feat(hypr): clean up

feat(homepage-dashboard): change vaultwarden icon
chore(jellyseerr): typo
2025-10-15 19:38:47 +02:00 · 2025-10-15 18:01:39 +02:00 · 2025-10-15 17:50:11 +02:00 · 2025-10-15 17:49:30 +02:00 · 2025-10-14 22:43:59 +02:00 · 2025-10-14 22:00:16 +02:00
71 changed files with 1907 additions and 2083 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -29,11 +29,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1758874004,
-        "narHash": "sha256-+RUCBtT01Z595NpGc6Tvms+dJ/C/cn1zdjT9+gE6dbU=",
+        "lastModified": 1760083914,
+        "narHash": "sha256-I9IMO9d+z71oeqOz6gOre07tK2Du3vp2FcOW3x4FDXw=",
        "owner": "anyrun-org",
        "repo": "anyrun",
-        "rev": "3c571bc1514c4211d1d6c011a1d482f97efd9c5f",
+        "rev": "3050aa30e25957bbb9e1ac91a44d3979eccadf59",
        "type": "github"
      },
      "original": {
@@ -83,11 +83,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1755946532,
-        "narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
+        "lastModified": 1759499898,
+        "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
+        "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
        "type": "github"
      },
      "original": {
@@ -153,11 +153,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1759235653,
-        "narHash": "sha256-sKFehUxXCzM6E1LcmnRa/O6HKsRI/TGtciG5ulAJt08=",
+        "lastModified": 1760395520,
+        "narHash": "sha256-4hVEyj3H4i0kwtO8dDIKee1WoZ0iMZxr3ageSdJ6Cck=",
        "owner": "chaotic-cx",
        "repo": "nyx",
-        "rev": "2bf7f138e42fa8b2133761edab64263505cb83bf",
+        "rev": "c438d72cee048fe6203df15c81a230efb16fa409",
        "type": "github"
      },
      "original": {
@@ -212,11 +212,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1759301100,
-        "narHash": "sha256-hmiTEoVAqLnn80UkreCNunnRKPucKvcg5T4/CELEtbw=",
+        "lastModified": 1760424233,
+        "narHash": "sha256-8jLfVik1ccwmacVW5BlprmsuK534rT5HjdPhkSaew44=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "0956bc5d1df2ea800010172c6bc4470d9a22cb81",
+        "rev": "48a763cdc0b2d07199a021de99c2ca50af76e49f",
        "type": "github"
      },
      "original": {
@@ -332,11 +332,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
        "type": "github"
      },
      "original": {
@@ -392,11 +392,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
        "type": "github"
      },
      "original": {
@@ -491,11 +491,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758108966,
-        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
+        "lastModified": 1760392170,
+        "narHash": "sha256-WftxJgr2MeDDFK47fQKywzC72L2jRc/PWcyGdjaDzkw=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
+        "rev": "46d55f0aeb1d567a78223e69729734f3dca25a85",
        "type": "github"
      },
      "original": {
@@ -571,11 +571,11 @@
    },
    "hardware": {
      "locked": {
-        "lastModified": 1759261527,
-        "narHash": "sha256-wPd5oGvBBpUEzMF0kWnXge0WITNsITx/aGI9qLHgJ4g=",
+        "lastModified": 1760106635,
+        "narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "e087756cf4abbe1a34f3544c480fc1034d68742f",
+        "rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
        "type": "github"
      },
      "original": {
@@ -590,11 +590,11 @@
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1759201995,
-        "narHash": "sha256-3STv6fITv8Ar/kl0H7vIA7VV0d2gyLh8UL0BOiVacXg=",
+        "lastModified": 1760446779,
+        "narHash": "sha256-UzJHuqTgfwtnh34zbGq6NUe5i8wv3wg6B9njykBAddc=",
        "owner": "helix-editor",
        "repo": "helix",
-        "rev": "bfcbef10c513108c7b43317569416c2eefc4ed44",
+        "rev": "6e07bcc04dd5a0bb5ae04677823a5b3821f622c5",
        "type": "github"
      },
      "original": {
@@ -610,11 +610,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759331616,
-        "narHash": "sha256-LVpodobJvJM5rmfh2sFBHPNX0PYpNbbHzx/gprlKGGg=",
+        "lastModified": 1760462439,
+        "narHash": "sha256-bks3rTsKGlqehk4l7rViIg2lBnUsY6we22O+ecRZB/c=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "5890176f856dcaf55f3ab56b25d4138657531cbd",
+        "rev": "990e5ce6791ff1f497a61280a82eb66e3789e0e9",
        "type": "github"
      },
      "original": {
@@ -652,11 +652,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759172751,
-        "narHash": "sha256-E8W8sRXfrvkFW26GuuiWq6QfReU7m5+cngwHuRo/3jc=",
+        "lastModified": 1760312644,
+        "narHash": "sha256-U9SkK45314urw9P7MmjhEgiQwwD/BTj+T3HTuz1JU1Q=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "12fa8548feefa9a10266ba65152fd1a787cdde8f",
+        "rev": "e121f3773fa596ecaba5b22e518936a632d72a90",
        "type": "github"
      },
      "original": {
@@ -710,11 +710,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758192433,
-        "narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
+        "lastModified": 1759490292,
+        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
+        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
        "type": "github"
      },
      "original": {
@@ -739,11 +739,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1750621377,
-        "narHash": "sha256-8u6b5oAdX0rCuoR8wFenajBRmI+mzbpNig6hSCuWUzE=",
+        "lastModified": 1759490292,
+        "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "b3d628d01693fb9bb0a6690cd4e7b80abda04310",
+        "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
        "type": "github"
      },
      "original": {
@@ -803,11 +803,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1759318697,
-        "narHash": "sha256-iCL/F+rlgzgBfG4QURfjBrxVBMPsXCzZKHXn1SNBshc=",
+        "lastModified": 1760466709,
+        "narHash": "sha256-m5Bd3RadgnA1HEdisWnZI4sGVvj6Mh3WERmFgZqyF+s=",
        "owner": "hyprwm",
        "repo": "hyprland",
-        "rev": "e0c96276df75accc853a30186ae5de580b2c725f",
+        "rev": "f324a3a564b40f4f62eb137808ca38bf6aee1b27",
        "type": "github"
      },
      "original": {
@@ -824,11 +824,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759238633,
-        "narHash": "sha256-4/AtRCQKXuU49ozZZouWuC+T7vCjQh9HAz3N8Tt5OZE=",
+        "lastModified": 1759613406,
+        "narHash": "sha256-PzgQJydp+RlKvwDi807pXPlURdIAVqLppZDga3DwPqg=",
        "owner": "hyprwm",
        "repo": "contrib",
-        "rev": "513d71d3f42c05d6a38e215382c5a6ce971bd77d",
+        "rev": "32e1a75b65553daefb419f0906ce19e04815aa3a",
        "type": "github"
      },
      "original": {
@@ -942,11 +942,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1757694755,
-        "narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
+        "lastModified": 1759080228,
+        "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
        "owner": "hyprwm",
        "repo": "hyprland-qtutils",
-        "rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
+        "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
        "type": "github"
      },
      "original": {
@@ -971,11 +971,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756810301,
-        "narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
+        "lastModified": 1758927902,
+        "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
        "owner": "hyprwm",
        "repo": "hyprlang",
-        "rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
+        "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
        "type": "github"
      },
      "original": {
@@ -1006,11 +1006,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758124489,
-        "narHash": "sha256-YiVF/8Me3vVKJBEgGpQhn0HF09EWfXZGaWLzAaJBrO4=",
+        "lastModified": 1760023949,
+        "narHash": "sha256-fu0B4duamVdbkPio/czu1XhsPLRXUJpZLDrSk3nih4U=",
        "owner": "hyprwm",
        "repo": "hyprlock",
-        "rev": "7f769fa993cb492982d7bf25676c68ddbcc0268e",
+        "rev": "36ec73f166d9434a3f27c96c575198906f77644a",
        "type": "github"
      },
      "original": {
@@ -1044,11 +1044,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754481642,
-        "narHash": "sha256-e1phd6KwtUsS9C2ShD+fQvfk2Dgr2JQi+rTDQUW15iE=",
+        "lastModified": 1760120448,
+        "narHash": "sha256-l/OxM4q/nLVv47OuS4bG2J7k0m+G7/3AMtvrV64XLb0=",
        "owner": "hyprwm",
        "repo": "hyprpaper",
-        "rev": "bcb1ffa322369c4898347ab5a7399a3d18494c8f",
+        "rev": "1733e0025b194c9bc083f4cd8782c5f151858a58",
        "type": "github"
      },
      "original": {
@@ -1069,11 +1069,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756117388,
-        "narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
+        "lastModified": 1759619523,
+        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
+        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
        "type": "github"
      },
      "original": {
@@ -1144,11 +1144,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1750371869,
-        "narHash": "sha256-lGk4gLjgZQ/rndUkzmPYcgbHr8gKU5u71vyrjnwfpB4=",
+        "lastModified": 1755184602,
+        "narHash": "sha256-RCBQN8xuADB0LEgaKbfRqwm6CdyopE1xIEhNc67FAbw=",
        "owner": "hyprwm",
        "repo": "hyprwayland-scanner",
-        "rev": "aa38edd6e3e277ae6a97ea83a69261a5c3aab9fd",
+        "rev": "b3b0f1f40ae09d4447c20608e5a4faf8bf3c492d",
        "type": "github"
      },
      "original": {
@@ -1191,11 +1191,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1757230583,
-        "narHash": "sha256-4uqu7sFPOaVTCogsxaGMgbzZ2vK40GVGMfUmrvK3/LY=",
+        "lastModified": 1760266702,
+        "narHash": "sha256-TP19RpzIyo1JeYAhKii13seYwmhkv7IOD+dCnQOrcgQ=",
        "owner": "Jovian-Experiments",
        "repo": "Jovian-NixOS",
-        "rev": "fc3960e6c32c9d4f95fff2ef84444284d24d3bea",
+        "rev": "3d7e970d4cac5d3ee3fe7cafa17cc9868fa21fed",
        "type": "github"
      },
      "original": {
@@ -1229,11 +1229,11 @@
    },
    "mnw": {
      "locked": {
-        "lastModified": 1756659871,
-        "narHash": "sha256-v6Rh4aQ6RKjM2N02kK9Usn0Ix7+OY66vNpeklc1MnGE=",
+        "lastModified": 1758834834,
+        "narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
        "owner": "Gerg-L",
        "repo": "mnw",
-        "rev": "ed6cc3e48557ba18266e598a5ebb6602499ada16",
+        "rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
        "type": "github"
      },
      "original": {
@@ -1278,11 +1278,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759110900,
-        "narHash": "sha256-fcu/r0ijvaYT2VHGkZGr0wq9uBMNFkiftVBy43/2oig=",
+        "lastModified": 1760406533,
+        "narHash": "sha256-ViYpiGv0w+TXpBCFXPXWlEP3dVNHeGgvpsKDbQMY6UE=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "2ac6a49266e9159ccb001b4c8cb1f50f67d502ae",
+        "rev": "f8f51dd445f7b0dbb3429a3e31994bb0f2908010",
        "type": "github"
      },
      "original": {
@@ -1363,11 +1363,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1759147044,
-        "narHash": "sha256-3ZPFytJOcLjTChljeaGgoaNj+tOqzgEpqZAvRe3bU90=",
-        "owner": "PedroHLC",
+        "lastModified": 1760284886,
+        "narHash": "sha256-TK9Kr0BYBQ/1P5kAsnNQhmWWKgmZXwUQr4ZMjCzWf2c=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "18e83bbe13aa50992777832b52bd0e0d8585fb3b",
+        "rev": "cf3f5c4def3c7b5f1fc012b3d839575dbe552d43",
        "type": "github"
      },
      "original": {
@@ -1395,11 +1395,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1740560979,
-        "narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
+        "lastModified": 1759381078,
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "5135c59491985879812717f4c9fea69604e7f26f",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
        "type": "github"
      },
      "original": {
@@ -1411,11 +1411,11 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1758198701,
-        "narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
+        "lastModified": 1759381078,
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
        "type": "github"
      },
      "original": {
@@ -1443,11 +1443,11 @@
    },
    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1759036355,
-        "narHash": "sha256-0m27AKv6ka+q270dw48KflE0LwQYrO7Fm4/2//KCVWg=",
+        "lastModified": 1760284886,
+        "narHash": "sha256-TK9Kr0BYBQ/1P5kAsnNQhmWWKgmZXwUQr4ZMjCzWf2c=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e9f00bd893984bc8ce46c895c3bf7cac95331127",
+        "rev": "cf3f5c4def3c7b5f1fc012b3d839575dbe552d43",
        "type": "github"
      },
      "original": {
@@ -1459,11 +1459,11 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1756696532,
-        "narHash": "sha256-6FWagzm0b7I/IGigOv9pr6LL7NQ86mextfE8g8Q6HBg=",
+        "lastModified": 1759386674,
+        "narHash": "sha256-wg1Lz/1FC5Q13R+mM5a2oTV9TA9L/CHHTm3/PiLayfA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "58dcbf1ec551914c3756c267b8b9c8c86baa1b2f",
+        "rev": "625ad6366178f03acd79f9e3822606dd7985b657",
        "type": "github"
      },
      "original": {
@@ -1482,11 +1482,11 @@
        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1758271661,
-        "narHash": "sha256-ENqd2/33uP5vB44ClDjjAV+J78oF8q1er4QUZuT8Z7g=",
+        "lastModified": 1760153667,
+        "narHash": "sha256-F7KmXT/Izse6Q6CkD5GCImoGPaDJxl03Kd7eD+eY/bU=",
        "owner": "notashelf",
        "repo": "nvf",
-        "rev": "b7571df4d6e9ac08506a738ddceeec0b141751b0",
+        "rev": "9df9d51fd9fc8f9a8fc377f984ea3b7ae796172d",
        "type": "github"
      },
      "original": {
@@ -1626,11 +1626,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1759245522,
-        "narHash": "sha256-H4Hx/EuMJ9qi1WzPV4UG2bbZiDCdREtrtDvYcHr0kmk=",
+        "lastModified": 1760260966,
+        "narHash": "sha256-pOVvZz/aa+laeaUKyE6PtBevdo4rywMwjhWdSZE/O1c=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "a6bc4a4bbe6a65b71cbf76a0cf528c47a8d9f97f",
+        "rev": "c5181dbbe33af6f21b9d83e02fdb6fda298a3b65",
        "type": "github"
      },
      "original": {
@@ -1648,11 +1648,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759113356,
-        "narHash": "sha256-xm4kEUcV2jk6u15aHazFP4YsMwhq+PczA+Ul/4FDKWI=",
+        "lastModified": 1760236527,
+        "narHash": "sha256-h9+WEQtUIZaZMvA1pnbZbMM+5X39OFnW92Q8hNoToD0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "be3b8843a2be2411500f6c052876119485e957a2",
+        "rev": "a38dd7f462825c75ce8567816ae38c2e7d826bfa",
        "type": "github"
      },
      "original": {
@@ -1669,11 +1669,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1740623427,
-        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
+        "lastModified": 1759631821,
+        "narHash": "sha256-V8A1L0FaU/aSXZ1QNJScxC12uP4hANeRBgI4YdhHeRM=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
+        "rev": "1d7cbdaad90f8a5255a89a6eddd8af24dc89cafe",
        "type": "github"
      },
      "original": {
@@ -1815,11 +1815,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758728421,
-        "narHash": "sha256-ySNJ008muQAds2JemiyrWYbwbG+V7S5wg3ZVKGHSFu8=",
+        "lastModified": 1760120816,
+        "narHash": "sha256-gq9rdocpmRZCwLS5vsHozwB6b5nrOBDNc2kkEaTXHfg=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "5eda4ee8121f97b218f7cc73f5172098d458f1d1",
+        "rev": "761ae7aff00907b607125b2f57338b74177697ed",
        "type": "github"
      },
      "original": {
@@ -1923,11 +1923,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759180079,
-        "narHash": "sha256-5hqTGqAKcLEumY3tqOtHK17CA6RkzS1I0EGKfuoyb58=",
+        "lastModified": 1759969704,
+        "narHash": "sha256-T7f/invcFIKHrBqD+FLf/C/HOGmpYfbZUzTDxFscpOA=",
        "ref": "refs/heads/main",
-        "rev": "d4a254b38c7ac2b99931220d767610adfa3a57fe",
-        "revCount": 135,
+        "rev": "1173c777dc8daddcc4959260a7b00fd8abc884c5",
+        "revCount": 137,
        "type": "git",
        "url": "https://git.sr.ht/~canasta/zen-browser-flake"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -1,8 +1,7 @@
 {
  description = "cnix nix";

-  outputs =
-    inputs:
+  outputs = inputs:
    inputs.flake-parts.lib.mkFlake {inherit inputs;} {
      systems = [
        "x86_64-linux"
@@ -17,13 +16,11 @@
        ./fmt-hooks.nix
      ];

-      perSystem =
-        {
+      perSystem = {
        config,
        pkgs,
        ...
-        }:
-        {
+      }: {
        devShells.default = pkgs.mkShell {
          packages = [
            pkgs.git
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -4,11 +4,9 @@
  homeImports,
  self,
  ...
-}:
-{
-  flake.nixosConfigurations =
-    let
-      cLib = import ../lib inputs.nixpkgs.lib;
+}: {
+  flake.nixosConfigurations = let
+    # clib = import ../lib inputs.nixpkgs.lib;
    userConfig = "${self}/home";
    systemConfig = "${self}/system";
    hostConfig = "${self}/hosts";
@@ -24,7 +22,7 @@

    specialArgs = {
      inherit
-          cLib
+        # clib
        inputs
        outputs
        self
@@ -37,8 +35,7 @@
        smodPath
        ;
    };
-    in
-    {
+  in {
    kima = nixosSystem {
      inherit specialArgs;
      modules = [
--- a/hosts/kima/modules.nix
+++ b/hosts/kima/modules.nix
@@ -29,6 +29,13 @@
      };
      network = {
        enable = true;
+        nameservers = [
+          "192.168.88.1"
+          "192.168.88.69"
+        ];
+        search = [
+          "taila7448a.ts.net"
+        ];
        interfaces = {
          "eno1" = {
            allowedTCPPorts = [
@@ -66,7 +73,7 @@
        };
      };
      gamescope = {
-        enable = true;
+        enable = false;
      };
      gimp = {
        enable = true;
--- a/hosts/sobotka/default.nix
+++ b/hosts/sobotka/default.nix
@@ -68,7 +68,10 @@ in {

  boot = {
    supportedFilesystems = ["zfs"];
-    zfs.extraPools = ["data"];
+    zfs = {
+      package = pkgs.zfs_unstable;
+      extraPools = ["data"];
+    };
  };

  services.zfs = {
--- a/hosts/sobotka/modules.nix
+++ b/hosts/sobotka/modules.nix
@@ -109,7 +109,7 @@
          enable = true;
        };
        dev = {
-          enable = false;
+          enable = true;
        };
      };
      mysql-workbench = {
--- a/hosts/sobotka/server.nix
+++ b/hosts/sobotka/server.nix
@@ -3,77 +3,30 @@
    enable = true;
    email = "adam@cnst.dev";
    domain = "cnix.dev";
+    ip = "192.168.88.14";
    user = "share";
    group = "share";
    uid = 994;
    gid = 993;

-    traefik = {
-      enable = true;
-    };
-    gitea = {
-      enable = true;
-    };
-    unbound = {
-      enable = true;
-    };
-    homepage-dashboard = {
-      enable = true;
-    };
-    n8n = {
-      enable = true;
-    };
-    bazarr = {
-      enable = true;
-    };
-    prowlarr = {
-      enable = true;
-    };
-    lidarr = {
-      enable = true;
-    };
-    sonarr = {
-      enable = true;
-    };
-    radarr = {
-      enable = true;
-    };
-    jellyseerr = {
-      enable = true;
-    };
-    jellyfin = {
-      enable = true;
-    };
-    uptime-kuma = {
-      enable = true;
-    };
-    vaultwarden = {
-      enable = true;
-      url = "vault.cnst.dev";
-      cloudflared = {
-        tunnelId = "fdd98086-6a4c-44f2-bba0-eb86b833cce5";
-        credentialsFile = config.age.secrets.vaultwardenCloudflared.path;
-      };
-    };
-    www = {
-      enable = true;
-      url = "cnst.dev";
-      cloudflared = {
-        tunnelId = "e5076186-efb7-405a-998c-6155af7fb221";
-        credentialsFile = config.age.secrets.wwwCloudflared.path;
-      };
-    };
+    infra = {
      authentik = {
        enable = true;
        url = "auth.cnst.dev";
+        port = 9000;
        cloudflared = {
          tunnelId = "b66f9368-db9e-4302-8b48-527cda34a635";
          credentialsFile = config.age.secrets.authentikCloudflared.path;
        };
      };
-    nextcloud = {
+      traefik = {
+        enable = true;
+      };
+      tailscale = {
+        enable = true;
+      };
+      unbound = {
        enable = true;
-      adminpassFile = config.age.secrets.nextcloudAdminPass.path;
      };
      fail2ban = {
        enable = true;
@@ -84,19 +37,230 @@
        enable = true;
        interface = "enp6s0";
      };
+      gluetun = {
+        enable = true;
+      };
      podman = {
        enable = true;
-      gluetun.enable = true;
+      };
+      www = {
+        enable = true;
+        url = "cnst.dev";
+        port = 8283;
+        cloudflared = {
+          tunnelId = "e5076186-efb7-405a-998c-6155af7fb221";
+          credentialsFile = config.age.secrets.wwwCloudflared.path;
+        };
+      };
+    };
+
+    services = {
+      homepage-dashboard = {
+        enable = true;
+        subdomain = "dash";
+        exposure = "local";
+        port = 8082;
+      };
+      n8n = {
+        enable = true;
+        subdomain = "n8n";
+        exposure = "local";
+        port = 5678;
+        homepage = {
+          name = "n8n";
+          description = "A workflow automation platform";
+          icon = "n8n.svg";
+          category = "Services";
+        };
+      };
+      bazarr = {
+        enable = true;
+        subdomain = "bazarr";
+        exposure = "local";
+        port = 6767;
+        homepage = {
+          name = "Bazarr";
+          description = "Subtitle manager";
+          icon = "bazarr.svg";
+          category = "Arr";
+        };
+      };
+      prowlarr = {
+        enable = true;
+        subdomain = "prowlarr";
+        exposure = "local";
+        port = 9696;
+        homepage = {
+          name = "Prowlarr";
+          description = "PVR indexer";
+          icon = "prowlarr.svg";
+          category = "Arr";
+        };
+      };
+      flaresolverr = {
+        enable = true;
+        subdomain = "flaresolverr";
+        exposure = "local";
+        port = 8191;
+        homepage = {
+          name = "FlareSolverr";
+          description = "Proxy to bypass Cloudflare/DDoS-GUARD protection";
+          icon = "flaresolverr.svg";
+          category = "Arr";
+        };
+      };
+      lidarr = {
+        enable = true;
+        subdomain = "lidarr";
+        exposure = "local";
+        port = 8686;
+        homepage = {
+          name = "Lidarr";
+          description = "Music collection manager";
+          icon = "lidarr.svg";
+          category = "Arr";
+        };
+      };
+      sonarr = {
+        enable = true;
+        subdomain = "sonarr";
+        exposure = "local";
+        port = 8989;
+        homepage = {
+          name = "Sonarr";
+          description = "Internet PVR for Usenet and Torrents";
+          icon = "sonarr.svg";
+          category = "Arr";
+        };
+      };
+      radarr = {
+        enable = true;
+        subdomain = "radarr";
+        exposure = "local";
+        port = 7878;
+        homepage = {
+          name = "Radarr";
+          description = "Movie collection manager";
+          icon = "radarr.svg";
+          category = "Arr";
+        };
+      };
+      jellyseerr = {
+        enable = true;
+        subdomain = "jellyseerr";
+        exposure = "local";
+        port = 5055;
+        homepage = {
+          name = "Jellyseerr";
+          description = "Media request and discovery manager";
+          icon = "jellyseerr.svg";
+          category = "Arr";
+        };
+      };
+      jellyfin = {
+        enable = true;
+        subdomain = "fin";
+        exposure = "tailscale";
+        port = 8096;
+        homepage = {
+          name = "Jellyfin";
+          description = "The Free Software Media System";
+          icon = "jellyfin.svg";
+          category = "Media";
+        };
+      };
+      uptime-kuma = {
+        enable = true;
+        subdomain = "uptime";
+        exposure = "local";
+        port = 3001;
+        homepage = {
+          name = "Uptime Kuma";
+          description = "Service monitoring tool";
+          icon = "uptime-kuma.svg";
+          category = "Services";
+        };
+      };
+      gitea = {
+        enable = true;
+        subdomain = "git";
+        exposure = "tunnel";
+        port = 5003;
+        cloudflared = {
+          tunnelId = "33e2fb8e-ecef-4d42-b845-6d15e216e448";
+          credentialsFile = config.age.secrets.giteaCloudflared.path;
+        };
+        homepage = {
+          name = "Gitea";
+          description = "Git with a cup of tea";
+          icon = "gitea.svg";
+          category = "Services";
+        };
+      };
+      vaultwarden = {
+        enable = true;
+        subdomain = "vault";
+        exposure = "tunnel";
+        port = 8222;
+        cloudflared = {
+          tunnelId = "fdd98086-6a4c-44f2-bba0-eb86b833cce5";
+          credentialsFile = config.age.secrets.vaultwardenCloudflared.path;
+        };
+        homepage = {
+          name = "Vaultwarden";
+          description = "Password manager";
+          icon = "vaultwarden-light.svg";
+          category = "Services";
+        };
+      };
+      nextcloud = {
+        enable = true;
+        subdomain = "cloud";
+        exposure = "local";
+        port = 8182;
+        homepage = {
+          name = "Nextcloud";
+          description = "A safe home for all your data";
+          icon = "nextcloud.svg";
+          category = "Services";
+        };
+      };
      qbittorrent = {
        enable = true;
+        subdomain = "qbt";
+        exposure = "local";
        port = 8080;
+        homepage = {
+          name = "qBittorrent";
+          description = "Torrent client";
+          icon = "qbittorrent.svg";
+          category = "Downloads";
+        };
      };
      slskd = {
        enable = true;
+        subdomain = "slskd";
+        exposure = "local";
+        port = 5030;
+        homepage = {
+          name = "Soulseek";
+          description = "Web-based Soulseek client";
+          icon = "slskd.svg";
+          category = "Downloads";
+        };
      };
      pihole = {
        enable = true;
+        subdomain = "pihole";
+        exposure = "local";
        port = 8053;
+        homepage = {
+          name = "PiHole";
+          description = "Adblocking and DNS service";
+          icon = "pi-hole.svg";
+          category = "Services";
+          path = "/admin";
+        };
      };
    };
  };
--- a/hosts/sobotka/settings.nix
+++ b/hosts/sobotka/settings.nix
@@ -4,6 +4,10 @@
      username = "cnst";
      mail = "adam@cnst.dev";
      sshUser = "sobotka";
+      domains = {
+        local = "cnix.dev";
+        public = "cnst.dev";
+      };
    };
  };
 }
--- a/lib/server/default.nix
+++ b/lib/server/default.nix
@@ -0,0 +1,26 @@
+{lib}: let
+  server = {
+    mkDomain = config: service: let
+      localDomain = config.settings.accounts.domains.local;
+      publicDomain = config.settings.accounts.domains.public;
+      tailscaleDomain = "ts.${publicDomain}";
+    in
+      if service.exposure == "tunnel"
+      then publicDomain
+      else if service.exposure == "tailscale"
+      then tailscaleDomain
+      else localDomain;
+
+    mkFullDomain = config: service: let
+      domain = server.mkDomain config service;
+    in "${service.subdomain}.${domain}";
+
+    mkHostDomain = config: service: let
+      domain = server.mkDomain config service;
+    in "${domain}";
+
+    mkSubDomain = config: service: "${service.subdomain}";
+  };
+in {
+  server = server;
+}
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -123,27 +123,6 @@
    server = {
      imports = [
        ./server
-        ./server/fail2ban
-        ./server/homepage-dashboard
-        ./server/nextcloud
-        ./server/vaultwarden
-        ./server/bazarr
-        ./server/prowlarr
-        ./server/lidarr
-        ./server/radarr
-        ./server/sonarr
-        ./server/jellyseerr
-        ./server/jellyfin
-        ./server/n8n
-        ./server/podman
-        ./server/unbound
-        ./server/uptime-kuma
-        ./server/keepalived
-        ./server/gitea
-        ./server/postgres
-        ./server/traefik
-        ./server/www
-        ./server/authentik
      ];
    };
    settings = {
--- a/modules/home/programs/hyprlock/default.nix
+++ b/modules/home/programs/hyprlock/default.nix
@@ -1,26 +1,18 @@
 {
-  inputs,
-  pkgs,
  lib,
  osConfig,
-  cLib,
+  clib,
  ...
-}:
-let
-  inherit (lib) mkIf mkEnableOption;
+}: let
+  inherit (lib) mkIf;
  cfg = osConfig.nixos.programs.hyprland;

-  hyprlockFlake = inputs.hyprlock.packages.${pkgs.system}.hyprlock;
-  # hyprlockPkg = pkgs.hyprlock;
-  #
  bg = osConfig.settings.theme.background;
-  inherit (cLib.theme.bgs) resolve;
-in
-{
+  inherit (clib.theme.bgs) resolve;
+in {
  config = mkIf cfg.enable {
    programs.hyprlock = {
      enable = true;
-      package = hyprlockFlake;
      settings = {
        general = {
          # disable_loading_bar = true;
--- a/modules/home/programs/pkgs/default.nix
+++ b/modules/home/programs/pkgs/default.nix
@@ -88,7 +88,7 @@ in
          hyprpicker
          libnotify
          pamixer
-          oculante
+          loupe
          adwaita-icon-theme
          qt5.qtwayland
          qt6.qtwayland
--- a/modules/home/services/hypridle/default.nix
+++ b/modules/home/services/hypridle/default.nix
@@ -1,22 +1,14 @@
 {
  osConfig,
  lib,
-  pkgs,
-  inputs,
  ...
-}:
-let
+}: let
  inherit (lib) mkIf;
  cfg = osConfig.nixos.programs.hyprland;
-
-  hypridleFlake = inputs.hypridle.packages.${pkgs.system}.hypridle;
-  # hypridlePkg = pkgs.hypridle;
-in
-{
+in {
  config = mkIf cfg.enable {
    services.hypridle = {
      enable = true;
-      package = hypridleFlake;
      settings = {
        general = {
          lock_cmd = "hyprlock";
--- a/modules/home/services/hyprpaper/default.nix
+++ b/modules/home/services/hyprpaper/default.nix
@@ -1,18 +1,14 @@
 {
  lib,
-  pkgs,
-  inputs,
  osConfig,
-  cLib,
+  clib,
  ...
-}:
-let
+}: let
  inherit (lib) mkIf;

  cfg = osConfig.nixos.programs.hyprland;
-  hyprpaperFlake = inputs.hyprpaper.packages.${pkgs.system}.default;
  bg = osConfig.settings.theme.background;
-  bgs = cLib.theme.bgs;
+  bgs = clib.theme.bgs;

  monitorMappings = [
    {
@@ -32,12 +28,10 @@ let
      bg = bg.primary;
    }
  ];
-in
-{
+in {
  config = mkIf cfg.enable {
    services.hyprpaper = {
      enable = true;
-      package = hyprpaperFlake;

      settings = {
        ipc = "on";
--- a/modules/home/services/xdg/default.nix
+++ b/modules/home/services/xdg/default.nix
@@ -84,15 +84,15 @@ in
          "application/pdf" = "org.pwmt.zathura-pdf-mupdf.desktop";
          "inode/directory" = "thunar.desktop";

-          "image/apng" = "oculante.desktop";
-          "image/avif" = "oculante.desktop";
-          "image/bmp" = "oculante.desktop";
-          "image/gif" = "oculante.desktop";
-          "image/jpeg" = "oculante.desktop";
-          "image/png" = "oculante.desktop";
-          "image/svg+xml" = "oculante.desktop";
-          "image/tiff" = "oculante.desktop";
-          "image/webp" = "oculante.desktop";
+          "image/apng" = "feh.desktop";
+          "image/avif" = "feh.desktop";
+          "image/bmp" = "feh.desktop";
+          "image/gif" = "feh.desktop";
+          "image/jpeg" = "feh.desktop";
+          "image/png" = "feh.desktop";
+          "image/svg+xml" = "feh.desktop";
+          "image/tiff" = "feh.desktop";
+          "image/webp" = "feh.desktop";

          "video/H264" = [
            "mpv.desktop"
--- a/modules/nixos/hardware/network/default.nix
+++ b/modules/nixos/hardware/network/default.nix
@@ -2,20 +2,29 @@
  config,
  lib,
  ...
-}:
-let
-  inherit (lib)
+}: let
+  inherit
+    (lib)
    mkIf
    mkEnableOption
    mkOption
    types
    ;
  cfg = config.nixos.hardware.network;
-in
-{
+in {
  options = {
    nixos.hardware.network = {
      enable = mkEnableOption "Enable the custom networking module";
+      nameservers = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "The list of nameservers ";
+      };
+      search = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Domain search paths";
+      };
      interfaces = mkOption {
        type = types.attrsOf (
          types.submodule {
@@ -55,6 +64,8 @@ in
    networking = {
      networkmanager.enable = true;
      nftables.enable = true;
+      nameservers = cfg.nameservers;
+      search = cfg.search;
      firewall = {
        enable = true;
        inherit (cfg) interfaces;
--- a/modules/nixos/programs/pkgs/default.nix
+++ b/modules/nixos/programs/pkgs/default.nix
@@ -78,6 +78,7 @@ in
          openssl
          xmrig
          ocl-icd
+          dig
        ]

        (mkIf cfg.common.enable [
@@ -96,9 +97,6 @@ in
        ])

        (mkIf cfg.desktop.enable [
-          protonup
-          winetricks
-          wine
          geekbench
          unigine-heaven
        ])
@@ -109,15 +107,13 @@ in

        (mkIf cfg.server.enable [
          nvtopPackages.intel
-          nvtopPackages.amd
-          dig
          helix
-          zfs
          zfstools
        ])

        (mkIf cfg.dev.enable [
          # lldb_20 # some biuld error atm
+          sqlite
          gemini-cli
          nfs-utils
          gcc
@@ -144,7 +140,6 @@ in
          prettierd
          # php84Packages.php-cs-fixer
          shfmt
-          luaformatter
          black
        ])
      ];
--- a/modules/nixos/programs/steam/default.nix
+++ b/modules/nixos/programs/steam/default.nix
@@ -1,6 +1,7 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:
 let
@@ -17,6 +18,20 @@ in
        enable = true;
        gamescopeSession.enable = true;
      };
+      gamescope = {
+        enable = true;
+        capSysNice = true;
+        args = [
+          "--rt"
+          "--expose-wayland"
+        ];
      };
    };
+    environment.systemPackages = with pkgs; [
+      protonup
+      wine
+      winetricks
+      wine-wayland
+    ];
+  };
 }
--- a/modules/nixos/system/devpkgs/default.nix
+++ b/modules/nixos/system/devpkgs/default.nix
@@ -45,7 +45,6 @@ in
      # nodePackages_latest.sql-formatter
      prettierd
      shfmt
-      luaformatter
      black
    ];
  };
--- a/modules/server/bazarr/default.nix
+++ b/modules/server/bazarr/default.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "bazarr";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Bazarr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Subtitle manager";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "bazarr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${unit} = {
-      enable = true;
-      user = srv.user;
-      group = srv.group;
-    };
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.bazarr.loadBalancer.servers = [{url = "http://127.0.0.1:${toString config.services.${unit}.listenPort}";}];
-          routers = {
-            bazarr = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "bazarr";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/default.nix
+++ b/modules/server/default.nix
@@ -1,101 +1,16 @@
 {
+  self,
  lib,
-  config,
-  pkgs,
  ...
 }: let
-  hardDrives = [
-    "/dev/disk/by-label/data"
-  ];
-  inherit (lib) mkOption types;
-  cfg = config.server;
-  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
+  clib = import "${self}/lib/server" {inherit lib;};
 in {
-  options.server = {
-    enable = lib.mkEnableOption "The server services and configuration variables";
-    email = mkOption {
-      default = "";
-      type = types.str;
-      description = ''
-        Email name to be used to access the server services via Caddy reverse proxy
-      '';
-    };
-    domain = mkOption {
-      default = "";
-      type = types.str;
-      description = ''
-        Domain name to be used to access the server services via Caddy reverse proxy
-      '';
-    };
-    user = lib.mkOption {
-      default = "share";
-      type = lib.types.str;
-      description = ''
-        User to run the server services as
-      '';
-    };
-    group = lib.mkOption {
-      default = "share";
-      type = lib.types.str;
-      description = ''
-        Group to run the server services as
-      '';
-    };
-    uid = lib.mkOption {
-      default = 1000;
-      type = lib.types.int;
-      description = ''
-        UID to run the server services as
-      '';
-    };
-    gid = lib.mkOption {
-      default = 1000;
-      type = lib.types.int;
-      description = ''
-        GID to run the server services as
-      '';
-    };
-    timeZone = lib.mkOption {
-      default = "Europe/Stockholm";
-      type = lib.types.str;
-      description = ''
-        Time zone to be used for the server services
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users = {
-      groups.${cfg.group} = {
-        gid = cfg.gid;
-      };
-      users.${cfg.user} = {
-        uid = cfg.uid;
-        isSystemUser = true;
-        group = cfg.group;
-        extraGroups = ifTheyExist [
-          "audio"
-          "video"
-          "docker"
-          "libvirtd"
-          "qemu-libvirtd"
-          "rtkit"
-          "fail2ban"
-          "vaultwarden"
-          "qbittorrent"
-          "lidarr"
-          "prowlarr"
-          "bazarr"
-          "sonarr"
-          "radarr"
-          "media"
-          "share"
-          "render"
-          "input"
-          "authentik"
-          "traefik"
-        ];
-      };
-    };
-  };
+  imports = [
+    {
+      _module.args.clib = clib;
+    }
+    ./options.nix
+    ./infra
+    ./services
+  ];
 }
--- a/modules/server/gitea/default.nix
+++ b/modules/server/gitea/default.nix
@@ -1,125 +0,0 @@
-# taken from @jtojnar
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "gitea";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "git.${srv.domain}";
-    };
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 5003;
-      description = "The port to host Gitea on.";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Gitea";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Git with a cup of tea";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "gitea.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Services";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${unit} = {
-      enable = true;
-      appName = "cnix code forge";
-
-      database = {
-        type = "postgres";
-        socket = "/run/postgresql";
-        name = "gitea";
-        user = "gitea";
-        createDatabase = false;
-      };
-
-      lfs = {
-        enable = true;
-      };
-
-      settings = {
-        cors = {
-          ENABLED = true;
-          SCHEME = "https";
-          ALLOW_DOMAIN = cfg.url;
-        };
-        log = {
-          MODE = "console";
-        };
-        mailer = {
-          ENABLED = false;
-          MAILER_TYPE = "sendmail";
-          FROM = "noreply+adam@cnst.dev";
-          SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
-        };
-        picture = {
-          DISABLE_GRAVATAR = true;
-        };
-        repository = {
-          DEFAULT_BRANCH = "main";
-          DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
-          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
-        };
-        indexer = {
-          REPO_INDEXER_ENABLED = true;
-        };
-        server = {
-          DOMAIN = cfg.url;
-          LANDING_PAGE = "explore";
-          HTTP_PORT = cfg.port;
-          ROOT_URL = "https://${cfg.url}/";
-        };
-        security = {
-          DISABLE_GIT_HOOKS = false;
-        };
-        service = {
-          DISABLE_REGISTRATION = true;
-        };
-        session = {
-          COOKIE_SECURE = true;
-        };
-      };
-    };
-
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.gitea.loadBalancer.servers = [{url = "http://127.0.0.1:5003";}];
-          routers = {
-            gitea = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "gitea";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-
-    server.postgresql.databases = [
-      {
-        database = "gitea";
-      }
-    ];
-  };
-}
--- a/modules/server/homepage-dashboard/default.nix
+++ b/modules/server/homepage-dashboard/default.nix
@@ -1,236 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}: let
-  unit = "homepage-dashboard";
-  cfg = config.server.homepage-dashboard;
-  srv = config.server;
-in {
-  options.server.homepage-dashboard = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    misc = lib.mkOption {
-      default = [];
-      type = lib.types.listOf (
-        lib.types.attrsOf (
-          lib.types.submodule {
-            options = {
-              description = lib.mkOption {
-                type = lib.types.str;
-              };
-              href = lib.mkOption {
-                type = lib.types.str;
-              };
-              siteMonitor = lib.mkOption {
-                type = lib.types.str;
-              };
-              icon = lib.mkOption {
-                type = lib.types.str;
-              };
-            };
-          }
-        )
-      );
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    age.secrets = {
-      homepageEnvironment = {
-        file = "${self}/secrets/homepageEnvironment.age";
-      };
-    };
-    services = {
-      glances.enable = true;
-      ${unit} = {
-        enable = true;
-        environmentFile = config.age.secrets.homepageEnvironment.path;
-        settings = {
-          layout = [
-            {
-              Glances = {
-                header = false;
-                style = "row";
-                columns = 4;
-              };
-            }
-            {
-              Arr = {
-                header = true;
-                style = "column";
-              };
-            }
-            {
-              Downloads = {
-                header = true;
-                style = "column";
-              };
-            }
-            {
-              Media = {
-                header = true;
-                style = "column";
-              };
-            }
-            {
-              Services = {
-                header = true;
-                style = "column";
-              };
-            }
-          ];
-          headerStyle = "clean";
-          statusStyle = "dot";
-          hideVersion = "true";
-        };
-        widgets = [
-          {
-            openmeteo = {
-              label = "Kalmar";
-              timezone = "Europe/Stockholm";
-              units = "metric";
-              cache = 5;
-              latitude = 56.707262;
-              longitude = 16.324541;
-            };
-          }
-          {
-            resources = {
-              label = "SYSTEM";
-              memory = true;
-              cpu = true;
-              uptime = true;
-            };
-          }
-        ];
-        services = let
-          homepageCategories = [
-            "Arr"
-            "Media"
-            "Downloads"
-            "Services"
-          ];
-          hl = config.server;
-          mergedServices = hl // hl.podman;
-          homepageServices = x: (lib.attrsets.filterAttrs (
-              name: value: value ? homepage && value.homepage.category == x
-            )
-            mergedServices);
-        in
-          lib.lists.forEach homepageCategories (cat: {
-            "${cat}" =
-              lib.lists.forEach
-              (lib.attrsets.mapAttrsToList (name: value: {
-                inherit name;
-                url = value.url;
-                homepage = value.homepage;
-              }) (homepageServices "${cat}"))
-              (x: {
-                "${x.homepage.name}" = {
-                  icon = x.homepage.icon;
-                  description = x.homepage.description;
-                  href = "https://${x.url}${x.homepage.path or ""}";
-                  siteMonitor = "https://${x.url}${x.homepage.path or ""}";
-                };
-              });
-          })
-          ++ [{Misc = cfg.misc;}]
-          ++ [
-            {
-              Glances = let
-                port = toString config.services.glances.port;
-              in [
-                {
-                  Info = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "info";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-                {
-                  "CPU Temp" = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "sensor:Tctl";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-                {
-                  "GPU Radeon" = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "sensor:junction";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-                {
-                  "GPU Intel" = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "sensor:pkg";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-                {
-                  Processes = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "process";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-                {
-                  Network = {
-                    widget = {
-                      type = "glances";
-                      url = "http://localhost:${port}";
-                      metric = "network:enp6s0";
-                      chart = false;
-                      version = 4;
-                    };
-                  };
-                }
-              ];
-            }
-          ];
-      };
-
-      traefik = {
-        dynamicConfigOptions = {
-          http = {
-            services.homepage.loadBalancer.servers = [
-              {url = "http://127.0.0.1:${toString config.services.${unit}.listenPort}";}
-            ];
-            routers = {
-              homepage = {
-                entryPoints = ["websecure"];
-                rule = "Host(`cnix.dev`)";
-                service = "homepage";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/infra/authentik/default.nix
+++ b/modules/server/infra/authentik/default.nix
@@ -1,15 +1,14 @@
 {
  config,
  lib,
-  pkgs,
  self,
  ...
 }: let
  unit = "authentik";
-  cfg = config.server.${unit};
-  srv = config.server;
+  cfg = config.server.infra.${unit};
+  srv = config.server.infra.www.domain;
 in {
-  options.server.${unit} = {
+  options.server.infra.${unit} = {
    enable = lib.mkEnableOption {
      description = "Enable ${unit}";
    };
@@ -17,6 +16,10 @@ in {
      type = lib.types.str;
      default = "auth.${srv.www.domain}";
    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      description = "The local port the service runs on";
+    };
    cloudflared = {
      credentialsFile = lib.mkOption {
        type = lib.types.str;
@@ -31,21 +34,11 @@ in {
        example = "00000000-0000-0000-0000-000000000000";
      };
    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Authentik";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "An open-source IdP for modern SSO";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "authentik.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Services";
+    homepage = {
+      name = "Authentik";
+      description = "An open-source IdP for modern SSO";
+      icon = "authentik.svg";
+      category = "Services";
    };
  };

@@ -53,24 +46,18 @@ in {
    age.secrets = {
      authentikEnv = {
        file = "${self}/secrets/authentikEnv.age";
-        owner = "authentik";
-        group = "authentik";
-        mode = "0400";
      };
      authentikCloudflared = {
        file = "${self}/secrets/authentikCloudflared.age";
-        owner = "authentik";
-        group = "authentik";
-        mode = "0400";
      };
    };

-    server = {
-      fail2ban = lib.mkIf cfg.enable {
+    server.infra = {
+      fail2ban = {
        jails = {
          authentik = {
            serviceName = "authentik";
-            failRegex = "^.*Username or password is incorrect.*IP:\s*<HOST>";
+            failRegex = ''^.*Username or password is incorrect.*IP:\s*<HOST>'';
          };
        };
      };
@@ -103,7 +90,6 @@ in {
            middlewares = {
              authentik = {
                forwardAuth = {
-                  # tls.insecureSkipVerify = true;
                  address = "https://localhost:9443/outpost.goauthentik.io/auth/traefik";
                  trustForwardHeader = true;
                  authResponseHeaders = [
@@ -134,7 +120,7 @@ in {
            routers = {
              auth = {
                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.url}`) || HostRegexp(`{subdomain:[a-z0-9]+}.${srv.www.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
+                rule = "Host(`${cfg.url}`) && PathPrefix(`/outpost.goauthentik.io/`)";
                service = "auth";
                tls.certResolver = "letsencrypt";
              };
--- a/modules/server/infra/default.nix
+++ b/modules/server/infra/default.nix
@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./authentik
+    ./fail2ban
+    ./keepalived
+    ./podman
+    ./postgres
+    ./tailscale
+    ./traefik
+    ./unbound
+    ./www
+  ];
+}
--- a/modules/server/infra/fail2ban/default.nix
+++ b/modules/server/infra/fail2ban/default.nix
@@ -5,9 +5,9 @@
  pkgs,
  ...
 }: let
-  cfg = config.server.fail2ban;
+  cfg = config.server.infra.fail2ban;
 in {
-  options.server.fail2ban = {
+  options.server.infra.fail2ban = {
    enable = lib.mkEnableOption {
      description = "Enable cloudflare fail2ban";
    };
@@ -30,14 +30,28 @@ in {
              example = "vaultwarden";
              type = lib.types.str;
            };
+            _groupsre = lib.mkOption {
+              type = lib.types.lines;
+              example = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
+              default = "";
+            };
            failRegex = lib.mkOption {
-              type = lib.types.str;
-              example = "Login failed from IP: <HOST>";
+              type = lib.types.lines;
+              example = ''
+                ^Login failed from IP: <HOST>$
+                ^Two-factor challenge failed from <HOST>$
+              '';
            };
            ignoreRegex = lib.mkOption {
              type = lib.types.str;
              default = "";
            };
+            datePattern = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              example = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
+              description = "Optional datepattern line for the fail2ban filter.";
+            };
            maxRetry = lib.mkOption {
              type = lib.types.int;
              default = 3;
@@ -47,6 +61,7 @@ in {
      );
    };
  };
+
  config = lib.mkIf cfg.enable {
    services.fail2ban = {
      enable = true;
@@ -75,10 +90,17 @@ in {
    environment.etc = lib.attrsets.mergeAttrsList [
      (lib.attrsets.mapAttrs' (
          name: value: (lib.nameValuePair "fail2ban/filter.d/${name}.conf" {
-            text = ''
+            text =
+              ''
                [Definition]
                failregex = ${value.failRegex}
                ignoreregex = ${value.ignoreRegex}
+              ''
+              + lib.optionalString (value.datePattern != "") ''
+                datepattern = ${value.datePattern}
+              ''
+              + lib.optionalString (value._groupsre != "") ''
+                _groupsre = ${value._groupsre}
              '';
          })
        )
--- a/modules/server/infra/keepalived/default.nix
+++ b/modules/server/infra/keepalived/default.nix
@@ -3,27 +3,24 @@
  config,
  self,
  ...
-}:
-let
+}: let
  unit = "keepalived";
-  cfg = config.server.${unit};
+  cfg = config.server.infra.${unit};

-  hostCfg =
-    hostname:
-    if hostname == "sobotka" then
-      {
+  hostCfg = hostname:
+    if hostname == "sobotka"
+    then {
      ip = "192.168.88.14";
      priority = 20;
      state = "MASTER";
    }
-    else if hostname == "ziggy" then
-      {
+    else if hostname == "ziggy"
+    then {
      ip = "192.168.88.12";
      priority = 10;
      state = "BACKUP";
    }
-    else
-      throw "No keepalived config defined for host ${hostname}";
+    else throw "No keepalived config defined for host ${hostname}";

  _self = hostCfg config.networking.hostName;

@@ -34,9 +31,8 @@ let

  # Remove self from peers
  peers = builtins.filter (ip: ip != _self.ip) allPeers;
-in
-{
-  options.server.${unit} = {
+in {
+  options.server.infra.${unit} = {
    enable = lib.mkEnableOption {
      description = "Enable ${unit}";
    };
--- a/modules/server/infra/podman/acquis.yaml
+++ b/modules/server/infra/podman/acquis.yaml
@@ -0,0 +1,6 @@
+---
+filenames:
+  - /var/log/traefik/access.log
+poll_without_inotify: true
+labels:
+  type: traefik
--- a/modules/server/infra/podman/default.nix
+++ b/modules/server/infra/podman/default.nix
@@ -0,0 +1,162 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}: let
+  infra = config.server.infra;
+  cfg = config.server.services;
+
+  getPiholeSecret = hostname:
+    if hostname == "ziggy"
+    then [config.age.secrets.piholeZiggy.path]
+    else if hostname == "sobotka"
+    then [config.age.secrets.pihole.path]
+    else throw "Unknown hostname: ${hostname}";
+in {
+  options.server.infra = {
+    podman.enable = lib.mkEnableOption "Enables Podman";
+    gluetun.enable = lib.mkEnableOption "Enables gluetun";
+  };
+  config = lib.mkIf infra.podman.enable {
+    age.secrets = {
+      pihole.file = "${self}/secrets/${config.networking.hostName}Pihole.age";
+      slskd.file = "${self}/secrets/slskd.age";
+    };
+
+    virtualisation = {
+      containers.enable = true;
+      podman.enable = true;
+    };
+
+    networking.firewall = lib.mkIf cfg.pihole.enable {
+      allowedTCPPorts = [
+        53
+        5335
+      ];
+      allowedUDPPorts = [
+        53
+        5335
+      ];
+    };
+
+    virtualisation.oci-containers.containers = lib.mkMerge [
+      (lib.mkIf infra.gluetun.enable {
+        gluetun = {
+          image = "qmcgaw/gluetun";
+          ports = [
+            "8388:8388"
+            "58846:58846"
+            "8080:8080"
+            "5030:5030"
+            "5031:5031"
+            "50300:50300"
+          ];
+          devices = ["/dev/net/tun:/dev/net/tun"];
+          autoStart = true;
+          extraOptions = [
+            "--cap-add=NET_ADMIN"
+          ];
+          volumes = ["/var:/gluetun"];
+          environmentFiles = [
+            config.age.secrets.gluetunEnvironment.path
+          ];
+          environment = {
+            DEV_MODE = "false";
+            VPN_SERVICE_PROVIDER = "mullvad";
+            VPN_TYPE = "wireguard";
+            SERVER_CITIES = "Stockholm";
+          };
+        };
+      })
+
+      (lib.mkIf cfg.qbittorrent.enable {
+        qbittorrent = {
+          image = "ghcr.io/hotio/qbittorrent:latest";
+          autoStart = true;
+          dependsOn = ["gluetun"];
+          ports = [
+            "8080:8080"
+            "58846:58846"
+          ];
+          extraOptions = [
+            "--network=container:gluetun"
+          ];
+          volumes = [
+            "/var/lib/qbittorrent:/config:rw"
+            "/mnt/data/media/downloads:/downloads:rw"
+          ];
+          environmentFiles = [
+            config.age.secrets.gluetunEnvironment.path
+          ];
+          environment = {
+            PUID = "994";
+            PGID = "993";
+            TZ = "Europe/Stockholm";
+            WEBUI_PORT = "${builtins.toString cfg.qbittorrent.port}";
+          };
+        };
+      })
+
+      (lib.mkIf cfg.slskd.enable {
+        slskd = {
+          image = "slskd/slskd:latest";
+          autoStart = true;
+          dependsOn = ["gluetun"];
+          ports = [
+            "5030:5030"
+            "5031:5031"
+            "50300:50300"
+          ];
+          extraOptions = [
+            "--network=container:gluetun"
+          ];
+          volumes = [
+            "/var/lib/slskd:/app:rw"
+            "/mnt/data/media/downloads:/downloads:rw"
+          ];
+          environmentFiles = [
+            config.age.secrets.gluetunEnvironment.path
+            config.age.secrets.slskd.path
+          ];
+          environment = {
+            TZ = "Europe/Stockholm";
+            PUID = "981";
+            PGID = "982";
+            SLSKD_REMOTE_CONFIGURATION = "true";
+            SLSKD_REMOTE_FILE_MANAGEMENT = "true";
+            SLSKD_DOWNLOADS_DIR = "/downloads";
+            SLSKD_UMASK = "022";
+          };
+        };
+      })
+
+      (lib.mkIf cfg.pihole.enable {
+        pihole = {
+          autoStart = true;
+          image = "pihole/pihole:2025.08.0";
+          volumes = [
+            "/var/lib/pihole:/etc/pihole/"
+            "/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
+          ];
+          environment = {
+            TZ = "Europe/Stockholm";
+            CUSTOM_CACHE_SIZE = "0";
+            WEBTHEME = "default-darker";
+          };
+          environmentFiles = getPiholeSecret config.networking.hostName;
+          ports = [
+            "53:53/tcp"
+            "53:53/udp"
+            "8053:80/tcp"
+          ];
+          extraOptions = [
+            "--cap-add=NET_ADMIN"
+            "--cap-add=SYS_NICE"
+            "--cap-add=SYS_TIME"
+          ];
+        };
+      })
+    ];
+  };
+}
--- a/modules/server/infra/postgres/default.nix
+++ b/modules/server/infra/postgres/default.nix
--- a/modules/server/infra/postgres/postgres-upgrade.nix
+++ b/modules/server/infra/postgres/postgres-upgrade.nix
@@ -7,10 +7,10 @@
 }: let
  inherit (lib) types mkOption;

-  cfg = config.server.postgresql;
+  cfg = config.server.infra.postgresql;
 in {
  options = {
-    server.postgresql = {
+    server.infra.postgresql = {
      upgradeTargetPackage = mkOption {
        type = types.nullOr types.package;
        default = null;
--- a/modules/server/infra/postgres/postgres.nix
+++ b/modules/server/infra/postgres/postgres.nix
@@ -7,7 +7,7 @@
 }: let
  inherit (lib) types mkOption;

-  cfg = config.server.postgresql;
+  cfg = config.server.infra.postgresql;

  database = {name, ...}: {
    options = {
@@ -31,7 +31,7 @@
  };
 in {
  options = {
-    server.postgresql = {
+    server.infra.postgresql = {
      databases = mkOption {
        type = types.listOf (types.submodule database);
        default = [];
--- a/modules/server/infra/tailscale/default.nix
+++ b/modules/server/infra/tailscale/default.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}:
+with lib; let
+  cfg = config.server.infra.tailscale;
+in {
+  options.server.infra.tailscale = {
+    enable = mkEnableOption "Enable tailscale server configuration";
+  };
+  config = mkIf cfg.enable {
+    age.secrets.sobotkaTsAuth.file = "${self}/secrets/sobotkaTsAuth.age";
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.age.secrets.sobotkaTsAuth.path;
+      extraSetFlags = [
+        "--advertise-exit-node"
+      ];
+    };
+  };
+}
--- a/modules/server/infra/traefik/default.nix
+++ b/modules/server/infra/traefik/default.nix
@@ -0,0 +1,183 @@
+{
+  lib,
+  clib,
+  config,
+  pkgs,
+  self,
+  ...
+}: let
+  inherit (lib) mkEnableOption mkIf types;
+
+  cfg = config.server.infra.traefik;
+  srv = config.server;
+
+  generateRouters = services: config:
+    lib.mapAttrs' (
+      name: service:
+        lib.nameValuePair name {
+          entryPoints = ["websecure"];
+          # FIX 3: Use backticks for the Host rule and interpolation
+          rule = "Host(`${clib.server.mkFullDomain config service}`)";
+          service = name;
+          tls.certResolver = "letsencrypt";
+        }
+    ) (lib.filterAttrs (_: s: s.enable) services);
+
+  generateServices = services:
+    lib.mapAttrs' (name: service:
+      lib.nameValuePair name {
+        loadBalancer.servers = [{url = "http://localhost:${toString service.port}";}];
+      }) (lib.filterAttrs (name: service: service.enable) services);
+
+  getCloudflareCredentials = hostname:
+    if hostname == "ziggy"
+    then config.age.secrets.cloudflareDnsCredentialsZiggy.path
+    else if hostname == "sobotka"
+    then config.age.secrets.cloudflareDnsCredentials.path
+    else throw "Unknown hostname: ${hostname}";
+in {
+  options.server.infra.traefik = {
+    enable = mkEnableOption "Enable global Traefik reverse proxy with ACME";
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets = {
+      traefikEnv = {
+        file = "${self}/secrets/traefikEnv.age";
+        mode = "640";
+        owner = "traefik";
+        group = "traefik";
+      };
+      crowdsecApi.file = "${self}/secrets/crowdsecApi.age";
+    };
+
+    systemd.services.traefik = {
+      serviceConfig = {
+        EnvironmentFile = [config.age.secrets.traefikEnv.path];
+      };
+    };
+    networking.firewall.allowedTCPPorts = [80 443];
+
+    services = {
+      tailscale.permitCertUid = "traefik";
+      traefik = {
+        enable = true;
+
+        staticConfigOptions = {
+          log = {
+            level = "DEBUG";
+          };
+
+          accesslog = {filepath = "/var/lib/traefik/logs/access.log";};
+
+          tracing = {};
+          api = {
+            dashboard = true;
+            insecure = false;
+          };
+
+          certificatesResolvers = {
+            vpn.tailscale = {};
+            letsencrypt = {
+              acme = {
+                email = "adam@cnst.dev";
+                storage = "/var/lib/traefik/cert.json";
+                dnsChallenge = {
+                  provider = "cloudflare";
+                  resolvers = [
+                    "1.1.1.1:53"
+                    "1.0.0.1:53"
+                  ];
+                };
+              };
+            };
+          };
+
+          entryPoints = {
+            # redis = {
+            #   address = "0.0.0.0:6381";
+            # };
+            # postgres = {
+            #   address = "0.0.0.0:5433";
+            # };
+            web = {
+              address = ":80";
+              forwardedHeaders.insecure = true;
+              http.redirections.entryPoint = {
+                to = "websecure";
+                scheme = "https";
+                permanent = true;
+              };
+              # http.middlewares = "crowdsec@file";
+            };
+
+            websecure = {
+              address = ":443";
+              forwardedHeaders.insecure = true;
+              http.tls = {
+                certResolver = "letsencrypt";
+                domains = [
+                  {
+                    main = "cnix.dev";
+                    sans = ["*.cnix.dev"];
+                  }
+                  {
+                    main = "ts.cnst.dev";
+                    sans = ["*ts.cnst.dev"];
+                  }
+                ];
+              };
+              # http.middlewares = "crowdsec@file";
+            };
+
+            experimental = {
+              address = ":1111";
+              forwardedHeaders.insecure = true;
+            };
+          };
+
+          experimental = {
+            # Install the Crowdsec Bouncer plugin
+            plugins = {
+              #enabled = "true";
+              bouncer = {
+                moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin";
+                version = "v1.4.5";
+              };
+            };
+          };
+        };
+
+        dynamicConfigOptions = {
+          http = {
+            services = generateServices srv.services;
+
+            routers =
+              (generateRouters srv.services config)
+              // {
+                api = {
+                  entryPoints = ["websecure"];
+                  rule = "Host(`traefik.${srv.domain}`)";
+                  service = "api@internal";
+                  tls.certResolver = "letsencrypt";
+                };
+              };
+            # middlewares = {
+            #   crowdsec = {
+            #     plugin = {
+            #       bouncer = {
+            #         enabled = "true";
+            #         logLevel = "DEBUG";
+            #         crowdsecLapiKeyFile = config.age.secrets.crowdsecApi.path;
+            #         crowdsecMode = "live";
+            #         crowdsecLapiHost = ":4223";
+            #       };
+            #     };
+            #   };
+            # };
+          };
+        };
+      };
+    };
+  };
+}
--- a/modules/server/infra/unbound/default.nix
+++ b/modules/server/infra/unbound/default.nix
@@ -5,7 +5,25 @@
  ...
 }: let
  unit = "unbound";
-  cfg = config.server.${unit};
+  cfg = config.server.infra.${unit};
+  srv = config.server;
+
+  svcNames = lib.attrNames srv.services;
+
+  localARecords = builtins.concatLists (map (
+      name: let
+        s = srv.services.${name};
+      in
+        if s != null && s.enable && s.subdomain != null
+        then [''"${s.subdomain}.${srv.domain}. A ${srv.ip}"'']
+        else []
+    )
+    svcNames);
+
+  revParts = lib.lists.reverseList (lib.splitString "." srv.ip);
+  revName = lib.concatStringsSep "." revParts;
+
+  localPTRs = ["${revName}.in-addr.arpa. PTR traefik.${srv.domain}"];

  hostIp = hostname:
    if hostname == "ziggy"
@@ -14,11 +32,12 @@
    then "192.168.88.14"
    else throw "No IP defined for host ${hostname}";
 in {
-  options.server.${unit} = {
+  options.server.infra.${unit} = {
    enable = lib.mkEnableOption {
      description = "Enable ${unit}";
    };
  };
+
  config = lib.mkIf cfg.enable {
    services = {
      # resolved.enable = lib.mkForce false;
@@ -97,6 +116,10 @@ in {
              "255.255.255.255/32"
              "2001:db8::/32"
            ];
+            local-data = localARecords;
+
+            # Example PTR entry: "14.88.168.192.in-addr.arpa. PTR traefik.cnix.dev."
+            # local-data-ptr = localPTRs;
          };
        };
      };
--- a/modules/server/infra/www/default.nix
+++ b/modules/server/infra/www/default.nix
@@ -1,15 +1,13 @@
 {
  lib,
  config,
-  pkgs,
  self,
  ...
 }: let
-  inherit (lib) mkOption mkEnableOption mkIf types;
-  cfg = config.server.www;
-  srv = config.server;
+  inherit (lib) mkIf mkEnableOption mkOption types;
+  cfg = config.server.infra.www;
 in {
-  options.server.www = {
+  options.server.infra.www = {
    enable = mkEnableOption {
      description = "Enable personal website";
    };
@@ -20,6 +18,12 @@ in {
        Public domain name to be used to access the server services via Traefik reverse proxy
      '';
    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 8283;
+      description = "The port to host webservice on.";
+    };
+
    cloudflared = {
      credentialsFile = lib.mkOption {
        type = lib.types.str;
@@ -41,13 +45,13 @@ in {
      wwwCloudflared.file = "${self}/secrets/wwwCloudflared.age";
    };

-    server = {
-      fail2ban = lib.mkIf config.server.www.enable {
+    server.infra = {
+      fail2ban = {
        jails = {
          nginx-404 = {
            serviceName = "nginx";
            failRegex = ''^.*\[error\].*directory index of.* is forbidden.*client: <HOST>.*$'';
-            ignoreRegex = "";
+            ignoreRegex = '''';
            maxRetry = 5;
          };
        };
--- a/modules/server/jellyfin/default.nix
+++ b/modules/server/jellyfin/default.nix
@@ -1,66 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  service = "jellyfin";
-  cfg = config.server.${service};
-  srv = config.server;
-in {
-  options.server.${service} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${service}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${service}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "jellyfin.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Jellyfin";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "The Free Software Media System";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "jellyfin.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Media";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${service} = {
-      enable = true;
-      user = srv.user;
-      group = srv.group;
-    };
-    environment.systemPackages = with pkgs; [
-      jellyfin-ffmpeg
-    ];
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.jellyfin.loadBalancer.servers = [{url = "http://127.0.0.1:8096";}];
-          routers = {
-            jellyfin = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "jellyfin";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/jellyseerr/default.nix
+++ b/modules/server/jellyseerr/default.nix
@@ -1,61 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  service = "jellyseerr";
-  srv = config.server;
-  cfg = config.server.${service};
-in {
-  options.server.${service} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${service}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${service}.${srv.domain}";
-    };
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 5055;
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Jellyseerr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Media request and discovery manager";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "jellyseerr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${service} = {
-      enable = true;
-      port = cfg.port;
-    };
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.jellyseerr.loadBalancer.servers = [{url = "http://127.0.0.1:${toString cfg.port}";}];
-          routers = {
-            jellyseerr = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "jellyseerr";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/lidarr/default.nix
+++ b/modules/server/lidarr/default.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "lidarr";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Lidarr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Music collection manager";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "lidarr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${unit} = {
-      enable = true;
-      user = srv.user;
-      group = srv.group;
-    };
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.lidarr.loadBalancer.servers = [{url = "http://127.0.0.1:8686";}];
-          routers = {
-            lidarr = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "lidarr";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/n8n/default.nix
+++ b/modules/server/n8n/default.nix
@@ -1,64 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "n8n";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "n8n";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "A workflow automation platform";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "n8n.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Services";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services = {
-      n8n = {
-        enable = true;
-        openFirewall = true;
-      };
-
-      traefik = {
-        dynamicConfigOptions = {
-          http = {
-            services.n8n.loadBalancer.servers = [{url = "http://127.0.0.1:5678";}];
-            routers = {
-              n8n = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.url}`)";
-                service = "n8n";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/options.nix
+++ b/modules/server/options.nix
@@ -0,0 +1,180 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption types;
+  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
+  cfg = config.server;
+in {
+  options.server = {
+    enable = lib.mkEnableOption "The server services and configuration variables";
+    email = mkOption {
+      default = "";
+      type = types.str;
+      description = ''
+        Email name to be used to access the server services via Caddy reverse proxy
+      '';
+    };
+    domain = mkOption {
+      default = "";
+      type = types.str;
+      description = ''
+        Domain name to be used to access the server services via Caddy reverse proxy
+      '';
+    };
+    ip = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "The local IP of the service.";
+    };
+    user = lib.mkOption {
+      default = "share";
+      type = lib.types.str;
+      description = ''
+        User to run the server services as
+      '';
+    };
+    group = lib.mkOption {
+      default = "share";
+      type = lib.types.str;
+      description = ''
+        Group to run the server services as
+      '';
+    };
+    uid = lib.mkOption {
+      default = 1000;
+      type = lib.types.int;
+      description = ''
+        UID to run the server services as
+      '';
+    };
+    gid = lib.mkOption {
+      default = 1000;
+      type = lib.types.int;
+      description = ''
+        GID to run the server services as
+      '';
+    };
+    timeZone = lib.mkOption {
+      default = "Europe/Stockholm";
+      type = lib.types.str;
+      description = ''
+        Time zone to be used for the server services
+      '';
+    };
+    services = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
+        options = {
+          enable = lib.mkEnableOption "the service";
+          subdomain = lib.mkOption {
+            type = lib.types.str;
+            default = "";
+            description = "The subdomain for the service (e.g., 'jellyfin')";
+          };
+          exposure = lib.mkOption {
+            type = lib.types.enum ["local" "tunnel" "tailscale"];
+            default = "local";
+            description = "Controls where the service is exposed";
+          };
+          port = lib.mkOption {
+            type = lib.types.int;
+            default = 80;
+            description = "The port to host service on.";
+          };
+          configDir = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/${name}";
+            description = "Configuration directory for ${name}.";
+          };
+          cloudflared = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                credentialsFile = lib.mkOption {
+                  type = lib.types.str;
+                  example = lib.literalExpression ''
+                    pkgs.writeText "cloudflare-credentials.json" '''
+                    {"AccountTag":"secret","TunnelSecret":"secret","TunnelID":"secret"}
+                    '''
+                  '';
+                };
+                tunnelId = lib.mkOption {
+                  type = lib.types.str;
+                  example = "00000000-0000-0000-0000-000000000000";
+                };
+              };
+            };
+            description = "Cloudflare tunnel configuration for this service.";
+          };
+          homepage = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                name = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                  description = "Display name on the homepage.";
+                };
+                description = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                  description = "A short description for the homepage tile.";
+                };
+                icon = lib.mkOption {
+                  type = lib.types.str;
+                  default = "Zervices c00l stuff";
+                  description = "Icon file name for the homepage tile.";
+                };
+                category = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                  description = "Homepage category grouping.";
+                };
+                path = lib.mkOption {
+                  type = lib.types.str;
+                  default = "";
+                  example = "/admin";
+                  description = "Optional path suffix for homepage links (e.g. /admin).";
+                };
+              };
+            };
+            description = "Homepage metadata for this service.";
+          };
+        };
+      }));
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.${cfg.group} = {
+        gid = cfg.gid;
+      };
+      users.${cfg.user} = {
+        uid = cfg.uid;
+        isSystemUser = true;
+        group = cfg.group;
+        extraGroups = ifTheyExist [
+          "audio"
+          "video"
+          "docker"
+          "libvirtd"
+          "qemu-libvirtd"
+          "rtkit"
+          "fail2ban"
+          "vaultwarden"
+          "qbittorrent"
+          "lidarr"
+          "prowlarr"
+          "bazarr"
+          "sonarr"
+          "radarr"
+          "media"
+          "share"
+          "render"
+          "input"
+          "authentik"
+          "traefik"
+        ];
+      };
+    };
+  };
+}
--- a/modules/server/podman/default.nix
+++ b/modules/server/podman/default.nix
@@ -1,321 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}: let
-  srv = config.server;
-  cfg = config.server.podman;
-
-  piholeUrl =
-    if config.networking.hostName == "sobotka"
-    then "pihole0"
-    else if config.networking.hostName == "ziggy"
-    then "pihole1"
-    else throw "Unknown hostname";
-
-  getPiholeSecret = hostname:
-    if hostname == "ziggy"
-    then [config.age.secrets.piholeZiggy.path]
-    else if hostname == "sobotka"
-    then [config.age.secrets.pihole.path]
-    else throw "Unknown hostname: ${hostname}";
-in {
-  options.server.podman = {
-    enable = lib.mkEnableOption "Enables Podman";
-    gluetun.enable = lib.mkEnableOption "Enables gluetun";
-
-    qbittorrent = {
-      enable = lib.mkEnableOption "Enable qBittorrent";
-      url = lib.mkOption {
-        type = lib.types.str;
-        default = "qbt.${srv.domain}";
-      };
-      port = lib.mkOption {
-        type = lib.types.int;
-        default = 8080;
-        description = "The port to host qBittorrent on.";
-      };
-      homepage.name = lib.mkOption {
-        type = lib.types.str;
-        default = "qBittorrent";
-      };
-      homepage.description = lib.mkOption {
-        type = lib.types.str;
-        default = "Torrent client";
-      };
-      homepage.icon = lib.mkOption {
-        type = lib.types.str;
-        default = "qbittorrent.svg";
-      };
-      homepage.category = lib.mkOption {
-        type = lib.types.str;
-        default = "Downloads";
-      };
-    };
-
-    slskd = {
-      enable = lib.mkEnableOption "Enable Soulseek";
-      url = lib.mkOption {
-        type = lib.types.str;
-        default = "slskd.${srv.domain}";
-      };
-      port = lib.mkOption {
-        type = lib.types.int;
-        default = 5030;
-        description = "The port to host Soulseek webui on.";
-      };
-      homepage.name = lib.mkOption {
-        type = lib.types.str;
-        default = "slskd";
-      };
-      homepage.description = lib.mkOption {
-        type = lib.types.str;
-        default = "Web-based Soulseek client";
-      };
-      homepage.icon = lib.mkOption {
-        type = lib.types.str;
-        default = "slskd.svg";
-      };
-      homepage.category = lib.mkOption {
-        type = lib.types.str;
-        default = "Downloads";
-      };
-    };
-
-    pihole = {
-      enable = lib.mkEnableOption {
-        description = "Enable";
-      };
-      port = lib.mkOption {
-        type = lib.types.int;
-        default = 8053;
-        description = "The port to host PiHole on.";
-      };
-      url = lib.mkOption {
-        type = lib.types.str;
-        default = "${piholeUrl}.${srv.domain}";
-      };
-      homepage.name = lib.mkOption {
-        type = lib.types.str;
-        default = "PiHole";
-      };
-      homepage.description = lib.mkOption {
-        type = lib.types.str;
-        default = "Adblocking and DNS service";
-      };
-      homepage.icon = lib.mkOption {
-        type = lib.types.str;
-        default = "pi-hole.svg";
-      };
-      homepage.category = lib.mkOption {
-        type = lib.types.str;
-        default = "Services";
-      };
-      homepage.path = lib.mkOption {
-        type = lib.types.str;
-        default = "/admin";
-        description = "Optional path suffix for homepage links (e.g. /admin).";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    age.secrets = {
-      pihole.file = "${self}/secrets/${config.networking.hostName}Pihole.age";
-      slskd.file = "${self}/secrets/slskd.age";
-    };
-
-    virtualisation = {
-      containers.enable = true;
-      podman.enable = true;
-    };
-
-    networking.firewall = lib.mkIf cfg.pihole.enable {
-      allowedTCPPorts = [
-        53
-        5335
-      ];
-      allowedUDPPorts = [
-        53
-        5335
-      ];
-    };
-
-    services.traefik = lib.mkMerge [
-      (lib.mkIf cfg.pihole.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              pihole.loadBalancer.servers = [{url = "http://localhost:${toString cfg.pihole.port}";}];
-            };
-            routers = {
-              pihole = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.pihole.url}`)";
-                service = "pihole";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-
-      (lib.mkIf cfg.qbittorrent.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              qbittorrent.loadBalancer.servers = [{url = "http://localhost:${toString cfg.qbittorrent.port}";}];
-            };
-            routers = {
-              qbittorrent = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.qbittorrent.url}`)";
-                service = "qbittorrent";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-
-      (lib.mkIf cfg.slskd.enable {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              slskd.loadBalancer.servers = [{url = "http://localhost:${toString cfg.slskd.port}";}];
-            };
-            routers = {
-              slskd = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.slskd.url}`)";
-                service = "slskd";
-                tls.certResolver = "letsencrypt";
-              };
-            };
-          };
-        };
-      })
-    ];
-
-    virtualisation.oci-containers.containers = lib.mkMerge [
-      (lib.mkIf cfg.gluetun.enable {
-        gluetun = {
-          image = "qmcgaw/gluetun";
-          ports = [
-            "8388:8388"
-            "58846:58846"
-            "8080:8080"
-            "5030:5030"
-            "5031:5031"
-            "50300:50300"
-          ];
-          devices = ["/dev/net/tun:/dev/net/tun"];
-          autoStart = true;
-          extraOptions = [
-            "--cap-add=NET_ADMIN"
-          ];
-          volumes = ["/var:/gluetun"];
-          environmentFiles = [
-            config.age.secrets.gluetunEnvironment.path
-          ];
-          environment = {
-            DEV_MODE = "false";
-            VPN_SERVICE_PROVIDER = "mullvad";
-            VPN_TYPE = "wireguard";
-            SERVER_CITIES = "Stockholm";
-          };
-        };
-      })
-
-      (lib.mkIf cfg.qbittorrent.enable {
-        qbittorrent = {
-          image = "ghcr.io/hotio/qbittorrent:latest";
-          autoStart = true;
-          dependsOn = ["gluetun"];
-          ports = [
-            "8080:8080"
-            "58846:58846"
-          ];
-          extraOptions = [
-            "--network=container:gluetun"
-          ];
-          volumes = [
-            "/var/lib/qbittorrent:/config:rw"
-            "/mnt/data/media/downloads:/downloads:rw"
-          ];
-          environmentFiles = [
-            config.age.secrets.gluetunEnvironment.path
-          ];
-          environment = {
-            PUID = "994";
-            PGID = "993";
-            TZ = "Europe/Stockholm";
-            WEBUI_PORT = "${builtins.toString cfg.qbittorrent.port}";
-          };
-        };
-      })
-
-      (lib.mkIf cfg.slskd.enable {
-        slskd = {
-          image = "slskd/slskd:latest";
-          autoStart = true;
-          dependsOn = ["gluetun"];
-          ports = [
-            "5030:5030"
-            "5031:5031"
-            "50300:50300"
-          ];
-          extraOptions = [
-            "--network=container:gluetun"
-          ];
-          volumes = [
-            "/var/lib/slskd:/app:rw"
-            "/mnt/data/media/downloads:/downloads:rw"
-          ];
-          environmentFiles = [
-            config.age.secrets.gluetunEnvironment.path
-            config.age.secrets.slskd.path
-          ];
-          environment = {
-            TZ = "Europe/Stockholm";
-            PUID = "981";
-            PGID = "982";
-            SLSKD_REMOTE_CONFIGURATION = "true";
-            SLSKD_REMOTE_FILE_MANAGEMENT = "true";
-            SLSKD_DOWNLOADS_DIR = "/downloads";
-            SLSKD_UMASK = "022";
-          };
-        };
-      })
-
-      (lib.mkIf cfg.pihole.enable {
-        pihole = {
-          autoStart = true;
-          image = "pihole/pihole:latest";
-          volumes = [
-            "/var/lib/pihole:/etc/pihole/"
-            "/var/lib/dnsmasq.d:/etc/dnsmasq.d/"
-          ];
-          environment = {
-            TZ = "Europe/Stockholm";
-            CUSTOM_CACHE_SIZE = "0";
-            WEBTHEME = "default-darker";
-          };
-          environmentFiles = getPiholeSecret config.networking.hostName;
-          ports = [
-            "53:53/tcp"
-            "53:53/udp"
-            "8053:80/tcp"
-          ];
-          extraOptions = [
-            "--cap-add=NET_ADMIN"
-            "--cap-add=SYS_NICE"
-            "--cap-add=SYS_TIME"
-          ];
-        };
-      })
-    ];
-  };
-}
--- a/modules/server/prowlarr/default.nix
+++ b/modules/server/prowlarr/default.nix
@@ -1,80 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "prowlarr";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Prowlarr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "PVR indexer";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "prowlarr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services = {
-      ${unit} = {
-        enable = true;
-      };
-      flaresolverr = {
-        enable = true;
-      };
-
-      traefik = {
-        dynamicConfigOptions = {
-          http = {
-            services = {
-              prowlarr = {
-                loadBalancer.servers = [{url = "http://127.0.0.1:9696";}];
-              };
-              flaresolverr = {
-                loadBalancer.servers = [{url = "http://127.0.0.1:8191";}];
-              };
-            };
-            routers = {
-              prowlarr = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.url}`)";
-                service = "prowlarr";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-              flaresolverr = {
-                entryPoints = ["websecure"];
-                rule = "Host(`flaresolverr.${srv.domain}`)";
-                service = "flaresolverr";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/radarr/default.nix
+++ b/modules/server/radarr/default.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "radarr";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Radarr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Film collection manager";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "radarr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${unit} = {
-      enable = true;
-      user = srv.user;
-      group = srv.group;
-    };
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.radarr.loadBalancer.servers = [{url = "http://127.0.0.1:7878";}];
-          routers = {
-            radarr = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "radarr";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/services/bazarr/default.nix
+++ b/modules/server/services/bazarr/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "bazarr";
+  srv = config.server;
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      user = srv.user;
+      group = srv.group;
+    };
+  };
+}
--- a/modules/server/services/default.nix
+++ b/modules/server/services/default.nix
@@ -0,0 +1,18 @@
+{
+  imports = [
+    ./bazarr
+    ./flaresolverr
+    ./gitea
+    ./homepage-dashboard
+    ./jellyfin
+    ./jellyseerr
+    ./lidarr
+    ./n8n
+    ./nextcloud
+    ./prowlarr
+    ./radarr
+    ./sonarr
+    ./uptime-kuma
+    ./vaultwarden
+  ];
+}
--- a/modules/server/services/flaresolverr/default.nix
+++ b/modules/server/services/flaresolverr/default.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "flaresolverr";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services = {
+      ${unit} = {
+        enable = true;
+      };
+    };
+  };
+}
--- a/modules/server/services/gitea/default.nix
+++ b/modules/server/services/gitea/default.nix
@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}: let
+  unit = "gitea";
+  cfg = config.server.services.${unit};
+  domain = "${cfg.subdomain}.${config.server.infra.www.url}";
+in {
+  config = lib.mkIf cfg.enable {
+    age.secrets.giteaCloudflared.file = "${self}/secrets/giteaCloudflared.age";
+
+    server.infra = {
+      fail2ban.jails.${unit} = {
+        serviceName = "${unit}";
+        failRegex = ''.*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>'';
+      };
+
+      postgresql.databases = [
+        {database = "gitea";}
+      ];
+    };
+
+    services = {
+      cloudflared = {
+        enable = true;
+        tunnels.${cfg.cloudflared.tunnelId} = {
+          credentialsFile = cfg.cloudflared.credentialsFile;
+          default = "http_status:404";
+          ingress."${domain}".service = "http://localhost:${toString cfg.port}";
+        };
+      };
+
+      gitea = {
+        enable = true;
+        appName = "cnix code forge";
+
+        database = {
+          type = "postgres";
+          socket = "/run/postgresql";
+          name = "gitea";
+          user = "gitea";
+          createDatabase = false;
+        };
+
+        lfs.enable = true;
+
+        settings = {
+          cors = {
+            ENABLED = true;
+            SCHEME = "https";
+            ALLOW_DOMAIN = domain;
+          };
+
+          log.MODE = "console";
+
+          mailer = {
+            ENABLED = false;
+            MAILER_TYPE = "sendmail";
+            FROM = "noreply+adam@cnst.dev";
+            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
+          };
+
+          picture.DISABLE_GRAVATAR = true;
+
+          repository = {
+            DEFAULT_BRANCH = "main";
+            DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
+            DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
+          };
+
+          indexer.REPO_INDEXER_ENABLED = true;
+
+          oauth2_client = {
+            ENABLE_AUTO_REGISTRATION = true;
+            ACCOUNT_LINKING = "auto";
+          };
+
+          server = {
+            DOMAIN = domain;
+            LANDING_PAGE = "explore";
+            HTTP_PORT = cfg.port;
+            ROOT_URL = "https://${domain}/";
+          };
+
+          security.DISABLE_GIT_HOOKS = false;
+          service.DISABLE_REGISTRATION = true;
+          session.COOKIE_SECURE = true;
+        };
+      };
+    };
+  };
+}
--- a/modules/server/services/homepage-dashboard/default.nix
+++ b/modules/server/services/homepage-dashboard/default.nix
@@ -0,0 +1,227 @@
+{
+  config,
+  lib,
+  self,
+  clib,
+  ...
+}: let
+  unit = "homepage-dashboard";
+  cfg = config.server.services.${unit};
+  srv = config.server;
+in {
+  config = lib.mkIf cfg.enable {
+    age.secrets = {
+      homepageEnvironment = {
+        file = "${self}/secrets/homepageEnvironment.age";
+      };
+    };
+
+    services = {
+      glances.enable = true;
+
+      ${unit} = {
+        enable = true;
+        environmentFile = config.age.secrets.homepageEnvironment.path;
+
+        settings = {
+          color = "stone";
+          theme = "dark";
+          headerStyle = "clean";
+          statusStyle = "dot";
+          hideVersion = true;
+          useEqualHeights = true;
+
+          layout = [
+            {
+              Glances = {
+                header = false;
+                style = "row";
+                columns = 4;
+              };
+            }
+            {
+              Arr = {
+                header = true;
+                style = "column";
+              };
+            }
+            {
+              Downloads = {
+                header = true;
+                style = "column";
+              };
+            }
+            {
+              Media = {
+                header = true;
+                style = "column";
+              };
+            }
+            {
+              Services = {
+                header = true;
+                style = "column";
+              };
+            }
+          ];
+        };
+
+        widgets = [
+          {
+            openmeteo = {
+              label = "Kalmar";
+              timezone = "Europe/Stockholm";
+              units = "metric";
+              cache = 5;
+              latitude = 56.707262;
+              longitude = 16.324541;
+            };
+          }
+          {
+            resources = {
+              label = "SYSTEM";
+              memory = true;
+              cpu = true;
+              uptime = false;
+            };
+          }
+        ];
+
+        services = let
+          homepageCategories = [
+            "Arr"
+            "Media"
+            "Downloads"
+            "Services"
+          ];
+          allServices = srv.services;
+
+          getDomain = s: clib.server.mkHostDomain config s;
+
+          homepageServicesFor = category:
+            lib.filterAttrs
+            (
+              name: value:
+                name
+                != unit
+                && value ? homepage
+                && value.homepage.category == category
+            )
+            allServices;
+        in
+          lib.lists.forEach homepageCategories (cat: {
+            "${cat}" =
+              lib.lists.forEach
+              (lib.attrsets.mapAttrsToList (name: _value: name) (homepageServicesFor cat))
+              (x: let
+                service = allServices.${x};
+                domain = getDomain service;
+              in {
+                "${service.homepage.name}" = {
+                  icon = service.homepage.icon;
+                  description = service.homepage.description;
+                  href = "https://${service.subdomain}.${domain}${service.homepage.path or ""}";
+                  siteMonitor = "https://${service.subdomain}.${domain}${x.homepage.path or ""}";
+                };
+              });
+          })
+          ++ [
+            {
+              Glances = let
+                glancesShared = {
+                  type = "glances";
+                  url = "http://localhost:${toString config.services.glances.port}";
+                  chart = true;
+                  version = 4;
+                };
+              in [
+                {
+                  Memory = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "memory";
+                        refreshInterval = 2000;
+                        pointsLimit = 30;
+                      };
+                  };
+                }
+                {
+                  "CPU Usage" = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "cpu";
+                        refreshInterval = 2000;
+                        pointsLimit = 30;
+                      };
+                  };
+                }
+
+                {
+                  "CPU Temp" = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "sensor:Tctl";
+                        refreshInterval = 5000;
+                        pointsLimit = 20;
+                      };
+                  };
+                }
+                {
+                  "GPU Radeon" = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "sensor:junction";
+                      };
+                  };
+                }
+                {
+                  "GPU Intel" = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "sensor:pkg";
+                      };
+                  };
+                }
+                {
+                  "ZFS Pool" = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "fs:/mnt/data";
+                        refreshInterval = 30000;
+                        pointsLimit = 20;
+                        diskUnits = "bytes";
+                      };
+                  };
+                }
+
+                {
+                  Processes = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "process";
+                      };
+                  };
+                }
+                {
+                  Network = {
+                    widget =
+                      glancesShared
+                      // {
+                        metric = "network:enp6s0";
+                      };
+                  };
+                }
+              ];
+            }
+          ];
+      };
+    };
+  };
+}
--- a/modules/server/services/jellyfin/default.nix
+++ b/modules/server/services/jellyfin/default.nix
@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  unit = "jellyfin";
+  cfg = config.server.services.${unit};
+  srv = config.server;
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      user = srv.user;
+      group = srv.group;
+    };
+    environment.systemPackages = with pkgs; [
+      jellyfin-ffmpeg
+    ];
+  };
+}
--- a/modules/server/services/jellyseerr/default.nix
+++ b/modules/server/services/jellyseerr/default.nix
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "jellyseerr";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      port = cfg.port;
+    };
+  };
+}
--- a/modules/server/services/lidarr/default.nix
+++ b/modules/server/services/lidarr/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "lidarr";
+  srv = config.server;
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      user = srv.user;
+      group = srv.group;
+    };
+  };
+}
--- a/modules/server/services/n8n/default.nix
+++ b/modules/server/services/n8n/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "n8n";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services = {
+      n8n = {
+        enable = true;
+        openFirewall = true;
+      };
+    };
+  };
+}
--- a/modules/server/services/nextcloud/default.nix
+++ b/modules/server/services/nextcloud/default.nix
@@ -6,64 +6,30 @@
  ...
 }: let
  unit = "nextcloud";
-  cfg = config.server.${unit};
+  cfg = config.server.services.${unit};
  srv = config.server;
 in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    adminpassFile = lib.mkOption {
-      type = lib.types.path;
-    };
-    adminuser = lib.mkOption {
-      type = lib.types.str;
-      default = "cnst";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "cloud.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Nextcloud";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "A safe home for all your data";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "nextcloud.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Services";
-    };
-  };
  config = lib.mkIf cfg.enable {
    age.secrets = {
      nextcloudAdminPass.file = "${self}/secrets/nextcloudAdminPass.age";
      nextcloudCloudflared.file = "${self}/secrets/nextcloudCloudflared.age";
    };

-    server.fail2ban = lib.mkIf config.server.fail2ban.enable {
-      jails = {
-        nextcloud = {
-          serviceName = "phpfpm-nextcloud";
-          failRegex = "^.*Login failed:.*(Remote IP: <HOST>).*$";
-        };
-      };
+    server.infra.fail2ban.jails.nextcloud = {
+      serviceName = "${unit}";
+      _groupsre = ''(?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)'';
+      failRegex = ''
+        ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+                    ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
+                    ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+      '';
+      datePattern = '',?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"'';
    };

    services = {
      ${unit} = {
        enable = true;
-        package = pkgs.nextcloud31;
+        package = pkgs.nextcloud32;
        hostName = "nextcloud";
        configureRedis = true;
        caching = {
@@ -101,7 +67,7 @@ in {
          dbhost = "/run/postgresql";
          dbname = "nextcloud";
          adminuser = "cnst";
-          adminpassFile = cfg.adminpassFile;
+          adminpassFile = config.age.secrets.nextcloudAdminPass.path;
        };
      };

@@ -120,21 +86,9 @@ in {
          forceSSL = false;
        };
      };
-
-      traefik.dynamicConfigOptions.http = {
-        routers.nextcloud = {
-          entryPoints = ["websecure"];
-          rule = "Host(`${cfg.url}`)";
-          service = "nextcloud";
-          tls.certResolver = "letsencrypt";
-        };
-        services.nextcloud.loadBalancer.servers = [
-          {url = "http://127.0.0.1:8182";}
-        ];
-      };
    };

-    server.postgresql.databases = [
+    server.infra.postgresql.databases = [
      {
        database = "nextcloud";
      }
--- a/modules/server/services/prowlarr/default.nix
+++ b/modules/server/services/prowlarr/default.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "prowlarr";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services = {
+      ${unit} = {
+        enable = true;
+      };
+    };
+  };
+}
--- a/modules/server/services/radarr/default.nix
+++ b/modules/server/services/radarr/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "radarr";
+  srv = config.server;
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      user = srv.user;
+      group = srv.group;
+    };
+  };
+}
--- a/modules/server/services/sonarr/default.nix
+++ b/modules/server/services/sonarr/default.nix
@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "sonarr";
+  srv = config.server;
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services.${unit} = {
+      enable = true;
+      user = srv.user;
+      group = srv.group;
+    };
+  };
+}
--- a/modules/server/services/uptime-kuma/default.nix
+++ b/modules/server/services/uptime-kuma/default.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  unit = "uptime-kuma";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    services = {
+      ${unit} = {
+        enable = true;
+      };
+    };
+  };
+}
--- a/modules/server/services/vaultwarden/default.nix
+++ b/modules/server/services/vaultwarden/default.nix
@@ -0,0 +1,59 @@
+# from @fufexan & @notthebee
+{
+  config,
+  lib,
+  self,
+  ...
+}: let
+  unit = "vaultwarden";
+  cfg = config.server.services.${unit};
+  domain = "${cfg.subdomain}.${config.server.infra.www.url}";
+in {
+  config = lib.mkIf cfg.enable {
+    age.secrets = {
+      vaultwardenCloudflared.file = "${self}/secrets/vaultwardenCloudflared.age";
+      vaultwardenEnvironment.file = "${self}/secrets/vaultwardenEnvironment.age";
+    };
+
+    server.infra.fail2ban.jails.${unit} = {
+      serviceName = "${unit}";
+      failRegex = ''^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$'';
+    };
+
+    services = {
+      cloudflared = {
+        enable = true;
+        tunnels.${cfg.cloudflared.tunnelId} = {
+          credentialsFile = cfg.cloudflared.credentialsFile;
+          default = "http_status:404";
+          ingress."${domain}".service = "http://localhost:${toString cfg.port}";
+        };
+      };
+
+      vaultwarden = {
+        enable = true;
+        environmentFile = config.age.secrets.vaultwardenEnvironment.path;
+
+        backupDir = "/var/backup/vaultwarden";
+
+        config = {
+          DOMAIN = "https://${domain}";
+          SIGNUPS_ALLOWED = false;
+          ROCKET_ADDRESS = "127.0.0.1";
+          ROCKET_PORT = cfg.port;
+          IP_HEADER = "CF-Connecting-IP";
+
+          logLevel = "warn";
+          extendedLogging = true;
+          useSyslog = true;
+          invitationsAllowed = true;
+          showPasswordHint = false;
+        };
+      };
+    };
+    systemd.services.backup-vaultwarden.serviceConfig = {
+      User = "root";
+      Group = "root";
+    };
+  };
+}
--- a/modules/server/sonarr/default.nix
+++ b/modules/server/sonarr/default.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "sonarr";
-  srv = config.server;
-  cfg = config.server.${unit};
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${unit}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${unit}.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Sonarr";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Series collection manager";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "sonarr.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Arr";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services.${unit} = {
-      enable = true;
-      user = srv.user;
-      group = srv.group;
-    };
-    services.traefik = {
-      dynamicConfigOptions = {
-        http = {
-          services.sonarr.loadBalancer.servers = [{url = "http://127.0.0.1:8989";}];
-          routers = {
-            sonarr = {
-              entryPoints = ["websecure"];
-              rule = "Host(`${cfg.url}`)";
-              service = "sonarr";
-              tls.certResolver = "letsencrypt";
-              # middlewares = ["authentik"];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/traefik/default.nix
+++ b/modules/server/traefik/default.nix
@@ -1,100 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  self,
-  ...
-}: let
-  inherit (lib) mkEnableOption mkIf types;
-
-  cfg = config.server.traefik;
-  getCloudflareCredentials = hostname:
-    if hostname == "ziggy"
-    then config.age.secrets.cloudflareDnsCredentialsZiggy.path
-    else if hostname == "sobotka"
-    then config.age.secrets.cloudflareDnsCredentials.path
-    else throw "Unknown hostname: ${hostname}";
-in {
-  options.server.traefik = {
-    enable = mkEnableOption "Enable global Traefik reverse proxy with ACME";
-  };
-
-  config = mkIf cfg.enable {
-    age.secrets.traefikEnv = {
-      file = "${self}/secrets/traefikEnv.age";
-      mode = "640";
-      owner = "root";
-      group = "traefik";
-    };
-
-    systemd.services.traefik = {
-      serviceConfig = {
-        EnvironmentFile = [config.age.secrets.traefikEnv.path];
-      };
-    };
-    networking.firewall.allowedTCPPorts = [80 443];
-
-    services = {
-      tailscale.permitCertUid = "traefik";
-      traefik = {
-        enable = true;
-
-        staticConfigOptions = {
-          log = {
-            level = "DEBUG";
-          };
-
-          tracing = {};
-          api = {
-            dashboard = true;
-          };
-          certificatesResolvers = {
-            tailscale.tailscale = {};
-            letsencrypt = {
-              acme = {
-                email = "adam@cnst.dev";
-                storage = "/var/lib/traefik/cert.json";
-                dnsChallenge = {
-                  provider = "cloudflare";
-                  resolvers = [
-                    "1.1.1.1:53"
-                    "1.0.0.1:53"
-                  ];
-                };
-              };
-            };
-          };
-
-          entryPoints = {
-            redis = {
-              address = "0.0.0.0:6381";
-            };
-            postgres = {
-              address = "0.0.0.0:5433";
-            };
-            web = {
-              address = "0.0.0.0:80";
-              http.redirections.entryPoint = {
-                to = "websecure";
-                scheme = "https";
-                permanent = true;
-              };
-            };
-            websecure = {
-              address = "0.0.0.0:443";
-              http.tls = {
-                certResolver = "letsencrypt";
-                domains = [
-                  {
-                    main = "cnix.dev";
-                    sans = ["*.cnix.dev"];
-                  }
-                ];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/uptime-kuma/default.nix
+++ b/modules/server/uptime-kuma/default.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  unit = "uptime-kuma";
-  cfg = config.server.${unit};
-  srv = config.server;
-in {
-  options.server.${unit} = {
-    enable = lib.mkEnableOption {
-      description = "Enable ${unit}";
-    };
-    configDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/uptime-kuma";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "uptime.${srv.domain}";
-    };
-    homepage.name = lib.mkOption {
-      type = lib.types.str;
-      default = "Uptime Kuma";
-    };
-    homepage.description = lib.mkOption {
-      type = lib.types.str;
-      default = "Service monitoring tool";
-    };
-    homepage.icon = lib.mkOption {
-      type = lib.types.str;
-      default = "uptime-kuma.svg";
-    };
-    homepage.category = lib.mkOption {
-      type = lib.types.str;
-      default = "Services";
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    services = {
-      ${unit} = {
-        enable = true;
-      };
-      traefik = {
-        dynamicConfigOptions = {
-          http = {
-            services.uptime-kuma.loadBalancer.servers = [{url = "http://127.0.0.1:3001";}];
-            routers = {
-              uptime-kuma = {
-                entryPoints = ["websecure"];
-                rule = "Host(`${cfg.url}`)";
-                service = "uptime-kuma";
-                tls.certResolver = "letsencrypt";
-                # middlewares = ["authentik"];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/modules/server/vaultwarden/default.nix
+++ b/modules/server/vaultwarden/default.nix
@@ -1,89 +0,0 @@
-# from @fufexan & @notthebee
-{
-  config,
-  lib,
-  self,
-  ...
-}: let
-  inherit (lib) mkIf mkEnableOption;
-  vcfg = config.services.vaultwarden.config;
-  cfg = config.server.vaultwarden;
-in {
-  options = {
-    server.vaultwarden = {
-      enable = mkEnableOption "Enables vaultwarden";
-      url = lib.mkOption {
-        type = lib.types.str;
-        default = "${cfg.domain}";
-      };
-      cloudflared = {
-        credentialsFile = lib.mkOption {
-          type = lib.types.str;
-          example = lib.literalExpression ''
-            pkgs.writeText "cloudflare-credentials.json" '''
-            {"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
-            '''
-          '';
-        };
-        tunnelId = lib.mkOption {
-          type = lib.types.str;
-          example = "00000000-0000-0000-0000-000000000000";
-        };
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    age.secrets = {
-      vaultwardenCloudflared.file = "${self}/secrets/vaultwardenCloudflared.age";
-      vaultwardenEnvironment.file = "${self}/secrets/vaultwardenEnvironment.age";
-    };
-
-    server = {
-      fail2ban = lib.mkIf config.server.fail2ban.enable {
-        jails = {
-          vaultwarden = {
-            serviceName = "vaultwarden";
-            failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
-          };
-        };
-      };
-    };
-
-    systemd.services.backup-vaultwarden.serviceConfig = {
-      User = "root";
-      Group = "root";
-    };
-
-    services = {
-      vaultwarden = {
-        enable = true;
-        environmentFile = config.age.secrets.vaultwardenEnvironment.path;
-
-        backupDir = "/var/backup/vaultwarden";
-
-        config = {
-          DOMAIN = "https://${cfg.url}";
-          SIGNUPS_ALLOWED = false;
-          ROCKET_ADDRESS = "127.0.0.1";
-          ROCKET_PORT = 8222;
-          IP_HEADER = "CF-Connecting-IP";
-
-          logLevel = "warn";
-          extendedLogging = true;
-          useSyslog = true;
-          invitationsAllowed = false;
-          showPasswordHint = false;
-        };
-      };
-      cloudflared = {
-        enable = true;
-        tunnels.${cfg.cloudflared.tunnelId} = {
-          credentialsFile = cfg.cloudflared.credentialsFile;
-          default = "http_status:404";
-          ingress."${cfg.url}".service = "http://${vcfg.ROCKET_ADDRESS}:${toString vcfg.ROCKET_PORT}";
-        };
-      };
-    };
-  };
-}
--- a/modules/settings/accounts/default.nix
+++ b/modules/settings/accounts/default.nix
@@ -2,8 +2,7 @@
  lib,
  config,
  ...
-}:
-let
+}: let
  inherit (lib) mkOption types;

  sshKeys = {
@@ -16,14 +15,14 @@ let
  keyName = config.settings.accounts.sshUser or null;

  selectedKey =
-    if keyName != null then
+    if keyName != null
+    then
      lib.attrByPath [
        keyName
-      ] (builtins.abort "No SSH key defined for hostname/key '${toString keyName}'") sshKeys
-    else
-      builtins.abort "No accounts.sshUser provided, cannot select SSH key.";
-in
-{
+      ] (builtins.abort "No SSH key defined for hostname/key '${toString keyName}'")
+      sshKeys
+    else builtins.abort "No accounts.sshUser provided, cannot select SSH key.";
+in {
  options.settings.accounts = {
    username = mkOption {
      type = types.str;
@@ -46,5 +45,21 @@ in
      default = null;
      description = "Optional override for selecting an SSH key by name";
    };
+    domains = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          local = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = "The local domain of the host";
+          };
+          public = lib.mkOption {
+            type = lib.types.str;
+            default = "example.com";
+            description = "The public domain of the host";
+          };
+        };
+      };
+    };
  };
 }
--- a/secrets/crowdsecApi.age
+++ b/secrets/crowdsecApi.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg lf7aPbZX2v3WGzE/KI/069DBObphqrDtjq7rhNriGl8
+Vv+Pqk6DbcE5R1A9135gVKroCex1xKsCLPETZdT3yTg
+-> ssh-ed25519 KUYMFA XxtBSmCwrQCZ9G3VcCrbzTdMshTK1pjlHPYj7fke818
+9tO2EcnHPD6v3TNeuZdL+zP39SM5R5q7om5sCFDB8lg
+-> ssh-ed25519 76RhUQ I6O/fYFRqYxExC9uLijZr6/kFze7uze0cIudCsl2jTo
+WAwb822vVj5UtUAdE1oVJ0/q6nQbWqdx0OHuGEogO7M
+-> ssh-ed25519 Jf8sqw gWBoe4HhXNw7Ih58lQ/L2vBoQfbU1ht8+ZSLUx/4TWk
+xor0ieJ2UI5bK4rSlCM0dX61PVbxYE37FNry0YSmHG4
+--- Cp8b3eTb3NfjPFvBE12a2c+Yni2jW6DZUK10IaXmmvo
+w<EFBFBD>xq<EFBFBD><EFBFBD>z:<3A>.{<7B>?<3F><><EFBFBD>f<EFBFBD><66><1D><><16><>A<EFBFBD>jT<6A><54>{<7B>J <20><>
--- a/secrets/giteaCloudflared.age
+++ b/secrets/giteaCloudflared.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg RnlIwFO8LSwzj94G0Uru9qibXqOOpCU2kWWdNa2tRFU
+lIC3K/jjBMKRfLfepoNYIkBe5rhHuR0l3Uf1Xuk8uZg
+-> ssh-ed25519 KUYMFA k16GBRcaaSwJm/8+Vm2QBOu05u6eEro/7YYj7kbuNSU
+VCpt918MBBFfFZKKypV9pSwz/Zhsxr+Ob6YjFuJ/oL0
+-> ssh-ed25519 76RhUQ FIKn3nuOT1ywu6pmYBbpC54HhpJGeMFejp5c0XibfAY
+WDsh/5G4wXYt21yIDxmI6u1l/xPOdZRxgTazf6QLXP8
+-> ssh-ed25519 Jf8sqw 2EvD96Ec8h97ACoOBYzn1Ugx4ZyYSHIRnsmtB5lb/XQ
+mFY8O8qwWWihsLe5ayB5iGm1JUY2B/9el/XSf5sPe7M
+--- uuwibRk7LS4/lUx9gwL+x5NMrxLjGM1Yf55bzjxQTKM
+<EFBFBD>H<>Ԅ6K<36>A<01>~<7E><>)!B<08><>^S!Wd<><64>$.:S'c<>d<EFBFBD><64><EFBFBD>_WW<57>Bj<42>,<2C><>l<EFBFBD><6C><EFBFBD><EFBFBD><EFBFBD>V<>S<EFBFBD><53>h<EFBFBD>
+h<EFBFBD><EFBFBD><12><>k
--- a/secrets/homepageEnvironment.age
+++ b/secrets/homepageEnvironment.age
--- a/secrets/mikrotikSecret.age
+++ b/secrets/mikrotikSecret.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg MLi7IOM8QlpvlCMSmo4SwZbTwZ9pyysSbiMMuWD/dyU
+cotV5TJf7oyyXIaAmu8n9Ie1rl27i8w7hsduwtQFnis
+-> ssh-ed25519 KUYMFA BhFQ/RXOH8L7gl/FSabAUv28fbaod+muvTGSV3rYQSs
+fWqwAkhSAmg6YB+yEtj0e83Q4XO/r+TBnMTN7vXBNqU
+-> ssh-ed25519 76RhUQ b1fDfGPNdJ9c3wtr8ww0mW5K4fKJxpxxTZy/ZCECWzs
+qhbvucUrv7dzOPKUmUaRs/AtXtwQfy/qp5HnaYzZ5eQ
+-> ssh-ed25519 Jf8sqw 19D2ztjyxJfGQAiUOTdgWyC0ZFso/wrC9VPEkmI34U8
+PavT5O8M6Zc2Num9Hb2sY+F3UmMPqRgjUZxuvP6AhyM
+--- uYOcbsL7JWoDF2mRUDLhXrbp6ssLFbQ9+a6RhAXNNPA
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD>	X<><58>PC<50><43>h<EFBFBD>;
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -48,6 +48,7 @@ in {
  "homepageEnvironment.age".publicKeys = kima ++ sobotka;
  "cloudflareFirewallApiKey.age".publicKeys = kima ++ sobotka;
  "vaultwardenCloudflared.age".publicKeys = kima ++ sobotka;
+  "giteaCloudflared.age".publicKeys = kima ++ sobotka;
  "nextcloudCloudflared.age".publicKeys = kima ++ sobotka;
  "nextcloudAdminPass.age".publicKeys = kima ++ sobotka;
  "cloudflareDnsApiToken.age".publicKeys = kima ++ sobotka;
@@ -61,6 +62,9 @@ in {
  "traefikEnv.age".publicKeys = kima ++ sobotka;
  "wwwCloudflared.age".publicKeys = kima ++ sobotka;
  "authentikCloudflared.age".publicKeys = kima ++ sobotka;
+  "sobotkaTsAuth.age".publicKeys = kima ++ sobotka;
+  "mikrotikSecret.age".publicKeys = kima ++ sobotka;
+  "crowdsecApi.age".publicKeys = kima ++ sobotka;

  # Ziggy-specific
  "cloudflareDnsCredentialsZiggy.age".publicKeys = kima ++ ziggy;
--- a/secrets/sobotkaTsAuth.age
+++ b/secrets/sobotkaTsAuth.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg fftdt8orBZoM0sDRAXf0TScDLosNWWWIg7JmmuunuWM
+2IfpTH6ptSyLnBtBStkk7SINct6LtBHrL6h22BVNb+k
+-> ssh-ed25519 KUYMFA HI04mnVOGPRsRhnqCkbO4My/sBq5v/3UYxDVcfIe4RM
+fcSApUYCnJlpzVW5e77CFoSHamEmP+6ztMmzp2WlJvY
+-> ssh-ed25519 76RhUQ c2FbmTXGl/F+1acZFEJUoenkxiIGdoXkT67VgxvoFHg
+eWExqblEp5VIeXuPEuvj4QAIWtFX5KLfMyh6/fZ9bnA
+-> ssh-ed25519 Jf8sqw IAcUf70EufTyjsva8XIlXOfPxwXvtr9AFl0LwrdAMgc
+bY098fejLaFbUMX0iF89gz8kiOGZHI8JIg4NzX4ItFw
+--- WNqpLyRM2EqISbZky++NbKLw4GCEgwbz2O5+VO7aKzE
+<EFBFBD><EFBFBD><1A><>(5<0F>q	<09><>m<EFBFBD>C<EFBFBD><43>G<EFBFBD>r<><72><16><><EFBFBD><EFBFBD>ޒ3<DE92><33><17><1F>7<><37><EFBFBD>rG<72>i<EFBFBD>c7<63>i<EFBFBD>P<EFBFBD><50>l<EFBFBD><19>7<EFBFBD><<3C>r?cGo<47>^ǚ<>W<0E>V<EFBFBD><56>f,2<>Qg!<21>t_<74>
--- a/secrets/traefikEnv.age
+++ b/secrets/traefikEnv.age
Author	SHA1	Message	Date
cnst	64df7abad5	feat(hypr): clean up	2025-10-15 19:38:47 +02:00
cnst	8efa649d47	feat(homepage-dashboard): change vaultwarden icon	2025-10-15 18:01:39 +02:00
cnst	2dc09e23a0	chore(jellyseerr): typo	2025-10-15 17:50:11 +02:00
cnst	8fd2a7d9ad	feat(homepage-dashboard): reintroduce path option	2025-10-15 17:49:30 +02:00
cnst	113892b75d	chore(update): flake lock	2025-10-14 22:43:59 +02:00
cnst	001dfbf27f	chore(traefik): delete dead code	2025-10-14 22:00:16 +02:00
cnst	3deca06206	Merge pull request 'refactor' (#6 ) from refactor into main Reviewed-on: #6	2025-10-14 21:56:13 +02:00
cnst	07333b4544	feat(refactor): ready for merge	2025-10-14 21:50:44 +02:00
cnst	63f495fa0d	feat(refactor): WIP 2.0 some progress	2025-10-13 21:13:53 +02:00
cnst	d2bd385367	feat(refactor): WIP refactor server modules	2025-10-12 21:07:30 +02:00
cnst	57cb48a11c	feat(gaming): cleaning up gaming related pkgs	2025-10-11 16:44:54 +02:00
cnst	6b7ca2b194	feat(update): new kernel, new container versions and temporarily moving to zfs_unstable in waiting for stable to catch up with new kernel	2025-10-11 11:04:15 +02:00
cnst	e578a280db	chore(update): flake lock and removing unmaintained pkgs	2025-10-11 09:40:35 +02:00
cnst	01ca3d7ebe	feat(gitea): integrate with authentik	2025-10-08 20:39:54 +02:00
cnst	46aa5a9deb	fix(fail2ban): some hacky fix	2025-10-07 21:05:43 +02:00
cnst	549037fe69	chore(flake) lock	2025-10-06 21:00:09 +02:00
cnst	0cb6862dcd	feat(sqlite): adding sqlite pkgs	2025-10-06 20:57:01 +02:00
cnst	9e4454ff57	feat(gitea): move to cnst.dev domain, cf tunnel	2025-10-06 20:55:31 +02:00
cnst	15a20dd8e0	feat(pkgs): adding some dev pkgs to sobotka and dig as default	2025-10-05 19:27:15 +02:00
cnst	3306598f8a	feat(jellyfin): adding to tnet	2025-10-05 19:10:43 +02:00
cnst	93f227ba7e	feat(network): adding options for dns and search	2025-10-05 15:40:52 +02:00
cnst	9d20eff7f9	feat(jellyfin): TS testing	2025-10-05 10:47:08 +02:00
cnst	94d3f2ad35	feat(jellyfin): will this break things?	2025-10-05 10:35:22 +02:00
cnst	1d5bc22274	Merge branch 'main' into working	2025-10-05 10:21:16 +02:00
cnst	f2386a851e	working 1	2025-10-05 10:11:40 +02:00
cnst	c9edc99a85	chore(revert): slowly introducing changes	2025-10-05 09:27:51 +02:00