgs'.dockerCompat
      python3Packages.ipython
      just
      glab
@@ -38,14 +36,14 @@
      ".pip/pip.conf".text = ''
        [global]
        retries = 1
-        index-url = https://pypi.python.org/
+        index-url = https://pypi.python.org/simple
        extra-index-url =
-            https://pypidev.ivrtechnology.com/
+            https://pypidev.ivrtechnology.com/simple/
      '';
      ".config/uv/uv.toml".text = ''
        index-strategy = "unsafe-first-match"
        [[index]]
-        url = "https://pypidev.ivrtechnology.com/"
+        url = "https://pypidev.ivrtechnology.com/simple/"
        name = "pypidev"
        ignore-error-codes = [403]
      '';
@@ -1,6 +1,5 @@
 {
  pkgs,
  pkgs',
  lib,
  ...
 }:
@@ -27,17 +26,12 @@ in
      ansible
      awscli2
      cargo
      clippy
      direnv
      pkgs'.dockerCompat
      go
      home-manager
      just
      mcp-grafana
      nil
      nixVersions.stable
      podman
      podman-compose
      poetry
      pre-commit
      (pulumi.withPackages (
@@ -51,7 +45,6 @@ in
      ))
      python
      rustc
      rustfmt
      terraform
    ];
  };
@@ -62,7 +62,6 @@
          serverProperties = {
            allow-flight = true;
            motd = "Maya's Minecraft World";
            online-mode = true;
          };
          whitelist = { };
@@ -129,8 +128,8 @@
                # Better storage engines
                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
+                  url = "https://mediafilez.forgecdn.net/files/8032/790/refinedstorage-fabric-3.0.0-beta.8.jar";
-                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
+                  hash = "sha256-XY5I+sw5JlWnKK/hPUOJsk2gnmqH4Iygq+aooN27NJY=";
                };
                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
                #storagedrawers = pkgs.fetchurl {
@@ -22,7 +22,6 @@ let
    #"1.0.0.1" # Cloudflare
    #"149.112.112.112" # Quad 9
    metadata.infra.gw # Currently using our UniFi router for DNS as well
    "100.100.100.100"
  ];
 in
 {
@@ -116,15 +115,10 @@ in
                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                "\tIN\tNS\t${config.networking.hostName}"
              ];
-              makeHost =
+              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
                host:
                [ "${host.name}\tIN\tA\t${host.address}" ]
                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
                );
            in
            pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
            );
        in
        lib.mapAttrs
@@ -133,7 +127,7 @@ in
            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
          })
          {
-            #"shire-zebra.ts.net" = "tailscale";
+            "shire-zebra.ts.net" = "tailscale";
            "nebula.thehellings.com" = "nebula";
            nebula = "nebula";
            "thehellings.lan" = "lan";
@@ -0,0 +1,70 @@
 {
  lib,
  metadata,
  pkgs,
  ...
 }:
 let
  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
  getTS = get "ts" tps;
  getIP = get "ip" ips;
  whitelists = builtins.concatStringsSep "," (
    [
      "localhost"
      "127.0.0.1"
    ]
    ++ getTS
    ++ getIP
  );
 in
 {
  services = {
    prowlarr = {
      enable = true;
      dataDir = "/arr/prowlarr";
      openFirewall = true;
    };
    radarr = {
      enable = true;
      openFirewall = true;
    };
    transmission = {
      enable = true;
      openPeerPorts = true;
      openRPCPort = true;
      package = pkgs.transmission_4;
      settings = {
        download-dir = "/arr/transmission/downloads";
        rpc-bind-address = "0.0.0.0";
        rpc-host-whitelist = whitelists;
        rpc-host-whitelist-enabled = false;
        rpc-whitelist = whitelists;
        rpc-whitelist-enabled = false;
        watch-dir-enabled = true;
        watch-dir = "/arr/transmission/incoming";
      };
    };
  };
  systemd.mounts =
    let
      nfs = name: {
        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
        type = "nfs";
        name = "${name}.mount";
        where = "/${name}";
        requires = [ "tailscaled-autoconnect.service" ];
        after = [ "tailscaled-autoconnect.service" ];
        wantedBy = [ "multi-user.target" ];
        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
      };
    in
    [
      (nfs "arr")
      (nfs "music")
      (nfs "photos")
      (nfs "video")
    ];
 }
@@ -18,6 +18,7 @@ in
 {
  imports = [
    # Include the results of the hardware scan.
    ./arr.nix
    ./hardware-configuration.nix
    top.niks3.nixosModules.niks3
  ];
@@ -199,25 +200,6 @@ in
    };
  };
  systemd.mounts =
    let
      nfs = name: {
        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
        type = "nfs";
        name = "${name}.mount";
        where = "/${name}";
        requires = [ "tailscaled-autoconnect.service" ];
        after = [ "tailscaled-autoconnect.service" ];
        wantedBy = [ "multi-user.target" ];
        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
      };
    in
    [
      (nfs "music")
      (nfs "photos")
      (nfs "video")
    ];
  # After first deploy: create a Grafana service account + API token for Klaatu
  # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
  age.secrets.grafana-api-token = {
@@ -142,12 +142,12 @@ in
            updateOutputs = false;
          };
        };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net";
        evalMaxMemorySize = 8192;
        evalWorkerCount = 4;
        gitea = {
          enable = true;
-          instanceUrl = "https://gitea.shire-zebra.ts.net";
+          instanceUrl = "https://src.thehellings.com";
          oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
          oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
          tokenFile = config.age.secrets.gitea-oauthToken.path;
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 let
  srcDomain = "src.thehellings.com";
@@ -6,23 +6,15 @@ let
 in
 {
  greg.proxies."${srcDomain}" = {
-    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
+    target = "https://gitea.shire-zebra.ts.net";
    ssl = true;
    genAliases = false;
    extraConfig = ''
-      #proxy_ssl_verify off;
+      proxy_ssl_verify off;
-      #proxy_ssl_server_name on;
+      proxy_ssl_server_name on;
-
+      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-Ssl on;
      proxy_set_header X-Http-Version $server_protocol;
      proxy_set_header User-Agent $http_user_agent;
      client_max_body_size 100000m;
      #proxy_set_header Host $host;
      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      #proxy_set_header X-Forwarded-Proto $scheme;
      #proxy_set_header X-Forwarded-Ssl on;
      # Ultimate AI Block List v1.7 20250924
      # https://perishablepress.com/ultimate-ai-block-list/
@@ -95,22 +87,18 @@ in
  networking.firewall.allowedTCPPorts = [ sshPort ];
-  services = {
+  systemd.services = {
-    anubis = {
+    haproxy = {
-      instances = {
+      after = [
-        git = {
+        "network-online.target"
-          enable = true;
+      ];
-          settings = {
+      wants = [
-            BIND = "/run/anubis/anubis-git/anubis.sock";
+        "network-online.target"
-            COOKIE_DOMAIN = "thehellings.com";
+      ];
            SERVE_ROBOTS_TXT = true;
            TARGET = "https://gitea.shire-zebra.ts.net/";
          };
        };
    };
  };
-    haproxy = {
+  services.haproxy = {
    enable = true;
    config = ''
      global
@@ -131,18 +119,4 @@ in
        server git-zeke zeke.shire-zebra.ts.net:32222
    '';
  };
  };
  systemd.services = {
    haproxy = {
      after = [
        "network-online.target"
      ];
      wants = [
        "network-online.target"
      ];
    };
  };
  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
 }
@@ -2,24 +2,12 @@
 # them by the following commands:
 # nix run nixpkgs.matrix-synapse
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, ... }:
+{ config, lib, ... }:
 let
  domain = "${config.networking.domain}";
  fqdn = "matrix.${domain}";
 in
 {
  greg.proxies."${fqdn}" = {
    extraConfig = ''
      error_log /var/log/nginx/debug.log debug;
      proxy_ssl_verify off;
      proxy_ssl_server_name on;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Ssl on;
    '';
    genAliases = false;
    ssl = true;
    target = "https://matrix.shire-zebra.ts.net";
  };
  services.nginx = {
    virtualHosts = {
      # Server the '.well-known' files to find the Matrix API server
@@ -56,6 +44,36 @@ in
            return 200 '${builtins.toJSON client}';
          '';
      };
      # Reverse proxy in front of the actual Matrix server
      "${fqdn}" = {
        enableACME = true;
        forceSSL = true;
        extraConfig = ''
          error_log /var/log/nginx/debug.log debug;
        '';
        # Not the appropriate place for the chat client
        locations =
          (builtins.listToAttrs (
            builtins.map
              (
                val:
                lib.nameValuePair "/_${val}" {
                  proxyPass = "https://matrix.shire-zebra.ts.net";
                }
              )
              [
                "matrix"
                "synapse"
                "dendrite"
              ]
          ))
          // {
            "/".extraConfig = "return 404;";
          };
      };
    };
  };
@@ -34,5 +34,10 @@ in
      ssl = true;
      genAliases = false;
    };
    "doubles.thehellings.com" = {
      target = "http://localhost:8081";
      ssl = true;
      genAliases = false;
    };
  };
 }
@@ -15,7 +15,6 @@
      (name: value: {
        inherit name;
        address = builtins.getAttr netAttr value;
        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
      })
      (
        lib.filterAttrs (
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.6.0"
+      version: "12.5.3"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default
    image:
-      tag: "1.26.2"
+      tag: "1.25.5"
    replicaCount: 1
@@ -66,8 +66,8 @@ spec:
          APP_NAME: "Gitea: Greg's Cup of Git"
          RUN_MODE: dev
        server:
-          DOMAIN: "shire-zebra.ts.net"
+          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://gitea.shire-zebra.ts.net"
+          ROOT_URL: "https://src.thehellings.com"
          SSH_PORT: "2222"
        database:
          DB_TYPE: postgres
@@ -27,7 +27,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: "1.11.2"
+      version: "1.11.1"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -19,7 +19,6 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -34,7 +33,6 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: longhorn
@@ -11,7 +11,6 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: mariadb-operator
@@ -77,7 +77,6 @@ in
      programs.firefox = {
        enable = true; # (!pkgs.stdenv.hostPlatform.isDarwin);
        configPath = "${config.xdg.configHome}/mozilla/firefox";
        package = pkgs.firefox-bin;
        policies = {
          DisableAppUpdate = true;
@@ -398,25 +398,17 @@
      {
        name = "Media";
        bookmarks = [
          {
            name = "Flaresolverr";
            url = "http://nas1.shire-zebra.ts.net:30098";
          }
          {
            name = "Prowlarr";
-            url = "http://nas1.shire-zebra.ts.net:30050/";
+            url = "https://hosea.shire-zebra.ts.net:9696/";
          }
          {
-            name = "Sonarr (TV)";
+            name = "Transmission";
-            url = "http://nas1.shire-zebra.ts.net:30113/";
+            url = "https://hosea.shire-zebra.ts.net:9091/";
          }
          {
            name = "Radarr (Movies)";
-            url = "http://nas1.shire-zebra.ts.net:30025/";
+            url = "https://hosea.shire-zebra.ts.net:7878/";
          }
          {
            name = "Deluge";
            url = "http://nas1.shire-zebra.ts.net:30038/";
          }
        ];
      }
@@ -13,8 +13,7 @@
      "ip": "10.42.1.4",
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
      "external": true,
-      "ts": "100.119.228.115",
+      "ts": "100.119.228.115"
      "aliases": ["s3"]
    },
    "exodus": {
      "ip": null,
@@ -16,12 +16,6 @@ let
    adblock_update = c ./adblock_update.nix { };
    brew = c ./homebrew.nix { };
    create_ssl = c ./create_ssl.nix { };
    dockerCompat = pkgs.runCommand "docker-compat" {
      nativeBuildInputs  = [];
    } ''
      mkdir -p $out/bin
      ln -s ${pkgs.podman}/bin/podman $out/bin/docker
    '';
    gcc-tune = c ./gcc-tune.nix { };
    #gen-build = c ./gen-build { };
    hms = c ./hms { };