diff --git a/SwarselSystems.org b/SwarselSystems.org index abca051..cda52c9 100644 --- a/SwarselSystems.org +++ b/SwarselSystems.org @@ -297,6 +297,18 @@ Here I give a brief overview over the hostmachines that I am using. This is held |🔗 **Link Shortener** | [Shlink](https://github.com/Swarsel/.dotfiles/tree/main/modules/nixos/server/shlink.nix) | #+end_src +** Manual steps when setting up a new machine + +#+begin_src markdown :noweb yes :exports both :results html + + <> + + If the new machine is a work machine, these steps are additionally needed: + + <> + +#+end_src + * flake.nix :PROPERTIES: :CUSTOM_ID: h:c7588c0d-2528-485d-b2df-04d6336428d7 @@ -10580,6 +10592,14 @@ This holds configuration that is specific to framework laptops. Options that I need specifically at work. There are more options at [[#h:f0b2ea93-94c8-48d8-8d47-6fe58f58e0e6][Work]] (home-manager side). +When setting up a new machine: + +#+begin_src markdown :noweb-ref worksetup :exports both :results html + - setup the work VPN: + - using the laptop certificate `.pem` as User cert and private key (CA cert: none) + - vpn gateway is found in `nixosConfig.repo.secrets.local.work.vpnGateway` +#+end_src + #+begin_src nix-ts :tangle modules/nixos/optional/work.nix { self, lib, pkgs, config, configName, ... }: let @@ -14427,7 +14447,18 @@ Currently, I am too lazy to explain every option here, but most of it is very se :CUSTOM_ID: h:7d384e3b-1be7-4644-b304-ada4af0b692b :END: -Settinfs that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here. +Settings that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here. + +When setting up a new machine: + +#+begin_src markdown :noweb-ref setup :exports both :results html + - setup gpgsm for signing of mails using S/MIME: + - `gpgsm --import ~/Certificates/.p12` + - `gpgsm --import ~/Certificates/harica-root.pem` + - `gpgsm --import ~/Certificates/harica-intermediate.pem` + - `gpgsm --list-keys --with-validation "HARICA Client RSA Root CA 2021"` + - trust the certificate and set passphrase +#+end_src #+begin_src nix-ts :tangle modules/home/common/gpg-agent.nix { self, lib, config, pkgs, ... }: @@ -15216,13 +15247,21 @@ The rest of the settings is at [[#h:fb3f3e01-7df4-4b06-9e91-aa9cac61a431][gaming #+end_src -**** Work +**** Work (pizauth) :PROPERTIES: :CUSTOM_ID: h:f0b2ea93-94c8-48d8-8d47-6fe58f58e0e6 :END: The rest of the settings is at [[#h:bbf2ecb6-c8ff-4462-b5d5-d45b28604ddf][work]]. Here, I am setting up the different firefox profiles that I need for the SSO sites that I need to access at work as well as a few ssh shorthands. +When setting up a new machine: + +#+begin_src markdown :noweb-ref setup :exports both :results html + - setup pizauth for microsoft mail sync (account names are possibly `uni` and `work`): + - `pizauth auth ` + - `pizauth dump > ~/.pizauth.state` +#+end_src + #+begin_src nix-ts :tangle modules/home/optional/work.nix :noweb yes { self, config, pkgs, lib, vars, nixosConfig ? config, ... }: let @@ -22120,6 +22159,14 @@ This sets up the =dashboard=, which is really quite useless. But, it looks cool :END: This sections is no longer used really. An introduction can be found in [[#h:bcc3ebbe-df8a-46bd-b42d-73aad6fc66e5][Structure of this file]] under the historical note. The little noweb-ref blocks that I still use are found in [[#h:48e0cb2c-e412-4ae3-a244-80a8c09dbb02][Hosts]] and [[#h:3bb92528-c61c-4b8d-8214-bf2a40baaa32][Services]]. +** General steps when setting up a new machine + +These general steps are needed when setting up a new machine and do not fit into another block well: + +#+begin_src markdown :noweb-ref setup :exports both :results html + - setup yubikey (automatic yubikey enrollment is not yet supported by `disko`): + - `systemd-cryptenroll --fido2-device=auto /dev/` +#+end_src * Appendix B: Supplementary Files :PROPERTIES: diff --git a/hosts/nixos/pyramid/secrets/pii.nix.enc b/hosts/nixos/pyramid/secrets/pii.nix.enc index f95ff57..8545d57 100644 --- a/hosts/nixos/pyramid/secrets/pii.nix.enc +++ b/hosts/nixos/pyramid/secrets/pii.nix.enc @@ -1,5 +1,5 @@ { - "data": "ENC[AES256_GCM,data:Avje6G0sf17iETA622PNdboM3FlYSFtdiPtEuCKpytuUS/2ATu1g9rTeLuSwKHzMfuweF1l+GWkME4D3PQZ2hzgtyByISnuHTFB0kO/QmnmpoNpEkGXgUKpogEaFWiTyFkg+Ceo8IFzSA+AW22DcNnU6ygZlnuK92XH3qJ9F/xyF8yd3eFXx9skA68GdpyoOxnw648ZKeL0/mWLcZVSxDpt7o2bnnL/lU8qp4HErRkgbIh8aUCfaZjRJMXOMfZj4rNSZ58ZCSTl1akuDRYQfqk8WdprrveDXVPtFe3Ol1LY2yqZtTTjE/L94fmQtkLE4U36uJfQBtnUAjqXJQqCpZRrJcQgqPyW29CWwIxK/2hccYIikv6033j2kUKQbXWMcniBsnFfmBvLLKBHdylNX2AstKjtkJ48dZskL833QvYwxNxePEk0heJ463goWHtDLWNFAMW5vrI/BYg8NM6PDYvZWG6yswUZFlUmzKoQxzbxKgnsXj4yDH+pNu8B8uWzKaEYDQjeKdOPEhagNVroeT+T6r0hp/sEJUTh8ekIwpmmNssF7DalKumEcuQy0K3Lvt7fUhB5Z+dFMz3eqhQuXtwQl9p0mpf13F8qVtbuB4Ye0N8HmGFp+TF5sVXy1RsgP80uVawaqKVyhiRoT+ZDMUno4MwkmPAmkYhemkH9UIsooiRdFOb9W4zzQbpC79htnGXGVWgDQMNYVun/TX0RMNnmFls/HoPQz5Ft6sKQp6cQ8bNxsWMJKTRR/Y8g32OomcGMegPDM+oeutvTFkUhhZdgFHd98brOZjrEeQVwyh6fOLqHaSIZB8XFjh/rDytPbX85/HQSH+k9zWgL4kpHoZeLPUK0alY2RMFlYuNd/a8yhgdlQZGGSfVP92JrdmOcTxgOd11zy6/eTWBWVZVE279CJvAYkKDTFN/MyoAC0gTl2mR9vW44BbDAHywOy8AJjzoDMWacg7DBFSqxW9ZGJbFs3udqYk5IDhrdOz941jE+WsP978K8uTn2F7d/Qz6lhmberdyIuPC0H18+2Gzv1L/LWtc6/kqqPOB9RYrlaayAfymqNV/3FdhFSxfx4Pm4SD5MIaZ99FS7+AwP3B5kmnCZToLZlFsgPL9DUwqwgx69gQxUlb362ih5swaCY0nOL63oa6c25/UvO9rYkDh52FhGl1N9gzvbzbYC0Mp7QuwzF1XWUFbhE+f9aJ6bAXHyS10GMfa76eLnnoPSslYZ4rZfLMjHOGjbTMY7wTLl50wKg4VbThWtpkxwbITGd5VZH1/iO6e7F8K0gMwHNMYSm/doNaRcN1HWi7eD6YtQVWlWlewx0C9BzW6TsOy3e9MtQBULFDkPEIbzoT/29dS1o7YKyomdBG867xbqKV31DkqBpq9G0Fv6kHCeu5MmfzeqhueA11+XFQvvNl2KsLW5LvlP7GPOl0VjlEBY61SGjXibMGcLOAEgsxyzzZhLP97pl1dTb2yokBkDTy9n9pgpWJ5NmZi68XMVew8Nx4vz0Dj6jZruPgO3vBtpUytx6vjp/hwKcUQq09PxY8QN5l3gfmZJvAiDMuZh6ZzaJvVhkK/afzt2YN1rozd+Ibo4k3831X+RkfKLFoiA6E0g9SEgm6HAl/gfRIKR740yH0uVVbpCNIRpfBuAQMAvoLczcgYjsMaZ5hqHh0nOC+hsHmEIP47KrPzyA8U3+TjQEbAN1aHAGkzVDVJ4E8iwPkPAP0B+b6mtSNfscdyG5iX2zlqcivvA51s8zouhxEZ4KZ9TiVtg6dlngP7fu1SjM2DYzG2Sshg8L+WyzFFjDgWPe5RO8btzWEFuNTpFgvaRYQWONa7JWgnigP4ZE7Tc+shN8BXGhjJnGM4Z1+PNPRWvB/d1Fqe1KbgTyVFHizD8DnNWmfgghFLOwenKbZXe8wAAGmfIaCHE7IMrTSeuqhfKpGGnrnlE9Hd3y/8ojYtOFPQ16ohTPxBVwN/gt8RCmBdP+i4Y11He0vdX3HaF3W9yGkIPDLY/aJ33NvK9lmCvXBYANSLirBJmY/xEgdxIbG9TDRnZPoUQ0b8WBZS8RFg7wuxNucNrMAHp+8n3Ww0D9+zqo1rropr7FRc1xYjRrxSvx+g0xhb46qe7In+mSaJy1seITD6T+LdnOz3SK6bXpZ1I1sg7B0XXCLyMe2cs3KrqmUwDYowm6rbyM65X2CVgl/ULXg0rjPBaKqqYpFeQDAYdBgLiLiA99tWhI3hf6WEYb9aio6gIgkDtKMe242TnauUBkCDHxqgC/Lhp4fG4+TCjRTNopO3nmEYoYH67+VQONyU4YRn7lmWReT5pFrkczBIogeihgCwL+zNzA/f4wvGdADNLH9uxuGIpR5a1/HwWa6cKxCQ375kl013By6dHre50zal18KHMz/ou8dDQOsWDMbjE01aDJEHHSVPZiySjXiNWD+mvy8SE8hMRVyP/9PyB91wXwhRAU1UJifFSCuKAlqkwOCkqrMJ+EDhoIrGhx+XfM84/wu/RIowKTtF4Zz7CmpjN8cSgm+Ht4akg7XaBiAGsZMal3TY33SzY7MHZ1Tsv2AeYHPtssyXBdVd8GRZAw7phoPqXpV1hSvLwS7fY2F3+Ie8U3E55p4U7HrYGo9SHqF90rSB/tUhQdah7ptcpywBWlCWqA9L+q7I5kljSLFSf/2Hl1B33M80rCCdnOSiyjawF+0n9Pysw4C/z0aHQIBTDYYTZ9a6RIEjHDFlX7GKX8CKw6XvTvsIgs2kDklcUNTgXI5MRMtkyIrh081V2gNj65B0+yWxlK2VvyKLv2AuFCH2m401Dazusp89yA624wMFRF/DQmiC7MPvWFMzhLbsQu3dRW+JKDv88t18OymQeQlbP+lNdff4Cd4fVoTqt6xCoDLrIcmX/rw9QZnmJF/dW2wmMVQIONdfBx6O+CHsaaLScHdJg0/RIfjA8bkObPh+p1ULvJ9ddLQA5J7Cd2omwhZqXpPbAiveykCEWRMOCD0mama5RHJOyNnqQGYUmPvpq+QwaR4+6DeGy319uyNiLcmKKMIx+hSq2qQhK+ler1DS5VLJC0g5rWcovE7bUs7sNKETvMfO8gr1Crve2wTWA6DCrNZSSkWXwzwJOsVmVx66e/hmh17k/DCqDG55z11QR6X7C0EryzAj1JPJ6wG9KamgsZOCqJL1h2piNdbTnnBPfE5btg2OIw1453OYgWI2f833p6BZR4irditSs67fNt4ZFGad7pq5ETlpFU1FQUZFuEm7iFrw==,iv:7YztaPs7GSC4AdIF36G3qb8lQAhUwkaD613z8LcUW7A=,tag:ULku+TZreQNt5/6ZyLtWog==,type:str]", + "data": "ENC[AES256_GCM,data:8y8t7e8XhVy3lc+JcPnFFzI7DTpr+JlXfOKZJu7uX7DczTYQHIZQTrMcFjyBbB8SWJLWLUG8Yd5JGXk377CBX73cxGF+r895lxP+puoKRRzDapkg6y2uN0E3Gr1wnQFB4I8YX7n8UWnj18s3mTIohQHmhoxkuIqu2zvgEGBpMiz3oZIL4zmb8diLXh4PyB1qAI5U5RFWPpkwRWjXteD5m8mqcZ8k4A4l00IMgz2n9MJDQPMjYNITR3XbOlI1qNMYBVb3xuVLXBOBN6x5W4539kGAiHcAi8pOUvBjAXphOEGQ7uLoorAniHx2PPyqReDr5tx47h4RtKJGeGoJ6ZdaFS2LwD10Dkiac330ELLGpSuHoNn7cfw6P8xSyYfreIXbzgavZAlJ1t3fNjEwVtgz63bXL1IX326fP1WcFqBUgAMd8I+VZsxo15j92zZS8gUbdu4KdSMag4dlOa9rgJCLpZGw4UIifHn6RqbH8s/HdisWV2YA3p1/Oowp39Hnr1ZeUecHQCpC2Y/nVLZid9wy4NcIPDbkeb33vMzJ/G5o4EVeYcrnM4J7+KS7aJ4c2bbkRixc1w0bTYeQHFgvM9VBHHEO30t68AGEzju29XeMVi7bzamJZeApPEacMVzzCXlRiAWtPru9JtBYz17VXliMBiEc5Ffo12PXPV7VK/BimKBppJAGNSJiWg/fXawRJNs/fJkLywEL88cf3RYP0Wdy01umjU9tW7Y0W1zc46auKy8KPpCcT0e6kBGmlG2WJje3dNYDFUutFTllV+N7VeDOuZi4oaGrwF1Rz8cAKPrZWMyLX3bMc4EkP7t7h0DoTyXvl3CcA9/wgeCQrLIPLnUTBDTF6jsyt32IjxfiMMBTtR5hLJeM5BzybuYHI2Jbbnt2Ko+tCWOUNdRR7rOYT7o+xzm7g3apcrKIKaufc5YUxdD9asc8uAx+9w7tkg7O/2Ak9qPVgE7HIu9m5O4qaEQn8I1P1GbwiHZeIrfiRzcf6+KgjsLU7i+gCCb3EtMZJUS1CFmlyA+akgsFaunZFYLjg6vUmhQgTKhWooNj3DkdWXWN4bOB/lUyzsCezAD+HfPYyy2pYETRtS/XlpBktSYhP2yLZSxEyjsKBH8roZ/LpNwJV3RuvM+CPstj/pxf23Ayi8LrU1t88Q+/mje1OsMCr67Ltbl+7HXNcpM8zwLUfmTt72YZd1CnoAvbqM3pfecLM1AZEeR+p+xq8tsl1tRE2V0y/SH9kew4UOYRY/eZHmiy8P8Eyjj6/PL+/9+CLU9KGeK/28hGz1u1Ao03FxcPL1AeAeA1mlCNAErT/Q4GUKdDNa5uTHpU86VrMoELtvVaVn3V4AS5I+kTfvI9WF8oaI20U2ysAMpJSiPJyC5AVteyehXAEdGY7bgltvity8arU8efxwmrjbZ29ZWwRezqf1kZLb7pySCfsoqYwCFFDx4s7hD4RF1N4X9GQA5JupUO/+UZTcVX4aud+yf6uTb9yRC5LGjXJj5S03DQ+Vj35nZMUn6xhbPPnEj0uS9yug685mQm/bwUVHIEyoBZfPZquSSh1oolKsKnAPS2+fS13dr2sNuHktq40sJTTglz97ZexoIbZ7Ftx3tzFtqFMhh11EBV4eb0MCu9zwaq5DMoLugXECSkUy6Nfc9XGdRU/x3iIha36jg0wj9MwKNpztNFJzzWSVd8XU5rILbr9yWs4xZKBZq6PFx3NEXCIsJ0kkfc1FUBlnsiYG52A/zcFQZmUAPDy58M4rzLnWjC+qk7jU01Yw6aOcFqqE5kg9+AvYmF8JQ16s17d4o49I/fmL0MYVbSgdXrJZF9ejrkBkIMfu7UgbBlQdJCSW8BFx6zFmg2Y22bh52q8+//PK1rgUKs9RAsAasl8WKrKo+xNgai+1M9eMxg+wsBIP+j4WutMHXPv3AMeqt+JwIPiydPwny49820Z24h49pXPVK0EXTqZl46b7bUvyZqAbDTTDmjb/gOJII/ho6/EeaEUSk/r1NVUehq5S/e/UJagTDI3csmBgEcMYdk5CfoJt0cDeqHgrAo8U8xpURT5BAbeCHwWpI7sE47LZwHStf9WbHyacCGsob+ELvfMvunaY2YmqnlVaYulf0mgmn5YmBI8ouQ2Zc4eklzso+NN6e9j7ODhxPxF/MWKjoi/kpF8eBiEKEbPk0drOS4PcOFEDvbA7fFrwiwUnTqG2+FVBTgyidxDYX70jX5asox5wBc4WAgPXU0WNNb5I2bbenUoGKbDrZ989FblN5I3xnP5kxFq25evPtEvA5R9mwBYtBnd3UBBnDzcsI6gA7o73VW7Y25gfX5ODTRbMjxGYBU+xnNK+B9IOeMGTmFjuqchrlyaSOQ9T2Wx4kNyVUwWRMw/eZPkP6LtEQLVM8iotO6BNcPVqx6dCU4nh19IbjbfyrO0I5ZqSV/PVCRx2Pomceu0EfMpVReFvlIi/UyKROzLuOy6AY1RlthR8gM39l6a6l+WZeukkn+SoAEXeyw4U83K2H9WR6hYcgX0SPGVYfI3C83I0EChET30kiX/rb/fFtb8xdQogA4+R/vR3mPBaGMiWh0WDZVDhNy5/DlwYPYp1zDxtVjQffEhqWS5FqRdw5BsQJQc9glptU5QCgY/ITYwGlaW4OYWokFQWinH0JF9bcCjjjZMT9C52N9ZuZ0muxTT2/UxyhKhX7Eojxq6sz0HJ+TISa5FpUKx/W7I+XqT25n3PtKfnkRDDba+RxDy3bCYo60aOPfR9aCG0VbGLWgc4TQHCmC209rSSIlsD2DhBzFC2lCxasXHIgNAymGfbpOjvqdId9ev1XN0EEd0al4HBUvvGsq9FUeshAWMeWDKu1t0aDKJ6/c4bphThjoAqxtQaGPUFOhNw94PedCBgiRqXN02WZcrnqp/spj+uIfch1F/X5A3jTUev8vq/s7lge7h3CNWXNpBFrW5trdzE8N2Kw3AahsJfZCo/Qd9e6WHIDRgbZFEbKwkTIyeEW8rMv5Ls0Aq+kFvs76muJVnr+Pb7e/GabhgT3pPhYNLQWjPRQYkF2KDKrGUlrc2BkJqRLF3fhI7vQPFphWPl0Lj5idYglIn5v2P2HR9n3Z1+9oyIpmFsqjqILCdoMCDleQOb4DCzXnR5QE4LKg/jjJqqGyO4mAbpwdvN9Q4j1FOUsJNOgMNBUUdEr7n65ktKnJX5wX9cymosRUozgoteb2dblFJjY/pf8toH5kU+YIYmbQR0caw8tdpBl0ETcsaQpF3LbCsSfmN8tZyxS4R/0W782i08IsaN9uXEevlsyFgMg7I2q739fHqJ7kFeosXpKdUpOnmuoLu1A7,iv:9SAQXPwrhy5yjkNxn1lITD77MjqdrYOSlFpUBE8a/fY=,tag:tYApnwq2auUk+/N9alPX3w==,type:str]", "sops": { "age": [ { @@ -11,8 +11,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z2tONmQxTUhZUW12Z2Jm\nUnoxSnpYcnZDNGNzSko1ckl2RDh3NG1VS2dFCmIwUXhmSk1OUk02S0JPVDR5UWJ4\na0gwWlg0V005ZWxYa29PZ0laS2VqM0kKLS0tIHN5SU9pQ090eHljeXJGWm5hRFQ4\nZ001Nzkyb29RYkNUMDNDNlo4YnVQeTQK34bNIBgxId2+DHKQNVV3Iro3KGkE03Sp\niB1+dADT6nRvGvoyPqnLq/NYfw7eQ6XqYt55zkdCta8v6L1UNUkw8g==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2025-10-21T17:51:36Z", - "mac": "ENC[AES256_GCM,data:nogwxr8xZVIPv1vnZyBZuGu5WHO7ygxfeoF+Nrmdqin4YrZ8nK3f8oVNAsEBfNvUyr2mkRAbAT3tgcP+u/w+RJgH9ERHWljnw5xy8iGLkTF36B83+lCL7cp3wIzllOQyRUYEHegnQWA79WoWWHD3u4sZmlinByJRUMscRV9uTww=,iv:rZd+3+WlcOVtqgJGhoBkJGm/HF/01wuopeFlEwvcupI=,tag:P7fIdk4ithHyOAfqui6xNw==,type:str]", + "lastmodified": "2025-10-21T19:32:24Z", + "mac": "ENC[AES256_GCM,data:wM862FQH/qX/abuD+krJOazli9Ci5GrpLtdcnzFgKCeNdjA2cfZ8M3DyzsBwMXjp6HxBHLyO7QXGcQkx3kIKGnRhEBuQzVOtrZhqcDi2Ho8iBV8Dh4xkhcpBYufw7xP8hGWg6ZVZ4JyM3P4NfAdxbfWTdc1VMStAafJ2SZ3pAYI=,iv:tDAKNe8LV40hRCqKzN6j6B71IV81SnrBgerxGPzU4Zk=,tag:7ZsST8pl9TjMog0dNKcUcA==,type:str]", "pgp": [ { "created_at": "2025-06-14T22:31:01Z", diff --git a/index.html b/index.html index 28c698b..07f172c 100644 --- a/index.html +++ b/index.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + SwarselSystems: NixOS + Emacs Configurationo @@ -209,6 +209,7 @@
  • 1.4. Hosts
  • 1.5. Programs
  • 1.6. Services
    • +
  • 1.7. Manual steps when setting up a new machine
  • 2. flake.nix @@ -443,8 +444,8 @@
  • 3.2.5.8. Hibernation
  • 3.2.5.9. BTRFS
  • 3.2.5.10. work
    • -
  • 3.2.5.11. microvm-host
    • -
  • 3.2.5.12. microvm-guest
    • +
  • 3.2.5.11. microvm-host
    • +
  • 3.2.5.12. microvm-guest
    • @@ -472,7 +473,7 @@
  • 3.3.1.12. Sourcing environment variables
  • 3.3.1.13. General Programs: bottom, imv, less, lesspipe, sioyek, bat, carapace, wlogout, swayr, yt-dlp, mpv, jq, nix-index, ripgrep, pandoc, fzf, zoxide, timidity
  • 3.3.1.14. nix-index
    • -
  • 3.3.1.15. nix-your-shell
    • +
  • 3.3.1.15. nix-your-shell
  • 3.3.1.16. password-store
  • 3.3.1.17. direnv
  • 3.3.1.18. eza
    • @@ -495,12 +496,12 @@
  • 3.3.1.31.3. Mako
  • 3.3.1.31.4. SwayOSD
  • 3.3.1.31.5. yubikey-touch-detector
    • -
  • 3.3.1.31.6. blueman-applet
    • -
  • 3.3.1.31.7. network-manager-applet
    • -
  • 3.3.1.31.8. obsidian service for tray
    • -
  • 3.3.1.31.9. anki service for tray
    • -
  • 3.3.1.31.10. element service for tray
    • -
  • 3.3.1.31.11. vesktop service for tray
    • +
  • 3.3.1.31.6. blueman-applet
    • +
  • 3.3.1.31.7. network-manager-applet
    • +
  • 3.3.1.31.8. obsidian service for tray
    • +
  • 3.3.1.31.9. anki service for tray
    • +
  • 3.3.1.31.10. element service for tray
    • +
  • 3.3.1.31.11. vesktop service for tray
  • 3.3.1.32. Sway
    • @@ -509,17 +510,17 @@
  • 3.3.1.35. gpg-agent
  • 3.3.1.36. gammastep
  • 3.3.1.37. Spicetify
    • -
  • 3.3.1.38. Obsidian
    • -
  • 3.3.1.39. Anki
    • -
  • 3.3.1.40. Element-desktop
    • -
  • 3.3.1.41. Hexchat
    • -
  • 3.3.1.42. obs-studio
    • -
  • 3.3.1.43. spotify-player
    • -
  • 3.3.1.44. vesktop
    • -
  • 3.3.1.45. batsignal
    • -
  • 3.3.1.46. autotiling
    • -
  • 3.3.1.47. swayidle
    • -
  • 3.3.1.48. swaylock
    • +
  • 3.3.1.38. Obsidian
    • +
  • 3.3.1.39. Anki
    • +
  • 3.3.1.40. Element-desktop
    • +
  • 3.3.1.41. Hexchat
    • +
  • 3.3.1.42. obs-studio
    • +
  • 3.3.1.43. spotify-player
    • +
  • 3.3.1.44. vesktop
    • +
  • 3.3.1.45. batsignal
    • +
  • 3.3.1.46. autotiling
    • +
  • 3.3.1.47. swayidle
    • +
  • 3.3.1.48. swaylock
  • 3.3.2. Server @@ -536,7 +537,7 @@
  • 3.3.4. Optional @@ -584,8 +585,8 @@
  • 3.5.31. swarsel-build
  • 3.5.32. swarsel-instantiate
  • 3.5.33. sshrm
    • -
  • 3.5.34. endme
    • -
  • 3.5.35. git-replace
    • +
  • 3.5.34. endme
    • +
  • 3.5.35. git-replace
  • 3.6. Profiles @@ -594,7 +595,7 @@
    • -
  • 5. Appendix A: Noweb-Ref blocks
    • +
  • 5. Appendix A: Noweb-Ref blocks + +
  • 6. Appendix B: Supplementary Files
    • 6.1. Server Emacs config
      • @@ -837,7 +843,7 @@

      -This file has 96128 words spanning 24842 lines and was last revised on 2025-10-21 13:09:36 +0200. +This file has 96609 words spanning 24942 lines and was last revised on 2025-10-21 21:36:59 +0200.

      @@ -906,7 +912,7 @@ This section defines my Emacs configuration. For a while, I considered to use ry

      -My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-10-21 13:09:36 +0200) +My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-10-21 21:36:59 +0200)

    @@ -1205,6 +1211,33 @@ Here I give a brief overview over the hostmachines that I am using. This is held |✂️ **Paste Tool** | [Microbin](https://github.com/Swarsel/.dotfiles/tree/main/modules/nixos/server/microbin.nix) | |📸 **Image Sharing** | [Slink](https://github.com/Swarsel/.dotfiles/tree/main/modules/nixos/server/slink.nix) | |🔗 **Link Shortener** | [Shlink](https://github.com/Swarsel/.dotfiles/tree/main/modules/nixos/server/shlink.nix) | + + + + +
    +

    1.7. Manual steps when setting up a new machine

    +
    +
    +
    +- setup gpgsm for signing of mails using S/MIME:
+  - `gpgsm --import ~/Certificates/<certname>.p12`
+  - `gpgsm --import ~/Certificates/harica-root.pem`
+  - `gpgsm --import ~/Certificates/harica-intermediate.pem`
+  - `gpgsm --list-keys --with-validation "HARICA Client RSA Root CA 2021"`
+    - trust the certificate and set passphrase
+- setup pizauth for microsoft mail sync (account names are possibly `uni` and `work`):
+  - `pizauth auth <account name, e.g. 'work'>`
+  - `pizauth dump > ~/.pizauth.state`
+- setup yubikey (automatic yubikey enrollment is not yet supported by `disko`):
+  - `systemd-cryptenroll --fido2-device=auto /dev/<device, e.g. 'nvme0n1p2'>`
+
+If the new machine is a work machine, these steps are additionally needed:
+
+- setup the work VPN:
+  - using the laptop certificate `.pem` as User cert and private key (CA cert: none)
+  - vpn gateway is found in `nixosConfig.repo.secrets.local.work.vpnGateway`
+
    @@ -11895,6 +11928,17 @@ This holds configuration that is specific to framework laptops. Options that I need specifically at work. There are more options at Work (home-manager side).

    +

    +When setting up a new machine: +

    + +
    +
    - setup the work VPN:
+  - using the laptop certificate `.pem` as User cert and private key (CA cert: none)
+  - vpn gateway is found in `nixosConfig.repo.secrets.local.work.vpnGateway`
+
    +
    + 
    { self, lib, pkgs, config, configName, ... }:
 let
@@ -12134,8 +12178,8 @@ in
    -
    -
    3.2.5.11. microvm-host
    +
    +
    3.2.5.11. microvm-host

    Some standard options that should be set for every microvm host. @@ -12161,8 +12205,8 @@ Some standard options that should be set for every microvm host.

    -
    -
    3.2.5.12. microvm-guest
    +
    +
    3.2.5.12. microvm-guest

    Some standard options that should be set vor every microvm guest. We set the default @@ -13089,7 +13133,7 @@ in SWARSEL_CAL3 = source3; SWARSEL_CAL3NAME = source3-name; SWARSEL_FULLNAME = fullName; - SWARSEL_MAIL_ALL = allMailAddresses; + SWARSEL_MAIL_ALL = lib.mkDefault allMailAddresses; GITHUB_NOTIFICATION_TOKEN_PATH = nixosConfig.sops.secrets.github-notifications-token.path; OPENROUTER_API_KEY = openrouterApi; }; @@ -13232,8 +13276,8 @@ nix-index provides a way to find out which packages are provided by which deriva

    -
    -
    3.3.1.15. nix-your-shell
    +
    +
    3.3.1.15. nix-your-shell
    { lib, config, ... }:
@@ -14946,8 +14990,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.6. blueman-applet
    +
    +
    3.3.1.31.6. blueman-applet
    { lib, config, ... }:
@@ -14961,8 +15005,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.7. network-manager-applet
    +
    +
    3.3.1.31.7. network-manager-applet
    { lib, config, ... }:
@@ -14977,8 +15021,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.8. obsidian service for tray
    +
    +
    3.3.1.31.8. obsidian service for tray
    { lib, config, ... }:
@@ -15012,9 +15056,13 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.9. anki service for tray
    +
    +
    3.3.1.31.9. anki service for tray
    +

    +Sets up a systemd user service for anki that does not stall the shutdown process. Note that the outcommented ExecStart does not work because the home-manager anki package builds a separate anki package that - I think - cannot be referenced as no such expression exists in the module. +

    + 
    { lib, config, ... }:
 {
@@ -15038,10 +15086,15 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
 
       Service = {
         # ExecStart = "${lib.getExe config.programs.anki.package}";
-        ExecStart = "/etc/profiles/per-user/swarsel/bin/anki";
+        Type = "simple";
+        ExecStart = "/etc/profiles/per-user/${config.swarselsystems.mainUser}/bin/anki";
         Environment = [
           "QT_QPA_PLATFORM=xcb"
         ];
+        TimeoutStopSec = "2s";
+        KillMode = "mixed";
+        KillSignal = "SIGTERM";
+        SendSIGKILL = "yes";
       };
     };
 
@@ -15051,8 +15104,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.10. element service for tray
    +
    +
    3.3.1.31.10. element service for tray
    { lib, config, pkgs, ... }:
@@ -15086,8 +15139,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.3.1.31.11. vesktop service for tray
    +
    +
    3.3.1.31.11. vesktop service for tray
    { lib, config, pkgs, ... }:
@@ -15891,9 +15944,23 @@ Currently, I am too lazy to explain every option here, but most of it is very se
 
    3.3.1.35. gpg-agent
    
 
    
 
    
-Settinfs that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here.
+Settings that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here.
 
    
 
+
    
+When setting up a new machine:
+
    
+
+
    
+
    - setup gpgsm for signing of mails using S/MIME:
+  - `gpgsm --import ~/Certificates/<certname>.p12`
+  - `gpgsm --import ~/Certificates/harica-root.pem`
+  - `gpgsm --import ~/Certificates/harica-intermediate.pem`
+  - `gpgsm --list-keys --with-validation "HARICA Client RSA Root CA 2021"`
+    - trust the certificate and set passphrase
+
    
+
    
+
 
    
 
    { self, lib, config, pkgs, ... }:
 let
@@ -16001,153 +16068,166 @@ in
    -
    -
    3.3.1.38. Obsidian
    +
    +
    3.3.1.38. Obsidian
    { lib, config, pkgs, nixosConfig ? config, ... }:
-  let
-    moduleName = "obsidian";
-    inherit (nixosConfig.repo.secrets.common.obsidian) userIgnoreFilters;
-    name = "Main";
-  in
-  {
-    options.swarselmodules.${moduleName} = lib.mkEnableOption "enable ${moduleName} with settings";
-    config = lib.mkIf config.swarselmodules.${moduleName} {
+let
+  moduleName = "obsidian";
+  inherit (nixosConfig.repo.secrets.common.obsidian) userIgnoreFilters;
+  name = "Main";
+in
+{
+  options.swarselmodules.${moduleName} = lib.mkEnableOption "enable ${moduleName} with settings";
+  config = lib.mkIf config.swarselmodules.${moduleName} {
 
-      home.file = {
-        "${config.programs.obsidian.vaults.${name}.target}/.obsidian/app.json".force = true;
-        "${config.programs.obsidian.vaults.${name}.target}/.obsidian/appearance.json".force = true;
-        "${config.programs.obsidian.vaults.${name}.target}/.obsidian/core-plugins.json".force = true;
-      };
+    home.file = {
+      "${config.programs.obsidian.vaults.${name}.target}/.obsidian/app.json".force = true;
+      "${config.programs.obsidian.vaults.${name}.target}/.obsidian/appearance.json".force = true;
+      "${config.programs.obsidian.vaults.${name}.target}/.obsidian/core-plugins.json".force = true;
+    };
 
-      programs.obsidian =
-        {
-          enable = true;
-          package = pkgs.obsidian;
-          defaultSettings = {
-            app = {
-              attachmentFolderPath = "attachments";
-              alwaysUpdateLinks = true;
-              spellcheck = false;
-              inherit userIgnoreFilters;
-              vimMode = false;
-              newFileLocation = "current";
-            };
-            corePlugins = [
-              "backlink"
-              "bookmarks"
-              "canvas"
-              "command-palette"
-              "daily-notes"
-              "editor-status"
-              "file-explorer"
-              "file-recovery"
-              "global-search"
-              "graph"
-              "note-composer"
-              "outgoing-link"
-              "outline"
-              "page-preview"
-              "properties"
-              "slides"
-              "switcher"
-              "tag-pane"
-              "templates"
-              "word-count"
-            ];
-            communityPlugins = with pkgs.swarsel-nix; [
-              advanced-tables
-              calendar
-              file-hider
-              linter
-              omnisearch
-              sort-and-permute-lines
-              tag-wrangler
-              tray
-            ];
+    programs.obsidian =
+      {
+        enable = true;
+        package = pkgs.obsidian;
+        defaultSettings = {
+          app = {
+            attachmentFolderPath = "attachments";
+            alwaysUpdateLinks = true;
+            spellcheck = false;
+            inherit userIgnoreFilters;
+            vimMode = false;
+            newFileLocation = "current";
           };
-          vaults = {
-            ${name} = {
-              target = "./Obsidian/${name}";
-              settings = {
-                appearance = {
-                  baseFontSize = lib.mkForce 19;
-                };
-                communityPlugins = with pkgs.swarsel-nix; [
-                  {
-                    pkg = advanced-tables;
-                    enable = true;
-                  }
-                  {
-                    pkg = calendar;
-                    enable = true;
-                  }
-                  {
-                    pkg = sort-and-permute-lines;
-                    enable = true;
-                  }
-                  {
-                    pkg = tag-wrangler;
-                    enable = true;
-                  }
-                  {
-                    pkg = tray;
-                    enable = true;
-                    settings = {
-                      launchOnStartup = false;
-                      hideOnLaunch = true;
-                      runInBackground = true;
-                      hideTaskbarIcon = false;
-                      createTrayIcon = true;
-                    };
-                  }
-                  {
-                    pkg = file-hider;
-                    enable = true;
-                    settings =
-                      {
-                        hidden = true;
-                        hiddenList = [
-                          "attachments"
-                          "images"
-                          "ltximg"
-                          "logseq"
-                        ];
-                      };
-                  }
-                  {
-                    pkg = linter;
-                    enable = true;
-                    settings = {
-                      auto-correct-common-misspellings = {
-                        skip-words-with-multiple-capitals = true;
-                      };
-                      convert-bullet-list-markers = {
-                        enabled = true;
-                      };
-                    };
-                  }
-                  {
-                    pkg = omnisearch;
-                    enable = true;
-                    settings = {
-                      hideExcluded = true;
-                    };
-                  }
+          hotkeys = {
+            "graph:open" = [ ];
+            "omnisearch:show-modal" = [
+              {
+                modifiers = [
+                  "Mod"
                 ];
+                key = "S";
+              }
+            ];
+            "editor:save-file" = [ ];
+            "editor:delete-paragraph" = [ ];
+          };
+          corePlugins = [
+            "backlink"
+            "bookmarks"
+            "canvas"
+            "command-palette"
+            "daily-notes"
+            "editor-status"
+            "file-explorer"
+            "file-recovery"
+            "global-search"
+            "graph"
+            "note-composer"
+            "outgoing-link"
+            "outline"
+            "page-preview"
+            "properties"
+            "slides"
+            "switcher"
+            "tag-pane"
+            "templates"
+            "word-count"
+          ];
+          communityPlugins = with pkgs.swarsel-nix; [
+            advanced-tables
+            calendar
+            file-hider
+            linter
+            omnisearch
+            sort-and-permute-lines
+            tag-wrangler
+            tray
+          ];
+        };
+        vaults = {
+          ${name} = {
+            target = "./Obsidian/${name}";
+            settings = {
+              appearance = {
+                baseFontSize = lib.mkForce 19;
               };
+              communityPlugins = with pkgs.swarsel-nix; [
+                {
+                  pkg = advanced-tables;
+                  enable = true;
+                }
+                {
+                  pkg = calendar;
+                  enable = true;
+                }
+                {
+                  pkg = sort-and-permute-lines;
+                  enable = true;
+                }
+                {
+                  pkg = tag-wrangler;
+                  enable = true;
+                }
+                {
+                  pkg = tray;
+                  enable = true;
+                  settings = {
+                    launchOnStartup = false;
+                    hideOnLaunch = true;
+                    runInBackground = true;
+                    hideTaskbarIcon = false;
+                    createTrayIcon = true;
+                  };
+                }
+                {
+                  pkg = file-hider;
+                  enable = true;
+                  settings =
+                    {
+                      hidden = true;
+                      hiddenList = [
+                        "attachments"
+                        "images"
+                        "ltximg"
+                        "logseq"
+                      ];
+                    };
+                }
+                {
+                  pkg = linter;
+                  enable = true;
+                  settings = {
+                    auto-correct-common-misspellings = {
+                      skip-words-with-multiple-capitals = true;
+                    };
+                    convert-bullet-list-markers = {
+                      enabled = true;
+                    };
+                  };
+                }
+                {
+                  pkg = omnisearch;
+                  enable = true;
+                  settings = {
+                    hideExcluded = true;
+                  };
+                }
+              ];
             };
           };
         };
-    };
-  }
+      };
+  };
+}
    -
    -
    3.3.1.39. Anki
    +
    +
    3.3.1.39. Anki
    { lib, config, pkgs, globals, nixosConfig ? config, ... }:
@@ -16219,8 +16299,8 @@ in
    -
    -
    3.3.1.40. Element-desktop
    +
    +
    3.3.1.40. Element-desktop
    { lib, config, ... }:
@@ -16256,8 +16336,8 @@ in
    -
    -
    3.3.1.41. Hexchat
    +
    +
    3.3.1.41. Hexchat
    { lib, config, nixosConfig ? config, ... }:
@@ -16281,8 +16361,8 @@ in
    -
    -
    3.3.1.42. obs-studio
    +
    +
    3.3.1.42. obs-studio
    { lib, config, ... }:
@@ -16302,8 +16382,8 @@ in
    -
    -
    3.3.1.43. spotify-player
    +
    +
    3.3.1.43. spotify-player
    { lib, config, ... }:
@@ -16323,8 +16403,8 @@ in
    -
    -
    3.3.1.44. vesktop
    +
    +
    3.3.1.44. vesktop
    { lib, config, ... }:
@@ -16410,8 +16490,8 @@ in
    -
    -
    3.3.1.45. batsignal
    +
    +
    3.3.1.45. batsignal
    { lib, config, ... }:
@@ -16443,8 +16523,8 @@ in
    -
    -
    3.3.1.46. autotiling
    +
    +
    3.3.1.46. autotiling
    { lib, config, ... }:
@@ -16465,8 +16545,8 @@ in
    -
    -
    3.3.1.47. swayidle
    +
    +
    3.3.1.47. swayidle
    { lib, config, pkgs, ... }:
@@ -16507,8 +16587,8 @@ in
    -
    -
    3.3.1.48. swaylock
    +
    +
    3.3.1.48. swaylock
    { lib, config, pkgs, ... }:
@@ -16714,641 +16794,656 @@ in
    -
    3.3.4.2. Work
    +
    3.3.4.2. Work (pizauth)

    The rest of the settings is at work. Here, I am setting up the different firefox profiles that I need for the SSO sites that I need to access at work as well as a few ssh shorthands.

    +

    +When setting up a new machine: +

    + +
    +
    - setup pizauth for microsoft mail sync (account names are possibly `uni` and `work`):
+  - `pizauth auth <account name, e.g. 'work'>`
+  - `pizauth dump > ~/.pizauth.state`
+
    +
    + 
    { self, config, pkgs, lib, vars, nixosConfig ? config, ... }:
-    let
-      inherit (config.swarselsystems) homeDir;
-    in
+let
+  inherit (config.swarselsystems) homeDir;
+  inherit (nixosConfig.repo.secrets.local.mail) allMailAddresses;
+  inherit (nixosConfig.repo.secrets.local.work) mailAddress;
+in
+{
+  options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
+  config = lib.mkIf config.swarselmodules.optional.work
     {
-      options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
-      config = lib.mkIf config.swarselmodules.optional.work
+      home.packages = with pkgs; [
+        stable.teams-for-linux
+        shellcheck
+        dig
+        docker
+        postman
+        # rclone
+        libguestfs-with-appliance
+        stable.prometheus.cli
+        tigervnc
+        # openstackclient
+
+        vscode
+      ];
+
+      systemd.user.sessionVariables = {
+        DOCUMENT_DIR_WORK = lib.mkForce "${homeDir}/Documents/Work";
+      } // lib.optionalAttrs (!config.swarselsystems.isPublic) {
+        SWARSEL_MAIL_ALL = lib.mkForce allMailAddresses;
+        SWARSEL_MAIL_WORK = lib.mkForce mailAddress;
+      };
+
+      accounts.email.accounts.work =
+        let
+          inherit (nixosConfig.repo.secrets.local.work) mailName;
+        in
         {
-          home.packages = with pkgs; [
-            stable.teams-for-linux
-            shellcheck
-            dig
-            docker
-            postman
-            # rclone
-            libguestfs-with-appliance
-            stable.prometheus.cli
-            tigervnc
-            # openstackclient
+          primary = false;
+          address = mailAddress;
+          userName = mailAddress;
+          realName = mailName;
+          passwordCommand = "pizauth show work";
+          imap = {
+            host = "outlook.office365.com";
+            port = 993;
+            tls.enable = true; # SSL/TLS
+          };
+          smtp = {
+            host = "outlook.office365.com";
+            port = 587;
+            tls = {
+              enable = true; # SSL/TLS
+              useStartTls = true;
+            };
+          };
+          thunderbird = {
+            enable = true;
+            profiles = [ "default" ];
+            settings = id: {
+              "mail.smtpserver.smtp_${id}.authMethod" = 10; # oauth
+              "mail.server.server_${id}.authMethod" = 10; # oauth
+              # "toolkit.telemetry.enabled" = false;
+              # "toolkit.telemetry.rejected" = true;
+              # "toolkit.telemetry.prompted" = 2;
+            };
+          };
+          msmtp = {
+            enable = true;
+            extraConfig = {
+              auth = "xoauth2";
+              host = "outlook.office365.com";
+              protocol = "smtp";
+              port = "587";
+              tls = "on";
+              tls_starttls = "on";
+              from = "${mailAddress}";
+              user = "${mailAddress}";
+              passwordeval = "pizauth show work";
+            };
+          };
+          mu.enable = true;
+          mbsync = {
+            enable = true;
+            expunge = "both";
+            patterns = [ "INBOX" ];
+            extraConfig = {
+              account = {
+                AuthMechs = "XOAUTH2";
+              };
+            };
+          };
+        };
 
-            vscode
+      # wayland.windowManager.sway.config = {
+      #   output = {
+      #     "Applied Creative Technology Transmitter QUATTRO201811" = {
+      #       bg = "${self}/files/wallpaper/navidrome.png ${config.stylix.imageScalingMode}";
+      #     };
+      #     "Hewlett Packard HP Z24i CN44250RDT" = {
+      #       bg = "${self}/files/wallpaper/op6wp.png ${config.stylix.imageScalingMode}";
+      #     };
+      #     "HP Inc. HP 732pk CNC4080YL5" = {
+      #       bg = "${self}/files/wallpaper/botanicswp.png ${config.stylix.imageScalingMode}";
+      #     };
+      #   };
+      # };
+
+      stylix = {
+        targets.firefox.profileNames =
+          let
+            inherit (nixosConfig.repo.secrets.local.work) user1 user2 user3;
+          in
+          [
+            "${user1}"
+            "${user2}"
+            "${user3}"
+            "work"
           ];
+      };
 
-
-          systemd.user.sessionVariables = {
-            DOCUMENT_DIR_WORK = lib.mkForce "${homeDir}/Documents/Work";
+      programs =
+        let
+          inherit (nixosConfig.repo.secrets.local.work) user1 user1Long user2 user2Long user3 user3Long user4 path1 loc1 loc2 site1 site2 site3 site4 site5 site6 site7 lifecycle1 lifecycle2 domain1 domain2 gitMail clouds;
+        in
+        {
+          openstackclient = {
+            enable = true;
+            inherit clouds;
           };
+          awscli = {
+            enable = true;
+            package = pkgs.stable24_05.awscli2;
+            # settings = {
+            #   "default" = { };
+            #   "profile s3-imagebuilder-prod" = { };
+            # };
+            # credentials = {
+            #   "s3-imagebuilder-prod" = {
+            #     aws_access_key_id = "5OYXY4879EJG9I91K1B6";
+            #     credential_process = "${pkgs.pass}/bin/pass show work/awscli/s3-imagebuilder-prod/secret-key";
+            #   };
+            # };
+          };
+          git.userEmail = lib.mkForce gitMail;
 
-          accounts.email.accounts.work =
-            let
-              inherit (nixosConfig.repo.secrets.local.work) mailAddress mailName;
-            in
-            {
-              primary = false;
-              address = mailAddress;
-              userName = mailAddress;
-              realName = mailName;
-              passwordCommand = "pizauth show work";
-              imap = {
-                host = "outlook.office365.com";
-                port = 993;
-                tls.enable = true; # SSL/TLS
-              };
-              smtp = {
-                host = "outlook.office365.com";
-                port = 587;
-                tls = {
-                  enable = true; # SSL/TLS
-                  useStartTls = true;
-                };
-              };
-              thunderbird = {
-                enable = true;
-                profiles = [ "default" ];
-                settings = id: {
-                  "mail.smtpserver.smtp_${id}.authMethod" = 10; # oauth
-                  "mail.server.server_${id}.authMethod" = 10; # oauth
-                  # "toolkit.telemetry.enabled" = false;
-                  # "toolkit.telemetry.rejected" = true;
-                  # "toolkit.telemetry.prompted" = 2;
-                };
-              };
-              msmtp = {
-                enable = true;
-                extraConfig = {
-                  auth = "xoauth2";
-                  host = "outlook.office365.com";
-                  protocol = "smtp";
-                  port = "587";
-                  tls = "on";
-                  tls_starttls = "on";
-                  from = "${mailAddress}";
-                  user = "${mailAddress}";
-                  passwordeval = "pizauth show work";
-                };
-              };
-              mu.enable = true;
-              mbsync = {
-                enable = true;
-                expunge = "both";
-                patterns = [ "INBOX" ];
-                extraConfig = {
-                  account = {
-                    AuthMechs = "XOAUTH2";
-                  };
-                };
-              };
+          zsh = {
+            shellAliases = {
+              dssh = "ssh -l ${user1Long}";
+              cssh = "ssh -l ${user2Long}";
+              wssh = "ssh -l ${user3Long}";
+            };
+            cdpath = [
+              "~/Documents/Work"
+            ];
+            dirHashes = {
+              d = "$HOME/.dotfiles";
+              w = "$HOME/Documents/Work";
+              s = "$HOME/.dotfiles/secrets";
+              pr = "$HOME/Documents/Private";
+              ac = path1;
             };
 
-          # wayland.windowManager.sway.config = {
-          #   output = {
-          #     "Applied Creative Technology Transmitter QUATTRO201811" = {
-          #       bg = "${self}/files/wallpaper/navidrome.png ${config.stylix.imageScalingMode}";
-          #     };
-          #     "Hewlett Packard HP Z24i CN44250RDT" = {
-          #       bg = "${self}/files/wallpaper/op6wp.png ${config.stylix.imageScalingMode}";
-          #     };
-          #     "HP Inc. HP 732pk CNC4080YL5" = {
-          #       bg = "${self}/files/wallpaper/botanicswp.png ${config.stylix.imageScalingMode}";
-          #     };
-          #   };
-          # };
+            sessionVariables = {
+              VSPHERE_USER = "$(cat ${nixosConfig.sops.secrets.vcuser.path})";
+              VSPHERE_PW = "$(cat ${nixosConfig.sops.secrets.vcpw.path})";
+              GOVC_USERNAME = "$(cat ${nixosConfig.sops.secrets.govcuser.path})";
+              GOVC_PASSWORD = "$(cat ${nixosConfig.sops.secrets.govcpw.path})";
+              GOVC_URL = "$(cat ${nixosConfig.sops.secrets.govcurl.path})";
+              GOVC_DATACENTER = "$(cat ${nixosConfig.sops.secrets.govcdc.path})";
+              GOVC_DATASTORE = "$(cat ${nixosConfig.sops.secrets.govcds.path})";
+              GOVC_HOST = "$(cat ${nixosConfig.sops.secrets.govchost.path})";
+              GOVC_RESOURCE_POOL = "$(cat ${nixosConfig.sops.secrets.govcpool.path})";
+              GOVC_NETWORK = "$(cat ${nixosConfig.sops.secrets.govcnetwork.path})";
+            };
+          };
 
-          stylix = {
-            targets.firefox.profileNames =
+          ssh = {
+            matchBlocks = {
+              "${loc1}" = {
+                hostname = "${loc1}.${domain2}";
+                user = user4;
+              };
+              "${loc1}.stg" = {
+                hostname = "${loc1}.${lifecycle1}.${domain2}";
+                user = user4;
+              };
+              "${loc1}.staging" = {
+                hostname = "${loc1}.${lifecycle1}.${domain2}";
+                user = user4;
+              };
+              "${loc1}.dev" = {
+                hostname = "${loc1}.${lifecycle2}.${domain2}";
+                user = user4;
+              };
+              "${loc2}" = {
+                hostname = "${loc2}.${domain1}";
+                user = user1Long;
+              };
+              "${loc2}.stg" = {
+                hostname = "${loc2}.${lifecycle1}.${domain2}";
+                user = user1Long;
+              };
+              "${loc2}.staging" = {
+                hostname = "${loc2}.${lifecycle1}.${domain2}";
+                user = user1Long;
+              };
+              "*.${domain1}" = {
+                user = user1Long;
+              };
+            };
+          };
+
+          firefox = {
+            profiles =
               let
-                inherit (nixosConfig.repo.secrets.local.work) user1 user2 user3;
+                isDefault = false;
               in
-              [
-                "${user1}"
-                "${user2}"
-                "${user3}"
-                "work"
-              ];
+              {
+                "${user1}" = lib.recursiveUpdate
+                  {
+                    inherit isDefault;
+                    id = 1;
+                    settings = {
+                      "browser.startup.homepage" = "${site1}|${site2}";
+                    };
+                  }
+                  vars.firefox;
+                "${user2}" = lib.recursiveUpdate
+                  {
+                    inherit isDefault;
+                    id = 2;
+                    settings = {
+                      "browser.startup.homepage" = "${site3}";
+                    };
+                  }
+                  vars.firefox;
+                "${user3}" = lib.recursiveUpdate
+                  {
+                    inherit isDefault;
+                    id = 3;
+                  }
+                  vars.firefox;
+                work = lib.recursiveUpdate
+                  {
+                    inherit isDefault;
+                    id = 4;
+                    settings = {
+                      "browser.startup.homepage" = "${site4}|${site5}|${site6}|${site7}";
+                    };
+                  }
+                  vars.firefox;
+              };
           };
 
-          programs =
-            let
-              inherit (nixosConfig.repo.secrets.local.work) user1 user1Long user2 user2Long user3 user3Long user4 path1 loc1 loc2 site1 site2 site3 site4 site5 site6 site7 lifecycle1 lifecycle2 domain1 domain2 gitMail clouds;
-            in
+          chromium = {
+            enable = true;
+            package = pkgs.chromium;
+
+            extensions = [
+              # 1password
+              "gejiddohjgogedgjnonbofjigllpkmbf"
+              # dark reader
+              "eimadpbcbfnmbkopoojfekhnkhdbieeh"
+              # ublock origin
+              "cjpalhdlnbpafiamejdnhcphjbkeiagm"
+              # i still dont care about cookies
+              "edibdbjcniadpccecjdfdjjppcpchdlm"
+              # browserpass
+              "naepdomgkenhinolocfifgehidddafch"
+            ];
+          };
+        };
+
+      services = {
+        kanshi = {
+          settings = [
             {
-              openstackclient = {
-                enable = true;
-                inherit clouds;
-};
-              awscli = {
-                enable = true;
-                package = pkgs.stable24_05.awscli2;
-                # settings = {
-                #   "default" = { };
-                #   "profile s3-imagebuilder-prod" = { };
-                # };
-                # credentials = {
-                #   "s3-imagebuilder-prod" = {
-                #     aws_access_key_id = "5OYXY4879EJG9I91K1B6";
-                #     credential_process = "${pkgs.pass}/bin/pass show work/awscli/s3-imagebuilder-prod/secret-key";
-                #   };
-                # };
+              # seminary room
+              output = {
+                criteria = "Applied Creative Technology Transmitter QUATTRO201811";
+                scale = 1.0;
+                mode = "1280x720";
               };
-              git.userEmail = lib.mkForce gitMail;
-
-              zsh = {
-                shellAliases = {
-                  dssh = "ssh -l ${user1Long}";
-                  cssh = "ssh -l ${user2Long}";
-                  wssh = "ssh -l ${user3Long}";
-                };
-                cdpath = [
-                  "~/Documents/Work"
+            }
+            {
+              # work main screen
+              output = {
+                criteria = "HP Inc. HP 732pk CNC4080YL5";
+                scale = 1.0;
+                mode = "3840x2160";
+              };
+            }
+            {
+              # work side screen
+              output = {
+                criteria = "Hewlett Packard HP Z24i CN44250RDT";
+                scale = 1.0;
+                mode = "1920x1200";
+                transform = "270";
+              };
+            }
+            {
+              profile = {
+                name = "lidopen";
+                exec = [
+                  "${pkgs.swaybg}/bin/swaybg --output '${config.swarselsystems.sharescreen}' --image ${config.swarselsystems.wallpaper} --mode ${config.stylix.imageScalingMode}"
+                  "${pkgs.swaybg}/bin/swaybg --output 'HP Inc. HP 732pk CNC4080YL5' --image ${self}/files/wallpaper/botanicswp.png --mode ${config.stylix.imageScalingMode}"
+                  "${pkgs.swaybg}/bin/swaybg --output 'Hewlett Packard HP Z24i CN44250RDT' --image ${self}/files/wallpaper/op6wp.png --mode ${config.stylix.imageScalingMode}"
                 ];
-                dirHashes = {
-                  d = "$HOME/.dotfiles";
-                  w = "$HOME/Documents/Work";
-                  s = "$HOME/.dotfiles/secrets";
-                  pr = "$HOME/Documents/Private";
-                  ac = path1;
-                };
-
-                sessionVariables = {
-                  VSPHERE_USER = "$(cat ${nixosConfig.sops.secrets.vcuser.path})";
-                  VSPHERE_PW = "$(cat ${nixosConfig.sops.secrets.vcpw.path})";
-                  GOVC_USERNAME = "$(cat ${nixosConfig.sops.secrets.govcuser.path})";
-                  GOVC_PASSWORD = "$(cat ${nixosConfig.sops.secrets.govcpw.path})";
-                  GOVC_URL = "$(cat ${nixosConfig.sops.secrets.govcurl.path})";
-                  GOVC_DATACENTER = "$(cat ${nixosConfig.sops.secrets.govcdc.path})";
-                  GOVC_DATASTORE = "$(cat ${nixosConfig.sops.secrets.govcds.path})";
-                  GOVC_HOST = "$(cat ${nixosConfig.sops.secrets.govchost.path})";
-                  GOVC_RESOURCE_POOL = "$(cat ${nixosConfig.sops.secrets.govcpool.path})";
-                  GOVC_NETWORK = "$(cat ${nixosConfig.sops.secrets.govcnetwork.path})";
-                };
-              };
-
-              ssh = {
-                matchBlocks = {
-                  "${loc1}" = {
-                    hostname = "${loc1}.${domain2}";
-                    user = user4;
-                  };
-                  "${loc1}.stg" = {
-                    hostname = "${loc1}.${lifecycle1}.${domain2}";
-                    user = user4;
-                  };
-                  "${loc1}.staging" = {
-                    hostname = "${loc1}.${lifecycle1}.${domain2}";
-                    user = user4;
-                  };
-                  "${loc1}.dev" = {
-                    hostname = "${loc1}.${lifecycle2}.${domain2}";
-                    user = user4;
-                  };
-                  "${loc2}" = {
-                    hostname = "${loc2}.${domain1}";
-                    user = user1Long;
-                  };
-                  "${loc2}.stg" = {
-                    hostname = "${loc2}.${lifecycle1}.${domain2}";
-                    user = user1Long;
-                  };
-                  "${loc2}.staging" = {
-                    hostname = "${loc2}.${lifecycle1}.${domain2}";
-                    user = user1Long;
-                  };
-                  "*.${domain1}" = {
-                    user = user1Long;
-                  };
-                };
-              };
-
-              firefox = {
-                profiles =
-                  let
-                    isDefault = false;
-                  in
+                outputs = [
                   {
-                    "${user1}" = lib.recursiveUpdate
-                      {
-                        inherit isDefault;
-                        id = 1;
-                        settings = {
-                          "browser.startup.homepage" = "${site1}|${site2}";
-                        };
-                      }
-                      vars.firefox;
-                    "${user2}" = lib.recursiveUpdate
-                      {
-                        inherit isDefault;
-                        id = 2;
-                        settings = {
-                          "browser.startup.homepage" = "${site3}";
-                        };
-                      }
-                      vars.firefox;
-                    "${user3}" = lib.recursiveUpdate
-                      {
-                        inherit isDefault;
-                        id = 3;
-                      }
-                      vars.firefox;
-                    work = lib.recursiveUpdate
-                      {
-                        inherit isDefault;
-                        id = 4;
-                        settings = {
-                          "browser.startup.homepage" = "${site4}|${site5}|${site6}|${site7}";
-                        };
-                      }
-                      vars.firefox;
-                  };
-              };
-
-              chromium = {
-                enable = true;
-                package = pkgs.chromium;
-
-                extensions = [
-                  # 1password
-                  "gejiddohjgogedgjnonbofjigllpkmbf"
-                  # dark reader
-                  "eimadpbcbfnmbkopoojfekhnkhdbieeh"
-                  # ublock origin
-                  "cjpalhdlnbpafiamejdnhcphjbkeiagm"
-                  # i still dont care about cookies
-                  "edibdbjcniadpccecjdfdjjppcpchdlm"
-                  # browserpass
-                  "naepdomgkenhinolocfifgehidddafch"
+                    criteria = config.swarselsystems.sharescreen;
+                    status = "enable";
+                    scale = 1.5;
+                    position = "1462,0";
+                  }
+                  {
+                    criteria = "HP Inc. HP 732pk CNC4080YL5";
+                    scale = 1.4;
+                    mode = "3840x2160";
+                    position = "-1280,0";
+                  }
+                  {
+                    criteria = "Hewlett Packard HP Z24i CN44250RDT";
+                    scale = 1.0;
+                    mode = "1920x1200";
+                    transform = "90";
+                    position = "-2480,0";
+                  }
                 ];
               };
-            };
-
-          services = {
-            kanshi = {
-              settings = [
+            }
+            {
+              profile =
+                let
+                  monitor = "Applied Creative Technology Transmitter QUATTRO201811";
+                in
                 {
-                  # seminary room
-                  output = {
-                    criteria = "Applied Creative Technology Transmitter QUATTRO201811";
-                    scale = 1.0;
-                    mode = "1280x720";
-                  };
-                }
-                {
-                  # work main screen
-                  output = {
+                  name = "lidopen";
+                  exec = [
+                    "${pkgs.swaybg}/bin/swaybg --output '${config.swarselsystems.sharescreen}' --image ${config.swarselsystems.wallpaper} --mode ${config.stylix.imageScalingMode}"
+                    "${pkgs.swaybg}/bin/swaybg --output '${monitor}' --image ${self}/files/wallpaper/navidrome.png --mode ${config.stylix.imageScalingMode}"
+                    "${pkgs.kanshare}/bin/kanshare ${config.swarselsystems.sharescreen} '${monitor}'"
+                  ];
+                  outputs = [
+                    {
+                      criteria = config.swarselsystems.sharescreen;
+                      status = "enable";
+                      scale = 1.7;
+                      position = "2560,0";
+                    }
+                    {
+                      criteria = "Applied Creative Technology Transmitter QUATTRO201811";
+                      scale = 1.0;
+                      mode = "1280x720";
+                      position = "10000,10000";
+                    }
+                  ];
+                };
+            }
+            {
+              profile = {
+                name = "lidclosed";
+                exec = [
+                  "${pkgs.swaybg}/bin/swaybg --output 'HP Inc. HP 732pk CNC4080YL5' --image ${self}/files/wallpaper/botanicswp.png --mode ${config.stylix.imageScalingMode}"
+                  "${pkgs.swaybg}/bin/swaybg --output 'Hewlett Packard HP Z24i CN44250RDT' --image ${self}/files/wallpaper/op6wp.png --mode ${config.stylix.imageScalingMode}"
+                ];
+                outputs = [
+                  {
+                    criteria = config.swarselsystems.sharescreen;
+                    status = "disable";
+                  }
+                  {
                     criteria = "HP Inc. HP 732pk CNC4080YL5";
-                    scale = 1.0;
+                    scale = 1.4;
                     mode = "3840x2160";
-                  };
-                }
-                {
-                  # work side screen
-                  output = {
+                    position = "-1280,0";
+                  }
+                  {
                     criteria = "Hewlett Packard HP Z24i CN44250RDT";
                     scale = 1.0;
                     mode = "1920x1200";
                     transform = "270";
-                  };
-                }
-                {
-                  profile = {
-                    name = "lidopen";
-                    exec = [
-                      "${pkgs.swaybg}/bin/swaybg --output '${config.swarselsystems.sharescreen}' --image ${config.swarselsystems.wallpaper} --mode ${config.stylix.imageScalingMode}"
-                      "${pkgs.swaybg}/bin/swaybg --output 'HP Inc. HP 732pk CNC4080YL5' --image ${self}/files/wallpaper/botanicswp.png --mode ${config.stylix.imageScalingMode}"
-                      "${pkgs.swaybg}/bin/swaybg --output 'Hewlett Packard HP Z24i CN44250RDT' --image ${self}/files/wallpaper/op6wp.png --mode ${config.stylix.imageScalingMode}"
-                    ];
-                    outputs = [
-                      {
-                        criteria = config.swarselsystems.sharescreen;
-                        status = "enable";
-                        scale = 1.5;
-                        position = "1462,0";
-                      }
-                      {
-                        criteria = "HP Inc. HP 732pk CNC4080YL5";
-                        scale = 1.4;
-                        mode = "3840x2160";
-                        position = "-1280,0";
-                      }
-                      {
-                        criteria = "Hewlett Packard HP Z24i CN44250RDT";
-                        scale = 1.0;
-                        mode = "1920x1200";
-                        transform = "90";
-                        position = "-2480,0";
-                      }
-                    ];
-                  };
-                }
-                {
-                  profile =
-                    let
-                      monitor = "Applied Creative Technology Transmitter QUATTRO201811";
-                    in
-                    {
-                      name = "lidopen";
-                      exec = [
-                        "${pkgs.swaybg}/bin/swaybg --output '${config.swarselsystems.sharescreen}' --image ${config.swarselsystems.wallpaper} --mode ${config.stylix.imageScalingMode}"
-                        "${pkgs.swaybg}/bin/swaybg --output '${monitor}' --image ${self}/files/wallpaper/navidrome.png --mode ${config.stylix.imageScalingMode}"
-                        "${pkgs.kanshare}/bin/kanshare ${config.swarselsystems.sharescreen} '${monitor}'"
-                      ];
-                      outputs = [
-                        {
-                          criteria = config.swarselsystems.sharescreen;
-                          status = "enable";
-                          scale = 1.7;
-                          position = "2560,0";
-                        }
-                        {
-                          criteria = "Applied Creative Technology Transmitter QUATTRO201811";
-                          scale = 1.0;
-                          mode = "1280x720";
-                          position = "10000,10000";
-                        }
-                      ];
-                    };
-                }
-                {
-                  profile = {
-                    name = "lidclosed";
-                    exec = [
-                      "${pkgs.swaybg}/bin/swaybg --output 'HP Inc. HP 732pk CNC4080YL5' --image ${self}/files/wallpaper/botanicswp.png --mode ${config.stylix.imageScalingMode}"
-                      "${pkgs.swaybg}/bin/swaybg --output 'Hewlett Packard HP Z24i CN44250RDT' --image ${self}/files/wallpaper/op6wp.png --mode ${config.stylix.imageScalingMode}"
-                    ];
-                    outputs = [
-                      {
-                        criteria = config.swarselsystems.sharescreen;
-                        status = "disable";
-                      }
-                      {
-                        criteria = "HP Inc. HP 732pk CNC4080YL5";
-                        scale = 1.4;
-                        mode = "3840x2160";
-                        position = "-1280,0";
-                      }
-                      {
-                        criteria = "Hewlett Packard HP Z24i CN44250RDT";
-                        scale = 1.0;
-                        mode = "1920x1200";
-                        transform = "270";
-                        position = "-2480,0";
-                      }
-                    ];
-                  };
-                }
-                {
-                  profile =
-                    let
-                      monitor = "Applied Creative Technology Transmitter QUATTRO201811";
-                    in
-                    {
-                      name = "lidclosed";
-                      exec = [
-                        "${pkgs.swaybg}/bin/swaybg --output '${monitor}' --image ${self}/files/wallpaper/navidrome.png --mode ${config.stylix.imageScalingMode}"
-                      ];
-                      outputs = [
-                        {
-                          criteria = config.swarselsystems.sharescreen;
-                          status = "disable";
-                        }
-                        {
-                          criteria = "Applied Creative Technology Transmitter QUATTRO201811";
-                          scale = 1.0;
-                          mode = "1280x720";
-                          position = "10000,10000";
-                        }
-                      ];
-                    };
-                }
-              ];
-            };
-          };
-
-          systemd.user.services = {
-            pizauth.Service = {
-              ExecStartPost = [
-                "${pkgs.toybox}/bin/sleep 1"
-                "//bin/sh -c '${lib.getExe pkgs.pizauth} restore < ${homeDir}/.pizauth.state'"
-              ];
-            };
-
-            teams-applet = {
-              Unit = {
-                Description = "teams applet";
-                Requires = [ "tray.target" ];
-                After = [
-                  "graphical-session.target"
-                  "tray.target"
+                    position = "-2480,0";
+                  }
                 ];
-                PartOf = [ "graphical-session.target" ];
               };
-
-              Install = {
-                WantedBy = [ "graphical-session.target" ];
-              };
-
-              Service = {
-                ExecStart = "${pkgs.stable.teams-for-linux}/bin/teams-for-linux --disableGpu=true --minimized=true --trayIconEnabled=true";
-              };
-            };
-
-            onepassword-applet = {
-              Unit = {
-                Description = "1password applet";
-                Requires = [ "tray.target" ];
-                After = [
-                  "graphical-session.target"
-                  "tray.target"
-                ];
-                PartOf = [ "graphical-session.target" ];
-              };
-
-              Install = {
-                WantedBy = [ "graphical-session.target" ];
-              };
-
-              Service = {
-                ExecStart = "${pkgs._1password-gui}/bin/1password";
-              };
-            };
-
-          };
-
-          swarselservices.pizauth = {
-            enable = true;
-            extraConfig = ''
-              auth_notify_cmd = "if [[ \"$(notify-send -A \"Open $PIZAUTH_ACCOUNT\" -t 30000 'pizauth authorisation')\" == \"0\" ]]; then open \"$PIZAUTH_URL\"; fi";
-              error_notify_cmd = "notify-send -t 90000 \"pizauth error for $PIZAUTH_ACCOUNT\" \"$PIZAUTH_MSG\"";
-              token_event_cmd = "pizauth dump > ${homeDir}/.pizauth.state";
-            '';
-            accounts = {
-              work = {
-                authUri = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
-                tokenUri = "https://login.microsoftonline.com/common/oauth2/v2.0/token";
-                clientId = "08162f7c-0fd2-4200-a84a-f25a4db0b584";
-                clientSecret = "TxRBilcHdC6WGBee]fs?QR:SJ8nI[g82";
-                scopes = [
-                  "https://outlook.office365.com/IMAP.AccessAsUser.All"
-                  "https://outlook.office365.com/SMTP.Send"
-                  "offline_access"
-                ];
-                loginHint = "${nixosConfig.repo.secrets.local.work.mailAddress}";
-              };
-            };
-
-          };
-
-          xdg =
-            let
-              inherit (nixosConfig.repo.secrets.local.work) user1 user2 user3;
-            in
+            }
             {
-              mimeApps = {
-                defaultApplications = {
-                  "x-scheme-handler/msteams" = [ "teams-for-linux.desktop" ];
-                };
-              };
-              desktopEntries =
+              profile =
                 let
-                  terminal = false;
-                  categories = [ "Application" ];
-                  icon = "firefox";
+                  monitor = "Applied Creative Technology Transmitter QUATTRO201811";
                 in
                 {
-                  firefox_work = {
-                    name = "Firefox (work)";
-                    genericName = "Firefox work";
-                    exec = "firefox -p work";
-                    inherit terminal categories icon;
-                  };
-                  "firefox_${user1}" = {
-                    name = "Firefox (${user1})";
-                    genericName = "Firefox ${user1}";
-                    exec = "firefox -p ${user1}";
-                    inherit terminal categories icon;
-                  };
-
-                  "firefox_${user2}" = {
-                    name = "Firefox (${user2})";
-                    genericName = "Firefox ${user2}";
-                    exec = "firefox -p ${user2}";
-                    inherit terminal categories icon;
-                  };
-
-                  "firefox_${user3}" = {
-                    name = "Firefox (${user3})";
-                    genericName = "Firefox ${user3}";
-                    exec = "firefox -p ${user3}";
-                    inherit terminal categories icon;
-                  };
-
-
+                  name = "lidclosed";
+                  exec = [
+                    "${pkgs.swaybg}/bin/swaybg --output '${monitor}' --image ${self}/files/wallpaper/navidrome.png --mode ${config.stylix.imageScalingMode}"
+                  ];
+                  outputs = [
+                    {
+                      criteria = config.swarselsystems.sharescreen;
+                      status = "disable";
+                    }
+                    {
+                      criteria = "Applied Creative Technology Transmitter QUATTRO201811";
+                      scale = 1.0;
+                      mode = "1280x720";
+                      position = "10000,10000";
+                    }
+                  ];
                 };
-            };
-          swarselsystems = {
-            startup = [
-              # { command = "nextcloud --background"; }
-              # { command = "vesktop --start-minimized --enable-speech-dispatcher --ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime"; }
-              # { command = "element-desktop --hidden  --enable-features=UseOzonePlatform --ozone-platform=wayland --disable-gpu-driver-bug-workarounds"; }
-              # { command = "anki"; }
-              # { command = "obsidian"; }
-              # { command = "nm-applet"; }
-              # { command = "feishin"; }
-              # { command = "teams-for-linux --disableGpu=true --minimized=true --trayIconEnabled=true"; }
-              # { command = "1password"; }
-            ];
-            monitors = {
-              work_back_middle = rec {
-                name = "LG Electronics LG Ultra HD 0x000305A6";
-                mode = "2560x1440";
-                scale = "1";
-                position = "5120,0";
-                workspace = "1:一";
-                # output = "DP-10";
-                output = name;
-              };
-              work_front_left = rec {
-                name = "LG Electronics LG Ultra HD 0x0007AB45";
-                mode = "3840x2160";
-                scale = "1";
-                position = "5120,0";
-                workspace = "1:一";
-                # output = "DP-7";
-                output = name;
-              };
-              work_back_right = rec {
-                name = "HP Inc. HP Z32 CN41212T55";
-                mode = "3840x2160";
-                scale = "1";
-                position = "5120,0";
-                workspace = "1:一";
-                # output = "DP-3";
-                output = name;
-              };
-              work_middle_middle_main = rec {
-                name = "HP Inc. HP 732pk CNC4080YL5";
-                mode = "3840x2160";
-                scale = "1";
-                position = "-1280,0";
-                workspace = "11:M";
-                # output = "DP-8";
-                output = name;
-              };
-              work_middle_middle_side = rec {
-                name = "Hewlett Packard HP Z24i CN44250RDT";
-                mode = "1920x1200";
-                transform = "270";
-                scale = "1";
-                position = "-2480,0";
-                workspace = "12:S";
-                # output = "DP-9";
-                output = name;
-              };
-              work_seminary = rec {
-                name = "Applied Creative Technology Transmitter QUATTRO201811";
-                mode = "1280x720";
-                scale = "1";
-                position = "10000,10000"; # i.e. this screen is inaccessible by moving the mouse
-                workspace = "14:T";
-                # output = "DP-4";
-                output = name;
-              };
-            };
-            inputs = {
-              "1133:45081:MX_Master_2S_Keyboard" = {
-                xkb_layout = "us";
-                xkb_variant = "altgr-intl";
-              };
-              # "2362:628:PIXA3854:00_093A:0274_Touchpad" = {
-              #   dwt = "enabled";
-              #   tap = "enabled";
-              #   natural_scroll = "enabled";
-              #   middle_emulation = "enabled";
-              #   drag_lock = "disabled";
-              # };
-              "1133:50504:Logitech_USB_Receiver" = {
-                xkb_layout = "us";
-                xkb_variant = "altgr-intl";
-              };
-              "1133:45944:MX_KEYS_S" = {
-                xkb_layout = "us";
-                xkb_variant = "altgr-intl";
-              };
-            };
+            }
+          ];
+        };
+      };
 
+      systemd.user.services = {
+        pizauth.Service = {
+          ExecStartPost = [
+            "${pkgs.toybox}/bin/sleep 1"
+            "//bin/sh -c '${lib.getExe pkgs.pizauth} restore < ${homeDir}/.pizauth.state'"
+          ];
+        };
+
+        teams-applet = {
+          Unit = {
+            Description = "teams applet";
+            Requires = [ "tray.target" ];
+            After = [
+              "graphical-session.target"
+              "tray.target"
+            ];
+            PartOf = [ "graphical-session.target" ];
+          };
+
+          Install = {
+            WantedBy = [ "graphical-session.target" ];
+          };
+
+          Service = {
+            ExecStart = "${pkgs.stable.teams-for-linux}/bin/teams-for-linux --disableGpu=true --minimized=true --trayIconEnabled=true";
           };
         };
 
-    }
+        onepassword-applet = {
+          Unit = {
+            Description = "1password applet";
+            Requires = [ "tray.target" ];
+            After = [
+              "graphical-session.target"
+              "tray.target"
+            ];
+            PartOf = [ "graphical-session.target" ];
+          };
+
+          Install = {
+            WantedBy = [ "graphical-session.target" ];
+          };
+
+          Service = {
+            ExecStart = "${pkgs._1password-gui}/bin/1password";
+          };
+        };
+
+      };
+
+      swarselservices.pizauth = {
+        enable = true;
+        extraConfig = ''
+          auth_notify_cmd = "if [[ \"$(notify-send -A \"Open $PIZAUTH_ACCOUNT\" -t 30000 'pizauth authorisation')\" == \"0\" ]]; then open \"$PIZAUTH_URL\"; fi";
+          error_notify_cmd = "notify-send -t 90000 \"pizauth error for $PIZAUTH_ACCOUNT\" \"$PIZAUTH_MSG\"";
+          token_event_cmd = "pizauth dump > ${homeDir}/.pizauth.state";
+        '';
+        accounts = {
+          work = {
+            authUri = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
+            tokenUri = "https://login.microsoftonline.com/common/oauth2/v2.0/token";
+            clientId = "08162f7c-0fd2-4200-a84a-f25a4db0b584";
+            clientSecret = "TxRBilcHdC6WGBee]fs?QR:SJ8nI[g82";
+            scopes = [
+              "https://outlook.office365.com/IMAP.AccessAsUser.All"
+              "https://outlook.office365.com/SMTP.Send"
+              "offline_access"
+            ];
+            loginHint = "${nixosConfig.repo.secrets.local.work.mailAddress}";
+          };
+        };
+
+      };
+
+      xdg =
+        let
+          inherit (nixosConfig.repo.secrets.local.work) user1 user2 user3;
+        in
+        {
+          mimeApps = {
+            defaultApplications = {
+              "x-scheme-handler/msteams" = [ "teams-for-linux.desktop" ];
+            };
+          };
+          desktopEntries =
+            let
+              terminal = false;
+              categories = [ "Application" ];
+              icon = "firefox";
+            in
+            {
+              firefox_work = {
+                name = "Firefox (work)";
+                genericName = "Firefox work";
+                exec = "firefox -p work";
+                inherit terminal categories icon;
+              };
+              "firefox_${user1}" = {
+                name = "Firefox (${user1})";
+                genericName = "Firefox ${user1}";
+                exec = "firefox -p ${user1}";
+                inherit terminal categories icon;
+              };
+
+              "firefox_${user2}" = {
+                name = "Firefox (${user2})";
+                genericName = "Firefox ${user2}";
+                exec = "firefox -p ${user2}";
+                inherit terminal categories icon;
+              };
+
+              "firefox_${user3}" = {
+                name = "Firefox (${user3})";
+                genericName = "Firefox ${user3}";
+                exec = "firefox -p ${user3}";
+                inherit terminal categories icon;
+              };
+
+
+            };
+        };
+      swarselsystems = {
+        startup = [
+          # { command = "nextcloud --background"; }
+          # { command = "vesktop --start-minimized --enable-speech-dispatcher --ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime"; }
+          # { command = "element-desktop --hidden  --enable-features=UseOzonePlatform --ozone-platform=wayland --disable-gpu-driver-bug-workarounds"; }
+          # { command = "anki"; }
+          # { command = "obsidian"; }
+          # { command = "nm-applet"; }
+          # { command = "feishin"; }
+          # { command = "teams-for-linux --disableGpu=true --minimized=true --trayIconEnabled=true"; }
+          # { command = "1password"; }
+        ];
+        monitors = {
+          work_back_middle = rec {
+            name = "LG Electronics LG Ultra HD 0x000305A6";
+            mode = "2560x1440";
+            scale = "1";
+            position = "5120,0";
+            workspace = "1:一";
+            # output = "DP-10";
+            output = name;
+          };
+          work_front_left = rec {
+            name = "LG Electronics LG Ultra HD 0x0007AB45";
+            mode = "3840x2160";
+            scale = "1";
+            position = "5120,0";
+            workspace = "1:一";
+            # output = "DP-7";
+            output = name;
+          };
+          work_back_right = rec {
+            name = "HP Inc. HP Z32 CN41212T55";
+            mode = "3840x2160";
+            scale = "1";
+            position = "5120,0";
+            workspace = "1:一";
+            # output = "DP-3";
+            output = name;
+          };
+          work_middle_middle_main = rec {
+            name = "HP Inc. HP 732pk CNC4080YL5";
+            mode = "3840x2160";
+            scale = "1";
+            position = "-1280,0";
+            workspace = "11:M";
+            # output = "DP-8";
+            output = name;
+          };
+          work_middle_middle_side = rec {
+            name = "Hewlett Packard HP Z24i CN44250RDT";
+            mode = "1920x1200";
+            transform = "270";
+            scale = "1";
+            position = "-2480,0";
+            workspace = "12:S";
+            # output = "DP-9";
+            output = name;
+          };
+          work_seminary = rec {
+            name = "Applied Creative Technology Transmitter QUATTRO201811";
+            mode = "1280x720";
+            scale = "1";
+            position = "10000,10000"; # i.e. this screen is inaccessible by moving the mouse
+            workspace = "14:T";
+            # output = "DP-4";
+            output = name;
+          };
+        };
+        inputs = {
+          "1133:45081:MX_Master_2S_Keyboard" = {
+            xkb_layout = "us";
+            xkb_variant = "altgr-intl";
+          };
+          # "2362:628:PIXA3854:00_093A:0274_Touchpad" = {
+          #   dwt = "enabled";
+          #   tap = "enabled";
+          #   natural_scroll = "enabled";
+          #   middle_emulation = "enabled";
+          #   drag_lock = "disabled";
+          # };
+          "1133:50504:Logitech_USB_Receiver" = {
+            xkb_layout = "us";
+            xkb_variant = "altgr-intl";
+          };
+          "1133:45944:MX_KEYS_S" = {
+            xkb_layout = "us";
+            xkb_variant = "altgr-intl";
+          };
+        };
+
+      };
+    };
+
+}
    @@ -19713,8 +19808,8 @@ writeShellApplication {
    -
    -

    3.5.34. endme

    +
    +

    3.5.34. endme

    Sometimes my DE crashes after putting it to suspend - to be precise, it happens when I put it into suspend when I have multiple screens plugged in. I have never taken the time to debug the issue, but instead just switch to a different TTY and then use this script to kill the hanging session. @@ -19735,8 +19830,8 @@ writeShellApplication {

    -
    -

    3.5.35. git-replace

    +
    +

    3.5.35. git-replace

    This script allows for quick git replace of a string. @@ -19898,8 +19993,8 @@ in

    -
    -
    3.6.1.3. Optionals
    +
    +
    3.6.1.3. Optionals
    { lib, config, ... }:
@@ -23807,6 +23902,40 @@ This adds the simple utility of sending desktop notifications whenever a new mai
 (add-hook 'after-init-hook #'mu4e-alert-enable-notifications)
 
 (mu4e t)
+
    +
    +
    +
    +
    +
    4.4.39.3. Work: Signing Mails (S/MIME, smime)
    +
    +

    +Used to automatically sign messages sent from my work email address using S/MIME certificate. +

    + +
    +
    (let ((work (getenv "SWARSEL_MAIL_WORK")))
+  (when (and work (not (string-empty-p work)))
+
+    (setq swarsel-smime-cert-path "~/.Certificates/$SWARSEL_MAIL_WORK.pem")
+    (setq swarsel-smime-cert-path (substitute-env-vars swarsel-smime-cert-path))
+    (setq mml-secure-prefer-scheme 'smime)
+    (setq mml-secure-smime-sign-with-sender t)
+    (add-hook 'mu4e-compose-mode-hook
+              (lambda ()
+                (when (and (boundp 'user-mail-address)
+                           (stringp user-mail-address)
+                           (string-equal user-mail-address (getenv "SWARSEL_MAIL_WORK")))
+                  (mml-secure-message-sign-smime))))
+
+    (setq smime-keys
+          `((,(getenv "SWARSEL_MAIL_WORK")
+             ,swarsel-smime-cert-path
+             ("~/Certificates/harica-root.pem"
+              "~/Certificates/harica-intermediate.pem"
+              ))))
+    ))
+
    @@ -24062,6 +24191,20 @@ Also see `prot-window-delete-popup-frame'." command) This sections is no longer used really. An introduction can be found in Structure of this file under the historical note. The little noweb-ref blocks that I still use are found in Hosts and Services.

    +
    +

    5.1. General steps when setting up a new machine

    +
    +

    +These general steps are needed when setting up a new machine and do not fit into another block well: +

    + +
    +
    - setup yubikey (automatic yubikey enrollment is not yet supported by `disko`):
+  - `systemd-cryptenroll --fido2-device=auto /dev/<device, e.g. 'nvme0n1p2'>`
+
    +
    +
    +

    6. Appendix B: Supplementary Files

    @@ -24303,7 +24446,7 @@ set allowautofocus false jsb browser.webRequest.onHeadersReceived.addListener(tri.request.clobberCSP,{urls:["<all_urls>"],types:["main_frame"]},["blocking","responseHeaders"]) " default is 300ms -set hintdelay 100 +set hintdelay 500 " Some pages like github break on the tridactyl quick search. have this as a fallback unbind <C-f> @@ -26993,7 +27136,7 @@ similarly, there exists an version that starts from the right.

    Author: Leon Schwarzäugl

    -

    Created: 2025-10-21 Di 13:09

    +

    Created: 2025-10-21 Di 21:37

    Validate