minecraft: use jdk25 for fabric 26.2 server

configurations/hardware/vds-new.nix

@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-{
-  fileSystems = {
-    "/" = {
-      device = lib.mkForce "/dev/disk/by-partlabel/disk-main-root"; # "/dev/disk/by-partlabel/disk-main-root";
-      fsType = "ext4";
-    };
-  };
-
-  # swapDevices = [
-  #   { device = "/dev/disk/by-partlabel/disk-main-swap"; }
-  # ];
-
-  networking.useDHCP = lib.mkDefault true;
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

configurations/mini-laptop.nix

@@ -4,11 +4,10 @@
   modules = [
     (
       {
-        config,
-        inputs,
         lib,
         pkgs,
         xlib,
+        inputs,
         ...
       }:
       {
@@ -26,101 +25,13 @@
           };
         };
 
-        fileSystems."${xlib.dirs.lamet-drive}" = {
+        fileSystems = xlib.helpers.mkNtfsMount {
-          device = "/dev/disk/by-uuid/DC76BD3576BD116E";
+          path = xlib.dirs.lamet-drive;
-          fsType = "ntfs3";
+          uuid = "DC76BD3576BD116E";
-          options = [
+          mask = "0000";
-            "defaults"
-            "uid=1000"
-            "gid=1000"
-            "fmask=0000"
-            "dmask=0000"
-            "nofail"
-          ];
-        };
-
-        hardware = {
-          bluetooth.enable = true;
-        };
-
-        networking = {
-          networkmanager.enable = true;
-          firewall.enable = false;
-        };
-
-        i18n = {
-          extraLocaleSettings = {
-            LC_ADDRESS = "ru_RU.UTF-8";
-            LC_IDENTIFICATION = "ru_RU.UTF-8";
-            LC_MEASUREMENT = "ru_RU.UTF-8";
-            LC_MONETARY = "ru_RU.UTF-8";
-            LC_NAME = "ru_RU.UTF-8";
-            LC_NUMERIC = "ru_RU.UTF-8";
-            LC_PAPER = "ru_RU.UTF-8";
-            LC_TELEPHONE = "ru_RU.UTF-8";
-            LC_TIME = "ru_RU.UTF-8";
-          };
-        };
-
-        services = {
-          # xserver = {
-          #   videoDrivers = [
-          #     "nomodeset"
-          #   ];
-          # };
-          syncthing = {
-            enable = true;
-            systemService = true;
-            configDir = "${xlib.dirs.user-storage}/Syncthing/${config.system.name}";
-            dataDir = "${xlib.dirs.user-home}";
-            group = "users";
-            user = "${xlib.device.username}";
-          };
-          # pipewire = {
-          #   enable = lib.mkDefault true;
-          #   systemWide = true;
-          #   alsa.enable = false;
-          #   alsa.support32Bit = true;
-          #   pulse.enable = true;
-          #   jack.enable = true;
-          #   extraConfig.pipewire = {
-          #     "99-default.conf" = {
-          #       "context.properties" = {
-          #         "default.clock.rate" = 96000;
-          #         "default.clock.allowed-rates" = [
-          #           44100
-          #           48000
-          #           96000
-          #         ];
-          #         "default.clock.quantum" = 1024;
-          #         "default.clock.min-quantum" = 256;
-          #         "default.clock.max-quantum" = 2048;
-          #       };
-          #     };
-          #   };
-          # };
-          thermald.enable = true;
-          earlyoom.enable = true;
-          openssh = {
-            enable = true;
-            allowSFTP = true;
-            hostKeys = [
-              {
-                path = "/etc/ssh/id_ed25519";
-                type = "ed25519";
-              }
-            ];
-            settings = {
-              PasswordAuthentication = false;
-              PermitRootLogin = "yes";
-              UsePAM = true;
-            };
-          };
-        };
-        security = {
-          rtkit.enable = true;
         };
 
+        xlib.ssh.enable = true;
         hardware.intel-gpu-tools.enable = true;
 
         system.stateVersion = "26.05";

configurations/mini-pc.nix

@@ -4,11 +4,10 @@
   modules = [
     (
       {
-        config,
-        inputs,
         lib,
         pkgs,
         xlib,
+        inputs,
         ...
       }:
       {
@@ -19,47 +18,25 @@
           self.nixosModules.default
         ];
 
-        fileSystems = {
+        fileSystems = lib.listToAttrs (
-          "${xlib.dirs.therima-drive}" = {
+          map (xlib.helpers.mkNtfsMount) [
+            {
+              path = xlib.dirs.therima-drive;
+              uuid = "C0A2DDEFA2DDEA44";
               enable = false;
-            device = "/dev/disk/by-uuid/C0A2DDEFA2DDEA44";
+            }
-            fsType = "ntfs3";
+            {
-            options = [
+              path = xlib.dirs.vetymae-drive;
-              "defaults"
+              uuid = "6408433908430A0E";
-              "uid=1000"
-              "gid=1000"
-              "fmask=0007"
-              "dmask=0007"
-              "nofail"
-            ];
-          };
-          "${xlib.dirs.vetymae-drive}" = {
               enable = false;
-            device = "/dev/disk/by-uuid/6408433908430A0E";
+            }
-            fsType = "ntfs3";
+            {
-            options = [
+              path = xlib.dirs.soptur-drive;
-              "defaults"
+              uuid = "C00C56E40C56D54E";
-              "uid=1000"
-              "gid=1000"
-              "fmask=0007"
-              "dmask=0007"
-              "nofail"
-            ];
-          };
-          "${xlib.dirs.soptur-drive}" = {
               enable = false;
-            device = "/dev/disk/by-uuid/C00C56E40C56D54E";
+            }
-            fsType = "ntfs3";
+          ]
-            options = [
+        );
-              "defaults"
-              "uid=1000"
-              "gid=1000"
-              "fmask=0007"
-              "dmask=0007"
-              "nofail"
-            ];
-          };
-        };
 
         boot = {
           kernelPackages = lib.mkDefault pkgs.linuxPackages_xanmod_stable;
@@ -69,46 +46,12 @@
           };
         };
 
-        hardware = {
+        services.xserver = {
-          bluetooth.enable = true;
-        };
-
-        networking = {
-          networkmanager.enable = true;
-          firewall.enable = false;
-        };
-
-        i18n = {
-          extraLocaleSettings = {
-            LC_ADDRESS = "ru_RU.UTF-8";
-            LC_IDENTIFICATION = "ru_RU.UTF-8";
-            LC_MEASUREMENT = "ru_RU.UTF-8";
-            LC_MONETARY = "ru_RU.UTF-8";
-            LC_NAME = "ru_RU.UTF-8";
-            LC_NUMERIC = "ru_RU.UTF-8";
-            LC_PAPER = "ru_RU.UTF-8";
-            LC_TELEPHONE = "ru_RU.UTF-8";
-            LC_TIME = "ru_RU.UTF-8";
-          };
-        };
-
-        services = {
-          #logrotate.checkConfig = false;
-          #power-profiles-daemon.enable = false;
-          xserver = {
           videoDrivers = [
             "amdgpu"
           ];
         };
-          syncthing = {
+        services.pipewire = {
-            enable = true;
-            systemService = true;
-            configDir = "${xlib.dirs.user-storage}/Syncthing/${config.system.name}";
-            dataDir = "${xlib.dirs.user-home}";
-            group = "users";
-            user = "${xlib.device.username}";
-          };
-          pipewire = {
           enable = lib.mkDefault true;
           systemWide = true;
           alsa.enable = false;
@@ -131,15 +74,8 @@
             };
           };
         };
-          thermald.enable = true;
-          earlyoom.enable = true;
-        };
         nixpkgs.config.pulseaudio = true;
 
-        security = {
-          rtkit.enable = true;
-        };
-
         system.stateVersion = "26.05";
       }
     )

configurations/server.nix

@@ -4,11 +4,10 @@
   modules = [
     (
       {
-        config,
-        inputs,
         lib,
         pkgs,
         xlib,
+        inputs,
         ...
       }:
       {
@@ -39,70 +38,32 @@
           intel-gpu-tools.enable = true;
         };
 
-        fileSystems = {
+        fileSystems =
+          (xlib.helpers.mkExfatMount {
+            path = xlib.dirs.archive-drive;
+            label = "archive";
+          })
+          // (xlib.helpers.mkExfatMount {
+            path = xlib.dirs.mobile-drive;
+            uuid = "7EB1-DC99";
+          })
+          // (xlib.helpers.mkBindMount {
+            what = xlib.dirs.services-folder;
+            where = xlib.dirs.services-mnt-folder;
+          })
+          // {
             # External drive
             "${xlib.dirs.server-home}" = {
               device = "/dev/disk/by-uuid/37e53ebc-5343-a94d-9fe2-0ca39e13a8de";
               fsType = "ext4";
             };
-          # Archive drive
-          "${xlib.dirs.archive-drive}" = {
-            device = "/dev/disk/by-label/archive";
-            fsType = "exfat";
-            options = [
-              "nofail"
-              "uid=1000"
-              "gid=1000"
-            ];
-          };
-          # Mobile SD-Card
-          "${xlib.dirs.mobile-drive}" = {
-            device = "/dev/disk/by-uuid/7EB1-DC99";
-            fsType = "exfat";
-            options = [
-              "nofail"
-              "uid=1000"
-              "gid=1000"
-            ];
-          };
-          # Services in /mnt folder
-          "${xlib.dirs.services-mnt-folder}" = {
-            device = "${xlib.dirs.services-folder}";
-            fsType = "none";
-            options = [
-              "bind"
-              "nofail"
-            ];
-          };
           };
 
         systemd.tmpfiles.rules = [
           "z ${xlib.dirs.services-mnt-folder} 0777 root root -"
         ];
 
-        services = {
+        xlib.ssh.enable = true;
-          earlyoom.enable = true;
-          journald = {
-            extraConfig = ''
-              SystemMaxUse=512M
-            '';
-          };
-          openssh = {
-            enable = true;
-            allowSFTP = true;
-            hostKeys = [
-              {
-                path = "/etc/ssh/id_ed25519";
-                type = "ed25519";
-              }
-            ];
-            settings = {
-              PasswordAuthentication = false;
-              PermitRootLogin = "yes";
-              UsePAM = true;
-            };
-          };
-        };
 
         networking = {
           networkmanager.enable = true;

configurations/vds.nix

@@ -5,11 +5,11 @@
     (
       {
         config,
-        inputs,
         lib,
         modulesPath,
         pkgs,
         xlib,
+        inputs,
         ...
       }:
       {
@@ -43,42 +43,17 @@
           };
         };
 
-        services = {
+        xlib.ssh.enable = true;
-          earlyoom.enable = true;
+        services.openssh.openFirewall = true;
-          journald = {
+
-            extraConfig = ''
+        services.tailscale = {
-              SystemMaxUse=512M
-            '';
-          };
-          openssh = {
-            enable = true;
-            allowSFTP = true;
-            openFirewall = true;
-            hostKeys = [
-              {
-                path = "/etc/ssh/id_ed25519";
-                type = "ed25519";
-              }
-            ];
-            settings = {
-              PasswordAuthentication = false;
-              PermitRootLogin = "yes";
-              UsePAM = true;
-            };
-          };
-          tailscale = {
           enable = true;
           openFirewall = true;
         };
-        };
         networking = {
           nameservers = [
             "1.1.1.1"
             "8.8.8.8"
-            # "2001:4860:4860::8844"
-            # "2001:4860:4860::8888"
-            # "2606:4700:4700::1111"
-            # "2606:4700:4700::1001"
           ];
           networkmanager.enable = true;
           tempAddresses = "disabled";

configurations/wsl.nix

@@ -5,11 +5,11 @@
     (
       {
         config,
-        inputs,
         lib,
-        modulesPath,
         pkgs,
+        modulesPath,
         xlib,
+        inputs,
         ...
       }:
       {
@@ -18,65 +18,16 @@
           inputs.self.nixosModules.default
         ];
 
-        #zramSwap.enable = true;
-        services = {
-          journald = {
-            extraConfig = ''
-              SystemMaxUse=512M
-            '';
-          };
-          earlyoom.enable = true;
-        };
-
         hardware = {
           graphics.enable = true;
-          # amdgpu.opencl.enable = true;
-          # amdgpu.amdvlk.enable = true;
         };
 
         networking = {
-          # nameservers = [
-          #   "1.1.1.1"
-          #   "8.8.8.8"
-          #   "2001:4860:4860::8844"
-          #   "2001:4860:4860::8888"
-          #   "2606:4700:4700::1111"
-          #   "2606:4700:4700::1001"
-          # ];
-          # networkmanager.enable = true;
-          # tempAddresses = "disabled";
-          # dhcpcd = {
-          #   enable = true;
-          #   IPv6rs = true;
-          # };
           firewall = {
             enable = false;
             allowPing = true;
           };
           enableIPv6 = true;
-          # interfaces.ens3 = {
-          #   useDHCP = true;
-          #   # ipv4.addresses = [
-          #   #   {
-          #   #     address = "31.57.158.109";
-          #   #     prefixLength = 24;
-          #   #   }
-          #   # ];
-          #   ipv6.addresses = [
-          #     {
-          #       address = "2a13:7c00:10:6:f816:3eff:fe36:fe1b";
-          #       prefixLength = 64;
-          #     }
-          #   ];
-          # };
-          # # defaultGateway = {
-          # #   address = "31.57.158.1";
-          # #   interface = "ens3";
-          # # };
-          # defaultGateway6 = {
-          #   address = "2a13:7c00:10:6::1";
-          #   interface = "ens3";
-          # };
         };
 
         wsl = {

flake.lock

@@ -127,6 +127,32 @@
         "type": "github"
       }
     },
+    "nix-minecraft": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "nix-systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786414302,
+        "narHash": "sha256-FNGnUYud1D3BqE1JU2Uef+puLB2Rml7gKSdIGQOb550=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "cacc8cd89550f0cbec7103f3db5e96d1a66c58e7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
     "nix-on-droid": {
       "inputs": {
         "home-manager": [
@@ -155,6 +181,21 @@
         "type": "github"
       }
     },
+    "nix-systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": "nixpkgs"
@@ -211,38 +252,6 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs-beets": {
-      "locked": {
-        "lastModified": 1774610258,
-        "narHash": "sha256-HaThtroVD9wRdx7KQk0B75JmFcXlMUoEdDFNOMOlsOs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "832efc09b4caf6b4569fbf9dc01bec3082a00611",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "832efc09b4caf6b4569fbf9dc01bec3082a00611",
-        "type": "github"
-      }
-    },
-    "nixpkgs-calibre": {
-      "locked": {
-        "lastModified": 1776255774,
-        "narHash": "sha256-psVTpH6PK3q1htMJpmdz1hLF5pQgEshu7gQWgKO6t6Y=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a",
-        "type": "github"
-      }
-    },
     "nixpkgs-docs": {
       "locked": {
         "lastModified": 1705957679,
@@ -275,70 +284,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-master": {
-      "locked": {
-        "lastModified": 1786198689,
-        "narHash": "sha256-XkvYmpRd4cmcrzKS8QplEHPZkDDeKwpalJQwosCd3+Q=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "94ec6671dbe7d4879c2c8103e67425e85bf066d7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-previous": {
-      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1782847189,
-        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1785975029,
-        "narHash": "sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "70ce234312134a463ba7728e94da2486a1d237ac",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1785967620,
@@ -444,21 +389,16 @@
         "flake-compat": "flake-compat",
         "grub2-themes": "grub2-themes",
         "home-manager": "home-manager",
+        "nix-minecraft": "nix-minecraft",
         "nix-on-droid": "nix-on-droid",
+        "nix-systems": "nix-systems",
         "nixos-hardware": "nixos-hardware",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
-        "nixpkgs-beets": "nixpkgs-beets",
-        "nixpkgs-calibre": "nixpkgs-calibre",
-        "nixpkgs-master": "nixpkgs-master",
-        "nixpkgs-previous": "nixpkgs-previous",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "nixpkgs-unstable": "nixpkgs-unstable",
         "plasma-manager": "plasma-manager",
         "proxy-suite": "proxy-suite",
         "sops-nix": "sops-nix",
         "utils": "utils",
-        "zapret": "zapret_2",
         "zeroq-credentials": "zeroq-credentials"
       }
     },
@@ -569,21 +509,6 @@
         "type": "github"
       }
     },
-    "zapret_2": {
-      "locked": {
-        "lastModified": 1767430655,
-        "narHash": "sha256-f9PricXeNm3lG1tk2TepPPY+wxM5y0ezo1HSzNn4BQ8=",
-        "owner": "oqyude",
-        "repo": "zapret-easyflake",
-        "rev": "302e77aae5fc6030a9c3bcc781d6514d87b19d11",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oqyude",
-        "repo": "zapret-easyflake",
-        "type": "github"
-      }
-    },
     "zeroq-credentials": {
       "locked": {
         "lastModified": 1772104025,

flake.nix

@@ -3,17 +3,10 @@
   inputs = {
     # My
     zeroq-credentials.url = "git+ssh://git@github.com/oqyude/zeroq-credentials.git"; # flake of creds
-    zapret.url = "github:oqyude/zapret-easyflake"; # stupid flake of zapret
 
     # nixpkgs
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     # nixpkgs-last-unstable.url = "github:NixOS/nixpkgs/6b4955211758ba47fac850c040a27f23b9b4008f";
-    nixpkgs-calibre.url = "github:NixOS/nixpkgs/566acc07c54dc807f91625bb286cb9b321b5f42a";
-    nixpkgs-previous.url = "github:NixOS/nixpkgs/3497aa5c9457a9d88d71fa93a4a8368816fbeeba";
-    nixpkgs-master.url = "github:NixOS/nixpkgs/master";
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
-    nixpkgs-beets.url = "github:NixOS/nixpkgs/832efc09b4caf6b4569fbf9dc01bec3082a00611"; # 2343bbb58f99267223bc2aac4fc9ea301a155a16
     # nixpkgs-fingerprint.url = "github:NixOS/nixpkgs/nixos-24.11";
 
     # nix-community
@@ -43,6 +36,7 @@
     utils.url = "github:numtide/flake-utils";
     flake-compat.url = "github:edolstra/flake-compat";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    nix-systems.url = "github:nix-systems/default";
     # nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
     # flake-utils.url = "github:numtide/flake-utils";
     # flake-parts.url = "github:hercules-ci/flake-parts";
@@ -78,6 +72,14 @@
       url = "github:vinceliuice/grub2-themes";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-minecraft = {
+      url = "github:Infinidoge/nix-minecraft";
+      inputs = {
+        flake-compat.follows = "flake-compat";
+        nixpkgs.follows = "nixpkgs";
+        systems.follows = "nix-systems";
+      };
+    };
     # nix-index-database = {
     #   url = "github:nix-community/nix-index-database";
     #   inputs.nixpkgs.follows = "nixpkgs";

home/home.nix

@@ -9,10 +9,14 @@ let
       ...
     }:
     let
-      mkHomeModule = username: {
+      mkUser =
-        imports = [
+        username:
-          (./. + "/${xlib.device.type}.nix")
+        {
-        ];
+          imports ? [ ],
+          headless ? false,
+        }:
+        {
+          inherit imports;
           home = {
             username = username;
             stateVersion = lib.mkDefault "26.05";
@@ -20,26 +24,22 @@ let
               if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
             enableNixpkgsReleaseCheck = false;
           };
+          # Headless hosts: no GUI user dirs
+          xdg = lib.mkIf headless {
+            enable = true;
+            autostart.enable = true;
+            userDirs = {
+              enable = true;
+              createDirectories = false;
+              desktop = null;
+              documents = null;
+              download = null;
+              music = null;
+              pictures = null;
+              publicShare = null;
+              templates = null;
+              videos = null;
             };
-      mkRootModule = username: {
-        home = {
-          username = username;
-          stateVersion = lib.mkDefault "26.05";
-          homeDirectory =
-            if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
-          enableNixpkgsReleaseCheck = false;
-        };
-      };
-      mkOthersModule = username: {
-        imports = [
-          (./. + "/others/${xlib.device.type}.nix")
-        ];
-        home = {
-          username = username;
-          stateVersion = lib.mkDefault "26.05";
-          homeDirectory =
-            if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
-          enableNixpkgsReleaseCheck = false;
           };
         };
     in
@@ -48,18 +48,17 @@ let
         useGlobalPkgs = true;
         useUserPackages = true;
         users = {
-          root = mkRootModule "root";
+          root = mkUser "root" { };
-          "${xlib.device.username}" = mkHomeModule xlib.device.username;
+          "${xlib.device.username}" = mkUser xlib.device.username {
-        }
+            imports = [
-        //
+              (./. + "/${xlib.device.type}.nix")
-          lib.optionalAttrs
+            ];
-            (builtins.elem xlib.device.type [
+            headless = builtins.elem xlib.device.type [
-              "test"
+              "server"
-              #"secondary"
+              "vds"
-              #"primary"
+              "wsl"
-            ])
+            ];
-            {
+          };
-              snity = mkOthersModule "snity";
         };
         sharedModules = [
           inputs.plasma-manager.homeModules.plasma-manager

home/others/primary.nix

@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  xlib,
-  ...
-}:
-let
-  symlinksPaths = {
-    "/home/oqyude/Games/PrismLaunchers" = "${config.home.homeDirectory}/Games/PrismLaunchers";
-    "${config.home.homeDirectory}/Games/PrismLaunchers/${config.home.username}" =
-      ".local/share/PrismLauncher";
-  };
-  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
-    name = targetPath;
-    value.source = config.lib.file.mkOutOfStoreSymlink "${sourcePath}";
-  }) symlinksPaths;
-in
-{
-  imports = [
-    ../minimal.nix
-    ../modules/packages.nix
-    ../modules/plasma-manager.nix
-  ];
-  xdg = {
-    enable = true;
-    autostart.enable = true;
-    userDirs = {
-      enable = true;
-      createDirectories = true;
-      desktop = "${config.xdg.dataHome}/desktop";
-      documents = null;
-      download = "${config.home.homeDirectory}/Downloads";
-      music = "${config.home.homeDirectory}/Music";
-      pictures = "${config.home.homeDirectory}/Pictures";
-      publicShare = "${config.home.homeDirectory}/Misc/Public";
-      templates = null;
-      videos = "${config.home.homeDirectory}/Pictures/Videos";
-    };
-  };
-  home = {
-    file = mkLinks;
-    pointerCursor = {
-      enable = true;
-      x11.enable = true;
-      gtk.enable = true;
-      size = 24;
-      name = "Qogir";
-      package = pkgs.qogir-icon-theme;
-    };
-  };
-}

home/others/secondary.nix

@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  xlib,
-  ...
-}:
-let
-  symlinksPaths = {
-    "/home/oqyude/Games/PrismLaunchers" = "${config.home.homeDirectory}/Games/PrismLaunchers";
-    "${config.home.homeDirectory}/Games/PrismLaunchers/${config.home.username}" =
-      ".local/share/PrismLauncher";
-  };
-  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
-    name = targetPath;
-    value.source = config.lib.file.mkOutOfStoreSymlink "${sourcePath}";
-  }) symlinksPaths;
-in
-{
-  imports = [
-    ../minimal.nix
-    ../modules/packages.nix
-    ../modules/plasma-manager.nix
-  ];
-  xdg = {
-    enable = true;
-    autostart.enable = true;
-    userDirs = {
-      enable = true;
-      createDirectories = true;
-      desktop = "${config.xdg.dataHome}/desktop";
-      documents = null;
-      download = "${config.home.homeDirectory}/Downloads";
-      music = "${config.home.homeDirectory}/Music";
-      pictures = "${config.home.homeDirectory}/Pictures";
-      publicShare = "${config.home.homeDirectory}/Misc/Public";
-      templates = null;
-      videos = "${config.home.homeDirectory}/Pictures/Videos";
-    };
-  };
-  home = {
-    file = mkLinks;
-    pointerCursor = {
-      enable = true;
-      x11.enable = true;
-      gtk.enable = true;
-      size = 24;
-      name = "Qogir";
-      package = pkgs.qogir-icon-theme;
-    };
-  };
-}

home/server.nix

@@ -5,35 +5,12 @@
   xlib,
   ...
 }:
-let
-  symlinksPaths = {
-    "${config.home.homeDirectory}/External/Music" = "Music";
-  };
-  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
-    name = targetPath;
-    value.source = config.lib.file.mkOutOfStoreSymlink "${sourcePath}";
-  }) symlinksPaths;
-in
 {
   imports = [
     ./minimal.nix
   ];
-  home.file = mkLinks;
+  home.file = xlib.helpers.mkSymlinks config {
-  xdg = {
+    "${config.home.homeDirectory}/External/Music" = "Music";
-    enable = true;
-    autostart.enable = true;
-    userDirs = {
-      enable = true;
-      createDirectories = false;
-      desktop = null;
-      documents = null;
-      download = null;
-      music = null;
-      pictures = null;
-      publicShare = null;
-      templates = null;
-      videos = null;
-    };
   };
   home.activation = {
     yaziSync = ''

home/vds.nix

@@ -1,27 +1,8 @@
 {
-  config,
-  pkgs,
-  xlib,
   ...
 }:
 {
   imports = [
     ./minimal.nix
   ];
-  xdg = {
-    enable = true;
-    autostart.enable = true;
-    userDirs = {
-      enable = true;
-      createDirectories = false;
-      desktop = null;
-      documents = null;
-      download = null;
-      music = null;
-      pictures = null;
-      publicShare = null;
-      templates = null;
-      videos = null;
-    };
-  };
 }

home/wsl.nix

@@ -5,38 +5,15 @@
   xlib,
   ...
 }:
-let
-  symlinksPaths = {
-    "${config.home.homeDirectory}/External/Music" = "Music";
-    "${xlib.dirs.wsl-home}" = "External";
-    "${xlib.dirs.wsl-storage}" = "Storage";
-  };
-  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
-    name = targetPath;
-    value.source = config.lib.file.mkOutOfStoreSymlink "${sourcePath}";
-  }) symlinksPaths;
-in
 {
   imports = [
     ./apps
     ./minimal.nix
   ];
-  home.file = mkLinks;
+  home.file = xlib.helpers.mkSymlinks config {
-  xdg = {
+    "${config.home.homeDirectory}/External/Music" = "Music";
-    enable = true;
+    "${xlib.dirs.wsl-home}" = "External";
-    autostart.enable = true;
+    "${xlib.dirs.wsl-storage}" = "Storage";
-    userDirs = {
-      enable = true;
-      createDirectories = false;
-      desktop = null;
-      documents = null;
-      download = null;
-      music = null;
-      pictures = null;
-      publicShare = null;
-      templates = null;
-      videos = null;
-    };
   };
   home.activation = {
     yaziSync = ''

lib/xlib.nix

@@ -0,0 +1,153 @@
+{
+  lib,
+  ...
+}:
+# Shared pure helper functions for module definitions.
+# Injected into every module via `xlib.helpers` (see options.nix).
+let
+  # tmpfiles rule: "type dir mode user group -"
+  mkTmpfile =
+    type: dir: mode: user: group:
+    "${type} ${dir} ${mode} ${user} ${group} -";
+
+  # several tmpfiles types for the same dir, e.g. ["d" "z"] or ["d" "Z"]
+  mkTmpDirs =
+    {
+      dir,
+      mode,
+      user,
+      group,
+      types ? [
+        "d"
+        "z"
+      ],
+    }:
+    map (type: mkTmpfile type dir mode user group) types;
+
+  # fileSystems bind mount
+  mkBindMount =
+    {
+      what,
+      where,
+    }:
+    {
+      "${where}" = {
+        device = what;
+        fsType = "none";
+        options = [
+          "bind"
+          "nofail"
+        ];
+      };
+    };
+
+  # systemd.mounts bind mount (automount variant)
+  mkSystemdBind =
+    {
+      what,
+      where,
+    }:
+    {
+      enable = true;
+      options = "bind,x-systemd.automount,nofail";
+      requires = [ "local-fs.target" ];
+      type = "none";
+      wantedBy = [ "multi-user.target" ];
+      inherit what where;
+    };
+
+  # Full "service storage" block: services-mnt source dir + /var/lib target,
+  # tmpfiles d/z + automount bind. Used as:
+  #   storage = xlib.helpers.mkServiceStorage { name = "x"; user = "x"; group = "x"; };
+  #   systemd = storage.systemd;
+  mkServiceStorage =
+    {
+      name,
+      user,
+      group,
+      mode ? "0755",
+      target ? "/var/lib/${name}",
+      base ? "/mnt/services",
+    }:
+    let
+      sourceDir = "${base}/${name}";
+    in
+    {
+      inherit sourceDir target;
+      systemd = {
+        tmpfiles.rules = mkTmpDirs {
+          dir = sourceDir;
+          inherit mode user group;
+        };
+        mounts = [
+          (mkSystemdBind {
+            what = sourceDir;
+            where = target;
+          })
+        ];
+      };
+    };
+
+  # ntfs3 mount, e.g. fileSystems = mkNtfsMount { path = ...; uuid = ...; }
+  mkNtfsMount =
+    {
+      path,
+      uuid,
+      mask ? "0007",
+      enable ? null,
+    }:
+    {
+      "${path}" = {
+        device = "/dev/disk/by-uuid/${uuid}";
+        fsType = "ntfs3";
+        options = [
+          "defaults"
+          "uid=1000"
+          "gid=1000"
+          "fmask=${mask}"
+          "dmask=${mask}"
+          "nofail"
+        ];
+      }
+      // lib.optionalAttrs (enable != null) { inherit enable; };
+    };
+
+  # exfat mount, e.g. fileSystems = mkExfatMount { path = ...; uuid = ...; }
+  mkExfatMount =
+    {
+      path,
+      uuid ? null,
+      label ? null,
+    }:
+    {
+      "${path}" = {
+        device = if uuid != null then "/dev/disk/by-uuid/${uuid}" else "/dev/disk/by-label/${label}";
+        fsType = "exfat";
+        options = [
+          "nofail"
+          "uid=1000"
+          "gid=1000"
+        ];
+      };
+    };
+
+  # home-manager out-of-store symlinks: path = source (target name = attr name)
+  mkSymlinks =
+    config: paths:
+    lib.mapAttrs' (sourcePath: targetPath: {
+      name = targetPath;
+      value.source = config.lib.file.mkOutOfStoreSymlink "${sourcePath}";
+    }) paths;
+in
+{
+  inherit
+    mkTmpfile
+    mkTmpDirs
+    mkBindMount
+    mkSystemdBind
+    mkServiceStorage
+    mkNtfsMount
+    mkExfatMount
+    mkSymlinks
+    ;
+}

modules/default.nix

@@ -1,5 +1,12 @@
 { inputs, ... }@flakeContext:
 let
+  # NixOS-only modules. termux runs nix-on-droid (its own module system,
+  # class = "nixOnDroid"): options like services.*, users.*, sops.*, disko.*
+  # and nixpkgs.overlays (flake assertion) do not exist there.
+  moduleArgs = config: {
+    inherit inputs;
+    xlib = config.xlib;
+  };
   defaultModule =
     {
       config,
@@ -8,15 +15,19 @@ let
       xlib,
       ...
     }:
+    let
+      isDesktop = builtins.elem deviceType [
+        "primary"
+        "secondary"
+      ];
+    in
     {
-      # NixOS-only modules. termux runs nix-on-droid (its own module system,
+      imports =
-      # class = "nixOnDroid"): options like services.*, users.*, sops.*, disko.*
+        with inputs;
-      # and nixpkgs.overlays (flake assertion) do not exist there.
+        [
-      imports = with inputs; [
           ./essentials
           ./options.nix
           ./users.nix
-        (./. + "/${deviceType}")
 
           home-manager.nixosModules.home-manager # home-manager module
           # nix-index-database.nixosModules.nix-index # nix-index module
@@ -24,37 +35,15 @@ let
           sops-nix.nixosModules.sops # sops module
           self.homeConfigurations.default.nixosModule # default homeConfigurations
           disko.nixosModules.disko # disko module
-      ];
+        ]
+        ++ lib.optional isDesktop ../desktop # desktop class: primary/secondary
+        # device-type module dir; "minimal" has no extra modules
+        ++ lib.optional (!isDesktop && deviceType != "minimal") (./. + "/${deviceType}");
       nixpkgs.overlays = with inputs; [
         self.nixosOverlays.default
       ];
       networking.hostName = lib.mkDefault config.xlib.device.hostname;
-      _module.args = {
+      _module.args = moduleArgs config;
-        inputs = inputs;
-        xlib = config.xlib;
-      };
-    };
-  publicModule =
-    {
-      config,
-      lib,
-      xlib,
-      ...
-    }:
-    {
-      imports = with inputs; [
-        ./essentials
-        ./users.nix
-        ./options.nix
-
-        disko.nixosModules.disko # disko module
-        sops-nix.nixosModules.sops # sops module
-      ];
-
-      _module.args = {
-        inputs = inputs;
-        xlib = config.xlib;
-      };
     };
   strictModule =
     {
@@ -73,16 +62,12 @@ let
         # sops-nix.nixosModules.sops
       ];
 
-      _module.args = {
+      _module.args = moduleArgs config;
-        inputs = inputs;
-        xlib = config.xlib;
-      };
     };
 in
 {
   nixosModules = {
     default = defaultModule;
-    public = publicModule;
     strict = strictModule;
   };
 }

modules/desktop/default.nix

@@ -3,6 +3,7 @@
   inputs,
   lib,
   pkgs,
+  xlib,
   ...
 }:
 {
@@ -11,6 +12,54 @@
     ./theming.nix
   ];
 
+  # Things every desktop host has in common
+  hardware.bluetooth.enable = true;
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "ru_RU.UTF-8";
+    LC_IDENTIFICATION = "ru_RU.UTF-8";
+    LC_MEASUREMENT = "ru_RU.UTF-8";
+    LC_MONETARY = "ru_RU.UTF-8";
+    LC_NAME = "ru_RU.UTF-8";
+    LC_NUMERIC = "ru_RU.UTF-8";
+    LC_PAPER = "ru_RU.UTF-8";
+    LC_TELEPHONE = "ru_RU.UTF-8";
+    LC_TIME = "ru_RU.UTF-8";
+  };
+
+  networking = {
+    networkmanager.enable = true;
+    firewall.enable = false;
+  };
+
+  security.rtkit.enable = true;
+
+  services = {
+    syncthing = {
+      enable = true;
+      systemService = true;
+      configDir = "${xlib.dirs.user-storage}/Syncthing/${config.system.name}";
+      dataDir = "${xlib.dirs.user-home}";
+      group = "users";
+      user = "${xlib.device.username}";
+    };
+    thermald.enable = true;
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "us,ru";
+        variant = "";
+        # options = "grp:alt_shift_toggle";
+      };
+    };
+    libinput.enable = true;
+    colord.enable = true;
+    printing = {
+      enable = true;
+      cups-pdf.enable = true;
+    };
+  };
+
   boot = {
     plymouth = {
       enable = true;
@@ -53,22 +102,6 @@
     steam.enable = true;
     xwayland.enable = true;
   };
-  services = {
-    xserver = {
-      enable = true;
-      xkb = {
-        layout = "us,ru";
-        variant = "";
-        # options = "grp:alt_shift_toggle";
-      };
-    };
-    libinput.enable = true;
-    colord.enable = true;
-    printing = {
-      enable = true;
-      cups-pdf.enable = true;
-    };
-  };
   # environment = {
   #   systemPackages = [
   #     pkgs.pcbu-desktop

modules/desktop/environment/default.nix

@@ -6,6 +6,5 @@
     ./kde.nix
     # ./gnome.nix
     # ./noctalia.nix
-    # ./xfce.nix
   ];
 }

modules/desktop/environment/xfce.nix

@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-
-  services.xserver.displayManager.lightdm.enable = true;
-  #services.displayManager.defaultSession = "lomiri";
-  #   services.xserver.desktopManager.budgie.enable = true;
-  #services.xserver.displayManager.lightdm.greeters.lomiri.enable= true;
-
-  #services.desktopManager.lomiri.enable = true;
-  #-services.xserver.desktopManager.mate.enable = true;
-  #-services.xserver.desktopManager.lxqt.enable = true;
-  #   services.xserver.desktopManager.lumina.enable = true;
-  #   services.xserver.desktopManager.cde.enable = true;
-  #   services.xserver.desktopManager.cinnamon.enable = true;
-  #   services.xserver.desktopManager.enlightenment.enable = true;
-  #   services.desktopManager.cosmic.xwayland.enable = true;
-  #   services.desktopManager.cosmic.enable = true;
-
-  services.xserver = {
-    enable = true;
-    desktopManager = {
-      #xterm.enable = false;
-      xfce.enable = true;
-      xfce.enableWaylandSession = true;
-    };
-  };
-
-  #- services.xserver.desktopManager.pantheon.enable = true;
-  #- services.pantheon.apps.enable = true;
-
-}

modules/essentials/default.nix

@@ -7,6 +7,7 @@
     ./packages.nix
     ./services.nix
     ./settings.nix
+    ./ssh.nix
     ./systemd-routines.nix
     ./shell.nix
   ];

modules/essentials/services.nix

@@ -1,13 +1,15 @@
 {
-  config,
-  inputs,
   lib,
-  pkgs,
   xlib,
   ...
 }:
 {
-  services = {
+  services.tailscale.enable = xlib.device.type != "wsl"; # true, if not wsl
-    tailscale.enable = xlib.device.type != "wsl"; # true, if not wsl
+
-  };
+  # All real hosts (not the bare "minimal" test config) get OOM protection
+  # and a bounded journal.
+  services.earlyoom.enable = lib.mkIf (xlib.device.type != "minimal") true;
+  services.journald.extraConfig = lib.mkIf (xlib.device.type != "minimal") ''
+    SystemMaxUse=512M
+  '';
 }

modules/essentials/ssh.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}:
+lib.mkIf config.xlib.ssh.enable {
+  services.openssh = {
+    enable = true;
+    allowSFTP = true;
+    openFirewall = lib.mkDefault false;
+    hostKeys = [
+      {
+        path = "/etc/ssh/id_ed25519";
+        type = "ed25519";
+      }
+    ];
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "yes";
+      UsePAM = true;
+    };
+  };
+}

modules/extra/self/zapret.nix

@@ -1,31 +0,0 @@
-{ inputs, ... }@flakeContext:
-{
-  config,
-  pkgs,
-  ...
-}:
-{
-  systemd.services.zapret = {
-    enable = true;
-    description = "zapret complete";
-    unitConfig = {
-      After = [ "network-online.target" ];
-      Wants = [ "network-online.target" ];
-    };
-    wantedBy = [ "multi-user.target" ];
-    path = [ "/run/current-system/sw" ];
-    serviceConfig = {
-      Type = "simple";
-      Restart = "on-failure";
-      User = "root";
-      WorkingDirectory = "${inputs.zapret.script-dir}";
-      ExecStart = "/run/current-system/sw/bin/bash ./main_script.sh -nointeractive";
-      ExecStop = "/run/current-system/sw/bin/bash ./stop_and_clean_nft.sh";
-    };
-  };
-  environment = {
-    systemPackages = with pkgs; [
-      nftables
-    ];
-  };
-}

modules/minimal/default.nix

@@ -1,7 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-{
-}

modules/options.nix

@@ -3,6 +3,17 @@
   lib,
   ...
 }:
+let
+  # Option factory for the xlib.dirs namespace
+  mkDir =
+    default: description:
+    lib.mkOption {
+      type = lib.types.str;
+      inherit default description;
+    };
+
+  helpers = import ../lib/xlib.nix { inherit lib; };
+in
 {
   options = {
     xlib = {
@@ -31,102 +42,38 @@
           description = "Hostname...";
         };
       };
+      ssh = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = "Enable SSH server with the standard config.";
+        };
+      };
       dirs = {
-        user-home = lib.mkOption {
+        user-home = mkDir "/home/${config.xlib.device.username}" "User home directory.";
-          type = lib.types.str;
+        user-storage = mkDir "${config.xlib.dirs.user-home}/Storage" "User storage directory.";
-          default = "/home/${config.xlib.device.username}";
+        archive-drive = mkDir "/mnt/archive" "Archive drive mount point.";
-          description = "User home directory.";
+        lamet-drive = mkDir "/mnt/lamet" "Lamet drive mount point.";
-        };
+        mobile-drive = mkDir "/mnt/mobile" "Mobile drive mount point.";
-        user-storage = lib.mkOption {
+        therima-drive = mkDir "/mnt/therima" "Therima drive mount point.";
-          type = lib.types.str;
+        vetymae-drive = mkDir "/mnt/vetymae" "Vetymae drive mount point.";
-          default = "${config.xlib.dirs.user-home}/Storage";
+        soptur-drive = mkDir "/mnt/soptur" "Soptur drive mount point.";
-          description = "User storage directory.";
+        wsl-home = mkDir "/mnt/c/Users/${config.xlib.device.username}" "WSL home directory.";
-        };
+        wsl-storage = mkDir "${config.xlib.dirs.wsl-home}/Storage" "WSL storage directory.";
-        archive-drive = lib.mkOption {
+        server-home = mkDir "/home/${config.xlib.device.username}/External" "Server home directory.";
-          type = lib.types.str;
+        server-credentials = mkDir "${config.xlib.dirs.server-home}/Credentials/server" "Server credentials directory.";
-          default = "/mnt/archive";
+        storage = mkDir "${config.xlib.dirs.server-home}/Storage" "General storage directory.";
-          description = "Archive drive mount point.";
+        calibre-library = mkDir "${config.xlib.dirs.server-home}/Books-Library" "Calibre library directory.";
-        };
+        music-library = mkDir "${config.xlib.dirs.user-home}/Music" "Music library directory.";
-        lamet-drive = lib.mkOption {
+        services-folder = mkDir "${config.xlib.dirs.server-home}/Services" "All services folder.";
-          type = lib.types.str;
+        services-mnt-folder = mkDir "/mnt/services" "All services folder.";
-          default = "/mnt/lamet";
+        services-nodes-folder = mkDir "${config.xlib.dirs.services-mnt-folder}/nodes" "All nodes folder.";
-          description = "Lamet drive mount point.";
+        postgresql-folder = mkDir "${config.xlib.dirs.services-mnt-folder}/postgresql" "PostgreSQL service folder.";
-        };
-        mobile-drive = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/mobile";
-          description = "Mobile drive mount point.";
-        };
-        therima-drive = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/therima";
-          description = "Therima drive mount point.";
-        };
-        vetymae-drive = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/vetymae";
-          description = "Vetymae drive mount point.";
-        };
-        soptur-drive = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/soptur";
-          description = "Soptur drive mount point.";
-        };
-        wsl-home = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/c/Users/${config.xlib.device.username}";
-          description = "WSL home directory.";
-        };
-        wsl-storage = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.wsl-home}/Storage";
-          description = "WSL storage directory.";
-        };
-        server-home = lib.mkOption {
-          type = lib.types.str;
-          default = "/home/${config.xlib.device.username}/External";
-          description = "Server home directory.";
-        };
-        server-credentials = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.server-home}/Credentials/server";
-          description = "Server credentials directory.";
-        };
-        storage = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.server-home}/Storage";
-          description = "General storage directory.";
-        };
-        calibre-library = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.server-home}/Books-Library";
-          description = "Calibre library directory.";
-        };
-        music-library = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.user-home}/Music";
-          description = "Music library directory.";
-        };
-        services-folder = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.server-home}/Services";
-          description = "All services folder.";
-        };
-        services-mnt-folder = lib.mkOption {
-          type = lib.types.str;
-          default = "/mnt/services";
-          description = "All services folder.";
-        };
-        services-nodes-folder = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.services-mnt-folder}/nodes";
-          description = "All nodes folder.";
-        };
-        postgresql-folder = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.xlib.dirs.services-mnt-folder}/postgresql";
-          description = "PostgreSQL service folder.";
       };
+      helpers = lib.mkOption {
+        type = lib.types.anything;
+        default = helpers;
+        description = "Shared helper functions (see lib/xlib.nix).";
       };
     };
   };

modules/pkgs/beets.nix

@@ -68,14 +68,9 @@ in
     };
   };
   systemd.mounts = [
-    {
+    (xlib.helpers.mkSystemdBind {
-      enable = true;
-      options = "bind,x-systemd.automount,nofail";
-      requires = [ "local-fs.target" ];
-      type = "none";
-      wantedBy = [ "multi-user.target" ];
       what = "/home/${xlib.device.username}/Music";
       where = "/home/${xlib.device.username}/.config/beets";
-    }
+    })
   ];
 }

modules/primary/default.nix

@@ -1,9 +0,0 @@
-{
-  lib,
-  ...
-}:
-{
-  imports = [
-    ../desktop
-  ];
-}

modules/secondary/default.nix

@@ -1,9 +0,0 @@
-{
-  lib,
-  ...
-}:
-{
-  imports = [
-    ../desktop
-  ];
-}

modules/server/calibre-web.nix

@@ -42,21 +42,30 @@ in
     # };
   };
 
-  systemd.tmpfiles.rules = [
+  systemd.tmpfiles.rules =
-    "d ${libraryDir} 0755 calibre-web calibre-web -"
+    xlib.helpers.mkTmpDirs {
-    "d ${sourceDir} 0755 calibre-web calibre-web -"
+      dir = libraryDir;
-    "Z ${libraryDir} 0755 calibre-web calibre-web -"
+      mode = "0755";
-    "Z ${sourceDir} 0755 calibre-web calibre-web -"
+      user = "calibre-web";
+      group = "calibre-web";
+      types = [
+        "d"
+        "Z"
       ];
-
+    }
-  fileSystems = {
+    ++ xlib.helpers.mkTmpDirs {
-    "${targetDir}" = {
+      dir = sourceDir;
-      device = "${sourceDir}";
+      mode = "0755";
-      fsType = "none";
+      user = "calibre-web";
-      options = [
+      group = "calibre-web";
-        "bind"
+      types = [
-        "nofail"
+        "d"
+        "Z"
       ];
     };
+
+  fileSystems = xlib.helpers.mkBindMount {
+    what = sourceDir;
+    where = targetDir;
   };
 }

modules/server/default.nix

@@ -6,7 +6,7 @@
 {
   imports = [
     ../containers/3x-ui.nix
-    ../software/beets
+    ../pkgs/beets.nix
     ./acme.nix
     ./bentopdf.nix
     ./calibre-web.nix
@@ -16,6 +16,7 @@
     ./glances.nix
     ./homebox.nix
     ./immich.nix
+    # ./minecraft.nix
     ./miniflux.nix
     ./navidrome.nix
     ./nextcloud.nix
@@ -44,7 +45,7 @@
     # ./zerotier.nix
   ];
   systemd.tmpfiles.rules = [
-    "d /mnt 0755 root root -"
+    (xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
-    "d ${xlib.dirs.services-mnt-folder} 0755 root root -"
+    (xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
   ];
 }

modules/server/gitea.nix

@@ -22,8 +22,10 @@
     };
   };
 
-  systemd.tmpfiles.rules = [
+  systemd.tmpfiles.rules = xlib.helpers.mkTmpDirs {
-    "d ${config.services.gitea.stateDir} 0755 gitea gitea -"
+    dir = config.services.gitea.stateDir;
-    "z ${config.services.gitea.stateDir} 0755 gitea gitea -"
+    mode = "0755";
-  ];
+    user = "gitea";
+    group = "gitea";
+  };
 }

modules/server/homebox.nix

@@ -5,8 +5,11 @@
   ...
 }:
 let
-  sourceDir = "${xlib.dirs.services-mnt-folder}/homebox";
+  storage = xlib.helpers.mkServiceStorage {
-  targetDir = "/var/lib/homebox";
+    name = "homebox";
+    user = "homebox";
+    group = "homebox";
+  };
 in
 {
   services.homebox = {
@@ -14,33 +17,17 @@ in
     settings = {
       HBOX_WEB_HOST = "0.0.0.0";
       HBOX_WEB_PORT = "7745";
-      HBOX_STORAGE_CONN_STRING = "file://${targetDir}";
+      HBOX_STORAGE_CONN_STRING = "file://${storage.target}";
       HBOX_STORAGE_PREFIX_PATH = "data";
       HBOX_DATABASE_DRIVER = "sqlite3";
-      HBOX_DATABASE_SQLITE_PATH = "${targetDir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
+      HBOX_DATABASE_SQLITE_PATH = "${storage.target}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
       HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
       HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
       HBOX_MODE = "production";
-      HOME = "${targetDir}";
+      HOME = "${storage.target}";
-      TMPDIR = "${targetDir}/tmp";
+      TMPDIR = "${storage.target}/tmp";
     };
   };
 
-  systemd = {
+  systemd = storage.systemd;
-    tmpfiles.rules = [
-      "d ${sourceDir} 0755 homebox homebox -"
-      "z ${sourceDir} 0755 homebox homebox -"
-    ];
-    mounts = [
-      {
-        enable = true;
-        options = "bind,x-systemd.automount,nofail";
-        requires = [ "local-fs.target" ];
-        type = "none";
-        wantedBy = [ "multi-user.target" ];
-        what = "${sourceDir}";
-        where = "${targetDir}";
-      }
-    ];
-  };
 }

modules/server/immich.nix

@@ -20,7 +20,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "z ${config.services.immich.mediaLocation} 0755 immich immich -"
+    (xlib.helpers.mkTmpfile "z" config.services.immich.mediaLocation "0755" "immich" "immich")
   ];
 
   users.users.immich.extraGroups = [

modules/server/memos.nix

@@ -21,6 +21,6 @@
   };
 
   systemd.tmpfiles.rules = [
-    "z /mnt/services/memos 0750 memos memos -"
+    (xlib.helpers.mkTmpfile "z" "${xlib.dirs.services-mnt-folder}/memos" "0750" "memos" "memos")
   ];
 }

modules/server/minecraft.nix

@@ -0,0 +1,67 @@
+{
+  config,
+  inputs,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  storage = xlib.helpers.mkServiceStorage {
+    name = "minecraft";
+    user = "minecraft";
+    group = "minecraft";
+    mode = "770";
+  };
+in
+{
+  imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
+  nixpkgs.overlays = [ inputs.nix-minecraft.overlay ];
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    openFirewall = true;
+    dataDir = "/var/lib/minecraft";
+    servers = {
+      vanilla = {
+        enable = true;
+        package = pkgs.fabricServers.fabric-26_2.override {
+          jre_headless = pkgs.jdk25_headless;
+        };
+        jvmOpts = "-Xmx2G -Xms1G";
+        enableReload = true;
+        serverProperties = {
+          view-distance = 6;
+          simulation-distance = 4;
+          online-mode = false;
+          difficulty = 3;
+          gamemode = 1;
+          max-players = 5;
+          server-port = 25565;
+          motd = "ZeroQ сервак майна епта!";
+          enable-rcon = true;
+          "rcon.password" = "zeroq";
+        };
+        symlinks.mods = pkgs.linkFarmFromDrvs "mods" (
+          builtins.attrValues {
+            Lithium = pkgs.fetchurl {
+              name = "lithium-fabric-0.25.3+mc26.2.jar";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/f7vZ0VWU/lithium-fabric-0.25.3%2Bmc26.2.jar";
+              hash = "sha256-/d6S4jjoB1+JrX9wHyo9WFSviLqaZ2VxhKRAexBKxWM=";
+            };
+            FerriteCore = pkgs.fetchurl {
+              name = "ferritecore-9.0.0-fabric.jar";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/d5ddUdiB/ferritecore-9.0.0-fabric.jar";
+              hash = "sha256-ITlmxy7ZZ6zHOSvrKKhm+6MB/1a5l2wueAHC233mvyI=";
+            };
+            Krypton = pkgs.fetchurl {
+              name = "krypton-0.3.1.jar";
+              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/5WeL0Nkz/krypton-0.3.1.jar";
+              hash = "sha256-XqiQFWGXPSnlHnUUadUtkhAPNIq0YeEYb2cBLpNCDEg=";
+            };
+          }
+        );
+      };
+    };
+  };
+  systemd = storage.systemd;
+}

modules/server/n8n.nix

@@ -7,8 +7,11 @@
   ...
 }:
 let
-  sourceDir = "${xlib.dirs.services-mnt-folder}/n8n";
+  storage = xlib.helpers.mkServiceStorage {
-  targetDir = "/var/lib/n8n";
+    name = "n8n";
+    user = "nobody";
+    group = "nogroup";
+  };
 in
 {
   services.n8n = {
@@ -21,21 +24,5 @@ in
     openFirewall = true;
   };
 
-  systemd = {
+  systemd = storage.systemd;
-    tmpfiles.rules = [
-      "d ${sourceDir} 0755 nobody nogroup -"
-      "z ${sourceDir} 0755 nobody nogroup -"
-    ];
-    mounts = [
-      {
-        enable = true;
-        options = "bind,x-systemd.automount,nofail";
-        requires = [ "local-fs.target" ];
-        type = "none";
-        wantedBy = [ "multi-user.target" ];
-        what = "${sourceDir}";
-        where = "${targetDir}";
-      }
-    ];
-  };
 }

modules/server/navidrome.nix

@@ -7,8 +7,8 @@
   ...
 }:
 let
-  pointDir = "/var/lib/services/navidrome-point";
   libraryDir = "${xlib.dirs.server-home}/Music";
+  pointDir = "/var/lib/services/navidrome-point";
 in
 {
   services = {
@@ -24,14 +24,9 @@ in
     };
   };
   systemd.mounts = [
-    {
+    (xlib.helpers.mkSystemdBind {
-      enable = true;
+      what = libraryDir;
-      options = "bind,x-systemd.automount,nofail";
+      where = pointDir;
-      requires = [ "local-fs.target" ];
+    })
-      type = "none";
-      wantedBy = [ "multi-user.target" ];
-      what = "${libraryDir}";
-      where = "${pointDir}";
-    }
   ];
 }

modules/server/nextcloud.nix

@@ -201,7 +201,7 @@
   #     };
 
   systemd.tmpfiles.rules = [
-    "z ${config.services.nextcloud.home} 0750 nextcloud nextcloud -"
+    (xlib.helpers.mkTmpfile "z" config.services.nextcloud.home "0750" "nextcloud" "nextcloud")
   ];
 
   environment.systemPackages = [

modules/server/nfs.nix

@@ -6,7 +6,7 @@
 }:
 {
   systemd.tmpfiles.rules = [
-    "z /export 0755 nobody nogroup -"
+    (xlib.helpers.mkTmpfile "z" "/export" "0755" "nobody" "nogroup")
   ];
   services.nfs = {
     server = {

modules/server/nginx.nix

@@ -7,6 +7,87 @@
 }:
 let
   server = "192.168.1.20";
+
+  # Standard TLS proxy vhost: "/" -> http://server:port
+  # Returns { name = domain; value = vhost; } for builtins.listToAttrs
+  mkProxy =
+    {
+      domain,
+      port,
+      addSSL ? false,
+      body ? false,
+    }:
+    {
+      name = domain;
+      value = {
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://${server}:${toString port}";
+          proxyWebsockets = true;
+        };
+      }
+      // lib.optionalAttrs (!addSSL) { forceSSL = true; }
+      // lib.optionalAttrs addSSL { addSSL = true; }
+      // lib.optionalAttrs body {
+        extraConfig = ''
+          client_max_body_size 5G;
+        '';
+      };
+    };
+
+  # Simple proxy sites
+  sites = [
+    {
+      domain = "immich.zeroq.su";
+      port = 2283;
+      addSSL = true;
+      body = true;
+    }
+    {
+      domain = "kuma.zeroq.su";
+      port = 4001;
+    }
+    {
+      domain = "health.zeroq.su";
+      port = 19999;
+    }
+    {
+      domain = "git.zeroq.su";
+      port = 3000;
+    }
+    {
+      domain = "homebox.zeroq.su";
+      port = 7745;
+    }
+    {
+      domain = "flux.zeroq.su";
+      port = 6061;
+    }
+    {
+      domain = "navidrome.zeroq.su";
+      port = 4533;
+      addSSL = true;
+    }
+    {
+      domain = "calibre.zeroq.su";
+      port = 8083;
+      body = true;
+    }
+    # {
+    #   domain = "mc.zeroq.su";
+    #   port = 25565;
+    # }
+    {
+      domain = "nix-cache.zeroq.su";
+      port = 5000;
+      body = true;
+    }
+    {
+      domain = "pdf.zeroq.su";
+      port = 8446;
+      body = true;
+    }
+  ];
 in
 {
   services = {
@@ -16,7 +97,7 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      virtualHosts = {
+      virtualHosts = (builtins.listToAttrs (map mkProxy sites)) // {
         "nextcloud.private" = {
           forceSSL = false;
           enableACME = false;
@@ -169,49 +250,6 @@ in
         #     client_max_body_size 5G;
         #   '';
         # };
-        "immich.zeroq.su" = {
-          addSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:2283";
-            proxyWebsockets = true;
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
-        "kuma.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:4001";
-            proxyWebsockets = true;
-          };
-        };
-        "health.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:19999";
-            proxyWebsockets = true;
-          };
-        };
-        "git.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:3000";
-            proxyWebsockets = true;
-          };
-        };
-        "homebox.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:7745";
-            proxyWebsockets = true;
-          };
-        };
         # "agent.zeroq.su" = {
         #   forceSSL = true;
         #   enableACME = true;
@@ -256,22 +294,6 @@ in
             # };
           };
         };
-        "flux.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:6061";
-            proxyWebsockets = true;
-          };
-        };
-        "navidrome.zeroq.su" = {
-          addSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:4533";
-            proxyWebsockets = true;
-          };
-        };
         "vetymae.opencodes.zeroq.su" = {
           forceSSL = true;
           enableACME = true;
@@ -323,39 +345,6 @@ in
             client_max_body_size 5G;
           '';
         };
-        "calibre.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:8083";
-            proxyWebsockets = true;
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
-        "nix-cache.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:5000";
-            proxyWebsockets = true;
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
-        "pdf.zeroq.su" = {
-          forceSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${server}:8446";
-            proxyWebsockets = true;
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
         # "calibre.home.arpa" = {
         #   forceSSL = true;
         #   enableACME = true;

modules/server/postgresql.nix

@@ -7,8 +7,12 @@
   ...
 }:
 let
-  sourceDir = "${xlib.dirs.services-mnt-folder}/postgresql";
+  storage = xlib.helpers.mkServiceStorage {
-  targetDir = "/var/lib/postgresql";
+    name = "postgresql";
+    user = "postgres";
+    group = "postgres";
+    mode = "0760";
+  };
 in
 {
   services = {
@@ -19,21 +23,5 @@ in
     # postgresqlBackup.enable = true;
   };
 
-  systemd = {
+  systemd = storage.systemd;
-    tmpfiles.rules = [
-      "d ${sourceDir} 0760 postgres postgres -"
-      "z ${sourceDir} 0760 postgres postgres -"
-    ];
-    mounts = [
-      {
-        enable = true;
-        options = "bind,x-systemd.automount,nofail";
-        requires = [ "local-fs.target" ];
-        type = "none";
-        wantedBy = [ "multi-user.target" ];
-        what = "${sourceDir}";
-        where = "${targetDir}";
-      }
-    ];
-  };
 }

modules/server/samba.nix

@@ -6,8 +6,11 @@
   ...
 }:
 let
-  sourceDir = "${xlib.dirs.services-mnt-folder}/samba";
+  storage = xlib.helpers.mkServiceStorage {
-  targetDir = "/var/lib/samba";
+    name = "samba";
+    user = "root";
+    group = "root";
+  };
 in
 {
   services = {
@@ -69,21 +72,5 @@ in
     };
   };
 
-  systemd = {
+  systemd = storage.systemd;
-    tmpfiles.rules = [
-      "d ${sourceDir} 0755 root root -"
-      "z ${sourceDir} 0755 root root -"
-    ];
-    mounts = [
-      {
-        enable = true;
-        options = "bind,x-systemd.automount,nofail";
-        requires = [ "local-fs.target" ];
-        type = "none";
-        wantedBy = [ "multi-user.target" ];
-        what = "${sourceDir}";
-        where = "${targetDir}";
-      }
-    ];
-  };
 }

modules/server/step-ca.nix

@@ -69,13 +69,9 @@ in
     };
   };
 
-  fileSystems."${targetDir}" = {
+  fileSystems = xlib.helpers.mkBindMount {
-    device = "${sourceDir}";
+    what = sourceDir;
-    fsType = "none";
+    where = targetDir;
-    options = [
-      "bind"
-      "nofail"
-    ];
   };
 
   environment = {
@@ -84,11 +80,14 @@ in
     ];
   };
 
-  systemd.tmpfiles.rules = [
+  systemd.tmpfiles.rules =
-    "d ${sourceDir} 0755 nobody nogroup -"
+    xlib.helpers.mkTmpDirs {
-    "z ${sourceDir} 0755 nobody nogroup -"
+      dir = sourceDir;
-    "Z ${sourceDir}/ 0700 nobody nogroup -"
+      mode = "0755";
-  ];
+      user = "nobody";
+      group = "nogroup";
+    }
+    ++ [ (xlib.helpers.mkTmpfile "Z" "${sourceDir}/" "0700" "nobody" "nogroup") ];
 
   sops.secrets = {
     intermediate-password = {

modules/server/trilium.nix

@@ -18,6 +18,6 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "z ${sourceDir} 0750 trilium trilium -"
+    (xlib.helpers.mkTmpfile "z" sourceDir "0750" "trilium" "trilium")
   ];
 }

modules/server/uptime-kuma.nix

@@ -20,15 +20,11 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "z ${xlib.dirs.services-mnt-folder}/uptime-kuma 0755 nobody nogroup -"
+    (xlib.helpers.mkTmpfile "z" sourceDir "0755" "nobody" "nogroup")
   ];
 
-  fileSystems."${targetDir}" = {
+  fileSystems = xlib.helpers.mkBindMount {
-    device = "${xlib.dirs.services-mnt-folder}/uptime-kuma";
+    what = sourceDir;
-    fsType = "none";
+    where = targetDir;
-    options = [
-      "bind"
-      "nofail"
-    ];
   };
 }

modules/services/tts.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  xlib,
-  ...
-}:
-{
-  services.tts.servers = {
-    russian = {
-      enable = true;
-      port = 5301;
-    };
-    english = {
-      #enable = false;
-      port = 5300;
-    };
-  };
-}

modules/services/zapret-old.nix

@@ -1,47 +0,0 @@
-{ pkgs, ... }:
-#? 🙏 https://github.com/ViZiD/dotfiles/blob/master/modules/shared/zapret.nix
-#? https://github.com/Flowseal/zapret-discord-youtube/blob/main/general.bat
-let
-  list-general = pkgs.fetchurl {
-    # https://github.com/Flowseal/zapret-discord-youtube/blob/main/lists/list-general.txt
-    url = "https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/779853740f9c957551685bdebf59ad3a788b5004/lists/list-general.txt";
-    sha256 = "sha256-/9dYk5fiVLfN+bY0STlqutnRQQoInS9NBGg9fWHZedk=";
-  };
-in
-{
-  services.zapret = {
-    enable = true;
-    udpSupport = true;
-    udpPorts = [
-      "443"
-      "50000:50099"
-    ];
-    params = [
-      "--filter-tcp=80"
-      "--hostlist=${list-general}"
-      "--dpi-desync=fake,split2"
-      "--dpi-desync-autottl=2"
-      "--dpi-desync-fooling=md5sig"
-
-      "--new"
-      "--filter-tcp=443"
-      "--hostlist=${list-general}"
-      "--dpi-desync=fake,multidisorder"
-      "--dpi-desync-split-pos=midsld"
-      "--dpi-desync-repeats=8"
-      "--dpi-desync-fooling=md5sig,badseq"
-
-      "--new"
-      "--filter-udp=443"
-      "--hostlist=${list-general}"
-      "--dpi-desync=fake"
-      "--dpi-desync-repeats=6"
-
-      "--new"
-      "--filter-udp=50000-50099"
-      "--filter-l7=discord,stun"
-      "--dpi-desync=fake"
-      "--dpi-desync-repeats=6"
-    ];
-  };
-}

modules/services/zapret.nix

@@ -1,54 +0,0 @@
-{
-  config,
-  pkgs,
-  xlib,
-  ...
-}:
-{
-  # services.zapret = {
-  #   enable = true;
-  #   params = [
-  #     "--dpi-desync=fake,disorder2"
-  #     "--dpi-desync-ttl=1"
-  #     "--dpi-desync-autottl=2"
-  #   ];
-  # };
-
-  systemd.services.zapret = {
-    enable = true;
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    description = "Custom Script Service";
-    path = with pkgs; [
-      sudo
-      git
-      nftables
-      iproute2
-      zapret
-      coreutils
-    ];
-    unitConfig = {
-      After = [ "network-online.target" ];
-      Wants = [ "network-online.target" ];
-    };
-    serviceConfig = {
-      Type = "simple";
-      WorkingDirectory = "${xlib.dirs.user-services}/zapret";
-      User = "root";
-      ExecStart = ''
-        /run/current-system/sw/bin/bash ${xlib.dirs.user-services}/zapret/main_script.sh -nointeractive
-      '';
-      ExecStop = ''
-        /run/current-system/sw/bin/bash ${xlib.dirs.user-services}/zapret/stop_and_clean_nft.sh
-      '';
-      # ExecStopPost = ''
-      #   /run/current-system/sw/bin/echo  "Сервис завершён"
-      # '';
-      PIDFile = ''
-        /run/zapret_discord_youtube.pid
-      '';
-      # Restart = "on-failure";
-      # RestartSec = "5s";
-    };
-  };
-}

modules/users.nix

@@ -2,23 +2,54 @@
   config,
   xlib,
   lib,
-  pkgs,
   ...
 }:
+let
+  user = "${xlib.device.username}";
+  userGroup = config.users.users."${user}".group;
+
+  # sops secret factory: name == key by default, owner/group default to root
+  mkSecret =
+    {
+      path,
+      mode,
+      key ? null,
+      owner ? null,
+      group ? null,
+    }:
+    {
+      format = "yaml";
+      inherit path mode;
+    }
+    // lib.optionalAttrs (key != null) { inherit key; }
+    // lib.optionalAttrs (owner != null) { inherit owner; }
+    // lib.optionalAttrs (group != null) { inherit group; };
+
+  # default owner = device user
+  mkUserSecret =
+    args:
+    mkSecret (
+      args
+      // {
+        owner = user;
+        group = userGroup;
+      }
+    );
+in
 {
   xlib.device.username = "oqyude";
 
   users = {
     mutableUsers = false;
     users = {
-      "${xlib.device.username}" = {
+      "${user}" = {
-        name = "${xlib.device.username}";
+        name = "${user}";
         isNormalUser = true;
         group = "users";
         description = "Jor Oqyude";
         hashedPasswordFile = config.sops.secrets.hashed_password.path; # hashed_password
         homeMode = "700";
-        home = "/home/${xlib.device.username}";
+        home = "/home/${user}";
         extraGroups = [
           "audio"
           "disk"
@@ -46,51 +77,32 @@
     secrets = {
       hashed_password = {
         neededForUsers = true;
+        format = "yaml";
         key = "hashed_password";
-        format = "yaml";
       };
-      age_key_private = {
+      age_key_private = mkUserSecret {
-        format = "yaml";
+        path = "${xlib.dirs.user-home}/.config/sops/age/keys.txt";
-        key = "age_key_private";
-        path = "/home/${xlib.device.username}/.config/sops/age/keys.txt";
-        owner = config.users.users."${xlib.device.username}".name;
-        group = config.users.users."${xlib.device.username}".group;
         mode = "0600";
       };
-      ssh_key_private = {
+      ssh_key_private = mkUserSecret {
-        format = "yaml";
+        path = "${xlib.dirs.user-home}/.ssh/id_ed25519";
-        key = "ssh_key_private";
-        path = "/home/${xlib.device.username}/.ssh/id_ed25519";
-        owner = config.users.users."${xlib.device.username}".name;
-        group = config.users.users."${xlib.device.username}".group;
         mode = "0600";
       };
-      ssh_key_public = {
+      ssh_key_public = mkUserSecret {
-        format = "yaml";
+        path = "${xlib.dirs.user-home}/.ssh/id_ed25519.pub";
-        key = "ssh_key_public";
-        path = "/home/${xlib.device.username}/.ssh/id_ed25519.pub";
-        owner = config.users.users."${xlib.device.username}".name;
-        group = config.users.users."${xlib.device.username}".group;
         mode = "0655";
       };
-      ssh_key_private_root = {
+      ssh_key_private_root = mkSecret {
-        format = "yaml";
         key = "ssh_key_private";
         path = "/root/.ssh/id_ed25519";
-        owner = "root";
-        group = "root";
         mode = "0600";
       };
-      ssh_key_public_root = {
+      ssh_key_public_root = mkSecret {
-        format = "yaml";
         key = "ssh_key_public";
         path = "/root/.ssh/id_ed25519.pub";
-        owner = "root";
-        group = "root";
         mode = "0655";
       };
-      ssh_key_public_host = {
+      ssh_key_public_host = mkSecret {
-        format = "yaml";
         key = "ssh_key_public";
         path = "/etc/ssh/id_ed25519.pub";
         mode = "0655";

modules/vds/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  xlib,
   ...
 }:
 {
@@ -13,7 +14,7 @@
     # ./xray.nix
   ];
   systemd.tmpfiles.rules = [
-    "d /mnt 0755 root root -"
+    (xlib.helpers.mkTmpfile "d" "/mnt" "0755" "root" "root")
-    "d ${xlib.dirs.services-mnt-folder} 0755 root root -"
+    (xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
   ];
 }

modules/wsl/default.nix

@@ -6,11 +6,9 @@
 }:
 {
   imports = [
-    ../software/beets
+    ../pkgs/beets.nix
     ./containers
     ./nix-serve.nix
     # ./tools
-    #../server/open-webui.nix
-    #../services/tts.nix
   ];
 }