Update hosts/docker/configuration.nix

new file:   hosts/kuma/configuration.nix

.gitignore

@@ -6,3 +6,6 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+auto-installer/flake.lock
+auto-installer/result
+auto-installer/nixos-auto.iso

common/aliases.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, lib, ... }:
+
+let
+  mySwitchCmd = ''
+    sudo nixos-rebuild switch \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
+  '';
+  myTestCmd = ''
+    sudo nixos-rebuild test \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
+  '';
+in {
+  programs.bash = {
+    enable = true;
+    shellAliases = {
+      "Switch-nix" = mySwitchCmd;
+      "Test-nix" = myTestCmd;
+    };
+  };
+}

common/configuration.nix

@@ -54,10 +54,10 @@ users.users.root = {
 nix.settings = {
   substituters = [
     "http://nix-cache"
-    "https://cache.nixos.org/"
+#    "https://cache.nixos.org/"
   ];
   trusted-public-keys = [
-    "nix-ccache-1:<base32‑pubkey‑hash‑from‑cache-pub.pem>"
+    "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
     "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
   ];
 };

common/home.nix

@@ -1,49 +1,60 @@
 { config, pkgs, lib, ... }:
 
 let
-  mySwitchCmd = ''
-    sudo nixos-rebuild switch \
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
-  '';
-  myTestCmd = ''
-    sudo nixos-rebuild switch \
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname)
-  '';
+  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
+  localMount = "${config.home.homeDirectory}/proxmox-iso";
 in {
+
+  imports = [
+    ./aliases.nix
+  ];
+
   home.username = "nixos";         # your actual username
   home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.05";        # match your NixOS stateVersion
+  home.stateVersion = "25.11";        # match your NixOS stateVersion
 
   programs.home-manager.enable = true;  # mandatory to activate HM
   
-programs.bash = {
-  enable = true;
-  shellAliases = {
-    "Switch-nix" = mySwitchCmd;
-    "Test-nix" = mySwitchCmd;
+programs.bash.enable = true;
+  
+  home.file = {
+    ".config/nix/nix.conf".text = ''
+      access-tokens = github.com=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
+    '';
   };
-    initExtra = ''
-    # ensure loading of aliases/session variables
-    [[ -f ~/.profile ]] && . ~/.profile
-  '';
-};
 
   # Optional: packages
   home.packages = with pkgs; [
     git
     vim
     tmux
+    nano
+    sshfs
   ];
 
   # Optional: set environment vars
   home.sessionVariables = {
-    EDITOR = "vim";
+    EDITOR = "nano";
   };
+  systemd.user.services.mount-proxmox-iso = {
+    Unit = {
+      Description = "Mount Proxmox ISO dir via SSHFS";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
 
+    Service = {
+      Type = "simple";
+      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+      Restart = "on-failure";
+    };
+
+    Install = {
+      WantedBy = [ "default.target" ];
+    };
+  };
   # Optional: enable bash (or zsh, fish...)
 #  programs.bash.enable = true;
 

flake.lock

@@ -0,0 +1,189 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils-plus": {
+      "inputs": {
+        "flake-utils": "flake-utils"
+      },
+      "locked": {
+        "lastModified": 1696331477,
+        "narHash": "sha256-YkbRa/1wQWdWkVJ01JvV+75KIdM37UErqKgTf0L54Fk=",
+        "owner": "gytis-ivaskevicius",
+        "repo": "flake-utils-plus",
+        "rev": "bfc53579db89de750b25b0c5e7af299e0c06d7d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gytis-ivaskevicius",
+        "repo": "flake-utils-plus",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765860045,
+        "narHash": "sha256-7Lxp/PfOy4h3QIDtmWG/EgycaswqRSkDX4DGtet14NE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "09de9577d47d8bffb11c449b6a3d24e32ac16c99",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixos-conf-editor": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs",
+        "snowfall-lib": "snowfall-lib"
+      },
+      "locked": {
+        "lastModified": 1707338010,
+        "narHash": "sha256-UtLeZzDdk96sLTRcWsGrkWCslNUDytrGe0VmOTB/iig=",
+        "owner": "snowfallorg",
+        "repo": "nixos-conf-editor",
+        "rev": "27b5e92f580f794c690093503869aab242f075ab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "snowfallorg",
+        "repo": "nixos-conf-editor",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1698318101,
+        "narHash": "sha256-gUihHt3yPD7bVqg+k/UVHgngyaJ3DMEBchbymBMvK1E=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "63678e9f3d3afecfeafa0acead6239cdb447574c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1765779637,
+        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixos-conf-editor": "nixos-conf-editor",
+        "nixpkgs": "nixpkgs_2"
+      }
+    },
+    "snowfall-lib": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "flake-utils-plus": "flake-utils-plus",
+        "nixpkgs": [
+          "nixos-conf-editor",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1696432959,
+        "narHash": "sha256-oJQZv2MYyJaVyVJY5IeevzqpGvMGKu5pZcCCJvb+xjc=",
+        "owner": "snowfallorg",
+        "repo": "lib",
+        "rev": "92803a029b5314d4436a8d9311d8707b71d9f0b6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "snowfallorg",
+        "repo": "lib",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -1,11 +1,16 @@
 {
-  description = "LAN NixOS configs";
   
+  description = "LAN NixOS configs";
+      nixConfig = {
+        access-tokens = [
+          "github.com=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"
+        ];
+      };          
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixos-conf-editor.url = "github:snowfallorg/nixos-conf-editor";
     home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -26,6 +31,9 @@
                       
                     }
                    ];
+
+
+
                   specialArgs = { inherit inputs; };
                  };
         docker = nixpkgs.lib.nixosSystem {
@@ -40,6 +48,18 @@
                     }
                    ];
                  };
+        kuma = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/kuma/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+                 };
         server = nixpkgs.lib.nixosSystem {
                    inherit system;
                    modules = [
@@ -63,8 +83,21 @@
                       home-manager.users.nixos = import ./common/home.nix;
                     }
                    ];
-                 };
         
+                 };
+        nix-minimal = nixpkgs.lib.nixosSystem {
+                   inherit system;
+                   modules = [
+                     ./hosts/nix-minimal/configuration.nix
+                     ./common/hardware-configuration.nix
+                     home-manager.nixosModules.home-manager {
+                      home-manager.useGlobalPkgs = true;
+                      home-manager.useUserPackages = true;
+                      home-manager.users.nixos = import ./common/home.nix;
+                    }
+                   ];
+        
+                 };
       };
     };
 }

hosts/docker/configuration.nix

@@ -18,24 +18,80 @@ in
     ];
 
   networking.hostName = "docker"; # Define your hostname.
-  virtualisation.docker.enable = true;
+#  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+  enable = true;
+#  listenOptions = [
+#  "unix:///var/run/docker.sock"
+#  "tcp://0.0.0.0:2375"
+#];
 
+#  daemon.settings = {
+#    metrics-addr = "0.0.0.0:9323";
+#    experimental = true;
+#  };
+};
+  services.tailscale.enable = true;
   # Enable docker-compose
   environment.systemPackages = with pkgs; [
   docker-compose
+  docker_25
+  nfs-utils
   ];
 
+  services.logrotate = {
+    enable = true;
+
+    settings = {
+      "/mnt/docker-persistent-data/docker/core/traefik/data/logs/*.log" = {
+        daily = true;
+        size = "100M";
+        rotate = 20;
+        compress = true;
+        missingok = true;
+        notifempty = true;
+        copytruncate = true;
+      };
+
+     };
+  };
+
+
+boot.supportedFilesystems = [ "nfs" ];
+services.rpcbind.enable = true;
+
   # Mount docker persistent data
   fileSystems."/mnt/docker-persistent-data" = {
     device = "/dev/disk/by-label/docker-data";
     fsType = "ext4";
     options = [ "defaults" "nofail" "noatime" ];
   };
+fileSystems."/mnt/raspi" = {
+  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
+  fsType = "nfs4";
+  options = [
+    "nofail"
+    "_netdev"
+    "noatime"
+
+    # Don't mount until first access
+    "x-systemd.automount"
+
+    # Unmount after 10 min idle
+    "x-systemd.idle-timeout=600"
+
+    # Give the Pi/Tailscale a little time to appear
+    "x-systemd.device-timeout=10s"
+
+    # Explicitly use NFSv4.2 if supported
+    "nfsvers=4.2"
+  ];
+};
 
 # Create nextcloud cron scheduled task
 systemd.services.nextcloud = {
   description = "Nextcloud scheduled task";
-  script = ''docker-compose -f ~/docker/nextcloud/docker-compose.yml exec -u 33 webapp php ./cron.php'';
+  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
   serviceConfig = {
     Type = "oneshot";
     User = "nixos";
@@ -81,6 +137,35 @@ systemd.timers.update-containers = {
   };
 };
 
+# Create Gotify Docker monitoring script task
+
+  systemd.services.docker-health-to-gotify = {
+    description = "Alert Gotify when Docker containers become unhealthy";
+    after = [ "docker.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      # Run as root so it can read /etc/secrets and access docker socket
+     # User = "root";
+      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
+      ExecStart = "${pkgs.bash}/bin/bash /mnt/docker-persistent-data/docker/gotify/docker-health-to-gotify.sh";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+    path = with pkgs; [ docker curl coreutils gnused ];
+  };
+
+  systemd.timers.docker-health-to-gotify = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "2min";
+      OnUnitActiveSec = "1min";
+      AccuracySec = "15s";
+      Persistent = true;
+    };
+  };
+
+
+
 #Add sym links to data on users home folder
 system.userActivationScripts.createDockerSymlink.text = ''
   ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
@@ -93,7 +178,7 @@ system.userActivationScripts.createSetupSymlink.text = ''
   services.openssh.settings.PermitRootLogin = "yes";
 
   # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 9323 ];
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;

hosts/kuma/configuration.nix

@@ -0,0 +1,77 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+let
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    docker
+    pytz
+  ]);
+in
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+    ];
+
+  networking.hostName = "kuma"; # Define your hostname.
+  virtualisation.docker.enable = true;
+
+  # Enable docker-compose
+  environment.systemPackages = with pkgs; [
+  docker-compose
+  docker_25
+  ];
+
+  # Mount docker persistent data
+  # fileSystems."/mnt/docker-persistent-data" = {
+  #   device = "/dev/disk/by-label/docker-data";
+  #   fsType = "ext4";
+  #   options = [ "defaults" "nofail" "noatime" ];
+  # };
+
+
+#Add sym links to data on users home folder
+# system.userActivationScripts.createDockerSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/docker /home/nixos/docker
+# '';
+# system.userActivationScripts.createSetupSymlink.text = ''
+#   ln -sf /mnt/docker-persistent-data/setup /home/nixos/setup
+# '';
+
+  users.users.nixos.extraGroups = [ "docker" ];
+  services.openssh.settings.PermitRootLogin = "yes";
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nix-cache/configuration.nix

@@ -22,6 +22,10 @@
       locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
     };
   };
+services.prometheus.exporters.node = {
+  enable = true;
+  openFirewall = true;
+};
 
   networking.firewall.allowedTCPPorts = [ config.services.nginx.defaultHTTPListenPort ];
   # Open ports in the firewall.

hosts/nix-minimal/configuration.nix

@@ -0,0 +1,76 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../../common/configuration.nix
+    ];
+
+  networking.hostName = "nix-minimal"; # Define your hostname.
+
+  environment.systemPackages = with pkgs; [
+    sshfs
+    fuse3 # needed for modern sshfs
+  ];
+
+  # Enable FUSE (if not already)
+  boot.extraModprobeConfig = ''
+    options fuse user_allow_other
+  '';
+
+  # Allow mounting with user permissions (optional, see note)
+  # security.wrappers.sshfs = {
+  #   source = "${pkgs.sshfs}/bin/sshfs";
+  #   owner = "nixos";
+  #   group = "users";
+  #   permissions = "4755";
+  
+  # fileSystems."/mnt/proxmox-iso" = {
+  #   device = "root@pve:/var/lib/vz/template/iso";
+  #   fsType = "fuse.sshfs";
+  #   options = [
+  #     "IdentityFile=/home/nixos/.ssh/id_ed25519.pub"   # or your SSH key path
+  #     "allow_other"
+  #     "reconnect"
+  #     "ServerAliveInterval=15"
+  #     "ServerAliveCountMax=3"
+  #     "StrictHostKeyChecking=no"         # only if you're OK with this
+  #   ];
+  # };
+  # };
+
+
+  # Open ports in the firewall.
+#  networking.firewall.allowedTCPPorts = [ 80 8080 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta>
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/nixos/configuration.nix

@@ -2,7 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, lib, inputs,... }:
+{ config, pkgs, lib, inputs, ... }:
 let
     nixosConfEditor = builtins.getFlake "github:snowfallorg/nixos-conf-editor";
 in {
@@ -12,7 +12,15 @@ in {
       nodejs
       appimage-run
       seahorse
-
+      vscode
+      p7zip
+      popsicle  # balena-etcher
+      shotcut
+      gimp
+      pdfarranger
+      terminator
+      libreoffice-qt
+      transmission_4-qt
     ];
 
 
@@ -91,6 +99,19 @@ in {
 services.xrdp.enable = true;
 services.xrdp.defaultWindowManager = "cinnamon-session";
 services.xrdp.openFirewall = true;
+nixpkgs.config.allowUnfree = true;
+
+services.gnome.gnome-keyring.enable = true;
+
+# security.pam.services.lightdm.enableGnomeKeyring = true;
+
+# services.gnome.gnome-keyring.enable = true;
+security.pam.services.login.enableGnomeKeyring = true;
+
+  services.xserver.displayManager.sessionCommands = ''
+    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+    export SSH_AUTH_SOCK
+  '';
 
 # systemd.services.nextcloud-appimage = {
 #   enable = true;

hosts/nixos/home.nix

@@ -1,6 +1,11 @@
 { config, pkgs, lib, ... }:
 
 {
+
+    imports = [
+    ../../common/aliases.nix
+  ];
+
   home.username = "nixos";         # your actual username
   home.homeDirectory = "/home/nixos";
   home.stateVersion = "25.05";        # match your NixOS stateVersion
@@ -13,6 +18,8 @@
     vim
     tmux
     nextcloud-client
+#    vscode
+    chromium
   ];
 
   # Optional: set environment vars
@@ -27,5 +34,46 @@
     # Optionally start in background directly
     startInBackground = true;
   };
+home.file = {
+  ".local/share/applications/proxmox-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Chromium)
+    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Chromium)
+    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
 
+  '';
+  ".local/share/applications/proxmox-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Firefox)
+    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Firefox)
+    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
+    StartupWMClass=PBS
+  '';
+};
 }

hosts/server/configuration.nix

@@ -59,29 +59,62 @@ services.nfs.server = {
   };
 
 
-  systemd.services.backup = {
-    description = "Backup data";
-    wantedBy = [ "multi-user.target" ];
+ # systemd.services.backup = {
+ #   description = "Backup data";
+ #   wantedBy = [ "multi-user.target" ];
 
-    serviceConfig = {
-      Type = "oneshot";
-      User = "root";
+#    serviceConfig = {
+#      Type = "oneshot";
+#      User = "root";
 #      WorkingDirectory = "/home/nixos/scripts";
-      ExecStart = "${pkgs.bash}/bin/bash -e /srv/scripts/rsync.sh";
-      StandardOutput = "journal";
-      StandardError = "journal";
-    };
-path = with pkgs; [ bash rsync openssh coreutils ];
-  };
+#      ExecStart = "${pkgs.bash}/bin/bash -e /srv/scripts/rsync.sh";
+#      StandardOutput = "journal";
+#      StandardError = "journal";
+#    };
+#path = with pkgs; [ bash rsync openssh coreutils ];
+#  };
 
 
-systemd.timers.backup = {
-  description = "Daily backup";
-  wantedBy = [ "timers.target" ];
-  timerConfig = {
-    OnUnitActiveSec = "1d";       # Run every day after last run
-    Persistent = true;            # Catch up if system was off
+#systemd.timers.backup = {
+#  description = "Daily backup";
+#  wantedBy = [ "timers.target" ];
+#  timerConfig = {
+#    OnUnitActiveSec = "1d";       # Run every day after last run
+#    Persistent = true;            # Catch up if system was off
+#  };
+#};
+
+#  networking.wireguard.enable = true;
+#  networking.wireguard.interfaces.wg0 = {
+#    ips = [ "10.100.0.254/24" ];
+#    listenPort = 51820;
+#    privateKeyFile = "/etc/wireguard/server.key";
+
+#    peers = [
+#      {
+#        publicKey = "cA30PTE/2gMbIhtAXaRPJkQeDc7/UWoA6eK3K+Xpsww=";
+#        allowedIPs = [ "10.100.0.2/32" ];
+#      }
+#    ];
+#  };
+
+  # Allow WireGuard UDP port in firewall
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  # Enable IPv4 forwarding
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
   };
+
+  # NAT: lets LAN devices reply to the Pi without needing routes on the LAN router
+  networking.nat = {
+    enable = true;
+    externalInterface = "enp0s18";
+    internalInterfaces = [ "wg0" ];
+  };
+services.prometheus.exporters.node = {
+  enable = true;
+  openFirewall = true;
 };
 
   services.openssh.settings.PermitRootLogin = "yes";

prepare.sh

@@ -17,13 +17,14 @@ swapon /dev/sda2
 
 #mount nixos partition
 mount /dev/disk/by-label/nixos /mnt
-
+export TMPDIR=/mnt/install-tmp
+mkdir -p /mnt/install-tmp
 #Generate config
-nixos-generate-config --root /mnt/
+#nixos-generate-config --root /mnt/
 
 #copy customised configuration over
-cp configuration.nix /mnt/etc/nixos/configuration.nix
+#cp configuration.nix /mnt/etc/nixos/configuration.nix
 
-nixos-install --no-root-passwd
+#nixos-install --no-root-passwd
 
-reboot
+#reboot