updated authorized keys

Add Nix cache / remote-builder modules, wire hosts, and harden maintenance scripts

.gitea/workflows/check-nixos.yml

@@ -1,29 +0,0 @@
-name: Check NixOS configurations
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  eval-hosts:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v19
-
-      - name: Evaluate all NixOS hosts
-        run: |
-          set -euo pipefail
-          hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \
-            .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
-          for host in $hosts; do
-            echo "Evaluating ${host}"
-            nix --extra-experimental-features 'nix-command flakes' eval \
-              ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw
-          done

.gitea/workflows/update-flake-lock.yml

@@ -1,32 +0,0 @@
-name: Update flake.lock
-
-on:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-
-jobs:
-  update-flake-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v19
-
-      - name: Update and commit flake.lock
-        run: |
-          set -euo pipefail
-          nix --extra-experimental-features 'nix-command flakes' flake update
-
-          if git diff --quiet -- flake.lock; then
-            echo "No flake.lock changes detected"
-            exit 0
-          fi
-
-          git config user.name "gitea-actions"
-          git config user.email "gitea-actions@nix-cache.local"
-          git add flake.lock
-          git commit -m "chore: update flake.lock"
-          git push

.githooks/pre-commit

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-# Blocks commits containing secrets. Installed via:
-#   git config core.hooksPath .githooks
-# (scripts/codex-setup.sh does this automatically in Codex sessions.)
-set -euo pipefail
-
-if command -v gitleaks >/dev/null 2>&1; then
-  gitleaks protect --staged -v
-else
-  nix-shell -p gitleaks --run "gitleaks protect --staged -v"
-fi

.github/workflows/check-nixos.yml

@@ -1,29 +0,0 @@
-name: Check NixOS configurations
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  eval-hosts:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v19
-
-      - name: Evaluate all NixOS hosts
-        run: |
-          set -euo pipefail
-          hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \
-            .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
-          for host in $hosts; do
-            echo "Evaluating ${host}"
-            nix --extra-experimental-features 'nix-command flakes' eval \
-              ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw
-          done

.github/workflows/update-flake-lock.yml

@@ -1,37 +0,0 @@
-name: Update flake.lock
-
-on:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update-flake-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@v19
-
-      - name: Update flake.lock
-        run: |
-          nix --extra-experimental-features 'nix-command flakes' flake update
-
-      - name: Create pull request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          add-paths: flake.lock
-          branch: chore/update-flake-lock
-          title: "chore: update flake.lock"
-          commit-message: "chore: update flake.lock"
-          body: |
-            This is an automated update of `flake.lock` generated by the scheduled workflow.
-            
-            It updates pinned flake inputs so dependency updates can be reviewed and merged via PR.

.gitignore

@@ -9,7 +9,3 @@ result-*
 auto-installer/flake.lock
 auto-installer/result
 auto-installer/nixos-auto.iso
-
-# Temporary Milestone 1 audit checklist (remove-sensetive-info-refactor.md)
-# - working notes only, never committed, deleted once every row is rotated.
-secrets-inventory.md

.sops.yaml

@@ -1,36 +0,0 @@
-keys:
-  - &admin age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
-  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
-  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-
-creation_rules:
-  # Shared across every currently-deployed host: root/nixos password hash,
-  # GitHub access token. Same value on every host today, so every live host's
-  # key can decrypt it (matches current risk profile — narrow further in
-  # Milestone 4 if hosts should diverge).
-  - path_regex: secrets/common\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *docker
-          - *server
-          - *nix-cache
-
-  - path_regex: secrets/nix-cache\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *nix-cache
-
-  - path_regex: secrets/server\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *server
-
-  - path_regex: secrets/docker\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *docker

AGENTS.md

@@ -2,31 +2,26 @@
 
 ## Repo purpose
 
-This repository contains flake-based NixOS configurations for Wayne's LAN
-servers and workstation.
+This repository contains flake-based NixOS configurations for Wayne’s LAN servers and workstation.
 
-The flake exposes NixOS configurations named `<platform>-<buildtype>`
-(platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`), generated from `modules/platforms/*`
-and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
-every combination is built — `pxe-boot` has no `linode` variant. See
-`README.md` for the full current target list; treat `flake.nix` as the
-source of truth since this list can drift.
+The flake currently exposes these NixOS configurations:
 
-Do not deploy, switch, reboot, repartition, format disks, or run destructive
-install commands from this repository unless explicitly asked.
+- `nixos`
+- `docker`
+- `kuma`
+- `server`
+- `nix-cache`
+- `nix-minimal`
+
+Do not deploy, switch, reboot, repartition, format disks, or run destructive install commands from this repository unless explicitly asked.
 
 ## Safety rules
 
-- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`,
-  `mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
-- Validation work should be limited to evaluation, linting, formatting checks,
-  and `nix build --dry-run --no-link`.
-- Do not add secrets, tokens, private keys, password hashes, or live credentials
-  to the repo.
+- Never run `nixos-rebuild switch`, `boot`, `test`, `nixos-install`, `parted`, `mkfs`, `mkswap`, `swapon`, `mount`, or destructive disk commands in Codex.
+- Validation work should be limited to evaluation, linting, formatting checks, and `nix build --dry-run --no-link`.
+- Do not add secrets, tokens, private keys, password hashes, or live credentials to the repo.
 - Treat `flake.nix`, Home Manager config, and Nix config files as public.
-- If you find committed tokens or hashes, flag them immediately and recommend
-  rotation/removal.
+- If you find committed tokens or hashes, flag them immediately and recommend rotation/removal.
 
 ## Expected commands
 
@@ -36,10 +31,3 @@ Use these commands when validating changes:
 bash scripts/codex-setup.sh
 bash scripts/codex-maintenance.sh
 bash scripts/codex-maintenance.sh dry-run
-```
-
-Host evaluation is safe when limited to drvPath checks:
-
-```bash
-nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
-```

CLAUDE.md

@@ -1,114 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Repo purpose
-
-Flake-based NixOS configuration for Wayne's LAN servers and workstation. There is
-no application code here — changes are Nix module edits that affect real
-machines when deployed.
-
-## Safety rules (read before touching anything)
-
-- **Never** run `nixos-rebuild switch|boot|test`, `nixos-install`, `parted`,
-  `mkfs`, `mkswap`, `swapon`, `mount`, or any other destructive disk/deploy
-  command from an agent session, even if asked indirectly. Deployment is done
-  manually by the operator on the target host.
-- Validation is limited to evaluation, linting, formatting checks, and
-  `nix build --dry-run --no-link`.
-- Do not add secrets, tokens, private keys, or new password hashes to the repo.
-- This repo currently contains **committed password hashes** (e.g.
-  `prepare.sh`, `hosts/nixos/configuration.nix`) and SSH public keys (e.g.
-  `modules/nix-cache/server.nix`). The hashes are known tech debt — do not use
-  them as a template for new hosts, and flag any *new* secret-like string you
-  encounter instead of committing it.
-
-## Commands
-
-```bash
-# One-time environment bootstrap (installs Nix if missing, prints hosts)
-bash scripts/codex-setup.sh
-
-# Full validation: secret grep, nixpkgs-fmt --check, statix lint, eval all hosts
-bash scripts/codex-maintenance.sh
-
-# Same, plus a dry-run build (no result symlink) of every host's toplevel
-bash scripts/codex-maintenance.sh dry-run
-
-# List the hosts the flake currently exposes
-nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
-
-# Evaluate a single host without building (fast sanity check)
-nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
-
-# Dry-run build a single host
-nix build --dry-run --no-link .#nixosConfigurations.<host>.config.system.build.toplevel
-```
-
-Formatting/lint tools (`nixpkgs-fmt`, `statix`) are not installed locally; the
-maintenance script pulls them via `nix run github:NixOS/nixpkgs/nixos-25.11#<tool>`.
-There is no test suite — "correctness" here means the flake evaluates and
-`nixpkgs-fmt`/`statix` are clean.
-
-## Architecture
-
-`flake.nix` is the single entry point. It defines one `nixosConfigurations.<host>`
-attribute per machine, each built the same way:
-
-```
-nixosSystem {
-  modules = [
-    disko.nixosModules.disko
-    ./hosts/<host>/configuration.nix        # host-specific config
-    ./modules/hardware-configuration/vm/<proxmox|linode>.nix
-    home-manager.nixosModules.home-manager { ... }
-  ];
-}
-```
-
-Hosts currently defined in `flake.nix`: `nixos`, `docker`, `server`,
-`nix-cache`, `nix-minimal`, `pxe-boot`, `linode-minimal`. Treat `flake.nix` as
-the source of truth for which hosts exist — `README.md`, `AGENTS.md`,
-`docs/flake-lock-automation.md`, and the CI eval workflows
-(`.github/workflows/check-nixos.yml`, `.gitea/workflows/check-nixos.yml`) list
-hosts by hand and can drift from it, so re-check them against `flake.nix` when
-adding or removing a host.
-
-### Composition pattern
-
-Every host's real configuration lives in `hosts/<host>/configuration.nix`,
-which is a thin list of `imports` pulling in reusable pieces from `modules/`:
-
-- `modules/common/configuration.nix` — base NixOS config imported by (almost)
-  every host: locale, users, nix settings, git. Nearly always the first import.
-- `modules/common/home.nix` / `hosts/<host>/home.nix` — Home Manager config for
-  the `nixos` user; the `nixos` workstation has its own, other hosts share
-  `modules/common/home.nix`.
-- `modules/disko/proxmox.nix` — declarative disk layout (GPT: ESP + swap +
-  ext4 root) via disko, used by all Proxmox-VM hosts.
-- `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
-- `modules/hardware-configuration/vm/{proxmox,linode}.nix` — hypervisor-specific
-  hardware config, wired in from `flake.nix` (not from the host file).
-- `modules/nix-cache/{client,server}.nix` + `modules/remote-builder-client.nix` —
-  binary cache substituter + SSH remote-builder wiring; see `docs/nix-cache.md`
-  for the full design (per-host local stores, no shared `/nix/store`, and how
-  the `nixremote` signing/SSH keys fit together).
-- `modules/tailscale/`, `modules/docker/`, `modules/beszel/`,
-  `modules/services/*` — single-purpose, single-host feature modules (e.g.
-  `docker/enable-service.nix`, `services/zfs/enable-service.nix`,
-  `beszel/enable-agent.nix` for monitoring). Grep `hosts/*/configuration.nix`
-  for the `imports` list to see which modules apply to a given host.
-
-New host = new `hosts/<name>/configuration.nix` + a matching block added to
-`flake.nix`'s `nixosConfigurations`, composed from existing `modules/*` pieces
-rather than duplicating config.
-
-### Other docs worth reading before touching these areas
-
-- `docs/nix-cache.md` — nix-cache binary cache/remote-builder design and key
-  handling.
-- `docs/pxe-boot.md` — the `pxe-boot` host's iPXE/TFTP/HTTP boot chain and
-  directory layout under `/srv/pxe`.
-- `docs/flake-lock-automation.md` — how `flake.lock` updates flow through CI
-  (scheduled `nix flake update` PR + host-eval-on-PR workflow) and why hosts
-  should track the committed lock file rather than `nixos-rebuild --upgrade-all`.

README.md

@@ -1,110 +1,25 @@
+
+## `README.md`
+
+```markdown
 # NixOS LAN Configurations
 
-Flake-based NixOS configuration repository for Wayne's LAN servers and
-workstation.
+Flake-based NixOS configuration repository for Wayne’s LAN machines.
 
 ## Hosts
 
-Targets are named `<platform>-<buildtype>`, generated from two orthogonal
-pieces composed in `flake.nix`:
+This flake currently defines:
 
-- **Platforms** (what it runs on): `linode`, `proxmox`, `lxc`
-- **Build types** (what it's for): `minimal`, `nix-cache`, `server`, `docker`,
-  `gui`, `pxe-boot`
-
-Not every combination exists — `pxe-boot` has no `linode` variant, since
-PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have. The full
-list:
-
-| Target | Purpose |
-| --- | --- |
-| `linode-minimal` | Minimal NixOS host profile on a Linode VPS (real, deployed) |
-| `proxmox-minimal` | Minimal NixOS host profile on Proxmox (real, deployed — previously the flat `nix-minimal` target) |
-| `lxc-minimal` | Minimal NixOS host profile in a Proxmox LXC container |
-| `linode-nix-cache` / `proxmox-nix-cache` / `lxc-nix-cache` | Local Nix binary cache and remote builder (`proxmox-nix-cache` is the real, deployed one — previously the flat `nix-cache` target) |
-| `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host (`proxmox-server` is the real, deployed one — previously the flat `server` target) |
-| `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack (`proxmox-docker` is the real, deployed one — previously the flat `docker` target) |
-| `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation (`proxmox-gui` is the real, deployed one — previously the flat `nixos` target) |
-| `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host (`proxmox-pxe-boot` is the real, deployed one — previously the flat `pxe-boot` target) |
-
-Each buildtype's `hosts/<name>/host.nix` carries the per-machine identity
-(hostname, hostId, per-machine secrets, `system.stateVersion`) that must stay
-fixed regardless of which platform it's built for — see
-`flake-target-refactor-spec.md` for the full rationale. Every deployed host
-stamps its own active target name into `/etc/flake-target` at build time, so
-`nixos-rebuild switch --flake .#$(cat /etc/flake-target)` always picks up the
-right one even after a platform migration changes the flake attribute name.
+| Host | Purpose |
+|---|---|
+| `nixos` | Main NixOS workstation / desktop |
+| `docker` | Docker host for the main container stack |
+| `kuma` | Docker-enabled Uptime Kuma style host |
+| `server` | Storage / NFS / backup style server |
+| `nix-cache` | Local Nix binary cache host |
+| `nix-minimal` | Minimal NixOS host profile |
 
 List hosts with:
 
 ```bash
 nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
-```
-
-## Layout
-
-| Path | Purpose |
-| --- | --- |
-| `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
-| `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
-| `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
-| `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |
-| `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache |
-| `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
-| `modules/nix-cache/` | Binary cache and remote builder client/server modules |
-| `docs/` | Operational notes for cache, builders, lock updates, and boot services |
-| `scripts/` | Codex setup and validation helpers |
-
-## Validation
-
-Safe validation commands for Codex and local review:
-
-```bash
-bash scripts/codex-setup.sh
-bash scripts/codex-maintenance.sh dry-run
-bash scripts/codex-maintenance.sh
-```
-
-For individual host evaluation:
-
-```bash
-nix eval .#nixosConfigurations.<host>.config.system.build.toplevel.drvPath --raw
-```
-
-Use `nix build --dry-run --no-link` when build planning is needed. Do not run
-deployment, install, disk formatting, mount, or reboot commands from automated
-review sessions.
-
-## Operations
-
-- Host rebuilds should consume the committed `flake.lock`.
-- Routine dependency updates should happen through the flake lock automation
-  described in `docs/flake-lock-automation.md`.
-- `nix-cache` serves substitutes over HTTP and can act as a remote builder for
-  client hosts.
-- `pxe-boot` serves iPXE boot files over HTTP from `/srv/pxe`.
-
-## Security Notes
-
-Do not commit tokens, private keys, live credentials, or new password hashes
-as plaintext. Secrets are managed with [sops-nix](https://github.com/Mic92/sops-nix):
-encrypted files live under `secrets/`, recipients (per-host age keys derived
-from each host's existing SSH host key, plus an admin key) are declared in
-`.sops.yaml`. To add or edit a secret:
-
-```bash
-nix-shell -p sops --run "sops secrets/<file>.yaml"
-```
-
-then reference it from a module via `config.sops.secrets."<name>".path`
-(or `sops.templates` for values that need to be embedded in a rendered
-config file, e.g. `nix.conf`'s `access-tokens`). Never write a secret value
-directly into a tracked `.nix` file. A pre-commit hook (`.githooks/`,
-enabled via `git config core.hooksPath .githooks`, done automatically by
-`scripts/codex-setup.sh`) runs `gitleaks protect --staged` to catch mistakes
-before they're committed.
-
-This repository's git *history* still contains secrets committed before this
-migration (see `remove-sensetive-info-refactor.md`) — those are being
-scrubbed and rotated separately; don't treat the repo as safe to make public
-until that's finished.

common/aliases.nix

@@ -1,24 +1,19 @@
 { config, pkgs, lib, ... }:
 
 let
-  # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
-  # and no longer match networking.hostName, since a host's hostname stays
-  # fixed while the platform backing it can change. Each nixosConfiguration
-  # stamps its own active target name into /etc/flake-target at build time.
   mySwitchCmd = ''
     sudo nixos-rebuild switch \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
   '';
   myTestCmd = ''
     sudo nixos-rebuild test \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
   '';
-in
-{
+in {
   programs.bash = {
     enable = true;
     shellAliases = {

common/configuration.nix

@@ -3,12 +3,12 @@
 {
     imports =
     [ # Include the results of the hardware scan.
-#      ./hardware-configuration.nix
-      ../set-locale.nix
+      ./hardware-configuration.nix
+      
     ];
   # Use the GRUB 2 boot loader.
-  # boot.loader.grub.enable = true;
-  #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
   networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
 
@@ -25,31 +25,9 @@
   git
   gcr
   ];
-
-  # Secrets shared by every host, decrypted at activation via each host's
-  # existing SSH host key (sops-nix derives the age key from
-  # /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
-  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
-  # neededForUsers so they're available before the normal secret-activation
-  # step, since user creation happens very early in boot.
-  sops.defaultSopsFile = ../../secrets/common.yaml;
-  sops.secrets."root-hashedPassword".neededForUsers = true;
-  sops.secrets."nixos-hashedPassword".neededForUsers = true;
-  sops.secrets."nix-github-token" = { };
-
-  # nix.conf doesn't support a *File-style option for access-tokens, so the
-  # token is rendered into a runtime-only file (never touches the Nix store)
-  # and pulled in via nix.conf's native !include directive.
-  sops.templates."nix-github-token.conf".content = ''
-    access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
-  '';
-  nix.extraOptions = ''
-    !include ${config.sops.templates."nix-github-token.conf".path}
-  '';
-
 #Set root password
 users.users.root = {
-  hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+  hashedPassword = "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
 };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
@@ -59,11 +37,10 @@ users.users.root = {
     packages = with pkgs; [
       tree
     ];
-    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
+    hashedPassword = "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
     openssh.authorizedKeys.keys = [
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-    ];
+  ];
   };
 
 

common/hardware-configuration.nix

@@ -10,18 +10,17 @@
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
-  # boot.loader.grub.device = "/dev/sda2"; # or "nodev" for efi only
 
-  # fileSystems."/" =
-  #   { device = "/dev/disk/by-label/nixos";
-  #     fsType = "ext4";
-  #   };
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+    };
 
-  # swapDevices =
-  #   [ { device = "/dev/disk/by-label/swap"; }
-  #   ];
+  swapDevices =
+    [ { device = "/dev/disk/by-label/swap"; }
+    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

common/home.nix

@@ -0,0 +1,66 @@
+{ config, pkgs, lib, ... }:
+
+let
+  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
+  localMount = "${config.home.homeDirectory}/proxmox-iso";
+in {
+
+  imports = [
+    ./aliases.nix
+  ];
+
+  home.username = "nixos";         # your actual username
+  home.homeDirectory = "/home/nixos";
+  home.stateVersion = "25.11";        # match your NixOS stateVersion
+
+  programs.home-manager.enable = true;  # mandatory to activate HM
+  
+programs.bash.enable = true;
+  
+  home.file = {
+    ".config/nix/nix.conf".text = ''
+      access-tokens = github.com=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
+    '';
+  };
+
+  # Optional: packages
+  home.packages = with pkgs; [
+    git
+    vim
+    tmux
+    nano
+    sshfs
+  ];
+
+  # Optional: set environment vars
+  home.sessionVariables = {
+    EDITOR = "nano";
+  };
+  systemd.user.services.mount-proxmox-iso = {
+    Unit = {
+      Description = "Mount Proxmox ISO dir via SSHFS";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+
+    Service = {
+      Type = "simple";
+      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+      Restart = "on-failure";
+    };
+
+    Install = {
+      WantedBy = [ "default.target" ];
+    };
+  };
+  # Optional: enable bash (or zsh, fish...)
+#  programs.bash.enable = true;
+
+  # Optional: manage dotfiles via symlinks
+#  home.file = {
+#    ".tmux.conf".source = ./dotfiles/tmux.conf;
+#    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
+#  };
+}

docs/flake-lock-automation.md

@@ -1,78 +0,0 @@
-# flake.lock automation
-
-This repository uses CI workflows to keep `flake.lock` up to date on a schedule
-and to verify that declared NixOS hosts still evaluate after dependency updates.
-
-## What this automation does
-
-- A scheduled workflow runs `nix flake update` once per week.
-- On GitHub, any resulting `flake.lock` change is proposed through a pull request.
-- On Gitea, the workflow can commit and push `flake.lock` directly when PR automation is not configured.
-- A separate CI workflow evaluates every configured host before merge, listed
-  dynamically via `nix eval --json .#nixosConfigurations --apply builtins.attrNames`
-  rather than hand-enumerated, so it can't drift as `<platform>-<buildtype>`
-  targets are added or removed. See `README.md` for the current target list.
-
-## Why hosts should stop using `--upgrade-all`
-
-`flake.lock` is the source of truth for pinned dependency versions in a flake-based workflow. Normal host rebuilds should consume the committed lock file instead of upgrading dependencies ad-hoc on each machine.
-
-Recommended rebuild command:
-
-```bash
-sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
-```
-
-Flake attribute names are `<platform>-<buildtype>` (e.g. `proxmox-docker`)
-and no longer match `hostname`, since a host's hostname stays fixed while
-the platform backing it can change. Each `nixosConfiguration` stamps its own
-active target name into `/etc/flake-target` at build time, which is what the
-command above reads.
-
-Using the committed lock file keeps all hosts aligned and makes updates auditable through CI and code review.
-
-Codex and automated review sessions must not run rebuilds. Limit checks to
-evaluation, linting, formatting, and dry-run builds.
-
-## Command differences
-
-- `nix flake update`
-  - Updates flake input pins in `flake.lock`.
-  - Should be run in CI or in a dedicated update PR workflow.
-- `nixos-rebuild --upgrade`
-  - Primarily for channel-based workflows; not the normal path for flake-pinned deployments.
-- `nixos-rebuild --upgrade-all`
-  - Aggressively updates package sources and bypasses coordinated lock-file updates.
-  - Avoid for routine flake-based host rebuilds.
-
-## nix-cache and remote builder fit
-
-With `nix-cache` acting as a binary cache and remote builder, lock-file updates become safer and more reproducible:
-
-- CI verifies host evaluations against the updated lock file.
-- Builds can be performed once on the remote builder.
-- Built artifacts can be served via `nix-cache` to other hosts, reducing rebuild time and drift.
-
-## Token and secret handling
-
-Do **not** commit access tokens into `flake.nix`, `flake.lock`, or any other tracked file.
-
-If private source access is needed:
-
-- configure tokens locally in `~/.config/nix/nix.conf` or equivalent machine-local config, or
-- provide tokens through CI secrets/environment variables.
-
-## GitHub Actions setup notes
-
-- Ensure `GITHUB_TOKEN` has permission to create branches and pull requests (workflow sets `contents: write` and `pull-requests: write`).
-- The update workflow uses `peter-evans/create-pull-request` with branch `chore/update-flake-lock`.
-- The evaluation workflow runs on pull requests, pushes to `main`, and manual dispatch.
-
-## Gitea Actions runner setup notes
-
-- Ensure the runner image includes Git and can execute the Nix installer action.
-- For direct push mode, grant workflow push permission to the repository.
-- The workflow sets commit identity to:
-  - `user.name = gitea-actions`
-  - `user.email = gitea-actions@nix-cache.local`
-- Commits are only created when `flake.lock` actually changes.

docs/nix-cache.md

@@ -8,8 +8,6 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Every machine still keeps and uses its own local `/nix/store`.
 - Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
 - Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
-- Client hosts import `modules/nix/cache-client.nix` and, when remote building is enabled, `modules/nix/remote-builder-client.nix`.
-- The `nix-cache` host imports `modules/nix/cache-server.nix`.
 
 ## Binary cache signing keys (on nix-cache)
 
@@ -22,8 +20,6 @@ cat /etc/nix/cache-pub.pem
 ```
 
 Do not commit private keys.
-Do not commit new password hashes or live credentials. Existing committed hashes
-should be rotated and moved to host-local secret management.
 
 ## Remote builder SSH keys
 
@@ -37,9 +33,6 @@ sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
 
 On `nix-cache`, install the matching public key used by `nixremote` authorized keys.
 
-The committed `nixremote` authorized keys are public SSH keys only. Keep the
-matching private keys on client hosts and out of the repository.
-
 ## Manual verification
 
 After deployment:

docs/pxe-boot.md

@@ -1,95 +0,0 @@
-# pxe-boot
-
-The `pxe-boot` host serves HTTP boot assets for iPXE clients.
-
-## Host Role
-
-- Hostname: `pxe-boot`
-- Web service: nginx on TCP port 80
-- PXE root: `/srv/pxe`
-- HTTP root for scripts and images: `/srv/pxe/http`
-- TFTP root for first-stage bootloaders: `/srv/pxe/tftp`
-- iPXE entry script: `/srv/pxe/http/boot.ipxe`
-- Generated iPXE menu: `/srv/pxe/http/menu.ipxe`
-- SystemRescue iPXE script: `/srv/pxe/http/systemrescue.ipxe`
-- TFTP fallback script: `/srv/pxe/tftp/autoexec.ipxe`
-- Boot binaries copied from the Nix `ipxe` package:
-  - `/srv/pxe/tftp/ipxe.efi`
-  - `/srv/pxe/tftp/undionly.kpxe`
-
-## Directory Layout
-
-The host creates these directories with systemd tmpfiles:
-
-```text
-/srv/pxe
-/srv/pxe/http
-/srv/pxe/http/images
-/srv/pxe/http/nixos
-/srv/pxe/http/systemrescue
-/srv/pxe/http/ubuntu
-/srv/pxe/http/rescue
-/srv/pxe/tftp
-```
-
-Mount shared image storage under `/srv/pxe/http`, preferably
-`/srv/pxe/http/images` unless a menu entry expects files in a specific
-directory such as `/srv/pxe/http/nixos`.
-
-The HTTP iPXE chain is:
-
-```text
-undionly.kpxe or ipxe.efi
-  -> autoexec.ipxe from the TFTP root, when iPXE requests it
-  -> http://192.168.2.247/boot.ipxe
-  -> http://192.168.2.247/menu.ipxe
-```
-
-The generated menu currently exposes entries for:
-
-- NixOS installer
-- SystemRescue environment
-- iPXE shell
-- Reboot
-
-Kernel and initrd artifacts for the NixOS installer entry must be placed under
-`/srv/pxe/http/nixos` by an operator or a separate build process.
-
-The SystemRescue entry expects the source ISO at:
-
-```text
-/srv/pxe/http/images/systemrescue.iso
-```
-
-The `stage-systemrescue.service` oneshot extracts that ISO into:
-
-```text
-/srv/pxe/http/systemrescue
-```
-
-The rescue menu entry then chains `http://192.168.2.247/systemrescue.ipxe`,
-which loads the SystemRescue kernel and initramfs from the extracted tree and
-uses `archiso_http_srv` to fetch the squashfs payload over HTTP.
-
-## Validation
-
-Safe evaluation check:
-
-```bash
-nix eval .#nixosConfigurations.pxe-boot.config.system.build.toplevel.drvPath --raw
-```
-
-After deployment by an operator, basic service checks are:
-
-```bash
-curl http://pxe-boot/boot.ipxe
-curl http://pxe-boot/menu.ipxe
-curl http://pxe-boot/systemrescue.ipxe
-curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/vmlinuz
-curl -I http://pxe-boot/systemrescue/sysresccd/boot/x86_64/sysresccd.img
-```
-
-During a successful BIOS chainload, TFTP should deliver `undionly.kpxe` once,
-then nginx should log requests for `/boot.ipxe` and `/menu.ipxe`. Repeated TFTP
-downloads of `undionly.kpxe` indicate the iPXE stage is still not reaching the
-HTTP chain.

flake-target-refactor-spec.md

@@ -1,143 +0,0 @@
-# Spec: Refactor Flake Targets into Platform × Build-Type Matrix
-
-## Context
-
-The flake at `~/nixos` currently defines these output targets (flat, ad-hoc naming):
-
-- `docker`
-- `linode-minimal`
-- `nix-cache`
-- `nix-minimal`
-- `nixos`
-- `server`
-- `pxe-boot`
-
-Some already follow a `platform-buildtype` convention (`linode-minimal`), most don't.
-`~/nix-auto-installer` is a related repo and should be checked for any coupling to
-these target names (scripts, docs, CI, or install automation that reference them by
-name) before renaming anything.
-
-## Goal
-
-Restructure the flake so targets are generated from two orthogonal concepts:
-
-**Build types** (what the system is for):
-- `minimal`
-- `nix-cache`
-- `server`
-- `docker`
-- `pxe-boot`
-- `gui`
-
-**Platforms** (what it's deployed on):
-- `linode` (Linode VM)
-- `proxmox` (Proxmox VM)
-- `lxc` (Proxmox LXC container)
-
-Final targets should be named consistently as `<platform>-<buildtype>`, e.g.:
-
-```
-linode-minimal    proxmox-minimal    lxc-minimal
-linode-nix-cache  proxmox-nix-cache  lxc-nix-cache
-linode-server     proxmox-server     lxc-server
-linode-docker     proxmox-docker     lxc-docker
-linode-pxe-boot   proxmox-pxe-boot   lxc-pxe-boot
-linode-gui        proxmox-gui        lxc-gui
-```
-
-That's the full matrix (18 targets) if every build type applies to every platform.
-See **Open Questions** below — some combinations may not make sense and should be
-confirmed with me before being built out, not silently included or dropped.
-
-## Migration mapping (old → new)
-
-| Old target        | New target                                          | Notes |
-|--------------------|------------------------------------------------------|-------|
-| `linode-minimal`   | `linode-minimal`                                      | Already correct, keep as-is |
-| `nix-minimal`      | likely `proxmox-minimal` or a platform-less base module | Ambiguous — see Open Questions |
-| `nix-cache`        | base module consumed by `linode-nix-cache`, `proxmox-nix-cache`, `lxc-nix-cache` | Currently platform-less; needs to become a build-type module, not a standalone target |
-| `server`           | base module consumed by `linode-server`, `proxmox-server`, `lxc-server` | Same as above |
-| `docker`           | base module consumed by `linode-docker`, `proxmox-docker`, `lxc-docker` | Confirm docker actually makes sense as an LXC/VM guest build vs. a standalone container image — see Open Questions |
-| `pxe-boot`         | TBD — may stay a single target rather than a per-platform one | See Open Questions |
-| `nixos`            | TBD — unclear what this maps to in the new scheme | See Open Questions |
-
-## Open Questions (Claude Code: raise these with me before implementing, don't guess)
-
-1. **`nixos` target** — what is this currently used for (bare metal install, dev
-   shell, template)? It doesn't obviously map to any of the six build types.
-2. **`nix-minimal` vs `linode-minimal`** — are these two different things, or is
-   `nix-minimal` a leftover/duplicate?
-3. **`pxe-boot` and `gui` across all three platforms** — does PXE boot make sense
-   for an LXC container or a cloud VM (Linode), or is it inherently bare-metal/
-   network-boot only and should remain a single non-platform target? Does `gui`
-   make sense inside an LXC container?
-4. **`docker` as a build type** — is this "a NixOS host configured to run Docker"
-   (which would sensibly have linode/proxmox/lxc variants), or "a Docker container
-   image built by the flake" (which wouldn't take a platform prefix at all, since
-   it doesn't run on Linode/Proxmox/LXC as a guest OS)? These are structurally
-   different and change how it should be wired in.
-5. Confirm whether all 18 combinations should actually exist, or whether this is
-   meant to produce only the combinations that are genuinely useful (e.g. maybe no
-   one needs `lxc-pxe-boot`).
-
-## Implementation approach
-
-1. **Inventory first.** Read the current `flake.nix` and any `nixosConfigurations`/
-   `modules` structure. Map every existing target to what module(s) it actually
-   pulls in. Don't assume — confirm against the real file contents.
-2. **Separate build-type and platform into their own module directories**, e.g.:
-   ```
-   modules/build-types/minimal.nix
-   modules/build-types/nix-cache.nix
-   modules/build-types/server.nix
-   modules/build-types/docker.nix
-   modules/build-types/pxe-boot.nix
-   modules/build-types/gui.nix
-
-   modules/platforms/linode.nix
-   modules/platforms/proxmox.nix
-   modules/platforms/lxc.nix
-   ```
-   Build-type modules should contain only what makes a system "minimal" vs
-   "server" vs "gui", etc. Platform modules should contain only what's specific
-   to running as a Linode VM vs Proxmox VM vs LXC container (virtualisation
-   guest tools, boot method, filesystem/image format, LXC-specific constraints
-   like no kernel modules, etc).
-3. **Generate the target matrix programmatically** in `flake.nix` rather than
-   hand-writing 18 near-identical `nixosConfigurations` entries — e.g. a small
-   function that takes a platform name and build-type name, composes the two
-   modules plus any shared base module, and produces the named output. This
-   keeps future build types/platforms a one-line addition rather than a copy-paste
-   job.
-4. **Only build combinations we've confirmed make sense** (see Open Questions) —
-   don't emit all 18 by default if some are structurally invalid.
-5. **Preserve existing working configs during the transition.** Don't delete the
-   old target names until their replacements build successfully — rename/alias
-   at the end, not the start, so there's no window where the flake is broken.
-
-## Verification
-
-For every new target produced:
-```bash
-nix flake check
-nix build .#nixosConfigurations.<target>.config.system.build.toplevel
-```
-Confirm each builds without evaluation errors before considering it done. If a
-target fails to build, report which one and why rather than silently skipping it.
-
-## Deliverables
-
-- Refactored `flake.nix` using the composed module + generated-matrix approach.
-- New `modules/build-types/*.nix` and `modules/platforms/*.nix` files.
-- Old flat target names removed only after their replacements are verified.
-- A short `README.md` (or section in existing docs) listing the final target
-  names and what each one is for.
-- A summary at the end of what changed, what was removed, and any of the Open
-  Questions above that got resolved differently than expected.
-
-## Out of scope
-
-- Don't touch `~/nix-auto-installer` contents beyond checking it for references
-  to the old target names — if changes there are needed, flag them, don't make
-  them without confirming.
-- Don't add new build types or platforms beyond the ones listed here.

flake.lock

@@ -1,38 +1,17 @@
 {
   "nodes": {
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
       },
       "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
       }
     },
     "flake-compat_2": {
@@ -74,17 +53,16 @@
         "flake-utils": "flake-utils"
       },
       "locked": {
-        "lastModified": 1715533576,
-        "narHash": "sha256-fT4ppWeCJ0uR300EH3i7kmgRZnAVxrH+XtK09jQWihk=",
+        "lastModified": 1696331477,
+        "narHash": "sha256-YkbRa/1wQWdWkVJ01JvV+75KIdM37UErqKgTf0L54Fk=",
         "owner": "gytis-ivaskevicius",
         "repo": "flake-utils-plus",
-        "rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
+        "rev": "bfc53579db89de750b25b0c5e7af299e0c06d7d3",
         "type": "github"
       },
       "original": {
         "owner": "gytis-ivaskevicius",
         "repo": "flake-utils-plus",
-        "rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
         "type": "github"
       }
     },
@@ -95,16 +73,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1783740085,
-        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "lastModified": 1765860045,
+        "narHash": "sha256-7Lxp/PfOy4h3QIDtmWG/EgycaswqRSkDX4DGtet14NE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "rev": "09de9577d47d8bffb11c449b6a3d24e32ac16c99",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -116,11 +93,11 @@
         "snowfall-lib": "snowfall-lib"
       },
       "locked": {
-        "lastModified": 1771149335,
-        "narHash": "sha256-YPUIwyumbQOE2DUY8NIsHIUTGUQnDVhnTVUZMZDRwi4=",
+        "lastModified": 1707338010,
+        "narHash": "sha256-UtLeZzDdk96sLTRcWsGrkWCslNUDytrGe0VmOTB/iig=",
         "owner": "snowfallorg",
         "repo": "nixos-conf-editor",
-        "rev": "9f8b4519a2e0e8919b69b7572bc26dab54274a6f",
+        "rev": "27b5e92f580f794c690093503869aab242f075ab",
         "type": "github"
       },
       "original": {
@@ -131,11 +108,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771008912,
-        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
+        "lastModified": 1698318101,
+        "narHash": "sha256-gUihHt3yPD7bVqg+k/UVHgngyaJ3DMEBchbymBMvK1E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
+        "rev": "63678e9f3d3afecfeafa0acead6239cdb447574c",
         "type": "github"
       },
       "original": {
@@ -147,27 +124,25 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1784011430,
-        "narHash": "sha256-lDebytrYdd47IBLwvNOD+6AGeoqZ78CIKlp70hzW280=",
+        "lastModified": 1765779637,
+        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8eeec934ae0dbeca3d7868c059568a65c08b2fc3",
+        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "disko": "disko",
         "home-manager": "home-manager",
         "nixos-conf-editor": "nixos-conf-editor",
-        "nixpkgs": "nixpkgs_2",
-        "sops-nix": "sops-nix"
+        "nixpkgs": "nixpkgs_2"
       }
     },
     "snowfall-lib": {
@@ -180,11 +155,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765361626,
-        "narHash": "sha256-kX0Dp/kYSRbQ+yd9e3lmmUWdNbipufvKfL2IzbrSpnY=",
+        "lastModified": 1696432959,
+        "narHash": "sha256-oJQZv2MYyJaVyVJY5IeevzqpGvMGKu5pZcCCJvb+xjc=",
         "owner": "snowfallorg",
         "repo": "lib",
-        "rev": "c566ad8b7352c30ec3763435de7c8f1c46ebb357",
+        "rev": "92803a029b5314d4436a8d9311d8707b71d9f0b6",
         "type": "github"
       },
       "original": {
@@ -193,26 +168,6 @@
         "type": "github"
       }
     },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1783174389,
-        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -231,4 +186,4 @@
   },
   "root": "root",
   "version": 7
-}
+}

flake.nix

@@ -1,92 +1,99 @@
 {
+  
   description = "LAN NixOS configs";
-
+  # GitHub tokens must be provided outside this repository (local nix.conf, env, or deployment secrets).
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixos-conf-editor.url = "github:snowfallorg/nixos-conf-editor";
     home-manager = {
-      url = "github:nix-community/home-manager/release-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { self, nixpkgs, nixos-conf-editor, home-manager, sops-nix, ... } @ inputs:
+  outputs = { self, nixpkgs, nixos-conf-editor, home-manager, ... } @ inputs:
+    let system = "x86_64-linux"; in { 
+      nixosConfigurations = {
+        # automatically use each host folder by name
+        nixos    = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/nixos/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./hosts/nixos/home.nix;
+                      
+                    }
+                   ];
 
-    let
-      system = "x86_64-linux";
-      inherit (nixpkgs) lib;
 
-      # Generates a nixosConfiguration from a platform (what it runs on) and
-      # a build type (what it's for), plus the per-identity host.nix that
-      # carries the bits that must stay fixed regardless of platform
-      # (hostName, hostId, per-machine secrets). Every build type except
-      # nix-cache itself consumes the nix-cache substituter and remote
-      # builder.
-      mkTarget = { platform, buildType, hostPath, homeFile ? ./modules/common/home.nix }:
-        nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [
-            inputs.disko.nixosModules.disko
-            sops-nix.nixosModules.sops
-            ./modules/common/configuration.nix
-            ./modules/platforms/${platform}.nix
-            ./modules/build-types/${buildType}.nix
-            hostPath
-            { environment.etc."flake-target".text = "${platform}-${buildType}"; }
-            home-manager.nixosModules.home-manager
-            {
-              home-manager = {
-                useGlobalPkgs = true;
-                useUserPackages = true;
-                users.nixos = import homeFile;
-              };
-            }
-          ] ++ lib.optionals (buildType != "nix-cache") [
-            ./modules/nix-cache/client.nix
-            ./modules/remote-builder-client.nix
-          ];
-          specialArgs = { inherit inputs; };
-        };
 
-      # Generated platform x build-type matrix. pxe-boot has no linode
-      # variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS
-      # doesn't have).
-      generatedTargets = {
-        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/linode-minimal/host.nix; };
-        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/proxmox-minimal/host.nix; };
-        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/lxc-minimal/host.nix; };
-
-        linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
-        proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
-        lxc-nix-cache = mkTarget { platform = "lxc"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
-
-        linode-server = mkTarget { platform = "linode"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
-        proxmox-server = mkTarget { platform = "proxmox"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
-        lxc-server = mkTarget { platform = "lxc"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
-
-        linode-docker = mkTarget { platform = "linode"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
-        proxmox-docker = mkTarget { platform = "proxmox"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
-        lxc-docker = mkTarget { platform = "lxc"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
-
-        linode-gui = mkTarget { platform = "linode"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
-        proxmox-gui = mkTarget { platform = "proxmox"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
-        lxc-gui = mkTarget { platform = "lxc"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
-
-        proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
-        lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
+                  specialArgs = { inherit inputs; };
+                 };
+        docker = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/docker/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+                 };
+        kuma = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/kuma/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+                 };
+        server = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/server/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+                 };
+        nix-cache = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/nix-cache/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+        
+                 };
+        nix-minimal = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/nix-minimal/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+        
+                 };
       };
-
-    in
-    {
-
-      nixosConfigurations = generatedTargets;
     };
 }

hosts/docker/configuration.nix

@@ -0,0 +1,211 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    docker
+    pytz
+  ]);
+in
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "docker"; # Define your hostname.
+#  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+  enable = true;
+#  listenOptions = [
+#  "unix:///var/run/docker.sock"
+#  "tcp://0.0.0.0:2375"
+#];
+
+#  daemon.settings = {
+#    metrics-addr = "0.0.0.0:9323";
+#    experimental = true;
+#  };
+};
+  services.tailscale.enable = true;
+  # Enable docker-compose
+  environment.systemPackages = with pkgs; [
+  docker-compose
+  docker_25
+  nfs-utils
+  ];
+
+  services.logrotate = {
+    enable = true;
+
+    settings = {
+      "/mnt/docker-persistent-data/docker/core/traefik/data/logs/*.log" = {
+        daily = true;
+        size = "100M";
+        rotate = 20;
+        compress = true;
+        missingok = true;
+        notifempty = true;
+        copytruncate = true;
+      };
+
+     };
+  };
+
+
+boot.supportedFilesystems = [ "nfs" ];
+services.rpcbind.enable = true;
+
+  # Mount docker persistent data
+  fileSystems."/mnt/docker-persistent-data" = {
+    device = "/dev/disk/by-label/docker-data";
+    fsType = "ext4";
+    options = [ "defaults" "nofail" "noatime" ];
+  };
+fileSystems."/mnt/raspi" = {
+  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
+  fsType = "nfs4";
+  options = [
+    "nofail"
+    "_netdev"
+    "noatime"
+
+    # Don't mount until first access
+    "x-systemd.automount"
+
+    # Unmount after 10 min idle
+    "x-systemd.idle-timeout=600"
+
+    # Give the Pi/Tailscale a little time to appear
+    "x-systemd.device-timeout=10s"
+
+    # Explicitly use NFSv4.2 if supported
+    "nfsvers=4.2"
+  ];
+};
+
+# Create nextcloud cron scheduled task
+systemd.services.nextcloud = {
+  description = "Nextcloud scheduled task";
+  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
+  serviceConfig = {
+    Type = "oneshot";
+    User = "nixos";
+  };
+  path = with pkgs; [ docker docker-compose ];
+};
+
+systemd.timers.nextcloud = {
+  wantedBy = [ "timers.target" ];
+  timerConfig = {
+    OnCalendar = "*:0/5";
+    Persistent = true;
+  };
+};
+
+# create update task
+
+  systemd.services.update-containers = {
+    description = "Update Docker Compose Containers";
+    after = [ "docker.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = "nixos";
+      WorkingDirectory = "/home/nixos/docker";
+      ExecStart = "${pythonEnv}/bin/python3 /home/nixos/docker/update-containers.py";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+
+    path = [ pkgs.docker pkgs.docker-compose ]; # Ensures docker CLI is available in $PATH
+  };
+
+
+systemd.timers.update-containers = {
+  description = "Weekly + Reboot container update";
+  wantedBy = [ "timers.target" ];
+  timerConfig = {
+    OnBootSec = "5min";           # Run 5 minutes after boot
+    OnUnitActiveSec = "1w";       # Run every week after last run
+    Persistent = true;            # Catch up if system was off
+  };
+};
+
+# Create Gotify Docker monitoring script task
+
+  systemd.services.docker-health-to-gotify = {
+    description = "Alert Gotify when Docker containers become unhealthy";
+    after = [ "docker.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      # Run as root so it can read /etc/secrets and access docker socket
+     # User = "root";
+      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
+      ExecStart = "${pkgs.bash}/bin/bash /mnt/docker-persistent-data/docker/gotify/docker-health-to-gotify.sh";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+    path = with pkgs; [ docker curl coreutils gnused ];
+  };
+
+  systemd.timers.docker-health-to-gotify = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "2min";
+      OnUnitActiveSec = "1min";
+      AccuracySec = "15s";
+      Persistent = true;
+    };
+  };
+
+
+
+#Add sym links to data on users home folder
+system.userActivationScripts.createDockerSymlink.text = ''
+  ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
+'';
+system.userActivationScripts.createSetupSymlink.text = ''
+  ln -sf /mnt/docker-persistent-data/setup /home/nixos/setup
+'';
+
+  users.users.nixos.extraGroups = [ "docker" ];
+  services.openssh.settings.PermitRootLogin = "yes";
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 9323 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+ 
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/docker/host.nix

@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "docker";
-  networking.hostId = "007f0200";
-  boot.zfs.forceImportRoot = false;
-
-  # Preserved from the pre-refactor `docker` target — stateVersion must never
-  # be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

hosts/kuma/configuration.nix

@@ -0,0 +1,79 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    docker
+    pytz
+  ]);
+in
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "kuma"; # Define your hostname.
+  virtualisation.docker.enable = true;
+
+  # Enable docker-compose
+  environment.systemPackages = with pkgs; [
+  docker-compose
+  docker_25
+  ];
+
+  # Mount docker persistent data
+  # fileSystems."/mnt/docker-persistent-data" = {
+  #   device = "/dev/disk/by-label/docker-data";
+  #   fsType = "ext4";
+  #   options = [ "defaults" "nofail" "noatime" ];
+  # };
+
+
+#Add sym links to data on users home folder
+# system.userActivationScripts.createDockerSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
+# '';
+# system.userActivationScripts.createSetupSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/setup /home/nixos/setup
+# '';
+
+  users.users.nixos.extraGroups = [ "docker" ];
+  services.openssh.settings.PermitRootLogin = "yes";
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/linode-minimal/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "linode-minimal";
-
-  # Preserved from the pre-refactor `linode-minimal` target — stateVersion
-  # must never be bumped on an already-installed machine.
-  system.stateVersion = "26.05";
-}

hosts/lxc-minimal/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "lxc-minimal";
-
-  # No pre-existing deployed machine to preserve — pin explicitly to the
-  # current release rather than let it silently default.
-  system.stateVersion = "26.05";
-}

hosts/nix-cache/configuration.nix

@@ -0,0 +1,50 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-server.nix
+    ];
+
+  networking.hostName = "nix-cache"; # Define your hostname.
+
+services.prometheus.exporters.node = {
+  enable = true;
+  openFirewall = true;
+};
+
+  # Open ports in the firewall.
+#  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nix-cache/host.nix

@@ -1,21 +0,0 @@
-{ config, ... }:
-
-{
-  networking.hostName = "nix-cache";
-
-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-
-  services.beszel.agent.environment = {
-    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
-    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-  };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
-
-  # Preserved from the pre-refactor `nix-cache` target — stateVersion must
-  # never be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

hosts/nix-minimal/configuration.nix

@@ -0,0 +1,78 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "nix-minimal"; # Define your hostname.
+
+  environment.systemPackages = with pkgs; [
+    sshfs
+    fuse3 # needed for modern sshfs
+  ];
+
+  # Enable FUSE (if not already)
+  boot.extraModprobeConfig = ''
+    options fuse user_allow_other
+  '';
+
+  # Allow mounting with user permissions (optional, see note)
+  # security.wrappers.sshfs = {
+  #   source = "${pkgs.sshfs}/bin/sshfs";
+  #   owner = "nixos";
+  #   group = "users";
+  #   permissions = "4755";
+  
+  # fileSystems."/mnt/proxmox-iso" = {
+  #   device = "root@pve:/var/lib/vz/template/iso";
+  #   fsType = "fuse.sshfs";
+  #   options = [
+  #     "IdentityFile=/home/nixos/.ssh/id_ed25519.pub"   # or your SSH key path
+  #     "allow_other"
+  #     "reconnect"
+  #     "ServerAliveInterval=15"
+  #     "ServerAliveCountMax=3"
+  #     "StrictHostKeyChecking=no"         # only if you're OK with this
+  #   ];
+  # };
+  # };
+
+
+  # Open ports in the firewall.
+#  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nixos/configuration.nix

@@ -0,0 +1,133 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, lib, inputs, ... }:
+let
+    nixosConfEditor = builtins.getFlake "github:snowfallorg/nixos-conf-editor";
+in {
+#{
+    environment.systemPackages = with pkgs; [
+      inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
+      nodejs
+      appimage-run
+      seahorse
+      vscode
+      p7zip
+      popsicle  # balena-etcher
+      shotcut
+      gimp
+      pdfarranger
+      terminator
+      libreoffice-qt
+      transmission_4-qt
+    ];
+
+
+
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  # Bootloader.
+  boot.loader.grub.useOSProber = true;
+
+  networking.hostName = "nixos"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_AU.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_AU.UTF-8";
+    LC_IDENTIFICATION = "en_AU.UTF-8";
+    LC_MEASUREMENT = "en_AU.UTF-8";
+    LC_MONETARY = "en_AU.UTF-8";
+    LC_NAME = "en_AU.UTF-8";
+    LC_NUMERIC = "en_AU.UTF-8";
+    LC_PAPER = "en_AU.UTF-8";
+    LC_TELEPHONE = "en_AU.UTF-8";
+    LC_TIME = "en_AU.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Cinnamon Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.cinnamon.enable = true;
+#  services.xserver.desktopManager.xfce.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "au";
+    variant = "";
+  };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+#  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  users.users.nixos.extraGroups = [ "networkmanager" ]; # Enable ‘sudo’ for the user.
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+services.xrdp.enable = true;
+services.xrdp.defaultWindowManager = "cinnamon-session";
+services.xrdp.openFirewall = true;
+nixpkgs.config.allowUnfree = true;
+
+services.gnome.gnome-keyring.enable = true;
+
+# security.pam.services.lightdm.enableGnomeKeyring = true;
+
+# services.gnome.gnome-keyring.enable = true;
+security.pam.services.login.enableGnomeKeyring = true;
+
+  services.xserver.displayManager.sessionCommands = ''
+    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+    export SSH_AUTH_SOCK
+  '';
+
+# systemd.services.nextcloud-appimage = {
+#   enable = true;
+#   Unit = {
+#     Description = "Nextcloud AppImage client";
+#     After = [ "graphical-session.target" ];
+#     Wants = [ "graphical-session.target" ]; # optional but helpful
+#   };
+#   Service = {
+#     ExecStart = "/run/current-system/sw/bin/appimage-run /home/nixos/Applications/Nextcloud.AppImage --background";
+#     Restart = "on-failure";
+#     # You can add RestartSec = "5s"; if you like
+#   };
+#   Install = {
+#     WantedBy = [ "default.target" ];
+#   };
+# };
+
+}

hosts/nixos/home.nix

@@ -3,7 +3,7 @@
 {
 
     imports = [
-    ../../modules/common/aliases.nix
+    ../../common/aliases.nix
   ];
 
   home.username = "nixos";         # your actual username

hosts/nixos/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "nixos";
-
-  # Preserved from the pre-refactor `nixos` target — stateVersion must never
-  # be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

hosts/proxmox-minimal/host.nix

@@ -1,12 +0,0 @@
-{ ... }:
-
-{
-  # Preserves the hostname of the existing, already-deployed machine
-  # (previously the flat `nix-minimal` target) — the flake attribute name
-  # changed, the real machine's hostname did not.
-  networking.hostName = "nix-minimal";
-
-  # Preserved from the pre-refactor `nix-minimal` target — stateVersion must
-  # never be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

hosts/pxe-boot/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "pxe-boot";
-
-  # Preserved from the pre-refactor `pxe-boot` target — stateVersion must
-  # never be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

hosts/server/configuration.nix

@@ -0,0 +1,152 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs,... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+      ../../modules/nix/cache-client.nix
+      ../../modules/nix/remote-builder-client.nix
+    ];
+
+  networking.hostName = "server"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Mount server data
+  fileSystems."/srv" = {
+    device = "/dev/disk/by-label/server-data";
+    fsType = "ext4";
+    options = [ "defaults" ];
+  };
+
+  fileSystems."/backup" = {
+    device = "/dev/disk/by-label/backup-data";
+    fsType = "ext4";
+    options = [ "defaults" ];
+  };
+
+#Add sym links to data on users home folder
+system.userActivationScripts.createDockerSymlink.text = ''
+  ln -sf /srv/scripts /home/nixos/scripts
+'';
+#system.userActivationScripts.createSetupSymlink.text = ''
+#  ln -sf /mnt/docker-persistent-data/setup /home/nixos/setup
+#'';
+
+services.nfs.server = {
+  enable = true;
+  exports = ''
+    /srv/ 192.168.2.0/24(rw,sync,no_subtree_check)
+    /backup 	192.168.2.0/24(rw,sync,no_subtree_check)
+  '';
+};
+
+  security.sudo = {
+    enable = true;
+    extraRules = [
+      {
+        users = [ "nixos" ];
+        commands = [
+          {
+            command = "/run/current-system/sw/bin/rsync";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
+
+
+ # systemd.services.backup = {
+ #   description = "Backup data";
+ #   wantedBy = [ "multi-user.target" ];
+
+#    serviceConfig = {
+#      Type = "oneshot";
+#      User = "root";
+#      WorkingDirectory = "/home/nixos/scripts";
+#      ExecStart = "${pkgs.bash}/bin/bash -e /srv/scripts/rsync.sh";
+#      StandardOutput = "journal";
+#      StandardError = "journal";
+#    };
+#path = with pkgs; [ bash rsync openssh coreutils ];
+#  };
+
+
+#systemd.timers.backup = {
+#  description = "Daily backup";
+#  wantedBy = [ "timers.target" ];
+#  timerConfig = {
+#    OnUnitActiveSec = "1d";       # Run every day after last run
+#    Persistent = true;            # Catch up if system was off
+#  };
+#};
+
+#  networking.wireguard.enable = true;
+#  networking.wireguard.interfaces.wg0 = {
+#    ips = [ "10.100.0.254/24" ];
+#    listenPort = 51820;
+#    privateKeyFile = "/etc/wireguard/server.key";
+
+#    peers = [
+#      {
+#        publicKey = "cA30PTE/2gMbIhtAXaRPJkQeDc7/UWoA6eK3K+Xpsww=";
+#        allowedIPs = [ "10.100.0.2/32" ];
+#      }
+#    ];
+#  };
+
+  # Allow WireGuard UDP port in firewall
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  # Enable IPv4 forwarding
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
+  # NAT: lets LAN devices reply to the Pi without needing routes on the LAN router
+  networking.nat = {
+    enable = true;
+    externalInterface = "enp0s18";
+    internalInterfaces = [ "wg0" ];
+  };
+services.prometheus.exporters.node = {
+  enable = true;
+  openFirewall = true;
+};
+
+  services.openssh.settings.PermitRootLogin = "yes";
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 2049 ];
+#  networking.firewall.allowedUDPPorts = [ 111 2049 20048 ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/server/host.nix

@@ -1,24 +0,0 @@
-{ config, ... }:
-
-{
-  networking.hostName = "server";
-  networking.hostId = "6689f93e";
-
-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-
-  services.beszel.agent.environment = {
-    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
-    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    EXTRA_FILESYSTEMS = "/tank/docker/volumes";
-    LOG_LEVEL = "debug";
-  };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
-
-  # Preserved from the pre-refactor `server` target — stateVersion must never
-  # be bumped on an already-installed machine.
-  system.stateVersion = "25.05";
-}

modules/beszel/enable-agent.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-services.beszel.agent.enable = true;
-services.beszel.agent.environment = {
-#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-HUB_URL = "http://docker.sweet.home:8090";
-};
-}

modules/boot/efi.nix

@@ -1,6 +0,0 @@
-{ ... }:
-
-{
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-}

modules/build-types/docker.nix

@@ -1,40 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # Pins the Docker Engine version, carried forward from the pre-refactor
-  # `docker` target's inline pkgs overlay.
-  nixpkgs.overlays = [
-    (final: prev: {
-      docker = prev.docker_29;
-      docker_cli = prev.docker_29;
-    })
-  ];
-
-  imports = [
-    ../docker/mount-data.nix
-    ../docker/enable-service.nix
-    ../tailscale/enable-service.nix
-    ../rotate-traefik-logs.nix
-    ../raspi/mount-data.nix
-    ../services/nextcloud-cron-job.nix
-    ../services/docker-health-to-gotify.nix
-    ../services/enable-rpcbind.nix
-  ];
-
-  environment.systemPackages = with pkgs; [
-    nfs-utils
-  ];
-
-  boot.supportedFilesystems = [ "nfs" ];
-
-  systemd.tmpfiles.rules = [
-    "L+ /home/nixos/docker - - - - /mnt/docker/config"
-    "d /mnt/docker 0755 nixos users -"
-    "d /mnt/raspi-backup 0755 nixos users -"
-  ];
-
-  users.users.nixos.extraGroups = [ "docker" ];
-  services.openssh.settings.PermitRootLogin = "yes";
-
-  networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ];
-}

modules/build-types/gui.nix

@@ -1,57 +0,0 @@
-{ config, pkgs, lib, inputs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
-    nodejs
-    appimage-run
-    seahorse
-    vscode
-    p7zip
-    popsicle # balena-etcher
-    shotcut
-    gimp
-    pdfarranger
-    terminator
-    libreoffice-qt
-    transmission_4-qt
-  ];
-
-  boot.loader.grub.useOSProber = true;
-
-  services.xserver.enable = true;
-  services.xserver.displayManager.lightdm.enable = true;
-  services.xserver.desktopManager.cinnamon.enable = true;
-
-  services.xserver.xkb = {
-    layout = "au";
-    variant = "";
-  };
-
-  services.printing.enable = true;
-
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-  };
-
-  users.users.nixos.extraGroups = [ "networkmanager" ];
-
-  programs.firefox.enable = true;
-
-  services.xrdp.enable = true;
-  services.xrdp.defaultWindowManager = "cinnamon-session";
-  services.xrdp.openFirewall = true;
-  nixpkgs.config.allowUnfree = true;
-
-  services.gnome.gnome-keyring.enable = true;
-  security.pam.services.login.enableGnomeKeyring = true;
-
-  services.xserver.displayManager.sessionCommands = ''
-    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
-    export SSH_AUTH_SOCK
-  '';
-}

modules/build-types/minimal.nix

@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  networking.networkmanager.enable = true;
-
-  users.users.nixos.extraGroups = [ "networkmanager" ];
-
-  environment.systemPackages = with pkgs; [
-    inetutils
-    mtr
-    sysstat
-  ];
-}

modules/build-types/nix-cache.nix

@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../nix-cache/server.nix
-    ../beszel/enable-agent.nix
-  ];
-}

modules/build-types/pxe-boot.nix

@@ -1,156 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-
-let
-  pxeRoot = "/srv/pxe";
-  httpRoot = "${pxeRoot}/http";
-  tftpRoot = "${pxeRoot}/tftp";
-  pxeBaseUrl = "http://192.168.2.247";
-
-  bootIpxe = pkgs.writeText "boot.ipxe" ''
-    #!ipxe
-
-    dhcp
-    echo Booting from PXE server...
-    chain ${pxeBaseUrl}/menu.ipxe
-  '';
-
-  autoexecIpxe = pkgs.writeText "autoexec.ipxe" ''
-    #!ipxe
-
-    dhcp
-    chain ${pxeBaseUrl}/boot.ipxe
-  '';
-
-  systemRescueIpxe = pkgs.writeText "systemrescue.ipxe" ''
-    #!ipxe
-
-    set base ${pxeBaseUrl}
-
-    kernel ''${base}/systemrescue/sysresccd/boot/x86_64/vmlinuz initrd=sysresccd.img archisobasedir=sysresccd archiso_http_srv=''${base}/systemrescue/ ip=dhcp checksum
-    initrd ''${base}/systemrescue/sysresccd/boot/x86_64/sysresccd.img sysresccd.img
-    boot
-  '';
-
-  stageSystemRescue = pkgs.writeShellScript "stage-systemrescue" ''
-    set -eu
-
-    iso="${httpRoot}/images/systemrescue.iso"
-    staged="${httpRoot}/systemrescue"
-    tmp="${httpRoot}/.systemrescue.tmp"
-    previous="${httpRoot}/.systemrescue.previous"
-
-    if [ ! -e "$iso" ]; then
-      echo "SystemRescue ISO not found at $iso; skipping staging."
-      exit 0
-    fi
-
-    rm -rf "$tmp"
-    mkdir -p "$tmp"
-
-    ${pkgs.libarchive}/bin/bsdtar -C "$tmp" -xf "$iso"
-
-    test -f "$tmp/sysresccd/boot/x86_64/vmlinuz"
-    test -f "$tmp/sysresccd/boot/x86_64/sysresccd.img"
-    chmod -R a+rX "$tmp"
-
-    rm -rf "$previous"
-    if [ -e "$staged" ]; then
-      mv "$staged" "$previous"
-    fi
-
-    mv "$tmp" "$staged"
-    rm -rf "$previous"
-  '';
-
-  menuIpxe = pkgs.writeText "menu.ipxe" ''
-    #!ipxe
-
-    set base ${pxeBaseUrl}
-
-    menu PXE Boot Menu
-    item nixos NixOS Installer
-    item rescue Rescue Environment
-    item shell iPXE Shell
-    item reboot Reboot
-
-    choose target && goto ''${target}
-
-    :nixos
-    kernel ''${base}/nixos/bzImage ip=dhcp
-    initrd ''${base}/nixos/initrd
-    boot
-
-    :rescue
-    chain ''${base}/systemrescue.ipxe
-
-    :shell
-    shell
-
-    :reboot
-    reboot
-  '';
-in
-{
-  environment.systemPackages = with pkgs; [
-    ipxe
-  ];
-
-  services.nginx = {
-    enable = true;
-
-    virtualHosts."pxe-boot" = {
-      default = true;
-      root = httpRoot;
-      locations."/" = {
-        extraConfig = ''
-          autoindex on;
-        '';
-      };
-    };
-  };
-
-  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
-  # starts, all further assets are fetched via nginx over HTTP.
-  services.atftpd = {
-    enable = true;
-    root = tftpRoot;
-    extraOptions = [
-      "--verbose=5"
-    ];
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${pxeRoot} 0755 root root -"
-    "d ${httpRoot} 0755 root root -"
-    "d ${httpRoot}/images 0755 root root -"
-    "d ${httpRoot}/nixos 0755 root root -"
-    "d ${httpRoot}/systemrescue 0755 root root -"
-    "d ${httpRoot}/ubuntu 0755 root root -"
-    "d ${httpRoot}/rescue 0755 root root -"
-    "d ${tftpRoot} 0755 root root -"
-    "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
-    "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
-    "C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
-    "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
-    "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
-    "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
-  ];
-
-  systemd.services.stage-systemrescue = {
-    description = "Stage SystemRescue ISO contents for HTTP PXE boot";
-    after = [
-      "local-fs.target"
-      "systemd-tmpfiles-setup.service"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = stageSystemRescue;
-    };
-  };
-
-  services.openssh.settings.PermitRootLogin = "yes";
-
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  networking.firewall.allowedUDPPorts = [ 69 ];
-}

modules/build-types/server.nix

@@ -1,28 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../beszel/enable-agent.nix
-    ../services/zfs/enable-service.nix
-  ];
-
-  boot.zfs.extraPools = [ "tank" ];
-
-  systemd.services.nfs-server = {
-    after = [ "zfs-mount.service" ];
-    requires = [ "zfs-mount.service" ];
-  };
-
-  services.nfs.server = {
-    enable = true;
-    exports = ''
-      /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [ 111 2049 ];
-}

modules/common/home.nix

@@ -1,65 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
-  localMount = "${config.home.homeDirectory}/proxmox-iso";
-in {
-
-  imports = [
-    ./aliases.nix
-  ];
-
-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.11";        # match your NixOS stateVersion
-
-  programs.home-manager.enable = true;  # mandatory to activate HM
-  
-programs.bash.enable = true;
-  
-  # GitHub access-tokens setting used to live here in plaintext; it's now
-  # rendered system-wide from a sops-nix secret via nix.extraOptions in
-  # modules/common/configuration.nix instead (covers the daemon for every
-  # user, not just this one).
-
-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nano
-    sshfs
-  ];
-
-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "nano";
-  };
-#  systemd.user.services.mount-proxmox-iso = {
-#    Unit = {
-#      Description = "Mount Proxmox ISO dir via SSHFS";
-#      After = [ "network-online.target" ];
-#      Wants = [ "network-online.target" ];
-#    };
-
-#    Service = {
-#      Type = "simple";
-#      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
-#      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
-#      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
-#      Restart = "on-failure";
-#    };
-
-#    Install = {
-#      WantedBy = [ "default.target" ];
-#    };
-#  };
-  # Optional: enable bash (or zsh, fish...)
-#  programs.bash.enable = true;
-
-  # Optional: manage dotfiles via symlinks
-#  home.file = {
-#    ".tmux.conf".source = ./dotfiles/tmux.conf;
-#    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
-#  };
-}

modules/disko/proxmox.nix

@@ -1,60 +0,0 @@
-{ ... }:
-
-{
-  disko.devices = {
-    disk.main = {
-      type = "disk";
-      device = "/dev/sda";
-
-      content = {
-        type = "gpt";
-
-        partitions = {
-          esp = {
-            priority = 1;
-            name = "ESP";
-            size = "512M";
-            type = "EF00";
-
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-              mountOptions = [ "umask=0077" ];
-              extraArgs = [
-                "-F"
-                "32"
-                "-n"
-                "boot"
-              ];
-            };
-          };
-
-          swap = {
-            size = "8G";
-
-            content = {
-              type = "swap";
-              randomEncryption = false;
-              # label = "swap";
-            };
-          };
-
-          root = {
-            size = "100%";
-
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-              extraArgs = [
-                "-L"
-                "nixos"
-              ];
-            };
-          };
-        };
-      };
-    };
-  };
-}

modules/docker/enable-service.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-    #  virtualisation.docker.enable = true;
-  virtualisation.docker = {
-  enable = true;
-  package = pkgs.docker;
-#  listenOptions = [
-#  "unix:///var/run/docker.sock"
-#  "tcp://0.0.0.0:2375"
-#];
-
-#  daemon.settings = {
-#    metrics-addr = "0.0.0.0:9323";
-#    experimental = true;
-#  };
-};
-
-environment.systemPackages = with pkgs; [
-  docker-compose
-  docker-buildx
-];
-}

modules/docker/mount-data.nix

@@ -1,63 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  fileSystems."/mnt/docker/config" = {
-    device = "server:/tank/docker/config";
-    fsType = "nfs";
-
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
-
-  fileSystems."/mnt/docker/databases" = {
-    device = "server:/tank/docker/databases";
-    fsType = "nfs";
-
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
-
-  fileSystems."/mnt/docker/volumes" = {
-    device = "server:/tank/docker/volumes";
-    fsType = "nfs";
-
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
-
- fileSystems."/mnt/nextcloud-data" = {
-    device = "server:/tank/docker/nextcloud-data";
-    fsType = "nfs";
-
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
-
- fileSystems."/mnt/raspi-backup" = {
-    device = "server:/tank/raspi/volumes";
-    fsType = "nfs";
-
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
-}

modules/enable-ip-forwarding.nix

@@ -1,12 +0,0 @@
-{ config, lib, ... }:
-
-{
-  options.myNetworking.ipForwarding.enable = lib.mkEnableOption "Enable IPv4 and IPv6 forwarding";
-
-  config = lib.mkIf config.myNetworking.ipForwarding.enable {
-    boot.kernel.sysctl = {
-      "net.ipv4.ip_forward" = 1;
-      "net.ipv6.conf.all.forwarding" = 1;
-    };
-  };
-}

modules/hardware-configuration/vm/linode.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.grub.device = "/dev/sda";
-
-  fileSystems."/" =
-    { device = "/dev/sda";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/sdb"; }
-    ];
-
-# Enable LISH
-boot.kernelParams = [ "console=ttyS0,19200n8" ];
-boot.loader.grub.extraConfig = ''
-  serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-  terminal_input serial;
-  terminal_output serial;
-'';
-
-boot.loader.grub.forceInstall = true;
-# boot.loader.grub.device = "nodev";
-boot.loader.timeout = 10;
-
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

modules/nix/cache-server.nix

@@ -38,11 +38,7 @@
     # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
     #
     # Avoid absolute keyFiles paths here because they break pure flake evaluation.
-    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" 
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
+    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" ];
   };
 
   services.openssh.enable = true;

modules/platforms/linode.nix

@@ -1,13 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../hardware-configuration/vm/linode.nix
-  ];
-
-  networking = {
-    usePredictableInterfaceNames = false;
-    useDHCP = false;
-    interfaces.eth0.useDHCP = true;
-  };
-}

modules/platforms/lxc.nix

@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  boot.isContainer = true;
-
-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
-}

modules/platforms/proxmox.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../hardware-configuration/vm/proxmox.nix
-    ../boot/efi.nix
-    ../disko/proxmox.nix
-  ];
-}

modules/raspi/mount-data.nix

@@ -1,26 +0,0 @@
-{ ... }:
-
-{
-fileSystems."/mnt/raspi" = {
-  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
-  fsType = "nfs4";
-  options = [
-    "nofail"
-    "_netdev"
-    "noatime"
-
-    # Don't mount until first access
-    "x-systemd.automount"
-
-    # Unmount after 10 min idle
-    "x-systemd.idle-timeout=600"
-
-    # Give the Pi/Tailscale a little time to appear
-    "x-systemd.device-timeout=10s"
-
-    # Explicitly use NFSv4.2 if supported
-    "nfsvers=4.2"
-  ];
-};
-
-}

modules/rotate-traefik-logs.nix

@@ -1,20 +0,0 @@
-{ ... }:
-
-{
-      services.logrotate = {
-    enable = true;
-
-    settings = {
-      "/mnt/docker/volumes/traefik-data/logs/*.log" = {
-        daily = true;
-        size = "100M";
-        rotate = 20;
-        compress = true;
-        missingok = true;
-        notifempty = true;
-        copytruncate = true;
-      };
-
-     };
-  };
-}

modules/services/docker-health-to-gotify.nix

@@ -1,28 +0,0 @@
-{ pkgs, ... }:
-
-{
-  systemd.services.docker-health-to-gotify = {
-    description = "Alert Gotify when Docker containers become unhealthy";
-    after = [ "docker.service" ];
-    serviceConfig = {
-      Type = "oneshot";
-      # Run as root so it can read /etc/secrets and access docker socket
-     # User = "root";
-      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
-      ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh";
-      StandardOutput = "journal";
-      StandardError = "journal";
-    };
-    path = with pkgs; [ docker curl coreutils gnused ];
-  };
-
-  systemd.timers.docker-health-to-gotify = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnBootSec = "2min";
-      OnUnitActiveSec = "1min";
-      AccuracySec = "15s";
-      Persistent = true;
-    };
-  };
-}

modules/services/enable-rpcbind.nix

@@ -1,5 +0,0 @@
- { ... }:
- 
- {
- services.rpcbind.enable = true;
- }

modules/services/nextcloud-cron-job.nix

@@ -1,22 +0,0 @@
-{ pkgs, ... }:
-
-{
-# Create nextcloud cron scheduled task
-systemd.services.nextcloud = {
-  description = "Nextcloud scheduled task";
-  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
-  serviceConfig = {
-    Type = "oneshot";
-    User = "nixos";
-  };
-  path = with pkgs; [ docker docker-compose ];
-};
-
-systemd.timers.nextcloud = {
-  wantedBy = [ "timers.target" ];
-  timerConfig = {
-    OnCalendar = "*:0/5";
-    Persistent = true;
-  };
-};
-}

modules/services/zfs/auto-mount-volumes.nix

@@ -1,12 +0,0 @@
-{ pkgs, boot, ... }:
-
-{
-boot.postBootCommands = ''
-  echo "=== STARTING ZPOOL IMPORT ==="
-  ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
-  ${pkgs.zfs_unstable}/bin/zpool status
-  ${pkgs.zfs_unstable}/bin/zfs mount -a
-  ${pkgs.zfs_unstable}/bin/zfs list
-    echo "=== ZPOOL IMPORT COMPLETE ==="
-'';
- }

modules/services/zfs/enable-service.nix

@@ -1,16 +0,0 @@
-{ pkgs, ... }:
-
- {
-boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.forceImportRoot = false;
-  boot.zfs.package = pkgs.zfs_unstable;
-      services.zfs = {
-    autoScrub.enable = true;
-    autoSnapshot.enable = true;
-    trim.enable = true;
-  };
-
-#systemd.services.zfs-import-cache.enable = true;
-systemd.services.zfs-mount.enable = true;
-boot.zfs.devNodes = "/dev/disk/by-id";
- }

modules/set-locale.nix

@@ -1,18 +0,0 @@
-{ ... }:
-
-{
-  i18n.defaultLocale = "en_AU.UTF-8";
-
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_AU.UTF-8";
-    LC_IDENTIFICATION = "en_AU.UTF-8";
-    LC_MEASUREMENT = "en_AU.UTF-8";
-    LC_MONETARY = "en_AU.UTF-8";
-    LC_NAME = "en_AU.UTF-8";
-    LC_NUMERIC = "en_AU.UTF-8";
-    LC_PAPER = "en_AU.UTF-8";
-    LC_TELEPHONE = "en_AU.UTF-8";
-    LC_TIME = "en_AU.UTF-8";
-  };
-
-}

modules/tailscale/enable-service.nix

@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-    services.tailscale.enable = true;
-}

modules/tailscale/exit-node.nix

@@ -1,12 +0,0 @@
-{ ... }:
-
-{
-  services.tailscale = {
-    enable = true;
-
-    extraUpFlags = [
-      "--advertise-exit-node"
-      "--advertise-routes=192.168.2.0/24"
-    ];
-  };
-}

remove-sensetive-info-refactor.md

@@ -1,134 +0,0 @@
-# Spec: Remove Sensitive Information from NixOS Flake
-
-## Goal
-
-Every secret currently readable in plaintext anywhere in this repo (working tree *and* git history) gets removed, replaced with `sops-nix`-managed encrypted references, and rotated. When this is done, the repo should be safe to make public without exposing anything about the systems it configures.
-
-Treat this as three sequential milestones. Do not start git history rewriting (Milestone 3) until Milestones 1 and 2 are fully verified and the flake still builds. This should be its own branch (`refactor/secrets`) until fully verified, then merged.
-
----
-
-## Milestone 1 — Audit
-
-Before touching anything, produce a complete inventory. Do not guess at scope — grep the whole tree and the whole history.
-
-1. Run a secret scanner across the working tree and full history. Use both, since they catch different things:
-   - `gitleaks detect --source . -v --log-opts="--all"` (scans history too)
-   - `trufflehog git file://. --since-commit=$(git rev-list --max-parents=0 HEAD) --only-verified=false`
-   If neither is installed, add them via a temporary `nix-shell -p gitleaks trufflehog` — don't install anything globally on the host.
-
-2. Manually grep for the categories below, since scanners miss config-specific patterns:
-   - `hashedPassword`, `password`, `initialPassword`, `initialHashedPassword` in any `users.users.*` block
-   - `age.secrets`, `sops.secrets` (if any partial secrets work already exists — check for it)
-   - PSK / `preSharedKey`, `privateKeyFile` inline values (vs. file references) for WireGuard
-   - `authKey`, `apiToken`, `api_key`, `token =`, `secret =` in service modules (Tailscale, Cloudflare, backup tools, etc.)
-   - SSH private key material: search for `BEGIN OPENSSH PRIVATE KEY` / `BEGIN RSA PRIVATE KEY` literals
-   - TLS cert/key pairs committed under e.g. `secrets/`, `certs/`, `pki/`
-   - Real name, personal email, home address, or anything in comments/hostnames that maps a machine to your physical identity or network layout (e.g. hostnames like `wayne-desktop`, static LAN IPs, ISP-identifying info)
-   - `.env` files, `secrets.nix`, `secrets.yaml`, or any file that looks like it was meant to be gitignored but wasn't
-
-3. Produce `secrets-inventory.md` (temporary, delete before finishing) listing: file path, line, secret type, and which host/service it belongs to. This becomes the checklist for Milestone 2 — every row must be either migrated to sops or deleted, with nothing left unaccounted for.
-
----
-
-## Milestone 2 — Migrate to sops-nix
-
-### 2.1 Set up sops-nix
-
-1. Add the flake input:
-   ```nix
-   sops-nix.url = "github:Mic92/sops-nix";
-   sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-   ```
-2. Import `sops-nix.nixosModules.sops` into each host's module list (or into a shared `common.nix` if all hosts use it).
-3. Generate an age keypair **per host** (not one shared key for everything — a compromised host shouldn't decrypt every other host's secrets):
-   ```
-   nix-shell -p age --run "age-keygen -o /var/lib/sops-nix/key.txt"
-   ```
-   Print the public key (`age-keygen -y`) for each host — you'll need it for `.sops.yaml`.
-4. Also generate one age key for yourself (your admin workstation) so you can edit secrets without needing to SSH into a host: store it at `~/.config/sops/age/keys.txt`, back it up somewhere outside this repo (password manager, offline). **If this key is lost, every secret encrypted with it is unrecoverable — losing the age key is equivalent to losing the secrets.**
-5. Create `.sops.yaml` at the repo root defining creation rules: which age public keys can decrypt which secrets files, keyed by path regex, so e.g. `secrets/hostA.yaml` is decryptable by your admin key + hostA's key, `secrets/hostB.yaml` by your admin key + hostB's key.
-
-### 2.2 Migrate each secret category from the inventory
-
-For each row in `secrets-inventory.md`:
-
-- **Password hashes**: generate hash with `mkpasswd -m sha-512` (or `bcrypt` if your setup wants that), store under `sops.secrets."<name>/hashedPassword"`, reference via `users.users.<name>.hashedPasswordFile = config.sops.secrets."<name>/hashedPassword".path;`. Do not put the *plaintext* password anywhere, only the hash, and only the hash goes into the encrypted sops file.
-- **API tokens / auth keys**: move the raw value into the per-host sops YAML, reference in the module via `config.sops.secrets."<service>/token".path` — most NixOS service modules that take a token also accept a `*File` variant (e.g. `environmentFile`, `tokenFile`); use that instead of passing the value directly.
-- **Private keys / certs**: move the PEM/key content wholesale into a sops secret, output as a file with appropriate `sops.secrets.<name>.path`, `owner`, `mode`, `restartUnits` so the depending service (sshd, wireguard, nginx) reloads when the secret changes.
-- **Personal/identifying info**: this doesn't belong in sops (it's not "secret," it's just information you don't want public). Replace real names/emails with placeholders or move to a small untracked `local.nix` that's `.gitignore`'d and imported conditionally, with a documented template (`local.nix.example`) committed instead.
-
-### 2.3 Verify before moving on
-
-- `nixos-rebuild dry-build --flake .#<host>` succeeds for every host.
-- `sudo nixos-rebuild switch --flake .#<host>` on at least one real machine (or a VM) confirms secrets decrypt and services start.
-- Confirm decrypted secrets land under `/run/secrets/` (not the Nix store — anything placed in `/nix/store` is world-readable by design, so sops-nix's runtime-only placement is the whole point; double check no module accidentally pulls a secret path into a store-built config file).
-- Re-run the grep/scanner sweep from Milestone 1 against the *working tree only* (not history yet) — it should now come back clean.
-
----
-
-## Milestone 3 — Scrub git history
-
-Do this only after Milestone 2 is merged to your main branch and confirmed working, since it rewrites every commit SHA from the point of the earliest offending commit onward.
-
-**This is destructive and irreversible on your local clone. Back up first:**
-```
-cp -r /path/to/nixos-repo /path/to/nixos-repo-backup-$(date +%F)
-```
-
-1. Install `git-filter-repo` (not the older `git filter-branch` / BFG — filter-repo is the currently maintained, faster, safer tool):
-   ```
-   nix-shell -p git-filter-repo
-   ```
-2. Use the `secrets-inventory.md` list to build a list of literal strings/paths to strip. Two approaches, use both:
-   - Path-based: if whole files were secret (e.g. `secrets.nix`, a `.env`, a private key file), remove them entirely from history:
-     ```
-     git filter-repo --path secrets.nix --path .env --invert-paths
-     ```
-   - Value-based: for secrets embedded inline in files you're keeping (not deleting the whole file), use `--replace-text` with a file listing each literal secret string to replace with `***REMOVED***`:
-     ```
-     git filter-repo --replace-text expressions.txt
-     ```
-3. After filtering, verify: run the Milestone 1 scanners again against full history (`--log-opts="--all"`). They must come back clean.
-4. Force-push the rewritten history:
-   ```
-   git push origin --force --all
-   git push origin --force --tags
-   ```
-5. **Every other clone of this repo (other machines, WSL instances, CI) must be deleted and re-cloned fresh** — a `git pull` against rewritten history will not work cleanly and risks resurrecting the old commits. Don't try to reconcile old clones; throw them away and re-clone.
-6. If this repo has ever been pushed to a public host (GitHub, etc.) or a fork/mirror exists, treat every secret that was ever in history as **permanently compromised regardless of the rewrite** — caches, forks, and Wayback-style archives can retain old commits indefinitely. History scrubbing prevents *future* exposure via `git clone`; it does not undo past exposure.
-
----
-
-## Milestone 4 — Rotate everything
-
-Because the secrets were exposed in history (even briefly, even in a private repo), the migration is not complete until every credential in the inventory has been **rotated**, not just re-encrypted. Re-encrypting an already-leaked value protects it going forward but doesn't undo the leak.
-
-For each row in the original inventory:
-- Password hashes → change the actual account password, regenerate the hash, update the sops file.
-- API tokens/auth keys → revoke the old token in the issuing service's dashboard (Cloudflare, Tailscale, backup provider, etc.) and generate a new one.
-- SSH/WireGuard private keys → generate new keypairs, update the corresponding public key wherever it's trusted (authorized_keys, peer configs, etc.), retire the old ones.
-- TLS certs → reissue if the private key was exposed.
-
-Keep `secrets-inventory.md` open during this step and check off each row as rotated. Delete the file only once every row is checked off — it should not be committed.
-
----
-
-## Ongoing prevention
-
-Add a pre-commit hook (or a `nix flake check` step) running `gitleaks protect --staged` so a secret can't be committed again by accident. Document in the repo README (briefly) that new secrets go through `sops <file>` to edit, never as plaintext in a tracked file.
-
----
-
-## Definition of done
-
-- [ ] Milestone 1 inventory complete and reviewed
-- [ ] All hosts have per-host age keys; admin key backed up outside the repo
-- [ ] Every inventoried secret migrated to sops-nix, referenced via `*File`/`sops.secrets.*.path`, nothing plaintext in the working tree
-- [ ] `nixos-rebuild dry-build` and at least one real `switch` verified per host
-- [ ] Working-tree scanner sweep clean
-- [ ] History rewritten with `git-filter-repo`, force-pushed, full-history scanner sweep clean
-- [ ] All other clones deleted and re-cloned from the rewritten history
-- [ ] Every credential in the original inventory rotated (not just re-encrypted)
-- [ ] Pre-commit secret scanning hook added
-- [ ] `secrets-inventory.md` deleted from the working directory (never committed)

scripts/codex-setup.sh

@@ -70,9 +70,6 @@ EOF
 echo "Nix version:"
 nix --version
 
-echo "Enabling tracked git hooks (pre-commit secret scan)..."
-git config core.hooksPath .githooks
-
 echo "Installing jq if unavailable..."
 if ! command -v jq >/dev/null 2>&1; then
   nix profile install nixpkgs#jq

scripts/create-linode-installer-disk.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-#boot to rescue mode
-# set root password
-scp $RESULT_ISO root@$LINODE_IP:/tmp/nixos-auto.iso
-
-#in LISH or ssh to rescue mode
-dd if=/tmp/nixos.iso of=/dev/sda bs=4M status=progress conv=fsync

secrets/common.yaml

@@ -1,45 +0,0 @@
-root-hashedPassword: ENC[AES256_GCM,data:Kp0nOZI7vDoLhJHiOJBwJn0rQZ5yhnwapGnAcA+qh8vlDETtFs/iQdetF/2ZxmANf62SviTNd+Ag0q5JIF1996x7onZGXqxgSMCuVzZLBdUlsO5IR0BslWWz47khYGTe4WkUg4NB1itBfQ==,iv:5Sra5vJ79V8hxQT3g9qJ+dOj2W2sumIhqpitqnHjJdk=,tag:3Igu0+8GeUZHqS3fKUVwog==,type:str]
-nixos-hashedPassword: ENC[AES256_GCM,data:pT7tVRN6X4a+DNUgB7fIUUE3CbnetkjxmoSL1PxSU+ktsFU+fB0mEvJjA1uujsGH5Rcztg7YM815+M0Z67ILmHaXbza5DtFacrqhi4/b277xly0SHRX4yOvBwQh6mJG1jn/0O/wvUUIYdw==,iv:bp2nfhC8nFbk6o5iWDAugvbzu7J/a1xayFnBEtkhNpE=,tag:HqWgkIpSrSM/K9OK2WO+VQ==,type:str]
-nix-github-token: ENC[AES256_GCM,data:OfNRGJg16Ede6EilWUetCs9za+xk5/Lsa3SpVajsqz8PMdA1xQNeCWdX7ZAMdijHClpBhU6ETFGsXvt41O9aORS951uijeGSW7/NH35/bnPISrKdYeBx/+xEiqwH,iv:QGU3v7xOy89uzRTCb1U9ICyJ8XYIpXrUsDt12aL3g2Y=,tag:Bde2wcWNv8H4WLxSEUAodg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6NkpZRzJuMFNuV09WamR0
-            SERDN0VSUlNQbkhSem1EeFlxdlhmdUx0S21JCnY1VkRBQTBqcW9JRHpJWEtJSitN
-            dHkyR0I4ckNkWkpGWHAzZGRaZkhJalEKLS0tIHRrU3RhU3UxN3B4NHdLeStuSXQ4
-            anFkRlpMTHowZzJNdnY0MExQcXd4OUEKgbT7uOSFkfEs6t3X6jmGOiC28lDJWF33
-            50f2fZ771ylhHa6WJMetGZ5cwl9r1RCaDiWyJEaqNGe7NqARlhr3EQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDamw2ekY0dFZyOGNJelVa
-            ZGlNK2VNOWtWNTRzU3o2aVJvRi9CME5yS1JFCndlamdFMzVRTnoyVE1ZWXZkTjRR
-            eWdSZzZERHE5VElrOGZvcE4vK0g2d0EKLS0tIG15QlVyalZTK2NpVDdWWU4yUU4r
-            SkFncC9rZkNKUS9MSmF6WGQwOENwZTQKs5kLNLdQJoZtcsw3zlUWUUtJs0MJnuvw
-            o5vziOswRnuXENw//xN01nMDC6Ckzvb+q9GFIyxHLE4j3fT5XdZakg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaWpWTGd4TEVoaHg4b3hm
-            S1o3VXdkYkZCS0QxcW5hUWxyVjFneE5aSmp3ClNsdEZoMHpPUzI4K3B0ZnBYMlEw
-            MkJyd2NPcGJDZzgvc1EyWFBhNVlGUVEKLS0tIEptYXI2bnJHZVZGR3hSSm1sMlN5
-            ay8wdUh6TEowL0ZiUWtqbXl3NzhYOVEKW9l4mr+MLhuXA8sgQndaU8NiFeCMcxhG
-            qjKFn+mu2GFbwfZWAy6y/KUd9Ug4H6y3pNHlJMHupTu8v2wZ+3S4EA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVG13RVVweGpRM04vMWxG
-            V2hMMnp2Qk5Ub1BZQWNKNXVya3J4NGpreDJrCktqajVPRXdEL1BMU1dMbDhmU01L
-            UlQvRVQvcEFUZVZ5Umc3Y0hMUWNLVFEKLS0tIFgzRnF1RHdQdktDVjROSURYYTdx
-            NjAydjVuV1VCOGZoVFdTZmw1YmJ0eEEKN9KRGegafu1sjHlhyn4KCMPPAKxsSZLc
-            QJkei1ZQ0AVgC2QfCVEXonMOrs45nCIplG+uyER9khZyyjKObWk1pA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-    lastmodified: "2026-07-19T02:30:40Z"
-    mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1

secrets/nix-cache.yaml

@@ -1,25 +0,0 @@
-beszel-token: ENC[AES256_GCM,data:meuzUP/6wCssJDVTgbC0XwiLZPMGyDl55HEIiON9xOXCD9k6,iv:TDqWcp+8Mxd8wN09r5otQRQXq3XTeQphaTWxvvuLTAs=,tag:cRPZQGlwB/dTguBAheWPQg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb29VM3haQ0c0WDY0STVn
-            L1ZyOUROSnR6ZjZZZWc1VGFFNVp6bWxCV3hZCnlGTC9CbEtIM3MvSGJQaStEbzJ0
-            eWVhY2l6UHNDRTYxdEpkd003WXFia2MKLS0tIHcxU3FPYTVuZ0RqZTZTT1RvZnN0
-            OGlQM3B2R0l4MHhWNXBBWmpiOEVxK1EK8kxh3ikKL6Fw2am3r7lPGpB0fCqzEukO
-            NU10Cbf38Bd+fybRbBnvRuu9To1FOf+KU3iKbsuWmZn4KJn4Ajcbhw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNWRhK2QrV1ZibllqY25Y
-            ZVRPLzZ0TE82TWZ4L0w5ZmFPTDBtT0poODBnCkE5TWhJcXJjNkdva1hYZ3loeVdq
-            UlBXWHZpRUpMSGhPU0FIRi9JMEtTdGMKLS0tIE9yUk5Ebjk2MEFtNEkyR3RDcU51
-            ZVMwNnNRMlBMVVFlamU1U3JQSy9UT00KJZdEpRHuj4Dp1dGwP1z4xi9oddQOrQj2
-            qheEN/IlifVdZDpvlLUc8jgLzd/TO5EeEhVqfbdrlua8FHly29oTNw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-    lastmodified: "2026-07-19T02:30:40Z"
-    mac: ENC[AES256_GCM,data:7+FeT6aeCGn+JFBXbPO0qP4BJ1nHPSennewv1kWkG+hOTIqs1ymuswUK1Hyfi6Z9h2umFX9HvK+o3qtmYvk6k7BUNe6w6QUHTNwm6lmNqrb7sgAE3iFVI2p9m14NGhgoTfnXx1M4JIZ1iuNYhCukpENI4+svIe+r7x5YeE5Evac=,iv:4AKAPI6upyAvHBr8BLWX7R/NupmJdcXdqiN8e0ZQ3ls=,tag:TkpfpCaLhn+Mx5cQZZuMdA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1

secrets/server.yaml

@@ -1,25 +0,0 @@
-beszel-token: ENC[AES256_GCM,data:cbQOXhLzNk4g9d6hvm2DH7Q5ApTPCTzsW2txflDT2dD/UPIE,iv:V19MI1GEo5/0205Hrt7JImfkjduFiZ7f9aIkDVaI8mU=,tag:WCArgdrnIOudVe/Tw+oxRw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaFZURjAxMGRJZEJ5MW1x
-            ZjVwWEQrQlkwNmRibVNiL2RpTTFLeUVDQ3hRCkVIamVnZkM1MnlueloxMHVFQnBF
-            RjV2bnUrZUo4WGZJTmR4Y0xITkxRUkUKLS0tIGlJdVQ5MFBubVhxRUVMWW0wSGpP
-            UGdKNUNPYW9nek1UZ0tWbXd3QVNUNDgKIHOiKelITQdH5R4Nc3WF7mzz15D1f9on
-            VaTdr5qkf8LNNvPI0fxsXA9is5cqeg+KbDRHtUumEhNp6Zrf8zWBkw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N0hvV01naytDSWVwK1B1
-            MXM1ZkdpaVc2Q3FPV2VBcC83WmcvSjdGUGgwClJGSXZ6YW5JeFlValNJbjVhK29u
-            bUFqN2dRQTI4ZkwyeXNWYk5JeWVJRXcKLS0tIDlMMkNBUnNUSTJwVVFmc2dlcEZS
-            VGQ1VHR2dXB0M3RsalppVWxiUUROM0UKZM/4QDTam3LDTzjnDs41Ije50R7Q7GC4
-            IZbUZjs72rBzY8IkJDbN9JidadEc4NAtMOJwXiJbpZGiCBNfc8+SXw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-    lastmodified: "2026-07-19T02:30:40Z"
-    mac: ENC[AES256_GCM,data:rKHZjU/MH08ASTlu32HZO9uWmsBYuMCEC6M8gwVhzuWvmablnP05tS2z13XfaWaCEUXk6kmGJKuU0zu5+IKVZgamCF6DAMtxQb6bVCaLsoAm/GSqWQ5VI9eHqgnSSdN/o3ul/33Rf8iBQo4aw8FFAmDVuNz8bfAn0QefFTj0ByI=,iv:JD2gtqRinOY77etg6PUmZNovkYl1Q3F6ZvRi4x7RznQ=,tag:/5IMpWKRVt+l1luCTQE0BA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1