feat(gaming): cleaning up gaming related pkgs

feat(update): new kernel, new container versions and temporarily moving to zfs_unstable in waiting for stable to catch up with new kernel
chore(update): flake lock and removing unmaintained pkgs
2025-10-11 16:44:54 +02:00 · 2025-10-11 11:04:15 +02:00 · 2025-10-11 09:40:35 +02:00 · 2025-10-08 20:39:54 +02:00 · 2025-10-07 21:05:43 +02:00 · 2025-10-06 21:00:09 +02:00
28 changed files with 444 additions and 279 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -29,11 +29,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1758874004,
+        "lastModified": 1760083914,
-        "narHash": "sha256-+RUCBtT01Z595NpGc6Tvms+dJ/C/cn1zdjT9+gE6dbU=",
+        "narHash": "sha256-I9IMO9d+z71oeqOz6gOre07tK2Du3vp2FcOW3x4FDXw=",
        "owner": "anyrun-org",
        "repo": "anyrun",
-        "rev": "3c571bc1514c4211d1d6c011a1d482f97efd9c5f",
+        "rev": "3050aa30e25957bbb9e1ac91a44d3979eccadf59",
        "type": "github"
      },
      "original": {
@@ -83,11 +83,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1755946532,
+        "lastModified": 1759499898,
-        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
+        "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
+        "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
        "type": "github"
      },
      "original": {
@@ -153,11 +153,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1759235653,
+        "lastModified": 1760148209,
-        "narHash": "sha256-sKFehUxXCzM6E1LcmnRa/O6HKsRI/TGtciG5ulAJt08=",
+        "narHash": "sha256-ssMUeLk1cmLqzNMW6l9dgGoLtOY9F9dEGplJlWJmNis=",
        "owner": "chaotic-cx",
        "repo": "nyx",
-        "rev": "2bf7f138e42fa8b2133761edab64263505cb83bf",
+        "rev": "b51bb724939dbfa264f08522efffce2bb47b6135",
        "type": "github"
      },
      "original": {
@@ -212,11 +212,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1759301100,
+        "lastModified": 1760164678,
-        "narHash": "sha256-hmiTEoVAqLnn80UkreCNunnRKPucKvcg5T4/CELEtbw=",
+        "narHash": "sha256-yxcfwZCysR6zPaFv7is3/FWd1h0h6kXME0vueSwTBhU=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "0956bc5d1df2ea800010172c6bc4470d9a22cb81",
+        "rev": "2579f163559b902959cc420a6d3bfbd98c46a323",
        "type": "github"
      },
      "original": {
@@ -332,11 +332,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756770412,
+        "lastModified": 1759362264,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
        "type": "github"
      },
      "original": {
@@ -392,11 +392,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756770412,
+        "lastModified": 1759362264,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
        "type": "github"
      },
      "original": {
@@ -491,11 +491,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758108966,
+        "lastModified": 1759523803,
-        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
+        "narHash": "sha256-PTod9NG+i3XbbnBKMl/e5uHDBYpwIWivQ3gOWSEuIEM=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
+        "rev": "cfc9f7bb163ad8542029d303e599c0f7eee09835",
        "type": "github"
      },
      "original": {
@@ -571,11 +571,11 @@
    },
    "hardware": {
      "locked": {
-        "lastModified": 1759261527,
+        "lastModified": 1760106635,
-        "narHash": "sha256-wPd5oGvBBpUEzMF0kWnXge0WITNsITx/aGI9qLHgJ4g=",
+        "narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "e087756cf4abbe1a34f3544c480fc1034d68742f",
+        "rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
        "type": "github"
      },
      "original": {
@@ -590,11 +590,11 @@
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1759201995,
+        "lastModified": 1759850138,
-        "narHash": "sha256-3STv6fITv8Ar/kl0H7vIA7VV0d2gyLh8UL0BOiVacXg=",
+        "narHash": "sha256-fYHIxjTvVIAEDWzenUROuzDPxy1rBCXZNPgh4b1dfgo=",
        "owner": "helix-editor",
        "repo": "helix",
-        "rev": "bfcbef10c513108c7b43317569416c2eefc4ed44",
+        "rev": "5b0563419eeeaf0595c848865c46be4abad246a7",
        "type": "github"
      },
      "original": {
@@ -610,11 +610,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759331616,
+        "lastModified": 1760130406,
-        "narHash": "sha256-LVpodobJvJM5rmfh2sFBHPNX0PYpNbbHzx/gprlKGGg=",
+        "narHash": "sha256-GKMwBaFRw/C1p1VtjDz4DyhyzjKUWyi1K50bh8lgA2E=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "5890176f856dcaf55f3ab56b25d4138657531cbd",
+        "rev": "d305eece827a3fe317a2d70138f53feccaf890a1",
        "type": "github"
      },
      "original": {
@@ -652,11 +652,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759172751,
+        "lastModified": 1760061988,
-        "narHash": "sha256-E8W8sRXfrvkFW26GuuiWq6QfReU7m5+cngwHuRo/3jc=",
+        "narHash": "sha256-CeuMo7fjWm3XaoK+b1PGyaVIlE1GHudoxk9jrJFvfbY=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "12fa8548feefa9a10266ba65152fd1a787cdde8f",
+        "rev": "c7f4214faca2f196c551b767c12a70bfa0614510",
        "type": "github"
      },
      "original": {
@@ -710,11 +710,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758192433,
+        "lastModified": 1759490292,
-        "narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
+        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
+        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
        "type": "github"
      },
      "original": {
@@ -739,11 +739,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1750621377,
+        "lastModified": 1759490292,
-        "narHash": "sha256-8u6b5oAdX0rCuoR8wFenajBRmI+mzbpNig6hSCuWUzE=",
+        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "b3d628d01693fb9bb0a6690cd4e7b80abda04310",
+        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
        "type": "github"
      },
      "original": {
@@ -803,11 +803,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1759318697,
+        "lastModified": 1760143218,
-        "narHash": "sha256-iCL/F+rlgzgBfG4QURfjBrxVBMPsXCzZKHXn1SNBshc=",
+        "narHash": "sha256-OhJPROcRcwBkjOKkXr/f3/7wuSjhAIqr8WfmEUF9Uuo=",
        "owner": "hyprwm",
        "repo": "hyprland",
-        "rev": "e0c96276df75accc853a30186ae5de580b2c725f",
+        "rev": "d599513d4a72d66ac62ffdedc41d6653fa81b39e",
        "type": "github"
      },
      "original": {
@@ -824,11 +824,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759238633,
+        "lastModified": 1759613406,
-        "narHash": "sha256-4/AtRCQKXuU49ozZZouWuC+T7vCjQh9HAz3N8Tt5OZE=",
+        "narHash": "sha256-PzgQJydp+RlKvwDi807pXPlURdIAVqLppZDga3DwPqg=",
        "owner": "hyprwm",
        "repo": "contrib",
-        "rev": "513d71d3f42c05d6a38e215382c5a6ce971bd77d",
+        "rev": "32e1a75b65553daefb419f0906ce19e04815aa3a",
        "type": "github"
      },
      "original": {
@@ -942,11 +942,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1757694755,
+        "lastModified": 1759080228,
-        "narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
+        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
        "owner": "hyprwm",
        "repo": "hyprland-qtutils",
-        "rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
+        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
        "type": "github"
      },
      "original": {
@@ -971,11 +971,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756810301,
+        "lastModified": 1758927902,
-        "narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
+        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
        "owner": "hyprwm",
        "repo": "hyprlang",
-        "rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
+        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
        "type": "github"
      },
      "original": {
@@ -1006,11 +1006,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758124489,
+        "lastModified": 1760023949,
-        "narHash": "sha256-YiVF/8Me3vVKJBEgGpQhn0HF09EWfXZGaWLzAaJBrO4=",
+        "narHash": "sha256-fu0B4duamVdbkPio/czu1XhsPLRXUJpZLDrSk3nih4U=",
        "owner": "hyprwm",
        "repo": "hyprlock",
-        "rev": "7f769fa993cb492982d7bf25676c68ddbcc0268e",
+        "rev": "36ec73f166d9434a3f27c96c575198906f77644a",
        "type": "github"
      },
      "original": {
@@ -1044,11 +1044,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754481642,
+        "lastModified": 1760120448,
-        "narHash": "sha256-e1phd6KwtUsS9C2ShD+fQvfk2Dgr2JQi+rTDQUW15iE=",
+        "narHash": "sha256-l/OxM4q/nLVv47OuS4bG2J7k0m+G7/3AMtvrV64XLb0=",
        "owner": "hyprwm",
        "repo": "hyprpaper",
-        "rev": "bcb1ffa322369c4898347ab5a7399a3d18494c8f",
+        "rev": "1733e0025b194c9bc083f4cd8782c5f151858a58",
        "type": "github"
      },
      "original": {
@@ -1069,11 +1069,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756117388,
+        "lastModified": 1759619523,
-        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
+        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
+        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
        "type": "github"
      },
      "original": {
@@ -1144,11 +1144,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1750371869,
+        "lastModified": 1755184602,
-        "narHash": "sha256-lGk4gLjgZQ/rndUkzmPYcgbHr8gKU5u71vyrjnwfpB4=",
+        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
        "owner": "hyprwm",
        "repo": "hyprwayland-scanner",
-        "rev": "aa38edd6e3e277ae6a97ea83a69261a5c3aab9fd",
+        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
        "type": "github"
      },
      "original": {
@@ -1191,11 +1191,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1757230583,
+        "lastModified": 1759815224,
-        "narHash": "sha256-4uqu7sFPOaVTCogsxaGMgbzZ2vK40GVGMfUmrvK3/LY=",
+        "narHash": "sha256-HbdOyjqHm38j6o5mV24i0bn+r5ykS+VJBnWJuZ0fE+A=",
        "owner": "Jovian-Experiments",
        "repo": "Jovian-NixOS",
-        "rev": "fc3960e6c32c9d4f95fff2ef84444284d24d3bea",
+        "rev": "ee974f496a080c61b3164992c850f43741edcc52",
        "type": "github"
      },
      "original": {
@@ -1229,11 +1229,11 @@
    },
    "mnw": {
      "locked": {
-        "lastModified": 1756659871,
+        "lastModified": 1758834834,
-        "narHash": "sha256-v6Rh4aQ6RKjM2N02kK9Usn0Ix7+OY66vNpeklc1MnGE=",
+        "narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
        "owner": "Gerg-L",
        "repo": "mnw",
-        "rev": "ed6cc3e48557ba18266e598a5ebb6602499ada16",
+        "rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
        "type": "github"
      },
      "original": {
@@ -1278,11 +1278,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759110900,
+        "lastModified": 1760146997,
-        "narHash": "sha256-fcu/r0ijvaYT2VHGkZGr0wq9uBMNFkiftVBy43/2oig=",
+        "narHash": "sha256-x2sF8Q4tWz3DI166s+KFDXySrK+cN+/YEd3DfhnhBLQ=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "2ac6a49266e9159ccb001b4c8cb1f50f67d502ae",
+        "rev": "ad505387568d024654da88fef03d9c5319cba92f",
        "type": "github"
      },
      "original": {
@@ -1363,11 +1363,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1759147044,
+        "lastModified": 1760038930,
-        "narHash": "sha256-3ZPFytJOcLjTChljeaGgoaNj+tOqzgEpqZAvRe3bU90=",
+        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
-        "owner": "PedroHLC",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "18e83bbe13aa50992777832b52bd0e0d8585fb3b",
+        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
        "type": "github"
      },
      "original": {
@@ -1395,11 +1395,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1740560979,
+        "lastModified": 1759381078,
-        "narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "5135c59491985879812717f4c9fea69604e7f26f",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
        "type": "github"
      },
      "original": {
@@ -1411,11 +1411,11 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1758198701,
+        "lastModified": 1759381078,
-        "narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
        "type": "github"
      },
      "original": {
@@ -1443,11 +1443,11 @@
    },
    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1759036355,
+        "lastModified": 1760038930,
-        "narHash": "sha256-0m27AKv6ka+q270dw48KflE0LwQYrO7Fm4/2//KCVWg=",
+        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e9f00bd893984bc8ce46c895c3bf7cac95331127",
+        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
        "type": "github"
      },
      "original": {
@@ -1459,11 +1459,11 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1756696532,
+        "lastModified": 1759386674,
-        "narHash": "sha256-6FWagzm0b7I/IGigOv9pr6LL7NQ86mextfE8g8Q6HBg=",
+        "narHash": "sha256-wg1Lz/1FC5Q13R+mM5a2oTV9TA9L/CHHTm3/PiLayfA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "58dcbf1ec551914c3756c267b8b9c8c86baa1b2f",
+        "rev": "625ad6366178f03acd79f9e3822606dd7985b657",
        "type": "github"
      },
      "original": {
@@ -1482,11 +1482,11 @@
        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1758271661,
+        "lastModified": 1760153667,
-        "narHash": "sha256-ENqd2/33uP5vB44ClDjjAV+J78oF8q1er4QUZuT8Z7g=",
+        "narHash": "sha256-F7KmXT/Izse6Q6CkD5GCImoGPaDJxl03Kd7eD+eY/bU=",
        "owner": "notashelf",
        "repo": "nvf",
-        "rev": "b7571df4d6e9ac08506a738ddceeec0b141751b0",
+        "rev": "9df9d51fd9fc8f9a8fc377f984ea3b7ae796172d",
        "type": "github"
      },
      "original": {
@@ -1626,11 +1626,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1759245522,
+        "lastModified": 1760090851,
-        "narHash": "sha256-H4Hx/EuMJ9qi1WzPV4UG2bbZiDCdREtrtDvYcHr0kmk=",
+        "narHash": "sha256-XGkBjf4Dzg6tXd0KGgKzeW4oVX/iLzLhD3rQ1cATpqM=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "a6bc4a4bbe6a65b71cbf76a0cf528c47a8d9f97f",
+        "rev": "b93180b4f2cb3c81ac7f17f46e3dfcb30ecc7843",
        "type": "github"
      },
      "original": {
@@ -1648,11 +1648,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759113356,
+        "lastModified": 1760063676,
-        "narHash": "sha256-xm4kEUcV2jk6u15aHazFP4YsMwhq+PczA+Ul/4FDKWI=",
+        "narHash": "sha256-s5Fjh43skH2L+avOGioLmEHoYZffDbg3abV5h0gjeew=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "be3b8843a2be2411500f6c052876119485e957a2",
+        "rev": "897deed0923cc5a1d560c5176abe0d172ec9716d",
        "type": "github"
      },
      "original": {
@@ -1669,11 +1669,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1740623427,
+        "lastModified": 1759631821,
-        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
+        "narHash": "sha256-V8A1L0FaU/aSXZ1QNJScxC12uP4hANeRBgI4YdhHeRM=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
+        "rev": "1d7cbdaad90f8a5255a89a6eddd8af24dc89cafe",
        "type": "github"
      },
      "original": {
@@ -1815,11 +1815,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758728421,
+        "lastModified": 1760120816,
-        "narHash": "sha256-ySNJ008muQAds2JemiyrWYbwbG+V7S5wg3ZVKGHSFu8=",
+        "narHash": "sha256-gq9rdocpmRZCwLS5vsHozwB6b5nrOBDNc2kkEaTXHfg=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "5eda4ee8121f97b218f7cc73f5172098d458f1d1",
+        "rev": "761ae7aff00907b607125b2f57338b74177697ed",
        "type": "github"
      },
      "original": {
@@ -1923,11 +1923,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759180079,
+        "lastModified": 1759969704,
-        "narHash": "sha256-5hqTGqAKcLEumY3tqOtHK17CA6RkzS1I0EGKfuoyb58=",
+        "narHash": "sha256-T7f/invcFIKHrBqD+FLf/C/HOGmpYfbZUzTDxFscpOA=",
        "ref": "refs/heads/main",
-        "rev": "d4a254b38c7ac2b99931220d767610adfa3a57fe",
+        "rev": "1173c777dc8daddcc4959260a7b00fd8abc884c5",
-        "revCount": 135,
+        "revCount": 137,
        "type": "git",
        "url": "https://git.sr.ht/~canasta/zen-browser-flake"
      },
--- a/hosts/kima/modules.nix
+++ b/hosts/kima/modules.nix
@@ -29,6 +29,13 @@
      };
      network = {
        enable = true;
        nameservers = [
          "192.168.88.1"
          "192.168.88.69"
        ];
        search = [
          "taila7448a.ts.net"
        ];
        interfaces = {
          "eno1" = {
            allowedTCPPorts = [
@@ -66,7 +73,7 @@
        };
      };
      gamescope = {
-        enable = true;
+        enable = false;
      };
      gimp = {
        enable = true;
--- a/hosts/sobotka/default.nix
+++ b/hosts/sobotka/default.nix
@@ -68,7 +68,10 @@ in {
  boot = {
    supportedFilesystems = ["zfs"];
-    zfs.extraPools = ["data"];
+    zfs = {
      package = pkgs.zfs_unstable;
      extraPools = ["data"];
    };
  };
  services.zfs = {
--- a/hosts/sobotka/modules.nix
+++ b/hosts/sobotka/modules.nix
@@ -109,7 +109,7 @@
          enable = true;
        };
        dev = {
-          enable = false;
+          enable = true;
        };
      };
      mysql-workbench = {
--- a/hosts/sobotka/server.nix
+++ b/hosts/sobotka/server.nix
@@ -11,7 +11,7 @@
    traefik = {
      enable = true;
    };
-    gitea = {
+    tailscale = {
      enable = true;
    };
    unbound = {
@@ -47,6 +47,14 @@
    uptime-kuma = {
      enable = true;
    };
    gitea = {
      enable = true;
      url = "git.cnst.dev";
      cloudflared = {
        tunnelId = "33e2fb8e-ecef-4d42-b845-6d15e216e448";
        credentialsFile = config.age.secrets.giteaCloudflared.path;
      };
    };
    vaultwarden = {
      enable = true;
      url = "vault.cnst.dev";
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -144,6 +144,7 @@
        ./server/traefik
        ./server/www
        ./server/authentik
        ./server/tailscale
      ];
    };
    settings = {
--- a/modules/home/programs/pkgs/default.nix
+++ b/modules/home/programs/pkgs/default.nix
@@ -88,7 +88,7 @@ in
          hyprpicker
          libnotify
          pamixer
-          oculante
+          loupe
          adwaita-icon-theme
          qt5.qtwayland
          qt6.qtwayland
--- a/modules/home/services/xdg/default.nix
+++ b/modules/home/services/xdg/default.nix
@@ -84,15 +84,15 @@ in
          "application/pdf" = "org.pwmt.zathura-pdf-mupdf.desktop";
          "inode/directory" = "thunar.desktop";
-          "image/apng" = "oculante.desktop";
+          "image/apng" = "feh.desktop";
-          "image/avif" = "oculante.desktop";
+          "image/avif" = "feh.desktop";
-          "image/bmp" = "oculante.desktop";
+          "image/bmp" = "feh.desktop";
-          "image/gif" = "oculante.desktop";
+          "image/gif" = "feh.desktop";
-          "image/jpeg" = "oculante.desktop";
+          "image/jpeg" = "feh.desktop";
-          "image/png" = "oculante.desktop";
+          "image/png" = "feh.desktop";
-          "image/svg+xml" = "oculante.desktop";
+          "image/svg+xml" = "feh.desktop";
-          "image/tiff" = "oculante.desktop";
+          "image/tiff" = "feh.desktop";
-          "image/webp" = "oculante.desktop";
+          "image/webp" = "feh.desktop";
          "video/H264" = [
            "mpv.desktop"
--- a/modules/nixos/hardware/network/default.nix
+++ b/modules/nixos/hardware/network/default.nix
@@ -2,38 +2,47 @@
  config,
  lib,
  ...
-}:
+}: let
-let
+  inherit
-  inherit (lib)
+    (lib)
    mkIf
    mkEnableOption
    mkOption
    types
    ;
  cfg = config.nixos.hardware.network;
-in
+in {
 {
  options = {
    nixos.hardware.network = {
      enable = mkEnableOption "Enable the custom networking module";
      nameservers = mkOption {
        type = types.listOf types.str;
        default = [];
        description = "The list of nameservers ";
      };
      search = mkOption {
        type = types.listOf types.str;
        default = [];
        description = "Domain search paths";
      };
      interfaces = mkOption {
        type = types.attrsOf (
          types.submodule {
            options = {
              allowedTCPPorts = mkOption {
                type = types.listOf types.int;
-                default = [ ];
+                default = [];
                description = "List of allowed TCP ports for this interface.";
              };
              allowedUDPPorts = mkOption {
                type = types.listOf types.int;
-                default = [ ];
+                default = [];
                description = "List of allowed UDP ports for this interface.";
              };
            };
          }
        );
-        default = { };
+        default = {};
        description = "Network interface configurations.";
      };
      extraHosts = mkOption {
@@ -47,7 +56,7 @@ in
  config = mkIf cfg.enable {
    assertions = [
      {
-        assertion = cfg.interfaces != { } -> config.networking.networkmanager.enable;
+        assertion = cfg.interfaces != {} -> config.networking.networkmanager.enable;
        message = "Network interfaces configured but NetworkManager is not enabled";
      }
    ];
@@ -55,6 +64,8 @@ in
    networking = {
      networkmanager.enable = true;
      nftables.enable = true;
      nameservers = cfg.nameservers;
      search = cfg.search;
      firewall = {
        enable = true;
        inherit (cfg) interfaces;
@@ -63,8 +74,8 @@ in
    };
    systemd.services.NetworkManager = {
-      wants = [ "nftables.service" ];
+      wants = ["nftables.service"];
-      after = [ "nftables.service" ];
+      after = ["nftables.service"];
    };
  };
 }
--- a/modules/nixos/programs/pkgs/default.nix
+++ b/modules/nixos/programs/pkgs/default.nix
@@ -78,6 +78,7 @@ in
          openssl
          xmrig
          ocl-icd
          dig
        ]
        (mkIf cfg.common.enable [
@@ -96,9 +97,6 @@ in
        ])
        (mkIf cfg.desktop.enable [
          protonup
          winetricks
          wine
          geekbench
          unigine-heaven
        ])
@@ -109,15 +107,13 @@ in
        (mkIf cfg.server.enable [
          nvtopPackages.intel
          nvtopPackages.amd
          dig
          helix
          zfs
          zfstools
        ])
        (mkIf cfg.dev.enable [
          # lldb_20 # some biuld error atm
          sqlite
          gemini-cli
          nfs-utils
          gcc
@@ -144,7 +140,6 @@ in
          prettierd
          # php84Packages.php-cs-fixer
          shfmt
          luaformatter
          black
        ])
      ];
--- a/modules/nixos/programs/steam/default.nix
+++ b/modules/nixos/programs/steam/default.nix
@@ -1,6 +1,7 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 let
@@ -17,6 +18,20 @@ in
        enable = true;
        gamescopeSession.enable = true;
      };
      gamescope = {
        enable = true;
        capSysNice = true;
        args = [
          "--rt"
          "--expose-wayland"
        ];
      };
    };
    environment.systemPackages = with pkgs; [
      protonup
      wine
      winetricks
      wine-wayland
    ];
  };
 }
--- a/modules/nixos/system/devpkgs/default.nix
+++ b/modules/nixos/system/devpkgs/default.nix
@@ -45,7 +45,6 @@ in
      # nodePackages_latest.sql-formatter
      prettierd
      shfmt
      luaformatter
      black
    ];
  };
--- a/modules/server/authentik/default.nix
+++ b/modules/server/authentik/default.nix
@@ -53,15 +53,9 @@ in {
    age.secrets = {
      authentikEnv = {
        file = "${self}/secrets/authentikEnv.age";
        owner = "authentik";
        group = "authentik";
        mode = "0400";
      };
      authentikCloudflared = {
        file = "${self}/secrets/authentikCloudflared.age";
        owner = "authentik";
        group = "authentik";
        mode = "0400";
      };
    };
@@ -70,7 +64,7 @@ in {
        jails = {
          authentik = {
            serviceName = "authentik";
-            failRegex = "^.*Username or password is incorrect.*IP:\s*<HOST>";
+            failRegex = ''^.*Username or password is incorrect.*IP:\s*<HOST>'';
          };
        };
      };
@@ -103,7 +97,6 @@ in {
            middlewares = {
              authentik = {
                forwardAuth = {
                  # tls.insecureSkipVerify = true;
                  address = "https://localhost:9443/outpost.goauthentik.io/auth/traefik";
                  trustForwardHeader = true;
                  authResponseHeaders = [
@@ -134,7 +127,7 @@ in {
            routers = {
              auth = {
                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.url}`) || HostRegexp(`{subdomain:[a-z0-9]+}.${srv.www.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
+                rule = "Host(`${cfg.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
                service = "auth";
                tls.certResolver = "letsencrypt";
              };
--- a/modules/server/fail2ban/default.nix
+++ b/modules/server/fail2ban/default.nix
@@ -30,14 +30,28 @@ in {
              example = "vaultwarden";
              type = lib.types.str;
            };
            _groupsre = lib.mkOption {
              type = lib.types.lines;
              example = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
              default = "";
            };
            failRegex = lib.mkOption {
-              type = lib.types.str;
+              type = lib.types.lines;
-              example = "Login failed from IP: <HOST>";
+              example = ''
                ^Login failed from IP: <HOST>$
                ^Two-factor challenge failed from <HOST>$
              '';
            };
            ignoreRegex = lib.mkOption {
              type = lib.types.str;
              default = "";
            };
            datePattern = lib.mkOption {
              type = lib.types.str;
              default = "";
              example = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
              description = "Optional datepattern line for the fail2ban filter.";
            };
            maxRetry = lib.mkOption {
              type = lib.types.int;
              default = 3;
@@ -75,11 +89,18 @@ in {
    environment.etc = lib.attrsets.mergeAttrsList [
      (lib.attrsets.mapAttrs' (
          name: value: (lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
-            text = ''
+            text =
-              [Definition]
+              ''
-              failregex = ${value.failRegex}
+                [Definition]
-              ignoreregex = ${value.ignoreRegex}
+                failregex = ${value.failRegex}
-            '';
+                ignoreregex = ${value.ignoreRegex}
              ''
              + lib.optionalString (value.datePattern != "") ''
                datepattern = ${value.datePattern}
              ''
              + lib.optionalString (value._groupsre != "") ''
                _groupsre = ${value._groupsre}
              '';
          })
        )
        cfg.jails)
--- a/modules/server/gitea/default.nix
+++ b/modules/server/gitea/default.nix
@@ -1,7 +1,8 @@
-# taken from @jtojnar
+# "inspired" by @jtojnar <3
 {
  config,
  lib,
  self,
  ...
 }: let
  unit = "gitea";
@@ -21,6 +22,20 @@ in {
      default = 5003;
      description = "The port to host Gitea on.";
    };
    cloudflared = {
      credentialsFile = lib.mkOption {
        type = lib.types.str;
        example = lib.literalExpression ''
          pkgs.writeText "cloudflare-credentials.json" '''
          {"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
          '''
        '';
      };
      tunnelId = lib.mkOption {
        type = lib.types.str;
        example = "00000000-0000-0000-0000-000000000000";
      };
    };
    homepage.name = lib.mkOption {
      type = lib.types.str;
      default = "Gitea";
@@ -39,62 +54,92 @@ in {
    };
  };
  config = lib.mkIf cfg.enable {
-    services.${unit} = {
+    age.secrets = {
-      enable = true;
+      giteaCloudflared.file = "${self}/secrets/giteaCloudflared.age";
-      appName = "cnix code forge";
+    };
-      database = {
+    server = {
-        type = "postgres";
+      fail2ban = lib.mkIf config.server.fail2ban.enable {
-        socket = "/run/postgresql";
+        jails = {
-        name = "gitea";
+          gitea = {
-        user = "gitea";
+            serviceName = "gitea";
-        createDatabase = false;
+            failRegex = ''.*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>'';
          };
        };
      };
    };
-      lfs = {
+    services = {
      cloudflared = {
        enable = true;
        tunnels.${cfg.cloudflared.tunnelId} = {
          credentialsFile = cfg.cloudflared.credentialsFile;
          default = "http_status:404";
          ingress."${cfg.url}".service = "http://localhost:${toString cfg.port}";
        };
      };
-      settings = {
+      ${unit} = {
-        cors = {
+        enable = true;
-          ENABLED = true;
+        appName = "cnix code forge";
-          SCHEME = "https";
+
-          ALLOW_DOMAIN = cfg.url;
+        database = {
          type = "postgres";
          socket = "/run/postgresql";
          name = "gitea";
          user = "gitea";
          createDatabase = false;
        };
-        log = {
+
-          MODE = "console";
+        lfs = {
          enable = true;
        };
-        mailer = {
+
-          ENABLED = false;
+        settings = {
-          MAILER_TYPE = "sendmail";
+          cors = {
-          FROM = "noreply+adam@cnst.dev";
+            ENABLED = true;
-          SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
+            SCHEME = "https";
-        };
+            ALLOW_DOMAIN = cfg.url;
-        picture = {
+          };
-          DISABLE_GRAVATAR = true;
+          log = {
-        };
+            MODE = "console";
-        repository = {
+          };
-          DEFAULT_BRANCH = "main";
+          mailer = {
-          DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
+            ENABLED = false;
-          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
+            MAILER_TYPE = "sendmail";
-        };
+            FROM = "noreply+adam@cnst.dev";
-        indexer = {
+            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
-          REPO_INDEXER_ENABLED = true;
+          };
-        };
+          picture = {
-        server = {
+            DISABLE_GRAVATAR = true;
-          DOMAIN = cfg.url;
+          };
-          LANDING_PAGE = "explore";
+          repository = {
-          HTTP_PORT = cfg.port;
+            DEFAULT_BRANCH = "main";
-          ROOT_URL = "https://${cfg.url}/";
+            DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
-        };
+            DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
-        security = {
+          };
-          DISABLE_GIT_HOOKS = false;
+          indexer = {
-        };
+            REPO_INDEXER_ENABLED = true;
-        service = {
+          };
-          DISABLE_REGISTRATION = true;
+          oauth2_client = {
-        };
+            ENABLE_AUTO_REGISTRATION = true;
-        session = {
+            ACCOUNT_LINKING = "auto";
-          COOKIE_SECURE = true;
+          };
          server = {
            DOMAIN = cfg.url;
            LANDING_PAGE = "explore";
            HTTP_PORT = cfg.port;
            ROOT_URL = "https://${cfg.url}/";
          };
          security = {
            DISABLE_GIT_HOOKS = false;
          };
          service = {
            DISABLE_REGISTRATION = true;
          };
          session = {
            COOKIE_SECURE = true;
          };
        };
      };
    };
--- a/modules/server/homepage-dashboard/default.nix
+++ b/modules/server/homepage-dashboard/default.nix
@@ -101,7 +101,7 @@ in {
              label = "SYSTEM";
              memory = true;
              cpu = true;
-              uptime = true;
+              uptime = false;
            };
          }
        ];
--- a/modules/server/jellyfin/default.nix
+++ b/modules/server/jellyfin/default.nix
@@ -4,21 +4,21 @@
  pkgs,
  ...
 }: let
-  service = "jellyfin";
+  unit = "jellyfin";
-  cfg = config.server.${service};
+  cfg = config.server.${unit};
  srv = config.server;
 in {
-  options.server.${service} = {
+  options.server.${unit} = {
    enable = lib.mkEnableOption {
-      description = "Enable ${service}";
+      description = "Enable ${unit}";
    };
    configDir = lib.mkOption {
      type = lib.types.str;
-      default = "/var/lib/${service}";
+      default = "/var/lib/${unit}";
    };
    url = lib.mkOption {
      type = lib.types.str;
-      default = "jellyfin.${srv.domain}";
+      default = "fin.${srv.tailscale.url}";
    };
    homepage.name = lib.mkOption {
      type = lib.types.str;
@@ -38,7 +38,7 @@ in {
    };
  };
  config = lib.mkIf cfg.enable {
-    services.${service} = {
+    services.${unit} = {
      enable = true;
      user = srv.user;
      group = srv.group;
@@ -49,14 +49,13 @@ in {
    services.traefik = {
      dynamicConfigOptions = {
        http = {
-          services.jellyfin.loadBalancer.servers = [{url = "http://127.0.0.1:8096";}];
+          services.${unit}.loadBalancer.servers = [{url = "http://localhost:8096";}];
          routers = {
-            jellyfin = {
+            jellyfinRouter = {
              entryPoints = ["websecure"];
              rule = "Host(`${cfg.url}`)";
-              service = "jellyfin";
+              service = "${unit}";
              tls.certResolver = "letsencrypt";
              # middlewares = ["authentik"];
            };
          };
        };
--- a/modules/server/jellyseerr/default.nix
+++ b/modules/server/jellyseerr/default.nix
@@ -3,17 +3,18 @@
  lib,
  ...
 }: let
-  service = "jellyseerr";
+  unit = "jellyseerr";
  srv = config.server;
-  cfg = config.server.${service};
+  cfg = config.server.${unit};
 in {
-  options.server.${service} = {
+  options.server.${unit} = {
    enable = lib.mkEnableOption {
-      description = "Enable ${service}";
+      description = "Enable ${unit}";
    };
    url = lib.mkOption {
      type = lib.types.str;
-      default = "${service}.${srv.domain}";
+      # default = "seer.${srv.tailscale.url}";
      default = "jellyseerr.${srv.domain}";
    };
    port = lib.mkOption {
      type = lib.types.port;
@@ -37,21 +38,20 @@ in {
    };
  };
  config = lib.mkIf cfg.enable {
-    services.${service} = {
+    services.${unit} = {
      enable = true;
      port = cfg.port;
    };
    services.traefik = {
      dynamicConfigOptions = {
        http = {
-          services.jellyseerr.loadBalancer.servers = [{url = "http://127.0.0.1:${toString cfg.port}";}];
+          services.jellyseerr.loadBalancer.servers = [{url = "http://localhost:${toString cfg.port}";}];
          routers = {
            jellyseerr = {
              entryPoints = ["websecure"];
              rule = "Host(`${cfg.url}`)";
-              service = "jellyseerr";
+              service = "${unit}";
              tls.certResolver = "letsencrypt";
              # middlewares = ["authentik"];
            };
          };
        };
--- a/modules/server/nextcloud/default.nix
+++ b/modules/server/nextcloud/default.nix
@@ -54,8 +54,14 @@ in {
    server.fail2ban = lib.mkIf config.server.fail2ban.enable {
      jails = {
        nextcloud = {
-          serviceName = "phpfpm-nextcloud";
+          serviceName = "${unit}";
-          failRegex = "^.*Login failed:.*(Remote IP: <HOST>).*$";
+          _groupsre = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
          failRegex = ''
            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
                        ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
                        ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
          '';
          datePattern = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
        };
      };
    };
@@ -63,7 +69,7 @@ in {
    services = {
      ${unit} = {
        enable = true;
-        package = pkgs.nextcloud31;
+        package = pkgs.nextcloud32;
        hostName = "nextcloud";
        configureRedis = true;
        caching = {
--- a/modules/server/podman/default.nix
+++ b/modules/server/podman/default.nix
@@ -143,61 +143,63 @@ in {
      ];
    };
-    services.traefik = lib.mkMerge [
+    services = {
-      (lib.mkIf cfg.pihole.enable {
+      traefik = lib.mkMerge [
-        dynamicConfigOptions = {
+        (lib.mkIf cfg.pihole.enable {
-          http = {
+          dynamicConfigOptions = {
-            services = {
+            http = {
-              pihole.loadBalancer.servers = [{url = "http://localhost:${toString cfg.pihole.port}";}];
+              services = {
-            };
+                pihole.loadBalancer.servers = [{url = "http://localhost:${toString cfg.pihole.port}";}];
-            routers = {
+              };
-              pihole = {
+              routers = {
-                entryPoints = ["websecure"];
+                pihole = {
-                rule = "Host(`${cfg.pihole.url}`)";
+                  entryPoints = ["websecure"];
-                service = "pihole";
+                  rule = "Host(`${cfg.pihole.url}`)";
-                tls.certResolver = "letsencrypt";
+                  service = "pihole";
                  tls.certResolver = "letsencrypt";
                };
              };
            };
          };
-        };
+        })
      })
-      (lib.mkIf cfg.qbittorrent.enable {
+        (lib.mkIf cfg.qbittorrent.enable {
-        dynamicConfigOptions = {
+          dynamicConfigOptions = {
-          http = {
+            http = {
-            services = {
+              services = {
-              qbittorrent.loadBalancer.servers = [{url = "http://localhost:${toString cfg.qbittorrent.port}";}];
+                qbittorrent.loadBalancer.servers = [{url = "http://localhost:${toString cfg.qbittorrent.port}";}];
-            };
+              };
-            routers = {
+              routers = {
-              qbittorrent = {
+                qbittorrent = {
-                entryPoints = ["websecure"];
+                  entryPoints = ["websecure"];
-                rule = "Host(`${cfg.qbittorrent.url}`)";
+                  rule = "Host(`${cfg.qbittorrent.url}`)";
-                service = "qbittorrent";
+                  service = "qbittorrent";
-                tls.certResolver = "letsencrypt";
+                  tls.certResolver = "letsencrypt";
                };
              };
            };
          };
-        };
+        })
      })
-      (lib.mkIf cfg.slskd.enable {
+        (lib.mkIf cfg.slskd.enable {
-        dynamicConfigOptions = {
+          dynamicConfigOptions = {
-          http = {
+            http = {
-            services = {
+              services = {
-              slskd.loadBalancer.servers = [{url = "http://localhost:${toString cfg.slskd.port}";}];
+                slskd.loadBalancer.servers = [{url = "http://localhost:${toString cfg.slskd.port}";}];
-            };
+              };
-            routers = {
+              routers = {
-              slskd = {
+                slskd = {
-                entryPoints = ["websecure"];
+                  entryPoints = ["websecure"];
-                rule = "Host(`${cfg.slskd.url}`)";
+                  rule = "Host(`${cfg.slskd.url}`)";
-                service = "slskd";
+                  service = "slskd";
-                tls.certResolver = "letsencrypt";
+                  tls.certResolver = "letsencrypt";
                };
              };
            };
          };
-        };
+        })
-      })
+      ];
-    ];
+    };
    virtualisation.oci-containers.containers = lib.mkMerge [
      (lib.mkIf cfg.gluetun.enable {
@@ -293,7 +295,7 @@ in {
      (lib.mkIf cfg.pihole.enable {
        pihole = {
          autoStart = true;
-          image = "pihole/pihole:latest";
+          image = "pihole/pihole:2025.08.0";
          volumes = [
            "/var/lib/pihole:/etc/pihole/"
            "/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
--- a/modules/server/tailscale/default.nix
+++ b/modules/server/tailscale/default.nix
@@ -0,0 +1,31 @@
 {
  config,
  lib,
  self,
  ...
 }:
 with lib; let
  cfg = config.server.tailscale;
 in {
  options.server.tailscale = {
    enable = mkEnableOption "Enable tailscale server configuration";
    url = lib.mkOption {
      type = lib.types.str;
      default = "ts.cnst.dev";
    };
  };
  config = mkIf cfg.enable {
    age.secrets.sobotkaTsAuth.file = "${self}/secrets/sobotkaTsAuth.age";
    services.tailscale = {
      enable = true;
      openFirewall = true;
      useRoutingFeatures = "server";
      authKeyFile = config.age.secrets.sobotkaTsAuth.path;
      extraSetFlags = [
        "--advertise-exit-node"
      ];
    };
  };
 }
--- a/modules/server/traefik/default.nix
+++ b/modules/server/traefik/default.nix
@@ -23,7 +23,7 @@ in {
    age.secrets.traefikEnv = {
      file = "${self}/secrets/traefikEnv.age";
      mode = "640";
-      owner = "root";
+      owner = "traefik";
      group = "traefik";
    };
@@ -49,7 +49,7 @@ in {
            dashboard = true;
          };
          certificatesResolvers = {
-            tailscale.tailscale = {};
+            vpn.tailscale = {};
            letsencrypt = {
              acme = {
                email = "adam@cnst.dev";
@@ -89,6 +89,10 @@ in {
                    main = "cnix.dev";
                    sans = ["*.cnix.dev"];
                  }
                  {
                    main = "ts.cnst.dev";
                    sans = ["*ts.cnst.dev"];
                  }
                ];
              };
            };
--- a/modules/server/vaultwarden/default.nix
+++ b/modules/server/vaultwarden/default.nix
@@ -44,7 +44,7 @@ in {
        jails = {
          vaultwarden = {
            serviceName = "vaultwarden";
-            failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
+            failRegex = ''^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$'';
          };
        };
      };
@@ -72,7 +72,7 @@ in {
          logLevel = "warn";
          extendedLogging = true;
          useSyslog = true;
-          invitationsAllowed = false;
+          invitationsAllowed = true;
          showPasswordHint = false;
        };
      };
--- a/modules/server/www/default.nix
+++ b/modules/server/www/default.nix
@@ -47,7 +47,7 @@ in {
          nginx-404 = {
            serviceName = "nginx";
            failRegex = ''^.*\[error\].*directory index of.* is forbidden.*client: <HOST>.*$'';
-            ignoreRegex = "";
+            ignoreRegex = '''';
            maxRetry = 5;
          };
        };
--- a/secrets/giteaCloudflared.age
+++ b/secrets/giteaCloudflared.age
@@ -0,0 +1,12 @@
 age-encryption.org/v1
 -> ssh-ed25519 t9iOEg RnlIwFO8LSwzj94G0Uru9qibXqOOpCU2kWWdNa2tRFU
 lIC3K/jjBMKRfLfepoNYIkBe5rhHuR0l3Uf1Xuk8uZg
 -> ssh-ed25519 KUYMFA k16GBRcaaSwJm/8+Vm2QBOu05u6eEro/7YYj7kbuNSU
 VCpt918MBBFfFZKKypV9pSwz/Zhsxr+Ob6YjFuJ/oL0
 -> ssh-ed25519 76RhUQ FIKn3nuOT1ywu6pmYBbpC54HhpJGeMFejp5c0XibfAY
 WDsh/5G4wXYt21yIDxmI6u1l/xPOdZRxgTazf6QLXP8
 -> ssh-ed25519 Jf8sqw 2EvD96Ec8h97ACoOBYzn1Ugx4ZyYSHIRnsmtB5lb/XQ
 mFY8O8qwWWihsLe5ayB5iGm1JUY2B/9el/XSf5sPe7M
 --- uuwibRk7LS4/lUx9gwL+x5NMrxLjGM1Yf55bzjxQTKM
 <EFBFBD>H<>Ԅ6K<36>A<01>~<7E><>)!B<08><>^S!Wd<><64>$.:S'c<>d<EFBFBD><64><EFBFBD>_WW<57>Bj<42>,<2C><>l<EFBFBD><6C><EFBFBD><EFBFBD><EFBFBD>V<>S<EFBFBD><53>h<EFBFBD>
 h<EFBFBD><EFBFBD><12><>k
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -48,6 +48,7 @@ in {
  "homepageEnvironment.age".publicKeys = kima ++ sobotka;
  "cloudflareFirewallApiKey.age".publicKeys = kima ++ sobotka;
  "vaultwardenCloudflared.age".publicKeys = kima ++ sobotka;
  "giteaCloudflared.age".publicKeys = kima ++ sobotka;
  "nextcloudCloudflared.age".publicKeys = kima ++ sobotka;
  "nextcloudAdminPass.age".publicKeys = kima ++ sobotka;
  "cloudflareDnsApiToken.age".publicKeys = kima ++ sobotka;
@@ -61,6 +62,7 @@ in {
  "traefikEnv.age".publicKeys = kima ++ sobotka;
  "wwwCloudflared.age".publicKeys = kima ++ sobotka;
  "authentikCloudflared.age".publicKeys = kima ++ sobotka;
  "sobotkaTsAuth.age".publicKeys = kima ++ sobotka;
  # Ziggy-specific
  "cloudflareDnsCredentialsZiggy.age".publicKeys = kima ++ ziggy;
--- a/secrets/sobotkaTsAuth.age
+++ b/secrets/sobotkaTsAuth.age
@@ -0,0 +1,11 @@
 age-encryption.org/v1
 -> ssh-ed25519 t9iOEg fftdt8orBZoM0sDRAXf0TScDLosNWWWIg7JmmuunuWM
 2IfpTH6ptSyLnBtBStkk7SINct6LtBHrL6h22BVNb+k
 -> ssh-ed25519 KUYMFA HI04mnVOGPRsRhnqCkbO4My/sBq5v/3UYxDVcfIe4RM
 fcSApUYCnJlpzVW5e77CFoSHamEmP+6ztMmzp2WlJvY
 -> ssh-ed25519 76RhUQ c2FbmTXGl/F+1acZFEJUoenkxiIGdoXkT67VgxvoFHg
 eWExqblEp5VIeXuPEuvj4QAIWtFX5KLfMyh6/fZ9bnA
 -> ssh-ed25519 Jf8sqw IAcUf70EufTyjsva8XIlXOfPxwXvtr9AFl0LwrdAMgc
 bY098fejLaFbUMX0iF89gz8kiOGZHI8JIg4NzX4ItFw
 --- WNqpLyRM2EqISbZky++NbKLw4GCEgwbz2O5+VO7aKzE
 <EFBFBD><EFBFBD><1A><>(5<0F>q	<09><>m<EFBFBD>C<EFBFBD><43>G<EFBFBD>r<><72><16><><EFBFBD><EFBFBD>ޒ3<DE92><33><17><1F>7<><37><EFBFBD>rG<72>i<EFBFBD>c7<63>i<EFBFBD>P<EFBFBD><50>l<EFBFBD><19>7<EFBFBD><<3C>r?cGo<47>^ǚ<>W<0E>V<EFBFBD><56>f,2<>Qg!<21>t_<74>
--- a/secrets/traefikEnv.age
+++ b/secrets/traefikEnv.age
Author	SHA1	Message	Date
cnst	57cb48a11c	feat(gaming): cleaning up gaming related pkgs	2025-10-11 16:44:54 +02:00
cnst	6b7ca2b194	feat(update): new kernel, new container versions and temporarily moving to zfs_unstable in waiting for stable to catch up with new kernel	2025-10-11 11:04:15 +02:00
cnst	e578a280db	chore(update): flake lock and removing unmaintained pkgs	2025-10-11 09:40:35 +02:00
cnst	01ca3d7ebe	feat(gitea): integrate with authentik	2025-10-08 20:39:54 +02:00
cnst	46aa5a9deb	fix(fail2ban): some hacky fix	2025-10-07 21:05:43 +02:00
cnst	549037fe69	chore(flake) lock	2025-10-06 21:00:09 +02:00
cnst	0cb6862dcd	feat(sqlite): adding sqlite pkgs	2025-10-06 20:57:01 +02:00
cnst	9e4454ff57	feat(gitea): move to cnst.dev domain, cf tunnel	2025-10-06 20:55:31 +02:00
cnst	15a20dd8e0	feat(pkgs): adding some dev pkgs to sobotka and dig as default	2025-10-05 19:27:15 +02:00
cnst	3306598f8a	feat(jellyfin): adding to tnet	2025-10-05 19:10:43 +02:00
cnst	93f227ba7e	feat(network): adding options for dns and search	2025-10-05 15:40:52 +02:00
cnst	9d20eff7f9	feat(jellyfin): TS testing	2025-10-05 10:47:08 +02:00
cnst	94d3f2ad35	feat(jellyfin): will this break things?	2025-10-05 10:35:22 +02:00
cnst	1d5bc22274	Merge branch 'main' into working	2025-10-05 10:21:16 +02:00
cnst	f2386a851e	working 1	2025-10-05 10:11:40 +02:00
cnst	c9edc99a85	chore(revert): slowly introducing changes	2025-10-05 09:27:51 +02:00