chore: update flake

modules/nixos/client/nautilus.nix

@@ -0,0 +1,10 @@
+{ lib, config, ... }:
+{
+  options.swarselmodules.nautilus = lib.mkEnableOption "nautilus config";
+  config = lib.mkIf config.swarselmodules.nautilus {
+    programs.nautilus-open-any-terminal = {
+      enable = true;
+      terminal = "kitty";
+    };
+  };
+}

modules/nixos/optional/microvm-guest.nix

@@ -1,4 +1,4 @@
-{ self, lib, config, inputs, microVMParent, nodes, globals, confLib, ... }:
+{ self, config, inputs, ... }:
 {
   imports = [
     inputs.disko.nixosModules.disko
@@ -15,6 +15,7 @@
     inputs.stylix.nixosModules.stylix
     inputs.swarsel-nix.nixosModules.default
     inputs.nixos-nftables-firewall.nixosModules.default
+    inputs.pia.nixosModules.default
 
     (inputs.nixos-extra-modules + "/modules/interface-naming.nix")
 

modules/nixos/server/adguardhome.nix

@@ -70,7 +70,7 @@ in
           homeDomains) ++ [
           {
             domain = "smb.${globals.domains.main}";
-            answer = globals.networks.home-lan.vlans.services.hosts.storage.ipv4;
+            answer = globals.networks.home-lan.vlans.services.hosts.summers-storage.ipv4;
             enabled = true;
           }
         ];

modules/nixos/server/bastion.nix

@@ -1,14 +1,16 @@
-{ self, lib, config, withHomeManager, ... }:
+{ self, lib, config, withHomeManager, confLib, ... }:
 {
   options.swarselmodules.server.bastion = lib.mkEnableOption "enable bastion on server";
   config = lib.mkIf config.swarselmodules.server.bastion ({
 
     users = {
+      persistentIds.jump = confLib.mkIds 1001;
       groups = {
         jump = { };
       };
       users = {
-        "jump" = {
+        jump = {
+          autoSubUidGidRange = false;
           isNormalUser = true;
           useDefaultShell = true;
           group = lib.mkForce "jump";

modules/nixos/server/kanidm.nix

@@ -93,58 +93,65 @@ in
       };
     };
 
-    systemd.services."generateSSLCert-${serviceName}" =
-      let
-        daysValid = 3650;
-        renewBeforeDays = 365;
-      in
-      {
-        before = [ "${serviceName}.service" ];
-        requiredBy = [ "${serviceName}.service" ];
-        after = [ "local-fs.target" ];
-        requires = [ "local-fs.target" ];
+    systemd.services = {
+      "generateSSLCert-${serviceName}" =
+        let
+          daysValid = 3650;
+          renewBeforeDays = 365;
+        in
+        {
+          before = [ "${serviceName}.service" ];
+          requiredBy = [ "${serviceName}.service" ];
+          after = [ "local-fs.target" ];
+          requires = [ "local-fs.target" ];
 
-        serviceConfig = {
-          Type = "oneshot";
-        };
+          serviceConfig = {
+            Type = "oneshot";
+          };
 
-        script = ''
-          set -eu
+          script = ''
+            set -eu
 
-          ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir}
-          ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0755 /persist${certsDir}" else ""}
-          ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir}
-          ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0750 /persist${privateDir}" else ""}
+            ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir}
+            ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0755 /persist${certsDir}" else ""}
+            ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir}
+            ${if config.swarselsystems.isImpermanence then "${pkgs.coreutils}/bin/install -d -m 0750 /persist${privateDir}" else ""}
 
-          need_gen=0
-          if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then
-            need_gen=1
-          else
-            enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)"
-            end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)"
-            now_epoch="$(${pkgs.coreutils}/bin/date +%s)"
-            seconds_left=$(( end_epoch - now_epoch ))
-            days_left=$(( seconds_left / 86400 ))
-            if [ "$days_left" -lt ${toString renewBeforeDays} ]; then
+            need_gen=0
+            if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then
               need_gen=1
             else
-              echo 'Certificate exists and is still valid'
+              enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)"
+              end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)"
+              now_epoch="$(${pkgs.coreutils}/bin/date +%s)"
+              seconds_left=$(( end_epoch - now_epoch ))
+              days_left=$(( seconds_left / 86400 ))
+              if [ "$days_left" -lt ${toString renewBeforeDays} ]; then
+                need_gen=1
+              else
+                echo 'Certificate exists and is still valid'
+              fi
             fi
-          fi
 
-          if [ "$need_gen" -eq 1 ]; then
-            ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \
-              -keyout "${keyPath}" \
-              -out "${certPath}" \
-              -subj "/CN=${serviceDomain}" \
-              -addext "subjectAltName=DNS:${serviceDomain}"
+            if [ "$need_gen" -eq 1 ]; then
+              ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \
+                -keyout "${keyPath}" \
+                -out "${certPath}" \
+                -subj "/CN=${serviceDomain}" \
+                -addext "subjectAltName=DNS:${serviceDomain}"
 
-            chmod 0644 "${certPath}"
-            chmod 0600 "${keyPath}"
-            chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}"
-          fi
-        '';
+              chmod 0644 "${certPath}"
+              chmod 0600 "${keyPath}"
+              chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}"
+            fi
+          '';
+        };
+      kanidm = {
+        environment.KANIDM_TRUST_X_FORWARD_FOR = "true";
+        serviceConfig.RestartSec = "30";
       };
+    };
+
 
 
     # system.activationScripts."createPersistentStorageDirs" = lib.mkIf config.swarselsystems.isImpermanence {
@@ -208,7 +215,7 @@ in
           # tls_key = config.sops.secrets.kanidm-self-signed-key.path;
           tls_key = keyPathBase;
           bindaddress = "0.0.0.0:${toString servicePort}";
-          trust_x_forward_for = true;
+          # trust_x_forward_for = true;
         };
         enableClient = true;
         clientSettings = {
@@ -405,7 +412,6 @@ in
       };
     };
 
-    systemd.services.${serviceName}.serviceConfig.RestartSec = "30";
 
     nodes =
       let

modules/nixos/server/koillection.nix

@@ -1,6 +1,6 @@
 { self, lib, config, globals, dns, confLib, ... }:
 let
-  inherit (confLib.gen { name = "koillection"; port = 2282; dir = "/var/lib/koillection"; }) servicePort serviceName serviceUser serviceDir serviceDomain serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "koillection"; port = 2282; dir = "/var/lib/koillection"; }) servicePort serviceName serviceUser serviceDir serviceDomain serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
   inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
   serviceDB = "koillection";
 
@@ -24,7 +24,7 @@ in
       koillection-env-file = { inherit sopsFile; };
     };
 
-    topology.self.services.${serviceName} = {
+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
       name = lib.swarselsystems.toCapitalized serviceName;
       info = "https://${serviceDomain}";
       icon = "${self}/files/topology-images/${serviceName}.png";

modules/nixos/server/mailserver.nix

@@ -16,6 +16,15 @@ in
   };
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
+    users = {
+      persistentIds = {
+        knot-resolver = confLib.mkIds 963;
+        postfix-tlspol = confLib.mkIds 962;
+        roundcube = confLib.mkIds 961;
+        redis-rspamd = confLib.mkIds 960;
+      };
+    };
+
     globals.services = {
       ${serviceName} = {
         domain = serviceDomain;
@@ -65,11 +74,12 @@ in
       domains = [ baseDomain ];
       indexDir = "${serviceDir}/indices";
       openFirewall = true;
-      certificateScheme = "acme";
+      # certificateScheme = "acme";
       dmarcReporting.enable = true;
       enableSubmission = true;
       enableSubmissionSsl = true;
       enableImapSsl = true;
+      x509.useACMEHost = globals.domains.main;
 
       loginAccounts = {
         "${user1}@${baseDomain}" = {

modules/nixos/server/matrix.nix

@@ -1,4 +1,4 @@
-{ self, lib, config, pkgs, globals, dns, confLib, ... }:
+{ lib, config, pkgs, globals, dns, confLib, ... }:
 let
   inherit (config.swarselsystems) sopsFile;
   inherit (confLib.gen { name = "matrix"; user = "matrix-synapse"; port = 8008; }) servicePort serviceName serviceUser serviceGroup serviceDomain serviceAddress proxyAddress4 proxyAddress6;
@@ -63,14 +63,6 @@ in
 
     # networking.firewall.allowedTCPPorts = [ servicePort federationPort ];
 
-    topology.self.services = lib.listToAttrs (map
-      (service:
-        lib.nameValuePair "mautrix-${service}" {
-          name = "mautrix-${service}";
-          icon = "${self}/files/topology-images/mautrix.png";
-        })
-      [ "whatsapp" "signal" "telegram" ]);
-
     systemd = {
       timers."restart-bridges" = {
         wantedBy = [ "timers.target" ];

modules/nixos/server/microbin.nix

@@ -12,6 +12,7 @@ in
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
     users = {
+      persistentIds.${serviceName} = confLib.mkIds 964;
       groups.${serviceGroup} = { };
 
       users.${serviceUser} = {

modules/nixos/server/mpd.nix

@@ -1,4 +1,4 @@
-{ self, lib, config, pkgs, confLib, ... }:
+{ lib, config, pkgs, confLib, ... }:
 let
   inherit (config.swarselsystems) sopsFile;
   inherit (confLib.gen { name = "mpd"; port = 3254; }) servicePort serviceName serviceUser serviceGroup;
@@ -30,10 +30,10 @@ in
       mpv
     ];
 
-    topology.self.services.${serviceName} = {
-      info = "http://localhost:${builtins.toString servicePort}";
-      icon = lib.mkForce "${self}/files/topology-images/mpd.png";
-    };
+    # topology.self.services.${serviceName} = {
+    #   info = "http://localhost:${builtins.toString servicePort}";
+    #   icon = lib.mkForce "${self}/files/topology-images/mpd.png";
+    # };
 
     environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
       directories = [{ directory = "/var/lib/${serviceName}"; user = "mpd"; group = "mpd"; }];

modules/nixos/server/shlink.nix

@@ -1,6 +1,6 @@
 { self, lib, config, dns, globals, confLib, ... }:
 let
-  inherit (confLib.gen { name = "shlink"; port = 8081; dir = "/var/lib/shlink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "shlink"; port = 8081; dir = "/var/lib/shlink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
   inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
 
   containerRev = "sha256:1a697baca56ab8821783e0ce53eb4fb22e51bb66749ec50581adc0cb6d031d7a";
@@ -31,6 +31,12 @@ in
       };
     };
 
+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
+      name = lib.swarselsystems.toCapitalized serviceName;
+      info = "https://${serviceDomain}";
+      icon = "${self}/files/topology-images/${serviceName}.png";
+    };
+
     virtualisation.oci-containers.containers.${serviceName} = {
       image = "shlinkio/shlink@${containerRev}";
       environment = {
@@ -77,12 +83,6 @@ in
       { directory = "/var/lib/containers"; }
     ];
 
-    topology.self.services.${serviceName} = {
-      name = lib.swarselsystems.toCapitalized serviceName;
-      info = "https://${serviceDomain}";
-      icon = "${self}/files/topology-images/${serviceName}.png";
-    };
-
     globals = {
       networks = {
         ${webProxyIf}.hosts = lib.mkIf isProxied {

modules/nixos/server/slink.nix

@@ -1,6 +1,6 @@
 { lib, config, dns, globals, confLib, ... }:
 let
-  inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
+  inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6 topologyContainerName;
   inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
 
   containerRev = "sha256:98b9442696f0a8cbc92f0447f54fa4bad227af5dcfd6680545fedab2ed28ddd9";
@@ -15,6 +15,12 @@ in
       podman = true;
     };
 
+    topology.nodes.${topologyContainerName}.services.${serviceName} = {
+      name = lib.swarselsystems.toCapitalized serviceName;
+      info = "https://${serviceDomain}";
+      icon = "services.not-available";
+    };
+
     virtualisation.oci-containers.containers.${serviceName} = {
       image = "anirdev/slink@${containerRev}";
       environment = {
@@ -54,12 +60,6 @@ in
       { directory = serviceDir; }
     ];
 
-    topology.self.services.${serviceName} = {
-      name = lib.swarselsystems.toCapitalized serviceName;
-      info = "https://${serviceDomain}";
-      icon = "services.not-available";
-    };
-
     globals = {
       networks = {
         ${webProxyIf}.hosts = lib.mkIf isProxied {

modules/nixos/server/ssh-builder.nix

@@ -1,4 +1,4 @@
-{ self, pkgs, lib, config, ... }:
+{ self, pkgs, lib, config, confLib, ... }:
 let
   ssh-restrict = "restrict,pty,command=\"${wrapper-dispatch-ssh-nix}/bin/wrapper-dispatch-ssh-nix\" ";
 
@@ -20,6 +20,7 @@ in
   options.swarselmodules.server.ssh-builder = lib.mkEnableOption "enable ssh-builder config on server";
   config = lib.mkIf config.swarselmodules.server.ssh-builder {
     users = {
+      persistentIds.builder = confLib.mkIds 965;
       groups.builder = { };
       users.builder = {
         useDefaultShell = true;

modules/nixos/server/transmission.nix

@@ -2,6 +2,7 @@
 let
   inherit (confLib.gen { name = "transmission"; port = 9091; }) serviceName servicePort serviceDomain;
   inherit (confLib.static) isHome homeServiceAddress homeWebProxy nginxAccessRules;
+  inherit (config.swarselsystems) sopsFile;
 
   lidarrUser = "lidarr";
   lidarrGroup = lidarrUser;
@@ -23,6 +24,10 @@ in
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} and friends on server";
   config = lib.mkIf config.swarselmodules.server.${serviceName} {
 
+    sops.secrets = {
+      pia = { inherit sopsFile; };
+    };
+
     # this user/group section is probably unneeded
     users = {
       persistentIds = {
@@ -107,6 +112,17 @@ in
     };
 
     services = {
+      pia = {
+        enable = true;
+        credentials.credentialsFile = config.sops.secrets.pia.path;
+        protocol = "wireguard";
+        autoConnect = {
+          enable = true;
+          region = "sweden";
+        };
+        portForwarding.enable = true;
+        dns.enable = true;
+      };
       radarr = {
         enable = true;
         user = radarrUser;