big refactoring

configurations/any.nix

@@ -1,12 +1,9 @@
-{ inputs, ... }@flakeContext:
+{
-let
+  deviceType = "minimal";
-  nixosModule =
+  modules = [
+    (
       {
-      config,
+        inputs,
-      lib,
-      modulesPath,
-      pkgs,
-      xlib,
         ...
       }:
       {
@@ -14,17 +11,8 @@ let
           inputs.self.nixosModules.default
         ];
 
-      system = {
+        system.stateVersion = "26.05";
-        stateVersion = "26.05";
+      }
-      };
+    )
-    };
-in
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "minimal";
-  };
 }

configurations/default.nix

@@ -1,13 +1,15 @@
 { inputs, ... }@flakeContext:
+let
+  mkSystem = import ../lib/mkSystem.nix flakeContext;
+in
 {
   nixosConfigurations = {
-    default = import ./any.nix flakeContext; # default
+    default = mkSystem (import ./any.nix); # default
-    atoridu = import ./mini-pc.nix flakeContext; # atoridu
+    atoridu = mkSystem (import ./mini-pc.nix); # atoridu
-    rydiwo = import ./mini-laptop.nix flakeContext; # rydiwo
+    rydiwo = mkSystem (import ./mini-laptop.nix); # rydiwo
-    otreca = import ./vds.nix flakeContext; # vds
+    otreca = mkSystem (import ./vds.nix); # vds
-    otreca-new = import ./vds-new.nix flakeContext; # vds-new
+    sapphira = mkSystem (import ./server.nix); # sapphira
-    sapphira = import ./server.nix flakeContext; # sapphira
+    wsl = mkSystem (import ./wsl.nix); # wsl
-    wsl = import ./wsl.nix flakeContext; # wsl
   };
   nixOnDroidConfigurations = {
     epral = import ./mobile.nix flakeContext; # epral (Android via nix-on-droid)

configurations/mini-laptop.nix

@@ -1,22 +1,17 @@
 {
-  inputs,
+  deviceType = "secondary";
-  ...
+  hostname = "rydiwo";
-}@flakeContext:
+  modules = [
-let
+    (
-  nixosModule =
       {
         config,
+        inputs,
         lib,
         pkgs,
         xlib,
         ...
       }:
       {
-      xlib.device = {
-        type = "secondary";
-        hostname = "rydiwo";
-      };
-
         imports = with inputs; [
           nixos-hardware.nixosModules.chuwi-minibook-x
           ./hardware/mini-laptop.nix
@@ -49,7 +44,6 @@ let
         };
 
         networking = {
-        hostName = "${xlib.device.hostname}";
           networkmanager.enable = true;
           firewall.enable = false;
         };
@@ -130,14 +124,7 @@ let
         hardware.intel-gpu-tools.enable = true;
 
         system.stateVersion = "26.05";
-    };
+      }
-in
+    )
-inputs.nixpkgs.lib.nixosSystem {
-  modules = with inputs; [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "secondary";
-  };
 }

configurations/mini-pc.nix

@@ -1,22 +1,17 @@
 {
-  inputs,
+  deviceType = "primary";
-  ...
+  hostname = "atoridu";
-}@flakeContext:
+  modules = [
-let
+    (
-  nixosModule =
       {
         config,
+        inputs,
         lib,
         pkgs,
         xlib,
         ...
       }:
       {
-      xlib.device = {
-        type = "primary";
-        hostname = "atoridu";
-      };
-
         imports = with inputs; [
           ./hardware/mini-pc.nix
           ./disko/mini-pc.nix
@@ -79,7 +74,6 @@ let
         };
 
         networking = {
-        hostName = "${xlib.device.hostname}";
           networkmanager.enable = true;
           firewall.enable = false;
         };
@@ -147,14 +141,7 @@ let
         };
 
         system.stateVersion = "26.05";
-    };
+      }
-in
+    )
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "primary";
-  };
 }

configurations/server.nix

@@ -1,19 +1,17 @@
-{ inputs, ... }@flakeContext:
+{
-let
+  deviceType = "server";
-  nixosModule =
+  hostname = "sapphira";
+  modules = [
+    (
       {
         config,
+        inputs,
         lib,
         pkgs,
         xlib,
         ...
       }:
       {
-      xlib.device = {
-        type = "server";
-        hostname = "sapphira";
-      };
-
         imports = [
           ./hardware/server.nix
           inputs.self.nixosModules.default
@@ -107,7 +105,6 @@ let
         };
 
         networking = {
-        hostName = "${xlib.device.hostname}";
           networkmanager.enable = true;
           firewall.enable = false;
           # nameservers = [
@@ -119,14 +116,7 @@ let
         system = {
           stateVersion = "25.05";
         };
-    };
+      }
-in
+    )
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "server";
-  };
 }

configurations/vds-new.nix

@@ -1,130 +0,0 @@
-{ inputs, ... }@flakeContext:
-let
-  nixosModule =
-    {
-      config,
-      lib,
-      modulesPath,
-      pkgs,
-      xlib,
-      ...
-    }:
-    {
-      xlib.device = {
-        type = "vds-new";
-        hostname = "otreca-new";
-      };
-
-      imports = [
-        (modulesPath + "/installer/scan/not-detected.nix")
-        (modulesPath + "/profiles/qemu-guest.nix")
-
-        ./disko/vds.nix
-        ./hardware/vds.nix
-
-        inputs.self.nixosModules.default
-      ];
-
-      boot = {
-        kernelPackages = pkgs.linuxPackages_xanmod_stable;
-        hardwareScan = true;
-        loader = {
-          grub = {
-            enable = true;
-            device = "nodev";
-            useOSProber = false;
-            efiSupport = false;
-          };
-          systemd-boot.enable = lib.mkDefault false;
-        };
-      };
-
-      services = {
-        earlyoom.enable = true;
-        journald = {
-          extraConfig = ''
-            SystemMaxUse=512M
-          '';
-        };
-        openssh = {
-          enable = true;
-          allowSFTP = true;
-          openFirewall = true;
-          hostKeys = [
-            {
-              path = "/etc/ssh/id_ed25519";
-              type = "ed25519";
-            }
-          ];
-          settings = {
-            PasswordAuthentication = false;
-            PermitRootLogin = "yes";
-            UsePAM = true;
-          };
-        };
-        tailscale = {
-          enable = true;
-          openFirewall = true;
-        };
-      };
-
-      networking = {
-        nameservers = [
-          "1.1.1.1"
-          "8.8.8.8"
-          "2001:4860:4860::8844"
-          "2001:4860:4860::8888"
-          "2606:4700:4700::1111"
-          "2606:4700:4700::1001"
-        ];
-        hostName = "${xlib.device.hostname}";
-        networkmanager.enable = true;
-        tempAddresses = "disabled";
-        dhcpcd = {
-          enable = true;
-          IPv6rs = true;
-        };
-        firewall = {
-          enable = true;
-          allowPing = true;
-        };
-        enableIPv6 = true;
-        interfaces.ens3 = {
-          useDHCP = true;
-          # ipv4.addresses = [
-          #   {
-          #     address = "31.57.158.109";
-          #     prefixLength = 24;
-          #   }
-          # ];
-          # ipv6.addresses = [
-          #   {
-          #     address = "2a13:7c00:6:102:f816:3eff:fe91:6b9e";
-          #     prefixLength = 64;
-          #   }
-          # ];
-        };
-        # defaultGateway = {
-        #   address = "31.57.158.1";
-        #   interface = "ens3";
-        # };
-        # defaultGateway6 = {
-        #   address = "2a13:7c00:6:102::1";
-        #   interface = "ens3";
-        # };
-      };
-
-      system = {
-        stateVersion = "25.05";
-      };
-    };
-in
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
-  ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "vds-new";
-  };
-}

configurations/vds.nix

@@ -1,8 +1,11 @@
-{ inputs, ... }@flakeContext:
+{
-let
+  deviceType = "vds";
-  nixosModule =
+  hostname = "otreca";
+  modules = [
+    (
       {
         config,
+        inputs,
         lib,
         modulesPath,
         pkgs,
@@ -10,11 +13,6 @@ let
         ...
       }:
       {
-      xlib.device = {
-        type = "vds";
-        hostname = "otreca";
-      };
-
         imports = [
           (modulesPath + "/installer/scan/not-detected.nix")
           (modulesPath + "/profiles/qemu-guest.nix")
@@ -82,7 +80,6 @@ let
             # "2606:4700:4700::1111"
             # "2606:4700:4700::1001"
           ];
-        hostName = "${xlib.device.hostname}";
           networkmanager.enable = true;
           tempAddresses = "disabled";
           dhcpcd = {
@@ -144,14 +141,7 @@ let
         system = {
           stateVersion = "25.05";
         };
-    };
+      }
-in
+    )
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "vds";
-  };
 }

configurations/wsl.nix

@@ -1,20 +1,18 @@
-{ inputs, ... }@flakeContext:
+{
-let
+  deviceType = "wsl";
-  nixosModule =
+  hostname = "wsl";
+  modules = [
+    (
       {
         config,
+        inputs,
         lib,
-      pkgs,
         modulesPath,
+        pkgs,
         xlib,
         ...
       }:
       {
-      xlib.device = {
-        type = "wsl";
-        hostname = "wsl";
-      };
-
         imports = [
           inputs.nixos-wsl.nixosModules.default
           inputs.self.nixosModules.default
@@ -45,7 +43,6 @@ let
           #   "2606:4700:4700::1111"
           #   "2606:4700:4700::1001"
           # ];
-        hostName = "${xlib.device.hostname}";
           # networkmanager.enable = true;
           # tempAddresses = "disabled";
           # dhcpcd = {
@@ -90,14 +87,7 @@ let
         };
 
         system.stateVersion = "24.11";
-    };
+      }
-in
+    )
-inputs.nixpkgs.lib.nixosSystem {
-  modules = [
-    nixosModule
   ];
-  system = "x86_64-linux";
-  specialArgs = {
-    deviceType = "wsl";
-  };
 }

deploy/default.nix

@@ -9,7 +9,6 @@ let
   user = "${inputs.self.nixosConfigurations.default.config.xlib.device.username}";
   server = "sapphira";
   vds = "otreca";
-  vds-new = "otreca-new";
   mini-laptop = "rydiwo";
 in
 {
@@ -19,7 +18,6 @@ in
     nodes = {
       "${server}" = mkDeploy "${server}";
       "${vds}" = mkDeploy "${vds}";
-      "${vds-new}" = mkDeploy "${vds-new}";
       "${mini-laptop}" = mkDeploy "${mini-laptop}";
     };
   };

flake.lock

@@ -420,19 +420,20 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "zapret": "zapret"
       },
       "locked": {
-        "lastModified": 1783174389,
+        "lastModified": 1785752612,
-        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "narHash": "sha256-xplyGWMis+MHSOJcwlnOTlebJGNag0qFsZ719JQWsz8=",
-        "owner": "Mic92",
+        "owner": "FUFSoB",
-        "repo": "sops-nix",
+        "repo": "proxy-suite-flake",
-        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "rev": "47a07d971cf53e62b912d2809a9a711275ceb00d",
         "type": "github"
       },
       "original": {
-        "owner": "Mic92",
+        "owner": "FUFSoB",
-        "repo": "sops-nix",
+        "repo": "proxy-suite-flake",
         "type": "github"
       }
     },
@@ -457,7 +458,7 @@
         "proxy-suite": "proxy-suite",
         "sops-nix": "sops-nix",
         "utils": "utils",
-        "zapret": "zapret",
+        "zapret": "zapret_2",
         "zeroq-credentials": "zeroq-credentials"
       }
     },
@@ -531,6 +532,44 @@
       }
     },
     "zapret": {
+      "inputs": {
+        "nixpkgs": [
+          "proxy-suite",
+          "nixpkgs"
+        ],
+        "zapret-flowseal": "zapret-flowseal"
+      },
+      "locked": {
+        "lastModified": 1784758289,
+        "narHash": "sha256-gUwiD33Dn5Q4Fi3RwbRmJJ7wiRw19rvyFJBBnhHWMQc=",
+        "owner": "kartavkun",
+        "repo": "zapret-discord-youtube",
+        "rev": "a7d7f1dd3765937b051d1289fba3fde2a6c8c7c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kartavkun",
+        "repo": "zapret-discord-youtube",
+        "type": "github"
+      }
+    },
+    "zapret-flowseal": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1784697388,
+        "narHash": "sha256-Lf7oloMkMziQRzyE/nw16J1/hAxSuRG5ioZb7UbLRUo=",
+        "owner": "Flowseal",
+        "repo": "zapret-discord-youtube",
+        "rev": "9503dc045133000af8075e066f09bb469008e530",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Flowseal",
+        "repo": "zapret-discord-youtube",
+        "type": "github"
+      }
+    },
+    "zapret_2": {
       "locked": {
         "lastModified": 1767430655,
         "narHash": "sha256-f9PricXeNm3lG1tk2TepPPY+wxM5y0ezo1HSzNn4BQ8=",

flake.nix

@@ -67,7 +67,7 @@
       };
     };
     proxy-suite = {
-      url = "github:Mic92/sops-nix";
+      url = "github:FUFSoB/proxy-suite-flake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     sops-nix = {

home/vds-new.nix

@@ -1,27 +0,0 @@
-{
-  config,
-  pkgs,
-  xlib,
-  ...
-}:
-{
-  imports = [
-    ./minimal.nix
-  ];
-  xdg = {
-    enable = true;
-    autostart.enable = true;
-    userDirs = {
-      enable = true;
-      createDirectories = false;
-      desktop = null;
-      documents = null;
-      download = null;
-      music = null;
-      pictures = null;
-      publicShare = null;
-      templates = null;
-      videos = null;
-    };
-  };
-}

lib/mkSystem.nix

@@ -0,0 +1,27 @@
+{
+  inputs,
+  ...
+}:
+{
+  deviceType,
+  hostname ? null,
+  modules ? [ ],
+  system ? "x86_64-linux",
+}:
+let
+  lib = inputs.nixpkgs.lib;
+in
+lib.nixosSystem {
+  inherit system;
+  modules = modules ++ [
+    {
+      xlib.device = {
+        type = deviceType;
+      }
+      // lib.optionalAttrs (hostname != null) { inherit hostname; };
+    }
+  ];
+  specialArgs = {
+    inherit deviceType inputs;
+  };
+}

modules/default.nix

@@ -28,6 +28,7 @@ let
       nixpkgs.overlays = with inputs; [
         self.nixosOverlays.default
       ];
+      networking.hostName = lib.mkDefault config.xlib.device.hostname;
       _module.args = {
         inputs = inputs;
         xlib = config.xlib;

modules/options.nix

@@ -14,7 +14,6 @@
             "secondary"
             "server"
             "vds"
-            "vds-new"
             "wsl"
             "termux"
           ];

modules/vds-new/default.nix

@@ -1,9 +0,0 @@
-{
-  lib,
-  ...
-}:
-{
-  imports = [
-    ../vds
-  ];
-}

modules/wsl/containers/3x-ui.nix

@@ -1,118 +0,0 @@
-# Auto-generated using compose2nix v0.3.3-pre.
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-
-{
-  # Runtime
-  virtualisation.podman = {
-    enable = true;
-    autoPrune = {
-      enable = true;
-      flags = [ "--all" ];
-    };
-    dockerCompat = true;
-  };
-
-  # Enable container name DNS for all Podman networks.
-  networking.firewall.interfaces =
-    let
-      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
-    in
-    {
-      "${matchAll}".allowedUDPPorts = [ 53 ];
-    };
-
-  networking.firewall = {
-    allowedUDPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
-    ];
-    allowedTCPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
-    ];
-    allowedTCPPorts = [
-      8443
-      9443
-      13380
-    ];
-    allowedUDPPorts = [
-      8443
-      9443
-      13380
-    ];
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  # Containers
-  virtualisation.oci-containers.containers."3xui_app" = {
-    image = "ghcr.io/mhsanaei/3x-ui:latest";
-    environment = {
-      "XRAY_VMESS_AEAD_FORCED" = "false";
-      "XUI_ENABLE_FAIL2BAN" = "true";
-      "TZ" = "Europe/Moscow";
-    };
-    volumes = [
-      "/mnt/containers/3x-ui/cert/:/root/cert:rw"
-      "/mnt/containers/3x-ui/db/:/etc/x-ui:rw"
-    ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network=host"
-    ];
-  };
-  systemd.services."podman-3xui_app" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 90 "always";
-    };
-    partOf = [
-      "podman-compose-3x-ui-root.target"
-    ];
-    wantedBy = [
-      "podman-compose-3x-ui-root.target"
-    ];
-  };
-
-  # Builds
-  systemd.services."podman-build-3xui_app" = {
-    path = [
-      pkgs.podman
-      pkgs.git
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      TimeoutSec = 300;
-    };
-    script = ''
-      cd /mnt/containers/3x-ui
-      podman build -t compose2nix/3xui_app -f ./Dockerfile .
-    '';
-  };
-
-  # Root service
-  # When started, this will automatically create all resources and start
-  # the containers. When stopped, this will teardown all resources.
-  systemd.targets."podman-compose-3x-ui-root" = {
-    unitConfig = {
-      Description = "Root target generated by compose2nix.";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-
-  # Folders
-  systemd.tmpfiles.rules = [
-    "d /mnt 0755 root root -"
-    "d /mnt/containers 0755 root root -"
-    "d /mnt/containers/3x-ui 0755 root root -"
-    "d /mnt/containers/3x-ui/cert 0755 root root -"
-    "d /mnt/containers/3x-ui/db 0755 root root -"
-  ];
-}

modules/wsl/containers/default.nix

@@ -6,7 +6,8 @@
 }:
 {
   imports = [
-    # ./3x-ui.nix
+    # shared container modules live in ../../containers
+    # ../../containers/3x-ui.nix
   ];
 
   environment.systemPackages = with pkgs; [

pkgs/default.nix

@@ -12,6 +12,5 @@ in
   packages.${system} = {
     rovr = pkgs.callPackage ./rovr { };
     pcbu-desktop = pkgs.callPackage ./pcbu-desktop { };
-    # immich = pkgs.callPackage ./immich { };
   };
 }