updated authorized keys

Add Nix cache / remote-builder modules, wire hosts, and harden maintenance scripts

.gitignore

@@ -6,3 +6,6 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+auto-installer/flake.lock
+auto-installer/result
+auto-installer/nixos-auto.iso

AGENTS.md

@@ -0,0 +1,33 @@
+# AGENTS.md
+
+## Repo purpose
+
+This repository contains flake-based NixOS configurations for Wayne’s LAN servers and workstation.
+
+The flake currently exposes these NixOS configurations:
+
+- `nixos`
+- `docker`
+- `kuma`
+- `server`
+- `nix-cache`
+- `nix-minimal`
+
+Do not deploy, switch, reboot, repartition, format disks, or run destructive install commands from this repository unless explicitly asked.
+
+## Safety rules
+
+- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`, `mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
+- Validation work should be limited to evaluation, linting, formatting checks, and `nix build --dry-run --no-link`.
+- Do not add secrets, tokens, private keys, password hashes, or live credentials to the repo.
+- Treat `flake.nix`, Home Manager config, and Nix config files as public.
+- If you find committed tokens or hashes, flag them immediately and recommend rotation/removal.
+
+## Expected commands
+
+Use these commands when validating changes:
+
+```bash
+bash scripts/codex-setup.sh
+bash scripts/codex-maintenance.sh
+bash scripts/codex-maintenance.sh dry-run

README.md

@@ -1,2 +1,25 @@
-# nixos
 
+## `README.md`
+
+```markdown
+# NixOS LAN Configurations
+
+Flake-based NixOS configuration repository for Wayne’s LAN machines.
+
+## Hosts
+
+This flake currently defines:
+
+| Host | Purpose |
+|---|---|
+| `nixos` | Main NixOS workstation / desktop |
+| `docker` | Docker host for the main container stack |
+| `kuma` | Docker-enabled Uptime Kuma style host |
+| `server` | Storage / NFS / backup style server |
+| `nix-cache` | Local Nix binary cache host |
+| `nix-minimal` | Minimal NixOS host profile |
+
+List hosts with:
+
+```bash
+nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'

common/aliases.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, lib, ... }:
+
+let
+  mySwitchCmd = ''
+    sudo nixos-rebuild switch \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
+  '';
+  myTestCmd = ''
+    sudo nixos-rebuild test \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
+  '';
+in {
+  programs.bash = {
+    enable = true;
+    shellAliases = {
+      "Switch-nix" = mySwitchCmd;
+      "Test-nix" = myTestCmd;
+    };
+  };
+}

common/configuration.nix

@@ -49,18 +49,10 @@ users.users.root = {
 
   #Enable flakes
 
-  nix.settings.experimental-features = "nix-command flakes";
+  nix.settings = {
-
+    experimental-features = [ "nix-command" "flakes" ];
-nix.settings = {
+    auto-optimise-store = true;
-  substituters = [
+  };
-    "http://nix-cache"
-    "https://cache.nixos.org/"
-  ];
-  trusted-public-keys = [
-    "nix-ccache-1:<base32‑pubkey‑hash‑from‑cache-pub.pem>"
-    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-  ];
-};
 
 
   programs.git = {

common/home.nix

@@ -1,49 +1,60 @@
 { config, pkgs, lib, ... }:
 
 let
-  mySwitchCmd = ''
+  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
-    sudo nixos-rebuild switch \
+  localMount = "${config.home.homeDirectory}/proxmox-iso";
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
-  '';
-  myTestCmd = ''
-    sudo nixos-rebuild switch \
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
-  '';
 in {
+
+  imports = [
+    ./aliases.nix
+  ];
+
   home.username = "nixos";         # your actual username
   home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.05";        # match your NixOS stateVersion
+  home.stateVersion = "25.11";        # match your NixOS stateVersion
 
   programs.home-manager.enable = true;  # mandatory to activate HM
   
-programs.bash = {
+programs.bash.enable = true;
-  enable = true;
-  shellAliases = {
-    "Switch-nix" = mySwitchCmd;
-    "Test-nix" = mySwitchCmd;
-  };
-    initExtra = ''
-    # ensure loading of aliases/session variables
-    [[ -f ~/.profile ]] && . ~/.profile
-  '';
-};
   
+  home.file = {
+    ".config/nix/nix.conf".text = ''
+      access-tokens = github.com=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
+    '';
+  };
+
   # Optional: packages
   home.packages = with pkgs; [
     git
     vim
     tmux
+    nano
+    sshfs
   ];
 
   # Optional: set environment vars
   home.sessionVariables = {
-    EDITOR = "vim";
+    EDITOR = "nano";
   };
+  systemd.user.services.mount-proxmox-iso = {
+    Unit = {
+      Description = "Mount Proxmox ISO dir via SSHFS";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
 
+    Service = {
+      Type = "simple";
+      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+      Restart = "on-failure";
+    };
+
+    Install = {
+      WantedBy = [ "default.target" ];
+    };
+  };
   # Optional: enable bash (or zsh, fish...)
 #  programs.bash.enable = true;
 

docs/nix-cache.md

@@ -0,0 +1,48 @@
+# nix-cache architecture
+
+This repository configures `nix-cache` as a **binary cache server** and a **remote builder** for other hosts.
+
+## Important design notes
+
+- This is **not** a shared `/nix/store` setup.
+- Every machine still keeps and uses its own local `/nix/store`.
+- Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
+- Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
+
+## Binary cache signing keys (on nix-cache)
+
+```bash
+sudo install -d -m 0700 /etc/nix
+sudo nix-store --generate-binary-cache-key nix-cache-1   /etc/nix/cache-priv.pem   /etc/nix/cache-pub.pem
+sudo chmod 0600 /etc/nix/cache-priv.pem
+sudo chmod 0644 /etc/nix/cache-pub.pem
+cat /etc/nix/cache-pub.pem
+```
+
+Do not commit private keys.
+
+## Remote builder SSH keys
+
+On each client, install the private key used to authenticate as `nixremote`:
+
+```bash
+sudo install -d -m 0700 /root/.ssh
+sudo install -m 0600 ./nixremote /root/.ssh/nixremote
+sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+```
+
+On `nix-cache`, install the matching public key used by `nixremote` authorized keys.
+
+## Manual verification
+
+After deployment:
+
+```bash
+curl http://nix-cache/nix-cache-info
+nix store ping --store http://nix-cache
+nix show-config | grep -E 'substituters|trusted-public-keys|builders-use-substitutes'
+sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+nix build nixpkgs#hello --builders 'ssh://nixremote@nix-cache x86_64-linux /root/.ssh/nixremote 4 2 big-parallel,kvm,nixos-test,benchmark' -L
+nix path-info -r nixpkgs#hello
+curl -I "http://nix-cache/$(basename "$(nix path-info nixpkgs#hello)").narinfo"
+```

flake.lock

@@ -0,0 +1,189 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils-plus": {
+      "inputs": {
+        "flake-utils": "flake-utils"
+      },
+      "locked": {
+        "lastModified": 1696331477,
+        "narHash": "sha256-YkbRa/1wQWdWkVJ01JvV+75KIdM37UErqKgTf0L54Fk=",
+        "owner": "gytis-ivaskevicius",
+        "repo": "flake-utils-plus",
+        "rev": "bfc53579db89de750b25b0c5e7af299e0c06d7d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gytis-ivaskevicius",
+        "repo": "flake-utils-plus",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765860045,
+        "narHash": "sha256-7Lxp/PfOy4h3QIDtmWG/EgycaswqRSkDX4DGtet14NE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "09de9577d47d8bffb11c449b6a3d24e32ac16c99",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixos-conf-editor": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs",
+        "snowfall-lib": "snowfall-lib"
+      },
+      "locked": {
+        "lastModified": 1707338010,
+        "narHash": "sha256-UtLeZzDdk96sLTRcWsGrkWCslNUDytrGe0VmOTB/iig=",
+        "owner": "snowfallorg",
+        "repo": "nixos-conf-editor",
+        "rev": "27b5e92f580f794c690093503869aab242f075ab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "snowfallorg",
+        "repo": "nixos-conf-editor",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1698318101,
+        "narHash": "sha256-gUihHt3yPD7bVqg+k/UVHgngyaJ3DMEBchbymBMvK1E=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "63678e9f3d3afecfeafa0acead6239cdb447574c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1765779637,
+        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixos-conf-editor": "nixos-conf-editor",
+        "nixpkgs": "nixpkgs_2"
+      }
+    },
+    "snowfall-lib": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "flake-utils-plus": "flake-utils-plus",
+        "nixpkgs": [
+          "nixos-conf-editor",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1696432959,
+        "narHash": "sha256-oJQZv2MYyJaVyVJY5IeevzqpGvMGKu5pZcCCJvb+xjc=",
+        "owner": "snowfallorg",
+        "repo": "lib",
+        "rev": "92803a029b5314d4436a8d9311d8707b71d9f0b6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "snowfallorg",
+        "repo": "lib",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -1,17 +1,18 @@
 {
+  
   description = "LAN NixOS configs";
-
+  # GitHub tokens must be provided outside this repository (local nix.conf, env, or deployment secrets).
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixos-conf-editor.url = "github:snowfallorg/nixos-conf-editor";
     home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
   outputs = { self, nixpkgs, nixos-conf-editor, home-manager, ... } @ inputs:
-    let system = "x86_64-linux"; in {
+    let system = "x86_64-linux"; in { 
       nixosConfigurations = {
         # automatically use each host folder by name
         nixos    = nixpkgs.lib.nixosSystem {
@@ -26,6 +27,9 @@
                       
                     }
                    ];
+
+
+
                   specialArgs = { inherit inputs; };
                  };
         docker = nixpkgs.lib.nixosSystem {
@@ -40,6 +44,18 @@
                     }
                    ];
                  };
+        kuma = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/kuma/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+                 };
         server = nixpkgs.lib.nixosSystem {
                    inherit system;
                    modules = [
@@ -63,8 +79,21 @@
                       home-manager.users.nixos = import ./common/home.nix;
                     }
                    ];
+        
+                 };
+        nix-minimal = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/nix-minimal/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+        
                  };
-
       };
     };
 }

hosts/docker/configuration.nix

@@ -15,27 +15,85 @@ in
   imports =
     [ # Include the results of the hardware scan.
       ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
     ];
 
   networking.hostName = "docker"; # Define your hostname.
-  virtualisation.docker.enable = true;
+#  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+  enable = true;
+#  listenOptions = [
+#  "unix:///var/run/docker.sock"
+#  "tcp://0.0.0.0:2375"
+#];
 
+#  daemon.settings = {
+#    metrics-addr = "0.0.0.0:9323";
+#    experimental = true;
+#  };
+};
+  services.tailscale.enable = true;
   # Enable docker-compose
   environment.systemPackages = with pkgs; [
   docker-compose
+  docker_25
+  nfs-utils
   ];
 
+  services.logrotate = {
+    enable = true;
+
+    settings = {
+      "/mnt/docker-persistent-data/docker/core/traefik/data/logs/*.log" = {
+        daily = true;
+        size = "100M";
+        rotate = 20;
+        compress = true;
+        missingok = true;
+        notifempty = true;
+        copytruncate = true;
+      };
+
+     };
+  };
+
+
+boot.supportedFilesystems = [ "nfs" ];
+services.rpcbind.enable = true;
+
   # Mount docker persistent data
   fileSystems."/mnt/docker-persistent-data" = {
     device = "/dev/disk/by-label/docker-data";
     fsType = "ext4";
     options = [ "defaults" "nofail" "noatime" ];
   };
+fileSystems."/mnt/raspi" = {
+  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
+  fsType = "nfs4";
+  options = [
+    "nofail"
+    "_netdev"
+    "noatime"
+
+    # Don't mount until first access
+    "x-systemd.automount"
+
+    # Unmount after 10 min idle
+    "x-systemd.idle-timeout=600"
+
+    # Give the Pi/Tailscale a little time to appear
+    "x-systemd.device-timeout=10s"
+
+    # Explicitly use NFSv4.2 if supported
+    "nfsvers=4.2"
+  ];
+};
 
 # Create nextcloud cron scheduled task
 systemd.services.nextcloud = {
   description = "Nextcloud scheduled task";
-  script = ''docker-compose -f ~/docker/nextcloud/docker-compose.yml exec -u 33 webapp php ./cron.php'';
+  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
   serviceConfig = {
     Type = "oneshot";
     User = "nixos";
@@ -81,6 +139,35 @@ systemd.timers.update-containers = {
   };
 };
 
+# Create Gotify Docker monitoring script task
+
+  systemd.services.docker-health-to-gotify = {
+    description = "Alert Gotify when Docker containers become unhealthy";
+    after = [ "docker.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      # Run as root so it can read /etc/secrets and access docker socket
+     # User = "root";
+      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
+      ExecStart = "${pkgs.bash}/bin/bash /mnt/docker-persistent-data/docker/gotify/docker-health-to-gotify.sh";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+    path = with pkgs; [ docker curl coreutils gnused ];
+  };
+
+  systemd.timers.docker-health-to-gotify = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "2min";
+      OnUnitActiveSec = "1min";
+      AccuracySec = "15s";
+      Persistent = true;
+    };
+  };
+
+
+
 #Add sym links to data on users home folder
 system.userActivationScripts.createDockerSymlink.text = ''
   ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
@@ -93,11 +180,11 @@ system.userActivationScripts.createSetupSymlink.text = ''
   services.openssh.settings.PermitRootLogin = "yes";
 
   # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 9323 ];
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
-
+ 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.

hosts/kuma/configuration.nix

@@ -0,0 +1,79 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    docker
+    pytz
+  ]);
+in
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "kuma"; # Define your hostname.
+  virtualisation.docker.enable = true;
+
+  # Enable docker-compose
+  environment.systemPackages = with pkgs; [
+  docker-compose
+  docker_25
+  ];
+
+  # Mount docker persistent data
+  # fileSystems."/mnt/docker-persistent-data" = {
+  #   device = "/dev/disk/by-label/docker-data";
+  #   fsType = "ext4";
+  #   options = [ "defaults" "nofail" "noatime" ];
+  # };
+
+
+#Add sym links to data on users home folder
+# system.userActivationScripts.createDockerSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
+# '';
+# system.userActivationScripts.createSetupSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/setup /home/nixos/setup
+# '';
+
+  users.users.nixos.extraGroups = [ "docker" ];
+  services.openssh.settings.PermitRootLogin = "yes";
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nix-cache/configuration.nix

@@ -8,22 +8,16 @@
   imports =
     [ # Include the results of the hardware scan.
       ../../common/configuration.nix
+      ../../modules/nix/cache-server.nix
     ];
 
   networking.hostName = "nix-cache"; # Define your hostname.
 
-  services.nix-serve.enable = true;
+services.prometheus.exporters.node = {
-  services.nix-serve.secretKeyFile = "/etc/nix/cache-priv.pem";
+  enable = true;
+  openFirewall = true;
+};
 
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts."cache.local" = {
-      locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ config.services.nginx.defaultHTTPListenPort ];
   # Open ports in the firewall.
 #  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
   # networking.firewall.allowedUDPPorts = [ ... ];

hosts/nix-minimal/configuration.nix

@@ -0,0 +1,78 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "nix-minimal"; # Define your hostname.
+
+  environment.systemPackages = with pkgs; [
+    sshfs
+    fuse3 # needed for modern sshfs
+  ];
+
+  # Enable FUSE (if not already)
+  boot.extraModprobeConfig = ''
+    options fuse user_allow_other
+  '';
+
+  # Allow mounting with user permissions (optional, see note)
+  # security.wrappers.sshfs = {
+  #   source = "${pkgs.sshfs}/bin/sshfs";
+  #   owner = "nixos";
+  #   group = "users";
+  #   permissions = "4755";
+  
+  # fileSystems."/mnt/proxmox-iso" = {
+  #   device = "root@pve:/var/lib/vz/template/iso";
+  #   fsType = "fuse.sshfs";
+  #   options = [
+  #     "IdentityFile=/home/nixos/.ssh/id_ed25519.pub"   # or your SSH key path
+  #     "allow_other"
+  #     "reconnect"
+  #     "ServerAliveInterval=15"
+  #     "ServerAliveCountMax=3"
+  #     "StrictHostKeyChecking=no"         # only if you're OK with this
+  #   ];
+  # };
+  # };
+
+
+  # Open ports in the firewall.
+#  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nixos/configuration.nix

@@ -2,7 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, lib, inputs,... }:
+{ config, pkgs, lib, inputs, ... }:
 let
     nixosConfEditor = builtins.getFlake "github:snowfallorg/nixos-conf-editor";
 in {
@@ -12,7 +12,15 @@ in {
       nodejs
       appimage-run
       seahorse
-
+      vscode
+      p7zip
+      popsicle  # balena-etcher
+      shotcut
+      gimp
+      pdfarranger
+      terminator
+      libreoffice-qt
+      transmission_4-qt
     ];
 
 
@@ -20,6 +28,8 @@ in {
   imports =
     [ # Include the results of the hardware scan.
       ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
     ];
 
   # Bootloader.
@@ -86,11 +96,22 @@ in {
 
   system.stateVersion = "25.05"; # Did you read the comment?
 
-
-  nix.settings.experimental-features = "nix-command flakes";
 services.xrdp.enable = true;
 services.xrdp.defaultWindowManager = "cinnamon-session";
 services.xrdp.openFirewall = true;
+nixpkgs.config.allowUnfree = true;
+
+services.gnome.gnome-keyring.enable = true;
+
+# security.pam.services.lightdm.enableGnomeKeyring = true;
+
+# services.gnome.gnome-keyring.enable = true;
+security.pam.services.login.enableGnomeKeyring = true;
+
+  services.xserver.displayManager.sessionCommands = ''
+    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+    export SSH_AUTH_SOCK
+  '';
 
 # systemd.services.nextcloud-appimage = {
 #   enable = true;

hosts/nixos/home.nix

@@ -1,6 +1,11 @@
 { config, pkgs, lib, ... }:
 
 {
+
+    imports = [
+    ../../common/aliases.nix
+  ];
+
   home.username = "nixos";         # your actual username
   home.homeDirectory = "/home/nixos";
   home.stateVersion = "25.05";        # match your NixOS stateVersion
@@ -13,6 +18,8 @@
     vim
     tmux
     nextcloud-client
+#    vscode
+    chromium
   ];
 
   # Optional: set environment vars
@@ -27,5 +34,46 @@
     # Optionally start in background directly
     startInBackground = true;
   };
+home.file = {
+  ".local/share/applications/proxmox-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Chromium)
+    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Chromium)
+    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
 
+  '';
+  ".local/share/applications/proxmox-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Firefox)
+    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Firefox)
+    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
+    StartupWMClass=PBS
+  '';
+};
 }

hosts/server/configuration.nix

@@ -8,6 +8,8 @@
   imports =
     [ # Include the results of the hardware scan.
       ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
     ];
 
   networking.hostName = "server"; # Define your hostname.
@@ -59,29 +61,62 @@ services.nfs.server = {
   };
 
 
-  systemd.services.backup = {
+ # systemd.services.backup = {
-    description = "Backup data";
+ #   description = "Backup data";
-    wantedBy = [ "multi-user.target" ];
+ #   wantedBy = [ "multi-user.target" ];
 
-    serviceConfig = {
+#    serviceConfig = {
-      Type = "oneshot";
+#      Type = "oneshot";
-      User = "root";
+#      User = "root";
 #      WorkingDirectory = "/home/nixos/scripts";
-      ExecStart = "${pkgs.bash}/bin/bash -e /srv/scripts/rsync.sh";
+#      ExecStart = "${pkgs.bash}/bin/bash -e /srv/scripts/rsync.sh";
-      StandardOutput = "journal";
+#      StandardOutput = "journal";
-      StandardError = "journal";
+#      StandardError = "journal";
-    };
+#    };
-path = with pkgs; [ bash rsync openssh coreutils ];
+#path = with pkgs; [ bash rsync openssh coreutils ];
-  };
+#  };
 
 
-systemd.timers.backup = {
+#systemd.timers.backup = {
-  description = "Daily backup";
+#  description = "Daily backup";
-  wantedBy = [ "timers.target" ];
+#  wantedBy = [ "timers.target" ];
-  timerConfig = {
+#  timerConfig = {
-    OnUnitActiveSec = "1d";       # Run every day after last run
+#    OnUnitActiveSec = "1d";       # Run every day after last run
-    Persistent = true;            # Catch up if system was off
+#    Persistent = true;            # Catch up if system was off
+#  };
+#};
+
+#  networking.wireguard.enable = true;
+#  networking.wireguard.interfaces.wg0 = {
+#    ips = [ "10.100.0.254/24" ];
+#    listenPort = 51820;
+#    privateKeyFile = "/etc/wireguard/server.key";
+
+#    peers = [
+#      {
+#        publicKey = "cA30PTE/2gMbIhtAXaRPJkQeDc7/UWoA6eK3K+Xpsww=";
+#        allowedIPs = [ "10.100.0.2/32" ];
+#      }
+#    ];
+#  };
+
+  # Allow WireGuard UDP port in firewall
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  # Enable IPv4 forwarding
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
   };
+
+  # NAT: lets LAN devices reply to the Pi without needing routes on the LAN router
+  networking.nat = {
+    enable = true;
+    externalInterface = "enp0s18";
+    internalInterfaces = [ "wg0" ];
+  };
+services.prometheus.exporters.node = {
+  enable = true;
+  openFirewall = true;
 };
 
   services.openssh.settings.PermitRootLogin = "yes";

modules/nix/cache-client.nix

@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  nix.settings = {
+    substituters = [
+      "http://nix-cache"
+      "https://cache.nixos.org/"
+    ];
+    trusted-public-keys = [
+      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+    auto-optimise-store = true;
+  };
+}

modules/nix/cache-server.nix

@@ -0,0 +1,58 @@
+{ config, pkgs, ... }:
+
+{
+  # Generate the binary cache key pair on the nix-cache host:
+  #   sudo install -d -m 0700 /etc/nix
+  #   sudo nix-store --generate-binary-cache-key nix-cache-1 \
+  #     /etc/nix/cache-priv.pem \
+  #     /etc/nix/cache-pub.pem
+  #   sudo chmod 0600 /etc/nix/cache-priv.pem
+  #   sudo chmod 0644 /etc/nix/cache-pub.pem
+  #   cat /etc/nix/cache-pub.pem
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = "/etc/nix/cache-priv.pem";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."nix-cache" = {
+      locations."/" = {
+        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  users.groups.nixremote = {};
+
+  users.users.nixremote = {
+    isSystemUser = true;
+    group = "nixremote";
+    createHome = true;
+    home = "/var/lib/nixremote";
+    shell = pkgs.bashInteractive;
+    # Provide remote builder public keys here (safe to commit public keys only):
+    # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
+    #
+    # Avoid absolute keyFiles paths here because they break pure flake evaluation.
+    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" ];
+  };
+
+  services.openssh.enable = true;
+
+  nix.settings = {
+    trusted-users = [ "root" "nixremote" ];
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    builders-use-substitutes = true;
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+}

modules/nix/remote-builder-client.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  # Install the remote builder key on each client host (do not commit private keys):
+  #   sudo install -d -m 0700 /root/.ssh
+  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
+  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+  nix.distributedBuilds = true;
+
+  nix.buildMachines = [
+    {
+      hostName = "nix-cache";
+      sshUser = "nixremote";
+      sshKey = "/root/.ssh/nixremote";
+      system = pkgs.stdenv.hostPlatform.system;
+      maxJobs = 4;
+      speedFactor = 2;
+      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    }
+  ];
+
+  nix.settings = {
+    builders-use-substitutes = true;
+    max-jobs = "auto";
+  };
+}

prepare.sh

@@ -17,13 +17,14 @@ swapon /dev/sda2
 
 #mount nixos partition
 mount /dev/disk/by-label/nixos /mnt
-
+export TMPDIR=/mnt/install-tmp
+mkdir -p /mnt/install-tmp
 #Generate config
-nixos-generate-config --root /mnt/
+#nixos-generate-config --root /mnt/
 
 #copy customised configuration over
-cp configuration.nix /mnt/etc/nixos/configuration.nix
+#cp configuration.nix /mnt/etc/nixos/configuration.nix
 
-nixos-install --no-root-passwd
+#nixos-install --no-root-passwd
 
-reboot
+#reboot

scripts/codex-maintenance.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export NIX_CONFIG="${NIX_CONFIG:-}
+experimental-features = nix-command flakes
+accept-flake-config = false
+warn-dirty = false
+"
+
+MODE="${1:-validate}"
+
+ensure_nix_profile() {
+  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+  fi
+}
+
+ensure_nix_profile
+
+if ! command -v nix >/dev/null 2>&1; then
+  echo "ERROR: nix is not available in PATH. Run bash scripts/codex-setup.sh first." >&2
+  exit 127
+fi
+
+hosts_json="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames)"
+hosts="$(echo "$hosts_json" | jq -r '.[]')"
+
+echo "Hosts:"
+echo "$hosts"
+
+echo
+echo "Checking for obvious committed secrets..."
+if grep -RInE 'github_pat_|ghp_|access-tokens|hashedPassword[[:space:]]*=' \
+  --exclude-dir=.git \
+  --exclude=flake.lock \
+  .; then
+  echo
+  echo "WARNING: Potential secrets or password hashes found. Review before committing."
+else
+  echo "No obvious token patterns found."
+fi
+
+echo
+echo "Checking Nix formatting with nixpkgs-fmt..."
+nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#nixpkgs-fmt -- --check .
+
+echo
+echo "Running statix lint..."
+nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#statix -- check .
+
+echo
+echo "Evaluating host toplevel derivations..."
+for host in $hosts; do
+  echo "==> $host"
+  nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+done
+
+if [[ "$MODE" == "dry-run" ]]; then
+  echo
+  echo "Running dry-run builds for all hosts. This will not create result symlinks."
+  for host in $hosts; do
+    echo "==> Dry-run build: $host"
+    nix build --dry-run --no-link --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel"
+  done
+fi
+
+echo
+echo "Maintenance checks complete."

scripts/codex-setup.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export NIX_CONFIG="${NIX_CONFIG:-}
+experimental-features = nix-command flakes
+accept-flake-config = false
+warn-dirty = false
+"
+
+ensure_nix_profile() {
+  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+  fi
+}
+
+install_nix_if_missing() {
+  if command -v nix >/dev/null 2>&1; then
+    return
+  fi
+
+  echo "Nix not found. Installing Nix..."
+
+  if [ "$(id -u)" -eq 0 ]; then
+    echo "Running as root; preparing nixbld users for container/Codex environment..."
+
+    if ! getent group nixbld >/dev/null; then
+      groupadd -r nixbld
+    fi
+
+    for i in $(seq 1 10); do
+      if ! id "nixbld$i" >/dev/null 2>&1; then
+        useradd \
+          -r \
+          -g nixbld \
+          -G nixbld \
+          -d /var/empty \
+          -s /usr/sbin/nologin \
+          "nixbld$i" || true
+      fi
+    done
+
+    mkdir -p /etc/nix
+    cat > /etc/nix/nix.conf <<'EOF'
+experimental-features = nix-command flakes
+accept-flake-config = false
+warn-dirty = false
+build-users-group = nixbld
+EOF
+
+    sh <(curl -L https://nixos.org/nix/install) --no-daemon
+  else
+    sh <(curl -L https://nixos.org/nix/install) --no-daemon
+  fi
+
+  ensure_nix_profile
+}
+
+install_nix_if_missing
+ensure_nix_profile
+
+mkdir -p "$HOME/.config/nix"
+cat > "$HOME/.config/nix/nix.conf" <<'EOF'
+experimental-features = nix-command flakes
+accept-flake-config = false
+warn-dirty = false
+EOF
+
+echo "Nix version:"
+nix --version
+
+echo "Installing jq if unavailable..."
+if ! command -v jq >/dev/null 2>&1; then
+  nix profile install nixpkgs#jq
+fi
+
+echo "Available NixOS hosts:"
+hosts="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
+echo "$hosts"
+
+echo "Evaluating all host toplevel derivations..."
+for host in $hosts; do
+  echo "==> Evaluating $host"
+  nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+done
+
+echo "Codex setup complete."