feat: update topology

.github/README.md

@@ -109,8 +109,7 @@
   <details>
     <summary>Click here for a summary of my infrastructure</summary>
 
-<img width="4250" height="9117" alt="topology" src="https://github.com/user-attachments/assets/582264cf-f239-4699-b90f-69f2cef5a7b2" />
-
+<img width="4176" height="8367" alt="topology" src="https://github.com/user-attachments/assets/8b7f148d-8e49-4788-ba0f-4487482a483b" />
 
   ### Programs
 

SwarselSystems.org

@@ -1736,8 +1736,8 @@ A short overview over each input and what it does:
       nixpkgs-stable25_11.url = "github:NixOS/nixpkgs/nixos-25.11";
 
       home-manager = {
-        url = "github:nix-community/home-manager";
-        # url = "github:Swarsel/home-manager/main";
+        # url = "github:nix-community/home-manager";
+        url = "github:Swarsel/home-manager/main";
         inputs.nixpkgs.follows = "nixpkgs";
       };
       nix-index-database = {
@@ -2662,8 +2662,7 @@ Another note concerning [[https://flake.parts/][flake-parts]]:
 
                 ender3 = mkDevice "Ender 3" {
                   info = "SKR V1.3, TMC2209 (Dual), TFT35";
-                  deviceIcon = "${self}/files/topology-images/ender3.png";
-                  icon = "${self}/files/topology-images/raspi.png";
+                  image = "${self}/files/topology-images/ender3.png";
                   interfaces.eth1 = { };
                   services = {
                     octoprint = {
@@ -2704,11 +2703,11 @@ Another note concerning [[https://flake.parts/][flake-parts]]:
                   services = {
                     ollama = {
                       name = "Ollama";
-                      icon = "services.ollama";
+                      icon = "${self}/files/topology-images/ollama.png";
                     };
                     openwebui = {
                       name = "Open WebUI";
-                      icon = "services.open-webui";
+                      icon = "${self}/files/topology-images/openwebui.png";
                     };
                     comfyui = {
                       name = "Comfy UI";
@@ -11348,7 +11347,22 @@ This is a collection of packages that are useful for server-type hosts that do n
       services = {
         # add a user with sudo smbpasswd -a <user>
         samba = {
+          # package = pkgs.samba4Full;
           package = pkgs.samba4;
+          # extraConfig = ''
+          #   workgroup = WORKGROUP
+          #   server role = standalone server
+          #   dns proxy = no
+
+          #   pam password change = yes
+          #   map to guest = bad user
+          #   create mask = 0664
+          #   force create mode = 0664
+          #   directory mask = 0775
+          #   force directory mode = 0775
+          #   follow symlinks = yes
+          # '';
+
           enable = true;
           openFirewall = true;
           settings.Eternor = {
@@ -13130,10 +13144,7 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin
         mpv
       ];
 
-      topology.self.services.${serviceName} = {
-        info = "http://localhost:${builtins.toString servicePort}";
-        icon = lib.mkForce "${self}/files/topology-images/mpd.png";
-      };
+      topology.self.services.${serviceName}.info = "http://localhost:${builtins.toString servicePort}";
 
       environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
         directories = [{ directory = "/var/lib/${serviceName}"; user = "mpd"; group = "mpd"; }];
@@ -13141,14 +13152,13 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin
 
       services.${serviceName} = {
         enable = true;
-        openFirewall = true;
-        settings = {
-          music_directory = "/storage/Music";
-          bind_to_address = "any";
-          port = servicePort;
-        };
+        musicDirectory = "/storage/Music";
         user = serviceUser;
         group = serviceGroup;
+        network = {
+          port = servicePort;
+          listenAddress = "any";
+        };
         credentials = [
           {
             passwordFile = config.sops.secrets.mpd-pw.path;
@@ -14432,7 +14442,8 @@ Note: you still need to run =restic-<name> init= once on the host to get the buc
   { lib, pkgs, config, ... }:
   let
     inherit (config.swarselsystems) sopsFile;
-    inherit (config.swarselsystems.server.restic) targets;
+
+    targets = config.swarselsystems.server.restic.targets;
   in
   {
     options.swarselmodules.server.restic = lib.mkEnableOption "enable restic backups on server";
@@ -15264,7 +15275,7 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with
       };
 
       environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
-        directories = [{ directory = "/var/lib/private/anki-sync-server"; }];
+        directories = [{ directory = "/var/lib/private/${serviceName}"; }];
       };
 
       services.anki-sync-server = {
@@ -16132,7 +16143,7 @@ kanidm person credential create-reset-token <user>
 
     postgresUser = config.systemd.services.postgresql.serviceConfig.User; # postgres
     postgresPort = config.services.postgresql.settings.port; # 5432
-    containerRev = "sha256:bb8ad2b6891441d8ec5c3169b684b71574f3bb3e9afb345bad2f91d833d60340";
+    containerRev = "sha256:96693e41a6eb2aae44f96033a090378270f024ddf4e6095edf8d57674f21095d";
 
     inherit (config.swarselsystems) sopsFile;
   in
@@ -16802,7 +16813,7 @@ Deployment notes:
   - finally, disable new user registration in web ui
 
 #+begin_src nix-ts :tangle modules/nixos/server/slink.nix
-{ lib, config, dns, globals, confLib, ... }:
+{ self, lib, config, dns, globals, confLib, ... }:
 let
   inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
   inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
@@ -16861,7 +16872,7 @@ in
     topology.self.services.${serviceName} = {
       name = lib.swarselsystems.toCapitalized serviceName;
       info = "https://${serviceDomain}";
-      icon = "services.not-available";
+      icon = "${self}/files/topology-images/shlink.png";
     };
 
     globals = {
@@ -17049,6 +17060,13 @@ in
         directories = [{ directory = "/var/lib/${serviceName}"; user = serviceUser; group = serviceGroup; }];
       };
 
+      systemd.services.homebox = {
+        environment = {
+          TMPDIR = "/var/lib/homebox/.tmp";
+          HOME = "/var/lib/homebox";
+        };
+      };
+
       services.${serviceName} = {
         enable = true;
         package = pkgs.bisect.homebox;
@@ -19046,7 +19064,7 @@ This has some state:
             ];
             dhcp.enabled = false;
           };
-          filtering.rewrites =  (map
+          filtering.rewrites =  map
             (domain: {
               inherit domain;
               # FIXME: change to homeWebProxy once that is setup
@@ -19054,13 +19072,7 @@ This has some state:
               # answer = globals.hosts.${webProxy}.wanAddress4;
               enabled = true;
             })
-            homeDomains) ++ [
-              {
-                domain = "smb.${globals.domains.main}";
-                answer = globals.networks.home-lan.vlans.services.hosts.storage.ipv4;
-                enabled = true;
-              }
-            ];
+            homeDomains;
           filters = [
             {
               name = "AdGuard DNS filter";
@@ -25123,20 +25135,16 @@ When setting up a new machine:
         ];
       };
 
-          systemd.user.tmpfiles.rules = [
-            "d ${homeDir}/.gnupg 0700 ${mainUser} users - -"
-          ];
-
       # assure correct permissions
-          # systemd.user.tmpfiles.settings."30-gpgagent".rules = {
-          #   "${homeDir}/.gnupg" = {
-          #     d = {
-          #       group = "users";
-          #       user = mainUser;
-          #       mode = "0700";
-          #     };
-          #   };
-          # };
+      systemd.user.tmpfiles.settings."30-gpgagent".rules = {
+        "${homeDir}/.gnupg" = {
+          d = {
+            group = "users";
+            user = mainUser;
+            mode = "0700";
+          };
+        };
+      };
     };
 
   }
@@ -37544,8 +37552,7 @@ Here lies defined the readme for GitHub and Forgejo:
     <details>
       <summary>Click here for a summary of my infrastructure</summary>
 
-  <img width="4250" height="9117" alt="topology" src="https://github.com/user-attachments/assets/582264cf-f239-4699-b90f-69f2cef5a7b2" />
-
+  <img width="4176" height="8367" alt="topology" src="https://github.com/user-attachments/assets/8b7f148d-8e49-4788-ba0f-4487482a483b" />
 
     ### Programs
 

flake.nix

@@ -36,8 +36,8 @@
     nixpkgs-stable25_11.url = "github:NixOS/nixpkgs/nixos-25.11";
 
     home-manager = {
-      url = "github:nix-community/home-manager";
-      # url = "github:Swarsel/home-manager/main";
+      # url = "github:nix-community/home-manager";
+      url = "github:Swarsel/home-manager/main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-index-database = {

modules/home/common/gpg-agent.nix

@@ -36,20 +36,16 @@ in
       ];
     };
 
-    systemd.user.tmpfiles.rules = [
-      "d ${homeDir}/.gnupg 0700 ${mainUser} users - -"
-    ];
-
     # assure correct permissions
-    # systemd.user.tmpfiles.settings."30-gpgagent".rules = {
-    #   "${homeDir}/.gnupg" = {
-    #     d = {
-    #       group = "users";
-    #       user = mainUser;
-    #       mode = "0700";
-    #     };
-    #   };
-    # };
+    systemd.user.tmpfiles.settings."30-gpgagent".rules = {
+      "${homeDir}/.gnupg" = {
+        d = {
+          group = "users";
+          user = mainUser;
+          mode = "0700";
+        };
+      };
+    };
   };
 
 }

modules/nixos/server/adguardhome.nix

@@ -59,7 +59,7 @@ in
           ];
           dhcp.enabled = false;
         };
-        filtering.rewrites = (map
+        filtering.rewrites = map
           (domain: {
             inherit domain;
             # FIXME: change to homeWebProxy once that is setup
@@ -67,13 +67,7 @@ in
             # answer = globals.hosts.${webProxy}.wanAddress4;
             enabled = true;
           })
-          homeDomains) ++ [
-          {
-            domain = "smb.${globals.domains.main}";
-            answer = globals.networks.home-lan.vlans.services.hosts.storage.ipv4;
-            enabled = true;
-          }
-        ];
+          homeDomains;
         filters = [
           {
             name = "AdGuard DNS filter";

modules/nixos/server/ankisync.nix

@@ -37,7 +37,7 @@ in
     };
 
     environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
-      directories = [{ directory = "/var/lib/private/anki-sync-server"; }];
+      directories = [{ directory = "/var/lib/private/${serviceName}"; }];
     };
 
     services.anki-sync-server = {

modules/nixos/server/homebox.nix

@@ -41,6 +41,13 @@ in
       directories = [{ directory = "/var/lib/${serviceName}"; user = serviceUser; group = serviceGroup; }];
     };
 
+    systemd.services.homebox = {
+      environment = {
+        TMPDIR = "/var/lib/homebox/.tmp";
+        HOME = "/var/lib/homebox";
+      };
+    };
+
     services.${serviceName} = {
       enable = true;
       package = pkgs.bisect.homebox;

modules/nixos/server/koillection.nix

@@ -6,7 +6,7 @@ let
 
   postgresUser = config.systemd.services.postgresql.serviceConfig.User; # postgres
   postgresPort = config.services.postgresql.settings.port; # 5432
-  containerRev = "sha256:bb8ad2b6891441d8ec5c3169b684b71574f3bb3e9afb345bad2f91d833d60340";
+  containerRev = "sha256:96693e41a6eb2aae44f96033a090378270f024ddf4e6095edf8d57674f21095d";
 
   inherit (config.swarselsystems) sopsFile;
 in

modules/nixos/server/mpd.nix

@@ -30,10 +30,7 @@ in
       mpv
     ];
 
-    topology.self.services.${serviceName} = {
-      info = "http://localhost:${builtins.toString servicePort}";
-      icon = lib.mkForce "${self}/files/topology-images/mpd.png";
-    };
+    topology.self.services.${serviceName}.info = "http://localhost:${builtins.toString servicePort}";
 
     environment.persistence."/state" = lib.mkIf config.swarselsystems.isMicroVM {
       directories = [{ directory = "/var/lib/${serviceName}"; user = "mpd"; group = "mpd"; }];
@@ -41,14 +38,13 @@ in
 
     services.${serviceName} = {
       enable = true;
-      openFirewall = true;
-      settings = {
-        music_directory = "/storage/Music";
-        bind_to_address = "any";
-        port = servicePort;
-      };
+      musicDirectory = "/storage/Music";
       user = serviceUser;
       group = serviceGroup;
+      network = {
+        port = servicePort;
+        listenAddress = "any";
+      };
       credentials = [
         {
           passwordFile = config.sops.secrets.mpd-pw.path;

modules/nixos/server/nfs.nix

@@ -19,7 +19,22 @@ in
     services = {
       # add a user with sudo smbpasswd -a <user>
       samba = {
+        # package = pkgs.samba4Full;
         package = pkgs.samba4;
+        # extraConfig = ''
+        #   workgroup = WORKGROUP
+        #   server role = standalone server
+        #   dns proxy = no
+
+        #   pam password change = yes
+        #   map to guest = bad user
+        #   create mask = 0664
+        #   force create mode = 0664
+        #   directory mask = 0775
+        #   force directory mode = 0775
+        #   follow symlinks = yes
+        # '';
+
         enable = true;
         openFirewall = true;
         settings.Eternor = {

modules/nixos/server/restic.nix

@@ -1,7 +1,8 @@
 { lib, pkgs, config, ... }:
 let
   inherit (config.swarselsystems) sopsFile;
-  inherit (config.swarselsystems.server.restic) targets;
+
+  targets = config.swarselsystems.server.restic.targets;
 in
 {
   options.swarselmodules.server.restic = lib.mkEnableOption "enable restic backups on server";

modules/nixos/server/slink.nix

@@ -1,4 +1,4 @@
-{ lib, config, dns, globals, confLib, ... }:
+{ self, lib, config, dns, globals, confLib, ... }:
 let
   inherit (confLib.gen { name = "slink"; port = 3000; dir = "/var/lib/slink"; }) servicePort serviceName serviceDomain serviceDir serviceAddress proxyAddress4 proxyAddress6;
   inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf homeServiceAddress nginxAccessRules;
@@ -57,7 +57,7 @@ in
     topology.self.services.${serviceName} = {
       name = lib.swarselsystems.toCapitalized serviceName;
       info = "https://${serviceDomain}";
-      icon = "services.not-available";
+      icon = "${self}/files/topology-images/shlink.png";
     };
 
     globals = {

nix/topology.nix

@@ -192,8 +192,7 @@
 
               ender3 = mkDevice "Ender 3" {
                 info = "SKR V1.3, TMC2209 (Dual), TFT35";
-                deviceIcon = "${self}/files/topology-images/ender3.png";
-                icon = "${self}/files/topology-images/raspi.png";
+                image = "${self}/files/topology-images/ender3.png";
                 interfaces.eth1 = { };
                 services = {
                   octoprint = {
@@ -234,11 +233,11 @@
                 services = {
                   ollama = {
                     name = "Ollama";
-                    icon = "services.ollama";
+                    icon = "${self}/files/topology-images/ollama.png";
                   };
                   openwebui = {
                     name = "Open WebUI";
-                    icon = "services.open-webui";
+                    icon = "${self}/files/topology-images/openwebui.png";
                   };
                   comfyui = {
                     name = "Comfy UI";