feat: nextcloud 30 -> 31

At the end of the day, we are not going to self-host it

.envrc

@@ -0,0 +1,2 @@
+use nix
+watch_file deps/sources.json

.gitignore

@@ -0,0 +1,5 @@
+.pre-commit-config.yaml
+.direnv
+result
+result-*
+nixmoxer.conf

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Julien Malka
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,2 +1,24 @@
-# nix-config
+# Snowfield ❄ 
-My Machines configuration
+[![Build status](https://ci.julienmalka.me/badges/JulienMalka_snowfield_nix-eval.svg)](https://ci.julienmalka.me/#/builders/16) [![built with nix](https://img.shields.io/static/v1?logo=nixos&logoColor=white&label=&message=Built%20with%20Nix&color=41439a)](https://builtwithnix.org)
+
+This repository contains the configurations of my machines using NixOS. 
+
+### *What is NixOS ?*
+
+NixOS is a linux distribution based on the Nix package manager. It allows fully reproducible builds and a declarative configuration style, using a functionnal langage called Nix (yes, it is the same name as the package manager and the OS).
+
+Machines configurations are located in the machines folder, and are using all the custom modules defined in this project.
+
+#### Modules
+
+This configuration defines a number of custom NixOS and home-manager modules. They are respectively defined in the modules and home-manager-modules folders.
+
+#### Secrets
+
+Secrets are stored in the secrets folder. They are uncrypted upon system activation using the host ssh key. Secrets are managed using agenix.
+
+### Inspirations 
+
+This project is freely inspired by some really cool projects, including MayNiklas/nixos, pinox/nixos and ncfavier/config.
+
+

base.nix

@@ -1,20 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-
-  imports = [ ./users/julien.nix ];
-  luj.nix.enable = true;
-
-  time.timeZone = "Europe/Paris";
-    i18n.defaultLocale = "en_US.UTF-8";
-    console = {
-        font = "Lat2-Terminus16";
-        keyMap = "fr";
-    };
-
-   
-    services.openssh.enable = true;
-    programs.mosh.enable = true;
-    programs.gnupg.agent.enable = true;
-
-}

default.nix

@@ -0,0 +1,94 @@
+let
+  inputs = import ./lon.nix;
+  inputs_final = inputs;
+  dnsLib = (import inputs.dns).lib;
+  lib = (import "${inputs.nixpkgs}/lib").extend (import ./lib inputs_final self.profiles dnsLib);
+  mkLibForMachine =
+    machine:
+    (import "${lib.snowfield.${machine}.nixpkgs_version}/lib").extend (
+      import ./lib inputs_final self.profiles dnsLib
+    );
+  machines_plats = lib.lists.unique (
+    lib.mapAttrsToList (_name: value: value.arch) (
+      lib.filterAttrs (_n: v: builtins.hasAttr "arch" v) lib.snowfield
+    )
+  );
+
+  nixpkgs_plats = builtins.listToAttrs (
+    builtins.map (plat: {
+      name = plat;
+      value = import inputs.nixpkgs { system = plat; };
+    }) machines_plats
+  );
+  self = rec {
+
+    nixosModules = builtins.listToAttrs (
+      map (x: {
+        name = x;
+        value = import (./modules + "/${x}");
+      }) (builtins.attrNames (builtins.readDir ./modules))
+    );
+
+    profiles = builtins.listToAttrs (
+      map (x: {
+        name = lib.strings.removeSuffix ".nix" x;
+        value = import (./profiles + "/${x}");
+      }) (builtins.attrNames (builtins.readDir ./profiles))
+    );
+
+    nixosConfigurations = builtins.mapAttrs (
+      name: value:
+      (lib.mkMachine {
+        inherit name self dnsLib;
+        host-config = value;
+        modules = builtins.attrValues nixosModules ++ lib.snowfield.${name}.profiles;
+        nixpkgs = lib.snowfield.${name}.nixpkgs_version;
+        system = lib.snowfield.${name}.arch;
+        home-manager = lib.snowfield.${name}.hm_version;
+      })
+    ) (lib.importConfig ./machines);
+
+    colmena = {
+      meta = {
+        nodeNixpkgs = builtins.mapAttrs (
+          n: _: import lib.snowfield.${n}.nixpkgs_version
+        ) nixosConfigurations;
+        nodeSpecialArgs = builtins.mapAttrs (
+          n: v: v._module.specialArgs // { lib = mkLibForMachine n; }
+        ) nixosConfigurations;
+      };
+    } // builtins.mapAttrs (_: v: { imports = v._module.args.modules; }) nixosConfigurations;
+
+    packages = builtins.listToAttrs (
+      builtins.map (plat: {
+        name = plat;
+        value =
+          lib.filterAttrs
+            (
+              _name: value:
+              (
+                !lib.hasAttrByPath [
+                  "meta"
+                  "platforms"
+                ] value
+              )
+              || builtins.elem plat value.meta.platforms
+            )
+            (
+              builtins.listToAttrs (
+                builtins.map (e: {
+                  name = e;
+                  value = nixpkgs_plats.${plat}.callPackage (./packages + "/${e}") { };
+                }) (builtins.attrNames (builtins.readDir ./packages))
+              )
+            );
+      }) machines_plats
+    );
+
+    checks = {
+      inherit packages;
+      machines = lib.mapAttrs (_: v: v.config.system.build.toplevel) nixosConfigurations;
+    };
+  };
+in
+self

flake.lock

@@ -1,237 +0,0 @@
-{
-  "nodes": {
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1627913399,
-        "narHash": "sha256-hY8g6H2KFL8ownSiFeMOjwPC8P0ueXpCVEbxgda3pko=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "12c64ca55c1014cdc1b16ed5a804aa8576601ff2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "locked": {
-        "lastModified": 1629481132,
-        "narHash": "sha256-JHgasjPR0/J1J3DRm4KxM4zTyAj4IOJY8vIl75v/kPI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "997f7efcb746a9c140ce1f13c72263189225f482",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1640037534,
-        "narHash": "sha256-lbD5EEqu2tXq3qo6UN3cZkWZA0hEWQkhluctivMtLZY=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "aef97988dac0541747de8bcc85c7e27726eea4af",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "homepage": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1639518131,
-        "narHash": "sha256-YuwHCXEbrzuEyRy1/2bX4Rux/nqmzRZ8H44+83JQNV8=",
-        "owner": "JulienMalka",
-        "repo": "homepage",
-        "rev": "29e779d8600b1c1e6235570a3614a54f8ec8126e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "JulienMalka",
-        "repo": "homepage",
-        "type": "github"
-      }
-    },
-    "neovim-flake": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "dir": "contrib",
-        "lastModified": 1640040739,
-        "narHash": "sha256-uuG7GM/N5T+cOpJ55+NnWCC+GhzGQElIIUUELY13WII=",
-        "owner": "neovim",
-        "repo": "neovim",
-        "rev": "1062ea2cc532b32862346a1972073f1a8dd6d19d",
-        "type": "github"
-      },
-      "original": {
-        "dir": "contrib",
-        "owner": "neovim",
-        "repo": "neovim",
-        "type": "github"
-      }
-    },
-    "neovim-nightly-overlay": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "neovim-flake": "neovim-flake",
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1640074481,
-        "narHash": "sha256-AY6pRenvEJamWWYV+WfkEmF5KN+SNUjhj7EOaqEEGf0=",
-        "owner": "nix-community",
-        "repo": "neovim-nightly-overlay",
-        "rev": "d69c7f42edb31bf839373cabb8e834aab85b338c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "neovim-nightly-overlay",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1640053112,
-        "narHash": "sha256-7C0UQssCdAMyCNSv8szLJfZ5xYMBr9mh27zYUmo8wHQ=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "c478eaf416411a7dedf773185b6d5bfc966a80ae",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1639966735,
-        "narHash": "sha256-FmVGFiyqE+pjQUTCTY0H75hqrnBnbEf3VVRB4dsd4KI=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "d87b72206aadebe6722944f541f55d33fd7046fb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1640077788,
-        "narHash": "sha256-YMSDk3hlucJTTARaHNOeQEF6zEW3A/x4sXgrz94VbS0=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9ab7d12287ced0e1b4c03b61c781901f178d9d77",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-21.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1638097282,
-        "narHash": "sha256-EXCzj9b8X/lqDPJapxZThIOKL5ASbpsJZ+8L1LnY1ig=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "78cb77b29d37a9663e05b61abb4fa09465da4b70",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nur": {
-      "locked": {
-        "lastModified": 1640109122,
-        "narHash": "sha256-IlbvQ+Grm8+qAEYW+a111+NsMeosjFF6GwYTSRXHOKk=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "b9810aabbd64485f31bea99096af5fae26177689",
-        "type": "github"
-      },
-      "original": {
-        "id": "nur",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "home-manager": "home-manager",
-        "homepage": "homepage",
-        "neovim-nightly-overlay": "neovim-nightly-overlay",
-        "nixpkgs": "nixpkgs_3",
-        "nur": "nur",
-        "sops-nix": "sops-nix",
-        "unstable": "unstable"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_4"
-      },
-      "locked": {
-        "lastModified": 1638821683,
-        "narHash": "sha256-oyqALhGijy2ZQxFSACrcC+Z8MzYLiomKCr9FQXVZ47U=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "afe00100b16648c1d79e62926caacac561df93a5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
-    "unstable": {
-      "locked": {
-        "lastModified": 1640053112,
-        "narHash": "sha256-7C0UQssCdAMyCNSv8szLJfZ5xYMBr9mh27zYUmo8wHQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c478eaf416411a7dedf773185b6d5bfc966a80ae",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,48 +0,0 @@
-{
-  description = "A flake for my personnal configurations";
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-21.11";
-
-    home-manager = {
-      url = "github:nix-community/home-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    neovim-nightly-overlay = {
-      url = "github:nix-community/neovim-nightly-overlay";
-    };
-    homepage = {
-      url = "github:JulienMalka/homepage";
-      flake = false;
-    };
-
-    unstable = {
-      url = "github:NixOS/nixpkgs/nixos-unstable";
-    };
-
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-    };
-      
-  };
-
-  outputs = { self, home-manager, nixpkgs, unstable, sops-nix, neovim-nightly-overlay, nur, ... }@inputs:
-    let
-      utils = import ./utils.nix { inherit nixpkgs sops-nix home-manager inputs; nixpkgs-unstable = unstable; };
-    in
-    with utils;
-    {
-      nixosModules = builtins.listToAttrs (map
-        (x: {
-          name = x;
-          value = import (./modules + "/${x}");
-        })
-        (builtins.attrNames (builtins.readDir ./modules)));
-
-       nixosConfigurations = builtins.mapAttrs (name: value: (mkMachine name value self.nixosModules)) (importConfig ./machines);
-       hydraJobs = (nixpkgs.lib.mapAttrs' (name: config:
-        nixpkgs.lib.nameValuePair "nixos-${name}"
-        config.config.system.build.toplevel) self.nixosConfigurations);
-
-    };
-}

hive.nix

@@ -0,0 +1 @@
+let outputs = import ./.; in outputs.colmena

home-manager-modules/alacritty/config

@@ -0,0 +1,990 @@
+# Configuration for Alacritty, the GPU enhanced terminal emulator.
+
+# Import additional configuration files
+#
+# Imports are loaded in order, skipping all missing files, with the importing
+# file being loaded last. If a field is already present in a previous import, it
+# will be replaced.
+#
+# All imports must either be absolute paths starting with `/`, or paths relative
+# to the user's home directory starting with `~/`.
+#import:
+#  - /path/to/alacritty.yml
+
+# Any items in the `env` entry below will be added as
+# environment variables. Some entries may override variables
+# set by alacritty itself.
+
+
+env:
+  TERM: xterm-256color
+
+#env:
+  # TERM variable
+  #
+  # This value is used to set the `$TERM` environment variable for
+  # each instance of Alacritty. If it is not present, alacritty will
+  # check the local terminfo database and use `alacritty` if it is
+  # available, otherwise `xterm-256color` is used.
+  #TERM: alacritty
+
+window:
+  # Window dimensions (changes require restart)
+  #
+  # Number of lines/columns (not pixels) in the terminal. Both lines and columns
+  # must be non-zero for this to take effect. The number of columns must be at
+  # least `2`, while using a value of `0` for columns and lines will fall back
+  # to the window manager's recommended size
+  #dimensions:
+  #  columns: 0
+  #  lines: 0
+
+  # Window position (changes require restart)
+  #
+  # Specified in number of pixels.
+  # If the position is not set, the window manager will handle the placement.
+  #position:
+  #  x: 0
+  #  y: 0
+
+  # Window padding (changes require restart)
+  #
+  # Blank space added around the window in pixels. This padding is scaled
+  # by DPI and the specified value is always added at both opposing sides.
+  padding:
+    x: 10
+    y: 10
+
+  # Spread additional padding evenly around the terminal content.
+  #dynamic_padding: false
+
+  # Window decorations
+  #
+  # Values for `decorations`:
+  #     - full: Borders and title bar
+  #     - none: Neither borders nor title bar
+  #
+  # Values for `decorations` (macOS only):
+  #     - transparent: Title bar, transparent background and title bar buttons
+  #     - buttonless: Title bar, transparent background and no title bar buttons
+  #decorations: full
+
+  # Background opacity
+  #
+  # Window opacity as a floating point number from `0.0` to `1.0`.
+  # The value `0.0` is completely transparent and `1.0` is opaque.
+  #opacity: 1.0
+
+  # Startup Mode (changes require restart)
+  #
+  # Values for `startup_mode`:
+  #   - Windowed
+  #   - Maximized
+  #   - Fullscreen
+  #
+  # Values for `startup_mode` (macOS only):
+  #   - SimpleFullscreen
+  #startup_mode: Windowed
+
+  # Window title
+  #title: Alacritty
+
+  # Allow terminal applications to change Alacritty's window title.
+  #dynamic_title: true
+
+  # Window class (Linux/BSD only):
+  #class:
+    # Application instance name
+    #instance: Alacritty
+    # General application class
+    #general: Alacritty
+
+  # Decorations theme variant
+  #
+  # Override the variant of the System theme/GTK theme/Wayland client side
+  # decorations. Commonly supported values are `Dark`, `Light`, and `None` for
+  # auto pick-up. Set this to `None` to use the default theme variant.
+  #decorations_theme_variant: None
+
+  # Make `Option` key behave as `Alt` (macOS only):
+  #   - OnlyLeft
+  #   - OnlyRight
+  #   - Both
+  #   - None (default)
+  #option_as_alt: None
+
+#scrolling:
+  # Maximum number of lines in the scrollback buffer.
+  # Specifying '0' will disable scrolling.
+  #history: 10000
+
+  # Scrolling distance multiplier.
+  #multiplier: 3
+
+# Font configuration
+font:
+   #Normal (roman) font face
+  normal:
+    # Font family
+    #
+    # Default:
+    #   - (macOS) Menlo
+    #   - (Linux/BSD) monospace
+    #   - (Windows) Consolas
+    family: Fira Code
+
+    # The `style` can be specified to pick a specific face.
+    style: Regular
+
+  # Bold font face
+  bold:
+    # Font family
+    #
+    # If the bold family is not specified, it will fall back to the
+    # value specified for the normal font.
+    #family: monospace
+
+    # The `style` can be specified to pick a specific face.
+    style: Bold
+
+  # Italic font face
+  italic:
+    # Font family
+    #
+    # If the italic family is not specified, it will fall back to the
+    # value specified for the normal font.
+    #family: monospace
+
+    # The `style` can be specified to pick a specific face.
+    style: Italic
+
+  # Bold italic font face
+  #bold_italic:
+    # Font family
+    #
+    # If the bold italic family is not specified, it will fall back to the
+    # value specified for the normal font.
+    #family: monospace
+
+    # The `style` can be specified to pick a specific face.
+    #style: Bold Italic
+
+  # Point size
+  size: 10.0
+
+  # Offset is the extra space around each character. `offset.y` can be thought
+  # of as modifying the line spacing, and `offset.x` as modifying the letter
+  # spacing.
+  #offset:
+  #  x: 0
+  #  y: 0
+
+  # Glyph offset determines the locations of the glyphs within their cells with
+  # the default being at the bottom. Increasing `x` moves the glyph to the
+  # right, increasing `y` moves the glyph upward.
+  #glyph_offset:
+  #  x: 0
+  #  y: 0
+
+  # Use built-in font for box drawing characters.
+  #
+  # If `true`, Alacritty will use a custom built-in font for box drawing
+  # characters (Unicode points 2500 - 259f).
+  #
+  #builtin_box_drawing: true
+
+# If `true`, bold text is drawn using the bright color variants.
+#draw_bold_text_with_bright_colors: false
+
+# Colors (Tomorrow Night)
+#colors:
+  # Default colors
+  #primary:
+  #  background: '#1d1f21'
+  #  foreground: '#c5c8c6'
+
+    # Bright and dim foreground colors
+    #
+    # The dimmed foreground color is calculated automatically if it is not
+    # present. If the bright foreground color is not set, or
+    # `draw_bold_text_with_bright_colors` is `false`, the normal foreground
+    # color will be used.
+    #dim_foreground: '#828482'
+    #bright_foreground: '#eaeaea'
+
+  # Cursor colors
+  #
+  # Colors which should be used to draw the terminal cursor.
+  #
+  # Allowed values are CellForeground/CellBackground, which reference the
+  # affected cell, or hexadecimal colors like #ff00ff.
+  #cursor:
+  #  text: CellBackground
+  #  cursor: CellForeground
+
+  # Vi mode cursor colors
+  #
+  # Colors for the cursor when the vi mode is active.
+  #
+  # Allowed values are CellForeground/CellBackground, which reference the
+  # affected cell, or hexadecimal colors like #ff00ff.
+  #vi_mode_cursor:
+  #  text: CellBackground
+  #  cursor: CellForeground
+
+  # Search colors
+  #
+  # Colors used for the search bar and match highlighting.
+  #search:
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
+    #matches:
+    #  foreground: '#000000'
+    #  background: '#ffffff'
+    #focused_match:
+    #  foreground: '#ffffff'
+    #  background: '#000000'
+
+  # Keyboard hints
+  #hints:
+    # First character in the hint label
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
+    #start:
+    #  foreground: '#1d1f21'
+    #  background: '#e9ff5e'
+
+    # All characters after the first one in the hint label
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
+    #end:
+    #  foreground: '#e9ff5e'
+    #  background: '#1d1f21'
+
+  # Line indicator
+  #
+  # Color used for the indicator displaying the position in history during
+  # search and vi mode.
+  #
+  # By default, these will use the opposing primary color.
+  #line_indicator:
+  #  foreground: None
+  #  background: None
+
+  # Footer bar
+  #
+  # Color used for the footer bar on the bottom, used by search regex input,
+  # hyperlink URI preview, etc.
+  #
+  #footer_bar:
+  #  background: '#c5c8c6'
+  #  foreground: '#1d1f21'
+
+  # Selection colors
+  #
+  # Colors which should be used to draw the selection area.
+  #
+  # Allowed values are CellForeground/CellBackground, which reference the
+  # affected cell, or hexadecimal colors like #ff00ff.
+  #selection:
+  #  text: CellBackground
+  #  background: CellForeground
+
+  # Normal colors
+  #normal:
+  #  black:   '#1d1f21'
+  #  red:     '#cc6666'
+  #  green:   '#b5bd68'
+  #  yellow:  '#f0c674'
+  #  blue:    '#81a2be'
+  #  magenta: '#b294bb'
+  #  cyan:    '#8abeb7'
+  #  white:   '#c5c8c6'
+
+  # Bright colors
+  #bright:
+  #  black:   '#666666'
+  #  red:     '#d54e53'
+  #  green:   '#b9ca4a'
+  #  yellow:  '#e7c547'
+  #  blue:    '#7aa6da'
+  #  magenta: '#c397d8'
+  #  cyan:    '#70c0b1'
+  #  white:   '#eaeaea'
+
+  # Dim colors
+  #
+  # If the dim colors are not set, they will be calculated automatically based
+  # on the `normal` colors.
+  #dim:
+  #  black:   '#131415'
+  #  red:     '#864343'
+  #  green:   '#777c44'
+  #  yellow:  '#9e824c'
+  #  blue:    '#556a7d'
+  #  magenta: '#75617b'
+  #  cyan:    '#5b7d78'
+  #  white:   '#828482'
+
+  # Indexed Colors
+  #
+  # The indexed colors include all colors from 16 to 256.
+  # When these are not set, they're filled with sensible defaults.
+  #
+  # Example:
+  #   `- { index: 16, color: '#ff00ff' }`
+  #
+  #indexed_colors: []
+
+  # Transparent cell backgrounds
+  #
+  # Whether or not `window.opacity` applies to all cell backgrounds or only to
+  # the default background. When set to `true` all cells will be transparent
+  # regardless of their background color.
+  #transparent_background_colors: false
+
+# Bell
+#
+# The bell is rung every time the BEL control character is received.
+#bell:
+  # Visual Bell Animation
+  #
+  # Animation effect for flashing the screen when the visual bell is rung.
+  #
+  # Values for `animation`:
+  #   - Ease
+  #   - EaseOut
+  #   - EaseOutSine
+  #   - EaseOutQuad
+  #   - EaseOutCubic
+  #   - EaseOutQuart
+  #   - EaseOutQuint
+  #   - EaseOutExpo
+  #   - EaseOutCirc
+  #   - Linear
+  #animation: EaseOutExpo
+
+  # Duration of the visual bell flash in milliseconds. A `duration` of `0` will
+  # disable the visual bell animation.
+  #duration: 0
+
+  # Visual bell animation color.
+  #color: '#ffffff'
+
+  # Bell Command
+  #
+  # This program is executed whenever the bell is rung.
+  #
+  # When set to `command: None`, no command will be executed.
+  #
+  # Example:
+  #   command:
+  #     program: notify-send
+  #     args: ["Hello, World!"]
+  #
+  #command: None
+
+#selection:
+  # This string contains all characters that are used as separators for
+  # "semantic words" in Alacritty.
+  #semantic_escape_chars: ",│`|:\"' ()[]{}<>\t"
+
+  # When set to `true`, selected text will be copied to the primary clipboard.
+  #save_to_clipboard: false
+
+#cursor:
+  # Cursor style
+  #style:
+    # Cursor shape
+    #
+    # Values for `shape`:
+    #   - ▇ Block
+    #   - _ Underline
+    #   - | Beam
+    #shape: Block
+
+    # Cursor blinking state
+    #
+    # Values for `blinking`:
+    #   - Never: Prevent the cursor from ever blinking
+    #   - Off: Disable blinking by default
+    #   - On: Enable blinking by default
+    #   - Always: Force the cursor to always blink
+    #blinking: Off
+
+  # Vi mode cursor style
+  #
+  # If the vi mode cursor style is `None` or not specified, it will fall back to
+  # the style of the active value of the normal cursor.
+  #
+  # See `cursor.style` for available options.
+  #vi_mode_style: None
+
+  # Cursor blinking interval in milliseconds.
+  #blink_interval: 750
+
+  # Time after which cursor stops blinking, in seconds.
+  #
+  # Specifying '0' will disable timeout for blinking.
+  #blink_timeout: 5
+
+  # If this is `true`, the cursor will be rendered as a hollow box when the
+  # window is not focused.
+  #unfocused_hollow: true
+
+  # Thickness of the cursor relative to the cell width as floating point number
+  # from `0.0` to `1.0`.
+  #thickness: 0.15
+
+# Live config reload (changes require restart)
+#live_config_reload: true
+
+# Shell
+#
+# You can set `shell.program` to the path of your favorite shell, e.g.
+# `/bin/fish`. Entries in `shell.args` are passed unmodified as arguments to the
+# shell.
+#
+# Default:
+#   - (Linux/BSD/macOS) `$SHELL` or the user's login shell, if `$SHELL` is unset
+#   - (Windows) powershell
+#shell:
+#  program: /bin/bash
+#  args:
+#    - --login
+
+# Startup directory
+#
+# Directory the shell is started in. If this is unset, or `None`, the working
+# directory of the parent process will be used.
+#working_directory: None
+
+# Offer IPC using `alacritty msg` (unix only)
+#ipc_socket: true
+
+#mouse:
+  # Click settings
+  #
+  # The `double_click` and `triple_click` settings control the time
+  # alacritty should wait for accepting multiple clicks as one double
+  # or triple click.
+  #double_click: { threshold: 300 }
+  #triple_click: { threshold: 300 }
+
+  # If this is `true`, the cursor is temporarily hidden when typing.
+  #hide_when_typing: false
+
+# Hints
+#
+# Terminal hints can be used to find text or hyperlink in the visible part of
+# the terminal and pipe it to other applications.
+#hints:
+  # Keys used for the hint labels.
+  #alphabet: "jfkdls;ahgurieowpq"
+
+  # List with all available hints
+  #
+  # Each hint must have any of `regex` or `hyperlinks` field and either an
+  # `action` or a `command` field. The fields `mouse`, `binding` and
+  # `post_processing` are optional.
+  #
+  # The `hyperlinks` option will cause OSC 8 escape sequence hyperlinks to be
+  # highlighted.
+  #
+  # The fields `command`, `binding.key`, `binding.mods`, `binding.mode` and
+  # `mouse.mods` accept the same values as they do in the `key_bindings` section.
+  #
+  # The `mouse.enabled` field controls if the hint should be underlined while
+  # the mouse with all `mouse.mods` keys held or the vi mode cursor is above it.
+  #
+  # If the `post_processing` field is set to `true`, heuristics will be used to
+  # shorten the match if there are characters likely not to be part of the hint
+  # (e.g. a trailing `.`). This is most useful for URIs and applies only to
+  # `regex` matches.
+  #
+  # Values for `action`:
+  #   - Copy
+  #       Copy the hint's text to the clipboard.
+  #   - Paste
+  #       Paste the hint's text to the terminal or search.
+  #   - Select
+  #       Select the hint's text.
+  #   - MoveViModeCursor
+  #       Move the vi mode cursor to the beginning of the hint.
+  #enabled:
+  # - regex: "(ipfs:|ipns:|magnet:|mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)\
+  #           [^\u0000-\u001F\u007F-\u009F<>\"\\s{-}\\^⟨⟩`]+"
+  #   hyperlinks: true
+  #   command: xdg-open
+  #   post_processing: true
+  #   mouse:
+  #     enabled: true
+  #     mods: None
+  #   binding:
+  #     key: U
+  #     mods: Control|Shift
+
+# Mouse bindings
+#
+# Mouse bindings are specified as a list of objects, much like the key
+# bindings further below.
+#
+# To trigger mouse bindings when an application running within Alacritty
+# captures the mouse, the `Shift` modifier is automatically added as a
+# requirement.
+#
+# Each mouse binding will specify a:
+#
+# - `mouse`:
+#
+#   - Middle
+#   - Left
+#   - Right
+#   - Numeric identifier such as `5`
+#
+# - `action` (see key bindings for actions not exclusive to mouse mode)
+#
+# - Mouse exclusive actions:
+#
+#   - ExpandSelection
+#       Expand the selection to the current mouse cursor location.
+#
+# And optionally:
+#
+# - `mods` (see key bindings)
+#mouse_bindings:
+#  - { mouse: Right,                 action: ExpandSelection }
+#  - { mouse: Right,  mods: Control, action: ExpandSelection }
+#  - { mouse: Middle, mode: ~Vi,     action: PasteSelection  }
+
+# Key bindings
+#
+# Key bindings are specified as a list of objects. For example, this is the
+# default paste binding:
+#
+# `- { key: V, mods: Control|Shift, action: Paste }`
+#
+# Each key binding will specify a:
+#
+# - `key`: Identifier of the key pressed
+#
+#    - A-Z
+#    - F1-F24
+#    - Key0-Key9
+#
+#    A full list with available key codes can be found here:
+#    https://docs.rs/winit/*/winit/event/enum.VirtualKeyCode.html#variants
+#
+#    Instead of using the name of the keys, the `key` field also supports using
+#    the scancode of the desired key. Scancodes have to be specified as a
+#    decimal number. This command will allow you to display the hex scancodes
+#    for certain keys:
+#
+#       `showkey --scancodes`.
+#
+# Then exactly one of:
+#
+# - `chars`: Send a byte sequence to the running application
+#
+#    The `chars` field writes the specified string to the terminal. This makes
+#    it possible to pass escape sequences. To find escape codes for bindings
+#    like `PageUp` (`"\x1b[5~"`), you can run the command `showkey -a` outside
+#    of tmux. Note that applications use terminfo to map escape sequences back
+#    to keys. It is therefore required to update the terminfo when changing an
+#    escape sequence.
+#
+# - `action`: Execute a predefined action
+#
+#   - ToggleViMode
+#   - SearchForward
+#       Start searching toward the right of the search origin.
+#   - SearchBackward
+#       Start searching toward the left of the search origin.
+#   - Copy
+#   - Paste
+#   - IncreaseFontSize
+#   - DecreaseFontSize
+#   - ResetFontSize
+#   - ScrollPageUp
+#   - ScrollPageDown
+#   - ScrollHalfPageUp
+#   - ScrollHalfPageDown
+#   - ScrollLineUp
+#   - ScrollLineDown
+#   - ScrollToTop
+#   - ScrollToBottom
+#   - ClearHistory
+#       Remove the terminal's scrollback history.
+#   - Hide
+#       Hide the Alacritty window.
+#   - Minimize
+#       Minimize the Alacritty window.
+#   - Quit
+#       Quit Alacritty.
+#   - ToggleFullscreen
+#   - SpawnNewInstance
+#       Spawn a new instance of Alacritty.
+#   - CreateNewWindow
+#       Create a new Alacritty window from the current process.
+#   - ClearLogNotice
+#       Clear Alacritty's UI warning and error notice.
+#   - ClearSelection
+#       Remove the active selection.
+#   - ReceiveChar
+#   - None
+#
+# - Vi mode exclusive actions:
+#
+#   - Open
+#       Perform the action of the first matching hint under the vi mode cursor
+#       with `mouse.enabled` set to `true`.
+#   - ToggleNormalSelection
+#   - ToggleLineSelection
+#   - ToggleBlockSelection
+#   - ToggleSemanticSelection
+#       Toggle semantic selection based on `selection.semantic_escape_chars`.
+#   - CenterAroundViCursor
+#       Center view around vi mode cursor
+#
+# - Vi mode exclusive cursor motion actions:
+#
+#   - Up
+#       One line up.
+#   - Down
+#       One line down.
+#   - Left
+#       One character left.
+#   - Right
+#       One character right.
+#   - First
+#       First column, or beginning of the line when already at the first column.
+#   - Last
+#       Last column, or beginning of the line when already at the last column.
+#   - FirstOccupied
+#       First non-empty cell in this terminal row, or first non-empty cell of
+#       the line when already at the first cell of the row.
+#   - High
+#       Top of the screen.
+#   - Middle
+#       Center of the screen.
+#   - Low
+#       Bottom of the screen.
+#   - SemanticLeft
+#       Start of the previous semantically separated word.
+#   - SemanticRight
+#       Start of the next semantically separated word.
+#   - SemanticLeftEnd
+#       End of the previous semantically separated word.
+#   - SemanticRightEnd
+#       End of the next semantically separated word.
+#   - WordLeft
+#       Start of the previous whitespace separated word.
+#   - WordRight
+#       Start of the next whitespace separated word.
+#   - WordLeftEnd
+#       End of the previous whitespace separated word.
+#   - WordRightEnd
+#       End of the next whitespace separated word.
+#   - Bracket
+#       Character matching the bracket at the cursor's location.
+#   - SearchNext
+#       Beginning of the next match.
+#   - SearchPrevious
+#       Beginning of the previous match.
+#   - SearchStart
+#       Start of the match to the left of the vi mode cursor.
+#   - SearchEnd
+#       End of the match to the right of the vi mode cursor.
+#
+# - Search mode exclusive actions:
+#   - SearchFocusNext
+#       Move the focus to the next search match.
+#   - SearchFocusPrevious
+#       Move the focus to the previous search match.
+#   - SearchConfirm
+#   - SearchCancel
+#   - SearchClear
+#       Reset the search regex.
+#   - SearchDeleteWord
+#       Delete the last word in the search regex.
+#   - SearchHistoryPrevious
+#       Go to the previous regex in the search history.
+#   - SearchHistoryNext
+#       Go to the next regex in the search history.
+#
+# - macOS exclusive actions:
+#   - ToggleSimpleFullscreen
+#       Enter fullscreen without occupying another space.
+#
+# - Linux/BSD exclusive actions:
+#
+#   - CopySelection
+#       Copy from the selection buffer.
+#   - PasteSelection
+#       Paste from the selection buffer.
+#
+# - `command`: Fork and execute a specified command plus arguments
+#
+#    The `command` field must be a map containing a `program` string and an
+#    `args` array of command line parameter strings. For example:
+#       `{ program: "alacritty", args: ["-e", "vttest"] }`
+#
+# And optionally:
+#
+# - `mods`: Key modifiers to filter binding actions
+#
+#    - Command
+#    - Control
+#    - Option
+#    - Super
+#    - Shift
+#    - Alt
+#
+#    Multiple `mods` can be combined using `|` like this:
+#       `mods: Control|Shift`.
+#    Whitespace and capitalization are relevant and must match the example.
+#
+# - `mode`: Indicate a binding for only specific terminal reported modes
+#
+#    This is mainly used to send applications the correct escape sequences
+#    when in different modes.
+#
+#    - AppCursor
+#    - AppKeypad
+#    - Search
+#    - Alt
+#    - Vi
+#
+#    A `~` operator can be used before a mode to apply the binding whenever
+#    the mode is *not* active, e.g. `~Alt`.
+#
+# Bindings are always filled by default, but will be replaced when a new
+# binding with the same triggers is defined. To unset a default binding, it can
+# be mapped to the `ReceiveChar` action. Alternatively, you can use `None` for
+# a no-op if you do not wish to receive input characters for that binding.
+#
+# If the same trigger is assigned to multiple actions, all of them are executed
+# in the order they were defined in.
+#key_bindings:
+  #- { key: Paste,                                       action: Paste          }
+  #- { key: Copy,                                        action: Copy           }
+  #- { key: L,         mods: Control,                    action: ClearLogNotice }
+  #- { key: L,         mods: Control, mode: ~Vi|~Search, chars: "\x0c"          }
+  #- { key: PageUp,    mods: Shift,   mode: ~Alt,        action: ScrollPageUp   }
+  #- { key: PageDown,  mods: Shift,   mode: ~Alt,        action: ScrollPageDown }
+  #- { key: Home,      mods: Shift,   mode: ~Alt,        action: ScrollToTop    }
+  #- { key: End,       mods: Shift,   mode: ~Alt,        action: ScrollToBottom }
+
+  # Vi Mode
+  #- { key: Space,  mods: Shift|Control, mode: ~Search,    action: ToggleViMode            }
+  #- { key: Space,  mods: Shift|Control, mode: Vi|~Search, action: ScrollToBottom          }
+  #- { key: Escape,                      mode: Vi|~Search, action: ClearSelection          }
+  #- { key: I,                           mode: Vi|~Search, action: ToggleViMode            }
+  #- { key: I,                           mode: Vi|~Search, action: ScrollToBottom          }
+  #- { key: C,      mods: Control,       mode: Vi|~Search, action: ToggleViMode            }
+  #- { key: Y,      mods: Control,       mode: Vi|~Search, action: ScrollLineUp            }
+  #- { key: E,      mods: Control,       mode: Vi|~Search, action: ScrollLineDown          }
+  #- { key: G,                           mode: Vi|~Search, action: ScrollToTop             }
+  #- { key: G,      mods: Shift,         mode: Vi|~Search, action: ScrollToBottom          }
+  #- { key: B,      mods: Control,       mode: Vi|~Search, action: ScrollPageUp            }
+  #- { key: F,      mods: Control,       mode: Vi|~Search, action: ScrollPageDown          }
+  #- { key: U,      mods: Control,       mode: Vi|~Search, action: ScrollHalfPageUp        }
+  #- { key: D,      mods: Control,       mode: Vi|~Search, action: ScrollHalfPageDown      }
+  #- { key: Y,                           mode: Vi|~Search, action: Copy                    }
+  #- { key: Y,                           mode: Vi|~Search, action: ClearSelection          }
+  #- { key: Copy,                        mode: Vi|~Search, action: ClearSelection          }
+  #- { key: V,                           mode: Vi|~Search, action: ToggleNormalSelection   }
+  #- { key: V,      mods: Shift,         mode: Vi|~Search, action: ToggleLineSelection     }
+  #- { key: V,      mods: Control,       mode: Vi|~Search, action: ToggleBlockSelection    }
+  #- { key: V,      mods: Alt,           mode: Vi|~Search, action: ToggleSemanticSelection }
+  #- { key: Return,                      mode: Vi|~Search, action: Open                    }
+  #- { key: Z,                           mode: Vi|~Search, action: CenterAroundViCursor    }
+  #- { key: K,                           mode: Vi|~Search, action: Up                      }
+  #- { key: J,                           mode: Vi|~Search, action: Down                    }
+  #- { key: H,                           mode: Vi|~Search, action: Left                    }
+  #- { key: L,                           mode: Vi|~Search, action: Right                   }
+  #- { key: Up,                          mode: Vi|~Search, action: Up                      }
+  #- { key: Down,                        mode: Vi|~Search, action: Down                    }
+  #- { key: Left,                        mode: Vi|~Search, action: Left                    }
+  #- { key: Right,                       mode: Vi|~Search, action: Right                   }
+  #- { key: Key0,                        mode: Vi|~Search, action: First                   }
+  #- { key: Key4,   mods: Shift,         mode: Vi|~Search, action: Last                    }
+  #- { key: Key6,   mods: Shift,         mode: Vi|~Search, action: FirstOccupied           }
+  #- { key: H,      mods: Shift,         mode: Vi|~Search, action: High                    }
+  #- { key: M,      mods: Shift,         mode: Vi|~Search, action: Middle                  }
+  #- { key: L,      mods: Shift,         mode: Vi|~Search, action: Low                     }
+  #- { key: B,                           mode: Vi|~Search, action: SemanticLeft            }
+  #- { key: W,                           mode: Vi|~Search, action: SemanticRight           }
+  #- { key: E,                           mode: Vi|~Search, action: SemanticRightEnd        }
+  #- { key: B,      mods: Shift,         mode: Vi|~Search, action: WordLeft                }
+  #- { key: W,      mods: Shift,         mode: Vi|~Search, action: WordRight               }
+  #- { key: E,      mods: Shift,         mode: Vi|~Search, action: WordRightEnd            }
+  #- { key: Key5,   mods: Shift,         mode: Vi|~Search, action: Bracket                 }
+  #- { key: Slash,                       mode: Vi|~Search, action: SearchForward           }
+  #- { key: Slash,  mods: Shift,         mode: Vi|~Search, action: SearchBackward          }
+  #- { key: N,                           mode: Vi|~Search, action: SearchNext              }
+  #- { key: N,      mods: Shift,         mode: Vi|~Search, action: SearchPrevious          }
+
+  # Search Mode
+  #- { key: Return,                mode: Search|Vi,  action: SearchConfirm         }
+  #- { key: Escape,                mode: Search,     action: SearchCancel          }
+  #- { key: C,      mods: Control, mode: Search,     action: SearchCancel          }
+  #- { key: U,      mods: Control, mode: Search,     action: SearchClear           }
+  #- { key: W,      mods: Control, mode: Search,     action: SearchDeleteWord      }
+  #- { key: P,      mods: Control, mode: Search,     action: SearchHistoryPrevious }
+  #- { key: N,      mods: Control, mode: Search,     action: SearchHistoryNext     }
+  #- { key: Up,                    mode: Search,     action: SearchHistoryPrevious }
+  #- { key: Down,                  mode: Search,     action: SearchHistoryNext     }
+  #- { key: Return,                mode: Search|~Vi, action: SearchFocusNext       }
+  #- { key: Return, mods: Shift,   mode: Search|~Vi, action: SearchFocusPrevious   }
+
+  # (Windows, Linux, and BSD only)
+  #- { key: V,              mods: Control|Shift, mode: ~Vi,        action: Paste            }
+  #- { key: C,              mods: Control|Shift,                   action: Copy             }
+  #- { key: F,              mods: Control|Shift, mode: ~Search,    action: SearchForward    }
+  #- { key: B,              mods: Control|Shift, mode: ~Search,    action: SearchBackward   }
+  #- { key: C,              mods: Control|Shift, mode: Vi|~Search, action: ClearSelection   }
+  #- { key: Insert,         mods: Shift,                           action: PasteSelection   }
+  #- { key: Key0,           mods: Control,                         action: ResetFontSize    }
+  #- { key: Equals,         mods: Control,                         action: IncreaseFontSize }
+  #- { key: Plus,           mods: Control,                         action: IncreaseFontSize }
+  #- { key: NumpadAdd,      mods: Control,                         action: IncreaseFontSize }
+  #- { key: Minus,          mods: Control,                         action: DecreaseFontSize }
+  #- { key: NumpadSubtract, mods: Control,                         action: DecreaseFontSize }
+
+  # (Windows only)
+  #- { key: Return,   mods: Alt,           action: ToggleFullscreen }
+
+  # (macOS only)
+  #- { key: K,              mods: Command, mode: ~Vi|~Search, chars: "\x0c"                 }
+  #- { key: K,              mods: Command, mode: ~Vi|~Search, action: ClearHistory          }
+  #- { key: Key0,           mods: Command,                    action: ResetFontSize         }
+  #- { key: Equals,         mods: Command,                    action: IncreaseFontSize      }
+  #- { key: Plus,           mods: Command,                    action: IncreaseFontSize      }
+  #- { key: NumpadAdd,      mods: Command,                    action: IncreaseFontSize      }
+  #- { key: Minus,          mods: Command,                    action: DecreaseFontSize      }
+  #- { key: NumpadSubtract, mods: Command,                    action: DecreaseFontSize      }
+  #- { key: V,              mods: Command,                    action: Paste                 }
+  #- { key: C,              mods: Command,                    action: Copy                  }
+  #- { key: C,              mods: Command, mode: Vi|~Search,  action: ClearSelection        }
+  #- { key: H,              mods: Command,                    action: Hide                  }
+  #- { key: H,              mods: Command|Alt,                action: HideOtherApplications }
+  #- { key: M,              mods: Command,                    action: Minimize              }
+  #- { key: Q,              mods: Command,                    action: Quit                  }
+  #- { key: W,              mods: Command,                    action: Quit                  }
+  #- { key: N,              mods: Command,                    action: CreateNewWindow       }
+  #- { key: F,              mods: Command|Control,            action: ToggleFullscreen      }
+  #- { key: F,              mods: Command, mode: ~Search,     action: SearchForward         }
+  #- { key: B,              mods: Command, mode: ~Search,     action: SearchBackward        }
+
+#debug:
+  # Display the time it takes to redraw each frame.
+  #render_timer: false
+
+  # Keep the log file after quitting Alacritty.
+  #persistent_logging: false
+
+  # Log level
+  #
+  # Values for `log_level`:
+  #   - Off
+  #   - Error
+  #   - Warn
+  #   - Info
+  #   - Debug
+  #   - Trace
+  #log_level: Warn
+
+  # Renderer override.
+  #   - glsl3
+  #   - gles2
+  #   - gles2_pure
+  #renderer: None
+
+  # Print all received window events.
+  #print_events: false
+
+  # Highlight window damage information.
+  #highlight_damage: false
+
+colors:
+    primary:
+        background: "#1E1E2E" # base
+        foreground: "#CDD6F4" # text
+        # Bright and dim foreground colors
+        dim_foreground: "#CDD6F4" # text
+        bright_foreground: "#CDD6F4" # text
+
+    # Cursor colors
+    cursor:
+        text: "#1E1E2E" # base
+        cursor: "#F5E0DC" # rosewater
+    vi_mode_cursor:
+        text: "#1E1E2E" # base
+        cursor: "#B4BEFE" # lavender
+
+    # Search colors
+    search:
+        matches:
+            foreground: "#1E1E2E" # base
+            background: "#A6ADC8" # subtext0
+        focused_match:
+            foreground: "#1E1E2E" # base
+            background: "#A6E3A1" # green
+        footer_bar:
+            foreground: "#1E1E2E" # base
+            background: "#A6ADC8" # subtext0
+
+    # Keyboard regex hints
+    hints:
+        start:
+            foreground: "#1E1E2E" # base
+            background: "#F9E2AF" # yellow
+        end:
+            foreground: "#1E1E2E" # base
+            background: "#A6ADC8" # subtext0
+
+    # Selection colors
+    selection:
+        text: "#1E1E2E" # base
+        background: "#F5E0DC" # rosewater
+
+    # Normal colors
+    normal:
+        black: "#45475A" # surface1
+        red: "#F38BA8" # red
+        green: "#A6E3A1" # green
+        yellow: "#F9E2AF" # yellow
+        blue: "#89B4FA" # blue
+        magenta: "#F5C2E7" # pink
+        cyan: "#94E2D5" # teal
+        white: "#BAC2DE" # subtext1
+
+    # Bright colors
+    bright:
+        black: "#585B70" # surface2
+        red: "#F38BA8" # red
+        green: "#A6E3A1" # green
+        yellow: "#F9E2AF" # yellow
+        blue: "#89B4FA" # blue
+        magenta: "#F5C2E7" # pink
+        cyan: "#94E2D5" # teal
+        white: "#A6ADC8" # subtext0
+
+    # Dim colors
+    dim:
+        black: "#45475A" # surface1
+        red: "#F38BA8" # red
+        green: "#A6E3A1" # green
+        yellow: "#F9E2AF" # yellow
+        blue: "#89B4FA" # blue
+        magenta: "#F5C2E7" # pink
+        cyan: "#94E2D5" # teal
+        white: "#BAC2DE" # subtext1
+
+    indexed_colors:
+        - { index: 16, color: "#FAB387" }
+        - { index: 17, color: "#F5E0DC" }
+

home-manager-modules/alacritty/default.nix

@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+let
+  cfg = config.luj.programs.alacritty;
+in
+with lib;
+{
+  options.luj.programs.alacritty = {
+    enable = mkEnableOption "Enable alacritty program";
+  };
+
+  config = mkIf cfg.enable
+    {
+      programs.alacritty.enable = true;
+      xdg.configFile."alacritty/alacritty.yml".source = lib.mkForce ./config;
+    };
+}
+    

home-manager-modules/alacritty/machiatto.yml

@@ -0,0 +1,80 @@
+colors:
+    # Default colors
+    primary:
+        background: "#24273A" # base
+        foreground: "#CAD3F5" # text
+        # Bright and dim foreground colors
+        dim_foreground: "#CAD3F5" # text
+        bright_foreground: "#CAD3F5" # text
+
+    # Cursor colors
+    cursor:
+        text: "#24273A" # base
+        cursor: "#F4DBD6" # rosewater
+    vi_mode_cursor:
+        text: "#24273A" # base
+        cursor: "#B7BDF8" # lavender
+
+    # Search colors
+    search:
+        matches:
+            foreground: "#24273A" # base
+            background: "#A5ADCB" # subtext0
+        focused_match:
+            foreground: "#24273A" # base
+            background: "#A6DA95" # green
+        footer_bar:
+            foreground: "#24273A" # base
+            background: "#A5ADCB" # subtext0
+
+    # Keyboard regex hints
+    hints:
+        start:
+            foreground: "#24273A" # base
+            background: "#EED49F" # yellow
+        end:
+            foreground: "#24273A" # base
+            background: "#A5ADCB" # subtext0
+
+    # Selection colors
+    selection:
+        text: "#24273A" # base
+        background: "#F4DBD6" # rosewater
+
+    # Normal colors
+    normal:
+        black: "#494D64" # surface1
+        red: "#ED8796" # red
+        green: "#A6DA95" # green
+        yellow: "#EED49F" # yellow
+        blue: "#8AADF4" # blue
+        magenta: "#F5BDE6" # pink
+        cyan: "#8BD5CA" # teal
+        white: "#B8C0E0" # subtext1
+
+    # Bright colors
+    bright:
+        black: "#5B6078" # surface2
+        red: "#ED8796" # red
+        green: "#A6DA95" # green
+        yellow: "#EED49F" # yellow
+        blue: "#8AADF4" # blue
+        magenta: "#F5BDE6" # pink
+        cyan: "#8BD5CA" # teal
+        white: "#A5ADCB" # subtext0
+
+    # Dim colors
+    dim:
+        black: "#494D64" # surface1
+        red: "#ED8796" # red
+        green: "#A6DA95" # green
+        yellow: "#EED49F" # yellow
+        blue: "#8AADF4" # blue
+        magenta: "#F5BDE6" # pink
+        cyan: "#8BD5CA" # teal
+        white: "#B8C0E0" # subtext1
+
+    indexed_colors:
+        - { index: 16, color: "#F5A97F" }
+        - { index: 17, color: "#F4DBD6" }
+

home-manager-modules/dunst/default.nix

@@ -0,0 +1,44 @@
+{ config, lib, ... }:
+let
+  cfg = config.luj.programs.dunst;
+in
+with lib;
+{
+  options.luj.programs.dunst = {
+    enable = mkEnableOption "Enable Dunst";
+  };
+
+  config = mkIf cfg.enable {
+
+    services.dunst = {
+      enable = true;
+      settings = {
+        global = {
+          monitor = 0;
+          corner_radius = 5;
+          frame_color = "#89B4FA";
+          frame_width = 0;
+          separator_color = "frame";
+        };
+
+        urgency_low = {
+          background = "#1E1E2E";
+          foreground = "#CDD6F4";
+        };
+        urgency_normal = {
+          background = "#1E1E2E";
+          foreground = "#CDD6F4";
+        };
+
+        urgency_critical = {
+          background = "#1E1E2E";
+          foreground = "#CDD6F4";
+          frame_color = "#FAB387";
+        };
+
+      };
+
+    };
+  };
+
+}

home-manager-modules/emacs/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+let
+  cfg = config.luj.programs.emacs;
+in
+with lib;
+{
+  options.luj.programs.emacs = {
+    enable = mkEnableOption "Enable Emacs";
+  };
+
+  config = mkIf cfg.enable {
+
+    services.emacs.enable = true;
+
+  };
+}

home-manager-modules/emacs/doom.d/config.el

@@ -0,0 +1 @@
+(setq doom-theme 'catppuccin)

home-manager-modules/emacs/doom.d/init.el

@@ -0,0 +1,192 @@
+;;; init.el -*- lexical-binding: t; -*-
+
+;; This file controls what Doom modules are enabled and what order they load
+;; in. Remember to run 'doom sync' after modifying it!
+
+;; NOTE Press 'SPC h d h' (or 'C-h d h' for non-vim users) to access Doom's
+;;      documentation. There you'll find a "Module Index" link where you'll find
+;;      a comprehensive list of Doom's modules and what flags they support.
+
+;; NOTE Move your cursor over a module's name (or its flags) and press 'K' (or
+;;      'C-c c k' for non-vim users) to view its documentation. This works on
+;;      flags as well (those symbols that start with a plus).
+;;
+;;      Alternatively, press 'gd' (or 'C-c c d') on a module to browse its
+;;      directory (for easy access to its source code).
+
+(doom! :input
+       ;;chinese
+       ;;japanese
+       ;;layout            ; auie,ctsrnm is the superior home row
+
+       :completion
+       company           ; the ultimate code completion backend
+       ;;helm              ; the *other* search engine for love and life
+       ;;ido               ; the other *other* search engine...
+       ;;ivy               ; a search engine for love and life
+       vertico           ; the search engine of the future
+
+       :ui
+       ;;deft              ; notational velocity for Emacs
+       doom              ; what makes DOOM look the way it does
+       doom-dashboard    ; a nifty splash screen for Emacs
+       doom-quit         ; DOOM quit-message prompts when you quit Emacs
+       (emoji +unicode)  ; 🙂
+       hl-todo           ; highlight TODO/FIXME/NOTE/DEPRECATED/HACK/REVIEW
+       ;;hydra
+       ;;indent-guides     ; highlighted indent columns
+       ;;ligatures         ; ligatures and symbols to make your code pretty again
+       ;;minimap           ; show a map of the code on the side
+       modeline          ; snazzy, Atom-inspired modeline, plus API
+       ;;nav-flash         ; blink cursor line after big motions
+       ;;neotree           ; a project drawer, like NERDTree for vim
+       ophints           ; highlight the region an operation acts on
+       (popup +defaults)   ; tame sudden yet inevitable temporary windows
+       ;;tabs              ; a tab bar for Emacs
+       treemacs          ; a project drawer, like neotree but cooler
+       ;;unicode           ; extended unicode support for various languages
+       vc-gutter         ; vcs diff in the fringe
+       vi-tilde-fringe   ; fringe tildes to mark beyond EOB
+       ;;window-select     ; visually switch windows
+       workspaces        ; tab emulation, persistence & separate workspaces
+       ;;zen               ; distraction-free coding or writing
+
+       :editor
+       (evil +everywhere); come to the dark side, we have cookies
+       file-templates    ; auto-snippets for empty files
+       fold              ; (nigh) universal code folding
+       (format +onsave)  ; automated prettiness
+       ;;god               ; run Emacs commands without modifier keys
+       ;;lispy             ; vim for lisp, for people who don't like vim
+       ;;multiple-cursors  ; editing in many places at once
+       ;;objed             ; text object editing for the innocent
+       ;;parinfer          ; turn lisp into python, sort of
+       ;;rotate-text       ; cycle region at point between text candidates
+       snippets          ; my elves. They type so I don't have to
+       ;;word-wrap         ; soft wrapping with language-aware indent
+
+       :emacs
+       dired             ; making dired pretty [functional]
+       electric          ; smarter, keyword-based electric-indent
+       ;;ibuffer         ; interactive buffer management
+       undo              ; persistent, smarter undo for your inevitable mistakes
+       vc                ; version-control and Emacs, sitting in a tree
+
+       :term
+       eshell            ; the elisp shell that works everywhere
+       ;;shell             ; simple shell REPL for Emacs
+       ;;term              ; basic terminal emulator for Emacs
+       vterm             ; the best terminal emulation in Emacs
+
+       :checkers
+       syntax              ; tasing you for every semicolon you forget
+       ;;(spell +flyspell) ; tasing you for misspelling mispelling
+       ;;grammar           ; tasing grammar mistake every you make
+
+       :tools
+       ;;ansible
+       ;;biblio            ; Writes a PhD for you (citation needed)
+       ;;debugger          ; FIXME stepping through code, to help you add bugs
+       ;;direnv
+       ;;docker
+       ;;editorconfig      ; let someone else argue about tabs vs spaces
+       ;;ein               ; tame Jupyter notebooks with emacs
+       (eval +overlay)     ; run code, run (also, repls)
+       ;;gist              ; interacting with github gists
+       lookup              ; navigate your code and its documentation
+       lsp               ; M-x vscode
+       magit             ; a git porcelain for Emacs
+       ;;make              ; run make tasks from Emacs
+       ;;pass              ; password manager for nerds
+       pdf               ; pdf enhancements
+       ;;prodigy           ; FIXME managing external services & code builders
+       ;;rgb               ; creating color strings
+       ;;taskrunner        ; taskrunner for all your projects
+       ;;terraform         ; infrastructure as code
+       ;;tmux              ; an API for interacting with tmux
+       ;;upload            ; map local to remote projects via ssh/ftp
+
+       :os
+       (:if IS-MAC macos)  ; improve compatibility with macOS
+       ;;tty               ; improve the terminal Emacs experience
+
+       :lang
+       ;;agda              ; types of types of types of types...
+       ;;beancount         ; mind the GAAP
+       ;;cc                ; C > C++ == 1
+       ;;clojure           ; java with a lisp
+       ;;common-lisp       ; if you've seen one lisp, you've seen them all
+       ;;coq               ; proofs-as-programs
+       ;;crystal           ; ruby at the speed of c
+       ;;csharp            ; unity, .NET, and mono shenanigans
+       ;;data              ; config/data formats
+       ;;(dart +flutter)   ; paint ui and not much else
+       ;;dhall
+       ;;elixir            ; erlang done right
+       ;;elm               ; care for a cup of TEA?
+       emacs-lisp        ; drown in parentheses
+       ;;erlang            ; an elegant language for a more civilized age
+       ;;ess               ; emacs speaks statistics
+       ;;factor
+       ;;faust             ; dsp, but you get to keep your soul
+       ;;fortran           ; in FORTRAN, GOD is REAL (unless declared INTEGER)
+       ;;fsharp            ; ML stands for Microsoft's Language
+       ;;fstar             ; (dependent) types and (monadic) effects and Z3
+       ;;gdscript          ; the language you waited for
+       ;;(go +lsp)         ; the hipster dialect
+       ;;(haskell +lsp)    ; a language that's lazier than I am
+       ;;hy                ; readability of scheme w/ speed of python
+       ;;idris             ; a language you can depend on
+       ;;json              ; At least it ain't XML
+       ;;(java +meghanada) ; the poster child for carpal tunnel syndrome
+       ;;javascript        ; all(hope(abandon(ye(who(enter(here))))))
+       ;;julia             ; a better, faster MATLAB
+       ;;kotlin            ; a better, slicker Java(Script)
+       latex             ; writing papers in Emacs has never been so fun
+       ;;lean              ; for folks with too much to prove
+       ;;ledger            ; be audit you can be
+       ;;lua               ; one-based indices? one-based indices
+       markdown          ; writing docs for people to ignore
+       ;;nim               ; python + lisp at the speed of c
+       nix               ; I hereby declare "nix geht mehr!"
+       ;;ocaml             ; an objective camel
+       org               ; organize your plain life in plain text
+       ;;php               ; perl's insecure younger brother
+       ;;plantuml          ; diagrams for confusing people more
+       ;;purescript        ; javascript, but functional
+       ;;python            ; beautiful is better than ugly
+       ;;qt                ; the 'cutest' gui framework ever
+       ;;racket            ; a DSL for DSLs
+       ;;raku              ; the artist formerly known as perl6
+       ;;rest              ; Emacs as a REST client
+       ;;rst               ; ReST in peace
+       ;;(ruby +rails)     ; 1.step {|i| p "Ruby is #{i.even? ? 'love' : 'life'}"}
+       rust              ; Fe2O3.unwrap().unwrap().unwrap().unwrap()
+       ;;scala             ; java, but good
+       ;;(scheme +guile)   ; a fully conniving family of lisps
+       sh                ; she sells {ba,z,fi}sh shells on the C xor
+       ;;sml
+       ;;solidity          ; do you need a blockchain? No.
+       ;;swift             ; who asked for emoji variables?
+       ;;terra             ; Earth and Moon in alignment for performance.
+       ;;web               ; the tubes
+       ;;yaml              ; JSON, but readable
+       ;;zig               ; C, but simpler
+
+       :email
+       ;;(mu4e +org +gmail)
+       ;;notmuch
+       ;;(wanderlust +gmail)
+
+       :app
+       ;;calendar
+       ;;emms
+       ;;everywhere        ; *leave* Emacs!? You must be joking
+       ;;irc               ; how neckbeards socialize
+       ;;(rss +org)        ; emacs as an RSS reader
+       ;;twitter           ; twitter client https://twitter.com/vnought
+
+       :config
+       ;;literate
+       (default +bindings +smartparens))
+

home-manager-modules/emacs/doom.d/packages.el

@@ -0,0 +1 @@
+(package! catppuccin-theme)

home-manager-modules/firefox/default.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.firefox;
+in
+with lib;
+{
+  options.luj.programs.firefox = {
+    enable = mkEnableOption "Enable Firefox";
+  };
+
+  config = mkIf cfg.enable {
+    programs.firefox = {
+      enable = true;
+      package = pkgs.firefox;
+    };
+
+  };
+}

home-manager-modules/fish/default.nix

@@ -0,0 +1,111 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.fish;
+in
+with lib;
+{
+  options.luj.programs.fish = {
+    enable = mkEnableOption "Enable fish";
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.fish = {
+      enable = true;
+      shellInit = ''
+        [ -n "$EAT_SHELL_INTEGRATION_DIR" ] && \
+          source "$EAT_SHELL_INTEGRATION_DIR/fish"
+      '';
+
+      shellAliases = {
+
+        ka = "killall";
+        mkd = "mkdir -pv";
+
+        nix-build = "nom-build";
+
+        ca = "khal interactive";
+        sync_ca = "vsync sync";
+
+        dnd = "dunstctl set-paused true";
+        nodnd = "dunstctl set-paused false";
+
+        lg = "lazygit";
+        g = "git";
+        gua = "git remote | xargs -L1 git push --all";
+
+        v = "$EDITOR";
+        sdn = "shutdown now";
+
+        SU = "systemctl --user";
+        SS = "sudo systemctl";
+
+        weather = "curl wttr.in";
+        v6 = "curl api6.ipify.org";
+        v4 = "curl api.ipify.org";
+        clbin = "curl -F'clbin=<-' https://clbin.com";
+        _0x0 = "curl -F'file=@-' https://0x0.st";
+
+        phs = "python -m http.server";
+
+        ls = "eza";
+
+        rtmv = "rsync -avP";
+        archive = "rsync --remove-source-files -avPzz";
+
+        luks_integrity_check = "gocryptfs -fsck -extpass 'pass Private/LUKS' /boot/luks";
+
+        fetch-emails = "mbsync --all && notmuch new && afew -t -n -v";
+
+        nsp = "nix-shell -p";
+        ns = "nix-shell";
+
+        ncg = "sudo nix-collect-garbage --delete-older-than 30d";
+        ncga = "sudo nix-collect-garbage -d";
+        nso = "sudo nix-store --optimise";
+
+        lln = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\"";
+        # Local build
+        lnb = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nom-build '<nixpkgs>' --no-out-link -A $1";
+        # Local shell
+        lns = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nix-shell -p $1";
+        # Local test
+        ltt = ''NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nom-build --no-out-link "$LOCAL_NIXPKGS_CHECKOUT/nixos/tests/$1"'';
+      };
+
+    };
+
+    # Broot
+    programs.broot = {
+      enable = true;
+      enableFishIntegration = true;
+    };
+
+    # Direnv: must have.
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+
+    programs.oh-my-posh = {
+      enable = true;
+      enableFishIntegration = true;
+      useTheme = "catppuccin_mocha";
+    };
+
+    # Misc
+    programs.lesspipe.enable = true;
+
+    home.packages = with pkgs; [
+      eza
+      python3
+      libnotify
+      nix-output-monitor
+    ];
+  };
+}

home-manager-modules/git/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.luj.programs.git;
 in
@@ -12,7 +17,34 @@ with lib;
     programs.git = {
       enable = true;
       userName = "Julien Malka";
-      userEmail = "julien.malka@me.com";
+      userEmail = "julien@malka.sh";
+      signing = {
+        signByDefault = true;
+        key = "6FC74C847011FD83";
+      };
+      maintenance = {
+        enable = true;
+        repositories = [
+          "/home/julien/dev/nixpkgs"
+        ];
+      };
+      delta.enable = true;
+      ignores = [ ".direnv" ];
+      extraConfig = {
+        init.defaultBranch = "main";
+        diff.colorMoved = "zebra";
+        pull.rebase = true;
+        fetch.prune = true;
+        rebase.autoStash = true;
+        push.autoSetupRemote = true;
+      };
+    };
+
+    home.extraActivationPath = [ pkgs.gnupg ];
+    home.activation = {
+      myActivationAction = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        gpg --import /run/agenix/git-gpg-private-key
+      '';
     };
   };
 }

home-manager-modules/gtk/default.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.gtk;
+in
+with lib;
+{
+  options.luj.programs.gtk = {
+    enable = mkEnableOption "Enable gtk customizations";
+  };
+
+  config = mkIf cfg.enable {
+    gtk = {
+      enable = true;
+      theme = {
+        name = "Catppuccin-Macchiato-Standard-Pink-Dark";
+        package = pkgs.catppuccin-gtk.override {
+          accents = [ "pink" ];
+          variant = "macchiato";
+        };
+      };
+    };
+    qt = {
+      enable = true;
+      platformTheme.name = "gtk";
+    };
+  };
+}

home-manager-modules/hyprland/default.nix

@@ -0,0 +1,170 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.hyprland;
+  terminal = "${pkgs.kitty}/bin/kitty";
+  menu = "${pkgs.rofi-wayland}/bin/rofi -no-lazy-grab -show drun";
+in
+with lib;
+{
+  options.luj.programs.hyprland = {
+    enable = mkEnableOption "Enable HyprLand";
+  };
+
+  config = mkIf cfg.enable {
+    wayland.windowManager.hyprland = {
+      enable = true;
+      package = pkgs.unstable.hyprland;
+      systemd = {
+        enable = true;
+        variables = [ "WLR_NO_HARDWARE_CURSORS=1" ];
+      };
+      settings = {
+        # Variables
+        "$mod" = "ALT_L";
+        "$term" = terminal;
+        "$launcher" = menu;
+
+        general = {
+          gaps_in = "6";
+          gaps_out = "10";
+        };
+        input = {
+          kb_layout = "fr";
+          follow_mouse = 1;
+          sensitivity = 0; # -1.0 - 1.0, 0 means no modification.
+        };
+        misc = {
+          disable_hyprland_logo = true;
+          disable_splash_rendering = true;
+        };
+        decoration = {
+          rounding = 6;
+        };
+        animations.enabled = true;
+
+        xwayland = {
+          force_zero_scaling = true;
+        };
+
+        workspace = [
+          "1,monitor:DP-3"
+          "2,monitor:HDM1-A-1"
+        ];
+
+        exec = [ "hyprpaper" ];
+
+        env = [
+          "LIBVA_DRIVER_NAME, nvidia"
+          "WLR_NO_HARDWARE_CURSORS, 1"
+          "WLR_DRM_DEVICES,/home/julien/.config/hypr/card"
+        ];
+
+        monitor = [
+          "DP-3, 2560x1440@60, 0x0, 1"
+          "HDM1-A-1, 2560x1440@60, 2560x0, 1"
+        ];
+
+        bind = [
+          "$mod, RETURN, exec, kitty"
+          "$mod, SPACE, exec, $launcher"
+          "$mod, w, exec, swaylock"
+
+          # Window management
+          "$mod, Q, killactive"
+          "$mod, F, fullscreen"
+          # Focus
+          "$mod, left, movefocus, l"
+          "$mod, right, movefocus, r"
+          "$mod, up, movefocus, u"
+          "$mod, down, movefocus, d"
+          # Move
+          "$mod SHIFT, left, movewindow, l"
+          "$mod SHIFT, right, movewindow, r"
+          "$mod SHIFT, up, movewindow, u"
+          "$mod SHIFT, down, movewindow, d"
+
+          # Switch workspaces
+          "$mod, code:10, workspace, 1"
+          "$mod, code:11, workspace, 2"
+          "$mod, code:12, workspace, 3"
+          "$mod, code:13, workspace, 4"
+          "$mod, code:14, workspace, 5"
+          "$mod, code:15, workspace, 6"
+          "$mod, code:16, workspace, 7"
+          "$mod, code:17, workspace, 8"
+          "$mod, code:18, workspace, 9"
+          "$mod, code:19, workspace, 10"
+
+          "$mod SHIFT, code:10, movetoworkspace, 1"
+          "$mod SHIFT, code:11, movetoworkspace, 2"
+          "$mod SHIFT, code:12, movetoworkspace, 3"
+          "$mod SHIFT, code:13, movetoworkspace, 4"
+          "$mod SHIFT, code:14, movetoworkspace, 5"
+          "$mod SHIFT, code:15, movetoworkspace, 6"
+          "$mod SHIFT, code:16, movetoworkspace, 7"
+          "$mod SHIFT, code:17, movetoworkspace, 8"
+          "$mod SHIFT, code:18, movetoworkspace, 9"
+          "$mod SHIFT, code:19, movetoworkspace, 10"
+
+        ];
+
+      };
+
+    };
+
+    xdg.configFile."hypr/hyprpaper.conf".text = ''
+      preload = ${../../machines/fischer/wallpaper.jpg}
+      wallpaper = ,${../../machines/fischer/wallpaper.jpg}
+    '';
+
+    services.swayidle = {
+      enable = true;
+      systemdTarget = "hyprland-session.target";
+      events = [
+        {
+          event = "before-sleep";
+          command = "${pkgs.swaylock-effects}/bin/swaylock --config /home/julien/.config/swaylock/config";
+        }
+      ];
+    };
+
+    programs.swaylock = {
+      enable = true;
+      package = pkgs.swaylock-effects;
+      settings = {
+        screenshots = true;
+        clock = true;
+        indicator = true;
+        indicator-radius = 200;
+        indicator-thickness = 20;
+        grace = 0;
+        grace-no-mouse = true;
+        grace-no-touch = true;
+        line-uses-ring = false;
+        ignore-empty-password = true;
+        show-failed-attempts = false;
+
+        font = "Fira Code";
+        timestr = "%H:%M";
+        datestr = "";
+        effect-blur = "8x5";
+        effect-vignette = "0.5:0.5";
+        color = "00000000";
+
+      };
+
+    };
+
+    home.packages = with pkgs; [
+      qt6.qtwayland
+      libsForQt5.qt5.qtwayland
+      hyprpaper
+    ];
+
+  };
+}

home-manager-modules/i3/config

@@ -1,265 +0,0 @@
-# This file has been auto-generated by i3-config-wizard(1).
-# It will not be overwritten, so edit it as you like.
-#
-# Should you change your keyboard layout some time, delete
-# this file and re-run i3-config-wizard(1).
-#
-
-# i3 config file (v4)
-#
-# Please see http://i3wm.org/docs/userguide.html for a complete reference!
-
-#Execs
-
-exec_always xrandr --output $leftm --primary --mode 1920x1080 --pos 0x0 --rotate normal --output $rightm --mode 1920x1080 --pos 1920x0 --rotate normal
-
-
-#exec_always xrandr --output $leftm --primary --mode 1920x1080 --pos 0x0 --rotate normal
-
-exec_always feh --bg-scale ~/df/bg.jpg
-
-# Variables {{{
-
-set $sup Mod1
-set $terminal tabbed -c urxvt -embed
-set $leftm HDMI-1
-set $rightm eDP-1
-
-set $workspace1  ""
-set $workspace2  ""
-set $workspace3  ""
-set $workspace4  "4"
-set $workspace5  "5"
-set $workspace6  "6"
-set $workspace7  "7"
-set $workspace8  "8"
-set $workspace9  "9"
-set $workspace10 ""
-# }}}
-
-
-workspace "" output $leftm
-workspace "" output $rightm
-workspace "" output $rightm
-
-
-
-#Set Mod
-set $mod 		Mod4
-
-set $bg-color 		#172A47
-set $text-color		#5A9857
-set $urgent-bg-color	#E53935
-set $inactive-bg-color  #435E75
-
-
-##########################################
-
-#Scrolling - doesn't work
-#exec --no-startup-id synclient HorizEdgeScroll=1 VertEdgeScroll=1 VertScrollDelta=-111
-
-#WORKSPACE STARTUP
-
-#Gaps and Window
-
-for_window [class="^.*"] border pixel 2
-#new_window pixel 4
-#new_float pixel 4
-#gaps inner 20
-gaps inner 10
-#border_radius 5
-#new_window pixel 3
-#new_float pixel 3
-#gaps top 35
-hide_edge_borders vertical
-
-# Color variables
-set $unfocused_border #72afff
-set $focused_border #b21c0e
-
-#                        class   border  backgr. text indicator
-client.focused          #698AB2 #698AB2 #698AB2  #698AB2 #698AB2
-#client.focused_inactive $base03 $base03 $base05 $base03
-#client.unfocused        $base03 $base03 $base05 $base00
-#client.urgent $base01 	$base01 $base05 $base00
-
-
-#Check .Xresources for font
-
-# start a terminal
-bindsym $mod+Return  workspace 
-bindsym $mod+Shift+Return exec urxvt
-
-# kill focused window
-bindsym $mod+q kill
-
-# start rofi
-
-bindsym $mod+space exec rofi -show run
-
-
-# change focus
-
-# alternatively, you can use the cursor keys:
-bindsym $mod+h focus left
-bindsym $mod+j focus down
-bindsym $mod+k focus up
-bindsym $mod+l focus right
-
-
-# alternatively, you can use the cursor keys:
-bindsym $mod+Shift+h move left
-bindsym $mod+Shift+j move down
-bindsym $mod+Shift+k move up
-bindsym $mod+Shift+l move right
-
-# split in horizontal orientation
-bindsym $mod+o split h
-
-# split in vertical orientation
-bindsym $mod+v split v
-
-# enter fullscreen mode for the focused container
-bindsym $mod+f fullscreen toggle
-
-# change container layout (stacked, tabbed, toggle split)
-bindsym $mod+s layout stacking
-bindsym $mod+w layout tabbed
-bindsym $mod+e layout toggle split
-
-# toggle tiling / floating
-bindsym $mod+Shift+space floating toggle
-
-# change focus between tiling / floating windows
-#bindsym $mod+space focus mode_toggle
-
-# focus the parent container
-bindsym $mod+a focus parent
-
-# focus the child container
-#bindsym $mod+d focus child
-
-bindsym $mod+Ctrl+Left move workspace to output $leftm
-bindsym $mod+Ctrl+Right move workspace to output $rightm
-
-
-# switch to workspace
-bindsym $mod+1 workspace 
-bindsym $mod+2 workspace 
-bindsym $mod+3 workspace 
-bindsym $mod+4 workspace 4
-bindsym $mod+5 workspace 5
-bindsym $mod+6 workspace 6
-bindsym $mod+7 workspace 7
-bindsym $mod+8 workspace 8
-bindsym $mod+9 workspace 9
-bindsym $mod+0 workspace 
-
-# move focused container to workspace
-bindsym $mod+Shift+1 move container to workspace 
-bindsym $mod+Shift+2 move container to workspace 
-bindsym $mod+Shift+3 move container to workspace 
-bindsym $mod+Shift+4 move container to workspace 4
-bindsym $mod+Shift+5 move container to workspace 5
-bindsym $mod+Shift+6 move container to workspace 6
-bindsym $mod+Shift+7 move container to workspace 7
-bindsym $mod+Shift+8 move container to workspace 8
-bindsym $mod+Shift+9 move container to workspace 9
-bindsym $mod+Shift+0 move container to workspace 
-
-
-#assign apps to workspaces
-#assign [class = "URxvt"] 
-assign [class = "Firefox"] 
-assign [class = "discord"] 
-assign[class="Atomic TweetDeck"] 
-assign [class="Slack"] 
-assign[class="Atom"]
-
-
-# reload the configuration file
-bindsym $mod+Shift+c reload
-# restart i3 inplace (preserves your layout/session, can be used to upgrade i3)
-# also destroy anything in startup workspace
-bindsym $mod+Shift+r restart [workspace=] kill
-# exit i3 (logs you out of your X session)
-bindsym $mod+Shift+e exec "i3-nagbar -t warning -m 'You pressed the exit shortcut. Do you really want to exit i3? This will end your X session.' -b 'Yes, exit i3' 'i3-msg exit'"
-
-# resize window (you can also use the mouse for that)
-mode "resize" {
-        # These bindings trigger as soon as you enter the resize mode
-
-        # Pressing left will shrink the window’s width.
-        # Pressing right will grow the window’s width.
-        # Pressing up will shrink the window’s height.
-        # Pressing down will grow the window’s height.
-        bindsym h resize shrink width 10 px or 10 ppt
-        bindsym j resize shrink height 10 px or 10 ppt
-		bindsym k resize grow height 10 px or 10 ppt
-        bindsym l resize grow width 10 px or 10 ppt
-
-        # same bindings, but for the arrow keys
-        bindsym Left resize shrink width 10 px or 10 ppt
-        bindsym Down resize grow height 10 px or 10 ppt
-        bindsym Up resize shrink height 10 px or 10 ppt
-        bindsym Right resize grow width 10 px or 10 ppt
-
-        # back to normal: Enter or Escape
-	bindsym $mod+R mode "default"
-        bindsym Return mode "default"
-        bindsym Escape mode "default"
-}
-
-bindsym $mod+r mode "resize"
-bindsym $mod+p exec i3lock-fancy
-
-# Start i3bar to display a workspace bar (plus the system information i3status
-# finds out, if available)
-#bar {
-#		font pango:DejaVu Sans Mono, Awesome 8
-#        status_command i3blocks
-#	colors {
-#		background #23313D
-#	    	separator #757575
-#		#                  border             background         text
-#		focused_workspace  $inactive-bg-color $bg-color          $text-color
-#		inactive_workspace $bg-color 	      $bg-color      	 $text-color
-#		urgent_workspace   $urgent-bg-color   $urgent-bg-color   $text-color
-#	}
-#}
-
-
-#SCROT
-bindsym --release Print exec "scrot ~/Pictures/Screenshots/%b%d:%H%M%S.png"
-
-# Alsa controls
-bindsym XF86AudioMute exec amixer set Master toggle;  exec pkill  -RTMIN+10 i3blocks
-bindsym XF86AudioRaiseVolume exec amixer set Master 5%+; exec pkill  -RTMIN+10 i3blocks
-bindsym XF86AudioLowerVolume exec amixer set Master 5%-; exec pkill  -RTMIN+10 i3blocks
-
-#Pulse Audio controls
-#bindsym XF86AudioRaiseVolume exec amixer -q -D pulse sset Master 2%+;
-#exec pkill -RTMIN+10 i3blocks
-#bindsym XF86AudioLowerVolume exec amixer -q -D pulse sset Master 2%-;
-#exec pkill -RTMIN+10 i3blocks
-#bindsym XF86AudioMute exec amixer -q -D pulse sset Master toggle;
-#exec pkill -RTMIN+10 i3blocks
-
-# Sreen brightness controls
-bindsym XF86MonBrightnessUp exec xbacklight -inc 20 # increase screen brightness
-bindsym XF86MonBrightnessDown exec xbacklight -dec 20 # decrease screen brightness
-
-# Touchpad controls
-bindsym XF86TouchpadToggle exec /some/path/toggletouchpad.sh # toggle touchpad
-
-# Media player controls
-bindsym XF86AudioPlay exec playerctl play
-bindsym XF86AudioPause exec playerctl pause
-#bindsym XF86AudioNext exec playerctl next
-#bindsym XF86AudioPrev exec playerctl previous
-
-
-exec systemctl --user restart polybar
-exec xrdb /home/julien/.Xressources
-
-#exec --no-startup-id i3-msg 'workspace ; exec urxvt;exec urxvt;exec urxvt;exec urxvt; workspace '

home-manager-modules/i3/default.nix

@@ -1,19 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.luj.i3;
-in with lib;
-{
-  options.luj.i3 = {
-    enable = mkEnableOption "activate i3";
-  };
-
-  config = mkIf cfg.enable {
-    xsession.windowManager.i3 = {
-      enable = true;
-      package = pkgs.i3-gaps;
-    };
-
-    xdg.configFile."i3/config".source = lib.mkForce ./config;
-
-  };
-}

home-manager-modules/kitty/default.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.kitty;
+in
+with lib;
+{
+  options.luj.programs.kitty = {
+    enable = mkEnableOption "Enable Kitty";
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.kitty = {
+      enable = true;
+      settings = {
+        wayland_titlebar_color = "background";
+        shell_integration = "no-cursor";
+        window_padding_width = 3;
+        font_size = 10;
+        confirm_os_window_close = 0;
+      };
+      font = {
+        name = "FiraCode Nerd Font Mono Reg";
+        package = pkgs.nerd-fonts.fira-code;
+      };
+      themeFile = "Catppuccin-Mocha";
+
+    };
+  };
+}

home-manager-modules/mails/afewconfig

@@ -1,90 +0,0 @@
-
-
-[Filter.1]
-query = subject:"Formulaire d'externement"
-tags =  +externement
-message = Externement
-
-
-[Filter.2]
-query = subject:/\[DG\]/
-tags = +dg
-message = Mail pour la DG
-
-[Filter.3]
-query = subject:"Demande de malle"
-tags = +malle
-message = Malle
-
-[Filter.4]
-query = subject:"Demande d'inscription de"
-tags = +thurnage
-message = Thurnage
-
-[Filter.5]
-query = subject:"Formulaire situation de"
-tags = +situation
-message = Situation
-
-[Filter.6]
-query = subject:"Inscription au thurnage général de"
-tags = +thurnage
-message = TG
-
-[Filter.7]
-query = subject:"Prévision d'externement de"
-tags = +externement
-message = previsionext
-
-[Filter.8]
-query = subject:"Demande d'accès"
-tags = +malle
-message = acces
-
-[Filter.9]
-query = subject:"Rendu de malle"
-tags = +malle
-message = rendu
-
-[Filter.10]
-query = subject:"Prolongation de la malle"
-tags = +malle
-message = prolong
-
-[Filter.11]
-query = subject:"Fermeture de l'internat"
-tags = +fermeture
-message = fermeture
-
-[Filter.12]
-query = subject:/\[COF\]/
-tags = +cof
-message = COF
-
-[Filter.13]
-query = subject:"Modification inscription TG"
-tags= +thurnage
-
-[Filter.14]
-query = subject:/\[Pouët-Pouêt\]/
-tags = +fanfare
-message = fanfare
-
-[Filter.15]
-query = subject:/\[K-Fêt\]/
-tags = +kfet
-message = kfet 
-
-[Filter.16]
-query = subject:/\[Chef.fe.s\]/
-tags = +chefs
-message = chefs
-
-
-[InboxFilter]
-
-[MailMover]
-folders = ens/INBOX ens/DG
-rename = True
-ens/INBOX = 'tag:dg':ens/DG 'tag:COF':ens/COF 'tag:fanfare':ens/Fanfare 'tag:kfet':ens/K-Fet 'tag:chefs':ens/K-Fet/Chefs 
-ens/DG = 'tag:externement':ens/DG/Externements 'tag:malle':ens/DG/Malles 'tag:thurnage':ens/DG/Thurnages 'tag:situation':ens/DG/Situations 'tag:fermeture':ens/DG/Fermeture

home-manager-modules/mails/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.luj.emails;
 in
@@ -6,68 +11,156 @@ with lib;
 {
   options.luj.emails = {
     enable = mkEnableOption "enable mail management";
-    backend.enable = mkEnableOption "enable filtering backend";
   };
 
+  config = mkIf cfg.enable {
 
-  config = mkMerge [
+    age.secrets.work-mail-pw = {
-    (mkIf cfg.enable {
+      file = ../../secrets/work-mail-pw.age;
-      programs.mbsync.enable = true;
+    };
-      programs.neomutt.enable = true;
+
-      programs.msmtp.enable = true;
+    age.secrets.dgnum-mail-pw = {
-      accounts.email = {
+      file = ../../secrets/dgnum-mail-pw.age;
-        accounts.ens = {
+    };
-          address = "julien.malka@ens.fr";
+
-          imap.host = "clipper.ens.fr";
+    age.secrets.telecom-mail-pw = {
-          mbsync = {
+      file = ../../secrets/telecom-mail-pw.age;
-            enable = true;
+    };
-            create = "maildir";
+
-            extraConfig.channel = {
+    age.secrets.ens-mail-pw = {
-              "CopyArrivalDate" = "yes";
+      file = ../../secrets/ens-mail-pw.age;
-            };
+    };
+
+    programs.mbsync = {
+      enable = lib.mkDefault true;
+      package = pkgs.unstable.isync;
+    };
+
+    programs.msmtp.enable = true;
+    accounts.email = {
+      accounts.ens = {
+        notmuch.enable = true;
+        folders.inbox = "INBOX";
+        address = "julien.malka@ens.fr";
+        imap.host = "clipper.ens.fr";
+        mbsync = {
+          enable = true;
+          create = "maildir";
+          expunge = "both";
+          extraConfig.channel = {
+            "CopyArrivalDate" = "yes";
           };
-          msmtp.enable = true;
-          primary = true;
-          realName = "Julien Malka";
-          passwordCommand = "${pkgs.gnupg}/bin/gpg -q --batch --passphrase-file /home/julien/email-passphrase -d ${./ens.pass.gpg}";
-          smtp = {
-            host = "clipper.ens.fr";
-          };
-          userName = "jmalka";
         };
+        msmtp.enable = true;
+        primary = true;
+        realName = "Julien Malka";
+        passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.ens-mail-pw.path}";
+        smtp = {
+          host = "clipper.ens.fr";
+        };
+        userName = "jmalka";
       };
-      services.mbsync = {
+      accounts.work = {
-        enable = true;
+        notmuch.enable = true;
-        frequency = "*-*-* *:*:00";
+        folders.inbox = "INBOX";
-        verbose = false;
+        address = "julien@malka.sh";
-      };
+        imap.host = "mail.luj.fr";
-      xdg.configFile = {
+        mbsync = {
-        "neomutt/neomuttrc".source = lib.mkForce ./neomuttrc;
+          enable = true;
+          create = "maildir";
+          expunge = "both";
+          extraConfig.channel = {
+            "CopyArrivalDate" = "yes";
+          };
+        };
+        msmtp.enable = true;
+        primary = false;
+        realName = "Julien Malka";
+        passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.work-mail-pw.path}";
+        smtp = {
+          host = "mail.luj.fr";
+        };
+        userName = "malka";
       };
 
-
+      accounts.telecom = {
-    })
+        notmuch.enable = true;
-
+        folders.inbox = "INBOX";
-    (mkIf (cfg.enable && cfg.backend.enable) {
+        address = "julien.malka@telecom-paris.fr";
-      programs.afew.enable = true;
+        imap.host = "z.imt.fr";
-      accounts.email.accounts.ens.notmuch.enable = true;
+        mbsync = {
-      services.mbsync.postExec = "${pkgs.notmuch}/bin/notmuch new";
+          enable = true;
-      programs.notmuch = {
+          create = "maildir";
-        enable = true;
+          expunge = "both";
-        new.tags = [ "new" ];
+          extraConfig.channel = {
-        hooks.postNew = ''
+            "CopyArrivalDate" = "yes";
-          ${pkgs.afew}/bin/afew --tag --new
+          };
-          ${pkgs.afew}/bin/afew --move-mails
+        };
-        '';
+        msmtp.enable = true;
-      };
+        primary = false;
-      xdg.configFile = {
+        realName = "Julien Malka";
-        "afew/config".source = lib.mkForce ./afewconfig;
+        passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.telecom-mail-pw.path}";
+        smtp = {
+          host = "z.imt.fr";
+        };
+        userName = "julien.malka@telecom-paris.fr";
       };
 
+      accounts.dgnum = {
+        notmuch.enable = true;
+        folders.inbox = "INBOX";
+        address = "luj@dgnum.eu";
+        imap.host = "kurisu.lahfa.xyz";
+        mbsync = {
+          enable = true;
+          create = "maildir";
+          expunge = "both";
+          extraConfig.channel = {
+            "CopyArrivalDate" = "yes";
+          };
+        };
+        msmtp.enable = true;
+        primary = false;
+        realName = "Julien Malka";
+        passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.dgnum-mail-pw.path}";
+        smtp = {
+          host = "kurisu.lahfa.xyz";
+        };
+        userName = "luj@dgnum.eu";
+      };
 
-    })
+    };
 
+    services.mbsync = {
+      enable = lib.mkDefault true;
+      frequency = "minutely";
+      package = pkgs.unstable.isync;
+    };
 
-  ];
+    services.mbsync.postExec = lib.mkDefault "${pkgs.notmuch}/bin/notmuch new";
 
+    programs.notmuch = {
+      enable = lib.mkDefault true;
+      new.tags = [ "new" ];
+      hooks.preNew = lib.mkDefault ''
+        ${pkgs.notmuch-mailmover}/bin/notmuch-mailmover --config ${./mailmover.lua}
+      '';
+      hooks.postNew = lib.mkDefault ''
+        ${pkgs.afew}/bin/afew --tag --new
+      '';
+    };
+
+    programs.afew = {
+      enable = true;
+      extraConfig = ''
+        [FolderNameFilter]
+        maildir_separator = /
+        folder_lowercases = true
+        [Filter.1]
+        query = tag:new
+        tags = -new
+      '';
+    };
+
+  };
 }

home-manager-modules/mails/mailmover.lua

@@ -0,0 +1,173 @@
+local match_modes = {
+    ALL = "all",
+    FIRST = "first",
+    UNIQUE = "unique",
+}
+
+--- Execute a shell command and return its output
+local function execute_command(cmd)
+    local handle = io.popen(cmd)
+    local result = handle:read("*a")
+    handle:close()
+    return result
+end
+
+--- Get all folders from the Maildir structure
+local function get_maildir_folders(maildir_path)
+    local cmd = "find " .. maildir_path .. " -type d -name cur | sed 's|/cur$||' | sed 's|" .. maildir_path .. "/||'"
+    local output = execute_command(cmd)
+    
+    local folders = {}
+    for folder in string.gmatch(output, "([^\n]+)") do
+        if folder ~= "" then
+            folders[#folders+1] = folder
+        end
+    end
+    
+    return folders
+end
+
+--- Check if one path is a parent of another
+local function is_parent_path(parent, child)
+    return child:match("^" .. parent .. "/") ~= nil
+end
+
+--- Check if a folder contains "Archive" in its name
+local function contains_archive(folder)
+    return string.find(folder, "Archive") ~= nil
+end
+
+--- Generate rules based on folder structure
+local function generate_rules(maildir_path)
+    local folders = get_maildir_folders(maildir_path)
+    local rules = {}
+    
+    -- Create a sorted copy of folders, from longest path to shortest
+    -- This ensures we process children before parents
+    local sorted_folders = {}
+    for _, folder in ipairs(folders) do
+        table.insert(sorted_folders, folder)
+    end
+    table.sort(sorted_folders, function(a, b) 
+        return #a > #b 
+    end)
+    
+    -- Store each folder's subfolder tags for exclusion
+    local subfolder_tags = {}
+    for _, folder in ipairs(sorted_folders) do
+        subfolder_tags[folder] = {}
+    end
+    
+    -- Collect all subfolder-specific tags for each folder
+    for _, folder in ipairs(sorted_folders) do
+        local parts = {}
+        for part in string.gmatch(folder, "([^/]+)") do
+            table.insert(parts, part)
+        end
+        
+        -- For each folder, find its parent folders and add its deepest tag to their exclusion list
+        if #parts > 0 then
+            local deepest_tag = string.lower(parts[#parts])
+            local parent_path = ""
+            
+            for i = 1, #parts - 1 do
+                if i > 1 then
+                    parent_path = parent_path .. "/"
+                end
+                parent_path = parent_path .. parts[i]
+                
+                -- Add this tag to the parent's exclusion list
+                if subfolder_tags[parent_path] then
+                    table.insert(subfolder_tags[parent_path], deepest_tag)
+                end
+            end
+        end
+    end
+    
+    -- Now generate rules with proper exclusions
+    for _, folder in ipairs(folders) do
+        -- Skip Trash and Sent as they're already handled
+        if folder ~= "Trash" and folder ~= "Sent" then
+            local query_parts = {}
+            local exclusion_parts = {}
+            
+            -- Convert each folder component to a lowercase tag requirement
+            for part in string.gmatch(folder, "([^/]+)") do
+                table.insert(query_parts, "tag:" .. string.lower(part))
+            end
+            
+            -- Add exclusions for subfolder-specific tags
+            if subfolder_tags[folder] then
+                for _, tag in ipairs(subfolder_tags[folder]) do
+                    table.insert(exclusion_parts, "not tag:" .. tag)
+                end
+            end
+            
+            -- Add "not tag:sent" for any folder containing "Archive"
+            if contains_archive(folder) then
+                table.insert(exclusion_parts, "not tag:sent")
+            end
+            
+            -- Build the complete query
+            local query = table.concat(query_parts, " and ")
+            if #exclusion_parts > 0 then
+                query = query .. " and " .. table.concat(exclusion_parts, " and ")
+            end
+            
+            -- Add rule for this folder
+            rules[#rules+1] = {
+                folder = folder,
+                query = query,
+            }
+        end
+    end
+    
+    -- Sort rules by complexity (number of tags) - more specific rules first
+    table.sort(rules, function(a, b)
+        if a.folder == "Trash" then return true end
+        if b.folder == "Trash" then return false end
+        if a.folder == "Sent" then return true end
+        if b.folder == "Sent" then return false end
+        
+        local a_count = select(2, string.gsub(a.query, "tag:", ""))
+        local b_count = select(2, string.gsub(b.query, "tag:", ""))
+        return a_count > b_count
+    end)
+
+   local final_rules = {}
+    for _, rule in ipairs(rules) do
+        if string.lower(rule.folder) ~= "drafts" then
+            table.insert(final_rules, rule)
+        end
+    end 
+    
+    return final_rules
+end
+
+-- Path to maildir
+local maildir_path = os.getenv("HOME") .. "/Maildir"
+
+--- Configuration for notmuch-mailmover.
+--
+--- @class config
+--- @field maildir      string                  Path to the maildir
+--- @field notmuch_config string                Path to the notmuch configuration
+--- @field rename       boolean                 Rename the files when moving
+--- @field max_age_days number                  Maximum age (days) of the messages to be procssed
+--- @field rule_match_mode config.match_mode    Match mode for rules
+--- @field rules        rule[]                  List of rules
+---
+--- @class rule
+--- @field folder string Folder to move the messages to
+--- @field query  string Notmuch query to match the messages
+local config = {
+    maildir = maildir_path,
+    notmuch_config = "/home/julien/.config/notmuch/default/config",
+    rename = true,
+    max_age_days = 356,
+    rule_match_mode = match_modes.UNIQUE,
+    rules = generate_rules(maildir_path),
+}
+
+
+return config

home-manager-modules/mails/neomuttrc

@@ -1,83 +0,0 @@
-set from = "julien.malka@ens.fr"
-
-# Nom complet de l'expéditeur
-set realname = "Julien Malka"
-
-# Génération du champs from
-set use_from = yes
-
-set edit_headers=yes
-set reverse_name
-set mark_old=no
-set editor = "nvim -c 'set tw=72' -c 'set wrap'"
-#set editor="vim +':set textwidth=0' +':set wrapmargin=0' +':set wrap'"
-#set wrap="72"
-set folder = ~/Maildir/ens
-
-set mbox_type=Maildir
-set virtual_spoolfile=yes
-set header_cache=~/.cache/mutt
-set sidebar_visible = yes
-set record = "+Sent\ Messages"
-#mailboxes =Inbox =DG =DG/Malles =DG/Externements =DG/Thurnages =DG/Situations =DG/Fermeture =Sent\ Messages
-#named-mailboxes "Malles" =DG/Malles
-#named-mailboxes "Externements" =DG/Externements
-#named-mailboxes "Thurnages" =DG/Thurnages
-#named-mailboxes "Situations" =DG/Situations
-#named-mailboxes "Fermeture" =DG/Fermeture
-#named-mailboxes "Sent" =Sent\ Messages
-set nm_unread_tag = unread
-set mail_check_stats=yes
-set sidebar_short_path = yes
-
-
-set timeout=10
-set mail_check=10
-virtual-mailboxes "Inbox" "notmuch://?query=tag:inbox and NOT tag:dg and NOT tag:cof and NOT tag:fanfare and NOT tag:kfet and NOT tag:chefs"
-virtual-mailboxes "K-Fêt" "notmuch://?query=tag:kfet"
-virtual-mailboxes "Chefs" "notmuch://?query=tag:chefs"
-virtual-mailboxes "DG" "notmuch://?query=tag:dg and NOT tag:externement and NOT tag:fermeture and NOT tag:malle and NOT tag:situation and NOT tag:thurnage"
-virtual-mailboxes "Externements" "notmuch://?query=tag:externement"
-virtual-mailboxes "Fermeture" "notmuch://?query=tag:fermeture"
-virtual-mailboxes "Malles" "notmuch://?query=tag:malle"
-virtual-mailboxes "Situations" "notmuch://?query=tag:situation"
-virtual-mailboxes "Thurnages" "notmuch://?query=tag:thurnage"
-virtual-mailboxes "Fanfare" "notmuch://?query=tag:fanfare"
-
-set sidebar_width=15
-set sidebar_divider_char='|'
-# color of folders with new mail
-# ctrl-n, ctrl-p to select next, prev folder# ctrl-o to open selected folder
-bind index \CP sidebar-prev
-bind index \CN sidebar-next
-bind index \CO sidebar-open
-bind pager \CP sidebar-prev
-bind pager \CN sidebar-next
-bind pager \CO sidebar-open
-bind pager <Backspace> previous-line
-set nm_default_url = "notmuch:///home/julien/Maildir"
-
-macro index \\ "<vfolder-from-query>"
-set metoo=yes
-
-set text_flowed
-
-set collapse_unread = no
-set collapse_all = yes
-
-bind index - collapse-thread
-
-
-
-set sort = threads 
-set sort_aux = reverse-last-date-received
-
-folder-hook .  'source /home/julien/dotfiles/profile.default'
-folder-hook "DG"  'source /home/julien/dotfiles/profile.dg'
-folder-hook "K-Fêt" 'source /home/julien/dotfiles/profile.kfet'
-folder-hook "Chefs" 'source /home/julien/dotfiles/profile.chefs'
-set sidebar_format = '%D%* %?N?(%N)?%*'
-color sidebar_unread yellow default
-
-source ~/dotfiles/dracula.muttrc
-set sendmail = "msmtp"

home-manager-modules/neovim/default.nix

@@ -1,16 +1,12 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  home,
+  lib,
+  config,
+  ...
+}:
 let
   cfg = config.luj.programs.neovim;
-  dusk-vim = pkgs.vimUtils.buildVimPlugin {
-    name = "dusk-vim";
-    src = pkgs.fetchFromGitHub {
-      owner = "notusknot";
-      repo = "dusk-vim";
-      rev = "8eb71f092ebfa173a6568befbe522a56e8382756";
-      sha256 = "09l4hda5jnyigc2hhlirv1rc8hsnsc4zgcv4sa4br8fryi73nf4g";
-    };
-  };
-
 in
 with lib;
 {
@@ -19,54 +15,166 @@ with lib;
   };
 
   config = mkIf cfg.enable {
+
+    home.packages = with pkgs; [
+      git
+      nodejs
+      ripgrep
+      gcc
+    ];
+
     programs.neovim = {
       enable = true;
       package = pkgs.neovim-unwrapped;
+      viAlias = true;
+      vimAlias = true;
+      vimdiffAlias = true;
+
+      coc = {
+        enable = true;
+        settings = {
+          coc.preferences.formatOnSaveFiletypes = [
+            "nix"
+            "rust"
+            "sql"
+            "python"
+            "haskell"
+          ];
+          rust-analyzer.enable = true;
+          rust-analyzer.cargo.allFeatures = true;
+          rust-analyzer.checkOnSave.allTargets = true;
+          languageserver = {
+            python = {
+              command = "pyright";
+              filetypes = [
+                "py"
+                "python"
+              ];
+            };
+
+            haskell = {
+              command = "haskell-language-server-wrapper";
+              args = [ "--lsp" ];
+              rootPatterns = [
+                "*.cabal"
+                "cabal.project"
+                "hie.yaml"
+                ".stack.yaml"
+              ];
+              filetypes = [
+                "haskell"
+                "lhaskell"
+                "hs"
+                "lhs"
+              ];
+              settings = {
+                haskell = {
+                  checkParents = "CheckOnSave";
+                  checkProject = true;
+                  maxCompletions = 40;
+                  formattingProvider = "ormolu";
+                };
+              };
+            };
+
+            go = {
+              command = "gopls";
+              rootPatterns = [
+                "go.work"
+                "go.mod"
+                ".vim/"
+                ".git/"
+                ".hg/"
+              ];
+              filetypes = [ "go" ];
+              initializationOptions = {
+                usePlaceholders = true;
+              };
+            };
+
+            nix = {
+              command = "nixd";
+              filetypes = [ "nix" ];
+              settings.nixd.formatting.command = [ "nixfmt" ];
+            };
+
+            ccls = {
+              command = "ccls";
+              filetypes = [
+                "c"
+                "cpp"
+                "objc"
+                "objcpp"
+              ];
+              rootPatterns = [
+                ".ccls"
+                "compile_commands.json"
+                ".vim/"
+                ".git/"
+                ".hg/"
+              ];
+              initializationOptions = {
+                cache = {
+                  directory = "/tmp/ccls";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      withPython3 = true;
       plugins = with pkgs.vimPlugins; [
-        # File tree
+        plenary-nvim
-        nvim-web-devicons
-        nvim-tree-lua
-        # LSP
-        nvim-lspconfig
-        # Languages
-        vim-nix
 
-        # Eyecandy 
+        #Telescope
-        nvim-treesitter
-        bufferline-nvim
-        galaxyline-nvim
-        nvim-colorizer-lua
-        pears-nvim
-        dusk-vim
-
-        # Lsp and completion
-        nvim-lspconfig
-        nvim-compe
-
-        # Telescope
         telescope-nvim
 
-        # Indent lines
+        nvim-web-devicons
-        #indent-blankline-nvim
+
+        catppuccin-nvim
+
+        pkgs.unstable.vimPlugins.bufferline-nvim
+        nvim-colorizer-lua
+        pears-nvim
+        nvim-tree-lua
+
+        (nvim-treesitter.withPlugins (
+          ps: with ps; [
+            tree-sitter-nix
+            tree-sitter-python
+          ]
+        ))
+
+        vim-lastplace
+        vim-nix
+        vim-nixhash
+        vim-yaml
+        vim-toml
+        vim-airline
+        vim-devicons
+        zig-vim
+        vim-scriptease
+        semshi
+        coc-prettier
+        coc-pyright
+        coc-rust-analyzer
+        rust-vim
       ];
+
       extraPackages = with pkgs; [
-        gcc
+        rust-analyzer
-        rnix-lsp
+        pkgs.nixd
-        tree-sitter
+        pyright
-        sumneko-lua-language-server
+        ormolu
+        ccls
+        gopls
+        unstable.nixfmt-rfc-style
       ];
+
       extraConfig = ''
-        luafile ${./lua}/lsp.lua
+        luafile ${./settings.lua}
-        luafile ${./lua}/nvim-tree.lua
-        luafile ${./lua}/galaxyline.lua
-        luafile ${./lua}/settings.lua
       '';
     };
   };
-
 }
-
-
-
-
-

home-manager-modules/neovim/lua/galaxyline.lua

@@ -1,204 +0,0 @@
- -- This file configures galaxyline, a fast and small statusline for nvim.
- -- The configuration was taken from github.com/siduck76/neovim-dotfiles/ 
- -- All I did was change the colors. Full credit goes to siduck76
-
-local gl = require("galaxyline")
-local gls = gl.section
-
-gl.short_line_list = {" "} -- keeping this table { } as empty will show inactive statuslines
-
-local colors = {
-    bg = "#2e303e",
-    line_bg = "#2e303e",
-    fg = "#e3e6ee",
-    green = "#29d398",
-    orange = "#efb993",
-    red = "#e95678",
-    lightbg = "#2e303e",
-    lightbasdfg = "#393b4d",
-    nord = "#9699b7",
-    greenYel = "#efb993"
-}
-
-gls.left[1] = {
-    leftRounded = {
-        provider = function()
-            return " "
-        end,
-        highlight = {colors.nord, colors.bg}
-    }
-}
-
-gls.left[2] = {
-    statusIcon = {
-        provider = function()
-            return "  "
-        end,
-        highlight = {colors.fg, colors.bg},
-        separator = " ",
-        separator_highlight = {colors.lightbg, colors.lightbg}
-    }
-}
-
-gls.left[3] = {
-    FileIcon = {
-        provider = "FileIcon",
-        condition = buffer_not_empty,
-        highlight = {require("galaxyline.provider_fileinfo").get_file_icon_color, colors.lightbg}
-    }
-}
-
-gls.left[4] = {
-    FileName = {
-        provider = {"FileName", "FileSize"},
-        condition = buffer_not_empty,
-        highlight = {colors.fg, colors.lightbg}
-    }
-}
-
-gls.left[5] = {
-    teech = {
-        provider = function()
-            return " "
-        end,
-        separator = " ",
-        highlight = {colors.lightbg, colors.bg}
-    }
-}
-
-local checkwidth = function()
-    local squeeze_width = vim.fn.winwidth(0) / 2
-    if squeeze_width > 40 then
-        return true
-    end
-    return false
-end
-
-gls.left[6] = {
-    DiffAdd = {
-        provider = "DiffAdd",
-        condition = checkwidth,
-        icon = "   ",
-        highlight = {colors.greenYel, colors.line_bg}
-    }
-}
-
-gls.left[7] = {
-    DiffModified = {
-        provider = "DiffModified",
-        condition = checkwidth,
-        icon = " ",
-        highlight = {colors.orange, colors.line_bg}
-    }
-}
-
-gls.left[8] = {
-    DiffRemove = {
-        provider = "DiffRemove",
-        condition = checkwidth,
-        icon = " ",
-        highlight = {colors.lightbg, colors.line_bg}
-    }
-}
-
-gls.left[9] = {
-    LeftEnd = {
-        provider = function()
-            return " "
-        end,
-        separator = " ",
-        separator_highlight = {colors.line_bg, colors.line_bg},
-        highlight = {colors.line_bg, colors.line_bg}
-    }
-}
-
-gls.left[10] = {
-    DiagnosticError = {
-        provider = "DiagnosticError",
-        icon = "  ",
-        highlight = {colors.red, colors.bg}
-    }
-}
-
-gls.left[11] = {
-    Space = {
-        provider = function()
-            return " "
-        end,
-        highlight = {colors.line_bg, colors.line_bg}
-    }
-}
-
-gls.left[12] = {
-    DiagnosticWarn = {
-        provider = "DiagnosticWarn",
-        icon = "  ",
-        highlight = {colors.red, colors.bg}
-    }
-}
-
-gls.right[1] = {
-    GitIcon = {
-        provider = function()
-            return "   "
-        end,
-        condition = require("galaxyline.provider_vcs").check_git_workspace,
-        highlight = {colors.green, colors.line_bg}
-    }
-}
-
-gls.right[2] = {
-    GitBranch = {
-        provider = "GitBranch",
-        condition = require("galaxyline.provider_vcs").check_git_workspace,
-        highlight = {colors.green, colors.line_bg}
-    }
-}
-
-gls.right[3] = {
-    right_LeftRounded = {
-        provider = function()
-            return " " 
-        end,
-        separator = " ",
-        separator_highlight = {colors.bg, colors.bg},
-        highlight = {colors.lightbg, colors.bg}
-    }
-}
-
-gls.right[4] = {
-    ViMode = {
-        provider = function()
-            local alias = {
-                n = "NORMAL",
-                i = "INSERT",
-                c = "COMMAND",
-                V = "VISUAL",
-                [""] = "VISUAL",
-                v = "VISUAL",
-                R = "REPLACE"
-            }
-            return alias[vim.fn.mode()]
-        end,
-        highlight = {colors.fg, colors.lightbg}
-    }
-}
-
-gls.right[5] = {
-    PerCent = {
-        provider = "LinePercent",
-        separator = " ",
-        separator_highlight = {colors.lightbg, colors.lightbg},
-        highlight = {colors.fg, colors.lightbg}
-    }
-}
-
-gls.right[6] = {
-    rightRounded = {
-        provider = function()
-            return " "
-        end,
-        highlight = {colors.lightbg, colors.bg}
-    }
-}
-

home-manager-modules/neovim/lua/lsp.lua

@@ -1,76 +0,0 @@
--- This file sets up autocompletion for neovim's native lsp
-
--- This enables all the language servers I want on my system
--- Change these to whatever languages you use
-
-require'lspconfig'.rnix.setup{}
-require'lspconfig'.sumneko_lua.setup{}
-vim.o.completeopt = "menuone,noselect"
-
--- Autocompletion setup
-require'compe'.setup {
-    enabled = true;
-    autocomplete = true;
-    debug = false;
-    min_length = 1;
-    preselect = 'enable';
-    throttle_time = 80;
-    source_timeout = 200;
-    incomplete_delay = 400;
-    max_abbr_width = 100;
-    max_kind_width = 100;
-    max_menu_width = 100;
-    documentation = false;
-    source = {
-        path = true;
-        buffer = true;
-        nvim_lsp = true;
-        treesitter = true;
-    };
-}
-
--- Set tab to accept the autocompletion
-local t = function(str)
-    return vim.api.nvim_replace_termcodes(str, true, true, true)
-end
-_G.tab_complete = function()
-    if vim.fn.pumvisible() == 1 then
-        return t "<C-n>"
-    else
-        return t "<S-Tab>"
-    end
-end
-
-vim.api.nvim_set_keymap("i", "<Tab>", "v:lua.tab_complete()", {expr = true})
-vim.api.nvim_set_keymap("s", "<Tab>", "v:lua.tab_complete()", {expr = true})
-
-
--- set the path to the sumneko installation; if you previously installed via the now deprecated :LspInstall, use
-local sumneko_root_path = vim.fn.stdpath('cache')..'/lspconfig/sumneko_lua/lua-language-server'
-local sumneko_binary = "lua-language-server"
-
-local runtime_path = vim.split(package.path, ';')
-table.insert(runtime_path, "lua/?.lua")
-table.insert(runtime_path, "lua/?/init.lua")
-
-require'lspconfig'.sumneko_lua.setup {
-    cmd = {sumneko_binary, "-E", sumneko_root_path .. "/main.lua"};
-    settings = {
-        Lua = {
-            runtime = {
-                version = 'LuaJIT',
-                path = runtime_path,
-            },
-            diagnostics = {
-                globals = {'vim'},
-            },
-            workspace = {
-                library = vim.api.nvim_get_runtime_file("", true),
-                preloadFileSize = 120
-            },
-            telemetry = {
-                enable = false,
-            },
-        },
-    },
-}

home-manager-modules/neovim/lua/nvim-tree.lua

@@ -1,60 +0,0 @@
--- following options are the default
--- each of these are documented in `:help nvim-tree.OPTION_NAME`
-require'nvim-tree'.setup {
-  disable_netrw       = true,
-  hijack_netrw        = true,
-  open_on_setup       = false,
-  ignore_ft_on_setup  = {},
-  auto_close          = false,
-  open_on_tab         = false,
-  hijack_cursor       = false,
-  update_cwd          = false,
-  update_to_buf_dir   = {
-    enable = true,
-    auto_open = true,
-  },
-  diagnostics = {
-    enable = false,
-    icons = {
-      hint = "",
-      info = "",
-      warning = "",
-      error = "",
-    }
-  },
-  update_focused_file = {
-    enable      = false,
-    update_cwd  = false,
-    ignore_list = {}
-  },
-  system_open = {
-    cmd  = nil,
-    args = {}
-  },
-  filters = {
-    dotfiles = false,
-    custom = {}
-  },
-  git = {
-    enable = true,
-    ignore = true,
-    timeout = 500,
-  },
-  view = {
-    width = 30,
-    height = 30,
-    hide_root_folder = false,
-    side = 'left',
-    auto_resize = false,
-    mappings = {
-      custom_only = false,
-      list = {}
-    },
-    number = false,
-    relativenumber = false
-  },
-  trash = {
-    cmd = "trash",
-    require_confirm = true
-  }
-}

home-manager-modules/neovim/lua/settings.lua

@@ -1,96 +0,0 @@
--- Lazy load everything!
--- 
---
---dofile("lsp.lua")
---dofile("galaxyline.lua")
---dofile("nvim-tree.lua")
-local opt = vim.opt
-local g = vim.g
- 
-
-vim.cmd [[
-    set nowrap
-    set nobackup
-    set nowritebackup
-    set noerrorbells
-    set noswapfile
-    
-    colorscheme dusk
-    function! Preserve(command)
-      let w = winsaveview()
-      execute a:command
-      call winrestview(w)
-    endfunction
-    autocmd FileType nix map <nowait> <leader>u :call Preserve("%!update-nix-fetchgit --location=" . line(".") . ":" . col("."))<CR>
-    autocmd BufWinEnter NvimTree setlocal nonumber
-    map ; :
-    highlight IndentBlanklineChar guifg = #393b4d
-
-]]
-
--- Enable plugins
-require('bufferline').setup{}
-require('pears').setup()
-require('colorizer').setup()
-
--- Treesitter settings
-require'nvim-treesitter.configs'.setup {
-    ensure_installed = "all", -- one of "all", "maintained" (parsers with maintainers), or a list of languages
-    highlight = {
-        enable = true
-    },
-}
-
-local map = vim.api.nvim_set_keymap
-options = { noremap = true }
-map('n', '<C-p>', ':NvimTreeToggle <CR>', options)
-map('n', '<C-f>', ':Telescope find_files <CR>', options)
-map('n', '<C-n>', ':Telescope live_grep <CR>', options)
-map('n', '<C-l>', ':noh <CR>', options)
-map('n', '<C-s>', ':!xclip -sel c -o | pygmentize -f html | xclip -sel c <CR> <CR>', options)
-vim.api.nvim_set_keymap('n', '0', "getline('.')[0 : col('.') - 2] =~# '^\\s\\+$' ? '0' : '^'", {silent = true, noremap = true, expr = true})
-g.mapleader = ' '
-
--- Indent line
-g.indent_blankline_char = '▏'
-
--- Performance
-opt.lazyredraw = true;
-opt.shell = "zsh"
-opt.shadafile = "NONE"
-
--- Colors
-opt.termguicolors = true
-
--- Undo files
-opt.undofile = true
-
--- Indentation
-opt.smartindent = true
-opt.tabstop = 4
-opt.shiftwidth = 4
-opt.shiftround = true
-opt.expandtab = true
-opt.scrolloff = 3
-
--- Set clipboard to use system clipboard
-opt.clipboard = "unnamedplus"
-
--- Use mouse
-opt.mouse = "a"
-
--- Nicer UI settings
-opt.cursorline = true
-opt.relativenumber = true
-opt.number = true
-
--- Get rid of annoying viminfo file
-opt.viminfo = ""
-opt.viminfofile = "NONE"
-
--- Miscellaneous quality of life
-opt.ignorecase = true
-opt.ttimeoutlen = 5
-opt.compatible = false
-opt.hidden = true
-opt.shortmess = "atI"

home-manager-modules/neovim/settings.lua

@@ -0,0 +1,273 @@
+local opt = vim.opt
+local g = vim.g
+local keyset = vim.keymap.set
+
+opt.backup = false
+opt.writebackup = false
+opt.updatetime = 300
+opt.signcolumn = "yes"
+
+
+vim.cmd [[
+    syntax on
+    set scrolloff=4
+    set nocompatible
+    set encoding=utf-8
+    set fileencoding=utf-8
+
+    set smartindent
+    set autoindent
+    set number
+    set relativenumber
+
+    colorscheme catppuccin
+]]
+
+require("catppuccin").setup({
+    flavour = "mocha", -- latte, frappe, macchiato, mocha
+    background = { -- :h background
+        light = "latte",
+        dark = "mocha",
+    },
+    transparent_background = false,
+    show_end_of_buffer = false, -- show the '~' characters after the end of buffers
+    term_colors = false,
+    dim_inactive = {
+        enabled = false,
+        shade = "dark",
+        percentage = 0.15,
+    },
+    no_italic = false, -- Force no italic
+    no_bold = false, -- Force no bold
+    styles = {
+        comments = { "italic" },
+        conditionals = { "italic" },
+        loops = {},
+        functions = {},
+        keywords = {},
+        strings = {},
+        variables = {},
+        numbers = {},
+        booleans = {},
+        properties = {},
+        types = {},
+        operators = {},
+    },
+    color_overrides = {},
+    custom_highlights = {},
+    integrations = {
+        cmp = true,
+        gitsigns = true,
+        nvimtree = true,
+        telescope = true,
+        notify = false,
+        mini = false,
+        -- For more plugins integrations please scroll down (https://github.com/catppuccin/nvim#integrations)
+    },
+})
+
+require("nvim-tree").setup()
+local builtin = require('telescope.builtin')
+vim.keymap.set('n', 'ff', builtin.find_files, {})
+vim.keymap.set('n', 'fg', builtin.live_grep, {})
+vim.keymap.set('n', 'fb', builtin.buffers, {})
+vim.keymap.set('n', 'fh', builtin.help_tags, {})
+
+require'nvim-web-devicons'.setup()
+
+vim.opt.termguicolors = true
+require("bufferline").setup{}
+
+require('colorizer').setup()
+
+-- Treesitter settings
+require'nvim-treesitter.configs'.setup {
+    ensure_installed = "", -- one of "all", "maintained" (parsers with maintainers), or a list of languages
+    highlight = {
+        enable = true
+    },
+}
+
+
+
+-- Some servers have issues with backup files, see #649.
+vim.opt.backup = false
+vim.opt.writebackup = false
+
+-- Having longer updatetime (default is 4000 ms = 4 s) leads to noticeable
+-- delays and poor user experience.
+vim.opt.updatetime = 300
+
+-- Always show the signcolumn, otherwise it would shift the text each time
+-- diagnostics appear/become resolved.
+vim.opt.signcolumn = "yes"
+
+local keyset = vim.keymap.set
+-- Auto complete
+function _G.check_back_space()
+    local col = vim.fn.col('.') - 1
+    return col == 0 or vim.fn.getline('.'):sub(col, col):match('%s') ~= nil
+end
+
+-- Use tab for trigger completion with characters ahead and navigate.
+-- NOTE: There's always complete item selected by default, you may want to enable
+-- no select by `"suggest.noselect": true` in your configuration file.
+-- NOTE: Use command ':verbose imap <tab>' to make sure tab is not mapped by
+-- other plugin before putting this into your config.
+local opts = {silent = true, noremap = true, expr = true, replace_keycodes = false}
+keyset("i", "<TAB>", 'coc#pum#visible() ? coc#pum#next(1) : v:lua.check_back_space() ? "<TAB>" : coc#refresh()', opts)
+keyset("i", "<S-TAB>", [[coc#pum#visible() ? coc#pum#prev(1) : "\<C-h>"]], opts)
+
+-- Make <CR> to accept selected completion item or notify coc.nvim to format
+-- <C-g>u breaks current undo, please make your own choice.
+keyset("i", "<cr>", [[coc#pum#visible() ? coc#pum#confirm() : "\<C-g>u\<CR>\<c-r>=coc#on_enter()\<CR>"]], opts)
+
+-- Use <c-j> to trigger snippets
+keyset("i", "<c-j>", "<Plug>(coc-snippets-expand-jump)")
+-- Use <c-space> to trigger completion.
+keyset("i", "<c-space>", "coc#refresh()", {silent = true, expr = true})
+
+-- Use `[g` and `]g` to navigate diagnostics
+-- Use `:CocDiagnostics` to get all diagnostics of current buffer in location list.
+keyset("n", "[g", "<Plug>(coc-diagnostic-prev)", {silent = true})
+keyset("n", "]g", "<Plug>(coc-diagnostic-next)", {silent = true})
+
+-- GoTo code navigation.
+keyset("n", "gd", "<Plug>(coc-definition)", {silent = true})
+keyset("n", "gy", "<Plug>(coc-type-definition)", {silent = true})
+keyset("n", "gi", "<Plug>(coc-implementation)", {silent = true})
+keyset("n", "gr", "<Plug>(coc-references)", {silent = true})
+
+
+-- Use K to show documentation in preview window.
+function _G.show_docs()
+    local cw = vim.fn.expand('<cword>')
+    if vim.fn.index({'vim', 'help'}, vim.bo.filetype) >= 0 then
+        vim.api.nvim_command('h ' .. cw)
+    elseif vim.api.nvim_eval('coc#rpc#ready()') then
+        vim.fn.CocActionAsync('doHover')
+    else
+        vim.api.nvim_command('!' .. vim.o.keywordprg .. ' ' .. cw)
+    end
+end
+keyset("n", "K", '<CMD>lua _G.show_docs()<CR>', {silent = true})
+
+
+-- Highlight the symbol and its references when holding the cursor.
+vim.api.nvim_create_augroup("CocGroup", {})
+vim.api.nvim_create_autocmd("CursorHold", {
+    group = "CocGroup",
+    command = "silent call CocActionAsync('highlight')",
+    desc = "Highlight symbol under cursor on CursorHold"
+})
+
+
+-- Symbol renaming.
+keyset("n", "<leader>rn", "<Plug>(coc-rename)", {silent = true})
+
+
+-- Formatting selected code.
+keyset("x", "<leader>f", "<Plug>(coc-format-selected)", {silent = true})
+keyset("n", "<leader>f", "<Plug>(coc-format-selected)", {silent = true})
+
+
+-- Setup formatexpr specified filetype(s).
+vim.api.nvim_create_autocmd("FileType", {
+    group = "CocGroup",
+    pattern = "typescript,json",
+    command = "setl formatexpr=CocAction('formatSelected')",
+    desc = "Setup formatexpr specified filetype(s)."
+})
+
+-- Update signature help on jump placeholder.
+vim.api.nvim_create_autocmd("User", {
+    group = "CocGroup",
+    pattern = "CocJumpPlaceholder",
+    command = "call CocActionAsync('showSignatureHelp')",
+    desc = "Update signature help on jump placeholder"
+})
+
+
+-- Applying codeAction to the selected region.
+-- Example: `<leader>aap` for current paragraph
+local opts = {silent = true, nowait = true}
+keyset("x", "<leader>a", "<Plug>(coc-codeaction-selected)", opts)
+keyset("n", "<leader>a", "<Plug>(coc-codeaction-selected)", opts)
+
+-- Remap keys for applying codeAction to the current buffer.
+keyset("n", "<leader>ac", "<Plug>(coc-codeaction)", opts)
+
+
+-- Apply AutoFix to problem on the current line.
+keyset("n", "<leader>qf", "<Plug>(coc-fix-current)", opts)
+
+
+-- Run the Code Lens action on the current line.
+keyset("n", "<leader>cl", "<Plug>(coc-codelens-action)", opts)
+
+
+-- Map function and class text objects
+-- NOTE: Requires 'textDocument.documentSymbol' support from the language server.
+keyset("x", "if", "<Plug>(coc-funcobj-i)", opts)
+keyset("o", "if", "<Plug>(coc-funcobj-i)", opts)
+keyset("x", "af", "<Plug>(coc-funcobj-a)", opts)
+keyset("o", "af", "<Plug>(coc-funcobj-a)", opts)
+keyset("x", "ic", "<Plug>(coc-classobj-i)", opts)
+keyset("o", "ic", "<Plug>(coc-classobj-i)", opts)
+keyset("x", "ac", "<Plug>(coc-classobj-a)", opts)
+keyset("o", "ac", "<Plug>(coc-classobj-a)", opts)
+
+
+-- Remap <C-f> and <C-b> for scroll float windows/popups.
+---@diagnostic disable-next-line: redefined-local
+local opts = {silent = true, nowait = true, expr = true}
+keyset("n", "<C-f>", 'coc#float#has_scroll() ? coc#float#scroll(1) : "<C-f>"', opts)
+keyset("n", "<C-b>", 'coc#float#has_scroll() ? coc#float#scroll(0) : "<C-b>"', opts)
+keyset("i", "<C-f>",
+       'coc#float#has_scroll() ? "<c-r>=coc#float#scroll(1)<cr>" : "<Right>"', opts)
+keyset("i", "<C-b>",
+       'coc#float#has_scroll() ? "<c-r>=coc#float#scroll(0)<cr>" : "<Left>"', opts)
+keyset("v", "<C-f>", 'coc#float#has_scroll() ? coc#float#scroll(1) : "<C-f>"', opts)
+keyset("v", "<C-b>", 'coc#float#has_scroll() ? coc#float#scroll(0) : "<C-b>"', opts)
+
+
+-- Use CTRL-S for selections ranges.
+-- Requires 'textDocument/selectionRange' support of language server.
+keyset("n", "<C-s>", "<Plug>(coc-range-select)", {silent = true})
+keyset("x", "<C-s>", "<Plug>(coc-range-select)", {silent = true})
+
+
+-- Add `:Format` command to format current buffer.
+vim.api.nvim_create_user_command("Format", "call CocAction('format')", {})
+
+-- " Add `:Fold` command to fold current buffer.
+vim.api.nvim_create_user_command("Fold", "call CocAction('fold', <f-args>)", {nargs = '?'})
+
+-- Add `:OR` command for organize imports of the current buffer.
+vim.api.nvim_create_user_command("OR", "call CocActionAsync('runCommand', 'editor.action.organizeImport')", {})
+
+-- Add (Neo)Vim's native statusline support.
+-- NOTE: Please see `:h coc-status` for integrations with external plugins that
+-- provide custom statusline: lightline.vim, vim-airline.
+vim.opt.statusline:prepend("%{coc#status()}%{get(b:,'coc_current_function','')}")
+
+-- Mappings for CoCList
+-- code actions and coc stuff
+---@diagnostic disable-next-line: redefined-local
+local opts = {silent = true, nowait = true}
+-- Show all diagnostics.
+keyset("n", "<space>a", ":<C-u>CocList diagnostics<cr>", opts)
+-- Manage extensions.
+keyset("n", "<space>e", ":<C-u>CocList extensions<cr>", opts)
+-- Show commands.
+keyset("n", "<space>c", ":<C-u>CocList commands<cr>", opts)
+-- Find symbol of current document.
+keyset("n", "<space>o", ":<C-u>CocList outline<cr>", opts)
+-- Search workspace symbols.
+keyset("n", "<space>s", ":<C-u>CocList -I symbols<cr>", opts)
+-- Do default action for next item.
+keyset("n", "<space>j", ":<C-u>CocNext<cr>", opts)
+-- Do default action for previous item.
+keyset("n", "<space>k", ":<C-u>CocPrev<cr>", opts)
+-- Resume latest coc list.
+keyset("n", "<space>p", ":<C-u>CocListResume<cr>", opts)

home-manager-modules/pass/default.nix

@@ -0,0 +1,23 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.luj.programs.pass;
+in
+with lib;
+{
+  options.luj.programs.pass = {
+    enable = mkEnableOption "Enable pass";
+  };
+
+  config = mkIf cfg.enable {
+    programs.rbw = {
+      enable = true;
+      settings = {
+        base_url = "https://vaults.malka.family";
+        email = "julien@malka.sh";
+        pinentry = pkgs.unstable.pinentry-tty;
+        lock_timeout = 600;
+      };
+    };
+  };
+
+}

home-manager-modules/polybar/config

@@ -1,434 +0,0 @@
-;-------------------------------------------------
-;                                                ;
-;           Polybar config for Cranium           ;
-;                                                ;
-;-------------------------------------------------
-
-
-[colors]
-;background = ${xrdb:color0:#222}
-;background = #212E36
-background = #cf172a47
-;it's ARGB so "cfl" is for transparency
-;background-alt = #cf3C5A46
-background-unf = #2D4058
-
-;background-unf = #cf2E463E
-background-alt = #405C7D
-background-mod0 = #cf3C5A46
-background-mod1 = #cf546E53
-background-mod2 = #cf708963
-background-alrt = #cfA1BB76
-
-;foreground = ${xrdb:color7:#222}
-foreground = #F3F3BA
-foreground-alt = #F3F3BA
-primary = #F3F3BA
-secondary = #F3F3BA
-
-
-[bar/PolybarTony]
-;monitor = ${env:MONITOR:HDMI-1}
-;monitor = ${env:MONITOR:}
-width = 100%
-height = 30
-offset-x = 0%
-;offset-y = 10%
-radius = 0.0
-fixed-center = true
-
-background = ${colors.background}
-foreground = ${colors.foreground}
-
-line-size = 0
-line-color = #f00
-
-border-size = 0
-border-color = #00000000
-
-padding-left = 0
-padding-right = 0
-
-module-margin-left = 0
-module-margin-right = 0
-
-font-0 = Misc Termsyn:size=8;1
-;font-0 = Ubuntu:size=10;1
-font-1 = FontAwesome:fontformat=truetype:size=12;1
-font-3 = Font Awesome 5 Free:style=Regular:pixelsize=8;1
-font-4 = Font Awesome 5 Free:style=Solid:pixelsize=8;1
-font-5 = Font Awesome 5 Brands:pixelsize=8;1
-font-2 = sm4tik:pixelsize=10;1
-
-modules-left = i3
-modules-center =  date
-modules-right = wireless-network memory cpu  battery powermenu
-
-tray-position = right
-tray-padding = 11
-tray-transparent = false
-tray-offset-y = 0
-tray-offset-x = 0
-tray-maxsize = 18
-tray-detached = false
-tray-background = colors.background
-
-;wm-restack = bspwm
-wm-restack = i3
-
-override-redirect = false
-
-;scroll-up = bspwm-desknext
-;scroll-down = bspwm-deskprev
-
-;scroll-up = i3wm-wsnext
-;scroll-down = i3wm-wsprev
-
-
-[module/weather]
-type = custom/script
-interval = 60
-
-;format-background = ${colors.background-alt}
-format = <label>
-format-prefix = "    "
-format-suffix = "   "
-format-prefix-foreground = ${colors.foreground-alt}
-exec = python ~/.config/polybar/weather.py
-
-[module/music]
-type = custom/script
-interval = 1
-bar-width = 50%
-
-;format-background = ${colors.background-alt}
-;format-foreground = ${colors.foreground-alt}
-
-label = " %output% "
-
-exec = ~/.config/polybar/mpris.sh
-
-
-[module/i3]
-pin-workspaces = true
-type = internal/i3
-;
-;strip-wsnumbers = true
-;
-;label-focused-padding = 3
-;label-unfocused-padding = 3
-;
-;label-focused-background = ${colors.background-alt}
-label-unfocused-background = ${colors.background-unf}
-;
-;label-mode-padding = 0
-;label-mode-background = ${colors.background-unf}
-;
-;label-visible-underline = #555555
-;label-visible-padding = 4
-
-
-; Available tokens:
-;   %mode%
-; Default: %mode%
-label-mode = %mode%
-label-mode-padding = 2
-label-mode-background = #e60053
-
-; Available tokens:
-;   %name%
-;   %icon%
-;   %index%
-;   %output%
-; Default: %icon%  %name%
-label-focused = %name%
-label-focused-foreground = #ffffff
-label-focused-background = ${colors.background-alt}
-label-focused-underline = #fba922
-label-focused-padding = 4
-
-; Available tokens:
-;   %name%
-;   %icon%
-;   %index%
-; Default: %icon%  %name%
-label-unfocused = %name%
-label-unfocused-padding = 4
-
-; Available tokens:
-;   %name%
-;   %icon%
-;   %index%
-; Default: %icon%  %name%
-label-visible = %name%
-label-visible-underline = #555555
-label-visible-padding = 4
-
-; Available tokens:
-;   %name%
-;   %icon%
-;   %index%
-; Default: %icon%  %name%
-label-urgent = %name%
-label-urgent-foreground = #000000
-label-urgent-background = ${colors.background-alrt}
-label-urgent-padding = 4
-
-
-
-
-[module/wireless-network]
-type = internal/network
-interface = wlp3s0
-interval = 3.0
-
-format-connected-prefix = " "
-
-format-connected-background = ${colors.background-alt}
-format-connected = "   <ramp-signal> <label-connected>  "
-format-connected-underline = #9f78e1
-label-connected =
-
-format-disconnected = " no wifi :( "
-format-disconnected-background = ${colors.background-alt}
-;format-disconnected-underline = ${self.format-connected-underline}
-;label-disconnected = %ifname% disconnected
-label-disconnected-foreground = ${colors.foreground-alt}
-
-ramp-signal-0 = "    0%"
-ramp-signal-1 = "    25%"
-ramp-signal-2 = "    50%"
-ramp-signal-3 = "    75%"
-ramp-signal-4 = "    100%"
-ramp-signal-foreground = ${colors.foreground-alt}
-
-
-[module/wired-network]
-type = internal/network
-interface = enp0s25
-interval = 3.0
-
-format-connected-underline = #55aa55
-format-connected-prefix = ""
-format-connected-prefix-foreground = ${colors.foreground-alt}
-label-connected = %local_ip%
-
-format-disconnected =
-;format-disconnected = <label-disconnected>
-;format-disconnected-underline = ${self.format-connected-underline}
-;label-disconnected = %ifname% disconnected
-;label-disconnected-foreground = ${colors.foreground-alt}
-
-
-[module/date]
-type = internal/date
-interval = 5
-
-date = 
-date-alt = " %d/%m"
-
-time = "   %a %b %d     %I:%M %p  "
-time-alt = %H:%M:%S
-
-format-prefix-foreground = ${colors.foreground-alt}
-format-underline = #0a6cf5
-
-label = %date% %time%
-
-;lable = %time%
-
-[module/volume]
-type = internal/pulseaudio
-;type = internal/alsa
-sink = alsa_output.pci-0000_00_1f.3.analog-stereo
-
-; Soundcard to be used
-; Usually in the format hw:#
-master-soundcard = hw:1
-speaker-soundcard = hw:1
-headphone-soundcard = hw:1
-
-; Name of the master mixer
-; Default: Master
-master-mixer = Master
-
-; Optionally define speaker and headphone mixers
-; Use the following command to list available mixer controls:
-; $ amixer scontrols | sed -nr "s/.*'([[:alnum:]]+)'.*/\1/p"
-; Default: none
-speaker-mixer = Speaker
-; Default: none
-headphone-mixer = Headphone
-
-; NOTE: This is required if headphone_mixer is defined
-; Use the following command to list available device controls
-; $ amixer controls | sed -r "/CARD/\!d; s/.*=([0-9]+).*name='([^']+)'.*/printf '%3.0f: %s\n' '\1' '\2'/e" | sort
-; Default: none
-headphone-id = 9
-
-; Use volume mapping (similar to amixer -M and alsamixer), where the increase in volume is linear to the ear
-; Default: false
-mapped = true
-
-format-muted-background = ${colors.background-unf}
-format-volume-background = ${colors.background-alt}
-format-volume = "   <ramp-volume>  <label-volume>  "
-format-volume-prefix = " "
-label-muted = "   mute   "
-
-;label-muted = "          "
-
-; Only applies if <ramp-volume> is used
-ramp-volume-0 = 
-ramp-volume-1 = 
-
-
-[module/battery]
-type = internal/battery
-battery = BAT0
-adapter = AC
-full-at = 97
-
-format-full-background = ${colors.background-mod2}
-format-charging-background = ${colors.background-alt}
-format-charging = "⁣   <animation-charging> <label-charging>"
-format-charging-underline = #ffb52a
-
-format-charging-suffix = "   "
-
-format-discharging-background = ${colors.background-alt}
-format-discharging = "⁣  <ramp-capacity> <label-discharging>  "
-format-discharging-underline = ${self.format-charging-underline}
-
-format-full = 
-format-full-prefix-foreground = ${colors.foreground-alt}
-format-full-underline = ${self.format-charging-underline}
-
-ramp-capacity-0 = 
-ramp-capacity-1 = 
-ramp-capacity-2 = 
-ramp-capacity-3 = 
-ramp-capacity-4 = 
-
-ramp-capacity-foreground = ${colors.foreground-alt}
-
-animation-charging-0 = 
-animation-charging-1 = 
-animation-charging-2 = 
-animation-charging-3 = 
-animation-charging-4 = 
-animation-charging-foreground = ${colors.foreground-alt}
-animation-charging-framerate = 750
-
-[module/powermenu]
-type = custom/menu
-
-format-spacing = 1
-
-label-open = "      "
-label-open-background = ${colors.background-unf}
-label-open-foreground = ${colors.secondary}
-label-close = "    cancel   "
-label-close-background = ${colors.background-unf}
-label-close-foreground = ${colors.secondary}
-label-separator = " "
-label-separator-foreground = ${colors.foreground-alt}
-
-menu-0-0 = reboot
-menu-0-0-exec = menu-open-1
-menu-0-1 = "power off   "
-menu-0-1-exec = menu-open-2
-
-menu-1-0 = cancel
-menu-1-0-exec = menu-open-0
-menu-1-1 = reboot
-menu-1-1-exec = sudo reboot
-
-menu-2-0 = power off
-menu-2-0-exec = shutdown now
-menu-2-1 = cancel
-menu-2-1-exec = menu-open-0
-
-
-[settings]
-screenchange-reload = true
-;compositing-background = xor
-;compositing-background = screen
-;compositing-foreground = source
-;compositing-border = over
-
-
-[global/wm]
-margin-top = 5
-margin-bottom = 5
-
-
-; 
-; [module/xkeyboard]
-; type = internal/xkeyboard
-; blacklist-0 = num lock
-; 
-; format-prefix = " "
-; format-prefix-foreground = ${colors.foreground-alt}
-; format-prefix-underline = ${colors.secondary}
-; 
-; label-layout = %layout%
-; label-layout-underline = ${colors.secondary}
-; 
-; label-indicator-padding = 2
-; label-indicator-margin = 1
-; label-indicator-background = ${colors.secondary}
-; label-indicator-underline = ${colors.secondary}
-; 
-; [module/filesystem]
-; type = internal/fs
-; interval = 25
-; 
-; mount-0 = /
-; 
-; label-mounted = %{F#0a81f5}%mountpoint%%{F-}: %percentage_used%%
-; label-unmounted = %mountpoint% not mounted
-; label-unmounted-foreground = ${colors.foreground-alt}
-; 
-;
-;[module/xbacklight]
-;type = internal/xbacklight
-;
-;format = <label> <bar>
-;label = BL
-;
-;bar-width = 10
-;bar-indicator = |
-;bar-indicator-foreground = #ff
-;bar-indicator-font = 2
-;bar-fill = -
-;bar-fill-font = 2
-;bar-fill-foreground = #9f78e1
-;bar-empty = -
-;bar-empty-font = 2
-;bar-empty-foreground = ${colors.foreground-alt}
-;bar-empty-background = ${colors.foreground-mod}
-;
-;[module/backlight-acpi]
-;inherit = module/xbacklight
-;type = internal/backlight
-;card = intel_backlight
-;
-[module/cpu]
-type = internal/cpu
-interval = 2
-format-prefix = "   "
-format-prefix-foreground = ${colors.foreground-alt}
-format-prefix-background = ${colors.background-alt}
-format-underline = #f90000
-label = %percentage%%
-format-background = ${colors.background-alt}
-[module/memory]
-type = internal/memory
-interval = 2
-format-prefix = " "
-format-prefix-foreground = ${colors.foreground-alt}
-format-underline = #4bffdc
-label = %percentage_used%%
-format-background = ${colors.background-alt}
-; vim:ft=dosini

home-manager-modules/polybar/default.nix

@@ -1,25 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.luj.polybar;
-in
-with lib; {
-
-  options.luj.polybar = {
-    enable = mkEnableOption "Enable polybar";
-  };
-
-  config = mkIf cfg.enable {
-    services.polybar = {
-      enable = true;
-      package = pkgs.polybar.override {
-        i3GapsSupport = true;
-      };
-
-      script = "polybar -q PolybarTony &";
-
-    };
-
-    xdg.configFile."polybar/config".source = lib.mkForce ./config;
-
-  };
-}

home-manager-modules/ssh-client/default.nix

@@ -0,0 +1,60 @@
+{ config, lib, ... }:
+let
+  cfg = config.luj.programs.ssh-client;
+in
+with lib;
+{
+  options.luj.programs.ssh-client = {
+    enable = mkEnableOption "Enable ssh client";
+  };
+
+  config = mkIf cfg.enable {
+    programs.ssh = {
+      enable = true;
+      matchBlocks =
+        lib.mapAttrs (_: v: {
+          hostname = if v.ips ? "vpn" then v.ips.vpn.ipv4 else v.ips.public.ipv4;
+          user = v.sshUser;
+          port = v.sshPort;
+        }) lib.snowfield
+        // {
+          sas = {
+            hostname = "sas.eleves.ens.fr";
+            user = "jmalka";
+          };
+          router = {
+            hostname = "vpn.saumon.network";
+          };
+          mails = {
+            hostname = "192.168.0.76";
+            proxyJump = "router";
+          };
+
+          proxy-telecom = {
+            hostname = "ssh.enst.fr";
+            user = "jmalka";
+          };
+          ferrari = {
+            hostname = "195.154.212.97";
+          };
+          lame24 = {
+            hostname = "lame24.enst.fr";
+            user = "jmalka";
+            proxyJump = "proxy-telecom";
+          };
+
+          epyc = {
+            hostname = "epyc.infra.newtype.fr";
+            user = "luj";
+            proxyJump = "tower";
+          };
+
+          exps = {
+            hostname = "192.168.0.240";
+            proxyJump = "router";
+          };
+
+        };
+    };
+  };
+}

home-manager-modules/sway/default.nix

@@ -0,0 +1,131 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.luj.programs.sway;
+  inherit (cfg) modifier;
+  terminal = "kitty";
+in
+with lib;
+{
+  options.luj.programs.sway = {
+    enable = mkEnableOption "Enable SwayWM";
+    modifier = mkOption {
+      type = lib.types.str;
+      default = "Mod1";
+    };
+    background = mkOption {
+      type = types.path;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    wayland.windowManager.sway = {
+      enable = true;
+      package = pkgs.swayfx;
+      config = {
+        inherit terminal;
+        output."*" = {
+          bg = builtins.toString cfg.background + " fill";
+        };
+
+        inherit (cfg) modifier;
+        input = {
+          "*" = {
+            xkb_layout = "fr";
+          };
+        };
+
+        gaps = {
+          right = 2;
+          left = 2;
+          top = 0;
+          bottom = 0;
+          inner = 1;
+        };
+
+        bars = [ ];
+        keybindings = lib.mkOptionDefault {
+          "${modifier}+ampersand" = "workspace 1";
+          "${modifier}+eacute" = "workspace 2";
+          "${modifier}+quotedbl" = "workspace 3";
+          "${modifier}+apostrophe" = "workspace 4";
+          "${modifier}+parenleft" = "workspace 5";
+          "${modifier}+egrave" = "workspace 6";
+          "${modifier}+minus" = "workspace 7";
+          "${modifier}+underscore" = "workspace 8";
+          "${modifier}+ccedilla" = "workspace 9";
+          "${modifier}+agrave" = "workspace 10";
+
+          "${modifier}+Shift+ampersand" = "move container to workspace 1";
+          "${modifier}+Shift+eacute" = "move container to workspace 2";
+          "${modifier}+Shift+quotedbl" = "move container to workspace 3";
+          "${modifier}+Shift+apostrophe" = "move container to workspace 4";
+          "${modifier}+Shift+parenleft" = "move container to workspace 5";
+          "${modifier}+Shift+egrave" = "move container to workspace 6";
+          "${modifier}+Shift+minus" = "move container to workspace 7";
+          "${modifier}+Shift+underscore" = "move container to workspace 8";
+          "${modifier}+Shift+ccedilla" = "move container to workspace 9";
+          "${modifier}+Shift+agrave" = "move container to workspace 10";
+
+          "${modifier}+h" = "focus left";
+          "${modifier}+j" = "focus down";
+          "${modifier}+k" = "focus up";
+          "${modifier}+l" = "focus right";
+
+          "${modifier}+Shift+h" = "move left";
+          "${modifier}+Shift+j" = "move down";
+          "${modifier}+Shift+k" = "move up";
+          "${modifier}+Shift+l" = "move right";
+
+
+          "${modifier}+q" = "kill";
+          "${modifier}+space" = "exec rofi -show run";
+          "${modifier}+Return" = "exec ${terminal}";
+          "${modifier}+f" = "fullscreen toggle";
+
+          "XF86MonBrightnessUp" = "exec brightnessctl s +10";
+          "XF86MonBrightnessDown" = "exec brightnessctl s 10-";
+          "${modifier}+w" = "exec swaylock";
+        };
+      };
+      extraConfig = ''
+        set $laptop eDP-1
+        corner_radius 8
+        default_dim_inactive 0.2
+        default_border none
+        default_floating_border none
+        bindswitch lid:on output $laptop disable
+        bindswitch lid:off output $laptop enable
+      '';
+      extraOptions = [ "--unsupported-gpu" ];
+    };
+
+    programs.swaylock =
+      {
+        enable = true;
+        package = pkgs.swaylock-effects;
+        settings = {
+          screenshots = true;
+          clock = true;
+          indicator = true;
+          indicator-radius = 200;
+          indicator-thickness = 20;
+          grace = 0;
+          grace-no-mouse = true;
+          grace-no-touch = true;
+          line-uses-ring = false;
+          ignore-empty-password = true;
+          show-failed-attempts = false;
+
+          font = "Fira Code";
+          timestr = "%H:%M";
+          datestr = "";
+          effect-blur = "8x5";
+          effect-vignette = "0.5:0.5";
+          color = "00000000";
+
+        };
+
+      };
+
+  };
+}

home-manager-modules/waybar/default.nix

@@ -0,0 +1,199 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.luj.programs.waybar;
+in
+with lib;
+{
+  options.luj.programs.waybar = {
+    enable = mkEnableOption "Enable waybar";
+    interfaceName = mkOption { type = lib.types.str; };
+  };
+
+  config = mkIf cfg.enable {
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          modules-left = [
+            "custom/nixos"
+            "hyprland/workspaces"
+          ];
+          modules-center = [ "clock" ];
+          modules-right = [
+            "custom/mails"
+            "network"
+            "battery"
+          ];
+          "custom/nixos" = {
+            format = " ❄ ";
+            tooltip = false;
+          };
+          "hyprland/workspaces" = {
+            format = "{name}";
+            tooltip = false;
+            all-outputs = true;
+          };
+          "clock" = { };
+          "backlight" = {
+            device = "intel_backlight";
+            format = "<span color='#cba6f7'>{icon}</span> {percent}%";
+            format-icons = [
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+          };
+          "pulseaudio" = {
+            format = "<span color='#cba6f7'>{icon}</span> {volume}%";
+            format-muted = "";
+            tooltip = false;
+            format-icons = {
+              headphone = "";
+              default = [
+                ""
+                ""
+                "󰕾"
+                "󰕾"
+                "󰕾"
+                ""
+                ""
+                ""
+              ];
+            };
+            scroll-step = 1;
+          };
+          "bluetooth" = {
+            format = "<span color='#cba6f7'></span> {status}";
+            format-disabled = "";
+            format-connected = "<span color='#cba6f7'></span> {num_connections}";
+            tooltip-format = "{device_enumerate}";
+            tooltip-format-enumerate-connected = "{device_alias}   {device_address}";
+          };
+          "network" = {
+            interface = cfg.interfaceName;
+            format = "{ifname}";
+            format-wifi = "<span color='#cba6f7'> </span>{essid}";
+            format-ethernet = "{ipaddr}/{cidr} ";
+            format-disconnected = "<span color='#cba6f7'>󰖪 </span>No Network";
+            tooltip = false;
+          };
+          "battery" = {
+            format = "<span color='#cba6f7'>{icon}</span> {capacity}%";
+            format-icons = [
+              ""
+              ""
+              ""
+              ""
+              ""
+            ];
+            format-charging = "<span color='#cba6f7'></span> {capacity}%";
+            tooltip = false;
+          };
+          "custom/mails" = {
+            format = "<span color='#cba6f7'></span> {}";
+            exec = "${pkgs.notmuch}/bin/notmuch count 'tag:unread and (tag:dgnum-inbox or tag:ens-inbox or tag:work-inbox or tag:telecom-inbox or tag:dgnum-bureau)'";
+            interval = 10;
+          };
+        };
+      };
+      style = ''
+        * {
+          border: none;
+          font-family: 'Fira Code', 'Symbols Nerd Font Mono';
+          font-size: 8px;
+          font-feature-settings: '"zero", "ss01", "ss02", "ss03", "ss04", "ss05", "cv31"';
+          min-height: 2px;
+        }
+
+        window#waybar {
+          background: transparent;
+        }
+
+        #custom-nixos, #workspaces {
+          border-radius: 8px;
+          background-color: #11111b;
+          color: #7eb9e3;
+          margin-top: 4px;
+          margin-bottom: 3px;
+          margin-right: 15px;
+          padding-top: 1px;
+          padding-left: 4px;
+          padding-right: 4px;
+        }
+
+        #workspaces {
+          padding-left: 1px;
+          padding-right: 1px;
+        }
+
+        #custom-nixos {
+          font-size: 15px;
+          margin-left: 15px;
+        }
+
+        #workspaces button {
+          background: #11111b;
+          color: #cdd6f4;
+          min-width: 0;
+
+        }
+
+        #workspaces button.active {
+          color: #cba6f7;
+        }
+
+        #clock, #backlight, #pulseaudio, #bluetooth, #network, #battery, #custom-mails{
+          border-radius: 10px;
+          background-color: #11111b;
+          color: #cdd6f4;
+          margin-top: 4px;
+          margin-bottom: 3px;
+          padding-left: 10px;
+          padding-right: 10px;
+          margin-right: 15px;
+        }
+
+        #backlight, #bluetooth {
+          border-top-right-radius: 0;
+          border-bottom-right-radius: 0;
+          padding-right: 5px;
+          margin-right: 0
+        }
+
+        #clock {
+          margin-right: 0;
+        }
+
+        @keyframes blink {
+          to {
+            background-color: #ffffff;
+            color: black;
+          }
+        }
+
+        #battery.warning:not(.charging) {
+          background: #f38ba8;
+          color: white;
+          animation-name: blink;
+          animation-duration: 0.5s;
+          animation-timing-function: linear;
+          animation-iteration-count: infinite;
+          animation-direction: alternate;
+        }
+      '';
+    };
+  };
+}

home-manager-modules/zsh/default.nix

@@ -0,0 +1,183 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.luj.programs.zsh;
+  inherit (pkgs) fetchFromGitHub;
+in
+with lib;
+{
+  options.luj.programs.zsh = {
+    enable = mkEnableOption "Enable Zsh";
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.zsh = {
+      enable = true;
+      enableCompletion = true;
+      enableAutosuggestions = true;
+      history = { save = 1000000; extended = true; ignoreDups = true; };
+      initExtra = ''
+        setopt notify autopushd
+        unsetopt autocd beep
+        ZSH_AUTOSUGGEST_STRATEGY=(completion history)
+      '';
+
+      shellAliases = {
+
+        ka = "killall";
+        mkd = "mkdir -pv";
+
+        ca = "khal interactive";
+        sync_ca = "vsync sync";
+
+        dnd = "dunstctl set-paused true";
+        nodnd = "dunstctl set-paused false";
+
+        lg = "lazygit";
+        g = "git";
+        gua = "git remote | xargs -L1 git push --all";
+
+        v = "$EDITOR";
+        sdn = "shutdown now";
+
+        SU = "systemctl --user";
+        SS = "sudo systemctl";
+
+
+        weather = "curl wttr.in";
+        v6 = "curl api6.ipify.org";
+        v4 = "curl api.ipify.org";
+        clbin = "curl -F'clbin=<-' https://clbin.com";
+        _0x0 = "curl -F'file=@-' https://0x0.st";
+
+        phs = "python -m http.server";
+
+        ls = "eza";
+
+        rtmv = "rsync -avP";
+        archive = "rsync --remove-source-files -avPzz";
+
+        luks_integrity_check = "gocryptfs -fsck -extpass 'pass Private/LUKS' /boot/luks";
+
+        fetch-emails = "mbsync --all && notmuch new && afew -t -n -v";
+
+        nsp = "nix-shell -p";
+        ns = "nix-shell";
+
+        ncg = "sudo nix-collect-garbage --delete-older-than 30d";
+        ncga = "sudo nix-collect-garbage -d";
+        nso = "sudo nix-store --optimise";
+
+        lln = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\"";
+        # Local build
+        lnb = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nom-build '<nixpkgs>' --no-out-link -A $1";
+        # Local shell
+        lns = "NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nix-shell -p $1";
+        # Local test
+        ltt = ''NIX_PATH=\"nixpkgs=$LOCAL_NIXPKGS_CHECKOUT\" nom-build --no-out-link "$LOCAL_NIXPKGS_CHECKOUT/nixos/tests/$1"'';
+      };
+
+      dirHashes = {
+        config = "/home/julien/dev/nix-config";
+      };
+      plugins = [
+        {
+          name = "history-search-multi-word";
+          src = fetchFromGitHub {
+            repo = "history-search-multi-word";
+            owner = "zdharma-continuum";
+            rev = "458e75c16db72596e4d7c6a45619dec285ebdcd7";
+            sha256 = "sha256-6B8uoKJm3gWmufsnLJzLEdSm1tQasrs2fUmS0pDsdMw=";
+          };
+        }
+        {
+          name = "git-aliases";
+          src = fetchFromGitHub {
+            repo = "git-aliases";
+            owner = "mdumitru";
+            rev = "c4cfe2cf5cf59a3da6bf3b735a20921a2c06c58d";
+            sha256 = "sha256-640qGgVeFaTIQBgYGY05/4wzMCxni0uWLWtByEFM2tE=";
+          };
+        }
+        {
+          name = "zsh-bitwarden";
+          src = fetchFromGitHub {
+            repo = "zsh-bitwarden";
+            owner = "Game4Move78";
+            rev = "8b32434d18765fe95ffc2191f5fb68100d913de7";
+            sha256 = "sha256-3zuutTUSdf218+jcn2z7yEGMYkg5VewXm9zO43aIYdI=";
+          };
+        }
+        {
+          name = "alias-tips";
+          src = fetchFromGitHub {
+            repo = "alias-tips";
+            owner = "djui";
+            rev = "4d2cf6f10e5080f3273be06b9801e1fd1f25d28d";
+            sha256 = "sha256-0N2DCpMraIXtEc7hMp0OBANNuYhHPLqzJ/hrAFcLma8=";
+          };
+        }
+        {
+          name = "auto-notify";
+          src = fetchFromGitHub {
+            repo = "zsh-auto-notify";
+            owner = "MichaelAquilina";
+            rev = "fb38802d331408e2ebc8e6745fb8e50356344aa4";
+            sha256 = "sha256-bY0qLX5Kpt2x4KnfvXjYK2+BhR3zKBgGsCvIxSzApws=";
+          };
+        }
+        {
+          name = "nix-shell";
+          src = fetchFromGitHub {
+            repo = "zsh-nix-shell";
+            owner = "chisui";
+            rev = "f8574f27e1d7772629c9509b2116d504798fe30a";
+            sha256 = "sha256-WNa8RljYhkOWk7AZbdTOvYhWw1fR8PjFxH/tnUCbems=";
+          };
+        }
+        {
+          name = "syntax-highlighting";
+          src = fetchFromGitHub {
+            repo = "zsh-syntax-highlighting";
+            owner = "zsh-users";
+            rev = "bb27265aeeb0a22fb77f1275118a5edba260ec47";
+            sha256 = "sha256-bD0oKXSw9lucJR+6/O16m7prwA1cP36C0Tvh5mklapw=";
+          };
+        }
+        {
+          name = "jq";
+          src = fetchFromGitHub {
+            repo = "jq-zsh-plugin";
+            owner = "reegnz";
+            rev = "98650d6eac46b5f87aa19f0a3dd321b0105643b8";
+            sha256 = "sha256-L2+PW39BZTy8h4yxxZxbKCVVKlfPruM12gRZ9FJ8YD8=";
+          };
+        }
+      ];
+    };
+
+    # Broot
+    programs.broot = {
+      enable = true;
+      enableZshIntegration = true;
+    };
+
+    # Direnv: must have.
+    programs.direnv = {
+      enable = true;
+      enableZshIntegration = true;
+      nix-direnv.enable = true;
+    };
+
+    programs.oh-my-posh = {
+      enable = true;
+      enableZshIntegration = true;
+      useTheme = "catppuccin_mocha";
+    };
+
+    # Misc
+    programs.lesspipe.enable = true;
+
+    home.packages = with pkgs; [ unstable.eza python3 libnotify ];
+  };
+}

lib/default.nix

@@ -0,0 +1,74 @@
+inputs: profiles: dnsLib: final: _prev:
+
+with builtins;
+let
+  evalMeta =
+    raw:
+    (_prev.evalModules {
+      modules = [
+        (import ../modules/meta/default.nix)
+        { machine.meta = raw; }
+      ];
+      specialArgs = {
+        inherit profiles;
+      };
+    }).config.machine.meta;
+
+  non_local_machines = (import ./snowfield.nix).machines;
+in
+rec {
+  importConfig =
+    path:
+    (mapAttrs (name: _value: import (path + "/${name}/default.nix")) (
+      final.filterAttrs (_: v: v == "directory") (readDir path)
+    ));
+
+  mkSubdomain = name: port: {
+    luj.nginx.enable = true;
+    services.nginx.virtualHosts."${name}.julienmalka.me" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString port}";
+      };
+    };
+  };
+
+  mkVPNSubdomain = name: port: {
+    luj.nginx.enable = true;
+    services.nginx.virtualHosts."${name}.luj" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString port}";
+      };
+    };
+  };
+
+  listToAttrsWithMerge =
+    l:
+    mapAttrs (_: v: _prev.fold (elem: acc: elem.value // acc) { } v) (builtins.groupBy (e: e.name) l);
+
+  mapAttrsWithMerge = f: set: listToAttrsWithMerge (map (attr: f attr set.${attr}) (attrNames set));
+
+  snowfield =
+    (mapAttrs (
+      name: _value:
+      let
+        machineF = import (../machines + "/${name}/default.nix");
+      in
+      evalMeta
+        (machineF (
+          (mapAttrs (_: _: null) (builtins.functionArgs machineF)) // { inherit inputs profiles; }
+        )).machine.meta
+    ) (final.filterAttrs (_: v: v == "directory") (readDir ../machines)))
+    // mapAttrs (_: evalMeta) non_local_machines;
+
+  dns = import ./dns.nix {
+    lib = final;
+    inherit dnsLib;
+  };
+
+  mkMachine = import ./mkmachine.nix inputs final;
+
+}

lib/dns.nix

@@ -0,0 +1,50 @@
+{ lib, dnsLib, ... }:
+
+with lib;
+
+rec {
+
+  allowedDomains = [
+    "luj.fr"
+    "julienmalka.me"
+    "malka.family"
+    "luj"
+    "malka.sh"
+    "hownix.works"
+  ];
+
+  isVPNDomain = hasSuffix "luj";
+
+  hasSuffix' = flip strings.hasSuffix;
+
+  domainToZone = allowedDomains: domain: (findFirst (hasSuffix' domain) null allowedDomains);
+
+  filterElligibleDomains = allowedDomains: domain: domainToZone allowedDomains domain != null;
+
+  domainsFromConfiguration =
+    allowedDomains: config:
+    filter (filterElligibleDomains allowedDomains) (attrNames config.services.nginx.virtualHosts);
+
+  ipsToRecord =
+    ipType: ipValue:
+    with dnsLib.combinators;
+    if ipType == "ipv4" then { A = [ ipValue ]; } else { AAAA = [ ipValue ]; };
+
+  domainToRecords =
+    domain: machineMeta: isVPNDomain:
+    with dnsLib.combinators;
+    (optionalAttrs isVPNDomain (
+      mapAttrsWithMerge (n: v: nameValuePair domain (ipsToRecord n v)) machineMeta.ips.vpn
+    ))
+    // (optionalAttrs (!isVPNDomain) (
+      mapAttrsWithMerge (n: v: nameValuePair domain (ipsToRecord n v)) machineMeta.ips.public
+    ));
+
+  getDomainPrefix =
+    allowedDomains: domain:
+    let
+      zone = domainToZone allowedDomains domain;
+    in
+    strings.removeSuffix ".${zone}" domain;
+
+}

lib/mkmachine.nix

@@ -0,0 +1,97 @@
+inputs: lib:
+
+let
+  overlay-unstable = arch: _final: _prev: {
+    stable = import inputs.nixpkgs { system = arch; };
+    unstable = import inputs.unstable { system = arch; };
+  };
+in
+
+{
+  name,
+  host-config,
+  modules,
+  nixpkgs ? inputs.nixpkgs,
+  system ? "x86_64-linux",
+  home-manager ? inputs.home-manager,
+  self,
+  dnsLib,
+}:
+let
+  pkgs = import nixpkgs { inherit system; };
+in
+import "${nixpkgs}/nixos/lib/eval-config.nix" {
+  inherit system;
+  lib = pkgs.lib.extend (import ./default.nix inputs self.profiles dnsLib);
+  specialArgs = {
+    inherit inputs dnsLib;
+    inherit (self) nixosConfigurations profiles;
+  };
+  modules = modules ++ [
+    host-config
+    (import "${home-manager}/nixos")
+    (import "${inputs.disko}/module.nix")
+    (import "${inputs.buildbot-nix}/nix/master.nix")
+    (import "${inputs.buildbot-nix}/nix/worker.nix")
+    (import "${inputs.agenix}/modules/age.nix")
+    (import "${inputs.artiflakery}/module.nix")
+    (import "${inputs.impermanence}/nixos.nix")
+    (import inputs.lanzaboote).nixosModules.lanzaboote
+    (import inputs.lila).nixosModules.hash-collection
+    (import "${inputs.stateless-uptime-kuma}/nixos/module.nix")
+    (import "${inputs.proxmox}/modules/declarative-vms")
+    {
+      home-manager.useGlobalPkgs = true;
+      nixpkgs.system = system;
+      networking.hostName = name;
+      nixpkgs.overlays = lib.mkAfter [
+        (overlay-unstable system)
+        (import "${inputs.emacs-overlay}/overlays/emacs.nix")
+        (_final: prev: {
+          waybar = prev.waybar.overrideAttrs (oldAttrs: {
+            mesonFlags = oldAttrs.mesonFlags ++ [ "-Dexperimental=true" ];
+          });
+          # Packages comming from other repositories
+          lila-build-hook = (import inputs.lila).packages.${system}.utils;
+          artiflakery = (import inputs.artiflakery).defaultPackage.${system};
+          # My own packages
+          keycloak-keywind = prev.pkgs.callPackage ../packages/keycloak-keywind { };
+          hydrasect = prev.pkgs.callPackage ../packages/hydrasect { };
+          codeberg-pages-custom = prev.pkgs.callPackage ../packages/codeberg-pages-custom { };
+          uptime-kuma-beta = prev.pkgs.callPackage ../packages/uptime-kuma-beta { };
+        })
+
+        (
+          _final: prev:
+          let
+            generated = import "${inputs.nix-index-database}/generated.nix";
+            nix-index-database =
+              (prev.fetchurl {
+                url = generated.url + prev.stdenv.system;
+                hash = generated.hashes.${prev.stdenv.system};
+              }).overrideAttrs
+                {
+                  __structuredAttrs = true;
+                  unsafeDiscardReferences.out = true;
+                };
+          in
+          {
+            inherit nix-index-database;
+            nix-index-with-db = prev.callPackage "${inputs.nix-index-database}/nix-index-wrapper.nix" {
+              inherit nix-index-database;
+            };
+            comma-with-db = prev.callPackage "${inputs.nix-index-database}/comma-wrapper.nix" {
+              inherit nix-index-database;
+            };
+          }
+        )
+
+      ];
+    }
+  ];
+  extraModules =
+    let
+      colmenaModules = import "${inputs.colmena}/src/nix/hive/options.nix";
+    in
+    [ colmenaModules.deploymentOptions ];
+}

lib/snowfield.nix

@@ -0,0 +1,113 @@
+{
+
+  # Metadata of machines whose configuration is not handled by this repository
+
+  machines = {
+
+    router = {
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        public.ipv6 = "2a01:e0a:de4:a0e0:2f0:cbff:feef:e12a";
+        vpn.ipv4 = "100.100.45.1";
+        vpn.ipv6 = "fd7a:115c:a1e0::1";
+      };
+    };
+
+    doma-backups = {
+      subdomains = [ "doma-backups.julienmalka.me" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.0.250";
+        public.ipv6 = "2a01:e0a:de4:a0e1:6b86:c2c:2141:6702";
+      };
+    };
+
+    proxmox-nixos-infra = {
+      subdomains = [ "proxmox-nixos-update-logs.saumon.network" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.0.177";
+        public.ipv6 = "2a01:e0a:de4:a0e1:eb2:caa1::78";
+      };
+    };
+
+    doma-zulip = {
+      subdomains = [ "zulip.julienmalka.me" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.0.187";
+        public.ipv6 = "2a01:e0a:de4:a0e1:6830:ddff:fe52:a444";
+      };
+    };
+
+    pve1 = {
+      subdomains = [ "pve1.luj" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.1.1";
+        vpn.ipv4 = "100.100.45.3";
+        public.ipv6 = "2a01:e0a:de4:a0e1:d250:99ff:fefa:b62";
+        vpn.ipv6 = "fd7a:115c:a1e0::3";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+    pve2 = {
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.1.2";
+        vpn.ipv4 = "100.100.45.15";
+        public.ipv6 = "2a01:e0a:de4:a0e1:aaa1:59ff:fec7:1d6";
+        vpn.ipv6 = "fd7a:115c:a1e0::f";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+    pve3 = {
+      subdomains = [ "pve3.luj" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.1.3";
+        vpn.ipv4 = "100.100.45.16";
+        public.ipv6 = "2a01:e0a:de4:a0e1:aaa1:59ff:fec1:aa10";
+        vpn.ipv6 = "fd7a:115c:a1e0::10";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+    pve4 = {
+      subdomains = [ "pve4.luj" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.1.4";
+        vpn.ipv4 = "100.100.45.17";
+        public.ipv6 = "2a01:e0a:de4:a0e1:d250:99ff:fefa:b76";
+        vpn.ipv6 = "fd7a:115c:a1e0::11";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+    saves-paris = {
+      subdomains = [ "saves-paris.luj" ];
+      ips = {
+        public.ipv4 = "82.67.34.230";
+        local.ipv4 = "192.168.4.5";
+        vpn.ipv4 = "100.100.45.4";
+        public.ipv6 = "2a01:e0a:de4:a0e1:3af3:abff:fe6a:1f54";
+        vpn.ipv6 = "fd7a:115c:a1e0::4";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+
+    saves-lyon = {
+      subdomains = [ "saves-lyon.luj" ];
+      ips = {
+        vpn.ipv4 = "100.100.45.20";
+        vpn.ipv6 = "fd7a:115c:a1e0::14";
+      };
+      sshPort = 22;
+      sshUser = "root";
+    };
+  };
+}

lon.lock

@@ -0,0 +1,204 @@
+{
+  "version": "1",
+  "sources": {
+    "agenix": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "ryantm",
+      "repo": "agenix",
+      "branch": "main",
+      "revision": "4835b1dc898959d8547a871ef484930675cb47f1",
+      "url": "https://github.com/ryantm/agenix/archive/4835b1dc898959d8547a871ef484930675cb47f1.tar.gz",
+      "hash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k="
+    },
+    "artiflakery": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "JulienMalka",
+      "repo": "artiflakery",
+      "branch": "authenticated-listing",
+      "revision": "9fc2c243c0f152303c602836ccbec8c23b4743eb",
+      "url": "https://github.com/JulienMalka/artiflakery/archive/9fc2c243c0f152303c602836ccbec8c23b4743eb.tar.gz",
+      "hash": "sha256-rbm5Ws+nsguJTZ1404bGLVexpJmFyyVirdRXCvLgtJs="
+    },
+    "buildbot-nix": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "JulienMalka",
+      "repo": "buildbot-nix",
+      "branch": "main",
+      "revision": "699160c3e095d349cf26a4957e07d9cb99a379f2",
+      "url": "https://github.com/JulienMalka/buildbot-nix/archive/699160c3e095d349cf26a4957e07d9cb99a379f2.tar.gz",
+      "hash": "sha256-AzQrQPctgjr+wGiVLMrP8ZT/B2s0W+DlxViniQbzZ+4="
+    },
+    "colmena": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "zhaofengli",
+      "repo": "colmena",
+      "branch": "main",
+      "revision": "c61641b156dfa3e82fc0671e77fccf7d7ccfaa3b",
+      "url": "https://github.com/zhaofengli/colmena/archive/c61641b156dfa3e82fc0671e77fccf7d7ccfaa3b.tar.gz",
+      "hash": "sha256-csQQPoCA5iv+Nd9yCOCQNKflP7qUKEe7D27wsz+LPKM="
+    },
+    "disko": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "disko",
+      "branch": "master",
+      "revision": "7f1857b31522062a6a00f88cbccf86b43acceed1",
+      "url": "https://github.com/nix-community/disko/archive/7f1857b31522062a6a00f88cbccf86b43acceed1.tar.gz",
+      "hash": "sha256-KrC9iOVYIn6ukpVlHbqSA4hYCZ6oDyJKrcLqv4c5v84="
+    },
+    "dns": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "JulienMalka",
+      "repo": "dns.nix",
+      "branch": "master",
+      "revision": "922d6a72ae1f4436cc8f8e04080c50aa65e0d749",
+      "url": "https://github.com/JulienMalka/dns.nix/archive/922d6a72ae1f4436cc8f8e04080c50aa65e0d749.tar.gz",
+      "hash": "sha256-K2X21U4sSYtEZiDM0Eg/IV4wRs80kztLi6qaVDIUCJE="
+    },
+    "emacs-overlay": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "emacs-overlay",
+      "branch": "master",
+      "revision": "cff16fc129c76889ddfb0ebb17b53b6633c77ba5",
+      "url": "https://github.com/nix-community/emacs-overlay/archive/cff16fc129c76889ddfb0ebb17b53b6633c77ba5.tar.gz",
+      "hash": "sha256-EtSUmvOKU7mfocPNsBSmgjOcqPBKWshSN/jsxmHZqfI="
+    },
+    "git-hooks": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "cachix",
+      "repo": "git-hooks.nix",
+      "branch": "master",
+      "revision": "623c56286de5a3193aa38891a6991b28f9bab056",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/623c56286de5a3193aa38891a6991b28f9bab056.tar.gz",
+      "hash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4="
+    },
+    "home-manager": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "home-manager",
+      "branch": "release-25.05",
+      "revision": "7aae0ee71a17b19708b93b3ed448a1a0952bf111",
+      "url": "https://github.com/nix-community/home-manager/archive/7aae0ee71a17b19708b93b3ed448a1a0952bf111.tar.gz",
+      "hash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg="
+    },
+    "home-manager-unstable": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "home-manager",
+      "branch": "master",
+      "revision": "28eef8722d1af18ca13e687dbf485e1c653a0402",
+      "url": "https://github.com/nix-community/home-manager/archive/28eef8722d1af18ca13e687dbf485e1c653a0402.tar.gz",
+      "hash": "sha256-K2xFtlD3PcKAZriOE3LaBLYmVfGQu+rIF4Jr1RFYR0Q="
+    },
+    "impermanence": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "impermanence",
+      "branch": "master",
+      "revision": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+      "url": "https://github.com/nix-community/impermanence/archive/4b3e914cdf97a5b536a889e939fb2fd2b043a170.tar.gz",
+      "hash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI="
+    },
+    "lanzaboote": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "lanzaboote",
+      "branch": "master",
+      "revision": "38c2addd2e0cedcb03708de6e6c21fb1be86d410",
+      "url": "https://github.com/nix-community/lanzaboote/archive/38c2addd2e0cedcb03708de6e6c21fb1be86d410.tar.gz",
+      "hash": "sha256-PBfJ7dGsR02im/RYN8wXII8yNPFhKxiPdq+JDfbvD2k="
+    },
+    "lila": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "JulienMalka",
+      "repo": "lila",
+      "branch": "main",
+      "revision": "7e84b2a9656fd139c6e12ff3dadde07a495bd796",
+      "url": "https://github.com/JulienMalka/lila/archive/7e84b2a9656fd139c6e12ff3dadde07a495bd796.tar.gz",
+      "hash": "sha256-TIK8220a8M/PQ36pJSRd2yBHhM7/PfMUTtj62qTD94c="
+    },
+    "lon": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nikstur",
+      "repo": "lon",
+      "branch": "main",
+      "revision": "c44e33ce55eed38a06fde43e69512380c4065441",
+      "url": "https://github.com/nikstur/lon/archive/c44e33ce55eed38a06fde43e69512380c4065441.tar.gz",
+      "hash": "sha256-bxu83mbdfAeDZYOnjZQYyjTs5WgZS8o6Q2irlzgbYs0="
+    },
+    "nix-index-database": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "mic92",
+      "repo": "nix-index-database",
+      "branch": "main",
+      "revision": "424a40050cdc5f494ec45e46462d288f08c64475",
+      "url": "https://github.com/mic92/nix-index-database/archive/424a40050cdc5f494ec45e46462d288f08c64475.tar.gz",
+      "hash": "sha256-EWlr9MZDd+GoGtZB4QsDzaLyaDQPGnRY03MFp6u2wSg="
+    },
+    "nixos-anywhere": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nix-community",
+      "repo": "nixos-anywhere",
+      "branch": "main",
+      "revision": "ff87db6a952191648ffaea97ec5559784c7223c6",
+      "url": "https://github.com/nix-community/nixos-anywhere/archive/ff87db6a952191648ffaea97ec5559784c7223c6.tar.gz",
+      "hash": "sha256-7iTUVUP6xgEYXdl9aCYBbYMYVsQmOvMoLUsUS2aoDNA="
+    },
+    "nixpkgs": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nixos",
+      "repo": "nixpkgs",
+      "branch": "nixos-25.05",
+      "revision": "6c64dabd3aa85e0c02ef1cdcb6e1213de64baee3",
+      "url": "https://github.com/nixos/nixpkgs/archive/6c64dabd3aa85e0c02ef1cdcb6e1213de64baee3.tar.gz",
+      "hash": "sha256-h/aac1dGLhS3qpaD2aZt25NdKY7b+JT0ZIP2WuGsJMU="
+    },
+    "proxmox": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "saumonnet",
+      "repo": "proxmox-nixos",
+      "branch": "main",
+      "revision": "8df841766fab6c15341577b6982ddd368be72113",
+      "url": "https://github.com/saumonnet/proxmox-nixos/archive/8df841766fab6c15341577b6982ddd368be72113.tar.gz",
+      "hash": "sha256-yaEzei8/2LBZL+h0iKO28eeP1Cvl5v0piAyakZfZL0s="
+    },
+    "stateless-uptime-kuma": {
+      "type": "Git",
+      "fetchType": "git",
+      "branch": "truly-deterministic",
+      "revision": "78564e5f2c4fad5175f709560e6ee75d30115b22",
+      "url": "https://git.dgnum.eu/Luj/stateless-uptime-kuma.git",
+      "hash": "sha256-I5uHrQvwKvJMFSOJfEZRZyc5ZElD0tCGfFVDaBfcLNM=",
+      "submodules": false
+    },
+    "unstable": {
+      "type": "GitHub",
+      "fetchType": "tarball",
+      "owner": "nixos",
+      "repo": "nixpkgs",
+      "branch": "nixos-unstable",
+      "revision": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
+      "url": "https://github.com/nixos/nixpkgs/archive/ee930f9755f58096ac6e8ca94a1887e0534e2d81.tar.gz",
+      "hash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc="
+    }
+  }
+}

lon.nix

@@ -0,0 +1,53 @@
+# Generated by lon. Do not modify!
+let
+
+  lock = builtins.fromJSON (builtins.readFile ./lon.lock);
+
+  # Override with a path defined in an environment variable. If no variable is
+  # set, the original path is used.
+  overrideFromEnv =
+    name: path:
+    let
+      replacement = builtins.getEnv "LON_OVERRIDE_${name}";
+    in
+    if replacement == "" then
+      path
+    else
+    # this turns the string into an actual Nix path (for both absolute and
+    # relative paths)
+    if builtins.substring 0 1 replacement == "/" then
+      /. + replacement
+    else
+      /. + builtins.getEnv "PWD" + "/${replacement}";
+
+  fetchSource =
+    args@{ fetchType, ... }:
+    if fetchType == "git" then
+      builtins.fetchGit (
+        {
+          url = args.url;
+          ref = args.branch;
+          rev = args.revision;
+          narHash = args.hash;
+          submodules = args.submodules;
+        }
+        // (
+          if args ? lastModified then
+            {
+              inherit (args) lastModified;
+              shallow = true;
+            }
+          else
+            { }
+        )
+      )
+    else if fetchType == "tarball" then
+      builtins.fetchTarball {
+        url = args.url;
+        sha256 = args.hash;
+      }
+    else
+      builtins.throw "Unsupported source type ${fetchType}";
+
+in
+builtins.mapAttrs (name: args: overrideFromEnv name (fetchSource args)) lock.sources

machines/akhaten/default.nix

@@ -0,0 +1,124 @@
+{ inputs, profiles, ... }:
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./stalwart.nix
+    ./nsd.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.unstable;
+    hm_version = inputs.home-manager-unstable;
+    ips = {
+      public.ipv4 = "163.172.91.82";
+      public.ipv6 = "2001:0bc8:3d24::45";
+      vpn.ipv4 = "100.100.45.33";
+    };
+    profiles = with profiles; [ server ];
+  };
+
+  disko = import ./disko.nix;
+
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/var/log"
+      "/srv"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+
+  fileSystems."/srv".neededForBoot = true;
+  fileSystems."/persistent".neededForBoot = true;
+
+  services.fail2ban.enable = true;
+
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+    config.networkConfig.IPv4Forwarding = true;
+
+    networks = {
+      "10-wan" = {
+        matchConfig.Name = "enp0s20";
+        networkConfig = {
+          DHCP = "ipv6";
+          IPv6AcceptRA = true;
+        };
+        addresses = [
+          { Address = "163.172.91.82/24"; }
+          { Address = "2001:0bc8:3d24::45/64"; }
+        ];
+        routes = [
+          {
+            Gateway = "163.172.91.1";
+            Destination = "0.0.0.0/0";
+          }
+        ];
+        dhcpV6Config = {
+          DUIDRawData = "00:01:62:7c:0e:d3:27:5b";
+          DUIDType = "link-layer";
+          UseAddress = "no";
+          WithoutRA = "solicit";
+        };
+        ipv6AcceptRAConfig = {
+          DHCPv6Client = "always";
+          UseOnLinkPrefix = false;
+          UseAutonomousPrefix = false;
+        };
+
+        linkConfig.RequiredForOnline = "routable";
+      };
+
+      "30-wg0" = {
+        matchConfig.Name = "wg0";
+        address = [
+          "10.100.45.1/24"
+          "fc00::1/64"
+        ];
+        networkConfig.IPMasquerade = "ipv4";
+      };
+    };
+
+    netdevs = {
+      "10-wg0" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+          MTUBytes = "1300";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = "/srv/wg-private";
+          ListenPort = 51821;
+        };
+        wireguardPeers = [
+          {
+            PublicKey = "axigTezuClSoQlxWvpdzXKXUDjrrQlswE50ox0uDLR0=";
+            AllowedIPs = [ "10.100.45.2/32" ];
+          }
+          {
+            PublicKey = "ElVrxNiYvV13hEDtqZNw4kLF7UiPTXziz8XgqABB0AU=";
+            AllowedIPs = [ "10.100.45.3/32" ];
+          }
+        ];
+      };
+    };
+
+  };
+
+  networking.firewall.allowedUDPPorts = [
+    51821
+  ];
+  networking.firewall.allowedTCPPorts = [
+    51821
+  ];
+
+  system.stateVersion = "24.11";
+}

machines/akhaten/disko.nix

@@ -0,0 +1,79 @@
+{
+  devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-HGST_HTE721010A9E630_JR10034M34EVTK";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+            };
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "mainpool";
+              };
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      mainpool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          persistent = {
+            size = "100G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/persistent";
+              mountOptions = [ "defaults" ];
+            };
+          };
+
+          store = {
+            size = "600G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/nix";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/akhaten/hardware.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.loader.grub.enable = true;
+  boot.initrd.availableKernelModules = [ "ahci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  boot.initrd.postDeviceCommands = ''
+    lvm lvremove --force /dev/mainpool/root || :
+    yes | lvm lvcreate --size 100G --name root mainpool
+    ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/mainpool/root
+  '';
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

machines/akhaten/home-julien.nix

@@ -1,7 +1,8 @@
-{ pkgs, lib, config, ... }:
+_: {
-{
+
- luj.hmgr.julien = {
+  luj.hmgr.julien = {
     luj.programs.neovim.enable = true;
+    luj.programs.ssh-client.enable = true;
     luj.programs.git.enable = true;
   };
 }

machines/akhaten/nsd.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  lib,
+  inputs,
+  nixosConfigurations,
+  ...
+}:
+let
+  zonesToList = lib.mapAttrsToList (name: value: { ${name} = value; });
+  zonesFromConfig = lib.mkMerge (
+    lib.fold (elem: acc: acc ++ (zonesToList elem.config.machine.meta.zones)) [ ] (
+      lib.attrValues nixosConfigurations
+    )
+  );
+  dnsLib = (import inputs.dns).lib;
+  evalZones =
+    zones:
+    (lib.evalModules {
+      modules = [
+        {
+          options = {
+            zones = lib.mkOption {
+              type = lib.types.attrsOf dnsLib.types.zone;
+              description = "DNS zones";
+            };
+          };
+          config = {
+            inherit zones;
+          };
+        }
+      ];
+    }).config.zones;
+
+  minimalZone = {
+    SOA = {
+      nameServer = "ns";
+      adminEmail = "dns@julienmalka.me";
+      serial = 0;
+    };
+  };
+
+in
+
+{
+  services.nsd = {
+    enable = true;
+    interfaces = [
+      config.machine.meta.ips.public.ipv4
+      config.machine.meta.ips.public.ipv6
+      config.machine.meta.ips.vpn.ipv4
+    ];
+    zones = lib.mapAttrs (name: _: {
+      requestXFR = [ "AXFR ${lib.snowfield.gustave.ips.vpn.ipv4} NOKEY" ];
+      allowNotify = [ "${lib.snowfield.gustave.ips.vpn.ipv4} NOKEY" ];
+      data = dnsLib.toString name minimalZone;
+    }) (evalZones zonesFromConfig);
+  };
+
+  networking.firewall.allowedUDPPorts = [ 53 ];
+  networking.firewall.allowedTCPPorts = [ 53 ];
+}

machines/akhaten/stalwart.nix

@@ -0,0 +1,261 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  services.stalwart-mail = {
+    enable = true;
+    settings = {
+      authentication.fallback-admin = {
+        user = "admin";
+        secret = "%{file:/var/lib/stalwart-mail/admin-hash}%";
+      };
+      lookup.default.hostname = "mail.luj.fr";
+      server = {
+        http.hsts = true;
+        max-connections = 8192;
+        hostname = "mail.luj.fr";
+        tls.enable = true;
+        listener = {
+          "smtp" = {
+            bind = [ "[::]:25" ];
+            protocol = "smtp";
+          };
+          "smtp-submission" = {
+            bind = "[::]:587";
+            protocol = "smtp";
+          };
+          "smtp-submissions" = {
+            bind = [ "[::]:465" ];
+            protocol = "smtp";
+            tls.implicit = true;
+          };
+          "imap" = {
+            bind = [ "[::]:143" ];
+            protocol = "imap";
+          };
+          "imaptls" = {
+            bind = [ "[::]:993" ];
+            protocol = "imap";
+            tls.implicit = true;
+          };
+          "http" = {
+            bind = "[::]:80";
+            protocol = "http";
+          };
+
+          "https" = {
+            bind = "[::]:443";
+            protocol = "http";
+            tls.implicit = true;
+          };
+
+          "sieve" = {
+            bind = "[::]:4190";
+            protocol = "managesieve";
+          };
+        };
+      };
+
+    };
+  };
+
+  services.backup.includes = [ "/var/lib/stalwart-mail/db" ];
+
+  age.secrets.stalwart-admin-hash = {
+    file = ../../secrets/stalwart-admin.age;
+    path = "/var/lib/stalwart-mail/admin-hash";
+    owner = "stalwart-mail";
+    group = "stalwart-mail";
+  };
+
+  machine.meta.zones."luj.fr" = {
+    MX = [
+      {
+        preference = 10;
+        exchange = "mail.luj.fr.";
+      }
+    ];
+    SRV = [
+      {
+        service = "jmap";
+        proto = "tcp";
+        port = 443;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "imaps";
+        proto = "tcp";
+        port = 993;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "imap";
+        proto = "tcp";
+        port = 143;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "submissions";
+        proto = "tcp";
+        port = 465;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "submission";
+        proto = "tcp";
+        port = 587;
+        target = "mail.luj.fr.";
+      }
+    ];
+    TXT = [ "v=spf1 mx ra=postmaster -all" ];
+    subdomains = {
+      "mail" = {
+        A = [ config.machine.meta.ips.public.ipv4 ];
+        AAAA = [ config.machine.meta.ips.public.ipv6 ];
+        TXT = [ "v=spf1 a ra=postmaster -all" ];
+      };
+      "202408e._domainkey".TXT = [
+        "v=DKIM1; k=ed25519; h=sha256; p=rWKEPnFhPFXFBlcEcLdxGHhFLzIjLdLzEChxUTafGyo="
+      ];
+      "202408r._domainkey".TXT = [
+        "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmLgfZ1HvXIPx5HENRcidzy/Wwkwr5GHNytBl+tocQDL2TL+PS+zYm+n1ziOCrQJbqxmlbKSCaX0JXwKO/0qwA9G2XYsZV7CiAhGHBJ/DPDVGADTcdFTvVOgmcbnQuAvJOSS3qUjBaUaO4nZQv3HmhjMsq3ukfUvHUQ6bneES9W3PX0qUSyNJInXOYr3447K9drzahH07kPX64mPMxlyKcDsHukOn3XrHGcqbqt0kYyGVdiOuGErwCn+nes1FIRutKIz2rC/TiXum4AtP9mfb0caa+rHSvKuFdlC2UpBkhGf5MUQ1i5xxQJraS23gCpIz5WLcDzH5F8b73w4EBvGM+QIDAQAB"
+      ];
+      "_mta-sts".TXT = [ "v=STSv1; id=17428246908727558748" ];
+      "_dmarc".TXT = [ "v=DMARC1; p=reject; rua=mailto:postmaster@luj.fr; ruf=mailto:postmaster@luj.fr" ];
+      "_smtp._tls".TXT = [ "v=TLSRPTv1; rua=mailto:postmaster@luj.fr" ];
+      "autoconfig".CNAME = [ "mail.luj.fr." ];
+      "autodiscover".CNAME = [ "mail.luj.fr." ];
+      "mta-sts".CNAME = [ "mail.luj.fr." ];
+      "_25._tcp".TLSA = [
+        {
+          usage = 3;
+          selector = 0;
+          matching-type = 1;
+          association-data = "44225ab4b789190c6b1a1992cfe6bd67ecbb958fd5e8cb4675c11b19754646fa";
+        }
+        {
+          usage = 3;
+          selector = 0;
+          matching-type = 2;
+          association-data = "82214869dc29f15a9becad146a4f6a8085992ef6ffc2fda53a0cafc03591c9c4fa3087aa7f44f5c965eb20176791f04666ad829f0cc3efe471743640e4b66e52";
+        }
+        {
+          usage = 3;
+          selector = 1;
+          matching-type = 1;
+          association-data = "c6242de30b6c304cbcfa5a391166c3aff89ada1e290081dde794594f724522f7";
+        }
+        {
+          usage = 3;
+          selector = 1;
+          matching-type = 2;
+          association-data = "c26c4c5a4079accbe9e310110d758cce1c965e5af1bbaef1c02f8b091bc7b3ae9e33b1f2c5db48df9c47355d8d88fa6ae6872b90304d49ef5323afd97b437294";
+        }
+        {
+          usage = 2;
+          selector = 0;
+          matching-type = 1;
+          association-data = "76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85";
+        }
+        {
+          usage = 2;
+          selector = 0;
+          matching-type = 2;
+          association-data = "afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518";
+        }
+        {
+          usage = 2;
+          selector = 1;
+          matching-type = 1;
+          association-data = "d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7";
+        }
+        {
+          usage = 2;
+          selector = 1;
+          matching-type = 2;
+          association-data = "f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9";
+        }
+      ];
+    };
+  };
+
+  machine.meta.zones."malka.sh" = {
+    # todo: remove when we are at a registar that knows how to publish GLUE records
+    NS = lib.mkForce [
+      "ns1.luj.fr."
+      "ns2.luj.fr."
+    ];
+    MX = [
+      {
+        preference = 10;
+        exchange = "mail.luj.fr.";
+      }
+    ];
+    SRV = [
+      {
+        service = "jmap";
+        proto = "tcp";
+        port = 443;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "imaps";
+        proto = "tcp";
+        port = 993;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "imap";
+        proto = "tcp";
+        port = 143;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "submissions";
+        proto = "tcp";
+        port = 465;
+        target = "mail.luj.fr.";
+      }
+      {
+        service = "submission";
+        proto = "tcp";
+        port = 587;
+        target = "mail.luj.fr.";
+      }
+    ];
+    TXT = [ "v=spf1 mx ra=postmaster -all" ];
+    subdomains = {
+      "mail".CNAME = [ "mail.luj.fr." ];
+      "202408e._domainkey".TXT = [
+        "v=DKIM1; k=ed25519; h=sha256; p=yApFb5wLSoy9+5bBx0EgzQFxJv3bAPrkEkZhrlDh0hs="
+      ];
+      "202408r._domainkey".TXT = [
+        "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApQii0y+8s9IM3ZTaGrwbG6H4qJTUsCFXhGjjfp11pv9hAzTMWKNiZQ9yazGGILtwX6l6ROBkzqFSfAeS2OV473dC5zPvQcWjDQaUbkf/XzktYkL7b8e4JuFqz4lRl3L/nzOYd37ymrM2wx1IDB78mjxqlyUjvdme+gYFHfd3a2RdpRhpsJtLhvCGItptxzRzrET3yUhEGFp4mM37eS0re0abckcodZTlCG4lHNlU4EsWTYDdbCuCVd43u15v27wET0MFnEyYvUYPB56n5eTNOXQd5DZU0xslldDwtUS0R5wpseWRGH+EFR22dtD/5dcvsdDYm+z16jjUL9bxUKooCwIDAQAB"
+      ];
+      "_mta-sts".TXT = [ "v=STSv1; id=17428246908727558748" ];
+      "_dmarc".TXT = [
+        "v=DMARC1; p=reject; rua=mailto:postmaster@malka.sh; ruf=mailto:postmaster@malka.sh"
+      ];
+      "_smtp._tls".TXT = [ "v=TLSRPTv1; rua=mailto:postmaster@malka.sh" ];
+      "autoconfig".CNAME = [ "mail.luj.fr." ];
+      "autodiscover".CNAME = [ "mail.luj.fr." ];
+      "mta-sts".CNAME = [ "mail.luj.fr." ];
+    };
+
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+    8080
+    465
+    993
+    143
+    25
+    4190
+    587
+  ];
+
+}

machines/akhaten/stalwart.patch

@@ -0,0 +1,46 @@
+From 1282e77ea96e5154011b3d4607c15140003ee2e6 Mon Sep 17 00:00:00 2001
+From: mdecimus <mauro@stalw.art>
+Date: Sun, 9 Mar 2025 17:47:40 +0100
+Subject: [PATCH] Do not panic when mailboxId is not found (closes #1293)
+
+---
+ crates/imap/src/op/list.rs | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/crates/imap/src/op/list.rs b/crates/imap/src/op/list.rs
+index 250db4be..4231ec1b 100644
+--- a/crates/imap/src/op/list.rs
++++ b/crates/imap/src/op/list.rs
+@@ -22,6 +22,7 @@ use imap_proto::{
+     },
+     receiver::Request,
+ };
++use trc::StoreEvent;
+ 
+ use super::ImapContext;
+ 
+@@ -202,7 +203,22 @@ impl<T: SessionStream> SessionData<T> {
+ 
+             for (mailbox_name, mailbox_id) in &account.mailbox_names {
+                 if matches_pattern(&patterns, mailbox_name) {
+-                    let mailbox = account.mailbox_state.get(mailbox_id).unwrap();
++                    let mailbox = if let Some(mailbox) = account.mailbox_state.get(mailbox_id) {
++                        mailbox
++                    } else {
++                        trc::event!(
++                            Store(StoreEvent::UnexpectedError),
++                            Details = "IMAP mailbox no longer present in account state",
++                            Id = *mailbox_id,
++                            Details = account
++                                .mailbox_state
++                                .keys()
++                                .copied()
++                                .map(trc::Value::from)
++                                .collect::<Vec<_>>()
++                        );
++                        continue;
++                    };
+                     let mut has_recursive_match = false;
+                     if recursive_match {
+                         let prefix = format!("{}/", mailbox_name);
+

machines/arcadia/default.nix

@@ -0,0 +1,98 @@
+{
+  pkgs,
+  inputs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./syncthing.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.unstable;
+    hm_version = inputs.home-manager-unstable;
+    # TODO: Fix colmena deployment
+    ips.public.ipv4 = "127.0.0.1";
+    ips.vpn.ipv4 = "100.100.45.12";
+
+  };
+
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/var/log"
+      "/etc/NetworkManager/system-connections"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+  programs.fuse.userAllowOther = true;
+
+  fileSystems."/persistent".neededForBoot = true;
+
+  disko = import ./disko.nix;
+
+  boot.loader.systemd-boot.enable = true;
+
+  networking.wireless.enable = false;
+
+  services.tailscale.enable = true;
+
+  networking.networkmanager.enable = true;
+
+  services.dbus.enable = true;
+
+  programs.dconf.enable = true;
+
+  security.polkit.enable = true;
+
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "epyc.infra.newtype.fr";
+        maxJobs = 100;
+        systems = [ "x86_64-linux" ];
+        sshUser = "root";
+        supportedFeatures = [
+          "kvm"
+          "nixos-test"
+        ];
+        sshKey = "/home/julien/.ssh/id_ed25519";
+        speedFactor = 2;
+      }
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    tailscale
+    brightnessctl
+    sbctl
+  ];
+
+  security.pam.services.swaylock = { };
+
+  programs.ssh.startAgent = true;
+
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.xterm.enable = true;
+  services.xserver.enable = true;
+
+  services.xserver.windowManager.session = lib.singleton {
+    name = "exwm";
+    start = ''
+      ${pkgs.emacs}/bin/emacs -l /home/julien/.emacs.d/exwm-config.el
+    '';
+  };
+
+  services.gnome.gnome-keyring.enable = true;
+  system.stateVersion = "25.05";
+}

machines/arcadia/disko.nix

@@ -0,0 +1,90 @@
+{
+  devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-PNY_CS2241_4TB_SSD_PNY23362309060100017";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+            };
+            ESP = {
+              size = "10G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                extraOpenArgs = [ ];
+                passwordFile = "/tmp/secret.key";
+                settings = {
+                  # if you want to use the key for interactive login be sure there is no trailing newline
+                  # for example use `echo -n "password" > /tmp/secret.key`
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "lvm_pv";
+                  vg = "mainpool";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      mainpool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "500G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          persistent = {
+            size = "1T";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/persistent";
+              mountOptions = [ "defaults" ];
+            };
+          };
+
+          store = {
+            size = "2T";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/nix";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/arcadia/hardware.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

machines/arcadia/home-julien.nix

@@ -0,0 +1,127 @@
+{ pkgs, lib, ... }:
+{
+
+  luj.hmgr.julien = {
+    home.stateVersion = "25.05";
+    luj.programs.neovim.enable = true;
+    luj.programs.ssh-client.enable = true;
+    luj.programs.git.enable = true;
+    luj.programs.gtk.enable = true;
+    luj.programs.kitty.enable = true;
+    luj.programs.dunst.enable = true;
+    luj.programs.fish.enable = true;
+    luj.programs.firefox.enable = true;
+    luj.programs.pass.enable = true;
+
+    luj.emails.enable = true;
+
+    services.mbsync.postExec = lib.mkForce null;
+
+    services.mbsync.enable = lib.mkForce false;
+    programs.mbsync.enable = lib.mkForce false;
+    programs.notmuch.hooks.postNew = lib.mkForce "";
+
+    services.muchsync.remotes."gustave" = {
+      frequency = "minutely";
+      local.checkForModifiedFiles = true;
+      remote.checkForModifiedFiles = true;
+      remote.host = "gustave";
+    };
+
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+
+    home.pointerCursor = {
+      name = "Adwaita";
+      package = pkgs.adwaita-icon-theme;
+      size = 15;
+      x11 = {
+        enable = true;
+        defaultCursor = "Adwaita";
+      };
+    };
+
+    home.packages =
+      with pkgs;
+      [
+        du-dust
+        kitty
+        jq
+        lazygit
+        fira-code
+        feh
+        meld
+        emacs-igc
+        vlc
+        jftui
+        libreoffice
+        font-awesome
+        cantarell-fonts
+        roboto
+        htop
+        evince
+        mosh
+        zotero
+        flameshot
+        kitty
+        networkmanagerapplet
+        xdg-utils
+        step-cli
+        gh
+        signal-desktop
+        scli
+        texlive.combined.scheme-full
+        unstable.nixd
+        emacs-lsp-booster
+        hunspellDicts.en_US
+        hunspellDicts.fr-moderne
+        rust-analyzer
+        cargo
+        rustc
+        pyright
+        unstable.nixfmt-rfc-style
+        i3lock
+      ]
+      ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts);
+    fonts.fontconfig.enable = true;
+
+    systemd.user.tmpfiles.rules = [
+      "L /home/julien/.emacs.d - - - - /home/julien/dev/emacs-config"
+    ];
+
+    home.persistence."/persistent/home/julien" = {
+      files = [
+        ".config/background"
+        ".cert/nm-openvpn/telecom-paris-ca.pem"
+      ];
+      directories = [
+        "Pictures"
+        "Documents"
+        ".ssh"
+        ".mozilla"
+        ".local/share/direnv"
+        ".local/share/atuin"
+        ".local/share/firefoxpwa"
+        ".config/Signal"
+        ".cache/spotify"
+        ".config/spotify"
+        ".config/autostart"
+        ".config/borg"
+        ".config/Element"
+        ".step"
+        ".gnupg"
+        "Zotero"
+        ".config/dconf"
+        ".local/share/keyrings"
+        "Maildir"
+      ];
+      allowOther = true;
+    };
+
+    home.keyboard = {
+      layout = "fr";
+    };
+  };
+}

machines/arcadia/syncthing.nix

@@ -0,0 +1,52 @@
+{ config, ... }:
+{
+  services.syncthing = {
+    enable = true;
+    user = "julien";
+    group = "users";
+    overrideDevices = true;
+    overrideFolders = true;
+
+    settings.options = {
+      urAccepted = -1;
+      listenAddresses = [ "tcp://${config.machine.meta.ips.vpn.ipv4}" ];
+    };
+
+    devices = {
+      "gustave" = {
+        id = "6APF3EP-TIV7ZBK-5WB5SA4-Y2K37CR-AMIB2TM-6T2VORK-UYNQO2X-TO6V2QH";
+        addresses = [
+          "tcp://gustave.luj:22000"
+        ];
+      };
+
+      "fischer" = {
+        id = "PLIMD3Z-L4DYKDB-MY4PFTS-3RMQUNF-GFWFOBB-SELW6MB-WIQJ2LM-QAC45QQ";
+        addresses = [
+          "tcp://fischer.luj:22000"
+        ];
+      };
+
+    };
+    folders = {
+      "dev" = {
+        path = "/home/julien/dev";
+        devices = [
+          "gustave"
+          "fischer"
+        ];
+      };
+    };
+  };
+
+  systemd.services.syncthing.serviceConfig.StateDirectory = "syncthing";
+  systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
+  environment.persistence."/persistent".directories = [
+    {
+      directory = "/home/julien/dev";
+      user = "julien";
+      group = "users";
+    }
+  ];
+
+}

machines/biblios/default.nix

@@ -0,0 +1,58 @@
+{
+  inputs,
+  profiles,
+  ...
+}:
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./garage.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.nixpkgs;
+    hm_version = inputs.home-manager;
+    profiles = with profiles; [
+      vm-simple-network
+      server
+      behind-sniproxy
+    ];
+    ips = {
+      public.ipv4 = "82.67.34.230";
+      vpn.ipv4 = "100.100.45.39";
+      public.ipv6 = "2a01:e0a:de4:a0e1:eb2:aaaa::46";
+      vpn.ipv6 = "fd7a:115c:a1e0::27";
+    };
+  };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  deployment.tags = [ "server" ];
+
+  disko = import ./disko.nix;
+
+  luj.nginx.enable = true;
+
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/var/log"
+      "/srv"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+
+  fileSystems."/srv".neededForBoot = true;
+
+  services.tailscale.enable = true;
+
+  system.stateVersion = "24.11";
+}

machines/biblios/disko.nix

@@ -0,0 +1,79 @@
+{
+  devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+            };
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "mainpool";
+              };
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      mainpool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "50G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          persistent = {
+            size = "800G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/persistent";
+              mountOptions = [ "defaults" ];
+            };
+          };
+
+          store = {
+            size = "100G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/nix";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/biblios/garage.nix

@@ -0,0 +1,161 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  api_domain = "s3.luj.fr";
+
+in
+{
+  services.garage = {
+    enable = true;
+    package = pkgs.garage_1_1_0;
+
+    settings = {
+      replication_factor = 1;
+      db_engine = "lmdb";
+      compression_level = 0;
+      s3_api = {
+        s3_region = "paris";
+        api_bind_addr = "[::]:3900";
+        root_domain = ".${api_domain}";
+      };
+      s3_web = {
+        bind_addr = "127.0.0.1:3902";
+        root_domain = ".cdn.luj.fr";
+        index = "index.html";
+      };
+
+      rpc_bind_addr = "[::]:3901";
+      rpc_public_addr = "127.0.0.1:3901";
+
+      admin.api_bind_addr = "127.0.0.1:3903";
+    };
+
+    environmentFile = config.age.secrets."garage-env-file".path;
+  };
+
+  age.secrets."garage-env-file".file = ../../secrets/garage-env-file.age;
+  age.secrets."book-auth" = {
+    file = ../../secrets/book-auth.age;
+    owner = "nginx";
+  };
+  age.secrets."notes-phd-auth" = {
+    file = ../../secrets/notes-phd-auth.age;
+    owner = "nginx";
+  };
+  age.secrets."notes-perso-auth" = {
+    file = ../../secrets/notes-perso-auth.age;
+    owner = "nginx";
+  };
+
+  services.nginx.virtualHosts."${api_domain}" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3900";
+      extraConfig = ''
+        proxy_max_temp_file_size 0;
+        client_max_body_size 5G;
+      '';
+    };
+  };
+
+  services.nginx.virtualHosts."cdn.luj.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [ "luj.fr" ];
+    locations."/".extraConfig = ''
+      proxy_pass http://127.0.0.1:3902;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header Host $host;
+    '';
+  };
+
+  services.nginx.virtualHosts."hownix.works" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".extraConfig = ''
+      proxy_pass http://127.0.0.1:3902;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header Host $host;
+    '';
+    locations."/book" = {
+      basicAuthFile = config.age.secrets.book-auth.path;
+      extraConfig = ''
+        proxy_pass http://127.0.0.1:3902;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+      '';
+
+    };
+  };
+
+  services.nginx.virtualHosts."notes.luj.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      basicAuthFile = config.age.secrets.notes-perso-auth.path;
+      proxyPass = "http://127.0.0.1:3902";
+
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+      '';
+    };
+  };
+
+  services.nginx.virtualHosts."phd.luj.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      basicAuthFile = config.age.secrets.notes-phd-auth.path;
+      proxyPass = "http://127.0.0.1:3902";
+
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+      '';
+    };
+  };
+
+  machine.meta.zones."luj.fr".A = [
+    config.machine.meta.ips.public.ipv4
+  ];
+  machine.meta.zones."luj.fr".AAAA = [
+    config.machine.meta.ips.public.ipv6
+  ];
+
+  machine.meta.probes.monitors."s3.luj.fr - IPv4".accepted_statuscodes = [ "403" ];
+  machine.meta.probes.monitors."s3.luj.fr - IPv6".accepted_statuscodes = [ "403" ];
+
+  machine.meta.probes.monitors."cdn.luj.fr - IPv4".accepted_statuscodes = [ "404" ];
+  machine.meta.probes.monitors."cdn.luj.fr - IPv6".accepted_statuscodes = [ "404" ];
+
+  machine.meta.probes.monitors = {
+    "luj.fr - IPv4" = {
+      url = "https://${config.machine.meta.ips.public.ipv4}";
+      type = "http";
+      accepted_statuscodes = [ "200-299" ];
+      notificationIDList = [ 1 ];
+      headers = ''
+        {
+          "Host": "luj.fr"
+        }
+      '';
+    };
+    "luj.fr - IPv6" = {
+      url = "https://[${config.machine.meta.ips.public.ipv6}]";
+      type = "http";
+      accepted_statuscodes = [ "200-299" ];
+      notificationIDList = [ 1 ];
+      headers = ''
+        {
+          "Host": "luj.fr"
+        }
+      '';
+    };
+  };
+
+}

machines/biblios/hardware.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/persistent".neededForBoot = lib.mkForce true;
+
+  boot.initrd.postDeviceCommands = ''
+    lvm lvremove --force /dev/mainpool/root || :
+    yes | lvm lvcreate --size 100G --name root mainpool
+    ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/mainpool/root
+  '';
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

machines/biblios/home-julien.nix

@@ -0,0 +1,3 @@
+_: {
+  luj.hmgr.julien = { };
+}

machines/core-data/default.nix

@@ -0,0 +1,100 @@
+{
+  pkgs,
+  lib,
+  inputs,
+  profiles,
+  ...
+}:
+
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.nixpkgs;
+    hm_version = inputs.home-manager;
+    profiles = with profiles; [
+      vm-simple-network
+      server
+      behind-sniproxy
+    ];
+    ips = {
+      public.ipv4 = "82.67.34.230";
+      local.ipv4 = "192.168.0.66";
+      vpn.ipv4 = "100.100.45.26";
+      public.ipv6 = "2a01:e0a:de4:a0e1:be24:11ff:fe09:638d";
+      vpn.ipv6 = "fd7a:115c:a1e0::1a";
+    };
+
+  };
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  deployment.tags = [ "server" ];
+
+  luj.nginx.enable = true;
+
+  systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
+
+  # Photoprism
+  services.photoprism = {
+    enable = true;
+    port = 2342;
+    originalsPath = "/data/photos";
+    passwordFile = "/srv/photoprism";
+    importPath = "import";
+    address = "0.0.0.0";
+    settings = {
+      PHOTOPRISM_ADMIN_USER = "admin";
+      PHOTOPRISM_DEFAULT_LOCALE = "en";
+      PHOTOPRISM_DATABASE_DRIVER = "mysql";
+      PHOTOPRISM_DATABASE_NAME = "photoprism";
+      PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
+      PHOTOPRISM_DATABASE_USER = "photoprism";
+      PHOTOPRISM_SITE_URL = "http://photos.malka.family:2342";
+      PHOTOPRISM_SITE_TITLE = "My PhotoPrism";
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    ensureDatabases = [ "photoprism" ];
+    ensureUsers = [
+      {
+        name = "photoprism";
+        ensurePermissions = {
+          "photoprism.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  services.nginx = {
+    clientMaxBodySize = "500m";
+    virtualHosts = {
+      "photos.malka.family" = {
+        forceSSL = true;
+        enableACME = true;
+        http2 = true;
+        locations."/" = {
+          proxyPass = "http://0.0.0.0:2342";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+  services.openssh.extraConfig = ''
+    HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+    HostKey /etc/ssh/ssh_host_ed25519_key
+    TrustedUserCAKeys /etc/ssh/ssh_user_key.pub
+    MaxAuthTries 20
+  '';
+
+  system.stateVersion = "23.11";
+}

machines/core-data/hardware.nix

@@ -0,0 +1,39 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/f2688b7f-1a8b-4060-a20e-db19a0c3a6ff";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/ca603044-0917-4051-a17b-8b12ff8011df";
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/B005-E88F";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/64070c2e-42ba-4f70-a5da-234b4474a1b3"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/core-data/home-julien.nix

@@ -0,0 +1,4 @@
+_:
+{
+  luj.hmgr.julien = { };
+}

machines/core-security/default.nix

@@ -0,0 +1,134 @@
+{
+  config,
+  pkgs,
+  lib,
+  inputs,
+  profiles,
+  ...
+}:
+
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./kanidm.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.nixpkgs;
+    hm_version = inputs.home-manager;
+    profiles = with profiles; [
+      vm-simple-network
+      server
+      behind-sniproxy
+    ];
+    ips = {
+      public.ipv4 = "82.67.34.230";
+      local.ipv4 = "192.168.0.175";
+      vpn.ipv4 = "100.100.45.14";
+      public.ipv6 = "2a01:e0a:de4:a0e1:40f0:8cff:fe31:3e94";
+      vpn.ipv6 = "fd7a:115c:a1e0::e";
+    };
+  };
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.grub.useOSProber = true;
+
+  deployment.tags = [ "server" ];
+
+  services.openssh.enable = true;
+
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
+
+  luj.nginx.enable = true;
+  services.nginx.virtualHosts."vaults.malka.family" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
+    };
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    config = {
+      DOMAIN = "https://vaults.malka.family";
+      ROCKET_PORT = "8223";
+      SIGNUPS_ALLOWED = false;
+    };
+    environmentFile = "/var/lib/vaultwarden.env";
+  };
+
+  services.keycloak = {
+    enable = true;
+    database.createLocally = true;
+    database.passwordFile = "/run/agenix/keycloak-db";
+    settings = {
+      hostname = "https://auth.julienmalka.me";
+      hostname-admin-url = "https://auth.julienmalka.me";
+      http-port = 8080;
+      proxy-headers = "forwarded";
+      http-enabled = true;
+    };
+    themes = {
+      keywind = pkgs.keycloak-keywind;
+    };
+  };
+
+  services.nginx.virtualHosts."auth.julienmalka.me" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8080";
+      extraConfig = ''
+        proxy_buffer_size   128k;
+        proxy_buffers   4 256k;
+        proxy_busy_buffers_size   256k;
+      '';
+    };
+  };
+
+  age.secrets.keycloak-db.file = ../../secrets/keycloak-db.age;
+
+  services.openssh.extraConfig = ''
+    HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+    HostKey /etc/ssh/ssh_host_ed25519_key
+    TrustedUserCAKeys /etc/ssh/ssh_user_key.pub
+    MaxAuthTries 20
+  '';
+
+  services.step-ca.enable = true;
+  services.step-ca.intermediatePasswordFile = "/root/capw";
+  services.step-ca.address = "100.100.45.14";
+  services.step-ca.port = 8444;
+  services.step-ca.settings = builtins.fromJSON ''
+    {}
+  '';
+
+  systemd.services."step-ca".serviceConfig.ExecStart = [
+    "" # override upstream
+    "${pkgs.step-ca}/bin/step-ca /etc/smallstep/ca_prod.json --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+  ];
+
+  services.nginx.virtualHosts."ca.luj" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "https://127.0.0.1:8444";
+    };
+  };
+
+  security.acme.certs."ca.luj".server = lib.mkForce "https://127.0.0.1:8444/acme/acme/directory";
+
+  machine.meta.probes.monitors."ca.luj - IPv4".url = lib.mkForce "https://100.100.45.14/health";
+  machine.meta.probes.monitors."ca.luj - IPv6".url = lib.mkForce "https://[fd7a:115c:a1e0::e]/health";
+
+  systemd.services."step-ca".after = [ "keycloak.service" ];
+
+  # TODO: Remove when keycloak is update in stable channel
+  nixpkgs.config.permittedInsecurePackages = [ "keycloak-23.0.6" ];
+
+  system.stateVersion = "22.11";
+}

machines/core-security/hardware.nix

@@ -0,0 +1,31 @@
+{ config, lib, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/bee9d8e2-9350-4949-a360-f3049ce7b89c";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

machines/core-security/home-julien.nix

@@ -0,0 +1,4 @@
+_:
+{
+  luj.hmgr.julien = { };
+}

machines/core-security/kanidm.nix

@@ -0,0 +1,32 @@
+{ pkgs, config, ... }:
+let
+  certificate = config.security.acme.certs."auth.luj.fr";
+  kanidm = pkgs.kanidm_1_5;
+in
+{
+  services.kanidm = {
+    enableServer = true;
+    package = kanidm;
+    serverSettings = rec {
+      domain = "auth.luj.fr";
+      origin = "https://${domain}";
+      bindaddress = "127.0.0.1:8443";
+      trust_x_forward_for = true;
+      tls_chain = "${certificate.directory}/fullchain.pem";
+      tls_key = "${certificate.directory}/key.pem";
+    };
+  };
+
+  environment.systemPackages = [ kanidm ];
+
+  users.users.kanidm.extraGroups = [ certificate.group ];
+
+  services.nginx.virtualHosts."auth.luj.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "https://127.0.0.1:8443";
+    };
+  };
+
+}

machines/fischer/default.nix

@@ -0,0 +1,350 @@
+{
+  config,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+let
+
+  stumpwmContrib = pkgs.fetchFromGitHub {
+    owner = "stumpwm";
+    repo = "stumpwm-contrib";
+    rev = "1e3fa7abae30e5d5498e69ba56da6a7e265144cc";
+    hash = "sha256-ewPeamcEWcvAHY1pmnbsVmej8gSt2qIo+lSMjpKwF6k=";
+
+  };
+  sbcl_stump = pkgs.sbcl_2_4_6;
+  stumpwmWithDeps = sbcl_stump.pkgs.stumpwm.overrideLispAttrs (x: {
+    lispLibs =
+      x.lispLibs
+      ++ (with sbcl_stump.pkgs; [
+        clx-truetype
+        slynk
+      ]);
+  });
+
+  stumpwmWithDepsRunnable = pkgs.runCommand "stuumpwm-with-deps-runnable" { } ''
+    mkdir -p "$out/bin" "$out/lib"
+    cp -r "${stumpwmContrib}" "contrib"
+    chmod u+rwX -R contrib
+    export HOME="$PWD"
+    FIRA_CODE_PATH="${pkgs.fira-code}/share/fonts/truetype"
+    POWERLINE_PATH="${pkgs.powerline-fonts}/share/fonts/truetype"
+    ln -s "${stumpwmWithDeps}" "$out/lib/stumpwm"
+    ${(sbcl_stump.withPackages (_: [ stumpwmWithDeps ]))}/bin/sbcl \
+        --eval '(require :asdf)'  --eval '(asdf:disable-output-translations)' \
+        --eval '(require :stumpwm)' \
+        --eval '(in-package :stumpwm)' \
+        --eval '(setf *default-package* :stumpwm)' \
+        --eval '(set-module-dir "contrib")' \
+        --eval '(defvar stumpwm::*local-module-dir* "contrib")' \
+        --eval '(load-module "mem")' \
+        --eval '(load-module "cpu")' \
+        --eval '(load-module "battery-portable")' \
+        --eval '(load-module "net")' \
+        --eval '(load-module "urgentwindows")' \
+        --eval '(load-module "ttf-fonts")' \
+        --eval '(require :slynk)' \
+        --eval '(require :clx-truetype)' \
+        --eval '(defvar *wallpaper* nil)' \
+        --eval '(setf *wallpaper* "${./wallpaper.jpeg}")' \
+        --eval "(setf clx-truetype:*font-dirs* (list \"$FIRA_CODE_PATH\" \"$POWERLINE_PATH\"))" \
+        --eval "(sb-ext:save-lisp-and-die \"$out/bin/stumpwm\" :executable t :toplevel #'stumpwm:stumpwm)"
+    test -x "$out/bin/stumpwm"
+  '';
+in
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./syncthing.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.unstable;
+    hm_version = inputs.home-manager-unstable;
+    # TODO: Fix colmena deployment
+    ips.public.ipv4 = "127.0.0.1";
+    ips.vpn.ipv4 = "100.100.45.11";
+  };
+
+  # Boot stuff
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/etc/secureboot";
+  };
+  boot.initrd.systemd.enable = true;
+  boot.initrd.clevis = {
+    enable = true;
+    devices."cryptroot".secretFile = ./root.jwe;
+  };
+  boot.initrd.systemd.tpm2.enable = true;
+
+  services.xserver = {
+    enable = true;
+    displayManager.lightdm.enable = true;
+    windowManager.stumpwm.enable = true;
+    windowManager.stumpwm.package = stumpwmWithDepsRunnable;
+  };
+
+  services.picom = {
+    enable = true;
+    backend = "xr_glx_hybrid";
+    vSync = true;
+  };
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+    wireplumber.enable = true;
+  };
+
+  networking.hostName = "fischer";
+
+  services.blueman.enable = true;
+  hardware.bluetooth.enable = true;
+  environment.sessionVariables = {
+    LIBSEAT_BACKEND = "logind";
+  };
+
+  services.tailscale.enable = true;
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
+  networking.networkmanager.dns = "systemd-resolved";
+  services.resolved.enable = true;
+
+  services.autorandr = {
+    enable = true;
+    matchEdid = true;
+    ignoreLid = true;
+    profiles = {
+      default = {
+        fingerprint = {
+          "eDP*" =
+            "00ffffffffffff0006af9af900000000141f0104a51e13780363f5a854489d240e505400000001010101010101010101010101010101fa3c80b870b0244010103e002dbc1000001ac83080b870b0244010103e002dbc1000001a000000fe004a38335646804231343055414e0000000000024101b2001100000a410a20200068";
+        };
+        config = {
+          "eDP*" = {
+            enable = true;
+            primary = true;
+            position = "0x0";
+            mode = "1920x1200";
+          };
+        };
+      };
+      dock-julien = {
+        fingerprint = {
+          "eDP*" =
+            "00ffffffffffff0006af9af900000000141f0104a51e13780363f5a854489d240e505400000001010101010101010101010101010101fa3c80b870b0244010103e002dbc1000001ac83080b870b0244010103e002dbc1000001a000000fe004a38335646804231343055414e0000000000024101b2001100000a410a20200068";
+          "DP*-3" =
+            "00ffffffffffff0010ac42d1425439312021010380351e78eaa3d5ab524f9d240f5054a54b008100b300d100714fa9408180d1c00101565e00a0a0a02950302035000f282100001a000000ff004446354c5459330a2020202020000000fc0044454c4c205032343233440a20000000fd00314b1d711c000a2020202020200107020318b14d010203071112161304141f051065030c001000023a801871382d40582c45000f282100001e011d8018711c1620582c25000f282100009e011d007251d01e206e2855000f282100001e7e3900a080381f4030203a000f282100001a00000000000000000000000000000000000000000000000000000000000000c1";
+          "DP*-1" =
+            "00ffffffffffff0026cd6b610f01010117210104a5351e783be725a8554ea0260d5054bfef80d140d100d1c0b30095009040818081c0565e00a0a0a02950302035000f282100001a000000ff0031323134383332333030313335000000fd00314b0f5a19000a202020202020000000fc00504c32343933510a202020202001c5020320f153101f051404131e1d121116150f0e030207060123097f0783010000394e00a0a0a02250302035000f282100001a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079";
+        };
+        config = {
+          "eDP*".enable = false;
+          "DP*-1" = {
+            enable = true;
+            primary = true;
+            position = "0x0";
+            mode = "2560x1440";
+          };
+          "DP*3" = {
+            enable = true;
+            position = "2560x0";
+            mode = "2560x1440";
+          };
+        };
+      };
+
+      dock-theo = {
+        fingerprint = {
+          "eDP*" =
+            "00ffffffffffff0006af9af900000000141f0104a51e13780363f5a854489d240e505400000001010101010101010101010101010101fa3c80b870b0244010103e002dbc1000001ac83080b870b0244010103e002dbc1000001a000000fe004a38335646804231343055414e0000000000024101b2001100000a410a20200068";
+          "DP*-1" =
+            "00ffffffffffff0010ac4042424d34412d200104a53c22783ac525aa534f9d25105054a54b00714f8180a9c0d1c081c081cf01010101023a801871382d40582c450056502100001e000000ff0039464c505a4e330a2020202020000000fc0044454c4c205032373232480a20000000fd00384c1e5311010a2020202020200000";
+        };
+        config = {
+          "eDP*".enable = false;
+          "DP*-1" = {
+            enable = true;
+            primary = true;
+            position = "0x0";
+            mode = "1920x1080";
+          };
+        };
+      };
+    };
+  };
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    useXkbConfig = true; # use xkbOptions in tty.
+  };
+
+  # Enable OpenGL
+  hardware.graphics.enable = true;
+
+  # Load nvidia driver for Xorg and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+  services.xserver.autoRepeatDelay = 250;
+  services.xserver.autoRepeatInterval = 30;
+
+  hardware.nvidia.forceFullCompositionPipeline = true;
+  services.libinput.touchpad.tapping = false;
+
+  hardware.nvidia.prime = {
+    sync.enable = true;
+    intelBusId = "PCI:0:2:0";
+    nvidiaBusId = "PCI:1:0:0";
+  };
+
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "epyc.infra.newtype.fr";
+        maxJobs = 100;
+        systems = [
+          "x86_64-linux"
+          "aarch64-linux"
+        ];
+        sshUser = "root";
+        sshKey = "/home/julien/.ssh/id_ed25519";
+        supportedFeatures = [
+          "nixos-test"
+          "benchmark"
+          "big-parallel"
+          "kvm"
+        ];
+        speedFactor = 2;
+      }
+    ];
+  };
+
+  hardware.nvidia = {
+    modesetting.enable = true;
+    open = true;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.beta;
+  };
+
+  environment.variables = {
+    # Required to run the correct GBM backend for nvidia GPUs on wayland
+    GBM_BACKEND = "nvidia-drm";
+    # Apparently, without this nouveau may attempt to be used instead
+    # (despite it being blacklisted)
+    __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+    # Hardware cursors are currently broken on wlroots
+    WLR_NO_HARDWARE_CURSORS = "1";
+  };
+
+  boot.extraModprobeConfig =
+    "options nvidia "
+    + lib.concatStringsSep " " [
+      # nvidia assume that by default your CPU does not support PAT,
+      # but this is effectively never the case in 2023
+      "NVreg_UsePageAttributeTable=1"
+      # This is sometimes needed for ddc/ci support, see
+      # https://www.ddcutil.com/nvidia/
+      #
+      # Current monitor does not support it, but this is useful for
+      # the future
+      "NVreg_RegistryDwords=RMUseSwI2c=0x01;RMI2cSpeed=100"
+    ];
+
+  boot.initrd.kernelModules = [ "nvidia" ];
+
+  programs.dconf.enable = true;
+
+  security.polkit.enable = true;
+
+  security.tpm2.enable = true;
+  security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
+  security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
+  users.users.julien.extraGroups = [ "tss" ]; # tss group has access to TPM devices
+
+  services.postgresql.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    tailscale
+    brightnessctl
+    sbctl
+    wl-mirror
+    texlive.combined.scheme-full
+    mu
+    stumpwmWithDepsRunnable
+  ];
+
+  networking.hosts = {
+    "172.25.90.82" = [ "ducati-diavel" ];
+  };
+
+  services.printing = {
+    enable = true;
+    extraConf = ''
+      JobPrivateAccess all
+      JobPrivateValues none
+    '';
+    clientConf = ''
+      ServerName localhost
+      Encryption Required
+      User jmalka
+    '';
+  };
+
+  environment.variables = {
+    CUPS_USER = "jmalka";
+  };
+
+  security.pam.services.swaylock = { };
+
+  programs.ssh.startAgent = true;
+
+  services.gnome.gnome-keyring.enable = true;
+
+  services.openssh.extraConfig = ''
+    HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+    HostKey /etc/ssh/ssh_host_ed25519_key
+    TrustedUserCAKeys /etc/ssh/ssh_user_key.pub
+    MaxAuthTries 20
+  '';
+
+  virtualisation.docker.enable = true;
+
+  services.pcscd.enable = true;
+  services.udev.packages = [ pkgs.yubikey-personalization ];
+
+  services.zerotierone = {
+    enable = true;
+    joinNetworks = [
+      "ebe7fbd4451442b0"
+    ];
+  };
+
+  # Desktop environment
+  programs.xwayland.enable = true;
+  programs.hyprland = {
+    enable = true;
+    package = pkgs.hyprland;
+    portalPackage = pkgs.xdg-desktop-portal-hyprland;
+  };
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+  };
+  system.stateVersion = "23.05";
+}

machines/fischer/hardware.nix

@@ -0,0 +1,58 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "vmd"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/f7072a83-0478-48ea-9f55-074541c1c524";
+    fsType = "btrfs";
+  };
+
+  boot.initrd.luks.devices."cryptroot".device =
+    "/dev/disk/by-uuid/56dc5a16-94ca-4a9c-a215-51ed55aec6b5";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/9331-9E52";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/63debceb-44e6-4e27-94df-092dd59fd9e2"; } ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s13f0u4u4u4.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

machines/fischer/home-julien.nix

@@ -0,0 +1,117 @@
+{ pkgs, lib, ... }:
+{
+
+  luj.hmgr.julien = {
+    home.stateVersion = "22.11";
+    luj.programs.neovim.enable = true;
+    luj.programs.ssh-client.enable = true;
+    luj.programs.git.enable = true;
+    luj.programs.gtk.enable = true;
+    luj.programs.waybar.enable = true;
+    luj.programs.waybar.interfaceName = "enp0s13f0u1u4u4";
+    luj.programs.kitty.enable = true;
+    luj.programs.fish.enable = true;
+    luj.programs.dunst.enable = true;
+    luj.programs.firefox.enable = true;
+    luj.programs.hyprland.enable = true;
+
+    luj.emails.enable = true;
+
+    services.mbsync.postExec = lib.mkForce null;
+
+    services.mbsync.enable = lib.mkForce false;
+    programs.mbsync.enable = lib.mkForce false;
+    programs.notmuch.hooks.postNew = lib.mkForce "";
+
+    services.muchsync.remotes."gustave" = {
+      frequency = "minutely";
+      local.checkForModifiedFiles = true;
+      remote.checkForModifiedFiles = true;
+      remote.host = "gustave";
+    };
+
+    programs.emacs = {
+      enable = true;
+      package = pkgs.emacs-igc;
+      extraPackages = epkgs: [
+        epkgs.mu4e
+      ];
+    };
+
+    programs.mu.enable = true;
+
+    programs.rofi = {
+      enable = true;
+      package = pkgs.rofi-wayland;
+      font = "Fira Font";
+      theme = "DarkBlue";
+    };
+
+    home.pointerCursor = {
+      name = "Adwaita";
+      package = pkgs.adwaita-icon-theme;
+      size = 15;
+    };
+
+    services.screen-locker = {
+      enable = true;
+      lockCmd = "XSECURELOCK_PASSWORD_PROMPT=time_hex ${pkgs.xsecurelock}/bin/xsecurelock";
+      xautolock.enable = false; # means use xss-lock
+      xss-lock.extraOptions = [
+        "--notifier=${pkgs.xsecurelock}/libexec/xsecurelock/dimmer"
+        "-l" # prevents suspend before locker is started
+      ];
+    };
+
+    home.packages =
+      with pkgs;
+      [
+        du-dust
+        kitty
+        jq
+        lazygit
+        fira-code
+        feh
+        meld
+        vlc
+        jftui
+        cantarell-fonts
+        libreoffice
+        font-awesome
+        nodejs
+        htop
+        evince
+        mosh
+        zotero
+        flameshot
+        networkmanagerapplet
+        xdg-utils
+        step-cli
+        gh
+        gh-dash
+        signal-desktop
+        scli
+        emacsPackages.jinx
+        hunspellDicts.en_US
+        hunspellDicts.fr-moderne
+        texlive.combined.scheme-full
+        hledger
+        emacs-lsp-booster
+        pkgs.stable.pyright
+        unstable.nixd
+        unstable.nixfmt-rfc-style
+        kanidm
+        yubioath-flutter
+        ltex-ls
+        powerline-fonts
+        drawio
+      ]
+      ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts);
+
+    fonts.fontconfig.enable = true;
+
+    home.keyboard = {
+      layout = "fr";
+    };
+  };
+}

machines/fischer/root.jwe

@@ -0,0 +1 @@
+eyJhbGciOiJkaXIiLCJjbGV2aXMiOnsicGluIjoidHBtMiIsInRwbTIiOnsiaGFzaCI6InNoYTI1NiIsImp3a19wcml2IjoiQU80QUlPTG9sak5fQTVia3FnMExxZzd2ZTE5TUR6TElScFJWYjdaNDVPenZ1UnBJQUJDTWFkQWdYYV9BWW5vQUU3VnRMWF9xNG44di1NdVh4YWVzVVQwUm51cEZYVzlEN2hDZ2QwY2pROFJoX2YyLWFzbGhPYWkxTU4wZ0hib3d5U25weVlYOHFfeUY5UXRZcjR6TXlwVFZfUmpwT18tdmZwSnFzYlBsTk9uWkpIc1pNd01rbHpuVXJYeXJnelpYRVlWUG9vU3RoSVFhZWF1enJDeG9DTWhKTXozTjdvNzRQT3M0MElxYjBXMHhrYW1WVjh1ZDFYbklxaG5hOGNQUDhqcjdsOXIwamRrOHJJTzF5LThhcWphTlMxVnFQYmJDNDVSNE80YUw0Y3cwV0VRTXRXVmxIWVhGcEt5dUtnN0wiLCJqd2tfcHViIjoiQUM0QUNBQUxBQUFFMGdBQUFCQUFJQVVLTVl0Slp2ZEltZWZla20xOFFxYTVtWWRYRlo2Q25RSi1tSkkxUFdHViIsImtleSI6ImVjYyJ9fSwiZW5jIjoiQTI1NkdDTSJ9..h1YWJLRjyGOHJF1a.oRKmPpgk3Q5fLJUOBQ.nKokH0S90iew6-k5n_aaeA

machines/fischer/syncthing.nix

@@ -0,0 +1,52 @@
+{ config, ... }:
+{
+  services.syncthing = {
+    enable = true;
+    user = "julien";
+    group = "users";
+    overrideDevices = true;
+    overrideFolders = true;
+
+    settings.options = {
+      urAccepted = -1;
+      listenAddresses = [ "tcp://${config.machine.meta.ips.vpn.ipv4}" ];
+    };
+
+    devices = {
+      "gustave" = {
+        id = "6APF3EP-TIV7ZBK-5WB5SA4-Y2K37CR-AMIB2TM-6T2VORK-UYNQO2X-TO6V2QH";
+        addresses = [
+          "tcp://gustave.luj:22000"
+        ];
+      };
+
+      "gallifrey" = {
+        id = "P3BTFAX-4MCSFQB-C5R5YBP-YGMJ6FU-OKJN4QG-MJ2BV6Y-YB4U7VL-3GFSTAM";
+        addresses = [
+          "tcp://gallifrey.luj:22000"
+        ];
+      };
+
+      "arcadia" = {
+        id = "E5CGH2H-3XMMCKQ-5PTMKKA-4C4VDS3-JCBZGRM-4GTAWHQ-QRJ367E-BXFMUAU";
+        addresses = [
+          "tcp://arcadia.luj:22000"
+        ];
+      };
+
+    };
+    folders = {
+      "dev" = {
+        path = "/home/julien/dev";
+        devices = [
+          "gustave"
+          "gallifrey"
+          "arcadia"
+        ];
+      };
+    };
+  };
+
+  systemd.services.syncthing.serviceConfig.StateDirectory = "syncthing";
+  systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
+}

machines/gallifrey/default.nix

@@ -0,0 +1,163 @@
+{
+  config,
+  pkgs,
+  inputs,
+  profiles,
+  ...
+}:
+
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./syncthing.nix
+  ];
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.unstable;
+    hm_version = inputs.home-manager-unstable;
+    profiles = with profiles; [ sound ];
+    ips.vpn.ipv4 = "100.100.45.35";
+  };
+
+  networking.hostName = "gallifrey";
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.networkmanager.enable = true;
+
+  programs.ssh.knownHosts."epyc.infra.newtype.fr".publicKey =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOXT9Init1MhKt4rjBANLq0t0bPww/WQZ96uB4AEDrml";
+
+  networking.networkmanager.dns = "systemd-resolved";
+  services.resolved.enable = true;
+  #services.userborn.enable = true;
+
+  networking.interfaces.eno1.wakeOnLan.enable = true;
+  boot.kernelParams = [
+    #   # See <https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for docs on this
+    #   # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>
+    #   # The server ip refers to the NFS server -- we don't need it.
+    #   # "ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:1.1.1.1"
+    ## initrd luks_remote_unlock
+    "ip=192.168.4.10::192.168.0.1:255.255.248.0:gallifrey-initrd:eno1:none"
+  ];
+
+  boot.initrd.kernelModules = [
+    "r8169"
+  ];
+
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 2222;
+      authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
+      hostKeys = [ "/persistent/initrd/ssh_host_ed25519_key" ];
+    };
+  };
+
+  security.pam.loginLimits = [
+    {
+      domain = "*";
+      type = "-";
+      item = "nofile";
+      value = "262144";
+    }
+  ];
+
+  disko = import ./disko.nix;
+
+  boot.extraModulePackages = [ config.boot.kernelPackages.nvidia_x11 ];
+  services.xserver = {
+    enable = true;
+    videoDrivers = [ "nvidia" ];
+    displayManager.gdm.enable = true;
+    desktopManager.gnome.enable = true;
+  };
+
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    powerManagement.finegrained = false;
+    open = false;
+    gsp.enable = false;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+
+  programs.xwayland.enable = true;
+  services.postgresql.enable = true;
+
+  programs.dconf.enable = true;
+
+  services.udev.packages = [ pkgs.nitrokey-udev-rules ];
+
+  security.polkit.enable = true;
+
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "epyc.infra.newtype.fr";
+        maxJobs = 100;
+        systems = [
+          "x86_64-linux"
+          "aarch64-linux"
+        ];
+        sshUser = "root";
+        supportedFeatures = [
+          "kvm"
+          "nixos-test"
+          "benchmark"
+          "big-parallel"
+        ];
+        sshKey = "/home/julien/.ssh/id_ed25519";
+        speedFactor = 2;
+      }
+    ];
+  };
+
+  networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ];
+  programs.ssh.startAgent = true;
+
+  environment.systemPackages = with pkgs; [
+    tailscale
+    brightnessctl
+    sbctl
+    ddcutil
+    xorg.xinit
+    gnomeExtensions.dash-to-dock
+    gnomeExtensions.tailscale-status
+    gnomeExtensions.appindicator
+    gnome-tweaks
+    pkgs.firefoxpwa
+  ];
+
+  programs.firefox = {
+    enable = true;
+    package = pkgs.firefox;
+    nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+  };
+
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/var/log"
+      "/etc/NetworkManager/system-connections"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+  programs.fuse.userAllowOther = true;
+
+  fileSystems."/persistent".neededForBoot = true;
+
+  system.stateVersion = "24.11";
+}

machines/gallifrey/disko.nix

@@ -0,0 +1,90 @@
+{
+  devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-CT2000P3PSSD8_2316E6CBA6BA";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+            };
+            ESP = {
+              size = "10G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                extraOpenArgs = [ ];
+                passwordFile = "/tmp/secret.key";
+                settings = {
+                  # if you want to use the key for interactive login be sure there is no trailing newline
+                  # for example use `echo -n "password" > /tmp/secret.key`
+                  allowDiscards = true;
+                };
+                content = {
+                  type = "lvm_pv";
+                  vg = "mainpool";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      mainpool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "300G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          persistent = {
+            size = "600G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/persistent";
+              mountOptions = [ "defaults" ];
+            };
+          };
+
+          store = {
+            size = "900G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/nix";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/gallifrey/hardware.nix

@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.kernelPackages = pkgs.linuxPackages_6_13;
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/4680be45-8156-4bf0-8b0b-e7493aaf37c0";
+    fsType = "ext4";
+  };
+
+  boot.initrd.postDeviceCommands = ''
+    lvm lvremove --force /dev/mainpool/root || :
+    yes | lvm lvcreate --size 100G --name root mainpool
+    ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/mainpool/root
+  '';
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enP5p1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

machines/gallifrey/home-julien.nix

@@ -0,0 +1,184 @@
+{ pkgs, lib, ... }:
+{
+
+  luj.hmgr.julien = {
+    home.stateVersion = "24.11";
+    luj.programs.neovim.enable = true;
+    luj.programs.ssh-client.enable = true;
+    luj.programs.git.enable = true;
+    luj.programs.kitty.enable = true;
+    luj.programs.fish.enable = true;
+    luj.emails.enable = true;
+
+    services.mbsync.postExec = lib.mkForce null;
+
+    services.mbsync.enable = lib.mkForce false;
+    programs.mbsync.enable = lib.mkForce false;
+    programs.notmuch.hooks.postNew = lib.mkForce "";
+
+    services.muchsync.remotes."gustave" = {
+      frequency = "minutely";
+      local.checkForModifiedFiles = true;
+      remote.checkForModifiedFiles = true;
+      remote.host = "gustave";
+    };
+
+    programs.rofi = {
+      enable = true;
+      package = pkgs.rofi-wayland;
+      font = "Fira Font";
+      theme = "DarkBlue";
+    };
+
+    programs.direnv = {
+      enable = true;
+      enableZshIntegration = true;
+      nix-direnv.enable = true;
+    };
+
+    home.pointerCursor = {
+      gtk.enable = true;
+      name = "Adwaita";
+      package = pkgs.adwaita-icon-theme;
+      size = 15;
+      x11 = {
+        enable = true;
+        defaultCursor = "Adwaita";
+      };
+    };
+
+    programs.atuin = {
+      enable = true;
+      enableFishIntegration = true;
+    };
+
+    dconf.settings = {
+      "org/gnome/shell" = {
+        welcome-dialog-last-shown-version = "999"; # prevent popup until gnome version 999 :)
+      };
+    };
+
+    programs.obs-studio = {
+      enable = true;
+      plugins = with pkgs; [ obs-studio-plugins.obs-vkcapture ];
+    };
+
+    programs.mu.enable = true;
+
+    programs.emacs = {
+      enable = true;
+      package = pkgs.emacs-igc;
+      extraPackages = epkgs: [
+        epkgs.mu4e
+      ];
+    };
+
+    home.packages =
+      with pkgs;
+      [
+        du-dust
+        kitty
+        jq
+        lazygit
+        fira-code
+        feh
+        meld
+        jetbrains-mono
+        cantarell-fonts
+        unstable.nixd
+        libreoffice
+        signal-desktop
+        font-awesome
+        nodejs
+        htop
+        evince
+        mosh
+        flameshot
+        kitty
+        networkmanagerapplet
+        element-desktop
+        xdg-utils
+        step-cli
+        scli
+        jftui
+        texlive.combined.scheme-full
+        inochi-creator
+        inochi-session
+        gh
+        ouch
+        spotify
+        nautilus
+        pika-backup
+        mpv
+        zotero
+        emacsPackages.jinx
+        hunspellDicts.en_US
+        hunspellDicts.fr-moderne
+        forge-sparks
+        citations
+        blanket
+        fragments
+        metadata-cleaner
+        gnome-obfuscate
+        warp
+        tuba
+        resources
+        notify-client
+        emacs-lsp-booster
+        pyright
+        nixfmt-rfc-style
+        slack
+        haskell-language-server
+        aporetic
+        notmuch
+        muchsync
+      ]
+      ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts);
+
+    fonts.fontconfig.enable = true;
+
+    systemd.user.tmpfiles.rules = [
+      "L /home/julien/.emacs.d - - - - /home/julien/dev/emacs-config"
+    ];
+
+    home.persistence."/persistent/home/julien" = {
+      files = [
+        ".config/gnome-initial-setup-done"
+        ".config/background"
+        ".cert/nm-openvpn/telecom-paris-ca.pem"
+        ".local/share/com.ranfdev.Notify.sqlite"
+      ];
+      directories = [
+        "Pictures"
+        "Documents"
+        ".ssh"
+        ".mozilla"
+        "devold"
+        ".config/cosmic"
+        ".local/share/direnv"
+        ".local/state/cosmic-comp"
+        ".local/share/atuin"
+        ".local/share/firefoxpwa"
+        ".config/Signal"
+        ".cache/spotify"
+        ".config/spotify"
+        ".config/autostart"
+        ".config/borg"
+        ".config/pika-backup"
+        ".config/Element"
+        ".step"
+        ".gnupg"
+        "Zotero"
+        ".config/dconf"
+        ".local/share/keyrings"
+        ".cache/mu"
+        "Maildir"
+      ];
+      allowOther = true;
+    };
+
+    home.keyboard = {
+      layout = "fr";
+    };
+  };
+}

machines/gallifrey/syncthing.nix

@@ -0,0 +1,52 @@
+{ config, ... }:
+{
+  services.syncthing = {
+    enable = true;
+    user = "julien";
+    group = "users";
+    overrideDevices = true;
+    overrideFolders = true;
+
+    settings.options = {
+      urAccepted = -1;
+      listenAddresses = [ "tcp://${config.machine.meta.ips.vpn.ipv4}" ];
+    };
+
+    devices = {
+      "gustave" = {
+        id = "6APF3EP-TIV7ZBK-5WB5SA4-Y2K37CR-AMIB2TM-6T2VORK-UYNQO2X-TO6V2QH";
+        addresses = [
+          "tcp://gustave.luj:22000"
+        ];
+      };
+
+      "fischer" = {
+        id = "PLIMD3Z-L4DYKDB-MY4PFTS-3RMQUNF-GFWFOBB-SELW6MB-WIQJ2LM-QAC45QQ";
+        addresses = [
+          "tcp://fischer.luj:22000"
+        ];
+      };
+
+    };
+    folders = {
+      "dev" = {
+        path = "/home/julien/dev";
+        devices = [
+          "gustave"
+          "fischer"
+        ];
+      };
+    };
+  };
+
+  systemd.services.syncthing.serviceConfig.StateDirectory = "syncthing";
+  systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
+  environment.persistence."/persistent".directories = [
+    {
+      directory = "/home/julien/dev";
+      user = "julien";
+      group = "users";
+    }
+  ];
+
+}

machines/gustave/artiflakery.nix

@@ -0,0 +1,120 @@
+{ config, lib, ... }:
+{
+
+  age.secrets."artiflakery-auth" = {
+    file = ../../secrets/artiflakery-auth.age;
+    owner = "artiflakery";
+  };
+
+  services.nginx.virtualHosts."static.luj.fr" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyWebsockets = true;
+      proxyPass = "http://localhost:8090";
+    };
+    locations."/ws" = {
+      proxyWebsockets = true;
+      proxyPass = "http://localhost:8090";
+    };
+  };
+
+  users.users.artiflakery.isSystemUser = lib.mkForce false;
+  users.users.artiflakery.isNormalUser = lib.mkForce true;
+
+  services.artiflakery = {
+    enable = true;
+    authFile = config.age.secrets."artiflakery-auth".path;
+    routes = {
+      "papers/2024/increasing-trust-scc-rb-fpm/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/papers/2024-ICSE-doctoral-symposium&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "papers/2024/reproducibility-env-space-time/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/papers/2024-ICSE-reproducibility-build-env-space-time&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "papers/2025/bitwise-reproducibility-at-scale/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/papers/2025-MSR-reproducibility&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "papers/WIP/xz-mitigation-rb/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/papers/2025-xz-reproducible-builds&ref=main";
+        access = [
+          "phd"
+          "julien"
+        ];
+      };
+      "posters/2024/ICSE-DS/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/posters/2024-ICSE-DS&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "posters/2025/MSR/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/posters/2025-MSR&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "slides/2023/journee-gdr-gpl/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2023-gdr-gpl-days&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "slides/2024/csi-year-1/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2024-csi-year-1&ref=main";
+        access = [
+          "phd"
+          "julien"
+        ];
+      };
+      "slides/2024/phd-symposium-infres/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2024-phd-symposium-infres&ref=main";
+        access = [
+          "public"
+        ];
+      };
+      "slides/2024/point-etape-mai/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2024-point-etape-main&ref=main";
+        access = [
+          "phd"
+          "julien"
+        ];
+      };
+      "slides/2024/reading-group-build-systems/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2024-reading-group-build-systems&ref=main";
+        access = [
+          "aces"
+        ];
+      };
+      "slides/2024/reading-group-vulnerabilities-ssc/" = {
+        flakeref = "git+ssh://git@gitlab.enst.fr/julien.malka/phd.git?dir=productions/slides/2024-reading-group-vulnerabilities-ssc&ref=main";
+        access = [
+          "aces"
+        ];
+      };
+      "slides/2025/assert-june-workshop/" = {
+        flakeref = "git+ssh://forgejo@git.luj.fr/luj/assert-prez.git?ref=main";
+        access = [
+          "assert"
+          "phd"
+          "julien"
+        ];
+      };
+      "slides/2025/chains-april-workshop/" = {
+        flakeref = "git+ssh://forgejo@git.luj.fr/luj/chains-2025.git?ref=main";
+        access = [
+          "public"
+        ];
+      };
+    };
+  };
+}

machines/gustave/borg.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  users.users.borg = {
+    home = "/home/borg";
+    group = "borg";
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAziNbLEO9D69xUGPGEq3eXYauFuOlvhqQTwpLNKjFqs julien@tower"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMAa0wll9ildhgPiV0DhgJXXtw3TQr5VkNxxxPspHSbX julien@gallifrey"
+    ];
+
+  };
+  users.groups.borg = { };
+
+  environment.systemPackages = with pkgs; [ borgbackup ];
+
+}

machines/gustave/default.nix

@@ -0,0 +1,201 @@
+{
+  pkgs,
+  inputs,
+  profiles,
+  lib,
+  ...
+}:
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./nsd.nix
+    ./borg.nix
+    # Performance is not as good as we expected, wait for pages v3
+    #    ./pages.nix
+    ./readeck.nix
+    ./plausible.nix
+    ./nextcloud.nix
+    ./glance.nix
+    ./syncthing.nix
+    ./artiflakery.nix
+  ];
+
+  users.users.julien.linger = true;
+
+  services.backup.includes = [ "/home/julien/Maildir" ];
+
+  services.openssh.extraConfig = ''
+    HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+    HostKey /etc/ssh/ssh_host_ed25519_key
+    TrustedUserCAKeys /etc/ssh/ssh_user_key.pub
+    MaxAuthTries 20
+  '';
+
+  machine.meta = {
+    arch = "x86_64-linux";
+    nixpkgs_version = inputs.nixpkgs;
+    hm_version = inputs.home-manager;
+    profiles = with profiles; [
+      vm-simple-network
+      server
+      behind-sniproxy
+    ];
+    ips = {
+      public.ipv4 = "82.67.34.230";
+      local.ipv4 = "192.168.0.90";
+      vpn.ipv4 = "100.100.45.24";
+      public.ipv6 = "2a01:e0a:de4:a0e1:eb2:aaaa::45";
+      vpn.ipv6 = "fd7a:115c:a1e0::18";
+    };
+
+  };
+
+  luj.docs = {
+    enable = true;
+    nginx.enable = true;
+    nginx.subdomain = "docs";
+  };
+
+  security.polkit.enable = true;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  programs.fuse.userAllowOther = true;
+
+  deployment.tags = [ "server" ];
+
+  disko = import ./disko.nix;
+
+  nixpkgs.config.permittedInsecurePackages = [
+    "dotnet-sdk-6.0.428"
+    "aspnetcore-runtime-6.0.36"
+  ];
+
+  systemd.network.netdevs = {
+    "20-wg0" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg0";
+        MTUBytes = "1300";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = "/srv/wg-private";
+        ListenPort = 51820;
+      };
+      wireguardPeers = [
+        {
+          PublicKey = "oYsN1Qy+a7dwVOKapN5s5KJOmhSflLHZqh+GLMeNpHw=";
+          AllowedIPs = [ "0.0.0.0/0" ];
+          Endpoint = "[${lib.snowfield.akhaten.ips.public.ipv6}]:51821";
+          PersistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+  systemd.network.networks."30-wg0" = {
+    matchConfig.Name = "wg0";
+    addresses = [
+      {
+        Address = "10.100.45.2/24";
+        AddPrefixRoute = false;
+      }
+    ];
+    routes = [
+      {
+        Gateway = "10.100.45.1";
+        Destination = "10.100.45.0/24";
+      }
+    ];
+    DHCP = "no";
+    networkConfig = {
+      IPv6AcceptRA = false;
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.unstable.forgejo;
+    database.type = "postgres";
+    settings = {
+      server = {
+        ROOT_URL = "https://git.luj.fr/";
+        LANDING_PAGE = "luj";
+      };
+      #openid.ENABLE_OPENID_SIGNIN = true;
+      openid.ENABLE_OPENID_SIGNUP = true;
+      oauth2_client.REGISTER_EMAIL_CONFIRM = false;
+      oauth2_client.ENABLE_AUTO_REGISTRATION = true;
+      oauth2_client.UPDATE_AVATAR = true;
+      oauth2_client.ACCOUNT_LINKING = "auto";
+      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+    };
+  };
+
+  services.openssh.ports = [ 22 ];
+
+  services.nginx.virtualHosts."git.luj.fr" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:3000";
+      proxyWebsockets = true;
+    };
+  };
+
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib"
+      "/var/log"
+      "/srv"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+
+  fileSystems."/srv".neededForBoot = true;
+
+  environment.systemPackages = [ pkgs.tailscale ];
+
+  services.tailscale.enable = true;
+
+  luj.irc = {
+    enable = true;
+    nginx = {
+      enable = true;
+      subdomain = "irc";
+    };
+  };
+
+  luj.homepage.enable = true;
+  luj.mediaserver = {
+    enable = true;
+    tv.enable = true;
+    music.enable = false;
+  };
+  luj.deluge.interface = "wg0";
+
+  networking.firewall.allowedTCPPorts = [ 51820 ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  services.roundcube = {
+    enable = true;
+    plugins = [
+      "managesieve"
+    ];
+    hostName = "webmail.luj.fr";
+    extraConfig = ''
+      # starttls needed for authentication, so the fqdn required to match
+      # the certificate
+      $config['smtp_server'] = "tls://mail.luj.fr";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+      $config['imap_host'] = 'ssl://mail.luj.fr';
+    '';
+  };
+
+  system.stateVersion = "23.11";
+}

machines/gustave/disko.nix

@@ -0,0 +1,79 @@
+{
+  devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sdb";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+            };
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "mainpool";
+              };
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      mainpool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          persistent = {
+            size = "1500G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/persistent";
+              mountOptions = [ "defaults" ];
+            };
+          };
+
+          store = {
+            size = "200G";
+            pool = "mainpool";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/nix";
+            };
+          };
+        };
+      };
+    };
+  };
+}

machines/gustave/glance.nix

@@ -0,0 +1,144 @@
+{ config, ... }:
+{
+  services.glance = {
+    enable = true;
+    settings = {
+      pages = [
+        {
+          center-vertically = true;
+          columns = [
+            {
+              size = "full";
+              widgets = [
+                {
+                  autofocus = true;
+                  type = "search";
+                  search-engine = "google";
+                }
+                {
+                  cache = "1m";
+                  sites = [
+                    {
+                      icon = "si:jellyfin";
+                      title = "Jellyfin";
+                      url = "https://yourdomain.com/";
+                    }
+                    {
+                      icon = "si:gitea";
+                      title = "Gitea";
+                      url = "https://yourdomain.com/";
+                    }
+                    {
+                      icon = "si:qbittorrent";
+                      title = "qBittorrent";
+                      url = "https://yourdomain.com/";
+                    }
+                    {
+                      icon = "si:immich";
+                      title = "Immich";
+                      url = "https://yourdomain.com/";
+                    }
+                    {
+                      icon = "si:adguard";
+                      title = "AdGuard Home";
+                      url = "https://yourdomain.com/";
+                    }
+                    {
+                      icon = "si:vaultwarden";
+                      title = "Vaultwarden";
+                      url = "https://yourdomain.com/";
+                    }
+                  ];
+                  title = "Services";
+                  type = "monitor";
+                }
+                {
+                  type = "lobsters";
+                  sort-by = "hot";
+                  limit = 15;
+                  collapse-after = 5;
+                }
+                {
+                  type = "repository";
+                  repository = "SaumonNet/proxmox-nixos";
+                  pull-requests-limit = 5;
+                  issues-limit = 3;
+                }
+                {
+                  groups = [
+                    {
+                      links = [
+                        {
+                          title = "Gmail";
+                          url = "https://mail.google.com/mail/u/0/";
+                        }
+                        {
+                          title = "Amazon";
+                          url = "https://www.amazon.com/";
+                        }
+                        {
+                          title = "Github";
+                          url = "https://github.com/";
+                        }
+                      ];
+                      title = "General";
+                    }
+                    {
+                      links = [
+                        {
+                          title = "YouTube";
+                          url = "https://www.youtube.com/";
+                        }
+                        {
+                          title = "Prime Video";
+                          url = "https://www.primevideo.com/";
+                        }
+                        {
+                          title = "Disney+";
+                          url = "https://www.disneyplus.com/";
+                        }
+                      ];
+                      title = "Entertainment";
+                    }
+                    {
+                      links = [
+                        {
+                          title = "Reddit";
+                          url = "https://www.reddit.com/";
+                        }
+                        {
+                          title = "Twitter";
+                          url = "https://twitter.com/";
+                        }
+                        {
+                          title = "Instagram";
+                          url = "https://www.instagram.com/";
+                        }
+                      ];
+                      title = "Social";
+                    }
+                  ];
+                  type = "bookmarks";
+                }
+              ];
+            }
+          ];
+          hide-desktop-navigation = true;
+          name = "Startpage";
+          width = "slim";
+        }
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts = {
+    "dashboard.luj" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.glance.settings.server.port}";
+      };
+    };
+  };
+
+}

machines/gustave/hardware.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  modulesPath,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  boot.initrd.postDeviceCommands = ''
+    lvm lvremove --force /dev/mainpool/root || :
+    yes | lvm lvcreate --size 100G --name root mainpool
+    ${pkgs.e2fsprogs}/bin/mkfs.ext4 /dev/mainpool/root
+  '';
+
+  fileSystems."/persistent".neededForBoot = lib.mkForce true;
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/gustave/home-julien.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  luj.hmgr.julien = {
+
+    luj.emails.enable = true;
+    luj.programs.fish.enable = true;
+    systemd.user.startServices = "sd-switch";
+
+    home.persistence."/persistent/home/julien" = {
+      directories = [
+        ".ssh"
+        ".local/share/direnv"
+        ".gnupg"
+        ".local/share/keyrings"
+        "Maildir"
+      ];
+      allowOther = true;
+    };
+
+    home.stateVersion = "23.11";
+    home.packages = [ pkgs.muchsync ];
+  };
+}

machines/gustave/nextcloud.nix

@@ -0,0 +1,91 @@
+{ pkgs, config, ... }:
+
+{
+
+  environment.systemPackages = [ config.services.nextcloud.occ ];
+
+  age.secrets."nextcloud-admin-password" = {
+    file = ../../secrets/nextcloud-admin-password.age;
+    owner = "nextcloud";
+    group = "nextcloud";
+  };
+
+  age.secrets."nextcloud-s3-token" = {
+    file = ../../secrets/nextcloud-s3-token.age;
+    owner = "nextcloud";
+    group = "nextcloud";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    configureRedis = true;
+    database.createLocally = true;
+    package = pkgs.nextcloud31;
+    https = true;
+    hostName = "nuage.luj.fr";
+    autoUpdateApps.enable = true;
+
+    config = {
+      dbtype = "pgsql";
+      adminuser = "admin";
+      adminpassFile = config.age.secrets."nextcloud-admin-password".path;
+      objectstore.s3 = {
+        enable = true;
+        hostname = "s3.luj.fr";
+        usePathStyle = true;
+        port = 443;
+        region = "paris";
+        bucket = "nextcloud-bucket";
+        key = "GK5e980f5f3c7e2780b931ccd0";
+        secretFile = config.age.secrets."nextcloud-s3-token".path;
+        autocreate = false;
+      };
+
+    };
+
+    settings = {
+      overwriteprotocol = "https";
+      overwritehost = "nuage.luj.fr";
+      "overwrite.cli.url" = "https://nuage.luj.fr";
+      updatechecker = false;
+      default_phone_region = "FR";
+      "memories.exiftool" = "${pkgs.exiftool}/bin/exiftool";
+      "memories.vod.ffmpeg" = "${pkgs.ffmpeg-headless}/bin/ffmpeg";
+      "memories.vod.ffprobe" = "${pkgs.ffmpeg-headless}/bin/ffprobe";
+      trusted_proxies = [ "::1" ];
+      allow_local_remote_servers = true;
+      allow_user_to_change_display_name = false;
+      lost_password_link = "disabled";
+
+    };
+
+    poolSettings = {
+      "pm" = "dynamic";
+      "pm.max_children" = "32";
+      "pm.start_servers" = "8";
+      "pm.min_spare_servers" = "2";
+      "pm.max_spare_servers" = "16";
+      "pm.max_requests" = "500";
+    };
+
+    phpOptions = {
+      "opcache.enable_cli" = "1";
+      "opcache.interned_strings_buffer" = "32";
+      "opcache.max_accelerated_files" = "10000";
+      "opcache.memory_consumption" = "256";
+      "opcache.revalidate_freq" = "1";
+      "opcache.fast_shutdown" = "0";
+      "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+    };
+
+  };
+
+  services.nginx.virtualHosts."nuage.luj.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      proxy_max_temp_file_size 4096m;
+    '';
+  };
+
+}

machines/gustave/nsd.nix

@@ -0,0 +1,112 @@
+{
+  config,
+  lib,
+  nixosConfigurations,
+  dnsLib,
+  ...
+}:
+let
+  zonesToList = lib.mapAttrsToList (name: value: { ${name} = value; });
+  zonesFromConfig = lib.mkMerge (
+    lib.fold (elem: acc: acc ++ (zonesToList elem.config.machine.meta.zones)) [ ] (
+      lib.attrValues nixosConfigurations
+    )
+  );
+
+  allowedDomains = [
+    "luj.fr"
+    "julienmalka.me"
+    "malka.family"
+    "luj"
+    "malka.sh"
+    "hownix.works"
+  ];
+
+  isVPNDomain = domain: lib.dns.domainToZone [ "luj" ] domain != null;
+
+  zonesFromSnowField = lib.fold (elem: acc: lib.attrsets.recursiveUpdate acc elem) { } (
+    lib.flatten (
+      map (
+        elem:
+        let
+          domains = if builtins.hasAttr "subdomains" elem then elem.subdomains else [ ];
+        in
+        map (domain: {
+          machine.meta.zones.${lib.dns.domainToZone allowedDomains domain}.subdomains =
+            lib.dns.domainToRecords (lib.dns.getDomainPrefix allowedDomains domain) elem
+              (isVPNDomain domain);
+        }) domains
+
+      ) (lib.attrValues lib.snowfield)
+    )
+  );
+
+  evalZones =
+    zones:
+    (lib.evalModules {
+      modules = [
+        {
+          options = {
+            zones = lib.mkOption {
+              type = lib.types.attrsOf dnsLib.types.zone;
+              description = "DNS zones";
+            };
+          };
+          config = {
+            inherit zones;
+          };
+        }
+      ];
+    }).config.zones;
+
+  stateDir = "/var/lib/nsd";
+
+in
+
+lib.mkMerge [
+  {
+    services.nsd = {
+      enable = true;
+      interfaces = [
+        config.machine.meta.ips.vpn.ipv4
+        config.machine.meta.ips.vpn.ipv6
+        config.machine.meta.ips.public.ipv6
+      ];
+      zones = lib.mapAttrs (_: value: {
+        data = builtins.toString value;
+        provideXFR = [
+          "100.100.45.0/24 NOKEY"
+          "fd7a:115c:a1e0::1/128 NOKEY"
+        ];
+        notify = [
+          "${lib.snowfield.akhaten.ips.vpn.ipv4} NOKEY"
+          "fd7a:115c:a1e0::1 NOKEY"
+        ];
+      }) (evalZones zonesFromConfig);
+    };
+
+    systemd.services.nsd.preStart = lib.mkAfter ''
+      if [ -f ${stateDir}/counter ]; then
+        current_value=$(cat ${stateDir}/counter)
+        new_value=$((current_value + 1))
+        echo "$new_value" > ${stateDir}/counter
+      else
+        echo "0" > ${stateDir}/counter
+        new_value="0"
+      fi
+      for file in ${stateDir}/zones/*; do
+        sed -i "3s/0/$new_value/" "$file"
+      done
+    '';
+
+    networking.firewall.allowedUDPPorts = [ 53 ];
+    networking.firewall.allowedTCPPorts = [ 53 ];
+
+    # Page server disabled for now
+    #machine.meta.zones."luj.fr".TXT = [ "homepage.luj.luj-static.page" ];
+
+  }
+
+  # DNS Records from all non local configurations are exported here
+  zonesFromSnowField
+]

machines/gustave/pages.nix

@@ -0,0 +1,122 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  allowedUpstream = "2a01:e0a:de4:a0e1:4bb5:9275:6010:e9b5/128";
+in
+{
+  age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
+
+  services.codeberg-pages = {
+    enable = true;
+    package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
+      src = pkgs.fetchFromGitea {
+        domain = "codeberg.org";
+        owner = "Codeberg";
+        repo = "pages-server";
+        rev = "044c684a47853af53c660e454328348a49277c9c";
+        hash = "sha256-FZmz4pSSa+d9UGUZuK6ROktsoDtYL8xBl0eRtr/BAD0=";
+      };
+      vendorHash = "sha256-Zs900VVd9jZIoeVFv2SqD97hbTqv2JqroDUz8G3XbY0=";
+      patches = [
+        ./update-lego.patch
+      ];
+    });
+
+    settings = {
+      ACME_ACCEPT_TERMS = "true";
+      ACME_EMAIL = "acme@malka.sh";
+      DNS_PROVIDER = "gandiv5";
+      ENABLE_HTTP_SERVER = "false";
+      GITEA_ROOT = "http://127.0.0.1:3000";
+      PORT = "8010";
+      PAGES_DOMAIN = "luj-static.page";
+      RAW_DOMAIN = "raw.luj-static.page";
+      PAGES_BRANCHES = "pages,main,master";
+      USE_PROXY_PROTOCOL = "true";
+      LOG_LEVEL = "trace";
+    };
+
+    settingsFile = config.age.secrets."pages-settings-file".path;
+  };
+
+  networking.nftables.enable = true;
+
+  # Only requests from the router must be accepted by proxy protocol listeners
+  # in order to prevent ip spoofing.
+  networking.firewall.extraInputRules = ''
+    ip6 saddr ${allowedUpstream} tcp dport 444 accept
+    ip6 saddr ${allowedUpstream} tcp dport 8110 accept
+  '';
+  networking.firewall.allowedTCPPorts = [
+    8010
+  ];
+
+  luj.nginx.enable = true;
+  services.nginx = {
+    appendHttpConfig = ''
+      set_real_ip_from ${allowedUpstream};
+      real_ip_header proxy_protocol;
+    '';
+
+    defaultListen = [
+      # proxy protocol listener with ipv6, which is what is used by the sniproxy
+      {
+        addr = "[::]";
+        port = 444;
+        ssl = true;
+        proxyProtocol = true;
+      }
+      # used for certificate requests with let's encrypt
+      {
+        addr = "[::]";
+        port = 80;
+        ssl = false;
+      }
+      # listener for ipv6 clients in private infra
+      {
+        addr = "[${config.machine.meta.ips.vpn.ipv6}]";
+        port = 443;
+        ssl = true;
+      }
+      # listener for ipv4 client in private infra
+      {
+        addr = config.machine.meta.ips.vpn.ipv4;
+        port = 443;
+        ssl = true;
+      }
+      # used for certificate request with internal CA
+      {
+        addr = "[${config.machine.meta.ips.vpn.ipv6}]";
+        port = 80;
+        ssl = false;
+      }
+    ];
+
+    # Listen to ipv6 packets coming from the internet, check the SNI
+    # If they are one of the declared virtualHosts, forward them to the proxy protocol listener 
+    # for that virtualHost, else forward them to the page server
+    streamConfig = ''
+      map $ssl_preread_server_name $sni_upstream {
+        hostnames;
+        default [::]:8010;
+      ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} [::0]:444;") (
+        lib.filter (e: e != "default") (lib.attrNames config.services.nginx.virtualHosts)
+      )}
+      }
+
+      server {
+        listen [${config.machine.meta.ips.public.ipv6}]:443;
+        ssl_preread on;
+        proxy_pass $sni_upstream;
+        proxy_protocol on;
+      }
+
+    '';
+
+  };
+
+}

machines/gustave/plausible.nix

@@ -0,0 +1,27 @@
+{ config, ... }:
+
+{
+  services.plausible = {
+    enable = true;
+    server = {
+      baseUrl = "https://probable.luj.fr";
+      port = 8455;
+      secretKeybaseFile = config.age.secrets.plausible-secret-key-base.path;
+    };
+  };
+
+  services.nginx.virtualHosts = {
+    "probable.luj.fr" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.plausible.server.port}";
+      };
+    };
+  };
+
+  age.secrets = {
+    plausible-admin-password.file = ../../secrets/plausible-password.age;
+    plausible-secret-key-base.file = ../../secrets/plausible-keybase-secret.age;
+  };
+}

machines/gustave/readeck.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+{
+
+  age.secrets."readeck-config".file = ../../secrets/readeck-config.age;
+
+  services.nginx.virtualHosts."read.luj" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:8000";
+    };
+  };
+
+  services.readeck = {
+    enable = true;
+    environmentFile = config.age.secrets."readeck-config".path;
+  };
+}

machines/gustave/syncthing.nix

@@ -0,0 +1,51 @@
+{ config, ... }:
+{
+  services.syncthing = {
+    enable = true;
+    user = "julien";
+    group = "users";
+    overrideDevices = true;
+    overrideFolders = true;
+
+    settings.options = {
+      urAccepted = -1;
+      listenAddresses = [ "tcp://${config.machine.meta.ips.vpn.ipv4}" ];
+    };
+
+    devices = {
+      "fischer" = {
+        id = "PLIMD3Z-L4DYKDB-MY4PFTS-3RMQUNF-GFWFOBB-SELW6MB-WIQJ2LM-QAC45QQ";
+        addresses = [
+          "tcp://fischer.luj:22000"
+        ];
+      };
+      "gallifrey" = {
+        id = "P3BTFAX-4MCSFQB-C5R5YBP-YGMJ6FU-OKJN4QG-MJ2BV6Y-YB4U7VL-3GFSTAM";
+        addresses = [
+          "tcp://gallifrey.luj:22000"
+        ];
+      };
+    };
+    folders = {
+      "dev" = {
+        path = "/home/julien/dev";
+        devices = [
+          "fischer"
+          "gallifrey"
+        ];
+      };
+    };
+  };
+
+  systemd.services.syncthing.serviceConfig.StateDirectory = "syncthing";
+  systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
+
+  environment.persistence."/persistent".directories = [
+    {
+      directory = "/home/julien/dev";
+      user = "julien";
+      group = "users";
+    }
+  ];
+
+}

machines/lambda/default.nix

@@ -0,0 +1,72 @@
+{
+  pkgs,
+  inputs,
+  profiles,
+  ...
+}:
+
+{
+  imports = [
+    ./hardware.nix
+    ./home-julien.nix
+    ./uptime-kuma.nix
+  ];
+
+  machine.meta = {
+    arch = "aarch64-linux";
+    nixpkgs_version = inputs.nixpkgs;
+    hm_version = inputs.home-manager;
+    profiles = with profiles; [ server ];
+    ips = {
+      public.ipv4 = "141.145.197.219";
+      vpn.ipv4 = "100.100.45.13";
+      public.ipv6 = "2603:c027:c001:89aa:aad9:34b3:f3c9:924f";
+      vpn.ipv6 = "fd7a:115c:a1e0::d";
+    };
+  };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.useNetworkd = true;
+  systemd.network.networks."10-wan" = {
+    matchConfig.Name = "enp0s3";
+    DHCP = "ipv4";
+    addresses = [ { Address = "2603:c027:c001:89aa:aad9:34b3:f3c9:924f"; } ];
+    linkConfig.RequiredForOnline = "routable";
+  };
+
+  deployment.buildOnTarget = true;
+  deployment.tags = [ "server" ];
+
+  luj.nginx.enable = true;
+
+  services.ntfy-sh = {
+    enable = true;
+    package = pkgs.unstable.ntfy-sh;
+    settings = {
+      listen-http = ":8081";
+      behind-proxy = true;
+      upstream-base-url = "https://ntfy.sh";
+      base-url = "https://notifications.julienmalka.me";
+      auth-file = "/srv/ntfy/user.db";
+      auth-default-access = "deny-all";
+    };
+  };
+
+  services.nginx.virtualHosts."notifications.julienmalka.me" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:8081";
+      proxyWebsockets = true;
+    };
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+  };
+
+  system.stateVersion = "22.11";
+}