nextcloud update

samba fixup
calibre fixup
2026-08-08 23:53:11 +03:00 · 2026-07-16 23:34:06 +03:00 · 2026-07-16 17:33:19 +03:00 · 2026-07-16 01:14:47 +03:00 · 2026-07-16 00:14:03 +03:00 · 2026-07-16 00:12:52 +03:00
99 changed files with 3132 additions and 1173 deletions
@@ -0,0 +1 @@
+* text=auto eol=lf
@@ -0,0 +1 @@
+.vscode
@@ -1 +1 @@
-I'm a super newbie who just posted my stuff here. Now maybe simple newbie
+I'm a super newbie who just posted my stuff here. Now maybe about intermediate
@@ -18,7 +18,7 @@
              };
            };
            swap = {
-              size = "2G";
+              size = "6G";
              content = {
                type = "swap";
              };
@@ -20,7 +20,7 @@
              };
            };
            swap = {
-              size = "1G";
+              size = "4G";
              content = {
                type = "swap";
              };
@@ -14,11 +14,11 @@

  boot = {
    initrd = {
-      supportedFilesystems = [
-        "nfs"
-        "nfsv4"
-        "overlay"
-      ];
+      # supportedFilesystems = [
+      #   "nfs"
+      #   "nfsv4"
+      #   "overlay"
+      # ];
      availableKernelModules = [
        "nvme"
        "xhci_pci"
@@ -51,9 +51,13 @@
    };
  };

-  # swapDevices = [
-  #   { device = "/dev/disk/by-partlabel/disk-main-swap"; }
-  # ];
+  zramSwap = {
+    enable = true;
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-partlabel/disk-main-swap"; }
+  ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
@@ -13,9 +13,13 @@
    };
  };

-  # swapDevices = [
-  #   { device = "/dev/disk/by-partlabel/disk-main-swap"; }
-  # ];
+  swapDevices = [
+    { device = "/dev/disk/by-partlabel/disk-main-swap"; }
+  ];
+
+  zramSwap = {
+    enable = true;
+  };

  networking.useDHCP = lib.mkDefault true;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
@@ -69,11 +69,11 @@ let
      };

      services = {
-        xserver = {
-          videoDrivers = [
-            "nomodeset"
-          ];
-        };
+        # xserver = {
+        #   videoDrivers = [
+        #     "nomodeset"
+        #   ];
+        # };
        syncthing = {
          enable = true;
          systemService = true;
@@ -20,7 +20,7 @@ let
      ];

      boot = {
-        kernelPackages = pkgs.linuxPackages_xanmod_stable;
+        # kernelPackages = pkgs.linuxPackages_xanmod_stable;
        hardwareScan = true;
        loader = {
          systemd-boot.enable = lib.mkDefault true;
@@ -41,10 +41,6 @@ let
        intel-gpu-tools.enable = true;
      };

-      # swapDevices = [
-      #   { device = "/dev/disk/by-partlabel/disk-main-swap"; }
-      # ];
-
      fileSystems = {
        # External drive
        "${xlib.dirs.server-home}" = {
@@ -52,7 +48,7 @@ let
          fsType = "ext4";
        };
        # Archive drive
-        "/mnt/archive" = {
+        "${xlib.dirs.archive-drive}" = {
          device = "/dev/disk/by-label/archive";
          fsType = "exfat";
          options = [
@@ -62,7 +58,7 @@ let
          ];
        };
        # Mobile SD-Card
-        "/mnt/mobile" = {
+        "${xlib.dirs.mobile-drive}" = {
          device = "/dev/disk/by-uuid/7EB1-DC99";
          fsType = "exfat";
          options = [
@@ -71,15 +67,13 @@ let
            "gid=1000"
          ];
        };
+        # Services in /mnt folder
        "${xlib.dirs.services-mnt-folder}" = {
          device = "${xlib.dirs.services-folder}";
+          fsType = "none";
          options = [
            "bind"
            "nofail"
-            # "uid=1000"
-            # "gid=1000"
-            # "fmask=0000"
-            # "dmask=0000"
          ];
        };
      };
@@ -91,8 +85,8 @@ let
      services = {
        power-profiles-daemon.enable = lib.mkForce false;
        earlyoom.enable = true;
-        auto-cpufreq.enable = false;
-        throttled.enable = true;
+        auto-cpufreq.enable = true;
+        throttled.enable = false;
        journald = {
          extraConfig = ''
            SystemMaxUse=512M
@@ -119,6 +113,10 @@ let
        hostName = "${xlib.device.hostname}";
        networkmanager.enable = true;
        firewall.enable = false;
+        nameservers = [
+          "127.0.0.1"
+          "192.168.1.1"
+        ];
      };

      system = {
@@ -46,53 +46,6 @@ let
            SystemMaxUse=512M
          '';
        };
-        samba = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            global = {
-              "invalid users" = [ ];
-              "passwd program" = "/run/wrappers/bin/passwd %u";
-              security = "user";
-            };
-            nixos = {
-              "path" = "/etc/nixos";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              "create mask" = 755;
-              "directory mask" = 755;
-              "force user" = "${xlib.device.username}";
-              "force group" = "users";
-            };
-            root = {
-              "path" = "/";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              #"create mask" = 0644;
-              #"directory mask" = 0644;
-              "force user" = "root";
-              "force group" = "root";
-            };
-            "${xlib.device.username}" = {
-              "path" = "/home/${xlib.device.username}";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              "create mask" = 700;
-              "directory mask" = 700;
-              "force user" = "${xlib.device.username}";
-              "force group" = "users";
-            };
-          };
-        };
        openssh = {
          enable = true;
          allowSFTP = true;
@@ -26,7 +26,7 @@ let
      ];

      boot = {
-        kernelPackages = pkgs.linuxPackages_xanmod_stable;
+        # kernelPackages = pkgs.linuxPackages_xanmod_stable;
        hardwareScan = true;
        loader = {
          grub = {
@@ -37,6 +37,12 @@ let
          };
          systemd-boot.enable = lib.mkDefault false;
        };
+        kernel.sysctl = {
+          "net.ipv4.tcp_syncookies" = 1;
+          "net.ipv4.tcp_max_syn_backlog" = 4096;
+          "net.ipv4.tcp_synack_retries" = 3;
+          "net.ipv4.tcp_syn_retries" = 3;
+        };
      };

      services = {
@@ -46,53 +52,6 @@ let
            SystemMaxUse=512M
          '';
        };
-        samba = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            global = {
-              "invalid users" = [ ];
-              "passwd program" = "/run/wrappers/bin/passwd %u";
-              security = "user";
-            };
-            nixos = {
-              "path" = "/etc/nixos";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              "create mask" = 755;
-              "directory mask" = 755;
-              "force user" = "${xlib.device.username}";
-              "force group" = "users";
-            };
-            root = {
-              "path" = "/";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              #"create mask" = 0644;
-              #"directory mask" = 0644;
-              "force user" = "root";
-              "force group" = "root";
-            };
-            "${xlib.device.username}" = {
-              "path" = "/home/${xlib.device.username}";
-              "browseable" = "yes";
-              "read only" = "no";
-              "valid users" = "${xlib.device.username}";
-              "guest ok" = "no";
-              "writable" = "yes";
-              "create mask" = 700;
-              "directory mask" = 700;
-              "force user" = "${xlib.device.username}";
-              "force group" = "users";
-            };
-          };
-        };
        openssh = {
          enable = true;
          allowSFTP = true;
@@ -114,28 +73,49 @@ let
          openFirewall = true;
        };
      };
-
      networking = {
        nameservers = [
          "1.1.1.1"
          "8.8.8.8"
-          "2001:4860:4860::8844"
-          "2001:4860:4860::8888"
-          "2606:4700:4700::1111"
-          "2606:4700:4700::1001"
+          # "2001:4860:4860::8844"
+          # "2001:4860:4860::8888"
+          # "2606:4700:4700::1111"
+          # "2606:4700:4700::1001"
        ];
        hostName = "${xlib.device.hostname}";
        networkmanager.enable = true;
        tempAddresses = "disabled";
        dhcpcd = {
          enable = true;
-          IPv6rs = true;
+          IPv6rs = false;
        };
        firewall = {
          enable = true;
          allowPing = true;
        };
-        enableIPv6 = true;
+        nftables = {
+          enable = true;
+          ruleset = ''
+            table inet filter {
+              chain input {
+                type filter hook input priority 0;
+
+                # loopback
+                iif lo accept
+
+                # уже установленные
+                ct state established,related accept
+
+                # РЕЖЕМ SYN СРАЗУ
+                tcp flags syn tcp dport {80,443} limit rate 20/second burst 40 packets accept
+                tcp flags syn tcp dport {80,443} drop
+
+                # остальное по необходимости
+              }
+            }
+          '';
+        };
+        enableIPv6 = false;
        interfaces.ens3 = {
          useDHCP = true;
          # ipv4.addresses = [
@@ -1,26 +1,5 @@
 {
  "nodes": {
-    "compose2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "onchg": "onchg"
-      },
-      "locked": {
-        "lastModified": 1768176895,
-        "narHash": "sha256-GvcYMsrvQ1yjehcKmnlniBQM8HP9U/v7qSvfnxj3VtA=",
-        "owner": "aksiksi",
-        "repo": "compose2nix",
-        "rev": "e36aecd3649f43d745a5f837bf91c27c4499e203",
-        "type": "github"
-      },
-      "original": {
-        "owner": "aksiksi",
-        "repo": "compose2nix",
-        "type": "github"
-      }
-    },
    "deploy-rs": {
      "inputs": {
        "flake-compat": [
@@ -34,11 +13,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770019181,
-        "narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=",
+        "lastModified": 1781627888,
+        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
+        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
        "type": "github"
      },
      "original": {
@@ -54,11 +33,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769524058,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
        "type": "github"
      },
      "original": {
@@ -82,21 +61,6 @@
        "type": "github"
      }
    },
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1652776076,
-        "narHash": "sha256-gzTw/v1vj4dOVbpBSJX4J0DwUR6LIyXo7/SuuTJp1kM=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "04c1b180862888302ddfb2e3ad9eaa63afc60cf8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
    "grub2-themes": {
      "inputs": {
        "nixpkgs": [
@@ -124,11 +88,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1771037579,
-        "narHash": "sha256-NX5XuhGcsmk0oEII2PEtMRgvh2KaAv3/WWQsOpxAgR4=",
+        "lastModified": 1784129366,
+        "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "05e6dc0f6ed936f918cb6f0f21f1dad1e4c53150",
+        "rev": "165228b0efefc3e635e5174020c40ea64271dc25",
        "type": "github"
      },
      "original": {
@@ -137,56 +101,16 @@
        "type": "github"
      }
    },
-    "musnix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1767232402,
-        "narHash": "sha256-li+h6crnhc5Zqs+M6pn7D7M0W9M63ECNennDjRgzioE=",
-        "owner": "musnix",
-        "repo": "musnix",
-        "rev": "d65f98e0b1f792365f1705653d7b2d266ceeff6e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "musnix",
-        "repo": "musnix",
-        "type": "github"
-      }
-    },
-    "nix-pre-commit": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "compose2nix",
-          "onchg",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1653259102,
-        "narHash": "sha256-XfCEu4zur/N2Dk4v8wFiQAgJ7bgNqPqwWp1vBXkeczM=",
-        "owner": "jmgilman",
-        "repo": "nix-pre-commit",
-        "rev": "6a99b2711c7eac9960939d8eb91e84322b22d50c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "jmgilman",
-        "repo": "nix-pre-commit",
-        "type": "github"
-      }
-    },
    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
      "locked": {
-        "lastModified": 1770882871,
-        "narHash": "sha256-nw5g+xl3veea+maxJ2/81tMEA/rPq9aF1H5XF35X+OE=",
+        "lastModified": 1784100666,
+        "narHash": "sha256-HF/mrw5NYQfKFZgkfV2h1UL5/E3ccfsE2XJ1AbbLLJ0=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "af04cb78aa85b2a4d1c15fc7270347e0d0eda97b",
+        "rev": "fccfa9031a85b78a437f2f153c1f6449f3bc3185",
        "type": "github"
      },
      "original": {
@@ -206,11 +130,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770657009,
-        "narHash": "sha256-v/LA5ZSJ+JQYzMSKB4sySM0wKfsAqddNzzxLLnbsV/E=",
+        "lastModified": 1784058842,
+        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "5b50ea1aaa14945d4794c80fcc99c4aa1db84d2d",
+        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
        "type": "github"
      },
      "original": {
@@ -222,27 +146,56 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1770843696,
-        "narHash": "sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs-beets": {
+      "locked": {
+        "lastModified": 1774610258,
+        "narHash": "sha256-HaThtroVD9wRdx7KQk0B75JmFcXlMUoEdDFNOMOlsOs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2343bbb58f99267223bc2aac4fc9ea301a155a16",
+        "rev": "832efc09b4caf6b4569fbf9dc01bec3082a00611",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
+        "rev": "832efc09b4caf6b4569fbf9dc01bec3082a00611",
+        "type": "github"
+      }
+    },
+    "nixpkgs-calibre": {
+      "locked": {
+        "lastModified": 1776255774,
+        "narHash": "sha256-psVTpH6PK3q1htMJpmdz1hLF5pQgEshu7gQWgKO6t6Y=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a",
        "type": "github"
      }
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1771056776,
-        "narHash": "sha256-0l776LxthDY08ujQ1h83k9z6K5vBg1bGc415AWeFOOI=",
+        "lastModified": 1784147573,
+        "narHash": "sha256-HPB/v0N2fCm4zhb5NxTpdd6vB64Bi7yx80cJ3Ah6bK0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d22fe1660f1f1ccbd52c9d2c09e92fe3861dd691",
+        "rev": "25d63b75f3246a99b53a02c18e0fa74a57817669",
        "type": "github"
      },
      "original": {
@@ -252,13 +205,29 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
+    "nixpkgs-previous": {
      "locked": {
-        "lastModified": 1770770419,
-        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1782847189,
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
        "type": "github"
      },
      "original": {
@@ -268,65 +237,35 @@
        "type": "github"
      }
    },
-    "noctalia": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1771045170,
-        "narHash": "sha256-esBQIlClWRgYYvtYW27N79fCbOUkuFj3gxwJrb8WFX4=",
-        "owner": "noctalia-dev",
-        "repo": "noctalia-shell",
-        "rev": "92612c09a9dce53d5dd60e53f066160f1cdf13b4",
+        "lastModified": 1784115452,
+        "narHash": "sha256-BoYPdqk6jlKXy+DyUzyGV/CtRGfAhk2MmIgBhsemTGI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "35d3407a3816f3b341d8cf1d60abaf2b7b8166ac",
        "type": "github"
      },
      "original": {
-        "owner": "noctalia-dev",
-        "repo": "noctalia-shell",
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nypkgs": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
+    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1761401328,
-        "narHash": "sha256-1Mylp3ZHkft5Sg5VzMpRRvSNsuuO/Oj+cBqjkFoOnRg=",
-        "owner": "yunfachi",
-        "repo": "nypkgs",
-        "rev": "193c13630997d000e72e9ae6f6bfe9b71f5c4b3f",
+        "lastModified": 1784007870,
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
        "type": "github"
      },
      "original": {
-        "owner": "yunfachi",
-        "repo": "nypkgs",
-        "type": "github"
-      }
-    },
-    "onchg": {
-      "inputs": {
-        "nix-pre-commit": "nix-pre-commit",
-        "nixpkgs": [
-          "compose2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1720368454,
-        "narHash": "sha256-NUSw3G2gsQX8/G64/pDBb1oitM+x13m7nFRvpiI4a+s=",
-        "owner": "aksiksi",
-        "repo": "onchg-rs",
-        "rev": "c42b693d10920874b3644ef1502e33318409d69c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "aksiksi",
-        "repo": "onchg-rs",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
@@ -340,11 +279,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770766818,
-        "narHash": "sha256-12RCFLyAedyMOdenUi7cN3ioJPEGjA/ZG1BLjugfUVs=",
+        "lastModified": 1783574839,
+        "narHash": "sha256-ICof1tV4/9XheBLBGf7dhMhfMq4dOs1zwTHrr7zGFlA=",
        "owner": "nix-community",
        "repo": "plasma-manager",
-        "rev": "44b928068359b7d2310a34de39555c63c93a2c90",
+        "rev": "c551f0687658e4bb699cfff6015436ad7ee57a0d",
        "type": "github"
      },
      "original": {
@@ -353,23 +292,44 @@
        "type": "github"
      }
    },
+    "proxy-suite": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
-        "compose2nix": "compose2nix",
        "deploy-rs": "deploy-rs",
        "disko": "disko",
        "flake-compat": "flake-compat",
        "grub2-themes": "grub2-themes",
        "home-manager": "home-manager",
-        "musnix": "musnix",
        "nixos-hardware": "nixos-hardware",
        "nixos-wsl": "nixos-wsl",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-beets": "nixpkgs-beets",
+        "nixpkgs-calibre": "nixpkgs-calibre",
        "nixpkgs-master": "nixpkgs-master",
+        "nixpkgs-previous": "nixpkgs-previous",
        "nixpkgs-stable": "nixpkgs-stable",
-        "noctalia": "noctalia",
-        "nypkgs": "nypkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable",
        "plasma-manager": "plasma-manager",
+        "proxy-suite": "proxy-suite",
        "sops-nix": "sops-nix",
        "utils": "utils",
        "zapret": "zapret",
@@ -383,11 +343,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770683991,
-        "narHash": "sha256-xVfPvXDf9QN3Eh9dV+Lw6IkWG42KSuQ1u2260HKvpnc=",
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "8b89f44c2cc4581e402111d928869fe7ba9f7033",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
        "type": "github"
      },
      "original": {
@@ -6,11 +6,14 @@
    zapret.url = "github:oqyude/zapret-easyflake"; # stupid flake of zapret

    # nixpkgs
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    # nixpkgs-last-unstable.url = "github:NixOS/nixpkgs/6b4955211758ba47fac850c040a27f23b9b4008f";
-    # nixpkgs-calibre.url = "github:NixOS/nixpkgs/e6f23dc08d3624daab7094b701aa3954923c6bbb";
+    nixpkgs-calibre.url = "github:NixOS/nixpkgs/566acc07c54dc807f91625bb286cb9b321b5f42a";
+    nixpkgs-previous.url = "github:NixOS/nixpkgs/3497aa5c9457a9d88d71fa93a4a8368816fbeeba";
    nixpkgs-master.url = "github:NixOS/nixpkgs/master";
    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs-beets.url = "github:NixOS/nixpkgs/832efc09b4caf6b4569fbf9dc01bec3082a00611"; # 2343bbb58f99267223bc2aac4fc9ea301a155a16
    #nixpkgs-fingerprint.url = "github:NixOS/nixpkgs/nixos-24.11";

    # nix-community
@@ -36,14 +39,10 @@
    # nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
    # flake-utils.url = "github:numtide/flake-utils";
    # flake-parts.url = "github:hercules-ci/flake-parts";
-    # nur = {
-    #   url = "github:nix-community/NUR";
+    # noctalia = {
+    #   url = "github:noctalia-dev/noctalia-shell";
    #   inputs.nixpkgs.follows = "nixpkgs";
    # };
-    noctalia = {
-      url = "github:noctalia-dev/noctalia-shell";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
    home-manager = {
      url = "github:nix-community/home-manager"; # flake:home-manager
      inputs.nixpkgs.follows = "nixpkgs";
@@ -60,14 +59,22 @@
        home-manager.follows = "home-manager";
      };
    };
+    proxy-suite = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    grub2-themes = {
+      url = "github:vinceliuice/grub2-themes";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    # nix-index-database = {
    #   url = "github:nix-community/nix-index-database";
    #   inputs.nixpkgs.follows = "nixpkgs";
    # };
-    compose2nix = {
-      url = "github:aksiksi/compose2nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };

    # extras
    # nix-gaming.url = "github:fufexan/nix-gaming";
@@ -78,23 +85,15 @@
    #     flake-compat.follows = "flake-compat";
    #   };
    # };
-    musnix = {
-      url = "github:musnix/musnix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    grub2-themes = {
-      url = "github:vinceliuice/grub2-themes";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nypkgs = {
-      # https://github.com/yunfachi/nypkgs
-      url = "github:yunfachi/nypkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    # musnix = {
+    #   url = "github:musnix/musnix";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
+    # nypkgs = {
+    #   # https://github.com/yunfachi/nypkgs
+    #   url = "github:yunfachi/nypkgs";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
    # stylix = {
    #   url = "github:danth/stylix";
    #   inputs = {
@@ -5,7 +5,7 @@
  imports = [
    ./gramps.nix
    ./streamrip.nix
-    ./v2rayn.nix
+    # ./v2rayn.nix
    ./yt-dlp.nix
  ];
 }
@@ -4,18 +4,7 @@
  xlib,
  ...
 }:
-let
-  streamripPath = "${xlib.dirs.wsl-storage}/streamrip";
-in
 {
-  xdg = {
-    configFile = {
-      "streamrip" = {
-        source = config.lib.file.mkOutOfStoreSymlink streamripPath;
-        target = "streamrip";
-      };
-    };
-  };
  home.packages = [
    pkgs.streamrip
  ];
@@ -15,7 +15,7 @@ let
        ];
        home = {
          username = username;
-          stateVersion = lib.mkDefault "25.05";
+          stateVersion = lib.mkDefault "26.05";
          homeDirectory =
            if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
          enableNixpkgsReleaseCheck = false;
@@ -24,7 +24,7 @@ let
      mkRootModule = username: {
        home = {
          username = username;
-          stateVersion = lib.mkDefault "25.05";
+          stateVersion = lib.mkDefault "26.05";
          homeDirectory =
            if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
          enableNixpkgsReleaseCheck = false;
@@ -36,7 +36,7 @@ let
        ];
        home = {
          username = username;
-          stateVersion = lib.mkDefault "25.05";
+          stateVersion = lib.mkDefault "26.05";
          homeDirectory =
            if username == "root" then lib.mkDefault "/${username}" else lib.mkDefault "/home/${username}";
          enableNixpkgsReleaseCheck = false;
@@ -75,7 +75,6 @@
      # Games
      #ludusavi
      #prismlauncher
-      steam
      #lutris

      # AI
@@ -8,12 +8,8 @@
 let
  symlinksPaths = {
    # cfg
-    "${xlib.dirs.user-storage}/ssh/config" = ".ssh/config";
-    "${xlib.dirs.user-storage}/beets" = ".config/beets";
    "${xlib.dirs.user-storage}/ludusavi" = ".config/ludusavi";
-    "${xlib.dirs.user-storage}/solaar" = ".config/solaar";
    "${xlib.dirs.user-storage}/easyeffects" = ".config/easyeffects";
-    "${xlib.dirs.user-storage}/KeePassXC" = ".config/keepassxc";
    "${xlib.dirs.user-storage}/v2rayN" = ".local/share/v2rayN";
    "/etc/nixos" = "Configuration";

@@ -8,18 +8,13 @@
 let
  symlinksPaths = {
    # cfg
-    "${xlib.dirs.user-storage}/ssh/config" = ".ssh/config";
-    "${xlib.dirs.user-storage}/beets" = ".config/beets";
    "${xlib.dirs.user-storage}/ludusavi" = ".config/ludusavi";
-    "${xlib.dirs.user-storage}/solaar" = ".config/solaar";
-    "${xlib.dirs.user-storage}/easyeffects" = ".config/easyeffects";
-    "${xlib.dirs.user-storage}/KeePassXC" = ".config/keepassxc";
    "${xlib.dirs.user-storage}/v2rayN" = ".local/share/v2rayN";
    "/etc/nixos" = "Configuration";

    "${config.home.homeDirectory}/Games/PrismLaunchers/${config.home.username}" =
      ".local/share/PrismLauncher";
-    #"${xlib.dirs.lamet-drive}/Users/oqyude/Music" = "Music";
+    "${xlib.dirs.lamet-drive}/Users/oqyude/Music" = "Music";
  };
  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
    name = targetPath;
@@ -8,9 +8,6 @@
 let
  symlinksPaths = {
    "${config.home.homeDirectory}/External/Music" = "Music";
-    "${xlib.dirs.storage}/beets" = ".config/beets";
-    "${xlib.dirs.storage}/ssh/config" = ".ssh/config";
-    "${xlib.dirs.storage}/ssh/known_hosts" = ".ssh/known_hosts";
  };
  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
    name = targetPath;
@@ -9,10 +9,7 @@ let
  symlinksPaths = {
    "${config.home.homeDirectory}/External/Music" = "Music";
    "${xlib.dirs.wsl-home}" = "External";
-    "${xlib.dirs.wsl-storage}/beets" = ".config/beets";
-    "${xlib.dirs.wsl-storage}/ssh/config" = ".ssh/config";
-    "${xlib.dirs.wsl-storage}/ssh/known_hosts" = ".ssh/known_hosts";
-    "${xlib.dirs.wsl-storage}/flow" = ".config/flow";
+    "${xlib.dirs.wsl-storage}" = "Storage";
  };
  mkLinks = lib.mapAttrs' (sourcePath: targetPath: {
    name = targetPath;
@@ -0,0 +1,132 @@
+{
+  config,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+{
+  virtualisation = {
+    podman = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        flags = [ "--all" ];
+      };
+      dockerCompat = true;
+    };
+    oci-containers = {
+      backend = "podman";
+      containers."3xui_app" = {
+        image = "ghcr.io/mhsanaei/3x-ui:latest";
+        environment = {
+          "XRAY_VMESS_AEAD_FORCED" = "false";
+          "XUI_ENABLE_FAIL2BAN" = "true";
+          "TZ" = "Europe/Moscow";
+        };
+        volumes = [
+          "${xlib.dirs.services-mnt-folder}/containers/3x-ui/cert/:/root/cert:rw"
+          "${xlib.dirs.services-mnt-folder}/containers/3x-ui/db/:/etc/x-ui:rw"
+        ];
+        log-driver = "journald";
+        extraOptions = [
+          "--network=host"
+        ];
+      };
+    };
+  };
+
+  systemd = {
+    services = {
+      "podman-3xui_app" = {
+        serviceConfig = {
+          Restart = lib.mkOverride 90 "always";
+        };
+        partOf = [
+          "podman-compose-3x-ui-root.target"
+        ];
+        wantedBy = [
+          "podman-compose-3x-ui-root.target"
+        ];
+      };
+      # Update
+      "podman-update-3xui_app" = {
+        path = [
+          pkgs.podman
+        ];
+        serviceConfig = {
+          Type = "oneshot";
+          TimeoutSec = 300;
+        };
+        script = ''
+          podman pull ghcr.io/mhsanaei/3x-ui:latest
+          systemctl restart podman-3xui_app.service
+        '';
+      };
+      # Builds
+      # "podman-build-3xui_app" = {
+      #   path = [
+      #     pkgs.podman
+      #     pkgs.git
+      #   ];
+      #   serviceConfig = {
+      #     Type = "oneshot";
+      #     TimeoutSec = 300;
+      #   };
+      #   script = ''
+      #     cd /mnt/containers/3x-ui
+      #     podman build -t compose2nix/3xui_app -f ./Dockerfile .
+      #   '';
+      # };
+    };
+    # Root service
+    # When started, this will automatically create all resources and start
+    # the containers. When stopped, this will teardown all resources.
+    targets."podman-compose-3x-ui-root" = {
+      unitConfig = {
+        Description = "Root target generated by compose2nix.";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+    timers."podman-update-3xui_app" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "weekly";
+        Persistent = true;
+      };
+    };
+    # Folders
+    tmpfiles.rules = [
+      "d /mnt 0755 root root -"
+      "d /mnt/services 0755 root root -"
+      "d /mnt/services/containers 0755 root root -"
+      "d /mnt/services/containers/3x-ui 0755 root root -"
+      "d /mnt/services/containers/3x-ui/cert 0755 root root -"
+      "d /mnt/services/containers/3x-ui/db 0755 root root -"
+      "Z /mnt/services/containers/3x-ui 0755 root root -"
+    ];
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall = {
+    allowedUDPPortRanges = [
+      {
+        from = 14380;
+        to = 15380;
+      }
+    ];
+    allowedTCPPortRanges = [
+      {
+        from = 14380;
+        to = 15380;
+      }
+    ];
+    interfaces =
+      let
+        matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+      in
+      {
+        "${matchAll}".allowedUDPPorts = [ 53 ];
+      };
+  };
+}
@@ -0,0 +1,121 @@
+{
+  pkgs,
+  lib,
+  config,
+  xlib,
+  ...
+}:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces =
+    let
+      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    in
+    {
+      "${matchAll}".allowedUDPPorts = [ 53 ];
+    };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."openhands-app" = {
+    image = "ghcr.io/openhands/openhands:latest";
+    environment = {
+      "AGENT_SERVER_IMAGE_REPOSITORY" = "ghcr.io/openhands/agent-server";
+      "AGENT_SERVER_IMAGE_TAG" = "31536c8-python";
+      "WORKSPACE_MOUNT_PATH" = "${xlib.dirs.services-mnt-folder}/containers/openhands/workspace";
+    };
+    volumes = [
+      "${xlib.dirs.services-mnt-folder}/containers/openhands/userspace:/.openhands:rw"
+      "${xlib.dirs.services-mnt-folder}/containers/openhands/workspace:/opt/workspace_base:rw"
+      "/run/podman/podman.sock:/var/run/docker.sock:rw"
+    ];
+    ports = [
+      "3000:3000/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      # "--network=host"
+      "--add-host=host.docker.internal:host-gateway"
+      "--network-alias=openhands"
+      "--network=openhands_default"
+    ];
+  };
+  systemd.services."podman-openhands-app" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "no";
+    };
+    after = [
+      "podman-network-openhands_default.service"
+    ];
+    requires = [
+      "podman-network-openhands_default.service"
+    ];
+    partOf = [
+      "podman-compose-openhands-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-openhands-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-openhands_default" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f openhands_default";
+    };
+    script = ''
+      podman network inspect openhands_default || podman network create openhands_default
+    '';
+    partOf = [ "podman-compose-openhands-root.target" ];
+    wantedBy = [ "podman-compose-openhands-root.target" ];
+  };
+
+  # Builds
+  # systemd.services."podman-build-openhands-app" = {
+  #   enable = false;
+  #   path = [
+  #     pkgs.podman
+  #     pkgs.git
+  #   ];
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     TimeoutSec = 300;
+  #   };
+  #   script = ''
+  #     cd ${xlib.dirs.services-mnt-folder}/containers/openhands/source
+  #     podman build -t openhands:latest -f ./containers/app/Dockerfile .
+  #   '';
+  # };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-openhands-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${xlib.dirs.services-mnt-folder} 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers/openhands 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers/openhands/userspace 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers/openhands/workspace 0755 root root -"
+  ];
+}
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  xlib,
+  ...
+}:
+{
+  systemd.tmpfiles.rules = [
+    "d ${xlib.dirs.services-mnt-folder} 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers/remnanode 0755 root root -"
+  ];
+}
@@ -0,0 +1,115 @@
+# Auto-generated by compose2nix.
+
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces =
+    let
+      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    in
+    {
+      "${matchAll}".allowedUDPPorts = [ 53 ];
+    };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."remnawave-panel-1" = {
+    image = "localhost/compose2nix/remnawave-panel-1";
+    environment = {
+      "API_INSTANCES" = "1";
+      "APP_PORT" = "3000";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_ENABLED" = "false";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_THRESHOLD" = "[60, 80]";
+      "CLOUDFLARE_TOKEN" = "ey...";
+      "DATABASE_URL" = "postgresql://remnawave:remnawave@remnawave-db:5432/postgres";
+      "FRONT_END_DOMAIN" = "*";
+      "IS_DOCS_ENABLED" = "false";
+      "IS_TELEGRAM_NOTIFICATIONS_ENABLED" = "false";
+      "JWT_API_TOKENS_SECRET" =
+        "787aa44c10130a9fa17ea3ea50c1248dd3e868f74941b96c09d608051399f88b95b67cd68d045aa39658b4b3fe933bf2b2c1437522498976f39f85ae1eab40da";
+      "JWT_AUTH_SECRET" =
+        "2bc14bacb6b82ce9e3ef69f8dd7bfb6b8a531f4f516902735d1d8f1bac8ff9b5077398f95b942b1adafc0ca1da4cdfd24a18539fa6eb26bee3f597a45deac94a";
+      "METRICS_PASS" = "admin";
+      "METRICS_PORT" = "3001";
+      "METRICS_USER" = "admin";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_AFTER_HOURS" = "[6, 24, 48]";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_ENABLED" = "false";
+      "PANEL_DOMAIN" = "rw.zeroq.ru";
+      "POSTGRES_DB" = "remnawave";
+      "POSTGRES_PASSWORD" = "gQLqOm2jK/Z1oBXCD18XSgr76M8ZqkVhHZbNKvZQXnY=";
+      "POSTGRES_USER" = "remnawave";
+      "REDIS_SOCKET" = "/var/run/valkey/valkey.sock";
+      "SCALAR_PATH" = "/scalar";
+      "SUB_PUBLIC_DOMAIN" = "rw.zeroq.ru/api/sub";
+      "SWAGGER_PATH" = "/docs";
+      # "TELEGRAM_BOT_TOKEN" = "change_me";
+      # "TELEGRAM_NOTIFY_CRM" = "change_me";
+      # "TELEGRAM_NOTIFY_NODES" = "change_me";
+      # "TELEGRAM_NOTIFY_SERVICE" = "change_me";
+      # "TELEGRAM_NOTIFY_TBLOCKER" = "change_me";
+      # "TELEGRAM_NOTIFY_USERS" = "change_me";
+      "WEBHOOK_ENABLED" = "false";
+      "WEBHOOK_SECRET_HEADER" = "vsmu67Kmg6R8FjIOF1WUY8LWBHie4scdEqrfsKmyf4IAf8dY3nFS0wwYHkhh6ZvQ";
+      "WEBHOOK_URL" = "https://your-webhook-url.com/endpoint";
+    };
+    ports = [
+      "3003:3003/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=remnawave-panel-1"
+      "--network=remnawavebackend_default"
+    ];
+  };
+  systemd.services."podman-remnawave-panel-1" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    partOf = [
+      "podman-compose-remnawave-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-remnawave-root.target"
+    ];
+  };
+
+  # Builds
+  systemd.services."podman-build-remnawave-panel-1" = {
+    path = [
+      pkgs.podman
+      pkgs.git
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      TimeoutSec = 300;
+    };
+    script = ''
+      cd /mnt/s/Deploy/remnawave-backend
+      podman build -t compose2nix/remnawave-panel-1 .
+    '';
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-remnawave-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}
@@ -0,0 +1,290 @@
+# Auto-generated by compose2nix.
+
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces =
+    let
+      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    in
+    {
+      "${matchAll}".allowedUDPPorts = [ 53 ];
+    };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."remnawave" = {
+    image = "remnawave/backend:2";
+    environment = {
+      "API_INSTANCES" = "1";
+      "APP_PORT" = "3000";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_ENABLED" = "false";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_THRESHOLD" = "[60, 80]";
+      "CLOUDFLARE_TOKEN" = "ey...";
+      "DATABASE_URL" = "postgresql://remnawave:remnawave@remnawave-db:5432/postgres";
+      "FRONT_END_DOMAIN" = "*";
+      "IS_DOCS_ENABLED" = "false";
+      "IS_TELEGRAM_NOTIFICATIONS_ENABLED" = "false";
+      "JWT_API_TOKENS_SECRET" =
+        "787aa44c10130a9fa17ea3ea50c1248dd3e868f74941b96c09d608051399f88b95b67cd68d045aa39658b4b3fe933bf2b2c1437522498976f39f85ae1eab40da";
+      "JWT_AUTH_SECRET" =
+        "2bc14bacb6b82ce9e3ef69f8dd7bfb6b8a531f4f516902735d1d8f1bac8ff9b5077398f95b942b1adafc0ca1da4cdfd24a18539fa6eb26bee3f597a45deac94a";
+      "METRICS_PASS" = "admin";
+      "METRICS_PORT" = "3001";
+      "METRICS_USER" = "admin";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_AFTER_HOURS" = "[6, 24, 48]";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_ENABLED" = "false";
+      "PANEL_DOMAIN" = "rw.zeroq.ru";
+      "POSTGRES_DB" = "remnawave";
+      "POSTGRES_PASSWORD" = "gQLqOm2jK/Z1oBXCD18XSgr76M8ZqkVhHZbNKvZQXnY=";
+      "POSTGRES_USER" = "remnawave";
+      "REDIS_SOCKET" = "/var/run/valkey/valkey.sock";
+      "SCALAR_PATH" = "/scalar";
+      "SUB_PUBLIC_DOMAIN" = "rw.zeroq.ru/api/sub";
+      "SWAGGER_PATH" = "/docs";
+      "TELEGRAM_BOT_TOKEN" = "change_me";
+      "TELEGRAM_NOTIFY_CRM" = "change_me";
+      "TELEGRAM_NOTIFY_NODES" = "change_me";
+      "TELEGRAM_NOTIFY_SERVICE" = "change_me";
+      "TELEGRAM_NOTIFY_TBLOCKER" = "change_me";
+      "TELEGRAM_NOTIFY_USERS" = "change_me";
+      "WEBHOOK_ENABLED" = "false";
+      "WEBHOOK_SECRET_HEADER" = "vsmu67Kmg6R8FjIOF1WUY8LWBHie4scdEqrfsKmyf4IAf8dY3nFS0wwYHkhh6ZvQ";
+      "WEBHOOK_URL" = "https://your-webhook-url.com/endpoint";
+    };
+    volumes = [
+      "valkey-socket:/var/run/valkey:rw"
+    ];
+    ports = [
+      "127.0.0.1:3000:3000/tcp"
+      "127.0.0.1:3001:3001/tcp"
+    ];
+    dependsOn = [
+      "remnawave-db"
+      "remnawave-redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--health-cmd=curl -f http://localhost:3001/health"
+      "--health-interval=30s"
+      "--health-retries=3"
+      "--health-start-period=30s"
+      "--health-timeout=5s"
+      "--hostname=remnawave"
+      "--network-alias=remnawave"
+      "--network=remnawave-network"
+    ];
+  };
+  systemd.services."podman-remnawave" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-valkey-socket.service"
+    ];
+    requires = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-valkey-socket.service"
+    ];
+    partOf = [
+      "podman-compose-remnawave-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-remnawave-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."remnawave-db" = {
+    image = "postgres:17.6";
+    environment = {
+      "API_INSTANCES" = "1";
+      "APP_PORT" = "3000";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_ENABLED" = "false";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_THRESHOLD" = "[60, 80]";
+      "CLOUDFLARE_TOKEN" = "ey...";
+      "DATABASE_URL" = "postgresql://remnawave:remnawave@remnawave-db:5432/postgres";
+      "FRONT_END_DOMAIN" = "*";
+      "IS_DOCS_ENABLED" = "false";
+      "IS_TELEGRAM_NOTIFICATIONS_ENABLED" = "false";
+      "JWT_API_TOKENS_SECRET" =
+        "787aa44c10130a9fa17ea3ea50c1248dd3e868f74941b96c09d608051399f88b95b67cd68d045aa39658b4b3fe933bf2b2c1437522498976f39f85ae1eab40da";
+      "JWT_AUTH_SECRET" =
+        "2bc14bacb6b82ce9e3ef69f8dd7bfb6b8a531f4f516902735d1d8f1bac8ff9b5077398f95b942b1adafc0ca1da4cdfd24a18539fa6eb26bee3f597a45deac94a";
+      "METRICS_PASS" = "admin";
+      "METRICS_PORT" = "3001";
+      "METRICS_USER" = "admin";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_AFTER_HOURS" = "[6, 24, 48]";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_ENABLED" = "false";
+      "PANEL_DOMAIN" = "rw.zeroq.ru";
+      "POSTGRES_DB" = "";
+      "POSTGRES_PASSWORD" = "";
+      "POSTGRES_USER" = "";
+      "REDIS_SOCKET" = "/var/run/valkey/valkey.sock";
+      "SCALAR_PATH" = "/scalar";
+      "SUB_PUBLIC_DOMAIN" = "rw.zeroq.ru/api/sub";
+      "SWAGGER_PATH" = "/docs";
+      "TELEGRAM_BOT_TOKEN" = "change_me";
+      "TELEGRAM_NOTIFY_CRM" = "change_me";
+      "TELEGRAM_NOTIFY_NODES" = "change_me";
+      "TELEGRAM_NOTIFY_SERVICE" = "change_me";
+      "TELEGRAM_NOTIFY_TBLOCKER" = "change_me";
+      "TELEGRAM_NOTIFY_USERS" = "change_me";
+      "TZ" = "UTC";
+      "WEBHOOK_ENABLED" = "false";
+      "WEBHOOK_SECRET_HEADER" = "vsmu67Kmg6R8FjIOF1WUY8LWBHie4scdEqrfsKmyf4IAf8dY3nFS0wwYHkhh6ZvQ";
+      "WEBHOOK_URL" = "https://your-webhook-url.com/endpoint";
+    };
+    volumes = [
+      "remnawave-db-data:/var/lib/postgresql/data:rw"
+    ];
+    ports = [
+      "127.0.0.1:6767:5432/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--health-cmd=pg_isready -U \${POSTGRES_USER} -d \${POSTGRES_DB}"
+      "--health-interval=3s"
+      "--health-retries=3"
+      "--health-timeout=10s"
+      "--hostname=remnawave-db"
+      "--network-alias=remnawave-db"
+      "--network=remnawave-network"
+    ];
+  };
+  systemd.services."podman-remnawave-db" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-remnawave-db-data.service"
+    ];
+    requires = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-remnawave-db-data.service"
+    ];
+    partOf = [
+      "podman-compose-remnawave-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-remnawave-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."remnawave-redis" = {
+    image = "valkey/valkey:9-alpine";
+    volumes = [
+      "valkey-socket:/var/run/valkey:rw"
+    ];
+    cmd = [
+      "valkey-server"
+      "--save"
+      ""
+      "--appendonly"
+      "no"
+      "--maxmemory-policy"
+      "noeviction"
+      "--loglevel"
+      "warning"
+      "--unixsocket"
+      "/var/run/valkey/valkey.sock"
+      "--unixsocketperm"
+      "777"
+      "--port"
+      "0"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--health-cmd=[\"valkey-cli\", \"-s\", \"/var/run/valkey/valkey.sock\", \"ping\"]"
+      "--health-interval=3s"
+      "--health-retries=3"
+      "--health-timeout=3s"
+      "--hostname=remnawave-redis"
+      "--network-alias=remnawave-redis"
+      "--network=remnawave-network"
+    ];
+  };
+  systemd.services."podman-remnawave-redis" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-valkey-socket.service"
+    ];
+    requires = [
+      "podman-network-remnawave-network.service"
+      "podman-volume-valkey-socket.service"
+    ];
+    partOf = [
+      "podman-compose-remnawave-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-remnawave-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-remnawave-network" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f remnawave-network";
+    };
+    script = ''
+      podman network inspect remnawave-network || podman network create remnawave-network --driver=bridge
+    '';
+    partOf = [ "podman-compose-remnawave-root.target" ];
+    wantedBy = [ "podman-compose-remnawave-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."podman-volume-remnawave-db-data" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect remnawave-db-data || podman volume create remnawave-db-data --driver=local
+    '';
+    partOf = [ "podman-compose-remnawave-root.target" ];
+    wantedBy = [ "podman-compose-remnawave-root.target" ];
+  };
+  systemd.services."podman-volume-valkey-socket" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect valkey-socket || podman volume create valkey-socket --driver=local
+    '';
+    partOf = [ "podman-compose-remnawave-root.target" ];
+    wantedBy = [ "podman-compose-remnawave-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-remnawave-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}
@@ -0,0 +1,198 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  xlib,
+  ...
+}:
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces =
+    let
+      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    in
+    {
+      "${matchAll}".allowedUDPPorts = [ 53 ];
+    };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."remnawave-panel-1" = {
+    image = "ghcr.io/remnawave/backend:latest";
+    environment = {
+      "API_INSTANCES" = "1";
+      "APP_PORT" = "3000";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_ENABLED" = "false";
+      "BANDWIDTH_USAGE_NOTIFICATIONS_THRESHOLD" = "[60, 80]";
+      "FRONT_END_DOMAIN" = "*";
+      "IS_DOCS_ENABLED" = "false";
+      "IS_TELEGRAM_NOTIFICATIONS_ENABLED" = "false";
+      "METRICS_PASS" = "admin";
+      "METRICS_PORT" = "3001";
+      "METRICS_USER" = "admin";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_AFTER_HOURS" = "[6, 24, 48]";
+      "NOT_CONNECTED_USERS_NOTIFICATIONS_ENABLED" = "false";
+      "PANEL_DOMAIN" = "rw.zeroq.su";
+      "POSTGRES_DB" = "remnawave";
+      "POSTGRES_USER" = "remnawave";
+      "REDIS_SOCKET" = "/var/run/valkey/valkey.sock";
+      "SCALAR_PATH" = "/scalar";
+      "SUB_PUBLIC_DOMAIN" = "rw.zeroq.su/api/sub";
+      "SWAGGER_PATH" = "/docs";
+      # "TELEGRAM_BOT_TOKEN" = "change_me";
+      # "TELEGRAM_NOTIFY_CRM" = "change_me";
+      # "TELEGRAM_NOTIFY_NODES" = "change_me";
+      # "TELEGRAM_NOTIFY_SERVICE" = "change_me";
+      # "TELEGRAM_NOTIFY_TBLOCKER" = "change_me";
+      # "TELEGRAM_NOTIFY_USERS" = "change_me";
+      "WEBHOOK_ENABLED" = "false";
+      # "WEBHOOK_URL" = "https://your-webhook-url.com/endpoint";
+    };
+    environmentFiles = [
+      "/run/secrets/remnawave-env"
+    ];
+    ports = [
+      "3003:3003/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=remnawave-panel-1"
+      "--network=host" # "--network=remnawavebackend_default"
+    ];
+  };
+  systemd.services."podman-remnawave-panel-1" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    partOf = [
+      "podman-compose-remnawave-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-remnawave-root.target"
+    ];
+  };
+
+  # Builds
+  # systemd.services."podman-build-remnawave-panel-1" = {
+  #   path = [ pkgs.podman pkgs.git ];
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     TimeoutSec = 300;
+  #   };
+  #   script = ''
+  #     cd /mnt/s/Deploy/remnawave-backend
+  #     podman build -t compose2nix/remnawave-panel-1 .
+  #   '';
+  # };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-remnawave-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  services = {
+    postgresql = {
+      ensureDatabases = [ "remnawave" ];
+      ensureUsers = [
+        {
+          name = "remnawave";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+  };
+
+  systemd.services = {
+    remnawave-env = {
+      description = "Generate remnawave env file";
+      requiredBy = [ "podman-remnawave-panel-1.service" ];
+      before = [ "podman-remnawave-panel-1.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+      };
+      script = ''
+        cat > /run/secrets/remnawave-env <<EOF
+          DATABASE_URL=$(cat ${config.sops.secrets.DATABASE_URL.path})
+          DATABASE_PASSWORD=$(cat ${config.sops.secrets.DATABASE_PASSWORD.path})
+          JWT_AUTH_SECRET=$(cat ${config.sops.secrets.JWT_AUTH_SECRET.path})
+          JWT_API_TOKENS_SECRET=$(cat ${config.sops.secrets.JWT_API_TOKENS_SECRET.path})
+          WEBHOOK_SECRET_HEADER=$(cat ${config.sops.secrets.WEBHOOK_SECRET_HEADER.path})
+          EOF
+        chmod 600 /run/secrets/remnawave-env
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+    remnawave-db-init = {
+      description = "Initialize Remnawave DB user";
+      after = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "postgres";
+      };
+      script = ''
+        PASSWORD=$(cat ${config.sops.secrets.DATABASE_PASSWORD.path})
+        ${pkgs.postgresql}/bin/psql -v ON_ERROR_STOP=1 <<EOF
+        DO \$\$
+        BEGIN
+          IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname='remnawave') THEN
+              EXECUTE format('ALTER ROLE remnawave WITH PASSWORD %L', '$PASSWORD');
+          END IF;
+        END
+        \$\$ LANGUAGE plpgsql;
+        EOF
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  sops.secrets = {
+    DATABASE_PASSWORD = {
+      key = "DATABASE_PASSWORD";
+      sopsFile = ./secrets/remnawave.yaml;
+      owner = "postgres";
+      group = "postgres";
+      mode = "0400";
+    };
+    WEBHOOK_SECRET_HEADER = {
+      key = "WEBHOOK_SECRET_HEADER";
+      sopsFile = ./secrets/remnawave.yaml;
+      mode = "0400";
+    };
+    DATABASE_URL = {
+      key = "DATABASE_URL";
+      sopsFile = ./secrets/remnawave.yaml;
+      mode = "0400";
+    };
+    JWT_AUTH_SECRET = {
+      key = "JWT_AUTH_SECRET";
+      sopsFile = ./secrets/remnawave.yaml;
+      mode = "0400";
+    };
+    JWT_API_TOKENS_SECRET = {
+      key = "JWT_API_TOKENS_SECRET";
+      sopsFile = ./secrets/remnawave.yaml;
+      mode = "0400";
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d ${xlib.dirs.services-mnt-folder} 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers 0755 root root -"
+    "d ${xlib.dirs.services-mnt-folder}/containers/remnawave 0755 root root -"
+  ];
+}
@@ -0,0 +1,20 @@
+DATABASE_PASSWORD: ENC[AES256_GCM,data:DRactR3j13q9zHFO0puGhBv09CX9YJc9KtFSLuOUVV/U7O/Nmh5Hb4ID0+A=,iv:5ErptccuQIVxfZKIcpfO5yVtcM0zE7kPn4v7kHctTP8=,tag:e3w8Rz+wGLTrxDSNftmkLw==,type:str]
+WEBHOOK_SECRET_HEADER: ENC[AES256_GCM,data:ZJYKwG1a8JH0ODeRnrv395plPN7PA18+gi3R/ueGd/r8OrtbVGL8UnZ/6HgW9M+/jCGWNclD5mZfyRg3He6hDg==,iv:PIYCD2n5ED5T24JfG6xhrvStd6jySCoBHhA8hUFIEMk=,tag:WWpfI1q9l9R44FRNaqIiaA==,type:str]
+DATABASE_URL: ENC[AES256_GCM,data:6plSDBUKyZVAO/djw3bPTthtS11yljwCGfQcIUqQetxROk5hwwVEGNMd1e6nGgS7eTtqJHW6uStkw58=,iv:RDjCVPDgPhMEbCriW0xjrxzcAolmyD55fbkD95LZMlE=,tag:ovH2D3eTXtHFmZba6u+IZg==,type:str]
+JWT_AUTH_SECRET: ENC[AES256_GCM,data:rzsOoIwJwwzCd+QbelcWYjfe1Bt7Y1ihrEn9tsxNyZnfmVVIkpFC948ne3YhUZ0CXYEDJYen/SFQgyyWsPwTwZgcy11mIZnROh4vlOJvPWILB1IlVQF/JDDts3fvXfe9HQ7ujBwkw5uR/33Rm+yxeLHMWTsn644DZSyKFi53QqY=,iv:aB3meC8BeEsLmiF0UMjQ60xipjGTJ0Qg1XqRHNujPFE=,tag:s/YcehFUrArknqHlXo3MYw==,type:str]
+JWT_API_TOKENS_SECRET: ENC[AES256_GCM,data:m6EtsdMNDRJk99LEYRgTk5rFNUYux4I2UWo/8AWy+2HJI8tRiOrBO284T3W/N+2/3fbty96sVB/SD8bjIIsxHij51sZTYi4+hdU7VxANGPdiMckKAXtvj3FMsVwrtW4MgRbH0j7taiDtnxVp6F3Cl7Sb0GamKFJjgAZnA3weN/8=,iv:rnNB1AzosstyF3c2pUcvYVTyUWcmo8Du+/b09OgcN9w=,tag:O81gnP2nXJ3JvgkivzVgkw==,type:str]
+sops:
+    age:
+        - recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3dWxEUDdhV2Z4V3JpNzNL
+            T0ZkYjlLWTNFV2c0Vm5Vb05xK09sQ0RxU0ZVCjhaSVhsSmoyZCtLYlNOVlNnTGFv
+            TTU1Y3I5U3UrcXhOOGt6U0hoSGw0YlUKLS0tIEJIbnJwNUk4Z0ZGNTRQRVFjWFhv
+            d0sreEpsMjV5M2JoRHFnVkpqeGhMM1EKX7K3Q2yj8EZuzCIxWIc+6Xeo+0lidPse
+            wstbeHV8ygWvOjIxjRGPOETQ17GLLl3eNEsk6P2gytZchmLkLYKKsA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-04T23:08:05Z"
+    mac: ENC[AES256_GCM,data:vWNFqNiWleqvRItVB0X5W/7e/F+LEWmfIKtnjbV5xwgyZ1jkP2N2wkw8CpzDNN5xwrkTdKfziGt+Psg8p72uMfvqns1lgQzvSbT3W8Di7bbIxgvwyBV8qCCpYn95ra/KRmV+oefhhr/1RlBN8wNb3oZI/m7sH8lv9d0sKw5SrE8=,iv:UAOifm4itrG6M3VKi7zelxL73lcpQkGXLSa/dk/hbvM=,tag:rzCK7Id3zQVF8VSDJV3nhg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
@@ -3,9 +3,9 @@ let
  defaultModule =
    {
      config,
+      deviceType,
      lib,
      xlib,
-      deviceType,
      ...
    }:
    {
@@ -21,10 +21,9 @@ let
        sops-nix.nixosModules.sops # sops module
        self.homeConfigurations.default.nixosModule # default homeConfigurations
        disko.nixosModules.disko # disko module
-        noctalia.nixosModules.default
      ];
-      nixpkgs.overlays = [
-        inputs.self.nixosOverlays.default
+      nixpkgs.overlays = with inputs; [
+        self.nixosOverlays.default
      ];
      _module.args = {
        inputs = inputs;
@@ -1,5 +1,6 @@
 {
  config,
+  inputs,
  lib,
  pkgs,
  ...
@@ -49,7 +50,7 @@
  programs = {
    dconf.enable = true;
    gamemode.enable = true;
-    # steam.enable = true;
+    steam.enable = true;
    xwayland.enable = true;
  };
  services = {
@@ -58,7 +59,7 @@
      xkb = {
        layout = "us,ru";
        variant = "";
-        options = "grp:alt_shift_toggle";
+        # options = "grp:alt_shift_toggle";
      };
    };
    libinput.enable = true;
@@ -68,7 +69,12 @@
      cups-pdf.enable = true;
    };
  };
-  # environment.sessionVariables = {
-  #   NIXOS_OZONE_WL = "1";
+  # environment = {
+  #   systemPackages = [
+  #     pkgs.pcbu-desktop
+  #   ];
+  #   # sessionVariables = {
+  #   #   NIXOS_OZONE_WL = "1";
+  #   # };
  # };
 }
@@ -7,7 +7,7 @@
    ./packages.nix
    ./services.nix
    ./settings.nix
-    # ./systemd-routine.nix
+    ./systemd-routines.nix
    ./shell.nix
  ];
 }
@@ -16,7 +16,7 @@ in
      btop
      broot
      bottom
-      fastfetchMinimal
+      fastfetch

      # Encrypt
      age
@@ -38,6 +38,12 @@ in
      lazyjournal
      systemctl-tui

+      # IDE
+      yaml-language-server
+      nil
+      fresh-editor
+      #flow-control
+
      # Base
      curl
      # efibootmgr
@@ -53,7 +59,7 @@ in
      wget
      tree
      dust
-      flow-control
+      tuckr

      # Net Diagnostic
      mtr
@@ -72,7 +78,7 @@ in
      exfatprogs # for gparted exfat support

      # Archivers
-      rar
+      # rar
      unzip
      zstd
      zip
@@ -86,20 +92,22 @@ in

      # To save
      tuios
-      fresh-editor
-
-      # Test
-      jocalsend
-      lazydocker
-      dtop
+      bluetui
+      speedtest-cli
+      # jocalsend
      tlrc
      lazyssh
      mcat
-      framework-tool-tui
-      bluetui
      snitch
-      devenv
      whosthere
+      devenv
+
+      # Test
+      rgx
+      net-tools
+      # lazydocker
+      # dtop
+      # framework-tool-tui
    ];
  };
  environment.variables.EDITOR = "fresh";
@@ -118,7 +126,6 @@ in
      enable = false;
      plugins = {
        inherit (pkgs.yaziPlugins)
-          gitui
          git
          sudo
          ouch
@@ -181,6 +188,9 @@ in
          name = "oqyude";
          email = "oqyude@gmail.com";
        };
+        pull = {
+          rebase = true;
+        };
      };
    };
    lazygit.enable = true;
@@ -192,7 +202,7 @@ in
      flake = "/etc/nixos";
      clean = {
        enable = true;
-        extraArgs = "--keep 3 --keep-since 2d";
+        extraArgs = "--keep 2 --keep-since 2d";
        dates = "daily";
      };
    };
@@ -0,0 +1,17 @@
+root-ca: ENC[AES256_GCM,data:5WxHCyp8sWl+XMpmMFQGfs+IhZx0r61JVFp7TJsn4pnCwV2KY/eyh6pEF+GF+P7eXALPEWGzdFYTzMJd6KJ+D+Ew0bLomIZ+KVhlxhgVzKG0xThrLpxSuyrrRFFfXzMz7C28v1HlBht6xtwKouPnxQcXDYTLyV52w7FrhWTXPuJ+TvaYDlHJcs3wHY5U+UiCoQZMcM8ddNkgbMqCu+/QC4G213EoJvjhQz+woXzIuqN8SYsOVmQ5su9Xy1sDMc8vIF+vl1Ax1E+T7ZqnE4E/7Y7HNzBQFpBGZjTb3JLUoyO4ALo0S36Yls12MWj/AZBmoBG8yL4wwA48FBHzGyH1aYtbWA/twJLDYzmu9saORW/TKIMrzeruxdufWU9sRs1f2BxpefAa2kZ8QTxhx2+3kUiOC1lipIjdMu9RSeq7q4HmKRTmuuXW087ere+IMhogh11RoshttB1W0/BU/dz6sYwAnCioSoOCd3n+WBGfuMNyeDjkpNJ4veg2HuU/K84rLFjNsxWnRfQML0BjUDHzFypA4dNIDo/FI0Z1cOrPojiqjwKt5Fb0XljTwfDQvkRtcZOQLVln7HfJlsU67YUCBMgJUJUTC3XKo82smZbz8JV1z8I9hVfnSfoEMiqNvDu3wKPGDpjWq0hAKD2R82keKe3Ji33Z2O4HK0e0Q7vSPP/Z5gIAay2S2aS2YLpqlvgzipqiLo2owzM2Mr4NrKRL9Vg36na7bLBPEoz+l9EK8EEiZaq+c8H2+dpmXpdmnUMQDF5yBxs4EU2M6Ga+X+2SYd1q9aZBT0yxykFkQrMUcA==,iv:Ee4tvSVLdk0Clh8vohbajEaKXJlQJjqOIu2lxfWueAI=,tag:oy99+HrMV1uGCdcAy7epug==,type:str]
+intermediate-ca: ENC[AES256_GCM,data:NUMdfNy+Opi/UypY1N2N8pZZK99m3VouzLxA7EKwC2sd2Q24uEflRfucjWupAASp7duncfSjmC1jQxCQpSzwV7Qbq3+PkKD+MnrceVzz40G97C5jEKEJG6ln5RdwGX5FeIF9tZpb/gBvkWcyrPQ6wDEpzd9rCDGJgvPzg/PaFuluO6UXKpppyC9Zzl2x/dms+2pV2aQcR0rEPEuXKK7NKxc+Zk3HFgcfhe26mbayZXZxdxs44vwPqPKr6xmWRiERBlCoMEfjLSWAiVjau/RXsW+/5Mtu80rbiRUHUesdZYIX4hqfoj914Mp1gsQ+bihnfBQ3xYyxtskBfHO8+oZNvOcDhx7zl8Vo+giD4435EYEFWNxjzRtbXoR0CHu50obmDDjpPcUpkRNzjpJK3VEJM45SEA2EZyupmf+Y8o4uHmOg/xTciVHLFqVOnchb6pm9WPbkyMT9K/+O9XvN3yVJzab6se6DdnEB/8PeA4s51M0ONk6PrFXSGdfwos84BmD8uaAqGhp64sXpTuunhfcmo02b1pZ2OqlGnjam5ZJOuyJ6vPeVYB/o60Dl/w5QtdeWc93EgsxNRAOyxOsrtSKdQPuZgp7+/I4S6kYaRJS8S7mvqSNdtCdrov1vYSEoHDXtu2XaDaJrStHJsP1FmTAAmXhzeyfGosB9JX7sdOGRkskesREqkzJ5V7+O0k3cpHFJvIZIFyj12rwpPSnrB66BELAQVxkqeol2dfPWn+G1aG9dmtq3T7+C3M5wW7VE41mmVgUrx9o4/8Z3wkHkBxZXiUkN4LfFHcZXmvuHFqRYYBOUpTzxRCkW6dl/gvP0qedMR3/zplhe51Gux7IFW7/s0wvTWHqWrpxirpW+c4l/IGf53Ox7kt3D,iv:atbEM7iZALuT1UipYmxlH0k0FOPJ7VKrfPrmCs3X9Mo=,tag:w6l49PKgjlzTZa1mIVpI4A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSamN6dkxYalBZc25EYThR
+            NnV0YW5oQWgrQWNhSE9Gemt3VGljaE0rTGcwCnYyV2JpdW1GbEZTRElDNFk2Y213
+            bk1FY1grM2tuc0UzV21ROG5BanpjbFEKLS0tIG83dnpNQzEvYVZ1ODArRjlYSFRY
+            WHp0NktOQVF0UW1KajhYM3U5WkZCNmsKrN8T73fg7JoT+7WheveOC3Jlxa79EFjs
+            ePfVY07TKEHsycFhNyjcsFCWMF2ddE7q28A+Sjg+C3SA+/cHO8U9lw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-23T20:42:27Z"
+    mac: ENC[AES256_GCM,data:XftvodNnD0YXmd1GsNt2w820CWYY3v2pXOtlFYE0k25kuKNeKqqGDgN4geTA/xh6eYMrDut6mryNHOOoWXTuU9r/NvpXotwT5/vW2s4Nq+Cd9XySceJn/Ja6aN8R5ICbq3BhmpmC3SCVXDTce4+MwIHeBmp+Lrff+mXvZ5cT1A4=,iv:FqI/KdPJFHOMHykeZj0oEcuIZsCBWF1WCK4saz9Es7g=,tag:IZ1xHkB4eqkp04L2iAbkOw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
@@ -1,5 +1,6 @@
 {
  config,
+  inputs,
  lib,
  pkgs,
  xlib,
@@ -1,6 +1,7 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:
 {
@@ -8,33 +9,34 @@
  system.nixos.label = "default";

  nix = {
-    channel = {
-      enable = true;
-    };
-    # nixPath = [ "nixpkgs=flake:nixpkgs" ];
+    # package = pkgs.lixPackageSets.stable.lix; # maybe unstable
+    channel.enable = false;
+    nixPath = [ "nixpkgs=flake:nixpkgs" ];
    settings = {
      require-sigs = false;
      substituters = [
+        "http://100.64.0.0:5000"
        "https://cache.nixos.org"
        "https://nix-community.cachix.org"
        "https://mirror.yandex.ru/nixos"
        "https://cache.nixos.kz"
-        "https://cache.xd0.zip"
+        # "https://cache.xd0.zip"
        "https://nixos-cache-proxy.cofob.dev"
        # "https://nixos-cache-proxy.sweetdogs.ru"
        # "https://nixos-cache-proxy.elxreno.com"
        # "https://nixos.snix.store" # https://nixos.snix.store/
      ];
      trusted-public-keys = [
+        "nix-cache.home.arpa:be5jFLkiwNyOep/McxSafB3jguBmztxx+oJ46ySyc/s="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      ];
-      stalled-download-timeout = 4;
-      connect-timeout = 4;
+      stalled-download-timeout = 8;
+      connect-timeout = 8;
      auto-optimise-store = true;
      fallback = true;
-      # allow-import-from-derivation = false;
-      # keep-derivations = true;
-      # keep-outputs = true;
+      allow-import-from-derivation = true;
+      keep-derivations = false;
+      keep-outputs = false;
      experimental-features = [
        "flakes"
        "nix-command"
@@ -43,10 +45,10 @@
  };

  nixpkgs = {
-    # flake = {
-    #   setFlakeRegistry = false;
-    #   setNixPath = false;
-    # };
+    flake = {
+      setFlakeRegistry = false;
+      setNixPath = false;
+    };
    config.allowUnfree = true;
  };

@@ -62,6 +64,34 @@
        });
      '';
    };
+    pki.certificates = [
+      ''
+        -----BEGIN CERTIFICATE-----
+        MIIBlDCCATmgAwIBAgIQUR+DM/LKIbokKxYPGZbCCjAKBggqhkjOPQQDAjAoMQ4w
+        DAYDVQQKEwVaZXJvUTEWMBQGA1UEAxMNWmVyb1EgUm9vdCBDQTAeFw0yNjA2MTMy
+        MjU2MDZaFw0zNjA2MTAyMjU2MDZaMCgxDjAMBgNVBAoTBVplcm9RMRYwFAYDVQQD
+        Ew1aZXJvUSBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgbhGtnlm
+        qd2Uv1B1VBSeg6NlXFMj4BG/k5gVu9bVFBK4cw9HVx21aHw9HhFW94P2KaySR6bu
+        K8tLDtzvs0xkyqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+        AQEwHQYDVR0OBBYEFH07/1blaqp0MVuSZIUHS9W3SjIrMAoGCCqGSM49BAMCA0kA
+        MEYCIQD1coTa7hqU1PAdnamAIgq1ApadDWpWfNaXPGiLCrkxTwIhAJhj/YSzqTJR
+        HvurdJ9m2glxV3rQHIUiVqKbQRcibObd
+        -----END CERTIFICATE-----
+        -----BEGIN CERTIFICATE-----
+        MIIBvjCCAWOgAwIBAgIRAMiJigRk8xbvHhCWN6a7D68wCgYIKoZIzj0EAwIwKDEO
+        MAwGA1UEChMFWmVyb1ExFjAUBgNVBAMTDVplcm9RIFJvb3QgQ0EwHhcNMjYwNjEz
+        MjI1NjA3WhcNMzYwNjEwMjI1NjA3WjAwMQ4wDAYDVQQKEwVaZXJvUTEeMBwGA1UE
+        AxMVWmVyb1EgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
+        QgAE2gUlKZ/z9kt5RrdYZHnGE1TVVegn+aDmGpZk5uvF04O9k/sfjD6QE7VtjwNH
+        ervZKu3iBXGRg92ba0k369VJpKNmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB
+        /wQIMAYBAf8CAQAwHQYDVR0OBBYEFCtYg4LEAHPIMrDPO7lrxKuFvw4PMB8GA1Ud
+        IwQYMBaAFH07/1blaqp0MVuSZIUHS9W3SjIrMAoGCCqGSM49BAMCA0kAMEYCIQD2
+        nNNHqs9/mIstOxetObgg8eqbrPWHXEVQ9CDucNFmQAIhANXAz2z1Rc7hxc6er23W
+        I8TU6UQc8dledPvalDJLyGym
+        -----END CERTIFICATE-----
+
+      ''
+    ];
  };
  systemd.network.wait-online.enable = false;

@@ -73,4 +103,23 @@
      "ru_RU.UTF-8/UTF-8"
    ];
  };
+
+  # sops.secrets = {
+  #   intermediate-ca = {
+  #     format = "yaml";
+  #     key = "intermediate-ca";
+  #     sopsFile = ./secrets/settings.yaml;
+  #     # owner = "nobody";
+  #     # group = "nogroup";
+  #     mode = "0700";
+  #   };
+  #   root-ca = {
+  #     format = "yaml";
+  #     key = "root-ca";
+  #     sopsFile = ./secrets/settings.yaml;
+  #     # owner = "nobody";
+  #     # group = "nogroup";
+  #     mode = "0700";
+  #   };
+  # };
 }
@@ -39,6 +39,7 @@
      gp = "git pull";
      ns = "nh os switch";
      gp-ns = "gp && ns";
+      gc = "git add . && git commit -m 'dev: автокоммит $(date +'%Y-%m-%d %H:%M:%S')'";
      y = "yazi";
      nix-shellp = "nix-shell --run $SHELL -p";
      z-proxy = "export ALL_PROXY=socks5://localhost:10808";
@@ -66,4 +67,7 @@
      json2nix = "nix run github:sempruijs/json2nix";
    };
  };
+  environment.sessionVariables = {
+    TUCKR_HOME = "$HOME/Storage/dotfiles";
+  };
 }
@@ -1,26 +0,0 @@
-{
-  config,
-  xlib,
-  ...
-}:
-{
-  systemd = {
-    services.nixos-auto-rebuild = {
-      description = "Auto rebuild NixOS config";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "${xlib.device.username}";
-        WorkingDirectory = "/etc/nixos";
-        ExecStart = "gp-ns";
-      };
-    };
-    timers.nixos-auto-rebuild = {
-      description = "Run NixOS auto rebuild at 4am daily";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "*-*-* 04:00:00";
-        Persistent = true;
-      };
-    };
-  };
-}
@@ -0,0 +1,39 @@
+{
+  config,
+  pkgs,
+  xlib,
+  ...
+}:
+{
+  systemd = {
+    services = {
+      nixos-prebuild = {
+        description = "Prebuild NixOS closure";
+        serviceConfig = {
+          CPUQuota = "20%";
+          User = "oqyude";
+          Group = "users";
+          Nice = 10;
+          Type = "oneshot";
+          WorkingDirectory = "/tmp";
+          Environment = [
+            "HOME=/home/oqyude"
+          ];
+          ExecStart = ''
+            ${pkgs.nix}/bin/nix build --no-link /etc/nixos#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel
+          '';
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+    timers = {
+      nixos-prebuild = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-* 04:00:00";
+          Persistent = true;
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,28 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "oqyude@zeroq.su";
+        server = "https://localhost:9000/acme/acme/directory";
+        dnsProvider = null;
+      };
+      # certs = {
+      #   # "home.arpa" = {
+      #   #   domain = "*.home.arpa";
+      #   #   server = "https://localhost:9000/acme/acme/directory";
+      #   #   listenHTTP = ":80";
+      #   # };
+      #   "turn.home.arpa" = {
+      #     listenHTTP = "127.0.0.1:80";
+      #     group = "turnserver";
+      #   };
+      # };
+    };
+  };
+}
@@ -0,0 +1,19 @@
+{
+  config,
+  inputs,
+  ...
+}:
+{
+  services.bentopdf = {
+    enable = true;
+    domain = "pdf.private";
+    nginx = {
+      enable = true;
+      # virtualHost = {
+      #   forceSSL = true;
+      #   enableACME = true;
+      # };
+    };
+    # package = pkgs-stable.bentopdf;
+  };
+}
@@ -1,22 +1,57 @@
 {
  config,
-  xlib,
  inputs,
+  pkgs,
+  xlib,
  ...
 }:
+let
+  stable = import inputs.nixpkgs-previous {
+    system = "x86_64-linux";
+  };
+in
 {
-  services.calibre-web = {
-    enable = true;
-    group = "users";
-    user = "${xlib.device.username}";
-    options = {
-      calibreLibrary = "${xlib.dirs.calibre-library}";
-      enableBookUploading = true;
-      enableKepubify = true;
-      enableBookConversion = false;
+  services = {
+    calibre-web = {
+      package = stable.calibre-web;
+      enable = true;
+      # dataDir = "${xlib.dirs.services-mnt-folder}/calibre-web";
+      options = {
+        calibreLibrary = "${xlib.dirs.services-mnt-folder}/calibre-web-library";
+        enableBookUploading = true;
+        enableKepubify = true;
+        enableBookConversion = false;
+      };
+      listen.ip = "0.0.0.0";
+      listen.port = 8083;
+      openFirewall = true;
+    };
+    # calibre-server = {
+    #   enable = true;
+    #   port = 8091;
+    #   host = "0.0.0.0";
+    #   openFirewall = true;
+    #   user = "calibre-web";
+    #   group = "calibre-web";
+    #   libraries = [
+    #     "/var/lib/calibre-server"
+    #   ];
+    # };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${xlib.dirs.services-mnt-folder}/calibre-web 0755 calibre-web calibre-web -"
+    "d ${xlib.dirs.services-mnt-folder}/calibre-web-library 0755 calibre-web calibre-web -"
+  ];
+
+  fileSystems = {
+    "/var/lib/calibre-web" = {
+      device = "${xlib.dirs.services-mnt-folder}/calibre-web";
+      fsType = "none";
+      options = [
+        "bind"
+        "nofail"
+      ];
    };
-    listen.ip = "0.0.0.0";
-    listen.port = 8083;
-    openFirewall = true;
  };
 }
@@ -0,0 +1,10 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  services.chrony = {
+    enable = true;
+  };
+}
@@ -1,28 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  xlib,
-  ...
-}:
-{
-
-  # fileSystems."${config.services.immich.mediaLocation}" = {
-  #   device = "${xlib.dirs.services-folder}/immich";
-  #   options = [
-  #     "bind"
-  #     "nofail"
-  #   ];
-  # };
-
-  # systemd.tmpfiles.rules = [
-  #   "z ${config.services.immich.mediaLocation} 0755 immich immich -"
-  # ];
-
-  # environment = {
-  #   systemPackages = with pkgs; [
-  #     immich-cli
-  #   ];
-  # };
-}
@@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  services.coredns = {
+    enable = true;
+    config = ''
+      zeroq.su:53 {
+          hosts {
+              109.248.161.5 x.zeroq.su
+              192.168.1.20 calibre.zeroq.su
+              192.168.1.20 dns.zeroq.su
+              192.168.1.20 flux.zeroq.su
+              192.168.1.20 git.zeroq.su
+              192.168.1.20 glances.zeroq.su
+              192.168.1.20 homebox.home.arpa
+              192.168.1.20 immich.zeroq.su
+              192.168.1.20 kuma.zeroq.su
+              192.168.1.20 nextcloud.zeroq.su
+              192.168.1.20 office.zeroq.su
+              192.168.1.20 pdf.zeroq.su
+              192.168.1.20 syncthing.zeroq.su
+              192.168.1.20 talk.zeroq.su
+              192.168.1.20 turn.zeroq.su
+              fallthrough
+          }
+          cache 300
+          log
+      }
+      home.arpa:53 {
+          hosts {
+              192.168.1.100 vetymae.home.arpa
+              192.168.1.20 ca.home.arpa
+              192.168.1.20 calibre.home.arpa
+              192.168.1.20 dns.home.arpa
+              192.168.1.20 flux.home.arpa
+              192.168.1.20 git.home.arpa
+              192.168.1.20 glances.home.arpa
+              192.168.1.20 home.arpa
+              192.168.1.20 homebox.home.arpa
+              192.168.1.20 immich.home.arpa
+              192.168.1.20 kuma.home.arpa
+              192.168.1.20 nextcloud.home.arpa
+              192.168.1.20 office.home.arpa
+              192.168.1.20 pdf.home.arpa
+              192.168.1.20 sapphira.home.arpa
+              192.168.1.20 syncthing.home.arpa
+              fallthrough
+          }
+          cache 300
+          log
+      }
+      .:53 {
+          forward . 1.1.1.1 9.9.9.9
+          cache 300
+      }
+    '';
+  };
+}
@@ -0,0 +1,53 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+# let
+#   acme-path = "/var/lib/acme";
+# in
+{
+  services.coturn = {
+    enable = false;
+    realm = "turn.home.arpa";
+    # cert = "${acme-path}/turn.home.arpa/fullchain.pem";
+    # pkey = "${acme-path}/turn.home.arpa/key.pem";
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets.turn-secret.path;
+    no-cli = true;
+    listening-port = 3478; # TURN
+    # tls-listening-port = 5349; # TURNS
+    extraConfig = ''
+      min-port=49160
+      max-port=49200
+    '';
+  };
+  networking.firewall = {
+    allowedTCPPorts = [
+      3478
+      # 5349
+    ];
+    allowedUDPPorts = [
+      3478
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 49160;
+        to = 49200;
+      }
+    ];
+  };
+  sops.secrets = {
+    turn-secret = {
+      format = "yaml";
+      key = "turn-secret";
+      sopsFile = ./secrets/coturn.yaml;
+      group = "nextcloud-spreed-signaling";
+      owner = "turnserver";
+      mode = "0440";
+    };
+  };
+}
@@ -5,26 +5,40 @@
 {
  imports = [
    ../software/beets
+    ./acme.nix
+    ./bentopdf.nix
    ./calibre-web.nix
-    ./containers
+    ./chrony.nix
+    ./coredns.nix
+    ./gitea.nix
+    ./glances.nix
+    ./homebox.nix
    ./immich.nix
    ./miniflux.nix
    ./nextcloud.nix
    ./nginx.nix
-    ./open-webui.nix
+    ./nix-serve.nix
+    # ./onlyoffice.nix
    ./postgresql.nix
    ./samba.nix
-    ./stirling-pdf.nix
+    ./step-ca.nix
    ./syncthing.nix
    ./systemd.nix
-    ./transmission.nix
-    ./uptime-kuma.nix
+    # ../containers/remnawave.nix
+    # ./coturn.nix
    # ./mealie.nix
    # ./memos.nix
+    # ./n8n.nix
+    # ./navidrome.nix
+    # ./netdata.nix
    # ./nfs.nix
    # ./node-red.nix
+    # ./open-webui.nix
    # ./rsync.nix
+    # ./stirling-pdf.nix
+    # ./transmission.nix
    # ./trilium.nix
+    # ./uptime-kuma.nix
    # ./zerotier.nix
  ];
 }
@@ -0,0 +1,29 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+{
+  services = {
+    gitea = {
+      enable = true;
+      stateDir = "${xlib.dirs.services-mnt-folder}/gitea";
+      appName = "ZeroQ Gitea Service";
+      settings = {
+        server = {
+          DOMAIN = "git.home.arpa";
+          HTTP_PORT = 3000;
+        };
+        service.DISABLE_REGISTRATION = true;
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${config.services.gitea.stateDir} 0755 gitea gitea -"
+    "z ${config.services.gitea.stateDir} 0755 gitea gitea -"
+  ];
+}
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    glances = {
+      enable = true;
+      openFirewall = true;
+      port = 61208;
+    };
+  };
+}
@@ -0,0 +1,44 @@
+{
+  config,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/homebox";
+  varDir = "/var/lib/homebox";
+in
+{
+  services.homebox = {
+    enable = true;
+    settings = {
+      HBOX_WEB_HOST = "0.0.0.0";
+      HBOX_WEB_PORT = "7745";
+      HBOX_STORAGE_CONN_STRING = "file://${varDir}";
+      HBOX_STORAGE_PREFIX_PATH = "data";
+      HBOX_DATABASE_DRIVER = "sqlite3";
+      HBOX_DATABASE_SQLITE_PATH = "${varDir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
+      HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+      HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
+      HBOX_MODE = "production";
+      HOME = "${varDir}";
+      TMPDIR = "${varDir}/tmp";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${configDir} 0755 homebox homebox -"
+    "z ${configDir} 0755 homebox homebox -"
+  ];
+  
+  fileSystems = {
+    "${varDir}" = {
+      device = "${configDir}";
+      fsType = "none";
+      options = [
+        "bind"
+        "nofail"
+      ];
+    };
+  };
+}
@@ -1,13 +1,13 @@
 {
  config,
+  inputs,
  lib,
  pkgs,
-  inputs,
  xlib,
  ...
 }:
 let
-  master = import inputs.nixpkgs-master {
+  new = import inputs.nixpkgs-unstable {
    system = "x86_64-linux";
  };
 in
@@ -15,28 +15,16 @@ in
  services = {
    immich = {
      enable = true;
-      # package = master.immich;
+      # package = new.immich;
      port = 2283;
      host = "0.0.0.0";
      openFirewall = true;
      accelerationDevices = null;
      machine-learning.enable = true;
      mediaLocation = "${xlib.dirs.services-mnt-folder}/immich";
-      database = {
-        enableVectors = false;
-        enableVectorChord = true;
-      };
    };
  };

-  # fileSystems."${config.services.immich.mediaLocation}" = {
-  #   device = "${xlib.dirs.services-folder}/immich";
-  #   options = [
-  #     "bind"
-  #     "nofail"
-  #   ];
-  # };
-
  systemd.tmpfiles.rules = [
    "z ${config.services.immich.mediaLocation} 0755 immich immich -"
  ];
@@ -4,7 +4,7 @@
 }:
 {
  services.mealie = {
-    enable = true;
+    enable = false;
    listenAddress = "0.0.0.0";
    port = 9000;
    database.createLocally = true;
@@ -5,7 +5,7 @@
 }:
 {
  services.memos = {
-    enable = true;
+    enable = false;
    openFirewall = true;
    settings = {
      MEMOS_MODE = "prod";
@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  xlib,
+  inputs,
+  ...
+}:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/n8n";
+  varDir = "/var/lib/n8n";
+in
+{
+  services.n8n = {
+    enable = false;
+    environment = {
+      # N8N_USER_FOLDER = lib.mkForce "${configDir}";
+      N8N_SECURE_COOKIE = "false";
+      N8N_PORT = 5678;
+    };
+    openFirewall = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${configDir} 0755 nobody nogroup -"
+    "z ${configDir} 0755 nobody nogroup -"
+  ];
+
+  fileSystems.${varDir} = {
+    device = "${configDir}";
+    fsType = "none";
+    options = [
+      "bind"
+      "nofail"
+    ];
+  };
+}
@@ -0,0 +1,22 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+{
+  services = {
+    navidrome = {
+      enable = false;
+      openFirewall = true;
+      # environmentFile = "";
+      settings = {
+        Address = "0.0.0.0";
+        Port = "4533";
+        MusicFolder = "/mnt/beets/music";
+      };
+    };
+  };
+}
@@ -0,0 +1,32 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    netdata = {
+      enable = false;
+      package = pkgs.netdata.override {
+        withCloudUi = true;
+      };
+      config = {
+        web = {
+          "allow connections from" = "localhost *";
+          "default port" = "19999";
+          "bind to" = "0.0.0.0";
+        };
+      };
+      # python = {
+      #   enable = true;
+      #   recommendedPythonPackages = true;
+      # };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    19999
+  ];
+}
@@ -1,16 +1,16 @@
 {
  config,
+  inputs,
  lib,
  pkgs,
-  inputs,
  xlib,
  ...
 }:
 let
-  master = import inputs.nixpkgs-master {
+  previous = import inputs.nixpkgs-master {
    system = "x86_64-linux";
-    # config.allowUnfree = true;
-    # config.allowUnfreePredicate = true;
+    config.allowUnfree = true;
+    config.allowUnfreePredicate = true;
  };
 in
 {
@@ -18,17 +18,50 @@ in
    nextcloud-whiteboard-server = {
      enable = true;
      settings = {
-        NEXTCLOUD_URL = "http://nextcloud.local";
+        NEXTCLOUD_URL = "https://nextcloud.home.arpa";
+      };
+      secrets = [ config.sops.secrets.nextcloud-whiteboard-jwt.path ];
+    };
+    nextcloud-spreed-signaling = {
+      enable = false;
+      hostName = "talk.private";
+      backends.nextcloud = {
+        urls = [
+          "https://nextcloud.home.arpa"
+          "https://nextcloud.zeroq.su"
+        ];
+        secretFile = config.sops.secrets.nextcloud-talk-secret.path;
+      };
+      settings = {
+        http.listen = "127.0.0.1:8080";
+        clients.internalsecretFile = config.sops.secrets.internal-secret.path;
+        sessions = {
+          hashkeyFile = config.sops.secrets.hashkey.path;
+          blockkeyFile = config.sops.secrets.blockkey.path;
+        };
+        mcu = {
+          type = "janus";
+          url = "ws://127.0.0.1:8188";
+        };
+        turn = {
+          secretFile = config.sops.secrets.turn-secret.path;
+          apikeyFile = config.sops.secrets.turn-api-key.path;
+          servers = [
+            "turn:turn.home.arpa:3478?transport=udp"
+            "turn:turn.home.arpa:3478?transport=tcp"
+            # "turns:turn.home.arpa:5349?transport=tcp"
+          ];
+        };
      };
-      secrets = [ "${inputs.zeroq-credentials}/services/nextcloud/jwt-secret.txt" ];
    };
    nextcloud = {
      enable = true;
-      package = pkgs.nextcloud32;
-      hostName = "nextcloud.local";
+      package = pkgs.nextcloud34;
+      hostName = "nextcloud.private";
      database.createLocally = true;
      home = "${xlib.dirs.services-mnt-folder}/nextcloud";
      configureRedis = true;
+      https = true;
      caching = {
        redis = true;
        memcached = true;
@@ -39,30 +72,44 @@ in
        dbuser = "nextcloud";
        dbname = "nextcloud";
        adminuser = "oqyude";
-        adminpassFile = "${inputs.zeroq-credentials}/services/nextcloud/admin-pass.txt";
+        adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
      };
      settings = {
        log_type = "file";
        trusted_domains = [
-          "nextcloud.zeroq.ru"
          "100.64.0.0"
          "192.168.1.20"
          "localhost"
+          "nextcloud.private"
+          "nextcloud.zeroq.su"
+          "office.zeroq.su"
+          "office.home.arpa"
+          "nextcloud.home.arpa"
        ];
        trusted_proxies = [
          "100.64.1.0"
+          "192.168.1.20"
+          "109.248.161.5"
        ];
-        overwriteprotocol = "https";
+        overwriteprotocol = "https"; # maybe no
      };
      extraAppsEnable = true;
      appstoreEnable = false;
+      notify_push = {
+        enable = true;
+        bendDomainToLocalhost = true;
+        nextcloudUrl = "https://nextcloud.home.arpa";
+      };
+      # phpPackage = pkgs.php85;
      extraApps = {
-        inherit (config.services.nextcloud.package.packages.apps) # (config.services.nextcloud.package.packages.apps)
+        inherit (config.services.nextcloud.package.packages.apps)
+          # richdocuments
          # gpoddersync
          # integration_paperless
          # memories
+          # news
          # nextpod
-          # onlyoffice
+          # notify_push
          # phonetrack
          # repod
          # sociallogin
@@ -80,96 +127,83 @@ in
          impersonate
          mail
          music
-          # news
          notes
-          notify_push
+          onlyoffice
          polls
          previewgenerator
-          richdocuments
          spreed
          tables
+          tasks
          user_oidc
          user_saml
          whiteboard
          ;
-        inherit (pkgs.nextcloud31Packages.apps)
-          # end_to_end_encryption
-          # maps
-          tasks
-          ;
+        # inherit (pkgs.nextcloud31Packages.apps)
+        #   # end_to_end_encryption
+        #   # maps
+        #   tasks
+        #   ;
      };
    };
-    collabora-online = {
-      enable = true;
-      port = 9980;
-      # package = master.collabora-online;
-      settings = {
-        server_name = "office.zeroq.ru";
-        ssl = {
-          enable = false;
-          termination = true;
-          ssl_verification = false;
-        };
-        net = {
-          listen = "0.0.0.0";
-          post_allow.host = [
-            "0.0.0.0"
-          ];
-        };
-        storage.wopi = {
-          "@allow" = true;
-          host = [
-            "0.0.0.0/0"
-          ];
-        };
-      };
-    };
-    onlyoffice = {
-      enable = false;
-      hostname = "0.0.0.0";
-      jwtSecretFile = "${inputs.zeroq-credentials}/services/onlyoffice/jwt.txt";
-    };
+    # collabora-online = {
+    #   enable = false;
+    #   port = 9980;
+    #   # package = master.collabora-online;
+    #   settings = {
+    #     server_name = "office.zeroq.su";
+    #     ssl = {
+    #       enable = false;
+    #       termination = true;
+    #       ssl_verification = false;
+    #     };
+    #     net = {
+    #       listen = "0.0.0.0";
+    #       post_allow.host = [
+    #         "0.0.0.0"
+    #       ];
+    #     };
+    #     storage.wopi = {
+    #       "@allow" = true;
+    #       host = [
+    #         "0.0.0.0/0"
+    #       ];
+    #     };
+    #   };
+    # };
  };

  # fonts.packages = [ work.corefonts ];

-  # networking.hosts = {
-  # };
+  #   networking.hosts = {
+  #     "localhost" = [ "nextcloud-private.local" ];
+  #   };

-  systemd.services.nextcloud-config-collabora =
-    let
-      inherit (config.services.nextcloud) occ;
-      wopi_url = "http://localhost:${toString config.services.collabora-online.port}";
-      public_wopi_url = "https://office.zeroq.ru";
-      wopi_allowlist = lib.concatStringsSep "," [
-        "0.0.0.0/0"
-      ];
-    in
-    {
-      wantedBy = [ "multi-user.target" ];
-      after = [
-        "nextcloud-setup.service"
-        "coolwsd.service"
-      ];
-      requires = [ "coolwsd.service" ];
-      script = ''
-        ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_url --value ${lib.escapeShellArg wopi_url}
-        ${occ}/bin/nextcloud-occ config:app:set richdocuments public_wopi_url --value ${lib.escapeShellArg public_wopi_url}
-        ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_allowlist --value ${lib.escapeShellArg wopi_allowlist}
-        ${occ}/bin/nextcloud-occ richdocuments:setup
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-      };
-    };
-
-  # fileSystems."${config.services.nextcloud.home}" = {
-  #   device = "${xlib.dirs.services-folder}/nextcloud";
-  #   options = [
-  #     "bind"
-  #     "nofail"
-  #   ];
-  # };
+  #   systemd.services.nextcloud-config-collabora =
+  #     let
+  #       inherit (config.services.nextcloud) occ;
+  #       wopi_url = "http://localhost:${toString config.services.collabora-online.port}";
+  #       public_wopi_url = "https://office.zeroq.su";
+  #       wopi_allowlist = lib.concatStringsSep "," [
+  #         "0.0.0.0/0"
+  #       ];
+  #     in
+  #     {
+  #       wantedBy = [ "multi-user.target" ];
+  #       after = [
+  #         "nextcloud-setup.service"
+  #         "coolwsd.service"
+  #       ];
+  #       requires = [ "coolwsd.service" ];
+  #       script = ''
+  #         ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_url --value ${lib.escapeShellArg wopi_url}
+  #         ${occ}/bin/nextcloud-occ config:app:set richdocuments public_wopi_url --value ${lib.escapeShellArg public_wopi_url}
+  #         ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_allowlist --value ${lib.escapeShellArg wopi_allowlist}
+  #         ${occ}/bin/nextcloud-occ richdocuments:setup
+  #       '';
+  #       serviceConfig = {
+  #         Type = "oneshot";
+  #       };
+  #     };

  systemd.tmpfiles.rules = [
    "z ${config.services.nextcloud.home} 0750 nextcloud nextcloud -"
@@ -178,4 +212,69 @@ in
  environment.systemPackages = [
    pkgs.nc4nix # Packaging helper for Nextcloud apps
  ];
+
+  sops.secrets = {
+    nextcloud-adminpass = {
+      format = "yaml";
+      key = "adminpass";
+      sopsFile = ./secrets/nextcloud.yaml;
+      owner = "nextcloud";
+      group = "nextcloud";
+      mode = "0650";
+    };
+    nextcloud-whiteboard-jwt = {
+      format = "yaml";
+      key = "whiteboard-jwt";
+      sopsFile = ./secrets/nextcloud.yaml;
+      owner = "nextcloud";
+      group = "nextcloud";
+      mode = "0650";
+    };
+    nextcloud-talk-secret = {
+      format = "yaml";
+      key = "nextcloud-talk-secret";
+      sopsFile = ./secrets/nextcloud.yaml;
+      # owner = "nextcloud-spreed-signaling";
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+    internal-secret = {
+      format = "yaml";
+      key = "internal-secret";
+      sopsFile = ./secrets/nextcloud.yaml;
+      # owner = "nextcloud-spreed-signaling";
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+    hashkey = {
+      format = "yaml";
+      key = "hashkey";
+      sopsFile = ./secrets/nextcloud.yaml;
+      # owner = "nextcloud-spreed-signaling";
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+    blockkey = {
+      format = "yaml";
+      key = "blockkey";
+      sopsFile = ./secrets/nextcloud.yaml;
+      # owner = "nextcloud-spreed-signaling";
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+    turn-secret = {
+      format = "yaml";
+      key = "turn-secret";
+      sopsFile = ./secrets/coturn.yaml;
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+    turn-api-key = {
+      format = "yaml";
+      key = "turn-api-key";
+      sopsFile = ./secrets/coturn.yaml;
+      # group = "nextcloud-spreed-signaling";
+      mode = "0440";
+    };
+  };
 }
@@ -5,6 +5,9 @@
  xlib,
  ...
 }:
+let
+  server = "192.168.1.20";
+in
 {
  services = {
    nginx = {
@@ -14,7 +17,7 @@
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      virtualHosts = {
-        "nextcloud.local" = {
+        "nextcloud.private" = {
          forceSSL = false;
          enableACME = false;
          listen = [
@@ -26,58 +29,235 @@
              addr = "192.168.1.20";
              port = 10000;
            }
+            {
+              addr = "127.0.0.1";
+              port = 10000;
+            }
          ];
        };
-        "zeroq.local" = {
+        "office.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+        };
+        "pdf.private" = {
          forceSSL = false;
          enableACME = false;
-          root = pkgs.writeTextDir "index.html" ''
-            <!doctype html>
-            <html>
-            <body>
-              <pre>This server is running in backend.</pre>
-            </body>
-            </html>
+          listen = [
+            {
+              addr = "0.0.0.0";
+              port = 80;
+            }
+            {
+              addr = "100.64.0.0";
+              port = 8446;
+            }
+            {
+              addr = "192.168.1.20";
+              port = 8446;
+            }
+            {
+              addr = "127.0.0.1";
+              port = 8446;
+            }
+          ];
+          extraConfig = ''
+            client_max_body_size 5G;
          '';
-          listen = [
-            {
-              addr = "100.64.0.0";
-              port = 80;
-            }
-            {
-              addr = "192.168.1.20";
-              port = 80;
-            }
-          ];
        };
-        # "localhost:8000" = {
-        #   forceSSL = false;
-        #   enableACME = false;
-        #   listen = [
-        #     {
-        #       addr = "100.64.0.0";
-        #       port = 9980;
-        #     }
-        #     {
-        #       addr = "192.168.1.20";
-        #       port = 9980;
-        #     }
-        #   ];
+        "pdf.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations = {
+            "/" = {
+              proxyPass = "http://127.0.0.1:8446";
+              proxyWebsockets = true;
+            };
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "homebox.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations = {
+            "/" = {
+              proxyPass = "http://127.0.0.1:7745";
+              proxyWebsockets = true;
+            };
+          };
+        };
+        "nextcloud.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations = {
+            "/" = {
+              proxyPass = "http://127.0.0.1:10000";
+              proxyWebsockets = true;
+            };
+            "/whiteboard" = {
+              proxyPass = "http://127.0.0.1:3002";
+              proxyWebsockets = true;
+            };
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        # "talk.home.arpa" = {
+        #   forceSSL = true;
+        #   enableACME = true;
+        #   # locations = {
+        #   #   "/" = {
+        #   #     proxyPass = "http://127.0.0.1:7880";
+        #   #     proxyWebsockets = true;
+        #   #   };
+        #   # };
+        #   extraConfig = ''
+        #     client_max_body_size 5G;
+        #   '';
        # };
-        # "office.zeroq.ru" = {
-        #   forceSSL = false;
-        #   enableACME = false;
+        # "turn.home.arpa" = {
+        #   forceSSL = true;
+        #   enableACME = true;
+        #   locations = {
+        #     "/" = {
+        #       proxyPass = "http://127.0.0.1:5349";
+        #       proxyWebsockets = true;
+        #     };
+        #   };
+        #   extraConfig = ''
+        #     client_max_body_size 5G;
+        #   '';
+        # };
+        "ca.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:9000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "git.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:3000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "git.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:3000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        # "n8n.home.arpa" = {
+        #   forceSSL = true;
+        #   enableACME = true;
        #   locations."/" = {
-        #     proxyPass = "http://onlyoffice.local:8000";
+        #     proxyPass = "http://${server}:5678";
        #     proxyWebsockets = true;
        #   };
        #   extraConfig = ''
-        #     # Force nginx to return relative redirects. This lets the browser
-        #     # figure out the full URL. This ends up working better because it's in
-        #     # front of the reverse proxy and has the right protocol, hostname & port.
-        #     absolute_redirect off;
+        #     client_max_body_size 5G;
        #   '';
        # };
+        "kuma.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:4001";
+            proxyWebsockets = true;
+          };
+        };
+        "flux.home.arpa" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:6061";
+            proxyWebsockets = true;
+          };
+        };
+        "immich.home.arpa" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:2283";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "calibre.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:8083";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "dns.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:53";
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "glances.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:61208";
+          };
+        };
+        "syncthing.home.arpa" = {
+          addSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:8384";
+          };
+        };
+        # "zeroq.home.arpa" = {
+        #   forceSSL = true;
+        #   enableACME = true;
+        #   root = pkgs.writeTextDir "index.html" ''
+        #     <!doctype html>
+        #     <html>
+        #     <body>
+        #       <pre>This server is running in backend.</pre>
+        #     </body>
+        #     </html>
+        #   '';
+        #   listen = [
+        #     {
+        #       addr = "100.64.0.0";
+        #       port = 80;
+        #     }
+        #     {
+        #       addr = "192.168.1.20";
+        #       port = 80;
+        #     }
+        #   ];
+        # };
      };
    };
  };
@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    nix-serve = {
+      enable = true;
+      package = pkgs.nix-serve-ng;
+      openFirewall = true;
+      port = 5000;
+      bindAddress = "0.0.0.0";
+      secretKeyFile = config.sops.secrets.private-key.path;
+    };
+  };
+  sops.secrets = {
+    private-key = {
+      key = "private-key";
+      sopsFile = ./secrets/nix-serve.yaml;
+      mode = "0600";
+    };
+  };
+}
@@ -0,0 +1,45 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  previous = import inputs.nixpkgs-master {
+    system = "x86_64-linux";
+    config.allowUnfree = true;
+    config.allowUnfreePredicate = true;
+  };
+in
+{
+  services.onlyoffice = {
+    enable = true;
+    # package = previous.onlyoffice-documentserver;
+    hostname = "office.home.arpa";
+    port = 8090;
+    allowLocalConnections = true;
+    wopi = true;
+    jwtSecretFile = config.sops.secrets.onlyoffice-jwt.path;
+    securityNonceFile = config.sops.secrets.onlyoffice-nonce.path;
+  };
+  sops.secrets = {
+    onlyoffice-nonce = {
+      format = "yaml";
+      key = "nonce";
+      sopsFile = ./secrets/onlyoffice.yaml;
+      owner = "onlyoffice";
+      group = "onlyoffice";
+      mode = "0650";
+    };
+    onlyoffice-jwt = {
+      format = "yaml";
+      key = "jwt";
+      sopsFile = ./secrets/onlyoffice.yaml;
+      owner = "onlyoffice";
+      group = "onlyoffice";
+      mode = "0650";
+    };
+  };
+}
@@ -23,6 +23,7 @@ in

  fileSystems."/var/lib/postgresql" = {
    device = "${xlib.dirs.services-mnt-folder}/postgresql";
+    fsType = "none";
    options = [
      "bind"
      "nofail"
@@ -1,53 +1,88 @@
 {
  config,
+  inputs,
+  pkgs,
  xlib,
  ...
 }:
+let
+  stable = import inputs.nixpkgs-master {
+    system = "x86_64-linux";
+  };
+in
 {
-  services.samba = {
-    enable = true;
-    settings = {
-      global = {
-        "invalid users" = [ ];
-        "passwd program" = "/run/wrappers/bin/passwd %u";
-        security = "user";
+  services = {
+    samba-wsdd = {
+      enable = true;
+      openFirewall = true;
+      hostname = "sapphira.home.arpa";
+      discovery = true;
+    };
+    samba = {
+      enable = true;
+      # package = pkgs.samba4Full;
+      nmbd = {
+        enable = true;
      };
-      nixos = {
-        "path" = "/etc/nixos";
-        "browseable" = "yes";
-        "read only" = "no";
-        "valid users" = "${xlib.device.username}";
-        "guest ok" = "no";
-        "writable" = "yes";
-        "create mask" = 755;
-        "directory mask" = 755;
-        "force user" = "${xlib.device.username}";
-        "force group" = "users";
-      };
-      root = {
-        "path" = "/";
-        "browseable" = "yes";
-        "read only" = "no";
-        "valid users" = "${xlib.device.username}";
-        "guest ok" = "no";
-        "writable" = "yes";
-        #"create mask" = 0644;
-        #"directory mask" = 0644;
-        "force user" = "root";
-        "force group" = "root";
-      };
-      "${xlib.device.username}" = {
-        "path" = "${xlib.dirs.server-home}";
-        "browseable" = "yes";
-        "read only" = "no";
-        "valid users" = "${xlib.device.username}";
-        "guest ok" = "no";
-        "writable" = "yes";
-        "create mask" = 700;
-        "directory mask" = 700;
-        "force user" = "${xlib.device.username}";
-        "force group" = "users";
+      settings = {
+        global = {
+          "invalid users" = [ ];
+          "passwd program" = "/run/wrappers/bin/passwd %u";
+          security = "user";
+        };
+        nixos = {
+          "path" = "/etc/nixos";
+          "browseable" = "yes";
+          "read only" = "no";
+          "valid users" = "${xlib.device.username}";
+          "guest ok" = "no";
+          "writable" = "yes";
+          "create mask" = 755;
+          "directory mask" = 755;
+          "force user" = "${xlib.device.username}";
+          "force group" = "users";
+        };
+        root = {
+          "path" = "/";
+          "browseable" = "yes";
+          "read only" = "no";
+          "valid users" = "${xlib.device.username}";
+          "guest ok" = "no";
+          "writable" = "yes";
+          #"create mask" = 0644;
+          #"directory mask" = 0644;
+          "force user" = "root";
+          "force group" = "root";
+        };
+        "${xlib.device.username}" = {
+          "path" = "${xlib.dirs.server-home}";
+          "browseable" = "yes";
+          "read only" = "no";
+          "valid users" = "${xlib.device.username}";
+          "guest ok" = "no";
+          "writable" = "yes";
+          "create mask" = 700;
+          "directory mask" = 700;
+          "force user" = "${xlib.device.username}";
+          "force group" = "users";
+        };
      };
    };
  };
+
+  systemd.tmpfiles.rules = [
+    "d ${xlib.dirs.services-mnt-folder}/samba 0755 root root -"
+    "z ${xlib.dirs.services-mnt-folder}/samba 0755 root root -"
+  ];
+
+  fileSystems = {
+    "/var/lib/samba" = {
+      device = "${xlib.dirs.services-mnt-folder}/samba";
+      fsType = "none";
+      options = [
+        "bind"
+        "nofail"
+      ];
+    };
+  };
 }
@@ -0,0 +1,46 @@
+{
+	"root": "/root/.step/certs/root_ca.crt",
+	"federatedRoots": null,
+	"crt": "/root/.step/certs/intermediate_ca.crt",
+	"key": "/root/.step/secrets/intermediate_ca_key",
+	"address": "0.0.0.0:9000",
+	"insecureAddress": "",
+	"dnsNames": [
+		"ca.zeroq.su"
+	],
+	"logger": {
+		"format": "text"
+	},
+	"db": {
+		"type": "badgerv2",
+		"dataSource": "/root/.step/db",
+		"badgerFileLoadingMode": ""
+	},
+	"authority": {
+		"provisioners": [
+			{
+				"type": "JWK",
+				"name": "oqyude@zeroq.su",
+				"key": {
+					"use": "sig",
+					"kty": "EC",
+					"kid": "vhOaaOVnwo0MtJVP13ZM60ckirLUqq-5WEbq2PQTQ-w",
+					"crv": "P-256",
+					"alg": "ES256",
+					"x": "0WXy0B9DHwz4POacxrSiml7bbOPFYPKVvyUlm18M5ro",
+					"y": "AptaeuzpC2TV9_hHAx8s2afDmCa_QJSzke23kCYzKfU"
+				},
+				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiVTBRS24wUHFJUUZiNTRyRkVYeDVwZyJ9.Xc96u-JxlKELcawpLmyrzqp4_UUY1sAqUo7PX6hBWL8_Ix2RzS8ZwA.fs5K5A9kXmp3KEUu.J1s016RTlqKbfRzQJB1bdz8v93S9PLpU3DqlEvIVnOIEhovL9vG5dzPLAfLApZ_MArHhubVkirHhZHB4fYd3KvbFpCRaYQomB4vP0V188zclL7gyatiQ36R_fTG_oiRiKHeP0nPubVpL-I-ESdtXR05pMQtit5A1luLGm3H78FuTF883Hiz-hc84v8E-nq0Z5l5zQeV-fy4QaCFzg1_5s7MacNlgplDLopzbfJIhp3SDKiwWjsotPjsuKMSQ-blawbBL5skf44t23hDelSaRvASq8-Dq-hkBLsKssMX7SzccHPWpxazZ07Ug8PKc8_o2kxc6k5-K0Xr5tY4h8VI.YSsnw_InABsga1SCjLtq1g"
+			}
+		]
+	},
+	"tls": {
+		"cipherSuites": [
+			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+		],
+		"minVersion": 1.2,
+		"maxVersion": 1.3,
+		"renegotiation": false
+	}
+}
@@ -0,0 +1,17 @@
+turn-secret: ENC[AES256_GCM,data:M8dIzxKmv/x07/KNFTB+0JusGNA61J9r8VaR1Yy/j8Lo5x+NI2S1+rytvUutGxnTnYVqXynozs3ABfIDu/yzyA==,iv:X70EiZNkjbSL2R0S79D2Ey6tMiU35Gr4ROcxbX6df70=,tag:dJjSBSyK2RtIdXP5npWOQA==,type:str]
+turn-api-key: ENC[AES256_GCM,data:xFV8ZCDSPrtybCSIas4JEamsYX6fqd0IZIdNqv7cfk0R5+rKsvJYzAFc2RcREOafiGrA6nR85NvldhoAB06HIQ==,iv:DeqlY9jBByn42ygx2TiRQscPYqKwxvGZyhLEo1nmAgw=,tag:RCW0LJqFANWycASBsBuKYA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVI1aUJDZ2gxWUhpSllL
+            dVRZS0cvYjVBeWlhNytpK09nMVBFQU1aOUVrCnpOdit6bGxxYmhJNTYwMkdKOWdI
+            QTQzZUhDc3ZCeTlFVWZER2U5dUxDNG8KLS0tIDRYUW02ZjV4OFNyTkhRa0ZDMU1Q
+            NzNnQXloNE9LODA3SXpUTzExU0RuUFUKOSmHSr4oKj+MdSLv1bXzGWdj+xBS4cXq
+            93hxORbXILr96DUfQucNHkAHT4BcW0TIE1F5EyOL1HVEnI3/WEuR4w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-30T08:02:46Z"
+    mac: ENC[AES256_GCM,data:NG0b9LrWQ1E6rQOxDvhAqu190a3EDmGwQV49ezuCVZmjr4okajomjCe3Q37KdG+d576RXldtciPq2ZNhEPzuC51kEvNk1x1oMn64lNDrYWXwev4tI+NcdpLm8W2hPeU6jsnY4NZAQf9YUvjJIwXyO2fhuR8AovRsUPj9A8fEjJU=,iv:H7C/GBsh8Zal3p+FXY7BjBCTVTEkC9ma4molPODsZDU=,tag:+V+mI88apssiXr3cJPQeiw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
@@ -0,0 +1,21 @@
+adminpass: ENC[AES256_GCM,data:Fm+Q6YWXxouP5cX2WHU05Jr49FU=,iv:Exf/li6bL6xpR9HQ8XDDSprjx4ltHkJFl99Ga+gXwmQ=,tag:iB9d5O4982tr7lPu1nWccQ==,type:str]
+whiteboard-jwt: ENC[AES256_GCM,data:5i+x8VODrBIhGEWS5Ua6lrk7tsfk6xTa/1qm1rXe4A==,iv:2gFEeudip7BxJh553QtZ1CZo9T8jro3Q/Afdo8ouHtw=,tag:HgBM9ta41rhXJlsQJ+asFg==,type:str]
+nextcloud-talk-secret: ENC[AES256_GCM,data:rdPoTwP00N3VdYKVMG1JgBL4GdXbJAGYIyBHGrVoH1kP0+vU9ImHFfhPNOGTJasTcsVH9Ub+ewLw8cnhBpjFGw==,iv:dOY3kuYZt+Uw1RqNLMV1AJirQXl6UZrD4TCSibnM+nI=,tag:gzkJCN7ipqKV3UdrSF6aGQ==,type:str]
+internal-secret: ENC[AES256_GCM,data:5dUblSAYYKaBXJj4nzHHggQp3+76Ubc0SE6VGbT6wzO+Zavdy/vo8JtVPkq3WZddyqJX9sgc2mn4fIXRRU+Zkg==,iv:A240Os4SEN+O9GT0HwX6WrGJx9TAYnJDSyW609vmES0=,tag:8p05AcrovwTaxxt+vFri9A==,type:str]
+hashkey: ENC[AES256_GCM,data:49w+JLFgN1pcV8QqcW+URURIypnZMi5RC6E7U60HgrY=,iv:u0r2QgVehL/Y0xSiDTvBc2yOw1fWL/PQgT+n6ZSGf4M=,tag:NF9h6FWwjX2RUxy5YN6ODA==,type:str]
+blockkey: ENC[AES256_GCM,data:t/w0aENV7X0/tiAoJWi74BKFsaGZblfCnsYPg271aBQ=,iv:hWiFMDEtq6g/11dAvtUun3wgZw2J4jbIMOz3ly4o34Q=,tag:z2DYXT+rylpgOp/0CY7qDQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNWFiUlZXMEEvNll0aFFk
+            UldxNitqaDgyenBFeWRhLzUxSVVhQk55Q1FBCkdLU3p4S0NTOVhERkRoaWVwbWVB
+            cUxwdkJnQ1IyNzFTaVJvVXRwbElYbVkKLS0tIDQ5ejZvRks5U0tPU0w0WXdtM0ht
+            WGVQYjZtaHhaeC9pMzYxYmxTcVNtYk0KKxXXNA9h0fs+mA6U/Vsyg+q1CPl5hFrI
+            Ozjqh+dzwajQeqkCPUdCsoeIWsvBY2Cyabvs+f0zj8S00faXb8rVQQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-30T07:33:27Z"
+    mac: ENC[AES256_GCM,data:fZlKozBczGDWfhXKyJXmW/I/7GdKKoPG/NVNt2ncoK2a+pjHglJ0Ur9Zg02v05Fb37MmFznmHH2nn4W4av1TX118dX4jkni2aue06NEF3L8iali+sHFPUSI+uT8SvG0DW7ZvllPNwyPNgzeZPLIKqRRGZ7CgOqKe6IWOha4jAhg=,iv:7gfdmYmktzRXq7ANwXOdOKVgZEe0kfFIPKEvEnhfKrc=,tag:3tkVXh+89Q/uW8TCHZtWWQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
@@ -0,0 +1,16 @@
+private-key: ENC[AES256_GCM,data:VTj1cmhYLbBuUnIgtXI3CZtULaNZ5XOpoheJB0gUwrWrH5B0rmxcvZLlJWX7xhGs4oqcC3Wwmo+TBPhcgGylLVdCuhJG5A94UwOa9ZIV4s3x3IJ4RU3UcHTsA0xdtw7XxBfryw==,iv:8oZCojIU0JXWJgE5t+fNNW9trC109yOJp1UGAV76FbU=,tag:S74cHFy9B8C29npdcoVBeg==,type:str]
+sops:
+    age:
+        - recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6MHBkYzZneEdhUlN5MEpx
+            NGxud1BkVU1NUFdyVFE2VDJWb1M2cW9IcUVFCm9QZ3RvNHFaeWpFbnZ3Q1dKSDdn
+            RHQvUDgrZHRiUHpSR3FrWXRkQUxXWGMKLS0tIERsemNuL1BwR2xYYUpmbVFROWtN
+            RGI1WlRGMzlkS2tqQ0JPSFJHTUY1TUkKDeaivc+ST8MYtnJEDx07Y+IhtpvblR47
+            SLZf6WKQ8WNY4Bb5VeMWiCABPP/2L+VwoACqkOdZ01yGUVQSc9X6tw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-03T17:05:41Z"
+    mac: ENC[AES256_GCM,data:6jNp7N7lIvsLez3zQbDKTWPyvkL8u9g34I3q27GudgXzYw8B3Pb26jc9dCYCxCylCZxN5IeWWyHvUt4PadQABI4jrrIKnIfVV1A2c+A90chu+xSyE/B9OhkSC7yYVOnCURJPYku8799RIRkpHAWeKawkydbOiszCiC3qIKZDSTQ=,iv:xXivLDNnTABlNeWOOWsCESDUOnFv+9Lh0o029r7rk+A=,tag:vUoIZjcNtE3xJX/jNCao7Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
@@ -0,0 +1,17 @@
+jwt: ENC[AES256_GCM,data:Mp+eAh0Nle0QDfo92isNLwvHn/E=,iv:0FLK/8QpmX5Mv7IXMy04AJAgUknp5DATpD0acyPqrUg=,tag:rP9x3G8WIDG6KWSjqPXulQ==,type:str]
+nonce: ENC[AES256_GCM,data:IGIo74eaE1vppWmLJt8C1cmpUm8eozumLXU5ecJJIolpKlC85H39l6oGmw==,iv:YwLbgbkOxpChwLTbknCii66LMVwD61sr7gXsbv3t/NI=,tag:YFfLkO5b55/AcJKTpSyslQ==,type:str]
+sops:
+    age:
+        - recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSzIwWlBrWFJWVHpIUVJk
+            eHh1MkYza28yeU54OWczY1ZjYmJHOFI3dXc4ClVKUVpoUWZTR0g5L2FTd0l4NzUr
+            R0xlYTJVQ1VLQXJuSGZJUE1Bd3Jsa00KLS0tIExPSi9Ob0ErSTRZQlhlTGN5WUV0
+            dm4xa25tSmN3VjlPaWpBWnhJdklqWEEK+sD+lvwQGjNkOic3ZCo2VGQ/+p2Nhmm+
+            g846YrGljYOib6hNryEhZWe0KmaDhn24vnEK5NS4WtqqwV+IhCZbmg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-30T21:55:57Z"
+    mac: ENC[AES256_GCM,data:Ff8KB0O7sDE4GL8kccuA3s8DSallp5aOsy+T60FLCxsZN1m7m6Cql+3Hb3IS0M/nLRZMoZre8kztnzSbWs8ZK0e5wZoQjb6KMESZaXPOfjjbPWjMKiRCAQZUJNZy5P067qoxOIQ3t25kPNolmHkSyicpLoLRIB4Adn8+M79/RLk=,iv:LfVbDH8JVbgkVk5cFpr/lbvtSu8waLhn9XHwPW/8jBE=,tag:ll5JQbyr84vI8V154ZE/wQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
@@ -0,0 +1,16 @@
+intermediate-password: ENC[AES256_GCM,data:SvV5uYVXVTuhh/dhzXIDJw69dJ3s33a0ibKCyDWnfyA=,iv:S9VydNWm4PL+quWQ7arCmSFXa6YO1/hL+xrYty/2IPE=,tag:zHJ6/ZNRfs9w9vrt77xdow==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5K3YyYkRkVkxwamMybWRj
+            WGxEZnc3TGRYRHNtTXRZYlZKQ2hBK0YrQjNZCndVQVhYcTJqRitCdUdmMjduTk1M
+            azNnMUhHKzB1M25vZGFScjZBcHJOaUEKLS0tIHJBRnZwamhvYU1ybFVFMFZsTmVS
+            ZmN3NTVnZ1RwRkNzTUxJTjVGMU4yUHMKMEZdpDBm6pdZmrFidkOdivnnd2/b8OO/
+            IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-23T20:42:29Z"
+    mac: ENC[AES256_GCM,data:pyayAQOBIBKwfpTCykHtVELGKmhrpS9Mu18wwl3aYyvEwdqqhfSbzt2fXURgWAbrsax6KzrTfi2bgixy8NxRibI+o5/magGAXdk0N5RUP68/FPe1cSL6ZRry+00WjJp8x75wbSp64GU0xY7uUuq+oUKfckGCsY/m4AODbZWU1Ic=,iv:jEpnTyllRd46vPiGG2VlZkFOgwcKQNSov1W813uLQEM=,tag:B7BNlVvhgm9HI/zUQneVQw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
@@ -0,0 +1,103 @@
+{
+  config,
+  inputs,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/step-ca";
+  varDir = "/var/lib/step-ca";
+in
+{
+  services.step-ca = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 9000;
+    openFirewall = true;
+    intermediatePasswordFile = config.sops.secrets.intermediate-password.path;
+    settings = {
+      root = "${varDir}/certs/root_ca.crt";
+      crt = "${varDir}/certs/intermediate_ca.crt";
+      key = "${varDir}/secrets/intermediate_ca_key";
+      # address = "0.0.0.0:9000";
+      dnsNames = [
+        "*.zeroq.su"
+        "*.home.arpa"
+        "localhost"
+      ];
+      db = {
+        type = "badgerv2";
+        dataSource = "${varDir}/db";
+      };
+      authority = {
+        claims = {
+          defaultTLSCertDuration = "2160h";
+          maxTLSCertDuration = "2160h";
+        };
+        provisioners = [
+          {
+            type = "ACME";
+            name = "acme";
+            claims = {
+              enableSSHCA = false;
+              allowSANs = [
+                "*.home.arpa"
+                "*.zeroq.su"
+                "home.arpa"
+                "localhost"
+              ];
+              maxTLSCertDuration = "2160h";
+            };
+          }
+          {
+            type = "JWK";
+            name = "oqyude@zeroq.su";
+            key = {
+              use = "sig";
+              kty = "EC";
+              kid = "XEpzFJA-sedFf0ANCiEH1UDaSvrHiZabLahQOyoAYmc";
+              crv = "P-256";
+              alg = "ES256";
+              x = "AGHevH0UU7_abhE6d8JhNuNRgXBeVI7qCldZrFfkn5o";
+              y = "pLKOpAwUiGRv4HRQUyiXFAMqsywTjrjazeEkDOr29Sk";
+            };
+            encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoibFlONzBwMWJiVzc0MDlGaS1EOEZVUSJ9.zBEsf2hAaj4yyy_Lk1Jss7h5Hn68kz6UMeg3Jz3X_VVeMWLvcoRVaw.tpY50S9CSzmcfWXz.u5ta_Yd3GLMz19RKA2WondVIwTGbGs3is5v7_D0aUOtQ0158d4GcjrOHFD2PexaackbTNuUPtqa2X38ypnFq5wh1uq3udWu-qWRjRSd_YkY4YJt_GWFvUHQ_jldx0NSfMDNGndU2IakR62-9WklEjU3UGmUeaPGP9DTuzmdJa36t2aLuPuNnmV-tEJIH3eQ5huU8nLy1ROZjdkrF-agHh78EG_Ss8P4vHuqOtTAjZW3YCtfSfb57iKAsbrk3nUTo6zhPc0ds8cPB7Rva0K8Rj2Pf3apB7qZnCVF5zBiu1icvhOYIfwVQAiqpdz6qMi42QSBWZ4ROu4Db2q5a6D0.AS7Dr3v_Niiwy7aHIR-0bw";
+          }
+        ];
+      };
+    };
+  };
+
+  fileSystems."${varDir}" = {
+    device = "${configDir}";
+    fsType = "none";
+    options = [
+      "bind"
+      "nofail"
+    ];
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      step-cli
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${configDir} 0755 nobody nogroup -"
+    "z ${configDir} 0755 nobody nogroup -"
+    "Z ${configDir}/ 0700 nobody nogroup -"
+  ];
+
+  sops.secrets = {
+    intermediate-password = {
+      format = "yaml";
+      key = "intermediate-password";
+      sopsFile = ./secrets/step-ca.yaml;
+      # owner = "nobody";
+      # group = "nogroup";
+      mode = "0600";
+    };
+  };
+}
@@ -1,17 +0,0 @@
-{
-  config,
-  inputs,
-  ...
-}:
-# let
-#   pkgs-stable = import inputs.nixpkgs-stable { system = "x86_64-linux"; };
-# in
-{
-  services.stirling-pdf = {
-    enable = false;
-    # package = pkgs-stable.stirling-pdf;
-    environment = {
-      SERVER_PORT = 6060;
-    };
-  };
-}
@@ -11,31 +11,47 @@
      rsync-archivesta = {
        # Archivesta
        description = "Backup data using rsync";
-        requisite = [ "mnt-archive.mount" ]; # hard-code
+        unitConfig.RequiresMountsFor = [
+          "${xlib.dirs.archive-drive}"
+          "${xlib.dirs.server-home}"
+          "${xlib.dirs.services-mnt-folder}"
+        ];
        script = ''
-          ${pkgs.rsync}/bin/rsync -rtv --delete ${xlib.dirs.services-folder}/ ${xlib.dirs.archive-drive}/Services/
+          ${pkgs.rsync}/bin/rsync -rtv --delete \
+            ${xlib.dirs.services-mnt-folder}/ \
+            ${xlib.dirs.archive-drive}/Services/
        '';
        serviceConfig = {
          Type = "oneshot";
          User = "root";
          Group = "root";
-          Nice = 19;
+          Nice = 10;
+          CPUQuota = "5%";
          IOSchedulingClass = "idle";
        };
      };
      rsync-archivesta-lite = {
        # Archivesta Lite
        description = "Backup data using rsync";
-        requisite = [ "mnt-mobile.mount" ]; # hard-code
+        unitConfig.RequiresMountsFor = [
+          "${xlib.dirs.server-home}"
+          "${xlib.dirs.mobile-drive}"
+        ];
        script = ''
-          ${pkgs.rsync}/bin/rsync -rtv --delete ${xlib.dirs.server-home}/Music/ ${xlib.dirs.mobile-drive}/Music/
-          ${pkgs.rsync}/bin/rsync -rtv --delete "${xlib.dirs.server-home}/Hosts/epral/Neo Backup/" "${xlib.dirs.mobile-drive}/Neo Backup/"
+          ${pkgs.rsync}/bin/rsync -rtv --delete \
+            ${xlib.dirs.server-home}/Music/ \
+            ${xlib.dirs.mobile-drive}/Music/
+
+          ${pkgs.rsync}/bin/rsync -rtv --delete \
+            "${xlib.dirs.server-home}/Hosts/epral/Neo Backup/" \
+            "${xlib.dirs.mobile-drive}/Neo Backup/"
        '';
        serviceConfig = {
          Type = "oneshot";
          User = "root";
          Group = "root";
-          Nice = 19;
+          Nice = 10;
+          CPUQuota = "5%";
          IOSchedulingClass = "idle";
        };
      };
@@ -8,7 +8,7 @@
 }:
 {
  services.uptime-kuma = {
-    enable = true;
+    enable = false;
    settings = {
      PORT = "4001";
      HOST = "0.0.0.0";
@@ -21,6 +21,7 @@

  fileSystems."/var/lib/private/uptime-kuma" = {
    device = "${xlib.dirs.services-mnt-folder}/uptime-kuma";
+    fsType = "none";
    options = [
      "bind"
      "nofail"
@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  xlib,
-  ...
-}:
-{
-  # services = {
-  #   nextjs-ollama-llm-ui.enable = false;
-  #   ollama = {
-  #     enable = false;
-  #     package = pkgs.ollama-rocm;
-  #     environmentVariables = {
-  #       HSA_OVERRIDE_GFX_VERSION = "11.5.0";
-  #       HCC_AMDGPU_TARGET = "gfx1150"; # used to be necessary, but doesn't seem to anymore
-  #     };
-  #     user = "ollama"; # "${xlib.device.username}";
-  #     group = "ollama";
-  #     acceleration = "rocm";
-  #     rocmOverrideGfx = "11.5.0";
-  #   };
-  # };
-}
@@ -1,28 +1,84 @@
 {
  config,
+  inputs,
  lib,
  pkgs,
  xlib,
  ...
 }:
 let
-  depsOverlay = import ./dependencies.nix {
-    # ./dependencies-full.nix if broken
-    inherit (pkgs) fetchurl fetchgit fetchhg;
-    inherit pkgs;
+  stable = import inputs.nixpkgs-beets {
+    system = "x86_64-linux";
  };
-  python3 = pkgs.python3.override {
-    packageOverrides = depsOverlay;
-  };
-  beetsEnv = python3.withPackages (ps: [
-    ps.beets
-  ]);
+in
+let
+  # depsOverlay = import ./dependencies.nix {
+  #   # ./dependencies-full.nix if broken
+  #   inherit (pkgs) fetchurl fetchgit fetchhg;
+  #   inherit pkgs;
+  # };
+  # python3 = pkgs.python3.override {
+  #   packageOverrides = depsOverlay;
+  # };
+  beetsEnv = pkgs.python314.withPackages (
+    ps: with ps; [
+      # et-xmlfile
+      # exceptiongroup
+      # markdown-it-py
+      # mdurl
+      # munkres
+      # musicbrainzngs
+      # openpyxl
+      # pygments
+      # rich
+      # sniffio
+      anyio
+      beautifulsoup4
+      beetcamp
+      beets
+      certifi
+      charset-normalizer
+      colorama
+      confuse
+      discogs-client
+      filetype
+      h11
+      httpcore
+      httpx
+      httpx-socks
+      idna
+      jellyfish
+      langdetect
+      lap
+      llvmlite
+      mediafile
+      mutagen
+      numba
+      numpy
+      oauthlib
+      packaging
+      pillow
+      platformdirs
+      pycountry
+      pylast
+      pyrate-limiter
+      pysocks
+      python-dateutil
+      pyyaml
+      requests
+      requests-ratelimiter
+      scipy
+      # setuptools
+      six
+      socksio
+      soupsieve
+      typing-extensions
+      unidecode
+      urllib3
+    ]
+  );
 in
 {
-  systemd.tmpfiles.rules = [
-    "z /mnt/beets 0700 ${xlib.device.username} users -" # beets absolute paths
-  ];
-
  users = {
    users = {
      "${xlib.device.username}" = {
@@ -30,21 +86,20 @@ in
          beetsEnv
          pkgs.mp3gain
          pkgs.imagemagick
-          #pkgs.ffmpeg
+          #ffmpeg
        ];
      };
    };
  };
-  fileSystems."/mnt/beets/music" = {
-    device = "/home/${xlib.device.username}/Music"; # "${xlib.dirs.vetymae-drive}/Users/User/Music"
-    options = [
-      "bind"
-      "uid=1000"
-      "gid=1000"
-      "fmask=0077"
-      "dmask=0077"
-      "nofail"
-      #"x-systemd.device-timeout=0"
-    ];
-  };
+  systemd.mounts = [
+    {
+      enable = true;
+      options = "bind,x-systemd.automount,nofail";
+      requires = [ "local-fs.target" ];
+      type = "none";
+      wantedBy = [ "multi-user.target" ];
+      what = "/home/${xlib.device.username}/Music";
+      where = "/home/${xlib.device.username}/.config/beets";
+    }
+  ];
 }
@@ -117,7 +117,7 @@ self: super: {
      self."requests" # For spotify, deezer, embedart, fetchart, lyrics
      self."python3-discogs-client" # For discogs
      self."pylast" # For lastgenre
-      self."beetcamp" # Another
+      # self."beetcamp" # Another
    ];
  };
  "certifi" = super.buildPythonPackage rec {
@@ -13,6 +13,7 @@
  xlib.device.username = "oqyude";

  users = {
+    mutableUsers = false;
    users = {
      "${xlib.device.username}" = {
        name = "${xlib.device.username}";
@@ -80,6 +81,22 @@
        group = config.users.users."${xlib.device.username}".group;
        mode = "0655";
      };
+      ssh_key_private_root = {
+        format = "yaml";
+        key = "ssh_key_private";
+        path = "/root/.ssh/id_ed25519";
+        owner = "root";
+        group = "root";
+        mode = "0600";
+      };
+      ssh_key_public_root = {
+        format = "yaml";
+        key = "ssh_key_public";
+        path = "/root/.ssh/id_ed25519.pub";
+        owner = "root";
+        group = "root";
+        mode = "0655";
+      };
      ssh_key_public_host = {
        format = "yaml";
        key = "ssh_key_public";
@@ -1,16 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-{
-  imports = [
-    ./3x-ui.nix
-  ];
-
-  environment.systemPackages = with pkgs; [
-    compose2nix
-    podman-tui
-  ];
-}
@@ -4,7 +4,6 @@
 }:
 {
  imports = [
-    ./containers
-    ./nginx.nix
+    ../vds
  ];
 }
@@ -1,40 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}:
-{
-  services.netbird.server = {
-    enable = false;
-    enableNginx = true;
-    domain = "netbird.zeroq.ru";
-    dashboard = {
-      enable = false;
-      domain = "netbird.zeroq.ru";
-      settings = {
-        #AUTH_AUTHORITY = "nbp_ufe0v5mbb5H1lQWL8eJfuzJ5ItPmlM46Mik0";
-      };
-    };
-    management = {
-      enable = false;
-      domain = "netbird.zeroq.ru";
-    };
-  };
-
-  # networking.firewall = {
-  #   allowedTCPPorts = [
-  #     80
-  #     443
-  #     33073
-  #     10000
-  #     33080
-  #   ];
-  #   allowedUDPPorts = [ 3478 ];
-  #   allowedUDPPortRanges = [
-  #     {
-  #       from = 49152;
-  #       to = 65535;
-  #     }
-  #   ];
-  # };
-}
@@ -1,202 +0,0 @@
-{
-  config,
-  inputs,
-  pkgs,
-  ...
-}:
-let
-  server = "100.64.0.0";
-in
-{
-  environment.etc."nginx/pubray".text = inputs.zeroq-credentials.services.xray.auth;
-  users.users.nginx.extraGroups = [ "acme" ];
-  services = {
-    nginx = {
-      enable = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      appendHttpConfig = inputs.zeroq-credentials.services.xray.maps;
-      virtualHosts = {
-        # "pubray.zeroq.ru" = {
-        #   enableACME = true;
-        #   forceSSL = true;
-        #   root = "${inputs.zeroq-credentials.services.xray.subs}";
-        #   locations."/" = {
-        #     extraConfig = ''
-        #       auth_basic "Restricted";
-        #       auth_basic_user_file /etc/nginx/pubray;
-
-        #       if ($subfile = "") { return 403; }
-        #       rewrite ^/$ $subfile break;
-        #     '';
-        #   };
-        # };
-        "x.new.zeroq.ru" = {
-          forceSSL = true;
-          enableACME = true;
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:2049";
-              proxyWebsockets = true;
-            };
-            "/default" = {
-              proxyPass = "http://localhost:2053";
-              proxyWebsockets = true;
-            };
-            "/subs/" = {
-              proxyPass = "http://localhost:2096";
-              proxyWebsockets = true;
-            };
-          };
-        };
-        # "kuma.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:4001";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "node-red.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   kTLS = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:1880";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   root = pkgs.writeTextDir "index.html" ''
-        #     <!doctype html>
-        #     <html>
-        #     <body>
-        #       <pre>What are you doing here?</pre>
-        #     </body>
-        #     </html>
-        #   '';
-        #   locations = {
-        #     "/guest/" = {
-        #       proxyPass = "http://${server}:80";
-        #       proxyWebsockets = true;
-        #     };
-        #     # "/.well-known/discord" = {
-        #     #   extraConfig = ''
-        #     #     default_type text/plain;
-        #     #     return 200 "dh=c2d103553a4cfdaa1b7952a87a7d8120a1e167cc";
-        #     #   '';
-        #     # };
-        #   };
-        # };
-        # "flux.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:6061";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "office.new.zeroq.ru" = {
-        #   enableACME = true;
-        #   forceSSL = true;
-        #   locations = {
-        #     "/" = {
-        #       proxyPass = "http://${server}:9980"; # API и coauthoring
-        #       proxyWebsockets = true;
-        #     };
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #     proxy_set_header X-Forwarded-Proto $scheme;
-        #     proxy_set_header X-Real-IP $remote_addr;
-        #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        #   ''; # absolute_redirect off;
-        # };
-        # "immich.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:2283";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "nextcloud.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations = {
-        #     "/" = {
-        #       proxyPass = "http://${server}:10000";
-        #       proxyWebsockets = true;
-        #     };
-        #     "/whiteboard" = {
-        #       proxyPass = "http://${server}:3002";
-        #       proxyWebsockets = true;
-        #     };
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "calibre.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:8083";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "pdf.new.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:6060";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "ai.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:11112";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-      };
-    };
-  };
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      email = "go.bin043120@gmail.com";
-    };
-  };
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-}
@@ -1,108 +0,0 @@
-# Auto-generated using compose2nix v0.3.3-pre.
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-
-{
-  # Runtime
-  virtualisation.podman = {
-    enable = true;
-    autoPrune = {
-      enable = true;
-      flags = [ "--all" ];
-    };
-    dockerCompat = true;
-  };
-
-  # Enable container name DNS for all Podman networks.
-  networking.firewall.interfaces =
-    let
-      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
-    in
-    {
-      "${matchAll}".allowedUDPPorts = [ 53 ];
-    };
-
-  networking.firewall = {
-    allowedUDPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
-    ];
-    allowedTCPPortRanges = [
-      {
-        from = 14380;
-        to = 15380;
-      }
-    ];
-    allowedTCPPorts = [
-      8443
-      9443
-      13380
-    ];
-    allowedUDPPorts = [
-      8443
-      9443
-      13380
-    ];
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  # Containers
-  virtualisation.oci-containers.containers."3xui_app" = {
-    image = "ghcr.io/mhsanaei/3x-ui:latest";
-    environment = {
-      "XRAY_VMESS_AEAD_FORCED" = "false";
-      "XUI_ENABLE_FAIL2BAN" = "true";
-    };
-    volumes = [
-      "/mnt/containers/3x-ui/cert/:/root/cert:rw"
-      "/mnt/containers/3x-ui/db/:/etc/x-ui:rw"
-    ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network=host"
-    ];
-  };
-  systemd.services."podman-3xui_app" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 90 "always";
-    };
-    partOf = [
-      "podman-compose-3x-ui-root.target"
-    ];
-    wantedBy = [
-      "podman-compose-3x-ui-root.target"
-    ];
-  };
-
-  # Builds
-  systemd.services."podman-build-3xui_app" = {
-    path = [
-      pkgs.podman
-      pkgs.git
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      TimeoutSec = 300;
-    };
-    script = ''
-      cd /mnt/containers/3x-ui
-      podman build -t compose2nix/3xui_app -f ./Dockerfile .
-    '';
-  };
-
-  # Root service
-  # When started, this will automatically create all resources and start
-  # the containers. When stopped, this will teardown all resources.
-  systemd.targets."podman-compose-3x-ui-root" = {
-    unitConfig = {
-      Description = "Root target generated by compose2nix.";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-}
@@ -1,16 +0,0 @@
-{
-  config,
-  pkgs,
-  inputs,
-  ...
-}:
-{
-  imports = [
-    ./3x-ui.nix
-  ];
-
-  environment.systemPackages = with pkgs; [
-    compose2nix
-    podman-tui
-  ];
-}
@@ -4,10 +4,17 @@
 }:
 {
  imports = [
-    ./containers
+    ../containers/3x-ui.nix
    ./nginx.nix
-    ./xray.nix
-    # ../services/uptime-kuma.nix
+    ./samba.nix
+    ./systemd.nix
+    # ./glances.nix
    # ./netbird.nix
+    # ./xray.nix
+  ];
+  systemd.tmpfiles.rules = [
+    "d /mnt 0755 root root -"
+    "d /mnt/services 0755 root root -"
+    "d /mnt/services/containers 0755 root root -"
  ];
 }
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    glances = {
+      enable = true;
+      openFirewall = true;
+      port = 61208;
+    };
+  };
+}
@@ -7,17 +7,17 @@
  services.netbird.server = {
    enable = false;
    enableNginx = true;
-    domain = "netbird.zeroq.ru";
+    domain = "netbird.zeroq.su";
    dashboard = {
      enable = false;
-      domain = "netbird.zeroq.ru";
+      domain = "netbird.zeroq.su";
      settings = {
        #AUTH_AUTHORITY = "nbp_ufe0v5mbb5H1lQWL8eJfuzJ5ItPmlM46Mik0";
      };
    };
    management = {
      enable = false;
-      domain = "netbird.zeroq.ru";
+      domain = "netbird.zeroq.su";
    };
  };

@@ -8,7 +8,7 @@ let
  server = "100.64.0.0";
 in
 {
-  environment.etc."nginx/pubray".text = inputs.zeroq-credentials.services.xray.auth;
+  # environment.etc."nginx/pubray".text = inputs.zeroq-credentials.services.xray.auth;
  users.users.nginx.extraGroups = [ "acme" ];
  services = {
    nginx = {
@@ -17,9 +17,9 @@ in
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
-      appendHttpConfig = inputs.zeroq-credentials.services.xray.maps;
+      # appendHttpConfig = inputs.zeroq-credentials.services.xray.maps;
      virtualHosts = {
-        # "pubray.zeroq.ru" = {
+        # "pubray.zeroq.su" = {
        #   enableACME = true;
        #   forceSSL = true;
        #   root = "${inputs.zeroq-credentials.services.xray.subs}";
@@ -33,7 +33,7 @@ in
        #     '';
        #   };
        # };
-        "x.zeroq.ru" = {
+        "x.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations = {
@@ -45,20 +45,57 @@ in
              proxyPass = "http://localhost:2096";
              proxyWebsockets = true;
            };
+            "/subsjs/" = {
+              proxyPass = "http://localhost:2096";
+              proxyWebsockets = true;
+            };
+            "/clash/" = {
+              proxyPass = "http://localhost:2096";
+              proxyWebsockets = true;
+            };
          };
        };
-        "kuma.zeroq.ru" = {
+        "kuma.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "http://${server}:4001";
            proxyWebsockets = true;
          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
        };
-        # "node-red.zeroq.ru" = {
+        "health.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:19999";
+            proxyWebsockets = true;
+          };
+        };
+        "git.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:3000";
+            proxyWebsockets = true;
+          };
+        };
+        "homebox.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:7745";
+            proxyWebsockets = true;
+          };
+        };
+        # "agent.zeroq.su" = {
+        #   forceSSL = true;
+        #   enableACME = true;
+        #   locations."/" = {
+        #     proxyPass = "http://${server}:3000";
+        #     proxyWebsockets = true;
+        #   };
+        # };
+        # "node-red.zeroq.su" = {
        #   forceSSL = true;
        #   enableACME = true;
        #   kTLS = true;
@@ -70,7 +107,7 @@ in
        #     client_max_body_size 5G;
        #   '';
        # };
-        "zeroq.ru" = {
+        "zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          root = pkgs.writeTextDir "index.html" ''
@@ -94,34 +131,66 @@ in
            # };
          };
        };
-        "flux.zeroq.ru" = {
+        "flux.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "http://${server}:6061";
            proxyWebsockets = true;
          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
        };
-        "office.zeroq.ru" = {
+        "vetymae.opencodes.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://100.86.62.4:4096";
+            proxyWebsockets = true;
+          };
+        };
+        "lamet.opencodes.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://100.106.21.39:6061";
+            proxyWebsockets = true;
+          };
+        };
+        "n8n.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:5678";
+            proxyWebsockets = true;
+          };
+        };
+        "office.zeroq.su" = {
          enableACME = true;
          forceSSL = true;
          locations = {
            "/" = {
-              proxyPass = "http://${server}:9980"; # API и coauthoring
+              proxyPass = "http://${server}:8090";
              proxyWebsockets = true;
            };
          };
-          extraConfig = ''
-            client_max_body_size 5G;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          ''; # absolute_redirect off;
+          # extraConfig = ''
+          #   client_max_body_size 5G;
+
+          #   proxy_http_version 1.1;
+          #   proxy_buffering off;
+
+          #   proxy_set_header Host $host;
+          #   proxy_set_header X-Forwarded-Host $host;
+          #   proxy_set_header X-Forwarded-Proto $scheme;
+          #   proxy_set_header X-Real-IP $remote_addr;
+          #   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+          #   proxy_set_header Authorization $http_authorization;
+
+          #   proxy_set_header Upgrade $http_upgrade;
+          #   proxy_set_header Connection "upgrade";
+          # ''; # absolute_redirect off;
        };
-        "immich.zeroq.ru" = {
+        "immich.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
@@ -132,7 +201,7 @@ in
            client_max_body_size 5G;
          '';
        };
-        "nextcloud.zeroq.ru" = {
+        "nextcloud.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations = {
@@ -149,7 +218,7 @@ in
            client_max_body_size 5G;
          '';
        };
-        "calibre.zeroq.ru" = {
+        "calibre.zeroq.su" = {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
@@ -160,18 +229,18 @@ in
            client_max_body_size 5G;
          '';
        };
-        # "pdf.zeroq.ru" = {
-        #   forceSSL = true;
-        #   enableACME = true;
-        #   locations."/" = {
-        #     proxyPass = "http://${server}:6060";
-        #     proxyWebsockets = true;
-        #   };
-        #   extraConfig = ''
-        #     client_max_body_size 5G;
-        #   '';
-        # };
-        # "ai.zeroq.ru" = {
+        "pdf.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:8446";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        # "ai.zeroq.su" = {
        #   forceSSL = true;
        #   enableACME = true;
        #   locations."/" = {
@@ -0,0 +1,56 @@
+{
+  config,
+  xlib,
+  ...
+}:
+{
+  services.samba = {
+    enable = true;
+    nmbd = {
+      enable = false;
+    };
+    settings = {
+      global = {
+        "invalid users" = [ ];
+        "passwd program" = "/run/wrappers/bin/passwd %u";
+        security = "user";
+      };
+      nixos = {
+        "path" = "/etc/nixos";
+        "browseable" = "yes";
+        "read only" = "no";
+        "valid users" = "${xlib.device.username}";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "create mask" = 755;
+        "directory mask" = 755;
+        "force user" = "${xlib.device.username}";
+        "force group" = "users";
+      };
+      root = {
+        "path" = "/";
+        "browseable" = "yes";
+        "read only" = "no";
+        "valid users" = "${xlib.device.username}";
+        "guest ok" = "no";
+        "writable" = "yes";
+        #"create mask" = 0644;
+        #"directory mask" = 0644;
+        "force user" = "root";
+        "force group" = "root";
+      };
+      "${xlib.device.username}" = {
+        "path" = "/home/${xlib.device.username}";
+        "browseable" = "yes";
+        "read only" = "no";
+        "valid users" = "${xlib.device.username}";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "create mask" = 700;
+        "directory mask" = 700;
+        "force user" = "${xlib.device.username}";
+        "force group" = "users";
+      };
+    };
+  };
+}
@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  serviceName = "rsync-services-sync";
+  serverAddress = "oqyude@100.64.0.0";
+  serverDir = "/mnt/services/nodes/vds";
+  nodeDir = "/mnt/services";
+in
+{
+  systemd = {
+    services = {
+      "${serviceName}" = {
+        description = "Bidirectional rsync";
+        unitConfig.RequiresMountsFor = [ ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        script = ''
+          set -euo pipefail
+
+          RSYNC="${pkgs.rsync}/bin/rsync"
+          SSH="${pkgs.openssh}/bin/ssh"
+
+          SSH_CMD="$SSH \
+            -o BatchMode=yes \
+            -o ConnectTimeout=5 \
+            -o StrictHostKeyChecking=no"
+
+          echo "Waiting for server..."
+
+          for i in $(seq 1 60); do
+            echo "Attempt $i"
+
+            if $SSH_CMD ${serverAddress} true >/dev/null 2>&1; then
+              echo "Server available"
+              break
+            fi
+
+            sleep 5
+          done
+
+          # final check
+          $SSH_CMD ${serverAddress} true >/dev/null 2>&1
+
+          mkdir -p "${nodeDir}"
+
+          if [ ! -d "${nodeDir}" ] || [ -z "$(ls -A "${nodeDir}")" ]; then
+            echo "Pull <- ${serverAddress}"
+
+            mkdir -p "${nodeDir}"
+
+            $RSYNC \
+              -e "$SSH_CMD" \
+              -a \
+              "${serverAddress}:${serverDir}/" \
+              "${nodeDir}/"
+          else
+            echo "Push -> ${serverAddress}"
+
+            $RSYNC \
+              -e "$SSH_CMD" \
+              -a \
+              --delete \
+              "${nodeDir}/" \
+              "${serverAddress}:${serverDir}/"
+          fi
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "root";
+          Nice = 10;
+          CPUQuota = "5%";
+          IOSchedulingClass = "idle";
+        };
+      };
+    };
+    timers = {
+      "${serviceName}" = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Persistent = true;
+          Unit = "${serviceName}.service";
+        };
+      };
+    };
+  };
+}
@@ -58,6 +58,7 @@
    environment = {
      "XRAY_VMESS_AEAD_FORCED" = "false";
      "XUI_ENABLE_FAIL2BAN" = "true";
+      "TZ" = "Europe/Moscow";
    };
    volumes = [
      "/mnt/containers/3x-ui/cert/:/root/cert:rw"
@@ -5,6 +5,10 @@
  ...
 }:
 {
+  imports = [
+    # ./3x-ui.nix
+  ];
+
  environment.systemPackages = with pkgs; [
    compose2nix
    podman-tui
@@ -1,15 +1,18 @@
 {
+  inputs,
  lib,
  pkgs,
  ...
 }:
 {
  imports = [
+    ../software/aichat.nix
    ../software/beets
    ../software/whisper.nix
-    ../software/aichat.nix
-    #../vds/docker.nix
-    #../services/tts.nix
+    ./containers
+    ./nix-serve.nix
+    ./tools
    #../server/open-webui.nix
+    #../services/tts.nix
  ];
 }
@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services = {
+    nix-serve = {
+      enable = true;
+      package = pkgs.nix-serve-ng;
+      openFirewall = true;
+      port = 5000;
+      bindAddress = "0.0.0.0";
+      secretKeyFile = config.sops.secrets.private-key.path;
+    };
+  };
+  sops.secrets = {
+    private-key = {
+      key = "private-key";
+      sopsFile = ./secrets/nix-serve.yaml;
+      mode = "0600";
+    };
+  };
+}
@@ -0,0 +1,16 @@
+private-key: ENC[AES256_GCM,data:VTj1cmhYLbBuUnIgtXI3CZtULaNZ5XOpoheJB0gUwrWrH5B0rmxcvZLlJWX7xhGs4oqcC3Wwmo+TBPhcgGylLVdCuhJG5A94UwOa9ZIV4s3x3IJ4RU3UcHTsA0xdtw7XxBfryw==,iv:8oZCojIU0JXWJgE5t+fNNW9trC109yOJp1UGAV76FbU=,tag:S74cHFy9B8C29npdcoVBeg==,type:str]
+sops:
+    age:
+        - recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6MHBkYzZneEdhUlN5MEpx
+            NGxud1BkVU1NUFdyVFE2VDJWb1M2cW9IcUVFCm9QZ3RvNHFaeWpFbnZ3Q1dKSDdn
+            RHQvUDgrZHRiUHpSR3FrWXRkQUxXWGMKLS0tIERsemNuL1BwR2xYYUpmbVFROWtN
+            RGI1WlRGMzlkS2tqQ0JPSFJHTUY1TUkKDeaivc+ST8MYtnJEDx07Y+IhtpvblR47
+            SLZf6WKQ8WNY4Bb5VeMWiCABPP/2L+VwoACqkOdZ01yGUVQSc9X6tw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-03T17:05:41Z"
+    mac: ENC[AES256_GCM,data:6jNp7N7lIvsLez3zQbDKTWPyvkL8u9g34I3q27GudgXzYw8B3Pb26jc9dCYCxCylCZxN5IeWWyHvUt4PadQABI4jrrIKnIfVV1A2c+A90chu+xSyE/B9OhkSC7yYVOnCURJPYku8799RIRkpHAWeKawkydbOiszCiC3qIKZDSTQ=,iv:xXivLDNnTABlNeWOOWsCESDUOnFv+9Lh0o029r7rk+A=,tag:vUoIZjcNtE3xJX/jNCao7Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
@@ -5,12 +5,12 @@
  ...
 }:
 {
-  imports = [
-    ./remnawave.nix
-  ];
-
  environment.systemPackages = with pkgs; [
-    compose2nix
-    podman-tui
+    gcc
+    gdb
+    cmake
+    gnumake
+
+    nlohmann_json
  ];
 }
@@ -1,3 +1,8 @@
-{ inputs, ... }:
+{
+  inputs,
+  ...
+}:
 self: super: {
+  rovr = inputs.self.packages.x86_64-linux.rovr;
+  pcbu-desktop = inputs.self.packages.x86_64-linux.pcbu-desktop;
 }
@@ -1,9 +1,17 @@
 { inputs, ... }@flakeContext:
 let
-  pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+  system = "x86_64-linux";
+  pkgs = import inputs.nixpkgs {
+    inherit system;
+    config = {
+      allowUnfree = true;
+    };
+  };
 in
 {
-  # packages."x86_64-linux" = {
-  #   immich = pkgs.callPackage ./immich/package.nix { };
-  # };
+  packages.${system} = {
+    rovr = pkgs.callPackage ./rovr { };
+    pcbu-desktop = pkgs.callPackage ./pcbu-desktop { };
+    # immich = pkgs.callPackage ./immich { };
+  };
 }
@@ -0,0 +1,54 @@
+{ pkgs }:
+
+let
+  pname = "pcbu-desktop";
+  version = "3.2.3";
+
+  src = pkgs.fetchurl {
+    url = "https://github.com/MeisApps/pcbu-desktop/releases/download/v${version}/PCBioUnlock-x64.AppImage";
+    sha256 = "sha256-+NxAm6vhMH51z6BscuFvaMidHN/3tNBR1g+i0q9hjWE=";
+  };
+
+in
+pkgs.appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs =
+    pkgs: with pkgs; [
+      glib
+      nss
+      nspr
+      libdrm
+      libGL
+      libxkbcommon
+      libX11
+      libXcursor
+      libXrandr
+      libXi
+      libXext
+      libXfixes
+      libXrender
+      libXtst
+      libxcrypt-legacy
+      gtk3
+      alsa-lib
+      at-spi2-atk
+      at-spi2-core
+      cups
+      dbus
+      expat
+      pango
+      cairo
+    ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share/applications
+    cat > $out/share/applications/${pname}.desktop <<EOF
+    [Desktop Entry]
+    Name=PCBU Desktop
+    Exec=${pname}
+    Type=Application
+    Categories=Utility;
+    EOF
+  '';
+}
@@ -0,0 +1,20 @@
+Для сервиса пригодится:
+
+```
+    hardware.bluetooth.enable = true;
+    services.dbus.enable = true;
+    networking.firewall.allowedUDPPorts = [ ... ];
+    networking.firewall.allowedTCPPorts = [ ... ];
+```
+
+---
+pcbu-desktop-3.2.3-fhsenv-rootfs> building '/nix/store/8q029crhzkqw1vqvjbnxvmpgpwfr9sk1-pcbu-desktop-3.2.3-fhsenv-rootfs.drv'
+pcbu-desktop-3.2.3-fhsenv-rootfs> structuredAttrs is enabled
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.locale? has path ?/system/locale/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.proxy? has path ?/system/proxy/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.proxy.http? has path ?/system/proxy/http/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.proxy.https? has path ?/system/proxy/https/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.proxy.ftp? has path ?/system/proxy/ftp/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-fhsenv-rootfs> Warning: Schema ?org.gnome.system.proxy.socks? has path ?/system/proxy/socks/?.  Paths starting with ?/apps/?, ?/desktop/? or ?/system/? are deprecated.
+pcbu-desktop-3.2.3-bwrap> building '/nix/store/6pzpm3vzia2jjfjizh8yx8v1n8l9apnr-pcbu-desktop-3.2.3-bwrap.drv'
+pcbu-desktop> building '/nix/store/9jrq44m27r427rfxvbn3ym7b4y6hnnha-pcbu-desktop-3.2.3.drv'
@@ -0,0 +1,74 @@
+{ pkgs }:
+
+let
+  python = pkgs.python314.override {
+    packageOverrides = self: super: {
+      textual = super.textual.overridePythonAttrs (old: rec {
+        version = "7.1.0";
+        src = super.fetchPypi {
+          pname = "textual";
+          inherit version;
+          sha256 = "sha256-PHFI7wCpJ3tF/Xihpq3HxBnEUdPtcUoLAVsW6qKopzs=";
+        };
+      });
+    };
+  };
+
+  py = python.pkgs;
+
+  textualDeps = with py; [
+    textual
+    textual-autocomplete
+    textual-image
+    textual-speedups
+  ];
+
+  pythonDeps = with py; [
+    ujson
+    prompt-toolkit
+    rich
+    fastjsonschema
+    humanize
+    natsort
+    pathvalidate
+    pdf2image
+    pillow
+    platformdirs
+    psutil
+    puremagic
+    rarfile
+    rich-click
+    send2trash
+    tomli
+  ];
+
+in
+
+py.buildPythonApplication rec {
+  pname = "rovr";
+  version = "0.7.0";
+
+  src = py.fetchPypi {
+    inherit pname version;
+    format = "wheel";
+    dist = "py3";
+    python = "py3";
+    abi = "none";
+    platform = "any";
+    sha256 = "sha256-CMj3jepLSA2bMcl2r89HY/ghPXEIpF5RohkBkLj6iNw=";
+  };
+
+  format = "wheel";
+
+  propagatedBuildInputs = pythonDeps ++ textualDeps;
+
+  nativeBuildInputs = [ pkgs.stdenv.cc.cc.lib ];
+
+  doCheck = false;
+
+  meta = with pkgs.lib; {
+    description = "Terminal file manager rovr";
+    homepage = "https://pypi.org/project/rovr/";
+    license = licenses.mit;
+  };
+}
Author	SHA1	Message	Date
oqyude	521d922961	nextcloud update	2026-07-16 23:34:06 +03:00
oqyude	e5e9dfd1de	samba fixup	2026-07-16 17:33:19 +03:00
oqyude	867a3227b8	calibre fixup	2026-07-16 01:14:47 +03:00
oqyude	7e8cc45a85	nix flake update	2026-07-16 00:14:03 +03:00
oqyude	69c53ccd65	fixup for onlyoffice (disabling)	2026-07-16 00:12:52 +03:00
oqyude	536bdf801e	homebox added	2026-07-15 23:08:18 +03:00
oqyude	9a2372caf8	nix flake update	2026-07-12 18:01:46 +03:00
oqyude	870f36ec9d	opencode serve on su	2026-07-10 11:17:45 +03:00
oqyude	85ea78b4b8	varlib reconfig	2026-07-08 12:55:40 +03:00
oqyude	6079ccc25a	nixpkgs unstable set	2026-07-07 12:19:07 +03:00
oqyude	5dd7a585a5	nix flake update	2026-07-06 01:56:06 +03:00
oqyude	7cbdd5860b	proxy-suite added	2026-07-04 23:33:33 +03:00
oqyude	f2740e87a0	node backup added	2026-07-04 22:54:38 +03:00
oqyude	d8300035cf	syncthing arpa	2026-07-03 21:15:55 +03:00
oqyude	1607482cb8	samba extend	2026-07-01 22:57:41 +03:00
oqyude	3ec5efb090	local dns test and chrony added	2026-06-29 23:03:17 +03:00
oqyude	e2e0e57918	new era dns	2026-06-24 11:44:13 +03:00
oqyude	0893ad28e7	new era nextcloud	2026-06-24 03:15:07 +03:00
oqyude	ee75c68ec3	dns fix	2026-06-24 02:30:55 +03:00
oqyude	ba7b36f16e	step-ca config	2026-06-24 00:15:03 +03:00
oqyude	c77915d0d1	nix flake update	2026-06-21 10:43:21 +03:00
oqyude	86e74f585a	dns-server setup	2026-06-17 12:25:24 +03:00
oqyude	3c3e3c75fb	n8n removed	2026-06-15 22:35:21 +03:00
oqyude	acd8b33a8b	coredns added	2026-06-14 22:10:22 +03:00
oqyude	624b63bc02	n8n added	2026-06-14 19:05:58 +03:00
oqyude	544aafd919	step-ca added	2026-06-14 01:59:39 +03:00
oqyude	6468c6583e	nix flake update	2026-06-13 00:11:38 +03:00
oqyude	b2b4883627	try to setup gitea	2026-06-10 12:38:23 +03:00
oqyude	ebd2e99066	try to fix onlyoffice now its working in lan)	2026-06-09 23:13:35 +03:00
oqyude	7514df3df3	cpp tools in wsl	2026-06-08 21:56:04 +03:00
oqyude	8ca46a632c	nix flake update	2026-06-05 16:50:35 +03:00
oqyude	aee5162344	nextcloud for lan	2026-06-04 20:40:17 +03:00
oqyude	b001652162	bentopdf added	2026-05-31 14:26:24 +03:00
oqyude	e0e908c79d	nix flake update	2026-05-30 18:15:23 +03:00
oqyude	f6027f7b9a	nix flake update	2026-05-25 20:18:58 +03:00
oqyude	4820c7d745	systemd units for rsync rewrite	2026-05-18 15:11:27 +03:00
oqyude	52e88c1da1	systemd-routine - prebuild	2026-05-18 14:19:51 +03:00
oqyude	98c923f98f	nix flake update	2026-05-16 12:40:20 +03:00
oqyude	cde8866383	win+space староверим)	2026-05-06 13:01:22 +03:00
oqyude	acf2452b84	beets env update	2026-05-06 12:39:54 +03:00
oqyude	81ab80c94a	fixes	2026-05-05 20:30:00 +03:00
oqyude	c752cb2e7f	pcbu-desktop try	2026-05-04 20:23:20 +03:00
oqyude	397bf49326	nix-serve added	2026-05-04 09:19:53 +03:00
oqyude	2df6ee7c3a	nix flake update and changed to nixos-unstable	2026-05-03 19:00:04 +03:00
oqyude	1d84fb7354	nix flake update	2026-05-02 11:27:32 +03:00
oqyude	86e20597a7	refact, beets 3.14py	2026-04-21 12:24:54 +03:00
oqyude	58d631c0fb	something	2026-04-17 20:46:49 +03:00
oqyude	da6aad4fcd	beets changes	2026-04-17 12:57:49 +03:00
oqyude	a319150b99	nix flake update	2026-04-17 11:56:10 +03:00
oqyude	94b7d30c02	syn ddos defence	2026-04-13 11:13:54 +03:00
oqyude	7f1f714e8c	glances added	2026-04-11 12:54:52 +03:00
oqyude	f5c6d40c89	systemd-mounts... lix frozen-removed, rovr frozen-removed	2026-04-10 14:07:07 +03:00
oqyude	fb1637c44e	nix flake update	2026-04-10 11:31:20 +03:00
oqyude	a5a2763f66	new domain	2026-04-10 10:57:20 +03:00
oqyude	bcd4bcffd5	beets fixed	2026-04-07 01:05:23 +03:00
oqyude	c17d01c3a1	nix flake update	2026-04-06 16:11:57 +03:00
oqyude	557351e27b	remnawave setup pause	2026-04-06 15:57:45 +03:00
oqyude	c4b52f942c	try to setup peerix and removed	2026-04-06 15:53:31 +03:00
oqyude	4d54a3b6fb	remnawave editing	2026-04-05 02:37:56 +03:00
oqyude	c3f8acad12	remnawave init	2026-04-05 02:28:14 +03:00
oqyude	cf77fa88bf	n8n enable	2026-04-01 12:50:28 +03:00
oqyude	efcb4232a5	try to setup onlyoffice	2026-03-31 01:47:42 +03:00
oqyude	5909a72654	sops and onlyoffice evolution	2026-03-30 15:50:00 +03:00
oqyude	7d731bd1c4	ref	2026-03-29 14:46:01 +03:00
oqyude	713bccc3b1	nix flake update	2026-03-29 12:57:26 +03:00
oqyude	c8c7c68c04	some fix	2026-03-27 17:56:12 +03:00
oqyude	6297df804e	nix flake update	2026-03-23 17:52:28 +03:00
oqyude	8797821d94	rovr package added	2026-03-16 23:22:18 +03:00
oqyude	6f278b36e7	disable unused	2026-03-16 18:22:17 +03:00
oqyude	ce19d10585	try to setup tuckr	2026-03-16 18:21:24 +03:00
oqyude	e7daeccb27	netdata enabled	2026-03-12 11:40:58 +03:00
oqyude	be816fe3bd	turn on swap	2026-03-10 15:43:16 +03:00
oqyude	af373baecc	refind is rofl 121 1 12 12 1 12 12 12 1 asd	2026-03-09 22:07:18 +03:00
oqyude	efa1ca2f0f	beets channel change	2026-03-09 20:06:00 +03:00
oqyude	e36db0e4ed	nix flake update	2026-03-09 19:44:12 +03:00
oqyude	a24f20cefb	unused flake inputs removed	2026-03-09 19:44:12 +03:00
oqyude	40d2d29055	refind bootloader appear	2026-03-09 19:44:12 +03:00
oqyude	3d3baf1780	try to setup fresh-editor, no result 1 1 1 1 1 12	2026-03-09 12:08:59 +03:00
oqyude	f1a81a6408	Init	2026-03-09 10:50:12 +03:00