From e964020b57f27da8efbe92ee6d96913178699b1b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 26 Sep 2024 23:50:15 -0400
Subject: [PATCH 001/847] init

---
 .git-crypt/.gitattributes                     |   4 +
 ...5E4754FE1AEDA15A6D47029AB28AC10ECE533D.gpg | Bin 0 -> 735 bytes
 .gitattributes                                |   3 +
 configuration.nix                             | 231 ++++++++++++++++++
 flake.lock                                    |  48 ++++
 flake.nix                                     |  82 +++++++
 hardware.nix                                  |  46 ++++
 secrets/hashedPass                            | Bin 0 -> 96 bytes
 secrets/mullvad.nix                           | Bin 0 -> 267 bytes
 secrets/murmur_password                       | Bin 0 -> 39 bytes
 services/caddy.nix                            |  41 ++++
 services/git.nix                              |  40 +++
 services/immich.nix                           |  26 ++
 services/jellyfin.nix                         |  18 ++
 services/quadlet.nix                          |  84 +++++++
 15 files changed, 623 insertions(+)
 create mode 100644 .git-crypt/.gitattributes
 create mode 100644 .git-crypt/keys/default/0/D15E4754FE1AEDA15A6D47029AB28AC10ECE533D.gpg
 create mode 100644 .gitattributes
 create mode 100644 configuration.nix
 create mode 100644 flake.lock
 create mode 100644 flake.nix
 create mode 100644 hardware.nix
 create mode 100644 secrets/hashedPass
 create mode 100644 secrets/mullvad.nix
 create mode 100644 secrets/murmur_password
 create mode 100644 services/caddy.nix
 create mode 100644 services/git.nix
 create mode 100644 services/immich.nix
 create mode 100644 services/jellyfin.nix
 create mode 100644 services/quadlet.nix

diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
new file mode 100644
index 0000000..665b10e
--- /dev/null
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
diff --git a/.git-crypt/keys/default/0/D15E4754FE1AEDA15A6D47029AB28AC10ECE533D.gpg b/.git-crypt/keys/default/0/D15E4754FE1AEDA15A6D47029AB28AC10ECE533D.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..1d65e96a4b3c019fb865e992ff37d734b430a914
GIT binary patch
literal 735
zcmZo=;$fb(sp}x$xnNsH0fw2^{7*~?5PdH_XRh+@`KOlsedqD#2Cw$Yi!J+<x5dTu
z>Q7qXy(h7)>TTcF+q)N@diE~tLFo+NlXtg%QF*bgIoH}Zjx)eUZRU%!k|7bH%36Gh
zoYT)&8&7lA4QuiK?Iy!*U~Xxvx?=8(4~~BoZVBJfZnIB+l>IUILE{OlQ_By`_;b>8
z&gA<yK3Rml({*Y(dh27ZQ>=mNRVBlQ%eEr!_n&`Rxu1o(qV<r;?g?x5w=f!VML7Sx
zdZskuKx<c^zzklKb(>0WSQfjje(zL#`tQCix0G|1eLk@u%=lr`zFRB0Hg4!$_~0wE
zw=Q4svyTic`*eQJ=$;U+e^lO3K3`G7R^`d2Ni&2PR4#PCh<Ph`dROPE<C8M$ChxfT
zrl#{0$L2_n+ecjfo;<ev-^;f*n^{ezsv4NoT3;Ibsa${a>kjYEAl0gSPbT*CO=V12
zwZY&Z*CBS-c>$lkT(Y0K&2<<5r<>QWezEDWm{7&IBs=kk*7<|Y&s_NXUwG=>h~2&E
z<Xzt>yPjTSeLl;jU5aI2%G1<l_BwYb<(<oSN{CGpC=$B!@?p@8K!JA(frV*nWqo~w
zpX-Z%^M9om7Sp*hqEBk(73SwWYDMp@QrMHaiZ%p=&S7j8JT&J-SLRmJY4X(v7lbW|
z`Kg$=+W3%@kHYn-3uV4+&#mF%*IRcpE9mai(EF?2_+4)`|762<<p3`uCzF8Z$74(h
zA!S}W+s_D{|G9{9%5K$_`8mJl3oy&gbg7+~bK!{KYMyFWx3@2Eo?fj{()U2h_S2*I
z^7~JdLQg%{is`NTa^}~DOH)mjU#fW%UJ$<F(AMq2u1jWxoU!HB4K+>iY3bdv$MM1P
zx`^Hsan(0BkI!Q@XqA`MvRxY?@yubWMw<J#r5%?hR7$6%T5=nT$?rQWBq{v&MXIl(
z_gZdg=Na-Mu6MH6EMYdDDD~a){?QWe4ShlKhRM1j$@Aq@nc4GwmO0K{oV!J1wIu*P
CU}p>f

literal 0
HcmV?d00001

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..82c6e8a
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+secrets/murmur_password filter=git-crypt diff=git-crypt
+secrets/hashedPass filter=git-crypt diff=git-crypt
+secrets/mullvad.nix filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
new file mode 100644
index 0000000..96c790c
--- /dev/null
+++ b/configuration.nix
@@ -0,0 +1,231 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostname,
+  username,
+  eth_interface,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    ./hardware.nix
+    # ./services/jellyfin.nix
+    ./services/caddy.nix
+    ./services/quadlet.nix
+    ./services/immich.nix
+    ./services/git.nix
+  ];
+
+  nix = {
+    #garbage collection and cleanup stuff
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+
+    #optimize the store
+    optimise.automatic = true;
+
+    #enable flakes!
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_6_10;
+
+    supportedFilesystems = [ "zfs" ];
+    zfs.extraPools = [ "tank" ];
+    loader = {
+      # Use the systemd-boot EFI boot loader.
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "America/New_York";
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  #Intel GPU stuff
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  };
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      intel-vaapi-driver # previously vaapiIntel
+      vaapiVdpau
+      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+      vpl-gpu-rt # QSV on 11th gen or newer
+    ];
+  };
+
+  #fwupd for updating firmware
+  services.fwupd = {
+    enable = true;
+    extraRemotes = [ "lvfs-testing" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    helix
+    nixfmt-rfc-style
+
+    lm_sensors
+    bottom
+    htop
+
+    borgbackup
+    smartmontools
+
+    nil
+
+    ripgrep
+
+    intel-gpu-tools
+  ];
+
+  services.zfs = {
+    autoScrub.enable = true;
+    autoSnapshot.enable = true;
+  };
+
+  systemd.services.no-rgb =
+    let
+      no-rgb = pkgs.writeScriptBin "no-rgb" ''
+        #!/bin/sh
+        NUM_DEVICES=$(${pkgs.openrgb}/bin/openrgb --noautoconnect --list-devices | ${pkgs.coreutils}/bin/grep -E '^[0-9]+: ' | ${pkgs.coreutils}/bin/wc -l)
+
+        for i in $(${pkgs.coreutils}/bin/seq 0 $(($NUM_DEVICES - 1))); do
+          ${pkgs.openrgb}/bin/openrgb --noautoconnect --device $i --mode direct --color 000000
+        done
+      '';
+    in
+    {
+      description = "disable rgb";
+      serviceConfig = {
+        ExecStart = "${no-rgb}/bin/no-rgb";
+        Type = "oneshot";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+  services.hardware.openrgb = {
+    enable = true;
+    package = pkgs.openrgb-with-all-plugins;
+    motherboard = "amd";
+  };
+
+  services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
+  hardware.i2c.enable = true;
+
+  networking = {
+    nameservers = [
+      "1.1.1.1"
+      "9.9.9.9"
+    ];
+
+    hostName = hostname;
+    hostId = "0f712d56";
+    firewall.enable = true;
+    useDHCP = false;
+
+    interfaces.${eth_interface} = {
+      ipv4.addresses = [
+        {
+          address = "10.1.1.102";
+          prefixLength = 24;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "10.1.1.1";
+      interface = eth_interface;
+    };
+  };
+
+  virtualisation = {
+    containers.enable = true;
+    podman = {
+      enable = true;
+
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  users.users.${username} = {
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "video"
+      "render"
+    ];
+    hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJjT5QZ3zRDb+V6Em20EYpSEgPW5e/U+06uQGJdraxi" # desktop
+    ];
+  };
+
+  # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
+  programs.fish.enable = true;
+  programs.bash = {
+    interactiveShellInit = ''
+      if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
+      then
+        shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
+        exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
+      fi
+    '';
+  };
+
+  security = {
+    #lets use doas and not sudo!
+    doas.enable = true;
+    sudo.enable = false;
+    # Configure doas
+    doas.extraRules = [
+      {
+        users = [ username ];
+        keepEnv = true;
+        persist = true;
+      }
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.minecraft
+  ];
+
+  services.murmur = {
+    enable = true;
+    openFirewall = true;
+    welcometext = "meow meow meow meow meow :3 xd";
+    password = builtins.readFile ./secrets/murmur_password;
+  };
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_16;
+    dataDir = "/tank/services/sql";
+  };
+
+  system.stateVersion = "24.05";
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..31ea209
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1727444619,
+        "narHash": "sha256-Y4X22oYrmYZcVVLa708GX/trYjSGkPgd2HpnOR0kTfg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c198f2dc39f569fadff23d199715be9c345a1383",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "quadlet-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1727065535,
+        "narHash": "sha256-jX83vspAPZnnpFUylUYqP+J1RoZc9w10bbQtsEwD20A=",
+        "owner": "SEIAROTg",
+        "repo": "quadlet-nix",
+        "rev": "51e2beaaf127c8b4460d909c6c29ed9d60bfde0c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SEIAROTg",
+        "repo": "quadlet-nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "quadlet-nix": "quadlet-nix"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..e08ed6f
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,82 @@
+{
+  description = "Flake for server muffin";
+
+  inputs = {
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
+    quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs =
+    {
+      nixpkgs,
+      quadlet-nix,
+      ...
+    }:
+    let
+      username = "primary";
+      hostname = "muffin";
+      eth_interface = "enp3s0";
+
+      service_configs = {
+        hdd_path = "/mnt/hdd";
+
+        # TODO: add checks to make sure none of these collide
+        ports = {
+          https = 443;
+          immich = 3001;
+          jellyfin = 8096;
+          torrent = 6011;
+          minecraft = 25565;
+          git-server = 3281;
+        };
+
+        https = {
+          certs = "/tank/services/http_certs";
+          data_dir = "/tank/services/http";
+        };
+
+        gitea = {
+          dir = "/tank/services/gitea";
+        };
+
+        postgres = {
+          socket = "/run/postgresql";
+        };
+
+        immich = {
+          dir = "/tank/services/immich";
+        };
+
+        minecraft = {
+          dir = "/tank/services/minecraft";
+        };
+
+        gluetun = {
+          dir = "/tank/services/gluetun";
+        };
+
+        torrent = {
+          config_dir = "/tank/services/qbittorrent/config";
+          download_dir = "${service_configs.hdd_path}/torrents";
+        };
+      };
+    in
+    {
+      nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          inherit
+            username
+            hostname
+            eth_interface
+            service_configs
+            ;
+        };
+        modules = [
+          ./configuration.nix
+          quadlet-nix.nixosModules.quadlet
+        ];
+      };
+    };
+}
diff --git a/hardware.nix b/hardware.nix
new file mode 100644
index 0000000..2229c44
--- /dev/null
+++ b/hardware.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+
+{
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/f467d1e8-5f00-40ee-aa67-55a999181918";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/96DC-6E54";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  # 3tb HDD
+  fileSystems.${service_configs.hdd_path} = {
+    device = "/dev/disk/by-uuid/f69b8c84-20ca-448f-b580-8951f20b9fc1";
+    fsType = "xfs";
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = true;
+  hardware.enableRedistributableFirmware = true;
+}
diff --git a/secrets/hashedPass b/secrets/hashedPass
new file mode 100644
index 0000000000000000000000000000000000000000..fe3affff75466277bda5c56a5e61ad6fbb110877
GIT binary patch
literal 96
zcmZQ@_Y83kiVO&0@VRxTU2fGot_6>$T6I54-8=Ws!~LDds#YF6@8ptx_E1WC7LU^Q
z0L29L)?Koj=1)$j{>`^NUL^YNs@kre;Nz{f4Zm40+`QXaZ1U`3sQAn)*$-I{@E%?P
E0M<<~XaE2J

literal 0
HcmV?d00001

diff --git a/secrets/mullvad.nix b/secrets/mullvad.nix
new file mode 100644
index 0000000000000000000000000000000000000000..4426bc5860ad5552e6c0b76ecd87e5ebce57fb7b
GIT binary patch
literal 267
zcmZQ@_Y83kiVO&0@YuQ0e$n;=n!&9P%AD@Z-_>z-L3FfY=9b7OeZ{#9qO;mfOkZ#B
z|CCpKm)Z1P?ah}*Qj(=vcQ`R@pYzDGxVisJiGt~S{*z*>*4^@n(5s1$za4*|&|kr$
zGI#fn9B21)F6*=>u4o96zNc;IXkM_ouupGK{pq^-Lerk=EPtRqYn503Q{T3<=8j)%
znb&%lmVb|&(R;UXbJmRMI)Qfmn?g=!hAwD4bV=c}i-@*5cd1_R^^3-gjJsT|ULQ}q
zquS#*^HxgZVY%7)&zYLfW$qMXk(&8->v`^nvF1Ix+a64;5~$@^d(k4X^zC2aeKYeJ
bFE+V9od3UU^MzBZ6B0|V?@iR45_Jp!XtROp

literal 0
HcmV?d00001

diff --git a/secrets/murmur_password b/secrets/murmur_password
new file mode 100644
index 0000000000000000000000000000000000000000..d1dd0c80284b03aa851d8dd7602c99ab7ac4a0be
GIT binary patch
literal 39
vcmZQ@_Y83kiVO&0IB`5$soc=q?oPuWji6M?8SlP!%6<rc<@1-}<io`PD|->x

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
new file mode 100644
index 0000000..eba481a
--- /dev/null
+++ b/services/caddy.nix
@@ -0,0 +1,41 @@
+{ service_configs, ... }:
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      ":${builtins.toString service_configs.ports.https}".extraConfig = ''
+        tls ${service_configs.https.certs}/cert.crt ${service_configs.https.certs}/cert.key
+
+        handle_path /torrent* {
+        	reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.torrent}
+        }
+
+        root * ${service_configs.https.data_dir}
+        file_server browse
+      '';
+
+      "immich.gardling.com".extraConfig = ''
+        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.immich}
+      '';
+
+      "jellyfin.gardling.com".extraConfig = ''
+        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.jellyfin}
+        request_body {
+        	max_size 4096MB
+        }
+      '';
+
+      "git.gardling.com".extraConfig = ''
+        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.git-server}
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.https
+  ];
+
+  networking.firewall.allowedUDPPorts = [
+    service_configs.ports.https
+  ];
+}
diff --git a/services/git.nix b/services/git.nix
new file mode 100644
index 0000000..867945a
--- /dev/null
+++ b/services/git.nix
@@ -0,0 +1,40 @@
+{
+  config,
+  service_configs,
+  ...
+}:
+{
+  services.gitea = {
+    enable = true;
+    appName = "TBD name of my gitea server";
+    stateDir = service_configs.gitea.dir;
+    database = {
+      type = "postgres";
+      socket = service_configs.postgres.socket;
+    };
+    settings = {
+      server = {
+        DOMAIN = "git.gardling.com";
+        ROOT_URL = "https://git.gardling.com";
+        HTTP_PORT = service_configs.ports.git-server;
+      };
+      session = {
+        # https cookies or smth
+        COOKIE_SECURE = true;
+      };
+      # only I shall use gitea
+      service.DISABLE_REGISTRATION = true;
+    };
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ config.services.gitea.user ];
+    ensureUsers = [
+      {
+        name = config.services.gitea.database.user;
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }
+    ];
+  };
+}
diff --git a/services/immich.nix b/services/immich.nix
new file mode 100644
index 0000000..114b2d4
--- /dev/null
+++ b/services/immich.nix
@@ -0,0 +1,26 @@
+{
+  service_configs,
+  pkgs,
+  config,
+  ...
+}:
+{
+  services.immich = {
+    enable = true;
+    mediaLocation = service_configs.immich.dir;
+    port = service_configs.ports.immich;
+    host = "0.0.0.0";
+    database = {
+      createDB = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    immich-go
+  ];
+
+  users.users.${config.services.immich.user}.extraGroups = [
+    "video"
+    "render"
+  ];
+}
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
new file mode 100644
index 0000000..8b78b74
--- /dev/null
+++ b/services/jellyfin.nix
@@ -0,0 +1,18 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    jellyfin
+    jellyfin-web
+    jellyfin-ffmpeg
+  ];
+
+  services.jellyfin = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  users.users.${config.services.jellyfin.user}.extraGroups = [
+    "video"
+    "render"
+  ];
+}
diff --git a/services/quadlet.nix b/services/quadlet.nix
new file mode 100644
index 0000000..8e5ecee
--- /dev/null
+++ b/services/quadlet.nix
@@ -0,0 +1,84 @@
+{ service_configs, ... }:
+{
+  virtualisation.quadlet = {
+    containers =
+      let
+        baseContainerConfig = {
+          autoUpdate = "registry";
+          environments = {
+            PUID = 1000;
+            PGID = 1000;
+          };
+        };
+      in
+      {
+        minecraft-server.containerConfig = baseContainerConfig // {
+          image = "docker.io/itzg/minecraft-server:java21-graalvm";
+          name = "minecraft";
+
+          environments = {
+            TYPE = "QUILT";
+            MEMORY = "4G";
+            MOD_PLATFORM = "MODRINTH";
+            USE_AIKAR_FLAGS = true;
+            JVM_OPTS = "-XX:-UseJVMCICompiler";
+            MODRINTH_MODPACK = "https://modrinth.com/modpack/sop";
+            VERSION = "1.21.1";
+          };
+
+          publishPorts = [ "${builtins.toString service_configs.ports.minecraft}:25565" ];
+          volumes = [ "${service_configs.minecraft.dir}:/data:z" ];
+        };
+
+        gluetun.containerConfig = baseContainerConfig // {
+          image = "docker.io/qmcgaw/gluetun";
+          name = "gluetun";
+
+          addCapabilities = [
+            "NET_ADMIN"
+            "MKNOD"
+          ];
+
+          environments = import ../secrets/mullvad.nix;
+
+          publishPorts = [
+            "6081:6081"
+            "6081:6081/udp"
+            "${builtins.toString service_configs.ports.torrent}:6011"
+          ];
+
+          volumes = [ "${service_configs.gluetun.dir}:/gluetun:z" ];
+          podmanArgs = [
+            "--device=/dev/net/tun"
+            "--security-opt label=disable"
+          ];
+        };
+
+        qbittorrent = {
+          containerConfig = baseContainerConfig // {
+            image = "lscr.io/linuxserver/qbittorrent:latest";
+            name = "qbittorrent";
+            environments = {
+              WEBUI_PORT = service_configs.ports.torrent;
+              DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
+            };
+
+            volumes = [
+              "${service_configs.torrent.config_dir}:/config:z"
+              "${service_configs.torrent.download_dir}:/downloads:z"
+            ];
+
+            networks = [ "container:gluetun" ];
+          };
+
+          serviceConfig = {
+            requires = [ "gluetun.service" ];
+            after = [ "gluetun.service" ];
+          };
+        };
+      };
+    networks = {
+      internal.networkConfig.subnets = [ "10.0.123.1/24" ];
+    };
+  };
+}

From 7588d7ca93f28c8c6a8773eddef4aeb9f721efc5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Sep 2024 10:29:46 -0400
Subject: [PATCH 002/847] remove comment

---
 secrets/mullvad.nix | Bin 267 -> 238 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/mullvad.nix b/secrets/mullvad.nix
index 4426bc5860ad5552e6c0b76ecd87e5ebce57fb7b..54a389797966e32eba5596b700b7978a23f74baf 100644
GIT binary patch
literal 238
zcmZQ@_Y83kiVO&0V9-r^7^s$@{(i4u#4c57k+x&469rGWdG6S&9k!b%d6VI_4IxKg
z|C`(xCh+;<nq_nEK3<-avUjeF*16j|7MR=&yKq3Mdb5azhSkC3nWYMbU;B6cnXWPa
zj^iQ|<F9%}C)GTAPjx*zskoZo;7<?lT&I=h2C)e#m-LTjFT1@tnBR29qZB8n54n$C
zv94NrBEjp8Q}FCn&sVLT)~RxJ_oaukj#UZ;X&rbPTz!7wG`{bttv4z*%(6edenF~`
zu-ne#(@NeX-LFeLIrsh<A&aR&XL*@EURacSefieM-)&yXoLpjf-&dnL^tlB9p-6bu

literal 267
zcmZQ@_Y83kiVO&0@YuQ0e$n;=n!&9P%AD@Z-_>z-L3FfY=9b7OeZ{#9qO;mfOkZ#B
z|CCpKm)Z1P?ah}*Qj(=vcQ`R@pYzDGxVisJiGt~S{*z*>*4^@n(5s1$za4*|&|kr$
zGI#fn9B21)F6*=>u4o96zNc;IXkM_ouupGK{pq^-Lerk=EPtRqYn503Q{T3<=8j)%
znb&%lmVb|&(R;UXbJmRMI)Qfmn?g=!hAwD4bV=c}i-@*5cd1_R^^3-gjJsT|ULQ}q
zquS#*^HxgZVY%7)&zYLfW$qMXk(&8->v`^nvF1Ix+a64;5~$@^d(k4X^zC2aeKYeJ
bFE+V9od3UU^MzBZ6B0|V?@iR45_Jp!XtROp


From 258ab0fbf668e693cace54551470a0aaf6f85e84 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Sep 2024 10:59:19 -0400
Subject: [PATCH 003/847] update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 31ea209..3d8f357 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1727444619,
-        "narHash": "sha256-Y4X22oYrmYZcVVLa708GX/trYjSGkPgd2HpnOR0kTfg=",
+        "lastModified": 1727447095,
+        "narHash": "sha256-bUFP8kDHzrbnM3cTVu+k6kJ2qtA7a1Q5cZHjC0J0v7A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c198f2dc39f569fadff23d199715be9c345a1383",
+        "rev": "4c030cf309bffa9cd87336705e96ce941ce977d9",
         "type": "github"
       },
       "original": {

From ef787b4cb5594a5a15a44a92ff94591e5d5975f0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Sep 2024 12:54:55 -0400
Subject: [PATCH 004/847] fix jellyfin? and gitea config change

---
 configuration.nix     | 2 +-
 flake.nix             | 5 +++++
 services/git.nix      | 1 +
 services/jellyfin.nix | 8 +++++++-
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 96c790c..88498fe 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -11,7 +11,7 @@
 {
   imports = [
     ./hardware.nix
-    # ./services/jellyfin.nix
+    ./services/jellyfin.nix
     ./services/caddy.nix
     ./services/quadlet.nix
     ./services/immich.nix
diff --git a/flake.nix b/flake.nix
index e08ed6f..1d9989f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -61,6 +61,11 @@
           config_dir = "/tank/services/qbittorrent/config";
           download_dir = "${service_configs.hdd_path}/torrents";
         };
+
+        jellyfin = {
+          data_dir = "/tank/services/jellyfin";
+          cache_dir = "/tank/services/jellyfin_cache";
+        };
       };
     in
     {
diff --git a/services/git.nix b/services/git.nix
index 867945a..f06deb0 100644
--- a/services/git.nix
+++ b/services/git.nix
@@ -17,6 +17,7 @@
         DOMAIN = "git.gardling.com";
         ROOT_URL = "https://git.gardling.com";
         HTTP_PORT = service_configs.ports.git-server;
+        LANDING_PAGE = "/explore/repos";
       };
       session = {
         # https cookies or smth
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 8b78b74..044d8f0 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, config, service_configs, ... }:
 {
   environment.systemPackages = with pkgs; [
     jellyfin
@@ -8,7 +8,13 @@
 
   services.jellyfin = {
     enable = true;
+    # used for local streaming
     openFirewall = true;
+
+    user = "jellyfin";
+    group = "users";
+    dataDir = service_configs.jellyfin.data_dir;
+    cacheDir = service_configs.jellyfin.cache_dir;
   };
 
   users.users.${config.services.jellyfin.user}.extraGroups = [

From 3cdbb27e6c3568f364689c6ae808dbccd006c9d2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 00:25:41 -0400
Subject: [PATCH 005/847] minecraft overhaul

---
 .gitattributes                  |   1 +
 configuration.nix               |  19 ++++++--
 flake.lock                      |  80 ++++++++++++++++++++++++++++--
 flake.nix                       |  18 +++++--
 secrets/minecraft-whitelist.nix | Bin 0 -> 352 bytes
 services/caddy.nix              |   2 +-
 services/{git.nix => gitea.nix} |   2 +-
 services/jellyfin.nix           |   9 +++-
 services/minecraft.nix          |  83 ++++++++++++++++++++++++++++++++
 services/quadlet.nix            |  32 ++++++------
 10 files changed, 214 insertions(+), 32 deletions(-)
 create mode 100644 secrets/minecraft-whitelist.nix
 rename services/{git.nix => gitea.nix} (94%)
 create mode 100644 services/minecraft.nix

diff --git a/.gitattributes b/.gitattributes
index 82c6e8a..4c9ff84 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,4 @@
 secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/mullvad.nix filter=git-crypt diff=git-crypt
+secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 88498fe..644f636 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -15,7 +15,8 @@
     ./services/caddy.nix
     ./services/quadlet.nix
     ./services/immich.nix
-    ./services/git.nix
+    ./services/gitea.nix
+    ./services/minecraft.nix
   ];
 
   nix = {
@@ -45,7 +46,19 @@
       # Use the systemd-boot EFI boot loader.
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
+
+      # 1 sec timeout
+      timeout = 1;
     };
+
+    initrd = {
+      compressor = "zstd";
+      compressorArgs = [ "-19" ];
+    };
+  };
+
+  environment.etc = {
+    "issue".text = "muffin server :3\n";
   };
 
   # Set your time zone.
@@ -210,10 +223,6 @@
     ];
   };
 
-  networking.firewall.allowedTCPPorts = [
-    service_configs.ports.minecraft
-  ];
-
   services.murmur = {
     enable = true;
     openFirewall = true;
diff --git a/flake.lock b/flake.lock
index 3d8f357..aa0651e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,17 +1,73 @@
 {
   "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nix-minecraft": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1727487901,
+        "narHash": "sha256-m+QPmso7l/SVPgrQz72PicSQgaaLs/Iyy+9eAyHY3+c=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "39983d066b08107165ba5757d03f414abb4e52c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1727447095,
-        "narHash": "sha256-bUFP8kDHzrbnM3cTVu+k6kJ2qtA7a1Q5cZHjC0J0v7A=",
+        "lastModified": 1727348695,
+        "narHash": "sha256-J+PeFKSDV+pHL7ukkfpVzCOO7mBSrrpJ3svwBFABbhI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c030cf309bffa9cd87336705e96ce941ce977d9",
+        "rev": "1925c603f17fc89f4c8f6bf6f631a802ad85d784",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -38,9 +94,25 @@
     },
     "root": {
       "inputs": {
+        "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs",
         "quadlet-nix": "quadlet-nix"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 1d9989f..f4ec7d2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,16 +2,19 @@
   description = "Flake for server muffin";
 
   inputs = {
-    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # nixpkgs.url = "github:NixOS/nixpkgs/master";
     quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
     quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
+    nix-minecraft.url = "github:Infinidoge/nix-minecraft";
+    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
     {
       nixpkgs,
       quadlet-nix,
+      nix-minecraft,
       ...
     }:
     let
@@ -29,7 +32,7 @@
           jellyfin = 8096;
           torrent = 6011;
           minecraft = 25565;
-          git-server = 3281;
+          gitea = 3281;
         };
 
         https = {
@@ -50,7 +53,7 @@
         };
 
         minecraft = {
-          dir = "/tank/services/minecraft";
+          dir = "/tank/services/minecraft/main";
         };
 
         gluetun = {
@@ -81,6 +84,13 @@
         modules = [
           ./configuration.nix
           quadlet-nix.nixosModules.quadlet
+          (
+            { pkgs, ... }:
+            {
+              imports = [ nix-minecraft.nixosModules.minecraft-servers ];
+              nixpkgs.overlays = [ nix-minecraft.overlay ];
+            }
+          )
         ];
       };
     };
diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
new file mode 100644
index 0000000000000000000000000000000000000000..f92437b67576231d2403c0699d96d2886c48d9c8
GIT binary patch
literal 352
zcmZQ@_Y83kiVO&0I5j2K{kJ`b)&Iz?t%qHe7X07gsQ*vg%p<|DD`J^&%3|&bPoD@g
zY9wu2Ia9%Y!&xp7Lz5p#(@sYUUDD#M;ZdCuf8tQ)ziBdcKTd6AoOH4{?6+KaavR@<
z%#uTE&+)#kp8P<rD?~8v)3*$9o0-2K`s$c)PI*#3O}_Szrz5ZBOw(M2G~cUHOLucW
zR{gYN)`A$B%CzuVRavhr{<R)IU(>ghJ$NNo($-6-IAr=-M9o$uI!$X4U--4?&b~dO
z+%e^6M0?DZ8U2(wdg<N1Uy%!%|L)qU>>BmnPhq~LU$XIk!vrRifFREGz6t*x6@PJC
zcgpA2fijQnLQgks=b89N@u7ajmefB<_Fr2s8$a~8wP3#{_r@Pi+?N9FgRga$+<gA<
zo1rrM>`M#z-u!Kj&<lKPky{woP$4%{TQ%{)$Ck_6e}(_)DeLNC@y}`gwn<0pVo`VF
NvGgUkLeAZ9000fhtOx)A

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
index eba481a..493548c 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -26,7 +26,7 @@
       '';
 
       "git.gardling.com".extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.git-server}
+        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.gitea}
       '';
     };
   };
diff --git a/services/git.nix b/services/gitea.nix
similarity index 94%
rename from services/git.nix
rename to services/gitea.nix
index f06deb0..0d20746 100644
--- a/services/git.nix
+++ b/services/gitea.nix
@@ -16,7 +16,7 @@
       server = {
         DOMAIN = "git.gardling.com";
         ROOT_URL = "https://git.gardling.com";
-        HTTP_PORT = service_configs.ports.git-server;
+        HTTP_PORT = service_configs.ports.gitea;
         LANDING_PAGE = "/explore/repos";
       };
       session = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 044d8f0..c602ce7 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -1,4 +1,9 @@
-{ pkgs, config, service_configs, ... }:
+{
+  pkgs,
+  config,
+  service_configs,
+  ...
+}:
 {
   environment.systemPackages = with pkgs; [
     jellyfin
@@ -11,7 +16,7 @@
     # used for local streaming
     openFirewall = true;
 
-    user = "jellyfin";
+    user = "primary";
     group = "users";
     dataDir = service_configs.jellyfin.data_dir;
     cacheDir = service_configs.jellyfin.cache_dir;
diff --git a/services/minecraft.nix b/services/minecraft.nix
new file mode 100644
index 0000000..c456087
--- /dev/null
+++ b/services/minecraft.nix
@@ -0,0 +1,83 @@
+{
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+
+{
+  nixpkgs.config.allowUnfreePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "minecraft-server"
+    ];
+
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    dataDir = "/tank/services/minecraft";
+    openFirewall = true;
+    servers.main = {
+      enable = true;
+      package = pkgs.fabricServers.fabric-1_21_1;
+      jvmOpts = "-Xmx6144M -Xms6144M -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";
+      serverProperties = {
+        server-port = service_configs.ports.minecraft;
+        enforce-whitelist = true;
+        gamemode = "survival";
+        white-list = true;
+        difficulty = "easy";
+        motd = "A Minecraft Server";
+      };
+
+      whitelist = import ../secrets/minecraft-whitelist.nix;
+
+      symlinks = {
+        "mods" = pkgs.linkFarmFromDrvs "mods" (
+          builtins.attrValues {
+            BadOptimizations = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/g96Z4WVZ/versions/XYBqWKD2/BadOptimizations-2.1.4-1.21.jar";
+              sha512 = "6f12d5d7b75ed38f006e4c1e176a2308bf78e6bb5d49601152d7a8fa8e576b3e884bd04fcfb976b82fb67a62408e7efcff3ecc6844cea62b07d4b0538b9f0549";
+            };
+            ClothConfig = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/9s6osm5g/versions/HpMb5wGb/cloth-config-15.0.140-fabric.jar";
+              sha512 = "1b3f5db4fc1d481704053db9837d530919374bf7518d7cede607360f0348c04fc6347a3a72ccfef355559e1f4aef0b650cd58e5ee79c73b12ff0fc2746797a00";
+            };
+            C2ME = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/AHlC1pea/c2me-fabric-mc1.21.1-0.3.0%2Balpha.0.212.jar";
+              sha512 = "a1977f3bb02a793677db0b0e20494af4bd648efd3b7e83d0c1ef3f14e7fdc0c4d3a9561b841fde97a123b87123275ce3c213bf414f91bc1393f26c95a70f0536";
+            };
+            FabricApi = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/WTaAx4ah/fabric-api-0.105.0%2B1.21.1.jar";
+              sha512 = "6e1ffcf7f5af9589c16ccec1f9bb5ef8dede5ebe52ae09d94affa8050603f6ecd71d130a793c2bdb4bd42b2a70905425e55141d39369dfa9840569eef4dace16";
+            };
+            FerriteCore = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/wmIZ4wP4/ferritecore-7.0.0-fabric.jar";
+              sha512 = "0f2f9b5aebd71ef3064fc94df964296ac6ee8ea12221098b9df037bdcaaca7bccd473c981795f4d57ff3d49da3ef81f13a42566880b9f11dc64645e9c8ad5d4f";
+            };
+            Lithium = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/9x0igjLz/lithium-fabric-mc1.21.1-0.13.1.jar";
+              sha512 = "4250a630d43492da35c4c197ae43082186938fdcb42bafcb6ccad925b79f583abdfdc17ce792c6c6686883f7f109219baecb4906a65d524026d4e288bfbaf146";
+            };
+            NoChatReports = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/riMhCAII/NoChatReports-FABRIC-1.21-v2.8.0.jar";
+              sha512 = "092837afc0fcb5208561062f8e4cd69971efa94c0180ae377e318d35d8f278abbf1552e4a577be882dc7e870f884779bc36caf808c8bc90bb05490f1e034ddb8";
+            };
+            noisium = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
+              sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
+            };
+            threadtweak = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/vSEH1ERy/versions/F4sjmsi3/threadtweak-fabric-0.1.5%2Bmc1.21.1.jar";
+              sha512 = "b0221075239b9998d08e9a42d7bb3205c22482dc39f4b62a1c57c1f7444c9ec9cdee4a245b6b9c6b23f61f3cec82056c40cfc09e6c1bc0690cd936dfed6393a1";
+            };
+            vmp = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/wnEe9KBa/versions/VuFHjBNh/vmp-fabric-mc1.21.1-0.2.0%2Bbeta.7.168-all.jar";
+              sha512 = "5e2360e91a36d0e76ff0e805c504c773a1449252572ae218edf4430bdf179ac50b1a080d3ca25ecca266499b5637b5b92a228d1c6516e742a7c9f560791c4059";
+            };
+          }
+        );
+      };
+    };
+  };
+}
diff --git a/services/quadlet.nix b/services/quadlet.nix
index 8e5ecee..47b997e 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -12,23 +12,23 @@
         };
       in
       {
-        minecraft-server.containerConfig = baseContainerConfig // {
-          image = "docker.io/itzg/minecraft-server:java21-graalvm";
-          name = "minecraft";
+        # minecraft-server.containerConfig = baseContainerConfig // {
+        #   image = "docker.io/itzg/minecraft-server:java21-graalvm";
+        #   name = "minecraft";
 
-          environments = {
-            TYPE = "QUILT";
-            MEMORY = "4G";
-            MOD_PLATFORM = "MODRINTH";
-            USE_AIKAR_FLAGS = true;
-            JVM_OPTS = "-XX:-UseJVMCICompiler";
-            MODRINTH_MODPACK = "https://modrinth.com/modpack/sop";
-            VERSION = "1.21.1";
-          };
+        #   environments = {
+        #     TYPE = "QUILT";
+        #     MEMORY = "4G";
+        #     MOD_PLATFORM = "MODRINTH";
+        #     USE_AIKAR_FLAGS = true;
+        #     JVM_OPTS = "-XX:-UseJVMCICompiler";
+        #     MODRINTH_MODPACK = "https://modrinth.com/modpack/sop";
+        #     VERSION = "1.21.1";
+        #   };
 
-          publishPorts = [ "${builtins.toString service_configs.ports.minecraft}:25565" ];
-          volumes = [ "${service_configs.minecraft.dir}:/data:z" ];
-        };
+        #   publishPorts = [ "${builtins.toString service_configs.ports.minecraft}:25565" ];
+        #   volumes = [ "${service_configs.minecraft.dir}:/data:z" ];
+        # };
 
         gluetun.containerConfig = baseContainerConfig // {
           image = "docker.io/qmcgaw/gluetun";
@@ -61,6 +61,8 @@
             environments = {
               WEBUI_PORT = service_configs.ports.torrent;
               DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
+              PUID = 1000;
+              PGID = 1000;
             };
 
             volumes = [

From 5476beb5284b9801f7c9382c58257501cd8c624c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 11:04:56 -0400
Subject: [PATCH 006/847] fix typo

---
 secrets/minecraft-whitelist.nix | Bin 352 -> 353 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index f92437b67576231d2403c0699d96d2886c48d9c8..939f4a12e64958d8f19637806b228622e1354489 100644
GIT binary patch
literal 353
zcmZQ@_Y83kiVO&0ct5wPiTm>2$L%N9Jy|N?Tv+_@w@6urMX$(Y=GR-@TI?2!>ozKF
z@Dxd_usW8heX?Bp#rb1bINscJm)j8~^Y^z=foB=-=D!aA16s<zezO!zYrU@h&3DD>
zRK=&NY9FSFd=H+ibM}qb0gZ6C(oM}vJNEWTFdEF6`Z)BjwfElMGuI0~RQ$CK6QA?b
z`+3>PHHLmJXWGlQKH^NQ@0g@5XyzZG|MJBpw-*6y_qcSleCJwS-j~OF$TYllc~PzA
zFSR98elEH*=W%*Rmsneo{i+=QD(AoL3qPpFSnN9g=jF9oTvf%*pP6p=sCzB46<Qh4
zAeR(w&VJiblj}|3CdLMz23NLIIVBqtznks;YcbK`>Uxm^<wbt6(;|y+u9xFIzQQ5t
z{!9Dba5;OKp7I@;_J6GyFUc`~+vv29;~4{g!IR?trP@{%?VCQzPe^+daz&!-gY{ST
Nf5pw)<93JC0|4kgs#pL3

literal 352
zcmZQ@_Y83kiVO&0I5j2K{kJ`b)&Iz?t%qHe7X07gsQ*vg%p<|DD`J^&%3|&bPoD@g
zY9wu2Ia9%Y!&xp7Lz5p#(@sYUUDD#M;ZdCuf8tQ)ziBdcKTd6AoOH4{?6+KaavR@<
z%#uTE&+)#kp8P<rD?~8v)3*$9o0-2K`s$c)PI*#3O}_Szrz5ZBOw(M2G~cUHOLucW
zR{gYN)`A$B%CzuVRavhr{<R)IU(>ghJ$NNo($-6-IAr=-M9o$uI!$X4U--4?&b~dO
z+%e^6M0?DZ8U2(wdg<N1Uy%!%|L)qU>>BmnPhq~LU$XIk!vrRifFREGz6t*x6@PJC
zcgpA2fijQnLQgks=b89N@u7ajmefB<_Fr2s8$a~8wP3#{_r@Pi+?N9FgRga$+<gA<
zo1rrM>`M#z-u!Kj&<lKPky{woP$4%{TQ%{)$Ck_6e}(_)DeLNC@y}`gwn<0pVo`VF
NvGgUkLeAZ9000fhtOx)A


From ce0c7e6c54770e0bd84646610e30cbd60c6487cb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 12:41:29 -0400
Subject: [PATCH 007/847] remove old minecraft container thingy

---
 configuration.nix    |  2 ++
 flake.lock           |  6 +++---
 services/quadlet.nix | 18 ------------------
 3 files changed, 5 insertions(+), 21 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 644f636..5d0c836 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -111,6 +111,8 @@
     ripgrep
 
     intel-gpu-tools
+
+    tmux
   ];
 
   services.zfs = {
diff --git a/flake.lock b/flake.lock
index aa0651e..c1f4eb0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727487901,
-        "narHash": "sha256-m+QPmso7l/SVPgrQz72PicSQgaaLs/Iyy+9eAyHY3+c=",
+        "lastModified": 1727574772,
+        "narHash": "sha256-bPoftKOe6oWR2o5jgLQjmaBNH2ke7+ooDGxlXXIjsBc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "39983d066b08107165ba5757d03f414abb4e52c9",
+        "rev": "5ce4fc09d6fcf0b9d801ff3c98da83c56d85e045",
         "type": "github"
       },
       "original": {
diff --git a/services/quadlet.nix b/services/quadlet.nix
index 47b997e..97767a5 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -12,24 +12,6 @@
         };
       in
       {
-        # minecraft-server.containerConfig = baseContainerConfig // {
-        #   image = "docker.io/itzg/minecraft-server:java21-graalvm";
-        #   name = "minecraft";
-
-        #   environments = {
-        #     TYPE = "QUILT";
-        #     MEMORY = "4G";
-        #     MOD_PLATFORM = "MODRINTH";
-        #     USE_AIKAR_FLAGS = true;
-        #     JVM_OPTS = "-XX:-UseJVMCICompiler";
-        #     MODRINTH_MODPACK = "https://modrinth.com/modpack/sop";
-        #     VERSION = "1.21.1";
-        #   };
-
-        #   publishPorts = [ "${builtins.toString service_configs.ports.minecraft}:25565" ];
-        #   volumes = [ "${service_configs.minecraft.dir}:/data:z" ];
-        # };
-
         gluetun.containerConfig = baseContainerConfig // {
           image = "docker.io/qmcgaw/gluetun";
           name = "gluetun";

From aa204512cebd88699285698ec2c6afcee155bf54 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 12:44:44 -0400
Subject: [PATCH 008/847] cleanup some minecraft config

---
 flake.nix              | 3 ++-
 services/minecraft.nix | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index f4ec7d2..6126287 100644
--- a/flake.nix
+++ b/flake.nix
@@ -53,7 +53,8 @@
         };
 
         minecraft = {
-          dir = "/tank/services/minecraft/main";
+          parent_dir = "/tank/services/minecraft";
+          server_name = "main";
         };
 
         gluetun = {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index c456087..03441bc 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -15,9 +15,9 @@
   services.minecraft-servers = {
     enable = true;
     eula = true;
-    dataDir = "/tank/services/minecraft";
+    dataDir = service_configs.minecraft.parent_dir;
     openFirewall = true;
-    servers.main = {
+    servers.${service_configs.minecraft.server_name} = {
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_1;
       jvmOpts = "-Xmx6144M -Xms6144M -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";

From 54c0b9aab1ffe39a5b7e1e4ea9a4653bad94a118 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 15:59:29 -0400
Subject: [PATCH 009/847] cleanup config

---
 configuration.nix      | 2 +-
 services/gitea.nix     | 2 +-
 services/minecraft.nix | 7 +++++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 5d0c836..c59a990 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -124,7 +124,7 @@
     let
       no-rgb = pkgs.writeScriptBin "no-rgb" ''
         #!/bin/sh
-        NUM_DEVICES=$(${pkgs.openrgb}/bin/openrgb --noautoconnect --list-devices | ${pkgs.coreutils}/bin/grep -E '^[0-9]+: ' | ${pkgs.coreutils}/bin/wc -l)
+        NUM_DEVICES=$(${pkgs.openrgb}/bin/openrgb --noautoconnect --list-devices | ${pkgs.gnugrep}/bin/grep -E '^[0-9]+: ' | ${pkgs.coreutils}/bin/wc -l)
 
         for i in $(${pkgs.coreutils}/bin/seq 0 $(($NUM_DEVICES - 1))); do
           ${pkgs.openrgb}/bin/openrgb --noautoconnect --device $i --mode direct --color 000000
diff --git a/services/gitea.nix b/services/gitea.nix
index 0d20746..39f3a0a 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -6,7 +6,7 @@
 {
   services.gitea = {
     enable = true;
-    appName = "TBD name of my gitea server";
+    appName = "Simon Gardling's Gitea instance";
     stateDir = service_configs.gitea.dir;
     database = {
       type = "postgres";
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 03441bc..d74bd07 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -4,7 +4,9 @@
   lib,
   ...
 }:
-
+let
+heap_size = "6144M";
+in
 {
   nixpkgs.config.allowUnfreePredicate =
     pkg:
@@ -20,7 +22,8 @@
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_1;
-      jvmOpts = "-Xmx6144M -Xms6144M -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";
+      # Aikar's flags
+      jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";
       serverProperties = {
         server-port = service_configs.ports.minecraft;
         enforce-whitelist = true;

From 3ab8f03c8184001efe1b8bc41a08dfa147fc1abb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Sep 2024 18:07:11 -0400
Subject: [PATCH 010/847] fix whitelist

---
 secrets/minecraft-whitelist.nix | Bin 353 -> 353 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 939f4a12e64958d8f19637806b228622e1354489..92ba758f1a2d7aca653b849cd160347f3e833799 100644
GIT binary patch
literal 353
zcmZQ@_Y83kiVO&0SjJ(I;_O-(zD}a!%f_aO3x4?<zE+#R-L`t`J_(skGP%XI^DbU@
zdA(%opZ&o<yqh~~+TOHpGs!N}{avhF9;$wB&5GqIC*#&@J9Dp{rf#%U_Jv3IwId(q
zgfA=-KT`Is&G$)*i-(id3AXO&c^oDEGt)TUH5moO-1==<V<x0q$ENqUbMm9vC;7j&
zPnc?QNzy#1=bpbw)$N43s<pvSr^q-T%Tl+vc3jHv^VGeG%QUn8iZn_rk(SyXeAG{$
ze}{TD!!)r+Ht*{;bVdG;R}SQwwPR9aL6ggGcE2tE&+VCJV|_+6!@@T*GikvphV?Cq
zyMxvgF}_dZHNW}SBUMXxcWqx+c+XamqaW(_RX(}Wv5p~+&4~9^qLS+L)}<R;KW2W~
z`+wS`Jr{EfN@fa$D6!7U7ye}N_Gp;J;+bCa=B4W1UVQ$#>$13ip|N@<^XF_W{pt4O
O#@CPR?XN;jz5oD4(yIIb

literal 353
zcmZQ@_Y83kiVO&0ct5wPiTm>2$L%N9Jy|N?Tv+_@w@6urMX$(Y=GR-@TI?2!>ozKF
z@Dxd_usW8heX?Bp#rb1bINscJm)j8~^Y^z=foB=-=D!aA16s<zezO!zYrU@h&3DD>
zRK=&NY9FSFd=H+ibM}qb0gZ6C(oM}vJNEWTFdEF6`Z)BjwfElMGuI0~RQ$CK6QA?b
z`+3>PHHLmJXWGlQKH^NQ@0g@5XyzZG|MJBpw-*6y_qcSleCJwS-j~OF$TYllc~PzA
zFSR98elEH*=W%*Rmsneo{i+=QD(AoL3qPpFSnN9g=jF9oTvf%*pP6p=sCzB46<Qh4
zAeR(w&VJiblj}|3CdLMz23NLIIVBqtznks;YcbK`>Uxm^<wbt6(;|y+u9xFIzQQ5t
z{!9Dba5;OKp7I@;_J6GyFUc`~+vv29;~4{g!IR?trP@{%?VCQzPe^+daz&!-gY{ST
Nf5pw)<93JC0|4kgs#pL3


From 3b0e8c2376761d81d33292beffa0dd3b774fd59b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Sep 2024 13:17:41 -0400
Subject: [PATCH 011/847] update

---
 configuration.nix      | 12 ++++++++++++
 flake.lock             |  6 +++---
 flake.nix              | 23 +++++++++++++----------
 hardware.nix           |  1 -
 services/gitea.nix     |  1 +
 services/minecraft.nix |  8 +++++++-
 6 files changed, 36 insertions(+), 15 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index c59a990..4c8ee57 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,6 +19,13 @@
     ./services/minecraft.nix
   ];
 
+  systemd.targets = {
+    sleep.enable = false;
+    suspend.enable = false;
+    hibernate.enable = false;
+    hybrid-sleep.enable = false;
+  };
+
   nix = {
     #garbage collection and cleanup stuff
     gc = {
@@ -113,6 +120,11 @@
     intel-gpu-tools
 
     tmux
+
+    (pkgs.writeScriptBin "mc-attach" ''
+    #!/bin/sh
+    tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
+    '')
   ];
 
   services.zfs = {
diff --git a/flake.lock b/flake.lock
index c1f4eb0..defb0ee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727574772,
-        "narHash": "sha256-bPoftKOe6oWR2o5jgLQjmaBNH2ke7+ooDGxlXXIjsBc=",
+        "lastModified": 1727660955,
+        "narHash": "sha256-993wM0FpCGf6V3MuHbooj7By3Jd6v/Skb7GYou9cNAI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5ce4fc09d6fcf0b9d801ff3c98da83c56d85e045",
+        "rev": "e13f816e5bd0612b68568b04a66b1a5a36566549",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 6126287..74b8718 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,8 +4,10 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     # nixpkgs.url = "github:NixOS/nixpkgs/master";
+
     quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
     quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
+
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
   };
@@ -24,6 +26,7 @@
 
       service_configs = {
         hdd_path = "/mnt/hdd";
+        services_dir = "/tank/services";
 
         # TODO: add checks to make sure none of these collide
         ports = {
@@ -36,12 +39,12 @@
         };
 
         https = {
-          certs = "/tank/services/http_certs";
-          data_dir = "/tank/services/http";
+          certs = service_configs.services_dir + "/http_certs";
+          data_dir = service_configs.services_dir + "/http";
         };
 
         gitea = {
-          dir = "/tank/services/gitea";
+          dir = service_configs.services_dir + "/gitea";
         };
 
         postgres = {
@@ -49,26 +52,26 @@
         };
 
         immich = {
-          dir = "/tank/services/immich";
+          dir = service_configs.services_dir + "/immich";
         };
 
         minecraft = {
-          parent_dir = "/tank/services/minecraft";
+          parent_dir = service_configs.services_dir + "/minecraft";
           server_name = "main";
         };
 
         gluetun = {
-          dir = "/tank/services/gluetun";
+          dir = service_configs.services_dir + "/gluetun";
         };
 
         torrent = {
-          config_dir = "/tank/services/qbittorrent/config";
-          download_dir = "${service_configs.hdd_path}/torrents";
+          config_dir = service_configs.services_dir + "/qbittorrent/config";
+          download_dir = service_configs.hdd_path + "/torrents";
         };
 
         jellyfin = {
-          data_dir = "/tank/services/jellyfin";
-          cache_dir = "/tank/services/jellyfin_cache";
+          data_dir = service_configs.services_dir + "/jellyfin";
+          cache_dir = service_configs.services_dir + "/jellyfin_cache";
         };
       };
     in
diff --git a/hardware.nix b/hardware.nix
index 2229c44..728a2cd 100644
--- a/hardware.nix
+++ b/hardware.nix
@@ -5,7 +5,6 @@
   service_configs,
   ...
 }:
-
 {
   boot.initrd.availableKernelModules = [
     "xhci_pci"
diff --git a/services/gitea.nix b/services/gitea.nix
index 39f3a0a..ff7bff3 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -12,6 +12,7 @@
       type = "postgres";
       socket = service_configs.postgres.socket;
     };
+
     settings = {
       server = {
         DOMAIN = "git.gardling.com";
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d74bd07..3664c36 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-heap_size = "6144M";
+  heap_size = "6144M";
 in
 {
   nixpkgs.config.allowUnfreePredicate =
@@ -14,16 +14,22 @@ in
       "minecraft-server"
     ];
 
+  users.groups.minecraft = {};
+
   services.minecraft-servers = {
     enable = true;
     eula = true;
     dataDir = service_configs.minecraft.parent_dir;
     openFirewall = true;
+    group = "users";
+
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_1;
+
       # Aikar's flags
       jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";
+
       serverProperties = {
         server-port = service_configs.ports.minecraft;
         enforce-whitelist = true;

From 7c57eb1ba6a4f21e1a1988eeeed7c3f15118740e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Sep 2024 13:18:29 -0400
Subject: [PATCH 012/847] format

---
 configuration.nix      | 4 ++--
 services/minecraft.nix | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 4c8ee57..a12ce5e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -122,8 +122,8 @@
     tmux
 
     (pkgs.writeScriptBin "mc-attach" ''
-    #!/bin/sh
-    tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
+      #!/bin/sh
+      tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
     '')
   ];
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 3664c36..815d47b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -14,7 +14,7 @@ in
       "minecraft-server"
     ];
 
-  users.groups.minecraft = {};
+  users.groups.minecraft = { };
 
   services.minecraft-servers = {
     enable = true;

From cee4725baf06f9cf4e508fae1427e3d11af2814b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 1 Oct 2024 09:40:19 -0400
Subject: [PATCH 013/847] flake update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index defb0ee..7467e6d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727660955,
-        "narHash": "sha256-993wM0FpCGf6V3MuHbooj7By3Jd6v/Skb7GYou9cNAI=",
+        "lastModified": 1727747697,
+        "narHash": "sha256-bNZ4ykMpxyTLrPsctiDwe5d69vafvIbNTbzbWfd2CH4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e13f816e5bd0612b68568b04a66b1a5a36566549",
+        "rev": "30af58cedcc444da772a73286e16287f94a9fef1",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1727348695,
-        "narHash": "sha256-J+PeFKSDV+pHL7ukkfpVzCOO7mBSrrpJ3svwBFABbhI=",
+        "lastModified": 1727634051,
+        "narHash": "sha256-S5kVU7U82LfpEukbn/ihcyNt2+EvG7Z5unsKW9H/yFA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1925c603f17fc89f4c8f6bf6f631a802ad85d784",
+        "rev": "06cf0e1da4208d3766d898b7fdab6513366d45b9",
         "type": "github"
       },
       "original": {

From 191ac4c93c1bb09447d0c0884d862374894b8cc7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Oct 2024 13:07:14 -0400
Subject: [PATCH 014/847] reduced power draw + update

---
 configuration.nix | 17 +++++++++++++++++
 flake.lock        | 23 ++++++++++++++++++++---
 flake.nix         |  6 ++++++
 3 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index a12ce5e..2dc3981 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -125,6 +125,21 @@
       #!/bin/sh
       tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
     '')
+
+    (pkgs.writeScriptBin "disk-smart-test" ''
+      #!/bin/sh
+      set -e
+      if [[ $EUID -ne 0 ]]; then
+        echo "This command requires root."
+        exit 2
+      fi
+
+      DISKS=$(${pkgs.coreutils}/bin/ls /dev/sd* | ${pkgs.gnugrep}/bin/grep -v "[0-9]$")
+      for i in $DISKS; do
+        ${pkgs.coreutils}/bin/echo -n "$i "
+        ${pkgs.smartmontools}/bin/smartctl -a "$i" | ${pkgs.gnugrep}/bin/grep "SMART overall-health self-assessment test result:" | ${pkgs.coreutils}/bin/cut -d' ' -f6
+      done
+    '')
   ];
 
   services.zfs = {
@@ -136,6 +151,8 @@
     let
       no-rgb = pkgs.writeScriptBin "no-rgb" ''
         #!/bin/sh
+        set -e
+
         NUM_DEVICES=$(${pkgs.openrgb}/bin/openrgb --noautoconnect --list-devices | ${pkgs.gnugrep}/bin/grep -E '^[0-9]+: ' | ${pkgs.coreutils}/bin/wc -l)
 
         for i in $(${pkgs.coreutils}/bin/seq 0 $(($NUM_DEVICES - 1))); do
diff --git a/flake.lock b/flake.lock
index 7467e6d..5bdf9ae 100644
--- a/flake.lock
+++ b/flake.lock
@@ -56,13 +56,29 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1727665282,
+        "narHash": "sha256-oKtfbQB1MBypqIyzkC8QCQcVGOa1soaXaGgcBIoh14o=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "11c43c830e533dad1be527ecce379fcf994fbbb5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1727634051,
-        "narHash": "sha256-S5kVU7U82LfpEukbn/ihcyNt2+EvG7Z5unsKW9H/yFA=",
+        "lastModified": 1727802920,
+        "narHash": "sha256-HP89HZOT0ReIbI7IJZJQoJgxvB2Tn28V6XS3MNKnfLs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "06cf0e1da4208d3766d898b7fdab6513366d45b9",
+        "rev": "27e30d177e57d912d614c88c622dcfdb2e6e6515",
         "type": "github"
       },
       "original": {
@@ -95,6 +111,7 @@
     "root": {
       "inputs": {
         "nix-minecraft": "nix-minecraft",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "quadlet-nix": "quadlet-nix"
       }
diff --git a/flake.nix b/flake.nix
index 74b8718..70641e2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,6 +5,8 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     # nixpkgs.url = "github:NixOS/nixpkgs/master";
 
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
     quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
     quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -17,6 +19,7 @@
       nixpkgs,
       quadlet-nix,
       nix-minecraft,
+      nixos-hardware,
       ...
     }:
     let
@@ -88,6 +91,9 @@
         modules = [
           ./configuration.nix
           quadlet-nix.nixosModules.quadlet
+          nixos-hardware.nixosModules.common-cpu-amd-pstate
+          nixos-hardware.nixosModules.common-cpu-amd-zenpower
+          nixos-hardware.nixosModules.common-pc-ssd
           (
             { pkgs, ... }:
             {

From f260b58e0f2f7254f4e598b0e0fd3faaf6d71b57 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 4 Oct 2024 10:20:27 -0400
Subject: [PATCH 015/847] jellyfin fix

---
 .gitattributes                           |   1 +
 configuration.nix                        |  22 +++++++++++++++++++++-
 flake.lock                               |   6 +++---
 secrets/Jellyfin.Plugin.ListenBrainz.xml | Bin 0 -> 1410 bytes
 services/jellyfin.nix                    |   7 +++++++
 5 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 secrets/Jellyfin.Plugin.ListenBrainz.xml

diff --git a/.gitattributes b/.gitattributes
index 4c9ff84..021d814 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,3 +2,4 @@ secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/mullvad.nix filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
+secrets/Jellyfin.Plugin.ListenBrainz.xml filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 2dc3981..9ea7519 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -62,6 +62,11 @@
       compressor = "zstd";
       compressorArgs = [ "-19" ];
     };
+    kernelModules = [
+      # kernel module for case fan control
+      "nct6775"
+    ];
+
   };
 
   environment.etc = {
@@ -123,7 +128,7 @@
 
     (pkgs.writeScriptBin "mc-attach" ''
       #!/bin/sh
-      tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
+      ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
     '')
 
     (pkgs.writeScriptBin "disk-smart-test" ''
@@ -178,6 +183,21 @@
   services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
   hardware.i2c.enable = true;
 
+  hardware.fancontrol = {
+    enable = true;
+    config = ''
+      INTERVAL=10
+      DEVPATH=hwmon0=devices/pci0000:00/0000:00:18.3 hwmon1=devices/platform/nct6775.656
+      DEVNAME=hwmon0=zenpower hwmon1=nct6798
+      FCTEMPS=hwmon1/pwm4=hwmon0/temp1_input hwmon1/pwm2=hwmon0/temp1_input
+      FCFANS=hwmon1/pwm4=hwmon1/fan4_input hwmon1/pwm2=hwmon1/fan2_input
+      MINTEMP=hwmon1/pwm4=20 hwmon1/pwm2=20
+      MAXTEMP=hwmon1/pwm4=70 hwmon1/pwm2=70
+      MINSTART=hwmon1/pwm4=150 hwmon1/pwm2=150
+      MINSTOP=hwmon1/pwm4=100 hwmon1/pwm2=100
+    '';
+  };
+
   networking = {
     nameservers = [
       "1.1.1.1"
diff --git a/flake.lock b/flake.lock
index 5bdf9ae..673af12 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727747697,
-        "narHash": "sha256-bNZ4ykMpxyTLrPsctiDwe5d69vafvIbNTbzbWfd2CH4=",
+        "lastModified": 1728006367,
+        "narHash": "sha256-Bdf5twzinaacnn1JBogvxq0S8Ytm+25mWD2cfJ7fvpo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "30af58cedcc444da772a73286e16287f94a9fef1",
+        "rev": "a3a7888df1b87bdababfd9f0b00b574ee4c2e204",
         "type": "github"
       },
       "original": {
diff --git a/secrets/Jellyfin.Plugin.ListenBrainz.xml b/secrets/Jellyfin.Plugin.ListenBrainz.xml
new file mode 100644
index 0000000000000000000000000000000000000000..f5a3780e9f55ea9b95f3623d1fea60cac62d427d
GIT binary patch
literal 1410
zcmZQ@_Y83kiVO&0NXUpfQ=WURgM(`=`{o@Fx5nuFJG?!CIXHmnbdkb~tJQATIK2&*
z2BcJ)u<SC~8$5&iaC^3pa^~8T$u^uur8#f+eOu3Qr+EIJ3p`h9c2%wLJyCb4UC)fS
z>{w;eyY<~Gt{83=2<Si9bUG(P&1NCr=Fi11nEFm#*~x5k?p*VEF~)|4?!L#}``_Mv
z)A#pKLHm=K-#fB4-iUcK=RuwB#LCn48#FfMKX=n*&op-GVm%#ik+CRkWhzUtkBG(3
zb;pb&;!08qi$l&&xc=%_&NSgS`kQ|<?%Di#Wq`=VHntT%KTm!2cTv{a^j$Zu#Z7WD
z3*Ek-aZe#<jN-N>dN#>+n=bb5m72I<l4U<%^Z!P@hxKmyO7q;Opa0OJF?CbY38ou~
zRw15CuUh3y)%iE=$eRN{TpvHJ+h5B6e_zn&=>ZXMER8NTHH5xelo{f8o<FxOVQqSK
z^6RBZpObyNcArx*eBzk-KILuVgE<$&zW+5}kQdE)U+R4kcg==-mbZ6bun36>zV_gw
z#8szc@1MD9uh_hoYOh-+w{a%dx^~8;hRpXIBqzj_Y43HY&1syuyo>Yn)fclrahhap
zxbSY*fAg&@8{K_dH1=&U=uz3m@Mt4L!o-iSd$LQOSIz#lV}Zr1qyJyc*idkfS(J6x
zLBGg@IdQ!lWuH4=nQXKv40^cql;juIr8gez{dL@WU)kEDYd0zEVLlgn=6JBvni*{;
zH{aN@=jxN1tqL5!HY7-&Wc>MA^kJpKmEz~w&Y^mV^A}uC6A7%!%sK48X$2>HUYYIQ
z)p0vJjvV{Vq&8Qn`$hIM^Cix27T+sPew}44kQ)Ac+qs`UuktwinP#S_Z<}y+;>)$1
zm;P?Lz{b4IfAN}7Lu<oL0{tc>vpzjb**klw^ZgrnA19n&yQ=DK;XmDz&d+{4f2Lx+
za$5YM1=Cj_T2@y%S#Y)O)5%(Mr|F5^eBcn%vgoao+IH>R)AHU3t<d_J+np&_A--?(
ziH}p|UU_*LJLS3<%n4ule%(T~LmxSxJgx37^|D{Js^XXKx*WqJrMvHZnmXZW!m3#*
zoK_tVIHUKiJJM@?-sXhgC(bF)g71hk_^9rmP`zmJnv1*V&A83(l+$<j-r7rNC$tDP
z)-QCtU6{P1=Cep#!kT98HtXIW7RtwZW@YS}v+yPNZ_T5BW^<UB2WNR-7TL^N^5XD;
z+s$u2_Q@(AS)`J=fa{`h(N(si&rTiQbmZ%!kBfJnc@Vs4=}xOBJ@)x5uU~8^Ss%Lo
z<+Q(BCayG&y7q#x{$@kWv<v)Kovmhj8y(L&^To+SbasfpvhgX$dp)M5OpE@X>%R2I
z<d4LkMSd68tge|UQst~4Wux|B$)<Rj(C{7(hnhoyA9floO3=xiG9&W3Zkghis{YD(
zryeMWEb}<q`)a`pwE~g&jlVKhm+LFXC#tY2qzEMYw}&0FR#R3|o03+&X@}h2d#OBe
zE?FO>&NF}33%v1TmO$EJo(S=sSDU=oItC@O{&tM{u;x2MdSLvK$p%YT3f|{0dH=zI
zkF8?yjECYc-TFDjXUtT%B=xSK%+%uR&pRf6nk~N1`=#}mQSzPB*$)T84;GbN`|PAH
zKIduLg1ZVHGxTIv^~yY)XL3l_%=h7WqgPi;Ra8_r2hDe8Q7^y1IC-&sMa&YlV@8JG
zZ&XaY^Z3rIhQg>zsY*}SX1%?ABHPWbSo(JAqVPJEG*gL{Q}QD(?{5*$eHQh5{S}VI
z3%2d+`my26J6WYS|Nbps@l!&HCsc2a6~FtfOBdEWXfSxWS9FV>c<Z7T&39)X?3<Xl
zY{G{7Up9T*^wwbpSD~W&-PKJ$56<l8Z~8SO>Gz|x3B5&Ig_gNZ@m;Un948gcGMlG(
tzuobW69M<~T&B(pG~MWT;+(Qd^qcFuZ*<JOQpI?G`-zW_l`iem1OWDx*@OT9

literal 0
HcmV?d00001

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index c602ce7..b1b6072 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  lib,
   ...
 }:
 {
@@ -26,4 +27,10 @@
     "video"
     "render"
   ];
+
+  # https://github.com/lyarenei/jellyfin-plugin-listenbrainz/issues/107
+  system.activationScripts.jellyfinListenBrain.text = ''
+    cp -v /etc/nixos/secrets/Jellyfin.Plugin.ListenBrainz.xml ${service_configs.jellyfin.data_dir}/plugins/configurations/
+    chown ${config.services.jellyfin.user}:${config.services.jellyfin.group} ${service_configs.jellyfin.data_dir}/plugins/configurations/Jellyfin.Plugin.ListenBrainz.xml
+  '';
 }

From 17daac98ee59b02cbc89d1bb32fa8293b74897ca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 4 Oct 2024 11:13:45 -0400
Subject: [PATCH 016/847] cleanup

---
 configuration.nix      |   4 ++
 secrets/mullvad.nix    | Bin 238 -> 269 bytes
 services/immich.nix    |   2 +-
 services/jellyfin.nix  |   2 -
 services/minecraft.nix |   3 --
 services/quadlet.nix   |  89 ++++++++++++++++++-----------------------
 6 files changed, 45 insertions(+), 55 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 9ea7519..d7344a2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -239,6 +239,10 @@
       "wheel"
       "video"
       "render"
+
+      "minecraft"
+      "gitea"
+      "jellyfin"
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/secrets/mullvad.nix b/secrets/mullvad.nix
index 54a389797966e32eba5596b700b7978a23f74baf..45d962b3c0a32968dcfc9301c62f12279e893efc 100644
GIT binary patch
literal 269
zcmZQ@_Y83kiVO&0D6+_&d{cVa{^xGfe{^>quPeXyp0%pKuZZhv@9EQl+vm>+RdCyv
zb+O_JKew^Pip@^fx&KP1u>UFP{i9~AJ176<j#E=|nWjp9-0@e@ojtK;|K~du27G@H
z*}mVq{@g>$?Q;8nDNgjfR+N<L*%+0}z5CdohU)8PC*wk!*cYUwD5|vt&$|$P>-9DD
zv-iJpc5a?ABWb}E=ihu1ZWd1qW_s#XPmf4Cv{LbujZ+fSg~qVGyq1-w+4oxW^4HJ1
zaq-|2y&r!nUu`kEJx|_j?jzm8L^Y`+)y`KgO}g?w%U$q#GK(ntw}#HwzKd9oY+7`|
ej=lEkfB6!lXg&*H{Yxe%AFfthb-AT_u08-d*oFcC

literal 238
zcmZQ@_Y83kiVO&0V9-r^7^s$@{(i4u#4c57k+x&469rGWdG6S&9k!b%d6VI_4IxKg
z|C`(xCh+;<nq_nEK3<-avUjeF*16j|7MR=&yKq3Mdb5azhSkC3nWYMbU;B6cnXWPa
zj^iQ|<F9%}C)GTAPjx*zskoZo;7<?lT&I=h2C)e#m-LTjFT1@tnBR29qZB8n54n$C
zv94NrBEjp8Q}FCn&sVLT)~RxJ_oaukj#UZ;X&rbPTz!7wG`{bttv4z*%(6edenF~`
zu-ne#(@NeX-LFeLIrsh<A&aR&XL*@EURacSefieM-)&yXoLpjf-&dnL^tlB9p-6bu

diff --git a/services/immich.nix b/services/immich.nix
index 114b2d4..d7ed8e2 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -11,7 +11,7 @@
     port = service_configs.ports.immich;
     host = "0.0.0.0";
     database = {
-      createDB = true;
+      createDB = false;
     };
   };
 
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index b1b6072..70d6054 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -17,8 +17,6 @@
     # used for local streaming
     openFirewall = true;
 
-    user = "primary";
-    group = "users";
     dataDir = service_configs.jellyfin.data_dir;
     cacheDir = service_configs.jellyfin.cache_dir;
   };
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 815d47b..1ca53ed 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -14,14 +14,11 @@ in
       "minecraft-server"
     ];
 
-  users.groups.minecraft = { };
-
   services.minecraft-servers = {
     enable = true;
     eula = true;
     dataDir = service_configs.minecraft.parent_dir;
     openFirewall = true;
-    group = "users";
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
diff --git a/services/quadlet.nix b/services/quadlet.nix
index 97767a5..5011543 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -1,66 +1,57 @@
 { service_configs, ... }:
 {
   virtualisation.quadlet = {
-    containers =
-      let
-        baseContainerConfig = {
-          autoUpdate = "registry";
+    containers = {
+      gluetun.containerConfig = {
+        image = "docker.io/qmcgaw/gluetun";
+        name = "gluetun";
+        autoUpdate = "registry";
+
+        addCapabilities = [
+          "NET_ADMIN"
+          "MKNOD"
+        ];
+
+        environments = import ../secrets/mullvad.nix;
+
+        publishPorts = [
+          "6081:6081"
+          "6081:6081/udp"
+          "${builtins.toString service_configs.ports.torrent}:6011"
+        ];
+
+        volumes = [ "${service_configs.gluetun.dir}:/gluetun:z" ];
+        podmanArgs = [
+          "--device=/dev/net/tun"
+          "--security-opt label=disable"
+        ];
+      };
+
+      qbittorrent = {
+        containerConfig = {
+          image = "lscr.io/linuxserver/qbittorrent:latest";
+          name = "qbittorrent";
           environments = {
+            WEBUI_PORT = service_configs.ports.torrent;
+            DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
             PUID = 1000;
             PGID = 1000;
           };
-        };
-      in
-      {
-        gluetun.containerConfig = baseContainerConfig // {
-          image = "docker.io/qmcgaw/gluetun";
-          name = "gluetun";
 
-          addCapabilities = [
-            "NET_ADMIN"
-            "MKNOD"
+          volumes = [
+            "${service_configs.torrent.config_dir}:/config:z"
+            "${service_configs.torrent.download_dir}:/downloads:z"
           ];
 
-          environments = import ../secrets/mullvad.nix;
-
-          publishPorts = [
-            "6081:6081"
-            "6081:6081/udp"
-            "${builtins.toString service_configs.ports.torrent}:6011"
-          ];
-
-          volumes = [ "${service_configs.gluetun.dir}:/gluetun:z" ];
-          podmanArgs = [
-            "--device=/dev/net/tun"
-            "--security-opt label=disable"
-          ];
+          networks = [ "container:gluetun" ];
         };
 
-        qbittorrent = {
-          containerConfig = baseContainerConfig // {
-            image = "lscr.io/linuxserver/qbittorrent:latest";
-            name = "qbittorrent";
-            environments = {
-              WEBUI_PORT = service_configs.ports.torrent;
-              DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
-              PUID = 1000;
-              PGID = 1000;
-            };
-
-            volumes = [
-              "${service_configs.torrent.config_dir}:/config:z"
-              "${service_configs.torrent.download_dir}:/downloads:z"
-            ];
-
-            networks = [ "container:gluetun" ];
-          };
-
-          serviceConfig = {
-            requires = [ "gluetun.service" ];
-            after = [ "gluetun.service" ];
-          };
+        serviceConfig = {
+          requires = [ "gluetun.service" ];
+          after = [ "gluetun.service" ];
         };
       };
+    };
     networks = {
       internal.networkConfig.subnets = [ "10.0.123.1/24" ];
     };

From abd7de8c6a908dc057f2bf5f855f0a486bb49c8c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 4 Oct 2024 13:41:22 -0400
Subject: [PATCH 017/847] intel driver stuff

---
 configuration.nix                        |   4 ++--
 flake.nix                                |   1 +
 secrets/Jellyfin.Plugin.ListenBrainz.xml | Bin 1410 -> 1393 bytes
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d7344a2..b289b11 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -93,14 +93,14 @@
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
-      intel-media-driver
-      intel-vaapi-driver # previously vaapiIntel
       vaapiVdpau
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       vpl-gpu-rt # QSV on 11th gen or newer
     ];
   };
 
+  hardware.intelgpu.driver = "xe";
+
   #fwupd for updating firmware
   services.fwupd = {
     enable = true;
diff --git a/flake.nix b/flake.nix
index 70641e2..6f07bbf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -94,6 +94,7 @@
           nixos-hardware.nixosModules.common-cpu-amd-pstate
           nixos-hardware.nixosModules.common-cpu-amd-zenpower
           nixos-hardware.nixosModules.common-pc-ssd
+          nixos-hardware.nixosModules.common-gpu-intel
           (
             { pkgs, ... }:
             {
diff --git a/secrets/Jellyfin.Plugin.ListenBrainz.xml b/secrets/Jellyfin.Plugin.ListenBrainz.xml
index f5a3780e9f55ea9b95f3623d1fea60cac62d427d..806cdae0ebeec313436b7f4a499b1d345051606c 100644
GIT binary patch
literal 1393
zcmZQ@_Y83kiVO&0*z>DQ{wtgBwPj8@5nRhBvop@Fs{X$AaaG-I&n@@Pu?dIn`=c!X
zVR=M7v(mxx)qG`UN7o2DgsMio_!l&<E~}C=<;nFE>$*Aidp*`&e66%)>au4)^6&iU
zzx7sJAn!x!qZN-QT=6Pd-2bmLuw>$@65pI+#fNh)9oTlGRcPCmGcLbwt+=&xb9>E{
zt~(M9!5vyt?AEI&x=p*-ws}hQhgS^ptH1N<rKEkTe`5MIOr6VxIXd@CZl>a4KCY}o
z3*wHt@#Xe6t=hAuXj<Sxcker^Ha@v`F@WRXD=%r*V|%@Kv-hSK{E0rg&m=v;Ci#29
zo1Y;fC+9N@et1#CVt!}kW1b1~CBr)piVK@I>mBt{$-a2Vz}I<0X5q53J3s7<|2;1i
zIPq!CS+m*8JYyY}?<`kYwSYrI{PwY=#G}RQm8EvK{S`l6m!zp<JA1>ksNPrEpPy!%
z{}N~6?^a&Pn8g~P<zBO9!&SqA1<ebVS>K6pVV)tyJ&*O``ux<E_4}<B$Ue`#V;DWR
z>qm*jw6cRX`@)>#ZfLT~ST7dWkw3R##?co)rq*0aQ<&E~|BS$Q2K8&&_8;uC*%ac6
z*LRobT;6lYc!{@)mHkoMb1{Ou1uZqduQDz?|Lt4o3dy~Kc5b>7cc(>a?prn8)n@MA
z&kDOvzONE5wcu);x9>!@V|2y~owx->y!#GtIqwK?n!bM0#Zxu%IUD=`$gjNk=6#nm
z=TzazdF^?L3!dd^nm*lCTvJx}ajDnqtnRF5PduerRDXvSL`*s^?Zz}`-ww&Dh~W9H
zCtn}mwB^FV?U^3D8<rNdEu1TtpOIC0FlpI`cjsKpk9nWT;1j=o-eHTV^gKg0rHpL{
zN<8N8>Qgd)7ij1CKJWC`uq!Eo%VI@8?5bZ?|E1@s__=t7qB%DLde8jHTlvm!w~v0a
zH_xKlX%~KOni@0Vz`DFgH+!ZYZgIZck#n>?H6VY2(#_6;PQf29ugsjY;+dRO*ymLp
ziRBe0?&r1}e2L6XaOyiD^m_V+pQ@ra{!X5-ST!-t`U>MAYv$<}wp(RP(Y#_Rl6oos
zhVAxmMehDlpCd0Q?AVn(HKbKpJih9IS7UT)Mow)T>!Rf)?5?wy2rOaj2+i_3uQB^B
z|1RkdPt`h>y-#-7x_Ht|-4mI6x3@3c=HDZ8qCl%x_ITXfrIXm7UE}rHCiK(yebAe2
z#%a&&5BBhxgsP|P)lE5fEk-zd@7w3CI_C_F=Ux}l{wFrkqt4y$!P;w<%UO#nTlZ|t
zOk{Ox*<2Fm^mXmya}DJIvpa4VG2i(rJ)KYYey1MCy`n7BM4bS`sDD98eml~YLN==P
zYgy=>`sMb}=-xetFM3tJh3guZeKJWZ6OPHtsO@N<e(7Dhc0ygH%!X;Y+-ikPfl^E{
zbJsp^&s${ZdS!F;n`1kJBD(tmAA2@`&Qg4*@PvQul83V@1hr2;<GFsBYo2BAtO@+S
zFPC&D?=sA@x^$22%mpK%E2}&rvy<I!sd29_ker;KX8t`iMW)Z=U2KE!mb<@qBvy%@
ztLKoFKWu4gr=#-yd4kfXgewi^`NGmZrZZ-}JABTK_4m%CvzHdSpVx3&`aaS#S+8JH
zNqy6S{oOa(3^uheFn#*ZmiQ?~XTN9e`^RspJ}XOaw|*(?*v~gDVAr`F{%=otyzsxB
z6YFDTuxr+e`G<b4%S;mb_=NEjb7awxvix_}imB(e#2?*$IiQRA;K2<pQ9m@(_xbVl
zY}DO4eYUa(V-#b=lClKeOOHG6T3y|}L8#Ns$71pB=bV3f7OnZUHh|@mwf5hipGw@q
zbxY3m>usvt6FK)=*z*N94>2BB6nb|sHgf;u*8#l8ZXEDCbhh}h#=AWo#j_U`t&?BE
TbNLp->WYu9E?ZgWX;=dQU8=H6

literal 1410
zcmZQ@_Y83kiVO&0NXUpfQ=WURgM(`=`{o@Fx5nuFJG?!CIXHmnbdkb~tJQATIK2&*
z2BcJ)u<SC~8$5&iaC^3pa^~8T$u^uur8#f+eOu3Qr+EIJ3p`h9c2%wLJyCb4UC)fS
z>{w;eyY<~Gt{83=2<Si9bUG(P&1NCr=Fi11nEFm#*~x5k?p*VEF~)|4?!L#}``_Mv
z)A#pKLHm=K-#fB4-iUcK=RuwB#LCn48#FfMKX=n*&op-GVm%#ik+CRkWhzUtkBG(3
zb;pb&;!08qi$l&&xc=%_&NSgS`kQ|<?%Di#Wq`=VHntT%KTm!2cTv{a^j$Zu#Z7WD
z3*Ek-aZe#<jN-N>dN#>+n=bb5m72I<l4U<%^Z!P@hxKmyO7q;Opa0OJF?CbY38ou~
zRw15CuUh3y)%iE=$eRN{TpvHJ+h5B6e_zn&=>ZXMER8NTHH5xelo{f8o<FxOVQqSK
z^6RBZpObyNcArx*eBzk-KILuVgE<$&zW+5}kQdE)U+R4kcg==-mbZ6bun36>zV_gw
z#8szc@1MD9uh_hoYOh-+w{a%dx^~8;hRpXIBqzj_Y43HY&1syuyo>Yn)fclrahhap
zxbSY*fAg&@8{K_dH1=&U=uz3m@Mt4L!o-iSd$LQOSIz#lV}Zr1qyJyc*idkfS(J6x
zLBGg@IdQ!lWuH4=nQXKv40^cql;juIr8gez{dL@WU)kEDYd0zEVLlgn=6JBvni*{;
zH{aN@=jxN1tqL5!HY7-&Wc>MA^kJpKmEz~w&Y^mV^A}uC6A7%!%sK48X$2>HUYYIQ
z)p0vJjvV{Vq&8Qn`$hIM^Cix27T+sPew}44kQ)Ac+qs`UuktwinP#S_Z<}y+;>)$1
zm;P?Lz{b4IfAN}7Lu<oL0{tc>vpzjb**klw^ZgrnA19n&yQ=DK;XmDz&d+{4f2Lx+
za$5YM1=Cj_T2@y%S#Y)O)5%(Mr|F5^eBcn%vgoao+IH>R)AHU3t<d_J+np&_A--?(
ziH}p|UU_*LJLS3<%n4ule%(T~LmxSxJgx37^|D{Js^XXKx*WqJrMvHZnmXZW!m3#*
zoK_tVIHUKiJJM@?-sXhgC(bF)g71hk_^9rmP`zmJnv1*V&A83(l+$<j-r7rNC$tDP
z)-QCtU6{P1=Cep#!kT98HtXIW7RtwZW@YS}v+yPNZ_T5BW^<UB2WNR-7TL^N^5XD;
z+s$u2_Q@(AS)`J=fa{`h(N(si&rTiQbmZ%!kBfJnc@Vs4=}xOBJ@)x5uU~8^Ss%Lo
z<+Q(BCayG&y7q#x{$@kWv<v)Kovmhj8y(L&^To+SbasfpvhgX$dp)M5OpE@X>%R2I
z<d4LkMSd68tge|UQst~4Wux|B$)<Rj(C{7(hnhoyA9floO3=xiG9&W3Zkghis{YD(
zryeMWEb}<q`)a`pwE~g&jlVKhm+LFXC#tY2qzEMYw}&0FR#R3|o03+&X@}h2d#OBe
zE?FO>&NF}33%v1TmO$EJo(S=sSDU=oItC@O{&tM{u;x2MdSLvK$p%YT3f|{0dH=zI
zkF8?yjECYc-TFDjXUtT%B=xSK%+%uR&pRf6nk~N1`=#}mQSzPB*$)T84;GbN`|PAH
zKIduLg1ZVHGxTIv^~yY)XL3l_%=h7WqgPi;Ra8_r2hDe8Q7^y1IC-&sMa&YlV@8JG
zZ&XaY^Z3rIhQg>zsY*}SX1%?ABHPWbSo(JAqVPJEG*gL{Q}QD(?{5*$eHQh5{S}VI
z3%2d+`my26J6WYS|Nbps@l!&HCsc2a6~FtfOBdEWXfSxWS9FV>c<Z7T&39)X?3<Xl
zY{G{7Up9T*^wwbpSD~W&-PKJ$56<l8Z~8SO>Gz|x3B5&Ig_gNZ@m;Un948gcGMlG(
tzuobW69M<~T&B(pG~MWT;+(Qd^qcFuZ*<JOQpI?G`-zW_l`iem1OWDx*@OT9


From 8c57bd531e894e0585405e86d254d0de5c0b8377 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 5 Oct 2024 22:41:06 -0400
Subject: [PATCH 018/847] powertop + update

---
 configuration.nix | 17 ++---------------
 flake.lock        | 12 ++++++------
 2 files changed, 8 insertions(+), 21 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index b289b11..7923c9b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -26,6 +26,8 @@
     hybrid-sleep.enable = false;
   };
 
+  powerManagement.powertop.enable = true;
+
   nix = {
     #garbage collection and cleanup stuff
     gc = {
@@ -183,21 +185,6 @@
   services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
   hardware.i2c.enable = true;
 
-  hardware.fancontrol = {
-    enable = true;
-    config = ''
-      INTERVAL=10
-      DEVPATH=hwmon0=devices/pci0000:00/0000:00:18.3 hwmon1=devices/platform/nct6775.656
-      DEVNAME=hwmon0=zenpower hwmon1=nct6798
-      FCTEMPS=hwmon1/pwm4=hwmon0/temp1_input hwmon1/pwm2=hwmon0/temp1_input
-      FCFANS=hwmon1/pwm4=hwmon1/fan4_input hwmon1/pwm2=hwmon1/fan2_input
-      MINTEMP=hwmon1/pwm4=20 hwmon1/pwm2=20
-      MAXTEMP=hwmon1/pwm4=70 hwmon1/pwm2=70
-      MINSTART=hwmon1/pwm4=150 hwmon1/pwm2=150
-      MINSTOP=hwmon1/pwm4=100 hwmon1/pwm2=100
-    '';
-  };
-
   networking = {
     nameservers = [
       "1.1.1.1"
diff --git a/flake.lock b/flake.lock
index 673af12..96c6bab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1727665282,
-        "narHash": "sha256-oKtfbQB1MBypqIyzkC8QCQcVGOa1soaXaGgcBIoh14o=",
+        "lastModified": 1728056216,
+        "narHash": "sha256-IrO06gFUDTrTlIP3Sz+mRB6WUoO2YsgMtOD3zi0VEt0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "11c43c830e533dad1be527ecce379fcf994fbbb5",
+        "rev": "b7ca02c7565fbf6d27ff20dd6dbd49c5b82eef28",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1727802920,
-        "narHash": "sha256-HP89HZOT0ReIbI7IJZJQoJgxvB2Tn28V6XS3MNKnfLs=",
+        "lastModified": 1728018373,
+        "narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "27e30d177e57d912d614c88c622dcfdb2e6e6515",
+        "rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
         "type": "github"
       },
       "original": {

From 68bbbc0dc52c5906442e04f3466a9e8aa87a0d6f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Oct 2024 21:46:36 -0400
Subject: [PATCH 019/847] misc fixes

---
 configuration.nix                        |   6 +++---
 flake.lock                               |  14 +++++++-------
 flake.nix                                |   9 +++++++--
 secrets/Jellyfin.Plugin.ListenBrainz.xml | Bin 1393 -> 1392 bytes
 services/llm.nix                         |  19 +++++++++++++++++++
 services/minecraft.nix                   |   2 +-
 services/quadlet.nix                     |   8 +++++---
 7 files changed, 42 insertions(+), 16 deletions(-)
 create mode 100644 services/llm.nix

diff --git a/configuration.nix b/configuration.nix
index 7923c9b..be3ee62 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -17,6 +17,7 @@
     ./services/immich.nix
     ./services/gitea.nix
     ./services/minecraft.nix
+    ./services/llm.nix
   ];
 
   systemd.targets = {
@@ -26,8 +27,6 @@
     hybrid-sleep.enable = false;
   };
 
-  powerManagement.powertop.enable = true;
-
   nix = {
     #garbage collection and cleanup stuff
     gc = {
@@ -64,11 +63,11 @@
       compressor = "zstd";
       compressorArgs = [ "-19" ];
     };
+
     kernelModules = [
       # kernel module for case fan control
       "nct6775"
     ];
-
   };
 
   environment.etc = {
@@ -230,6 +229,7 @@
       "minecraft"
       "gitea"
       "jellyfin"
+      "ollama"
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/flake.lock b/flake.lock
index 96c6bab..5c3b03d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1728056216,
-        "narHash": "sha256-IrO06gFUDTrTlIP3Sz+mRB6WUoO2YsgMtOD3zi0VEt0=",
+        "lastModified": 1728269138,
+        "narHash": "sha256-oKxDImsOvgUZMY4NwXVyUc/c1HiU2qInX+b5BU0yXls=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b7ca02c7565fbf6d27ff20dd6dbd49c5b82eef28",
+        "rev": "ecfcd787f373f43307d764762e139a7cdeb9c22b",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728018373,
-        "narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
+        "lastModified": 1728348559,
+        "narHash": "sha256-jVgMjAEhwvnuI1WZWoZfM8Luh3zsjn4ZsfOHKKF7kKI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
+        "rev": "6235ae1ef7b09fe720a7f32bd38f74ccb859305a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 6f07bbf..9c57d1a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    # nixpkgs.url = "github:NixOS/nixpkgs/master";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
@@ -39,6 +39,7 @@
           torrent = 6011;
           minecraft = 25565;
           gitea = 3281;
+          ollama = 11434;
         };
 
         https = {
@@ -76,6 +77,10 @@
           data_dir = service_configs.services_dir + "/jellyfin";
           cache_dir = service_configs.services_dir + "/jellyfin_cache";
         };
+
+        ollama = {
+          data_dir = service_configs.services_dir + "/ollama";
+        };
       };
     in
     {
diff --git a/secrets/Jellyfin.Plugin.ListenBrainz.xml b/secrets/Jellyfin.Plugin.ListenBrainz.xml
index 806cdae0ebeec313436b7f4a499b1d345051606c..aa01cea075978240e0a03c38b35fd26324c219f6 100644
GIT binary patch
literal 1392
zcmZQ@_Y83kiVO&0xGfd_@U8*V=H|qhwAK3`eV_4)v%|6QL~hQfcB$j9KP}2|zI#f7
z_xH8cr>B*7@i4}1QT@5Zzg1X^|Fd$`N=FG!>$UIBG&QbCvDakZq@Q-)nBgq%{4FaZ
zdUk$VbH?QLnmyW8VUw>ptYMg5`sGI3Px&T+mO7JT4-$`koNgf}ApQA<-JS%8V|$kL
z?fG|gmO_T$cHuSpSEXc2o7;F<<Inp^uzGu0S~Y)Nm-<4p>bc9|Nk%4r-)S9t#Jj78
z&&uUzPlZ_Y>GLgTKDRU0Un;S&+aAh)XkW@@Ilsj329>GL7j~9gd&Nt<Wh-myO!%j`
z$NJzLA;pXKOE<EXe!A_qUpC9)GvkCka+P!1s&$_3t>72;{P)phXWNV)E?2|%ryT7)
zS(B%kZYM1g`A$SV&g_CzeNBeP&Hcgirx;9fGI}Rm8u56Ymx_)=%+hs<|DGfXIbQTy
z*De$1JKIU=O;5bA`qP?>|LbxN{%Oe6lsxb{+`@SM-GdKUcAmVT^VUe;vh{_fs%(2h
z{DxBs@549_tw}4FeG_1$Cp|qS^43Y#Gb>)z{P%rp@;$Eeu1=C{Tu4jibG@6{Y`f($
z7CfD<$o|^SrsUJk(2COCYCD?#3S=2t=e^@p&tzUy`b1%txPhjyQ1|NGn9}X~AFIlK
zGx2u0`rYM@={~WvUG_jt_Q{PMT{ouiF?j8nxPE<;{MG;QZ#*V6GZa+Ucqy28WvrIw
z@lV@o6Y$xFtLN0MBQ8Si_D4VJw6nWSa%b4ol0I?r+W0B{@#{=KoG~xm6_I>7m-)rN
z+T5QLx0xP`)Bn@qxKp83_rt>9+eBY;Uk;6npXzzC#oX!0+Av$rz~+|Xx>b9eWppa<
zKbo4E`tywZq~rc;uBm^X->7UhLtXCEo&$B;7SF%1i|xU})jkWitToyE`Ks8uaIehe
zFQYZQ1KILD7xKKaN|<Lh<<6|wb@D!jx14L8Cq{fYa(l0zUvKf-X}x9_9kz$Ojpp8J
zyR|2A-si8ndwHTQXSOPQzv1h4%gf>4#8`f}u<}_`i<@^Ru!S9rY7<`gYU}d)>zPd|
zuP^IQsrqzae|yx^V>c@Qhx5OFo_|?*&$h<j^K`?C)}-9OV*F}FuKLDHCa!xJQg+^2
zz4YGXCq^r3EG^$(bk5ko9`S$Lk`A_mRqrm&k*!&~&@D^z*_||RCKj$&y+-|iZ{8@o
z_9Y`*HlMLbNwgtA^utGIN486WNxZRs&o@l`dfcEU%Xz``7rBdhjag?}&ey9|_%V_9
z#L_ys@`~Gu#X>(UJ#H$#eX_N~q2Wk0`-vCJ@^^0gu-MLQgS@nhb3%vfH-p=8Cq1V>
zHY<Mj!GF(z&s{6*wmdq%JyC>J#eG*&wdSpjy@yOE9{<o}#a(yfJ4bfIdWRmKz)dxV
z+&h?0AM3u-zTZT#-ywHZ&6R}H^Sn(DoY?;_@82aIyE`A_j{fE}tNi$<@<BJxgoHGQ
zb*rnR7vH}r7=8YV%#tkq873m{Kb$<g`v241%k6S|HcJ_?Xee$z{y@F^kWKUaj&8Hx
zF^7W`<_l%@9$r<=e=i~7Vcg<vzHB>>Mt&>fvu+JJnK5&L)Q<fR1pHcsg0C`Hp9w5>
z5LOJ@vFMTJw0#dtJbWtqPPj*0{kPPu;7Zv!v#FbIZVZ%^yJNhHy+M_KXZgddkG}Q6
zs)yABxY+-i{90qq;xK!Mcvx?twEHW*%Q7;j{pF4yod0Qh$k|j6d1K{|U0z#HM`=pO
zT6gG|owwEfy6JQBd;2qwZhx&3(Mh~?dx_`Sn;9R{?w|b}&&>Wz+Pw64s-)e!x+Cv9
zSMLrDG1z);$t-rW>-(-MzdC<Ev^FG>@2<K@ZoALL-B-HIm*<35Rh`;($3Jt;<*x6u
Q&vnm!a#G-=&9OFH0Mgg8{Qv*}

literal 1393
zcmZQ@_Y83kiVO&0*z>DQ{wtgBwPj8@5nRhBvop@Fs{X$AaaG-I&n@@Pu?dIn`=c!X
zVR=M7v(mxx)qG`UN7o2DgsMio_!l&<E~}C=<;nFE>$*Aidp*`&e66%)>au4)^6&iU
zzx7sJAn!x!qZN-QT=6Pd-2bmLuw>$@65pI+#fNh)9oTlGRcPCmGcLbwt+=&xb9>E{
zt~(M9!5vyt?AEI&x=p*-ws}hQhgS^ptH1N<rKEkTe`5MIOr6VxIXd@CZl>a4KCY}o
z3*wHt@#Xe6t=hAuXj<Sxcker^Ha@v`F@WRXD=%r*V|%@Kv-hSK{E0rg&m=v;Ci#29
zo1Y;fC+9N@et1#CVt!}kW1b1~CBr)piVK@I>mBt{$-a2Vz}I<0X5q53J3s7<|2;1i
zIPq!CS+m*8JYyY}?<`kYwSYrI{PwY=#G}RQm8EvK{S`l6m!zp<JA1>ksNPrEpPy!%
z{}N~6?^a&Pn8g~P<zBO9!&SqA1<ebVS>K6pVV)tyJ&*O``ux<E_4}<B$Ue`#V;DWR
z>qm*jw6cRX`@)>#ZfLT~ST7dWkw3R##?co)rq*0aQ<&E~|BS$Q2K8&&_8;uC*%ac6
z*LRobT;6lYc!{@)mHkoMb1{Ou1uZqduQDz?|Lt4o3dy~Kc5b>7cc(>a?prn8)n@MA
z&kDOvzONE5wcu);x9>!@V|2y~owx->y!#GtIqwK?n!bM0#Zxu%IUD=`$gjNk=6#nm
z=TzazdF^?L3!dd^nm*lCTvJx}ajDnqtnRF5PduerRDXvSL`*s^?Zz}`-ww&Dh~W9H
zCtn}mwB^FV?U^3D8<rNdEu1TtpOIC0FlpI`cjsKpk9nWT;1j=o-eHTV^gKg0rHpL{
zN<8N8>Qgd)7ij1CKJWC`uq!Eo%VI@8?5bZ?|E1@s__=t7qB%DLde8jHTlvm!w~v0a
zH_xKlX%~KOni@0Vz`DFgH+!ZYZgIZck#n>?H6VY2(#_6;PQf29ugsjY;+dRO*ymLp
ziRBe0?&r1}e2L6XaOyiD^m_V+pQ@ra{!X5-ST!-t`U>MAYv$<}wp(RP(Y#_Rl6oos
zhVAxmMehDlpCd0Q?AVn(HKbKpJih9IS7UT)Mow)T>!Rf)?5?wy2rOaj2+i_3uQB^B
z|1RkdPt`h>y-#-7x_Ht|-4mI6x3@3c=HDZ8qCl%x_ITXfrIXm7UE}rHCiK(yebAe2
z#%a&&5BBhxgsP|P)lE5fEk-zd@7w3CI_C_F=Ux}l{wFrkqt4y$!P;w<%UO#nTlZ|t
zOk{Ox*<2Fm^mXmya}DJIvpa4VG2i(rJ)KYYey1MCy`n7BM4bS`sDD98eml~YLN==P
zYgy=>`sMb}=-xetFM3tJh3guZeKJWZ6OPHtsO@N<e(7Dhc0ygH%!X;Y+-ikPfl^E{
zbJsp^&s${ZdS!F;n`1kJBD(tmAA2@`&Qg4*@PvQul83V@1hr2;<GFsBYo2BAtO@+S
zFPC&D?=sA@x^$22%mpK%E2}&rvy<I!sd29_ker;KX8t`iMW)Z=U2KE!mb<@qBvy%@
ztLKoFKWu4gr=#-yd4kfXgewi^`NGmZrZZ-}JABTK_4m%CvzHdSpVx3&`aaS#S+8JH
zNqy6S{oOa(3^uheFn#*ZmiQ?~XTN9e`^RspJ}XOaw|*(?*v~gDVAr`F{%=otyzsxB
z6YFDTuxr+e`G<b4%S;mb_=NEjb7awxvix_}imB(e#2?*$IiQRA;K2<pQ9m@(_xbVl
zY}DO4eYUa(V-#b=lClKeOOHG6T3y|}L8#Ns$71pB=bV3f7OnZUHh|@mwf5hipGw@q
zbxY3m>usvt6FK)=*z*N94>2BB6nb|sHgf;u*8#l8ZXEDCbhh}h#=AWo#j_U`t&?BE
TbNLp->WYu9E?ZgWX;=dQU8=H6

diff --git a/services/llm.nix b/services/llm.nix
new file mode 100644
index 0000000..73323a2
--- /dev/null
+++ b/services/llm.nix
@@ -0,0 +1,19 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  ...
+}:
+{
+  services.ollama = {
+    enable = true;
+    home = service_configs.ollama.data_dir + "/home";
+    models = service_configs.ollama.data_dir + "/home/models";
+    environmentVariables = {
+      OLLAMA_LLM_LIBRARY = "cpu_avx2";
+    };
+    host = "0.0.0.0";
+    port = service_configs.ports.ollama;
+    user = "ollama";
+  };
+}
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 1ca53ed..02cea05 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  heap_size = "6144M";
+  heap_size = "3000M";
 in
 {
   nixpkgs.config.allowUnfreePredicate =
diff --git a/services/quadlet.nix b/services/quadlet.nix
index 5011543..e65ecd3 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -1,4 +1,4 @@
-{ service_configs, ... }:
+{ service_configs, config, ... }:
 {
   virtualisation.quadlet = {
     containers = {
@@ -31,11 +31,13 @@
         containerConfig = {
           image = "lscr.io/linuxserver/qbittorrent:latest";
           name = "qbittorrent";
+          autoUpdate = "registry";
+
           environments = {
             WEBUI_PORT = service_configs.ports.torrent;
             DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
-            PUID = 1000;
-            PGID = 1000;
+            # PUID = 1000;
+            PGID = config.users.groups.${config.services.jellyfin.group}.gid;
           };
 
           volumes = [

From 93a4988f95db555b6445602141e652cf0456840b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Oct 2024 23:16:04 -0400
Subject: [PATCH 020/847] fixes

---
 flake.lock            | 12 ++++++------
 flake.nix             |  1 +
 services/caddy.nix    |  2 +-
 services/gitea.nix    |  4 ++--
 services/jellyfin.nix |  1 -
 services/quadlet.nix  |  4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5c3b03d..ab73c22 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728006367,
-        "narHash": "sha256-Bdf5twzinaacnn1JBogvxq0S8Ytm+25mWD2cfJ7fvpo=",
+        "lastModified": 1728351976,
+        "narHash": "sha256-X83r7hCo6fzllvgVGT2sJhl0dwZbA4xfud3GFtkwaBg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a3a7888df1b87bdababfd9f0b00b574ee4c2e204",
+        "rev": "02bae91cf389340c62bb367d4a5b6ad06a2562d1",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728348559,
-        "narHash": "sha256-jVgMjAEhwvnuI1WZWoZfM8Luh3zsjn4ZsfOHKKF7kKI=",
+        "lastModified": 1728352754,
+        "narHash": "sha256-rIa/pEDxkQqSaDMxNIlsFq0GpKSCeNxWkvhUzdLLrWk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6235ae1ef7b09fe720a7f32bd38f74ccb859305a",
+        "rev": "3727d51a8e07e635b9bcbc5f812b16d80d46eaeb",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 9c57d1a..dd28d8f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -49,6 +49,7 @@
 
         gitea = {
           dir = service_configs.services_dir + "/gitea";
+          domain = "git.gardling.com";
         };
 
         postgres = {
diff --git a/services/caddy.nix b/services/caddy.nix
index 493548c..df814df 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -25,7 +25,7 @@
         }
       '';
 
-      "git.gardling.com".extraConfig = ''
+      ${service_configs.gitea.domain}.extraConfig = ''
         reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.gitea}
       '';
     };
diff --git a/services/gitea.nix b/services/gitea.nix
index ff7bff3..76e1500 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -15,8 +15,8 @@
 
     settings = {
       server = {
-        DOMAIN = "git.gardling.com";
-        ROOT_URL = "https://git.gardling.com";
+        DOMAIN = service_configs.gitea.domain;
+        ROOT_URL = "https://" + service_configs.gitea.domain;
         HTTP_PORT = service_configs.ports.gitea;
         LANDING_PAGE = "/explore/repos";
       };
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 70d6054..dc492ad 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   service_configs,
-  lib,
   ...
 }:
 {
diff --git a/services/quadlet.nix b/services/quadlet.nix
index e65ecd3..cfad5af 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -5,7 +5,7 @@
       gluetun.containerConfig = {
         image = "docker.io/qmcgaw/gluetun";
         name = "gluetun";
-        autoUpdate = "registry";
+        # autoUpdate = "registry";
 
         addCapabilities = [
           "NET_ADMIN"
@@ -36,7 +36,6 @@
           environments = {
             WEBUI_PORT = service_configs.ports.torrent;
             DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
-            # PUID = 1000;
             PGID = config.users.groups.${config.services.jellyfin.group}.gid;
           };
 
@@ -54,6 +53,7 @@
         };
       };
     };
+
     networks = {
       internal.networkConfig.subnets = [ "10.0.123.1/24" ];
     };

From ce6409221e7b72c033b7149c9bd561eb4b23587d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Oct 2024 13:44:28 -0400
Subject: [PATCH 021/847] add reflac and misc changes

---
 configuration.nix | 30 ++++++++++++++++--------------
 flake.lock        | 14 +++++++-------
 flake.nix         |  4 ++--
 3 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index be3ee62..9c924e5 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -55,23 +55,22 @@
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
 
-      # 1 sec timeout
+      # 1s timeout
       timeout = 1;
     };
 
     initrd = {
       compressor = "zstd";
-      compressorArgs = [ "-19" ];
     };
 
-    kernelModules = [
-      # kernel module for case fan control
-      "nct6775"
-    ];
+    # kernelModules = [
+    #   # kernel module for case fan control
+    #   "nct6775"
+    # ];
   };
 
   environment.etc = {
-    "issue".text = "muffin server :3\n";
+    "issue".text = "";
   };
 
   # Set your time zone.
@@ -86,11 +85,6 @@
     };
   };
 
-  #Intel GPU stuff
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
-  };
-
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
@@ -100,8 +94,6 @@
     ];
   };
 
-  hardware.intelgpu.driver = "xe";
-
   #fwupd for updating firmware
   services.fwupd = {
     enable = true;
@@ -146,6 +138,16 @@
         ${pkgs.smartmontools}/bin/smartctl -a "$i" | ${pkgs.gnugrep}/bin/grep "SMART overall-health self-assessment test result:" | ${pkgs.coreutils}/bin/cut -d' ' -f6
       done
     '')
+
+    flac
+    (pkgs.writeScriptBin "reflac" (
+      builtins.readFile (
+        pkgs.fetchurl {
+          url = "https://raw.githubusercontent.com/chungy/reflac/refs/heads/master/reflac";
+          sha256 = "61c6cc8be3d276c6714e68b55e5de0e6491f50bbf195233073dbce14a1e278a7";
+        }
+      )
+    ))
   ];
 
   services.zfs = {
diff --git a/flake.lock b/flake.lock
index ab73c22..d0316c9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728351976,
-        "narHash": "sha256-X83r7hCo6fzllvgVGT2sJhl0dwZbA4xfud3GFtkwaBg=",
+        "lastModified": 1728611137,
+        "narHash": "sha256-P3IMlCnXU2yK1eosUjZy/zGvjYJLv4aCIK0s/d9iUKY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "02bae91cf389340c62bb367d4a5b6ad06a2562d1",
+        "rev": "76dd43c0d72e8ada06a7f04348e88f91385791bf",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728352754,
-        "narHash": "sha256-rIa/pEDxkQqSaDMxNIlsFq0GpKSCeNxWkvhUzdLLrWk=",
+        "lastModified": 1728492678,
+        "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3727d51a8e07e635b9bcbc5f812b16d80d46eaeb",
+        "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index dd28d8f..46491c0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
   description = "Flake for server muffin";
 
   inputs = {
-    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 

From 777d685a7898a808bc7df1ecad0e95072bdf7b6f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 12 Oct 2024 22:45:50 -0400
Subject: [PATCH 022/847] minecraft mod overhaul + explicitly set zfs snapshot
 timers

---
 configuration.nix      | 10 +++++-
 flake.lock             | 12 +++----
 services/minecraft.nix | 71 ++++++++++++++++++++++++++----------------
 3 files changed, 60 insertions(+), 33 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 9c924e5..0d8d5ec 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -152,7 +152,15 @@
 
   services.zfs = {
     autoScrub.enable = true;
-    autoSnapshot.enable = true;
+    trim.enable = true;
+    autoSnapshot = {
+      enable = true;
+      frequent = 4; # 15-minutes
+      hourly = 24;
+      daily = 7;
+      weekly = 4;
+      monthly = 12;
+    };
   };
 
   systemd.services.no-rgb =
diff --git a/flake.lock b/flake.lock
index d0316c9..17c2955 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728611137,
-        "narHash": "sha256-P3IMlCnXU2yK1eosUjZy/zGvjYJLv4aCIK0s/d9iUKY=",
+        "lastModified": 1728697384,
+        "narHash": "sha256-dyO5diBCVROITF9d0MP5opEKDWuGNs7mNJWUevoxbjk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "76dd43c0d72e8ada06a7f04348e88f91385791bf",
+        "rev": "2888f41c58ea9a09725dafd55f72dd4839b23387",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1728269138,
-        "narHash": "sha256-oKxDImsOvgUZMY4NwXVyUc/c1HiU2qInX+b5BU0yXls=",
+        "lastModified": 1728729581,
+        "narHash": "sha256-oazkQ/z7r43YkDLLQdMg8oIB3CwWNb+2ZrYOxtLEWTQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "ecfcd787f373f43307d764762e139a7cdeb9c22b",
+        "rev": "a8dd1b21995964b115b1e3ec639dd6ce24ab9806",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 02cea05..bba98c3 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  heap_size = "3000M";
+  heap_size = "4000M";
 in
 {
   nixpkgs.config.allowUnfreePredicate =
@@ -41,45 +41,64 @@ in
       symlinks = {
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           builtins.attrValues {
-            BadOptimizations = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/g96Z4WVZ/versions/XYBqWKD2/BadOptimizations-2.1.4-1.21.jar";
-              sha512 = "6f12d5d7b75ed38f006e4c1e176a2308bf78e6bb5d49601152d7a8fa8e576b3e884bd04fcfb976b82fb67a62408e7efcff3ecc6844cea62b07d4b0538b9f0549";
-            };
-            ClothConfig = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/9s6osm5g/versions/HpMb5wGb/cloth-config-15.0.140-fabric.jar";
-              sha512 = "1b3f5db4fc1d481704053db9837d530919374bf7518d7cede607360f0348c04fc6347a3a72ccfef355559e1f4aef0b650cd58e5ee79c73b12ff0fc2746797a00";
-            };
-            C2ME = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/AHlC1pea/c2me-fabric-mc1.21.1-0.3.0%2Balpha.0.212.jar";
-              sha512 = "a1977f3bb02a793677db0b0e20494af4bd648efd3b7e83d0c1ef3f14e7fdc0c4d3a9561b841fde97a123b87123275ce3c213bf414f91bc1393f26c95a70f0536";
-            };
             FabricApi = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/WTaAx4ah/fabric-api-0.105.0%2B1.21.1.jar";
               sha512 = "6e1ffcf7f5af9589c16ccec1f9bb5ef8dede5ebe52ae09d94affa8050603f6ecd71d130a793c2bdb4bd42b2a70905425e55141d39369dfa9840569eef4dace16";
             };
-            FerriteCore = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/wmIZ4wP4/ferritecore-7.0.0-fabric.jar";
-              sha512 = "0f2f9b5aebd71ef3064fc94df964296ac6ee8ea12221098b9df037bdcaaca7bccd473c981795f4d57ff3d49da3ef81f13a42566880b9f11dc64645e9c8ad5d4f";
-            };
+
+            # ClothConfig = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/9s6osm5g/versions/HpMb5wGb/cloth-config-15.0.140-fabric.jar";
+            #   sha512 = "1b3f5db4fc1d481704053db9837d530919374bf7518d7cede607360f0348c04fc6347a3a72ccfef355559e1f4aef0b650cd58e5ee79c73b12ff0fc2746797a00";
+            # };
+
+            # BadOptimizations = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/g96Z4WVZ/versions/XYBqWKD2/BadOptimizations-2.1.4-1.21.jar";
+            #   sha512 = "6f12d5d7b75ed38f006e4c1e176a2308bf78e6bb5d49601152d7a8fa8e576b3e884bd04fcfb976b82fb67a62408e7efcff3ecc6844cea62b07d4b0538b9f0549";
+            # };
+
+            # FerriteCore = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/wmIZ4wP4/ferritecore-7.0.0-fabric.jar";
+            #   sha512 = "0f2f9b5aebd71ef3064fc94df964296ac6ee8ea12221098b9df037bdcaaca7bccd473c981795f4d57ff3d49da3ef81f13a42566880b9f11dc64645e9c8ad5d4f";
+            # };
+
             Lithium = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/9x0igjLz/lithium-fabric-mc1.21.1-0.13.1.jar";
               sha512 = "4250a630d43492da35c4c197ae43082186938fdcb42bafcb6ccad925b79f583abdfdc17ce792c6c6686883f7f109219baecb4906a65d524026d4e288bfbaf146";
             };
+
             NoChatReports = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/riMhCAII/NoChatReports-FABRIC-1.21-v2.8.0.jar";
               sha512 = "092837afc0fcb5208561062f8e4cd69971efa94c0180ae377e318d35d8f278abbf1552e4a577be882dc7e870f884779bc36caf808c8bc90bb05490f1e034ddb8";
             };
-            noisium = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
-              sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
+
+            krypton = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/Acz3ttTp/krypton-0.2.8.jar";
+              sha512 = "5f8cf96c79bfd4d893f1d70da582e62026bed36af49a7fa7b1e00fb6efb28d9ad6a1eec147020496b4fe38693d33fe6bfcd1eebbd93475612ee44290c2483784";
             };
-            threadtweak = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/vSEH1ERy/versions/F4sjmsi3/threadtweak-fabric-0.1.5%2Bmc1.21.1.jar";
-              sha512 = "b0221075239b9998d08e9a42d7bb3205c22482dc39f4b62a1c57c1f7444c9ec9cdee4a245b6b9c6b23f61f3cec82056c40cfc09e6c1bc0690cd936dfed6393a1";
+
+            tick-stasis = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
+              sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
             };
-            vmp = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/wnEe9KBa/versions/VuFHjBNh/vmp-fabric-mc1.21.1-0.2.0%2Bbeta.7.168-all.jar";
-              sha512 = "5e2360e91a36d0e76ff0e805c504c773a1449252572ae218edf4430bdf179ac50b1a080d3ca25ecca266499b5637b5b92a228d1c6516e742a7c9f560791c4059";
+
+            # noisium = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
+            #   sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
+            # };
+
+            # threadtweak = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/vSEH1ERy/versions/F4sjmsi3/threadtweak-fabric-0.1.5%2Bmc1.21.1.jar";
+            #   sha512 = "b0221075239b9998d08e9a42d7bb3205c22482dc39f4b62a1c57c1f7444c9ec9cdee4a245b6b9c6b23f61f3cec82056c40cfc09e6c1bc0690cd936dfed6393a1";
+            # };
+
+            # vmp = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/wnEe9KBa/versions/VuFHjBNh/vmp-fabric-mc1.21.1-0.2.0%2Bbeta.7.168-all.jar";
+            #   sha512 = "5e2360e91a36d0e76ff0e805c504c773a1449252572ae218edf4430bdf179ac50b1a080d3ca25ecca266499b5637b5b92a228d1c6516e742a7c9f560791c4059";
+            # };
+
+            moonrise = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/cYZu5wqk/Moonrise-Fabric-0.1.0-beta.4%2Be244c60.jar";
+              sha512 = "e54f1072a7a037f75f990abfb8d34282a9c70c36e7eea2ecb6d1e0e5f127aa46c8f40345d661df49357e9adbe3850816b732b515d5821f49f114b06ddac91c07";
             };
           }
         );

From c99f3f69dc9249d5d852fd87a3ab4f88227b0661 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 12 Oct 2024 23:08:20 -0400
Subject: [PATCH 023/847] minecraft stuff

---
 flake.lock             |  6 +++---
 services/minecraft.nix | 28 ++++------------------------
 2 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 17c2955..84335b2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728697384,
-        "narHash": "sha256-dyO5diBCVROITF9d0MP5opEKDWuGNs7mNJWUevoxbjk=",
+        "lastModified": 1728784327,
+        "narHash": "sha256-Ib1rAnxE4ZZtO3WE7E4+mwivz37gwNOW5qPToJb9RPQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "2888f41c58ea9a09725dafd55f72dd4839b23387",
+        "rev": "14f679c6eaba1ef43b6f6092ba82e24cba97c858",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index bba98c3..f216c08 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -46,16 +46,6 @@ in
               sha512 = "6e1ffcf7f5af9589c16ccec1f9bb5ef8dede5ebe52ae09d94affa8050603f6ecd71d130a793c2bdb4bd42b2a70905425e55141d39369dfa9840569eef4dace16";
             };
 
-            # ClothConfig = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/9s6osm5g/versions/HpMb5wGb/cloth-config-15.0.140-fabric.jar";
-            #   sha512 = "1b3f5db4fc1d481704053db9837d530919374bf7518d7cede607360f0348c04fc6347a3a72ccfef355559e1f4aef0b650cd58e5ee79c73b12ff0fc2746797a00";
-            # };
-
-            # BadOptimizations = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/g96Z4WVZ/versions/XYBqWKD2/BadOptimizations-2.1.4-1.21.jar";
-            #   sha512 = "6f12d5d7b75ed38f006e4c1e176a2308bf78e6bb5d49601152d7a8fa8e576b3e884bd04fcfb976b82fb67a62408e7efcff3ecc6844cea62b07d4b0538b9f0549";
-            # };
-
             # FerriteCore = pkgs.fetchurl {
             #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/wmIZ4wP4/ferritecore-7.0.0-fabric.jar";
             #   sha512 = "0f2f9b5aebd71ef3064fc94df964296ac6ee8ea12221098b9df037bdcaaca7bccd473c981795f4d57ff3d49da3ef81f13a42566880b9f11dc64645e9c8ad5d4f";
@@ -81,20 +71,10 @@ in
               sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
             };
 
-            # noisium = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
-            #   sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
-            # };
-
-            # threadtweak = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/vSEH1ERy/versions/F4sjmsi3/threadtweak-fabric-0.1.5%2Bmc1.21.1.jar";
-            #   sha512 = "b0221075239b9998d08e9a42d7bb3205c22482dc39f4b62a1c57c1f7444c9ec9cdee4a245b6b9c6b23f61f3cec82056c40cfc09e6c1bc0690cd936dfed6393a1";
-            # };
-
-            # vmp = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/wnEe9KBa/versions/VuFHjBNh/vmp-fabric-mc1.21.1-0.2.0%2Bbeta.7.168-all.jar";
-            #   sha512 = "5e2360e91a36d0e76ff0e805c504c773a1449252572ae218edf4430bdf179ac50b1a080d3ca25ecca266499b5637b5b92a228d1c6516e742a7c9f560791c4059";
-            # };
+            noisium = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
+              sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
+            };
 
             moonrise = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/cYZu5wqk/Moonrise-Fabric-0.1.0-beta.4%2Be244c60.jar";

From 1511a5b009b61b07380d57899e7db5b92f0a1eca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 17 Oct 2024 15:45:29 -0400
Subject: [PATCH 024/847] refactoring

---
 configuration.nix      |  8 ++++----
 flake.lock             | 20 ++++++++++----------
 flake.nix              | 15 ++++++---------
 services/caddy.nix     |  6 +++---
 services/gitea.nix     |  4 ++--
 services/immich.nix    |  2 +-
 services/jellyfin.nix  |  8 ++++----
 services/llm.nix       |  2 +-
 services/minecraft.nix |  5 ++---
 9 files changed, 33 insertions(+), 37 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 0d8d5ec..ed0e7b1 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -119,7 +119,7 @@
 
     tmux
 
-    (pkgs.writeScriptBin "mc-attach" ''
+    (pkgs.writeScriptBin "mc-console" ''
       #!/bin/sh
       ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
     '')
@@ -237,9 +237,9 @@
       "render"
 
       "minecraft"
-      "gitea"
-      "jellyfin"
-      "ollama"
+      config.services.gitea.group
+      config.services.jellyfin.group
+      config.services.caddy.group
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/flake.lock b/flake.lock
index 84335b2..de0597e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1728784327,
-        "narHash": "sha256-Ib1rAnxE4ZZtO3WE7E4+mwivz37gwNOW5qPToJb9RPQ=",
+        "lastModified": 1729129578,
+        "narHash": "sha256-iZnoPpexSDKsCNFWfF6QFsxD/jC+l6GalSqx7Q3L41M=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "14f679c6eaba1ef43b6f6092ba82e24cba97c858",
+        "rev": "8a5c546a755ecc089ea8355c5b7ccbe284e8f00e",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728492678,
-        "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
+        "lastModified": 1729194116,
+        "narHash": "sha256-JrdCY/CX30eyUhd7u8hmDgZLuG/HsNDqTu8RQQTpQO0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
+        "rev": "8e8d47269fef696d0264584a33405bae4c9a4005",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -95,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727065535,
-        "narHash": "sha256-jX83vspAPZnnpFUylUYqP+J1RoZc9w10bbQtsEwD20A=",
+        "lastModified": 1729072507,
+        "narHash": "sha256-srn/XjGNtaO34/CX6H85NVIQ1ksBDOSToMiLu+22Tek=",
         "owner": "SEIAROTg",
         "repo": "quadlet-nix",
-        "rev": "51e2beaaf127c8b4460d909c6c29ed9d60bfde0c",
+        "rev": "5970e7be88ec6d063a79c7669a68918c4827caa0",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 46491c0..3e74686 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    # nixpkgs.url = "github:NixOS/nixpkgs/master";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
@@ -21,7 +21,7 @@
       nix-minecraft,
       nixos-hardware,
       ...
-    }:
+    }@inputs:
     let
       username = "primary";
       hostname = "muffin";
@@ -34,11 +34,8 @@
         # TODO: add checks to make sure none of these collide
         ports = {
           https = 443;
-          immich = 3001;
-          jellyfin = 8096;
+          jellyfin = 8096; # no services.jellyfin option for this
           torrent = 6011;
-          minecraft = 25565;
-          gitea = 3281;
           ollama = 11434;
         };
 
@@ -75,8 +72,7 @@
         };
 
         jellyfin = {
-          data_dir = service_configs.services_dir + "/jellyfin";
-          cache_dir = service_configs.services_dir + "/jellyfin_cache";
+          dir = service_configs.services_dir + "/jellyfin";
         };
 
         ollama = {
@@ -92,6 +88,7 @@
             hostname
             eth_interface
             service_configs
+            inputs
             ;
         };
         modules = [
diff --git a/services/caddy.nix b/services/caddy.nix
index df814df..1f13e27 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -1,4 +1,4 @@
-{ service_configs, ... }:
+{ config, service_configs, ... }:
 {
   services.caddy = {
     enable = true;
@@ -15,7 +15,7 @@
       '';
 
       "immich.gardling.com".extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.immich}
+        reverse_proxy 127.0.0.1:${builtins.toString config.services.immich.port}
       '';
 
       "jellyfin.gardling.com".extraConfig = ''
@@ -26,7 +26,7 @@
       '';
 
       ${service_configs.gitea.domain}.extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.gitea}
+        reverse_proxy 127.0.0.1:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
       '';
     };
   };
diff --git a/services/gitea.nix b/services/gitea.nix
index 76e1500..e930e61 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -16,8 +16,8 @@
     settings = {
       server = {
         DOMAIN = service_configs.gitea.domain;
-        ROOT_URL = "https://" + service_configs.gitea.domain;
-        HTTP_PORT = service_configs.ports.gitea;
+        ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
+        HTTP_PORT = 3281;
         LANDING_PAGE = "/explore/repos";
       };
       session = {
diff --git a/services/immich.nix b/services/immich.nix
index d7ed8e2..20c2f74 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -8,7 +8,7 @@
   services.immich = {
     enable = true;
     mediaLocation = service_configs.immich.dir;
-    port = service_configs.ports.immich;
+    port = 2283;
     host = "0.0.0.0";
     database = {
       createDB = false;
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index dc492ad..d971c0a 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -16,8 +16,8 @@
     # used for local streaming
     openFirewall = true;
 
-    dataDir = service_configs.jellyfin.data_dir;
-    cacheDir = service_configs.jellyfin.cache_dir;
+    dataDir = service_configs.jellyfin.dir;
+    cacheDir = config.services.jellyfin.dataDir + "/cache";
   };
 
   users.users.${config.services.jellyfin.user}.extraGroups = [
@@ -27,7 +27,7 @@
 
   # https://github.com/lyarenei/jellyfin-plugin-listenbrainz/issues/107
   system.activationScripts.jellyfinListenBrain.text = ''
-    cp -v /etc/nixos/secrets/Jellyfin.Plugin.ListenBrainz.xml ${service_configs.jellyfin.data_dir}/plugins/configurations/
-    chown ${config.services.jellyfin.user}:${config.services.jellyfin.group} ${service_configs.jellyfin.data_dir}/plugins/configurations/Jellyfin.Plugin.ListenBrainz.xml
+    cp -v /etc/nixos/secrets/Jellyfin.Plugin.ListenBrainz.xml ${config.services.jellyfin.dataDir}/plugins/configurations/
+    chown ${config.services.jellyfin.user}:${config.services.jellyfin.group} ${config.services.jellyfin.dataDir}/plugins/configurations/Jellyfin.Plugin.ListenBrainz.xml
   '';
 }
diff --git a/services/llm.nix b/services/llm.nix
index 73323a2..ca65410 100644
--- a/services/llm.nix
+++ b/services/llm.nix
@@ -8,7 +8,7 @@
   services.ollama = {
     enable = true;
     home = service_configs.ollama.data_dir + "/home";
-    models = service_configs.ollama.data_dir + "/home/models";
+    models = config.services.ollama.home + "/models";
     environmentVariables = {
       OLLAMA_LLM_LIBRARY = "cpu_avx2";
     };
diff --git a/services/minecraft.nix b/services/minecraft.nix
index f216c08..328073b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -24,11 +24,10 @@ in
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_1;
 
-      # Aikar's flags
-      jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+AlwaysPreTouch -XX:+DisableExplicitGC -XX:+ParallelRefProcEnabled -XX:+PerfDisableSharedMem -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1HeapRegionSize=8M -XX:G1HeapWastePercent=5 -XX:G1MaxNewSizePercent=40 -XX:G1MixedGCCountTarget=4 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1NewSizePercent=30 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:G1ReservePercent=20 -XX:InitiatingHeapOccupancyPercent=15 -XX:MaxGCPauseMillis=200 -XX:MaxTenuringThreshold=1 -XX:SurvivorRatio=32";
+      jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
       serverProperties = {
-        server-port = service_configs.ports.minecraft;
+        server-port = 25565;
         enforce-whitelist = true;
         gamemode = "survival";
         white-list = true;

From c12cf497644689d8c2bf4472d5ac266fdc56271f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 25 Oct 2024 15:39:25 -0400
Subject: [PATCH 025/847] stuff

---
 configuration.nix      | 21 +++++++++++----------
 flake.lock             | 18 +++++++++---------
 services/immich.nix    |  1 +
 services/minecraft.nix |  5 +++++
 4 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index ed0e7b1..d442ea8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,25 +28,26 @@
   };
 
   nix = {
-    #garbage collection and cleanup stuff
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-
-    #optimize the store
+    # optimize the store
     optimise.automatic = true;
 
-    #enable flakes!
+    # enable flakes!
     settings.experimental-features = [
       "nix-command"
       "flakes"
     ];
   };
 
+  # https://github.com/viperML/nh
+  programs.nh = {
+    enable = true;
+    clean.enable = true;
+    clean.extraArgs = "--keep-since 4d --keep 3";
+  };
+
   boot = {
-    kernelPackages = pkgs.linuxPackages_6_10;
+    # kernelPackages = pkgs.linuxPackages_6_10;
+    kernelPackages = pkgs.linuxPackages;
 
     supportedFilesystems = [ "zfs" ];
     zfs.extraPools = [ "tank" ];
diff --git a/flake.lock b/flake.lock
index de0597e..cac869c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729129578,
-        "narHash": "sha256-iZnoPpexSDKsCNFWfF6QFsxD/jC+l6GalSqx7Q3L41M=",
+        "lastModified": 1729647959,
+        "narHash": "sha256-3effNhs4C9+45qkMDR0cIbp5YAbhdosUFxf5jBetRXk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8a5c546a755ecc089ea8355c5b7ccbe284e8f00e",
+        "rev": "7372dca0c43e1a9829ea7b86fd93bb17ab3b2e41",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1728729581,
-        "narHash": "sha256-oazkQ/z7r43YkDLLQdMg8oIB3CwWNb+2ZrYOxtLEWTQ=",
+        "lastModified": 1729690929,
+        "narHash": "sha256-cTSekmupaDfrhlpLhBUBrU9mUzBaD6mYsMveTX0bKDg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a8dd1b21995964b115b1e3ec639dd6ce24ab9806",
+        "rev": "64d900abe40057393148bc0283d35c2254dd4f57",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729194116,
-        "narHash": "sha256-JrdCY/CX30eyUhd7u8hmDgZLuG/HsNDqTu8RQQTpQO0=",
+        "lastModified": 1729732943,
+        "narHash": "sha256-MVVup9A+42n+Ch3mh44pXfGuhVzdZD/iItcuc9+xXbY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8e8d47269fef696d0264584a33405bae4c9a4005",
+        "rev": "37ac2e71f555dc8ad41744d4c16f9d2e1c541a7b",
         "type": "github"
       },
       "original": {
diff --git a/services/immich.nix b/services/immich.nix
index 20c2f74..f33ef36 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -9,6 +9,7 @@
     enable = true;
     mediaLocation = service_configs.immich.dir;
     port = 2283;
+    openFirewall = true;
     host = "0.0.0.0";
     database = {
       createDB = false;
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 328073b..d65f917 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -79,6 +79,11 @@ in
               url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/cYZu5wqk/Moonrise-Fabric-0.1.0-beta.4%2Be244c60.jar";
               sha512 = "e54f1072a7a037f75f990abfb8d34282a9c70c36e7eea2ecb6d1e0e5f127aa46c8f40345d661df49357e9adbe3850816b732b515d5821f49f114b06ddac91c07";
             };
+
+            mixintrace = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/sGmHWmeL/versions/1.1.1%2B1.17/mixintrace-1.1.1%2B1.17.jar";
+              sha512 = "ea9034b60bc1c64629a9bcad2e619907692fe6e7464026236c55cc5a4892a20d21dd6318ad0380ab2ec245f7077939b6717d2ed58e00708c17470be14f5e0b5f";
+            };
           }
         );
       };

From b62bf97d2a27a9bb21f15c60cc8cfec6db5d08f9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 28 Oct 2024 01:14:01 -0400
Subject: [PATCH 026/847] disable caches

---
 configuration.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d442ea8..d2aee0c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -32,10 +32,15 @@
     optimise.automatic = true;
 
     # enable flakes!
-    settings.experimental-features = [
-      "nix-command"
-      "flakes"
-    ];
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+
+      substituters = lib.mkForce [ ];
+      trusted-public-keys = lib.mkForce [ ];
+    };
   };
 
   # https://github.com/viperML/nh

From e3ba2d1d3124591ac3169ff8abeb95874582cbca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 28 Oct 2024 01:14:12 -0400
Subject: [PATCH 027/847] fix jellyfin cache

---
 services/jellyfin.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index d971c0a..a98574f 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -17,7 +17,7 @@
     openFirewall = true;
 
     dataDir = service_configs.jellyfin.dir;
-    cacheDir = config.services.jellyfin.dataDir + "/cache";
+    cacheDir = config.services.jellyfin.dataDir + "_cache";
   };
 
   users.users.${config.services.jellyfin.user}.extraGroups = [

From 86ab01c1136b8a5410b86ad46babadeca9a4ff63 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 1 Nov 2024 00:24:14 -0400
Subject: [PATCH 028/847] misc stuff + minecraft mod updates

---
 configuration.nix      |  3 ---
 flake.lock             | 37 +++++++++++++++++++++++++++----------
 flake.nix              | 11 +++++++----
 services/jellyfin.nix  |  4 ++++
 services/minecraft.nix | 22 ++++++++++++++--------
 5 files changed, 52 insertions(+), 25 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d2aee0c..52cf27a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -37,9 +37,6 @@
         "nix-command"
         "flakes"
       ];
-
-      substituters = lib.mkForce [ ];
-      trusted-public-keys = lib.mkForce [ ];
     };
   };
 
diff --git a/flake.lock b/flake.lock
index cac869c..e991846 100644
--- a/flake.lock
+++ b/flake.lock
@@ -34,6 +34,22 @@
         "type": "github"
       }
     },
+    "jellyfin": {
+      "locked": {
+        "lastModified": 1730145036,
+        "narHash": "sha256-amYxkGRsSbDe8YNgJ9x0lxDAgDvi3xxO3pRjImdy5DQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "bf8b641d2d58a80650ac486525d7ec5a306b69da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "pull/351966/head",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -43,11 +59,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729647959,
-        "narHash": "sha256-3effNhs4C9+45qkMDR0cIbp5YAbhdosUFxf5jBetRXk=",
+        "lastModified": 1730426071,
+        "narHash": "sha256-2BkSiHqyWikpz9HSgTBk5kikaQ5m0Rs60C9KA2kf53o=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "7372dca0c43e1a9829ea7b86fd93bb17ab3b2e41",
+        "rev": "4b371c3d119493051d081ff5b6cff689a97ad1a1",
         "type": "github"
       },
       "original": {
@@ -58,11 +74,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1729690929,
-        "narHash": "sha256-cTSekmupaDfrhlpLhBUBrU9mUzBaD6mYsMveTX0bKDg=",
+        "lastModified": 1730368399,
+        "narHash": "sha256-F8vJtG389i9fp3k2/UDYHMed3PLCJYfxCqwiVP7b9ig=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "64d900abe40057393148bc0283d35c2254dd4f57",
+        "rev": "da14839ac5f38ee6adbdb4e6db09b5eef6d6ccdc",
         "type": "github"
       },
       "original": {
@@ -74,16 +90,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729732943,
-        "narHash": "sha256-MVVup9A+42n+Ch3mh44pXfGuhVzdZD/iItcuc9+xXbY=",
+        "lastModified": 1730200266,
+        "narHash": "sha256-l253w0XMT8nWHGXuXqyiIC/bMvh1VRszGXgdpQlfhvU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "37ac2e71f555dc8ad41744d4c16f9d2e1c541a7b",
+        "rev": "807e9154dcb16384b1b765ebe9cd2bba2ac287fd",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -110,6 +126,7 @@
     },
     "root": {
       "inputs": {
+        "jellyfin": "jellyfin",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index 3e74686..8ea7960 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,13 +2,14 @@
   description = "Flake for server muffin";
 
   inputs = {
-    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
     quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
+    jellyfin.url = "github:NixOS/nixpkgs/pull/351966/head";
 
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
@@ -99,10 +100,12 @@
           nixos-hardware.nixosModules.common-pc-ssd
           nixos-hardware.nixosModules.common-gpu-intel
           (
-            { pkgs, ... }:
+            { pkgs, lib, ... }:
             {
               imports = [ nix-minecraft.nixosModules.minecraft-servers ];
-              nixpkgs.overlays = [ nix-minecraft.overlay ];
+              nixpkgs.overlays = [
+                nix-minecraft.overlay
+              ];
             }
           )
         ];
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index a98574f..ec071ee 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  inputs,
   ...
 }:
 {
@@ -16,6 +17,9 @@
     # used for local streaming
     openFirewall = true;
 
+    # https://github.com/NixOS/nixpkgs/pull/351966
+    # package = inputs.jellyfin.legacyPackages.${pkgs.system}.jellyfin;
+
     dataDir = service_configs.jellyfin.dir;
     cacheDir = config.services.jellyfin.dataDir + "_cache";
   };
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d65f917..c9dc551 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -41,13 +41,14 @@ in
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           builtins.attrValues {
             FabricApi = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/WTaAx4ah/fabric-api-0.105.0%2B1.21.1.jar";
-              sha512 = "6e1ffcf7f5af9589c16ccec1f9bb5ef8dede5ebe52ae09d94affa8050603f6ecd71d130a793c2bdb4bd42b2a70905425e55141d39369dfa9840569eef4dace16";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/thGkUOxt/fabric-api-0.107.0%2B1.21.1.jar";
+              sha512 = "04cf3f205c83882c7c741da392d10cbf9ab471fb44836d753f9673b7b37ddb9b2842cc8e72d6d7f36c48d121715f9f9dae8d20e597f2c0de3bb8abd37037baaa";
             };
 
+            # https://github.com/malte0811/FerriteCore/issues/164
             # FerriteCore = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/wmIZ4wP4/ferritecore-7.0.0-fabric.jar";
-            #   sha512 = "0f2f9b5aebd71ef3064fc94df964296ac6ee8ea12221098b9df037bdcaaca7bccd473c981795f4d57ff3d49da3ef81f13a42566880b9f11dc64645e9c8ad5d4f";
+            #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/bwKMSBhn/ferritecore-7.0.2-hotfix-fabric.jar";
+            #   sha512 = "ca975bd3708cd96d30cf1447ac8883572113562eb2dd697e60c1cf382d6b70d0b1a511fcbfd042c51b2cf5d5ffc718b847f845e4c8a3e421e8c9ee741119a421";
             # };
 
             Lithium = pkgs.fetchurl {
@@ -56,8 +57,8 @@ in
             };
 
             NoChatReports = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/riMhCAII/NoChatReports-FABRIC-1.21-v2.8.0.jar";
-              sha512 = "092837afc0fcb5208561062f8e4cd69971efa94c0180ae377e318d35d8f278abbf1552e4a577be882dc7e870f884779bc36caf808c8bc90bb05490f1e034ddb8";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/sOHvPS0X/NoChatReports-FABRIC-1.21.1-v2.9.0.jar";
+              sha512 = "3326d278e57cc2d7bdb4348570c3876ed096af872e166241209ef5ac7c823829596a81570db029ac751e5a11b7686046f72119f259365350ca2eba10037f6d24";
             };
 
             krypton = pkgs.fetchurl {
@@ -76,14 +77,19 @@ in
             };
 
             moonrise = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/cYZu5wqk/Moonrise-Fabric-0.1.0-beta.4%2Be244c60.jar";
-              sha512 = "e54f1072a7a037f75f990abfb8d34282a9c70c36e7eea2ecb6d1e0e5f127aa46c8f40345d661df49357e9adbe3850816b732b515d5821f49f114b06ddac91c07";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/1ZrRaRbq/Moonrise-Fabric-0.1.0-beta.8%2B68ea18b.jar";
+              sha512 = "7510ce6a908d384031b8134c719a6e4f959f35cc9f7889a12f5fc2188937c61f84c916eff8639786fa2c3411141316802437b1cbc105e00dee0f6a8cc6d96b92";
             };
 
             mixintrace = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/sGmHWmeL/versions/1.1.1%2B1.17/mixintrace-1.1.1%2B1.17.jar";
               sha512 = "ea9034b60bc1c64629a9bcad2e619907692fe6e7464026236c55cc5a4892a20d21dd6318ad0380ab2ec245f7077939b6717d2ed58e00708c17470be14f5e0b5f";
             };
+
+            better-fabric-console = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/6FB2l9zd/better-fabric-console-mc1.21.1-1.2.0.jar";
+              sha512 = "3120f168a201a0d7eee55dc34788f0b1134754895d86ceca082f72b16902a00fc70ca05c73712b1d45bae8b74176af30a1821e636ba528f2abd60d94b1f35297";
+            };
           }
         );
       };

From efa4139d4cd99a60b22d4e4cf816f68d47da948a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 1 Nov 2024 00:26:30 -0400
Subject: [PATCH 029/847] remove listenbrainz stuff

---
 .gitattributes                           |   1 -
 secrets/Jellyfin.Plugin.ListenBrainz.xml | Bin 1392 -> 0 bytes
 services/jellyfin.nix                    |   6 ------
 3 files changed, 7 deletions(-)
 delete mode 100644 secrets/Jellyfin.Plugin.ListenBrainz.xml

diff --git a/.gitattributes b/.gitattributes
index 021d814..4c9ff84 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,4 +2,3 @@ secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/mullvad.nix filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
-secrets/Jellyfin.Plugin.ListenBrainz.xml filter=git-crypt diff=git-crypt
diff --git a/secrets/Jellyfin.Plugin.ListenBrainz.xml b/secrets/Jellyfin.Plugin.ListenBrainz.xml
deleted file mode 100644
index aa01cea075978240e0a03c38b35fd26324c219f6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1392
zcmZQ@_Y83kiVO&0xGfd_@U8*V=H|qhwAK3`eV_4)v%|6QL~hQfcB$j9KP}2|zI#f7
z_xH8cr>B*7@i4}1QT@5Zzg1X^|Fd$`N=FG!>$UIBG&QbCvDakZq@Q-)nBgq%{4FaZ
zdUk$VbH?QLnmyW8VUw>ptYMg5`sGI3Px&T+mO7JT4-$`koNgf}ApQA<-JS%8V|$kL
z?fG|gmO_T$cHuSpSEXc2o7;F<<Inp^uzGu0S~Y)Nm-<4p>bc9|Nk%4r-)S9t#Jj78
z&&uUzPlZ_Y>GLgTKDRU0Un;S&+aAh)XkW@@Ilsj329>GL7j~9gd&Nt<Wh-myO!%j`
z$NJzLA;pXKOE<EXe!A_qUpC9)GvkCka+P!1s&$_3t>72;{P)phXWNV)E?2|%ryT7)
zS(B%kZYM1g`A$SV&g_CzeNBeP&Hcgirx;9fGI}Rm8u56Ymx_)=%+hs<|DGfXIbQTy
z*De$1JKIU=O;5bA`qP?>|LbxN{%Oe6lsxb{+`@SM-GdKUcAmVT^VUe;vh{_fs%(2h
z{DxBs@549_tw}4FeG_1$Cp|qS^43Y#Gb>)z{P%rp@;$Eeu1=C{Tu4jibG@6{Y`f($
z7CfD<$o|^SrsUJk(2COCYCD?#3S=2t=e^@p&tzUy`b1%txPhjyQ1|NGn9}X~AFIlK
zGx2u0`rYM@={~WvUG_jt_Q{PMT{ouiF?j8nxPE<;{MG;QZ#*V6GZa+Ucqy28WvrIw
z@lV@o6Y$xFtLN0MBQ8Si_D4VJw6nWSa%b4ol0I?r+W0B{@#{=KoG~xm6_I>7m-)rN
z+T5QLx0xP`)Bn@qxKp83_rt>9+eBY;Uk;6npXzzC#oX!0+Av$rz~+|Xx>b9eWppa<
zKbo4E`tywZq~rc;uBm^X->7UhLtXCEo&$B;7SF%1i|xU})jkWitToyE`Ks8uaIehe
zFQYZQ1KILD7xKKaN|<Lh<<6|wb@D!jx14L8Cq{fYa(l0zUvKf-X}x9_9kz$Ojpp8J
zyR|2A-si8ndwHTQXSOPQzv1h4%gf>4#8`f}u<}_`i<@^Ru!S9rY7<`gYU}d)>zPd|
zuP^IQsrqzae|yx^V>c@Qhx5OFo_|?*&$h<j^K`?C)}-9OV*F}FuKLDHCa!xJQg+^2
zz4YGXCq^r3EG^$(bk5ko9`S$Lk`A_mRqrm&k*!&~&@D^z*_||RCKj$&y+-|iZ{8@o
z_9Y`*HlMLbNwgtA^utGIN486WNxZRs&o@l`dfcEU%Xz``7rBdhjag?}&ey9|_%V_9
z#L_ys@`~Gu#X>(UJ#H$#eX_N~q2Wk0`-vCJ@^^0gu-MLQgS@nhb3%vfH-p=8Cq1V>
zHY<Mj!GF(z&s{6*wmdq%JyC>J#eG*&wdSpjy@yOE9{<o}#a(yfJ4bfIdWRmKz)dxV
z+&h?0AM3u-zTZT#-ywHZ&6R}H^Sn(DoY?;_@82aIyE`A_j{fE}tNi$<@<BJxgoHGQ
zb*rnR7vH}r7=8YV%#tkq873m{Kb$<g`v241%k6S|HcJ_?Xee$z{y@F^kWKUaj&8Hx
zF^7W`<_l%@9$r<=e=i~7Vcg<vzHB>>Mt&>fvu+JJnK5&L)Q<fR1pHcsg0C`Hp9w5>
z5LOJ@vFMTJw0#dtJbWtqPPj*0{kPPu;7Zv!v#FbIZVZ%^yJNhHy+M_KXZgddkG}Q6
zs)yABxY+-i{90qq;xK!Mcvx?twEHW*%Q7;j{pF4yod0Qh$k|j6d1K{|U0z#HM`=pO
zT6gG|owwEfy6JQBd;2qwZhx&3(Mh~?dx_`Sn;9R{?w|b}&&>Wz+Pw64s-)e!x+Cv9
zSMLrDG1z);$t-rW>-(-MzdC<Ev^FG>@2<K@ZoALL-B-HIm*<35Rh`;($3Jt;<*x6u
Q&vnm!a#G-=&9OFH0Mgg8{Qv*}

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index ec071ee..1abca40 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -28,10 +28,4 @@
     "video"
     "render"
   ];
-
-  # https://github.com/lyarenei/jellyfin-plugin-listenbrainz/issues/107
-  system.activationScripts.jellyfinListenBrain.text = ''
-    cp -v /etc/nixos/secrets/Jellyfin.Plugin.ListenBrainz.xml ${config.services.jellyfin.dataDir}/plugins/configurations/
-    chown ${config.services.jellyfin.user}:${config.services.jellyfin.group} ${config.services.jellyfin.dataDir}/plugins/configurations/Jellyfin.Plugin.ListenBrainz.xml
-  '';
 }

From 8ce0e79b13b8354223f5835b2a0cab2aa6cd5c23 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 1 Nov 2024 00:29:01 -0400
Subject: [PATCH 030/847] reformat flake.nix

---
 flake.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 8ea7960..f7eb8b0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -99,13 +99,12 @@
           nixos-hardware.nixosModules.common-cpu-amd-zenpower
           nixos-hardware.nixosModules.common-pc-ssd
           nixos-hardware.nixosModules.common-gpu-intel
+
           (
             { pkgs, lib, ... }:
             {
               imports = [ nix-minecraft.nixosModules.minecraft-servers ];
-              nixpkgs.overlays = [
-                nix-minecraft.overlay
-              ];
+              nixpkgs.overlays = [ nix-minecraft.overlay ];
             }
           )
         ];

From ffdf4cbd1482d44b71d13b923b19337c5ba2d191 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Nov 2024 12:33:17 -0500
Subject: [PATCH 031/847] things and stuff

---
 configuration.nix      | 18 ++++++++++++------
 flake.lock             | 37 ++++++++++---------------------------
 flake.nix              |  5 ++---
 services/caddy.nix     |  6 +++++-
 services/gitea.nix     |  6 ++++++
 services/jellyfin.nix  |  8 +++++---
 services/minecraft.nix | 10 +++++-----
 services/quadlet.nix   |  2 +-
 services/soulseek.nix  | 14 ++++++++++++++
 9 files changed, 60 insertions(+), 46 deletions(-)
 create mode 100644 services/soulseek.nix

diff --git a/configuration.nix b/configuration.nix
index 52cf27a..e96dbf2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -17,7 +17,8 @@
     ./services/immich.nix
     ./services/gitea.nix
     ./services/minecraft.nix
-    ./services/llm.nix
+    # ./services/llm.nix
+    # ./services/soulseek.nix
   ];
 
   systemd.targets = {
@@ -48,11 +49,12 @@
   };
 
   boot = {
-    # kernelPackages = pkgs.linuxPackages_6_10;
-    kernelPackages = pkgs.linuxPackages;
+    kernelPackages = pkgs.linuxPackages_latest;
 
     supportedFilesystems = [ "zfs" ];
     zfs.extraPools = [ "tank" ];
+    zfs.package = pkgs.zfsUnstable;
+
     loader = {
       # Use the systemd-boot EFI boot loader.
       systemd-boot.enable = true;
@@ -207,6 +209,7 @@
     hostId = "0f712d56";
     firewall.enable = true;
     useDHCP = false;
+    enableIPv6 = false;
 
     interfaces.${eth_interface} = {
       ipv4.addresses = [
@@ -215,6 +218,12 @@
           prefixLength = 24;
         }
       ];
+      ipv6.addresses = [
+        {
+          address = "2603:9001:3900:f005:1779:17ed:4698:6259";
+          prefixLength = 64;
+        }
+      ];
     };
     defaultGateway = {
       address = "10.1.1.1";
@@ -240,9 +249,6 @@
       "render"
 
       "minecraft"
-      config.services.gitea.group
-      config.services.jellyfin.group
-      config.services.caddy.group
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/flake.lock b/flake.lock
index e991846..e119398 100644
--- a/flake.lock
+++ b/flake.lock
@@ -34,22 +34,6 @@
         "type": "github"
       }
     },
-    "jellyfin": {
-      "locked": {
-        "lastModified": 1730145036,
-        "narHash": "sha256-amYxkGRsSbDe8YNgJ9x0lxDAgDvi3xxO3pRjImdy5DQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "bf8b641d2d58a80650ac486525d7ec5a306b69da",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "pull/351966/head",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -59,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730426071,
-        "narHash": "sha256-2BkSiHqyWikpz9HSgTBk5kikaQ5m0Rs60C9KA2kf53o=",
+        "lastModified": 1731375802,
+        "narHash": "sha256-CvWPEzrl2EA3xrtg9X6K8aqV7T5r0SaDz6PLpGA0yIY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4b371c3d119493051d081ff5b6cff689a97ad1a1",
+        "rev": "b873a123366b9a62f9262414ada8d83b03f1f0bf",
         "type": "github"
       },
       "original": {
@@ -74,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1730368399,
-        "narHash": "sha256-F8vJtG389i9fp3k2/UDYHMed3PLCJYfxCqwiVP7b9ig=",
+        "lastModified": 1731403644,
+        "narHash": "sha256-T9V7CTucjRZ4Qc6pUEV/kpgNGzQbHWfGcfK6JJLfUeI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "da14839ac5f38ee6adbdb4e6db09b5eef6d6ccdc",
+        "rev": "f6581f1c3b137086e42a08a906bdada63045f991",
         "type": "github"
       },
       "original": {
@@ -90,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1730200266,
-        "narHash": "sha256-l253w0XMT8nWHGXuXqyiIC/bMvh1VRszGXgdpQlfhvU=",
+        "lastModified": 1731432729,
+        "narHash": "sha256-xMIgn4+PJrb9IQh/Llq4EOmeoHnz2rDWSqlF2BDPkNQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "807e9154dcb16384b1b765ebe9cd2bba2ac287fd",
+        "rev": "9c66a68772c91490d7991b5136873e09e75d517d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -126,7 +110,6 @@
     },
     "root": {
       "inputs": {
-        "jellyfin": "jellyfin",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index f7eb8b0..778678a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,14 +2,13 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    # nixpkgs.url = "github:NixOS/nixpkgs/master";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
     quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
-    jellyfin.url = "github:NixOS/nixpkgs/pull/351966/head";
 
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/services/caddy.nix b/services/caddy.nix
index 1f13e27..755291f 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -1,4 +1,4 @@
-{ config, service_configs, ... }:
+{ config, service_configs, username, ... }:
 {
   services.caddy = {
     enable = true;
@@ -38,4 +38,8 @@
   networking.firewall.allowedUDPPorts = [
     service_configs.ports.https
   ];
+
+    users.users.${username}.extraGroups = [
+      config.services.caddy.group
+    ];
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index e930e61..59b586f 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -1,6 +1,7 @@
 {
   config,
   service_configs,
+  username,
   ...
 }:
 {
@@ -39,4 +40,9 @@
       }
     ];
   };
+
+  
+  users.users.${username}.extraGroups = [
+      config.services.gitea.group
+    ];
 }
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 1abca40..c1804bc 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -3,6 +3,7 @@
   config,
   service_configs,
   inputs,
+  username,
   ...
 }:
 {
@@ -17,9 +18,6 @@
     # used for local streaming
     openFirewall = true;
 
-    # https://github.com/NixOS/nixpkgs/pull/351966
-    # package = inputs.jellyfin.legacyPackages.${pkgs.system}.jellyfin;
-
     dataDir = service_configs.jellyfin.dir;
     cacheDir = config.services.jellyfin.dataDir + "_cache";
   };
@@ -28,4 +26,8 @@
     "video"
     "render"
   ];
+
+  users.users.${username}.extraGroups = [
+      config.services.jellyfin.group
+    ];
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index c9dc551..7b55357 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -61,11 +61,6 @@ in
               sha512 = "3326d278e57cc2d7bdb4348570c3876ed096af872e166241209ef5ac7c823829596a81570db029ac751e5a11b7686046f72119f259365350ca2eba10037f6d24";
             };
 
-            krypton = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/Acz3ttTp/krypton-0.2.8.jar";
-              sha512 = "5f8cf96c79bfd4d893f1d70da582e62026bed36af49a7fa7b1e00fb6efb28d9ad6a1eec147020496b4fe38693d33fe6bfcd1eebbd93475612ee44290c2483784";
-            };
-
             tick-stasis = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
               sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
@@ -90,6 +85,11 @@ in
               url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/6FB2l9zd/better-fabric-console-mc1.21.1-1.2.0.jar";
               sha512 = "3120f168a201a0d7eee55dc34788f0b1134754895d86ceca082f72b16902a00fc70ca05c73712b1d45bae8b74176af30a1821e636ba528f2abd60d94b1f35297";
             };
+
+            vivecraft = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
+              sha512 = "6241183987d6197a5e2b4b17f86db2ee9c594f0b6ec335153f1733c2c9ace9f21d07007150a9082e2834deead68b2c287e9443b23be5cd09a366db3f1593975b";
+            };
           }
         );
       };
diff --git a/services/quadlet.nix b/services/quadlet.nix
index cfad5af..f619c85 100644
--- a/services/quadlet.nix
+++ b/services/quadlet.nix
@@ -23,7 +23,6 @@
         volumes = [ "${service_configs.gluetun.dir}:/gluetun:z" ];
         podmanArgs = [
           "--device=/dev/net/tun"
-          "--security-opt label=disable"
         ];
       };
 
@@ -36,6 +35,7 @@
           environments = {
             WEBUI_PORT = service_configs.ports.torrent;
             DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
+            # PUID = config.users.users.${config.services.jellyfin.user}.uid;
             PGID = config.users.groups.${config.services.jellyfin.group}.gid;
           };
 
diff --git a/services/soulseek.nix b/services/soulseek.nix
new file mode 100644
index 0000000..6a068c3
--- /dev/null
+++ b/services/soulseek.nix
@@ -0,0 +1,14 @@
+{pkgs, ...}:
+{
+  services.slskd = {
+    enable = true;
+    openFirewall = true;
+    domain = "www.gardling.com";
+
+    settings = {
+      shares = {
+        directories = ["/tank/music"];
+      };
+    };
+  };
+}

From 96205e28a66675dad4ac2f91f016bcca761d49e5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Nov 2024 12:41:54 -0500
Subject: [PATCH 032/847] minecraft: 1.21.1 -> 1.21.3

---
 services/caddy.nix     | 13 +++++++++----
 services/gitea.nix     |  5 ++---
 services/jellyfin.nix  |  4 ++--
 services/minecraft.nix | 36 ++++++++++++++++--------------------
 services/soulseek.nix  |  4 ++--
 5 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 755291f..cba1ce7 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -1,4 +1,9 @@
-{ config, service_configs, username, ... }:
+{
+  config,
+  service_configs,
+  username,
+  ...
+}:
 {
   services.caddy = {
     enable = true;
@@ -39,7 +44,7 @@
     service_configs.ports.https
   ];
 
-    users.users.${username}.extraGroups = [
-      config.services.caddy.group
-    ];
+  users.users.${username}.extraGroups = [
+    config.services.caddy.group
+  ];
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index 59b586f..5bf07f7 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -41,8 +41,7 @@
     ];
   };
 
-  
   users.users.${username}.extraGroups = [
-      config.services.gitea.group
-    ];
+    config.services.gitea.group
+  ];
 }
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index c1804bc..0139add 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -28,6 +28,6 @@
   ];
 
   users.users.${username}.extraGroups = [
-      config.services.jellyfin.group
-    ];
+    config.services.jellyfin.group
+  ];
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 7b55357..e0075f8 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -22,7 +22,7 @@ in
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_1;
+      package = pkgs.fabricServers.fabric-1_21_3;
 
       jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
@@ -41,8 +41,8 @@ in
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           builtins.attrValues {
             FabricApi = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/thGkUOxt/fabric-api-0.107.0%2B1.21.1.jar";
-              sha512 = "04cf3f205c83882c7c741da392d10cbf9ab471fb44836d753f9673b7b37ddb9b2842cc8e72d6d7f36c48d121715f9f9dae8d20e597f2c0de3bb8abd37037baaa";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/MawoBGbv/fabric-api-0.107.3%2B1.21.3.jar";
+              sha512 = "84e6bbdcd9819999e9d8873be7b6470bc9de898cdc0b878caeb8deb26e7cf3a1c532710e239815565d40afdb06db423746506f4c174fc3938c2790b5e6d5266f";
             };
 
             # https://github.com/malte0811/FerriteCore/issues/164
@@ -52,13 +52,13 @@ in
             # };
 
             Lithium = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/9x0igjLz/lithium-fabric-mc1.21.1-0.13.1.jar";
-              sha512 = "4250a630d43492da35c4c197ae43082186938fdcb42bafcb6ccad925b79f583abdfdc17ce792c6c6686883f7f109219baecb4906a65d524026d4e288bfbaf146";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/2Ea7RMWZ/lithium-fabric-0.14.1-snapshot%2Bmc1.21.3-build.89.jar";
+              sha512 = "d122b23a520cb2573c2eaba9556c07846ae5f2f8ee9aabdf5dce914334e44027a273c8cf2ef2243fe03cf86a8858eab2ddcc247d95661dee40cd783cf444aeff";
             };
 
             NoChatReports = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/sOHvPS0X/NoChatReports-FABRIC-1.21.1-v2.9.0.jar";
-              sha512 = "3326d278e57cc2d7bdb4348570c3876ed096af872e166241209ef5ac7c823829596a81570db029ac751e5a11b7686046f72119f259365350ca2eba10037f6d24";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/Cg7X9iDa/NoChatReports-FABRIC-1.21.3-v2.10.1.jar";
+              sha512 = "8f1163ad515ebdfab5ef54a4985af05e643749c2efc0bf7b62e00074bbe61d91789b0c9e558bbe1b5c5d21a89b88084ce6350a11a5a9a3bea59eea9764a27171";
             };
 
             tick-stasis = pkgs.fetchurl {
@@ -66,14 +66,9 @@ in
               sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
             };
 
-            noisium = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/KuNKN7d2/versions/4sGQgiu2/noisium-fabric-2.3.0%2Bmc1.21-1.21.1.jar";
-              sha512 = "606ba78cf7f30d99e417c96aa042f600c1b626ed9c783919496d139de650013f1434fcf93545782e3889660322837ce6e85530d9e1a5cc20f9ad161357ede43e";
-            };
-
             moonrise = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/1ZrRaRbq/Moonrise-Fabric-0.1.0-beta.8%2B68ea18b.jar";
-              sha512 = "7510ce6a908d384031b8134c719a6e4f959f35cc9f7889a12f5fc2188937c61f84c916eff8639786fa2c3411141316802437b1cbc105e00dee0f6a8cc6d96b92";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/S7ZBVFid/Moonrise-Fabric-0.2.0-beta.3%2Bbad5cae.jar";
+              sha512 = "84831de3f402bd2f69fba1329412064f487571527fbb4182c45433eba3d716ef52c057d4f2e9f794821ac5147dbae774ef5c83776f4e376fc10ba3d80015cfde";
             };
 
             mixintrace = pkgs.fetchurl {
@@ -82,14 +77,15 @@ in
             };
 
             better-fabric-console = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/6FB2l9zd/better-fabric-console-mc1.21.1-1.2.0.jar";
-              sha512 = "3120f168a201a0d7eee55dc34788f0b1134754895d86ceca082f72b16902a00fc70ca05c73712b1d45bae8b74176af30a1821e636ba528f2abd60d94b1f35297";
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/QGfoAASu/better-fabric-console-mc1.21.3-1.2.1.jar";
+              sha512 = "3a88c281a65f26e44b17b3a7a5cc9f84046b013931bd3af7f2553f462987a96357b21c104a41593ca0516038e6c4398a890ee118046fe95a7e0c7f2d743d944a";
             };
 
-            vivecraft = pkgs.fetchurl {
-              url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
-              sha512 = "6241183987d6197a5e2b4b17f86db2ee9c594f0b6ec335153f1733c2c9ace9f21d07007150a9082e2834deead68b2c287e9443b23be5cd09a366db3f1593975b";
-            };
+            # hasn't updated to 1.21.3 yet (https://modrinth.com/mod/vivecraft/versions)
+            # vivecraft = pkgs.fetchurl {
+            #   url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
+            #   sha512 = "6241183987d6197a5e2b4b17f86db2ee9c594f0b6ec335153f1733c2c9ace9f21d07007150a9082e2834deead68b2c287e9443b23be5cd09a366db3f1593975b";
+            # };
           }
         );
       };
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 6a068c3..e3a4934 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ pkgs, ... }:
 {
   services.slskd = {
     enable = true;
@@ -7,7 +7,7 @@
 
     settings = {
       shares = {
-        directories = ["/tank/music"];
+        directories = [ "/tank/music" ];
       };
     };
   };

From b440d3bcd49c6f446ab0259f534bc77d14066f2d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Nov 2024 12:49:46 -0500
Subject: [PATCH 033/847] minecraft: fix infocmp command error

---
 services/minecraft.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index e0075f8..dfc9dbb 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -37,6 +37,9 @@ in
 
       whitelist = import ../secrets/minecraft-whitelist.nix;
 
+      # provide `infocmp` command for better-fabric-console
+      path = [ pkgs.ncurses ];
+
       symlinks = {
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           builtins.attrValues {

From 83deeff36d937e2585d8c29224a5dfbeabd6c940 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Nov 2024 12:54:28 -0500
Subject: [PATCH 034/847] minecraft: re-add ferritecore

---
 services/minecraft.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index dfc9dbb..a60ed76 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -48,11 +48,10 @@ in
               sha512 = "84e6bbdcd9819999e9d8873be7b6470bc9de898cdc0b878caeb8deb26e7cf3a1c532710e239815565d40afdb06db423746506f4c174fc3938c2790b5e6d5266f";
             };
 
-            # https://github.com/malte0811/FerriteCore/issues/164
-            # FerriteCore = pkgs.fetchurl {
-            #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/bwKMSBhn/ferritecore-7.0.2-hotfix-fabric.jar";
-            #   sha512 = "ca975bd3708cd96d30cf1447ac8883572113562eb2dd697e60c1cf382d6b70d0b1a511fcbfd042c51b2cf5d5ffc718b847f845e4c8a3e421e8c9ee741119a421";
-            # };
+            FerriteCore = pkgs.fetchurl {
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/a3QXXGz2/ferritecore-7.1.0-hotfix-fabric.jar";
+              sha512 = "ae1ab30beb5938643cf2ae7b8220769f2c917e3f5441e46e9bc900295348c0a541a325c30b8dfc38039205620d872c27809acdc6741351f08e4c8edc36ae2bcc";
+            };
 
             Lithium = pkgs.fetchurl {
               url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/2Ea7RMWZ/lithium-fabric-0.14.1-snapshot%2Bmc1.21.3-build.89.jar";

From 30a30dd7656d14faa8e1d9d5aed409baf7070ffa Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Nov 2024 17:52:18 -0500
Subject: [PATCH 035/847] try and do native qbittorrent

---
 .gitattributes    |   1 +
 configuration.nix |  42 ++++++++++++++++++++++++++++++++++++++++++
 flake.lock        |  41 +++++++++++++++++++++++++++++++++++++----
 flake.nix         |  11 +++++++++++
 secrets/wg0.conf  | Bin 0 -> 312 bytes
 5 files changed, 91 insertions(+), 4 deletions(-)
 create mode 100644 secrets/wg0.conf

diff --git a/.gitattributes b/.gitattributes
index 4c9ff84..0bb32ff 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,3 +2,4 @@ secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/mullvad.nix filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
+secrets/wg0.conf filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index e96dbf2..998f0a8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -21,6 +21,48 @@
     # ./services/soulseek.nix
   ];
 
+  # vpnNamespaces.wg = {
+  #   enable = true;
+  #   wireguardConfigFile = ./secrets/wg0.conf;
+  #   accessibleFrom = [
+  #     # "192.168.1.0/24"
+  #     # "127.0.0.1"
+  #     "0.0.0.0/32"
+  #   ];
+  #   # portMappings = [
+  #   #   {
+  #   #     from = config.services.qbittorrent.webuiPort;
+  #   #     to = config.services.qbittorrent.webuiPort;
+  #   #   }
+  #   # ];
+  #   openVPNPorts = [
+  #     {
+  #       port = config.services.qbittorrent.webuiPort;
+  #       protocol = "tcp";
+  #     }
+  #   ];
+  # };
+
+  # services.qbittorrent = {
+  #   enable = true;
+  #   openFirewall = true;
+  #   package = pkgs.qbittorrent-nox;
+  #   webuiPort = service_configs.ports.torrent;
+  #   serverConfig.LegalNotice.Accepted = true;
+  #   serverConfig.Preferences.WebUI = {
+  #     AlternativeUIEnabled = true;
+  #     RootFolder = "${pkgs.fetchzip {
+  #       url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.17.0/vuetorrent.zip";
+  #       hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
+  #     }}";
+  #   };
+  # };
+
+  #   systemd.services.qbittorrent.vpnConfinement = {
+  #   enable = true;
+  #   vpnNamespace = "wg";
+  # };
+
   systemd.targets = {
     sleep.enable = false;
     suspend.enable = false;
diff --git a/flake.lock b/flake.lock
index e119398..8cec60a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731432729,
-        "narHash": "sha256-xMIgn4+PJrb9IQh/Llq4EOmeoHnz2rDWSqlF2BDPkNQ=",
+        "lastModified": 1731433909,
+        "narHash": "sha256-uB4TW3PP9ZC85OjbNV3n5VPAFEdJ5852erzlaE9+vSs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9c66a68772c91490d7991b5136873e09e75d517d",
+        "rev": "ef9b4bce3e4829beefebc2246d08517732fbffbf",
         "type": "github"
       },
       "original": {
@@ -88,6 +88,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-qbt": {
+      "locked": {
+        "lastModified": 1728358927,
+        "narHash": "sha256-8SUsg/Nmn8aEURRdZwxKKNnz22zRMyNwNoP1+aWnhlg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ed446194bbf78795e4ec2d004da093116c93653f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "pull/287923/head",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "quadlet-nix": {
       "inputs": {
         "nixpkgs": [
@@ -113,7 +129,9 @@
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "quadlet-nix": "quadlet-nix"
+        "nixpkgs-qbt": "nixpkgs-qbt",
+        "quadlet-nix": "quadlet-nix",
+        "vpn-confinement": "vpn-confinement"
       }
     },
     "systems": {
@@ -130,6 +148,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "vpn-confinement": {
+      "locked": {
+        "lastModified": 1731209328,
+        "narHash": "sha256-b3jggBHZh20jUfBxoaIvew23czsw82zBc0aKxtkF3g8=",
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "rev": "74e6fd47804b5ca69187200efbb14cf1ecb9ea07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Maroka-chan",
+        "repo": "VPN-Confinement",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 778678a..bd3db0f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,6 +12,10 @@
 
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
+
+    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
+
+    nixpkgs-qbt.url = "github:NixOS/nixpkgs/pull/287923/head";
   };
 
   outputs =
@@ -20,6 +24,8 @@
       quadlet-nix,
       nix-minecraft,
       nixos-hardware,
+      vpn-confinement,
+      nixpkgs-qbt,
       ...
     }@inputs:
     let
@@ -99,6 +105,11 @@
           nixos-hardware.nixosModules.common-pc-ssd
           nixos-hardware.nixosModules.common-gpu-intel
 
+          vpn-confinement.nixosModules.default
+
+          # import the `services.qbittorrent` module
+          (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
+
           (
             { pkgs, lib, ... }:
             {
diff --git a/secrets/wg0.conf b/secrets/wg0.conf
new file mode 100644
index 0000000000000000000000000000000000000000..9d2e7b84af8518ccd5493db9711519b7e424150d
GIT binary patch
literal 312
zcmZQ@_Y83kiVO&0=npVF@9XzZdByq#66OzAyuPvgfYb`Nz4taunsR2+P06WNuas6_
z4OwyYl5dc+ZO(J6;CbsAIW6V9XD8L%$lqm{-ItzrJT`!hS@U21iJ4L|e|(lKdLHyF
z@I%*aE#dtw(;a+`Uj&)W+TvyJA$sO~EYq^BEXxY7sWrJYoEO<+COs#2<GZEI(({X*
z3=5x~KC@+0V8;I|`_ykJifowg*zOb=ow&BqE?VI3mb2^5%(#C2py6F*l}b&YlxQWx
zO+OER&SKtgAosALz}xj_oY|AGIZxDzT^-(^C|%5_AUo$dZ^Q%n3PBEuy+UU*gnX=?
z*T%%IFsNkM`1e|&NcHB`AGW6PH-0I*-Em{i$IBD^e&0H7?s@-)Pv!hpR;|E=d<m+v
YGjD7=#`NWbK;YClwo+%(vI}1U0J~h4!~g&Q

literal 0
HcmV?d00001


From 0b7e1af676391018609aaaaa1679fe4efac6950d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 13 Nov 2024 10:04:33 -0500
Subject: [PATCH 036/847] use native qbittorrent

---
 configuration.nix        | 46 ++-----------------------------
 flake.lock               |  6 ++--
 services/caddy.nix       |  2 +-
 services/qbittorrent.nix | 59 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 65 insertions(+), 48 deletions(-)
 create mode 100644 services/qbittorrent.nix

diff --git a/configuration.nix b/configuration.nix
index 998f0a8..896977f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -13,56 +13,14 @@
     ./hardware.nix
     ./services/jellyfin.nix
     ./services/caddy.nix
-    ./services/quadlet.nix
+    # ./services/quadlet.nix
     ./services/immich.nix
     ./services/gitea.nix
     ./services/minecraft.nix
-    # ./services/llm.nix
     # ./services/soulseek.nix
+    ./services/qbittorrent.nix
   ];
 
-  # vpnNamespaces.wg = {
-  #   enable = true;
-  #   wireguardConfigFile = ./secrets/wg0.conf;
-  #   accessibleFrom = [
-  #     # "192.168.1.0/24"
-  #     # "127.0.0.1"
-  #     "0.0.0.0/32"
-  #   ];
-  #   # portMappings = [
-  #   #   {
-  #   #     from = config.services.qbittorrent.webuiPort;
-  #   #     to = config.services.qbittorrent.webuiPort;
-  #   #   }
-  #   # ];
-  #   openVPNPorts = [
-  #     {
-  #       port = config.services.qbittorrent.webuiPort;
-  #       protocol = "tcp";
-  #     }
-  #   ];
-  # };
-
-  # services.qbittorrent = {
-  #   enable = true;
-  #   openFirewall = true;
-  #   package = pkgs.qbittorrent-nox;
-  #   webuiPort = service_configs.ports.torrent;
-  #   serverConfig.LegalNotice.Accepted = true;
-  #   serverConfig.Preferences.WebUI = {
-  #     AlternativeUIEnabled = true;
-  #     RootFolder = "${pkgs.fetchzip {
-  #       url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.17.0/vuetorrent.zip";
-  #       hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
-  #     }}";
-  #   };
-  # };
-
-  #   systemd.services.qbittorrent.vpnConfinement = {
-  #   enable = true;
-  #   vpnNamespace = "wg";
-  # };
-
   systemd.targets = {
     sleep.enable = false;
     suspend.enable = false;
diff --git a/flake.lock b/flake.lock
index 8cec60a..a772f4f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731433909,
-        "narHash": "sha256-uB4TW3PP9ZC85OjbNV3n5VPAFEdJ5852erzlaE9+vSs=",
+        "lastModified": 1731474235,
+        "narHash": "sha256-wcteA0D0PKmULhuHKhIsnXpngAAmbMMrWxvGwi/eITM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ef9b4bce3e4829beefebc2246d08517732fbffbf",
+        "rev": "1641c8d30380e2507a5ccff8f4a4800311bdfe5a",
         "type": "github"
       },
       "original": {
diff --git a/services/caddy.nix b/services/caddy.nix
index cba1ce7..119079b 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -12,7 +12,7 @@
         tls ${service_configs.https.certs}/cert.crt ${service_configs.https.certs}/cert.key
 
         handle_path /torrent* {
-        	reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.torrent}
+        	reverse_proxy 192.168.15.1:${builtins.toString service_configs.ports.torrent}
         }
 
         root * ${service_configs.https.data_dir}
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
new file mode 100644
index 0000000..f1fcfda
--- /dev/null
+++ b/services/qbittorrent.nix
@@ -0,0 +1,59 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  ...
+}:
+{
+  # network namespace that is proxied through mullvad
+  vpnNamespaces.wg = {
+    enable = true;
+    wireguardConfigFile = ./secrets/wg0.conf;
+    accessibleFrom = [
+      "192.168.0.0/24"
+    ];
+    portMappings = [
+      {
+        from = config.services.qbittorrent.webuiPort;
+        to = config.services.qbittorrent.webuiPort;
+      }
+    ];
+    openVPNPorts = [
+      {
+        port = config.services.qbittorrent.webuiPort;
+        protocol = "both";
+      }
+    ];
+  };
+
+  services.qbittorrent = {
+    enable = true;
+    package = pkgs.qbittorrent-nox;
+    webuiPort = service_configs.ports.torrent;
+    serverConfig.LegalNotice.Accepted = true;
+    serverConfig.Preferences.WebUI = {
+      AlternativeUIEnabled = true;
+      RootFolder = "${pkgs.fetchzip {
+        url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.17.0/vuetorrent.zip";
+        hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
+      }}";
+      Password_PBKDF2 = "@ByteArray(U6PmgkmajHD6Nu5rLbazHw==:ycEEnAMGTxwAhkFiQtdkc6mbGArmnZ2Tkujk6wt4CCytlX0mzGgjQVLKzRb8vSV/S1Yu6+PuAO5gC8IxGR97jA==)";
+    };
+
+    serverConfig.Preferences.Downloads = {
+      SavePath = service_configs.hdd_path + "/torrents";
+      TempPath = service_configs.hdd_path + "/torrents/incomplete";
+    };
+
+    serverConfig.BitTorrent.Session = {
+      GlobalUPSpeedLimit = 1000; # 1 MiB/s
+      QueueingSystemEnabled = false; # seed all torrents all the time
+    };
+  };
+
+  # make qbittorrent use a vpn
+  systemd.services.qbittorrent.vpnConfinement = {
+    enable = true;
+    vpnNamespace = "wg";
+  };
+}

From 78365ae6a1012a7d09c71fe67a56e333a1171196 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 13 Nov 2024 10:06:33 -0500
Subject: [PATCH 037/847] qbt: fix wg0.conf

---
 flake.lock               | 6 +++---
 services/qbittorrent.nix | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index a772f4f..1dde859 100644
--- a/flake.lock
+++ b/flake.lock
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731474235,
-        "narHash": "sha256-wcteA0D0PKmULhuHKhIsnXpngAAmbMMrWxvGwi/eITM=",
+        "lastModified": 1731510190,
+        "narHash": "sha256-Mkl4TRmpw4vADc5mjBaG0CrbjqbqPsKevSXRBLdzF9o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1641c8d30380e2507a5ccff8f4a4800311bdfe5a",
+        "rev": "ac313b3f6f18d38abb71feb156531a371b828d35",
         "type": "github"
       },
       "original": {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f1fcfda..a93c192 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -8,7 +8,7 @@
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     enable = true;
-    wireguardConfigFile = ./secrets/wg0.conf;
+    wireguardConfigFile = ../secrets/wg0.conf;
     accessibleFrom = [
       "192.168.0.0/24"
     ];

From 3ac58f23876bdfc6b3a94d3da60bee02c1c15a17 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 13 Nov 2024 20:34:23 -0500
Subject: [PATCH 038/847] bitmagnet

---
 configuration.nix        |  1 +
 flake.lock               |  6 +++---
 flake.nix                |  1 +
 services/bitmagnet.nix   | 21 +++++++++++++++++++++
 services/caddy.nix       |  4 ++++
 services/minecraft.nix   | 27 +++++++++++++++++++--------
 services/qbittorrent.nix | 12 ++++++++++++
 7 files changed, 61 insertions(+), 11 deletions(-)
 create mode 100644 services/bitmagnet.nix

diff --git a/configuration.nix b/configuration.nix
index 896977f..e4be65a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,6 +19,7 @@
     ./services/minecraft.nix
     # ./services/soulseek.nix
     ./services/qbittorrent.nix
+    ./services/bitmagnet.nix
   ];
 
   systemd.targets = {
diff --git a/flake.lock b/flake.lock
index 1dde859..0d8c7a1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731510190,
-        "narHash": "sha256-Mkl4TRmpw4vADc5mjBaG0CrbjqbqPsKevSXRBLdzF9o=",
+        "lastModified": 1731541698,
+        "narHash": "sha256-o+BOgSM/jEvLACofjMvQAKdZrvKztmwOfiWiuDjOig0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac313b3f6f18d38abb71feb156531a371b828d35",
+        "rev": "00205055ce9ed57333f28b4023d19a2d74b3745f",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index bd3db0f..125963b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,7 @@
           jellyfin = 8096; # no services.jellyfin option for this
           torrent = 6011;
           ollama = 11434;
+          bitmagnet = 3333;
         };
 
         https = {
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
new file mode 100644
index 0000000..d7de760
--- /dev/null
+++ b/services/bitmagnet.nix
@@ -0,0 +1,21 @@
+{ pkgs, service_configs, ... }:
+{
+  services.bitmagnet = {
+    enable = true;
+
+    settings = {
+      postgres = {
+        host = service_configs.postgres.socket;
+      };
+      http_server = {
+        port = ":" + (builtins.toString service_configs.ports.bitmagnet);
+      };
+    };
+  };
+
+  systemd.services.bitmagnet.vpnConfinement = {
+    enable = true;
+    vpnNamespace = "wg";
+  };
+
+}
diff --git a/services/caddy.nix b/services/caddy.nix
index 119079b..40d596b 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -33,6 +33,10 @@
       ${service_configs.gitea.domain}.extraConfig = ''
         reverse_proxy 127.0.0.1:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
       '';
+
+      "recorder.gardling.com".extraConfig = ''
+        reverse_proxy 192.168.15.1:${builtins.toString service_configs.ports.bitmagnet}
+      '';
     };
   };
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index a60ed76..f18952d 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -42,47 +42,58 @@ in
 
       symlinks = {
         "mods" = pkgs.linkFarmFromDrvs "mods" (
+          with pkgs;
           builtins.attrValues {
-            FabricApi = pkgs.fetchurl {
+            FabricApi = fetchurl {
               url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/MawoBGbv/fabric-api-0.107.3%2B1.21.3.jar";
               sha512 = "84e6bbdcd9819999e9d8873be7b6470bc9de898cdc0b878caeb8deb26e7cf3a1c532710e239815565d40afdb06db423746506f4c174fc3938c2790b5e6d5266f";
             };
 
-            FerriteCore = pkgs.fetchurl {
+            FerriteCore = fetchurl {
               url = "https://cdn.modrinth.com/data/uXXizFIs/versions/a3QXXGz2/ferritecore-7.1.0-hotfix-fabric.jar";
               sha512 = "ae1ab30beb5938643cf2ae7b8220769f2c917e3f5441e46e9bc900295348c0a541a325c30b8dfc38039205620d872c27809acdc6741351f08e4c8edc36ae2bcc";
             };
 
-            Lithium = pkgs.fetchurl {
+            Lithium = fetchurl {
               url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/2Ea7RMWZ/lithium-fabric-0.14.1-snapshot%2Bmc1.21.3-build.89.jar";
               sha512 = "d122b23a520cb2573c2eaba9556c07846ae5f2f8ee9aabdf5dce914334e44027a273c8cf2ef2243fe03cf86a8858eab2ddcc247d95661dee40cd783cf444aeff";
             };
 
-            NoChatReports = pkgs.fetchurl {
+            NoChatReports = fetchurl {
               url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/Cg7X9iDa/NoChatReports-FABRIC-1.21.3-v2.10.1.jar";
               sha512 = "8f1163ad515ebdfab5ef54a4985af05e643749c2efc0bf7b62e00074bbe61d91789b0c9e558bbe1b5c5d21a89b88084ce6350a11a5a9a3bea59eea9764a27171";
             };
 
-            tick-stasis = pkgs.fetchurl {
+            tick-stasis = fetchurl {
               url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
               sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
             };
 
-            moonrise = pkgs.fetchurl {
+            moonrise = fetchurl {
               url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/S7ZBVFid/Moonrise-Fabric-0.2.0-beta.3%2Bbad5cae.jar";
               sha512 = "84831de3f402bd2f69fba1329412064f487571527fbb4182c45433eba3d716ef52c057d4f2e9f794821ac5147dbae774ef5c83776f4e376fc10ba3d80015cfde";
             };
 
-            mixintrace = pkgs.fetchurl {
+            mixintrace = fetchurl {
               url = "https://cdn.modrinth.com/data/sGmHWmeL/versions/1.1.1%2B1.17/mixintrace-1.1.1%2B1.17.jar";
               sha512 = "ea9034b60bc1c64629a9bcad2e619907692fe6e7464026236c55cc5a4892a20d21dd6318ad0380ab2ec245f7077939b6717d2ed58e00708c17470be14f5e0b5f";
             };
 
-            better-fabric-console = pkgs.fetchurl {
+            better-fabric-console = fetchurl {
               url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/QGfoAASu/better-fabric-console-mc1.21.3-1.2.1.jar";
               sha512 = "3a88c281a65f26e44b17b3a7a5cc9f84046b013931bd3af7f2553f462987a96357b21c104a41593ca0516038e6c4398a890ee118046fe95a7e0c7f2d743d944a";
             };
 
+            StackDeobfuscator = fetchurl {
+              url = "https://cdn.modrinth.com/data/NusMqsjF/versions/pyiVLk9R/StackDeobfuscatorFabric-1.4.3%2B08e71cc.jar";
+              sha512 = "ef851d54a60e223e90cfd21da91effcdc70175dd32b194366ca3ba29646c9ebdbfb60a1eaa88070c4e9f83bd654da1344e67226dfdf5c68140db4ef693361353";
+            };
+
+            mods-command = fetchurl {
+              url = "https://cdn.modrinth.com/data/PExmWQV8/versions/1F0YwdWN/mods-command-mc1.21.3-1.1.8.jar";
+              sha512 = "761ee048edd6b53eac6fd922c21f7c4012970b3aa57fbd8e7613294e57a12603a7a30af6d6595c06a6a67a02c2a90cb76cd3dafd0bb647d16b4a9888454f0421";
+            };
+
             # hasn't updated to 1.21.3 yet (https://modrinth.com/mod/vivecraft/versions)
             # vivecraft = pkgs.fetchurl {
             #   url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index a93c192..ac33cc3 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  lib,
   ...
 }:
 {
@@ -17,12 +18,23 @@
         from = config.services.qbittorrent.webuiPort;
         to = config.services.qbittorrent.webuiPort;
       }
+      {
+        from = service_configs.ports.bitmagnet;
+        to = service_configs.ports.bitmagnet;
+
+      }
     ];
+
     openVPNPorts = [
       {
         port = config.services.qbittorrent.webuiPort;
         protocol = "both";
       }
+      {
+        # TODO! make an issue about this variable
+        port = service_configs.ports.bitmagnet;
+        protocol = "both";
+      }
     ];
   };
 

From e80d7d77faf19304112cae2544c9d138858e5e9c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 14 Nov 2024 10:36:54 -0500
Subject: [PATCH 039/847] split up wireguard stuff

---
 configuration.nix        |  1 +
 services/bitmagnet.nix   | 19 ++++++++++++++++++-
 services/qbittorrent.nix | 15 ---------------
 services/wg.nix          | 12 ++++++++++++
 4 files changed, 31 insertions(+), 16 deletions(-)
 create mode 100644 services/wg.nix

diff --git a/configuration.nix b/configuration.nix
index e4be65a..3874764 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -18,6 +18,7 @@
     ./services/gitea.nix
     ./services/minecraft.nix
     # ./services/soulseek.nix
+    ./services/wg.nix
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
   ];
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index d7de760..7a7cd53 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -1,5 +1,23 @@
 { pkgs, service_configs, ... }:
 {
+  vpnNamespaces.wg = {
+    portMappings = [
+      {
+        from = service_configs.ports.bitmagnet;
+        to = service_configs.ports.bitmagnet;
+
+      }
+    ];
+
+    openVPNPorts = [
+      {
+        # TODO! make an issue about this variable
+        port = service_configs.ports.bitmagnet;
+        protocol = "both";
+      }
+    ];
+  };
+
   services.bitmagnet = {
     enable = true;
 
@@ -17,5 +35,4 @@
     enable = true;
     vpnNamespace = "wg";
   };
-
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index ac33cc3..d95c3a2 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -8,21 +8,11 @@
 {
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
-    enable = true;
-    wireguardConfigFile = ../secrets/wg0.conf;
-    accessibleFrom = [
-      "192.168.0.0/24"
-    ];
     portMappings = [
       {
         from = config.services.qbittorrent.webuiPort;
         to = config.services.qbittorrent.webuiPort;
       }
-      {
-        from = service_configs.ports.bitmagnet;
-        to = service_configs.ports.bitmagnet;
-
-      }
     ];
 
     openVPNPorts = [
@@ -30,11 +20,6 @@
         port = config.services.qbittorrent.webuiPort;
         protocol = "both";
       }
-      {
-        # TODO! make an issue about this variable
-        port = service_configs.ports.bitmagnet;
-        protocol = "both";
-      }
     ];
   };
 
diff --git a/services/wg.nix b/services/wg.nix
new file mode 100644
index 0000000..258a58e
--- /dev/null
+++ b/services/wg.nix
@@ -0,0 +1,12 @@
+{ pkgs, service_configs, ... }:
+{
+
+  # network namespace that is proxied through mullvad
+  vpnNamespaces.wg = {
+    enable = true;
+    wireguardConfigFile = ../secrets/wg0.conf;
+    accessibleFrom = [
+      "192.168.0.0/24"
+    ];
+  };
+}

From f7867e4f9e7b2849d19f51136f3104b0398b8905 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 15 Nov 2024 11:01:33 -0500
Subject: [PATCH 040/847] caddy: redo stuff

---
 .gitattributes           |   2 +-
 configuration.nix        |   3 ++
 flake.lock               |  33 ++++---------------
 flake.nix                |  68 +++++++++++++++++++--------------------
 secrets/caddy_auth.nix   | Bin 0 -> 108 bytes
 secrets/mullvad.nix      | Bin 269 -> 0 bytes
 services/bitmagnet.nix   |   3 +-
 services/caddy.nix       |  42 +++++++++++++++---------
 services/qbittorrent.nix |  10 +++---
 services/quadlet.nix     |  61 -----------------------------------
 services/wg.nix          |   3 +-
 11 files changed, 78 insertions(+), 147 deletions(-)
 create mode 100644 secrets/caddy_auth.nix
 delete mode 100644 secrets/mullvad.nix
 delete mode 100644 services/quadlet.nix

diff --git a/.gitattributes b/.gitattributes
index 0bb32ff..4910fb3 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,5 @@
 secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
-secrets/mullvad.nix filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
 secrets/wg0.conf filter=git-crypt diff=git-crypt
+secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 3874764..2a93976 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -115,6 +115,9 @@
     bottom
     htop
 
+    doas-sudo-shim
+    neofetch
+
     borgbackup
     smartmontools
 
diff --git a/flake.lock b/flake.lock
index 0d8c7a1..2b0c2b4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731375802,
-        "narHash": "sha256-CvWPEzrl2EA3xrtg9X6K8aqV7T5r0SaDz6PLpGA0yIY=",
+        "lastModified": 1731548755,
+        "narHash": "sha256-kFg3S67OaYWI1SQ0tcmsPIC4PXtq7Av8AJcyf21ZxDE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b873a123366b9a62f9262414ada8d83b03f1f0bf",
+        "rev": "e6f7090175ae5183d84adb6192f115d8f859beaa",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731541698,
-        "narHash": "sha256-o+BOgSM/jEvLACofjMvQAKdZrvKztmwOfiWiuDjOig0=",
+        "lastModified": 1731682847,
+        "narHash": "sha256-6O0APLMLj/Zp2iDQVUVDiVTMWC1XC3TcVHuufzZ0dS0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00205055ce9ed57333f28b4023d19a2d74b3745f",
+        "rev": "a8eb04832bed6c5cee8cd2d148a77644c5a4197f",
         "type": "github"
       },
       "original": {
@@ -104,33 +104,12 @@
         "type": "github"
       }
     },
-    "quadlet-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729072507,
-        "narHash": "sha256-srn/XjGNtaO34/CX6H85NVIQ1ksBDOSToMiLu+22Tek=",
-        "owner": "SEIAROTg",
-        "repo": "quadlet-nix",
-        "rev": "5970e7be88ec6d063a79c7669a68918c4827caa0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "SEIAROTg",
-        "repo": "quadlet-nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixpkgs-qbt": "nixpkgs-qbt",
-        "quadlet-nix": "quadlet-nix",
         "vpn-confinement": "vpn-confinement"
       }
     },
diff --git a/flake.nix b/flake.nix
index 125963b..94bccfb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,9 +7,6 @@
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
-    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
-    quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";
-
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -21,7 +18,6 @@
   outputs =
     {
       nixpkgs,
-      quadlet-nix,
       nix-minecraft,
       nixos-hardware,
       vpn-confinement,
@@ -33,7 +29,7 @@
       hostname = "muffin";
       eth_interface = "enp3s0";
 
-      service_configs = {
+      service_configs = rec {
         hdd_path = "/mnt/hdd";
         services_dir = "/tank/services";
 
@@ -47,13 +43,14 @@
         };
 
         https = {
-          certs = service_configs.services_dir + "/http_certs";
-          data_dir = service_configs.services_dir + "/http";
+          certs = services_dir + "/http_certs";
+          data_dir = services_dir + "/http";
+          domain = "gardling.com";
         };
 
         gitea = {
-          dir = service_configs.services_dir + "/gitea";
-          domain = "git.gardling.com";
+          dir = services_dir + "/gitea";
+          domain = "git.${https.domain}";
         };
 
         postgres = {
@@ -61,29 +58,29 @@
         };
 
         immich = {
-          dir = service_configs.services_dir + "/immich";
+          dir = services_dir + "/immich";
         };
 
         minecraft = {
-          parent_dir = service_configs.services_dir + "/minecraft";
+          parent_dir = services_dir + "/minecraft";
           server_name = "main";
         };
 
         gluetun = {
-          dir = service_configs.services_dir + "/gluetun";
+          dir = services_dir + "/gluetun";
         };
 
         torrent = {
-          config_dir = service_configs.services_dir + "/qbittorrent/config";
-          download_dir = service_configs.hdd_path + "/torrents";
+          SavePath = hdd_path + "/torrents";
+          TempPath = hdd_path + "/torrents/incomplete";
         };
 
         jellyfin = {
-          dir = service_configs.services_dir + "/jellyfin";
+          dir = services_dir + "/jellyfin";
         };
 
         ollama = {
-          data_dir = service_configs.services_dir + "/ollama";
+          data_dir = services_dir + "/ollama";
         };
       };
     in
@@ -98,27 +95,30 @@
             inputs
             ;
         };
-        modules = [
-          ./configuration.nix
-          quadlet-nix.nixosModules.quadlet
-          nixos-hardware.nixosModules.common-cpu-amd-pstate
-          nixos-hardware.nixosModules.common-cpu-amd-zenpower
-          nixos-hardware.nixosModules.common-pc-ssd
-          nixos-hardware.nixosModules.common-gpu-intel
+        modules =
+          [
+            ./configuration.nix
 
-          vpn-confinement.nixosModules.default
+            vpn-confinement.nixosModules.default
 
-          # import the `services.qbittorrent` module
-          (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
+            # import the `services.qbittorrent` module
+            (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
 
-          (
-            { pkgs, lib, ... }:
-            {
-              imports = [ nix-minecraft.nixosModules.minecraft-servers ];
-              nixpkgs.overlays = [ nix-minecraft.overlay ];
-            }
-          )
-        ];
+            # get nix-minercaft working!
+            nix-minecraft.nixosModules.minecraft-servers
+            (
+              { ... }:
+              {
+                nixpkgs.overlays = [ nix-minecraft.overlay ];
+              }
+            )
+          ]
+          ++ (with nixos-hardware.nixosModules; [
+            common-cpu-amd-pstate
+            common-cpu-amd-zenpower
+            common-pc-ssd
+            common-gpu-intel
+          ]);
       };
     };
 }
diff --git a/secrets/caddy_auth.nix b/secrets/caddy_auth.nix
new file mode 100644
index 0000000000000000000000000000000000000000..d85fde0cb0919be86c63cf2752b259e77d8a5c43
GIT binary patch
literal 108
zcmZQ@_Y83kiVO&0urF+x_vstA(@7h*S8kVE3*OgP9dB7}QOu~<Up(vGS!>pH2CJWx
z$lme)EB8rFH}3zv@)c`!az4M?<x$|gW33DGN8XK6la?z!<em|$^Y*KmpZ&Y%f)`xh
QaIN&NQ|`;SQGe+q0J!Qjy#N3J

literal 0
HcmV?d00001

diff --git a/secrets/mullvad.nix b/secrets/mullvad.nix
deleted file mode 100644
index 45d962b3c0a32968dcfc9301c62f12279e893efc..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 269
zcmZQ@_Y83kiVO&0D6+_&d{cVa{^xGfe{^>quPeXyp0%pKuZZhv@9EQl+vm>+RdCyv
zb+O_JKew^Pip@^fx&KP1u>UFP{i9~AJ176<j#E=|nWjp9-0@e@ojtK;|K~du27G@H
z*}mVq{@g>$?Q;8nDNgjfR+N<L*%+0}z5CdohU)8PC*wk!*cYUwD5|vt&$|$P>-9DD
zv-iJpc5a?ABWb}E=ihu1ZWd1qW_s#XPmf4Cv{LbujZ+fSg~qVGyq1-w+4oxW^4HJ1
zaq-|2y&r!nUu`kEJx|_j?jzm8L^Y`+)y`KgO}g?w%U$q#GK(ntw}#HwzKd9oY+7`|
ej=lEkfB6!lXg&*H{Yxe%AFfthb-AT_u08-d*oFcC

diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 7a7cd53..8fcf96a 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -5,13 +5,11 @@
       {
         from = service_configs.ports.bitmagnet;
         to = service_configs.ports.bitmagnet;
-
       }
     ];
 
     openVPNPorts = [
       {
-        # TODO! make an issue about this variable
         port = service_configs.ports.bitmagnet;
         protocol = "both";
       }
@@ -26,6 +24,7 @@
         host = service_configs.postgres.socket;
       };
       http_server = {
+        # TODO! make issue about this being a string and not a `port` type
         port = ":" + (builtins.toString service_configs.ports.bitmagnet);
       };
     };
diff --git a/services/caddy.nix b/services/caddy.nix
index 40d596b..851bc19 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -7,35 +7,45 @@
 {
   services.caddy = {
     enable = true;
+    email = "titaniumtown@proton.me";
+    globalConfig = ''
+      auto_https disable_redirects
+    '';
     virtualHosts = {
-      ":${builtins.toString service_configs.ports.https}".extraConfig = ''
-        tls ${service_configs.https.certs}/cert.crt ${service_configs.https.certs}/cert.key
+      ${service_configs.https.domain} = {
+        extraConfig = ''
+          root * ${service_configs.https.data_dir}
+          file_server browse
+        '';
 
-        handle_path /torrent* {
-        	reverse_proxy 192.168.15.1:${builtins.toString service_configs.ports.torrent}
-        }
+        serverAliases = [ "www.${service_configs.https.domain}" ];
+      };
 
-        root * ${service_configs.https.data_dir}
-        file_server browse
+      "immich.${service_configs.https.domain}".extraConfig = ''
+        reverse_proxy :${builtins.toString config.services.immich.port}
       '';
 
-      "immich.gardling.com".extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString config.services.immich.port}
-      '';
-
-      "jellyfin.gardling.com".extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString service_configs.ports.jellyfin}
+      "jellyfin.${service_configs.https.domain}".extraConfig = ''
+        reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
         request_body {
         	max_size 4096MB
         }
       '';
 
       ${service_configs.gitea.domain}.extraConfig = ''
-        reverse_proxy 127.0.0.1:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
+        reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
       '';
 
-      "recorder.gardling.com".extraConfig = ''
-        reverse_proxy 192.168.15.1:${builtins.toString service_configs.ports.bitmagnet}
+      "bitmagnet.${service_configs.https.domain}".extraConfig = ''
+        tls internal
+        ${import ../secrets/caddy_auth.nix}
+        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.bitmagnet}
+      '';
+
+      "torrent.${service_configs.https.domain}".extraConfig = ''
+        tls internal
+        ${import ../secrets/caddy_auth.nix}
+        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.torrent}
       '';
     };
   };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index d95c3a2..cc0a2fd 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   service_configs,
-  lib,
   ...
 }:
 {
@@ -35,11 +34,14 @@
         hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
       }}";
       Password_PBKDF2 = "@ByteArray(U6PmgkmajHD6Nu5rLbazHw==:ycEEnAMGTxwAhkFiQtdkc6mbGArmnZ2Tkujk6wt4CCytlX0mzGgjQVLKzRb8vSV/S1Yu6+PuAO5gC8IxGR97jA==)";
-    };
+
+AuthSubnetWhitelist="127.0.0.1";
+AuthSubnetWhitelistEnabled = true;
+        };
 
     serverConfig.Preferences.Downloads = {
-      SavePath = service_configs.hdd_path + "/torrents";
-      TempPath = service_configs.hdd_path + "/torrents/incomplete";
+      SavePath = service_configs.torrent.SavePath;
+      TempPath = service_configs.torrent.TempPath;
     };
 
     serverConfig.BitTorrent.Session = {
diff --git a/services/quadlet.nix b/services/quadlet.nix
deleted file mode 100644
index f619c85..0000000
--- a/services/quadlet.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{ service_configs, config, ... }:
-{
-  virtualisation.quadlet = {
-    containers = {
-      gluetun.containerConfig = {
-        image = "docker.io/qmcgaw/gluetun";
-        name = "gluetun";
-        # autoUpdate = "registry";
-
-        addCapabilities = [
-          "NET_ADMIN"
-          "MKNOD"
-        ];
-
-        environments = import ../secrets/mullvad.nix;
-
-        publishPorts = [
-          "6081:6081"
-          "6081:6081/udp"
-          "${builtins.toString service_configs.ports.torrent}:6011"
-        ];
-
-        volumes = [ "${service_configs.gluetun.dir}:/gluetun:z" ];
-        podmanArgs = [
-          "--device=/dev/net/tun"
-        ];
-      };
-
-      qbittorrent = {
-        containerConfig = {
-          image = "lscr.io/linuxserver/qbittorrent:latest";
-          name = "qbittorrent";
-          autoUpdate = "registry";
-
-          environments = {
-            WEBUI_PORT = service_configs.ports.torrent;
-            DOCKER_MODS = "ghcr.io/gabe565/linuxserver-mod-vuetorrent";
-            # PUID = config.users.users.${config.services.jellyfin.user}.uid;
-            PGID = config.users.groups.${config.services.jellyfin.group}.gid;
-          };
-
-          volumes = [
-            "${service_configs.torrent.config_dir}:/config:z"
-            "${service_configs.torrent.download_dir}:/downloads:z"
-          ];
-
-          networks = [ "container:gluetun" ];
-        };
-
-        serviceConfig = {
-          requires = [ "gluetun.service" ];
-          after = [ "gluetun.service" ];
-        };
-      };
-    };
-
-    networks = {
-      internal.networkConfig.subnets = [ "10.0.123.1/24" ];
-    };
-  };
-}
diff --git a/services/wg.nix b/services/wg.nix
index 258a58e..83ef5a3 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -1,12 +1,11 @@
 { pkgs, service_configs, ... }:
 {
-
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     enable = true;
     wireguardConfigFile = ../secrets/wg0.conf;
     accessibleFrom = [
-      "192.168.0.0/24"
+      # "192.168.0.0/24"
     ];
   };
 }

From dea385eb80a12e5f99270b7b0bb5a28657fe4fb2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 15 Nov 2024 11:03:07 -0500
Subject: [PATCH 041/847] format + bittorrent changes

---
 services/qbittorrent.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index cc0a2fd..eee5e67 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -33,11 +33,11 @@
         url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.17.0/vuetorrent.zip";
         hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
       }}";
-      Password_PBKDF2 = "@ByteArray(U6PmgkmajHD6Nu5rLbazHw==:ycEEnAMGTxwAhkFiQtdkc6mbGArmnZ2Tkujk6wt4CCytlX0mzGgjQVLKzRb8vSV/S1Yu6+PuAO5gC8IxGR97jA==)";
 
-AuthSubnetWhitelist="127.0.0.1";
-AuthSubnetWhitelistEnabled = true;
-        };
+      # disable auth because we use caddy for auth
+      AuthSubnetWhitelist = "0.0.0.0/0";
+      AuthSubnetWhitelistEnabled = true;
+    };
 
     serverConfig.Preferences.Downloads = {
       SavePath = service_configs.torrent.SavePath;

From e25b980d13f9850c790cc9b0376d328e8a31e07b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 16 Nov 2024 00:30:47 -0500
Subject: [PATCH 042/847] firewall: add port 80

---
 services/caddy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/caddy.nix b/services/caddy.nix
index 851bc19..5bcfdf4 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -52,6 +52,7 @@
 
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.https
+    80
   ];
 
   networking.firewall.allowedUDPPorts = [

From 81fa2861fced1e4b9c3bd4c182de85849b410110 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 16 Nov 2024 01:52:30 -0500
Subject: [PATCH 043/847] remove ollama stuff

---
 services/llm.nix | 19 -------------------
 1 file changed, 19 deletions(-)
 delete mode 100644 services/llm.nix

diff --git a/services/llm.nix b/services/llm.nix
deleted file mode 100644
index ca65410..0000000
--- a/services/llm.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  pkgs,
-  config,
-  service_configs,
-  ...
-}:
-{
-  services.ollama = {
-    enable = true;
-    home = service_configs.ollama.data_dir + "/home";
-    models = config.services.ollama.home + "/models";
-    environmentVariables = {
-      OLLAMA_LLM_LIBRARY = "cpu_avx2";
-    };
-    host = "0.0.0.0";
-    port = service_configs.ports.ollama;
-    user = "ollama";
-  };
-}

From 8ec99d1b8e7dc1f6a2dac09d7e69c7ae01482df9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 17 Nov 2024 00:17:25 -0500
Subject: [PATCH 044/847] update

---
 configuration.nix      | 14 --------------
 flake.lock             | 18 +++++++++---------
 services/jellyfin.nix  |  5 ++---
 services/minecraft.nix |  5 +++++
 services/soulseek.nix  | 14 --------------
 5 files changed, 16 insertions(+), 40 deletions(-)
 delete mode 100644 services/soulseek.nix

diff --git a/configuration.nix b/configuration.nix
index 2a93976..2b9c310 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -13,11 +13,9 @@
     ./hardware.nix
     ./services/jellyfin.nix
     ./services/caddy.nix
-    # ./services/quadlet.nix
     ./services/immich.nix
     ./services/gitea.nix
     ./services/minecraft.nix
-    # ./services/soulseek.nix
     ./services/wg.nix
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
@@ -236,24 +234,12 @@
     };
   };
 
-  virtualisation = {
-    containers.enable = true;
-    podman = {
-      enable = true;
-
-      # Required for containers under podman-compose to be able to talk to each other.
-      defaultNetwork.settings.dns_enabled = true;
-    };
-  };
-
   users.users.${username} = {
     isNormalUser = true;
     extraGroups = [
       "wheel"
       "video"
       "render"
-
-      "minecraft"
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/flake.lock b/flake.lock
index 2b0c2b4..7e31cf5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731548755,
-        "narHash": "sha256-kFg3S67OaYWI1SQ0tcmsPIC4PXtq7Av8AJcyf21ZxDE=",
+        "lastModified": 1731808593,
+        "narHash": "sha256-dyMU//DLz1Zs1bl7jAZA6d68bXCRzTYim4JyrLFfqME=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e6f7090175ae5183d84adb6192f115d8f859beaa",
+        "rev": "ada86c417801a44c32b59374b1e0b3141826291a",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1731403644,
-        "narHash": "sha256-T9V7CTucjRZ4Qc6pUEV/kpgNGzQbHWfGcfK6JJLfUeI=",
+        "lastModified": 1731797098,
+        "narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f6581f1c3b137086e42a08a906bdada63045f991",
+        "rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731682847,
-        "narHash": "sha256-6O0APLMLj/Zp2iDQVUVDiVTMWC1XC3TcVHuufzZ0dS0=",
+        "lastModified": 1731816655,
+        "narHash": "sha256-55e1JMAuYvHZs9EICprWgJ4RmaWwDuSjzJ5K7S7zb6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a8eb04832bed6c5cee8cd2d148a77644c5a4197f",
+        "rev": "0a14706530dcb90acecb81ce0da219d88baaae75",
         "type": "github"
       },
       "original": {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 0139add..485f900 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   service_configs,
-  inputs,
   username,
   ...
 }:
@@ -13,13 +12,13 @@
     jellyfin-ffmpeg
   ];
 
-  services.jellyfin = {
+  services.jellyfin = rec {
     enable = true;
     # used for local streaming
     openFirewall = true;
 
     dataDir = service_configs.jellyfin.dir;
-    cacheDir = config.services.jellyfin.dataDir + "_cache";
+    cacheDir = dataDir + "_cache";
   };
 
   users.users.${config.services.jellyfin.user}.extraGroups = [
diff --git a/services/minecraft.nix b/services/minecraft.nix
index f18952d..557d225 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -2,6 +2,7 @@
   pkgs,
   service_configs,
   lib,
+  username,
   ...
 }:
 let
@@ -104,4 +105,8 @@ in
       };
     };
   };
+
+  users.users.${username}.extraGroups = [
+    "minecraft"
+  ];
 }
diff --git a/services/soulseek.nix b/services/soulseek.nix
deleted file mode 100644
index e3a4934..0000000
--- a/services/soulseek.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-{
-  services.slskd = {
-    enable = true;
-    openFirewall = true;
-    domain = "www.gardling.com";
-
-    settings = {
-      shares = {
-        directories = [ "/tank/music" ];
-      };
-    };
-  };
-}

From 9f09e35cbcbc5d099131652c7dfc3b9a5e2e5972 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Nov 2024 15:43:44 -0500
Subject: [PATCH 045/847] cleanup

---
 flake.lock               | 14 +++++++-------
 flake.nix                | 13 +++----------
 services/caddy.nix       |  7 ++-----
 services/qbittorrent.nix |  4 ++--
 4 files changed, 14 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7e31cf5..b1c30ed 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731808593,
-        "narHash": "sha256-dyMU//DLz1Zs1bl7jAZA6d68bXCRzTYim4JyrLFfqME=",
+        "lastModified": 1731894859,
+        "narHash": "sha256-G8W50PtK+VkwnC/bYUWXy0Bg4+AX21Sg/wg8pjjE+yw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ada86c417801a44c32b59374b1e0b3141826291a",
+        "rev": "400994c4d85841549bcbdac9dd71fc5ce505cdf0",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731816655,
-        "narHash": "sha256-55e1JMAuYvHZs9EICprWgJ4RmaWwDuSjzJ5K7S7zb6w=",
+        "lastModified": 1731676054,
+        "narHash": "sha256-OZiZ3m8SCMfh3B6bfGC/Bm4x3qc1m2SVEAlkV6iY7Yg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0a14706530dcb90acecb81ce0da219d88baaae75",
+        "rev": "5e4fbfb6b3de1aa2872b76d49fafc942626e2add",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 94bccfb..1cf68f3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,8 @@
   description = "Flake for server muffin";
 
   inputs = {
-    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
@@ -46,6 +46,7 @@
           certs = services_dir + "/http_certs";
           data_dir = services_dir + "/http";
           domain = "gardling.com";
+          wg_ip = "192.168.15.1";
         };
 
         gitea = {
@@ -66,10 +67,6 @@
           server_name = "main";
         };
 
-        gluetun = {
-          dir = services_dir + "/gluetun";
-        };
-
         torrent = {
           SavePath = hdd_path + "/torrents";
           TempPath = hdd_path + "/torrents/incomplete";
@@ -78,10 +75,6 @@
         jellyfin = {
           dir = services_dir + "/jellyfin";
         };
-
-        ollama = {
-          data_dir = services_dir + "/ollama";
-        };
       };
     in
     {
diff --git a/services/caddy.nix b/services/caddy.nix
index 5bcfdf4..5435caf 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -8,9 +8,6 @@
   services.caddy = {
     enable = true;
     email = "titaniumtown@proton.me";
-    globalConfig = ''
-      auto_https disable_redirects
-    '';
     virtualHosts = {
       ${service_configs.https.domain} = {
         extraConfig = ''
@@ -39,13 +36,13 @@
       "bitmagnet.${service_configs.https.domain}".extraConfig = ''
         tls internal
         ${import ../secrets/caddy_auth.nix}
-        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.bitmagnet}
+        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
       '';
 
       "torrent.${service_configs.https.domain}".extraConfig = ''
         tls internal
         ${import ../secrets/caddy_auth.nix}
-        reverse_proxy http://192.168.15.1:${builtins.toString service_configs.ports.torrent}
+        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}
       '';
     };
   };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index eee5e67..55d490c 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -30,8 +30,8 @@
     serverConfig.Preferences.WebUI = {
       AlternativeUIEnabled = true;
       RootFolder = "${pkgs.fetchzip {
-        url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.17.0/vuetorrent.zip";
-        hash = "sha256-PpumQCgIZp9wENL1XZvf7CdUAW9W0pQP5wqtG9oOUpM=";
+        url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.18.0/vuetorrent.zip";
+        sha256 = "Z+N1RgcF67R6hWEfmfBls1+YLWkhEJQuOVqXXJCyptE=";
       }}";
 
       # disable auth because we use caddy for auth

From 1fb58321311bb590526635b4fab66fd1067fa420 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 21 Nov 2024 12:38:09 -0500
Subject: [PATCH 046/847] update

---
 configuration.nix |  3 +--
 flake.lock        | 12 ++++++------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 2b9c310..d1abb25 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -49,11 +49,10 @@
   };
 
   boot = {
-    kernelPackages = pkgs.linuxPackages_latest;
+    kernelPackages = pkgs.linuxPackages;
 
     supportedFilesystems = [ "zfs" ];
     zfs.extraPools = [ "tank" ];
-    zfs.package = pkgs.zfsUnstable;
 
     loader = {
       # Use the systemd-boot EFI boot loader.
diff --git a/flake.lock b/flake.lock
index b1c30ed..4d8c75f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731894859,
-        "narHash": "sha256-G8W50PtK+VkwnC/bYUWXy0Bg4+AX21Sg/wg8pjjE+yw=",
+        "lastModified": 1732153840,
+        "narHash": "sha256-lt8Gdx6TNheby/9lRNE1GMP3vkdpLaXmyHQk+ZvYNAY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "400994c4d85841549bcbdac9dd71fc5ce505cdf0",
+        "rev": "8325d463c1c424f2e6edeef2010c0d902a37b3d3",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731676054,
-        "narHash": "sha256-OZiZ3m8SCMfh3B6bfGC/Bm4x3qc1m2SVEAlkV6iY7Yg=",
+        "lastModified": 1732014248,
+        "narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e4fbfb6b3de1aa2872b76d49fafc942626e2add",
+        "rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
         "type": "github"
       },
       "original": {

From dbcd42c421b2e2088e11f54663873b7a76b7d4fa Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Nov 2024 01:18:07 -0500
Subject: [PATCH 047/847] cleanup + minecraft changes

---
 configuration.nix      |  9 +++++++++
 flake.lock             | 12 ++++++------
 services/caddy.nix     | 17 +++++++++++++++--
 services/minecraft.nix | 31 +++++++++++++++++++------------
 4 files changed, 49 insertions(+), 20 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d1abb25..4816fd0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -281,6 +281,15 @@
     password = builtins.readFile ./secrets/murmur_password;
   };
 
+  # services.botamusique = {
+  #   enable = true;
+  #   settings = {
+  #     server = {port = config.services.murmur.port;
+  #       password = config.services.murmur.password;
+  #     };
+  #   };
+  # };
+
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16;
diff --git a/flake.lock b/flake.lock
index 4d8c75f..0365f42 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732153840,
-        "narHash": "sha256-lt8Gdx6TNheby/9lRNE1GMP3vkdpLaXmyHQk+ZvYNAY=",
+        "lastModified": 1732499634,
+        "narHash": "sha256-RFtqNl1OOi5uKxP2UwYKz4zknpG7CnaocqOf7jcp1AY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8325d463c1c424f2e6edeef2010c0d902a37b3d3",
+        "rev": "6f29ed33273eef383a33ac7e10e6cfb4949ef3d4",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1731797098,
-        "narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
+        "lastModified": 1732483221,
+        "narHash": "sha256-kF6rDeCshoCgmQz+7uiuPdREVFuzhIorGOoPXMalL2U=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
+        "rev": "45348ad6fb8ac0e8415f6e5e96efe47dd7f39405",
         "type": "github"
       },
       "original": {
diff --git a/services/caddy.nix b/services/caddy.nix
index 5435caf..f740e3f 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -2,6 +2,7 @@
   config,
   service_configs,
   username,
+  pkgs,
   ...
 }:
 {
@@ -34,19 +35,27 @@
       '';
 
       "bitmagnet.${service_configs.https.domain}".extraConfig = ''
-        tls internal
+        # tls internal
         ${import ../secrets/caddy_auth.nix}
         reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
       '';
 
       "torrent.${service_configs.https.domain}".extraConfig = ''
-        tls internal
+        # tls internal
         ${import ../secrets/caddy_auth.nix}
         reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}
       '';
+
+      "map.${service_configs.https.domain}".extraConfig = ''
+        # tls internal
+        root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
+        file_server browse
+      '';
     };
   };
 
+  systemd.packages = with pkgs; [ nssTools ];
+
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.https
     80
@@ -56,6 +65,10 @@
     service_configs.ports.https
   ];
 
+  users.users.${config.services.caddy.user}.extraGroups = [
+    "minecraft"
+  ];
+
   users.users.${username}.extraGroups = [
     config.services.caddy.group
   ];
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 557d225..4565965 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -6,7 +6,7 @@
   ...
 }:
 let
-  heap_size = "4000M";
+  heap_size = "2000M";
 in
 {
   nixpkgs.config.allowUnfreePredicate =
@@ -34,6 +34,7 @@ in
         white-list = true;
         difficulty = "easy";
         motd = "A Minecraft Server";
+        view-distance = 12;
       };
 
       whitelist = import ../secrets/minecraft-whitelist.nix;
@@ -46,8 +47,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/MawoBGbv/fabric-api-0.107.3%2B1.21.3.jar";
-              sha512 = "84e6bbdcd9819999e9d8873be7b6470bc9de898cdc0b878caeb8deb26e7cf3a1c532710e239815565d40afdb06db423746506f4c174fc3938c2790b5e6d5266f";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/Xhw2LuSh/fabric-api-0.109.0%2B1.21.3.jar";
+              sha512 = "decfcbcc4cc9748b9822a5e0b34dada9e1454bbf7c0eb1d4e014db243e8eebaa240a05a48c1bcde232ddecf150692fe295f9bb147794c861e42d2cad66119657";
             };
 
             FerriteCore = fetchurl {
@@ -56,8 +57,8 @@ in
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/2Ea7RMWZ/lithium-fabric-0.14.1-snapshot%2Bmc1.21.3-build.89.jar";
-              sha512 = "d122b23a520cb2573c2eaba9556c07846ae5f2f8ee9aabdf5dce914334e44027a273c8cf2ef2243fe03cf86a8858eab2ddcc247d95661dee40cd783cf444aeff";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/QhCwdt4l/lithium-fabric-0.14.2-snapshot%2Bmc1.21.3-build.91.jar";
+              sha512 = "6c025877e0f5de8f87baca0be08e19bbad8fb7f6e2037d064f2497fd9779cdc3b979dfc80d228374934ef84014949c9cb4740c816cac0ac9ad0d566d1d7e4f0e";
             };
 
             NoChatReports = fetchurl {
@@ -65,14 +66,15 @@ in
               sha512 = "8f1163ad515ebdfab5ef54a4985af05e643749c2efc0bf7b62e00074bbe61d91789b0c9e558bbe1b5c5d21a89b88084ce6350a11a5a9a3bea59eea9764a27171";
             };
 
-            tick-stasis = fetchurl {
-              url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
-              sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
-            };
+            # breaks squaremap
+            # tick-stasis = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
+            #   sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
+            # };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/S7ZBVFid/Moonrise-Fabric-0.2.0-beta.3%2Bbad5cae.jar";
-              sha512 = "84831de3f402bd2f69fba1329412064f487571527fbb4182c45433eba3d716ef52c057d4f2e9f794821ac5147dbae774ef5c83776f4e376fc10ba3d80015cfde";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/GD9TRt0g/Moonrise-Fabric-0.2.0-beta.4%2Be7510ed.jar";
+              sha512 = "32be95ce0c1526e2522cefbe3321024d6c12405742b5367edc2e373dc0ff203c25422c98c68cf81355375d7fcf52f90520749811bff1e2ac302671263caa58a6";
             };
 
             mixintrace = fetchurl {
@@ -96,10 +98,15 @@ in
             };
 
             # hasn't updated to 1.21.3 yet (https://modrinth.com/mod/vivecraft/versions)
-            # vivecraft = pkgs.fetchurl {
+            # vivecraft = fetchurl {
             #   url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
             #   sha512 = "6241183987d6197a5e2b4b17f86db2ee9c594f0b6ec335153f1733c2c9ace9f21d07007150a9082e2834deead68b2c287e9443b23be5cd09a366db3f1593975b";
             # };
+
+            squaremap = fetchurl {
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.3-SNAPSHOT+6298c9d.jar";
+              sha256 = "TkXdjYimTSBsvCLstX8siq9AbupOmgIkEkHunQv8now=";
+            };
           }
         );
       };

From 56912f8969521a88f8cd4fa5970e86b30226108a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Nov 2024 12:11:00 -0500
Subject: [PATCH 048/847] use systemd.tmpfiles to manage folder permissions

---
 configuration.nix        | 4 ++++
 services/caddy.nix       | 4 ++++
 services/gitea.nix       | 4 ++++
 services/immich.nix      | 4 ++++
 services/minecraft.nix   | 4 ++++
 services/qbittorrent.nix | 5 +++++
 6 files changed, 25 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 4816fd0..4c2e6d1 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -296,5 +296,9 @@
     dataDir = "/tank/services/sql";
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.postgresql.dataDir} 0700 postgres postgres"
+  ];
+
   system.stateVersion = "24.05";
 }
diff --git a/services/caddy.nix b/services/caddy.nix
index f740e3f..4869d17 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -54,6 +54,10 @@
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.https.data_dir} 0755 ${config.services.caddy.user} ${config.services.caddy.group}"
+  ];
+
   systemd.packages = with pkgs; [ nssTools ];
 
   networking.firewall.allowedTCPPorts = [
diff --git a/services/gitea.nix b/services/gitea.nix
index 5bf07f7..69647a9 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -30,6 +30,10 @@
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.gitea.stateDir} 0755 ${config.services.gitea.user} ${config.services.gitea.group}"
+  ];
+
   services.postgresql = {
     ensureDatabases = [ config.services.gitea.user ];
     ensureUsers = [
diff --git a/services/immich.nix b/services/immich.nix
index f33ef36..4b4d4c6 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -16,6 +16,10 @@
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.immich.mediaLocation} 0755 ${config.services.immich.user} ${config.services.immich.group}"
+  ];
+
   environment.systemPackages = with pkgs; [
     immich-go
   ];
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 4565965..7040e27 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -113,6 +113,10 @@ in
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0755 minecraft minecraft"
+  ];
+
   users.users.${username}.extraGroups = [
     "minecraft"
   ];
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 55d490c..a22d5b3 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -50,6 +50,11 @@
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0755 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0755 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+  ];
+
   # make qbittorrent use a vpn
   systemd.services.qbittorrent.vpnConfinement = {
     enable = true;

From 9000643f432c49a862fdd15e58b4963c4d377930 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Nov 2024 12:30:56 -0500
Subject: [PATCH 049/847] more tmpfiles

---
 services/gitea.nix       |  2 +-
 services/jellyfin.nix    |  6 ++++++
 services/minecraft.nix   |  2 +-
 services/qbittorrent.nix | 30 +++++++++++++++++-------------
 4 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/services/gitea.nix b/services/gitea.nix
index 69647a9..0bd615d 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -31,7 +31,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.gitea.stateDir} 0755 ${config.services.gitea.user} ${config.services.gitea.group}"
+    "d ${config.services.gitea.stateDir} 0750 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
 
   services.postgresql = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 485f900..30bffb1 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -14,6 +14,7 @@
 
   services.jellyfin = rec {
     enable = true;
+
     # used for local streaming
     openFirewall = true;
 
@@ -21,6 +22,11 @@
     cacheDir = dataDir + "_cache";
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.jellyfin.dataDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.cacheDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+  ];
+
   users.users.${config.services.jellyfin.user}.extraGroups = [
     "video"
     "render"
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 7040e27..06adeb3 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -114,7 +114,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0755 minecraft minecraft"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 minecraft minecraft"
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index a22d5b3..7723729 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -26,22 +26,26 @@
     enable = true;
     package = pkgs.qbittorrent-nox;
     webuiPort = service_configs.ports.torrent;
+
     serverConfig.LegalNotice.Accepted = true;
-    serverConfig.Preferences.WebUI = {
-      AlternativeUIEnabled = true;
-      RootFolder = "${pkgs.fetchzip {
-        url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.18.0/vuetorrent.zip";
-        sha256 = "Z+N1RgcF67R6hWEfmfBls1+YLWkhEJQuOVqXXJCyptE=";
-      }}";
 
-      # disable auth because we use caddy for auth
-      AuthSubnetWhitelist = "0.0.0.0/0";
-      AuthSubnetWhitelistEnabled = true;
-    };
+    serverConfig.Preferences = {
+      WebUI = {
+        AlternativeUIEnabled = true;
+        RootFolder = "${pkgs.fetchzip {
+          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.18.0/vuetorrent.zip";
+          sha256 = "Z+N1RgcF67R6hWEfmfBls1+YLWkhEJQuOVqXXJCyptE=";
+        }}";
 
-    serverConfig.Preferences.Downloads = {
-      SavePath = service_configs.torrent.SavePath;
-      TempPath = service_configs.torrent.TempPath;
+        # disable auth because we use caddy for auth
+        AuthSubnetWhitelist = "0.0.0.0/0";
+        AuthSubnetWhitelistEnabled = true;
+      };
+
+      Downloads = {
+        SavePath = service_configs.torrent.SavePath;
+        TempPath = service_configs.torrent.TempPath;
+      };
     };
 
     serverConfig.BitTorrent.Session = {

From cd67d3d15d35a68120b700124e7909369702b9d8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Nov 2024 12:34:43 -0500
Subject: [PATCH 050/847] immich file perms

---
 services/immich.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/immich.nix b/services/immich.nix
index 4b4d4c6..b059254 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -17,7 +17,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.immich.mediaLocation} 0755 ${config.services.immich.user} ${config.services.immich.group}"
+    "d ${config.services.immich.mediaLocation} 0750 ${config.services.immich.user} ${config.services.immich.group}"
   ];
 
   environment.systemPackages = with pkgs; [

From f6b0a72d654ac266b7eb621a96a055dae4ffe916 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Dec 2024 10:45:17 -0500
Subject: [PATCH 051/847] conduit and other changes

---
 .gitattributes               |   1 +
 configuration.nix            |   2 ++
 flake.lock                   |  18 ++++++++---------
 flake.nix                    |  12 ++++-------
 secrets/matrix_reg_token.nix | Bin 0 -> 134 bytes
 services/caddy.nix           |  20 +++++++++++++++++-
 services/matrix.nix          |  38 +++++++++++++++++++++++++++++++++++
 7 files changed, 73 insertions(+), 18 deletions(-)
 create mode 100644 secrets/matrix_reg_token.nix
 create mode 100644 services/matrix.nix

diff --git a/.gitattributes b/.gitattributes
index 4910fb3..59bbd76 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,3 +3,4 @@ secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
 secrets/wg0.conf filter=git-crypt diff=git-crypt
 secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
+secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 4c2e6d1..78f947f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,6 +19,8 @@
     ./services/wg.nix
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
+
+    ./services/matrix.nix
   ];
 
   systemd.targets = {
diff --git a/flake.lock b/flake.lock
index 0365f42..754ba3c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732499634,
-        "narHash": "sha256-RFtqNl1OOi5uKxP2UwYKz4zknpG7CnaocqOf7jcp1AY=",
+        "lastModified": 1733104667,
+        "narHash": "sha256-77V9I6NiwUaDswdsc5TilIREd7OFs8UAVQ3+++cIPN0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "6f29ed33273eef383a33ac7e10e6cfb4949ef3d4",
+        "rev": "5747ec35c936d9d9f58c281111f5ab7115fe13cc",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1732483221,
-        "narHash": "sha256-kF6rDeCshoCgmQz+7uiuPdREVFuzhIorGOoPXMalL2U=",
+        "lastModified": 1733139194,
+        "narHash": "sha256-PVQW9ovo0CJbhuhCsrhFJGGdD1euwUornspKpBIgdok=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "45348ad6fb8ac0e8415f6e5e96efe47dd7f39405",
+        "rev": "c6c90887f84c02ce9ebf33b95ca79ef45007bf88",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1732014248,
-        "narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
+        "lastModified": 1733015953,
+        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
+        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 1cf68f3..1264196 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,6 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    # nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
@@ -97,14 +96,11 @@
             # import the `services.qbittorrent` module
             (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
 
-            # get nix-minercaft working!
+            # get nix-minecraft working!
             nix-minecraft.nixosModules.minecraft-servers
-            (
-              { ... }:
-              {
-                nixpkgs.overlays = [ nix-minecraft.overlay ];
-              }
-            )
+            {
+              nixpkgs.overlays = [ nix-minecraft.overlay ];
+            }
           ]
           ++ (with nixos-hardware.nixosModules; [
             common-cpu-amd-pstate
diff --git a/secrets/matrix_reg_token.nix b/secrets/matrix_reg_token.nix
new file mode 100644
index 0000000000000000000000000000000000000000..52490c1df3cc68d7a18880c8386f2de6a393788b
GIT binary patch
literal 134
zcmZQ@_Y83kiVO&02;KN1=;o}6@0aqQeOYiT-&Mvq;O(~etBjKFv!6Kk;+Nju6@g`$
zA9gk|A6@%-sf2#I;*-yhITyZ5c`UPYW~1nCk*bx&w(i0c&IblaUtn2rGMLR|(W99C
sg6B<z`ATHpM@cL$eXHj!Dn0wu&e#-=rXaoS=jHNC8VdIZSnS^h06XeG#sB~S

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
index 4869d17..6eb6d61 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -51,25 +51,43 @@
         root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
         file_server browse
       '';
+
+      "${config.services.matrix-conduit.settings.global.server_name}".extraConfig = ''
+        reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
+      '';
+
+      # Exact duplicate of matrix.gardling.com
+      "${config.services.matrix-conduit.settings.global.server_name}:8448".extraConfig =
+        config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
+        }".extraConfig;
     };
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} 0755 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${service_configs.https.data_dir} 0750 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];
 
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.https
+
+    # http (but really acmeCA challenges)
     80
+
+    # for matrix federation
+    8448
   ];
 
   networking.firewall.allowedUDPPorts = [
     service_configs.ports.https
+
+    # for matrix federation
+    8448
   ];
 
   users.users.${config.services.caddy.user}.extraGroups = [
+    # for `map.gardling.com`
     "minecraft"
   ];
 
diff --git a/services/matrix.nix b/services/matrix.nix
new file mode 100644
index 0000000..c9433bd
--- /dev/null
+++ b/services/matrix.nix
@@ -0,0 +1,38 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    ../secrets/matrix_reg_token.nix
+  ];
+
+  services.matrix-conduit = {
+    enable = true;
+    package = pkgs.conduwuit;
+    # package = pkgs.conduwuit.overrideAttrs (old: {
+    #   cargoBuildFeatures = pkgs.lib.remove "release_max_log_level" old.cargoBuildFeatures;
+    # });
+
+    settings.global = {
+      port = 6167;
+      server_name = "matrix.${service_configs.https.domain}";
+      database_backend = "rocksdb";
+      allow_registration = true;
+
+      trusted_servers = [
+        "matrix.org"
+        "envs.net"
+      ];
+
+      # without this, conduit fails to start
+      address = "0.0.0.0";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/private/matrix-conduit 0750 conduit conduit"
+  ];
+}

From 16abe6b433a0037660386ac3d069ce0c721dd16b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Dec 2024 23:00:11 -0500
Subject: [PATCH 052/847] minecraft: update mods

---
 services/minecraft.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 06adeb3..d9c2b4f 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -57,8 +57,8 @@ in
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/QhCwdt4l/lithium-fabric-0.14.2-snapshot%2Bmc1.21.3-build.91.jar";
-              sha512 = "6c025877e0f5de8f87baca0be08e19bbad8fb7f6e2037d064f2497fd9779cdc3b979dfc80d228374934ef84014949c9cb4740c816cac0ac9ad0d566d1d7e4f0e";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/pZRO3EKX/lithium-fabric-0.14.3%2Bmc1.21.3.jar";
+              sha512 = "31ad08427ac50dd54cd2215c29452bd20430ce13f2bd8f4bdb8a6e2f6222b83df47d5727edac721f9397fa296db2998f9aa3eabe2c4c5d45619f8b5b00cd21fc";
             };
 
             NoChatReports = fetchurl {
@@ -73,8 +73,8 @@ in
             # };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/GD9TRt0g/Moonrise-Fabric-0.2.0-beta.4%2Be7510ed.jar";
-              sha512 = "32be95ce0c1526e2522cefbe3321024d6c12405742b5367edc2e373dc0ff203c25422c98c68cf81355375d7fcf52f90520749811bff1e2ac302671263caa58a6";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/LMdPX7nZ/Moonrise-Fabric-0.2.0-beta.5%2Ba6cf977.jar";
+              sha512 = "550474a8c2fd94c97d30ec3a03456b343db8467eff0807487d4fb84bb8f3be1b36720c70a86f0b364a448103519315fc6d7752a3df8cabf140f2af4f4a0b5851";
             };
 
             mixintrace = fetchurl {
@@ -104,8 +104,8 @@ in
             # };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.3-SNAPSHOT+6298c9d.jar";
-              sha256 = "TkXdjYimTSBsvCLstX8siq9AbupOmgIkEkHunQv8now=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+61898fc.jar";
+              sha256 = "k5PYfaO+9akftd1+43DGVHL8hGL5Ys02mEjV4Ici60g=";
             };
           }
         );

From 41289cb88f053e6cd681adf0e56b2f0152014cec Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Dec 2024 23:00:38 -0500
Subject: [PATCH 053/847] matrix: setup delegation and misc configs

---
 services/caddy.nix  | 13 +++++++++++--
 services/matrix.nix |  7 ++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 6eb6d61..6b6e811 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -5,6 +5,9 @@
   pkgs,
   ...
 }:
+let
+  matrix_hostname = "matrix.${service_configs.https.domain}";
+in
 {
   services.caddy = {
     enable = true;
@@ -12,6 +15,12 @@
     virtualHosts = {
       ${service_configs.https.domain} = {
         extraConfig = ''
+
+          header /.well-known/matrix/* Content-Type application/json
+          header /.well-known/matrix/* Access-Control-Allow-Origin *
+          respond /.well-known/matrix/server `{"m.server": "${matrix_hostname}:443"}`
+          respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${matrix_hostname}"},"m.homeserver":{"base_url":"https://${matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
+
           root * ${service_configs.https.data_dir}
           file_server browse
         '';
@@ -52,12 +61,12 @@
         file_server browse
       '';
 
-      "${config.services.matrix-conduit.settings.global.server_name}".extraConfig = ''
+      "${matrix_hostname}".extraConfig = ''
         reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
       '';
 
       # Exact duplicate of matrix.gardling.com
-      "${config.services.matrix-conduit.settings.global.server_name}:8448".extraConfig =
+      "${matrix_hostname}:8448".extraConfig =
         config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
         }".extraConfig;
     };
diff --git a/services/matrix.nix b/services/matrix.nix
index c9433bd..4601aac 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -18,12 +18,17 @@
 
     settings.global = {
       port = 6167;
-      server_name = "matrix.${service_configs.https.domain}";
+      # server_name = "matrix.${service_configs.https.domain}";
+      server_name = service_configs.https.domain;
       database_backend = "rocksdb";
       allow_registration = true;
 
+      new_user_displayname_suffix = "";
+
       trusted_servers = [
         "matrix.org"
+        "constellatory.net"
+        "tchncs.de"
         "envs.net"
       ];
 

From 39fe69a689d9dfded0f471bcd707642cf5387817 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Dec 2024 23:00:45 -0500
Subject: [PATCH 054/847] update

---
 configuration.nix |  2 ++
 flake.lock        | 18 +++++++++---------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 78f947f..c9668bb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -128,6 +128,8 @@
 
     tmux
 
+    wget
+
     (pkgs.writeScriptBin "mc-console" ''
       #!/bin/sh
       ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
diff --git a/flake.lock b/flake.lock
index 754ba3c..d2e2b82 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733104667,
-        "narHash": "sha256-77V9I6NiwUaDswdsc5TilIREd7OFs8UAVQ3+++cIPN0=",
+        "lastModified": 1733277378,
+        "narHash": "sha256-jPhKF6d2UXBr2nkJIFuUjVXdo6kEwLuIMK3RyJeA60s=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5747ec35c936d9d9f58c281111f5ab7115fe13cc",
+        "rev": "ea8246bb2a70d33b5d332667a57da75e95c89af9",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1733139194,
-        "narHash": "sha256-PVQW9ovo0CJbhuhCsrhFJGGdD1euwUornspKpBIgdok=",
+        "lastModified": 1733217105,
+        "narHash": "sha256-fc6jTzIwCIVWTX50FtW6AZpuukuQWSEbPiyg6ZRGWFY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c6c90887f84c02ce9ebf33b95ca79ef45007bf88",
+        "rev": "cceee0a31d2f01bcc98b2fbd591327c06a4ea4f9",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733015953,
-        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
+        "lastModified": 1733212471,
+        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
+        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
         "type": "github"
       },
       "original": {

From 3e3ee89e37ea71d8f4899b777cad5f86f4afcf11 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Dec 2024 11:17:54 -0500
Subject: [PATCH 055/847] fix ipv6

---
 configuration.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index c9668bb..2d64631 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -215,7 +215,7 @@
     hostId = "0f712d56";
     firewall.enable = true;
     useDHCP = false;
-    enableIPv6 = false;
+    # enableIPv6 = false;
 
     interfaces.${eth_interface} = {
       ipv4.addresses = [
@@ -226,7 +226,7 @@
       ];
       ipv6.addresses = [
         {
-          address = "2603:9001:3900:f005:1779:17ed:4698:6259";
+          address = "fe80::9e6b:ff:fe4d:abb";
           prefixLength = 64;
         }
       ];
@@ -235,6 +235,11 @@
       address = "10.1.1.1";
       interface = eth_interface;
     };
+    # TODO! fix this
+    # defaultGateway6 = {
+    #   address = "fe80::/64";
+    #   interface = eth_interface;
+    # };
   };
 
   users.users.${username} = {

From bbd2a9ba2272107c3cdb135c8724b3fd15b080c5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Dec 2024 11:41:48 -0500
Subject: [PATCH 056/847] cleanup reflac

---
 configuration.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 2d64631..c23ba50 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -150,15 +150,19 @@
       done
     '')
 
-    flac
-    (pkgs.writeScriptBin "reflac" (
-      builtins.readFile (
+    (pkgs.writeShellApplication {
+      name = "reflac";
+      runtimeInputs = with pkgs; [ flac ];
+      excludeShellChecks = [ "2086" ];
+
+      text = builtins.readFile (
         pkgs.fetchurl {
           url = "https://raw.githubusercontent.com/chungy/reflac/refs/heads/master/reflac";
           sha256 = "61c6cc8be3d276c6714e68b55e5de0e6491f50bbf195233073dbce14a1e278a7";
         }
-      )
-    ))
+      );
+    })
+
   ];
 
   services.zfs = {

From 4947a0eeeb3af3040b1a312651b800276db1e8bd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 8 Dec 2024 10:14:20 -0500
Subject: [PATCH 057/847] update

---
 flake.lock             | 18 +++++++++---------
 services/matrix.nix    |  1 -
 services/minecraft.nix |  4 ++--
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index d2e2b82..ee7e651 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733277378,
-        "narHash": "sha256-jPhKF6d2UXBr2nkJIFuUjVXdo6kEwLuIMK3RyJeA60s=",
+        "lastModified": 1733623390,
+        "narHash": "sha256-2NcNHpofUCVam1gLhj71nbszEzki7Q/PtjH1X0MqCso=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ea8246bb2a70d33b5d332667a57da75e95c89af9",
+        "rev": "d63629179143d079d6e4975f8c68bb71a5d3ea08",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1733217105,
-        "narHash": "sha256-fc6jTzIwCIVWTX50FtW6AZpuukuQWSEbPiyg6ZRGWFY=",
+        "lastModified": 1733481457,
+        "narHash": "sha256-IS3bxa4N1VMSh3/P6vhEAHQZecQ3oAlKCDvzCQSO5Is=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cceee0a31d2f01bcc98b2fbd591327c06a4ea4f9",
+        "rev": "e563803af3526852b6b1d77107a81908c66a9fcf",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733212471,
-        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
+        "lastModified": 1733581040,
+        "narHash": "sha256-Qn3nPMSopRQJgmvHzVqPcE3I03zJyl8cSbgnnltfFDY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
+        "rev": "22c3f2cf41a0e70184334a958e6b124fb0ce3e01",
         "type": "github"
       },
       "original": {
diff --git a/services/matrix.nix b/services/matrix.nix
index 4601aac..df9f0ac 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -18,7 +18,6 @@
 
     settings.global = {
       port = 6167;
-      # server_name = "matrix.${service_configs.https.domain}";
       server_name = service_configs.https.domain;
       database_backend = "rocksdb";
       allow_registration = true;
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d9c2b4f..79d9da6 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -104,8 +104,8 @@ in
             # };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+61898fc.jar";
-              sha256 = "k5PYfaO+9akftd1+43DGVHL8hGL5Ys02mEjV4Ici60g=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+4c8b7c6.jar";
+              sha256 = "1rf1hy934zvkihm9hy99d17hh9v4lbwsxkzbf3zxj124lzbdmn79";
             };
           }
         );

From 757e6a0fb0db96eb88eea554505ba0c43fcdc249 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 13 Dec 2024 19:10:26 -0500
Subject: [PATCH 058/847] mc stuff

---
 flake.lock             |  6 +++---
 services/minecraft.nix | 32 --------------------------------
 2 files changed, 3 insertions(+), 35 deletions(-)

diff --git a/flake.lock b/flake.lock
index ee7e651..77ed56a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733623390,
-        "narHash": "sha256-2NcNHpofUCVam1gLhj71nbszEzki7Q/PtjH1X0MqCso=",
+        "lastModified": 1733709556,
+        "narHash": "sha256-u0ll0DDrKlO7tiLGGtmphv3wFy5ReDuf0USo/OlfROU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d63629179143d079d6e4975f8c68bb71a5d3ea08",
+        "rev": "8d11f147df83fe137d3d94f6f3646e3a52bec855",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 79d9da6..9e418f3 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -66,43 +66,11 @@ in
               sha512 = "8f1163ad515ebdfab5ef54a4985af05e643749c2efc0bf7b62e00074bbe61d91789b0c9e558bbe1b5c5d21a89b88084ce6350a11a5a9a3bea59eea9764a27171";
             };
 
-            # breaks squaremap
-            # tick-stasis = fetchurl {
-            #   url = "https://cdn.modrinth.com/data/t6XBQ2xn/versions/fDbxgNHz/tick-stasis-1.1.1.jar";
-            #   sha512 = "346fae7e0f1a62636525a9331643ac4343b781c240db6ef9bafe1b3a295d24d131d2b4b20cef8edc33835e9069fcaf1c2e2b3ce9ced9a2ec6e4e3d82770f52c6";
-            # };
-
             moonrise = fetchurl {
               url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/LMdPX7nZ/Moonrise-Fabric-0.2.0-beta.5%2Ba6cf977.jar";
               sha512 = "550474a8c2fd94c97d30ec3a03456b343db8467eff0807487d4fb84bb8f3be1b36720c70a86f0b364a448103519315fc6d7752a3df8cabf140f2af4f4a0b5851";
             };
 
-            mixintrace = fetchurl {
-              url = "https://cdn.modrinth.com/data/sGmHWmeL/versions/1.1.1%2B1.17/mixintrace-1.1.1%2B1.17.jar";
-              sha512 = "ea9034b60bc1c64629a9bcad2e619907692fe6e7464026236c55cc5a4892a20d21dd6318ad0380ab2ec245f7077939b6717d2ed58e00708c17470be14f5e0b5f";
-            };
-
-            better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/QGfoAASu/better-fabric-console-mc1.21.3-1.2.1.jar";
-              sha512 = "3a88c281a65f26e44b17b3a7a5cc9f84046b013931bd3af7f2553f462987a96357b21c104a41593ca0516038e6c4398a890ee118046fe95a7e0c7f2d743d944a";
-            };
-
-            StackDeobfuscator = fetchurl {
-              url = "https://cdn.modrinth.com/data/NusMqsjF/versions/pyiVLk9R/StackDeobfuscatorFabric-1.4.3%2B08e71cc.jar";
-              sha512 = "ef851d54a60e223e90cfd21da91effcdc70175dd32b194366ca3ba29646c9ebdbfb60a1eaa88070c4e9f83bd654da1344e67226dfdf5c68140db4ef693361353";
-            };
-
-            mods-command = fetchurl {
-              url = "https://cdn.modrinth.com/data/PExmWQV8/versions/1F0YwdWN/mods-command-mc1.21.3-1.1.8.jar";
-              sha512 = "761ee048edd6b53eac6fd922c21f7c4012970b3aa57fbd8e7613294e57a12603a7a30af6d6595c06a6a67a02c2a90cb76cd3dafd0bb647d16b4a9888454f0421";
-            };
-
-            # hasn't updated to 1.21.3 yet (https://modrinth.com/mod/vivecraft/versions)
-            # vivecraft = fetchurl {
-            #   url = "https://cdn.modrinth.com/data/wGoQDPN5/versions/55ml9ENB/vivecraft-1.21.1-1.1.14-b2-fabric.jar";
-            #   sha512 = "6241183987d6197a5e2b4b17f86db2ee9c594f0b6ec335153f1733c2c9ace9f21d07007150a9082e2834deead68b2c287e9443b23be5cd09a366db3f1593975b";
-            # };
-
             squaremap = fetchurl {
               url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+4c8b7c6.jar";
               sha256 = "1rf1hy934zvkihm9hy99d17hh9v4lbwsxkzbf3zxj124lzbdmn79";

From 08cf7b9d9d743ede5f3489909ffc3ffedb3617f3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 13 Dec 2024 19:10:40 -0500
Subject: [PATCH 059/847] update vuetorrent

---
 flake.lock               | 18 +++++++++---------
 services/immich.nix      |  2 +-
 services/qbittorrent.nix |  4 ++--
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 77ed56a..25c8551 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733709556,
-        "narHash": "sha256-u0ll0DDrKlO7tiLGGtmphv3wFy5ReDuf0USo/OlfROU=",
+        "lastModified": 1733968549,
+        "narHash": "sha256-r18fyuignDxOTgmgSRAvR2XRvdwoZOtPxqgRBuafqFQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8d11f147df83fe137d3d94f6f3646e3a52bec855",
+        "rev": "8f4795cc29b2a1e62e0d1856d9f7dcf219829748",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1733481457,
-        "narHash": "sha256-IS3bxa4N1VMSh3/P6vhEAHQZecQ3oAlKCDvzCQSO5Is=",
+        "lastModified": 1733861262,
+        "narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "e563803af3526852b6b1d77107a81908c66a9fcf",
+        "rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733581040,
-        "narHash": "sha256-Qn3nPMSopRQJgmvHzVqPcE3I03zJyl8cSbgnnltfFDY=",
+        "lastModified": 1733759999,
+        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "22c3f2cf41a0e70184334a958e6b124fb0ce3e01",
+        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
         "type": "github"
       },
       "original": {
diff --git a/services/immich.nix b/services/immich.nix
index b059254..3f51fba 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -9,7 +9,7 @@
     enable = true;
     mediaLocation = service_configs.immich.dir;
     port = 2283;
-    openFirewall = true;
+    # openFirewall = true;
     host = "0.0.0.0";
     database = {
       createDB = false;
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 7723729..a43fc67 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -33,8 +33,8 @@
       WebUI = {
         AlternativeUIEnabled = true;
         RootFolder = "${pkgs.fetchzip {
-          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.18.0/vuetorrent.zip";
-          sha256 = "Z+N1RgcF67R6hWEfmfBls1+YLWkhEJQuOVqXXJCyptE=";
+          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.19.0/vuetorrent.zip";
+          sha256 = "cIY5fhcLyEPwt5D2T0S4KhAbb8Qmd9m3xcsQTa4FX+8=";
         }}";
 
         # disable auth because we use caddy for auth

From 36003956d082ff519da5b55488e0772b60809c39 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 22 Dec 2024 01:40:00 +0100
Subject: [PATCH 060/847] update things

---
 flake.lock               | 20 ++++++++++----------
 flake.nix                |  2 +-
 services/minecraft.nix   | 36 +++++++++++++++++-------------------
 services/qbittorrent.nix |  3 ++-
 4 files changed, 30 insertions(+), 31 deletions(-)

diff --git a/flake.lock b/flake.lock
index 25c8551..c4f5b6f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733968549,
-        "narHash": "sha256-r18fyuignDxOTgmgSRAvR2XRvdwoZOtPxqgRBuafqFQ=",
+        "lastModified": 1734314370,
+        "narHash": "sha256-9PhjDAAuXP4tuJg+kM1AozKwBFyHHJ8ZqhQD+peqGtg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8f4795cc29b2a1e62e0d1856d9f7dcf219829748",
+        "rev": "616634de04e87b621bc3d495af114c4e9c6ccd36",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1733861262,
-        "narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
+        "lastModified": 1734352517,
+        "narHash": "sha256-mfv+J/vO4nqmIOlq8Y1rRW8hVsGH3M+I2ESMjhuebDs=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
+        "rev": "b12e314726a4226298fe82776b4baeaa7bcf3dcd",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733759999,
-        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
+        "lastModified": 1734827055,
+        "narHash": "sha256-stFrYYMZd9ydDbp7/EmzDZg0AwvKM6kxvVEvDqy5eKk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
+        "rev": "55d3dc18887e5dd8c1c16a60b9e63e54fe62a21f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 1264196..0ba2e8b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 9e418f3..5a94bd2 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -6,7 +6,7 @@
   ...
 }:
 let
-  heap_size = "2000M";
+  heap_size = "4000M";
 in
 {
   nixpkgs.config.allowUnfreePredicate =
@@ -23,7 +23,7 @@ in
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_3;
+      package = pkgs.fabricServers.fabric-1_21_4;
 
       jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
@@ -39,42 +39,40 @@ in
 
       whitelist = import ../secrets/minecraft-whitelist.nix;
 
-      # provide `infocmp` command for better-fabric-console
-      path = [ pkgs.ncurses ];
-
       symlinks = {
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/Xhw2LuSh/fabric-api-0.109.0%2B1.21.3.jar";
-              sha512 = "decfcbcc4cc9748b9822a5e0b34dada9e1454bbf7c0eb1d4e014db243e8eebaa240a05a48c1bcde232ddecf150692fe295f9bb147794c861e42d2cad66119657";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/KEv54FjE/fabric-api-0.111.0%2B1.21.4.jar";
+              sha512 = "ca6e1f0a6178f48b319891ca666ddaa186c094b6402e64e9d45e9f206d0985b0dbb00dfc833b14f26013463845ee1496356d4d8c0028eee4db9524e2cf2df618";
             };
 
             FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/a3QXXGz2/ferritecore-7.1.0-hotfix-fabric.jar";
-              sha512 = "ae1ab30beb5938643cf2ae7b8220769f2c917e3f5441e46e9bc900295348c0a541a325c30b8dfc38039205620d872c27809acdc6741351f08e4c8edc36ae2bcc";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/IPM0JlHd/ferritecore-7.1.1-fabric.jar";
+              sha512 = "f41dc9e8b28327a1e29b14667cb42ae5e7e17bcfa4495260f6f851a80d4b08d98a30d5c52b110007ee325f02dac7431e3fad4560c6840af0bf347afad48c5aac";
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/pZRO3EKX/lithium-fabric-0.14.3%2Bmc1.21.3.jar";
-              sha512 = "31ad08427ac50dd54cd2215c29452bd20430ce13f2bd8f4bdb8a6e2f6222b83df47d5727edac721f9397fa296db2998f9aa3eabe2c4c5d45619f8b5b00cd21fc";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/t1FlWYl9/lithium-fabric-0.14.3%2Bmc1.21.4.jar";
+              sha512 = "1a4eafbdcee3886d33c04aa462d13a8c1e345ff492001add262476585b78327a2d016e56385bced869615bc97161a34a0a716f5f579c8c1d7080b278f4f11183";
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/Cg7X9iDa/NoChatReports-FABRIC-1.21.3-v2.10.1.jar";
-              sha512 = "8f1163ad515ebdfab5ef54a4985af05e643749c2efc0bf7b62e00074bbe61d91789b0c9e558bbe1b5c5d21a89b88084ce6350a11a5a9a3bea59eea9764a27171";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/9xt05630/NoChatReports-FABRIC-1.21.4-v2.11.0.jar";
+              sha512 = "d343b05c8e50f1de15791ff622ad44eeca6cdcb21e960a267a17d71506c61ca79b1c824167779e44d778ca18dcbdebe594ff234fbe355b68d25cdb5b6afd6e4f";
             };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/LMdPX7nZ/Moonrise-Fabric-0.2.0-beta.5%2Ba6cf977.jar";
-              sha512 = "550474a8c2fd94c97d30ec3a03456b343db8467eff0807487d4fb84bb8f3be1b36720c70a86f0b364a448103519315fc6d7752a3df8cabf140f2af4f4a0b5851";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/FZCC8uFL/Moonrise-Fabric-0.2.0-beta.6%2Bb70443e.jar";
+              sha512 = "1574d3a0f81220ff1daacbda79ce889ac4120ebeb8ad51fdce11a27413603f9e5d37fdcfbb90f206b50559fa65aec68d515559cf91d223116e4f314aa69cf468";
             };
 
-            squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+4c8b7c6.jar";
-              sha256 = "1rf1hy934zvkihm9hy99d17hh9v4lbwsxkzbf3zxj124lzbdmn79";
-            };
+            # Not updated to 1.21.4
+            # squaremap = fetchurl {
+            #   url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+4c8b7c6.jar";
+            #   sha256 = "6dja1qdEBNn/cOvPrvmiZCcIT2gpeZgqjHN/MpKHweU=";
+            # };
           }
         );
       };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index a43fc67..740bfc4 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -49,7 +49,8 @@
     };
 
     serverConfig.BitTorrent.Session = {
-      GlobalUPSpeedLimit = 1000; # 1 MiB/s
+      GlobalUPSpeedLimit = 100; # in KiB/s
+      GlobalDLSpeedLimit = 1000; # in KiB/s
       QueueingSystemEnabled = false; # seed all torrents all the time
     };
   };

From 5440223d1ab5f91a77b065e3f1d9d189b90a4366 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Dec 2024 19:57:47 +0100
Subject: [PATCH 061/847] update things

---
 flake.lock               | 20 ++++++++++----------
 flake.nix                |  2 +-
 services/minecraft.nix   |  9 ++++-----
 services/qbittorrent.nix |  3 ++-
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/flake.lock b/flake.lock
index c4f5b6f..8abad20 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1734314370,
-        "narHash": "sha256-9PhjDAAuXP4tuJg+kM1AozKwBFyHHJ8ZqhQD+peqGtg=",
+        "lastModified": 1735004788,
+        "narHash": "sha256-4fR1BPM2IJWbCaoAQqkVr+DhDzpgGhbfLcl7V2fd0ME=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "616634de04e87b621bc3d495af114c4e9c6ccd36",
+        "rev": "cc5f59e353d94a907cd9e06919aaecb093b59d46",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1734352517,
-        "narHash": "sha256-mfv+J/vO4nqmIOlq8Y1rRW8hVsGH3M+I2ESMjhuebDs=",
+        "lastModified": 1734954597,
+        "narHash": "sha256-QIhd8/0x30gEv8XEE1iAnrdMlKuQ0EzthfDR7Hwl+fk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b12e314726a4226298fe82776b4baeaa7bcf3dcd",
+        "rev": "def1d472c832d77885f174089b0d34854b007198",
         "type": "github"
       },
       "original": {
@@ -74,16 +74,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734827055,
-        "narHash": "sha256-stFrYYMZd9ydDbp7/EmzDZg0AwvKM6kxvVEvDqy5eKk=",
+        "lastModified": 1734649271,
+        "narHash": "sha256-4EVBRhOjMDuGtMaofAIqzJbg4Ql7Ai0PSeuVZTHjyKQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55d3dc18887e5dd8c1c16a60b9e63e54fe62a21f",
+        "rev": "d70bd19e0a38ad4790d3913bf08fcbfc9eeca507",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 0ba2e8b..1264196 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 5a94bd2..27f27e0 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -68,11 +68,10 @@ in
               sha512 = "1574d3a0f81220ff1daacbda79ce889ac4120ebeb8ad51fdce11a27413603f9e5d37fdcfbb90f206b50559fa65aec68d515559cf91d223116e4f314aa69cf468";
             };
 
-            # Not updated to 1.21.4
-            # squaremap = fetchurl {
-            #   url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.3-1.3.4-SNAPSHOT+4c8b7c6.jar";
-            #   sha256 = "6dja1qdEBNn/cOvPrvmiZCcIT2gpeZgqjHN/MpKHweU=";
-            # };
+            squaremap = fetchurl {
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.4-SNAPSHOT+53d7948.jar";
+              sha256 = "v1iCRTXvTLuxEy1hzbd9fVXmY62nqBAhFTEfdIu7sAk=";
+            };
           }
         );
       };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 740bfc4..56f77ef 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -49,8 +49,9 @@
     };
 
     serverConfig.BitTorrent.Session = {
-      GlobalUPSpeedLimit = 100; # in KiB/s
+      GlobalUPSpeedLimit = 50; # in KiB/s
       GlobalDLSpeedLimit = 1000; # in KiB/s
+      GlobalMaxRatio = 6;
       QueueingSystemEnabled = false; # seed all torrents all the time
     };
   };

From 91c67183be3147e0e94573c0229b5d3267dd6ea9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Dec 2024 20:34:31 +0100
Subject: [PATCH 062/847] qbt: include overhead in limits

---
 services/qbittorrent.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 56f77ef..587a034 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -51,6 +51,7 @@
     serverConfig.BitTorrent.Session = {
       GlobalUPSpeedLimit = 50; # in KiB/s
       GlobalDLSpeedLimit = 1000; # in KiB/s
+      IncludeOverheadInLimits = true; # make limits more accurate
       GlobalMaxRatio = 6;
       QueueingSystemEnabled = false; # seed all torrents all the time
     };

From b2ab5ba88d77ca721fb479954b49ee0b874c2c09 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 26 Dec 2024 20:58:05 +0100
Subject: [PATCH 063/847] qbt: adjust settings

---
 services/qbittorrent.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 587a034..79169b1 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -50,8 +50,11 @@
 
     serverConfig.BitTorrent.Session = {
       GlobalUPSpeedLimit = 50; # in KiB/s
-      GlobalDLSpeedLimit = 1000; # in KiB/s
-      IncludeOverheadInLimits = true; # make limits more accurate
+      GlobalDLSpeedLimit = 0;
+
+      # Including overhead in limits ruins download because download
+      # uses upload to communicate with seeders
+      IncludeOverheadInLimits = false;
       GlobalMaxRatio = 6;
       QueueingSystemEnabled = false; # seed all torrents all the time
     };

From 643609c3bfa18d71536f66892813a3e5189c3d51 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Dec 2024 21:15:08 +0100
Subject: [PATCH 064/847] update and use stable nixos version

---
 configuration.nix      |  2 ++
 flake.lock             | 42 ++++++++++++++++++++++++++++++++----------
 flake.nix              | 27 ++++++++++++++++++++++++---
 home.nix               | 31 +++++++++++++++++++++++++++++++
 services/caddy.nix     |  2 +-
 services/minecraft.nix | 12 ++++++------
 6 files changed, 96 insertions(+), 20 deletions(-)
 create mode 100644 home.nix

diff --git a/configuration.nix b/configuration.nix
index c23ba50..161bb79 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -163,6 +163,8 @@
       );
     })
 
+    pfetch-rs
+
   ];
 
   services.zfs = {
diff --git a/flake.lock b/flake.lock
index 8abad20..f5488de 100644
--- a/flake.lock
+++ b/flake.lock
@@ -34,6 +34,27 @@
         "type": "github"
       }
     },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1735344290,
+        "narHash": "sha256-oJDtWPH1oJT34RJK1FSWjwX4qcGOBRkcNQPD0EbSfNM=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "613691f285dad87694c2ba1c9e6298d04736292d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-24.11",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -43,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735004788,
-        "narHash": "sha256-4fR1BPM2IJWbCaoAQqkVr+DhDzpgGhbfLcl7V2fd0ME=",
+        "lastModified": 1735609543,
+        "narHash": "sha256-2+sJqwaileD2izqMv/k6Z7iLlHOF8T4kRWflCGURzN4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "cc5f59e353d94a907cd9e06919aaecb093b59d46",
+        "rev": "2faa9fdd8d29df54d6cec075055cf1dcf50de280",
         "type": "github"
       },
       "original": {
@@ -58,11 +79,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1734954597,
-        "narHash": "sha256-QIhd8/0x30gEv8XEE1iAnrdMlKuQ0EzthfDR7Hwl+fk=",
+        "lastModified": 1735388221,
+        "narHash": "sha256-e5IOgjQf0SZcFCEV/gMGrsI0gCJyqOKShBQU0iiM3Kg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "def1d472c832d77885f174089b0d34854b007198",
+        "rev": "7c674c6734f61157e321db595dbfcd8523e04e19",
         "type": "github"
       },
       "original": {
@@ -74,16 +95,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734649271,
-        "narHash": "sha256-4EVBRhOjMDuGtMaofAIqzJbg4Ql7Ai0PSeuVZTHjyKQ=",
+        "lastModified": 1735531152,
+        "narHash": "sha256-As8I+ebItDKtboWgDXYZSIjGlKeqiLBvjxsQHUmAf1Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d70bd19e0a38ad4790d3913bf08fcbfc9eeca507",
+        "rev": "3ffbbdbac0566a0977da3d2657b89cbcfe9a173b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -106,6 +127,7 @@
     },
     "root": {
       "inputs": {
+        "home-manager": "home-manager",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index 1264196..9bc4c54 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,16 +2,23 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
-    nix-minecraft.url = "github:Infinidoge/nix-minecraft";
-    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
+    nix-minecraft = {
+      url = "github:Infinidoge/nix-minecraft";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
 
     nixpkgs-qbt.url = "github:NixOS/nixpkgs/pull/287923/head";
+
+    home-manager = {
+      url = "github:nix-community/home-manager/release-24.11";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -21,6 +28,7 @@
       nixos-hardware,
       vpn-confinement,
       nixpkgs-qbt,
+      home-manager,
       ...
     }@inputs:
     let
@@ -101,6 +109,19 @@
             {
               nixpkgs.overlays = [ nix-minecraft.overlay ];
             }
+
+            home-manager.nixosModules.home-manager
+            (
+              {
+                pkgs,
+                username,
+                home-manager,
+                ...
+              }:
+              {
+                home-manager.users.${username} = import ./home.nix;
+              }
+            )
           ]
           ++ (with nixos-hardware.nixosModules; [
             common-cpu-amd-pstate
diff --git a/home.nix b/home.nix
new file mode 100644
index 0000000..cda675a
--- /dev/null
+++ b/home.nix
@@ -0,0 +1,31 @@
+{ pkgs, username, ... }:
+{
+  home.stateVersion = "24.11";
+  programs.fish =
+    let
+      eza = "${pkgs.eza}/bin/eza --color=always --group-directories-first";
+      coreutils = "${pkgs.coreutils}/bin";
+    in
+    {
+      enable = true;
+
+      interactiveShellInit = ''
+        #disable greeting
+        set fish_greeting
+
+        #fixes gnupg password entry
+        export GPG_TTY=(${coreutils}/tty)
+
+        #pfetch on shell start (disable pkgs because of execution time)
+        PF_INFO="ascii title os host kernel uptime memory editor wm" ${pkgs.pfetch-rs}/bin/pfetch
+      '';
+
+      shellAliases = {
+        # from DistroTube's dot files: Changing "ls" to "eza"
+        ls = "${eza} -al";
+        la = "${eza} -a";
+        ll = "${eza} -l";
+        lt = "${eza} -aT";
+      };
+    };
+}
diff --git a/services/caddy.nix b/services/caddy.nix
index 6b6e811..4c887ab 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -65,7 +65,7 @@ in
         reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
       '';
 
-      # Exact duplicate of matrix.gardling.com
+      # Exact duplicate of matrix.DOMAIN_NAME
       "${matrix_hostname}:8448".extraConfig =
         config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
         }".extraConfig;
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 27f27e0..ff3893b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -44,8 +44,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/KEv54FjE/fabric-api-0.111.0%2B1.21.4.jar";
-              sha512 = "ca6e1f0a6178f48b319891ca666ddaa186c094b6402e64e9d45e9f206d0985b0dbb00dfc833b14f26013463845ee1496356d4d8c0028eee4db9524e2cf2df618";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/5tj7y3PJ/fabric-api-0.114.0%2B1.21.4.jar";
+              sha512 = "5e801dd76fa4ca0d393cd8c82059556bee420d8610e1ffb09c2c90eb487e997acb5061ec571250db1fe57491505f304b8222fcbe02243048c5df809a610d94a6";
             };
 
             FerriteCore = fetchurl {
@@ -64,13 +64,13 @@ in
             };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/FZCC8uFL/Moonrise-Fabric-0.2.0-beta.6%2Bb70443e.jar";
-              sha512 = "1574d3a0f81220ff1daacbda79ce889ac4120ebeb8ad51fdce11a27413603f9e5d37fdcfbb90f206b50559fa65aec68d515559cf91d223116e4f314aa69cf468";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/a8Zqa1bJ/Moonrise-Fabric-0.2.0-beta.7%2B6ec14ff.jar";
+              sha512 = "4ebc97764038aebd0b4bc5f6b25f9356419cf32f6c8bd64016665d9aad5c9f79ca9df2decac3038f7f713ff595c2b3286b3a1eb4d6debcd6639a52556416581a";
             };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.4-SNAPSHOT+53d7948.jar";
-              sha256 = "v1iCRTXvTLuxEy1hzbd9fVXmY62nqBAhFTEfdIu7sAk=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.4-SNAPSHOT+022b4b3.jar";
+              sha256 = "1625xlbmaj2rcxm1rlbgnm3c8sjnld48qk588p8vpy5i5xfx7ry2";
             };
           }
         );

From 4a26abc211e82f1853d0d7f2fd3ae375bff6485c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Jan 2025 00:44:03 +0100
Subject: [PATCH 065/847] owntracks and updates

---
 .gitattributes                   |   1 +
 configuration.nix                |   4 ++++
 flake.lock                       |  12 +++++------
 flake.nix                        |   6 ++++++
 home.nix                         |   7 ++++++-
 secrets/owntracks_caddy_auth.nix | Bin 0 -> 112 bytes
 services/caddy.nix               |   5 +++++
 services/owntracks.nix           |  34 +++++++++++++++++++++++++++++++
 8 files changed, 62 insertions(+), 7 deletions(-)
 create mode 100644 secrets/owntracks_caddy_auth.nix
 create mode 100644 services/owntracks.nix

diff --git a/.gitattributes b/.gitattributes
index 59bbd76..02fe85a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,4 @@ secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
 secrets/wg0.conf filter=git-crypt diff=git-crypt
 secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
 secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
+secrets/owntracks_caddy_auth.nix filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 161bb79..15dcd60 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -21,6 +21,8 @@
     ./services/bitmagnet.nix
 
     ./services/matrix.nix
+
+    ./services/owntracks.nix
   ];
 
   systemd.targets = {
@@ -53,6 +55,8 @@
   boot = {
     kernelPackages = pkgs.linuxPackages;
 
+    kernelParams = [ "zfs.zfs_arc_max=2000000000" ];
+
     supportedFilesystems = [ "zfs" ];
     zfs.extraPools = [ "tank" ];
 
diff --git a/flake.lock b/flake.lock
index f5488de..fe6571c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735609543,
-        "narHash": "sha256-2+sJqwaileD2izqMv/k6Z7iLlHOF8T4kRWflCGURzN4=",
+        "lastModified": 1736128264,
+        "narHash": "sha256-B2RuVaQBbVChPf9ZqRBEqUA09MCD5P/iBpOokoXd5gM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "2faa9fdd8d29df54d6cec075055cf1dcf50de280",
+        "rev": "eefeae9b72d15f69e7264a6a87fba6ecc9782496",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1735531152,
-        "narHash": "sha256-As8I+ebItDKtboWgDXYZSIjGlKeqiLBvjxsQHUmAf1Q=",
+        "lastModified": 1736061677,
+        "narHash": "sha256-DjkQPnkAfd7eB522PwnkGhOMuT9QVCZspDpJJYyOj60=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3ffbbdbac0566a0977da3d2657b89cbcfe9a173b",
+        "rev": "cbd8ec4de4469333c82ff40d057350c30e9f7d36",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 9bc4c54..166a722 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,6 +47,7 @@
           torrent = 6011;
           ollama = 11434;
           bitmagnet = 3333;
+          owntracks = 3825;
         };
 
         https = {
@@ -82,6 +83,10 @@
         jellyfin = {
           dir = services_dir + "/jellyfin";
         };
+
+        owntracks = {
+          data_dir = "/tank/services/owntracks";
+        };
       };
     in
     {
@@ -116,6 +121,7 @@
                 pkgs,
                 username,
                 home-manager,
+                stateVersion,
                 ...
               }:
               {
diff --git a/home.nix b/home.nix
index cda675a..893dae0 100644
--- a/home.nix
+++ b/home.nix
@@ -1,4 +1,9 @@
-{ pkgs, username, ... }:
+{
+  pkgs,
+  username,
+  stateVersion,
+  ...
+}:
 {
   home.stateVersion = "24.11";
   programs.fish =
diff --git a/secrets/owntracks_caddy_auth.nix b/secrets/owntracks_caddy_auth.nix
new file mode 100644
index 0000000000000000000000000000000000000000..f353a8b4d3c2d3e0319567ad576b5d6943eecd3a
GIT binary patch
literal 112
zcmZQ@_Y83kiVO&0aB4XCz3n86ELVH3hvbu+%heiL9a8sQ`D`!Vd?WLuUFWQZUB~qf
z?$qXbyr@j)Tg^27V{wlY|4sTQ!K>yr=Yy38li@DW_CTw@&+fZU@47vsif{Y00~_Bz
VSz=nZJ@S;&%(`Ft9_J3c0RSplHw*v(

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
index 4c887ab..0d62bb3 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -69,6 +69,11 @@ in
       "${matrix_hostname}:8448".extraConfig =
         config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
         }".extraConfig;
+
+      "owntracks.${service_configs.https.domain}".extraConfig = ''
+        ${import ../secrets/owntracks_caddy_auth.nix}
+        reverse_proxy :${builtins.toString service_configs.ports.owntracks}
+      '';
     };
   };
 
diff --git a/services/owntracks.nix b/services/owntracks.nix
new file mode 100644
index 0000000..458f7b4
--- /dev/null
+++ b/services/owntracks.nix
@@ -0,0 +1,34 @@
+{ pkgs, service_configs, ... }:
+let
+  owntracks_pkg = pkgs.owntracks-recorder.overrideAttrs (old: {
+    installPhase =
+      old.installPhase
+      + ''
+        mkdir -p $out/usr/share/ot-recorder
+        cp -R docroot/* $out/usr/share/ot-recorder'';
+  });
+in
+{
+  users.groups.owntracks = { };
+  users.users.owntracks = {
+    isNormalUser = true;
+    group = "owntracks";
+  };
+
+  systemd.services.owntracks = {
+    enable = true;
+    description = "Store and access data published by OwnTracks apps";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      User = "owntracks";
+      Group = "owntracks";
+      WorkingDirectory = "${owntracks_pkg}";
+      ExecStart = "${owntracks_pkg}/bin/ot-recorder -S ${service_configs.owntracks.data_dir} --doc-root usr/share/ot-recorder --http-port ${builtins.toString service_configs.ports.owntracks} --port 0";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.owntracks.data_dir} 0750 owntracks owntracks"
+  ];
+}

From 4689cf4258f8e4779a3697ff87354020e0358298 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Jan 2025 19:38:17 +0100
Subject: [PATCH 066/847] minecraft: update mods

---
 services/minecraft.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index ff3893b..ac8f0fd 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,10 +43,7 @@ in
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           with pkgs;
           builtins.attrValues {
-            FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/5tj7y3PJ/fabric-api-0.114.0%2B1.21.4.jar";
-              sha512 = "5e801dd76fa4ca0d393cd8c82059556bee420d8610e1ffb09c2c90eb487e997acb5061ec571250db1fe57491505f304b8222fcbe02243048c5df809a610d94a6";
-            };
+            FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/IrJDerMf/fabric-api-0.114.1%2B1.21.4.jar"; sha512 = "ce8e14be350154c5b3b8346b122d9a1a4721f129b1263584b1b94e2038bb9d787bfc127b858aa07487d961d460adf16687a6d914ce5d6036efea12703726347c"; };
 
             FerriteCore = fetchurl {
               url = "https://cdn.modrinth.com/data/uXXizFIs/versions/IPM0JlHd/ferritecore-7.1.1-fabric.jar";
@@ -69,8 +66,8 @@ in
             };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.4-SNAPSHOT+022b4b3.jar";
-              sha256 = "1625xlbmaj2rcxm1rlbgnm3c8sjnld48qk588p8vpy5i5xfx7ry2";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.5-SNAPSHOT+24f14ef.jar";
+              sha256 = "0a3f0yn3m01nb485mls4f8knx04gnw1syi65m5y2znz3j05mxh12";
             };
           }
         );

From 8577e6303e841ffdaf4db997dca73ba6207b0a89 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Jan 2025 19:38:28 +0100
Subject: [PATCH 067/847] flake.lock update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index fe6571c..0684d2a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -41,11 +41,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735344290,
-        "narHash": "sha256-oJDtWPH1oJT34RJK1FSWjwX4qcGOBRkcNQPD0EbSfNM=",
+        "lastModified": 1736373539,
+        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "613691f285dad87694c2ba1c9e6298d04736292d",
+        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
         "type": "github"
       },
       "original": {
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736128264,
-        "narHash": "sha256-B2RuVaQBbVChPf9ZqRBEqUA09MCD5P/iBpOokoXd5gM=",
+        "lastModified": 1736473741,
+        "narHash": "sha256-mt/uzoQ9J7o4lEP1mBJSArE6jsXKhpbnBWFfeOu0CUc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "eefeae9b72d15f69e7264a6a87fba6ecc9782496",
+        "rev": "39e804edbf69b926d25db2bb43b80995911d5776",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1735388221,
-        "narHash": "sha256-e5IOgjQf0SZcFCEV/gMGrsI0gCJyqOKShBQU0iiM3Kg=",
+        "lastModified": 1736441705,
+        "narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7c674c6734f61157e321db595dbfcd8523e04e19",
+        "rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736061677,
-        "narHash": "sha256-DjkQPnkAfd7eB522PwnkGhOMuT9QVCZspDpJJYyOj60=",
+        "lastModified": 1736200483,
+        "narHash": "sha256-JO+lFN2HsCwSLMUWXHeOad6QUxOuwe9UOAF/iSl1J4I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cbd8ec4de4469333c82ff40d057350c30e9f7d36",
+        "rev": "3f0a8ac25fb674611b98089ca3a5dd6480175751",
         "type": "github"
       },
       "original": {

From 7a0620eb0db6e16f87fab360101252804d77f7e7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Jan 2025 19:38:39 +0100
Subject: [PATCH 068/847] qbt: adjust settings

---
 services/qbittorrent.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 79169b1..380f033 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -49,12 +49,13 @@
     };
 
     serverConfig.BitTorrent.Session = {
-      GlobalUPSpeedLimit = 50; # in KiB/s
+      GlobalUPSpeedLimit = 500; # in KiB/s
       GlobalDLSpeedLimit = 0;
 
       # Including overhead in limits ruins download because download
       # uses upload to communicate with seeders
       IncludeOverheadInLimits = false;
+
       GlobalMaxRatio = 6;
       QueueingSystemEnabled = false; # seed all torrents all the time
     };

From 2498421d1d34d29fa892b013f4d91aec46e23bd2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 21 Jan 2025 23:27:39 -0500
Subject: [PATCH 069/847] update mods and options

---
 configuration.nix        |  5 ++++-
 flake.lock               | 18 +++++++++---------
 services/minecraft.nix   | 14 +++++++++++---
 services/qbittorrent.nix | 28 ++++++++++++++++++----------
 4 files changed, 42 insertions(+), 23 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 15dcd60..25ea396 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -55,7 +55,10 @@
   boot = {
     kernelPackages = pkgs.linuxPackages;
 
-    kernelParams = [ "zfs.zfs_arc_max=2000000000" ];
+    kernelParams = [
+      # 2048MB
+      "zfs.zfs_arc_max=2048000000"
+    ];
 
     supportedFilesystems = [ "zfs" ];
     zfs.extraPools = [ "tank" ];
diff --git a/flake.lock b/flake.lock
index 0684d2a..500e9e0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736473741,
-        "narHash": "sha256-mt/uzoQ9J7o4lEP1mBJSArE6jsXKhpbnBWFfeOu0CUc=",
+        "lastModified": 1737510347,
+        "narHash": "sha256-wEEkmpmd5FF0HEBeA3upQg2W1yI7jGJ7xg2dmKuZE7o=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "39e804edbf69b926d25db2bb43b80995911d5776",
+        "rev": "ed6d2231a22a507f9a32d5661ef17c76eab8404d",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1736441705,
-        "narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=",
+        "lastModified": 1737359802,
+        "narHash": "sha256-utplyRM6pqnN940gfaLFBb9oUCSzkan86IvmkhsVlN8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337",
+        "rev": "61c79181e77ef774ab0468b28a24bc2647d498d6",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1736200483,
-        "narHash": "sha256-JO+lFN2HsCwSLMUWXHeOad6QUxOuwe9UOAF/iSl1J4I=",
+        "lastModified": 1737299813,
+        "narHash": "sha256-Qw2PwmkXDK8sPQ5YQ/y/icbQ+TYgbxfjhgnkNJyT1X8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3f0a8ac25fb674611b98089ca3a5dd6480175751",
+        "rev": "107d5ef05c0b1119749e381451389eded30fb0d5",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index ac8f0fd..6acc0a1 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,7 +43,10 @@ in
         "mods" = pkgs.linkFarmFromDrvs "mods" (
           with pkgs;
           builtins.attrValues {
-            FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/IrJDerMf/fabric-api-0.114.1%2B1.21.4.jar"; sha512 = "ce8e14be350154c5b3b8346b122d9a1a4721f129b1263584b1b94e2038bb9d787bfc127b858aa07487d961d460adf16687a6d914ce5d6036efea12703726347c"; };
+            FabricApi = fetchurl {
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/8FAH9fuR/fabric-api-0.114.2%2B1.21.4.jar";
+              sha512 = "24ed904096a17f65ef2ee4b04e076df2df076bd7748c838573cf97f5b38d2353bf62fe202779fb0c8372a82fb1133e16ce1fba585e2ec5aa5a5164203e785072";
+            };
 
             FerriteCore = fetchurl {
               url = "https://cdn.modrinth.com/data/uXXizFIs/versions/IPM0JlHd/ferritecore-7.1.1-fabric.jar";
@@ -66,8 +69,13 @@ in
             };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.4-1.3.5-SNAPSHOT+24f14ef.jar";
-              sha256 = "0a3f0yn3m01nb485mls4f8knx04gnw1syi65m5y2znz3j05mxh12";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/9i2KwI5R/squaremap-fabric-mc1.21.4-1.3.4.jar";
+              sha512 = "6eb44061f057d1bbd0bb6f9186d03d496479dcd953af8f09f70099c2e67e567e5dca626972d45af0315c2e2714c3dd74beef97575396e3bb90b7c670f5c80fef";
+            };
+
+            modernfix = fetchurl {
+              url = "https://cdn.modrinth.com/data/nmDcB62a/versions/gx7PIV8n/modernfix-fabric-5.20.1%2Bmc1.21.4.jar";
+              sha512 = "e1596a89dc100f454c445d64b5ebf59f1788de22270a4ca52837337abe6a76c517c771e234ededbadf5b51dbb62efe1bc0eccee841c45bc263f9406d8348dfe8";
             };
           }
         );
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 380f033..656a544 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  username,
   ...
 }:
 {
@@ -33,8 +34,8 @@
       WebUI = {
         AlternativeUIEnabled = true;
         RootFolder = "${pkgs.fetchzip {
-          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.19.0/vuetorrent.zip";
-          sha256 = "cIY5fhcLyEPwt5D2T0S4KhAbb8Qmd9m3xcsQTa4FX+8=";
+          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.21.0/vuetorrent.zip";
+          sha256 = "ELerk/4q+eR3rmCx/jFoDirrmx12D+5JBfDZjkPK5wA=";
         }}";
 
         # disable auth because we use caddy for auth
@@ -48,16 +49,18 @@
       };
     };
 
-    serverConfig.BitTorrent.Session = {
-      GlobalUPSpeedLimit = 500; # in KiB/s
-      GlobalDLSpeedLimit = 0;
+    serverConfig.BitTorrent = {
+      Session = {
+        GlobalUPSpeedLimit = 500; # in KiB/s
+        GlobalDLSpeedLimit = 0;
 
-      # Including overhead in limits ruins download because download
-      # uses upload to communicate with seeders
-      IncludeOverheadInLimits = false;
+        # Including overhead in limits ruins download because download
+        # uses upload to communicate with seeders
+        IncludeOverheadInLimits = false;
 
-      GlobalMaxRatio = 6;
-      QueueingSystemEnabled = false; # seed all torrents all the time
+        GlobalMaxRatio = 2;
+        QueueingSystemEnabled = false; # seed all torrents all the time
+      };
     };
   };
 
@@ -71,4 +74,9 @@
     enable = true;
     vpnNamespace = "wg";
   };
+
+  users.users.${username}.extraGroups = [
+    config.services.qbittorrent.group
+  ];
+
 }

From 03b587a4509f8dc6bb6e405869a3bf77f48671b0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 26 Jan 2025 01:12:11 -0500
Subject: [PATCH 070/847] secureboot and stuff

---
 .gitattributes           |   1 +
 flake.lock               |  18 +++++++++---------
 secrets/secureboot.tar   | Bin 0 -> 30742 bytes
 services/caddy.nix       |   4 ++--
 services/matrix.nix      |   3 ---
 services/qbittorrent.nix |   6 +++++-
 6 files changed, 17 insertions(+), 15 deletions(-)
 create mode 100644 secrets/secureboot.tar

diff --git a/.gitattributes b/.gitattributes
index 02fe85a..5238122 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -5,3 +5,4 @@ secrets/wg0.conf filter=git-crypt diff=git-crypt
 secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
 secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
 secrets/owntracks_caddy_auth.nix filter=git-crypt diff=git-crypt
+secrets/secureboot.tar filter=git-crypt diff=git-crypt
diff --git a/flake.lock b/flake.lock
index 500e9e0..0b9b65c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737510347,
-        "narHash": "sha256-wEEkmpmd5FF0HEBeA3upQg2W1yI7jGJ7xg2dmKuZE7o=",
+        "lastModified": 1737683037,
+        "narHash": "sha256-1J2Pf6ub2DkkoqRq2xEFrusJKR4XHnnFk0wyOPrV2PM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ed6d2231a22a507f9a32d5661ef17c76eab8404d",
+        "rev": "f80c70946d3e27a466b8b9e65b24e36d571eac8b",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1737359802,
-        "narHash": "sha256-utplyRM6pqnN940gfaLFBb9oUCSzkan86IvmkhsVlN8=",
+        "lastModified": 1737751639,
+        "narHash": "sha256-ZEbOJ9iT72iwqXsiEMbEa8wWjyFvRA9Ugx8utmYbpz4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "61c79181e77ef774ab0468b28a24bc2647d498d6",
+        "rev": "dfad538f751a5aa5d4436d9781ab27a6128ec9d4",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737299813,
-        "narHash": "sha256-Qw2PwmkXDK8sPQ5YQ/y/icbQ+TYgbxfjhgnkNJyT1X8=",
+        "lastModified": 1737672001,
+        "narHash": "sha256-YnHJJ19wqmibLQdUeq9xzE6CjrMA568KN/lFPuSVs4I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "107d5ef05c0b1119749e381451389eded30fb0d5",
+        "rev": "035f8c0853c2977b24ffc4d0a42c74f00b182cd8",
         "type": "github"
       },
       "original": {
diff --git a/secrets/secureboot.tar b/secrets/secureboot.tar
new file mode 100644
index 0000000000000000000000000000000000000000..7d87891d6937831a36a4dfc1159fb15815666ca6
GIT binary patch
literal 30742
zcmZQ@_Y83kiVO&0xYxBrl(X|!!#*34`Yg4b=D$PyPi*z@WXjpA8MVdO?ABEG6tlk~
zF49E{H}JOXG)Ui^E?DEgU*Wbunh0y7{j4=7*MB~){g11d!9u6CNJH%UWd6G)Nx`Nk
z@@?m5rE`D0sM<YSHv9C!2<8t_o3d4nrLUwHmv5h)5*Aq6%jK}`-TH+;e?Nb-|E>^+
zwyq$18sCbQQWF<sN~q>JaF;y1uF9}N<8a)&{_jC8lNI0S+OK-4Z?~&;=Xc|WtU5f;
z`HuPR&D+U%vU!8=%INb4B=<DBGCs}__I~&_HPX@9uxavrZ5i81w<qL&YkJ*M7y5F(
z=PI8W8*Xk3=1COTTFhbMdsuq!(G8vV%_6SnA3gEw`mrUam@{_2ls?GgzHpV-i!C+l
zY}!6(&wP*++v@ZAcmB_f`y`8EcTeq9_UDN-?#Z83<H!9&lsBsQ{v+MBzPf71EVema
zUvy~JRBly$+i7ps9NfQi&YJ~s_gm-wuU!98EUtcG`C?|{htCY}HT{0_D@1Hdsk`yN
z)pw?<ELQic{_U~<)v61p9^2VuZQURJk#oY4zVtdtU)`m@CiXu)bcNYp-qGpobGv-;
zs!v{v^z0)`7aX4PT>G?XZNsdmH5zx1L@wB%^>#y49arI>pkSAO?%OQ`&OSPyS~vZ3
zoy+^J`qSeArWv-*ouF|zxkjnesz5wp#nZlmjI!IQGcVkYsx+)oIpQ1aYU6UrIzDU8
zXCKbS6HX^q@@=UJG+^G<bM3ht<DSCiDo2Lf^AuY3Yj^x{o#8Z5<KVjz)(P<o7x9GL
zo6^frk$N-ny6O45Vk+mEHM#Vh6)rVC>|5D1HAeqOk<+I?{FA?{pPc`;s^*xVlj2b+
z{*|(P2`}4@sy0Rn{hQdgj!8V&owIPp3Qwyr3pov0jwhU9!W?cws*z$IpOmi2v_ART
zTC1SaJo(83mFDTp6RfH_SLeiSUTd2D&^E5Le9QGm$NRcEoeONugR?x|KAZC`wdGF`
zKS#LPWbOqW^Bi*4o7>I3u3qqS*3{Eazxr$GHon$4!zH<1L6@`ncI2lQ8r>&eK3e{6
zwVL^q$<Mz{mV5p7?wr$G84o<Vn*Ly)fc4Lc@+GCw8dhKJPgMMtPhY^1;<|3qWEPIS
z@1OYQOzv!PU<)ZOb$r26CoaEXd%W_)b+@uY?n|l$`p>f4kgYkRUgZ1T-If<sFA7E0
zgsrvEX5uKHdB-8fJ9N*9g!IYhi*+9!p8WW$GspRzlK;G~v>Z%fw_fv0=KZBZ=Ttpx
zRDA*iHg>OJyI*p5QMUbT<*z>?AFqphZ{2?BbNOENtp4dzQj?ss&lodrzdilxdbQx+
zJI*hUF)7<;ytHlW-w7`q7v7qCqRw<t>Z=7;Uw2Cz_&EK|WQgtByE01Bk~blzO=dPr
zjq<h)feTi?=W?E>r^}?2Sh}sRU3aO>W;w2onfzX6(iiSs{jhzBxZF+Sot9VP(@q5O
z@8Uk2Fq8X6kBQ?8k?m*t8O^qFH&;H8G7w%a=y2?>f#`#`C&eq(*zbRfJN;Hz<d~-P
zMOlN~`TynC%KudR!Si&73)jyd;i`5=>`leCeDn5acyx{PBzykjbw+2eDb5P%Wn(;f
zKV9#g?3$|HJB?nCdG^HC9Qz|x>zS5ku~?-qQeACj()px6kt?)IS>C)TXSv-jw`xLp
z?6h^?woJcQdp~Pc%X$xfLCH>m>yv9ztV69*{3rbjIePChuX4oV%`T#+mg-Lpc>7Op
zll83Lg|3zxTo|KRqCYstuI)LZ>-hB1r`ZSP#VbWz@}r|(_DTP{e3VI}x8Zna)T(*H
zAHGcP`eUKEslV~%-z^MZC9d$Vd3C5UF}EPA;NJGtw$F?&NuOQc&$>lf=E*fi%PB8c
zRBVrCdJ*eY)LMOm=hVbokI&20nlf)++HHQV$YJ`%I8)7#{3uQ1r%E$dW{I2<&gu_J
zc35@rOX@XahF`0HvE^@=d4H1P)Bag@C8w9HUG{A8p6`8`ybEp~FScu|PWP61tgB*V
z`a@;uiNBZEEcv-`@loxH&<`f1g}t+HaTn$+c(HVOUZ}m><t3@E9ESUsME^ZvsTEsb
zS|R_Icf}OLE8Cq;-!Go}r9Vrt+CkR%VM*tP&+EUnrupnJs=W0;eeKo9eg-}F1*UN(
zDLh-|^zlM!aO!=})y_$rFJtph9kYDVl~bSZE4!bSm&I(>-Df8bEJ-PPwq#{WC(~b1
zHSRsLPs@Ee_Uf0?_nNtfU9W1gmRlYWGu37L?^~ayUO({y<G~-IQLCnRCV#YDkyve^
zVAZ#4pJ{GNn)x;1Tr1b?6R`=mzp%Amy?RwA|L(zmFJexgtuzlv(LT0Q>a31M?7Ef>
z?2M1D-1)eS-CA}|wA+RAtZg5pIpXDF3p28=9?qHj{E+JtsV$N>w(iqpxM1*nN>$a)
zyoo>6KRCNFtyp_BGSxe1vf8BY5-Vd__f+p)e_QST?#fS(g9Y8s9G!nJt?=2z__9mt
zUsL(79r)dO@8X>cZ&@~Ztc$wI6K$v*$NK&L<V(-9Klf~&VXvjAzBttT^2rvh8N2Qz
zo|f@d)9ebDwZ6W2eZ=L5Ps<NGK9*oCkyd#7ey%aAT+Z#g_50kr&4p)w{`m9W3>NcO
zdDflATkd@qeHgnZW7?W~*J6A^bo)7eHQh?A=sDQ0#AhW@cPC77M)gmHIHRi^?5%xF
z+pQX|=lnCSa<)=s++TB}#^k)~x0-`b3-$y}QU7SV<i#@mGx}W@xmIpF9x88igh}6=
zeRJ9UN1nMGVw}1)KNT!C-X|B3B&fRc;0CE9CI!cAbqzbqe)0cpG<)OZ@%wpG_3e~(
zW$WwuEuJdBcCVfCQ&QeMXXP{nMd@4T*p|Nz-MjuItENt5LS?VCuZ88ZPd$fkn96%(
zG>K<4us3dDG8MS|J-+5>XKBjR$2u=({=Pc#T*kU58-6!!`?>Z<`$<*iRny+Qa(NP&
z;Urk<7y16h;cYSNgkA`?yzYL`YGug2^W67>Kwl4=Z)}kdKii09UN76Yes0GKyU#0v
zQ*9Q?{kU<#<hQRj|M{nnv!tt%8aFI<{M20_yDUSvqkc<UY5bubf-(M;OPtF;xTc0h
zIkp=2Jd!?Q&a&j%yH8JciXFc)ZPn6M0#`di=BH?^*>~Rk>->+kY8BtEwy-m(K6YPT
z?RMoz{rsERfkhfAi`8=KHf8d8{&T;@F1UN@&Q}Mw{B2W9e|9OEja`k|tNE$No3nF_
z4_oj2_l0fp1+K=8N4HGNUD3NP%xzwf5QCrle%?OYtk73VcP~i#-EH|+BG=KswJ`2=
z@PC_YT~k-Se?NQH)~kYcTAZJ69H=@yb>-UGeN{j5b0-Cu>`&y-U(>f*_5P)!{^y@=
z+;}<p<NsRGT>Z@gr>mSao~R}NF!TFj-no8v%;mqIT7%|qh`y`fl9wwj_f4Wxvnr>>
zF!Ge9PMA-*%yjOHj<0`9z7ni**)7G!aC}DipK#W_OSYG7i9a&?K=sNyTbweA+s-Y#
z9w7KqWZKJPj<ttv8#ew@>YaD*`7LSlxZ(xjqF1i&@)4@?opEGh&OR3p!{p-E{5dlU
z57cm-{&qeu?aazM4^oPyFTVYBE9r#r5|wRno0feI*IZldw5&dD@*ky!=)?*uk+;F@
zt3UH;=$RW#ELuOiiR<Sj%hMCKen_p&mYlw=uV%)%S#cK+KHK!O=>NSaX%l{vOW)F5
z%Fo1}>V0W!V)`UJc)3~Gtw|})mZC2O3zAnYX!_f3`8A-xCGCCldG#H9i}vc8$X91h
z5q1bUR-37}X-d-HPDRGL-#ia*uR3{x<6?RB#H-AmItLhp&;Hj??7jSVX4%A<_w664
z28ir_yTI-*Yv{_&6|LX2mPvWd%=5o9si`T6dA6bli)q?H_9bkx&&%FDOnLLHxAw-}
ztpzt1uUvX=eaHD_Yjk7^axLu~|8AXq)#{vq(XGX%?Ij}K)w+{Pz2)5WexBImGvD&g
z*`%b}+P$;x|NnD+|LN=I43Ey*z1L;%czt_~bCZa-;FtYcD>hGE*s5_#=poz8?=KbD
zH0Ap(f9kcAH9Fi<-CFh5?qAH@nR5?txTMA(;NP)<T}(;zMxbzl<t&!cf7aKoTutq}
zvj1Gg7Vqn|8iErt%8%C<oH^*Iop{^LkY)3<pNkzdWDD+w_*SlQQ7fB#YE@XD{FerM
zkr^z_YCn!zww{ZAnZsZG^3>tHvkQDzzTY7E>vpiTmUF<wu$MKJQAIu_SI+nUQY<;a
z7ZM^G(p^~2pk9)5T6^;~w`Hn-B7&#?XV6*Lns3#*{IB4>rGFQ_b>Pmob(!PT(d}tg
z(sb#>`sIsDWnP<veaT63vy@BVP5biVRNGz2lg9gu!)#ZDY)UBMH{uOUX{hRGTi&&H
z-OsM3gO|_zconr}%OSxt+n4P&66&78q|i5$Yqj1xku!&lHu(wduUV4A?5bt$dSN<)
zSB+ZF>Fx_xyOY<gR}MSdczc0jB;$j<`By3x7tTJw)6sviuBp6xfufzaP3g+jCjP5~
zr(F;XKXCfr0<(qe2e-_*A+_~TQP=F~HhIR1TOoB?9a9UAulf|?J$2uDi8&v8R+#a%
zK5+V1&YhCkvPJ6t^S);nSwiH`&FwL7h_Xxx3wd&?{Zi54_4i-wy)yqzyOhvL74zaX
z$G8Q4O=vl_;>J{Cd4ocm9OiA;)?9n~lgr+zapR^#4y{sh`P(*dZ=A^aD@{~q(F4o0
zmv2k=Oudky&RM--e!2hudyUur9aeJ`XXt5Va9FHxsi|q--xNPpUy%iAKQliYS$%cV
zmNA{9FyY5uud6fKmx`b2y%V;>!0!L!^ur+nZwi-Ait3E`9WmG7`q@XRYu<J`NTn-^
z>1%2|55M|IwaNE}{c>A|Z_<6Uw=}ESPR_jMsPjQ*rrYY8T%#*zQaMAm|C)E|%y<6N
zK3ujDKPMSYW8Gu$aF*vSBfl$WpR9W3^Dn(~=e_-No+QL4uU)n0PTmXy#-nG;@((XK
zXg1Y8W&MO%$%+pS8eZI7+`4q_7A@n_Psi1KEhqllmhtnzwHFqx5*2eYt{0dwXC6@Q
zku~0ZVOayqU(HX4syY0wsc!h=%gPhBGN^cR;tJ-ap3E=p3VaS3&y{k&^zL><R(0wN
zfh#{nF7NoJa{Q9t#bf)ww|`n$qPcJq({iWvZ5roJTlgKn?Zw-E*0SENTzjrhh*&T?
z_o>b8*Q6NMa=(msd?;EyWv+q1%kM(GOir>w=TawK;H$nPkP<0y=TAVlb)4yi@{9Ad
z@)f>%?+z=<^O>i~8Is)i%IEUiACq1P$L+c)xQ|JiV?*3!-6V~D2iP+^<~pubK6-BN
z4EC9)8cLE^REvLIG)ZdzI^n%nHYa<DrELFizL&wunDNrx*I%FI>V-+J@V6+~Ewhs2
z)aS5ctCh^ni(Wm{{&_QwDeI1#%Y>(=N&_3+8{NO&Qjpc%_V&kFfeAdy*QJi1Ka+1D
zv~<zIu>2E+o}AZgrziZGA9$p$J^k(WGd6dg?lV7pKH~AuY|&LlA!XjXtrH(IFRs~}
zULH0%@3g?u<vWe9EANZ^oS4b`gqth=AnUd}+%jvvscfFx)OBlXTB+HQ<8wFGK1|-S
z_h;$POfSVp%Wj(;-(~$&|MKT9N#8oAH#5EWH=QfHx?@g}bMbaxlQp8R`)q&iyE$Rv
z&LcbO8+M(p$WaXnUmVr?<@PbpT~evF`W5Uk2kxIZ&*U~WX3?AYC+{?4SpO-!eYdBi
zP3_>ToSf3`!|k6ZJ{CV-)6G>^qOiCyVUhmZfK^`V`~@pg7WjFdTlZ7iC-Lv*Jw7t|
z&+Z#31u3sHdN+U5jbeU<pEKHzT=(i(r>t?qefeLmsYWNI{rv*8Iv?>}TH7>nmULzJ
z2b<%**(<vF(p4lCAEikAe)e1Z;J38rr!0(kuZnGGd(~1MyP<X6(a_?{-@o4!Sv)6m
z!#t<huq$(wj*0Th>~>}I@&7pEguS_eBH!}!hnpwNO`7p@g;SqKcl3rMJ5+?bdv>Jo
zU0<0Hvq6LJ#y$3ejb(q_*IP8k3kFND#}@80X7sVi?a=QrU!vhRLG$>XmnkWY=JFa7
zld2X8xWC_W_|4V_H%)G&823m&H2rGjt^K{)^2Ej`MH~(u3sn=ua{OxM=ub=Fo|}-E
zxAbUd`t}xk7lElWH#s!4>}FjUa8T-7<=6d!LOJW!9uR*yP1k9W!(~~G@3w8Wk@4}m
z>hotR$O@mj$knMYJKIHnvCmI&^Lg_&vhFKkk-oV~^lF2bKl|_4C--^JtEfA_K3*_+
zuBUR><hx6QjwqI0f2ERG{!@Qp(yQx-TDk3o+4Aq!){C&N_HIvWVK~A)#nV;I?LhhD
zPny>hOD}TNU%0|~G>_MC#v9}N1}YcbcU|t{e%#<P>y@op=FS$~X+IWiERTsvTY6^B
z>RA8J@<#-CME5;du_s^H>dcyH?YoOk7_(3IiPMR1NO{ioyx`~w{Yy7xUcEYTylBFc
zPPti9YXWbT?!RxuCCnLmbhmM>t7~TBz3FX>^5g{$TeLdb?%crC=rn<=ZL_@S3C;gX
z=iZ7=3=A%)-?pr2Wv;`=>pKsB?)rAKX6c1(2RpkGLQYlx*~-f?ne}VSk3H8DzZNKn
zq;@CI$x`_(y3we?pg;6P=*=~yU*{JUJIb^uHwrQDyb%9O#BbNp|EKaYl3aY*L*DZ9
zcF75yJ!`d4+vB2esp$IxPX*JM)d`#ywth3X9Jg8C_;^FVdfK$}FHe<lol3I}zi@kr
zvA+BCSEsEQmQN82`x#@yqp4lTQ@r}iE~lxEt+P9KESK#vzWUFeF~;lo-miim`;;fS
z-a2}p?Ll*@==<BQnf)7cQ%x?2*^9DmT$TB6z01=TTUoE(Nz1D=?z|W{cjon-GW=7U
zBx}W@8rv)GDcyg>^q?@sD*VWeils}p`=n&8E4GyWe`rC>v_D1d@1OkpxJ~*%Ncw|`
z^Xs#GAKqH@X`g|@<<lSTUkee?7SG-C#lBilk3+>zaDnCw?%wp@N7GI(pS&?BpZjmb
zVs^3fTig%M`_}eb*?O|p{nLF`#-6EDeh9LzV0da*@o8W0(ZgRR1=qUt&(m9cZ{CAu
z>4GKtx^LD#*dDz4Nz$A%UoScwba%KpchCQ~`_CGGnRc;b^~MPAZSN9!@0?}qcp~?!
zM$mi94%bCZ3;vW(H%pxOQT?UMDTn8Y@={7U(<ZRX{|qhG3Z0N=SSMj(z_soD)O|~(
zBJ&m;k8@qT{$Ll!RwMsZ$<=*-w>I=PSBV(g+}_t2u=+#QE%|L1`m5(T&due>%8JcD
z;Il}lJI-1+D{J?|<yn3Y?HzpMmvlN_tKX{Wp!MpRL}Nj!)#(VSys3Xmrn;8we|EKh
zuCT}aq^uXoukPPAeb_ZCX<_L^3GoQUtB)M&?v{w&*3Yr1iqGWPxYvF6JD(eu0#>j%
z&E>Aw_VHd5ysF4zYJ_vP$N%z)FK_g{^4zlZdzPQ<EtXxmhx{^q+;T!y*PIa6aQM4)
zV!7B|w@K<%HzydDC+EEQr?)NPkNra4EWP^cj5j_<EZ_5K)j}i3h&^hbemN$+RJvWv
za>AoVi^r)y|3?f5|NSL<xL4{n3RFFslWW`5pBip^Cx2@AjAv8pw#J{Hd8^yzfz8+I
z6AbY`_icR~Gw;*IiKk4`f1i>GDd=_$?(NcSbDn2)cE6|{6Zd*OmF16RR%XYR#6Ows
zrQgz2aLI+`^Y)<7i6QgsC#`1UdAm#PhNP=eLwfw5do43>{?;!(d!OAbWJ{OWp0C1z
zVS$&zGLJ-mljscRPnc;g>f|agQ7DP!^pdXFn0XUrOwxaLioa%Q7h+WCpHiMZ=YPz^
zvar)OiJKEH8+c6Ke)w?jEuj;doQCTA=X~Y<S;+L+&+PZ!J?AREm;|b~9=^BRGUe++
z>qkr`te;-!3q=Pz<Ynf*UZXtqi)4N9+LfY@!ekzuU9J$i=u_=O8HG&&fp<3_N}drl
z?GEFTWnry<7oNYl_-g3&@2C0tqOL@pi9Ons;=rTybt_Zku{L*c&#n8S?wnOx(Y$QM
z+M;y_|Jy9|VczuWMcdD+mAh+BJji>0AyD7-;=$aoYObBneZPxkW-JO@5U-f=s(-^N
zwv36J_1`_aVj9?TLhsXG?ftJeukyUuHnHo+!o6CrcYnQ?@!Uu5)S(>~ZNHA^M=bjI
zCHz=swwK9g9ks^}|L&h}7u@1EyQ8FR#t!vu&(;)rov6-P{%*JW`45VgvsnD4oN}G6
z#Kx|0k(FOva9by9!kL{emD+Ji4oTM0u8Vi{-LkZc)|j37`r#Ryqf5j@r!W2YSBE`f
z<9VYAB_%HPe;gmRM3(;hAADKksYsk`>zdCK7X;4Q*zuLaw&T!^IVU~7>Hd6>Fqa{I
z;gv5<Gm{qH<`qqFc&GVxvAo#ky~{3bm=-R(hPg}ln`Xbt!b?AYSF#@TPrbSP`VNhH
zo%eqq%z9H3?K;z(+bvG(mkNJuX~i=ctu40R>%6=>mn?GG_>z53$iMAv-g0bJb5F?|
zoHGv9n`&BMBmeJtW`Rgx#JoQT*023MnX`$(c*f>wpZjh)EsA|y(a&(l>exos2WdCo
z?(W?8XZks(X5Sy$>1=b>e07m?SjKzf@WzOzRf%zpemm!G*gJ>0@83~Z_bXFByomUs
zUNw<7$cl9(-!?BJ(_g$BXDWRT-F;(D)3K*rH_obF-&wo-t@OK`Y2Jos_}*-rqjsz0
zw)vrGjfMjZb-oMCgM=mcO#eF<9FoaR<9xqpVyMB!tO>{G>3&SE>S0fBjkC+_RJ!w~
z$;tD-sI|aDla$|!LSw?3cBG2kdbKgY`Fy<VOxyV9yPwWYYBGN1Vr(<x`*wA)lM}AK
zK6xkN_@2A`;xRw6c%Cvw+;J{@pybf;@Kn>n!v!IaCOgW_{}E&|=|yHf@89KfjO))X
zTD<U?=;b`dpRb#5U!17&+~Ss3^7@}14+`>sPf=OzwTb)rlTW__ckPYz2})e~dfByo
zCt3G@F0|d#VqLAc;`3{TjaggH?e1Jvm2o`K!OfdX@@?9wOWHTSTTP!HeQd$)@REj>
z#Q#~c|EJx5_sd%OobDBtwo`K$Zz($XmImCGPj!5<OYhj}KZ~YZQVMyoBqD2`ZEkR-
z5{uT&eG9)Acp5lZ%{Z|<vt~*6Ud@+N*Ca`#=FU))4vN>Cf3Ena-#6jy;&vLwN7rwP
zwFr{d+ja8$S;<*vs|?d#neUU^X5|sPBR)8^?ERgu#pV)WN1tgw?RjVOLO<(};Ve#v
z-wI#7O#d8`lKaDcd84@a8HpVQJTKxN%(}34&e4~XZ6EE4ue)&6v~e?=w)pZ3tJMFj
z&AnO^bMuwe+lLYLSABNpU3%VYw6A4OMb9DChhfi*qWick)BW$<x*05ca!rccI`%yF
zC8EWrQol&>wr;n*_|oll&Ik6YyM{Kt51+ZR9@wLA*LiRE`v0@mOuVfnas0=jS=<jl
z3ONe-^4-o93Uj_*`Raf3t}Al4A9x8aZCd;8ZQ5mt;Ey5aOdq*_=5S<>*|sx$!v<4T
zA+^otMB?+;WPZA+x53**X69tg<+q%C)GH4eq@>)u^OY@c`<A|jStsMxZgSc9mh+x$
zwPNZo*1g8ZmTT)X?|-$v$m7preIL2ir@mdi+;D0AjP&yi&*y3XaueCQbX}SEmhTm3
zzCGD-w!FLKz?a;W6|=epb@yBs%b4(@=IH0(rf?<B0{@N%4W-_Fk=$?J&Sv*Ip_mb0
zEY)e3T5xj>XV{VJS6H8A-#E(UvLfi{-4loZc1tdH(X+bL(6#H*@9U*;;^{?;ziITJ
zxS6E$RO7PZ#PII30=qt+UKzfW>lFV)1wY5I(~6u+l~!p>J}#KLGSXE&s+(o<oi7Wk
zP2^uR{!x-WG11*hzi|D5=-J{{p$tieMM=LBUq$gHpJ?LO-#*E;SJiCY;>pj~1uhiY
zGr5h&DC=9jBIi!`LgCxX!=|R4llP2?TN9C<*I^u|ymsd5O)+feR`y$HyN5sBV|~R#
zIsOKhxBWj&)2k{PKkLJJq>KvZ|6M&<Kze2=$GKCC{Kk*|adB$An*RK*{oi7a6AM}&
z3ktZrxDw#aJ}*A+@(and$T{NMG6MvR^k#WJUvc9{=T3(;$}vic@}lNb_g-CV)R!r!
zzWAHY&GJk4A7?l{d&zcw#X+g{mvZM!vGSPteW~D&Lkw$OrcKdQY?k6$%((R7o<?4)
zz_OVhsh+v_AGA8u@7xl-%-%@-%Vv$QW%UY?V#~{WZym3x@LRce()Y?+cTP!JNb7Pl
zD!JZbimvmNKEAl4=*Ew~@4kFJaHLMAQY(C4q1P|T1)7J~6!|kn_sy60y(RYHMB0xA
zhV-wRJUP>+{lBT9RCPl-<nr+i2@{<{8`?~5PNjECZ9iZ6SSfASHZP;s_hxNhYG9&y
z&d&eWuL>va>8E<FT6*ud9q^2LnQ~yt-@QxM2`yecU*0uXn*W+*=vE_zT_2^Yt)?VY
zbX?I9RNu0malyKMNku(DIkUcNdhMGQym4|3$LiTH?HaFF6)jj@z`f43yy<@}M`n2A
zZ*xY?>mNfV+<3uaVpnr@nWtLGjGKqsBPLmv1U4OAX?1>%rs__CSu?rzYR&lZ<@JMo
zo3|K#5ZKQhZO-%h5le&YpVucRhO-vfwOyZbW`?iS{R??h&Aho^^H$|fiRX;lQCV}I
zYh_cyrD<GNkI%Q1NUXS*#}@cP%kfXYV8XqP3*IgI$Fu*GeD=3!f%z^)vmPuBe=yh7
zO_I&V>YnqJE9MyibAoTpP3hwl>&kD;?R9+pZ6V*H$qExX9PgEybmRmH+Qy%paKTa3
zKULSBXRFC}-R&E41kx&J9e0}3cfKss_Hg>vEt?es3yxGB5)k37ox;-_xp0x)jdgKu
zlSHjeE-0RpS`@PF{M=hz+icZ}PHwI^edS}mqEFddt@;fszdCcwXNiBp8^tAb{gL2;
zm2;L~x%+|L>HPHt+9xwT^JV9j3Ok5jz25QlQRAx!uH-}hhq7<1|MK;Dn@nAxtM|N(
z7ruRJS~D+AD6i~a)hXR)KO=v??2cDadHHjpzH@-2*sZ`9o^wU_AA3FLTVQ&?PB|gJ
zEi2Q`DQn9X9M8Ca+*-4)L?oPpYXOh6#hIV}H6b1ylj=+-e_mmtzkQ9r+U2A-?&bWh
zR&yu)`PFE*@?{uP;<U1mZB>Dmh1u^XU)fb2)%^4EmRO!-g$Ik*e!doF!r-KTcCK*i
z-ED32PCwDSB0T%S0ga!IAv>q%v?_0ReSFU|<x8#o)LY*yPCtCsP`7odlFQ<tY5sRi
zR?JVH*(JDc?*5xqDRW+1MF=pNmL2;wxw}B=ivA(tHOX`C^WVRbKk-4r;#vNyI}UGq
zdYRktx4jF`7O7m8{Mz{V`bBxgwX=V%-q7IVx!kAE#7J>Azq!lZoQt7Xs}?>waya{G
zn@Z_w@zrJRN4NBJW<)mc);jsEv)ie|cjf0Mck^xHQA`Ion)NgsJL>t5am>}8(>Fg_
zwUuS}@fc&@hOIvzZ4rJg9&&i<l)A1bYt=>SYQ9$TCI*IQ`rdbG{c}}`dFF}>Gqu>~
zDt(BltBsoQ`BP8TwiSylpFPnyS-;VxZdIMINSK=PiH3spnWv_7`W5_SeVg|{qWk&L
z2NSO?P+mPd_|M<t`=-6s?=CWHER1utTJa_4uY%XjXGJ{ftFk|?nzd^7<o3tAwy#MK
zex7--^5eele6EBqS*PFopOX6Y_rsIPE`}W}ssA5E%a^G<T99Vp&zT)zw`5E5GSS1#
zpFiASYFA-VH+*vcjJJ{_)1Dhg0`r#k%CcV9l3v@O9_t!$DrC)-)(dG{V_zKzS||Ja
z{j0olI$zEnnz1J})&JfijsP`fdwcVsIYn*p-GUvbEUm@z!frn;6`374)i>|X<D_S4
zU#|x(fAf{$i}RA(6>IivNy}HcbRz4GLQ3OQweQ)Atlpls_cHHfh|anaYnvVUO-!_^
zP*wj+*O3jIGL!#gUW(s)eUodvf#kZloXP9zmd*@bZ+dr^)xC!56Z)HOnYJ$fH)}<1
zw$r3k??c4~%|UyOWhcH05BvVrKtA)??tJH`zq?{zF<j6OyL?b`M$&q_R-g2JXF{eW
z$#Y69ntx&6$BH~fqm$W7`R3?GOw>7gY{4N@J+)U2UEJ?fGUoh0b>{kl3hD5j(N|S(
z%l3NPhx_hXq<?eWjz5>qo?z9j-_R0!>OWJ0(wgFitX)ZUoAh4BsI;tEwJ+yIisH^t
ztw~x*m2C3A{GR@4b#`K1wyN6Q@qX;rdz*ds^8Rv3mS;L8w^!V(SYXfDuERwWdd%Vu
zE<I|tqHxU?PnXu}h`8>u!1HQ{t_Ga5+ve-yGiPSX%?COEa}K`|UpKMibFe^^P>Nm9
zeAa2j<sTkwC@(ZsXbhcP+x5&SwbqF3%Zd<d)*F}G9-Nx+Zt6Mayhlo18$NQ*k_@_e
z(C)+SkQ~87_X2tJemqOh?bu(lYTM2N<r8{wQ~vl)mWjG@@b6h!cDqk6+E>}}YF)Fo
zS1Z3|F?oY!D*Ih`SBI^&(>T98=z5{nV);{jj_TSbi-$+~rZpX#Gq>V2cZ<o1IgOEz
zn#<-1CT=r+vCN_3?EghJU+QvqU+>EP`z!p8iEn<)zLyJ*_m_q8J->fz+ZTp7q0`&7
z?xdVr&0S=<?;h)+4&Is*Cl_*;-sJz=V9hb>VZ*^6`{Rt7{~Izb@8pl1oG{JZOXm_-
z6!T`QGn=K|m+b!B?zK7m<+7D8-31>@z79-M`?1ruOf|nMI*ivM*yC~2`HzoeP2?C?
zMRc-Ein8Yt&{IhAa5K?WI2)IcCbcWGbnnsK?k^r(x^?>0|H`zTLT{9!bl(2`ef86e
zZ>9Qsq62RxhUV-!`{YARAg3imP66{ORz-<~Z5;<w)-M(kzhzOj@vg4nkE2nAo3<?|
zth`wNf8o&w*CXFdJn>DmWpUM;Cs)~=PJH@bdDr^;<;*o_rfVJ)P}c65TYveK-~*r4
zU5l$iXPql$pTo50*uTo~Q0-YPuU*bsbfn!}asJj6+iN#B7v7h6>1iGyQD(iXB;=;(
zL`KfJE4CD`UnR-&@Y|-JKRx92H|Ot<WSSOyW$}cWJ?~wn*BD3ecUk&#x%AZ6@H}(a
ztok+XZs3n?C*Hd1MzegMuz7N&|FX4KZYM7Xy0I>G3)Ee}xM1e?X_;@nNqkwpeV22P
zy5BSYB?XgJYK#{5{EFHgv88-k+1kew^j2pF%Kr7}y0=tG=4p*Jmt8vNuH0vt&$i9{
zU+X0+c1|zonrFMLx54@a5rxN8J7#71`zQC;>z&&oaM?yx=h1rI;@QhB%Hr5}YrlHA
z*l#V*Ci8cOyJ9lf_U$_=9`{uz!Sac6a5GcFi9p|kb*J*~+|s-07%DwcK9t8pkmu{v
zRS9O>ekDxMdH79_nZ?zn=Ge<xbq}}niUQtw2BQ0InH;QdeW>#h@awie?pHW(9V_Rt
zyk_RYiEPpf3*=>MGWR?ReVTsQd)@^7uNzx-&dlVwF17BznQ4{v)J^vN1z8uK$2?pp
z^LRlVpZfK%3-5Pi?|eA5tzIE9VB=?h?i=d!qT|f%&aw2$E1T&=Us=;Bn9?-0VbiN8
zLE8jR^khxl^gz(!Po0C=?SSxNZeLxW;{mC6+^gh;ja>dm|6K6<#3lcavywd@vAMPe
zoUeWCSMz3e{L4l9dp;gm;K{l#BDu|^i7n&cv=>LyZyor4>S^*z8PzJ5S-!HZua;#n
zXZh3waGojsd6vQM|GUdURR(kaFF5O{A^T}fn)Y?abBT{HUf9r<aj9PXv$>s$41emD
z{!L+0t2>rov2#5%r;H)eOgKu**5OIRr8yG&CiDlkGoRa+xiR=Q=Q(Ttmv@h>zLli<
z;?1+G35Se>d?aRDw;ooK_%-Xd`Ww&6nfrF|_={h+UEXITzs&L9Nil(Wg?g`7zW?2=
z`kCj=-n0Evr~Z2&{(kPdqSF@T=jHhI)3nr|$z99a+1Dn>s_$#>#Pa&7w%6yCW>$ao
z#VdUn+KacJ&@&0!Wu|!Kc>miS{+AXC9-hdZ+1eai{=aZuwAK5r8L_f%B`p&>ZhdEa
zA39fNeeVv#ee<i9?c)oscfUV#p3c6bkLIneWH@n{`Q>ceZr2|NqAK=nn8uVQy!>6P
zj&H#(`_9K_jfMIBixl2S>^f$X$M+)PiitvD`QLwA?!EodxJ-RAdrSX`AX$ku4fAal
zAOFam{Xj<`+`VMh?cl`qis>3Nezebf&E*sPvbu6!k%4Oa6W_O@D>9DF+9b&!7VofY
zZlk@FvEjyfYd9C3X%UcS*!lK*K|$SF(PfWW8GZBW`WW@>6rZ2|@%)itqteBrhhINm
zy};t^q0(aqeSD*Gw~78LaemL`yTy6)tm3kl>S~Jfl$M=)n15g4v*(|X2klM`>Pxf^
za#tT&VA?O<viIc=Yt16%H#%woPjjOgAOFm^f7S1{>B+qHoQ8eeY|L+7yty4a{di}@
zTb<_j4tFz+Im;}#uA7PNyOL$3tTSsy&}Z=<I|81So->&8WS{(Yr56i~0za(Oo2_zr
zw`5M{GjX>DKf_PUX58M%7iu?CvopJdv&-m-dGk`IdFFv1_BY@7cC&^3Vd~nYyPEY5
zI@)t8CJ6cSEuL=u?5YLV8OCq-)>IcSUv8Xr^vRtilB%{EMM3tZw>ovRji1ViYTnG#
z*<+cWn0@KkQ`u$Zzm@8y9D1K@p_=8Sb6eBs?Yak>&n8?DE7fjE$(39BWA}F@rA0-_
zj%9rk`tNir7aV^Uxaxa-(JLD<7LU2B9H+e%lKy;XUb}M*$HWycm3w8RkMyiRrm`k`
zlV{P>{cqN5%kTP}ra9aHUyOn}Q#U(H$0U!xY&XxP*0U$DZmN8mINNW<w7)688xHoK
ztUY$d>x0yfgFha9-&%26rqAh~U=8zcjurPxT0Ta9es;iiV&*jl@w3r^0vw0F)?5^M
zUgCGcO6UGrmMo(cC)YdtQNLvB`+-OKT8#m(+y1LAmb2ZhWotAJhbd%C{NEzl6_Ud7
zKD_e7%Y0|PbKR>eRjuugw)&r4Fx#%PLZde)B>r&OvE#E>DD31_yv_Jqbn&CRsju{I
zPk5skW7W(fev@0}&Zo`$ZFc<sGM(eoh5C0l)yw@Rp5GE-J=;=kf`p@UYaR3MW6%57
zRUeal`daVH;h?J*w4|9gO|Q^@XArKG@o;VAGFx-=?}{OxW)%N5`p)u^-`cEr)Aw7R
zwHBJ+Kg?a9dR5{)``4YlKBt?mZAsUB{Has_<56pk4=b;BOzt{%ru-{UXMX6EgB$xy
z5*EkYPF(HTb0_G)+9OwaHFPC}!zRyV`M=hyW%rMn%$@%uZQmZ9et(nUnJItt=HAJ$
z`Jv{o&ZzRlEX(ZG^pH1Z2Ylp>gkFE-@>yjr<dkTU(?8LK@&D<Dh0|x9TzgOL*OPVc
zjlR2l@wh&7TVdaiSqg8&^6ePB??#(j{{3<%NN@9Dn}D^Sl%KiCck;b@8;}_FBXr+u
zhaZ~?t+SqgWxOeoecs~|=P|=7jvIPf8v}J$pIY#^^kDLH?%N)EGg*%Ly*1f#BKL95
zoGU)}kN7WM{O9AEmw|TTT<%Q`Qit6hZsp!8*7vFYM4D1)?v4{mo2M9e>py#>=uyze
zTJ?v2@8jv28$}kJjcbZ4XHK)e-;x`kX&_b=FtH`%QC?j_+nZ{(-b()!7meNRe)4Gb
zYfZcy@-AieyNTTq1+07iIltMqrTm%elxV{VY=>G)z9&VA^;~nwnd|Yg-*K*O*|KZ7
zc9LTH&zKvoRX81-xZ;DZYk1$cuAGe7p|-XgqnLOf3-vEZ<WycgO<m{4ea#EizZGPD
z*JTvhzT}9Ac7GA(!?Ns&A`i>)j1TF7{MNi(?n)ub2TV3S<7q4m{E@o#qxe+QFL9?F
zOhTqxeB17K?CIW*6aTz7vET8Nb>Fr3HK|gS-(y-+cy~SLxzP4;)x|?U5|w7ltk>A|
zAp7zI!{%1qrpP@zCY)O2`n6$ey-rH(@vgIaa$Kf;7KfOw-2b@6AW%MW$K@oU?vzQT
zw}m*Tt@?3Tzt>Xihjnht!iRa`N8WvxKf7Z=Waupuo0#*y%cQ4I{}dvXVz@tUx3<TE
zur~_HO-`G9gc+77eOva@#_Jxp*Xr(@nR33#KOeU!{Ws(<eem%mulMTXmpu%-=P8wa
zcAaanXk$oxz=um;))zgU{&$!15j_$1OUo7+Y*_j<(udum>(<t9eG5*dmaK8HNt?E0
z+PW>fg8X(`9rTmTopmo~tx8tNIh!QsX)jkD>DWFwKlGXEmenQa^xQ74QkgOH0Q1Fr
zcN<bWLnIpds&9*HRB>y37x{2Yv#+v4EqtZa#OiHVLhM{md#fBO&HVql$49VOaHXKE
zC6BS{l>hes&lqevEm8NeK;J>Mrgdkmrrl1rq&cEJjaM}*TGpGLKf5cy&UfeaRK4g9
ziQa{UN2i`@;aR?1`}7W<8k5$FSra_7Z{<|6e|e^7ZgpPk=g$AzX0ARVzkHL-^M?E<
z;tJ~*OPNf+_;R`X&J}(s?2BEOMM=c{U&zw4*30J81g?NH5mw)Jn)BBExid5JkEi5}
z$ubLrIt^1KkE<5e&%Jnk|FRbgr(T&GSF6Cvt6j!s@H%7irVCq_&3zc2wz0i=;a%}a
zu5T}`+-n=FGK}^tZ{1>T%_1XpVCJ&Pd%V@W^;%pH_GuY?6Rtn-==}8jU(T1di)if-
zKE5^DAWl7XO$&QXU*zXY6EEs=wP<K59=YlzdnohA-g!&aSBkst^*t58cFNoUwVCFZ
z=4S2|78EVp_9Q4E@wF-68UEIyz6j--_r~Hk?iMrgT$Z1`b#c<~uRG?&pY}PXzrXFb
zdZl)$&63KNzy0}lYJ966JUH|*a9&gG-a`8ne~bN9EsEVrrB^=qO!YYIy7QQVORunC
z*h{t}uM1i4ivGSA%KC2gL@uM;dv~IRIX=4YynSl+%iC&;B$>Z!w0}Nx<o^=!gvwRR
zzTKJZxHT*1NQFIH=z~-lrRKboC!;TE9$I2-r}wb_>2LW=or=7`ADNtW1@nCjMVWmB
zuWP>AwpeM+Qt2e_&65OHzBYYyR!?g~#iF3N)6Xw2Z)-Uzt$rq3ojoo6*E)vpC*RF&
zn0}~UUm(zcBjKB|&)prH&OeF&cD~7Tf<|JqxYK`+qbY1sFMeN+@cy%Hk+J6)#l$k#
z>RbOryOd8Sm$UqGKJ@zRSJt~n4S4qQE^X(S`|jMMpKqMG>(mTBnI2Ur+oB@8Ai~h+
zBKvl8jWu_d_nfKS^zymw<)nHKwbWduT?tk`GS3C3927Jcm$lD7_x*Qpva<Cn(Jx6i
z94GNBZ>(88Q)k{`_e<NBY2+WN%~Cn{e$ChQFPub~_U#KY5-GB}|LNiMX%TZ$USGWX
zmt$_m=H1<{fA=YP{hzV1mXjg5Xs&?l=I44s8Sg&SFZ6u7U3ih43e(zzW43vm`kldj
z9(OM+;Lfbrv*N+Ig-<?j-u!PvWhF<0;@t3ydvEIIl%14MlYXh|y7+O8!~wr~8vEU^
z2L8`ayHVFEbgO%9t?I0{uszpL`R(2pZ!ELJ|B=ep_#a;9Ca>C_<-789@zu-zk8{1m
z#iJj0%CSv<%J%EctahoTT}@_7Hm+DL5gkyOJwe?vVE<z=kF|?>JOA#BxZOWz))W!R
zKerV3-I}M8I@3Cllk<l4?JuV;7oPtS>A2tcVaGYQi<1;gjDDUxI(7G@4}BRI{lzz5
z(%#l?{Jf6$omYV96}O9>MPaM{?0D|7`%St<z`yYKt-Z@1SBkX?wXZO>H1S&XVXDP7
zLAl8s2O`U@(;u%tuW0u<<dDmzr94s6Qn3fFy|bOIAMP&_kP?$&G2`Q#^V`3~&S7du
zYfE{OIa$(fv*#gZ<%{+q53hytc86`dP}X`S?cGGHjMy8i{W&^LPrcRe{w7yzpWv#Z
z=Z&&WT|3mDt`D{SC-ZV`U}&f3j~ix}^486F{Q9zNV$r(3)K`vA!sm$n-#6>`QoS4Z
zxZAjcZtJaJcv{P1pZ3%J^TE1vLb7r5cRs#xKSot%)5SHizuP3Y-r~5_suXtcV8bOp
z#ToM#ZEbsf>BLpHsf{mXrAijCW&Y}u-&?hH-lwEBQxxTDY&15XTPQyF{L&*zMZMb9
z(>}VT^ounuJb3X)3-cLY&f_O+%;bN`>^L^3L20q*BB|cfUCcszrtg?38@-mPx9Rib
zwgVi?-zr^R{`a?XU1z{KmY&z`l7G#N4a!%@Zep*UvhQqjR(;98dy5%Pq*R{y+;@JS
zRe0d3NS0%BjB`^e^g`5^{!(~x?c~mRAJ1i<Zt4<RSiJwsuPm<zc2hGJA8fkd+V}3E
z!#UBysO`rW{n>EKB4SH&UP|4pmr}Rd=f(<#y<4a)?a)5!ZO>gVzL4<GmpdP{JUAp^
zGVSf|S94G3e^d=wk;3@9H0rK^kHPcCYfdv?rCFvgRQMxyNiX=}!I))7G(@g*m`o}+
z<F{X+bJ%a;0=e3R1sCkzT)g>jeonL2jSGQGcc{6VJ>K1NwR<l6EOyIs`=a;X?_M}%
zHitV(`nzzLlxW;<JD;RY#=C6pv;3NRzPO6BrukgNhYcmQvI)|ho0k8yKl|a+4(GDH
zhD{7F+?&2GO9`>f`4-N#?6~B)Qr>qxTT3#OEKF<t>a#X}nzsCbT}t=voxe-A`FKXW
zYJ5I_i^cnxITM|?xIbC`_1Xu^YKQ5u7yq}oOn=<9mE&vq{?LO9>h_(p-&4MR`<X9K
z^galgE>4x}`><h)=dDKJ3j(jsckh#ZTlA*(LduthwF;7jszIrD3vPyqHD5Kzkoe&J
z?q|tWmKzWBW}R53WG{9(q%-PZ`R)bH8c&?roA*pxHIHZY8O~`tT)n61t?A9N@)ysJ
zNobqZVwpKv_V8@2zdygNH8!}*Df%<IUfcAd-=ZU)D?cy1_;&8in<82w``Wu_UYp5s
zSMHf?zK;Gg`z72NkxSj&Hd&c1`+aOr(z>m(*J@AnpU`oQ-PUh3`;T{-*RhR(kvn|S
z(>k(PPAs`_#bCGd8?Qw!GirtX4<~&xG&g<r^U}g?c1B_!t-P(`pENfr*#AuO$a;M?
z(`RD-X=cx5T28kPv#vW|kv6GySthI0^UTLPEk$qtw6H#$F{RCOPgnoGH_s-femu#!
zDX~VObd8rj&kWwM&a^X(VN)0Bip*K-<FnoGm8yf2Yy^v@OYDSLq41rP4&U0#sVDV>
zN7T*HT}PLFiT?rFH%XUQND8kywvYeVf<t~+B$Jy=);?O8!80)-zxAliW?LrN;%Bk(
zTf{{c6h2ox9AVF6cB8V_@n%v#?;3{dChxk~yqTsRm^isJ%yPEG`k0<NnY-uz%(Is$
zeR4ueGA8KbOXhDj=MO(zn525rvTT7x!P~66+tj)ney3bNzxayHlgypl^JA8A=Q%KI
zEc^Ik>$yAmG2b&Se*Ri=dad@cDCIX7KWthpBYu6)x$RRnNHv9B;1jN~a%*aTpRqg2
ztKUL?xgf*+!1QQ_XMBpQ-21;zPnVxOCDloze9A+U?b^Kccf`-k>-opK`eNOq(~(Cv
zeNka}{IRb?K;@p7uEwU+$=RA)^yOGx3s&zr_I_d`oBm(fUmyP0NzFT^l9%K+`RLED
zmoM%+EAacZ_Pu>4t!@;pf08TSQ)PB&uKF7R>DANj`2|%ySn_r2=a|k9n-=gLs&(<W
z-{bj7H{-6S$%KQ3IVMr}68<oh*_dC`C@b!<JN|7R*HYQ|?@g=Der+_0{dZ=z$Jg4Y
zlbTZ>IW1wmmeTPs@NT%_uDw^!zj@Q0*R!sl^+Hw$uQji3+5guG8{(w5+1=I7ElYDM
z%2nh3%I(aT(`)=E>|UlfcUfL|-)1?k#SGV1mCt^dFU!GsS@3q=b>S&d;#;i>g;)ih
z6U=Yi%zgSXu2cNutfp!6jh;+gDEw6D$#cbx!ApCOz5VDBZkb(DbLyk$GsRn(tUIKH
zO1l#N%)0cU?abflUxKo?Uc0|%VzXOFPG0qb{YM^d@Ai9jaq~w$&lNlJ-Nm1On=@;d
zKvMt4<x1HTK4cV`a{Dc2*I5*B_iyZ#75ukff3q^`o^o5@;XA&>i&BO=Iy?fh4<2eS
z()?)h>z<p`R>xU(Rll_!t&`Ya((ZR>U1Uh{ztZG{U#>m-OV~YmXBGbZn!o%(tW)R8
z<8xoE@CsWvXHmq9*QTfB9)|QvW(%l!TsqI`-B`M7+tsd*%WWIf&dze{+wo{3?~=_c
zm$|Ujr!*RW*>%bDZr00BUf(<Q75}unJj@Wl(8RWVd!^IP!%HXUGS~l2m_B{N^)LS<
z{@!vAIZ!w~GVg1}%r*CR>}OS#uhL5l3O}dyOses#oS*IP7u)y6O#kC^aZR65!`~9;
z0-cTxI`(zjzxE0quRNXO5#({&Zu-)qzR3(Nf1^+38!qtLlM>dwSpWQ{ug^}}i+q^&
zZ_%gEvCk)Ee=PaPB!B+*r23+H>Kf-PKRWAmm5aaK`O1hfsNk*C-PT!`j(>W4*0{$r
z{jd2v2JZ%+%R49C+ZA-<S`v%4&mYO(Pn6QxMOa>&&fR)DnDI*U-1|BW2hP1evi_=E
z&^!4fzU6I>7vFE6Vpw2#v)69@(mxH0DhzLb&F3^x6%o4dsOiq`XPQsGe^;`-&LJax
zYgfSSU9sLCQya>3F7eu*KCgeRRQKqwL#cwkNe&+cG$yWJ)xTdu%*!p}+xF7Fi{dSN
zHaR_d-JT;kwKi$9tBlqOrP&X*H@)UieP57c*KNejpb};`J7pb@+JQ$?^G<~AT=`8w
zVAreKlNM8c@ch<UVRz%Swy(*4%h?RiwC-PjIN2}w>;GrRPtLJ>+z_Q!<9%&|TK}TP
z-7?=(x&C{8dbafUyBc+`(<`Nf-p$=tqPBnUVc{|bo5+plJ{L|tILA3~hl0rS2WxK1
z6-m$7`+ocRjEacE-$j<5{4LM8Wnt4Sjir5UHWAg^elLIFy>P~f+0N%~i~o$X?#eUy
zb-(Ah=C4bir)*ep{MTHs-c%VipC1youk|<nmx{Xk&?NWay^}{*t*w_?>wT+Muy9l4
z<-|hy28&|<X9a2I?4|J!?yWtu%zJ4Vmnu`bX~fR&(}K4i_^vVM#f55>r~kqt9G6d<
z7hN{v@xO@|>u;a6SYPru<HxI*i=9inSJj)dyS$0MWcU8GebL26Z=K9Y+XcTu^MrS)
zt<^a=Z^DG&7N4ee6=NRfiLVS=mu$J&xMJ(v(07jyB)zZgU_AJTjeUv8t@CHjYJ2@$
z6?;6SBA|(LTB<bL%&YGOEQJ=FX205Qt3A_v`7`&KEXI?RTxA&S${*d|%gB_c(A#yZ
zarqKyeeLyo<RTYtd=hGX`orzJ>%PbAsmXflXZX*|QlfA&<NLk5YZjcG(qP-pbk@po
z+s{o==L|R9RFr->&&Vt8GF$SlzaHXBwhIl;mqr!w@2+J#+P1x*uRA|ds9x0W`#v^r
zhfMF|Ec_w64tYI(7rgq$vS(tv(PtVH?|r?$t!=|YmhDsi`d*)&?sRU2rqRk4A<a!&
z%Ustb{EN^&zw*@$6@!(FsxNf?EY`H=y=k?uigR0x=wJJ!#=9xoCiSk^9<-?M_g)?L
z%kwV2KPh%uck$vw4j)*GADO+G^r6{z`x~cS1-7SB(^XU2F5hOGlGC1dXNkbIj=06A
zYIF|xZ)UKcvgaaKM~e_=^uhx#ntx7+T=>d!<MFevau&TPQ=9xS`^~fWN%K~v+ZU)*
zD{i~y>0=hyyL;h5i%;`jxCxh9HM%UlDshdeq~&pi_R(KYzHDzWI?r(D@W%@wq3a&x
z#0wPFT#DP}z-{wp%G#aJG__hyYh=^q&m5ZnXOHUhbH#3r0m5?wvi!}JckEr}U+l`9
zqw?*APsF0#8`Gw~%zD1omrdf;VUrN{i0m^ri}V6F{5N0Wbah(6UzPpg((i@1mMmB~
zaf>F`>cG9fPaZlg8TemLJA%b(mXwq0|HI5%Uo<q?v~wvf``iC%e*Mz9<-SLg0<Q%M
zy;;EC)^)PdhL8K$`dS64QrRT+bsbxd8lO6IKJdW7t-D*IG|E<Atvup=)P1(@-_U4#
zt{aOl*zCB)xGU_n>*F=EJG(de9G#cC=3HQF;ig#uomtP)<UUNhWqs(-qld3-Z+2H)
zY%}>)elYG|#=GcL(?A2CVkY@oiBk?X&t0s$jCZ-7Hts%pONB>3#${pt&#9j)8`itq
z*pyeS_uTqVeZmiggxVHooBBVq*ZuwOHZT2r{<8maMT+`2A6Uh%uI_*Oe*3~0nOj@y
znLno-`_1MOY4&W-OjqVvE4$ksGtZiSA#3Fl+ul7bb=%8xv(9l9GI5wl|NC|1L}lVG
zgFBsUh7EV0y*bZ0cXf4OQ^00%!|#dlmp^f@{ucM@*S|R&R*uUnSgU+2H_v3d+{Yps
zu(*i1Q}xPrxpObARxVlH?$;q2Gh@|nAC<$LIVF=ioOU=kY*`_gdi-vqa?&|Fl^gF)
z7JrjJ_ln_ovP9YZwqmh>!~3)6pZ#>>bD&CFtlo)D9WRwu`A?OMOw-Dkaef-};slq|
z77i`b&6{scwaM|{B*5#rc|o$ta+6PUF4!DY<XglOciJRPXl1+UoePS#4sP?M#21`o
z&;IgN{!8T1OvB=DO^3@{Tg+1Q6qNJaUW-j%YZbZZ^@@{+_gY>Q@a(T<3|ey4XhPpv
z`AwIEm+W(^VEMnbz;xb@+opl4{IQcxuWS^tyZLVavx$!4&m<=v6Z<})EpPMUG|g%w
zu^R%PtX4dik`?;(@uB30Z|>pym+Vox)v0?t#YedBfJj%`uCw1m{2J8xEkdSpiZYpH
z@Ck10y1c1?Nvhtb*s%YZ-A;=QEK{cjzqruYeC+?R%lz$cWejWif2&^U>$%?{Sa|&K
z^ZaW!JU6^MRJNUM_hXOzBWD_KAMCB$YiFqW_Ml|><SMJh1?ueI6dV>f@Tg7tcSn2j
z{zdOL3e6R=JSh{t`9j0wlsW0YCnX5KJpVCcc9D%s**y-aS1lKJRq^#}?4Nw3?yAp|
z7}xhxE+jm98!p)9xU;tFHs>AA7drpT4qyDS>t(;)-*w9m<gS0`v&ZemXYI>w%ZoqE
zH|p#C_(PzXp)fC?O=3rq-r{oycJ_T=e@bLh$EwW>nSCzaIIy~s<BqSwlZQ8UNExqP
zyQc1R`M;CwJw-8f8Cnq?`xi*A-{Zr*G4s#d{Y<;BTU0+j_3o9flk3{4HEx{s2g3cs
zRrmNwSUysnG<E$oyU4|i7mK~q=C&TID?h&HWGR=p!}VN`yr&Lx7Cw6@IQxM$Q^ZmC
zgDunN6rI|}^y2~B{0o6Wg<XX;OOj((HEv#cFl6JZ?~?MlKgE7E21UdywdLIYKH0WD
z^$^=a#hYx&*R&V7o+^|)yx`!z>L*R_ezvWzUR3gz-PBKI!7{$No(r$tX^7a`9<+5%
z*dm6*Q*GG9f~HKHS7|A|YNf+WiHc<I>?bAn7Y2S1*X|Uavv$pk%g=>MEU)=3^7Ma^
z6S_lfOXr0UhNbZ`chfsW)AwJlS$=!vtcQ_q!VjybOM0J({w4Kq;bHl;p4%B1!fZpI
zE$}yv{>h?utkES_?ss%Tz@iq`Pg;SiF2AZWQeU3dUGs6qpUJwDPlX6qSSRMMmw75E
z8~)#Cz3r*<jxVI=6<9x<993p?HqbZo&Aj|8UDxgw8(u5QS9!5RrDNHC*GTr)X}A7r
zyq0e9b<mz}EHZC%arxT94gsYp_r3P+F%Sznu=$XH-UTC>HIGksE84z)@jF}QhH2^K
z+ws3MQsffs&b(&*b!gA3h4Q_+lNS6mc(BrVe$1b&q|TL-x1N2b^3X)GF<d{*mv?`V
z_ae!oB5HQKo3^a>$qsH@ZQonUaf(wfXD(BCRF1Lm>>P>D!am987X(&cVp{AY5E^v1
zXIGx`nRmOEe*Sitaa~QIq_9Tz8hr-8Gc4<b8J+}gJ^XXI(uu}~nG?h}UHHy=U>Z{m
z$G63;m(5KzC!O||RKCt8-fi3ECG~5?^;N6PUT>b6xLhXo-i=9zW2bM*U#+2j@gb+0
zs(-J+blKBSH+pMwafXEWH=Ve8`TmPl7u<|oxLZ!timkXe<@yG(=Wm|dbBc%CoxNTC
zjP3jDh5u5UB^5Q>8vU(5O#6GWXwl!7Jd+h4$+j$g%JTV+x89B|R=TYRJh*4p?|0nh
zEfjg~<^e8iP6r9w$<jG3rp+e;-tBjl{lcLtXCV4x$roQg&+f`*fyjub{0@PV+k*^d
z+PG|3apS?hSyEvq7WBUOa3=A`gH?MLe5s#i&ok+@h_UDI9VM~moBn-o4t;&_l<zs#
z=l|I+J+XHQWO#ZbbhXUfj5U*c*;8fyuDmeoUZy>h#>#g2gUK&AtJy9v|F!-&(N)YV
zOd??0yc@qF<#iia|NlFEWqPhq@Bib+FUuzQu8VxU+(^}0>{kWfItTSCll&9=u4?~v
zR_B~M(Xn__5%=2Ni!CJ`b05gvXL|5n=<$x!{I}u?YA1Crg(qz9T<D#?_ioxpHX$zG
z6B|v!l}c8B-czS6c75iiYo||gZ7W{$X0^_X?+cqA$Ge?)9FVfttM+Z8`-#+@QLH!F
zk5AumytZZ5m6iib4Yk(=7+VBg%oh9DA|StYf7kQc%-$W26KtB#O1@bhRe!lLaGvE1
zzxxRhd2b#Vz42+<`}yIn)q8iEuJ=9d{#!CT;%@Wh{kD1sc-CJ`%W$!>-}m59`Qn>4
z`9^xd2F14oPE2U!y|4D8+5TgM&+WA)xp{ee!<Y}S+aF5p^RhO&c5^|Slh+IXnuI>H
z>RD^~*WD>72n$;oYhJ!)%dDlPhc=}cct%%+Z*~!F;GD2+j&qL`_gt$R+L@~p{_Ztc
zA(pvi!O^t;yz?)GhFNaCbL-I0?4=I<SI_z^eY|vA>B%MT`%9jOG|e=79mJw@v*fPH
z`wcJG<r#^!dUtG&e$sw$!Q*L-Gan~41+u<=W^r9kWNq1ktori*&bPD;`7(bjIobPd
zzp$9!&521r-dsAloS$pLb<;0OhPS&_i+Z>3R=4+-ylBSoc70z+=f*wN%evxu_>R|<
za(RUxe0$yanTjEEz|-Qk)lU5V*+-4Ml*2vNt93nn|N7CBlWV&5{!Ma-{>bcVdHcH3
zri=?VRTphftA5j)oc@s~E--w$+>YYRWA&TYv@uP%s~7ktZu<G!d%D)OX=1Y#oFd*`
zs5qhj+d$x3F{j&#%9qX=Rsn0mg#NEDd=kFs61Vs+NAYWg>();aov!{>t54w)|CA@;
zavBd^BmI|7eGs_ulAdkS%f%HOi|&~%JTU8^b*eVgf(bj<&7JFCllttCoyFVV**};c
zw%jysU{>Tv{aCDdsPUOB>wSy2IrG<K<{mTodPzBkM^fkW9+o{@TNK%>JTI)c!?Tj9
z-;kM2^T@M+b5gq)*enyTd=1kyXUO2J`jzs$*X3|m*}YWu)*ww$Ik7Zb%@a%)6!#VF
z+ka#2-LpS7?dx*M@U(~!zM!6-(U3nmYwEWBYv#6eU$}g2y|l$oB{}uqabILjr%pTa
z?@0G`X5V*$=k}S*{q>|+WnO#mV!17h3~F<u@44^dsP^$Gao=|<zv$kN$hP8JX7xdD
z=8DeMNn5&m-eFT~p#;^dhwDE%e(Wo8vH6$0?CKTqYeKEDXIw%bhu8QhSJ@t(`#9`d
z)&Kd=uT}MPs|0!92>!M8`t_*m5zqg=y8rg7{@0n&%Iub*9MSy`U(T6!>+VbKRquXZ
zk#bwh`QF$r@vAD2#LR0x(n@QRW-Zp9`}!!SmSy^!ZSti8*Xj!-3KW)Ui{G9+f7*me
zQw3JJ)m*%`OZMTDUybLI_vQB})ZKd>;HT7BxaPvs2{&a9m07NuDD+H2z*zqBwy>Cp
zYX{dYx*>e#cd?Vmlsrp|#)Gc{@3q9(oYM3+miAEUa&2Nf`Qd*b&yN=|8@}%66#w(&
z*n~Zw8Rs{5R%w4_TH<){+vb#&H}u!N@e?UYNiuw4xnJ(z@euu;5BlebT2C*yv$(2L
zHRXEY{X-A;Msx+oxxEvS&63@2-QjS!?2vs7S5E$1fh`J)jGhW|Y>o{z+1>0s%_P+J
zc6R%r=g$suuXr{0kmlt2{XO3g-BP;xxwt4Rz-;%Ua!sEFXJ<T`+ap<O;Jj*TMPt^c
z39bbPub=yJU-{BX--~ZkjxKuh@PwroL-~QGZR!jQ+Gk(<$+v@V@vCT4UCRrh&6j64
zh3@~G{ZuJf&xl`?<9E(#CeN5>b~U`uPDdYz2rt|?Veh%+``$e8X;QenkK=*j4i*F7
zPi%2>W<PL>`76{Mw0Yq=t*sSbg34@W@EqH@ci|(Ut*on81}3vHu3U7FN7Cc8&gq+h
z!V{&L%CBEvy|T5!aYeb1amStIwSUC+rdV0Lvz}X)@uI%k{$SR;14~~nKfHm>vOyyJ
z>n*7{)Bo2>HCZUXoXC9Uenga*pwHPgB54XfUH^jFw5ML5u<V%v>+1c1pJUG^v3!l|
z|Jk|GTQ*Sed#~vAS*!ontX!R-`6fj_>X2Ys-Nz|Ms!G{vrB_W0IZ^xZy0P8Wl$y4y
z9AC`YyS5rdO!?Q8Iq7uJl7|^3OSz>}DvFOs$IYAl>+Topw`c#WN%d{AFPm~kdHENK
zYckKIyp**Mr53%IEnXkZIDz-i4#^d98$6Hwi#E+G{<z8G=--=aThko&)!O-I>`4A?
zFQ{@S;>k&eZ94kTR&G8!QBG7mV5i)rFPlrUi&!~)Yw`rHKA*)RS;?w$IPeQ6+vn0R
z-<pJ`Uis=%;=l9GI&+uL=`ByQ{rQEX7Wi17c*K7&bLaZoYvLvq^DfY7et2`{*<YRS
z9@u3jEi>$Uvct~x#)KTZ_L#UgZb#l)yxAa{(4NWJyi=mUWyAl91@D$V4*%@+Kw{_o
z@(nR7)-Bm}s?Jlbe)>hTkeBc0Y@gQoq+_H1PF9C0^;7J1{|9-cxUY|Nc@=s7)XK`h
z-Fvh84|_injP*Wsa&vfynf?CES(CC2QhqPl?VB`f<)mYU$LADtFVVQP_TSb?RqK>5
zvTwCp{r1eG)?>?=e%+ZT_M@_%d+W@Yb<aO6EH7Te#{N`MKZM&X*JY)?bckZ&k285I
zrGsTNoG+{qJehDgVdc+f6V6=B-?&|<drwXOm1$NJQ;r!~PY!Uo7-#D6b-njnQyGCN
z9@;OSrIoddPKrG<xoP_O%^$hvKRw^S%Kg!+$`7G^vKO*m{q}z7996LHN$KLvN4|VG
zE$*8%h3BS5{XfH*yf1eeobppO4E8*gJCoy)@ul*LJdTppX&+)YhnE-M`l+46lNi~`
zV*R~k*Y5>+Aw^ehMDrYjeU|@C^W(UdyDRITi9^<!?4KtU8x{GMe&70Z_3Vec{YB3_
z%(7p&P=|Fc19Nlr>BURB?j7=ybcyo6{d2d-yn?Kjk4pM4pL~40c*Pf29;aU2(8Ta#
z?_Ap_J=NX0AbYu!-rk^(hc7gy*Uhv!WDvK(<k2FJmPWCkrq6=Y1OsN5NA^oH#4fWE
zn(G|2$XY=ATA}y!bE_9@ylN`_X<b!X&MVdU^}QD=9*NY?m|CtSp}>6JJ+;X-aXPoR
z&8hVz`>qG(p3d6NJN@K`+n-;#AJpGE!@zIhguJvf&(`efvj2Af;O8}E7orO4bygaf
z&GUZrU*qOA)|$$)ke0`$m4{TnU1E})=2{$_E+lQs`1^Oj!QCvnPtRI@K7325K+Zz*
zQMk(nZoU4Tn|cP@clzD^yRP1BLA0&H)wM5$8~byXe`qt)VBd6Y=^>p1mG7E5bbj15
zR?^r$OFnjLmHf%OC!YKikzrDfjP5&E6gRE^oAZZr#lD|ZE2Q-dK3ukVs@=3VdacM?
z%iO2lfz1r|yA<!R^Cur_|IIwN@!;D1`Nr`Ik39|rehdwsTzx!)J0akSnqSC@Tn!~#
z?eP2a6HAlMv-8c_^2y?4?Z(%eXKLvDe*Mp0X|gZ7akY%Znc$TxesoGdz57OLO_FT{
z_lX-%wU^6X(!VVKd46ATwEf!7ymJ*C4E?w6ob@f+b0KG4$`yfI!u#y53LW-ls@Jb!
z*073C^T-LkAhAFrCnGe=W7&j%Pfd$%_{%c|sE1wh2t9V#;r`Slt9+@Qi*K3h#O`xX
z*}34><axptb6-`k>D-jbj4MoRo6fC!uvqNJ8gI+Af5r)_Du*6;eiRUEVikXCQe0CW
zHgCC`xz!GBroyc*J#NVtZ7mC1%lH478DVL@ulC+;Hh-1Bth4U1?!OW7GGI#XDHgYl
zMzs=-F;|PDk4!)IUdL6xZRsrQo~>rC?V73IcAK7-4EX)&e^bD=Lo7v&DQ~#7o2|TO
z6*#$1ZusxLa9VltUfKOOEGKW@d)@Fslhy+Vy;Nph*+UsmCN8`Fob$T(l4Y(ta^Bum
zj4=wkH+5zF&i&oO0ZDPI&0oo0H_O?v@WDKD?l(`}iw>=ksXUi;{F=&hv8^`C@7yj5
z6@K<=jcx6z**6Qg4(z%k=ebXM4%6bTH`$8i&BNqW4js_HUaz-x?)kLNRd4joK0Z$N
zt=*kC$$hhU>!~f0OEmlCr}S{|yEV7sult-Y`bF&#pZO-+KYx9ay|3Co=@he4;kMM&
zu3K~eD{j~k^@s6@=#l==8fj(LZ;9u7MD^5LZ|lsh<lM-z%JfJI`?a}ZA6}o3T37kZ
z<b3kn<h~7I?j}|@DpqJts#h`je{$n5*(n9TGXBX{T`K55eEOxyCsz0DJJoYd&)wTK
z#n54gR&n`?r3-fm-BR>f?CQISGtA{pNrz*`h1)kAPc4dYdd2bS@o$|*@d?bIZ+Chs
zujwtlasK#p)B9V)?oQCy7;RZJ@4CyZCuQ+*L1#PXyKt#*ICx}V?87eqbx*qAdLCeO
z(1~{mzp1z0bF!^lAoKP9>f(LZ)fesgy)E?b$-j~_L^nk8uIbfEi*BC&Wbda(>%9vv
zY3wd9m^5SUvOmizPN`LA&#G2V@Sbrqkd=*n{UJRr`Le`}f(0$g!cWz%e$=|J-*#ld
z-29%I+o$c3dsDq_YK!Zn#ZxY2SQj3cRX?qW^^K$CE?XCu_bWF3>@;N1oFXQE>qwF^
ztEtH}*XEeI+8<~9vW}-@iTvHIQDOYL_}PrJ43mGCEz9|<fA;wmR=<N%M<*K|2@1{I
z>MQgn^XAp#A2O7tHuJDO|G)KR+Y!z;{Kv!}dU-6<{3Og#+2y7a>6?1|)wVOjOQ-KQ
zn$yDj%k0ywV`bAn%ry%2%0Ha6X{VL-r;EnVKmCngJ)<|H@qgV0eUaPNaW>Zqw<r|d
zn3B1Br{u=ycvqM8>R%0RPTd*EIj_3sq^(uV;ah9iIl>~ZZ!$@9E(|i*>wf)e{>FS&
zxr86@4X=E&(`}Y0DxVhh>+c$-gI<QMMLN3_ID(pAR<CFIH6`tr6_-K9LBR`&IZlf#
zZ`(&*aAgZ#x~pU1uKq7Fx$~EI_~+|wYH>ODerM;hd!;6KF7)&=t1jR1al`oqPebLj
z=DVb+Ua+j=2@mmU-&AtBA?i_8t2$3jzU<2ro!$3m70thKxVN`BEFu4lwAHIe?Yw$t
z&%~efe<c&PR7*hpS<m~He$(3r?r-`zVPmL^*<%?|?ZWk5W+FoBQb(g(mv5Y*Q#9N5
z*sJdeR^96Bmdr2v;-@p`be7S2LraT)xmVeny3M#B8oA8hIp0+5>)E244F??A6ICo~
z0#Y*K#N!$IOpZQW?smfQW2JM~&drZEdq;<bW?r&oo#$9yeM$a{m+Qy<8FQ9;ELM{F
z@Ru*`eqsKrwd?zSN6$HWAl{DEJNMSMK!=TnhYlvFA1nQN!tB0b*7xNco&5THlebmw
zS^E1+%c+urk5Ao~U*~J*K7HHejnuM>>Y)z;kM8KQ-5~ULiFDs5voyw82l-!w{hMm_
z=~(`Z`-WT1-nk?^%VSnF6)l;j!u4SB>V#W+^rt@EcChU5gqp}_O({}K^&G8>&$_&7
z+wA$_S%hLxfUlLn-TRXgHj0#py?oob$Ljy4lAfvSeyGNa9c}pfQ+7jy`fH`)x@8C7
z=7v6ssJ0IF)tzyx$>P{vhMm3P6<T6V^G;-zhVK#nbf7sXRYzlChrFFpzkbq{)zvr5
zxy!SAe_G4yhd6ZncK9hV>HW&S8CQ>#bJz#W=m=!>b33{8PyOk(K-(+9PYqt1Z2Y+4
zZCvtM*{i7y#-HN$98g}_YhSygqSdWed~S-h{oK8aw*IXM6<Ko7x6FXs<o52_SLfer
z_qN%#O;y76@8^H#A8!;*?)|c-JE6;7FVE(LY?MOj{$D3e)6Q_OaQw~sPi@wrqb5Zs
z=aq%^wYVyH<^S9EXx%lRq6r2E{h6jShqXU@wTP*%Uu|lyWB%t5hx4vKX3dV)bYAYi
z=jbVS-@^%|sc%b{o{!nV)uQ))wat+&YgZlRT4QT<EN*)ei@eCsPWkukM`I_wslIdO
z_?f+0%Z`RgUi<a<%;&2Q+NxqK=Y^QH3RN2`{mRao*nCUoYIkXG%Kq;{+G{s(E^MD1
z;oH6Y`idFh^R6@-Yn5GP_&7a%%YC<&-TDcg2W}~>+2NoiShYD!c)kA>DgXS=E2iwl
zoKEwU>{GY27hB$qF})FY;)eaxjaOX1bSqbQuCY9m5qRsv-6$U0GCsaNQ+=9lmbJfJ
zVXA4k&}vKH+v~-S(zk0ZZ!Y~Am@2$1m065y=ftPHylYPyJ)aSCYNfOM<A&%Mp=3Lg
zF2A4qd{>%9ZQxpOyf3<=Ve-+7VMUXg&ziYKdRe^u)&J%2)u|VfvKMh&Ufoq=plz0%
zeeub{ijagiwbE{TL|$o3Q`_4SseZ`aZMrIhgg*Q1OTrEJEVo`~-N}0YCi|LupAvcu
zUOMpoGt7uMyNhda&#UP(l&)`FzG}tQdtcIQeZ(Up6AgNoyyQ65)xPQ0^@M|R-EBrm
zS*yEZjV-clTXeWj_U25e7hIdYXx*<B^=l&C_N;te>*pf=;_@v+q1N2>K|fXMCBEDh
zzjOOVY8%hY%l{Y5%GjpiIF~p4QSJZfhwC_&-F94eT2|oS8L4M`Tt5D7(X5$zGykIa
zp^1+#iFfTcu)U$Ha^v~Zmv5uH^4FB!{*`oUZ`%JfmHIPR<e~y1JcB0xYPcuFo8xc4
zzW0Ja*S4DVz9tu^EqHS4_{laq&ncOjKQxV)X0K_y%lW=G<NLxK)8$W}>z~;BdF?-Q
ztGPjXrDwh~ok%;HEwt^wRry(^``d4=)ID)Qyr6pZCi^Kz=IskRC1!PAW`EDZDK2_5
zFRap$VwmYWtK`^ZWfj?qHtzEuszMf8atn8?=iIty#<Z`y%vbib@^%MsDK*y1&APTz
zxP$e-fPTH+|8yzMS=C};7lfM{RuyC&dF%TB$#nOKlL{3NkDN8Fzt=o#>o?J<{?_)7
zr03t>cjTdv)Y{eWR5xorJr(e?qB*oFFj;(e)`V3$50iV}T{c^+JN1FLaL4-WKpEk5
zPSJ<U3+lCX6CcI<l`PiEy`<0RuBL9Y$a3!gWs}}Kyw0rn?+Z7h^(4Q$`m^sXj=LD#
zJS!+F?D@eEr{_kuI8>K7wwqUYe{}d;d{@&>YF1Xdm#1iS^p|FX(6cLdrkGo0E%sdC
zr<Pe#7SO@Lb*ES{fQ$8U?_LFq-_L)jG$s7;Sh;^eOM_4S2Vef)R*iWq+uXh9Z>?BU
zKjl+IaJkjBD-Yc_CoKwD5uL&xSmZv5PybZLlJla)>E~97Z7P`Vn>O#tA?c6%_O3t4
zC+PcWM&vxV{e@w?^G-AT_dnY2UMXGnQNQYw_OkSoE0|hLvclMB*oPf?Rxi0irPbxP
ztH)&<sh-A*kG=~Z%UUeVbvyOfrLto)JAXX9bKa^fz*LxR-O69PV*+iQFXi`TdO5l!
znQWWBQgv&^Tprajr;jWCu*+@v;M1}zE`L)@N|$bK!ji*p-X2-;arWB9cb6Le-&Au}
z_Y~vCX`AL2>)-tKddaCHEITgA8vHwcadGpVn-5D>>kcTenLT^-*4_WL_eW2g-lu0j
za5)_liDLTkB);eUGdr8M`A;%;PMW~`Y_WDyeZ}@8i|=h*wcuCl#iTd=eC<rzVs-RB
z2u{w~Z>ebWr+L21l0RQoC+H-uS$g=LkpApHNo8?W2{|Hs7K;{4cJh4~X>~9E?H+@d
z$0j=_F3kR*=q;cs@;o#7>60W;UE%jj6MNNf-q^OOCh__+18FUWl}olK?fSML_sViU
z<$cTh^J?cem1y13{l3)k;<{f!_NDnpn{1*!>@L{P_WN>tkzO|c6_)EaR(@}Bye=|p
zb@c3n)1q_cr_Ia%bmfGr`Kya3|K%=Zv=^VHZPNUC?}SrtBc8eKcoqG10T-WE$Z2~y
zjbta=+h^a+G~lV&I$7b(xono(nfz~ORvcuDP`Y|Dx@EFrr<Ih%=d`pW^=C{1U)^jr
z|G99rOxsy-x%;QD`I8cFGvB*^C_+5F&ND&4xzt8X{Z{M^*_lsN7ih%vTu<j`+fu&t
zc*2IOQJg9JI_^x(Qi<d|8|1~l^2YgPdl`2<iQ}&4Q<?rhMA7|7z{MQX$MTKe{Gv4;
zKE122zv&2Ds=ZQa?Kg*W0z1MBGM8^Vy)%?QDd7G2n-AZy7%G|f96onXoO6@l)aLKe
z0fD`%t>sL)i!3;Jue2ZBJICeF)b7uRbF5Czdi6KD#!t9q{h~RS<Da|neY?8$P0Hqj
z2Yu!>P5!+^aO>j#f6fUrt9_WhhB0fRne!(v0ns1@_Fj?42^WLoTW6-7RPiy9PZRzv
z-}|)xj)U=C_ET5G%igM$D171<Y$=cnZ7=+mZ2JGvj+w?Y6YE9Hcj&x3zESv78N)_D
zl?|=x8>Ho$I%K@&+WeJSWW*K_Sn=V=x}dTmr%K%eLJB6Y)P3)&*6h-HC+xs=@rKRY
zw2u>w=A37q>1=YinaOY6$-w<frRwf36w^8*HE;il7Oh_k_g4jMEWM+@C};QoACBr=
zd7D!8yw<D{iYsPuF8|RZuxgdfi=?}Wzniw^%;#7wGpXDpD|WT<(uj)_)~#EqD0Rs@
zGV<ajw|6UxN;?=*f9slFnlodq?}_?Pvmcydd1m^(^ykGDf8QUwEy5M1#*m_JSQ=2>
zf1~Eto0(pPFXPtj`n>XLMOtjNTzL&^SK;=92g_!yxqI^M>e|y&&N4UJtMO*4&$S74
zdEL_`e?z}?)t`>tKN?SQ&*e~!IF-1N>Elba+RKkx7N6~?{FA-V<CI0xM7yFNtD{@`
zA5~9!SvYe>u1V|9sc)TkN4`I}HCp}4o-_JO-e0t~D9pKW{KN+1$7~lkKbNoJ=H9m@
zfc5s3!!qyn?g}d~@6%FV;3R4>eb1qkw(PHS17x;z#jp5v{nP8{sU2^!qd(4CJK^uM
z&?_YY`tf@uUpxDkUC&*q{^Od!Dlv9fx6@xbM2v-}K1*(#Tezd+y?oo>RkHiG>juVc
zJ`xeScb<UQ302Jpui1PoG-b^f>=baQ6uuUCm^(``YZ9yR>%Ff%8Dx*|RP@ZeAY?DL
zqVvH4i@*mtQ)(j$mu`IhQjlBCwST6?E~AIDFYmv?U96V+?9zp^`lip7B%2LX3b%Z^
z>2I<9nvLshMZ0YxGfLk5@BDe3duEjN^Q&z4Sz_-`UT-O-`L-eZbgH{Y<Sy>@*(*Cz
zHWY2pUvN_7O*N0qtd%ooy*$*`-F2pQuD9rf1)g7K+NvGUvC)0E#qWxX;kzIDH!aU>
zJCi*B#+kd4$!j{I`>#AW?v}dUo9Vz5|3-C}=k->Z3t#z~Cop?gO2lcz)+|1@ATVmP
z-5Z~^W^;36V@^yL5jk(NX|tBDm}JhX$H&e@^O@doyBvF1_FqzjePEbP$n`(Mi;8$=
zBulZ(l6>QTfOCOuvDl$mzYl~=V$yp1w$W2Fy6}s=%5(dL4a}1Bmv?`^u$^<q)YF@;
z_iu<+OijC!xaGiM#hP_WM-S(2;QFt9@k!b4U$<Vet?1`UbX>jWo({iJW2|7Phxz)A
z;@^Gcesev$?d-PqltRPB<8Kr5Bs=31xT;k1l0F^3Zg}?S%c$yUVaaJe?_PxO+SSvO
zw^q}AO_|8msh4`wE%n<h7Ob;68ZElu&;`-#x>=uBWIVh&<DY?~^4+*+g4dH-7MPYC
zcG<|x@qVt$M-DcI2Qn>MCz98kmQY(W&sL!|IAfR6(O*+$&8_OnF_!%P=ZDQ?mH2KC
z8>i*7*w3{7nQ~U-?);jKMjOvD98O)-c7BDKZr`UW9;P1C-z+Ec-j(G^CC_I3alAI^
z>Gj2)tNB+*%Sz5v_6>V9m&0WFE~UM9d|s?K`0>X!T;XnopvB6^(=V=z%Q*4e?T%AW
zuzd=X*zT{(gV$fNOgPHmSDTx4w}tf<6WfHpGhcT}{bBr<cD>$rX3o^TH%r7`Zl5nZ
zGyc|o?zHdfGw&GxlHRxQQ}>kcPL=6~JRb@**9ER<u<N*K{I=Np(KlQ5o#x3l8`(Yf
zFmOFQCba4B;k2poVvbsApB4vQskNOjZ@zzzdtyVW^Rl9YDmPiy?OOOk(%W_Sf}c?v
zG*a?KPx*N3Tz6f2+c<X0WXHAk>8C_?Zuy{JIqg1=#Ic>3;<LV0ib#ucUHmY=RR4^b
z>S2W~5_h;JE!p0=-0X7QOMyH|wmjV+ca4M7SGx0CXH4NuwK!~d#Ot>%_fwaDG8*SR
zczixCzUzA5*}$lG)9=GQ-sjG*mC-x&(N}Bb;g>%W_8t(_JJikiVPf)JYwy4Ood<<Q
zK0n%eAX?udC^ahb%O-}Ibw@=O-<_+WuGPQQB)EI#%<6+nKR-9y?Pnza(8OV~giWq+
zZ1F<wj~*hk1!HQGuX1ndILX{lw^u7ncIpAP>@Ur1*PZ_>^=Ei#p7xy;;Pm{{wyljU
z$$8IojtTBMb!1ZGSrMyEZSHaAMHAQrWP;QUf<AEmHWs<Q>-)Rxe@l)<K5i|v?iJdl
z5j;=ZO>ANQ+KROb8Y>fzyuH2ArmJkyq1j9hwx(Z;7gZIlvM<{zC6F5YOYD2NPPovA
zdp#1ej>3DsDJ14wujZRHuUuHC|J2HYmtLtU!c}LOJ;aqJOm9`YwZ7CrL#f#~;NA8$
zc})7Jj-Ts4Gv(C2dnZ*sU%kIR)ADUo>@qutsYfe&?fDcrrY3(4R(({b;-I_#e`NOi
z6>@QTPrtwT-QOEm5?b5McBO4M+hm)G!4(JF?su5%Si1Gk3AfBJAy=NTPC?rhUr)Es
zc5~|8WB2~b>O%)UyzV-2Y+>k>_kAjYnHlXGha0sew`$+@j`$m_;rIKEmTj-WpH1R{
zFDqY1-@fNr6?Ek8)x}W>b2d8dyP)`TvwdDqoWr{AhA$<L`ll_4Ycb<+vk&hx-+B1_
ztw&o$O&4BH>R&pO`NqE1)e;|`F|VC^eAm~+*2HuA$ILf<GRb|!qQBYY`9q_HGwR+l
ze!TJFwP?dFxB0;avpW`>Un_F5+^iBc<F)rRffqA7%G>=amY=&-T&{WQgLpwfhOyiZ
z=V{fe*N5)T3upT{Q+TJJq;1~y==-JHSENrp!hePTg->;;m~`XfvTG{I&Q50cyc$A%
z*5%FVog28+RQ$oIPSvJQuVqdLwBG6dy!C~{%WSpwms@!h3@a=JTRZJ^K9$X#n!7i9
zl4otlx{RA5?Kf4mUEWGPG~1-q$jj-(vE))*gsnrhS^Bc}ZzdV`@(aHuUERAN@vYDF
zy;r@=&(4t3HkkQ-quU%^fq+oyZIUxLm`*>E&-8f#%jL@jx7yY}FnO6@X6gL+amMP~
zB1+AXVG+T~QaY=S{V`ze@%&--R4_|2iY@w2vyjn+onoIQ%IqTUrEh<)-@Qva?qg1C
zyXd{AVMolobgZ9b<vXNYV>K$<%9K_(bKYh-*$0Xf`DMA@c^=K*KUc6r>cWc)DOpc#
zJDxuNHGge_*JO{ce?C@UZxU=>Ve#A9@O$*b`)!{*xAkB1-TTp`tGO_AYD$7C|Hdne
zgr{EXFmO6A^6+T$o?UCiIUjBHoVwhk%W}naAEg=#S)1R^J8Q3QJ(D!qWrowq4K5pf
zpJ)ngJ^uB>(Nhk>Mtx4Rw)g(N=f1GC{l|H`<=0u?`tqa%Zi{)Q8rX3ElXT+|=Q&3n
z$~|Vg`-<s#%U9OdZ*|XRFZje{ayIkHo~+B;{ipu3Ns;=;&U^O6j`i1K7rL^qF*xvK
z7u)V=tJIpCtZ4!J6E#?8{Oz4K-FK<xN`cSKe~PB3FWGfobjSSpZWYgkWiKVYI^d<(
zbuanD+2@-BwO<L?%zx`u87in}a{OyP?``Q1Zg<<+^YZS=Hz)=x`$-?EW4JUg_`HB;
z6l3RS1*>Ck|7@||;qG~V!5iPV3ZmBA1<DJ}jV`I}Z#TZfp~uUvBC@(ubKb>sJ`%><
zVrN&!{bc*~`gM<j+x?SI&g(YSUU+p{`q?q}_i{_uR`^%%EAC+{4QNu6)n34I=5xpD
zo%1SYvTx$t96hP&@-Mll#!LHyi;Z8o?Vq+g?bKe0)eTR$|4)7NMqM~c!zS`s)Mv(o
zg3qTkf>VxkwdQ;&j6E9XFwxQ@vfBLT44Jz1bE6l3vboZhdZBMytoG*o)z1^H7{3Im
z)XUFpGU`3CYJ<wML$NBGb*?sXB{kkO-0<)NFL&?Wf09Px9(F>%*F9IewjprZ_wMBn
zGgLaH5@k9oFNrM)NbHvGDt{h-XsN11ljr36w<o8|Zm5{(^3$eDx1aCU->dvD^H#9G
z3SxfXQOmy~eG<1R>$}<Vj#7L#*yNteI{etUl|AQya~p5Ti_<1wZu&00HCOyzU-irN
zU$kmD_AJOu^5Zym`+xJA`^|RiL?gU&|J_wsQu}r`-?Rs7xu!I1dm4VAf?037rO1iN
zVJ@#qO1M;-Zf{*;VEN4N8%xR+jhHUCNi{9D<@Z(c3!=6}94mif?>HyxgjHqh?b?Q`
z{Fkk4-n$5@WxjrN-<vJ*-KT#!X+;e4=Sv-HzRT1%X%pY2&o_!9McS&~yq4To^k25l
zTVvP3Pziqb@}G~>7fKlU2z*a(m37u<nf@<c`u*&+hI!xo?gy0`DyOkTR4Xs+o%!_g
zT29Bk$vo;Bb$(0FFue-PW^(4Kskh(Vm)7!_$za>ZkZWr{TH5~<JH7ptyvJ{^cV6px
zw_Uk*f2jf6ql)+1*AmY>sG4hg|L6H8OMadA$%+4Usyi%RvYt*{lC5y&$w`|}*A_Z0
ztxVD``dPg9K)BG!yNeiC{pj?+A^L6hCm*Jpg}>(iJTPHR&AF?+`%KD|Dv!>d^FzC2
z`DML^WtCQiuPRsiKjr+St@`VTa*XTilG`tDZTTCq?Cs_W?ceX5Fy_dQpQf*rVxN}W
z`NA)A&&M4l>1V%HOyn?~_Tqwj9M6Z2Eh=jS=1o-9i_)vk+U&i{(T3q>?3exLUX@JU
zW)T#*mE&wm?4LU4Q*wO=^5k|il<n|3A@M_cUGeNSvSD!rJo7KzIsY?Zx1mQ%!nyZi
z2H6agUvz4%XRrM{EvURuRL_HNp|hajLY=tfx>F9FDh<0hqp)f#gBiz($l33Xee*MN
z<#u#r|75h@qx-b*6h^7$4c%hf`Cjkg_hol=bo<I)vf6&LQepP<xT|Yjr9RK%m^bVB
zEt><a`$J@TH)xnoSJIfJANXO3M`CEdSZh&^*bm)(PG+5Xo2O0LD-rr2BXZmQ=ZXim
zaTM9H@%O3jYzRnqw$D)SI-z?eVs9SXqncJjql_@N1-A~l7{|9vH|jnnb|ff&^}QF>
z9&u8U_cl+SoPUr>K}^-3@9)7)Hz$4L<!+fJ{bGM{)VGV>%ConM#8^##?6vTyIp+;0
z&qe+*Znm43&)=?d;P58Pdz&0R6L<K9NLOl}R#83}^;WV<#{2a1*<Yg8H%1zoMln0@
z&Jvkyd{{_yhMUdJ&k{Lj+h#aEQmmUbSAW$qQ#lbU%|F?~`y%FjSgHN}NoB*VgSF2-
z9C&ANqFZi~*vYj#eo=-p+XQy`E`KrgvYH87bU2gE_bjiuoU^9aOrKM&@bRZg$ohW^
zLXxHQf+QZ62&QkesF?WZLgd3ORT~sFb59!_by+#Pr{zxgp3)N^f_sYhy#Ev)^H^YQ
z?wT3e`bTC~yT7iO)2h^E<}vAw`XjZccYQ=cFMd(G=ie&4BK%il<q5G3=aQ?>*Ic+8
z>ScTMk>On9Q0bpWS#nH@Z8AOkIIrKBt#MkFTj9muyL^HwEW9_)p1WoLA^!c0`4`yz
z+OMqEz7)GEV6WmM*ICDXyklPF+O9XTna#rWcg<nG=C8>Mo0h!#A+bg(_t;0@<)RB?
z-~8Q^RCmeu4%@$jQ`5>L?tVCQ`^GeNmgNO+wpOQaUTemF(s1eSrHwBg*=AhR4e#P<
zIKprE`J>k%!=xh`W(ybDPu=&vFu-|{di0UZj8jft%(HfFY!RK4J!uzHO+BCWfiH%g
zu9|Wu-lQcgFX8El)rfx0)1@tOwxjph1I7w5mTiv|KiH?8p1)(4Z?CIV-v2bO{v-TF
z57zWOb2aWcytehPrLgGoX&n)})PnCiEnRiF<(p)fLZM3HviE0Kq;{GvFWnM)xRj;-
z-xc;n<zHQS_HR@^^6Z41Ncx+em2Sl`O!I!sbQjh6vH4<Icv9>MRd)BqXXUQSm%QfA
z^)l~T=i&I<bmpngyWX#uc(382Xxv<v_Q`Lrf1D?kwcBS2!}bLWx#g`7b>wt39G(5_
zTJl>f<#YPxtfo29X093@4hR2Mp1+ee@2sudDIUd#B9qQby<#!C>>Kg2Wn)<T>z-d}
zS64jo3clj%^d{Jfp^#<o>u<?7Y;U|j&SUAc?&e?jc&*2GPPrXy$lAYN%Wc}@$+}Wm
zZ>$|Awak93H2r7b%HrZ2el@?pW+o4oO^n>W-`~Eampf!PbIs(J)BCf&J+gPJNPar?
z-HchC+-IMvJa0J5a^89Irg_`<hCcqh(OKb)J&Wff-PUI|e*%SauWpsM)y~~J_rTE^
z$BzEqmGo<N_tOpL>s>#--}FV2_rgy8r3bW~w$?SKE%<S`;Ypt2VucAjkB+o?J#H;_
z^m8&u^oq#h@_q4+tz+J;yH@x7cJ6T8eQ^GC?)|R}#f6M@UxmGj=b2tJZ~L#mZ=bl_
zGyXBF@Ff2?BWA9)Ejbg#=kN<3<oz+-<o#CVxHU<uqMwz1yC$}wae~F&U8;3Ly31^s
zc{lF*bJ(yk^3iqSH9XUmn(fj~_}-|k)(B7KI%0Fbv0vvLf2`<Zr^{FCZNDF7iklNX
z^DN_hy%+9v=1l5aE4Q;c9lLfTKHGtJ(-V=4j*^1mfy~^$ib_71=PHE%E9DK1jySuz
zFK<SFtNCZGXOaHWQc1;g;*We;dBfwO>5`PvYyWtP4&3K_uB?7sq-)=@Wircb4R-Jy
z2%DjE`-RjxpO^(kuHThwPX~M{*kY6X@_&EH5)Co+e+<b+=OS;u6_$zJX2G!Q)tYBs
zeQB~gK9$zitzq62QWtZ2v8bwj{#F)`nJ16FTmPM*)ly|P)4Q3Q&ffXD|NIwCjX2YP
zTvG4eG`D<Yb3FK_ErQv2)2lZEJg26`T;Mw2*!SenKhM>PuX;W{-Lde=jr2CQmTMo&
zYaFNZ<_l^yy$d<H@?^Ya((VQU)7kCEKX^~_4-h^1d!^5gteEGP7yY~V1!N;X%m4j1
z>#+2_4e1p-wVXAMhh9m279n(9{(IR3O=ISH-ID74zj_Rpv{=_K?%tfWH%x_XSM{|s
zN>Ow3s+L-uzM6NISM01ezp8k|_n#A*f_RiJze!>hU9J;;|L~$oY|FQqZkVCWdi5*A
zy%yP{A43u@>^s7DIgU|PJjmO=Rbu<TdH&b0WS!X5cO<#+`U;O72iqgFcDc9IG+bR)
zIs1my_I->}kqfpSE36ZdQ+4L}xxRDBn?G~@`+XF6An`-pEc)}}O=~MuOsiyVwbaAA
z&F%E%6g$Ib9$}XiJFUpQ_uw6`K(SL1_rg0X45qECeD%e-D0livj-vW0`foQbTxux6
z9;!S2(cHI*_pR<fH|sk5Ztg-+w#L1`+2$9{JK(c;&w=jW{1xRV<W`6sxGFD{^6K}6
zz1q=t|J0UjTNd|Vnopwf#vZ1l61U%M=57;GoD$$)d&<dZa{q!3`^K4F6Ye?Zm&GhE
z7T&VdvhQE{8_{E5y95ocA5&U#;pfEay<e_Ro3XUciAzN78UKovvP<9DU40>5`o<;p
z&GJe)Rw=VLjnb3PF5LEU+Tu-JHZ^k(y*FEAuy~4mq7m1Ny_?;`Dxa?idlaRzYueN4
zZ#U=EEAGGh_PU*DEbC=A5znhvRNsH?w|@OLlXYvz+mbnx+1~79FEjYvF=?07@0$$o
z_`?3YR$9@#-0IbZwfh<We_gQp_l-jHkE*g^e-{|9{k}`WKYH4ao9W_fTPAgc`2Rmv
zclTS{KjE_JMOSA!ik@)aUu-b%;oV^O^P5h3s{EKJ>MZ%1X`{T0<F%}_k@=2`bK>g7
z7jG3W+G_vmT3a@s1;6$KUB?L`&7bscU7W*b{#szo1s}%m!k3>vobr@;hk<2(f!X!K
zyA1UfMt5G>S*;JK*uBj1NAvVIf{QsWYA<{6=7m#&YSpbR+8>`3#-Dj@cT6=T>Gei2
zn{}188&<|7i#o25k13bZIQF$xhB5p}!(GL^COhu`d%qp{!t%fK48xQKCp%TxRA<J$
zF|x|pv9@g@gHl+t?LVu1Qh%6Eef9aG*J0v){%z7Cq430~^ERJV4*K2mVC9wxD(pi4
zYixZltFC`1wqw!dqc@E^=WSkaE~2Pp$G6~q-pqiQm%LgkOKaZTOgf~;ThuviW9;)6
zEK4R`IQcVCZld_-XAu(lJs|~uGyVryJvyzwJ?;8*ZjYO>)-3VGXSSpt=)Lb=cqlAt
zbJxy!vHuPBx-1AeE4914<t3;3%e!?pi}{M$nKp#UHZRoWFubk)EoJXnQD2@H9P7<k
z!v6l1*tbji*1E{XlI0z1<zBHZd~<n?YQ@~kTs&JE1s2^-RL;4YYQ;UhVw2yRF3YK#
zR(;rVyFP8x1C^$gUOY!XhCXh(QuTYyy8QumlQ{O7dhHFeik8c(D0siO*6ixf`c+cV
z{Oo(Q%pO#S^7!inO+9ZIZQtYdT$X$B{+a%}jZ7Fnhh~55wZ7S=d(iOXirLNWYu<9d
zblFkTT-Cmlo87jr_WseCUG9%R7G4wk<rf%H7XMUP=i#Hn)wi$3J1z@X-eDO3w!QPs
zi%T+P8@T)Deq6Ecz^UD*%cEH9=UouAc`qlfx=N?E)S|miB=Fi@t)@MjxmIL{)wF#p
zWaL#-TgDiwbV_pG0m(@T!Bg3cI9i^4+$*@>@_X=>?GxXAhz?jC5_2gr^<!48RUQ+!
zg^7jrN==!JEB{`UuU?iQcO>WKrh68J<<nnegcUTNcFt2Qdi(gKjTg)Ixff2Jo3V3o
z>(+d}^4vvpZ6a>p{9&1T?a?XgPlb9cAO4^J@bJNQnI%uy=Q8h1I<chr!PmUcPCs|%
zCp{?5U;Mpr&0P`x2lj#c*PIkFoD|w##wHuSSU`!7)4S|UwR>EBZjH&76Swaj`Y0P~
zJ&$|Eu`Bb!ZHw>n%t=kyxbS!G=GKdBGEo=aS+@1n@U>)Sv)(*+GUwP%?Uz1cXB{gu
zY*>`Fp6ol({B-Jx`}>zDZ?{<3&)EMr;ELqpSKc!xJvq#^C-~*>nfpaqjukDFe$Vsc
z+36{U-#m`~sNlN4y40ZS<Z7AiJ9cI6Gu^R#6YFn9hyNTCbrmx^Ub3vqdt2yKd}pTO
zw8uC8&+nX+9q0R0{nxAAHG2)@o*bAW`@?bm{9g?T*-VBXD%GR-%9a&ynnd#b_^^}j
zmaX~vlv&;ilWKeZS1$|Iv0T6Vc#&#ySJ(x9m*BP&F0QIQ5t;nyd)Mj2TH1B;T{3o_
z(Rm}{eNv`Iiye2z`3vrSWq0o%csoBYo2xgq=0r*D)hDIe9B;ape!ZR(J87-vCy&0g
zy$=<yZ#<h-ezn5xd__Ia#{)5^?yUQ>?Z4O@jWe@j^^VDE&v+QF^?y=k$F+A86i*bM
zZJ(QcV$teQCXJi(@-=0zwLaau>P_?WGf!vKURr6oqHR{wuNiZe8Jm}N76xbP`Zra5
zZD)NGe&^YP_8<YNmleN@PIoO<t?^4$Gg5we?~A~eg<(mvc?(|zct^Z!_*F9Dt69!Q
zm6_+AOwX%T)L-86D*Huj0N2liC5+QLQ!Zb6&i6W<lSyLR_4>m{cErChd%s^{4_EN{
z0Jo1E-2D1q?B_AuOnozb<CBbcMooEtUw`4SZ~y%-MYsKjWy)Ru$X1{EeeRDBFR|!O
zW1G#G6?($|ujB9BB~wgJy|9iteED>r$hyaOdMtYX^i;nvdHyk)sa9ERbuaH6y$t|J
Cn=_LD

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
index 0d62bb3..be4c1df 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -39,7 +39,7 @@ in
         }
       '';
 
-      ${service_configs.gitea.domain}.extraConfig = ''
+      "${service_configs.gitea.domain}".extraConfig = ''
         reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
       '';
 
@@ -78,7 +78,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} 0750 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${service_configs.https.data_dir} g+rwx ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];
diff --git a/services/matrix.nix b/services/matrix.nix
index df9f0ac..816f3d6 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,9 +12,6 @@
   services.matrix-conduit = {
     enable = true;
     package = pkgs.conduwuit;
-    # package = pkgs.conduwuit.overrideAttrs (old: {
-    #   cargoBuildFeatures = pkgs.lib.remove "release_max_log_level" old.cargoBuildFeatures;
-    # });
 
     settings.global = {
       port = 6167;
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 656a544..57bc643 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -59,7 +59,11 @@
         IncludeOverheadInLimits = false;
 
         GlobalMaxRatio = 2;
-        QueueingSystemEnabled = false; # seed all torrents all the time
+        QueueingSystemEnabled = false; # seed all torrents all the timei
+
+        # add a few trackers TODO! add a script so I can just do a list
+        AddTrackersEnabled = true;
+        AdditionalTrackers = "udp://tracker.opentrackr.org:1337/announce\\nudp://open.stealth.si:80/announce\\nudp://open.demonii.com:1337\\nudp://exodus.desync.com:6969/announce";
       };
     };
   };

From 3be617ba88de3dcd3c8f78ffafc7fa871064c4a4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 28 Jan 2025 21:29:13 -0500
Subject: [PATCH 071/847] overhaul of qbt + tmpfiles

---
 .gitattributes                  |   1 +
 configuration.nix               |  41 ++++++-
 flake.lock                      | 184 ++++++++++++++++++++++++++++++--
 flake.nix                       |   8 ++
 secrets/minecraft-whitelist.nix | Bin 353 -> 408 bytes
 secrets/zfs-key                 | Bin 0 -> 54 bytes
 services/caddy.nix              |   2 +-
 services/gitea.nix              |   2 +-
 services/immich.nix             |   2 +-
 services/jellyfin.nix           |   4 +-
 services/matrix.nix             |   2 +-
 services/minecraft.nix          |   6 +-
 services/owntracks.nix          |   2 +-
 services/qbittorrent.nix        |  23 ++--
 14 files changed, 246 insertions(+), 31 deletions(-)
 create mode 100644 secrets/zfs-key

diff --git a/.gitattributes b/.gitattributes
index 5238122..8771b43 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -6,3 +6,4 @@ secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
 secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
 secrets/owntracks_caddy_auth.nix filter=git-crypt diff=git-crypt
 secrets/secureboot.tar filter=git-crypt diff=git-crypt
+secrets/zfs-key filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 25ea396..ae78331 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -32,6 +32,12 @@
     hybrid-sleep.enable = false;
   };
 
+  powerManagement = {
+    powertop.enable = true;
+    enable = true;
+    cpuFreqGovernor = "powersave";
+  };
+
   nix = {
     # optimize the store
     optimise.automatic = true;
@@ -65,7 +71,6 @@
 
     loader = {
       # Use the systemd-boot EFI boot loader.
-      systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
 
       # 1s timeout
@@ -76,10 +81,32 @@
       compressor = "zstd";
     };
 
-    # kernelModules = [
-    #   # kernel module for case fan control
-    #   "nct6775"
-    # ];
+    kernelModules = [
+      "msr"
+    ];
+
+    loader.systemd-boot.enable = lib.mkForce false;
+
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+
+  system.activationScripts = {
+    # extract all my secureboot keys
+    "secureboot-keys".text = ''
+      #!/bin/sh
+      rm -fr ${config.boot.lanzaboote.pkiBundle} || true
+      mkdir -p ${config.boot.lanzaboote.pkiBundle}
+      ${pkgs.gnutar}/bin/tar xf /etc/nixos/secrets/secureboot.tar -C ${config.boot.lanzaboote.pkiBundle}
+    '';
+
+    "zfs-encryption-keys".text = ''
+      #!/bin/sh
+      rm -fr /etc/zfs-key
+      cp /etc/nixos/secrets/zfs-key /etc/zfs-key
+    '';
   };
 
   environment.etc = {
@@ -137,6 +164,8 @@
 
     wget
 
+    powertop
+
     (pkgs.writeScriptBin "mc-console" ''
       #!/bin/sh
       ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
@@ -172,6 +201,8 @@
 
     pfetch-rs
 
+    sbctl
+
   ];
 
   services.zfs = {
diff --git a/flake.lock b/flake.lock
index 0b9b65c..dfb48bb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,6 +1,37 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1673956053,
@@ -16,6 +47,27 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -34,6 +86,28 @@
         "type": "github"
       }
     },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -55,20 +129,45 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
         "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1737683037,
-        "narHash": "sha256-1J2Pf6ub2DkkoqRq2xEFrusJKR4XHnnFk0wyOPrV2PM=",
+        "lastModified": 1738028598,
+        "narHash": "sha256-0AjsOFj8Tyl1S8mEgr2MKCHIj0Y+/Gy275xas2kduqQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f80c70946d3e27a466b8b9e65b24e36d571eac8b",
+        "rev": "381b2e789876208216b26725009826c80c99399f",
         "type": "github"
       },
       "original": {
@@ -95,11 +194,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737672001,
-        "narHash": "sha256-YnHJJ19wqmibLQdUeq9xzE6CjrMA568KN/lFPuSVs4I=",
+        "lastModified": 1737885640,
+        "narHash": "sha256-GFzPxJzTd1rPIVD4IW+GwJlyGwBDV1Tj5FLYwDQQ9sM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "035f8c0853c2977b24ffc4d0a42c74f00b182cd8",
+        "rev": "4e96537f163fad24ed9eb317798a79afc85b51b7",
         "type": "github"
       },
       "original": {
@@ -111,11 +210,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1728358927,
-        "narHash": "sha256-8SUsg/Nmn8aEURRdZwxKKNnz22zRMyNwNoP1+aWnhlg=",
+        "lastModified": 1738103934,
+        "narHash": "sha256-MhDdcDDdK2uscLU370r3V9PQcejx+2LVbMG8bjCXMb0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ed446194bbf78795e4ec2d004da093116c93653f",
+        "rev": "4f4706686c921ef202712a00da1c96f0100f6921",
         "type": "github"
       },
       "original": {
@@ -125,9 +224,53 @@
         "type": "github"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
@@ -135,6 +278,27 @@
         "vpn-confinement": "vpn-confinement"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 166a722..8a93b37 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,6 +4,11 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
 
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     nix-minecraft = {
@@ -29,6 +34,7 @@
       vpn-confinement,
       nixpkgs-qbt,
       home-manager,
+      lanzaboote,
       ...
     }@inputs:
     let
@@ -115,6 +121,8 @@
               nixpkgs.overlays = [ nix-minecraft.overlay ];
             }
 
+            lanzaboote.nixosModules.lanzaboote
+
             home-manager.nixosModules.home-manager
             (
               {
diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 92ba758f1a2d7aca653b849cd160347f3e833799..5c7462f66d9489a9513db9e49d5dad2fc36f1f76 100644
GIT binary patch
literal 408
zcmZQ@_Y83kiVO&0SS&m_*o&!+yW)=76K9K;+Zu`(^LMpfdNP51`i76Ud!r_WluqO<
zyxM(X!N&TnD>ksJRMh{CURNdYi)XKM>8CA~CjAQUgf*ufUAt|~sXASm51W>8e7ZJg
zjlvxtceOT|Ysa}<)@(7C`txqVwuz6{sPI2fe6(Q6i(Z+|>qqsXkGtgmk~;nCn=I?*
z*$HpVbX5*Gy6D;bw|lfb;J21eag480Tu1mnmDw}v6|UvpK9#D|WGEK3ZsYnQZH}%3
z>KfhWnR}zm8KQ01zGmw1s5&&gWJ=<vZ~XR$-511JIYnM{jC^77QN{8*yXAx#59YH~
zo1Z-T;-7+*MQ~KfSJAX{Hoa3*{Ss_VHmxn}X+0R(w^eCv&Ew@#VtsS=rG95Tdpk+@
zmG~p4XF55pfB#obXB8-WTPaj&_Tx+c&4V{z_1Hcx>+xicF3QxiF8hA&<Nw4tQxe0{
zZ`ghLutg}&!_Q~iUD*KN+s+bf%7M?qmA%3Q9v$&r<Xxt*Qs$!3f$lqt{`AMqtUP~n
U9rLjhnx1+_^NuvRX3T#K00sKT+5i9m

literal 353
zcmZQ@_Y83kiVO&0SjJ(I;_O-(zD}a!%f_aO3x4?<zE+#R-L`t`J_(skGP%XI^DbU@
zdA(%opZ&o<yqh~~+TOHpGs!N}{avhF9;$wB&5GqIC*#&@J9Dp{rf#%U_Jv3IwId(q
zgfA=-KT`Is&G$)*i-(id3AXO&c^oDEGt)TUH5moO-1==<V<x0q$ENqUbMm9vC;7j&
zPnc?QNzy#1=bpbw)$N43s<pvSr^q-T%Tl+vc3jHv^VGeG%QUn8iZn_rk(SyXeAG{$
ze}{TD!!)r+Ht*{;bVdG;R}SQwwPR9aL6ggGcE2tE&+VCJV|_+6!@@T*GikvphV?Cq
zyMxvgF}_dZHNW}SBUMXxcWqx+c+XamqaW(_RX(}Wv5p~+&4~9^qLS+L)}<R;KW2W~
z`+wS`Jr{EfN@fa$D6!7U7ye}N_Gp;J;+bCa=B4W1UVQ$#>$13ip|N@<^XF_W{pt4O
O#@CPR?XN;jz5oD4(yIIb

diff --git a/secrets/zfs-key b/secrets/zfs-key
new file mode 100644
index 0000000000000000000000000000000000000000..35c226ca6a103c08dc5a1eac710b115d11661f17
GIT binary patch
literal 54
zcmZQ@_Y83kiVO&0$dsAJ>AfhyekHr^{=JN%av`rGmeg&u&tICYD5!U1a&+s-gB;xs
K=Gqx2Dg^-et`q(M

literal 0
HcmV?d00001

diff --git a/services/caddy.nix b/services/caddy.nix
index be4c1df..0c89c18 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -78,7 +78,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} g+rwx ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${service_configs.https.data_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];
diff --git a/services/gitea.nix b/services/gitea.nix
index 0bd615d..8c14677 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -31,7 +31,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.gitea.stateDir} 0750 ${config.services.gitea.user} ${config.services.gitea.group}"
+    "d ${config.services.gitea.stateDir} 0770 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
 
   services.postgresql = {
diff --git a/services/immich.nix b/services/immich.nix
index 3f51fba..98226ed 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -17,7 +17,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.immich.mediaLocation} 0750 ${config.services.immich.user} ${config.services.immich.group}"
+    "d ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
   ];
 
   environment.systemPackages = with pkgs; [
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 30bffb1..9db8244 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -23,8 +23,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.jellyfin.dataDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
-    "d ${config.services.jellyfin.cacheDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.dataDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.cacheDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
   ];
 
   users.users.${config.services.jellyfin.user}.extraGroups = [
diff --git a/services/matrix.nix b/services/matrix.nix
index 816f3d6..a00ede6 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -34,6 +34,6 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d /var/lib/private/matrix-conduit 0750 conduit conduit"
+    "d /var/lib/private/matrix-conduit 0770 conduit conduit"
   ];
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 6acc0a1..469a17b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -44,8 +44,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/8FAH9fuR/fabric-api-0.114.2%2B1.21.4.jar";
-              sha512 = "24ed904096a17f65ef2ee4b04e076df2df076bd7748c838573cf97f5b38d2353bf62fe202779fb0c8372a82fb1133e16ce1fba585e2ec5aa5a5164203e785072";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/S6sAWXmr/fabric-api-0.115.0%2B1.21.4.jar";
+              sha512 = "abb2b28e9b874adfc82c3c87ddf348e2e98adc5153aed7ae5bcaddf5b1d8bd98982a052ab91411b7fad3bbdffc5d788be60d22b9c95dd21e62b96ea49aa404ca";
             };
 
             FerriteCore = fetchurl {
@@ -84,7 +84,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 minecraft minecraft"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0770 minecraft minecraft"
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/owntracks.nix b/services/owntracks.nix
index 458f7b4..0019d7a 100644
--- a/services/owntracks.nix
+++ b/services/owntracks.nix
@@ -29,6 +29,6 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.owntracks.data_dir} 0750 owntracks owntracks"
+    "d ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
   ];
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 57bc643..28f9900 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -3,6 +3,7 @@
   config,
   service_configs,
   username,
+  lib,
   ...
 }:
 {
@@ -53,24 +54,34 @@
       Session = {
         GlobalUPSpeedLimit = 500; # in KiB/s
         GlobalDLSpeedLimit = 0;
+        IgnoreLimitsOnLAN = true;
 
         # Including overhead in limits ruins download because download
         # uses upload to communicate with seeders
         IncludeOverheadInLimits = false;
 
-        GlobalMaxRatio = 2;
-        QueueingSystemEnabled = false; # seed all torrents all the timei
+        GlobalMaxRatio = 3;
+        QueueingSystemEnabled = false; # seed all torrents all the time
 
-        # add a few trackers TODO! add a script so I can just do a list
         AddTrackersEnabled = true;
-        AdditionalTrackers = "udp://tracker.opentrackr.org:1337/announce\\nudp://open.stealth.si:80/announce\\nudp://open.demonii.com:1337\\nudp://exodus.desync.com:6969/announce";
+        AdditionalTrackers = (lib.concatStrings (
+          map (url: url + "\\n") [
+            "udp://tracker.opentrackr.org:1337/announce"
+            "udp://open.stealth.si:80/announce"
+            "udp://open.demonii.com:1337"
+            "udp://exodus.desync.com:6969/announce"
+            "udp://tracker.dler.org:6969/announce"
+            "udp://tracker.bittor.pw:1337/announce"
+            "udp://tracker.torrent.eu.org:451/announce"
+          ]
+        ));
       };
     };
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0755 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0755 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0770 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
   ];
 
   # make qbittorrent use a vpn

From 16d53e45890d873721819c524157189ea14f4154 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 29 Jan 2025 23:47:35 -0500
Subject: [PATCH 072/847] zfs full pool encryption

---
 configuration.nix        | 13 ++++++-------
 flake.lock               | 12 ++++++------
 services/minecraft.nix   |  4 ++--
 services/qbittorrent.nix | 24 +++++++++++++-----------
 4 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index ae78331..09703e9 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -101,14 +101,10 @@
       mkdir -p ${config.boot.lanzaboote.pkiBundle}
       ${pkgs.gnutar}/bin/tar xf /etc/nixos/secrets/secureboot.tar -C ${config.boot.lanzaboote.pkiBundle}
     '';
-
-    "zfs-encryption-keys".text = ''
-      #!/bin/sh
-      rm -fr /etc/zfs-key
-      cp /etc/nixos/secrets/zfs-key /etc/zfs-key
-    '';
   };
 
+  boot.initrd.secrets."/etc/zfs-key" = /etc/nixos/secrets/zfs-key;
+
   environment.etc = {
     "issue".text = "";
   };
@@ -292,6 +288,9 @@
       "wheel"
       "video"
       "render"
+      "postgres"
+      "owntracks"
+      "immich"
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
@@ -353,5 +352,5 @@
     "d ${config.services.postgresql.dataDir} 0700 postgres postgres"
   ];
 
-  system.stateVersion = "24.05";
+  system.stateVersion = "24.11";
 }
diff --git a/flake.lock b/flake.lock
index dfb48bb..f018f11 100644
--- a/flake.lock
+++ b/flake.lock
@@ -163,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738028598,
-        "narHash": "sha256-0AjsOFj8Tyl1S8mEgr2MKCHIj0Y+/Gy275xas2kduqQ=",
+        "lastModified": 1738201338,
+        "narHash": "sha256-yO1zdfkSyNWywriGUTRbDnJsoZkjFwpl/1DVwdv9GNA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "381b2e789876208216b26725009826c80c99399f",
+        "rev": "ce78a3fcb768948c3b2ed1196fdd124a4316a863",
         "type": "github"
       },
       "original": {
@@ -194,11 +194,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737885640,
-        "narHash": "sha256-GFzPxJzTd1rPIVD4IW+GwJlyGwBDV1Tj5FLYwDQQ9sM=",
+        "lastModified": 1738023785,
+        "narHash": "sha256-BPHmb3fUwdHkonHyHi1+x89eXB3kA1jffIpwPVJIVys=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4e96537f163fad24ed9eb317798a79afc85b51b7",
+        "rev": "2b4230bf03deb33103947e2528cac2ed516c5c89",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 469a17b..62f1f8b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -64,8 +64,8 @@ in
             };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/a8Zqa1bJ/Moonrise-Fabric-0.2.0-beta.7%2B6ec14ff.jar";
-              sha512 = "4ebc97764038aebd0b4bc5f6b25f9356419cf32f6c8bd64016665d9aad5c9f79ca9df2decac3038f7f713ff595c2b3286b3a1eb4d6debcd6639a52556416581a";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/J5ayzvZp/Moonrise-Fabric-0.2.0-beta.8%2B0cbff02.jar";
+              sha512 = "d6f8b698226ebfcd87635cc2796022b0dad030f1d9ff5fd77d184b729c4d0c1f7dcfd265ab0f80186178c8c89fbdce20407b1025af05edec8c4a4f8df605ebf6";
             };
 
             squaremap = fetchurl {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 28f9900..87bad24 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -64,17 +64,19 @@
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;
-        AdditionalTrackers = (lib.concatStrings (
-          map (url: url + "\\n") [
-            "udp://tracker.opentrackr.org:1337/announce"
-            "udp://open.stealth.si:80/announce"
-            "udp://open.demonii.com:1337"
-            "udp://exodus.desync.com:6969/announce"
-            "udp://tracker.dler.org:6969/announce"
-            "udp://tracker.bittor.pw:1337/announce"
-            "udp://tracker.torrent.eu.org:451/announce"
-          ]
-        ));
+        AdditionalTrackers = (
+          lib.concatStrings (
+            map (url: url + "\\n") [
+              "udp://tracker.opentrackr.org:1337/announce"
+              "udp://open.stealth.si:80/announce"
+              "udp://open.demonii.com:1337"
+              "udp://exodus.desync.com:6969/announce"
+              "udp://tracker.dler.org:6969/announce"
+              "udp://tracker.bittor.pw:1337/announce"
+              "udp://tracker.torrent.eu.org:451/announce"
+            ]
+          )
+        );
       };
     };
   };

From efeb7757f31309b67bad51cc9edd274e5d19a552 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 10:48:35 -0500
Subject: [PATCH 073/847] update

---
 configuration.nix |  6 ++----
 flake.lock        | 12 ++++++------
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 09703e9..260f14e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -60,6 +60,7 @@
 
   boot = {
     kernelPackages = pkgs.linuxPackages;
+    zfs.package = pkgs.zfs_unstable;
 
     kernelParams = [
       # 2048MB
@@ -81,10 +82,6 @@
       compressor = "zstd";
     };
 
-    kernelModules = [
-      "msr"
-    ];
-
     loader.systemd-boot.enable = lib.mkForce false;
 
     lanzaboote = {
@@ -103,6 +100,7 @@
     '';
   };
 
+  # encryption key for zpool (VERY IMPORTANT)
   boot.initrd.secrets."/etc/zfs-key" = /etc/nixos/secrets/zfs-key;
 
   environment.etc = {
diff --git a/flake.lock b/flake.lock
index f018f11..fe0cbff 100644
--- a/flake.lock
+++ b/flake.lock
@@ -163,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738201338,
-        "narHash": "sha256-yO1zdfkSyNWywriGUTRbDnJsoZkjFwpl/1DVwdv9GNA=",
+        "lastModified": 1738287839,
+        "narHash": "sha256-Vh060kC/aTX+e8Ru195wo+QySd0z91wJ++JZNSDJxy8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ce78a3fcb768948c3b2ed1196fdd124a4316a863",
+        "rev": "58f1ae4ac2620cbcef912e32b17f9a64fcb372ad",
         "type": "github"
       },
       "original": {
@@ -194,11 +194,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738023785,
-        "narHash": "sha256-BPHmb3fUwdHkonHyHi1+x89eXB3kA1jffIpwPVJIVys=",
+        "lastModified": 1738163270,
+        "narHash": "sha256-B/7Y1v4y+msFFBW1JAdFjNvVthvNdJKiN6EGRPnqfno=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2b4230bf03deb33103947e2528cac2ed516c5c89",
+        "rev": "59e618d90c065f55ae48446f307e8c09565d5ab0",
         "type": "github"
       },
       "original": {

From 79cfbff95248b94152fb10ba47d24d7985942937 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 11:12:31 -0500
Subject: [PATCH 074/847] nits

---
 configuration.nix   |  2 --
 disk-config.nix     | 33 +++++++++++++++++++++++++++++++++
 flake.nix           |  9 +++++++++
 services/caddy.nix  |  2 +-
 services/gitea.nix  |  2 +-
 services/immich.nix |  5 +++++
 6 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 disk-config.nix

diff --git a/configuration.nix b/configuration.nix
index 260f14e..f3b9b23 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -196,7 +196,6 @@
     pfetch-rs
 
     sbctl
-
   ];
 
   services.zfs = {
@@ -288,7 +287,6 @@
       "render"
       "postgres"
       "owntracks"
-      "immich"
     ];
     hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
 
diff --git a/disk-config.nix b/disk-config.nix
new file mode 100644
index 0000000..2782928
--- /dev/null
+++ b/disk-config.nix
@@ -0,0 +1,33 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        # When using disko-install, we will overwrite this value from the commandline
+        device = "/dev/disk/by-id/some-disk-id";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/flake.nix b/flake.nix
index 8a93b37..5cf9db4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,6 +24,11 @@
       url = "github:nix-community/home-manager/release-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -35,6 +40,7 @@
       nixpkgs-qbt,
       home-manager,
       lanzaboote,
+      disko,
       ...
     }@inputs:
     let
@@ -54,6 +60,7 @@
           ollama = 11434;
           bitmagnet = 3333;
           owntracks = 3825;
+          gitea = 2283;
         };
 
         https = {
@@ -108,6 +115,8 @@
         };
         modules =
           [
+            ./disk-config.nix
+            disko.nixosModules.disko
             ./configuration.nix
 
             vpn-confinement.nixosModules.default
diff --git a/services/caddy.nix b/services/caddy.nix
index 0c89c18..1ded345 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -52,7 +52,7 @@ in
       "torrent.${service_configs.https.domain}".extraConfig = ''
         # tls internal
         ${import ../secrets/caddy_auth.nix}
-        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}
+        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
       '';
 
       "map.${service_configs.https.domain}".extraConfig = ''
diff --git a/services/gitea.nix b/services/gitea.nix
index 8c14677..013c2b4 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -18,7 +18,7 @@
       server = {
         DOMAIN = service_configs.gitea.domain;
         ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
-        HTTP_PORT = 3281;
+        HTTP_PORT = service_configs.ports.gitea;
         LANDING_PAGE = "/explore/repos";
       };
       session = {
diff --git a/services/immich.nix b/services/immich.nix
index 98226ed..9228ed5 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -2,6 +2,7 @@
   service_configs,
   pkgs,
   config,
+  username,
   ...
 }:
 {
@@ -28,4 +29,8 @@
     "video"
     "render"
   ];
+
+  users.users.${username}.extraGroups = [
+    config.services.immich.group
+  ];
 }

From 196259d48fcac5d5a00e0771e9bfd12fbf4e39d9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 11:13:02 -0500
Subject: [PATCH 075/847] remove some stuff

---
 hardware.nix | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/hardware.nix b/hardware.nix
index 728a2cd..bdaa6b7 100644
--- a/hardware.nix
+++ b/hardware.nix
@@ -17,20 +17,6 @@
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f467d1e8-5f00-40ee-aa67-55a999181918";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/96DC-6E54";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-
   # 3tb HDD
   fileSystems.${service_configs.hdd_path} = {
     device = "/dev/disk/by-uuid/f69b8c84-20ca-448f-b580-8951f20b9fc1";

From d6939c089b1222783f3104ca7d06d391fa24e813 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 20:13:37 -0500
Subject: [PATCH 076/847] overhaul

---
 configuration.nix        | 64 ++++++++++++++++++++--------------------
 flake.lock               | 39 ++++++++++++++++++------
 flake.nix                |  4 ++-
 services/jellyfin.nix    |  1 +
 services/minecraft.nix   |  7 +++++
 services/owntracks.nix   | 11 ++++++-
 services/qbittorrent.nix |  8 +++--
 zfs.nix                  | 29 ++++++++++++++++++
 8 files changed, 118 insertions(+), 45 deletions(-)
 create mode 100644 zfs.nix

diff --git a/configuration.nix b/configuration.nix
index f3b9b23..3de7cd8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -11,6 +11,7 @@
 {
   imports = [
     ./hardware.nix
+    ./zfs.nix
     ./services/jellyfin.nix
     ./services/caddy.nix
     ./services/immich.nix
@@ -60,15 +61,6 @@
 
   boot = {
     kernelPackages = pkgs.linuxPackages;
-    zfs.package = pkgs.zfs_unstable;
-
-    kernelParams = [
-      # 2048MB
-      "zfs.zfs_arc_max=2048000000"
-    ];
-
-    supportedFilesystems = [ "zfs" ];
-    zfs.extraPools = [ "tank" ];
 
     loader = {
       # Use the systemd-boot EFI boot loader.
@@ -96,13 +88,10 @@
       #!/bin/sh
       rm -fr ${config.boot.lanzaboote.pkiBundle} || true
       mkdir -p ${config.boot.lanzaboote.pkiBundle}
-      ${pkgs.gnutar}/bin/tar xf /etc/nixos/secrets/secureboot.tar -C ${config.boot.lanzaboote.pkiBundle}
+      ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
     '';
   };
 
-  # encryption key for zpool (VERY IMPORTANT)
-  boot.initrd.secrets."/etc/zfs-key" = /etc/nixos/secrets/zfs-key;
-
   environment.etc = {
     "issue".text = "";
   };
@@ -160,25 +149,32 @@
 
     powertop
 
-    (pkgs.writeScriptBin "mc-console" ''
-      #!/bin/sh
-      ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
-    '')
+    (pkgs.writeShellApplication {
+      name = "disk-smart-test";
+      runtimeInputs = with pkgs; [
+        gnugrep
+        coreutils
+        smartmontools
+      ];
 
-    (pkgs.writeScriptBin "disk-smart-test" ''
-      #!/bin/sh
-      set -e
-      if [[ $EUID -ne 0 ]]; then
-        echo "This command requires root."
-        exit 2
-      fi
+      # i gotta fix that
+      excludeShellChecks = [ "SC2010" ];
 
-      DISKS=$(${pkgs.coreutils}/bin/ls /dev/sd* | ${pkgs.gnugrep}/bin/grep -v "[0-9]$")
-      for i in $DISKS; do
-        ${pkgs.coreutils}/bin/echo -n "$i "
-        ${pkgs.smartmontools}/bin/smartctl -a "$i" | ${pkgs.gnugrep}/bin/grep "SMART overall-health self-assessment test result:" | ${pkgs.coreutils}/bin/cut -d' ' -f6
-      done
-    '')
+      text = ''
+        #!/bin/sh
+        set -e
+        if [[ $EUID -ne 0 ]]; then
+          echo "This command requires root."
+          exit 2
+        fi
+
+        DISKS=$(ls /dev/sd* | grep -v "[0-9]$")
+        for i in $DISKS; do
+          echo -n "$i "
+          smartctl -a "$i" | grep "SMART overall-health self-assessment test result:" | cut -d' ' -f6
+        done
+      '';
+    })
 
     (pkgs.writeShellApplication {
       name = "reflac";
@@ -279,6 +275,8 @@
     # };
   };
 
+  users.groups.${service_configs.torrent_group} = { };
+
   users.users.${username} = {
     isNormalUser = true;
     extraGroups = [
@@ -286,9 +284,11 @@
       "video"
       "render"
       "postgres"
-      "owntracks"
+      "media"
+      service_configs.torrent_group
     ];
-    hashedPasswordFile = "/etc/nixos/secrets/hashedPass";
+
+    hashedPasswordFile = "${./secrets/hashedPass}";
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
diff --git a/flake.lock b/flake.lock
index fe0cbff..1281959 100644
--- a/flake.lock
+++ b/flake.lock
@@ -15,6 +15,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1738148035,
+        "narHash": "sha256-KYOATYEwaKysL3HdHdS5kbQMXvzS4iPJzJrML+3TKAo=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "18d0a984cc2bc82cf61df19523a34ad463aa7f54",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -163,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738287839,
-        "narHash": "sha256-Vh060kC/aTX+e8Ru195wo+QySd0z91wJ++JZNSDJxy8=",
+        "lastModified": 1738374527,
+        "narHash": "sha256-OcZG42dKolSREIIBM39/kY2TqykihbtYopQSjBbgBjM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "58f1ae4ac2620cbcef912e32b17f9a64fcb372ad",
+        "rev": "2c815583946bcf1f7327c89fdf9bb4af7f3f5a14",
         "type": "github"
       },
       "original": {
@@ -178,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1737751639,
-        "narHash": "sha256-ZEbOJ9iT72iwqXsiEMbEa8wWjyFvRA9Ugx8utmYbpz4=",
+        "lastModified": 1738391520,
+        "narHash": "sha256-6HI58PKjddsC0RA0gBQlt6ox47oH//jLUHwx05RO8g0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "dfad538f751a5aa5d4436d9781ab27a6128ec9d4",
+        "rev": "34b64e4e1ddb14e3ffc7db8d4a781396dbbab773",
         "type": "github"
       },
       "original": {
@@ -194,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738163270,
-        "narHash": "sha256-B/7Y1v4y+msFFBW1JAdFjNvVthvNdJKiN6EGRPnqfno=",
+        "lastModified": 1738277201,
+        "narHash": "sha256-6L+WXKCw5mqnUIExvqkD99pJQ41xgyCk6z/H9snClwk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "59e618d90c065f55ae48446f307e8c09565d5ab0",
+        "rev": "666e1b3f09c267afd66addebe80fb05a5ef2b554",
         "type": "github"
       },
       "original": {
@@ -269,6 +289,7 @@
     },
     "root": {
       "inputs": {
+        "disko": "disko",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "nix-minecraft": "nix-minecraft",
diff --git a/flake.nix b/flake.nix
index 5cf9db4..13ab5be 100644
--- a/flake.nix
+++ b/flake.nix
@@ -46,11 +46,13 @@
     let
       username = "primary";
       hostname = "muffin";
-      eth_interface = "enp3s0";
+      eth_interface = "enp4s0";
 
       service_configs = rec {
+        zpool = "tank";
         hdd_path = "/mnt/hdd";
         services_dir = "/tank/services";
+        torrent_group = "media";
 
         # TODO: add checks to make sure none of these collide
         ports = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 9db8244..8008002 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -30,6 +30,7 @@
   users.users.${config.services.jellyfin.user}.extraGroups = [
     "video"
     "render"
+    service_configs.torrent_group
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 62f1f8b..03e90ca 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -9,6 +9,13 @@ let
   heap_size = "4000M";
 in
 {
+  environment.systemPackages = [
+    (pkgs.writeScriptBin "mc-console" ''
+      #!/bin/sh
+      ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
+    '')
+  ];
+
   nixpkgs.config.allowUnfreePredicate =
     pkg:
     builtins.elem (lib.getName pkg) [
diff --git a/services/owntracks.nix b/services/owntracks.nix
index 0019d7a..c246e10 100644
--- a/services/owntracks.nix
+++ b/services/owntracks.nix
@@ -1,4 +1,9 @@
-{ pkgs, service_configs, ... }:
+{
+  pkgs,
+  service_configs,
+  username,
+  ...
+}:
 let
   owntracks_pkg = pkgs.owntracks-recorder.overrideAttrs (old: {
     installPhase =
@@ -31,4 +36,8 @@ in
   systemd.tmpfiles.rules = [
     "d ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
   ];
+
+  users.users.${username}.extraGroups = [
+    "owntracks"
+  ];
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 87bad24..592f52b 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -82,8 +82,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0770 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0770 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
   ];
 
   # make qbittorrent use a vpn
@@ -92,6 +92,10 @@
     vpnNamespace = "wg";
   };
 
+  users.users.${config.services.qbittorrent.user}.extraGroups = [
+    service_configs.torrent_group
+  ];
+
   users.users.${username}.extraGroups = [
     config.services.qbittorrent.group
   ];
diff --git a/zfs.nix b/zfs.nix
new file mode 100644
index 0000000..eb0c215
--- /dev/null
+++ b/zfs.nix
@@ -0,0 +1,29 @@
+{
+  service_configs,
+  config,
+  pkgs,
+  ...
+}:
+let
+  zfs-key = "/etc/zfs-key";
+in
+{
+  system.activationScripts = {
+    "zfs-key".text = ''
+      #!/bin/sh
+      rm -fr ${zfs-key} || true
+      cp ${./secrets/zfs-key} ${zfs-key}
+    '';
+  };
+
+  boot.zfs.package = pkgs.zfs_unstable;
+  boot.initrd.kernelModules = [ "zfs" ];
+
+  boot.kernelParams = [
+    # 2048MB
+    "zfs.zfs_arc_max=2048000000"
+  ];
+
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.zfs.extraPools = [ service_configs.zpool ];
+}

From 141acf762aef0fbf118e232b9e414ee083030e10 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 21:32:26 -0500
Subject: [PATCH 077/847] cleanup

---
 .gitattributes                   |   4 +--
 configuration.nix                |  44 +++++++++++++--------------
 disk-config.nix                  |   2 --
 flake.nix                        |   1 +
 secrets/caddy_auth               | Bin 0 -> 106 bytes
 secrets/caddy_auth.nix           | Bin 108 -> 0 bytes
 secrets/owntracks_caddy_auth     | Bin 0 -> 110 bytes
 secrets/owntracks_caddy_auth.nix | Bin 112 -> 0 bytes
 services/bitmagnet.nix           |  15 +++++++++-
 services/caddy.nix               |  50 -------------------------------
 services/gitea.nix               |   4 +++
 services/immich.nix              |   4 +++
 services/jellyfin.nix            |   7 +++++
 services/matrix.nix              |  17 +++++++++++
 services/owntracks.nix           |   5 ++++
 services/postgresql.nix          |  21 +++++++++++++
 services/qbittorrent.nix         |   6 ++++
 zfs.nix                          |   1 -
 18 files changed, 102 insertions(+), 79 deletions(-)
 create mode 100644 secrets/caddy_auth
 delete mode 100644 secrets/caddy_auth.nix
 create mode 100644 secrets/owntracks_caddy_auth
 delete mode 100644 secrets/owntracks_caddy_auth.nix
 create mode 100644 services/postgresql.nix

diff --git a/.gitattributes b/.gitattributes
index 8771b43..ecba705 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,8 +2,8 @@ secrets/murmur_password filter=git-crypt diff=git-crypt
 secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
 secrets/wg0.conf filter=git-crypt diff=git-crypt
-secrets/caddy_auth.nix filter=git-crypt diff=git-crypt
+secrets/caddy_auth filter=git-crypt diff=git-crypt
 secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
-secrets/owntracks_caddy_auth.nix filter=git-crypt diff=git-crypt
+secrets/owntracks_caddy_auth filter=git-crypt diff=git-crypt
 secrets/secureboot.tar filter=git-crypt diff=git-crypt
 secrets/zfs-key filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 3de7cd8..205b57f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -12,6 +12,7 @@
   imports = [
     ./hardware.nix
     ./zfs.nix
+    ./services/postgresql.nix
     ./services/jellyfin.nix
     ./services/caddy.nix
     ./services/immich.nix
@@ -20,9 +21,7 @@
     ./services/wg.nix
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
-
     ./services/matrix.nix
-
     ./services/owntracks.nix
   ];
 
@@ -209,21 +208,32 @@
 
   systemd.services.no-rgb =
     let
-      no-rgb = pkgs.writeScriptBin "no-rgb" ''
-        #!/bin/sh
-        set -e
+      no-rgb = (
+        pkgs.writeShellApplication {
+          name = "no-rgb";
+          runtimeInputs = with pkgs; [
+            openrgb
+            coreutils
+            gnugrep
+          ];
 
-        NUM_DEVICES=$(${pkgs.openrgb}/bin/openrgb --noautoconnect --list-devices | ${pkgs.gnugrep}/bin/grep -E '^[0-9]+: ' | ${pkgs.coreutils}/bin/wc -l)
+          text = ''
+            #!/bin/sh
+            set -e
 
-        for i in $(${pkgs.coreutils}/bin/seq 0 $(($NUM_DEVICES - 1))); do
-          ${pkgs.openrgb}/bin/openrgb --noautoconnect --device $i --mode direct --color 000000
-        done
-      '';
+            NUM_DEVICES=$(openrgb --noautoconnect --list-devices | grep -cE '^[0-9]+: ')
+
+            for i in $(seq 0 $((NUM_DEVICES - 1))); do
+              openrgb --noautoconnect --device "$i" --mode direct --color 000000
+            done
+          '';
+        }
+      );
     in
     {
       description = "disable rgb";
       serviceConfig = {
-        ExecStart = "${no-rgb}/bin/no-rgb";
+        ExecStart = "${no-rgb}/bin/${no-rgb.name}";
         Type = "oneshot";
       };
       wantedBy = [ "multi-user.target" ];
@@ -283,8 +293,6 @@
       "wheel"
       "video"
       "render"
-      "postgres"
-      "media"
       service_configs.torrent_group
     ];
 
@@ -338,15 +346,5 @@
   #   };
   # };
 
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_16;
-    dataDir = "/tank/services/sql";
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${config.services.postgresql.dataDir} 0700 postgres postgres"
-  ];
-
   system.stateVersion = "24.11";
 }
diff --git a/disk-config.nix b/disk-config.nix
index 2782928..25580ff 100644
--- a/disk-config.nix
+++ b/disk-config.nix
@@ -2,8 +2,6 @@
   disko.devices = {
     disk = {
       main = {
-        # When using disko-install, we will overwrite this value from the commandline
-        device = "/dev/disk/by-id/some-disk-id";
         type = "disk";
         content = {
           type = "gpt";
diff --git a/flake.nix b/flake.nix
index 13ab5be..3934d81 100644
--- a/flake.nix
+++ b/flake.nix
@@ -70,6 +70,7 @@
           data_dir = services_dir + "/http";
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
+          matrix_hostname = "matrix.${service_configs.https.domain}";
         };
 
         gitea = {
diff --git a/secrets/caddy_auth b/secrets/caddy_auth
new file mode 100644
index 0000000000000000000000000000000000000000..8871a692382bb62587cfceb82fa96e1f8bbdaf9d
GIT binary patch
literal 106
zcmZQ@_Y83kiVO&0SUoX*`6Yqc&|US#cj6)+yl8T>4m~Kg_sIGAoOTNzt4r8?*w@gu
zPuFUd;QRy8`KislYQGk3vpU%KB<X&Rh}O&H4r;GW4$EBXoqqn>*NMf+uTK4E^7wO2
O@Lfo$y#EzTiO&FPq%`6H

literal 0
HcmV?d00001

diff --git a/secrets/caddy_auth.nix b/secrets/caddy_auth.nix
deleted file mode 100644
index d85fde0cb0919be86c63cf2752b259e77d8a5c43..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 108
zcmZQ@_Y83kiVO&0urF+x_vstA(@7h*S8kVE3*OgP9dB7}QOu~<Up(vGS!>pH2CJWx
z$lme)EB8rFH}3zv@)c`!az4M?<x$|gW33DGN8XK6la?z!<em|$^Y*KmpZ&Y%f)`xh
QaIN&NQ|`;SQGe+q0J!Qjy#N3J

diff --git a/secrets/owntracks_caddy_auth b/secrets/owntracks_caddy_auth
new file mode 100644
index 0000000000000000000000000000000000000000..2cd6cbc0dd4af78dc4c30b9f7223e22f7d8a8840
GIT binary patch
literal 110
zcmZQ@_Y83kiVO&0$eIz5na8s4gYN35!K`=6h1l&Lw6CAof9b5qiFeoT=>45+rh70s
zh1XtP^oQHJdFoGnCCXj}3O3(sthlJGwRdq~o|*pp#di|IxBE}Bn{sA_Y2fGh7}qZ^
S59vK<F^Qa{deSsFC=~#$-7`f1

literal 0
HcmV?d00001

diff --git a/secrets/owntracks_caddy_auth.nix b/secrets/owntracks_caddy_auth.nix
deleted file mode 100644
index f353a8b4d3c2d3e0319567ad576b5d6943eecd3a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 112
zcmZQ@_Y83kiVO&0aB4XCz3n86ELVH3hvbu+%heiL9a8sQ`D`!Vd?WLuUFWQZUB~qf
z?$qXbyr@j)Tg^27V{wlY|4sTQ!K>yr=Yy38li@DW_CTw@&+fZU@47vsif{Y00~_Bz
VSz=nZJ@S;&%(`Ft9_J3c0RSplHw*v(

diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 8fcf96a..16a0d84 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -1,4 +1,9 @@
-{ pkgs, service_configs, ... }:
+{
+  pkgs,
+  service_configs,
+  config,
+  ...
+}:
 {
   vpnNamespaces.wg = {
     portMappings = [
@@ -30,6 +35,14 @@
     };
   };
 
+  services.caddy.virtualHosts.
+
+  "bitmagnet.${service_configs.https.domain}".extraConfig =
+    ''
+      # tls internal
+      ${builtins.readFile ../secrets/caddy_auth}
+      reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
+    '';
   systemd.services.bitmagnet.vpnConfinement = {
     enable = true;
     vpnNamespace = "wg";
diff --git a/services/caddy.nix b/services/caddy.nix
index 1ded345..8e56c73 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -5,9 +5,6 @@
   pkgs,
   ...
 }:
-let
-  matrix_hostname = "matrix.${service_configs.https.domain}";
-in
 {
   services.caddy = {
     enable = true;
@@ -15,12 +12,6 @@ in
     virtualHosts = {
       ${service_configs.https.domain} = {
         extraConfig = ''
-
-          header /.well-known/matrix/* Content-Type application/json
-          header /.well-known/matrix/* Access-Control-Allow-Origin *
-          respond /.well-known/matrix/server `{"m.server": "${matrix_hostname}:443"}`
-          respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${matrix_hostname}"},"m.homeserver":{"base_url":"https://${matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
-
           root * ${service_configs.https.data_dir}
           file_server browse
         '';
@@ -28,52 +19,11 @@ in
         serverAliases = [ "www.${service_configs.https.domain}" ];
       };
 
-      "immich.${service_configs.https.domain}".extraConfig = ''
-        reverse_proxy :${builtins.toString config.services.immich.port}
-      '';
-
-      "jellyfin.${service_configs.https.domain}".extraConfig = ''
-        reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
-        request_body {
-        	max_size 4096MB
-        }
-      '';
-
-      "${service_configs.gitea.domain}".extraConfig = ''
-        reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
-      '';
-
-      "bitmagnet.${service_configs.https.domain}".extraConfig = ''
-        # tls internal
-        ${import ../secrets/caddy_auth.nix}
-        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
-      '';
-
-      "torrent.${service_configs.https.domain}".extraConfig = ''
-        # tls internal
-        ${import ../secrets/caddy_auth.nix}
-        reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
-      '';
-
       "map.${service_configs.https.domain}".extraConfig = ''
         # tls internal
         root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
         file_server browse
       '';
-
-      "${matrix_hostname}".extraConfig = ''
-        reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
-      '';
-
-      # Exact duplicate of matrix.DOMAIN_NAME
-      "${matrix_hostname}:8448".extraConfig =
-        config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
-        }".extraConfig;
-
-      "owntracks.${service_configs.https.domain}".extraConfig = ''
-        ${import ../secrets/owntracks_caddy_auth.nix}
-        reverse_proxy :${builtins.toString service_configs.ports.owntracks}
-      '';
     };
   };
 
diff --git a/services/gitea.nix b/services/gitea.nix
index 013c2b4..e5b07fb 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -30,6 +30,10 @@
     };
   };
 
+  services.caddy.virtualHosts."${service_configs.gitea.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
+  '';
+
   systemd.tmpfiles.rules = [
     "d ${config.services.gitea.stateDir} 0770 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
diff --git a/services/immich.nix b/services/immich.nix
index 9228ed5..37634da 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -17,6 +17,10 @@
     };
   };
 
+  services.caddy.virtualHosts."immich.${service_configs.https.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString config.services.immich.port}
+  '';
+
   systemd.tmpfiles.rules = [
     "d ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
   ];
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 8008002..d67cfe6 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -22,6 +22,13 @@
     cacheDir = dataDir + "_cache";
   };
 
+  services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
+    request_body {
+    	max_size 4096MB
+    }
+  '';
+
   systemd.tmpfiles.rules = [
     "d ${config.services.jellyfin.dataDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
     "d ${config.services.jellyfin.cacheDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
diff --git a/services/matrix.nix b/services/matrix.nix
index a00ede6..cb05217 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  lib,
   ...
 }:
 {
@@ -9,6 +10,22 @@
     ../secrets/matrix_reg_token.nix
   ];
 
+  services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
+    header /.well-known/matrix/* Content-Type application/json
+    header /.well-known/matrix/* Access-Control-Allow-Origin *
+    respond /.well-known/matrix/server `{"m.server": "${service_configs.https.matrix_hostname}:443"}`
+    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.https.matrix_hostname}"},"m.homeserver":{"base_url":"https://${service_configs.https.matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
+  '';
+
+  services.caddy.virtualHosts."${service_configs.https.matrix_hostname}".extraConfig = ''
+    reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
+  '';
+
+  # Exact duplicate
+  services.caddy.virtualHosts."${service_configs.https.matrix_hostname}:8448".extraConfig =
+    config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
+    }".extraConfig;
+
   services.matrix-conduit = {
     enable = true;
     package = pkgs.conduwuit;
diff --git a/services/owntracks.nix b/services/owntracks.nix
index c246e10..3def720 100644
--- a/services/owntracks.nix
+++ b/services/owntracks.nix
@@ -37,6 +37,11 @@ in
     "d ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
   ];
 
+  services.caddy.virtualHosts."owntracks.${service_configs.https.domain}".extraConfig = ''
+    ${builtins.readFile ../secrets/owntracks_caddy_auth}
+    reverse_proxy :${builtins.toString service_configs.ports.owntracks}
+  '';
+
   users.users.${username}.extraGroups = [
     "owntracks"
   ];
diff --git a/services/postgresql.nix b/services/postgresql.nix
new file mode 100644
index 0000000..b120aa0
--- /dev/null
+++ b/services/postgresql.nix
@@ -0,0 +1,21 @@
+{
+  pkgs,
+  config,
+  username,
+  ...
+}:
+{
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_16;
+    dataDir = "/tank/services/sql";
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
+  ];
+
+  users.users.${username}.extraGroups = [
+    "postgresql"
+  ];
+}
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 592f52b..a594dc8 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -92,6 +92,12 @@
     vpnNamespace = "wg";
   };
 
+  services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
+    # tls internal
+    ${builtins.readFile ../secrets/caddy_auth}
+    reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
+  '';
+
   users.users.${config.services.qbittorrent.user}.extraGroups = [
     service_configs.torrent_group
   ];
diff --git a/zfs.nix b/zfs.nix
index eb0c215..1aa8ae7 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -1,6 +1,5 @@
 {
   service_configs,
-  config,
   pkgs,
   ...
 }:

From 0c3a4b916db2134361ae59e8ce6050f559445c58 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 23:10:51 -0500
Subject: [PATCH 078/847] fix gitea and stuff

---
 configuration.nix       | 1 +
 services/gitea.nix      | 7 ++++++-
 services/postgresql.nix | 1 +
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 205b57f..28cee28 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -102,6 +102,7 @@
   services.openssh = {
     enable = true;
     settings = {
+      AllowUsers = [ username ];
       PasswordAuthentication = false;
       PermitRootLogin = "no";
     };
diff --git a/services/gitea.nix b/services/gitea.nix
index e5b07fb..ac337cc 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -16,10 +16,12 @@
 
     settings = {
       server = {
+        SSH_USER = "gitea";
         DOMAIN = service_configs.gitea.domain;
         ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
         HTTP_PORT = service_configs.ports.gitea;
         LANDING_PAGE = "/explore/repos";
+        DISABLE_HTTP_GIT = true;
       };
       session = {
         # https cookies or smth
@@ -35,7 +37,8 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.gitea.stateDir} 0770 ${config.services.gitea.user} ${config.services.gitea.group}"
+    # 0700 for ssh permission reasons
+    "d ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
 
   services.postgresql = {
@@ -49,6 +52,8 @@
     ];
   };
 
+  services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
+
   users.users.${username}.extraGroups = [
     config.services.gitea.group
   ];
diff --git a/services/postgresql.nix b/services/postgresql.nix
index b120aa0..afd552e 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -12,6 +12,7 @@
   };
 
   systemd.tmpfiles.rules = [
+    # postgresql requires 0700
     "d ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
   ];
 

From 9776e971dbd747d46bd71933a20664704b8827e2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 1 Feb 2025 23:36:08 -0500
Subject: [PATCH 079/847] fix immich v gitea port collision

---
 services/immich.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/immich.nix b/services/immich.nix
index 37634da..a0c0dc4 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -9,7 +9,7 @@
   services.immich = {
     enable = true;
     mediaLocation = service_configs.immich.dir;
-    port = 2283;
+    port = 2284;
     # openFirewall = true;
     host = "0.0.0.0";
     database = {

From 040f527f2dda7eba0fc87ac747994da27ca6c5d3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 3 Feb 2025 11:50:44 -0500
Subject: [PATCH 080/847] changes

---
 .gitattributes               |   2 +-
 configuration.nix            |  17 ++++-------------
 flake.lock                   |  18 +++++++++---------
 flake.nix                    |   1 +
 secrets/matrix_reg_token     | Bin 0 -> 55 bytes
 secrets/matrix_reg_token.nix | Bin 134 -> 0 bytes
 services/immich.nix          |   2 +-
 services/matrix.nix          |   5 ++---
 services/minecraft.nix       |   4 ++--
 zfs.nix                      |  17 +++++++++++++++++
 10 files changed, 37 insertions(+), 29 deletions(-)
 create mode 100644 secrets/matrix_reg_token
 delete mode 100644 secrets/matrix_reg_token.nix

diff --git a/.gitattributes b/.gitattributes
index ecba705..37dc6c6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,7 +3,7 @@ secrets/hashedPass filter=git-crypt diff=git-crypt
 secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
 secrets/wg0.conf filter=git-crypt diff=git-crypt
 secrets/caddy_auth filter=git-crypt diff=git-crypt
-secrets/matrix_reg_token.nix filter=git-crypt diff=git-crypt
+secrets/matrix_reg_token filter=git-crypt diff=git-crypt
 secrets/owntracks_caddy_auth filter=git-crypt diff=git-crypt
 secrets/secureboot.tar filter=git-crypt diff=git-crypt
 secrets/zfs-key filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 28cee28..fbdf9a6 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -194,19 +194,6 @@
     sbctl
   ];
 
-  services.zfs = {
-    autoScrub.enable = true;
-    trim.enable = true;
-    autoSnapshot = {
-      enable = true;
-      frequent = 4; # 15-minutes
-      hourly = 24;
-      daily = 7;
-      weekly = 4;
-      monthly = 12;
-    };
-  };
-
   systemd.services.no-rgb =
     let
       no-rgb = (
@@ -347,5 +334,9 @@
   #   };
   # };
 
+  systemd.tmpfiles.rules = [
+    "d /tank/music 775 ${username} users"
+  ];
+
   system.stateVersion = "24.11";
 }
diff --git a/flake.lock b/flake.lock
index 1281959..0522216 100644
--- a/flake.lock
+++ b/flake.lock
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738374527,
-        "narHash": "sha256-OcZG42dKolSREIIBM39/kY2TqykihbtYopQSjBbgBjM=",
+        "lastModified": 1738547119,
+        "narHash": "sha256-cc6AfR7W0AavgqA5nHUXRUus4Rr7oPWQNku5nhR4SYs=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "2c815583946bcf1f7327c89fdf9bb4af7f3f5a14",
+        "rev": "5b93268c80c3300dbec0fbbb2b50f674f84a474a",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1738391520,
-        "narHash": "sha256-6HI58PKjddsC0RA0gBQlt6ox47oH//jLUHwx05RO8g0=",
+        "lastModified": 1738471961,
+        "narHash": "sha256-cgXDFrplNGs7bCVzXhRofjD8oJYqqXGcmUzXjHmip6Y=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "34b64e4e1ddb14e3ffc7db8d4a781396dbbab773",
+        "rev": "537286c3c59b40311e5418a180b38034661d2536",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738277201,
-        "narHash": "sha256-6L+WXKCw5mqnUIExvqkD99pJQ41xgyCk6z/H9snClwk=",
+        "lastModified": 1738435198,
+        "narHash": "sha256-5+Hmo4nbqw8FrW85FlNm4IIrRnZ7bn0cmXlScNsNRLo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "666e1b3f09c267afd66addebe80fb05a5ef2b554",
+        "rev": "f6687779bf4c396250831aa5a32cbfeb85bb07a3",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 3934d81..25a84ba 100644
--- a/flake.nix
+++ b/flake.nix
@@ -63,6 +63,7 @@
           bitmagnet = 3333;
           owntracks = 3825;
           gitea = 2283;
+          immich = 2284;
         };
 
         https = {
diff --git a/secrets/matrix_reg_token b/secrets/matrix_reg_token
new file mode 100644
index 0000000000000000000000000000000000000000..206fd319d29af83c6aca65d7d50891833acb1596
GIT binary patch
literal 55
zcmZQ@_Y83kiVO&0h|ItFZvRfPm4EMQ9N2m3hep`}Yi(~A@#v5nZG5j+#b2mh^dLd-
M&&w!{!kJ=I0lldjR{#J2

literal 0
HcmV?d00001

diff --git a/secrets/matrix_reg_token.nix b/secrets/matrix_reg_token.nix
deleted file mode 100644
index 52490c1df3cc68d7a18880c8386f2de6a393788b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 134
zcmZQ@_Y83kiVO&02;KN1=;o}6@0aqQeOYiT-&Mvq;O(~etBjKFv!6Kk;+Nju6@g`$
zA9gk|A6@%-sf2#I;*-yhITyZ5c`UPYW~1nCk*bx&w(i0c&IblaUtn2rGMLR|(W99C
sg6B<z`ATHpM@cL$eXHj!Dn0wu&e#-=rXaoS=jHNC8VdIZSnS^h06XeG#sB~S

diff --git a/services/immich.nix b/services/immich.nix
index a0c0dc4..d2b3026 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -9,7 +9,7 @@
   services.immich = {
     enable = true;
     mediaLocation = service_configs.immich.dir;
-    port = 2284;
+    port = service_configs.ports.immich;
     # openFirewall = true;
     host = "0.0.0.0";
     database = {
diff --git a/services/matrix.nix b/services/matrix.nix
index cb05217..5f5407f 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -6,9 +6,8 @@
   ...
 }:
 {
-  imports = [
-    ../secrets/matrix_reg_token.nix
-  ];
+  services.matrix-conduit.settings.global.registration_token =
+    builtins.readFile ../secrets/matrix_reg_token;
 
   services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
     header /.well-known/matrix/* Content-Type application/json
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 03e90ca..4aaa214 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -51,8 +51,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/S6sAWXmr/fabric-api-0.115.0%2B1.21.4.jar";
-              sha512 = "abb2b28e9b874adfc82c3c87ddf348e2e98adc5153aed7ae5bcaddf5b1d8bd98982a052ab91411b7fad3bbdffc5d788be60d22b9c95dd21e62b96ea49aa404ca";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/UnrycCWP/fabric-api-0.115.1%2B1.21.4.jar";
+              sha512 = "d5e9f87679b5edc9786e651fc481f8861a9cf53ed381890a1cb5e129222d6c5fa99f06045007f8e1fba02da686cdb6db2d99b334a1d23881cb56dfa199932eea";
             };
 
             FerriteCore = fetchurl {
diff --git a/zfs.nix b/zfs.nix
index 1aa8ae7..eeeb39b 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -25,4 +25,21 @@ in
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [ service_configs.zpool ];
+
+  services.zfs = {
+    autoScrub.enable = true;
+    trim.enable = true;
+    # doesn't work, maybe replace with `services.sanoid` instead
+    autoSnapshot = {
+      # attempted to manually set zpool, didn't work
+      flags = "-k -p -P ${service_configs.zpool}";
+
+      enable = true;
+      frequent = 4; # 15-minutes
+      hourly = 24;
+      daily = 7;
+      weekly = 4;
+      monthly = 12;
+    };
+  };
 }

From f94143c82f7580c7e9af385720bad039ed76abb4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 3 Feb 2025 21:47:07 -0500
Subject: [PATCH 081/847] services.sanoid

---
 zfs.nix | 35 +++++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/zfs.nix b/zfs.nix
index eeeb39b..fe8cef1 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -26,20 +26,31 @@ in
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [ service_configs.zpool ];
 
+  services.sanoid = {
+    enable = true;
+    datasets."${service_configs.zpool}" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 24;
+      daily = 30;
+      monthly = 12;
+      yearly = 4;
+    };
+
+    datasets."${service_configs.zpool}/services/sql" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 12;
+      daily = 2;
+      monthly = 0;
+      yearly = 0;
+    };
+  };
+
   services.zfs = {
     autoScrub.enable = true;
     trim.enable = true;
-    # doesn't work, maybe replace with `services.sanoid` instead
-    autoSnapshot = {
-      # attempted to manually set zpool, didn't work
-      flags = "-k -p -P ${service_configs.zpool}";
-
-      enable = true;
-      frequent = 4; # 15-minutes
-      hourly = 24;
-      daily = 7;
-      weekly = 4;
-      monthly = 12;
-    };
   };
 }

From 3bf59749715e370613c0a4ad21a83c951544aba2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Feb 2025 20:38:19 -0500
Subject: [PATCH 082/847] update

---
 configuration.nix               |   3 +-
 flake.lock                      |  48 ++++++++++++++++----------------
 flake.nix                       |   4 +--
 secrets/minecraft-whitelist.nix | Bin 408 -> 638 bytes
 services/minecraft.nix          |  17 +++++++----
 services/qbittorrent.nix        |  36 ++++++++++++++----------
 6 files changed, 61 insertions(+), 47 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index fbdf9a6..1540f8d 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -59,7 +59,8 @@
   };
 
   boot = {
-    kernelPackages = pkgs.linuxPackages;
+    # 6.12 LTS until 2027
+    kernelPackages = pkgs.linuxPackages_6_12;
 
     loader = {
       # Use the systemd-boot EFI boot loader.
diff --git a/flake.lock b/flake.lock
index 0522216..4c73e58 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738148035,
-        "narHash": "sha256-KYOATYEwaKysL3HdHdS5kbQMXvzS4iPJzJrML+3TKAo=",
+        "lastModified": 1739841949,
+        "narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "18d0a984cc2bc82cf61df19523a34ad463aa7f54",
+        "rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
         "type": "github"
       },
       "original": {
@@ -54,11 +54,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -93,11 +93,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -135,11 +135,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736373539,
-        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
+        "lastModified": 1739757849,
+        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
+        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
         "type": "github"
       },
       "original": {
@@ -161,11 +161,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1737639419,
-        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "lastModified": 1739186342,
+        "narHash": "sha256-2j+sln9RwQn+g7J4GmdFFgvqXnLkvWBNMaUzONlkzUE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "rev": "3bdeebbc484a09391c4f0ec8a37bb77809426660",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738547119,
-        "narHash": "sha256-cc6AfR7W0AavgqA5nHUXRUus4Rr7oPWQNku5nhR4SYs=",
+        "lastModified": 1740188624,
+        "narHash": "sha256-z5G/JoTGICMdhxkN+sztsrcCD7vRFHIJiw/fchHX580=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5b93268c80c3300dbec0fbbb2b50f674f84a474a",
+        "rev": "8c0d05c3ce359b0d08226298ff7e4200486cbed3",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1738471961,
-        "narHash": "sha256-cgXDFrplNGs7bCVzXhRofjD8oJYqqXGcmUzXjHmip6Y=",
+        "lastModified": 1740089251,
+        "narHash": "sha256-Y78mDBWoO8CLLTjQfPfII+KXFb6lAmF9GrLbyVBsIMM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "537286c3c59b40311e5418a180b38034661d2536",
+        "rev": "18e9f9753e9ae261bcc7d3abe15745686991fd30",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738435198,
-        "narHash": "sha256-5+Hmo4nbqw8FrW85FlNm4IIrRnZ7bn0cmXlScNsNRLo=",
+        "lastModified": 1740162160,
+        "narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f6687779bf4c396250831aa5a32cbfeb85bb07a3",
+        "rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 25a84ba..e43f6b8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -51,7 +51,7 @@
       service_configs = rec {
         zpool = "tank";
         hdd_path = "/mnt/hdd";
-        services_dir = "/tank/services";
+        services_dir = "/${zpool}/services";
         torrent_group = "media";
 
         # TODO: add checks to make sure none of these collide
@@ -102,7 +102,7 @@
         };
 
         owntracks = {
-          data_dir = "/tank/services/owntracks";
+          data_dir = services_dir + "/owntracks";
         };
       };
     in
diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 5c7462f66d9489a9513db9e49d5dad2fc36f1f76..82ec65cdb3ad26596e64a6774f3d316f86fc6687 100644
GIT binary patch
literal 638
zcmZQ@_Y83kiVO&0IPgn+yXXp)jgk!gHy6(?ZIQbFa+&brOuw>Y&%>OLW=^@4nRa;7
z@AHDjq1%o9jp}c&&RwD(s`JHN$Etk&pJ{W?UtV>2$#ur2-7EY!&R@Fni}`3s_Z9O`
zO&%6$UF&Bpv;2JT^8CATp;Dp8R<r5&C@0wptrz6Aw!I+Drn`9Ge$E=3H;#6Ze7n1<
zvXu87@7tj4c=JcQpw@$SE?&c@W@)<?x4tTmZC%LPHPNbUsf_P~d8t3SPAao6KVo=q
z={2{IMGOq=x?87(v5RXMYga$Ev_5T9UA?|tyD8Rop0;=IOQoBS`zPK1AwD6o$9r=4
zEaQy&Z5I#CN!DTg@oDpXqf`k)@hOk9Y7aI{{dwEPK2<u(&FW;N`gSMTNt+5!mGo+U
zYq&Duoqvg54B!4IUoXsSUa1y3*XuF+l)Xi~tA9`XF5<fPpNdG{#N@z7*-blhj7*Mw
z-uKk-`o7uuK|h}bZ%P!nC38!?O`W&(<3`(iGU*ojz8{xVnR#C3ysD;azWvIBBfhb@
z4n8|$p5I@(Jl$AB%!j*=>E!{|tm6j`>9%Q>b?91nZnHa;Yh(E@P472@dm?v}%1JTt
zz6W1zx!GA}@D}TR_PTES>2~%Kk=GZUI-}2pu>bDtaou@Mzw&3qv^OHZwgf*^U9|tr
zBY~FlK1`=$O{9Dd2372G42$_B^7{Sj&)1G$KEEy1@{)w*r035)m^ivz?7Zctp3ODA
zyg+)ltkXM7uZJPI>gq0<60<km=}JpD{3rOG@5z&YUnJe$l_Gic*iHWE(tu`Xwl7Sj
zjg7MtHy&$V&cl6f!^9$|gQ`-lvHaFrFLfe})-n5VTS(6d>*#D0DSY+%!s%rKNdWc&
BFz)~W

literal 408
zcmZQ@_Y83kiVO&0SS&m_*o&!+yW)=76K9K;+Zu`(^LMpfdNP51`i76Ud!r_WluqO<
zyxM(X!N&TnD>ksJRMh{CURNdYi)XKM>8CA~CjAQUgf*ufUAt|~sXASm51W>8e7ZJg
zjlvxtceOT|Ysa}<)@(7C`txqVwuz6{sPI2fe6(Q6i(Z+|>qqsXkGtgmk~;nCn=I?*
z*$HpVbX5*Gy6D;bw|lfb;J21eag480Tu1mnmDw}v6|UvpK9#D|WGEK3ZsYnQZH}%3
z>KfhWnR}zm8KQ01zGmw1s5&&gWJ=<vZ~XR$-511JIYnM{jC^77QN{8*yXAx#59YH~
zo1Z-T;-7+*MQ~KfSJAX{Hoa3*{Ss_VHmxn}X+0R(w^eCv&Ew@#VtsS=rG95Tdpk+@
zmG~p4XF55pfB#obXB8-WTPaj&_Tx+c&4V{z_1Hcx>+xicF3QxiF8hA&<Nw4tQxe0{
zZ`ghLutg}&!_Q~iUD*KN+s+bf%7M?qmA%3Q9v$&r<Xxt*Qs$!3f$lqt{`AMqtUP~n
U9rLjhnx1+_^NuvRX3T#K00sKT+5i9m

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 4aaa214..0259318 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -51,8 +51,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/UnrycCWP/fabric-api-0.115.1%2B1.21.4.jar";
-              sha512 = "d5e9f87679b5edc9786e651fc481f8861a9cf53ed381890a1cb5e129222d6c5fa99f06045007f8e1fba02da686cdb6db2d99b334a1d23881cb56dfa199932eea";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar";
+              sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d";
             };
 
             FerriteCore = fetchurl {
@@ -61,8 +61,8 @@ in
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/t1FlWYl9/lithium-fabric-0.14.3%2Bmc1.21.4.jar";
-              sha512 = "1a4eafbdcee3886d33c04aa462d13a8c1e345ff492001add262476585b78327a2d016e56385bced869615bc97161a34a0a716f5f579c8c1d7080b278f4f11183";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/kLc5Oxr4/lithium-fabric-0.14.8%2Bmc1.21.4.jar";
+              sha512 = "ea0d7a4aea29b32527245d933227c85d0606e17c88cc05ed9918a1b966f22011961bfa85e33ab318e729f1ac3e69217d37709413bf70d1dc5a3acc9fd75ef317";
             };
 
             NoChatReports = fetchurl {
@@ -81,8 +81,13 @@ in
             };
 
             modernfix = fetchurl {
-              url = "https://cdn.modrinth.com/data/nmDcB62a/versions/gx7PIV8n/modernfix-fabric-5.20.1%2Bmc1.21.4.jar";
-              sha512 = "e1596a89dc100f454c445d64b5ebf59f1788de22270a4ca52837337abe6a76c517c771e234ededbadf5b51dbb62efe1bc0eccee841c45bc263f9406d8348dfe8";
+              url = "https://cdn.modrinth.com/data/nmDcB62a/versions/ZGxQddYr/modernfix-fabric-5.20.3%2Bmc1.21.4.jar";
+              sha512 = "ae49114c92a048c9ce79e197fc4df028e186cf13546e710f72247382fa8076f0b70d6aa3224951f4a36c886ca236f099a011f20b021a2b0d1a75c631da4d7d52";
+            };
+
+            alternatecurrent = fetchurl {
+              url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/DwfiGUVU/alternate-current-mc1.21.2-1.9.1.jar";
+              sha512 = "8ed44291a8aed3e1c9750cfce85e0de679daeff7c3b1bc8f6329b41ba4570442750b8039d2d5c79c32655fc9372ea35843c60805438d33888b30e28731c39137";
             };
           }
         );
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index a594dc8..eeaf219 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -35,8 +35,8 @@
       WebUI = {
         AlternativeUIEnabled = true;
         RootFolder = "${pkgs.fetchzip {
-          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.21.0/vuetorrent.zip";
-          sha256 = "ELerk/4q+eR3rmCx/jFoDirrmx12D+5JBfDZjkPK5wA=";
+          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.22.0/vuetorrent.zip";
+          sha256 = "UJflyTyftWSIOi942OgH/tvylyAeo6EjR14U0SHk6bs=";
         }}";
 
         # disable auth because we use caddy for auth
@@ -60,22 +60,30 @@
         # uses upload to communicate with seeders
         IncludeOverheadInLimits = false;
 
-        GlobalMaxRatio = 3;
+        GlobalMaxRatio = 4;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;
         AdditionalTrackers = (
-          lib.concatStrings (
-            map (url: url + "\\n") [
-              "udp://tracker.opentrackr.org:1337/announce"
-              "udp://open.stealth.si:80/announce"
-              "udp://open.demonii.com:1337"
-              "udp://exodus.desync.com:6969/announce"
-              "udp://tracker.dler.org:6969/announce"
-              "udp://tracker.bittor.pw:1337/announce"
-              "udp://tracker.torrent.eu.org:451/announce"
-            ]
-          )
+          lib.concatStringsSep "\\n" [
+            "udp://tracker.opentrackr.org:1337/announce"
+            "udp://open.stealth.si:80/announce"
+            "udp://open.demonii.com:1337"
+            "udp://exodus.desync.com:6969/announce"
+            "udp://tracker.dler.org:6969/announce"
+            "udp://tracker.bittor.pw:1337/announce"
+            "udp://tracker.torrent.eu.org:451/announce"
+            # "udp://opentracker.i2p.rocks:6969/announce"
+            # "udp://tracker.openbittorrent.com:6969/announce"
+            # "udp://aarsen.me:6969/announce"
+            "udp://explodie.org:6969/announce"
+            # "udp://uploads.gamecoast.net:6969/announce"
+            "http://tracker.files.fm:6969/announce"
+            "udp://tracker.tiny-vps.com:6969/announce"
+            "udp://p4p.arenabg.com:1337/announce"
+            "udp://tracker.dler.com:6969/announce"
+            "udp://inferno.demonoid.is:3391/announce"
+          ]
         );
       };
     };

From eca1b666f9e800ca59c079edc6e4a978d20c3791 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 28 Feb 2025 20:59:30 -0500
Subject: [PATCH 083/847] updates

---
 flake.lock                      |  30 +++++++++++++++---------------
 secrets/minecraft-whitelist.nix | Bin 638 -> 716 bytes
 services/minecraft.nix          |   4 ++--
 3 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4c73e58..b4ff989 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739841949,
-        "narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
+        "lastModified": 1740485968,
+        "narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
+        "rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
         "type": "github"
       },
       "original": {
@@ -161,11 +161,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1739186342,
-        "narHash": "sha256-2j+sln9RwQn+g7J4GmdFFgvqXnLkvWBNMaUzONlkzUE=",
+        "lastModified": 1740440383,
+        "narHash": "sha256-w8ixbqOGrVWMQZFFs4uAwZpuwuGMzFoKjocMFxTR5Ts=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "3bdeebbc484a09391c4f0ec8a37bb77809426660",
+        "rev": "6321bc060d757c137c1fbae2057c7e941483878f",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740188624,
-        "narHash": "sha256-z5G/JoTGICMdhxkN+sztsrcCD7vRFHIJiw/fchHX580=",
+        "lastModified": 1740707367,
+        "narHash": "sha256-MK8KXbsLgLju27AnP86f8tsC8oZWXCwlfS6n6Vi3U1U=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8c0d05c3ce359b0d08226298ff7e4200486cbed3",
+        "rev": "cb6a182ec450063d73a78450344dbb6684842117",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1740089251,
-        "narHash": "sha256-Y78mDBWoO8CLLTjQfPfII+KXFb6lAmF9GrLbyVBsIMM=",
+        "lastModified": 1740646007,
+        "narHash": "sha256-dMReDQobS3kqoiUCQIYI9c0imPXRZnBubX20yX/G5LE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "18e9f9753e9ae261bcc7d3abe15745686991fd30",
+        "rev": "009b764ac98a3602d41fc68072eeec5d24fc0e49",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740162160,
-        "narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
+        "lastModified": 1740603184,
+        "narHash": "sha256-t+VaahjQAWyA+Ctn2idyo1yxRIYpaDxMgHkgCNiMJa4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
+        "rev": "f44bd8ca21e026135061a0a57dcf3d0775b67a49",
         "type": "github"
       },
       "original": {
diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 82ec65cdb3ad26596e64a6774f3d316f86fc6687..bd458b163ab818db1a703101514a3d73cb37e266 100644
GIT binary patch
literal 716
zcmZQ@_Y83kiVO&0c>L&_uttB-new`@()(-kezEpFe*U{8Vxz^k6CW3Z?KvQ0YU8(m
z))v_ndw73+59#zU5BRereCxb5wxt>$@5~QeTeJ7E`^^t0HuBp$zI@eqi{W;}zANoo
z{#V`dE=(>ixgJ(7eS)pJH})n=aOX-T*7!ACo4%|m_1UX`%r4TiG3a-kV!&Zx200la
z(OXaMZqT>-|4wFGxl8Pp1${|H7T)EVvHzFMJ?OesNpJp}Ihh+1`sPSC^j2#fnlO2;
z){<un{_XGDaWeJP{wU7VYiDw=pUje0^F*V(y{}~jd+?6dyX8lng706Px2JojJ7aV1
zBjt%#T|K#8T=ITu;cA}pcD?Y5_?v5dg@P<?r?4i?dTlSOF;PvTEkJP5wjvIXOUqi)
zr=B#4IIFy~Q7UAP`~NaV*Xy+!I$tNLcvgk0by)ZsCrp%W>fSZKSNpHb%Q(XTZI*JC
zfSGBX!N(Yz7Wrvf{CaPY-ShlUYrx%uo#&_MtLASz`Sz^4rL?VV;|w0nDJp65*QPrv
za4{t-BwU>R>X}iWONGG+VO^%4JpEJQN6u=k*8EU>r|k8*K%t4}XU~2;XO+E>U-5!V
zrxhYJmplKm=?%zw=sn@*Pm%j&*B<J9&kTER^WVF5Z|3xdlk-y6+jZ}{*?Hub&0&}3
zIJw(APjXIm3r%6zn#)`)DOGVob$M9E`&k{Qd8~6e?z6qrT-v$UHsMl`daCHHR<2wl
zwXcf>^<#nqm8-&@Zu5J2y*BCdtZjO}Gm>v*Zz@htyLHh`<ha9?`Jzl7Cs*jSS}YWQ
zzjxo+l!BQb7yo~=f5pp%End@4O*kwflvQcD)BNJPWox@9?X91*-nlC3li7})dvz-P
z_!3{v`lZ?Pl%YCDc+c`?yPXHJYc5tP&AG#+Y01m6{KDf0uOg56UwNG)7s|G<PpihJ
gK61Nr)%i2M5=}Q#x2|XJNzXMupBOO3s5@v20C*%{0RR91

literal 638
zcmZQ@_Y83kiVO&0IPgn+yXXp)jgk!gHy6(?ZIQbFa+&brOuw>Y&%>OLW=^@4nRa;7
z@AHDjq1%o9jp}c&&RwD(s`JHN$Etk&pJ{W?UtV>2$#ur2-7EY!&R@Fni}`3s_Z9O`
zO&%6$UF&Bpv;2JT^8CATp;Dp8R<r5&C@0wptrz6Aw!I+Drn`9Ge$E=3H;#6Ze7n1<
zvXu87@7tj4c=JcQpw@$SE?&c@W@)<?x4tTmZC%LPHPNbUsf_P~d8t3SPAao6KVo=q
z={2{IMGOq=x?87(v5RXMYga$Ev_5T9UA?|tyD8Rop0;=IOQoBS`zPK1AwD6o$9r=4
zEaQy&Z5I#CN!DTg@oDpXqf`k)@hOk9Y7aI{{dwEPK2<u(&FW;N`gSMTNt+5!mGo+U
zYq&Duoqvg54B!4IUoXsSUa1y3*XuF+l)Xi~tA9`XF5<fPpNdG{#N@z7*-blhj7*Mw
z-uKk-`o7uuK|h}bZ%P!nC38!?O`W&(<3`(iGU*ojz8{xVnR#C3ysD;azWvIBBfhb@
z4n8|$p5I@(Jl$AB%!j*=>E!{|tm6j`>9%Q>b?91nZnHa;Yh(E@P472@dm?v}%1JTt
zz6W1zx!GA}@D}TR_PTES>2~%Kk=GZUI-}2pu>bDtaou@Mzw&3qv^OHZwgf*^U9|tr
zBY~FlK1`=$O{9Dd2372G42$_B^7{Sj&)1G$KEEy1@{)w*r035)m^ivz?7Zctp3ODA
zyg+)ltkXM7uZJPI>gq0<60<km=}JpD{3rOG@5z&YUnJe$l_Gic*iHWE(tu`Xwl7Sj
zjg7MtHy&$V&cl6f!^9$|gQ`-lvHaFrFLfe})-n5VTS(6d>*#D0DSY+%!s%rKNdWc&
BFz)~W

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 0259318..7adc9dd 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -71,8 +71,8 @@ in
             };
 
             moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/J5ayzvZp/Moonrise-Fabric-0.2.0-beta.8%2B0cbff02.jar";
-              sha512 = "d6f8b698226ebfcd87635cc2796022b0dad030f1d9ff5fd77d184b729c4d0c1f7dcfd265ab0f80186178c8c89fbdce20407b1025af05edec8c4a4f8df605ebf6";
+              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/6Dgh9jQx/Moonrise-Fabric-0.2.0-beta.9%2Bac0c7de.jar";
+              sha512 = "c101f1a41db4095d651d32eae47bd7e6f7358f7390898610d1bf261ebfc7e0f4165fd551c08a99cca31a3308f1989a16b8c75c1ece60ef9cd475107ca4f4219e";
             };
 
             squaremap = fetchurl {

From 4469fd4b40c0063fdf12a99f945180d1fefe4324 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 14 Mar 2025 23:53:01 -0400
Subject: [PATCH 084/847] update

---
 configuration.nix        |  2 +
 flake.lock               | 85 ++++++++++++++++------------------------
 flake.nix                | 11 +++---
 hardware.nix             |  6 ---
 services/minecraft.nix   |  4 +-
 services/qbittorrent.nix | 19 ++++-----
 zfs.nix                  | 37 +++++++++++++----
 7 files changed, 81 insertions(+), 83 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 1540f8d..9ea7b67 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -150,6 +150,8 @@
 
     powertop
 
+    lsof
+
     (pkgs.writeShellApplication {
       name = "disk-smart-test";
       runtimeInputs = with pkgs; [
diff --git a/flake.lock b/flake.lock
index b4ff989..0cbe7c6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1731098351,
-        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "lastModified": 1741148495,
+        "narHash": "sha256-EV8KUaIZ2/CdBXlutXrHoZYbWPeB65p5kKZk71gvDRI=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "rev": "75390a36cd0c2cdd5f1aafd8a9f827d7107f2e53",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740485968,
-        "narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
+        "lastModified": 1741786315,
+        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
+        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
         "type": "github"
       },
       "original": {
@@ -38,11 +38,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -75,11 +75,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "lastModified": 1740872218,
+        "narHash": "sha256-ZaMw0pdoUKigLpv9HiNDH2Pjnosg7NBYMJlHTIsHEUo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "rev": "3876f6b87db82f33775b1ef5ea343986105db764",
         "type": "github"
       },
       "original": {
@@ -161,11 +161,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1740440383,
-        "narHash": "sha256-w8ixbqOGrVWMQZFFs4uAwZpuwuGMzFoKjocMFxTR5Ts=",
+        "lastModified": 1741442524,
+        "narHash": "sha256-tVcxLDLLho8dWcO81Xj/3/ANLdVs0bGyCPyKjp70JWk=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "6321bc060d757c137c1fbae2057c7e941483878f",
+        "rev": "d8099586d9a84308ffedac07880e7f07a0180ff4",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740707367,
-        "narHash": "sha256-MK8KXbsLgLju27AnP86f8tsC8oZWXCwlfS6n6Vi3U1U=",
+        "lastModified": 1742003385,
+        "narHash": "sha256-c9gUL+HaIth47YUZTiXgG3NDhaxriJxHM7a0TEXAuBQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "cb6a182ec450063d73a78450344dbb6684842117",
+        "rev": "9f51cce843d03d7456b535aeabca87db1012da2c",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1740646007,
-        "narHash": "sha256-dMReDQobS3kqoiUCQIYI9c0imPXRZnBubX20yX/G5LE=",
+        "lastModified": 1741792691,
+        "narHash": "sha256-f0BVt1/cvA0DQ/q3rB+HY4g4tKksd03ZkzI4xehC2Ew=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "009b764ac98a3602d41fc68072eeec5d24fc0e49",
+        "rev": "e1f12151258b12c567f456d8248e4694e9390613",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740603184,
-        "narHash": "sha256-t+VaahjQAWyA+Ctn2idyo1yxRIYpaDxMgHkgCNiMJa4=",
+        "lastModified": 1741862977,
+        "narHash": "sha256-prZ0M8vE/ghRGGZcflvxCu40ObKaB+ikn74/xQoNrGQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f44bd8ca21e026135061a0a57dcf3d0775b67a49",
+        "rev": "cdd2ef009676ac92b715ff26630164bb88fec4e0",
         "type": "github"
       },
       "original": {
@@ -244,22 +244,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1730741070,
-        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -270,15 +254,14 @@
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
+        ]
       },
       "locked": {
-        "lastModified": 1731363552,
-        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "lastModified": 1740915799,
+        "narHash": "sha256-JvQvtaphZNmeeV+IpHgNdiNePsIpHD5U/7QN5AeY44A=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "rev": "42b1ba089d2034d910566bf6b40830af6b8ec732",
         "type": "github"
       },
       "original": {
@@ -307,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731897198,
-        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "lastModified": 1741228283,
+        "narHash": "sha256-VzqI+k/eoijLQ5am6rDFDAtFAbw8nltXfLBC6SIEJAE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "rev": "38e9826bc4296c9daf18bc1e6aa299f3e932a403",
         "type": "github"
       },
       "original": {
@@ -337,11 +320,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1731209328,
-        "narHash": "sha256-b3jggBHZh20jUfBxoaIvew23czsw82zBc0aKxtkF3g8=",
+        "lastModified": 1740921534,
+        "narHash": "sha256-orXe3m04DLTW3I19VVanClzpqeq7adnDTqKAD7aPbA8=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "74e6fd47804b5ca69187200efbb14cf1ecb9ea07",
+        "rev": "5eb7dc3e901f4dbb085eb37f5785473a9ae78bc4",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index e43f6b8..89d851c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -49,9 +49,10 @@
       eth_interface = "enp4s0";
 
       service_configs = rec {
-        zpool = "tank";
-        hdd_path = "/mnt/hdd";
-        services_dir = "/${zpool}/services";
+        zpool_ssds = "tank";
+        zpool_hdds = "hdds";
+        torrents_path = "/torrents";
+        services_dir = "/${zpool_ssds}/services";
         torrent_group = "media";
 
         # TODO: add checks to make sure none of these collide
@@ -93,8 +94,8 @@
         };
 
         torrent = {
-          SavePath = hdd_path + "/torrents";
-          TempPath = hdd_path + "/torrents/incomplete";
+          SavePath = torrents_path;
+          TempPath = torrents_path + "/incomplete";
         };
 
         jellyfin = {
diff --git a/hardware.nix b/hardware.nix
index bdaa6b7..16dc8b5 100644
--- a/hardware.nix
+++ b/hardware.nix
@@ -17,12 +17,6 @@
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  # 3tb HDD
-  fileSystems.${service_configs.hdd_path} = {
-    device = "/dev/disk/by-uuid/f69b8c84-20ca-448f-b580-8951f20b9fc1";
-    fsType = "xfs";
-  };
-
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 7adc9dd..d54c1fe 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -51,8 +51,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar";
-              sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/IXeiAH6H/fabric-api-0.118.5%2B1.21.4.jar";
+              sha512 = "5ad7b91f3077fdd412d30b08cc93ddb625b281c3dc39b7ca24957901931807695fda045c040990e1bdd741c5bf384f21fb8c136a04ab1fb99a08b38d361fba6b";
             };
 
             FerriteCore = fetchurl {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index eeaf219..b7aef5a 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -35,8 +35,8 @@
       WebUI = {
         AlternativeUIEnabled = true;
         RootFolder = "${pkgs.fetchzip {
-          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.22.0/vuetorrent.zip";
-          sha256 = "UJflyTyftWSIOi942OgH/tvylyAeo6EjR14U0SHk6bs=";
+          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.23.0/vuetorrent.zip";
+          sha256 = "GCrKmv1jvN6bZb3s5E96KE3PsJ3ju63sVfCtU1RF/u8=";
         }}";
 
         # disable auth because we use caddy for auth
@@ -52,15 +52,14 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        GlobalUPSpeedLimit = 500; # in KiB/s
-        GlobalDLSpeedLimit = 0;
+        GlobalUPSpeedLimit = 500; # 500 KiB/s
+        GlobalDLSpeedLimit = 5000; # 5 MiB/s
+
         IgnoreLimitsOnLAN = true;
 
-        # Including overhead in limits ruins download because download
-        # uses upload to communicate with seeders
-        IncludeOverheadInLimits = false;
+        IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 4;
+        GlobalMaxRatio = -1;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;
@@ -73,11 +72,7 @@
             "udp://tracker.dler.org:6969/announce"
             "udp://tracker.bittor.pw:1337/announce"
             "udp://tracker.torrent.eu.org:451/announce"
-            # "udp://opentracker.i2p.rocks:6969/announce"
-            # "udp://tracker.openbittorrent.com:6969/announce"
-            # "udp://aarsen.me:6969/announce"
             "udp://explodie.org:6969/announce"
-            # "udp://uploads.gamecoast.net:6969/announce"
             "http://tracker.files.fm:6969/announce"
             "udp://tracker.tiny-vps.com:6969/announce"
             "udp://p4p.arenabg.com:1337/announce"
diff --git a/zfs.nix b/zfs.nix
index fe8cef1..b401255 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -24,21 +24,24 @@ in
   ];
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.extraPools = [ service_configs.zpool ];
+  boot.zfs.extraPools = [
+    service_configs.zpool_ssds
+    service_configs.zpool_hdds
+  ];
 
   services.sanoid = {
     enable = true;
-    datasets."${service_configs.zpool}" = {
+    datasets."${service_configs.zpool_ssds}" = {
       recursive = true;
       autoprune = true;
       autosnap = true;
-      hourly = 24;
-      daily = 30;
-      monthly = 12;
-      yearly = 4;
+      hourly = 5;
+      daily = 7;
+      monthly = 3;
+      yearly = 0;
     };
 
-    datasets."${service_configs.zpool}/services/sql" = {
+    datasets."${service_configs.zpool_ssds}/services/sql" = {
       recursive = true;
       autoprune = true;
       autosnap = true;
@@ -47,6 +50,26 @@ in
       monthly = 0;
       yearly = 0;
     };
+
+    datasets."${service_configs.zpool_ssds}/services/jellyfin_cache" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 0;
+      daily = 0;
+      monthly = 0;
+      yearly = 0;
+    };
+
+    datasets."${service_configs.zpool_hdds}" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 0;
+      daily = 0;
+      monthly = 0;
+      yearly = 0;
+    };
   };
 
   services.zfs = {

From 3a49a5d01bcb6b16626d7454fc8632bc0acc8c4b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 17 Mar 2025 14:14:09 -0400
Subject: [PATCH 085/847] update

---
 flake.lock             | 20 ++++++++++----------
 flake.nix              |  2 +-
 services/jellyfin.nix  |  1 -
 services/minecraft.nix |  4 ++--
 4 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0cbe7c6..155de25 100644
--- a/flake.lock
+++ b/flake.lock
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1741792691,
-        "narHash": "sha256-f0BVt1/cvA0DQ/q3rB+HY4g4tKksd03ZkzI4xehC2Ew=",
+        "lastModified": 1742217307,
+        "narHash": "sha256-3fwpN7KN226ghLlpO9TR0/WpgQOmOj1e8bieUxpIYSk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "e1f12151258b12c567f456d8248e4694e9390613",
+        "rev": "4f4d97d7b7be387286cc9c988760a7ebaa5be1f1",
         "type": "github"
       },
       "original": {
@@ -214,16 +214,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1741862977,
-        "narHash": "sha256-prZ0M8vE/ghRGGZcflvxCu40ObKaB+ikn74/xQoNrGQ=",
+        "lastModified": 1742139335,
+        "narHash": "sha256-r8MlAuCJxIYb0fvNLYdVr78f4saYtGyWKj47sEv9chM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cdd2ef009676ac92b715ff26630164bb88fec4e0",
+        "rev": "e1361b38d11a95b86a3663a32201dcd3d6392b7e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-24.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -320,11 +320,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1740921534,
-        "narHash": "sha256-orXe3m04DLTW3I19VVanClzpqeq7adnDTqKAD7aPbA8=",
+        "lastModified": 1742138327,
+        "narHash": "sha256-Y71Mjej98CjaUKa1ecAIOo0eJ1B3ZVQl2ng6xl7/s9Y=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "5eb7dc3e901f4dbb085eb37f5785473a9ae78bc4",
+        "rev": "38eeb3bc501900b48d1caf8c52a5b7f2fb7a52c5",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 89d851c..d4805e0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small";
 
     lanzaboote = {
       url = "github:nix-community/lanzaboote";
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index d67cfe6..3921590 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -14,7 +14,6 @@
 
   services.jellyfin = rec {
     enable = true;
-
     # used for local streaming
     openFirewall = true;
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d54c1fe..2b03071 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -51,8 +51,8 @@ in
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/IXeiAH6H/fabric-api-0.118.5%2B1.21.4.jar";
-              sha512 = "5ad7b91f3077fdd412d30b08cc93ddb625b281c3dc39b7ca24957901931807695fda045c040990e1bdd741c5bf384f21fb8c136a04ab1fb99a08b38d361fba6b";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/HbTXYTBz/fabric-api-0.119.0%2B1.21.4.jar";
+              sha512 = "f2e44507dcf7c34ac5104bf78c0f0f0ab99840272d0c1afc51236b7f8a56541bd5c2024953a83599034e1b55191e38b3e437b6b80736137e2ee4d7d571f42c82";
             };
 
             FerriteCore = fetchurl {

From 616052e311ebf3a45f9b9f157f8099463169ef12 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 19 Mar 2025 00:37:15 -0400
Subject: [PATCH 086/847] comments and soulseek work?

---
 .gitattributes           |   1 +
 configuration.nix        |   8 +++---
 flake.lock               |  18 ++++++-------
 flake.nix                |   4 +++
 secrets/slskd_env        | Bin 0 -> 157 bytes
 services/qbittorrent.nix |  15 +++++++++++
 services/soulseek.nix    |  56 +++++++++++++++++++++++++++++++++++++++
 7 files changed, 90 insertions(+), 12 deletions(-)
 create mode 100644 secrets/slskd_env
 create mode 100644 services/soulseek.nix

diff --git a/.gitattributes b/.gitattributes
index 37dc6c6..89340db 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -7,3 +7,4 @@ secrets/matrix_reg_token filter=git-crypt diff=git-crypt
 secrets/owntracks_caddy_auth filter=git-crypt diff=git-crypt
 secrets/secureboot.tar filter=git-crypt diff=git-crypt
 secrets/zfs-key filter=git-crypt diff=git-crypt
+secrets/slskd_env filter=git-crypt diff=git-crypt
diff --git a/configuration.nix b/configuration.nix
index 9ea7b67..15cbb9a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -12,6 +12,7 @@
   imports = [
     ./hardware.nix
     ./zfs.nix
+
     ./services/postgresql.nix
     ./services/jellyfin.nix
     ./services/caddy.nix
@@ -23,6 +24,7 @@
     ./services/bitmagnet.nix
     ./services/matrix.nix
     ./services/owntracks.nix
+    ./services/soulseek.nix
   ];
 
   systemd.targets = {
@@ -337,9 +339,9 @@
   #   };
   # };
 
-  systemd.tmpfiles.rules = [
-    "d /tank/music 775 ${username} users"
-  ];
+  # systemd.tmpfiles.rules = [
+  #   "d /tank/music 775 ${username} users"
+  # ];
 
   system.stateVersion = "24.11";
 }
diff --git a/flake.lock b/flake.lock
index 155de25..bdcedc3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -135,11 +135,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739757849,
-        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
+        "lastModified": 1742234739,
+        "narHash": "sha256-zFL6zsf/5OztR1NSNQF33dvS1fL/BzVUjabZq4qrtY4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
+        "rev": "f6af7280a3390e65c2ad8fd059cdc303426cbd59",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742003385,
-        "narHash": "sha256-c9gUL+HaIth47YUZTiXgG3NDhaxriJxHM7a0TEXAuBQ=",
+        "lastModified": 1742262784,
+        "narHash": "sha256-a/Knvms22n1Co7TR5uXW+gvpIZcmNWxzm7oUM+Unyok=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "9f51cce843d03d7456b535aeabca87db1012da2c",
+        "rev": "b72f0bc3698833e2d079fce2edf5bda04d411287",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742139335,
-        "narHash": "sha256-r8MlAuCJxIYb0fvNLYdVr78f4saYtGyWKj47sEv9chM=",
+        "lastModified": 1742268799,
+        "narHash": "sha256-IhnK4LhkBlf14/F8THvUy3xi/TxSQkp9hikfDZRD4Ic=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e1361b38d11a95b86a3663a32201dcd3d6392b7e",
+        "rev": "da044451c6a70518db5b730fe277b70f494188f1",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index d4805e0..3113d0e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -53,6 +53,7 @@
         zpool_hdds = "hdds";
         torrents_path = "/torrents";
         services_dir = "/${zpool_ssds}/services";
+        music_dir = "/${zpool_ssds}/music";
         torrent_group = "media";
 
         # TODO: add checks to make sure none of these collide
@@ -65,10 +66,13 @@
           owntracks = 3825;
           gitea = 2283;
           immich = 2284;
+          soulseek_web = 5030;
+          soulseek_listen = 50300;
         };
 
         https = {
           certs = services_dir + "/http_certs";
+          # TODO! generate website from repo directly using hugo
           data_dir = services_dir + "/http";
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
diff --git a/secrets/slskd_env b/secrets/slskd_env
new file mode 100644
index 0000000000000000000000000000000000000000..b0fc4661b5140543a548fcd489d05789ab9c8c66
GIT binary patch
literal 157
zcmZQ@_Y83kiVO&0I4dRSyfr5~dF6!7duH9)p*wqi`ri}#Qa*S$iY`=ZR-M7G#NeIl
z^5P<Qdvis7>e*#}?dv8gc$j6@O!j}=u`Ng9pVW+4-}u0{=OP{IcRT;|Fz^1Z#$7z;
z!Hk0Vca!|qSS8vVU34Rgxw~FS$uvPP;N?l}^XfGxH~d@dw(WAc)Mmf0(|p9DW;bwo
P3py{b<o%x1Z*m6!?VLzC

literal 0
HcmV?d00001

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index b7aef5a..a716648 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -78,6 +78,21 @@
             "udp://p4p.arenabg.com:1337/announce"
             "udp://tracker.dler.com:6969/announce"
             "udp://inferno.demonoid.is:3391/announce"
+
+            "udp://tracker.torrent.eu.org:451/announce"
+            "udp://tracker.ololosh.space:6969/announce"
+            "udp://ns-1.x-fins.com:6969/announce"
+            "udp://leet-tracker.moe:1337/announce"
+            "http://tracker.vanitycore.co:6969/announce"
+            "http://tracker.sbsub.com:2710/announce"
+            "http://tracker.moxing.party:6969/announce"
+            "http://tracker.ipv6tracker.org:80/announce"
+            "http://tracker.corpscorp.online:80/announce"
+            "http://shubt.net:2710/announce"
+            "http://share.hkg-fansub.info:80/announce.php"
+            "http://servandroidkino.ru:80/announce"
+            "http://bt.poletracker.org:2710/announce"
+            "http://0d.kebhana.mx:443/announce"
           ]
         );
       };
diff --git a/services/soulseek.nix b/services/soulseek.nix
new file mode 100644
index 0000000..ae8e967
--- /dev/null
+++ b/services/soulseek.nix
@@ -0,0 +1,56 @@
+{
+  pkgs,
+  config,
+  lib,
+  service_configs,
+  username,
+  ...
+}:
+{
+  users.groups."music" = { };
+
+  services.slskd = {
+    enable = true;
+    domain = null; # null so we don't use nginx reverse proxy
+    environmentFile = ../secrets/slskd_env;
+
+    settings = {
+      web = {
+        port = service_configs.ports.soulseek_web;
+      };
+      soulseek = {
+        # description = "smth idk";
+        listen_port = service_configs.ports.soulseek_listen;
+      };
+
+      shares = {
+        directories = [ service_configs.music_dir ];
+      };
+
+      global = {
+        download = {
+          slots = 10;
+          speed_limit = 1000;
+        };
+        upload = {
+          slots = 10;
+          speed_limit = 1000;
+        };
+      };
+    };
+  };
+
+  users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
+  users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
+
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.music_dir} 0750 ${username} music"
+    "d ${service_configs.music_dir} 0750 ${username} music"
+  ];
+
+  services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
+    # tls internal
+    ${builtins.readFile ../secrets/caddy_auth}
+    reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
+  '';
+}

From cd916ae97b4b50ecf54bb0f34e265ba4cf966955 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Mar 2025 03:44:43 -0400
Subject: [PATCH 087/847] soulseek: what??!?!??!

---
 services/soulseek.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index ae8e967..386d96b 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -29,12 +29,12 @@
 
       global = {
         download = {
-          slots = 10;
-          speed_limit = 1000;
+          slots = 3;
+          speed_limit = 500;
         };
         upload = {
-          slots = 10;
-          speed_limit = 1000;
+          slots = 4;
+          speed_limit = 500;
         };
       };
     };
@@ -48,9 +48,11 @@
     "d ${service_configs.music_dir} 0750 ${username} music"
   ];
 
+
+
+
+  # doesn't work with auth????
   services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
-    # tls internal
-    ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
   '';
 }

From 19516349083d18a226261d1288d96ee66c0a8189 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 15:34:23 -0400
Subject: [PATCH 088/847] minecraft: fix log spam

---
 services/minecraft.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 2b03071..ff7d772 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -89,6 +89,12 @@ in
               url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/DwfiGUVU/alternate-current-mc1.21.2-1.9.1.jar";
               sha512 = "8ed44291a8aed3e1c9750cfce85e0de679daeff7c3b1bc8f6329b41ba4570442750b8039d2d5c79c32655fc9372ea35843c60805438d33888b30e28731c39137";
             };
+
+            # fix `Error sending packet clientbound/minecraft:disconnect` error
+            disconnectpacketfix = fetchurl {
+              url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
+              sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
+            };
           }
         );
       };

From c5ae4a1290cd0d154bf4a699fdfbe57881e874bd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 15:34:48 -0400
Subject: [PATCH 089/847] qbt: adjust settings + vuetorrent bump

---
 services/qbittorrent.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index a716648..28b4617 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -34,10 +34,12 @@
     serverConfig.Preferences = {
       WebUI = {
         AlternativeUIEnabled = true;
-        RootFolder = "${pkgs.fetchzip {
-          url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.23.0/vuetorrent.zip";
-          sha256 = "GCrKmv1jvN6bZb3s5E96KE3PsJ3ju63sVfCtU1RF/u8=";
-        }}";
+        RootFolder = builtins.toString (
+          pkgs.fetchzip {
+            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.23.1/vuetorrent.zip";
+            sha256 = "yZmnRmYoinJ8uSuUpjGIRCQWBrK59hwyEkCq8aWiOvQ=";
+          }
+        );
 
         # disable auth because we use caddy for auth
         AuthSubnetWhitelist = "0.0.0.0/0";
@@ -52,7 +54,7 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        GlobalUPSpeedLimit = 500; # 500 KiB/s
+        GlobalUPSpeedLimit = 1500; # 500 KiB/s
         GlobalDLSpeedLimit = 5000; # 5 MiB/s
 
         IgnoreLimitsOnLAN = true;

From a70f06b23c970b18cc71b06931a025445373d2d8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 15:35:03 -0400
Subject: [PATCH 090/847] slskd: format

---
 services/soulseek.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 386d96b..02d4684 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -48,9 +48,6 @@
     "d ${service_configs.music_dir} 0750 ${username} music"
   ];
 
-
-
-
   # doesn't work with auth????
   services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
     reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}

From 431b405edcc324ee2cdcde6dba43ec8c1ecb7d98 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 18:07:04 -0400
Subject: [PATCH 091/847] make config deployable

---
 configuration.nix | 18 +++++++-----------
 deploy.sh         |  2 ++
 flake.lock        | 18 +++++++++---------
 3 files changed, 18 insertions(+), 20 deletions(-)
 create mode 100755 deploy.sh

diff --git a/configuration.nix b/configuration.nix
index 15cbb9a..b9a1ee3 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -53,13 +53,6 @@
     };
   };
 
-  # https://github.com/viperML/nh
-  programs.nh = {
-    enable = true;
-    clean.enable = true;
-    clean.extraArgs = "--keep-since 4d --keep 3";
-  };
-
   boot = {
     # 6.12 LTS until 2027
     kernelPackages = pkgs.linuxPackages_6_12;
@@ -105,9 +98,9 @@
   services.openssh = {
     enable = true;
     settings = {
-      AllowUsers = [ username ];
+      AllowUsers = [ username "root" ];
       PasswordAuthentication = false;
-      PermitRootLogin = "no";
+      PermitRootLogin = "yes"; # for deploying configs
     };
   };
 
@@ -139,12 +132,13 @@
 
     borgbackup
     smartmontools
-
     nil
 
     ripgrep
 
     intel-gpu-tools
+    iotop
+    iftop
 
     tmux
 
@@ -289,7 +283,7 @@
       service_configs.torrent_group
     ];
 
-    hashedPasswordFile = "${./secrets/hashedPass}";
+    hashedPasswordFile = builtins.toString ./secrets/hashedPass;
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
@@ -297,6 +291,8 @@
     ];
   };
 
+  users.users.root.openssh.authorizedKeys.keys = config.users.users.${username}.openssh.authorizedKeys.keys;
+
   # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
   programs.fish.enable = true;
   programs.bash = {
diff --git a/deploy.sh b/deploy.sh
new file mode 100755
index 0000000..6e26436
--- /dev/null
+++ b/deploy.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+nixos-rebuild switch --flake .#muffin --target-host root@server --build-host root@server --verbose
diff --git a/flake.lock b/flake.lock
index bdcedc3..c6ae6d5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742262784,
-        "narHash": "sha256-a/Knvms22n1Co7TR5uXW+gvpIZcmNWxzm7oUM+Unyok=",
+        "lastModified": 1742522051,
+        "narHash": "sha256-uDlj+5J7eTuFkDaNl9cYf++gJdEW23Z4zSuDcNANIQc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b72f0bc3698833e2d079fce2edf5bda04d411287",
+        "rev": "57464e795fd31ceef845d7ce454d3b83e80e283e",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1742217307,
-        "narHash": "sha256-3fwpN7KN226ghLlpO9TR0/WpgQOmOj1e8bieUxpIYSk=",
+        "lastModified": 1742376361,
+        "narHash": "sha256-VFMgJkp/COvkt5dnkZB4D2szVdmF6DGm5ZdVvTUy61c=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "4f4d97d7b7be387286cc9c988760a7ebaa5be1f1",
+        "rev": "daaae13dff0ecc692509a1332ff9003d9952d7a9",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742268799,
-        "narHash": "sha256-IhnK4LhkBlf14/F8THvUy3xi/TxSQkp9hikfDZRD4Ic=",
+        "lastModified": 1742562948,
+        "narHash": "sha256-QUnzAW7CW0sCkFN1Kez/8UVq8EbBGNKOfHZHIZON0XQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "da044451c6a70518db5b730fe277b70f494188f1",
+        "rev": "e7a04ccc42104e0554f0a2325930fe98db9a5325",
         "type": "github"
       },
       "original": {

From 8476668c9f538e9477bde9e39b18e4f51e4afccd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 18:14:17 -0400
Subject: [PATCH 092/847] properly manage slskd_env file

---
 services/soulseek.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 02d4684..4cdd268 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -6,13 +6,24 @@
   username,
   ...
 }:
+let
+  slskd_env = "/etc/slskd_env";
+in
 {
   users.groups."music" = { };
 
+  system.activationScripts = {
+    "zfs-key".text = ''
+      #!/bin/sh
+      rm -fr ${slskd_env} || true
+      cp ${../secrets/slskd_env} ${slskd_env}
+    '';
+  };
+
   services.slskd = {
     enable = true;
     domain = null; # null so we don't use nginx reverse proxy
-    environmentFile = ../secrets/slskd_env;
+    environmentFile = slskd_env;
 
     settings = {
       web = {

From 9e1f649e0c6e9f9741e4fc8edfba52cdfabe01c5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 18:16:40 -0400
Subject: [PATCH 093/847] activation scripts: proper file permissions

---
 services/soulseek.nix | 2 ++
 zfs.nix               | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 4cdd268..86ba93c 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -17,6 +17,8 @@ in
       #!/bin/sh
       rm -fr ${slskd_env} || true
       cp ${../secrets/slskd_env} ${slskd_env}
+      chmod 0500 ${slskd_env}
+      chown ${config.services.slskd.user}:${config.services.slskd.group} ${slskd_env}
     '';
   };
 
diff --git a/zfs.nix b/zfs.nix
index b401255..a94f8d9 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -12,6 +12,8 @@ in
       #!/bin/sh
       rm -fr ${zfs-key} || true
       cp ${./secrets/zfs-key} ${zfs-key}
+      chmod 0500 ${zfs-key}
+      chown root:wheel ${zfs-key}
     '';
   };
 

From 49d3c5f6fdf666615f2c6b5254096d3be2b6ccdb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 18:18:48 -0400
Subject: [PATCH 094/847] remove stuff used pre-deploy

---
 configuration.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index b9a1ee3..d3f2f16 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -121,8 +121,6 @@
 
   environment.systemPackages = with pkgs; [
     helix
-    nixfmt-rfc-style
-
     lm_sensors
     bottom
     htop
@@ -132,7 +130,6 @@
 
     borgbackup
     smartmontools
-    nil
 
     ripgrep
 

From 6677a7efb15f6812350043720f15ee76413d1dbd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 20:04:39 -0400
Subject: [PATCH 095/847] make jellyfin data private

---
 services/jellyfin.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 3921590..0e4b23c 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -29,8 +29,8 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.jellyfin.dataDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
-    "d ${config.services.jellyfin.cacheDir} 0770 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.dataDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.cacheDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
   ];
 
   users.users.${config.services.jellyfin.user}.extraGroups = [

From 067d3e103b5549c19680decedab009dba25880b8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 20:04:46 -0400
Subject: [PATCH 096/847] format

---
 services/bitmagnet.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 16a0d84..437f258 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -35,14 +35,12 @@
     };
   };
 
-  services.caddy.virtualHosts.
+  services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
+    # tls internal
+    ${builtins.readFile ../secrets/caddy_auth}
+    reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
+  '';
 
-  "bitmagnet.${service_configs.https.domain}".extraConfig =
-    ''
-      # tls internal
-      ${builtins.readFile ../secrets/caddy_auth}
-      reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
-    '';
   systemd.services.bitmagnet.vpnConfinement = {
     enable = true;
     vpnNamespace = "wg";

From 7c7d35e3dc28cfd670fc8d0f80871154949490e2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Mar 2025 20:07:06 -0400
Subject: [PATCH 097/847] minecraft: move map caddy config to minecraft.nix

---
 services/caddy.nix     | 6 ------
 services/minecraft.nix | 6 ++++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 8e56c73..0863eeb 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -18,12 +18,6 @@
 
         serverAliases = [ "www.${service_configs.https.domain}" ];
       };
-
-      "map.${service_configs.https.domain}".extraConfig = ''
-        # tls internal
-        root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
-        file_server browse
-      '';
     };
   };
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index ff7d772..702cbba 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -101,6 +101,12 @@ in
     };
   };
 
+  services.caddy.virtualHosts."map.${service_configs.https.domain}".extraConfig = ''
+    # tls internal
+    root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
+    file_server browse
+  '';
+
   systemd.tmpfiles.rules = [
     "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0770 minecraft minecraft"
   ];

From 88025a75c3540e600184492b1e795d43719e076e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 14:56:00 -0400
Subject: [PATCH 098/847] matrix: fix port 443 with delegation

---
 services/matrix.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 5f5407f..fe6733a 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,7 +12,7 @@
   services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
     header /.well-known/matrix/* Content-Type application/json
     header /.well-known/matrix/* Access-Control-Allow-Origin *
-    respond /.well-known/matrix/server `{"m.server": "${service_configs.https.matrix_hostname}:443"}`
+    respond /.well-known/matrix/server `{"m.server": "${service_configs.https.matrix_hostname}:${service_configs.ports.https}"}`
     respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.https.matrix_hostname}"},"m.homeserver":{"base_url":"https://${service_configs.https.matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
   '';
 

From 008f20f3b465695280a16ecc35250b9b45027f68 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 17:20:56 -0400
Subject: [PATCH 099/847] formatting and nits

---
 configuration.nix       | 14 ++++++++++----
 flake.lock              | 24 ++++++++++++------------
 flake.nix               |  4 +++-
 services/jellyfin.nix   |  6 +++---
 services/postgresql.nix |  3 ++-
 5 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d3f2f16..db91d8f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,11 +19,13 @@
     ./services/immich.nix
     ./services/gitea.nix
     ./services/minecraft.nix
+
     ./services/wg.nix
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
-    ./services/matrix.nix
-    ./services/owntracks.nix
+
+    # ./services/matrix.nix
+    # ./services/owntracks.nix
     ./services/soulseek.nix
   ];
 
@@ -98,7 +100,10 @@
   services.openssh = {
     enable = true;
     settings = {
-      AllowUsers = [ username "root" ];
+      AllowUsers = [
+        username
+        "root"
+      ];
       PasswordAuthentication = false;
       PermitRootLogin = "yes"; # for deploying configs
     };
@@ -288,7 +293,8 @@
     ];
   };
 
-  users.users.root.openssh.authorizedKeys.keys = config.users.users.${username}.openssh.authorizedKeys.keys;
+  users.users.root.openssh.authorizedKeys.keys =
+    config.users.users.${username}.openssh.authorizedKeys.keys;
 
   # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
   programs.fish.enable = true;
diff --git a/flake.lock b/flake.lock
index c6ae6d5..a706e0a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -135,11 +135,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742234739,
-        "narHash": "sha256-zFL6zsf/5OztR1NSNQF33dvS1fL/BzVUjabZq4qrtY4=",
+        "lastModified": 1742655702,
+        "narHash": "sha256-jbqlw4sPArFtNtA1s3kLg7/A4fzP4GLk9bGbtUJg0JQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f6af7280a3390e65c2ad8fd059cdc303426cbd59",
+        "rev": "0948aeedc296f964140d9429223c7e4a0702a1ff",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742522051,
-        "narHash": "sha256-uDlj+5J7eTuFkDaNl9cYf++gJdEW23Z4zSuDcNANIQc=",
+        "lastModified": 1742608263,
+        "narHash": "sha256-NMd7fpj04y0srAbHa19o7xMk19MzIrwkOKz57mxJC5E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "57464e795fd31ceef845d7ce454d3b83e80e283e",
+        "rev": "341dc497af2d985ec97a9b5c935674b885706e52",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1742376361,
-        "narHash": "sha256-VFMgJkp/COvkt5dnkZB4D2szVdmF6DGm5ZdVvTUy61c=",
+        "lastModified": 1742631601,
+        "narHash": "sha256-yJ3OOAmsGAxSl0bTmKUp3+cEYtSS+V6hUPK2rYhIPr8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "daaae13dff0ecc692509a1332ff9003d9952d7a9",
+        "rev": "380ed15bcd6440606c6856db44a99140d422b46f",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742562948,
-        "narHash": "sha256-QUnzAW7CW0sCkFN1Kez/8UVq8EbBGNKOfHZHIZON0XQ=",
+        "lastModified": 1742596159,
+        "narHash": "sha256-SH9ein8zlFHD1xk/se3OXE3ZuxGHNyY8DlVb0fFj/bg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e7a04ccc42104e0554f0a2325930fe98db9a5325",
+        "rev": "904178ac5c12ff07a359fbb20453a977f0b7effd",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 3113d0e..2d4765f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -86,6 +86,7 @@
 
         postgres = {
           socket = "/run/postgresql";
+          dataDir = "${service_configs.services_dir}/sql";
         };
 
         immich = {
@@ -103,7 +104,8 @@
         };
 
         jellyfin = {
-          dir = services_dir + "/jellyfin";
+          dataDir = services_dir + "/jellyfin";
+          cacheDir = services_dir + "/jellyfin_cache";
         };
 
         owntracks = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 0e4b23c..911f4fd 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -12,13 +12,13 @@
     jellyfin-ffmpeg
   ];
 
-  services.jellyfin = rec {
+  services.jellyfin = {
     enable = true;
     # used for local streaming
     openFirewall = true;
 
-    dataDir = service_configs.jellyfin.dir;
-    cacheDir = dataDir + "_cache";
+    dataDir = service_configs.jellyfin.dataDir;
+    cacheDir = service_configs.jellyfin.cacheDir;
   };
 
   services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
diff --git a/services/postgresql.nix b/services/postgresql.nix
index afd552e..9bf429b 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -2,13 +2,14 @@
   pkgs,
   config,
   username,
+  service_configs,
   ...
 }:
 {
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16;
-    dataDir = "/tank/services/sql";
+    dataDir = service_configs.postgres.dataDir;
   };
 
   systemd.tmpfiles.rules = [

From 2d9232df164ff5a48784411100efa9bdeda4230a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 17:37:54 -0400
Subject: [PATCH 100/847] add nix formatter

---
 flake.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/flake.nix b/flake.nix
index 2d4765f..2567f3b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -114,6 +114,7 @@
       };
     in
     {
+      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
       nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
         specialArgs = {
           inherit

From 39ea6f90d8165a9ef965ade5a95aa86493301185 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 18:34:50 -0400
Subject: [PATCH 101/847] move some more caddy stuff to minecraft.nix

---
 services/caddy.nix     | 5 -----
 services/minecraft.nix | 6 ++++++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 0863eeb..f3024c3 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -44,11 +44,6 @@
     8448
   ];
 
-  users.users.${config.services.caddy.user}.extraGroups = [
-    # for `map.gardling.com`
-    "minecraft"
-  ];
-
   users.users.${username}.extraGroups = [
     config.services.caddy.group
   ];
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 702cbba..be362b4 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -3,6 +3,7 @@
   service_configs,
   lib,
   username,
+  config,
   ...
 }:
 let
@@ -107,6 +108,11 @@ in
     file_server browse
   '';
 
+  users.users.${config.services.caddy.user}.extraGroups = [
+    # for `map.gardling.com`
+    "minecraft"
+  ];
+
   systemd.tmpfiles.rules = [
     "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0770 minecraft minecraft"
   ];

From 3856bb56bf278b132cf8089e97dceb1a3b207c94 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 20:01:17 -0400
Subject: [PATCH 102/847] minecraft: move let..in statement

---
 services/minecraft.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index be362b4..87983be 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -6,9 +6,6 @@
   config,
   ...
 }:
-let
-  heap_size = "4000M";
-in
 {
   environment.systemPackages = [
     (pkgs.writeScriptBin "mc-console" ''
@@ -33,7 +30,11 @@ in
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_4;
 
-      jvmOpts = "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
+      jvmOpts =
+        let
+          heap_size = "4000M";
+        in
+        "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
       serverProperties = {
         server-port = 25565;

From c45c66f7772e4010bf59735017a4059dc550826e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 20:06:58 -0400
Subject: [PATCH 103/847] add comment about deploying configs to server

---
 configuration.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configuration.nix b/configuration.nix
index db91d8f..57f0ee0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -293,6 +293,7 @@
     ];
   };
 
+  # used for deploying configs to server
   users.users.root.openssh.authorizedKeys.keys =
     config.users.users.${username}.openssh.authorizedKeys.keys;
 

From 430b3ead5035119bdc719b6afbe43d7602c25652 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 20:46:55 -0400
Subject: [PATCH 104/847] add serviceMountDeps

---
 flake.nix                | 7 +++++++
 services/gitea.nix       | 5 +++++
 services/immich.nix      | 5 +++++
 services/jellyfin.nix    | 9 +++++++++
 services/minecraft.nix   | 7 +++++++
 services/postgresql.nix  | 5 +++++
 services/qbittorrent.nix | 8 ++++++++
 7 files changed, 46 insertions(+)

diff --git a/flake.nix b/flake.nix
index 2567f3b..c9c3b38 100644
--- a/flake.nix
+++ b/flake.nix
@@ -112,6 +112,12 @@
           data_dir = services_dir + "/owntracks";
         };
       };
+
+      serviceMountDeps = serviceName: dirs: {
+        systemd.services.${serviceName} = {
+          unitConfig.RequiresMountsFor = dirs;
+        };
+      };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
@@ -123,6 +129,7 @@
             eth_interface
             service_configs
             inputs
+            serviceMountDeps
             ;
         };
         modules =
diff --git a/services/gitea.nix b/services/gitea.nix
index ac337cc..335f919 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -2,9 +2,14 @@
   config,
   service_configs,
   username,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
+  ];
+
   services.gitea = {
     enable = true;
     appName = "Simon Gardling's Gitea instance";
diff --git a/services/immich.nix b/services/immich.nix
index d2b3026..1adafa0 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -3,9 +3,14 @@
   pkgs,
   config,
   username,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "immich" [ config.services.immich.mediaLocation ])
+  ];
+
   services.immich = {
     enable = true;
     mediaLocation = service_configs.immich.dir;
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 911f4fd..1870547 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -3,9 +3,17 @@
   config,
   service_configs,
   username,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "jellyfin" [
+      config.services.jellyfin.dataDir
+      config.services.jellyfin.cacheDir
+    ])
+  ];
+
   environment.systemPackages = with pkgs; [
     jellyfin
     jellyfin-web
@@ -37,6 +45,7 @@
     "video"
     "render"
     service_configs.torrent_group
+    "media"
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 87983be..f268331 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -4,9 +4,16 @@
   lib,
   username,
   config,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
+      "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
+    ])
+  ];
+
   environment.systemPackages = [
     (pkgs.writeScriptBin "mc-console" ''
       #!/bin/sh
diff --git a/services/postgresql.nix b/services/postgresql.nix
index 9bf429b..30d80c5 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -3,9 +3,14 @@
   config,
   username,
   service_configs,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ])
+  ];
+
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_16;
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 28b4617..e84d513 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -4,9 +4,17 @@
   service_configs,
   username,
   lib,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "qbittorrent" [
+      service_configs.torrent.SavePath
+      service_configs.torrent.TempPath
+    ])
+  ];
+
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     portMappings = [

From edd0b9939b4787b27391e72fa552093f58bb9d1e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 20:50:31 -0400
Subject: [PATCH 105/847] immich: fix serverMountDeps

---
 services/immich.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/immich.nix b/services/immich.nix
index 1adafa0..67b3117 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -8,7 +8,8 @@
 }:
 {
   imports = [
-    (serviceMountDeps "immich" [ config.services.immich.mediaLocation ])
+    (serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ])
+    (serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ])
   ];
 
   services.immich = {

From db7594b95d6851d8ab0e59e9cf41d243a3b9f7ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 22 Mar 2025 21:21:26 -0400
Subject: [PATCH 106/847] fix qbittorrent mount requirements

---
 services/qbittorrent.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index e84d513..735d22f 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -10,8 +10,8 @@
 {
   imports = [
     (serviceMountDeps "qbittorrent" [
-      service_configs.torrent.SavePath
-      service_configs.torrent.TempPath
+      service_configs.torrents_path
+      "/var/lib/qBittorrent/qBittorrent"
     ])
   ];
 

From 7724377b62dfaff6d2f99ced9653b6741e71569c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 23 Mar 2025 17:50:35 -0400
Subject: [PATCH 107/847] update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a706e0a..a983a82 100644
--- a/flake.lock
+++ b/flake.lock
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742596159,
-        "narHash": "sha256-SH9ein8zlFHD1xk/se3OXE3ZuxGHNyY8DlVb0fFj/bg=",
+        "lastModified": 1742735568,
+        "narHash": "sha256-979zbJFSn3aPWt5N+dt9N5n1BULL1W6sdoPEDGOSW4Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "904178ac5c12ff07a359fbb20453a977f0b7effd",
+        "rev": "0ab4a35ea3f79f11018702be57548589170f93f6",
         "type": "github"
       },
       "original": {

From 3d56d452999c48f1b7691252936d5cb3b106f8a0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:26:33 -0400
Subject: [PATCH 108/847] flake update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index a983a82..a3e61e3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1742631601,
-        "narHash": "sha256-yJ3OOAmsGAxSl0bTmKUp3+cEYtSS+V6hUPK2rYhIPr8=",
+        "lastModified": 1742806253,
+        "narHash": "sha256-zvQ4GsCJT6MTOzPKLmlFyM+lxo0JGQ0cSFaZSACmWfY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "380ed15bcd6440606c6856db44a99140d422b46f",
+        "rev": "ecaa2d911e77c265c2a5bac8b583c40b0f151726",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742735568,
-        "narHash": "sha256-979zbJFSn3aPWt5N+dt9N5n1BULL1W6sdoPEDGOSW4Y=",
+        "lastModified": 1742827197,
+        "narHash": "sha256-Kk4R74Bp49I2FpX1FQtOiRbc79zMnmzgUE0xXJvy9Ys=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0ab4a35ea3f79f11018702be57548589170f93f6",
+        "rev": "f7e08e59e383f6ebf6e921b9191b4b7c32706206",
         "type": "github"
       },
       "original": {

From a3bd648716bbcd3531bb388c9656160eb3d4da15 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:26:49 -0400
Subject: [PATCH 109/847] deploy: target public ip

---
 deploy.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy.sh b/deploy.sh
index 6e26436..77aff2d 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,2 +1,2 @@
 #!/bin/sh
-nixos-rebuild switch --flake .#muffin --target-host root@server --build-host root@server --verbose
+nixos-rebuild switch --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose

From 6dd7219f6ae894776700ac5d1fb8ad9a1d0a02db Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:27:08 -0400
Subject: [PATCH 110/847] qbt: settings

---
 services/qbittorrent.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 735d22f..4e4451d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -62,14 +62,14 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        GlobalUPSpeedLimit = 1500; # 500 KiB/s
-        GlobalDLSpeedLimit = 5000; # 5 MiB/s
+        GlobalUPSpeedLimit = 1500; # 1.500 MiB/s
+        GlobalDLSpeedLimit = -1;
 
         IgnoreLimitsOnLAN = true;
 
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = -1;
+        GlobalMaxRatio = 2.5;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;

From b750de6b18076325ae215836af656abd0dbcfab8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:33:11 -0400
Subject: [PATCH 111/847] secureboot: restrictive file permissions

---
 configuration.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 57f0ee0..b7f55ba 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -86,6 +86,8 @@
       rm -fr ${config.boot.lanzaboote.pkiBundle} || true
       mkdir -p ${config.boot.lanzaboote.pkiBundle}
       ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
+      chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+      chmod -R 700 ${config.boot.lanzaboote.pkiBundle}
     '';
   };
 

From c192d26146558b14af1fd3b7a09cac2fec20a6f8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:40:38 -0400
Subject: [PATCH 112/847] zfs: arc 2048 -> 4096 mb

---
 zfs.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/zfs.nix b/zfs.nix
index a94f8d9..14a9270 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -20,10 +20,13 @@ in
   boot.zfs.package = pkgs.zfs_unstable;
   boot.initrd.kernelModules = [ "zfs" ];
 
-  boot.kernelParams = [
-    # 2048MB
-    "zfs.zfs_arc_max=2048000000"
-  ];
+  boot.kernelParams =
+    let
+      mb = 4096;
+    in
+    [
+      "zfs.zfs_arc_max=${mb * 1000000}"
+    ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [

From b4b81dba2405068f35ad5d05ea31acb4785a8298 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 11:41:20 -0400
Subject: [PATCH 113/847] fix string conversion

---
 zfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zfs.nix b/zfs.nix
index 14a9270..1a3bae8 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -25,7 +25,7 @@ in
       mb = 4096;
     in
     [
-      "zfs.zfs_arc_max=${mb * 1000000}"
+      "zfs.zfs_arc_max=${builtins.toString (mb * 1000000)}"
     ];
 
   boot.supportedFilesystems = [ "zfs" ];

From e4dc3cf5b19c17e69da51faed7533de7e5573782 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Mar 2025 12:34:51 -0400
Subject: [PATCH 114/847] fix slskd env

---
 services/soulseek.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 86ba93c..5efa77f 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -13,7 +13,7 @@ in
   users.groups."music" = { };
 
   system.activationScripts = {
-    "zfs-key".text = ''
+    "skskd_env".text = ''
       #!/bin/sh
       rm -fr ${slskd_env} || true
       cp ${../secrets/slskd_env} ${slskd_env}

From 07274e3b0bbdb2f8ebcb4a2d8b851aaeaa00dbbd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 26 Mar 2025 00:54:11 -0400
Subject: [PATCH 115/847] 0700 -> 0500 secureboot keys

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index b7f55ba..d96c088 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -87,7 +87,7 @@
       mkdir -p ${config.boot.lanzaboote.pkiBundle}
       ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
       chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
-      chmod -R 700 ${config.boot.lanzaboote.pkiBundle}
+      chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
     '';
   };
 

From 17052bb6ec502356ff4569130f7150a1ad83ffab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 28 Mar 2025 00:02:17 -0400
Subject: [PATCH 116/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index a3e61e3..5436c42 100644
--- a/flake.lock
+++ b/flake.lock
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742608263,
-        "narHash": "sha256-NMd7fpj04y0srAbHa19o7xMk19MzIrwkOKz57mxJC5E=",
+        "lastModified": 1743097263,
+        "narHash": "sha256-Af/fF5Lxi1fTo69ygdyJlcIyrYACczBshldEIUWyf9A=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "341dc497af2d985ec97a9b5c935674b885706e52",
+        "rev": "dd88b706b63259a206fcafe07229d820abbf47f9",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742827197,
-        "narHash": "sha256-Kk4R74Bp49I2FpX1FQtOiRbc79zMnmzgUE0xXJvy9Ys=",
+        "lastModified": 1743036386,
+        "narHash": "sha256-W1Qap/jwnpvWPXC+cUp0PlaZsJO05sfQfzffRrYW7YY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f7e08e59e383f6ebf6e921b9191b4b7c32706206",
+        "rev": "1751c9cb80247edc5fed79b90211a92c56bf91e6",
         "type": "github"
       },
       "original": {

From c82d756363aefab50538ecd182e2df551fefbefa Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 28 Mar 2025 15:02:26 -0400
Subject: [PATCH 117/847] update + zfs arc increase

---
 flake.lock | 12 ++++++------
 zfs.nix    |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5436c42..6af1cba 100644
--- a/flake.lock
+++ b/flake.lock
@@ -198,11 +198,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1742806253,
-        "narHash": "sha256-zvQ4GsCJT6MTOzPKLmlFyM+lxo0JGQ0cSFaZSACmWfY=",
+        "lastModified": 1743167577,
+        "narHash": "sha256-I09SrXIO0UdyBFfh0fxDq5WnCDg8XKmZ1HQbaXzMA1k=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "ecaa2d911e77c265c2a5bac8b583c40b0f151726",
+        "rev": "0ed819e708af17bfc4bbc63ee080ef308a24aa42",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743036386,
-        "narHash": "sha256-W1Qap/jwnpvWPXC+cUp0PlaZsJO05sfQfzffRrYW7YY=",
+        "lastModified": 1743161759,
+        "narHash": "sha256-AJJy0SKtqLld9JPYi/yvI2P6qCNpcjExHuniZbRSklk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1751c9cb80247edc5fed79b90211a92c56bf91e6",
+        "rev": "873f4b2202bdac3845fa5ae294cfa2748ef0667e",
         "type": "github"
       },
       "original": {
diff --git a/zfs.nix b/zfs.nix
index 1a3bae8..a82cb56 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -22,7 +22,7 @@ in
 
   boot.kernelParams =
     let
-      mb = 4096;
+      mb = 12000;
     in
     [
       "zfs.zfs_arc_max=${builtins.toString (mb * 1000000)}"

From 3655612c49f666677a555d18390e19222ff0be8a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 29 Mar 2025 12:23:31 -0400
Subject: [PATCH 118/847] update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6af1cba..ea027e9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743097263,
-        "narHash": "sha256-Af/fF5Lxi1fTo69ygdyJlcIyrYACczBshldEIUWyf9A=",
+        "lastModified": 1743213175,
+        "narHash": "sha256-6cI/ScqqZekTwhyBgqInX3ZPXzXdsqy64NjvSvzuCpo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "dd88b706b63259a206fcafe07229d820abbf47f9",
+        "rev": "5ac2c907b5ebfea6d999fb861561f5b096a2e9e1",
         "type": "github"
       },
       "original": {

From 952f14c2c5d4948505238ace0ffa44ef6bcf9b09 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 30 Mar 2025 15:36:54 -0400
Subject: [PATCH 119/847] update

---
 flake.lock               | 12 ++++++------
 services/qbittorrent.nix |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index ea027e9..f17ac99 100644
--- a/flake.lock
+++ b/flake.lock
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743213175,
-        "narHash": "sha256-6cI/ScqqZekTwhyBgqInX3ZPXzXdsqy64NjvSvzuCpo=",
+        "lastModified": 1743300109,
+        "narHash": "sha256-P+3ux9uyGsbzWSvfB3sAzvERTonvthc2iCDJYh6bIeM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5ac2c907b5ebfea6d999fb861561f5b096a2e9e1",
+        "rev": "bd7ef340501fbd2cb855a3b725992914b5fa5fbe",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743161759,
-        "narHash": "sha256-AJJy0SKtqLld9JPYi/yvI2P6qCNpcjExHuniZbRSklk=",
+        "lastModified": 1743290600,
+        "narHash": "sha256-v2NB8B3EahTvJ0Zg6QVJVUjq2cBwZ0UKTwMr2nv9718=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "873f4b2202bdac3845fa5ae294cfa2748ef0667e",
+        "rev": "b9c20f02b5c6e5ef418767eac59c2655d18419f0",
         "type": "github"
       },
       "original": {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4e4451d..e12a33d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -63,7 +63,7 @@
     serverConfig.BitTorrent = {
       Session = {
         GlobalUPSpeedLimit = 1500; # 1.500 MiB/s
-        GlobalDLSpeedLimit = -1;
+        GlobalDLSpeedLimit = 500; # 500 KiB/s
 
         IgnoreLimitsOnLAN = true;
 

From 37cebee3ec5dd10a1ee233109c5d513146665095 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 01:39:21 -0400
Subject: [PATCH 120/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index f17ac99..5160a1b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -135,11 +135,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742655702,
-        "narHash": "sha256-jbqlw4sPArFtNtA1s3kLg7/A4fzP4GLk9bGbtUJg0JQ=",
+        "lastModified": 1743387206,
+        "narHash": "sha256-24N3NAuZZbYqZ39NgToZgHUw6M7xHrtrAm18kv0+2Wo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0948aeedc296f964140d9429223c7e4a0702a1ff",
+        "rev": "15c5f9d04fabd176f30286c8f52bbdb2c853a146",
         "type": "github"
       },
       "original": {
@@ -183,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743300109,
-        "narHash": "sha256-P+3ux9uyGsbzWSvfB3sAzvERTonvthc2iCDJYh6bIeM=",
+        "lastModified": 1743386393,
+        "narHash": "sha256-NmEVRiuYMVMsvJy0XoK2LZpsOKgKOl5yNjA50VeUip4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "bd7ef340501fbd2cb855a3b725992914b5fa5fbe",
+        "rev": "614092c967b71cb9857a9fbcbf2c09bd3eea76ff",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743290600,
-        "narHash": "sha256-v2NB8B3EahTvJ0Zg6QVJVUjq2cBwZ0UKTwMr2nv9718=",
+        "lastModified": 1743354925,
+        "narHash": "sha256-B+AxLrBmlMmnkGD/5PWtoy2zdk/0epewoUw4EDlc8lA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b9c20f02b5c6e5ef418767eac59c2655d18419f0",
+        "rev": "47d6fd35d221f4a8fe8d45cbaec844d59c7dd6c2",
         "type": "github"
       },
       "original": {

From 925031c640b7e3c4619851bdfcf16acba75d02c5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 03:19:55 -0400
Subject: [PATCH 121/847] add llama-server

---
 configuration.nix      |  2 ++
 flake.lock             | 52 ++++++++++++++++++++++++++++++++++++++++++
 flake.nix              |  7 ++++++
 services/llama-cpp.nix | 28 +++++++++++++++++++++++
 4 files changed, 89 insertions(+)
 create mode 100644 services/llama-cpp.nix

diff --git a/configuration.nix b/configuration.nix
index d96c088..6288472 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -27,6 +27,8 @@
     # ./services/matrix.nix
     # ./services/owntracks.nix
     ./services/soulseek.nix
+
+    # ./services/llama-cpp.nix
   ];
 
   systemd.targets = {
diff --git a/flake.lock b/flake.lock
index 5160a1b..ca2927e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -88,6 +88,24 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -174,6 +192,27 @@
         "type": "github"
       }
     },
+    "llamacpp": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743366063,
+        "narHash": "sha256-Jrvjz9A8oGVo4KCP2miGX2VxIm5mRNPVIEcEaVBDRsE=",
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "rev": "2c3f8b850a4a6cff0f5dda2135c03fc81d33ed8b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -228,6 +267,18 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      }
+    },
     "nixpkgs-qbt": {
       "locked": {
         "lastModified": 1738103934,
@@ -275,6 +326,7 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
+        "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index c9c3b38..2361afe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,6 +29,11 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    llamacpp = {
+      url = "github:ggml-org/llama.cpp";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -41,6 +46,7 @@
       home-manager,
       lanzaboote,
       disko,
+      llamacpp,
       ...
     }@inputs:
     let
@@ -68,6 +74,7 @@
           immich = 2284;
           soulseek_web = 5030;
           soulseek_listen = 50300;
+          llama_cpp = 8991;
         };
 
         https = {
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
new file mode 100644
index 0000000..cf3a62e
--- /dev/null
+++ b/services/llama-cpp.nix
@@ -0,0 +1,28 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  inputs,
+  ...
+}:
+{
+  services.llama-cpp = {
+    enable = true;
+    model = builtins.toString (
+      pkgs.fetchurl {
+        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-IQ4_XS.gguf";
+        sha256 = "bd2f188c66d8ccb0bffcb0c91e4dbbb72754bb1732e0bca323a2f266a35e01c8";
+      }
+    );
+    port = service_configs.ports.llama_cpp;
+    host = "0.0.0.0";
+    package = inputs.llamacpp.packages.${pkgs.system}.default;
+    extraFlags = [
+
+    ];
+  };
+
+  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString config.services.llama-cpp.port}
+  '';
+}

From 6097b3ce0f9c8b2c1e8dbced94d3b28395899c9a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 10:29:36 -0400
Subject: [PATCH 122/847] auth for llm

---
 flake.lock               | 18 +++++++++---------
 services/bitmagnet.nix   |  1 -
 services/llama-cpp.nix   |  1 +
 services/minecraft.nix   |  1 -
 services/qbittorrent.nix |  1 -
 5 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index ca2927e..2d3e1d6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743366063,
-        "narHash": "sha256-Jrvjz9A8oGVo4KCP2miGX2VxIm5mRNPVIEcEaVBDRsE=",
+        "lastModified": 1743424621,
+        "narHash": "sha256-M4dHt10aGASKjoRtafFMJfewANh/7+O6t+ITb9oPsNY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2c3f8b850a4a6cff0f5dda2135c03fc81d33ed8b",
+        "rev": "a8a1f3356786cbf8bcc3422e3c8737fc33b453e7",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1743167577,
-        "narHash": "sha256-I09SrXIO0UdyBFfh0fxDq5WnCDg8XKmZ1HQbaXzMA1k=",
+        "lastModified": 1743420942,
+        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "0ed819e708af17bfc4bbc63ee080ef308a24aa42",
+        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743354925,
-        "narHash": "sha256-B+AxLrBmlMmnkGD/5PWtoy2zdk/0epewoUw4EDlc8lA=",
+        "lastModified": 1743398199,
+        "narHash": "sha256-Zy9o4AiBVjmswfXtw5l0YTUSEp676YKAqC9Z2d6MvI0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "47d6fd35d221f4a8fe8d45cbaec844d59c7dd6c2",
+        "rev": "e9549075069ef5e68ddf29cb07c0e38e2a915242",
         "type": "github"
       },
       "original": {
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 437f258..5396fe3 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -36,7 +36,6 @@
   };
 
   services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
-    # tls internal
     ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
   '';
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index cf3a62e..f26dc6f 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -23,6 +23,7 @@
   };
 
   services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
+    ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy :${builtins.toString config.services.llama-cpp.port}
   '';
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index f268331..3a4f314 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -111,7 +111,6 @@
   };
 
   services.caddy.virtualHosts."map.${service_configs.https.domain}".extraConfig = ''
-    # tls internal
     root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
     file_server browse
   '';
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index e12a33d..2aa353f 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -121,7 +121,6 @@
   };
 
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
-    # tls internal
     ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
   '';

From 6cd839cdce0e22af1dd40b8d6805fffa8fa5b5eb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 10:31:29 -0400
Subject: [PATCH 123/847] gemma-3 12b

---
 configuration.nix      | 2 +-
 services/llama-cpp.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 6288472..19055af 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
   ];
 
   systemd.targets = {
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index f26dc6f..94e5eff 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -10,8 +10,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-IQ4_XS.gguf";
-        sha256 = "bd2f188c66d8ccb0bffcb0c91e4dbbb72754bb1732e0bca323a2f266a35e01c8";
+        url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-IQ4_XS.gguf";
+        sha256 = "aa7b7ae0b17931c379ede82da59b01f246046925aeb752af1ab4285a3b0d69db";
       }
     );
     port = service_configs.ports.llama_cpp;

From 75ea442642fa8719244873f68bcaa44501994d8a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 11:17:32 -0400
Subject: [PATCH 124/847] llama-cpp: compiler optimizations

---
 services/llama-cpp.nix | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 94e5eff..76918de 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -5,6 +5,23 @@
   inputs,
   ...
 }:
+let
+
+  # stolen from: https://stackoverflow.com/a/42398526
+  optimizeWithFlags =
+    pkg: flags:
+    pkgs.lib.overrideDerivation pkg (
+      old:
+      let
+        newflags = pkgs.lib.foldl' (acc: x: "${acc} ${x}") "" flags;
+        oldflags = if (pkgs.lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
+      in
+      {
+        NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
+        stdenv = pkgs.clang19Stdenv;
+      }
+    );
+in
 {
   services.llama-cpp = {
     enable = true;
@@ -16,7 +33,13 @@
     );
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
-    package = inputs.llamacpp.packages.${pkgs.system}.default;
+    package = (
+      optimizeWithFlags inputs.llamacpp.packages.${pkgs.system}.default [
+        "-O3"
+        "-march=znver2"
+        "-mtune=znver2"
+      ]
+    );
     extraFlags = [
 
     ];

From 4a3b1b14f27570701b953ac9f6d9df4c568124f0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 12:02:38 -0400
Subject: [PATCH 125/847] llm: enable AVX2

---
 services/llama-cpp.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 76918de..7a4f568 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -34,14 +34,20 @@ in
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
     package = (
-      optimizeWithFlags inputs.llamacpp.packages.${pkgs.system}.default [
-        "-O3"
-        "-march=znver2"
-        "-mtune=znver2"
-      ]
+      optimizeWithFlags
+        (inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
+          cmakeFlags = old.cmakeFlags ++ [
+            "-DGGML_AVX2=ON"
+          ];
+        }))
+        [
+          "-O3"
+          "-march=znver2"
+          "-mtune=znver2"
+        ]
     );
     extraFlags = [
-
+      "--flash-attn"
     ];
   };
 

From fd3fcac42dbcd97fe6fd4bbebdb5169de4ae7cda Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 16:02:37 -0400
Subject: [PATCH 126/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2d3e1d6..7269f2d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743424621,
-        "narHash": "sha256-M4dHt10aGASKjoRtafFMJfewANh/7+O6t+ITb9oPsNY=",
+        "lastModified": 1743439256,
+        "narHash": "sha256-eVxyPbpJuQV3qShmoerj6xzjUsB/UmNGbqP0cNBv42g=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "a8a1f3356786cbf8bcc3422e3c8737fc33b453e7",
+        "rev": "c80a7759dab10657b9b6c3e87eef988a133b9b6a",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743398199,
-        "narHash": "sha256-Zy9o4AiBVjmswfXtw5l0YTUSEp676YKAqC9Z2d6MvI0=",
+        "lastModified": 1743445058,
+        "narHash": "sha256-jayDP/dth0BdbFGM2C0Ny7uRHwwA0ppbB+2s23QG9Vk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9549075069ef5e68ddf29cb07c0e38e2a915242",
+        "rev": "e4a74fd10b211a6d8f5575a85154aac0209a8e55",
         "type": "github"
       },
       "original": {

From 8ac8f707005ffdaa37a62b846ba6cdf611b7a627 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 17:04:41 -0400
Subject: [PATCH 127/847] format

---
 services/llama-cpp.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 7a4f568..008c904 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -6,7 +6,6 @@
   ...
 }:
 let
-
   # stolen from: https://stackoverflow.com/a/42398526
   optimizeWithFlags =
     pkg: flags:

From 516e2391a712d8f7e8cd18541a22e26d666fe754 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 18:33:24 -0400
Subject: [PATCH 128/847] llm: use Q4_0 quants (faster)

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 008c904..59f67e3 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -26,8 +26,8 @@ in
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-IQ4_XS.gguf";
-        sha256 = "aa7b7ae0b17931c379ede82da59b01f246046925aeb752af1ab4285a3b0d69db";
+        url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
+        sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
       }
     );
     port = service_configs.ports.llama_cpp;

From 3119cc3594b4b40fecf315280e67d5100da90735 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 31 Mar 2025 21:52:14 -0400
Subject: [PATCH 129/847] gemma-3 27b

---
 services/llama-cpp.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 59f67e3..f88e4b5 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -25,9 +25,13 @@ in
   services.llama-cpp = {
     enable = true;
     model = builtins.toString (
+      # pkgs.fetchurl {
+        # url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
+        # sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
+      # }
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
-        sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
+        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-Q4_0.gguf";
+        sha256 = "a6edacc9e7bab200eea6dd9ff4568c5838e959235dd0da71309e68ff5c81d775";
       }
     );
     port = service_configs.ports.llama_cpp;

From d8d90a2cfd66091a2c137520dcf405c80ce592b7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Apr 2025 10:11:41 -0400
Subject: [PATCH 130/847] llm: use finetuned model

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index f88e4b5..6805dbc 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -30,8 +30,8 @@ in
         # sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
       # }
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-Q4_0.gguf";
-        sha256 = "a6edacc9e7bab200eea6dd9ff4568c5838e959235dd0da71309e68ff5c81d775";
+        url = "https://huggingface.co/bartowski/mlabonne_gemma-3-27b-it-abliterated-GGUF/resolve/main/mlabonne_gemma-3-27b-it-abliterated-Q4_0.gguf";
+        sha256 = "d47047ff6fabb02e8aa8bea1d3fd32a551382016bd7d91f45f74615ada670a21";
       }
     );
     port = service_configs.ports.llama_cpp;

From 55a49e9b6a02d0b28e5f3091d4656dc5ff8707e6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Apr 2025 10:11:48 -0400
Subject: [PATCH 131/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7269f2d..5949b3b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741786315,
-        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
+        "lastModified": 1743598667,
+        "narHash": "sha256-ViE7NoFWytYO2uJONTAX35eGsvTYXNHjWALeHAg8OQY=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
+        "rev": "329d3d7e8bc63dd30c39e14e6076db590a6eabe6",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743439256,
-        "narHash": "sha256-eVxyPbpJuQV3qShmoerj6xzjUsB/UmNGbqP0cNBv42g=",
+        "lastModified": 1743601134,
+        "narHash": "sha256-Lk9LrFIIydQu/3lybw9Lyw3G+Iw7CwvN05eC4tf4m+s=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c80a7759dab10657b9b6c3e87eef988a133b9b6a",
+        "rev": "833e2b7409211a07df97716998c5002526642652",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743386393,
-        "narHash": "sha256-NmEVRiuYMVMsvJy0XoK2LZpsOKgKOl5yNjA50VeUip4=",
+        "lastModified": 1743558957,
+        "narHash": "sha256-fem8N9FBKtIu04Fq5Q3KbcFA0EjEviicsKctYTLzIRE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "614092c967b71cb9857a9fbcbf2c09bd3eea76ff",
+        "rev": "01442a9d7c7a1d7fe5a526c54bf1a70fbc6bd182",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743445058,
-        "narHash": "sha256-jayDP/dth0BdbFGM2C0Ny7uRHwwA0ppbB+2s23QG9Vk=",
+        "lastModified": 1743576891,
+        "narHash": "sha256-vXiKURtntURybE6FMNFAVpRPr8+e8KoLPrYs9TGuAKc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e4a74fd10b211a6d8f5575a85154aac0209a8e55",
+        "rev": "44a69ed688786e98a101f02b712c313f1ade37ab",
         "type": "github"
       },
       "original": {

From a660d39a79d80386e6f33145bafe652350a0ae97 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Apr 2025 23:06:55 -0400
Subject: [PATCH 132/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5949b3b..5f31235 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743601134,
-        "narHash": "sha256-Lk9LrFIIydQu/3lybw9Lyw3G+Iw7CwvN05eC4tf4m+s=",
+        "lastModified": 1743643875,
+        "narHash": "sha256-s8UFfKa6NeLnGCQ2pljgSPzMKGxEaJTE+7vFOQ6Pfpg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "833e2b7409211a07df97716998c5002526642652",
+        "rev": "3f9da22c2b21a2cef216de50006436ef1cab8764",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743558957,
-        "narHash": "sha256-fem8N9FBKtIu04Fq5Q3KbcFA0EjEviicsKctYTLzIRE=",
+        "lastModified": 1743645265,
+        "narHash": "sha256-BR63p2MRsMoqDAhkvXoZgJeDkRxyS+muFHChB2IWqdA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "01442a9d7c7a1d7fe5a526c54bf1a70fbc6bd182",
+        "rev": "b077dee2aaa3a7bc5d68ff1762a9be375ffd993d",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743576891,
-        "narHash": "sha256-vXiKURtntURybE6FMNFAVpRPr8+e8KoLPrYs9TGuAKc=",
+        "lastModified": 1743610589,
+        "narHash": "sha256-WGF28rESap8yMXII9GoMm38C5UpoieC2aXdT/xOgNuk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "44a69ed688786e98a101f02b712c313f1ade37ab",
+        "rev": "f2c3ddb8ae619ff2b036a7d5455559b2fb81a4d4",
         "type": "github"
       },
       "original": {

From d4acb26617297a6803bb94fde884bc03d38fdba1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Apr 2025 23:18:58 -0400
Subject: [PATCH 133/847] minecraft: 1.21.4 -> 1.21.5

---
 services/minecraft.nix | 56 +++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 23 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 3a4f314..bf327e6 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -35,7 +35,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_4;
+      package = pkgs.fabricServers.fabric-1_21_5;
 
       jvmOpts =
         let
@@ -60,43 +60,48 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/HbTXYTBz/fabric-api-0.119.0%2B1.21.4.jar";
-              sha512 = "f2e44507dcf7c34ac5104bf78c0f0f0ab99840272d0c1afc51236b7f8a56541bd5c2024953a83599034e1b55191e38b3e437b6b80736137e2ee4d7d571f42c82";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/rYSz5dRU/fabric-api-0.119.6%2B1.21.5.jar";
+              sha512 = "80a4660c9bf5410b37ee4c2bf86ed1fcaccd77cea7fd203e00650659f02271a71d367cd95178f9177998401d1693ec48753a3e73b1ba96631c014e7a92d64501";
             };
 
             FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/IPM0JlHd/ferritecore-7.1.1-fabric.jar";
-              sha512 = "f41dc9e8b28327a1e29b14667cb42ae5e7e17bcfa4495260f6f851a80d4b08d98a30d5c52b110007ee325f02dac7431e3fad4560c6840af0bf347afad48c5aac";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/CtMpt7Jr/ferritecore-8.0.0-fabric.jar";
+              sha512 = "131b82d1d366f0966435bfcb38c362d604d68ecf30c106d31a6261bfc868ca3a82425bb3faebaa2e5ea17d8eed5c92843810eb2df4790f2f8b1e6c1bdc9b7745";
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/kLc5Oxr4/lithium-fabric-0.14.8%2Bmc1.21.4.jar";
-              sha512 = "ea0d7a4aea29b32527245d933227c85d0606e17c88cc05ed9918a1b966f22011961bfa85e33ab318e729f1ac3e69217d37709413bf70d1dc5a3acc9fd75ef317";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/nhc57Td2/lithium-fabric-0.16.0%2Bmc1.21.5.jar";
+              sha512 = "4be66cbb840501e9d7dfbcb6942daba6ce6b8f462694ee498d5c899e476e6d36697bcec70c49c818ca914571c70805de3d8b9a1e4c12c1bb7a3dc89dccbef17f";
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/9xt05630/NoChatReports-FABRIC-1.21.4-v2.11.0.jar";
-              sha512 = "d343b05c8e50f1de15791ff622ad44eeca6cdcb21e960a267a17d71506c61ca79b1c824167779e44d778ca18dcbdebe594ff234fbe355b68d25cdb5b6afd6e4f";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/CHlHxkvf/NoChatReports-FABRIC-1.21.5-v2.12.0.jar";
+              sha512 = "c0825db25672cf8b50face51ec8a6bedb4be50b374a2537640a433c98817bc07c177485e93ab8cee9e3f7bfb1d2eb1460309e818b411764c92426b552487a9f7";
             };
 
-            moonrise = fetchurl {
-              url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/6Dgh9jQx/Moonrise-Fabric-0.2.0-beta.9%2Bac0c7de.jar";
-              sha512 = "c101f1a41db4095d651d32eae47bd7e6f7358f7390898610d1bf261ebfc7e0f4165fd551c08a99cca31a3308f1989a16b8c75c1ece60ef9cd475107ca4f4219e";
-            };
+            # waiting for 1.21.5 version:
+            # https://github.com/Tuinity/Moonrise/tree/mc/1.21.5
+            # moonrise = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/6Dgh9jQx/Moonrise-Fabric-0.2.0-beta.9%2Bac0c7de.jar";
+            #   sha512 = "c101f1a41db4095d651d32eae47bd7e6f7358f7390898610d1bf261ebfc7e0f4165fd551c08a99cca31a3308f1989a16b8c75c1ece60ef9cd475107ca4f4219e";
+            # };
 
-            squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/9i2KwI5R/squaremap-fabric-mc1.21.4-1.3.4.jar";
-              sha512 = "6eb44061f057d1bbd0bb6f9186d03d496479dcd953af8f09f70099c2e67e567e5dca626972d45af0315c2e2714c3dd74beef97575396e3bb90b7c670f5c80fef";
-            };
+            # doesn't support 1.21.5:
+            # https://github.com/jpenilla/squaremap/issues/386
+            # squaremap = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/9i2KwI5R/squaremap-fabric-mc1.21.4-1.3.4.jar";
+            #   sha512 = "6eb44061f057d1bbd0bb6f9186d03d496479dcd953af8f09f70099c2e67e567e5dca626972d45af0315c2e2714c3dd74beef97575396e3bb90b7c670f5c80fef";
+            # };
 
-            modernfix = fetchurl {
-              url = "https://cdn.modrinth.com/data/nmDcB62a/versions/ZGxQddYr/modernfix-fabric-5.20.3%2Bmc1.21.4.jar";
-              sha512 = "ae49114c92a048c9ce79e197fc4df028e186cf13546e710f72247382fa8076f0b70d6aa3224951f4a36c886ca236f099a011f20b021a2b0d1a75c631da4d7d52";
-            };
+            # doesn't support 1.21.5
+            # modernfix = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/nmDcB62a/versions/ZGxQddYr/modernfix-fabric-5.20.3%2Bmc1.21.4.jar";
+            #   sha512 = "ae49114c92a048c9ce79e197fc4df028e186cf13546e710f72247382fa8076f0b70d6aa3224951f4a36c886ca236f099a011f20b021a2b0d1a75c631da4d7d52";
+            # };
 
             alternatecurrent = fetchurl {
-              url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/DwfiGUVU/alternate-current-mc1.21.2-1.9.1.jar";
-              sha512 = "8ed44291a8aed3e1c9750cfce85e0de679daeff7c3b1bc8f6329b41ba4570442750b8039d2d5c79c32655fc9372ea35843c60805438d33888b30e28731c39137";
+              url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/eTNKfjl1/alternate-current-mc1.21.5-1.9.0.jar";
+              sha512 = "3e4088170917846b30275825420b553e3fc3befb52bb259848853b93343bae3b39cd592902c0c79f05b17381d80170784990d9c4e110ff3b6c552e5508b40d67";
             };
 
             # fix `Error sending packet clientbound/minecraft:disconnect` error
@@ -104,6 +109,11 @@
               url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
               sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
             };
+
+            krypton = fetchurl {
+              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/neW85eWt/krypton-0.2.9.jar";
+              sha512 = "2e2304b1b17ecf95783aee92e26e54c9bfad325c7dfcd14deebf9891266eb2933db00ff77885caa083faa96f09c551eb56f93cf73b357789cb31edad4939ffeb";
+            };
           }
         );
       };

From 3c727db2b2aa596713faf1b8278722cb216ee138 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 2 Apr 2025 23:19:06 -0400
Subject: [PATCH 134/847] fmt

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 6805dbc..9a29016 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -26,8 +26,8 @@ in
     enable = true;
     model = builtins.toString (
       # pkgs.fetchurl {
-        # url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
-        # sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
+      # url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
+      # sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
       # }
       pkgs.fetchurl {
         url = "https://huggingface.co/bartowski/mlabonne_gemma-3-27b-it-abliterated-GGUF/resolve/main/mlabonne_gemma-3-27b-it-abliterated-Q4_0.gguf";

From 90baa22ab58302515ffed0f9c785d43036aaeae6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 3 Apr 2025 14:55:26 -0400
Subject: [PATCH 135/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5f31235..2b73a78 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743643875,
-        "narHash": "sha256-s8UFfKa6NeLnGCQ2pljgSPzMKGxEaJTE+7vFOQ6Pfpg=",
+        "lastModified": 1743697229,
+        "narHash": "sha256-pvKKYCreCcw4iPI09INlAMqdSBO4eRKHr31szhRLYCQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "3f9da22c2b21a2cef216de50006436ef1cab8764",
+        "rev": "c262beddf29f3f3be5bbbf167b56029a19876956",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743610589,
-        "narHash": "sha256-WGF28rESap8yMXII9GoMm38C5UpoieC2aXdT/xOgNuk=",
+        "lastModified": 1743662880,
+        "narHash": "sha256-SJGfTwLwEZDFvJ2Jtfh00z1pFa6LjR8I7UbXNR40uHU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f2c3ddb8ae619ff2b036a7d5455559b2fb81a4d4",
+        "rev": "a3d31201243547359e6ebe1c1d407cf768eebf2e",
         "type": "github"
       },
       "original": {

From 915d42e7dbfaee7fa993494295d43c3eafb1f717 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 5 Apr 2025 13:54:03 -0400
Subject: [PATCH 136/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2b73a78..c1d3f3b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743387206,
-        "narHash": "sha256-24N3NAuZZbYqZ39NgToZgHUw6M7xHrtrAm18kv0+2Wo=",
+        "lastModified": 1743808813,
+        "narHash": "sha256-2lDQBOmlz9ggPxcS7/GvcVdzXMIiT+PpMao6FbLJSr0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "15c5f9d04fabd176f30286c8f52bbdb2c853a146",
+        "rev": "a9f8b3db211b4609ddd83683f9db89796c7f6ac6",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743697229,
-        "narHash": "sha256-pvKKYCreCcw4iPI09INlAMqdSBO4eRKHr31szhRLYCQ=",
+        "lastModified": 1743869043,
+        "narHash": "sha256-dOvdvxR3HHzuuhDWiCk/+Ly0u8WnfjyWfg3eOVfDWmQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c262beddf29f3f3be5bbbf167b56029a19876956",
+        "rev": "6bf28f0111ff9f21b3c1b1eace20c590281e7ba6",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743645265,
-        "narHash": "sha256-BR63p2MRsMoqDAhkvXoZgJeDkRxyS+muFHChB2IWqdA=",
+        "lastModified": 1743731670,
+        "narHash": "sha256-CiAsYNtZy+5tMyId4OoJQwkXy6iROvP9hoFkXzuoAFI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b077dee2aaa3a7bc5d68ff1762a9be375ffd993d",
+        "rev": "5822965a54c2439c004918cbb7bf1f64b64f3352",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743662880,
-        "narHash": "sha256-SJGfTwLwEZDFvJ2Jtfh00z1pFa6LjR8I7UbXNR40uHU=",
+        "lastModified": 1743792629,
+        "narHash": "sha256-dqQv17m0O5j9YUHXM1RZr3jtTDYqLUBjtJUlLHYAZEo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a3d31201243547359e6ebe1c1d407cf768eebf2e",
+        "rev": "749bd56cf89ec71d3c953d5fbfe27ede27d04c37",
         "type": "github"
       },
       "original": {
@@ -281,11 +281,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1738103934,
-        "narHash": "sha256-MhDdcDDdK2uscLU370r3V9PQcejx+2LVbMG8bjCXMb0=",
+        "lastModified": 1743722002,
+        "narHash": "sha256-MAypbzET/N/7hhVov7CgsKndj+82vu/Z2etRRP/Njns=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4f4706686c921ef202712a00da1c96f0100f6921",
+        "rev": "5a582c37b3dc1304f2d32a4333bd3f2b345ef9d0",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1742138327,
-        "narHash": "sha256-Y71Mjej98CjaUKa1ecAIOo0eJ1B3ZVQl2ng6xl7/s9Y=",
+        "lastModified": 1743810720,
+        "narHash": "sha256-kbv/W4gizUSa6qH2rUQdgPj9AJaeN9k2XSWUYqj7IMU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "38eeb3bc501900b48d1caf8c52a5b7f2fb7a52c5",
+        "rev": "74ae51e6d18b972ecc918ab43e8bde60c21a65d8",
         "type": "github"
       },
       "original": {

From 96fb867ef1429988d28136e66209303a65b2513f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 6 Apr 2025 14:24:35 -0400
Subject: [PATCH 137/847] slskd: properly integrate into zfs volumes and
 permissions

---
 flake.nix             |  6 ++++++
 services/soulseek.nix | 13 ++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 2361afe..9e088fc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -118,6 +118,12 @@
         owntracks = {
           data_dir = services_dir + "/owntracks";
         };
+
+        slskd = rec {
+          base = "/var/lib/slskd";
+          downloads = base + "/downloads";
+          incomplete = base + "/incomplete";
+        };
       };
 
       serviceMountDeps = serviceName: dirs: {
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 5efa77f..2a5de74 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -4,12 +4,21 @@
   lib,
   service_configs,
   username,
+  serviceMountDeps,
   ...
 }:
 let
   slskd_env = "/etc/slskd_env";
 in
 {
+  imports = [
+    (serviceMountDeps "slskd" [
+      service_configs.slskd.base
+      service_configs.slskd.downloads
+      service_configs.slskd.incomplete
+    ])
+  ];
+
   users.groups."music" = { };
 
   system.activationScripts = {
@@ -58,7 +67,9 @@ in
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.music_dir} 0750 ${username} music"
-    "d ${service_configs.music_dir} 0750 ${username} music"
+    "d ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
+    "d ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
+    "d ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
   ];
 
   # doesn't work with auth????

From 2e6fec6bca2bbfaa97ea16538069bfd0091a0a82 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 6 Apr 2025 14:45:30 -0400
Subject: [PATCH 138/847] minecraft: add squaremap PR in comment

---
 services/minecraft.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index bf327e6..e823739 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -88,6 +88,7 @@
 
             # doesn't support 1.21.5:
             # https://github.com/jpenilla/squaremap/issues/386
+            # https://github.com/jpenilla/squaremap/pull/387
             # squaremap = fetchurl {
             #   url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/9i2KwI5R/squaremap-fabric-mc1.21.4-1.3.4.jar";
             #   sha512 = "6eb44061f057d1bbd0bb6f9186d03d496479dcd953af8f09f70099c2e67e567e5dca626972d45af0315c2e2714c3dd74beef97575396e3bb90b7c670f5c80fef";

From 7a200d22c8dc180d2738ebd7005cad07054fe4d1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 6 Apr 2025 14:45:39 -0400
Subject: [PATCH 139/847] fix soulseek folder permissions

---
 services/soulseek.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 2a5de74..eb1148f 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -64,6 +64,7 @@ in
 
   users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
   users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
+  users.users.${username}.extraGroups = [ "music" ];
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.music_dir} 0750 ${username} music"

From 501ee24f62c6fe10add78d4a5d67e0386b4e9c39 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 6 Apr 2025 14:45:43 -0400
Subject: [PATCH 140/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index c1d3f3b..c4ded80 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743869043,
-        "narHash": "sha256-dOvdvxR3HHzuuhDWiCk/+Ly0u8WnfjyWfg3eOVfDWmQ=",
+        "lastModified": 1743945834,
+        "narHash": "sha256-ZO2feSnDgGFKrp+O9Pp/pjWkL/ko0GAPtv8fLnCEdlg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "6bf28f0111ff9f21b3c1b1eace20c590281e7ba6",
+        "rev": "916c83bfe7f8b08ada609c3b8e583cf5301e594b",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743792629,
-        "narHash": "sha256-dqQv17m0O5j9YUHXM1RZr3jtTDYqLUBjtJUlLHYAZEo=",
+        "lastModified": 1743891346,
+        "narHash": "sha256-QNxnxIi6PJEnwJp7ZXUpxX4/z/cmRJGeIOkIYfYh/8E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "749bd56cf89ec71d3c953d5fbfe27ede27d04c37",
+        "rev": "f27c6099cec4fe9b67c7fbc51d8324dcb4b52694",
         "type": "github"
       },
       "original": {

From 7c1843830515109240e5853cd820cc55589608bb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 10:14:50 -0400
Subject: [PATCH 141/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index c4ded80..39a8ffd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743945834,
-        "narHash": "sha256-ZO2feSnDgGFKrp+O9Pp/pjWkL/ko0GAPtv8fLnCEdlg=",
+        "lastModified": 1744029448,
+        "narHash": "sha256-egX91Q77jyXOZ1kNR8jdgT86vitDVnMDRFAbmfmoZLU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "916c83bfe7f8b08ada609c3b8e583cf5301e594b",
+        "rev": "e391d3ee8ddae86be70c034de1082ad51c55e211",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743731670,
-        "narHash": "sha256-CiAsYNtZy+5tMyId4OoJQwkXy6iROvP9hoFkXzuoAFI=",
+        "lastModified": 1743991090,
+        "narHash": "sha256-gZK+vyw5BeQ8cmdigRN0uInhyfrXWJXFsZEP/Wh+ay8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5822965a54c2439c004918cbb7bf1f64b64f3352",
+        "rev": "021d01fa37cdc9dc936c3a1f7ca6dc9354b21589",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743891346,
-        "narHash": "sha256-QNxnxIi6PJEnwJp7ZXUpxX4/z/cmRJGeIOkIYfYh/8E=",
+        "lastModified": 1743987495,
+        "narHash": "sha256-46T2vMZ4/AfCK0Y2OjlFzJPxmdpP8GtsuEqSSJv3oe4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f27c6099cec4fe9b67c7fbc51d8324dcb4b52694",
+        "rev": "db8f4fe18ce772a9c8f3adf321416981c8fe9371",
         "type": "github"
       },
       "original": {
@@ -281,11 +281,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1743722002,
-        "narHash": "sha256-MAypbzET/N/7hhVov7CgsKndj+82vu/Z2etRRP/Njns=",
+        "lastModified": 1744007630,
+        "narHash": "sha256-Bp9zvSffazGFv63DW6HnVtJvDBGP8Q44Y6AsrcSKU/Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5a582c37b3dc1304f2d32a4333bd3f2b345ef9d0",
+        "rev": "ae375e942eef10c579ac274e503da4dc50d9629c",
         "type": "github"
       },
       "original": {

From 55a5b24ef87f6885952262eaeccac8ed7930088c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 10:45:13 -0400
Subject: [PATCH 142/847] kernel: 6.12 -> 6.6 (because of kworker issues)

---
 configuration.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 19055af..352899c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -58,8 +58,8 @@
   };
 
   boot = {
-    # 6.12 LTS until 2027
-    kernelPackages = pkgs.linuxPackages_6_12;
+    # 6.6 LTS until 2026
+    kernelPackages = pkgs.linuxPackages_6_6;
 
     loader = {
       # Use the systemd-boot EFI boot loader.

From 99978c108b697129977c96e70fb79ecbbc9ec7ac Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 14:31:56 -0400
Subject: [PATCH 143/847] move optimizeWithFlags

---
 flake.nix              | 16 ++++++++++++++++
 services/llama-cpp.nix | 17 +----------------
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/flake.nix b/flake.nix
index 9e088fc..a015c48 100644
--- a/flake.nix
+++ b/flake.nix
@@ -144,6 +144,22 @@
             inputs
             serviceMountDeps
             ;
+
+          # stolen from: https://stackoverflow.com/a/42398526
+          optimizeWithFlags =
+            pkg: flags:
+            nixpkgs.lib.overrideDerivation pkg (
+              old:
+              let
+                newflags = nixpkgs.lib.foldl' (acc: x: "${acc} ${x}") "" flags;
+                oldflags =
+                  if (nixpkgs.lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
+              in
+              {
+                NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
+                # stdenv = pkgs.clang19Stdenv;
+              }
+            );
         };
         modules =
           [
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 9a29016..78eb239 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -3,24 +3,9 @@
   service_configs,
   config,
   inputs,
+  optimizeWithFlags,
   ...
 }:
-let
-  # stolen from: https://stackoverflow.com/a/42398526
-  optimizeWithFlags =
-    pkg: flags:
-    pkgs.lib.overrideDerivation pkg (
-      old:
-      let
-        newflags = pkgs.lib.foldl' (acc: x: "${acc} ${x}") "" flags;
-        oldflags = if (pkgs.lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
-      in
-      {
-        NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
-        stdenv = pkgs.clang19Stdenv;
-      }
-    );
-in
 {
   services.llama-cpp = {
     enable = true;

From 5161e62433066b8a938edcc1e583d7379f3ac889 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 14:33:34 -0400
Subject: [PATCH 144/847] create single function to optimize for system

---
 flake.nix              | 10 +++++++++-
 services/llama-cpp.nix | 14 +++++---------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/flake.nix b/flake.nix
index a015c48..dd76a8b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -135,7 +135,7 @@
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
       nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
-        specialArgs = {
+        specialArgs = rec {
           inherit
             username
             hostname
@@ -160,6 +160,14 @@
                 # stdenv = pkgs.clang19Stdenv;
               }
             );
+
+          optimizePackage =
+            pkg:
+            optimizeWithFlags pkg [
+              "-O3"
+              "-march=znver2"
+              "-mtune=znver2"
+            ];
         };
         modules =
           [
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 78eb239..81a2918 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -3,7 +3,7 @@
   service_configs,
   config,
   inputs,
-  optimizeWithFlags,
+  optimizePackage,
   ...
 }:
 {
@@ -22,17 +22,13 @@
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
     package = (
-      optimizeWithFlags
-        (inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
+      optimizePackage (
+        inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags ++ [
             "-DGGML_AVX2=ON"
           ];
-        }))
-        [
-          "-O3"
-          "-march=znver2"
-          "-mtune=znver2"
-        ]
+        })
+      )
     );
     extraFlags = [
       "--flash-attn"

From fc90ca0c03b9d40e2f52429c84c8c46fa489941b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 14:35:16 -0400
Subject: [PATCH 145/847] compile jellyfin-ffmpeg with compiler optimizations

---
 services/jellyfin.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 1870547..3505631 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -4,6 +4,7 @@
   service_configs,
   username,
   serviceMountDeps,
+  optimizePackage,
   ...
 }:
 {
@@ -24,6 +25,7 @@
     enable = true;
     # used for local streaming
     openFirewall = true;
+    package = pkgs.jellyfin.override { jellyfin-ffmpeg = (optimizePackage pkgs.jellyfin-ffmpeg); };
 
     dataDir = service_configs.jellyfin.dataDir;
     cacheDir = service_configs.jellyfin.cacheDir;

From 0849fa1a006384b453988e91f4d29861518d7f6c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 14:37:46 -0400
Subject: [PATCH 146/847] minecraft: update lithium

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index e823739..56ff3a5 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -70,8 +70,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/nhc57Td2/lithium-fabric-0.16.0%2Bmc1.21.5.jar";
-              sha512 = "4be66cbb840501e9d7dfbcb6942daba6ce6b8f462694ee498d5c899e476e6d36697bcec70c49c818ca914571c70805de3d8b9a1e4c12c1bb7a3dc89dccbef17f";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/5YInGgMN/lithium-fabric-0.16.1%2Bmc1.21.5.jar";
+              sha512 = "3b723b7e3cb62f1b4b9f56c3acd4e0d0dd2cf02159cddf302c631a7141e4add447c5298b37a96e25a6432bdeb645b085cb59e489161f22bade139d1c6fdc4387";
             };
 
             NoChatReports = fetchurl {

From 688c0356a5261da3c56e1ae80ff373883ec3ca5c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 14:41:58 -0400
Subject: [PATCH 147/847] jellyfin: remove packages from systemPackages

---
 services/jellyfin.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 3505631..3e9db72 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -15,11 +15,11 @@
     ])
   ];
 
-  environment.systemPackages = with pkgs; [
-    jellyfin
-    jellyfin-web
-    jellyfin-ffmpeg
-  ];
+  # environment.systemPackages = with pkgs; [
+  #   jellyfin
+  #   jellyfin-web
+  #   jellyfin-ffmpeg
+  # ];
 
   services.jellyfin = {
     enable = true;

From 1223d177ed2a192004a32d5f2aabbf3528f734e1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 16:53:41 -0400
Subject: [PATCH 148/847] simplify gitattributes

---
 .gitattributes | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 89340db..45b5ca3 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,10 +1 @@
-secrets/murmur_password filter=git-crypt diff=git-crypt
-secrets/hashedPass filter=git-crypt diff=git-crypt
-secrets/minecraft-whitelist.nix filter=git-crypt diff=git-crypt
-secrets/wg0.conf filter=git-crypt diff=git-crypt
-secrets/caddy_auth filter=git-crypt diff=git-crypt
-secrets/matrix_reg_token filter=git-crypt diff=git-crypt
-secrets/owntracks_caddy_auth filter=git-crypt diff=git-crypt
-secrets/secureboot.tar filter=git-crypt diff=git-crypt
-secrets/zfs-key filter=git-crypt diff=git-crypt
-secrets/slskd_env filter=git-crypt diff=git-crypt
+secrets/** filter=git-crypt diff=git-crypt

From 7c8fb9346352afc7f530192a63676fd44a6259d3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Apr 2025 23:10:33 -0400
Subject: [PATCH 149/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 39a8ffd..431fda9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744029448,
-        "narHash": "sha256-egX91Q77jyXOZ1kNR8jdgT86vitDVnMDRFAbmfmoZLU=",
+        "lastModified": 1744060004,
+        "narHash": "sha256-BQCoowBp7gdB6J5T4jwlNaHqS5ICiDjw03gAPDZC3pY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e391d3ee8ddae86be70c034de1082ad51c55e211",
+        "rev": "1466621e738779eefe1bb672e17dc55d63d166bb",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743991090,
-        "narHash": "sha256-gZK+vyw5BeQ8cmdigRN0uInhyfrXWJXFsZEP/Wh+ay8=",
+        "lastModified": 1744077311,
+        "narHash": "sha256-gw66zuvKqFaePakredq9sjliD7fN1xBG1kbycQgIdEI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "021d01fa37cdc9dc936c3a1f7ca6dc9354b21589",
+        "rev": "ee83e148c2a3c754592e04f2f7d92f4497ffc7ac",
         "type": "github"
       },
       "original": {

From d52154770e7cd842e0268d88169697e240c30ace Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 8 Apr 2025 00:22:12 -0400
Subject: [PATCH 150/847] llm: model stuff

---
 services/llama-cpp.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 81a2918..b628622 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -10,13 +10,9 @@
   services.llama-cpp = {
     enable = true;
     model = builtins.toString (
-      # pkgs.fetchurl {
-      # url = "https://huggingface.co/bartowski/google_gemma-3-12b-it-GGUF/resolve/main/google_gemma-3-12b-it-Q4_0.gguf";
-      # sha256 = "9a7b70be8727da9fb28523b35946dd42d4fe0f622cce03daa44fccff0775516d";
-      # }
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/mlabonne_gemma-3-27b-it-abliterated-GGUF/resolve/main/mlabonne_gemma-3-27b-it-abliterated-Q4_0.gguf";
-        sha256 = "d47047ff6fabb02e8aa8bea1d3fd32a551382016bd7d91f45f74615ada670a21";
+        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-IQ2_XS.gguf";
+        sha256 = "080150a6758afefb40950f2753ea9f113b3cdc2b8ad4243a3711959748cd4df0";
       }
     );
     port = service_configs.ports.llama_cpp;

From 36aad5f40ebc7ed9b5390d3293f0b15680ec571b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 8 Apr 2025 09:48:07 -0400
Subject: [PATCH 151/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 431fda9..0b4342a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743808813,
-        "narHash": "sha256-2lDQBOmlz9ggPxcS7/GvcVdzXMIiT+PpMao6FbLJSr0=",
+        "lastModified": 1744117652,
+        "narHash": "sha256-t7dFCDl4vIOOUMhEZnJF15aAzkpaup9x4ZRGToDFYWI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a9f8b3db211b4609ddd83683f9db89796c7f6ac6",
+        "rev": "b4e98224ad1336751a2ac7493967a4c9f6d9cb3f",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744060004,
-        "narHash": "sha256-BQCoowBp7gdB6J5T4jwlNaHqS5ICiDjw03gAPDZC3pY=",
+        "lastModified": 1744115459,
+        "narHash": "sha256-B4RdKULEnEVWXNW9eVkST3eH9IgDanwo/1BOQfgH0yo=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "1466621e738779eefe1bb672e17dc55d63d166bb",
+        "rev": "1d343b4069c74b2c7b19ae84260cd98aa2320a9a",
         "type": "github"
       },
       "original": {

From 1afb116e86990bd3712c491a9b8e56e234c536ae Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 8 Apr 2025 14:11:36 -0400
Subject: [PATCH 152/847] qbt: chmod 750

---
 services/qbittorrent.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 2aa353f..c231464 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -110,8 +110,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0770 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0750 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
   ];
 
   # make qbittorrent use a vpn

From eea8f6380e680c20b9caef62712b638900fc6876 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 8 Apr 2025 14:12:03 -0400
Subject: [PATCH 153/847] caddy: chmod 750

---
 services/caddy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index f3024c3..a2f0726 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -22,7 +22,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${service_configs.https.data_dir} 750 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];

From 68ed5f41f3dda4f290bc50236c9ad7ca69872863 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 8 Apr 2025 14:12:22 -0400
Subject: [PATCH 154/847] minecraft: chmod 750

---
 services/minecraft.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 56ff3a5..fb2bd38 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -132,7 +132,7 @@
   ];
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0770 minecraft minecraft"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 minecraft minecraft"
   ];
 
   users.users.${username}.extraGroups = [

From 79516cdf2f659229d89547a857222fd12f6ee1ed Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 9 Apr 2025 17:33:56 -0400
Subject: [PATCH 155/847] minecraft: lithium update

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index fb2bd38..cafdb43 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -70,8 +70,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/5YInGgMN/lithium-fabric-0.16.1%2Bmc1.21.5.jar";
-              sha512 = "3b723b7e3cb62f1b4b9f56c3acd4e0d0dd2cf02159cddf302c631a7141e4add447c5298b37a96e25a6432bdeb645b085cb59e489161f22bade139d1c6fdc4387";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/VWYoZjBF/lithium-fabric-0.16.2%2Bmc1.21.5.jar";
+              sha512 = "09a68051504bb16069dd6af8901f2bbeadfd08ad5353d8bcc0c4784e814fb293d9197b4fb0a8393be1f2db003cd987a9e4b98391bbe18c50ae181dace20c2fa4";
             };
 
             NoChatReports = fetchurl {

From 9e0aa9ef04f499c854a6bb374b73e3ca037c7c31 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 9 Apr 2025 17:34:11 -0400
Subject: [PATCH 156/847] jellyfin: remove commented out section

---
 services/jellyfin.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 3e9db72..0798e24 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -15,12 +15,6 @@
     ])
   ];
 
-  # environment.systemPackages = with pkgs; [
-  #   jellyfin
-  #   jellyfin-web
-  #   jellyfin-ffmpeg
-  # ];
-
   services.jellyfin = {
     enable = true;
     # used for local streaming

From ffb66c14d611c5cf97d49288b178e91b1596f4c2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 9 Apr 2025 17:34:16 -0400
Subject: [PATCH 157/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0b4342a..894c821 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743598667,
-        "narHash": "sha256-ViE7NoFWytYO2uJONTAX35eGsvTYXNHjWALeHAg8OQY=",
+        "lastModified": 1744145203,
+        "narHash": "sha256-I2oILRiJ6G+BOSjY+0dGrTPe080L3pbKpc+gCV3Nmyk=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "329d3d7e8bc63dd30c39e14e6076db590a6eabe6",
+        "rev": "76c0a6dba345490508f36c1aa3c7ba5b6b460989",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744115459,
-        "narHash": "sha256-B4RdKULEnEVWXNW9eVkST3eH9IgDanwo/1BOQfgH0yo=",
+        "lastModified": 1744192056,
+        "narHash": "sha256-QUKPhAkWqTB1qTbG9C66WVoY4IUXhLWFWiVxkknvzT4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "1d343b4069c74b2c7b19ae84260cd98aa2320a9a",
+        "rev": "d3bd7193ba66c15963fd1c59448f22019a8caf6e",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744077311,
-        "narHash": "sha256-gw66zuvKqFaePakredq9sjliD7fN1xBG1kbycQgIdEI=",
+        "lastModified": 1744163731,
+        "narHash": "sha256-+Knh6oXNp211kRFmo3eWyMXjBB7rND6wPdJkjZHvmak=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ee83e148c2a3c754592e04f2f7d92f4497ffc7ac",
+        "rev": "c92a6a5c6609cb501c6e4117cd40808eceae8b1a",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743987495,
-        "narHash": "sha256-46T2vMZ4/AfCK0Y2OjlFzJPxmdpP8GtsuEqSSJv3oe4=",
+        "lastModified": 1744120788,
+        "narHash": "sha256-a5NZpBF8kunuAABFDwAfradQrnrQdQuFawZ57+x5RDg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "db8f4fe18ce772a9c8f3adf321416981c8fe9371",
+        "rev": "a62d20dd366a941a588bfe3c814826cf631a0554",
         "type": "github"
       },
       "original": {

From f174985c8984fb399b69dac0a3afde96e14824bd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 9 Apr 2025 18:48:32 -0400
Subject: [PATCH 158/847] zen 2 -> zen 3

---
 flake.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index dd76a8b..4f2e71a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -165,8 +165,8 @@
             pkg:
             optimizeWithFlags pkg [
               "-O3"
-              "-march=znver2"
-              "-mtune=znver2"
+              "-march=znver3"
+              "-mtune=znver3"
             ];
         };
         modules =

From 06f47a32af8cb53167ce4a8af5fe094347f4617c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Apr 2025 11:15:18 -0400
Subject: [PATCH 159/847] change llm model

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index b628622..d307b13 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/google_gemma-3-27b-it-GGUF/resolve/main/google_gemma-3-27b-it-IQ2_XS.gguf";
-        sha256 = "080150a6758afefb40950f2753ea9f113b3cdc2b8ad4243a3711959748cd4df0";
+        url = "https://huggingface.co/mradermacher/Gemma-3-R1984-12B-GGUF/resolve/main/Gemma-3-R1984-12B.IQ4_XS.gguf";
+        sha256 = "f6d94f4bc6bd2101617f0c2b0b7883d20d74018da101e440cb7e7a55514fe78d";
       }
     );
     port = service_configs.ports.llama_cpp;

From 09331db87a3cd6d5e96b42600e9881fa8a57b7c0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Apr 2025 14:41:48 -0400
Subject: [PATCH 160/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 894c821..4a00464 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744192056,
-        "narHash": "sha256-QUKPhAkWqTB1qTbG9C66WVoY4IUXhLWFWiVxkknvzT4=",
+        "lastModified": 1744298684,
+        "narHash": "sha256-TFf6HAj9CCpehpXqW4e7cJhQzxd4/PgVRn2cw7Kkz3I=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "d3bd7193ba66c15963fd1c59448f22019a8caf6e",
+        "rev": "64eda5deb9859e87a020e56bab5d2f9ca956f1de",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744163731,
-        "narHash": "sha256-+Knh6oXNp211kRFmo3eWyMXjBB7rND6wPdJkjZHvmak=",
+        "lastModified": 1744250117,
+        "narHash": "sha256-mN2s4Iv4mvLGYnbO1AxFxBciqyTr7iLZ+dvQtQRmHUI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c92a6a5c6609cb501c6e4117cd40808eceae8b1a",
+        "rev": "f6a325abc772355778692695ada023ac073a3411",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744120788,
-        "narHash": "sha256-a5NZpBF8kunuAABFDwAfradQrnrQdQuFawZ57+x5RDg=",
+        "lastModified": 1744232197,
+        "narHash": "sha256-dGkTIwxR58w6DTiCV7AD/YlSZMz5en/IwnvW8mQq36A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a62d20dd366a941a588bfe3c814826cf631a0554",
+        "rev": "300cf356fb3aca28d3d73bfd0276ddf6b21dd0c2",
         "type": "github"
       },
       "original": {

From 2f579a37959591750a431aa3bea27f1c8e72dd94 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Apr 2025 14:45:38 -0400
Subject: [PATCH 161/847] remove unused port

---
 flake.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 4f2e71a..48ffc57 100644
--- a/flake.nix
+++ b/flake.nix
@@ -67,7 +67,6 @@
           https = 443;
           jellyfin = 8096; # no services.jellyfin option for this
           torrent = 6011;
-          ollama = 11434;
           bitmagnet = 3333;
           owntracks = 3825;
           gitea = 2283;

From 8cbf02a52d3d0c2aafd6da742b9496397b785cd1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Apr 2025 14:51:29 -0400
Subject: [PATCH 162/847] add test for port uniqueness

---
 flake.nix | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 48ffc57..e005317 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,7 +62,6 @@
         music_dir = "/${zpool_ssds}/music";
         torrent_group = "media";
 
-        # TODO: add checks to make sure none of these collide
         ports = {
           https = 443;
           jellyfin = 8096; # no services.jellyfin option for this
@@ -170,6 +169,26 @@
         };
         modules =
           [
+            # SAFETY! make sure no ports collide
+            (
+              { lib, ... }:
+              {
+                config = {
+                  assertions = [
+                    {
+                      assertion =
+                        let
+                          ports = lib.attrValues service_configs.ports;
+                          uniquePorts = lib.unique ports;
+                        in
+                        (lib.length ports) == (lib.length uniquePorts);
+                      message = "Duplicate ports detected in 'ports' configuration";
+                    }
+                  ];
+                };
+              }
+            )
+
             ./disk-config.nix
             disko.nixosModules.disko
             ./configuration.nix

From a5f4f65894d3e5bd7b457c3b6c28bc7c77c2208d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 14 Apr 2025 13:11:40 -0400
Subject: [PATCH 163/847] deepcoder 14b

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index d307b13..d7d6b65 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/mradermacher/Gemma-3-R1984-12B-GGUF/resolve/main/Gemma-3-R1984-12B.IQ4_XS.gguf";
-        sha256 = "f6d94f4bc6bd2101617f0c2b0b7883d20d74018da101e440cb7e7a55514fe78d";
+        url = "https://huggingface.co/bartowski/agentica-org_DeepCoder-14B-Preview-GGUF/resolve/main/agentica-org_DeepCoder-14B-Preview-Q4_0.gguf";
+        sha256 = "6f60030be2287d6a1d52c91e6880352ed99e18da6d955a6204c77cfeaebbca01";
       }
     );
     port = service_configs.ports.llama_cpp;

From 183b621aea54db77603ad5034ff4ca96f305684c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 15 Apr 2025 09:28:57 -0400
Subject: [PATCH 164/847] pam: fix file access error

---
 configuration.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 352899c..ff07f0f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -44,6 +44,16 @@
     cpuFreqGovernor = "powersave";
   };
 
+  # https://github.com/NixOS/nixpkgs/issues/101459#issuecomment-758306434
+  security.pam.loginLimits = [
+    {
+      domain = "*";
+      type = "soft";
+      item = "nofile";
+      value = "4096";
+    }
+  ];
+
   nix = {
     # optimize the store
     optimise.automatic = true;

From 47a32ec4773a5a661bfa557bd0cbe74ae4345ea0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 15 Apr 2025 09:29:37 -0400
Subject: [PATCH 165/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4a00464..ff77f99 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744298684,
-        "narHash": "sha256-TFf6HAj9CCpehpXqW4e7cJhQzxd4/PgVRn2cw7Kkz3I=",
+        "lastModified": 1744717505,
+        "narHash": "sha256-8GS3nqO7iCIdjsd63t5EpHDu489tJYe4MjXpFtgc+No=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "64eda5deb9859e87a020e56bab5d2f9ca956f1de",
+        "rev": "f8f820cc4dc37032d5375972ba904ce53043445d",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744250117,
-        "narHash": "sha256-mN2s4Iv4mvLGYnbO1AxFxBciqyTr7iLZ+dvQtQRmHUI=",
+        "lastModified": 1744682339,
+        "narHash": "sha256-EnfBeDSsqEku5gvudXWYdXoFghmXb4Vp9YY1vMNzebY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f6a325abc772355778692695ada023ac073a3411",
+        "rev": "deaa09e85d9288c27e0f76431dcdea21f32f96fa",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1743420942,
-        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
+        "lastModified": 1744633460,
+        "narHash": "sha256-fbWE4Xpw6eH0Q6in+ymNuDwTkqmFmtxcQEmtRuKDTTk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
+        "rev": "9a049b4a421076d27fee3eec664a18b2066824cb",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744232197,
-        "narHash": "sha256-dGkTIwxR58w6DTiCV7AD/YlSZMz5en/IwnvW8mQq36A=",
+        "lastModified": 1744590740,
+        "narHash": "sha256-VmLebR17+ibes9clXWOpKNLvWwLB3ZZOkkqnOoOY6HA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "300cf356fb3aca28d3d73bfd0276ddf6b21dd0c2",
+        "rev": "dfbd2d178780253ae2f2382b08972231bc9a3f49",
         "type": "github"
       },
       "original": {

From d9392b40f990d05e9a262aaaab0e28ae1cd4fe9a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 15 Apr 2025 09:32:37 -0400
Subject: [PATCH 166/847] nixos-24.11-small -> nixos-24.11

---
 flake.lock | 8 ++++----
 flake.nix  | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/flake.lock b/flake.lock
index ff77f99..7acf51b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -253,16 +253,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744590740,
-        "narHash": "sha256-VmLebR17+ibes9clXWOpKNLvWwLB3ZZOkkqnOoOY6HA=",
+        "lastModified": 1744440957,
+        "narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dfbd2d178780253ae2f2382b08972231bc9a3f49",
+        "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11-small",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index e005317..597bb53 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
 
     lanzaboote = {
       url = "github:nix-community/lanzaboote";

From defe465248333479fa4d56a557a091a0213efe9f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 16 Apr 2025 21:34:01 -0400
Subject: [PATCH 167/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7acf51b..a2ff31a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744117652,
-        "narHash": "sha256-t7dFCDl4vIOOUMhEZnJF15aAzkpaup9x4ZRGToDFYWI=",
+        "lastModified": 1744743431,
+        "narHash": "sha256-iyn/WBYDc7OtjSawbegINDe/gIkok888kQxk3aVnkgg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b4e98224ad1336751a2ac7493967a4c9f6d9cb3f",
+        "rev": "c61bfe3ae692f42ce688b5865fac9e0de58e1387",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744717505,
-        "narHash": "sha256-8GS3nqO7iCIdjsd63t5EpHDu489tJYe4MjXpFtgc+No=",
+        "lastModified": 1744791665,
+        "narHash": "sha256-PeX0XesV1AsM4e+Rv5jIFC67boZl3MQpyC0RvXZZdF8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "f8f820cc4dc37032d5375972ba904ce53043445d",
+        "rev": "b43d89e311c5e7fbf62e5ec3c0401eb536677267",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744682339,
-        "narHash": "sha256-EnfBeDSsqEku5gvudXWYdXoFghmXb4Vp9YY1vMNzebY=",
+        "lastModified": 1744768706,
+        "narHash": "sha256-7W63qdst98cXE4j/QDF1L3OHz5N5JjcfTVL17a4a3kw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "deaa09e85d9288c27e0f76431dcdea21f32f96fa",
+        "rev": "46be353e058e970480a9c62ee94a0d1ad2f0c569",
         "type": "github"
       },
       "original": {

From e650bfdd6fddc77704e91135d70e456c824c902f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 16 Apr 2025 23:12:28 -0400
Subject: [PATCH 168/847] throttle torrenting when needed

---
 services/qbittorrent.nix |  2 +-
 services/wg.nix          | 52 +++++++++++++++++++++++++++++++++++++++-
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index c231464..3708de1 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -62,7 +62,7 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        GlobalUPSpeedLimit = 1500; # 1.500 MiB/s
+        GlobalUPSpeedLimit = 0; # unlimited upload
         GlobalDLSpeedLimit = 500; # 500 KiB/s
 
         IgnoreLimitsOnLAN = true;
diff --git a/services/wg.nix b/services/wg.nix
index 83ef5a3..ce95ed9 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -1,4 +1,9 @@
-{ pkgs, service_configs, ... }:
+{
+  pkgs,
+  service_configs,
+  eth_interface,
+  ...
+}:
 {
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
@@ -8,4 +13,49 @@
       # "192.168.0.0/24"
     ];
   };
+
+  environment.systemPackages = with pkgs; [
+    # used to monitor bandwidth usage
+    nload
+  ];
+
+  networking.firewall.extraCommands = ''
+    # Exempt local traffic from marking
+    iptables -t mangle -A POSTROUTING -s ${service_configs.https.wg_ip}/24 -d 192.168.1.0/24 -j RETURN
+
+    # Mark all other traffic from the VPN namespace
+    iptables -t mangle -A POSTROUTING -s ${service_configs.https.wg_ip}/24 -j MARK --set-mark 1
+  '';
+
+  systemd.services."traffic-shaping" =
+    let
+      upload_pipe = 20;
+      high_prio = 18;
+      low_prio = 2;
+    in
+    {
+      description = "Apply QoS to prioritize non-VPN traffic";
+      after = [
+        "network.target"
+        "vpn-wg.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = pkgs.writeShellScript "tc-setup" ''
+          # Add HTB qdisc to physical interface
+          ${pkgs.iproute2}/bin/tc qdisc add dev ${eth_interface} root handle 1: htb default 10
+
+          # Define classes:
+          # - Class 1:10 (high priority, unmarked)
+          # - Class 1:20 (low priority, marked VPN traffic)
+          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1: classid 1:1 htb rate ${builtins.toString upload_pipe}mbit ceil ${builtins.toString upload_pipe}mbit
+          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1:1 classid 1:10 htb rate ${builtins.toString high_prio}mbit ceil ${builtins.toString upload_pipe}mbit prio 1
+          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1:1 classid 1:20 htb rate ${builtins.toString low_prio}mbit ceil ${builtins.toString upload_pipe}mbit prio 2
+
+          # Direct marked packets to low-priority class
+          ${pkgs.iproute2}/bin/tc filter add dev ${eth_interface} parent 1: protocol ip prio 1 handle 1 fw flowid 1:20
+        '';
+      };
+    };
 }

From 4773ddffc3f886329ef3407bd731524b6288bd8e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 17 Apr 2025 18:16:53 -0400
Subject: [PATCH 169/847] traffic shaping improvements

---
 services/wg.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/services/wg.nix b/services/wg.nix
index ce95ed9..5a4122a 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -29,8 +29,8 @@
 
   systemd.services."traffic-shaping" =
     let
-      upload_pipe = 20;
-      high_prio = 18;
+      upload_pipe = 22;
+      high_prio = 20;
       low_prio = 2;
     in
     {
@@ -56,6 +56,14 @@
           # Direct marked packets to low-priority class
           ${pkgs.iproute2}/bin/tc filter add dev ${eth_interface} parent 1: protocol ip prio 1 handle 1 fw flowid 1:20
         '';
+
+      ExecStop = pkgs.writeShellScript "tc-stop" ''
+        ${pkgs.iproute2}/bin/tc filter del dev ${eth_interface} parent 1:
+        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:20
+        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:10
+        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:1
+        ${pkgs.iproute2}/bin/tc qdisc del dev ${eth_interface} root
+      '';
       };
     };
 }

From 5604a64351e8f25c320ece8add911cd9de2eed11 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 18 Apr 2025 17:47:03 -0400
Subject: [PATCH 170/847] update

---
 deploy.sh  |  2 +-
 flake.lock | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 77aff2d..c9813cf 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,2 +1,2 @@
 #!/bin/sh
-nixos-rebuild switch --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose
+nixos-rebuild boot --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose
diff --git a/flake.lock b/flake.lock
index a2ff31a..8834ba3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744145203,
-        "narHash": "sha256-I2oILRiJ6G+BOSjY+0dGrTPe080L3pbKpc+gCV3Nmyk=",
+        "lastModified": 1744940522,
+        "narHash": "sha256-TNoetfICvd29DhxRPpmyKItQBDlqSvKcV+wGNkn14jk=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "76c0a6dba345490508f36c1aa3c7ba5b6b460989",
+        "rev": "51d33bbb7f1e74ba5f9d9a77357735149da99081",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744791665,
-        "narHash": "sha256-PeX0XesV1AsM4e+Rv5jIFC67boZl3MQpyC0RvXZZdF8=",
+        "lastModified": 1745006575,
+        "narHash": "sha256-Vxz8jdb0yNmJRlTZqmIG4nSLpeJl581aQxz/lwAtEMg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b43d89e311c5e7fbf62e5ec3c0401eb536677267",
+        "rev": "6408210082cc0a61b992b487be7e2ff2efbb9e36",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744768706,
-        "narHash": "sha256-7W63qdst98cXE4j/QDF1L3OHz5N5JjcfTVL17a4a3kw=",
+        "lastModified": 1744941245,
+        "narHash": "sha256-tIfmf4UYcbhCtV0CwJkB7S1zrWzodtB/jYyoMvKSvug=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "46be353e058e970480a9c62ee94a0d1ad2f0c569",
+        "rev": "556c14e59b53c7c1d70823919d8a02c763e8a9f1",
         "type": "github"
       },
       "original": {

From 21962c586cce61947755c054a73f07b0e06c7418 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 18 Apr 2025 20:10:16 -0400
Subject: [PATCH 171/847] minecraft: fabric-api update

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index cafdb43..11d0059 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -60,8 +60,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/rYSz5dRU/fabric-api-0.119.6%2B1.21.5.jar";
-              sha512 = "80a4660c9bf5410b37ee4c2bf86ed1fcaccd77cea7fd203e00650659f02271a71d367cd95178f9177998401d1693ec48753a3e73b1ba96631c014e7a92d64501";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZOyJh09R/fabric-api-0.120.0%2B1.21.5.jar";
+              sha512 = "a4db4ae64f6590c69e5b86fdd6e89c66e8f3160d57dfa4369ea64fdc9bfb1f3812c2ed8ffdddca43c01d3335aaf404b283f5761b42ecc5389cd1ca206e6f500e";
             };
 
             FerriteCore = fetchurl {

From af54ed8e5a10a088a6ecacf15a7d963fdf92d049 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 18 Apr 2025 20:10:26 -0400
Subject: [PATCH 172/847] format

---
 services/wg.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/services/wg.nix b/services/wg.nix
index 5a4122a..b3a9768 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -57,13 +57,13 @@
           ${pkgs.iproute2}/bin/tc filter add dev ${eth_interface} parent 1: protocol ip prio 1 handle 1 fw flowid 1:20
         '';
 
-      ExecStop = pkgs.writeShellScript "tc-stop" ''
-        ${pkgs.iproute2}/bin/tc filter del dev ${eth_interface} parent 1:
-        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:20
-        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:10
-        ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:1
-        ${pkgs.iproute2}/bin/tc qdisc del dev ${eth_interface} root
-      '';
+        ExecStop = pkgs.writeShellScript "tc-stop" ''
+          ${pkgs.iproute2}/bin/tc filter del dev ${eth_interface} parent 1:
+          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:20
+          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:10
+          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:1
+          ${pkgs.iproute2}/bin/tc qdisc del dev ${eth_interface} root
+        '';
       };
     };
 }

From bf3f64bf51192e7c9550d355a50949ed50060841 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 18 Apr 2025 20:43:39 -0400
Subject: [PATCH 173/847] qbt: update vuetorrent

---
 services/qbittorrent.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 3708de1..f608209 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -44,8 +44,8 @@
         AlternativeUIEnabled = true;
         RootFolder = builtins.toString (
           pkgs.fetchzip {
-            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.23.1/vuetorrent.zip";
-            sha256 = "yZmnRmYoinJ8uSuUpjGIRCQWBrK59hwyEkCq8aWiOvQ=";
+            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.24.1/vuetorrent.zip";
+            sha256 = "XECHyc60F5JoJXybwIhUXg6kL1CceVpFGMjarB0dvbk=";
           }
         );
 
@@ -69,7 +69,7 @@
 
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 2.5;
+        GlobalMaxRatio = 1.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;

From 5eb4c00f67ea12de99bffb496ed277505dbf4fb9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 21 Apr 2025 22:44:51 -0400
Subject: [PATCH 174/847] minecraft: update squaremap

---
 services/minecraft.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 11d0059..f377f84 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -86,13 +86,10 @@
             #   sha512 = "c101f1a41db4095d651d32eae47bd7e6f7358f7390898610d1bf261ebfc7e0f4165fd551c08a99cca31a3308f1989a16b8c75c1ece60ef9cd475107ca4f4219e";
             # };
 
-            # doesn't support 1.21.5:
-            # https://github.com/jpenilla/squaremap/issues/386
-            # https://github.com/jpenilla/squaremap/pull/387
-            # squaremap = fetchurl {
-            #   url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/9i2KwI5R/squaremap-fabric-mc1.21.4-1.3.4.jar";
-            #   sha512 = "6eb44061f057d1bbd0bb6f9186d03d496479dcd953af8f09f70099c2e67e567e5dca626972d45af0315c2e2714c3dd74beef97575396e3bb90b7c670f5c80fef";
-            # };
+            squaremap = fetchurl {
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+8c0b8f6.jar";
+              sha256 = "CMoI2pRCoKwWg+HNUbbGcdQFrW2MJpyfbF1m92QrNEk=";
+            };
 
             # doesn't support 1.21.5
             # modernfix = fetchurl {

From edd7e72169ee820e12c6b5b5c4bceec681ab4568 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 21 Apr 2025 23:54:29 -0400
Subject: [PATCH 175/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8834ba3..2813b36 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1741148495,
-        "narHash": "sha256-EV8KUaIZ2/CdBXlutXrHoZYbWPeB65p5kKZk71gvDRI=",
+        "lastModified": 1741481578,
+        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "75390a36cd0c2cdd5f1aafd8a9f827d7107f2e53",
+        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744940522,
-        "narHash": "sha256-TNoetfICvd29DhxRPpmyKItQBDlqSvKcV+wGNkn14jk=",
+        "lastModified": 1745224732,
+        "narHash": "sha256-0OWgbEKhpMLpk3WQi3ugOwxWW4Y6JVpKiQ+o0nuNzus=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "51d33bbb7f1e74ba5f9d9a77357735149da99081",
+        "rev": "1770bf1ae5da05564f86b969ef21c7228cc1a70b",
         "type": "github"
       },
       "original": {
@@ -75,11 +75,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740872218,
-        "narHash": "sha256-ZaMw0pdoUKigLpv9HiNDH2Pjnosg7NBYMJlHTIsHEUo=",
+        "lastModified": 1741352980,
+        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3876f6b87db82f33775b1ef5ea343986105db764",
+        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1741442524,
-        "narHash": "sha256-tVcxLDLLho8dWcO81Xj/3/ANLdVs0bGyCPyKjp70JWk=",
+        "lastModified": 1745271491,
+        "narHash": "sha256-4GAHjus6JRpYHVROMIhFIz/sgLDF/klBM3UHulbSK9s=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "d8099586d9a84308ffedac07880e7f07a0180ff4",
+        "rev": "995637eb3ab78eac33f8ee6b45cc2ecd5ede12ba",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745006575,
-        "narHash": "sha256-Vxz8jdb0yNmJRlTZqmIG4nSLpeJl581aQxz/lwAtEMg=",
+        "lastModified": 1745252031,
+        "narHash": "sha256-Gq9KrKEZlkHjYoJQqLqmnYqvaKybEUXBXhgBtKDujIg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "6408210082cc0a61b992b487be7e2ff2efbb9e36",
+        "rev": "1d735c0b4fa0551c51c2f4ac888dd9a01f447985",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744941245,
-        "narHash": "sha256-tIfmf4UYcbhCtV0CwJkB7S1zrWzodtB/jYyoMvKSvug=",
+        "lastModified": 1745287043,
+        "narHash": "sha256-y8DH++s3Zt9LDCRDp7+tehFaeLs4WXRxnR3lFC5qbuY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "556c14e59b53c7c1d70823919d8a02c763e8a9f1",
+        "rev": "9c4b4690ea3a1f7233e7f9d3bdfa88e464f77d57",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740915799,
-        "narHash": "sha256-JvQvtaphZNmeeV+IpHgNdiNePsIpHD5U/7QN5AeY44A=",
+        "lastModified": 1741379162,
+        "narHash": "sha256-srpAbmJapkaqGRE3ytf3bj4XshspVR5964OX5LfjDWc=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "42b1ba089d2034d910566bf6b40830af6b8ec732",
+        "rev": "b5a62751225b2f62ff3147d0a334055ebadcd5cc",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741228283,
-        "narHash": "sha256-VzqI+k/eoijLQ5am6rDFDAtFAbw8nltXfLBC6SIEJAE=",
+        "lastModified": 1741573199,
+        "narHash": "sha256-A2sln1GdCf+uZ8yrERSCZUCqZ3JUlOv1WE2VFqqfaLQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "38e9826bc4296c9daf18bc1e6aa299f3e932a403",
+        "rev": "c777dc8a1e35407b0e80ec89817fe69970f4e81a",
         "type": "github"
       },
       "original": {

From bef204a801565c81b44d7ca51a1c68c7e973b26d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 23 Apr 2025 01:58:31 -0400
Subject: [PATCH 176/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2813b36..61d37bb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745224732,
-        "narHash": "sha256-0OWgbEKhpMLpk3WQi3ugOwxWW4Y6JVpKiQ+o0nuNzus=",
+        "lastModified": 1745369821,
+        "narHash": "sha256-mi6cAjuBztm9gFfpiVo6mAn81cCID6nmDXh5Kmyjwyc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "1770bf1ae5da05564f86b969ef21c7228cc1a70b",
+        "rev": "c5140c6079ff690e85eac0b86e254de16a79a4b7",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745252031,
-        "narHash": "sha256-Gq9KrKEZlkHjYoJQqLqmnYqvaKybEUXBXhgBtKDujIg=",
+        "lastModified": 1745350060,
+        "narHash": "sha256-kFdCgKLy6+llPcpA7WF8UeCsXyzD1Fc0ATIGiAOmXO4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "1d735c0b4fa0551c51c2f4ac888dd9a01f447985",
+        "rev": "658987cfc9d752dca7758987390d5fb1a7a0a54a",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745287043,
-        "narHash": "sha256-y8DH++s3Zt9LDCRDp7+tehFaeLs4WXRxnR3lFC5qbuY=",
+        "lastModified": 1745373492,
+        "narHash": "sha256-gZG/Lpqo4vcey27lyXtAt1jy74cTJ0G+mwCT7dBxapA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "9c4b4690ea3a1f7233e7f9d3bdfa88e464f77d57",
+        "rev": "41913d868adce57fa88f678e10c3965a2560e541",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744440957,
-        "narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=",
+        "lastModified": 1745279238,
+        "narHash": "sha256-AQ7M9wTa/Pa/kK5pcGTgX/DGqMHyzsyINfN7ktsI7Fo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d",
+        "rev": "9684b53175fc6c09581e94cc85f05ab77464c7e3",
         "type": "github"
       },
       "original": {

From 8db96f1fed00cf6653b3caae724aff5018c35134 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 23 Apr 2025 18:31:41 -0400
Subject: [PATCH 177/847] update

---
 flake.lock             | 12 ++++++------
 services/minecraft.nix |  5 +++++
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 61d37bb..cb377f4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745350060,
-        "narHash": "sha256-kFdCgKLy6+llPcpA7WF8UeCsXyzD1Fc0ATIGiAOmXO4=",
+        "lastModified": 1745443955,
+        "narHash": "sha256-tT7pVq1WOHTV3Rplr/kWTVS5QcrE33BW5FnbBOR0w1g=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "658987cfc9d752dca7758987390d5fb1a7a0a54a",
+        "rev": "56304069599f4dd9749d94b9bca2c2c65bb27c02",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1744633460,
-        "narHash": "sha256-fbWE4Xpw6eH0Q6in+ymNuDwTkqmFmtxcQEmtRuKDTTk=",
+        "lastModified": 1745392233,
+        "narHash": "sha256-xmqG4MZArM1JNxPJ33s0MtuBzgnaCO9laARoU3AfP8E=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9a049b4a421076d27fee3eec664a18b2066824cb",
+        "rev": "8bf8a2a0822365bd8f44fd1a19d7ed0a1d629d64",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index f377f84..237d489 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -108,6 +108,11 @@
               sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
             };
 
+            packetfixer = fetchurl {
+              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/nBmGzZcV/packetfixer-fabric-1.21.5-2.1.2.jar";
+              sha512 = "b66042f85072e037bb43c6cfa59e889204ffc06768ba6c393f3cfdb735b11192b5390ac79b022713739ac836b9662f5e476690b3d6b9dd350cbe2de5449eddbe";
+            };
+
             krypton = fetchurl {
               url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/neW85eWt/krypton-0.2.9.jar";
               sha512 = "2e2304b1b17ecf95783aee92e26e54c9bfad325c7dfcd14deebf9891266eb2933db00ff77885caa083faa96f09c551eb56f93cf73b357789cb31edad4939ffeb";

From b0c890c0f0f006fface065a46c0d213ee838c903 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 23 Apr 2025 18:37:52 -0400
Subject: [PATCH 178/847] minecraft: update squaremap

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 237d489..960b61e 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -87,8 +87,8 @@
             # };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+8c0b8f6.jar";
-              sha256 = "CMoI2pRCoKwWg+HNUbbGcdQFrW2MJpyfbF1m92QrNEk=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+bcc4c23.jar";
+              sha256 = "JgS4PfZOp9Y2MuVjBRTgCi0+CaU2eso7HVCZb85Ak8k=";
             };
 
             # doesn't support 1.21.5

From 5fcb85bc58dbca95da44114a3d4f1303d12a0878 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 24 Apr 2025 11:45:33 -0400
Subject: [PATCH 179/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index cb377f4..574f41b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745369821,
-        "narHash": "sha256-mi6cAjuBztm9gFfpiVo6mAn81cCID6nmDXh5Kmyjwyc=",
+        "lastModified": 1745502102,
+        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "c5140c6079ff690e85eac0b86e254de16a79a4b7",
+        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745443955,
-        "narHash": "sha256-tT7pVq1WOHTV3Rplr/kWTVS5QcrE33BW5FnbBOR0w1g=",
+        "lastModified": 1745505167,
+        "narHash": "sha256-lJJzcVHM3nb8/GEcOaYmTniAt1BVIxe/c995i2EUgcE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "56304069599f4dd9749d94b9bca2c2c65bb27c02",
+        "rev": "87616f0680947800ecba3e9f6bc6e101943bf8e6",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745373492,
-        "narHash": "sha256-gZG/Lpqo4vcey27lyXtAt1jy74cTJ0G+mwCT7dBxapA=",
+        "lastModified": 1745459915,
+        "narHash": "sha256-98cnDz6QiQhgx48OrNomrMnKZL+cfihFDYAzhDg0MVE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "41913d868adce57fa88f678e10c3965a2560e541",
+        "rev": "f6f2c8849abea259af2749b65a9bcf86f90aa0d5",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1745392233,
-        "narHash": "sha256-xmqG4MZArM1JNxPJ33s0MtuBzgnaCO9laARoU3AfP8E=",
+        "lastModified": 1745503349,
+        "narHash": "sha256-bUGjvaPVsOfQeTz9/rLTNLDyqbzhl0CQtJJlhFPhIYw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "8bf8a2a0822365bd8f44fd1a19d7ed0a1d629d64",
+        "rev": "f7bee55a5e551bd8e7b5b82c9bc559bc50d868d1",
         "type": "github"
       },
       "original": {

From 7586fd5082a132ebd9fda21693845195b46d09c0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 24 Apr 2025 13:42:57 -0400
Subject: [PATCH 180/847] disable llama

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index ff07f0f..eb521e0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From f268a5d3364b4cc7f2654df142fc41949afeddd8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 25 Apr 2025 00:30:35 -0400
Subject: [PATCH 181/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 574f41b..6e46b2e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745505167,
-        "narHash": "sha256-lJJzcVHM3nb8/GEcOaYmTniAt1BVIxe/c995i2EUgcE=",
+        "lastModified": 1745525824,
+        "narHash": "sha256-bTFh5B2LOjdvRyK1BlSe4K1u/Oeip4nUECCxjFzGd6Q=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "87616f0680947800ecba3e9f6bc6e101943bf8e6",
+        "rev": "13be08daf992c89d5169518229b3740041c0f419",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745459915,
-        "narHash": "sha256-98cnDz6QiQhgx48OrNomrMnKZL+cfihFDYAzhDg0MVE=",
+        "lastModified": 1745546361,
+        "narHash": "sha256-Y+YB9aC4nQqPo1Ion3QTOtCQb1zpgquHCmQksbBecRI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f6f2c8849abea259af2749b65a9bcf86f90aa0d5",
+        "rev": "6dc8851d678a7a3afeab274e1087a75b42ceca1b",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745279238,
-        "narHash": "sha256-AQ7M9wTa/Pa/kK5pcGTgX/DGqMHyzsyINfN7ktsI7Fo=",
+        "lastModified": 1745487689,
+        "narHash": "sha256-FQoi3R0NjQeBAsEOo49b5tbDPcJSMWc3QhhaIi9eddw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9684b53175fc6c09581e94cc85f05ab77464c7e3",
+        "rev": "5630cf13cceac06cefe9fc607e8dfa8fb342dde3",
         "type": "github"
       },
       "original": {

From dea66003e4d5f586336e05738e90692ac6822066 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 26 Apr 2025 20:24:34 -0400
Subject: [PATCH 182/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6e46b2e..59cef4c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744743431,
-        "narHash": "sha256-iyn/WBYDc7OtjSawbegINDe/gIkok888kQxk3aVnkgg=",
+        "lastModified": 1745557122,
+        "narHash": "sha256-eqSo9ugzsqhFgaDFYUZj943nurlX4L6f+AW0skJ4W+M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c61bfe3ae692f42ce688b5865fac9e0de58e1387",
+        "rev": "dd26f75fb4ec1c731d4b1396eaf4439ce40a91c1",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745525824,
-        "narHash": "sha256-bTFh5B2LOjdvRyK1BlSe4K1u/Oeip4nUECCxjFzGd6Q=",
+        "lastModified": 1745701092,
+        "narHash": "sha256-5UxFDCNNEKPWEaoIZ+SEZDY6tov1D//yC0fJcS1uyVw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "13be08daf992c89d5169518229b3740041c0f419",
+        "rev": "2d451c80590b9ac250322769ac13d3b4870dbcf7",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745546361,
-        "narHash": "sha256-Y+YB9aC4nQqPo1Ion3QTOtCQb1zpgquHCmQksbBecRI=",
+        "lastModified": 1745632480,
+        "narHash": "sha256-Rjr9Dh33zXciPbSgOSoYoOJ7gpvpJ+wy04WGIUOY+Nw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "6dc8851d678a7a3afeab274e1087a75b42ceca1b",
+        "rev": "ad10d773fc3a39ace88f495c2c111a0bf7f5a481",
         "type": "github"
       },
       "original": {

From 4ea18429e1ecc9152ac5dd205fbeba008284ff06 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 27 Apr 2025 00:53:26 -0400
Subject: [PATCH 183/847] minecraft: update squaremap

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 960b61e..1acfb59 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -87,8 +87,8 @@
             # };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+bcc4c23.jar";
-              sha256 = "JgS4PfZOp9Y2MuVjBRTgCi0+CaU2eso7HVCZb85Ak8k=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+463e7ee.jar";
+              sha256 = "nHqvRHertYZUFMHQtsEK75RiB5K4zOi8nPvEBBUOzPg=";
             };
 
             # doesn't support 1.21.5

From cb61f17b9d24cdfb237d37fa70f3e7dd0fb6f384 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 28 Apr 2025 01:14:51 -0400
Subject: [PATCH 184/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 59cef4c..d2d84c5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745502102,
-        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
+        "lastModified": 1745812220,
+        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
+        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745701092,
-        "narHash": "sha256-5UxFDCNNEKPWEaoIZ+SEZDY6tov1D//yC0fJcS1uyVw=",
+        "lastModified": 1745790506,
+        "narHash": "sha256-Jl1PVOzj5NyKBrDeIFFCaiT9ScriX1RtsQpU8sPZ9y0=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2d451c80590b9ac250322769ac13d3b4870dbcf7",
+        "rev": "c0a97b762e5ec767dc414f0dc4979befd4c09a52",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745632480,
-        "narHash": "sha256-Rjr9Dh33zXciPbSgOSoYoOJ7gpvpJ+wy04WGIUOY+Nw=",
+        "lastModified": 1745805739,
+        "narHash": "sha256-ryJ95o+w0hSVm5LkW5dxTbL2e1HCHCPcpNh627D3KHU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ad10d773fc3a39ace88f495c2c111a0bf7f5a481",
+        "rev": "ea8fa40a5fbf2762c41efc913c03aed3587ec7fa",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745487689,
-        "narHash": "sha256-FQoi3R0NjQeBAsEOo49b5tbDPcJSMWc3QhhaIi9eddw=",
+        "lastModified": 1745742390,
+        "narHash": "sha256-1rqa/XPSJqJg21BKWjzJZC7yU0l/YTVtjRi0RJmipus=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5630cf13cceac06cefe9fc607e8dfa8fb342dde3",
+        "rev": "26245db0cb552047418cfcef9a25da91b222d6c7",
         "type": "github"
       },
       "original": {

From 2d9ed6d784fa2ea4fc80a24098fe06068ac6d353 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 00:46:23 -0400
Subject: [PATCH 185/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index d2d84c5..c1dd1e8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745790506,
-        "narHash": "sha256-Jl1PVOzj5NyKBrDeIFFCaiT9ScriX1RtsQpU8sPZ9y0=",
+        "lastModified": 1745962324,
+        "narHash": "sha256-LMGfqVNGxlc0Nzf0k3jTF1EoOZrpmBUGocf2PCQY8bY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c0a97b762e5ec767dc414f0dc4979befd4c09a52",
+        "rev": "19e899ce21a7c9ffcf8bb2b22269a75f6e078f8f",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745805739,
-        "narHash": "sha256-ryJ95o+w0hSVm5LkW5dxTbL2e1HCHCPcpNh627D3KHU=",
+        "lastModified": 1745978367,
+        "narHash": "sha256-sBBdYbDTM8cZknj+3wwb05xOx/Di2cCtu/XQqz4U6u4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ea8fa40a5fbf2762c41efc913c03aed3587ec7fa",
+        "rev": "e5d5c68e28c3d2f03110f316be380bf90d5a54b7",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1745503349,
-        "narHash": "sha256-bUGjvaPVsOfQeTz9/rLTNLDyqbzhl0CQtJJlhFPhIYw=",
+        "lastModified": 1745955289,
+        "narHash": "sha256-mmV2oPhQN+YF2wmnJzXX8tqgYmUYXUj3uUUBSTmYN5o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f7bee55a5e551bd8e7b5b82c9bc559bc50d868d1",
+        "rev": "72081c9fbbef63765ae82bff9727ea79cc86bd5b",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745742390,
-        "narHash": "sha256-1rqa/XPSJqJg21BKWjzJZC7yU0l/YTVtjRi0RJmipus=",
+        "lastModified": 1745868005,
+        "narHash": "sha256-hZScOyQphT4RUmSEJX+2OxjIlGgLwSd8iW1LNtAWIOs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "26245db0cb552047418cfcef9a25da91b222d6c7",
+        "rev": "330d0a4167924b43f31cc9406df363f71b768a02",
         "type": "github"
       },
       "original": {

From 51704a0543ab72a3974cf9e33dea5ad91e10796b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 11:22:52 -0400
Subject: [PATCH 186/847] llm: use xiomo model

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index d7d6b65..393c090 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/agentica-org_DeepCoder-14B-Preview-GGUF/resolve/main/agentica-org_DeepCoder-14B-Preview-Q4_0.gguf";
-        sha256 = "6f60030be2287d6a1d52c91e6880352ed99e18da6d955a6204c77cfeaebbca01";
+        url = "https://huggingface.co/jedisct1/MiMo-7B-RL-GGUF/resolve/main/MiMo-7B-RL-Q4_K_M.gguf";
+        sha256 = "9142f02e34f64da37ae411dbde4059f5e5aac8aba32f261608d1c6f79f0c2eae";
       }
     );
     port = service_configs.ports.llama_cpp;

From b789db4d1f456b83c29fd555900a4e4a2122f9d0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 11:26:31 -0400
Subject: [PATCH 187/847] re-enable llm

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index eb521e0..ff07f0f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From b4c734f8ba5a617702eb4ecd79b5aaa1444eb733 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 11:33:53 -0400
Subject: [PATCH 188/847] qbt: max ratio 1 -> 2

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f608209..5240815 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -69,7 +69,7 @@
 
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 1.0;
+        GlobalMaxRatio = 2.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;

From cf3e032acb183d55562c0722057b55760f43d78f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 12:59:07 -0400
Subject: [PATCH 189/847] llm: use vulkan

---
 services/llama-cpp.nix | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 393c090..3dc4573 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -4,6 +4,7 @@
   config,
   inputs,
   optimizePackage,
+  lib,
   ...
 }:
 {
@@ -17,20 +18,17 @@
     );
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
-    package = (
-      optimizePackage (
-        inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
-          cmakeFlags = old.cmakeFlags ++ [
-            "-DGGML_AVX2=ON"
-          ];
-        })
-      )
-    );
+    package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
     extraFlags = [
       "--flash-attn"
+      "-ngl"
+      "9999"
     ];
   };
 
+  # have to do this in order to get vulkan to work
+  systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
+
   services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
     ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy :${builtins.toString config.services.llama-cpp.port}

From f210544af91f0a232dd7aedce9cdd6d716dc634c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 18:39:26 -0400
Subject: [PATCH 190/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index c1dd1e8..b27d7a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745962324,
-        "narHash": "sha256-LMGfqVNGxlc0Nzf0k3jTF1EoOZrpmBUGocf2PCQY8bY=",
+        "lastModified": 1746047579,
+        "narHash": "sha256-k2VFtZnanEvMQf2bk/Oc1H2NY5UJmOc36dvCkXqksBU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "19e899ce21a7c9ffcf8bb2b22269a75f6e078f8f",
+        "rev": "e1e8e0991ffd9e99a445c6812bb519d5bac9f4b5",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745868005,
-        "narHash": "sha256-hZScOyQphT4RUmSEJX+2OxjIlGgLwSd8iW1LNtAWIOs=",
+        "lastModified": 1745921652,
+        "narHash": "sha256-hEAvEN+y/OQ7wA7+u3bFJwXSe8yoSf2QaOMH3hyTJTQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "330d0a4167924b43f31cc9406df363f71b768a02",
+        "rev": "b000159bba69b0106a42f65e52dbf27f77aca9d3",
         "type": "github"
       },
       "original": {

From 9c6c9919809e298a38bc7406457416cc66df90ab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Apr 2025 19:19:30 -0400
Subject: [PATCH 191/847] minecraft: update squaremap + add c2me and
 scalablelux

---
 services/minecraft.nix | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 1acfb59..fca7cce 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -51,6 +51,8 @@
         difficulty = "easy";
         motd = "A Minecraft Server";
         view-distance = 12;
+        simulation-distance = 10;
+        sync-chunk-writes = false;
       };
 
       whitelist = import ../secrets/minecraft-whitelist.nix;
@@ -79,23 +81,20 @@
               sha512 = "c0825db25672cf8b50face51ec8a6bedb4be50b374a2537640a433c98817bc07c177485e93ab8cee9e3f7bfb1d2eb1460309e818b411764c92426b552487a9f7";
             };
 
-            # waiting for 1.21.5 version:
-            # https://github.com/Tuinity/Moonrise/tree/mc/1.21.5
-            # moonrise = fetchurl {
-            #   url = "https://cdn.modrinth.com/data/KOHu7RCS/versions/6Dgh9jQx/Moonrise-Fabric-0.2.0-beta.9%2Bac0c7de.jar";
-            #   sha512 = "c101f1a41db4095d651d32eae47bd7e6f7358f7390898610d1bf261ebfc7e0f4165fd551c08a99cca31a3308f1989a16b8c75c1ece60ef9cd475107ca4f4219e";
-            # };
-
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.5-1.3.5-SNAPSHOT+463e7ee.jar";
-              sha256 = "nHqvRHertYZUFMHQtsEK75RiB5K4zOi8nPvEBBUOzPg=";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/L1i3PIWB/squaremap-fabric-mc1.21.5-1.3.5.jar";
+              sha512 = "fa21ac0d60a0f2152f31878c7243e9e4e72c8abdd88ce35bd7e5bae0c3db2214e6f0c994f67e5a33993bb35bb78c684a813411d76a879ec1bbabe3b312a609e9";
             };
 
-            # doesn't support 1.21.5
-            # modernfix = fetchurl {
-            #   url = "https://cdn.modrinth.com/data/nmDcB62a/versions/ZGxQddYr/modernfix-fabric-5.20.3%2Bmc1.21.4.jar";
-            #   sha512 = "ae49114c92a048c9ce79e197fc4df028e186cf13546e710f72247382fa8076f0b70d6aa3224951f4a36c886ca236f099a011f20b021a2b0d1a75c631da4d7d52";
-            # };
+            scalablelux = fetchurl {
+              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/UueJNiJn/ScalableLux-0.1.3%2Bbeta.1%2Bfabric.4039a8d-all.jar";
+              sha512 = "144dd32f5f7b9c015ae2ff2efc8ba58c561d0fae7a22aba071f0d45f8b3154ae8d23783e9a0308c80eee51857a0ef68191c444830e5da3b44021f03b55a26da2";
+            };
+
+            c2me = fetchurl {
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/eL3rprSq/c2me-fabric-mc1.21.5-0.3.2.0.0.jar";
+              sha512 = "f1529136ef4e51331842df2518bc6d11c5347ea67ef118fd2be0c63243d173d8b6d97cca0d198f872b117510564b1dd815f14eadb85e2b1babf433d760cfc0e4";
+            };
 
             alternatecurrent = fetchurl {
               url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/eTNKfjl1/alternate-current-mc1.21.5-1.9.0.jar";

From af872d3afa6e17ac6a5a2403faa7e619216d0de2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 1 May 2025 13:03:19 -0400
Subject: [PATCH 192/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index b27d7a8..36cd576 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746047579,
-        "narHash": "sha256-k2VFtZnanEvMQf2bk/Oc1H2NY5UJmOc36dvCkXqksBU=",
+        "lastModified": 1746111942,
+        "narHash": "sha256-sxC8ev5fx4G+u0+IVrhdyqV/jiLWQ/mjNRqP1Lm0EYk=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e1e8e0991ffd9e99a445c6812bb519d5bac9f4b5",
+        "rev": "8936784f7a1ec4f91637d04b77fdc90ec36ebac9",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745978367,
-        "narHash": "sha256-sBBdYbDTM8cZknj+3wwb05xOx/Di2cCtu/XQqz4U6u4=",
+        "lastModified": 1746065310,
+        "narHash": "sha256-5B+j82oDN+Jm6CdwHdYeUp5dswWYDARJkOhznu1I7X8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e5d5c68e28c3d2f03110f316be380bf90d5a54b7",
+        "rev": "f2fcf7cd864c0e31b7f48d6709f436d524892fe4",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745921652,
-        "narHash": "sha256-hEAvEN+y/OQ7wA7+u3bFJwXSe8yoSf2QaOMH3hyTJTQ=",
+        "lastModified": 1746055187,
+        "narHash": "sha256-3dqArYSMP9hM7Qpy5YWhnSjiqniSaT2uc5h2Po7tmg0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b000159bba69b0106a42f65e52dbf27f77aca9d3",
+        "rev": "3e362ce63e16b9572d8c2297c04f7c19ab6725a5",
         "type": "github"
       },
       "original": {

From 45cbd74efa420be565677601626e747d4365d99e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 2 May 2025 21:50:13 -0400
Subject: [PATCH 193/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 36cd576..3b6cd41 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745557122,
-        "narHash": "sha256-eqSo9ugzsqhFgaDFYUZj943nurlX4L6f+AW0skJ4W+M=",
+        "lastModified": 1746171682,
+        "narHash": "sha256-EyXUNSa+H+YvGVuQJP1nZskXAowxKYp79RNUsNdQTj4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "dd26f75fb4ec1c731d4b1396eaf4439ce40a91c1",
+        "rev": "50eee705bbdbac942074a8c120e8194185633675",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746111942,
-        "narHash": "sha256-sxC8ev5fx4G+u0+IVrhdyqV/jiLWQ/mjNRqP1Lm0EYk=",
+        "lastModified": 1746210433,
+        "narHash": "sha256-a1VLDeB6NFqbVFMB/BR0kfw8QBqqHHoGP5GlhSRcdhc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8936784f7a1ec4f91637d04b77fdc90ec36ebac9",
+        "rev": "1d36b3670b285e69e58b9d687c770a2a0a192194",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746065310,
-        "narHash": "sha256-5B+j82oDN+Jm6CdwHdYeUp5dswWYDARJkOhznu1I7X8=",
+        "lastModified": 1746151214,
+        "narHash": "sha256-rwimRjWUa4EgjWo8YU8GWL/D4ZDBHkE32y/DtBP0RwE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f2fcf7cd864c0e31b7f48d6709f436d524892fe4",
+        "rev": "a97ba80db972f4a9ebb86948644d9c7cd95fc546",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746055187,
-        "narHash": "sha256-3dqArYSMP9hM7Qpy5YWhnSjiqniSaT2uc5h2Po7tmg0=",
+        "lastModified": 1746183838,
+        "narHash": "sha256-kwaaguGkAqTZ1oK0yXeQ3ayYjs8u/W7eEfrFpFfIDFA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e362ce63e16b9572d8c2297c04f7c19ab6725a5",
+        "rev": "bf3287dac860542719fe7554e21e686108716879",
         "type": "github"
       },
       "original": {

From 7e4eb5029a0f6b3749e80e90caa02526bd56dc1b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 3 May 2025 12:13:50 -0400
Subject: [PATCH 194/847] update + qbt changes

---
 flake.lock               | 12 ++++++------
 services/qbittorrent.nix |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3b6cd41..caa2477 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746210433,
-        "narHash": "sha256-a1VLDeB6NFqbVFMB/BR0kfw8QBqqHHoGP5GlhSRcdhc=",
+        "lastModified": 1746286791,
+        "narHash": "sha256-YZEQMuHFAk+Xpjcyhiw3u+F7oicMVTJolteij1ftEB4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "1d36b3670b285e69e58b9d687c770a2a0a192194",
+        "rev": "3bf785f3efa89ed28294fbf73054558a2b034bfb",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746151214,
-        "narHash": "sha256-rwimRjWUa4EgjWo8YU8GWL/D4ZDBHkE32y/DtBP0RwE=",
+        "lastModified": 1746237443,
+        "narHash": "sha256-rkt2eXq87Kvw4qU3OZTBiSavbVQ8jy3mKMv3Bp3ocyk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a97ba80db972f4a9ebb86948644d9c7cd95fc546",
+        "rev": "5b810e15ebce44e79429dd66212c8425a8256df8",
         "type": "github"
       },
       "original": {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 5240815..f1589ce 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -63,7 +63,7 @@
     serverConfig.BitTorrent = {
       Session = {
         GlobalUPSpeedLimit = 0; # unlimited upload
-        GlobalDLSpeedLimit = 500; # 500 KiB/s
+        GlobalDLSpeedLimit = 20000; # 20 MiB/s
 
         IgnoreLimitsOnLAN = true;
 

From 7404c5737c0e6ad92dcf6b31a23cfc974c522c46 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 4 May 2025 01:31:14 -0400
Subject: [PATCH 195/847] qbt: config changes

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f1589ce..fff0ddf 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -63,7 +63,7 @@
     serverConfig.BitTorrent = {
       Session = {
         GlobalUPSpeedLimit = 0; # unlimited upload
-        GlobalDLSpeedLimit = 20000; # 20 MiB/s
+        GlobalDLSpeedLimit = 0; # unlimited download
 
         IgnoreLimitsOnLAN = true;
 

From 5fc776c0b67660ebefb7fd31f83dec96b863234f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 4 May 2025 18:37:39 -0400
Subject: [PATCH 196/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index caa2477..17cca11 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745812220,
-        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
+        "lastModified": 1746390295,
+        "narHash": "sha256-TAfIbY/OWEn/3Kvq6L0NkN3AaMoIo2FPQLLj/W3+cI4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
+        "rev": "7b636423586635985f91bd2f0f0cb0511c340627",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746286791,
-        "narHash": "sha256-YZEQMuHFAk+Xpjcyhiw3u+F7oicMVTJolteij1ftEB4=",
+        "lastModified": 1746395022,
+        "narHash": "sha256-Y9KhkQzrYOoFmjbqBiQRXC+bVly7/voQ66gSBXxP5us=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "3bf785f3efa89ed28294fbf73054558a2b034bfb",
+        "rev": "27aa2595321c4d9cc4086a8e67bdea204b8309b0",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746237443,
-        "narHash": "sha256-rkt2eXq87Kvw4qU3OZTBiSavbVQ8jy3mKMv3Bp3ocyk=",
+        "lastModified": 1746324578,
+        "narHash": "sha256-VUSIQ2W1Q3YgGvX3M4jPwIi3iIApdPHabhdrVjVgnwE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5b810e15ebce44e79429dd66212c8425a8256df8",
+        "rev": "9e7fd83ba3b25b6f03561a5b7f8ea74b70296816",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1745955289,
-        "narHash": "sha256-mmV2oPhQN+YF2wmnJzXX8tqgYmUYXUj3uUUBSTmYN5o=",
+        "lastModified": 1746341346,
+        "narHash": "sha256-WjupK5Xpc+viJlJWiyPHp/dF4aJItp1BPuFsEdv2/fI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "72081c9fbbef63765ae82bff9727ea79cc86bd5b",
+        "rev": "0833dc8bbc4ffa9cf9b0cbfccf1c5ec8632fc66e",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746183838,
-        "narHash": "sha256-kwaaguGkAqTZ1oK0yXeQ3ayYjs8u/W7eEfrFpFfIDFA=",
+        "lastModified": 1746301764,
+        "narHash": "sha256-5odz+NZszRya//Zd0P8h+sIwOnV35qJi+73f4I+iv1M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bf3287dac860542719fe7554e21e686108716879",
+        "rev": "537ee98218704e21ea465251de512ab6bbb9012e",
         "type": "github"
       },
       "original": {

From 0b9bc1ae0d0571f5c36bbe377fb8cb132da9d47b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 5 May 2025 15:18:45 -0400
Subject: [PATCH 197/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 17cca11..b30df0d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746390295,
-        "narHash": "sha256-TAfIbY/OWEn/3Kvq6L0NkN3AaMoIo2FPQLLj/W3+cI4=",
+        "lastModified": 1746411114,
+        "narHash": "sha256-mLlkVX1kKbAa/Ns5u26wDYw4YW4ziMFM21fhtRmfirU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "7b636423586635985f91bd2f0f0cb0511c340627",
+        "rev": "b5d1320ebc2f34dbea4655f95167f55e2130cdb3",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746395022,
-        "narHash": "sha256-Y9KhkQzrYOoFmjbqBiQRXC+bVly7/voQ66gSBXxP5us=",
+        "lastModified": 1746453811,
+        "narHash": "sha256-6ddRXH4fPZu/X6m2rXRRwT1IUim3qsw2dwubWNDPMD8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "27aa2595321c4d9cc4086a8e67bdea204b8309b0",
+        "rev": "b34c859146630dff136943abc9852ca173a7c9d6",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1746341346,
-        "narHash": "sha256-WjupK5Xpc+viJlJWiyPHp/dF4aJItp1BPuFsEdv2/fI=",
+        "lastModified": 1746468201,
+        "narHash": "sha256-hSOSlrvMJwGr8hX/gc0mnhUf5UIClMDUAadfXlSXzfc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "0833dc8bbc4ffa9cf9b0cbfccf1c5ec8632fc66e",
+        "rev": "6aabf68429c0a414221d1790945babfb6a0bd068",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746301764,
-        "narHash": "sha256-5odz+NZszRya//Zd0P8h+sIwOnV35qJi+73f4I+iv1M=",
+        "lastModified": 1746422338,
+        "narHash": "sha256-NTtKOTLQv6dPfRe00OGSywg37A1FYqldS6xiNmqBUYc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "537ee98218704e21ea465251de512ab6bbb9012e",
+        "rev": "5b35d248e9206c1f3baf8de6a7683fee126364aa",
         "type": "github"
       },
       "original": {

From 32c121e94b097f03a139c8a0b3ea5f8051dada3f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 6 May 2025 01:32:10 -0400
Subject: [PATCH 198/847] kernel: 6.6 -> 6.12

---
 configuration.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index ff07f0f..e6c4d8c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -68,8 +68,8 @@
   };
 
   boot = {
-    # 6.6 LTS until 2026
-    kernelPackages = pkgs.linuxPackages_6_6;
+    # 6.12 LTS until 2026
+    kernelPackages = pkgs.linuxPackages_6_12;
 
     loader = {
       # Use the systemd-boot EFI boot loader.

From f86d45afd7dc1208294eb0bc751826fb9277eadf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 6 May 2025 02:30:40 -0400
Subject: [PATCH 199/847] secureboot directory stuff

---
 configuration.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index e6c4d8c..6128745 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -87,7 +87,8 @@
 
     lanzaboote = {
       enable = true;
-      pkiBundle = "/var/lib/sbctl";
+      # needed to be in `/etc/secureboot` for sbctl to work
+      pkiBundle = "/etc/secureboot";
     };
   };
 

From b6fee2380441b41f90a86a6dc6324766ac610838 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 7 May 2025 00:14:25 -0400
Subject: [PATCH 200/847] minecraft whitelist update

---
 secrets/minecraft-whitelist.nix | Bin 716 -> 803 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index bd458b163ab818db1a703101514a3d73cb37e266..c04b52e9f0e8bf11ce3bb73858a4ee7fcac2a93b 100644
GIT binary patch
literal 803
zcmZQ@_Y83kiVO&0IBaJ3X5QLs%ZkH31xD_=&t)L_=7R3>M_2chm93hh$FrmLOInQ4
zW(LK%Z<_Lw_MhcgGqEs#&+GgBk$h{+%!1~01~d!E^^2~TeX{RM+)S6qdd1WidqiHp
zv;A}9;7a%7@q&)^hSs+y3a!~G&hyEX_q4@{mh}sl%LuovmNhvn8x)##)ZpIY)=g4P
zUwmy0U)D^QoU$UsD)!*ZB+YB}Z}xNA#XC9w6kN^2{G@RHHuw7bGC!+th|IhCWUXI&
z?3`JWavzWJDNUNRfqB>c=ZkDC*2M%hM@$r-u<fk4>q3M3<qO)ja61{7f0%dU&tm_w
zmQ1DwTjL(X89(N)F<f@?(VJy_VQXTO%tRSundOe0QU2#w*Pqk(u-#hZ?Zss2m8GWH
zO}b((rwmzlr>?&)$$omVljy6DdL;||Vw<=nC+z)uZ8~$ZyXwJxD%;!dz53g1XIvsK
zlOp_5yP)IrvKO{YQtI3I1nr};*O=vfh>3o)hdoK|8cT!r<ZX2(M<=TD-ECYYzh};F
zf$+sm#p~x;xtp}GeZ73EBLBSmefDqHrJqMV*!Adr{`J3-c`VXPRfDH4{h9eW;KY(V
zhn3#;Iy|x4A9QT$xUz85&wmX^_TJsi8^@H#e{sp{h-*1})|V_epZ{Q2lZn<DRsFr;
zOYRC+-(O$$d7aw+mjaI5!hx&S{=N9JKYPcr)xRsG6iVKDHU_kEbpQ5wc4b#pQs|L{
z^1tmuJQACZ{_WXz)!p^`@AREdRxGuC80+pItRwWt>hVNr2Y;LO?tVG*ul0J?R65MI
z%=)q2No#B18<zi1mzS0oPUz~pD*JPN#e%8%hAeYVpW)hhM0IksuX3rS-c=vzz3SHc
zJvvR-AG|L3??#Da3E!^!?+TOp(iRJOF-LSi_*GrJ{-aT>KF_z%=W#5(y_}DxG=92T
znwT9~lJT@uRcp?S|NGvEu@q?K)u}~a`~AyRdCInr?2QU`(->HttG{dL)KqMqyuQw0
zmi3Q4Kc;+m)!Vy8Y{m|eS!DvgSDDuPFP?hfuL;MI1+}^tA`Ty6+%nVnLgSgMa~G?e
W_RhGqX~_%j2{)M-`66Fyrvm`LZHw&y

literal 716
zcmZQ@_Y83kiVO&0c>L&_uttB-new`@()(-kezEpFe*U{8Vxz^k6CW3Z?KvQ0YU8(m
z))v_ndw73+59#zU5BRereCxb5wxt>$@5~QeTeJ7E`^^t0HuBp$zI@eqi{W;}zANoo
z{#V`dE=(>ixgJ(7eS)pJH})n=aOX-T*7!ACo4%|m_1UX`%r4TiG3a-kV!&Zx200la
z(OXaMZqT>-|4wFGxl8Pp1${|H7T)EVvHzFMJ?OesNpJp}Ihh+1`sPSC^j2#fnlO2;
z){<un{_XGDaWeJP{wU7VYiDw=pUje0^F*V(y{}~jd+?6dyX8lng706Px2JojJ7aV1
zBjt%#T|K#8T=ITu;cA}pcD?Y5_?v5dg@P<?r?4i?dTlSOF;PvTEkJP5wjvIXOUqi)
zr=B#4IIFy~Q7UAP`~NaV*Xy+!I$tNLcvgk0by)ZsCrp%W>fSZKSNpHb%Q(XTZI*JC
zfSGBX!N(Yz7Wrvf{CaPY-ShlUYrx%uo#&_MtLASz`Sz^4rL?VV;|w0nDJp65*QPrv
za4{t-BwU>R>X}iWONGG+VO^%4JpEJQN6u=k*8EU>r|k8*K%t4}XU~2;XO+E>U-5!V
zrxhYJmplKm=?%zw=sn@*Pm%j&*B<J9&kTER^WVF5Z|3xdlk-y6+jZ}{*?Hub&0&}3
zIJw(APjXIm3r%6zn#)`)DOGVob$M9E`&k{Qd8~6e?z6qrT-v$UHsMl`daCHHR<2wl
zwXcf>^<#nqm8-&@Zu5J2y*BCdtZjO}Gm>v*Zz@htyLHh`<ha9?`Jzl7Cs*jSS}YWQ
zzjxo+l!BQb7yo~=f5pp%End@4O*kwflvQcD)BNJPWox@9?X91*-nlC3li7})dvz-P
z_!3{v`lZ?Pl%YCDc+c`?yPXHJYc5tP&AG#+Y01m6{KDf0uOg56UwNG)7s|G<PpihJ
gK61Nr)%i2M5=}Q#x2|XJNzXMupBOO3s5@v20C*%{0RR91


From d106743d066b314d30bb6918a96ff026526c3c5e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 7 May 2025 00:17:27 -0400
Subject: [PATCH 201/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index b30df0d..c4623b8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746453811,
-        "narHash": "sha256-6ddRXH4fPZu/X6m2rXRRwT1IUim3qsw2dwubWNDPMD8=",
+        "lastModified": 1746567351,
+        "narHash": "sha256-F/DuGSUZYA4E1M9NJF7bAtA5AXjAarLVAaGLjruXnIQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b34c859146630dff136943abc9852ca173a7c9d6",
+        "rev": "141a908a59bbc68ceae3bf090b850e33322a2ca9",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746324578,
-        "narHash": "sha256-VUSIQ2W1Q3YgGvX3M4jPwIi3iIApdPHabhdrVjVgnwE=",
+        "lastModified": 1746583312,
+        "narHash": "sha256-8+hYlwQPV3y1rn2r5NA53K7PlTqkREAUgoUBQZVEz2o=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "9e7fd83ba3b25b6f03561a5b7f8ea74b70296816",
+        "rev": "bbab1428178717cb831ecdb94b4ae0365ce6a570",
         "type": "github"
       },
       "original": {

From 0b7db386057959eae3aaa01f31b11aa877604784 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 7 May 2025 12:28:19 -0400
Subject: [PATCH 202/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index c4623b8..da11f16 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746567351,
-        "narHash": "sha256-F/DuGSUZYA4E1M9NJF7bAtA5AXjAarLVAaGLjruXnIQ=",
+        "lastModified": 1746628593,
+        "narHash": "sha256-1TDaZwU/aswMEtFX1qAcfYffJKrgeLnKWlJbY1qqZc8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "141a908a59bbc68ceae3bf090b850e33322a2ca9",
+        "rev": "814f795e063c257f33b921eab4073484238a151a",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1746468201,
-        "narHash": "sha256-hSOSlrvMJwGr8hX/gc0mnhUf5UIClMDUAadfXlSXzfc=",
+        "lastModified": 1746621361,
+        "narHash": "sha256-T9vOxEqI1j1RYugV0b9dgy0AreiZ9yBDKZJYyclF0og=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "6aabf68429c0a414221d1790945babfb6a0bd068",
+        "rev": "2ea3ad8a1f26a76f8a8e23fc4f7757c46ef30ee5",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746422338,
-        "narHash": "sha256-NTtKOTLQv6dPfRe00OGSywg37A1FYqldS6xiNmqBUYc=",
+        "lastModified": 1746557022,
+        "narHash": "sha256-QkNoyEf6TbaTW5UZYX0OkwIJ/ZMeKSSoOMnSDPQuol0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5b35d248e9206c1f3baf8de6a7683fee126364aa",
+        "rev": "1d3aeb5a193b9ff13f63f4d9cc169fb88129f860",
         "type": "github"
       },
       "original": {

From 3ec1d5b3c2c22d5b89759e72aec26d6d2eadcf67 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 May 2025 14:39:04 -0400
Subject: [PATCH 203/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index da11f16..58bad73 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1741481578,
-        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
+        "lastModified": 1746291859,
+        "narHash": "sha256-DdWJLA+D5tcmrRSg5Y7tp/qWaD05ATI4Z7h22gd1h7Q=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
+        "rev": "dfd9a8dfd09db9aad544c4d3b6c47b12562544a5",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746411114,
-        "narHash": "sha256-mLlkVX1kKbAa/Ns5u26wDYw4YW4ziMFM21fhtRmfirU=",
+        "lastModified": 1746729224,
+        "narHash": "sha256-9R4sOLAK1w3Bq54H3XOJogdc7a6C2bLLmatOQ+5pf5w=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "b5d1320ebc2f34dbea4655f95167f55e2130cdb3",
+        "rev": "85555d27ded84604ad6657ecca255a03fd878607",
         "type": "github"
       },
       "original": {
@@ -75,11 +75,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741352980,
-        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1745271491,
-        "narHash": "sha256-4GAHjus6JRpYHVROMIhFIz/sgLDF/klBM3UHulbSK9s=",
+        "lastModified": 1746717538,
+        "narHash": "sha256-mBPMdT19oLO6zRxTiuoKIKPQ4smlD8om3CZC3F34ZNo=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "995637eb3ab78eac33f8ee6b45cc2ecd5ede12ba",
+        "rev": "fa81496ad7359f62deec2f52882479250b237fc7",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746628593,
-        "narHash": "sha256-1TDaZwU/aswMEtFX1qAcfYffJKrgeLnKWlJbY1qqZc8=",
+        "lastModified": 1746728739,
+        "narHash": "sha256-QzMCS8R1bSx9IWLA+AvwU4DDjCCqDbtZKvYr7l+WpXw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "814f795e063c257f33b921eab4073484238a151a",
+        "rev": "f05a6d71a0f3dbf0730b56a1abbad41c0f42e63d",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746583312,
-        "narHash": "sha256-8+hYlwQPV3y1rn2r5NA53K7PlTqkREAUgoUBQZVEz2o=",
+        "lastModified": 1746728836,
+        "narHash": "sha256-ohXlk5xWTNP4oEBWkbNPVQLVuFzfXK6JmF9gpLnAfmI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "bbab1428178717cb831ecdb94b4ae0365ce6a570",
+        "rev": "e0dde293acbe7f1826c323dbe291651c60400763",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741379162,
-        "narHash": "sha256-srpAbmJapkaqGRE3ytf3bj4XshspVR5964OX5LfjDWc=",
+        "lastModified": 1746537231,
+        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "b5a62751225b2f62ff3147d0a334055ebadcd5cc",
+        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741573199,
-        "narHash": "sha256-A2sln1GdCf+uZ8yrERSCZUCqZ3JUlOv1WE2VFqqfaLQ=",
+        "lastModified": 1746671794,
+        "narHash": "sha256-V+mpk2frYIEm85iYf+KPDmCGG3zBRAEhbv0E3lHdG2U=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c777dc8a1e35407b0e80ec89817fe69970f4e81a",
+        "rev": "ceec434b8741c66bb8df5db70d7e629a9d9c598f",
         "type": "github"
       },
       "original": {

From 0c951d1fb90542860e81ed3303d0b4f5682498be Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 10 May 2025 20:20:45 -0400
Subject: [PATCH 204/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 58bad73..cbf5127 100644
--- a/flake.lock
+++ b/flake.lock
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1746717538,
-        "narHash": "sha256-mBPMdT19oLO6zRxTiuoKIKPQ4smlD8om3CZC3F34ZNo=",
+        "lastModified": 1746809399,
+        "narHash": "sha256-rMYfYaUpKuyMpDnodIfgFOnj6Wn0duItZvG4kQODcZo=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "fa81496ad7359f62deec2f52882479250b237fc7",
+        "rev": "8f27abb5e623d83db4988ee3e864df48181e7c30",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746728739,
-        "narHash": "sha256-QzMCS8R1bSx9IWLA+AvwU4DDjCCqDbtZKvYr7l+WpXw=",
+        "lastModified": 1746908806,
+        "narHash": "sha256-yhAEklpJSG1k2k94uefCk90HbMkV9AJyp2ZjaxE035A=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "f05a6d71a0f3dbf0730b56a1abbad41c0f42e63d",
+        "rev": "62d4250e52917dc4d634f054b1e2183ed7dee944",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746728836,
-        "narHash": "sha256-ohXlk5xWTNP4oEBWkbNPVQLVuFzfXK6JmF9gpLnAfmI=",
+        "lastModified": 1746842210,
+        "narHash": "sha256-bGJ3q4BEJEEz9MNo2QwXgQULmSUItxn52lMQLNImZ+w=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e0dde293acbe7f1826c323dbe291651c60400763",
+        "rev": "9acdd362e10b50cb36234544b5b80b3d0372456d",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1746621361,
-        "narHash": "sha256-T9vOxEqI1j1RYugV0b9dgy0AreiZ9yBDKZJYyclF0og=",
+        "lastModified": 1746814339,
+        "narHash": "sha256-hf2lICJzwACWuzHCmZn5NI6LUAOgGdR1yh8ip+duyhk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2ea3ad8a1f26a76f8a8e23fc4f7757c46ef30ee5",
+        "rev": "3c5e12673265dfb0de3d9121420c0c2153bf21e0",
         "type": "github"
       },
       "original": {

From aaaa6c107e2de22f135dc49a76e5ae18bb005799 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 11 May 2025 16:26:01 -0700
Subject: [PATCH 205/847] minecraft whitelist update

---
 secrets/minecraft-whitelist.nix | Bin 803 -> 1082 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index c04b52e9f0e8bf11ce3bb73858a4ee7fcac2a93b..8f834562327ff8c878928e31147509e1c30b1afa 100644
GIT binary patch
literal 1082
zcmZQ@_Y83kiVO&0I90@HP%;0msj1QC{1ub_%{i;THZgwR9@D@l^M$xKn*8rd+qiM9
z0aF+MPvJ|iuDbuT_#;2zhLB&aj`ZpKry3HbZ(Y>n@$HBFvB}Rw-k&P|Xps1p>Cw~0
zlLcM(-#9KJZNewAeNxKG*DDU5cDV5BsgqyS0nyDBDIYh?`@*9YpSeqNi$eL)o$~}8
z&oAq#-+ss{d+ITH<Hyo^#oMoM__A;EifHXmQ%~EkO-oev(082DIA8VR)h46aYqwnU
zWmKLbFnj6sRlc+R9xU^}l$?6#MegJiIZq^a8Okfp*ImbBlXfMcE7+ma-a766965&_
zM-N@wQnxskdG+KwwUUZ2JfG>;?~_QEvoy1P8gbYENx@D*PsYQt_7$wNBwYE!Chl=P
z@;~F0PUfGQM`9UX?eflZu2nUh%;??tv?Fw#aIM9*FPFA>mzPWq^fu>R5!m2vJ1Zo0
zr-hTfSAEDtmB3;??FqeUhkYk7Nwptde@fikYwKdEmh4Z<a-POUA1vzc+wQAa{`AQ6
zdLKVgGnvIpioL)7=G@^URw$Em{*2(_Mz>qO=QhM0(0S49Ror}RapmToGSNH<yJu-V
zWlbK%SKPH1uD#5=K~s*;(|JAj0<NSjJS7_$y7+22HRcxoI$UnlYu(MDcDLNZz5Fp}
zS$I6dMk87E<;s<>ezj~(wLdeBp?KlinJ-e3lN2NJ{>vo?mwDTlJPmN>eBa)o{MTUb
zpB*cvZ>!e#NfwKJ<?&_@x7yo%+|#zKOfr`!v|W0s<$MAEkDrb%uXfLx$rQkQF#Pa&
zugp!W(%<nWboegTI(%I*_;|{*mdSmm9)5Fk&V9M4Ag&?!)Ou~JSHFIC2|GSAf1I0A
z>As<+WB+zu_SKgD<=42cKU;ZjYX6ekdpN`+TMbMqI5G=M8v2wD+hkULyDz`-X{@z%
z!Pz;Jjxq7n_{7fdS)?^be&wHt05$dl_Fbt*ZPs3r*IRgS{$*dYjS0zna<~s`_b^tg
zzpAmVS+&n!>2{#1THyN{wvI!^%dY(2yllFtHPg3QN>ybYUuP~&`@q7HIrY~9rn;Qk
zsPKXxEq4S~vld=EqH)KiRIx1htdMlaEsjqNN@urhs+QG`FiH=6c`>Nv<x%EIUgEAd
z5;T{IWyWr`usf;$+{a(^_l1u!`<@?qW1nndenEQ=L)!f<HyMQHd(8go`lajqstk9%
zX#F=WeL3n3$3z$HVP#^>s5qrQ)yd$?<KrhBig_=cxbge#3G3B$-jzpp%EoFOO^BWA
zlYCcSXvf~_B{uKgYd8fpKYZA_tkZ#0{>-YH@>?xSSl;pfOWFVJ%R8I&!pPms)=|ss
z?)~+4RNAHf>BM(|_`i#4_WatJbyMQ2Yo*C8c0VQ2V^wYmGnGQly9KDM(fvK=X~|?g
zk>DwZe!TG!O5br_>hGdh#hVZLMFqs!l1^Uh%<O(D|Bh3Nokh*lwky={>sz@(08nEH
A#Q*>R

literal 803
zcmZQ@_Y83kiVO&0IBaJ3X5QLs%ZkH31xD_=&t)L_=7R3>M_2chm93hh$FrmLOInQ4
zW(LK%Z<_Lw_MhcgGqEs#&+GgBk$h{+%!1~01~d!E^^2~TeX{RM+)S6qdd1WidqiHp
zv;A}9;7a%7@q&)^hSs+y3a!~G&hyEX_q4@{mh}sl%LuovmNhvn8x)##)ZpIY)=g4P
zUwmy0U)D^QoU$UsD)!*ZB+YB}Z}xNA#XC9w6kN^2{G@RHHuw7bGC!+th|IhCWUXI&
z?3`JWavzWJDNUNRfqB>c=ZkDC*2M%hM@$r-u<fk4>q3M3<qO)ja61{7f0%dU&tm_w
zmQ1DwTjL(X89(N)F<f@?(VJy_VQXTO%tRSundOe0QU2#w*Pqk(u-#hZ?Zss2m8GWH
zO}b((rwmzlr>?&)$$omVljy6DdL;||Vw<=nC+z)uZ8~$ZyXwJxD%;!dz53g1XIvsK
zlOp_5yP)IrvKO{YQtI3I1nr};*O=vfh>3o)hdoK|8cT!r<ZX2(M<=TD-ECYYzh};F
zf$+sm#p~x;xtp}GeZ73EBLBSmefDqHrJqMV*!Adr{`J3-c`VXPRfDH4{h9eW;KY(V
zhn3#;Iy|x4A9QT$xUz85&wmX^_TJsi8^@H#e{sp{h-*1})|V_epZ{Q2lZn<DRsFr;
zOYRC+-(O$$d7aw+mjaI5!hx&S{=N9JKYPcr)xRsG6iVKDHU_kEbpQ5wc4b#pQs|L{
z^1tmuJQACZ{_WXz)!p^`@AREdRxGuC80+pItRwWt>hVNr2Y;LO?tVG*ul0J?R65MI
z%=)q2No#B18<zi1mzS0oPUz~pD*JPN#e%8%hAeYVpW)hhM0IksuX3rS-c=vzz3SHc
zJvvR-AG|L3??#Da3E!^!?+TOp(iRJOF-LSi_*GrJ{-aT>KF_z%=W#5(y_}DxG=92T
znwT9~lJT@uRcp?S|NGvEu@q?K)u}~a`~AyRdCInr?2QU`(->HttG{dL)KqMqyuQw0
zmi3Q4Kc;+m)!Vy8Y{m|eS!DvgSDDuPFP?hfuL;MI1+}^tA`Ty6+%nVnLgSgMa~G?e
W_RhGqX~_%j2{)M-`66Fyrvm`LZHw&y


From 0975e804d50e0ac654e190d43bd712c83bcfbdb8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 11 May 2025 16:26:12 -0700
Subject: [PATCH 206/847] minecraft disable spawn protection

---
 services/minecraft.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index fca7cce..4eb50f9 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -53,6 +53,7 @@
         view-distance = 12;
         simulation-distance = 10;
         sync-chunk-writes = false;
+        spawn-protection = 0;
       };
 
       whitelist = import ../secrets/minecraft-whitelist.nix;

From 48fffd1096eb995231efe8742c6168b4b17cfb1f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 11 May 2025 20:15:30 -0700
Subject: [PATCH 207/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index cbf5127..55131d5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746908806,
-        "narHash": "sha256-yhAEklpJSG1k2k94uefCk90HbMkV9AJyp2ZjaxE035A=",
+        "lastModified": 1747003146,
+        "narHash": "sha256-1Ppgrppd7ZRYzdpjKJPpcvigwFuXiYIMIw0wZ8qsAPY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "62d4250e52917dc4d634f054b1e2183ed7dee944",
+        "rev": "c104023994d36a8e791fc6a43789b84fd552cefc",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746842210,
-        "narHash": "sha256-bGJ3q4BEJEEz9MNo2QwXgQULmSUItxn52lMQLNImZ+w=",
+        "lastModified": 1747015534,
+        "narHash": "sha256-xWZ9OlyNPs4bU81cctlqiuZREhe1rD4j4GuLoh2nd4M=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "9acdd362e10b50cb36234544b5b80b3d0372456d",
+        "rev": "540f19177d1b41719731da8d9a91366d0732a6e7",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746557022,
-        "narHash": "sha256-QkNoyEf6TbaTW5UZYX0OkwIJ/ZMeKSSoOMnSDPQuol0=",
+        "lastModified": 1746810718,
+        "narHash": "sha256-VljtYzyttmvkWUKTVJVW93qAsJsrBbgAzy7DdnJaQfI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1d3aeb5a193b9ff13f63f4d9cc169fb88129f860",
+        "rev": "0c0bf9c057382d5f6f63d54fd61f1abd5e1c2f63",
         "type": "github"
       },
       "original": {

From a31158a7e2daddc9e74b9f2be12d9a3d5dd4ea63 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 May 2025 17:36:08 -0700
Subject: [PATCH 208/847] minecraft whitelist update

---
 secrets/minecraft-whitelist.nix | Bin 1082 -> 1145 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 8f834562327ff8c878928e31147509e1c30b1afa..4c106b01b466428ae20d3a0a97210e1aea33f967 100644
GIT binary patch
literal 1145
zcmZQ@_Y83kiVO&02(z;aG|XKa5ZQHYV})0@=eqqSoZFKR@2j|!QrB9r|JUakAszXW
zK`xChs#e>UG3(3ded*-r-!J&y;o6ZS$2#>+Pu(wkaeYTjjj`d6&5s!FFv~fz%+%Sd
zAf%#P^UU^i-Ok4ykA0n7?@e`?w8rSi*2~ZML;UJat`**2^<r|*pQv^_U;dUS70mqn
zm$K$mIX`*aV|c{lO7Z2}{YD#V{U6q@D^2>hZNsIVPxllZFtho0Pf|?WPU6_#(nki7
zP1B|A_gHRQXJS>6wUtM@Lv`YM&ZEa>?lKNf5WClTwz9*2=KY##zqg#PZpY_#2s;F<
zD0{HHH0}s<_Qv<#KYktGc`E+!4>dU^p_iG{Rk-EnBrYsIr1-dcs>Ah|_S5Tk{tdqR
zHbCnVhuOVlDaKt7l|`>6zR48)@<6ra=C;`Qk`s;FvR~z`w&C(w^<c_HN9V3=Ars|?
zWhWArzsm4<XI2uv<@l=R#3(CUcFn0jr2B*CPG`K<xBuMgr*@47*6UudR$7$Y|5%mK
zb%48WBI}kerxivry5<LLJm2YkyHOOdiQ~v)6}6eily9?s5Aeyq88b~<;7hzpBIm{c
zk=q~2z2|JbUG%#x*sJ7`hxWo{v9H$6zaj3EUui9xrOahiw9|6B-_{+IN;dx9^FP~-
zIj(ln8%Ku3;5Az+E*F(nwC$7-PFwPOhR+xGxq3flHgBwZQh5ENgv8SfwiRvq=F2$s
zYW#BM{wtdDQ?$kJ+QD_-xr#EEe$NqJcjoR_o|9`|o0)(2nrr=EKyt5d*ZXh!cW3;{
zyL)@0tAn^`%BoE-ZZ@RNI`uR%X)ROntftdJEVX9UMuHNJ7qd2)Kk&a4HpfeBl15F$
zw#&QsAA0mDE0E9E>ai=!&yDw1X)|sAvBmI+zy06Gfyp}E&cE`j>bFmIR9`Fn!R7d3
z?#I@h#!5*C4((&$yAdoPA+Sr-{*7R;XGgC4w<Hy7Z(WY8-3s3-r=Ody_v83C(IW|S
z^hD=5Y^=5a`%T}j&LwzrfE$PW+g+|UlO^gqwU@9x=t*nT+*rQzd-K#-u^4}uK#rH}
z?cV=l+a>Q6-A)vr_-Xy#&vp;WZd*$%E_v$lq*-v{<Erj|{O0?v9M=+GHa(``TEM$I
zjak}{In_cklo<GTecf`L^;?a|uUaV<n-rDm|2?--rtR_hyC6PUXZFqz=A_xe4?|LT
zStS;TaJ6^U$Gg3FA|AU-;!V<3v0M|r1SYZklzCy>zVDZxakTDR()`_>uh|w}@%HsA
z?6NX{P-8UJhUe<1k8Ulq^;BHX7W@rn=m=W=Z{5Y>%HY|L9cotB%%3#r>fwVSMc?98
zwST$nnRlA!$gBMA&Ih($IpwlRLFmcuMOP;0K5{%LJUeuD!KR|CLViKYJ{61CJZ$9J
zrm(Sl&d2m?d0xwAD6nswm=mNw)o*K)O=6m`wJ6KVCI8GkR=sAA5pk}c;TV#7c~g}w
zD@R#$RbgMutp)$4t!U9o;GAQAOo4+z^4pf_A+PVY?b=@ZtwcllZ$p=x%wKkY>0l<u
PJFnjQE{jil_V_0NfC(>D

literal 1082
zcmZQ@_Y83kiVO&0I90@HP%;0msj1QC{1ub_%{i;THZgwR9@D@l^M$xKn*8rd+qiM9
z0aF+MPvJ|iuDbuT_#;2zhLB&aj`ZpKry3HbZ(Y>n@$HBFvB}Rw-k&P|Xps1p>Cw~0
zlLcM(-#9KJZNewAeNxKG*DDU5cDV5BsgqyS0nyDBDIYh?`@*9YpSeqNi$eL)o$~}8
z&oAq#-+ss{d+ITH<Hyo^#oMoM__A;EifHXmQ%~EkO-oev(082DIA8VR)h46aYqwnU
zWmKLbFnj6sRlc+R9xU^}l$?6#MegJiIZq^a8Okfp*ImbBlXfMcE7+ma-a766965&_
zM-N@wQnxskdG+KwwUUZ2JfG>;?~_QEvoy1P8gbYENx@D*PsYQt_7$wNBwYE!Chl=P
z@;~F0PUfGQM`9UX?eflZu2nUh%;??tv?Fw#aIM9*FPFA>mzPWq^fu>R5!m2vJ1Zo0
zr-hTfSAEDtmB3;??FqeUhkYk7Nwptde@fikYwKdEmh4Z<a-POUA1vzc+wQAa{`AQ6
zdLKVgGnvIpioL)7=G@^URw$Em{*2(_Mz>qO=QhM0(0S49Ror}RapmToGSNH<yJu-V
zWlbK%SKPH1uD#5=K~s*;(|JAj0<NSjJS7_$y7+22HRcxoI$UnlYu(MDcDLNZz5Fp}
zS$I6dMk87E<;s<>ezj~(wLdeBp?KlinJ-e3lN2NJ{>vo?mwDTlJPmN>eBa)o{MTUb
zpB*cvZ>!e#NfwKJ<?&_@x7yo%+|#zKOfr`!v|W0s<$MAEkDrb%uXfLx$rQkQF#Pa&
zugp!W(%<nWboegTI(%I*_;|{*mdSmm9)5Fk&V9M4Ag&?!)Ou~JSHFIC2|GSAf1I0A
z>As<+WB+zu_SKgD<=42cKU;ZjYX6ekdpN`+TMbMqI5G=M8v2wD+hkULyDz`-X{@z%
z!Pz;Jjxq7n_{7fdS)?^be&wHt05$dl_Fbt*ZPs3r*IRgS{$*dYjS0zna<~s`_b^tg
zzpAmVS+&n!>2{#1THyN{wvI!^%dY(2yllFtHPg3QN>ybYUuP~&`@q7HIrY~9rn;Qk
zsPKXxEq4S~vld=EqH)KiRIx1htdMlaEsjqNN@urhs+QG`FiH=6c`>Nv<x%EIUgEAd
z5;T{IWyWr`usf;$+{a(^_l1u!`<@?qW1nndenEQ=L)!f<HyMQHd(8go`lajqstk9%
zX#F=WeL3n3$3z$HVP#^>s5qrQ)yd$?<KrhBig_=cxbge#3G3B$-jzpp%EoFOO^BWA
zlYCcSXvf~_B{uKgYd8fpKYZA_tkZ#0{>-YH@>?xSSl;pfOWFVJ%R8I&!pPms)=|ss
z?)~+4RNAHf>BM(|_`i#4_WatJbyMQ2Yo*C8c0VQ2V^wYmGnGQly9KDM(fvK=X~|?g
zk>DwZe!TG!O5br_>hGdh#hVZLMFqs!l1^Uh%<O(D|Bh3Nokh*lwky={>sz@(08nEH
A#Q*>R


From 29586d149823fec1712dac12f032b6f043e2ad29 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 May 2025 19:34:33 -0700
Subject: [PATCH 209/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 55131d5..693c563 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746171682,
-        "narHash": "sha256-EyXUNSa+H+YvGVuQJP1nZskXAowxKYp79RNUsNdQTj4=",
+        "lastModified": 1747020534,
+        "narHash": "sha256-D/6rkiC6w2p+4SwRiVKrWIeYzun8FBg7NlMKMwQMxO0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "50eee705bbdbac942074a8c120e8194185633675",
+        "rev": "b4bbdc6fde16fc2051fcde232f6e288cd22007ca",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1746809399,
-        "narHash": "sha256-rMYfYaUpKuyMpDnodIfgFOnj6Wn0duItZvG4kQODcZo=",
+        "lastModified": 1747056319,
+        "narHash": "sha256-qSKcBaISBozadtPq6BomnD+wIYTZIkiua3UuHLaD52c=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "8f27abb5e623d83db4988ee3e864df48181e7c30",
+        "rev": "2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747003146,
-        "narHash": "sha256-1Ppgrppd7ZRYzdpjKJPpcvigwFuXiYIMIw0wZ8qsAPY=",
+        "lastModified": 1747089097,
+        "narHash": "sha256-KIWfrMeYabthZBXM0ULjWN9/y9I72kn0f7cRwlq0rMg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c104023994d36a8e791fc6a43789b84fd552cefc",
+        "rev": "cf0a43bb6490bd49344775abb22ba26f8047cb54",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1746814339,
-        "narHash": "sha256-hf2lICJzwACWuzHCmZn5NI6LUAOgGdR1yh8ip+duyhk=",
+        "lastModified": 1747083103,
+        "narHash": "sha256-dMx20S2molwqJxbmMB4pGjNfgp5H1IOHNa1Eby6xL+0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3c5e12673265dfb0de3d9121420c0c2153bf21e0",
+        "rev": "d1d68fe8b00248caaa5b3bbe4984c12b47e0867d",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746810718,
-        "narHash": "sha256-VljtYzyttmvkWUKTVJVW93qAsJsrBbgAzy7DdnJaQfI=",
+        "lastModified": 1746957726,
+        "narHash": "sha256-k9ut1LSfHCr0AW82ttEQzXVCqmyWVA5+SHJkS5ID/Jo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0c0bf9c057382d5f6f63d54fd61f1abd5e1c2f63",
+        "rev": "a39ed32a651fdee6842ec930761e31d1f242cb94",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746671794,
-        "narHash": "sha256-V+mpk2frYIEm85iYf+KPDmCGG3zBRAEhbv0E3lHdG2U=",
+        "lastModified": 1747017456,
+        "narHash": "sha256-C/U12fcO+HEF071b5mK65lt4XtAIZyJSSJAg9hdlvTk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ceec434b8741c66bb8df5db70d7e629a9d9c598f",
+        "rev": "5b07506ae89b025b14de91f697eba23b48654c52",
         "type": "github"
       },
       "original": {

From 342d1d3c8082cd380087611f431a4c5267ed7593 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 May 2025 19:36:02 -0700
Subject: [PATCH 210/847] minecraft: update fabricapi

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 4eb50f9..86cff81 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -63,8 +63,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZOyJh09R/fabric-api-0.120.0%2B1.21.5.jar";
-              sha512 = "a4db4ae64f6590c69e5b86fdd6e89c66e8f3160d57dfa4369ea64fdc9bfb1f3812c2ed8ffdddca43c01d3335aaf404b283f5761b42ecc5389cd1ca206e6f500e";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/vcgUMTb2/fabric-api-0.124.0%2B1.21.5.jar";
+              sha512 = "674c876eb68e00fd19c3644286ea76380b639df068d51de77439d20c8abeb9460bfafe7d6e1dd6bedbcbcd500356a17f89488b73cd832a4599ee091700c7fad4";
             };
 
             FerriteCore = fetchurl {

From 110f02a159867b9380272642779e9b17859f3219 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 14 May 2025 00:16:41 -0700
Subject: [PATCH 211/847] disable llama

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 6128745..aac41b2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From 0bec71e92e73197ace0609bff1e27a82eb420c01 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 14 May 2025 00:51:13 -0700
Subject: [PATCH 212/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 693c563..7e9275a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747089097,
-        "narHash": "sha256-KIWfrMeYabthZBXM0ULjWN9/y9I72kn0f7cRwlq0rMg=",
+        "lastModified": 1747204861,
+        "narHash": "sha256-btzN+JvYs+Zz/EjlDzxJxRa6+9/iI7usDyNolvCPTU4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "cf0a43bb6490bd49344775abb22ba26f8047cb54",
+        "rev": "be1d4a13db26750fac702ceb3af88ae4f39dc9f4",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747015534,
-        "narHash": "sha256-xWZ9OlyNPs4bU81cctlqiuZREhe1rD4j4GuLoh2nd4M=",
+        "lastModified": 1747188102,
+        "narHash": "sha256-h/J6hSskrsR+YFCjWW4x4qXm1oGcUUvXH8TEZDZnLqk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "540f19177d1b41719731da8d9a91366d0732a6e7",
+        "rev": "cc53b6b79022c9dd31b9d426bb5a5f39246196e1",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1747083103,
-        "narHash": "sha256-dMx20S2molwqJxbmMB4pGjNfgp5H1IOHNa1Eby6xL+0=",
+        "lastModified": 1747129300,
+        "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d1d68fe8b00248caaa5b3bbe4984c12b47e0867d",
+        "rev": "e81fd167b33121269149c57806599045fd33eeed",
         "type": "github"
       },
       "original": {

From 4f49a19b7dcdd36aa11ba6a0988e3b5b03bc35c2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 15 May 2025 21:40:42 -0700
Subject: [PATCH 213/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7e9275a..439890c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746729224,
-        "narHash": "sha256-9R4sOLAK1w3Bq54H3XOJogdc7a6C2bLLmatOQ+5pf5w=",
+        "lastModified": 1747274630,
+        "narHash": "sha256-87RJwXbfOHyzTB9LYagAQ6vOZhszCvd8Gvudu+gf3qo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "85555d27ded84604ad6657ecca255a03fd878607",
+        "rev": "ec7c109a4f794fce09aad87239eab7f66540b888",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747020534,
-        "narHash": "sha256-D/6rkiC6w2p+4SwRiVKrWIeYzun8FBg7NlMKMwQMxO0=",
+        "lastModified": 1747331121,
+        "narHash": "sha256-3MmiUN/jOHBHQUnjqzg6qKArc17j2OS6jisEppDY4g8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b4bbdc6fde16fc2051fcde232f6e288cd22007ca",
+        "rev": "1eec32f0efe3b830927989767a9e6ece0d82d608",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747204861,
-        "narHash": "sha256-btzN+JvYs+Zz/EjlDzxJxRa6+9/iI7usDyNolvCPTU4=",
+        "lastModified": 1747348150,
+        "narHash": "sha256-HwxkDh4uhhXjs5yNecXhREeH6kl4/GEqpU3dD+a2eVs=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "be1d4a13db26750fac702ceb3af88ae4f39dc9f4",
+        "rev": "bc098c3cf0aac93e57e9bda9d95e2456acf88894",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747188102,
-        "narHash": "sha256-h/J6hSskrsR+YFCjWW4x4qXm1oGcUUvXH8TEZDZnLqk=",
+        "lastModified": 1747361001,
+        "narHash": "sha256-hDqfjdb/b7YD/M2b6o+aVbx+Plq80E7/h4OGyi2ku4Y=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "cc53b6b79022c9dd31b9d426bb5a5f39246196e1",
+        "rev": "8ca7db5b196b9316b5f2ea81414a537fba41393a",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746957726,
-        "narHash": "sha256-k9ut1LSfHCr0AW82ttEQzXVCqmyWVA5+SHJkS5ID/Jo=",
+        "lastModified": 1747209494,
+        "narHash": "sha256-fLise+ys+bpyjuUUkbwqo5W/UyIELvRz9lPBPoB0fbM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a39ed32a651fdee6842ec930761e31d1f242cb94",
+        "rev": "5d736263df906c5da72ab0f372427814de2f52f8",
         "type": "github"
       },
       "original": {

From 30df521e677329bbdab8a5f5817997f675444d75 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 18 May 2025 00:22:06 -0700
Subject: [PATCH 214/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 439890c..2077a47 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747348150,
-        "narHash": "sha256-HwxkDh4uhhXjs5yNecXhREeH6kl4/GEqpU3dD+a2eVs=",
+        "lastModified": 1747519188,
+        "narHash": "sha256-GOB1QKc3KDKT+brNqi7kpSxjdCoi6aEIEvmc4H2Fi1A=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "bc098c3cf0aac93e57e9bda9d95e2456acf88894",
+        "rev": "6a2bc8bfb7cd502e5ebc72e36c97a6f848c21c2c",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747361001,
-        "narHash": "sha256-hDqfjdb/b7YD/M2b6o+aVbx+Plq80E7/h4OGyi2ku4Y=",
+        "lastModified": 1747534164,
+        "narHash": "sha256-XylyMpP3g7z67pWdLW/VASRwsSF1tk7mUgH7FJvA0W4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8ca7db5b196b9316b5f2ea81414a537fba41393a",
+        "rev": "56cc76a519eb623c2cff2604b2509e000c853af2",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747209494,
-        "narHash": "sha256-fLise+ys+bpyjuUUkbwqo5W/UyIELvRz9lPBPoB0fbM=",
+        "lastModified": 1747335874,
+        "narHash": "sha256-IKKIXTSYJMmUtE+Kav5Rob8SgLPnfnq4Qu8LyT4gdqQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5d736263df906c5da72ab0f372427814de2f52f8",
+        "rev": "ba8b70ee098bc5654c459d6a95dfc498b91ff858",
         "type": "github"
       },
       "original": {

From 3861cbc8125de108bdfc95e539f4d5465046428f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 18 May 2025 00:22:12 -0700
Subject: [PATCH 215/847] minecraft whitelist update

---
 secrets/minecraft-whitelist.nix | Bin 1145 -> 1222 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/minecraft-whitelist.nix b/secrets/minecraft-whitelist.nix
index 4c106b01b466428ae20d3a0a97210e1aea33f967..93f0e9e64a44cc61a321219d1aab360a3c371565 100644
GIT binary patch
literal 1222
zcmZQ@_Y83kiVO&0D0!IhP-Vx~_}W_!95bg)Vpqt#ZN8I%FR6j;dueank43R|uj_A5
zi@fpnu!)(h?fX;qC5AosQf3@madhYQciZ;-n0oBQs%<yREKleh+xoLukk@JAtpmQ@
zt+!U?h2LGajAzM*Wrgz;4#vg?N$%NoHY&Bn`s@t9%O8wVm+QaWW4uh6`&$y9NN$Oh
znwFf`)Ras2ld5M}u+$t_f4DH?meb~4FTT8vd$Qb>v*N_W8%OS`{#>Q}a)O=4MI}c?
z)!E8ZCjU|~keOIg-|(-nbj5BF(bVf@WrFjUtleezvQF}&#LLspB^7*cBP46(id<Fu
zm2Q92^K9M`D*twwx|_+w#~XH+Uh;eyzWnbMv#Vy|9TViW9RBXDYv6iX)DZZg|8>;l
z2OIC)S6y;P_PMKK>8p#A7hGWFR-Zq|IQG@U+Lz24TDQ;kt8kqBq_g2>td}~Et-+PE
zN=`4Qh0e{{GbwMCLB-zP71Nvi%)~!egd~QRFUq*JFiN74Ys%xFsk-yzE?QN{Ew#M=
zbA!a6^LHgXR>Ym@WWTRxxan8n-FvT@9G{&(cKptTysqBa|D4Y8F1d0hVsm!wsq3p}
z6z|K}Y2Lf`tcdE)7=P!;)fz1~8w^e+EACN=JS5w<^n1;T!^u(a{(BXttkQn9Ah#mP
zXU*?<A%`lLdM}*+?suuu)mQ6UuT0}mF`GEgys+qc@2URoUG3{aO;T4}{=apWg_OTv
zpO?u3p2XB&yJVH*q)hB5=UwOhH@WwM)ZwX*N~VRc&$*>vuYcg4#=_W#V%x++UW6wl
zymFelH-7WqfG?Z%XG`;asX0-zxk6v<hwAsrO?(`We;F44Tekme{rlo=PS(3#C26j@
zc=F^+8{fpKn;-oV*%+DQIse_M0|iN*2m2MmTUUHoxBA9bMcef+1GD&wGep0gi%#5r
zY}OTphO6%P7~>`%|B@9txjg81ZmQ|+Wy&|C_wL*Ii%+4|NnxKvc-N_)+?f%#`PGZI
z=t?I2Y`o0A+we)P&VqFz53SF=I5B6__jPQy*oB&{dp^u{J=kyGVtDz+svG%joxCiC
zu>#D!+h2#g_Vf$7@p08In{R8<c-+n%n3MBK_|AMYYo}Y`48E&$1rJAa#{XaM@V;oG
z%m&{4mk*9Jv(0DnnLcyX^Vv7$juihAsk^s#r{A@_Wm<pP7A=vSv9e)j4Y$hPeS5>=
zjxP0T=qYxoWt%KmkiSH*sP2QuNyp}>howAh48FD{|CkrbT3w%C6ljt7dFj?^D|D~u
zFwI;zZ|}YdU0O%JEMN3!YHayirSsK7tp`&))_NUVpnQ3;!LHYg2Fp*sSE-ri@YHY8
zzcoJ$f3!E6b3XaX9-!2uTgX+EXVoWhy)AIv-iYG5`X@KKze+b7MFi*lS*!Rtq@`v1
z`I!t(>#_rk4?efe&X&-8#3fe6-nPi*K-3+cHzq&W{;Ra?dUwOKO2pBCe|xXR(c8+~
zx)Wp?iWmD-Dd%6b3;1?(&w-W%?w!9|I`%&})Fkd;eXM6^n83X$wkCA}a}6Iote#`g
zH&N}(rgp)b>z+On?$@-sw(CmYN$Yw0PAz#g<5R!iUZ*JuH>RzPQIcw2)X7@c?98Vs
ywjkK?f9N&apNz?zuPu`6bY5MJ+<J{M*=zMu(*;{kMXcVib%F0I-Ea?`FY^GULvF4B

literal 1145
zcmZQ@_Y83kiVO&02(z;aG|XKa5ZQHYV})0@=eqqSoZFKR@2j|!QrB9r|JUakAszXW
zK`xChs#e>UG3(3ded*-r-!J&y;o6ZS$2#>+Pu(wkaeYTjjj`d6&5s!FFv~fz%+%Sd
zAf%#P^UU^i-Ok4ykA0n7?@e`?w8rSi*2~ZML;UJat`**2^<r|*pQv^_U;dUS70mqn
zm$K$mIX`*aV|c{lO7Z2}{YD#V{U6q@D^2>hZNsIVPxllZFtho0Pf|?WPU6_#(nki7
zP1B|A_gHRQXJS>6wUtM@Lv`YM&ZEa>?lKNf5WClTwz9*2=KY##zqg#PZpY_#2s;F<
zD0{HHH0}s<_Qv<#KYktGc`E+!4>dU^p_iG{Rk-EnBrYsIr1-dcs>Ah|_S5Tk{tdqR
zHbCnVhuOVlDaKt7l|`>6zR48)@<6ra=C;`Qk`s;FvR~z`w&C(w^<c_HN9V3=Ars|?
zWhWArzsm4<XI2uv<@l=R#3(CUcFn0jr2B*CPG`K<xBuMgr*@47*6UudR$7$Y|5%mK
zb%48WBI}kerxivry5<LLJm2YkyHOOdiQ~v)6}6eily9?s5Aeyq88b~<;7hzpBIm{c
zk=q~2z2|JbUG%#x*sJ7`hxWo{v9H$6zaj3EUui9xrOahiw9|6B-_{+IN;dx9^FP~-
zIj(ln8%Ku3;5Az+E*F(nwC$7-PFwPOhR+xGxq3flHgBwZQh5ENgv8SfwiRvq=F2$s
zYW#BM{wtdDQ?$kJ+QD_-xr#EEe$NqJcjoR_o|9`|o0)(2nrr=EKyt5d*ZXh!cW3;{
zyL)@0tAn^`%BoE-ZZ@RNI`uR%X)ROntftdJEVX9UMuHNJ7qd2)Kk&a4HpfeBl15F$
zw#&QsAA0mDE0E9E>ai=!&yDw1X)|sAvBmI+zy06Gfyp}E&cE`j>bFmIR9`Fn!R7d3
z?#I@h#!5*C4((&$yAdoPA+Sr-{*7R;XGgC4w<Hy7Z(WY8-3s3-r=Ody_v83C(IW|S
z^hD=5Y^=5a`%T}j&LwzrfE$PW+g+|UlO^gqwU@9x=t*nT+*rQzd-K#-u^4}uK#rH}
z?cV=l+a>Q6-A)vr_-Xy#&vp;WZd*$%E_v$lq*-v{<Erj|{O0?v9M=+GHa(``TEM$I
zjak}{In_cklo<GTecf`L^;?a|uUaV<n-rDm|2?--rtR_hyC6PUXZFqz=A_xe4?|LT
zStS;TaJ6^U$Gg3FA|AU-;!V<3v0M|r1SYZklzCy>zVDZxakTDR()`_>uh|w}@%HsA
z?6NX{P-8UJhUe<1k8Ulq^;BHX7W@rn=m=W=Z{5Y>%HY|L9cotB%%3#r>fwVSMc?98
zwST$nnRlA!$gBMA&Ih($IpwlRLFmcuMOP;0K5{%LJUeuD!KR|CLViKYJ{61CJZ$9J
zrm(Sl&d2m?d0xwAD6nswm=mNw)o*K)O=6m`wJ6KVCI8GkR=sAA5pk}c;TV#7c~g}w
zD@R#$RbgMutp)$4t!U9o;GAQAOo4+z^4pf_A+PVY?b=@ZtwcllZ$p=x%wKkY>0l<u
PJFnjQE{jil_V_0NfC(>D


From 962c36e2310859f566386423bf26366d6c09c6e8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 23 May 2025 21:39:44 -0700
Subject: [PATCH 216/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2077a47..92f5e64 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747274630,
-        "narHash": "sha256-87RJwXbfOHyzTB9LYagAQ6vOZhszCvd8Gvudu+gf3qo=",
+        "lastModified": 1747742835,
+        "narHash": "sha256-kYL4GCwwznsypvsnA20oyvW8zB/Dvn6K5G/tgMjVMT4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ec7c109a4f794fce09aad87239eab7f66540b888",
+        "rev": "df522e787fdffc4f32ed3e1fca9ed0968a384d62",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747331121,
-        "narHash": "sha256-3MmiUN/jOHBHQUnjqzg6qKArc17j2OS6jisEppDY4g8=",
+        "lastModified": 1747688870,
+        "narHash": "sha256-ypL9WAZfmJr5V70jEVzqGjjQzF0uCkz+AFQF7n9NmNc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1eec32f0efe3b830927989767a9e6ece0d82d608",
+        "rev": "d5f1f641b289553927b3801580598d200a501863",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747519188,
-        "narHash": "sha256-GOB1QKc3KDKT+brNqi7kpSxjdCoi6aEIEvmc4H2Fi1A=",
+        "lastModified": 1748031240,
+        "narHash": "sha256-6dlk8uxnn4R/aqtiyGntJTUtm/UUrZLYzXnNxpdJmPU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "6a2bc8bfb7cd502e5ebc72e36c97a6f848c21c2c",
+        "rev": "b775345d788ac16260e7eef49e11fe57ee5677f7",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747534164,
-        "narHash": "sha256-XylyMpP3g7z67pWdLW/VASRwsSF1tk7mUgH7FJvA0W4=",
+        "lastModified": 1748051893,
+        "narHash": "sha256-KV6bgVHPzb9ymVk9WDRX1lkkeoZETMbS/MyPpIOUWVo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "56cc76a519eb623c2cff2604b2509e000c853af2",
+        "rev": "a600d058c19e1668db6ba759ecc4cfd154079ab5",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1747129300,
-        "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=",
+        "lastModified": 1747900541,
+        "narHash": "sha256-dn64Pg9xLETjblwZs9Euu/SsjW80pd6lr5qSiyLY1pg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "e81fd167b33121269149c57806599045fd33eeed",
+        "rev": "11f2d9ea49c3e964315215d6baa73a8d42672f06",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747335874,
-        "narHash": "sha256-IKKIXTSYJMmUtE+Kav5Rob8SgLPnfnq4Qu8LyT4gdqQ=",
+        "lastModified": 1747862697,
+        "narHash": "sha256-U4HaNZ1W26cbOVm0Eb5OdGSnfQVWQKbLSPrSSa78KC0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ba8b70ee098bc5654c459d6a95dfc498b91ff858",
+        "rev": "2baa12ff69913392faf0ace833bc54bba297ea95",
         "type": "github"
       },
       "original": {

From 089a1ff41a2d3748e4a1914d57a38a08635be281 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 23 May 2025 22:01:17 -0700
Subject: [PATCH 217/847] minecraft: update squaremap

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 86cff81..b9c88db 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -83,8 +83,8 @@
             };
 
             squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/L1i3PIWB/squaremap-fabric-mc1.21.5-1.3.5.jar";
-              sha512 = "fa21ac0d60a0f2152f31878c7243e9e4e72c8abdd88ce35bd7e5bae0c3db2214e6f0c994f67e5a33993bb35bb78c684a813411d76a879ec1bbabe3b312a609e9";
+              url = "https://github.com/jpenilla/squaremap/releases/download/v1.3.6/squaremap-fabric-mc1.21.5-1.3.6.jar";
+              sha256 = "Y3CiPf8qzZ0q2vfi4z3QoQgXdPZlT/gBm1ghlmGJCZQ=";
             };
 
             scalablelux = fetchurl {

From 218f9487d28b2045965f41de0ecf12e955a2788e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 23 May 2025 23:23:42 -0700
Subject: [PATCH 218/847] nixos 24.11 -> 25.05

---
 flake.lock | 16 ++++++++--------
 flake.nix  |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index 92f5e64..d520791 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,16 +153,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1747688870,
-        "narHash": "sha256-ypL9WAZfmJr5V70jEVzqGjjQzF0uCkz+AFQF7n9NmNc=",
+        "lastModified": 1747556831,
+        "narHash": "sha256-Qb84nbYFFk0DzFeqVoHltS2RodAYY5/HZQKE8WnBDsc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d5f1f641b289553927b3801580598d200a501863",
+        "rev": "d0bbd221482c2713cccb80220f3c9d16a6e20a33",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -253,16 +253,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747862697,
-        "narHash": "sha256-U4HaNZ1W26cbOVm0Eb5OdGSnfQVWQKbLSPrSSa78KC0=",
+        "lastModified": 1747953325,
+        "narHash": "sha256-y2ZtlIlNTuVJUZCqzZAhIw5rrKP4DOSklev6c8PyCkQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2baa12ff69913392faf0ace833bc54bba297ea95",
+        "rev": "55d1f923c480dadce40f5231feb472e81b0bab48",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 597bb53..7f86b4f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     lanzaboote = {
       url = "github:nix-community/lanzaboote";
@@ -21,7 +21,7 @@
     nixpkgs-qbt.url = "github:NixOS/nixpkgs/pull/287923/head";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

From 5e11f2d91046770455484fe98d197a1be26912e8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 25 May 2025 12:55:14 -0700
Subject: [PATCH 219/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index d520791..7830dde 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748031240,
-        "narHash": "sha256-6dlk8uxnn4R/aqtiyGntJTUtm/UUrZLYzXnNxpdJmPU=",
+        "lastModified": 1748192538,
+        "narHash": "sha256-3Op1/8FnnmtUY1+g4lRgqhoAg3XUTq9VxBrsLGY8TYU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b775345d788ac16260e7eef49e11fe57ee5677f7",
+        "rev": "2f099b510f460374acd52742b494595e3e3442d3",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748051893,
-        "narHash": "sha256-KV6bgVHPzb9ymVk9WDRX1lkkeoZETMbS/MyPpIOUWVo=",
+        "lastModified": 1748139117,
+        "narHash": "sha256-20rk3nzu5uFpg3ZGrSoB88VdCr+eJENGnuncKHorXTE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a600d058c19e1668db6ba759ecc4cfd154079ab5",
+        "rev": "3aede7ec07e25d1abdf55e4b9921872d08e4d0a9",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747953325,
-        "narHash": "sha256-y2ZtlIlNTuVJUZCqzZAhIw5rrKP4DOSklev6c8PyCkQ=",
+        "lastModified": 1748162331,
+        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55d1f923c480dadce40f5231feb472e81b0bab48",
+        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
         "type": "github"
       },
       "original": {

From d406c015f022b286da2b3dbf5c72edbcab01ace0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 25 May 2025 12:56:42 -0700
Subject: [PATCH 220/847] qbt: update vuetorrent

---
 services/qbittorrent.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index fff0ddf..2c14ca0 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -44,8 +44,8 @@
         AlternativeUIEnabled = true;
         RootFolder = builtins.toString (
           pkgs.fetchzip {
-            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.24.1/vuetorrent.zip";
-            sha256 = "XECHyc60F5JoJXybwIhUXg6kL1CceVpFGMjarB0dvbk=";
+            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.25.0/vuetorrent.zip";
+            sha256 = "sOaQNw6AnpwNFEextgTnsjEOfpl3/lpoOZFgFOz7Bos=";
           }
         );
 

From 46a762cc25be99ef46d971d6fdfa8b77ac7aaa95 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 25 May 2025 23:10:00 -0700
Subject: [PATCH 221/847] minecraft: update c2me

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index b9c88db..c01ac6c 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -93,8 +93,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/eL3rprSq/c2me-fabric-mc1.21.5-0.3.2.0.0.jar";
-              sha512 = "f1529136ef4e51331842df2518bc6d11c5347ea67ef118fd2be0c63243d173d8b6d97cca0d198f872b117510564b1dd815f14eadb85e2b1babf433d760cfc0e4";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/jrmtD6AF/c2me-fabric-mc1.21.5-0.3.3.0.0.jar";
+              sha512 = "4d6a3efcef9aaec8b494f1ac5917c5230175d6485592243a45eb2ee263baf481ce07681b0fb5b65a4969cd08d4708e001a83b17949dad32a646a8ea26052a9f9";
             };
 
             alternatecurrent = fetchurl {

From d58c9b7bab7704a2033a5398fd245c5db86e6851 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 May 2025 19:23:17 -0700
Subject: [PATCH 222/847] minecraft: 4gb -> 10gb ram + install spark

---
 services/minecraft.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index c01ac6c..42b38c4 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -39,7 +39,7 @@
 
       jvmOpts =
         let
-          heap_size = "4000M";
+          heap_size = "10000M";
         in
         "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
@@ -117,6 +117,11 @@
               url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/neW85eWt/krypton-0.2.9.jar";
               sha512 = "2e2304b1b17ecf95783aee92e26e54c9bfad325c7dfcd14deebf9891266eb2933db00ff77885caa083faa96f09c551eb56f93cf73b357789cb31edad4939ffeb";
             };
+
+            spark = fetchurl {
+              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/65SnrRgF/spark-1.10.138-fabric.jar";
+              sha512 = "c2bdb171c7ec1783f9efb0ff9a995433fd5838bd8571896be4f498c857ae9f2242d3f24c0541cd96049ea29d742a0e3f8077a3bd1af5d79654f19d34a3adc79c";
+            };
           }
         );
       };

From 3b282297b1df46b61df295201a9228ac31f8c575 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 May 2025 20:12:18 -0700
Subject: [PATCH 223/847] minecraft: reduce render distance

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 42b38c4..e16dad1 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -50,8 +50,8 @@
         white-list = true;
         difficulty = "easy";
         motd = "A Minecraft Server";
-        view-distance = 12;
-        simulation-distance = 10;
+        view-distance = 10;
+        simulation-distance = 6;
         sync-chunk-writes = false;
         spawn-protection = 0;
       };

From 29aa5244e4a45ae81ed92d42ee59d5145b2bf4cd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 May 2025 21:28:48 -0700
Subject: [PATCH 224/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7830dde..015fd07 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747742835,
-        "narHash": "sha256-kYL4GCwwznsypvsnA20oyvW8zB/Dvn6K5G/tgMjVMT4=",
+        "lastModified": 1748225455,
+        "narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "df522e787fdffc4f32ed3e1fca9ed0968a384d62",
+        "rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747556831,
-        "narHash": "sha256-Qb84nbYFFk0DzFeqVoHltS2RodAYY5/HZQKE8WnBDsc=",
+        "lastModified": 1748226808,
+        "narHash": "sha256-GaBRgxjWO1bAQa8P2+FDxG4ANBVhjnSjBms096qQdxo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d0bbd221482c2713cccb80220f3c9d16a6e20a33",
+        "rev": "83665c39fa688bd6a1f7c43cf7997a70f6a109f9",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748192538,
-        "narHash": "sha256-3Op1/8FnnmtUY1+g4lRgqhoAg3XUTq9VxBrsLGY8TYU=",
+        "lastModified": 1748295267,
+        "narHash": "sha256-UJdP+x76SJAzeNNQN5H3g39FF5sObzaOci2wJTg6Org=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2f099b510f460374acd52742b494595e3e3442d3",
+        "rev": "cdf94a18023c92f41808ec874ba577d914674717",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748139117,
-        "narHash": "sha256-20rk3nzu5uFpg3ZGrSoB88VdCr+eJENGnuncKHorXTE=",
+        "lastModified": 1748225187,
+        "narHash": "sha256-gpNN43fNJQoHhnK1Z+nms4lo6i/t9t2rfZMAxc165vQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "3aede7ec07e25d1abdf55e4b9921872d08e4d0a9",
+        "rev": "98c1bcaaa4dbd5980523a08a5b32e35d44e830e5",
         "type": "github"
       },
       "original": {

From 4d91edf6a71f2ba0197c484a1f3651f10f1cb68c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 20:03:48 -0700
Subject: [PATCH 225/847] qbt: max ratio 2 -> 4

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 2c14ca0..eab7c5f 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -69,7 +69,7 @@
 
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 2.0;
+        GlobalMaxRatio = 4.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;

From 28e9b3d1f39203a9c97d524f475f11a32c5aef1c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 20:14:49 -0700
Subject: [PATCH 226/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 015fd07..99844fc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748226808,
-        "narHash": "sha256-GaBRgxjWO1bAQa8P2+FDxG4ANBVhjnSjBms096qQdxo=",
+        "lastModified": 1748455876,
+        "narHash": "sha256-4n9uDN54LSgN7WVEzj2r0nBthV5m0uFi9BgiD0dfS54=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "83665c39fa688bd6a1f7c43cf7997a70f6a109f9",
+        "rev": "529d2aac542a42c57d4b765501ace564b07e3d99",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748295267,
-        "narHash": "sha256-UJdP+x76SJAzeNNQN5H3g39FF5sObzaOci2wJTg6Org=",
+        "lastModified": 1748469020,
+        "narHash": "sha256-tPOsjGyTYcSa5c/X/iNAdXEEdgrZ4hW6eirbqwuu+ZM=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "cdf94a18023c92f41808ec874ba577d914674717",
+        "rev": "53ae30640e131082d8d19bd80485b47c4553d551",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748225187,
-        "narHash": "sha256-gpNN43fNJQoHhnK1Z+nms4lo6i/t9t2rfZMAxc165vQ=",
+        "lastModified": 1748484226,
+        "narHash": "sha256-EEAoks/XEcA1c+PPkgqHfG0gU20Vsv4AVNRZw94+2d8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "98c1bcaaa4dbd5980523a08a5b32e35d44e830e5",
+        "rev": "89004e07d97d2fa1113bbcc51a9ed1abea5b3371",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748162331,
-        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
+        "lastModified": 1748302896,
+        "narHash": "sha256-ixMT0a8mM091vSswlTORZj93WQAJsRNmEvqLL+qwTFM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
+        "rev": "7848cd8c982f7740edf76ddb3b43d234cb80fc4d",
         "type": "github"
       },
       "original": {

From 3f54be649ca1902e97c8652633f255f204310652 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 20:16:11 -0700
Subject: [PATCH 227/847] minecraft: add better-fabric-console

---
 services/minecraft.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index e16dad1..e4fabf7 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -122,6 +122,11 @@
               url = "https://cdn.modrinth.com/data/l6YH9Als/versions/65SnrRgF/spark-1.10.138-fabric.jar";
               sha512 = "c2bdb171c7ec1783f9efb0ff9a995433fd5838bd8571896be4f498c857ae9f2242d3f24c0541cd96049ea29d742a0e3f8077a3bd1af5d79654f19d34a3adc79c";
             };
+
+            better-fabric-console = fetchurl {
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/OexcFHtG/better-fabric-console-mc1.21.5-1.2.3.jar";
+              sha512 = "0a5b0da9d6d3c78ed9af66d2bca3976889649942025aecf7f469bea500ce7914070569259332fefb3629b2eb478ee0cfbf85252aaec5d7969727c1668732e8f4";
+            };
           }
         );
       };

From 0f46de5eb7fe7da6ed1f23c38988dfe85af93a5a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 20:59:45 -0700
Subject: [PATCH 228/847] llama-cpp: nvidia-acereason-7b

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 3dc4573..e29e4e8 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -12,8 +12,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/jedisct1/MiMo-7B-RL-GGUF/resolve/main/MiMo-7B-RL-Q4_K_M.gguf";
-        sha256 = "9142f02e34f64da37ae411dbde4059f5e5aac8aba32f261608d1c6f79f0c2eae";
+        url = "https://huggingface.co/bartowski/nvidia_AceReason-Nemotron-7B-GGUF/resolve/main/nvidia_AceReason-Nemotron-7B-Q4_0.gguf";
+        sha256 = "27f93349ea88f3c84e53469288ac2ac3f5c985de9f8e00e275870e7e524bb3d8";
       }
     );
     port = service_configs.ports.llama_cpp;

From efb0bd38e80c9eeea28ffc41fd89c2fdeb433f23 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 21:00:08 -0700
Subject: [PATCH 229/847] llama-cpp: disable flash attn

---
 services/llama-cpp.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index e29e4e8..c49b32c 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -20,7 +20,6 @@
     host = "0.0.0.0";
     package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
     extraFlags = [
-      "--flash-attn"
       "-ngl"
       "9999"
     ];

From f500258c84c78f38e28d6979e96d7aa4659cf7f8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 21:00:28 -0700
Subject: [PATCH 230/847] re-enable llm

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index aac41b2..6128745 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From c8c150e10c9088dad664c4649bc345aae6992906 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 21:04:34 -0700
Subject: [PATCH 231/847] llama-cpp: vulkan broken

---
 services/llama-cpp.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index c49b32c..557faee 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -18,7 +18,8 @@
     );
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
-    package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
+    package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
     extraFlags = [
       "-ngl"
       "9999"

From 5835da1f7b63aa888aaa6eafb080df1d030e65dd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 21:09:45 -0700
Subject: [PATCH 232/847] llama-cpp: disable gpu

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 557faee..cb8fdbc 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -21,8 +21,8 @@
     # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
     package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
     extraFlags = [
-      "-ngl"
-      "9999"
+      # "-ngl"
+      # "9999"
     ];
   };
 

From 22f6682cee590471fb38f7bfd4dad40f91df4b33 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 21:20:42 -0700
Subject: [PATCH 233/847] llama-cpp: use q8 quantization instead of q4

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index cb8fdbc..86b4d85 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -12,8 +12,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/nvidia_AceReason-Nemotron-7B-GGUF/resolve/main/nvidia_AceReason-Nemotron-7B-Q4_0.gguf";
-        sha256 = "27f93349ea88f3c84e53469288ac2ac3f5c985de9f8e00e275870e7e524bb3d8";
+        url = "https://huggingface.co/bartowski/nvidia_AceReason-Nemotron-7B-GGUF/resolve/main/nvidia_AceReason-Nemotron-7B-Q8_0.gguf";
+        sha256 = "0d5eb8b46490af7c097357cb20ad215ebfd30efacedac58bf68a8c7d84e996fc";
       }
     );
     port = service_configs.ports.llama_cpp;

From 5a38343a6c068925d80da0cde54a7d224a0cf802 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 28 May 2025 23:32:21 -0700
Subject: [PATCH 234/847] add NOTES.md

---
 NOTES.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 NOTES.md

diff --git a/NOTES.md b/NOTES.md
new file mode 100644
index 0000000..c54d286
--- /dev/null
+++ b/NOTES.md
@@ -0,0 +1,7 @@
+## List drives in external usb bay
+
+fish shell script:
+```fish
+find /dev/disk/by-id -name "usb*" | grep -v "part[0-9]\$" | while read drive; lsblk -no model,serial $drive | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo $drive | cut -d':' -f2-)"; end | column -t --table-columns=DRIVE,BAY | sort -n -k 2
+```
+

From 6cb313a760fde2b21551fe8615ec096727409542 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 1 Jun 2025 14:45:29 -0700
Subject: [PATCH 235/847] minecraft: update fabricapi

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index e4fabf7..26dba5d 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -63,8 +63,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/vcgUMTb2/fabric-api-0.124.0%2B1.21.5.jar";
-              sha512 = "674c876eb68e00fd19c3644286ea76380b639df068d51de77439d20c8abeb9460bfafe7d6e1dd6bedbcbcd500356a17f89488b73cd832a4599ee091700c7fad4";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/1Hweb6k1/fabric-api-0.125.3%2B1.21.5.jar";
+              sha512 = "54d1c195803de90a7055858ab835d527919007f0e80048e854d3beaaad151d30766a78f530a4189eadfbbef3bd98cca69c9f54f565d49b586180cbd5834eda97";
             };
 
             FerriteCore = fetchurl {

From c7237e1f72cafc804e9a1603a2795ed6c5f35d5d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Jun 2025 19:42:46 -0700
Subject: [PATCH 236/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 99844fc..faef2fa 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748225455,
-        "narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
+        "lastModified": 1748832438,
+        "narHash": "sha256-/CtyLVfNaFP7PrOPrTEuGOJBIhcBKVQ91KiEbtXJi0A=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
+        "rev": "58d6e5a83fff9982d57e0a0a994d4e5c0af441e4",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748455876,
-        "narHash": "sha256-4n9uDN54LSgN7WVEzj2r0nBthV5m0uFi9BgiD0dfS54=",
+        "lastModified": 1748665073,
+        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "529d2aac542a42c57d4b765501ace564b07e3d99",
+        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748469020,
-        "narHash": "sha256-tPOsjGyTYcSa5c/X/iNAdXEEdgrZ4hW6eirbqwuu+ZM=",
+        "lastModified": 1748908498,
+        "narHash": "sha256-BmdtmB9GXqlUYvsDYN39LWkM+lEj+8FpS4TwBUvSMbs=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "53ae30640e131082d8d19bd80485b47c4553d551",
+        "rev": "71e74a3ac929b8af91f16f73f3c2b9b2f796d207",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748484226,
-        "narHash": "sha256-EEAoks/XEcA1c+PPkgqHfG0gU20Vsv4AVNRZw94+2d8=",
+        "lastModified": 1748916347,
+        "narHash": "sha256-eIy97tvwFpLYsKX9uuALUyheoab+1HvIG0DHjxuY1bE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "89004e07d97d2fa1113bbcc51a9ed1abea5b3371",
+        "rev": "ba53b41891daed8bea64bb32c12a98f159bcca9b",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1747900541,
-        "narHash": "sha256-dn64Pg9xLETjblwZs9Euu/SsjW80pd6lr5qSiyLY1pg=",
+        "lastModified": 1748634340,
+        "narHash": "sha256-pZH4bqbOd8S+si6UcfjHovWDiWKiIGRNRMpmRWaDIms=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "11f2d9ea49c3e964315215d6baa73a8d42672f06",
+        "rev": "daa628a725ab4948e0e2b795e8fb6f4c3e289a7a",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748302896,
-        "narHash": "sha256-ixMT0a8mM091vSswlTORZj93WQAJsRNmEvqLL+qwTFM=",
+        "lastModified": 1748889542,
+        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7848cd8c982f7740edf76ddb3b43d234cb80fc4d",
+        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
         "type": "github"
       },
       "original": {

From 5f958308f3b4e4495e687b0863fff32148540146 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Jun 2025 21:07:56 -0700
Subject: [PATCH 237/847] update

---
 flake.lock | 66 +++++++++++++++++++++++++++---------------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/flake.lock b/flake.lock
index faef2fa..f315744 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1746291859,
-        "narHash": "sha256-DdWJLA+D5tcmrRSg5Y7tp/qWaD05ATI4Z7h22gd1h7Q=",
+        "lastModified": 1748047550,
+        "narHash": "sha256-t0qLLqb4C1rdtiY8IFRH5KIapTY/n3Lqt57AmxEv9mk=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "dfd9a8dfd09db9aad544c4d3b6c47b12562544a5",
+        "rev": "b718a78696060df6280196a6f992d04c87a16aef",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748832438,
-        "narHash": "sha256-/CtyLVfNaFP7PrOPrTEuGOJBIhcBKVQ91KiEbtXJi0A=",
+        "lastModified": 1749089136,
+        "narHash": "sha256-A1UgwtAEQYd38Z6VoRAiGs4jZQczAGyP5DF3hhYUdpg=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "58d6e5a83fff9982d57e0a0a994d4e5c0af441e4",
+        "rev": "a4f7deb49f7336feb6c5abaf213b374936421dbe",
         "type": "github"
       },
       "original": {
@@ -38,11 +38,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -54,11 +54,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1747056319,
-        "narHash": "sha256-qSKcBaISBozadtPq6BomnD+wIYTZIkiua3UuHLaD52c=",
+        "lastModified": 1748959397,
+        "narHash": "sha256-hq+njWbMLAfQIFEP+8G/7xLz1ZELWC+780332FdpnW0=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85",
+        "rev": "20721e48123f1f900b323a76349130080a2f8343",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748908498,
-        "narHash": "sha256-BmdtmB9GXqlUYvsDYN39LWkM+lEj+8FpS4TwBUvSMbs=",
+        "lastModified": 1749067320,
+        "narHash": "sha256-ZpKzmdUug1Giz04mFfqx4MaRTaITX/dknMe1e7Vjyro=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "71e74a3ac929b8af91f16f73f3c2b9b2f796d207",
+        "rev": "0d3984424f2973c49c4bcabe4cc0153b4f90c601",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748916347,
-        "narHash": "sha256-eIy97tvwFpLYsKX9uuALUyheoab+1HvIG0DHjxuY1bE=",
+        "lastModified": 1749095188,
+        "narHash": "sha256-Y6TWh4WBLaalq0+U1Hd/Gco6MF6F3Ikj4yD1EIl8b2g=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ba53b41891daed8bea64bb32c12a98f159bcca9b",
+        "rev": "862e62f46d27681b2195904e18e3b670efa81b24",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1748634340,
-        "narHash": "sha256-pZH4bqbOd8S+si6UcfjHovWDiWKiIGRNRMpmRWaDIms=",
+        "lastModified": 1749056381,
+        "narHash": "sha256-QITcurR19KZlrCngBoCjsFF2BdYsiCG4UqmlrVcLb8Q=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "daa628a725ab4948e0e2b795e8fb6f4c3e289a7a",
+        "rev": "029bd66faa180e11262dd1bc2732254c33415f52",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748889542,
-        "narHash": "sha256-Hb4iMhIbjX45GcrgOp3b8xnyli+ysRPqAgZ/LZgyT5k=",
+        "lastModified": 1749024892,
+        "narHash": "sha256-OGcDEz60TXQC+gVz5sdtgGJdKVYr6rwdzQKuZAJQpCA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "10d7f8d34e5eb9c0f9a0485186c1ca691d2c5922",
+        "rev": "8f1b52b04f2cb6e5ead50bd28d76528a2f0380ef",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746537231,
-        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747017456,
-        "narHash": "sha256-C/U12fcO+HEF071b5mK65lt4XtAIZyJSSJAg9hdlvTk=",
+        "lastModified": 1748227081,
+        "narHash": "sha256-RLnN7LBxhEdCJ6+rIL9sbhjBVDaR6jG377M/CLP/fmE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b07506ae89b025b14de91f697eba23b48654c52",
+        "rev": "1cbe817fd8c64a9f77ba4d7861a4839b0b15983e",
         "type": "github"
       },
       "original": {

From ab8e88979321cca722899e6edf3036de5a833628 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Jun 2025 20:05:11 -0700
Subject: [PATCH 238/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index f315744..05ad9da 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749089136,
-        "narHash": "sha256-A1UgwtAEQYd38Z6VoRAiGs4jZQczAGyP5DF3hhYUdpg=",
+        "lastModified": 1749200714,
+        "narHash": "sha256-W8KiJIrVwmf43JOPbbTu5lzq+cmdtRqaNbOsZigjioY=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a4f7deb49f7336feb6c5abaf213b374936421dbe",
+        "rev": "17d08c65c241b1d65b3ddf79e3fac1ddc870b0f6",
         "type": "github"
       },
       "original": {
@@ -153,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748665073,
-        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
+        "lastModified": 1749154018,
+        "narHash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
+        "rev": "7aae0ee71a17b19708b93b3ed448a1a0952bf111",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749067320,
-        "narHash": "sha256-ZpKzmdUug1Giz04mFfqx4MaRTaITX/dknMe1e7Vjyro=",
+        "lastModified": 1749208275,
+        "narHash": "sha256-+sb4ZDeFuxSvu0yB1WWbJsMyQabuY7Vd4NTp0Nog8R8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0d3984424f2973c49c4bcabe4cc0153b4f90c601",
+        "rev": "745aa5319b9930068aff5e87cf5e9eef7227339b",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749095188,
-        "narHash": "sha256-Y6TWh4WBLaalq0+U1Hd/Gco6MF6F3Ikj4yD1EIl8b2g=",
+        "lastModified": 1749261782,
+        "narHash": "sha256-0jd9kSztFf0zBptAeTOzgjqYC7uiwCZDJHAcHlL17lQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "862e62f46d27681b2195904e18e3b670efa81b24",
+        "rev": "10209e2ab990b7ccd296c7c6ac47342fe6988bdf",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1749056381,
-        "narHash": "sha256-QITcurR19KZlrCngBoCjsFF2BdYsiCG4UqmlrVcLb8Q=",
+        "lastModified": 1749195551,
+        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "029bd66faa180e11262dd1bc2732254c33415f52",
+        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749024892,
-        "narHash": "sha256-OGcDEz60TXQC+gVz5sdtgGJdKVYr6rwdzQKuZAJQpCA=",
+        "lastModified": 1749086602,
+        "narHash": "sha256-DJcgJMekoxVesl9kKjfLPix2Nbr42i7cpEHJiTnBUwU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f1b52b04f2cb6e5ead50bd28d76528a2f0380ef",
+        "rev": "4792576cb003c994bd7cc1edada3129def20b27d",
         "type": "github"
       },
       "original": {

From 432d53318ae3b352a73a77ed8de82cb8d866ae33 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Jun 2025 20:05:42 -0700
Subject: [PATCH 239/847] DeepSeek-R1-0528-Qwen3-8B

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 86b4d85..7bdb9d5 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -12,8 +12,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/nvidia_AceReason-Nemotron-7B-GGUF/resolve/main/nvidia_AceReason-Nemotron-7B-Q8_0.gguf";
-        sha256 = "0d5eb8b46490af7c097357cb20ad215ebfd30efacedac58bf68a8c7d84e996fc";
+        url = "https://huggingface.co/bartowski/deepseek-ai_DeepSeek-R1-0528-Qwen3-8B-GGUF/resolve/main/deepseek-ai_DeepSeek-R1-0528-Qwen3-8B-Q4_0.gguf";
+        sha256 = "a71a983c64eb72a2b4a885993cd0675474afe7e92d72b051ab8716b23157daa0";
       }
     );
     port = service_configs.ports.llama_cpp;

From bf20789a1f0e0d30a0596774bdeac49b15b64048 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Jun 2025 20:06:15 -0700
Subject: [PATCH 240/847] improve deploy script

---
 deploy.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/deploy.sh b/deploy.sh
index c9813cf..78ff99f 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,2 +1,7 @@
 #!/bin/sh
-nixos-rebuild boot --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose
+ARG="$*"
+if [ "$ARG" = "" ]; then
+  ARG="boot"
+fi
+
+nixos-rebuild "$ARG" --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose

From 5aba0832a8eed53b30f663a90877fda96c60f8b2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Jun 2025 20:57:54 -0700
Subject: [PATCH 241/847] disable llama

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 6128745..aac41b2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,7 +28,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From 18c833794185ab84b0b50c56e41223aa9f62d557 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 8 Jun 2025 18:46:43 -0700
Subject: [PATCH 242/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 05ad9da..0c89cd0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749208275,
-        "narHash": "sha256-+sb4ZDeFuxSvu0yB1WWbJsMyQabuY7Vd4NTp0Nog8R8=",
+        "lastModified": 1749407996,
+        "narHash": "sha256-Rr08YpAnuWxg1mlCamnj7dwVOp8NFUPSjqtIBH6bMAc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "745aa5319b9930068aff5e87cf5e9eef7227339b",
+        "rev": "247e5c6e447707bb4539bdf1913d206088a8fc69",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749261782,
-        "narHash": "sha256-0jd9kSztFf0zBptAeTOzgjqYC7uiwCZDJHAcHlL17lQ=",
+        "lastModified": 1749349190,
+        "narHash": "sha256-yGJD5LLOz6AF5xwK+pDm9I2SFu1z8/eYvMDWWjgXy5E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "10209e2ab990b7ccd296c7c6ac47342fe6988bdf",
+        "rev": "5ad4e9b639f7ef91bf59e3c04a84c5e1ffed6cf0",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749086602,
-        "narHash": "sha256-DJcgJMekoxVesl9kKjfLPix2Nbr42i7cpEHJiTnBUwU=",
+        "lastModified": 1749237914,
+        "narHash": "sha256-N5waoqWt8aMr/MykZjSErOokYH6rOsMMXu3UOVH5kiw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4792576cb003c994bd7cc1edada3129def20b27d",
+        "rev": "70c74b02eac46f4e4aa071e45a6189ce0f6d9265",
         "type": "github"
       },
       "original": {

From 52d27d5f7cb31779fa6262cf7b464f711c65c9c3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Jun 2025 19:06:29 -0700
Subject: [PATCH 243/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0c89cd0..e101e58 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1748047550,
-        "narHash": "sha256-t0qLLqb4C1rdtiY8IFRH5KIapTY/n3Lqt57AmxEv9mk=",
+        "lastModified": 1748970125,
+        "narHash": "sha256-UDyigbDGv8fvs9aS95yzFfOKkEjx1LO3PL3DsKopohA=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "b718a78696060df6280196a6f992d04c87a16aef",
+        "rev": "323b5746d89e04b22554b061522dfce9e4c49b18",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749200714,
-        "narHash": "sha256-W8KiJIrVwmf43JOPbbTu5lzq+cmdtRqaNbOsZigjioY=",
+        "lastModified": 1749436314,
+        "narHash": "sha256-CqmqU5FRg5AadtIkxwu8ulDSOSoIisUMZRLlcED3Q5w=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "17d08c65c241b1d65b3ddf79e3fac1ddc870b0f6",
+        "rev": "dfa4d1b9c39c0342ef133795127a3af14598017a",
         "type": "github"
       },
       "original": {
@@ -75,11 +75,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1748959397,
-        "narHash": "sha256-hq+njWbMLAfQIFEP+8G/7xLz1ZELWC+780332FdpnW0=",
+        "lastModified": 1749471908,
+        "narHash": "sha256-uGfPqd43KTomeIVWUzHu3hGLWFsqYibhWLt2OaRic28=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "20721e48123f1f900b323a76349130080a2f8343",
+        "rev": "00292388ad3b497763b81568d6ee5e1c4a2bcf85",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749407996,
-        "narHash": "sha256-Rr08YpAnuWxg1mlCamnj7dwVOp8NFUPSjqtIBH6bMAc=",
+        "lastModified": 1749599758,
+        "narHash": "sha256-VruFyp7GUbVN/h6lkPcgarRBt/twJRVDNM63gzbiBJ4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "247e5c6e447707bb4539bdf1913d206088a8fc69",
+        "rev": "4c763c8d1b4d4de20bf364ec1837430783cba984",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749349190,
-        "narHash": "sha256-yGJD5LLOz6AF5xwK+pDm9I2SFu1z8/eYvMDWWjgXy5E=",
+        "lastModified": 1749521246,
+        "narHash": "sha256-DfEntGtcKJtY+P8TB+sbl7ZJWl3Zeo0vo37243CfXMQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5ad4e9b639f7ef91bf59e3c04a84c5e1ffed6cf0",
+        "rev": "549f7c2c7b5869e954e1467f089363c2d9c21031",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749237914,
-        "narHash": "sha256-N5waoqWt8aMr/MykZjSErOokYH6rOsMMXu3UOVH5kiw=",
+        "lastModified": 1749494155,
+        "narHash": "sha256-FG4DEYBpROupu758beabUk9lhrblSf5hnv84v1TLqMc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "70c74b02eac46f4e4aa071e45a6189ce0f6d9265",
+        "rev": "88331c17ba434359491e8d5889cce872464052c2",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748227081,
-        "narHash": "sha256-RLnN7LBxhEdCJ6+rIL9sbhjBVDaR6jG377M/CLP/fmE=",
+        "lastModified": 1749436897,
+        "narHash": "sha256-OkDtaCGQQVwVFz5HWfbmrMJR99sFIMXHCHEYXzUJEJY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "1cbe817fd8c64a9f77ba4d7861a4839b0b15983e",
+        "rev": "e7876c387e35dc834838aff254d8e74cf5bd4f19",
         "type": "github"
       },
       "original": {

From d762d859d30d5d51fc79d786b1bca1628aaf70e4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Jun 2025 15:25:55 -0700
Subject: [PATCH 244/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index e101e58..faed54d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749599758,
-        "narHash": "sha256-VruFyp7GUbVN/h6lkPcgarRBt/twJRVDNM63gzbiBJ4=",
+        "lastModified": 1749673184,
+        "narHash": "sha256-kraDKfplx39nMHVZa6Lw90Umql6uzOftR1qP1h4uWvI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "4c763c8d1b4d4de20bf364ec1837430783cba984",
+        "rev": "2e89f76b7af2c0b827be785e445f2e2b3e52e1ca",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749521246,
-        "narHash": "sha256-DfEntGtcKJtY+P8TB+sbl7ZJWl3Zeo0vo37243CfXMQ=",
+        "lastModified": 1749607590,
+        "narHash": "sha256-vvu9zoaYuuPIGG9YKRBMNqOELGN+x2qHbEK6PrZ/Ky0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "549f7c2c7b5869e954e1467f089363c2d9c21031",
+        "rev": "83aaf9c7e3caa39608992e723cfb997624920a35",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1743810720,
-        "narHash": "sha256-kbv/W4gizUSa6qH2rUQdgPj9AJaeN9k2XSWUYqj7IMU=",
+        "lastModified": 1749672087,
+        "narHash": "sha256-j8LG0s0QcvNkZZLcItl78lvTZemvsScir0dG3Ii4B1c=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "74ae51e6d18b972ecc918ab43e8bde60c21a65d8",
+        "rev": "880b3bd2c864dce4f6afc79f6580ca699294c011",
         "type": "github"
       },
       "original": {

From f3d2b70ab1a3ffeca0e29f350c661c9ad71ad0af Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 12 Jun 2025 16:25:10 -0700
Subject: [PATCH 245/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index faed54d..1a97e6b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749673184,
-        "narHash": "sha256-kraDKfplx39nMHVZa6Lw90Umql6uzOftR1qP1h4uWvI=",
+        "lastModified": 1749734111,
+        "narHash": "sha256-OEGah4li1BgTxOZWQU39dYoaopnl4VynSBdOVClyaEk=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2e89f76b7af2c0b827be785e445f2e2b3e52e1ca",
+        "rev": "ed52f3668e633423054a4eab61bb7efee47025ab",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749607590,
-        "narHash": "sha256-vvu9zoaYuuPIGG9YKRBMNqOELGN+x2qHbEK6PrZ/Ky0=",
+        "lastModified": 1749693896,
+        "narHash": "sha256-uQETCN7a1oB4moN78r9mnVp2nSu4D0pRBidpwLTaJK0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "83aaf9c7e3caa39608992e723cfb997624920a35",
+        "rev": "4ce3cdd54fb3dab07225b9cc49a429acc0d20338",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749494155,
-        "narHash": "sha256-FG4DEYBpROupu758beabUk9lhrblSf5hnv84v1TLqMc=",
+        "lastModified": 1749727998,
+        "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "88331c17ba434359491e8d5889cce872464052c2",
+        "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd",
         "type": "github"
       },
       "original": {

From fcf0c97c9c2293f996fe9126ec61e07143b4db6c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Jun 2025 00:28:25 -0700
Subject: [PATCH 246/847] qbt settings adjust

---
 services/qbittorrent.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index eab7c5f..4cae6a7 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -11,6 +11,7 @@
   imports = [
     (serviceMountDeps "qbittorrent" [
       service_configs.torrents_path
+      config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "/var/lib/qBittorrent/qBittorrent"
     ])
   ];
@@ -44,8 +45,8 @@
         AlternativeUIEnabled = true;
         RootFolder = builtins.toString (
           pkgs.fetchzip {
-            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.25.0/vuetorrent.zip";
-            sha256 = "sOaQNw6AnpwNFEextgTnsjEOfpl3/lpoOZFgFOz7Bos=";
+            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.26.0/vuetorrent.zip";
+            sha256 = "EFVzsr/OZ/QMJ+NN3kDkmIk6FCCnqgK6DgsLWNonspU=";
           }
         );
 
@@ -105,6 +106,10 @@
             "http://0d.kebhana.mx:443/announce"
           ]
         );
+
+        # idk why it also has to be specified here too?
+        TempPath = config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath;
+        TempPathEnabled = true;
       };
     };
   };

From 8935c0dd34fec86ce1d8c0e6f6eba51ba887d36b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Jun 2025 14:10:46 -0700
Subject: [PATCH 247/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1a97e6b..9bd3640 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749734111,
-        "narHash": "sha256-OEGah4li1BgTxOZWQU39dYoaopnl4VynSBdOVClyaEk=",
+        "lastModified": 1750006425,
+        "narHash": "sha256-xOpP8b/zksc1Tbro/t5Ts+50S4/Vl1g+tGrVvxNIK20=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "ed52f3668e633423054a4eab61bb7efee47025ab",
+        "rev": "30e5b01de2a0bcddc7c063c8ef0802703a958417",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749693896,
-        "narHash": "sha256-uQETCN7a1oB4moN78r9mnVp2nSu4D0pRBidpwLTaJK0=",
+        "lastModified": 1749954099,
+        "narHash": "sha256-+SV/FYZOmmziTZ9LEss2IeSq6cLMakRe9EzXDDDJMR8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4ce3cdd54fb3dab07225b9cc49a429acc0d20338",
+        "rev": "18e674ed84ad8e5c1e133797e94c580b07184457",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1749195551,
-        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
+        "lastModified": 1749832440,
+        "narHash": "sha256-lfxhuxAaHlYFGr8yOrAXZqdMt8PrFLzjVqH9v3lQaoY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
+        "rev": "db030f62a449568345372bd62ed8c5be4824fa49",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749727998,
-        "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=",
+        "lastModified": 1749857119,
+        "narHash": "sha256-tG5xUn3hFaPpAHYIvr2F88b+ovcIO5k1HqajFy7ZFPM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd",
+        "rev": "5f4f306bea96741f1588ea4f450b2a2e29f42b98",
         "type": "github"
       },
       "original": {

From 37536b046166a19d80fc19a3957943470892622e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 16 Jun 2025 21:06:24 -0700
Subject: [PATCH 248/847] minecraft: remove alternatecurrent

---
 services/minecraft.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 26dba5d..8d8db5e 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -97,11 +97,6 @@
               sha512 = "4d6a3efcef9aaec8b494f1ac5917c5230175d6485592243a45eb2ee263baf481ce07681b0fb5b65a4969cd08d4708e001a83b17949dad32a646a8ea26052a9f9";
             };
 
-            alternatecurrent = fetchurl {
-              url = "https://cdn.modrinth.com/data/r0v8vy1s/versions/eTNKfjl1/alternate-current-mc1.21.5-1.9.0.jar";
-              sha512 = "3e4088170917846b30275825420b553e3fc3befb52bb259848853b93343bae3b39cd592902c0c79f05b17381d80170784990d9c4e110ff3b6c552e5508b40d67";
-            };
-
             # fix `Error sending packet clientbound/minecraft:disconnect` error
             disconnectpacketfix = fetchurl {
               url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";

From 73ee21de1a7794d6ce47fcc5388e98d847921e89 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Jun 2025 21:42:58 -0700
Subject: [PATCH 249/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9bd3640..0d38800 100644
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749436314,
-        "narHash": "sha256-CqmqU5FRg5AadtIkxwu8ulDSOSoIisUMZRLlcED3Q5w=",
+        "lastModified": 1750040002,
+        "narHash": "sha256-KrC9iOVYIn6ukpVlHbqSA4hYCZ6oDyJKrcLqv4c5v84=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "dfa4d1b9c39c0342ef133795127a3af14598017a",
+        "rev": "7f1857b31522062a6a00f88cbccf86b43acceed1",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1749471908,
-        "narHash": "sha256-uGfPqd43KTomeIVWUzHu3hGLWFsqYibhWLt2OaRic28=",
+        "lastModified": 1750168384,
+        "narHash": "sha256-PBfJ7dGsR02im/RYN8wXII8yNPFhKxiPdq+JDfbvD2k=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "00292388ad3b497763b81568d6ee5e1c4a2bcf85",
+        "rev": "38c2addd2e0cedcb03708de6e6c21fb1be86d410",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750006425,
-        "narHash": "sha256-xOpP8b/zksc1Tbro/t5Ts+50S4/Vl1g+tGrVvxNIK20=",
+        "lastModified": 1750192405,
+        "narHash": "sha256-lP8n2LvCy8TgLTSs7pmZI1PagvBNOAFgPp89vreymHc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "30e5b01de2a0bcddc7c063c8ef0802703a958417",
+        "rev": "c46503014db0d63fa7b1b28c58adfb51054e2dec",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749954099,
-        "narHash": "sha256-+SV/FYZOmmziTZ9LEss2IeSq6cLMakRe9EzXDDDJMR8=",
+        "lastModified": 1750212369,
+        "narHash": "sha256-QXZc1il1KSGTtARN5ZI6wx1HxCXjEFZXsRZWl5+tOLc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "18e674ed84ad8e5c1e133797e94c580b07184457",
+        "rev": "886fbf6b49af5754ed096e04f97fd9d87f0fd7e0",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1749832440,
-        "narHash": "sha256-lfxhuxAaHlYFGr8yOrAXZqdMt8PrFLzjVqH9v3lQaoY=",
+        "lastModified": 1750083401,
+        "narHash": "sha256-ynqbgIYrg7P1fAKYqe8I/PMiLABBcNDYG9YaAP/d/C4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "db030f62a449568345372bd62ed8c5be4824fa49",
+        "rev": "61837d2a33ccc1582c5fabb7bf9130d39fee59ad",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749857119,
-        "narHash": "sha256-tG5xUn3hFaPpAHYIvr2F88b+ovcIO5k1HqajFy7ZFPM=",
+        "lastModified": 1750005367,
+        "narHash": "sha256-h/aac1dGLhS3qpaD2aZt25NdKY7b+JT0ZIP2WuGsJMU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5f4f306bea96741f1588ea4f450b2a2e29f42b98",
+        "rev": "6c64dabd3aa85e0c02ef1cdcb6e1213de64baee3",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747372754,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "lastModified": 1749636823,
+        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749436897,
-        "narHash": "sha256-OkDtaCGQQVwVFz5HWfbmrMJR99sFIMXHCHEYXzUJEJY=",
+        "lastModified": 1749955444,
+        "narHash": "sha256-CllTHvHX8KAdAZ+Lxzd23AmZTxO1Pfy+zC43/5tYkAE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "e7876c387e35dc834838aff254d8e74cf5bd4f19",
+        "rev": "539ba15741f0e6691a2448743dbc601d8910edce",
         "type": "github"
       },
       "original": {

From 0721426357a872be461f4952351012feefa4d864 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Jun 2025 20:11:00 -0700
Subject: [PATCH 250/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0d38800..852639f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -200,11 +200,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750192405,
-        "narHash": "sha256-lP8n2LvCy8TgLTSs7pmZI1PagvBNOAFgPp89vreymHc=",
+        "lastModified": 1750266626,
+        "narHash": "sha256-LSCxaOFIVNTdrNiR4IxtNokcaabTFOWA3wT7uqUiO/I=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c46503014db0d63fa7b1b28c58adfb51054e2dec",
+        "rev": "8d947136546773f6410756f37fcc5d3e65b8135d",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750005367,
-        "narHash": "sha256-h/aac1dGLhS3qpaD2aZt25NdKY7b+JT0ZIP2WuGsJMU=",
+        "lastModified": 1750133334,
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c64dabd3aa85e0c02ef1cdcb6e1213de64baee3",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
         "type": "github"
       },
       "original": {

From 75ee4c3c6b831907d9b0c14eb220145ab5cd2ece Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Jun 2025 20:16:36 -0700
Subject: [PATCH 251/847] use srvos

---
 configuration.nix | 10 ++++++++++
 flake.lock        | 21 +++++++++++++++++++++
 flake.nix         |  9 +++++++++
 3 files changed, 40 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index aac41b2..9c046cb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -6,6 +6,7 @@
   username,
   eth_interface,
   service_configs,
+  options,
   ...
 }:
 {
@@ -38,6 +39,15 @@
     hybrid-sleep.enable = false;
   };
 
+  # srvos enables vim, i don't want to use vim, disable it here:
+  programs.vim =
+    {
+      defaultEditor = false;
+    }
+    // lib.optionalAttrs (options.programs.vim ? enable) {
+      enable = false;
+    };
+
   powerManagement = {
     powertop.enable = true;
     enable = true;
diff --git a/flake.lock b/flake.lock
index 852639f..209878a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -331,6 +331,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixpkgs-qbt": "nixpkgs-qbt",
+        "srvos": "srvos",
         "vpn-confinement": "vpn-confinement"
       }
     },
@@ -355,6 +356,26 @@
         "type": "github"
       }
     },
+    "srvos": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1750295173,
+        "narHash": "sha256-W2dgraLz7VZZz/x+6LGt+hiHb94+FCjfyGfxN0TR+Qo=",
+        "owner": "nix-community",
+        "repo": "srvos",
+        "rev": "7c93b611d175a62f3ce57fbda976c29261525a15",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "srvos",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 7f86b4f..aa7eed6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,6 +34,11 @@
       url = "github:ggml-org/llama.cpp";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    srvos = {
+      url = "github:nix-community/srvos";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -47,6 +52,7 @@
       lanzaboote,
       disko,
       llamacpp,
+      srvos,
       ...
     }@inputs:
     let
@@ -189,6 +195,9 @@
               }
             )
 
+            # sets up things like the watchdog
+            srvos.nixosModules.server
+
             ./disk-config.nix
             disko.nixosModules.disko
             ./configuration.nix

From 51e764fb249a84193aa1b3d5447f87481e97f29b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Jun 2025 20:54:39 -0700
Subject: [PATCH 252/847] use deploy-rs

---
 deploy.sh  |  7 -----
 flake.lock | 80 +++++++++++++++++++++++++++++++++++++++++++++++++++---
 flake.nix  | 16 ++++++++++-
 3 files changed, 91 insertions(+), 12 deletions(-)
 delete mode 100755 deploy.sh

diff --git a/deploy.sh b/deploy.sh
deleted file mode 100755
index 78ff99f..0000000
--- a/deploy.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-ARG="$*"
-if [ "$ARG" = "" ]; then
-  ARG="boot"
-fi
-
-nixos-rebuild "$ARG" --flake .#muffin --target-host root@server-public --build-host root@server-public --verbose
diff --git a/flake.lock b/flake.lock
index 209878a..1e7116a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -15,6 +15,28 @@
         "type": "github"
       }
     },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1749105467,
+        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -36,6 +58,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1747046372,
@@ -51,7 +89,7 @@
         "type": "github"
       }
     },
-    "flake-compat_2": {
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1747046372,
@@ -108,7 +146,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -170,7 +208,7 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
@@ -215,7 +253,7 @@
     },
     "nix-minecraft": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
@@ -323,6 +361,7 @@
     },
     "root": {
       "inputs": {
+        "deploy-rs": "deploy-rs",
         "disko": "disko",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
@@ -391,6 +430,39 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "vpn-confinement": {
       "locked": {
         "lastModified": 1749672087,
diff --git a/flake.nix b/flake.nix
index aa7eed6..7b0803c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,10 +39,15 @@
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    deploy-rs = {
+      url = "github:serokell/deploy-rs";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
+      self,
       nixpkgs,
       nix-minecraft,
       nixos-hardware,
@@ -51,8 +56,8 @@
       home-manager,
       lanzaboote,
       disko,
-      llamacpp,
       srvos,
+      deploy-rs,
       ...
     }@inputs:
     let
@@ -236,5 +241,14 @@
             common-gpu-intel
           ]);
       };
+
+      deploy.nodes.muffin = {
+        hostname = "server-public";
+        profiles.system = {
+          sshUser = "root";
+          user = "root";
+          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.muffin;
+        };
+      };
     };
 }

From 2b6d4d94183f70c4d34b9f62ad44406e10dfae37 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Jun 2025 18:09:11 -0700
Subject: [PATCH 253/847] kernel: use hardened kernel

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 9c046cb..24eb3e7 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -79,7 +79,7 @@
 
   boot = {
     # 6.12 LTS until 2026
-    kernelPackages = pkgs.linuxPackages_6_12;
+    kernelPackages = pkgs.linuxPackages_6_12_hardened;
 
     loader = {
       # Use the systemd-boot EFI boot loader.

From a16411db01be47ceda5ce50a54bf46622aa2f4c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Jun 2025 18:09:15 -0700
Subject: [PATCH 254/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1e7116a..7cfc876 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750266626,
-        "narHash": "sha256-LSCxaOFIVNTdrNiR4IxtNokcaabTFOWA3wT7uqUiO/I=",
+        "lastModified": 1750361054,
+        "narHash": "sha256-MysIyBn05x9HYuKwCfHh0fZvAFr2QReRLoMRO9lrrwI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8d947136546773f6410756f37fcc5d3e65b8135d",
+        "rev": "8f71d0f3e86ccbba059350058af8758cafed73e6",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750212369,
-        "narHash": "sha256-QXZc1il1KSGTtARN5ZI6wx1HxCXjEFZXsRZWl5+tOLc=",
+        "lastModified": 1750298798,
+        "narHash": "sha256-jdwSQWssdK1iOhOUteHiW7IoNEBdK05s8ioLqtKaKas=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "886fbf6b49af5754ed096e04f97fd9d87f0fd7e0",
+        "rev": "efe6de64b35fa9092a5d6605edcf8036106f6d78",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750133334,
-        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "lastModified": 1750259320,
+        "narHash": "sha256-H8J4H2XCIMEJ5g6fZ179QfQvsc2dUqhqfBjC8RAHNRY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "rev": "9ba04bda9249d5d5e5238303c9755de5a49a79c5",
         "type": "github"
       },
       "original": {

From c1c2f016b1e879646f463eae3e8f18f4045f202c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Jun 2025 18:11:12 -0700
Subject: [PATCH 255/847] add more terminfos

---
 flake.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/flake.nix b/flake.nix
index 7b0803c..da46113 100644
--- a/flake.nix
+++ b/flake.nix
@@ -203,6 +203,9 @@
             # sets up things like the watchdog
             srvos.nixosModules.server
 
+            # diff terminal support
+            srvos.nixosModules.mixins-terminfo
+
             ./disk-config.nix
             disko.nixosModules.disko
             ./configuration.nix

From c0326b8afe0117ee75c853d27b94d79152b60a97 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Jun 2025 21:29:37 -0700
Subject: [PATCH 256/847] minecraft: 1.21.5 -> 1.21.6

---
 services/minecraft.nix | 62 ++++++++++++++++++++----------------------
 1 file changed, 30 insertions(+), 32 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 8d8db5e..e01d325 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -35,7 +35,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_5;
+      package = pkgs.fabricServers.fabric-1_21_6;
 
       jvmOpts =
         let
@@ -63,8 +63,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/1Hweb6k1/fabric-api-0.125.3%2B1.21.5.jar";
-              sha512 = "54d1c195803de90a7055858ab835d527919007f0e80048e854d3beaaad151d30766a78f530a4189eadfbbef3bd98cca69c9f54f565d49b586180cbd5834eda97";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/N3z6cNQv/fabric-api-0.127.1%2B1.21.6.jar";
+              sha512 = "c7b4ea754a486193476b33ac4d1eaeb30b644e05b76a6abe8cf51ca4eb6832063d32293f1c9052c32c806712d26f85b531085a3ff52575021ee831a804167c4d";
             };
 
             FerriteCore = fetchurl {
@@ -73,19 +73,25 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/VWYoZjBF/lithium-fabric-0.16.2%2Bmc1.21.5.jar";
-              sha512 = "09a68051504bb16069dd6af8901f2bbeadfd08ad5353d8bcc0c4784e814fb293d9197b4fb0a8393be1f2db003cd987a9e4b98391bbe18c50ae181dace20c2fa4";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/XWGBHYcB/lithium-fabric-0.17.0%2Bmc1.21.6.jar";
+              sha512 = "a8d6a8b69ae2b10dd0cf8f8149260d5bdbd2583147462bad03380014edd857852972b967d97df69728333d8836b1e9db8997712ea26365ddb8a05b8c845c6534";
             };
 
-            NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/CHlHxkvf/NoChatReports-FABRIC-1.21.5-v2.12.0.jar";
-              sha512 = "c0825db25672cf8b50face51ec8a6bedb4be50b374a2537640a433c98817bc07c177485e93ab8cee9e3f7bfb1d2eb1460309e818b411764c92426b552487a9f7";
-            };
+            # not updated to 1.21.6
+            /*
+              NoChatReports = fetchurl {
+                url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/CHlHxkvf/NoChatReports-FABRIC-1.21.5-v2.12.0.jar";
+                sha512 = "c0825db25672cf8b50face51ec8a6bedb4be50b374a2537640a433c98817bc07c177485e93ab8cee9e3f7bfb1d2eb1460309e818b411764c92426b552487a9f7";
+              };
+            */
 
-            squaremap = fetchurl {
-              url = "https://github.com/jpenilla/squaremap/releases/download/v1.3.6/squaremap-fabric-mc1.21.5-1.3.6.jar";
-              sha256 = "Y3CiPf8qzZ0q2vfi4z3QoQgXdPZlT/gBm1ghlmGJCZQ=";
-            };
+            # not updated yet to 1.21.6: https://github.com/jpenilla/squaremap/pull/422
+            /*
+              squaremap = fetchurl {
+                url = "https://github.com/jpenilla/squaremap/releases/download/v1.3.6/squaremap-fabric-mc1.21.5-1.3.6.jar";
+                sha256 = "Y3CiPf8qzZ0q2vfi4z3QoQgXdPZlT/gBm1ghlmGJCZQ=";
+              };
+            */
 
             scalablelux = fetchurl {
               url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/UueJNiJn/ScalableLux-0.1.3%2Bbeta.1%2Bfabric.4039a8d-all.jar";
@@ -93,19 +99,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/jrmtD6AF/c2me-fabric-mc1.21.5-0.3.3.0.0.jar";
-              sha512 = "4d6a3efcef9aaec8b494f1ac5917c5230175d6485592243a45eb2ee263baf481ce07681b0fb5b65a4969cd08d4708e001a83b17949dad32a646a8ea26052a9f9";
-            };
-
-            # fix `Error sending packet clientbound/minecraft:disconnect` error
-            disconnectpacketfix = fetchurl {
-              url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
-              sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
-            };
-
-            packetfixer = fetchurl {
-              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/nBmGzZcV/packetfixer-fabric-1.21.5-2.1.2.jar";
-              sha512 = "b66042f85072e037bb43c6cfa59e889204ffc06768ba6c393f3cfdb735b11192b5390ac79b022713739ac836b9662f5e476690b3d6b9dd350cbe2de5449eddbe";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/y6wodInu/c2me-fabric-mc1.21.6-0.3.4%2Balpha.0.42.jar";
+              sha512 = "3d53b1dd84a036b5fb91f15a0bc538e6f2a4ac207c4749ab1ab874972178bc2cc20f1fe1c2f8c08e9eef0a66b4f6b2de22314d94d0498abcf025219dfc69d756";
             };
 
             krypton = fetchurl {
@@ -114,14 +109,17 @@
             };
 
             spark = fetchurl {
-              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/65SnrRgF/spark-1.10.138-fabric.jar";
-              sha512 = "c2bdb171c7ec1783f9efb0ff9a995433fd5838bd8571896be4f498c857ae9f2242d3f24c0541cd96049ea29d742a0e3f8077a3bd1af5d79654f19d34a3adc79c";
+              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/qW2mPW6y/spark-1.10.139-fabric.jar";
+              sha512 = "cd991acee93c074912f2934b5a9c3967be2f1e9157ca5a7254fd3fce8d280c5aa9a3ab06d3ee19f06c5111181853cf12048d000bf8b9f722c902c080fe258a97";
             };
 
-            better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/OexcFHtG/better-fabric-console-mc1.21.5-1.2.3.jar";
-              sha512 = "0a5b0da9d6d3c78ed9af66d2bca3976889649942025aecf7f469bea500ce7914070569259332fefb3629b2eb478ee0cfbf85252aaec5d7969727c1668732e8f4";
-            };
+            # not updated to 1.21.6
+            /*
+              better-fabric-console = fetchurl {
+                url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/OexcFHtG/better-fabric-console-mc1.21.5-1.2.3.jar";
+                sha512 = "0a5b0da9d6d3c78ed9af66d2bca3976889649942025aecf7f469bea500ce7914070569259332fefb3629b2eb478ee0cfbf85252aaec5d7969727c1668732e8f4";
+              };
+            */
           }
         );
       };

From 25c390d1e8e1a2907360bba3204912a5a4006e33 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 22 Jun 2025 02:12:05 -0700
Subject: [PATCH 257/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7cfc876..fdf817d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750361054,
-        "narHash": "sha256-MysIyBn05x9HYuKwCfHh0fZvAFr2QReRLoMRO9lrrwI=",
+        "lastModified": 1750570663,
+        "narHash": "sha256-MEi4FM0euRezifbW3HqVIp3mrRKQTu+yneVwV9a+64Q=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8f71d0f3e86ccbba059350058af8758cafed73e6",
+        "rev": "40bfa04c95c19fb42bafd4e21b5c2a7771846801",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750298798,
-        "narHash": "sha256-jdwSQWssdK1iOhOUteHiW7IoNEBdK05s8ioLqtKaKas=",
+        "lastModified": 1750558898,
+        "narHash": "sha256-nzFrohyx5WGJsGnYsOlD2wHlgATFZlEjdpkVIvKclug=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "efe6de64b35fa9092a5d6605edcf8036106f6d78",
+        "rev": "44ba6a80d396f8d5c1be5291f70ed725750ad0ff",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1750083401,
-        "narHash": "sha256-ynqbgIYrg7P1fAKYqe8I/PMiLABBcNDYG9YaAP/d/C4=",
+        "lastModified": 1750431636,
+        "narHash": "sha256-vnzzBDbCGvInmfn2ijC4HsIY/3W1CWbwS/YQoFgdgPg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "61837d2a33ccc1582c5fabb7bf9130d39fee59ad",
+        "rev": "1552a9f4513f3f0ceedcf90320e48d3d47165712",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750259320,
-        "narHash": "sha256-H8J4H2XCIMEJ5g6fZ179QfQvsc2dUqhqfBjC8RAHNRY=",
+        "lastModified": 1750400657,
+        "narHash": "sha256-3vkjFnxCOP6vm5Pm13wC/Zy6/VYgei/I/2DWgW4RFeA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ba04bda9249d5d5e5238303c9755de5a49a79c5",
+        "rev": "b2485d56967598da068b5a6946dadda8bfcbcd37",
         "type": "github"
       },
       "original": {

From 5a9c03e6eb05f87e2ff0b6b3165af7818fa18b49 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 22 Jun 2025 22:10:56 -0700
Subject: [PATCH 258/847] zfs: arc 12000 -> 20000 mb

---
 zfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zfs.nix b/zfs.nix
index a82cb56..70e4fde 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -22,7 +22,7 @@ in
 
   boot.kernelParams =
     let
-      mb = 12000;
+      mb = 20000;
     in
     [
       "zfs.zfs_arc_max=${builtins.toString (mb * 1000000)}"

From d6662f234f1d49fda4aa96f3a4fdd48c047b93b4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 23 Jun 2025 18:43:35 -0700
Subject: [PATCH 259/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index fdf817d..25c0feb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750040002,
-        "narHash": "sha256-KrC9iOVYIn6ukpVlHbqSA4hYCZ6oDyJKrcLqv4c5v84=",
+        "lastModified": 1750680230,
+        "narHash": "sha256-kD88T/NqmcgfOBFAwphN30ccaUdj6K6+LG0XdM2w2LA=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "7f1857b31522062a6a00f88cbccf86b43acceed1",
+        "rev": "8fd2d6c75009ac75f9a6fb18c33a239806778d01",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750570663,
-        "narHash": "sha256-MEi4FM0euRezifbW3HqVIp3mrRKQTu+yneVwV9a+64Q=",
+        "lastModified": 1750720376,
+        "narHash": "sha256-UUTJdzGcnpLl9XD7sp7ZcJccrH90I5YzHvxXdzu3JtU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "40bfa04c95c19fb42bafd4e21b5c2a7771846801",
+        "rev": "0142961a2e67909e33cdf410274b56c08c5dce7a",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750558898,
-        "narHash": "sha256-nzFrohyx5WGJsGnYsOlD2wHlgATFZlEjdpkVIvKclug=",
+        "lastModified": 1750645183,
+        "narHash": "sha256-9QCgmv+BeL5aqNTe4U5uh3mVSgfd0+6+du1VvC9bDHc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "44ba6a80d396f8d5c1be5291f70ed725750ad0ff",
+        "rev": "f2c91681c5f604e40c47949e374b9e0ed2c18e08",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750400657,
-        "narHash": "sha256-3vkjFnxCOP6vm5Pm13wC/Zy6/VYgei/I/2DWgW4RFeA=",
+        "lastModified": 1750622754,
+        "narHash": "sha256-kMhs+YzV4vPGfuTpD3mwzibWUE6jotw5Al2wczI0Pv8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b2485d56967598da068b5a6946dadda8bfcbcd37",
+        "rev": "c7ab75210cb8cb16ddd8f290755d9558edde7ee1",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750295173,
-        "narHash": "sha256-W2dgraLz7VZZz/x+6LGt+hiHb94+FCjfyGfxN0TR+Qo=",
+        "lastModified": 1750641062,
+        "narHash": "sha256-BlsBuLi1YxJyYQFmSUesBZaMmPnfTzI2WbZhAbc20z8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "7c93b611d175a62f3ce57fbda976c29261525a15",
+        "rev": "59e4d88787de0a2bdc58854566ab90419de73a06",
         "type": "github"
       },
       "original": {

From cb83ec20122ed2681a282f92fe80b6793d5301d5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Jun 2025 19:42:59 -0700
Subject: [PATCH 260/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 25c0feb..13eedd6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749154018,
-        "narHash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg=",
+        "lastModified": 1750792728,
+        "narHash": "sha256-Lh3dopA8DdY+ZoaAJPrtkZOZaFEJGSYjOdAYYgOPgE4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7aae0ee71a17b19708b93b3ed448a1a0952bf111",
+        "rev": "366f00797b1efb70f2882d3da485e3c10fd3d557",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750720376,
-        "narHash": "sha256-UUTJdzGcnpLl9XD7sp7ZcJccrH90I5YzHvxXdzu3JtU=",
+        "lastModified": 1750790785,
+        "narHash": "sha256-NKFBe7aSvQZYFFmXdGvW2DX1zMHSdzMtrYreKrPwO8s=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0142961a2e67909e33cdf410274b56c08c5dce7a",
+        "rev": "73e53dc834c0a2336cd104473af6897197b96277",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750645183,
-        "narHash": "sha256-9QCgmv+BeL5aqNTe4U5uh3mVSgfd0+6+du1VvC9bDHc=",
+        "lastModified": 1750817281,
+        "narHash": "sha256-LvG73wlNA3DXN9d28OcsOhS7NHOO28HfxiXZHf/7duA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f2c91681c5f604e40c47949e374b9e0ed2c18e08",
+        "rev": "6f8ed319c3fd449c5bf68291b773a450dfe1723d",
         "type": "github"
       },
       "original": {

From 4f88fd0b9ecc5b49d43bff25b0d4406915875eec Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 25 Jun 2025 23:30:16 -0700
Subject: [PATCH 261/847] only open port 8448 for matrix

---
 services/caddy.nix  |  6 ------
 services/matrix.nix | 10 ++++++++++
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index a2f0726..3a0c622 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -32,16 +32,10 @@
 
     # http (but really acmeCA challenges)
     80
-
-    # for matrix federation
-    8448
   ];
 
   networking.firewall.allowedUDPPorts = [
     service_configs.ports.https
-
-    # for matrix federation
-    8448
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/matrix.nix b/services/matrix.nix
index fe6733a..88d1e56 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -52,4 +52,14 @@
   systemd.tmpfiles.rules = [
     "d /var/lib/private/matrix-conduit 0770 conduit conduit"
   ];
+
+  # for federation
+  networking.firewall.allowedTCPPorts = [
+    8448
+  ];
+
+  # for federation
+  networking.firewall.allowedUDPPorts = [
+    8448
+  ];
 }

From 21b5f09b335fc26a133af64c9eb809297bbc43ae Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 26 Jun 2025 09:14:17 -0700
Subject: [PATCH 262/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 13eedd6..21da205 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1748970125,
-        "narHash": "sha256-UDyigbDGv8fvs9aS95yzFfOKkEjx1LO3PL3DsKopohA=",
+        "lastModified": 1750266157,
+        "narHash": "sha256-tL42YoNg9y30u7zAqtoGDNdTyXTi8EALDeCB13FtbQA=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "323b5746d89e04b22554b061522dfce9e4c49b18",
+        "rev": "e37c943371b73ed87faf33f7583860f81f1d5a48",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750680230,
-        "narHash": "sha256-kD88T/NqmcgfOBFAwphN30ccaUdj6K6+LG0XdM2w2LA=",
+        "lastModified": 1750903843,
+        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "8fd2d6c75009ac75f9a6fb18c33a239806778d01",
+        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1750168384,
-        "narHash": "sha256-PBfJ7dGsR02im/RYN8wXII8yNPFhKxiPdq+JDfbvD2k=",
+        "lastModified": 1750866260,
+        "narHash": "sha256-fo5NvfutMEw9OV+5rGYuCKjlNNjcnD3cKMbOfzusO/E=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "38c2addd2e0cedcb03708de6e6c21fb1be86d410",
+        "rev": "f40a3401f86d117affeeb8ca6f0ce5cd1ca3cc24",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750790785,
-        "narHash": "sha256-NKFBe7aSvQZYFFmXdGvW2DX1zMHSdzMtrYreKrPwO8s=",
+        "lastModified": 1750942874,
+        "narHash": "sha256-EBJT4kEiDwMNTPRwlPKxhOtNJGef/KSDiw7XFNW7M4o=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "73e53dc834c0a2336cd104473af6897197b96277",
+        "rev": "b25346221dadb9101aa9dda55431dde4d3596943",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750817281,
-        "narHash": "sha256-LvG73wlNA3DXN9d28OcsOhS7NHOO28HfxiXZHf/7duA=",
+        "lastModified": 1750906391,
+        "narHash": "sha256-zLR0SM1oUewUpZL+WCF7IgtfxcXw7bRl+P285mkX9Ug=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "6f8ed319c3fd449c5bf68291b773a450dfe1723d",
+        "rev": "e8575513ca4495e12073824ebd8bfc88c68ee011",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1750431636,
-        "narHash": "sha256-vnzzBDbCGvInmfn2ijC4HsIY/3W1CWbwS/YQoFgdgPg=",
+        "lastModified": 1750837715,
+        "narHash": "sha256-2m1ceZjbmgrJCZ2PuQZaK4in3gcg3o6rZ7WK6dr5vAA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "1552a9f4513f3f0ceedcf90320e48d3d47165712",
+        "rev": "98236410ea0fe204d0447149537a924fb71a6d4f",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750622754,
-        "narHash": "sha256-kMhs+YzV4vPGfuTpD3mwzibWUE6jotw5Al2wczI0Pv8=",
+        "lastModified": 1750838302,
+        "narHash": "sha256-aVkL3/yu50oQzi2YuKo0ceiCypVZpZXYd2P2p1FMJM4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c7ab75210cb8cb16ddd8f290755d9558edde7ee1",
+        "rev": "7284e2decc982b81a296ab35aa46e804baaa1cfe",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749955444,
-        "narHash": "sha256-CllTHvHX8KAdAZ+Lxzd23AmZTxO1Pfy+zC43/5tYkAE=",
+        "lastModified": 1750560265,
+        "narHash": "sha256-jQCojKl1/TzqE6ANOu6rP2qqxOcGK2xs6hpxZ77wrR8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "539ba15741f0e6691a2448743dbc601d8910edce",
+        "rev": "076fdb0d45a9de3f379a626f51a62c78afe7efb1",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750641062,
-        "narHash": "sha256-BlsBuLi1YxJyYQFmSUesBZaMmPnfTzI2WbZhAbc20z8=",
+        "lastModified": 1750907330,
+        "narHash": "sha256-rXA4RdUfZxBmy3RZ8TiP9ITuGwLGBWlyP16dN6ILS6M=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "59e4d88787de0a2bdc58854566ab90419de73a06",
+        "rev": "3af451e7eb42df68fc06b689da4f4ca7198eed5e",
         "type": "github"
       },
       "original": {

From 2bf156504459a875a6b7d87d891a2d02f940ca8b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 26 Jun 2025 23:56:55 -0700
Subject: [PATCH 263/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 21da205..675cc47 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750942874,
-        "narHash": "sha256-EBJT4kEiDwMNTPRwlPKxhOtNJGef/KSDiw7XFNW7M4o=",
+        "lastModified": 1750959242,
+        "narHash": "sha256-3MMtSJZPBmAOB0u2HoM3tAGum6WC1Yi3OADpu9ibhN0=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b25346221dadb9101aa9dda55431dde4d3596943",
+        "rev": "8846aace4934ad29651ea61b8c7e3f6b0556e3d2",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750906391,
-        "narHash": "sha256-zLR0SM1oUewUpZL+WCF7IgtfxcXw7bRl+P285mkX9Ug=",
+        "lastModified": 1750990061,
+        "narHash": "sha256-iY9cAa5sxlTuB/ymVgmwEwnJwPvY4HPFDLpT9F4668E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e8575513ca4495e12073824ebd8bfc88c68ee011",
+        "rev": "ce1dca291a0f67fecbc985e35f83da1a4fdac617",
         "type": "github"
       },
       "original": {

From fe03af4b655d3f2f422c3fbfd273878a7f393e2d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Jun 2025 14:57:20 -0700
Subject: [PATCH 264/847] update minecraft mods to 1.21.6

---
 services/minecraft.nix | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index e01d325..5dcbc4c 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -77,21 +77,15 @@
               sha512 = "a8d6a8b69ae2b10dd0cf8f8149260d5bdbd2583147462bad03380014edd857852972b967d97df69728333d8836b1e9db8997712ea26365ddb8a05b8c845c6534";
             };
 
-            # not updated to 1.21.6
-            /*
-              NoChatReports = fetchurl {
-                url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/CHlHxkvf/NoChatReports-FABRIC-1.21.5-v2.12.0.jar";
-                sha512 = "c0825db25672cf8b50face51ec8a6bedb4be50b374a2537640a433c98817bc07c177485e93ab8cee9e3f7bfb1d2eb1460309e818b411764c92426b552487a9f7";
-              };
-            */
+            NoChatReports = fetchurl {
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/G2i6IY0q/NoChatReports-FABRIC-1.21.6-v2.13.0.jar";
+              sha512 = "8586a61185d4c381ccfef2f8e4cce04cd43e4d1d13bf89ece643495b41e1942c0a2c82f438f7e2afcd8ad0babed16265182da82316c55929eb293c763c317678";
+            };
 
-            # not updated yet to 1.21.6: https://github.com/jpenilla/squaremap/pull/422
-            /*
-              squaremap = fetchurl {
-                url = "https://github.com/jpenilla/squaremap/releases/download/v1.3.6/squaremap-fabric-mc1.21.5-1.3.6.jar";
-                sha256 = "Y3CiPf8qzZ0q2vfi4z3QoQgXdPZlT/gBm1ghlmGJCZQ=";
-              };
-            */
+            squaremap = fetchurl {
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.6-1.3.7-SNAPSHOT+8fa0e64.jar";
+              sha256 = "46MepTg3X/dcckBXq4jDFuqEQWDJ3f6EJAarASZQXHQ=";
+            };
 
             scalablelux = fetchurl {
               url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/UueJNiJn/ScalableLux-0.1.3%2Bbeta.1%2Bfabric.4039a8d-all.jar";

From 082c43c3b19182c972b973d76c8ee2e403627c18 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Jun 2025 14:57:48 -0700
Subject: [PATCH 265/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 675cc47..fd952f1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750959242,
-        "narHash": "sha256-3MMtSJZPBmAOB0u2HoM3tAGum6WC1Yi3OADpu9ibhN0=",
+        "lastModified": 1751131853,
+        "narHash": "sha256-NiJ/ZTkQafLveRwEBgbV65INcU70Vfuux9T2MuL/rLM=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8846aace4934ad29651ea61b8c7e3f6b0556e3d2",
+        "rev": "27208bf657cfe7262791df473927225e48efe482",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750838302,
-        "narHash": "sha256-aVkL3/yu50oQzi2YuKo0ceiCypVZpZXYd2P2p1FMJM4=",
+        "lastModified": 1750969886,
+        "narHash": "sha256-zW/OFnotiz/ndPFdebpo3X0CrbVNf22n4DjN2vxlb58=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7284e2decc982b81a296ab35aa46e804baaa1cfe",
+        "rev": "a676066377a2fe7457369dd37c31fd2263b662f4",
         "type": "github"
       },
       "original": {

From 1e6d980da596f9f2ce14eaea18af460ddbd315cb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Jun 2025 13:31:56 -0700
Subject: [PATCH 266/847] re-disable ipv6

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 24eb3e7..5c88298 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -272,7 +272,7 @@
     hostId = "0f712d56";
     firewall.enable = true;
     useDHCP = false;
-    # enableIPv6 = false;
+    enableIPv6 = false;
 
     interfaces.${eth_interface} = {
       ipv4.addresses = [

From 77ba1b1ffb846b23f7a215377a400c3d69b4c86b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Jun 2025 13:33:58 -0700
Subject: [PATCH 267/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index fd952f1..ee6f634 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751131853,
-        "narHash": "sha256-NiJ/ZTkQafLveRwEBgbV65INcU70Vfuux9T2MuL/rLM=",
+        "lastModified": 1751299024,
+        "narHash": "sha256-vA7sDICs2DNAE9qSbnx5z2D8KcASr+C+LHLsnAKysgY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "27208bf657cfe7262791df473927225e48efe482",
+        "rev": "0a5a3b5cdfd887cf0f8e09d9ff89dee130cfcdde",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750990061,
-        "narHash": "sha256-iY9cAa5sxlTuB/ymVgmwEwnJwPvY4HPFDLpT9F4668E=",
+        "lastModified": 1751163853,
+        "narHash": "sha256-TgZaxZMJM7Oyp4ClDhevGAX8bHeIZ0hh5u6m99+8XWo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ce1dca291a0f67fecbc985e35f83da1a4fdac617",
+        "rev": "620b8a095b4e4958e071a7ef712f752d6e82dfcf",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750969886,
-        "narHash": "sha256-zW/OFnotiz/ndPFdebpo3X0CrbVNf22n4DjN2vxlb58=",
+        "lastModified": 1751211869,
+        "narHash": "sha256-1Cu92i1KSPbhPCKxoiVG5qnoRiKTgR5CcGSRyLpOd7Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a676066377a2fe7457369dd37c31fd2263b662f4",
+        "rev": "b43c397f6c213918d6cfe6e3550abfe79b5d1c51",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1744007630,
-        "narHash": "sha256-Bp9zvSffazGFv63DW6HnVtJvDBGP8Q44Y6AsrcSKU/Q=",
+        "lastModified": 1751268849,
+        "narHash": "sha256-mt0EZbtWM5BmXlffj16x0SyvU155V5wb8VjijwsuUpc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ae375e942eef10c579ac274e503da4dc50d9629c",
+        "rev": "d3892a329e8e30d534c6ae5cc26675ffe1000246",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750907330,
-        "narHash": "sha256-rXA4RdUfZxBmy3RZ8TiP9ITuGwLGBWlyP16dN6ILS6M=",
+        "lastModified": 1751245728,
+        "narHash": "sha256-0UHOzDW5yRgNL0AyHgN0r0B6XehzLFKZ00HBSjX8BWM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "3af451e7eb42df68fc06b689da4f4ca7198eed5e",
+        "rev": "c877dc6f7920b373e5943f77377e6ef816f4dc30",
         "type": "github"
       },
       "original": {

From 979ae241c0d148071dd9bd788b8f1737cee323bb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Jun 2025 18:40:09 -0700
Subject: [PATCH 268/847] minecraft: update squaremap

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 5dcbc4c..d1e3632 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -83,8 +83,8 @@
             };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.6-1.3.7-SNAPSHOT+8fa0e64.jar";
-              sha256 = "46MepTg3X/dcckBXq4jDFuqEQWDJ3f6EJAarASZQXHQ=";
+              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.6-1.3.7-SNAPSHOT+2604148.jar";
+              sha256 = "6TUPi6/1fbOFyWDu2pzP9YKPYohSgTryaAghV4I+fqs=";
             };
 
             scalablelux = fetchurl {

From cb7231a167a4e4f557359cb360fdfbfd849b5824 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 1 Jul 2025 16:52:07 -0700
Subject: [PATCH 269/847] qbt: add udp://tracker.openbittorrent.com:80 tracker

---
 services/qbittorrent.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4cae6a7..c71f0fe 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -104,6 +104,8 @@
             "http://servandroidkino.ru:80/announce"
             "http://bt.poletracker.org:2710/announce"
             "http://0d.kebhana.mx:443/announce"
+
+            "udp://tracker.openbittorrent.com:80"
           ]
         );
 

From faddb5c008d8baf41424d1f8e75f93fa998cecfb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Jul 2025 03:43:31 -0700
Subject: [PATCH 270/847] minecraft: 1.21.6 -> 1.21.7

---
 services/minecraft.nix | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index d1e3632..1c71d71 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -35,7 +35,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_6;
+      package = pkgs.fabricServers.fabric-1_21_7;
 
       jvmOpts =
         let
@@ -63,8 +63,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/N3z6cNQv/fabric-api-0.127.1%2B1.21.6.jar";
-              sha512 = "c7b4ea754a486193476b33ac4d1eaeb30b644e05b76a6abe8cf51ca4eb6832063d32293f1c9052c32c806712d26f85b531085a3ff52575021ee831a804167c4d";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/JIZogEYa/fabric-api-0.128.2%2B1.21.7.jar";
+              sha512 = "afb9b3d1040689f53dd51341626b04d197e7d057d578a72c7a374a66465e0e07f5b3d52721d71e36be26d197668d3a96ea50dbb85e2bc5835d9d858e31b15966";
             };
 
             FerriteCore = fetchurl {
@@ -73,18 +73,18 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/XWGBHYcB/lithium-fabric-0.17.0%2Bmc1.21.6.jar";
-              sha512 = "a8d6a8b69ae2b10dd0cf8f8149260d5bdbd2583147462bad03380014edd857852972b967d97df69728333d8836b1e9db8997712ea26365ddb8a05b8c845c6534";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/77EtzYFA/lithium-fabric-0.18.0%2Bmc1.21.7.jar";
+              sha512 = "afaf6ddaf0cbae2050d725efd438c4c98141d738a637f0f058dcbaff077ef85af801e2dca138ce9f7f8ba3a169dc6af1c9f56736b255c6ea13363f8a1be8ecdb";
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/G2i6IY0q/NoChatReports-FABRIC-1.21.6-v2.13.0.jar";
-              sha512 = "8586a61185d4c381ccfef2f8e4cce04cd43e4d1d13bf89ece643495b41e1942c0a2c82f438f7e2afcd8ad0babed16265182da82316c55929eb293c763c317678";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/LhwpK0O6/NoChatReports-FABRIC-1.21.7-v2.14.0.jar";
+              sha512 = "6e93c822e606ad12cb650801be1b3f39fcd2fef64a9bb905f357eb01a28451afddb3a6cadb39c112463519df0a07b9ff374d39223e9bf189aee7e7182077a7ae";
             };
 
             squaremap = fetchurl {
-              url = "https://jenkins.jpenilla.xyz/job/squaremap/lastSuccessfulBuild/artifact/build/libs/squaremap-fabric-mc1.21.6-1.3.7-SNAPSHOT+2604148.jar";
-              sha256 = "6TUPi6/1fbOFyWDu2pzP9YKPYohSgTryaAghV4I+fqs=";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/Gvw4v06M/squaremap-fabric-mc1.21.7-1.3.7.jar";
+              sha512 = "f1e4218ba0146b3dcc63d36ca70e4d1b987e83a4004c5dd1ef0145afb2fb833e3418ae6e86f2fac22e0dfe0ecfdc84fe5a9f52d04b87892b8636d8f8d75379dd";
             };
 
             scalablelux = fetchurl {
@@ -93,8 +93,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/y6wodInu/c2me-fabric-mc1.21.6-0.3.4%2Balpha.0.42.jar";
-              sha512 = "3d53b1dd84a036b5fb91f15a0bc538e6f2a4ac207c4749ab1ab874972178bc2cc20f1fe1c2f8c08e9eef0a66b4f6b2de22314d94d0498abcf025219dfc69d756";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/Erjpfj2l/c2me-fabric-mc1.21.7-0.3.4%2Bbeta.1.0.jar";
+              sha512 = "8942e82c216315198d4752fbb9396e6d59d6447085ce5c00811ba0189765b20acad0153a10532f7ade29f7c090e0299c01802174aa89d4da642bc10f9429998d";
             };
 
             krypton = fetchurl {
@@ -103,11 +103,11 @@
             };
 
             spark = fetchurl {
-              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/qW2mPW6y/spark-1.10.139-fabric.jar";
-              sha512 = "cd991acee93c074912f2934b5a9c3967be2f1e9157ca5a7254fd3fce8d280c5aa9a3ab06d3ee19f06c5111181853cf12048d000bf8b9f722c902c080fe258a97";
+              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/wPYvarTa/spark-1.10.140-fabric.jar";
+              sha512 = "595fb359cdecda4afea773aa47a34c7bcfef899abfcfb93f0cd346c6308cb88ad09f87f29606640768c48945da1617a89bc97cdea6d9e916cb47ab1fbec41328";
             };
 
-            # not updated to 1.21.6
+            # not updated to 1.21.7
             /*
               better-fabric-console = fetchurl {
                 url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/OexcFHtG/better-fabric-console-mc1.21.5-1.2.3.jar";

From f3398e7b36642ff9d26df315d307648d8817d9e0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 7 Jul 2025 03:43:46 -0700
Subject: [PATCH 271/847] update

---
 flake.lock | 60 +++++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/flake.lock b/flake.lock
index ee6f634..caf324a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750903843,
-        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
+        "lastModified": 1751854533,
+        "narHash": "sha256-U/OQFplExOR1jazZY4KkaQkJqOl59xlh21HP9mI79Vc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
+        "rev": "16b74a1e304197248a1bc663280f2548dbfcae3c",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750792728,
-        "narHash": "sha256-Lh3dopA8DdY+ZoaAJPrtkZOZaFEJGSYjOdAYYgOPgE4=",
+        "lastModified": 1751810233,
+        "narHash": "sha256-kllkNbIqQi3VplgTMeGzuh1t8Gk8TauvkTRt93Km+tQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "366f00797b1efb70f2882d3da485e3c10fd3d557",
+        "rev": "9b0873b46c9f9e4b7aa01eb634952c206af53068",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1750866260,
-        "narHash": "sha256-fo5NvfutMEw9OV+5rGYuCKjlNNjcnD3cKMbOfzusO/E=",
+        "lastModified": 1751381593,
+        "narHash": "sha256-js1XwtJpYhvQrrTaVzViybpztkHJVZ63aXOlFAcTENM=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "f40a3401f86d117affeeb8ca6f0ce5cd1ca3cc24",
+        "rev": "f4eb75540307c2b33521322c04b7fea74e48a66f",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751299024,
-        "narHash": "sha256-vA7sDICs2DNAE9qSbnx5z2D8KcASr+C+LHLsnAKysgY=",
+        "lastModified": 1751797776,
+        "narHash": "sha256-ZAiy7aGC4Q1nstnzEDDfBlAb1AiEHmpKClHuVQUB9II=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0a5a3b5cdfd887cf0f8e09d9ff89dee130cfcdde",
+        "rev": "6491d6e4f1caf0ad2221865b4249ae6938a6308c",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751163853,
-        "narHash": "sha256-TgZaxZMJM7Oyp4ClDhevGAX8bHeIZ0hh5u6m99+8XWo=",
+        "lastModified": 1751854764,
+        "narHash": "sha256-StA6nw3eYixvv1KKPKKD+L1nCxz65Gyx4zg5Es7V8tQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "620b8a095b4e4958e071a7ef712f752d6e82dfcf",
+        "rev": "d4a00866abd69011e70ac3a5976db9008601fd09",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1750837715,
-        "narHash": "sha256-2m1ceZjbmgrJCZ2PuQZaK4in3gcg3o6rZ7WK6dr5vAA=",
+        "lastModified": 1751432711,
+        "narHash": "sha256-136MeWtckSHTN9Z2WRNRdZ8oRP3vyx3L8UxeBYE+J9w=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "98236410ea0fe204d0447149537a924fb71a6d4f",
+        "rev": "497ae1357f1ac97f1aea31a4cb74ad0d534ef41f",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751211869,
-        "narHash": "sha256-1Cu92i1KSPbhPCKxoiVG5qnoRiKTgR5CcGSRyLpOd7Y=",
+        "lastModified": 1751741127,
+        "narHash": "sha256-t75Shs76NgxjZSgvvZZ9qOmz5zuBE8buUaYD28BMTxg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b43c397f6c213918d6cfe6e3550abfe79b5d1c51",
+        "rev": "29e290002bfff26af1db6f64d070698019460302",
         "type": "github"
       },
       "original": {
@@ -346,11 +346,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749636823,
-        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750560265,
-        "narHash": "sha256-jQCojKl1/TzqE6ANOu6rP2qqxOcGK2xs6hpxZ77wrR8=",
+        "lastModified": 1751165203,
+        "narHash": "sha256-3QhlpAk2yn+ExwvRLtaixWsVW1q3OX3KXXe0l8VMLl4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "076fdb0d45a9de3f379a626f51a62c78afe7efb1",
+        "rev": "90f547b90e73d3c6025e66c5b742d6db51c418c3",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751245728,
-        "narHash": "sha256-0UHOzDW5yRgNL0AyHgN0r0B6XehzLFKZ00HBSjX8BWM=",
+        "lastModified": 1751564530,
+        "narHash": "sha256-DybnqQMmkMEbNQhrbMGFijZCa9g5mtYIMPACVNMJ5u8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "c877dc6f7920b373e5943f77377e6ef816f4dc30",
+        "rev": "6bb452f0b31058ffe64241bcf092ebf1c7758be1",
         "type": "github"
       },
       "original": {

From 61a2a39ddd3917a93e83c60f200c763d53bd6553 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 9 Jul 2025 18:43:42 -0700
Subject: [PATCH 272/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index caf324a..e81fec9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751797776,
-        "narHash": "sha256-ZAiy7aGC4Q1nstnzEDDfBlAb1AiEHmpKClHuVQUB9II=",
+        "lastModified": 1752095368,
+        "narHash": "sha256-U2YJO3uAUkXlOxXPum/3I1XM68/ISozGxAoLvk8YIf8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "6491d6e4f1caf0ad2221865b4249ae6938a6308c",
+        "rev": "cb9178f885d1986cc0b12feb26ff426bc8a3556c",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1751432711,
-        "narHash": "sha256-136MeWtckSHTN9Z2WRNRdZ8oRP3vyx3L8UxeBYE+J9w=",
+        "lastModified": 1752048960,
+        "narHash": "sha256-gATnkOe37eeVwKKYCsL+OnS2gU4MmLuZFzzWCtaKLI8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "497ae1357f1ac97f1aea31a4cb74ad0d534ef41f",
+        "rev": "7ced9122cff2163c6a0212b8d1ec8c33a1660806",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751741127,
-        "narHash": "sha256-t75Shs76NgxjZSgvvZZ9qOmz5zuBE8buUaYD28BMTxg=",
+        "lastModified": 1751943650,
+        "narHash": "sha256-7orTnNqkGGru8Je6Un6mq1T8YVVU/O5kyW4+f9C1mZQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "29e290002bfff26af1db6f64d070698019460302",
+        "rev": "88983d4b665fb491861005137ce2b11a9f89f203",
         "type": "github"
       },
       "original": {

From b8eac316823affeb8405e7cbdf5ac160a6dfc480 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Jul 2025 00:11:01 -0700
Subject: [PATCH 273/847] disable hdd array (broken)

---
 configuration.nix     |  2 +-
 services/soulseek.nix |  4 ++--
 zfs.nix               | 20 ++++++++++----------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 5c88298..6aa4ffb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -22,7 +22,7 @@
     ./services/minecraft.nix
 
     ./services/wg.nix
-    ./services/qbittorrent.nix
+    # ./services/qbittorrent.nix
     ./services/bitmagnet.nix
 
     # ./services/matrix.nix
diff --git a/services/soulseek.nix b/services/soulseek.nix
index eb1148f..6fb6d85 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -14,8 +14,8 @@ in
   imports = [
     (serviceMountDeps "slskd" [
       service_configs.slskd.base
-      service_configs.slskd.downloads
-      service_configs.slskd.incomplete
+      # service_configs.slskd.downloads
+      # service_configs.slskd.incomplete
     ])
   ];
 
diff --git a/zfs.nix b/zfs.nix
index 70e4fde..23b9926 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -31,7 +31,7 @@ in
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [
     service_configs.zpool_ssds
-    service_configs.zpool_hdds
+    # service_configs.zpool_hdds
   ];
 
   services.sanoid = {
@@ -66,15 +66,15 @@ in
       yearly = 0;
     };
 
-    datasets."${service_configs.zpool_hdds}" = {
-      recursive = true;
-      autoprune = true;
-      autosnap = true;
-      hourly = 0;
-      daily = 0;
-      monthly = 0;
-      yearly = 0;
-    };
+    #    datasets."${service_configs.zpool_hdds}" = {
+    #      recursive = true;
+    #      autoprune = true;
+    #      autosnap = true;
+    #      hourly = 0;
+    #      daily = 0;
+    #      monthly = 0;
+    #      yearly = 0;
+    #    };
   };
 
   services.zfs = {

From 75acb771624638f3a213029b4203a9fff52e77a6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Jul 2025 01:31:52 -0700
Subject: [PATCH 274/847] proper mountpoint testing

---
 flake.nix                | 17 +++++++++++++++--
 services/gitea.nix       |  3 ++-
 services/immich.nix      |  4 ++--
 services/jellyfin.nix    |  2 +-
 services/minecraft.nix   |  2 +-
 services/postgresql.nix  |  2 +-
 services/qbittorrent.nix |  2 +-
 services/soulseek.nix    |  2 +-
 8 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/flake.nix b/flake.nix
index da46113..ff53774 100644
--- a/flake.nix
+++ b/flake.nix
@@ -135,9 +135,22 @@
         };
       };
 
-      serviceMountDeps = serviceName: dirs: {
+      serviceMountDeps = serviceName: dirs: pkgs: {
+        systemd.services."${serviceName}_mounts" = {
+          unitConfig.Wants = "zfs.target";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart =
+              let
+                lib = nixpkgs.lib;
+              in
+              "${lib.getExe pkgs.bash} -c \"${lib.getExe pkgs.zfs} get mounted | ${lib.getExe pkgs.gnugrep} yes | ${lib.getExe pkgs.gawk} '{print $1}' | while read i; do ${lib.getExe pkgs.zfs} get mountpoint \$i | ${lib.getExe pkgs.gawk} 'FNR==2 {print \$3}'; done | ${lib.getExe pkgs.gnugrep} '${lib.strings.concatStringsSep "\|" dirs}' | ${pkgs.coreutils}/bin/wc -l | ${lib.getExe pkgs.gnugrep} -q ${toString (lib.length dirs)}\"";
+          };
+        };
+
         systemd.services.${serviceName} = {
-          unitConfig.RequiresMountsFor = dirs;
+          wants = [ "${serviceName}_mounts.service" ];
         };
       };
     in
diff --git a/services/gitea.nix b/services/gitea.nix
index 335f919..7c22a7f 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -1,4 +1,5 @@
 {
+  pkgs,
   config,
   service_configs,
   username,
@@ -7,7 +8,7 @@
 }:
 {
   imports = [
-    (serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
+    (serviceMountDeps "gitea" [ config.services.gitea.stateDir ] pkgs)
   ];
 
   services.gitea = {
diff --git a/services/immich.nix b/services/immich.nix
index 67b3117..327f3bb 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -8,8 +8,8 @@
 }:
 {
   imports = [
-    (serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ])
-    (serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ])
+    (serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ] pkgs)
+    (serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ] pkgs)
   ];
 
   services.immich = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 0798e24..91d71d3 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -12,7 +12,7 @@
     (serviceMountDeps "jellyfin" [
       config.services.jellyfin.dataDir
       config.services.jellyfin.cacheDir
-    ])
+    ] pkgs)
   ];
 
   services.jellyfin = {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 1c71d71..902390e 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -11,7 +11,7 @@
   imports = [
     (serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
       "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
-    ])
+    ] pkgs)
   ];
 
   environment.systemPackages = [
diff --git a/services/postgresql.nix b/services/postgresql.nix
index 30d80c5..f882925 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -8,7 +8,7 @@
 }:
 {
   imports = [
-    (serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ])
+    (serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ] pkgs)
   ];
 
   services.postgresql = {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index c71f0fe..059836d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -13,7 +13,7 @@
       service_configs.torrents_path
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "/var/lib/qBittorrent/qBittorrent"
-    ])
+    ] pkgs)
   ];
 
   # network namespace that is proxied through mullvad
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 6fb6d85..a8998ee 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -16,7 +16,7 @@ in
       service_configs.slskd.base
       # service_configs.slskd.downloads
       # service_configs.slskd.incomplete
-    ])
+    ] pkgs)
   ];
 
   users.groups."music" = { };

From c2badfbc60c22267e754831ff869346bac27700b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Jul 2025 09:19:35 -0700
Subject: [PATCH 275/847] simplify mountpoint script

---
 flake.nix | 38 +++++++++++++++++++++++++++-----------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/flake.nix b/flake.nix
index ff53774..63cd862 100644
--- a/flake.nix
+++ b/flake.nix
@@ -136,18 +136,34 @@
       };
 
       serviceMountDeps = serviceName: dirs: pkgs: {
-        systemd.services."${serviceName}_mounts" = {
-          unitConfig.Wants = "zfs.target";
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart =
-              let
-                lib = nixpkgs.lib;
-              in
-              "${lib.getExe pkgs.bash} -c \"${lib.getExe pkgs.zfs} get mounted | ${lib.getExe pkgs.gnugrep} yes | ${lib.getExe pkgs.gawk} '{print $1}' | while read i; do ${lib.getExe pkgs.zfs} get mountpoint \$i | ${lib.getExe pkgs.gawk} 'FNR==2 {print \$3}'; done | ${lib.getExe pkgs.gnugrep} '${lib.strings.concatStringsSep "\|" dirs}' | ${pkgs.coreutils}/bin/wc -l | ${lib.getExe pkgs.gnugrep} -q ${toString (lib.length dirs)}\"";
+        systemd.services."${serviceName}_mounts" =
+          let
+            zfslistmounted = pkgs.writeShellApplication {
+              name = "zfslistmounted";
+              runtimeInputs = with pkgs; [
+                zfs
+                gnugrep
+                gawk
+              ];
+              text = ''
+                #!/bin/sh
+                zfs get mounted | grep yes | awk '{print $1}' | while read -r i; do zfs get mountpoint "$i" | awk 'FNR==2 {print $3}'; done
+              '';
+            };
+          in
+          {
+            unitConfig.Wants = "zfs.target";
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              ExecStart =
+                let
+                  lib = nixpkgs.lib;
+                  contains_cmd = "${lib.getExe pkgs.gnugrep} '${lib.strings.concatStringsSep "\|" dirs}' | ${pkgs.coreutils}/bin/wc -l | ${lib.getExe pkgs.gnugrep} -q ${toString (lib.length dirs)}";
+                in
+                "${lib.getExe pkgs.bash} -c \"${lib.getExe zfslistmounted} | ${contains_cmd}\"";
+            };
           };
-        };
 
         systemd.services.${serviceName} = {
           wants = [ "${serviceName}_mounts.service" ];

From 7a47083fbdad6cf47e266f9824933adb0fa4c033 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Jul 2025 18:52:33 -0700
Subject: [PATCH 276/847] caddy: serviceMountDeps

---
 services/caddy.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/services/caddy.nix b/services/caddy.nix
index 3a0c622..23b2598 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -3,9 +3,17 @@
   service_configs,
   username,
   pkgs,
+  serviceMountDeps,
   ...
 }:
 {
+  imports = [
+    (serviceMountDeps "caddy" [
+      "/var/lib/caddy"
+      service_configs.https.data_dir
+    ] pkgs)
+  ];
+
   services.caddy = {
     enable = true;
     email = "titaniumtown@proton.me";
@@ -23,6 +31,7 @@
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.https.data_dir} 750 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d /var/lib/caddy 750 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];

From 7092a55f6025a5614ea484a59ea87c586b07643b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 10 Jul 2025 23:07:35 -0700
Subject: [PATCH 277/847] this is awful i hate it

---
 flake.nix | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/flake.nix b/flake.nix
index 63cd862..1daa87e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -144,24 +144,25 @@
                 zfs
                 gnugrep
                 gawk
+                coreutils
               ];
-              text = ''
-                #!/bin/sh
-                zfs get mounted | grep yes | awk '{print $1}' | while read -r i; do zfs get mountpoint "$i" | awk 'FNR==2 {print $3}'; done
-              '';
+              text =
+                let
+                  lib = nixpkgs.lib;
+                in
+                ''
+                  #!/bin/sh
+                  zfs get mounted | grep yes | awk '{print $1}' | while read -r i; do zfs get mountpoint "$i" | awk 'FNR==2 {print $3}'; done | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
+                '';
             };
+
           in
           {
             unitConfig.Wants = "zfs.target";
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
-              ExecStart =
-                let
-                  lib = nixpkgs.lib;
-                  contains_cmd = "${lib.getExe pkgs.gnugrep} '${lib.strings.concatStringsSep "\|" dirs}' | ${pkgs.coreutils}/bin/wc -l | ${lib.getExe pkgs.gnugrep} -q ${toString (lib.length dirs)}";
-                in
-                "${lib.getExe pkgs.bash} -c \"${lib.getExe zfslistmounted} | ${contains_cmd}\"";
+              ExecStart = nixpkgs.lib.getExe zfslistmounted;
             };
           };
 

From 9fd314c265dd863c149582b3c3ff5838ec9f7dab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 00:07:33 -0700
Subject: [PATCH 278/847] simplify script

---
 flake.nix | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/flake.nix b/flake.nix
index 1daa87e..1a2a68f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -138,6 +138,7 @@
       serviceMountDeps = serviceName: dirs: pkgs: {
         systemd.services."${serviceName}_mounts" =
           let
+            lib = nixpkgs.lib;
             zfslistmounted = pkgs.writeShellApplication {
               name = "zfslistmounted";
               runtimeInputs = with pkgs; [
@@ -146,16 +147,11 @@
                 gawk
                 coreutils
               ];
-              text =
-                let
-                  lib = nixpkgs.lib;
-                in
-                ''
-                  #!/bin/sh
-                  zfs get mounted | grep yes | awk '{print $1}' | while read -r i; do zfs get mountpoint "$i" | awk 'FNR==2 {print $3}'; done | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
-                '';
+              text = ''
+                #!/bin/sh
+                zfs list -o mountpoint,mounted | awk 'FNR > 1 && $2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
+              '';
             };
-
           in
           {
             unitConfig.Wants = "zfs.target";

From 6019dfc0f3b2046f31c27bae383fcd0d8341933b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 20:19:45 -0700
Subject: [PATCH 279/847] improve zfs mounted script EVEN MORE

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 1a2a68f..c57b406 100644
--- a/flake.nix
+++ b/flake.nix
@@ -149,7 +149,7 @@
               ];
               text = ''
                 #!/bin/sh
-                zfs list -o mountpoint,mounted | awk 'FNR > 1 && $2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
+                zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
               '';
             };
           in

From 07b4fc2d90f27c32f12508013a8de032c74ef85f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 20:34:45 -0700
Subject: [PATCH 280/847] extend nixpkgs's lib instead

---
 flake.nix                | 59 ++---------------------------------
 lib.nix                  | 66 ++++++++++++++++++++++++++++++++++++++++
 services/caddy.nix       |  6 ++--
 services/gitea.nix       |  4 +--
 services/immich.nix      |  6 ++--
 services/jellyfin.nix    |  9 +++---
 services/llama-cpp.nix   |  3 +-
 services/minecraft.nix   |  5 ++-
 services/postgresql.nix  |  4 +--
 services/qbittorrent.nix |  5 ++-
 services/soulseek.nix    |  5 ++-
 11 files changed, 90 insertions(+), 82 deletions(-)
 create mode 100644 lib.nix

diff --git a/flake.nix b/flake.nix
index c57b406..177c0c5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -135,37 +135,8 @@
         };
       };
 
-      serviceMountDeps = serviceName: dirs: pkgs: {
-        systemd.services."${serviceName}_mounts" =
-          let
-            lib = nixpkgs.lib;
-            zfslistmounted = pkgs.writeShellApplication {
-              name = "zfslistmounted";
-              runtimeInputs = with pkgs; [
-                zfs
-                gnugrep
-                gawk
-                coreutils
-              ];
-              text = ''
-                #!/bin/sh
-                zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
-              '';
-            };
-          in
-          {
-            unitConfig.Wants = "zfs.target";
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-              ExecStart = nixpkgs.lib.getExe zfslistmounted;
-            };
-          };
-
-        systemd.services.${serviceName} = {
-          wants = [ "${serviceName}_mounts.service" ];
-        };
-      };
+      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      lib = import ./lib.nix { inherit inputs pkgs; };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
@@ -177,32 +148,8 @@
             eth_interface
             service_configs
             inputs
-            serviceMountDeps
+            lib
             ;
-
-          # stolen from: https://stackoverflow.com/a/42398526
-          optimizeWithFlags =
-            pkg: flags:
-            nixpkgs.lib.overrideDerivation pkg (
-              old:
-              let
-                newflags = nixpkgs.lib.foldl' (acc: x: "${acc} ${x}") "" flags;
-                oldflags =
-                  if (nixpkgs.lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
-              in
-              {
-                NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
-                # stdenv = pkgs.clang19Stdenv;
-              }
-            );
-
-          optimizePackage =
-            pkg:
-            optimizeWithFlags pkg [
-              "-O3"
-              "-march=znver3"
-              "-mtune=znver3"
-            ];
         };
         modules =
           [
diff --git a/lib.nix b/lib.nix
new file mode 100644
index 0000000..70edb8d
--- /dev/null
+++ b/lib.nix
@@ -0,0 +1,66 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+inputs.nixpkgs.lib.extend (
+  final: prev:
+  let
+    lib = prev;
+  in
+  {
+    ensureZfsMounts =
+      dirs:
+      pkgs.writeShellApplication {
+        name = "zfslistmounted";
+        runtimeInputs = with pkgs; [
+          zfs
+          gnugrep
+          gawk
+          coreutils
+        ];
+        text = ''
+          #!/bin/sh
+          zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
+        '';
+      };
+
+    serviceMountDeps = serviceName: dirs: {
+      systemd.services."${serviceName}_mounts" = {
+        unitConfig.Wants = "zfs.target";
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = lib.getExe (final.ensureZfsMounts dirs);
+        };
+      };
+
+      systemd.services.${serviceName} = {
+        wants = [ "${serviceName}_mounts.service" ];
+      };
+    };
+
+    # stolen from: https://stackoverflow.com/a/42398526
+    optimizeWithFlags =
+      pkg: flags:
+      lib.overrideDerivation pkg (
+        old:
+        let
+          newflags = lib.foldl' (acc: x: "${acc} ${x}") "" flags;
+          oldflags = if (lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
+        in
+        {
+          NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
+          # stdenv = pkgs.clang19Stdenv;
+        }
+      );
+
+    optimizePackage =
+      pkg:
+      final.optimizeWithFlags pkg [
+        "-O3"
+        "-march=znver3"
+        "-mtune=znver3"
+      ];
+  }
+)
diff --git a/services/caddy.nix b/services/caddy.nix
index 23b2598..8f7ebed 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -3,15 +3,15 @@
   service_configs,
   username,
   pkgs,
-  serviceMountDeps,
+  lib,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "caddy" [
+    (lib.serviceMountDeps "caddy" [
       "/var/lib/caddy"
       service_configs.https.data_dir
-    ] pkgs)
+    ])
   ];
 
   services.caddy = {
diff --git a/services/gitea.nix b/services/gitea.nix
index 7c22a7f..593d2c1 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -1,14 +1,14 @@
 {
   pkgs,
+  lib,
   config,
   service_configs,
   username,
-  serviceMountDeps,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "gitea" [ config.services.gitea.stateDir ] pkgs)
+    (lib.serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
   ];
 
   services.gitea = {
diff --git a/services/immich.nix b/services/immich.nix
index 327f3bb..f89b149 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -3,13 +3,13 @@
   pkgs,
   config,
   username,
-  serviceMountDeps,
+  lib,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ] pkgs)
-    (serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ] pkgs)
+    (lib.serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ])
+    (lib.serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ])
   ];
 
   services.immich = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 91d71d3..0ca5469 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -3,23 +3,22 @@
   config,
   service_configs,
   username,
-  serviceMountDeps,
-  optimizePackage,
+  lib,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "jellyfin" [
+    (lib.serviceMountDeps "jellyfin" [
       config.services.jellyfin.dataDir
       config.services.jellyfin.cacheDir
-    ] pkgs)
+    ])
   ];
 
   services.jellyfin = {
     enable = true;
     # used for local streaming
     openFirewall = true;
-    package = pkgs.jellyfin.override { jellyfin-ffmpeg = (optimizePackage pkgs.jellyfin-ffmpeg); };
+    package = pkgs.jellyfin.override { jellyfin-ffmpeg = (lib.optimizePackage pkgs.jellyfin-ffmpeg); };
 
     dataDir = service_configs.jellyfin.dataDir;
     cacheDir = service_configs.jellyfin.cacheDir;
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 7bdb9d5..90dd3c3 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -3,7 +3,6 @@
   service_configs,
   config,
   inputs,
-  optimizePackage,
   lib,
   ...
 }:
@@ -19,7 +18,7 @@
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
     # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
-    package = (optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
     extraFlags = [
       # "-ngl"
       # "9999"
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 902390e..d56c77a 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -4,14 +4,13 @@
   lib,
   username,
   config,
-  serviceMountDeps,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
+    (lib.serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
       "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
-    ] pkgs)
+    ])
   ];
 
   environment.systemPackages = [
diff --git a/services/postgresql.nix b/services/postgresql.nix
index f882925..58086a7 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -3,12 +3,12 @@
   config,
   username,
   service_configs,
-  serviceMountDeps,
+  lib,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ] pkgs)
+    (lib.serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ])
   ];
 
   services.postgresql = {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 059836d..82e3e16 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -4,16 +4,15 @@
   service_configs,
   username,
   lib,
-  serviceMountDeps,
   ...
 }:
 {
   imports = [
-    (serviceMountDeps "qbittorrent" [
+    (lib.serviceMountDeps "qbittorrent" [
       service_configs.torrents_path
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "/var/lib/qBittorrent/qBittorrent"
-    ] pkgs)
+    ])
   ];
 
   # network namespace that is proxied through mullvad
diff --git a/services/soulseek.nix b/services/soulseek.nix
index a8998ee..a86e937 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -4,7 +4,6 @@
   lib,
   service_configs,
   username,
-  serviceMountDeps,
   ...
 }:
 let
@@ -12,11 +11,11 @@ let
 in
 {
   imports = [
-    (serviceMountDeps "slskd" [
+    (lib.serviceMountDeps "slskd" [
       service_configs.slskd.base
       # service_configs.slskd.downloads
       # service_configs.slskd.incomplete
-    ] pkgs)
+    ])
   ];
 
   users.groups."music" = { };

From 308ecd35f3e786d06908702d207b3eb1f5b943fb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 20:43:24 -0700
Subject: [PATCH 281/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index e81fec9..eef5ca1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751854533,
-        "narHash": "sha256-U/OQFplExOR1jazZY4KkaQkJqOl59xlh21HP9mI79Vc=",
+        "lastModified": 1752113600,
+        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "16b74a1e304197248a1bc663280f2548dbfcae3c",
+        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751810233,
-        "narHash": "sha256-kllkNbIqQi3VplgTMeGzuh1t8Gk8TauvkTRt93Km+tQ=",
+        "lastModified": 1752208517,
+        "narHash": "sha256-aRY1cYOdVdXdNjcL/Twpa27CknO7pVHxooPsBizDraE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9b0873b46c9f9e4b7aa01eb634952c206af53068",
+        "rev": "c6a01e54af81b381695db796a43360bf6db5702f",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752095368,
-        "narHash": "sha256-U2YJO3uAUkXlOxXPum/3I1XM68/ISozGxAoLvk8YIf8=",
+        "lastModified": 1752258421,
+        "narHash": "sha256-NBKcNtJv78fv6HJp1peu3HRwdITUCgZoqKNMpiEnpR0=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "cb9178f885d1986cc0b12feb26ff426bc8a3556c",
+        "rev": "f5e96b368f1acc7f53c390001b936517c4d18999",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751854764,
-        "narHash": "sha256-StA6nw3eYixvv1KKPKKD+L1nCxz65Gyx4zg5Es7V8tQ=",
+        "lastModified": 1752286765,
+        "narHash": "sha256-GtbDWVpILwZY1UDrDvdn06Q5W0CXkcJ0kEcOxT8cObk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d4a00866abd69011e70ac3a5976db9008601fd09",
+        "rev": "c1f8c5755d2107cdab536b5dff33239ce8df7e18",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751943650,
-        "narHash": "sha256-7orTnNqkGGru8Je6Un6mq1T8YVVU/O5kyW4+f9C1mZQ=",
+        "lastModified": 1752162966,
+        "narHash": "sha256-3MxxkU8ZXMHXcbFz7UE4M6qnIPTYGcE/7EMqlZNnVDE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "88983d4b665fb491861005137ce2b11a9f89f203",
+        "rev": "10e687235226880ed5e9f33f1ffa71fe60f2638a",
         "type": "github"
       },
       "original": {

From d62e1f63a332ff233529523b894fbdba1d2c1374 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 20:44:18 -0700
Subject: [PATCH 282/847] avoid using unitConfig

---
 lib.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib.nix b/lib.nix
index 70edb8d..60ce4d4 100644
--- a/lib.nix
+++ b/lib.nix
@@ -27,7 +27,7 @@ inputs.nixpkgs.lib.extend (
 
     serviceMountDeps = serviceName: dirs: {
       systemd.services."${serviceName}_mounts" = {
-        unitConfig.Wants = "zfs.target";
+        wants = [ "zfs.target" ];
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;

From 34eb49ba7a32dc1c41d4b8e6ace9156e5889b172 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 11 Jul 2025 22:14:28 -0700
Subject: [PATCH 283/847] nit

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 177c0c5..82c95ea 100644
--- a/flake.nix
+++ b/flake.nix
@@ -102,7 +102,7 @@
 
         postgres = {
           socket = "/run/postgresql";
-          dataDir = "${service_configs.services_dir}/sql";
+          dataDir = services_dir + "/sql";
         };
 
         immich = {

From de41d80c02500333320cc060aad80c0c3901f1d0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 13 Jul 2025 02:53:35 -0700
Subject: [PATCH 284/847] improve zfs mounted script EVEN MORE (EVEN MORE MORE
 MORE)

---
 lib.nix | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/lib.nix b/lib.nix
index 60ce4d4..08df3d1 100644
--- a/lib.nix
+++ b/lib.nix
@@ -19,15 +19,30 @@ inputs.nixpkgs.lib.extend (
           gawk
           coreutils
         ];
+
         text = ''
           #!/bin/sh
-          zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | grep -c '${lib.strings.concatStringsSep "\|" dirs}' | grep -Fq ${toString (lib.length dirs)}
+
+          TARGETS=$(echo "${lib.strings.concatStringsSep "\n" dirs}" | sort | uniq)
+          MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
+          NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec '${lib.strings.concatStringsSep "\|" dirs}')
+          if [[ "$NUM_MATCHED" -eq "${toString (lib.length dirs)}" ]]; then
+             exit 0
+          fi
+
+          FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
+          MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
+
+          echo "FAILURE, missing: $MISSING" 1>&2
+          exit 1
         '';
       };
 
     serviceMountDeps = serviceName: dirs: {
       systemd.services."${serviceName}_mounts" = {
         wants = [ "zfs.target" ];
+        before = [ "${serviceName}.service" ];
+
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
@@ -37,6 +52,8 @@ inputs.nixpkgs.lib.extend (
 
       systemd.services.${serviceName} = {
         wants = [ "${serviceName}_mounts.service" ];
+        after = [ "${serviceName}_mounts.service" ];
+        requires = [ "${serviceName}_mounts.service" ];
       };
     };
 

From ffd1d2f4b5945f0db9e667ba07a3aba407ac9a5a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 13 Jul 2025 02:54:45 -0700
Subject: [PATCH 285/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index eef5ca1..0a588a3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752208517,
-        "narHash": "sha256-aRY1cYOdVdXdNjcL/Twpa27CknO7pVHxooPsBizDraE=",
+        "lastModified": 1752391422,
+        "narHash": "sha256-ReX0NG6nIAEtQQjLqeu1vUU2jjZuMlpymNtb4VQYeus=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c6a01e54af81b381695db796a43360bf6db5702f",
+        "rev": "c26266790678863cce8e7460fdbf0d80991b1906",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752258421,
-        "narHash": "sha256-NBKcNtJv78fv6HJp1peu3HRwdITUCgZoqKNMpiEnpR0=",
+        "lastModified": 1752399196,
+        "narHash": "sha256-6g8BFnit2vPB4kPSio2WDqoIX5q799fOOw3Pn7pAXFw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "f5e96b368f1acc7f53c390001b936517c4d18999",
+        "rev": "e743cddb60dc3a8815b9de7dd7d5c491e61b2259",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752286765,
-        "narHash": "sha256-GtbDWVpILwZY1UDrDvdn06Q5W0CXkcJ0kEcOxT8cObk=",
+        "lastModified": 1752373696,
+        "narHash": "sha256-xdjUzHG3sPAs3U1wVnx5hf1NrspCN+qtaBmAks+wnsM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c1f8c5755d2107cdab536b5dff33239ce8df7e18",
+        "rev": "93ca1ac26dc85d8c34f838a5afb7138ff445d2bc",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751564530,
-        "narHash": "sha256-DybnqQMmkMEbNQhrbMGFijZCa9g5mtYIMPACVNMJ5u8=",
+        "lastModified": 1752305350,
+        "narHash": "sha256-5sUt2hme7ReKCTUgcspIMnkZg80//zy8S6Yd27fKZJQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6bb452f0b31058ffe64241bcf092ebf1c7758be1",
+        "rev": "c1229575cfc15ae7ad5d9f9bfa90c8a996a23d72",
         "type": "github"
       },
       "original": {

From 25c053a1fec38f37cf53b9ed3765c22c498093b1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 15 Jul 2025 00:12:29 -0700
Subject: [PATCH 286/847] update

---
 flake.lock | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0a588a3..898f612 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752113600,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "lastModified": 1752541678,
+        "narHash": "sha256-dyhGzkld6jPqnT/UfGV2oqe7tYn7hppAqFvF3GZTyXY=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "2bf3421f7fed5c84d9392b62dcb9d76ef09796a7",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752391422,
+        "lastModified": 1752544374,
         "narHash": "sha256-ReX0NG6nIAEtQQjLqeu1vUU2jjZuMlpymNtb4VQYeus=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c26266790678863cce8e7460fdbf0d80991b1906",
+        "rev": "2e00ed310c218127e02ffcf28ddd4e0f669fde3e",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752399196,
-        "narHash": "sha256-6g8BFnit2vPB4kPSio2WDqoIX5q799fOOw3Pn7pAXFw=",
+        "lastModified": 1752513162,
+        "narHash": "sha256-ZwiiltQ3KjI+SIGSoNNJmrxsa2tv+HMs4RYaAtMR9Bk=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e743cddb60dc3a8815b9de7dd7d5c491e61b2259",
+        "rev": "bdca38376f7e8dd928defe01ce6a16218a64b040",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752373696,
-        "narHash": "sha256-xdjUzHG3sPAs3U1wVnx5hf1NrspCN+qtaBmAks+wnsM=",
+        "lastModified": 1752546159,
+        "narHash": "sha256-0YBxe3xVy27V5qLOAfx774DXqEfU+0bjQtoxQVJRr5E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "93ca1ac26dc85d8c34f838a5afb7138ff445d2bc",
+        "rev": "f6a906567cc2fda5c91add519fb4a449f560c075",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752162966,
-        "narHash": "sha256-3MxxkU8ZXMHXcbFz7UE4M6qnIPTYGcE/7EMqlZNnVDE=",
+        "lastModified": 1752308619,
+        "narHash": "sha256-pzrVLKRQNPrii06Rm09Q0i0dq3wt2t2pciT/GNq5EZQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "10e687235226880ed5e9f33f1ffa71fe60f2638a",
+        "rev": "650e572363c091045cdbc5b36b0f4c1f614d3058",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752305350,
-        "narHash": "sha256-5sUt2hme7ReKCTUgcspIMnkZg80//zy8S6Yd27fKZJQ=",
+        "lastModified": 1752558821,
+        "narHash": "sha256-EOQMTHn8AAqeZcLPXEIN+BcXRduLlt9crhqzKBXImUQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "c1229575cfc15ae7ad5d9f9bfa90c8a996a23d72",
+        "rev": "edf89f42a9b5aa25856315a18b0d627232c670aa",
         "type": "github"
       },
       "original": {

From ca3d1567bc56ac588969516db57218ef27274e3c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 15 Jul 2025 18:02:47 -0700
Subject: [PATCH 287/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 898f612..c0e4dbd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752513162,
-        "narHash": "sha256-ZwiiltQ3KjI+SIGSoNNJmrxsa2tv+HMs4RYaAtMR9Bk=",
+        "lastModified": 1752617082,
+        "narHash": "sha256-oZM7311CJIqukBNpuIZhxVq/SeTgPAttRBU6arwUjj4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "bdca38376f7e8dd928defe01ce6a16218a64b040",
+        "rev": "c81f4192f91a1e209c1eec7a84fe5371ef9175da",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752308619,
-        "narHash": "sha256-pzrVLKRQNPrii06Rm09Q0i0dq3wt2t2pciT/GNq5EZQ=",
+        "lastModified": 1752436162,
+        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "650e572363c091045cdbc5b36b0f4c1f614d3058",
+        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752558821,
-        "narHash": "sha256-EOQMTHn8AAqeZcLPXEIN+BcXRduLlt9crhqzKBXImUQ=",
+        "lastModified": 1752619489,
+        "narHash": "sha256-7YKiwNoJhK4LDaFvGbxB4UeEq3FSIGjCt5capipkA4A=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "edf89f42a9b5aa25856315a18b0d627232c670aa",
+        "rev": "1637ff5392f9d10a5a0ecfbebef67a0e6ec7b252",
         "type": "github"
       },
       "original": {

From 2af0fe269cd08180f6788fcce2e4719690b85f59 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 17 Jul 2025 08:44:27 -0700
Subject: [PATCH 288/847] update

---
 flake.lock | 60 +++++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/flake.lock b/flake.lock
index c0e4dbd..cb7ee6a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1750266157,
-        "narHash": "sha256-tL42YoNg9y30u7zAqtoGDNdTyXTi8EALDeCB13FtbQA=",
+        "lastModified": 1751562746,
+        "narHash": "sha256-smpugNIkmDeicNz301Ll1bD7nFOty97T79m4GUMUczA=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "e37c943371b73ed87faf33f7583860f81f1d5a48",
+        "rev": "aed2020fd3dc26e1e857d4107a5a67a33ab6c1fd",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752541678,
-        "narHash": "sha256-dyhGzkld6jPqnT/UfGV2oqe7tYn7hppAqFvF3GZTyXY=",
+        "lastModified": 1752718651,
+        "narHash": "sha256-PkaR0qmyP9q/MDN3uYa+RLeBA0PjvEQiM0rTDDBXkL8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "2bf3421f7fed5c84d9392b62dcb9d76ef09796a7",
+        "rev": "d5ad4485e6f2edcc06751df65c5e16572877db88",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749398372,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1751381593,
-        "narHash": "sha256-js1XwtJpYhvQrrTaVzViybpztkHJVZ63aXOlFAcTENM=",
+        "lastModified": 1752673703,
+        "narHash": "sha256-9Cc0YqL9ZUpaybJsrRJfXex91QlPmQNqpTLgw/KvJGA=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "f4eb75540307c2b33521322c04b7fea74e48a66f",
+        "rev": "5a776450d904b7ccd377c2a759703152b2553e98",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752617082,
-        "narHash": "sha256-oZM7311CJIqukBNpuIZhxVq/SeTgPAttRBU6arwUjj4=",
+        "lastModified": 1752736931,
+        "narHash": "sha256-rVstNHXxhdv7SzwVIcGqxB25JkF4TGgT2kcgBwwSH4Y=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c81f4192f91a1e209c1eec7a84fe5371ef9175da",
+        "rev": "086cf81e88fb75287b71ff19c08a206b7bc2e02f",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752546159,
-        "narHash": "sha256-0YBxe3xVy27V5qLOAfx774DXqEfU+0bjQtoxQVJRr5E=",
+        "lastModified": 1752718801,
+        "narHash": "sha256-g1cxd979ygXfFygtq/lSq8tWpVZP5S68tWGm0jn6AN4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f6a906567cc2fda5c91add519fb4a449f560c075",
+        "rev": "830a8af4deff672682db461a002ce7a429d04afe",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1752048960,
-        "narHash": "sha256-gATnkOe37eeVwKKYCsL+OnS2gU4MmLuZFzzWCtaKLI8=",
+        "lastModified": 1752666637,
+        "narHash": "sha256-P8J72psdc/rWliIvp8jUpoQ6qRDlVzgSDDlgkaXQ0Fw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7ced9122cff2163c6a0212b8d1ec8c33a1660806",
+        "rev": "d1bfa8f6ccfb5c383e1eba609c1eb67ca24ed153",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752436162,
-        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
+        "lastModified": 1752620740,
+        "narHash": "sha256-f3pO+9lg66mV7IMmmIqG4PL3223TYMlnlw+pnpelbss=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "rev": "32a4e87942101f1c9f9865e04dc3ddb175f5f32e",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751165203,
-        "narHash": "sha256-3QhlpAk2yn+ExwvRLtaixWsVW1q3OX3KXXe0l8VMLl4=",
+        "lastModified": 1751769931,
+        "narHash": "sha256-QR2Rp/41NkA5YxcpvZEKD1S2QE1Pb9U415aK8M/4tJc=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "90f547b90e73d3c6025e66c5b742d6db51c418c3",
+        "rev": "3ac4f630e375177ea8317e22f5c804156de177e8",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752619489,
-        "narHash": "sha256-7YKiwNoJhK4LDaFvGbxB4UeEq3FSIGjCt5capipkA4A=",
+        "lastModified": 1752715576,
+        "narHash": "sha256-CA8WzNOh7/bgxD7I0xZN0ZFqlsOWkfvHxlbXr+UvaQs=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "1637ff5392f9d10a5a0ecfbebef67a0e6ec7b252",
+        "rev": "403c3ef33457ed306a91214acb78913e47b0f093",
         "type": "github"
       },
       "original": {

From 4e8ca3285a28694a9333df61b440dad173a4e4e3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 19 Jul 2025 23:33:54 -0700
Subject: [PATCH 289/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index cb7ee6a..3d2c1d6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752544374,
-        "narHash": "sha256-ReX0NG6nIAEtQQjLqeu1vUU2jjZuMlpymNtb4VQYeus=",
+        "lastModified": 1752780124,
+        "narHash": "sha256-5dn97vIYxn6VozKePOQSDxVCsrl38nDdMJXx86KIJH0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2e00ed310c218127e02ffcf28ddd4e0f669fde3e",
+        "rev": "c718918222bdb104397762dea67e6b397a7927fe",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752736931,
-        "narHash": "sha256-rVstNHXxhdv7SzwVIcGqxB25JkF4TGgT2kcgBwwSH4Y=",
+        "lastModified": 1752958041,
+        "narHash": "sha256-aCb71zoJO59FCVXIdmDRTQkozlAYeoNZdEVY7FGK8VY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "086cf81e88fb75287b71ff19c08a206b7bc2e02f",
+        "rev": "36c153248faf969af1b62ab231348694b2047b8b",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752718801,
-        "narHash": "sha256-g1cxd979ygXfFygtq/lSq8tWpVZP5S68tWGm0jn6AN4=",
+        "lastModified": 1752902428,
+        "narHash": "sha256-lX1D0TPT4xPXLCoNIssdEmPtAwDrpDyZVU/+J/L86Xo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "830a8af4deff672682db461a002ce7a429d04afe",
+        "rev": "0004c25356ce4f89b311b9f26ac22fa13c64ebf2",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752620740,
-        "narHash": "sha256-f3pO+9lg66mV7IMmmIqG4PL3223TYMlnlw+pnpelbss=",
+        "lastModified": 1752866191,
+        "narHash": "sha256-NV4S2Lf2hYmZQ3Qf4t/YyyBaJNuxLPyjzvDma0zPp/M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "32a4e87942101f1c9f9865e04dc3ddb175f5f32e",
+        "rev": "f01fe91b0108a7aff99c99f2e9abbc45db0adc2a",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1751268849,
-        "narHash": "sha256-mt0EZbtWM5BmXlffj16x0SyvU155V5wb8VjijwsuUpc=",
+        "lastModified": 1752985094,
+        "narHash": "sha256-ORkhaeeZ0GeCLabfgHplvXODINpOHrIJVoIVyaloqAc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d3892a329e8e30d534c6ae5cc26675ffe1000246",
+        "rev": "f37d8847eab214634098ba75a499f8036a6ab287",
         "type": "github"
       },
       "original": {

From 51149e9cbed8c30b73ab929ca6175e4ed0fe7a97 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 24 Jul 2025 20:02:39 -0700
Subject: [PATCH 290/847] zfs hdds are BACK

---
 configuration.nix | 15 +++++++--------
 zfs.nix           | 20 ++++++++++----------
 2 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 6aa4ffb..d6a24dd 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -22,7 +22,7 @@
     ./services/minecraft.nix
 
     ./services/wg.nix
-    # ./services/qbittorrent.nix
+    ./services/qbittorrent.nix
     ./services/bitmagnet.nix
 
     # ./services/matrix.nix
@@ -40,13 +40,12 @@
   };
 
   # srvos enables vim, i don't want to use vim, disable it here:
-  programs.vim =
-    {
-      defaultEditor = false;
-    }
-    // lib.optionalAttrs (options.programs.vim ? enable) {
-      enable = false;
-    };
+  programs.vim = {
+    defaultEditor = false;
+  }
+  // lib.optionalAttrs (options.programs.vim ? enable) {
+    enable = false;
+  };
 
   powerManagement = {
     powertop.enable = true;
diff --git a/zfs.nix b/zfs.nix
index 23b9926..70e4fde 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -31,7 +31,7 @@ in
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [
     service_configs.zpool_ssds
-    # service_configs.zpool_hdds
+    service_configs.zpool_hdds
   ];
 
   services.sanoid = {
@@ -66,15 +66,15 @@ in
       yearly = 0;
     };
 
-    #    datasets."${service_configs.zpool_hdds}" = {
-    #      recursive = true;
-    #      autoprune = true;
-    #      autosnap = true;
-    #      hourly = 0;
-    #      daily = 0;
-    #      monthly = 0;
-    #      yearly = 0;
-    #    };
+    datasets."${service_configs.zpool_hdds}" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 0;
+      daily = 0;
+      monthly = 0;
+      yearly = 0;
+    };
   };
 
   services.zfs = {

From 9d5ac63537b14ec8117aed364125e22f50e022ca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 24 Jul 2025 20:02:48 -0700
Subject: [PATCH 291/847] update

---
 flake.lock | 64 +++++++++++++++++++++++++++---------------------------
 1 file changed, 32 insertions(+), 32 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3d2c1d6..c964718 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1751562746,
-        "narHash": "sha256-smpugNIkmDeicNz301Ll1bD7nFOty97T79m4GUMUczA=",
+        "lastModified": 1752946753,
+        "narHash": "sha256-g5uP3jIj+STUcfTJDKYopxnSijs2agRg13H0SGL5iE4=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "aed2020fd3dc26e1e857d4107a5a67a33ab6c1fd",
+        "rev": "544d09fecc8c2338542c57f3f742f1a0c8c71e13",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752718651,
-        "narHash": "sha256-PkaR0qmyP9q/MDN3uYa+RLeBA0PjvEQiM0rTDDBXkL8=",
+        "lastModified": 1753140376,
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d5ad4485e6f2edcc06751df65c5e16572877db88",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752780124,
-        "narHash": "sha256-5dn97vIYxn6VozKePOQSDxVCsrl38nDdMJXx86KIJH0=",
+        "lastModified": 1753288231,
+        "narHash": "sha256-WcMW9yUDfER8kz4NdCaaI/ep0Ef91L+Nf7MetNzHZc4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c718918222bdb104397762dea67e6b397a7927fe",
+        "rev": "7b5a978e00273b8676c530c03d315f5b75fae564",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1752673703,
-        "narHash": "sha256-9Cc0YqL9ZUpaybJsrRJfXex91QlPmQNqpTLgw/KvJGA=",
+        "lastModified": 1753349211,
+        "narHash": "sha256-wGfVht5kOLc9t3GZxEr4IIq5QgHV6nB3w9qqhcVKloo=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "5a776450d904b7ccd377c2a759703152b2553e98",
+        "rev": "4775927ef576f6493b79b1d205e42493d6878d47",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752958041,
-        "narHash": "sha256-aCb71zoJO59FCVXIdmDRTQkozlAYeoNZdEVY7FGK8VY=",
+        "lastModified": 1753383937,
+        "narHash": "sha256-oFX6YrhdSCMdXevyViMX/LWtK5rFdfOVTC0qDvg4bYU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "36c153248faf969af1b62ab231348694b2047b8b",
+        "rev": "3f4fc97f1d745f1d5d3c853949503136d419e6de",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752902428,
-        "narHash": "sha256-lX1D0TPT4xPXLCoNIssdEmPtAwDrpDyZVU/+J/L86Xo=",
+        "lastModified": 1753237324,
+        "narHash": "sha256-iXvv/VYLMyAoaTadYrX0PGwd6N2wVX337Os6k8TAlF4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "0004c25356ce4f89b311b9f26ac22fa13c64ebf2",
+        "rev": "64ca2cbbf9c65dd3bd98192d74872a80e8dcb871",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1752666637,
-        "narHash": "sha256-P8J72psdc/rWliIvp8jUpoQ6qRDlVzgSDDlgkaXQ0Fw=",
+        "lastModified": 1753122741,
+        "narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d1bfa8f6ccfb5c383e1eba609c1eb67ca24ed153",
+        "rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752866191,
-        "narHash": "sha256-NV4S2Lf2hYmZQ3Qf4t/YyyBaJNuxLPyjzvDma0zPp/M=",
+        "lastModified": 1753345091,
+        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f01fe91b0108a7aff99c99f2e9abbc45db0adc2a",
+        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
     },
     "nixpkgs-qbt": {
       "locked": {
-        "lastModified": 1752985094,
+        "lastModified": 1753162786,
         "narHash": "sha256-ORkhaeeZ0GeCLabfgHplvXODINpOHrIJVoIVyaloqAc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f37d8847eab214634098ba75a499f8036a6ab287",
+        "rev": "84d174e312870ccefb9ba0dd11532bb2a58773db",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751769931,
-        "narHash": "sha256-QR2Rp/41NkA5YxcpvZEKD1S2QE1Pb9U415aK8M/4tJc=",
+        "lastModified": 1752979888,
+        "narHash": "sha256-qRRP3QavbwW0o+LOh31QNEfCgPlzK5SKlWALUJL6T7E=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "3ac4f630e375177ea8317e22f5c804156de177e8",
+        "rev": "95719de18aefa63a624bf75a1ff98744b089ec12",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752715576,
-        "narHash": "sha256-CA8WzNOh7/bgxD7I0xZN0ZFqlsOWkfvHxlbXr+UvaQs=",
+        "lastModified": 1753319211,
+        "narHash": "sha256-WR9rKJhFjX5FJbqNWCg8dwQsJWUuCNgff63DpuKL39c=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "403c3ef33457ed306a91214acb78913e47b0f093",
+        "rev": "6a29375c7b8e9bb477233f66cd6609583741dadc",
         "type": "github"
       },
       "original": {

From 39b147ac00caba8c70f634d2c8b66e8db188f7f3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 24 Jul 2025 23:23:23 -0700
Subject: [PATCH 292/847] soulseek: re-rely on hdd zpool mountpoints

---
 services/soulseek.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index a86e937..1d9fe2b 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -13,8 +13,8 @@ in
   imports = [
     (lib.serviceMountDeps "slskd" [
       service_configs.slskd.base
-      # service_configs.slskd.downloads
-      # service_configs.slskd.incomplete
+      service_configs.slskd.downloads
+      service_configs.slskd.incomplete
     ])
   ];
 

From 631cdc2be3f18badc9097496b69b1fba92d63634 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 25 Jul 2025 16:18:46 -0700
Subject: [PATCH 293/847] traffic shaping: we got a upload speed upgrade!

---
 services/wg.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/wg.nix b/services/wg.nix
index b3a9768..3f22593 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -29,9 +29,9 @@
 
   systemd.services."traffic-shaping" =
     let
-      upload_pipe = 22;
-      high_prio = 20;
-      low_prio = 2;
+      upload_pipe = 44;
+      high_prio = 40;
+      low_prio = 4;
     in
     {
       description = "Apply QoS to prioritize non-VPN traffic";

From 699941f1f7aa146ac28d2b04b3efdeeb60e252f5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 26 Jul 2025 12:03:00 -0700
Subject: [PATCH 294/847] qbt: GlobalMaxRatio 4.0 -> 6.0

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 82e3e16..2544971 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -69,7 +69,7 @@
 
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 4.0;
+        GlobalMaxRatio = 6.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
         AddTrackersEnabled = true;

From 0effc194c8b9b815ee7261e8abebb618de198154 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 26 Jul 2025 22:15:26 -0700
Subject: [PATCH 295/847] qbt: add other settings

---
 services/qbittorrent.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 2544971..19de17d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -108,9 +108,18 @@
           ]
         );
 
+        AnnounceToAllTrackers = true;
+
         # idk why it also has to be specified here too?
         TempPath = config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath;
         TempPathEnabled = true;
+
+        # how many connections per sec
+        ConnectionSpeed = 300;
+
+        ChokingAlgorithm = "RateBased";
+        PieceExtentAffinity = true;
+        SuggestMode = true;
       };
     };
   };

From 501fe06c041f4454d3eef217c332788de65dae8e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 27 Jul 2025 00:12:16 -0700
Subject: [PATCH 296/847] minecraft: 1.21.7 -> 1.21.8

---
 services/minecraft.nix | 37 +++++++++++++++++--------------------
 1 file changed, 17 insertions(+), 20 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index d56c77a..5ed59e8 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -34,7 +34,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_7;
+      package = pkgs.fabricServers.fabric-1_21_8;
 
       jvmOpts =
         let
@@ -62,8 +62,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/JIZogEYa/fabric-api-0.128.2%2B1.21.7.jar";
-              sha512 = "afb9b3d1040689f53dd51341626b04d197e7d057d578a72c7a374a66465e0e07f5b3d52721d71e36be26d197668d3a96ea50dbb85e2bc5835d9d858e31b15966";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/zhzhM2yQ/fabric-api-0.130.0%2B1.21.8.jar";
+              sha512 = "27399d629d3fb955c8fc1e5e86cacb9b124814bb97ee7fe283336b0e28f5eb9ae31619814ab4aef70c5beea908d2a1ed5a8dd6b8641a53ecd50375d50067f061";
             };
 
             FerriteCore = fetchurl {
@@ -72,8 +72,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/77EtzYFA/lithium-fabric-0.18.0%2Bmc1.21.7.jar";
-              sha512 = "afaf6ddaf0cbae2050d725efd438c4c98141d738a637f0f058dcbaff077ef85af801e2dca138ce9f7f8ba3a169dc6af1c9f56736b255c6ea13363f8a1be8ecdb";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/pDfTqezk/lithium-fabric-0.18.0%2Bmc1.21.8.jar";
+              sha512 = "6c69950760f48ef88f0c5871e61029b59af03ab5ed9b002b6a470d7adfdf26f0b875dcd360b664e897291002530981c20e0b2890fb889f29ecdaa007f885100f";
             };
 
             NoChatReports = fetchurl {
@@ -82,18 +82,18 @@
             };
 
             squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/Gvw4v06M/squaremap-fabric-mc1.21.7-1.3.7.jar";
-              sha512 = "f1e4218ba0146b3dcc63d36ca70e4d1b987e83a4004c5dd1ef0145afb2fb833e3418ae6e86f2fac22e0dfe0ecfdc84fe5a9f52d04b87892b8636d8f8d75379dd";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/V9xWIMui/squaremap-fabric-mc1.21.8-1.3.8.jar";
+              sha512 = "ed32aca04ef0ad6d46549f9309a342624b64857296515037e5531611d43a7f5d4a6b97f6495f76d2ecfdfac9e4f0bf8a66c938c379cdddae59c8a7f2fe0c03f4";
             };
 
             scalablelux = fetchurl {
-              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/UueJNiJn/ScalableLux-0.1.3%2Bbeta.1%2Bfabric.4039a8d-all.jar";
-              sha512 = "144dd32f5f7b9c015ae2ff2efc8ba58c561d0fae7a22aba071f0d45f8b3154ae8d23783e9a0308c80eee51857a0ef68191c444830e5da3b44021f03b55a26da2";
+              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PQLHDg2Q/ScalableLux-0.1.5%2Bfabric.e4acdcb-all.jar";
+              sha512 = "ec8fabc3bf991fbcbe064c1e97ded3e70f145a87e436056241cbb1e14c57ea9f59ef312f24c205160ccbda43f693e05d652b7f19aa71f730caec3bb5f7f7820a";
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/Erjpfj2l/c2me-fabric-mc1.21.7-0.3.4%2Bbeta.1.0.jar";
-              sha512 = "8942e82c216315198d4752fbb9396e6d59d6447085ce5c00811ba0189765b20acad0153a10532f7ade29f7c090e0299c01802174aa89d4da642bc10f9429998d";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/RzzXyBlx/c2me-fabric-mc1.21.8-0.3.4%2Brc.1.0.jar";
+              sha512 = "4addc9ccbc66b547c96152c7fafcaccde47eefa62b0e99a31f7b4ee5844ac738f2557909bd74e1f755ff4835ce13e8ff6c556f8ebda276370912f50ebd054e3a";
             };
 
             krypton = fetchurl {
@@ -102,17 +102,14 @@
             };
 
             spark = fetchurl {
-              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/wPYvarTa/spark-1.10.140-fabric.jar";
-              sha512 = "595fb359cdecda4afea773aa47a34c7bcfef899abfcfb93f0cd346c6308cb88ad09f87f29606640768c48945da1617a89bc97cdea6d9e916cb47ab1fbec41328";
+              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/3KCl7Vx0/spark-1.10.142-fabric.jar";
+              sha512 = "95b7e4f2416e20abf9d9df41fcbce04f28ebf0aa086374742652789a88642dd6820c8884ab240334555345b49c39f7d0caf23d521cec9516991ef43ba24758af";
             };
 
-            # not updated to 1.21.7
-            /*
-              better-fabric-console = fetchurl {
-                url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/OexcFHtG/better-fabric-console-mc1.21.5-1.2.3.jar";
-                sha512 = "0a5b0da9d6d3c78ed9af66d2bca3976889649942025aecf7f469bea500ce7914070569259332fefb3629b2eb478ee0cfbf85252aaec5d7969727c1668732e8f4";
-              };
-            */
+            better-fabric-console = fetchurl {
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/FTLKiVb8/better-fabric-console-mc1.21.8-1.2.4.jar";
+              sha512 = "1542578e195ddedc3a99a7e23dbda9b79ec795077e85e9cfce3ad7d0812f558c7a5c19b3c5cc0f177c443738afac7690d486c499a02dbe59cf22ef17e887a2fc";
+            };
           }
         );
       };

From 816e236c0a840410dcce428c5c6e3aa8c90b4ea1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 27 Jul 2025 00:22:43 -0700
Subject: [PATCH 297/847] format

---
 flake.nix              | 122 ++++++++++++++++++++---------------------
 services/owntracks.nix |   8 +--
 2 files changed, 64 insertions(+), 66 deletions(-)

diff --git a/flake.nix b/flake.nix
index 82c95ea..b56fb9e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,6 +39,7 @@
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
     deploy-rs = {
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -151,71 +152,70 @@
             lib
             ;
         };
-        modules =
-          [
-            # SAFETY! make sure no ports collide
-            (
-              { lib, ... }:
-              {
-                config = {
-                  assertions = [
-                    {
-                      assertion =
-                        let
-                          ports = lib.attrValues service_configs.ports;
-                          uniquePorts = lib.unique ports;
-                        in
-                        (lib.length ports) == (lib.length uniquePorts);
-                      message = "Duplicate ports detected in 'ports' configuration";
-                    }
-                  ];
-                };
-              }
-            )
-
-            # sets up things like the watchdog
-            srvos.nixosModules.server
-
-            # diff terminal support
-            srvos.nixosModules.mixins-terminfo
-
-            ./disk-config.nix
-            disko.nixosModules.disko
-            ./configuration.nix
-
-            vpn-confinement.nixosModules.default
-
-            # import the `services.qbittorrent` module
-            (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
-
-            # get nix-minecraft working!
-            nix-minecraft.nixosModules.minecraft-servers
+        modules = [
+          # SAFETY! make sure no ports collide
+          (
+            { lib, ... }:
             {
-              nixpkgs.overlays = [ nix-minecraft.overlay ];
+              config = {
+                assertions = [
+                  {
+                    assertion =
+                      let
+                        ports = lib.attrValues service_configs.ports;
+                        uniquePorts = lib.unique ports;
+                      in
+                      (lib.length ports) == (lib.length uniquePorts);
+                    message = "Duplicate ports detected in 'ports' configuration";
+                  }
+                ];
+              };
             }
+          )
 
-            lanzaboote.nixosModules.lanzaboote
+          # sets up things like the watchdog
+          srvos.nixosModules.server
 
-            home-manager.nixosModules.home-manager
-            (
-              {
-                pkgs,
-                username,
-                home-manager,
-                stateVersion,
-                ...
-              }:
-              {
-                home-manager.users.${username} = import ./home.nix;
-              }
-            )
-          ]
-          ++ (with nixos-hardware.nixosModules; [
-            common-cpu-amd-pstate
-            common-cpu-amd-zenpower
-            common-pc-ssd
-            common-gpu-intel
-          ]);
+          # diff terminal support
+          srvos.nixosModules.mixins-terminfo
+
+          ./disk-config.nix
+          disko.nixosModules.disko
+          ./configuration.nix
+
+          vpn-confinement.nixosModules.default
+
+          # import the `services.qbittorrent` module
+          (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
+
+          # get nix-minecraft working!
+          nix-minecraft.nixosModules.minecraft-servers
+          {
+            nixpkgs.overlays = [ nix-minecraft.overlay ];
+          }
+
+          lanzaboote.nixosModules.lanzaboote
+
+          home-manager.nixosModules.home-manager
+          (
+            {
+              pkgs,
+              username,
+              home-manager,
+              stateVersion,
+              ...
+            }:
+            {
+              home-manager.users.${username} = import ./home.nix;
+            }
+          )
+        ]
+        ++ (with nixos-hardware.nixosModules; [
+          common-cpu-amd-pstate
+          common-cpu-amd-zenpower
+          common-pc-ssd
+          common-gpu-intel
+        ]);
       };
 
       deploy.nodes.muffin = {
diff --git a/services/owntracks.nix b/services/owntracks.nix
index 3def720..0b59d51 100644
--- a/services/owntracks.nix
+++ b/services/owntracks.nix
@@ -6,11 +6,9 @@
 }:
 let
   owntracks_pkg = pkgs.owntracks-recorder.overrideAttrs (old: {
-    installPhase =
-      old.installPhase
-      + ''
-        mkdir -p $out/usr/share/ot-recorder
-        cp -R docroot/* $out/usr/share/ot-recorder'';
+    installPhase = old.installPhase + ''
+      mkdir -p $out/usr/share/ot-recorder
+      cp -R docroot/* $out/usr/share/ot-recorder'';
   });
 in
 {

From 57617d9efe8941ef938e99d3b8d4696b4abf5841 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 28 Jul 2025 00:02:02 -0700
Subject: [PATCH 298/847] qbt: add a bunch of trackers

---
 services/qbittorrent.nix | 141 +++++++++++++++++++++++++++++++--------
 1 file changed, 113 insertions(+), 28 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 19de17d..4b03581 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -75,36 +75,121 @@
         AddTrackersEnabled = true;
         AdditionalTrackers = (
           lib.concatStringsSep "\\n" [
-            "udp://tracker.opentrackr.org:1337/announce"
-            "udp://open.stealth.si:80/announce"
-            "udp://open.demonii.com:1337"
-            "udp://exodus.desync.com:6969/announce"
-            "udp://tracker.dler.org:6969/announce"
-            "udp://tracker.bittor.pw:1337/announce"
-            "udp://tracker.torrent.eu.org:451/announce"
-            "udp://explodie.org:6969/announce"
-            "http://tracker.files.fm:6969/announce"
-            "udp://tracker.tiny-vps.com:6969/announce"
-            "udp://p4p.arenabg.com:1337/announce"
-            "udp://tracker.dler.com:6969/announce"
-            "udp://inferno.demonoid.is:3391/announce"
-
-            "udp://tracker.torrent.eu.org:451/announce"
-            "udp://tracker.ololosh.space:6969/announce"
-            "udp://ns-1.x-fins.com:6969/announce"
-            "udp://leet-tracker.moe:1337/announce"
-            "http://tracker.vanitycore.co:6969/announce"
-            "http://tracker.sbsub.com:2710/announce"
-            "http://tracker.moxing.party:6969/announce"
-            "http://tracker.ipv6tracker.org:80/announce"
-            "http://tracker.corpscorp.online:80/announce"
-            "http://shubt.net:2710/announce"
-            "http://share.hkg-fansub.info:80/announce.php"
-            "http://servandroidkino.ru:80/announce"
-            "http://bt.poletracker.org:2710/announce"
+            "http://0123456789nonexistent.com:80/announce"
             "http://0d.kebhana.mx:443/announce"
-
+            "http://1337.abcvg.info:80/announce"
+            "http://bittorrent-tracker.e-n-c-r-y-p-t.net:1337/announce"
+            "http://bt1.xxxxbt.cc:6969/announce"
+            "http://bt.poletracker.org:2710/announce"
+            "http://buny.uk:6969/announce"
+            "http://finbytes.org:80/announce.php"
+            "http://highteahop.top:6960/announce"
+            "http://home.yxgz.club:6969/announce"
+            "http://open.tracker.cl:1337/announce"
+            "http://open.trackerlist.xyz:80/announce"
+            "http://p4p.arenabg.com:1337/announce"
+            "http://public.tracker.vraphim.com:6969/announce"
+            "http://region.nl1.privex.cc:6969/announce"
+            "http://retracker.spark-rostov.ru:80/announce"
+            "http://seeders-paradise.org:80/announce"
+            "http://servandroidkino.ru:80/announce"
+            "http://share.hkg-fansub.info:80/announce.php"
+            "http://shubt.net:2710/announce"
+            "https://sparkle.ghostchu-services.top:443/announce"
+            "https://tracker.bt4g.com:443/announce"
+            "https://tracker.expli.top:443/announce"
+            "https://tracker.gcrenwp.top:443/announce"
+            "https://tracker.ghostchu-services.top:443/announce"
+            "https://tracker.leechshield.link:443/announce"
+            "https://tracker.moeblog.cn:443/announce"
+            "https://tracker.pmman.tech:443/announce"
+            "https://tracker.yemekyedim.com:443/announce"
+            "https://tracker.zhuqiy.top:443/announce"
+            "https://tr.zukizuki.org:443/announce"
+            "http://taciturn-shadow.spb.ru:6969/announce"
+            "http://t.jaekr.sh:6969/announce"
+            "http://t.overflow.biz:6969/announce"
+            "http://tracker1.bt.moack.co.kr:80/announce"
+            "http://tracker1.itzmx.com:8080/announce"
+            "http://tracker.23794.top:6969/announce"
+            "http://tracker2.dler.org:80/announce"
+            "http://tracker810.xyz:11450/announce"
+            "http://tracker.bittor.pw:1337/announce"
+            "http://tracker.bt4g.com:2095/announce"
+            "http://tracker.bt-hash.com:80/announce"
+            "http://tracker.bz:80/announce"
+            "http://tracker.corpscorp.online:80/announce"
+            "http://tracker.darkness.services:6969/announce"
+            "http://tracker.dler.com:6969/announce"
+            "http://tracker.dler.org:6969/announce"
+            "http://tracker.dmcomic.org:2710/announce"
+            "http://tracker.files.fm:6969/announce"
+            "http://tracker.ghostchu-services.top:80/announce"
+            "http://tracker.ipv6tracker.org:80/announce"
+            "http://tracker.lintk.me:2710/announce"
+            "http://tracker.moxing.party:6969/announce"
+            "http://tracker.mywaifu.best:6969/announce"
+            "http://tracker.opentrackr.org:1337/announce"
+            "http://tracker.qu.ax:6969/announce"
+            "http://tracker.renfei.net:8080/announce"
+            "http://tracker.sbsub.com:2710/announce"
+            "http://tracker.vanitycore.co:6969/announce"
+            "http://tracker.waaa.moe:6969/announce"
+            "http://tracker.xiaoduola.xyz:6969/announce"
+            "http://tracker.zhuqiy.top:80/announce"
+            "http://tr.kxmp.cf:80/announce"
+            "http://wepzone.net:6969/announce"
+            "http://www.genesis-sp.org:2710/announce"
+            "http://www.torrentsnipe.info:2701/announce"
+            "udp://1c.premierzal.ru:6969/announce"
+            "udp://bandito.byterunner.io:6969/announce"
+            "udp://bittorrent-tracker.e-n-c-r-y-p-t.net:1337/announce"
+            "udp://bt.ktrackers.com:6666/announce"
+            "udp://concen.org:6969/announce"
+            "udp://d40969.acod.regrucolo.ru:6969/announce"
+            "udp://discord.heihachi.pw:6969/announce"
+            "udp://evan.im:6969/announce"
+            "udp://exodus.desync.com:6969/announce"
+            "udp://explodie.org:6969/announce"
+            "udp://inferno.demonoid.is:3391/announce"
+            "udp://ipv4announce.sktorrent.eu:6969/announce"
+            "udp://ipv4.rer.lol:2710/announce"
+            "udp://isk.richardsw.club:6969/announce"
+            "udp://leet-tracker.moe:1337/announce"
+            "udp://martin-gebhardt.eu:25/announce"
+            "udp://ns-1.x-fins.com:6969/announce"
+            "udp://open.demonii.com:1337"
+            "udp://open.demonii.com:1337/announce"
+            "udp://open.dstud.io:6969/announce"
+            "udp://open.free-tracker.ga:6969/announce"
+            "udp://open.stealth.si:80/announce"
+            "udp://open.tracker.cl:1337/announce"
+            "udp://opentracker.io:6969/announce"
+            "udp://p4p.arenabg.com:1337/announce"
+            "udp://public.tracker.vraphim.com:6969/announce"
+            "udp://retracker01-msk-virt.corbina.net:80/announce"
+            "udp://retracker.lanta.me:2710/announce"
+            "udp://t.overflow.biz:6969/announce"
+            "udp://tr4ck3r.duckdns.org:6969/announce"
+            "udp://tracker2.dler.org:80/announce"
+            "udp://tracker.bittor.pw:1337/announce"
+            "udp://tracker.dler.com:6969/announce"
+            "udp://tracker.dler.org:6969/announce"
+            "udp://tracker.filemail.com:6969/announce"
+            "udp://tracker.fnix.net:6969/announce"
+            "udp://tracker.gigantino.net:6969/announce"
+            "udp://tracker.gmi.gd:6969/announce"
+            "udp://tracker.ololosh.space:6969/announce"
             "udp://tracker.openbittorrent.com:80"
+            "udp://tracker.opentrackr.org:1337/announce"
+            "udp://tracker.srv00.com:6969/announce"
+            "udp://tracker.therarbg.to:6969/announce"
+            "udp://tracker.tiny-vps.com:6969/announce"
+            "udp://tracker.torrent.eu.org:451/announce"
+            "udp://tracker.torrust-demo.com:6969/announce"
+            "udp://tracker.tryhackx.org:6969/announce"
+            "udp://ttk2.nbaonlineservice.com:6969/announce"
+            "udp://wepzone.net:6969/announce"
           ]
         );
 

From 2f16bc8a3dd63344f97ad8f76535e3c231655c48 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 28 Jul 2025 20:09:28 -0700
Subject: [PATCH 299/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index c964718..86f3cd9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1752946753,
-        "narHash": "sha256-g5uP3jIj+STUcfTJDKYopxnSijs2agRg13H0SGL5iE4=",
+        "lastModified": 1753316655,
+        "narHash": "sha256-tzWa2kmTEN69OEMhxFy+J2oWSvZP5QhEgXp3TROOzl0=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "544d09fecc8c2338542c57f3f742f1a0c8c71e13",
+        "rev": "f35a3372d070c9e9ccb63ba7ce347f0634ddf3d2",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "lastModified": 1753121425,
+        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753288231,
-        "narHash": "sha256-WcMW9yUDfER8kz4NdCaaI/ep0Ef91L+Nf7MetNzHZc4=",
+        "lastModified": 1753592768,
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7b5a978e00273b8676c530c03d315f5b75fae564",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1753349211,
-        "narHash": "sha256-wGfVht5kOLc9t3GZxEr4IIq5QgHV6nB3w9qqhcVKloo=",
+        "lastModified": 1753693791,
+        "narHash": "sha256-pZQyCkqIFwGA77np+vqVQZgg2P0qPAI6x6kC3w6+PjE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "4775927ef576f6493b79b1d205e42493d6878d47",
+        "rev": "785a5701b22259b85735301b1aad19c2bee15498",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753383937,
-        "narHash": "sha256-oFX6YrhdSCMdXevyViMX/LWtK5rFdfOVTC0qDvg4bYU=",
+        "lastModified": 1753721417,
+        "narHash": "sha256-msPTZU85NDVuUlAvhXRk7JebU+FA9hLUfBUdkz9kyFc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "3f4fc97f1d745f1d5d3c853949503136d419e6de",
+        "rev": "8ad7b3e65b5834e5574c2f5640056c9047b5d93b",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753237324,
-        "narHash": "sha256-iXvv/VYLMyAoaTadYrX0PGwd6N2wVX337Os6k8TAlF4=",
+        "lastModified": 1753583461,
+        "narHash": "sha256-yPXsgsTXAn9b0TZVATbhtpZrXH+rFpndsS/TzFBVUqU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "64ca2cbbf9c65dd3bd98192d74872a80e8dcb871",
+        "rev": "87c3535bbe5d811194978a0b7375f11f37b68767",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753345091,
-        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
+        "lastModified": 1753489912,
+        "narHash": "sha256-uDCFHeXdRIgJpYmtcUxGEsZ+hYlLPBhR83fdU+vbC1s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "rev": "13e8d35b7d6028b7198f8186bc0347c6abaa2701",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752979888,
-        "narHash": "sha256-qRRP3QavbwW0o+LOh31QNEfCgPlzK5SKlWALUJL6T7E=",
+        "lastModified": 1753584741,
+        "narHash": "sha256-i147iFSy4K4PJvID+zoszLbRi2o+YV8AyG4TUiDQ3+I=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "95719de18aefa63a624bf75a1ff98744b089ec12",
+        "rev": "69dfe029679e73b8d159011c9547f6148a85ca6b",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753319211,
-        "narHash": "sha256-WR9rKJhFjX5FJbqNWCg8dwQsJWUuCNgff63DpuKL39c=",
+        "lastModified": 1753665188,
+        "narHash": "sha256-EZ4FUDaZVonbTE8rGr5+SIVOki0QLQugd481cmNjisc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6a29375c7b8e9bb477233f66cd6609583741dadc",
+        "rev": "cc76247e77c04cf2ad0bf04be10a5d47bc3da594",
         "type": "github"
       },
       "original": {

From c1d7eb6b9d484a0b6e2a68a0f3958833486431c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 30 Jul 2025 09:58:15 -0700
Subject: [PATCH 300/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 86f3cd9..61c58a9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753721417,
-        "narHash": "sha256-msPTZU85NDVuUlAvhXRk7JebU+FA9hLUfBUdkz9kyFc=",
+        "lastModified": 1753891631,
+        "narHash": "sha256-Ho5ULhL6g1txCTNBRn9U+GF6YCTdkmYfhB6YNzMbbRg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8ad7b3e65b5834e5574c2f5640056c9047b5d93b",
+        "rev": "41e78c567e9a8c652e405f4f909deb598deecd31",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753583461,
-        "narHash": "sha256-yPXsgsTXAn9b0TZVATbhtpZrXH+rFpndsS/TzFBVUqU=",
+        "lastModified": 1753842237,
+        "narHash": "sha256-hbDXVQBilvccF8SrbwNO3LhM1zMZlVqhAJBE5bkpT2Y=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "87c3535bbe5d811194978a0b7375f11f37b68767",
+        "rev": "75d4eacfb24ffb1b0b9fee2d64d45dd689400e16",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753489912,
-        "narHash": "sha256-uDCFHeXdRIgJpYmtcUxGEsZ+hYlLPBhR83fdU+vbC1s=",
+        "lastModified": 1753749649,
+        "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "13e8d35b7d6028b7198f8186bc0347c6abaa2701",
+        "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a",
         "type": "github"
       },
       "original": {

From 67bf7fabf47ba94996566f0333ee1f9a8411efff Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 2 Aug 2025 00:06:19 -0700
Subject: [PATCH 301/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 61c58a9..d56cf5c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753891631,
-        "narHash": "sha256-Ho5ULhL6g1txCTNBRn9U+GF6YCTdkmYfhB6YNzMbbRg=",
+        "lastModified": 1754074052,
+        "narHash": "sha256-NW+f3iKMokI8bMgf+W+ChpXzL7GIUAtFWuGGCJ7CCp0=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "41e78c567e9a8c652e405f4f909deb598deecd31",
+        "rev": "9c35706b98ea271858acef4194f526a71b24cdc9",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753842237,
-        "narHash": "sha256-hbDXVQBilvccF8SrbwNO3LhM1zMZlVqhAJBE5bkpT2Y=",
+        "lastModified": 1754015684,
+        "narHash": "sha256-5Aet3ANxlrWFUqT65+W2esoo9eWp14EGsTdUQFbzqt8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "75d4eacfb24ffb1b0b9fee2d64d45dd689400e16",
+        "rev": "880dac6903961763770d507ce363ae0cc1da9444",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753749649,
-        "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=",
+        "lastModified": 1754028485,
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753665188,
-        "narHash": "sha256-EZ4FUDaZVonbTE8rGr5+SIVOki0QLQugd481cmNjisc=",
+        "lastModified": 1753924140,
+        "narHash": "sha256-eZ+71f1rflReoA3EtIlUVV11ar2wQJ577jLHWHZWWdE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "cc76247e77c04cf2ad0bf04be10a5d47bc3da594",
+        "rev": "f7c9ea726dcaeb7954091bf51c73611b9f2781c6",
         "type": "github"
       },
       "original": {

From c9948fc02347f0a95bfde2796cf12fe1b572dfbd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 2 Aug 2025 00:57:47 -0700
Subject: [PATCH 302/847] wg: change endpoint

---
 secrets/wg0.conf | Bin 312 -> 314 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/wg0.conf b/secrets/wg0.conf
index 9d2e7b84af8518ccd5493db9711519b7e424150d..0707030259b7c6b4ece89a5c38ad5c3ed60ef142 100644
GIT binary patch
literal 314
zcmZQ@_Y83kiVO&0_>(@5p)OQT<lDoaGxbdVFRfCl317}RqkDfQfAB7WuTojX^&ake
z8^e{@lOIiMQr6wdv-#y&VZES?6fcpZ4BOI|zvPR^Y5kLYyGQS>!jn1a(}I}OStL>)
zPi^o!6zt%sdy?(0<HoAGvy(J7<%I@C=RcVI`tE|Jz>N<l{@JjZ>1IH&^<$qO)=X0}
z+W$>Zt8b6;-8(NP*)8SQwEEM^F2_3CS=Ej9*sP45W|`h&_^6{+bTWs=e6<-z|HfV`
zoW5b(1GkcSW{-`hADObWb-v-!ZyqMgU9Ydn&@FXYw0`#f-)=L{ePY^ldH%y&+xK6Y
za<#l!_Hq8#+q2%<mv*h5?x1$^*;m(C^Qn7y!XEy*6uUuPEkM6p+pA)W{)O4EwPbn1
a{LeDheY_rh?EdKu!fs2~Zmv0!ZwLTn2%4Ax

literal 312
zcmZQ@_Y83kiVO&0=npVF@9XzZdByq#66OzAyuPvgfYb`Nz4taunsR2+P06WNuas6_
z4OwyYl5dc+ZO(J6;CbsAIW6V9XD8L%$lqm{-ItzrJT`!hS@U21iJ4L|e|(lKdLHyF
z@I%*aE#dtw(;a+`Uj&)W+TvyJA$sO~EYq^BEXxY7sWrJYoEO<+COs#2<GZEI(({X*
z3=5x~KC@+0V8;I|`_ykJifowg*zOb=ow&BqE?VI3mb2^5%(#C2py6F*l}b&YlxQWx
zO+OER&SKtgAosALz}xj_oY|AGIZxDzT^-(^C|%5_AUo$dZ^Q%n3PBEuy+UU*gnX=?
z*T%%IFsNkM`1e|&NcHB`AGW6PH-0I*-Em{i$IBD^e&0H7?s@-)Pv!hpR;|E=d<m+v
YGjD7=#`NWbK;YClwo+%(vI}1U0J~h4!~g&Q


From 4f8c1913dc8d8dd2d923b59df9d681634f86aec2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 2 Aug 2025 01:07:17 -0700
Subject: [PATCH 303/847] qbt: unlimited connections

---
 services/qbittorrent.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4b03581..d84f445 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -72,6 +72,11 @@
         GlobalMaxRatio = 6.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
 
+        MaxConnections = -1;
+        MaxConnectionsPerTorrent = -1;
+        MaxUploads = -1;
+        MaxUploadsPerTorrent = -1;
+
         AddTrackersEnabled = true;
         AdditionalTrackers = (
           lib.concatStringsSep "\\n" [

From 53f4042ad83666cc7f393d5ef2ead04b712bcb4a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 4 Aug 2025 23:43:52 -0700
Subject: [PATCH 304/847] update

---
 flake.lock | 71 +++++++++++++++++++++---------------------------------
 flake.nix  |  6 -----
 2 files changed, 27 insertions(+), 50 deletions(-)

diff --git a/flake.lock b/flake.lock
index d56cf5c..c90f5c3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1753316655,
-        "narHash": "sha256-tzWa2kmTEN69OEMhxFy+J2oWSvZP5QhEgXp3TROOzl0=",
+        "lastModified": 1754269165,
+        "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "f35a3372d070c9e9ccb63ba7ce347f0634ddf3d2",
+        "rev": "444e81206df3f7d92780680e45858e31d2f07a08",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753121425,
-        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
+        "lastModified": 1754091436,
+        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
+        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1753693791,
-        "narHash": "sha256-pZQyCkqIFwGA77np+vqVQZgg2P0qPAI6x6kC3w6+PjE=",
+        "lastModified": 1754297745,
+        "narHash": "sha256-aD6/scLN3L4ZszmNbhhd3JQ9Pzv1ScYFphz14wHinfs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "785a5701b22259b85735301b1aad19c2bee15498",
+        "rev": "892cbdca865d6b42f9c0d222fe309f7720259855",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754074052,
-        "narHash": "sha256-NW+f3iKMokI8bMgf+W+ChpXzL7GIUAtFWuGGCJ7CCp0=",
+        "lastModified": 1754348736,
+        "narHash": "sha256-rNJpXydIdOtVdbtN0A8XCgcR2+s8JP5IznEp34gy68s=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "9c35706b98ea271858acef4194f526a71b24cdc9",
+        "rev": "ec428b02c347767f24c78111309e3f30d2ada289",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754015684,
-        "narHash": "sha256-5Aet3ANxlrWFUqT65+W2esoo9eWp14EGsTdUQFbzqt8=",
+        "lastModified": 1754360791,
+        "narHash": "sha256-Nn2f13jY3M3v79uGscM3qZW0bqCF1EmOk+8ruaH5Drg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "880dac6903961763770d507ce363ae0cc1da9444",
+        "rev": "9b109c7db8379df8ae33317c10c29099de91b942",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1753122741,
-        "narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
+        "lastModified": 1754316476,
+        "narHash": "sha256-Ry1gd1BQrNVJJfT11cpVP0FY8XFMx4DJV2IDp01CH9w=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
+        "rev": "9368056b73efb46eb14fd4667b99e0f81b805f28",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754028485,
-        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
+        "lastModified": 1754292888,
+        "narHash": "sha256-1ziydHSiDuSnaiPzCQh1mRFBsM2d2yRX9I+5OPGEmIE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
+        "rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
         "type": "github"
       },
       "original": {
@@ -317,22 +317,6 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
       }
     },
-    "nixpkgs-qbt": {
-      "locked": {
-        "lastModified": 1753162786,
-        "narHash": "sha256-ORkhaeeZ0GeCLabfgHplvXODINpOHrIJVoIVyaloqAc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "84d174e312870ccefb9ba0dd11532bb2a58773db",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "pull/287923/head",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -369,7 +353,6 @@
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-qbt": "nixpkgs-qbt",
         "srvos": "srvos",
         "vpn-confinement": "vpn-confinement"
       }
@@ -382,11 +365,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753584741,
-        "narHash": "sha256-i147iFSy4K4PJvID+zoszLbRi2o+YV8AyG4TUiDQ3+I=",
+        "lastModified": 1754189623,
+        "narHash": "sha256-fstu5eb30UYwsxow0aQqkzxNxGn80UZjyehQVNVHuBk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "69dfe029679e73b8d159011c9547f6148a85ca6b",
+        "rev": "c582ff7f0d8a7ea689ae836dfb1773f1814f472a",
         "type": "github"
       },
       "original": {
@@ -402,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753924140,
-        "narHash": "sha256-eZ+71f1rflReoA3EtIlUVV11ar2wQJ577jLHWHZWWdE=",
+        "lastModified": 1754273897,
+        "narHash": "sha256-l7epHqAcg8Qktu8vO2ZfjSH1wcai01XQOKQA9ADHIk4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "f7c9ea726dcaeb7954091bf51c73611b9f2781c6",
+        "rev": "8e7d3c690975ee6790926bdfd1258016c967d163",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index b56fb9e..8c258c3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,8 +18,6 @@
 
     vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
 
-    nixpkgs-qbt.url = "github:NixOS/nixpkgs/pull/287923/head";
-
     home-manager = {
       url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -53,7 +51,6 @@
       nix-minecraft,
       nixos-hardware,
       vpn-confinement,
-      nixpkgs-qbt,
       home-manager,
       lanzaboote,
       disko,
@@ -185,9 +182,6 @@
 
           vpn-confinement.nixosModules.default
 
-          # import the `services.qbittorrent` module
-          (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")
-
           # get nix-minecraft working!
           nix-minecraft.nixosModules.minecraft-servers
           {

From 84b0913fa6ac1e152152135f8fd790bc86246658 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 5 Aug 2025 19:53:20 -0700
Subject: [PATCH 305/847] llama-cpp: use gpt-oss-20b-mxfp4

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 90dd3c3..167b073 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/bartowski/deepseek-ai_DeepSeek-R1-0528-Qwen3-8B-GGUF/resolve/main/deepseek-ai_DeepSeek-R1-0528-Qwen3-8B-Q4_0.gguf";
-        sha256 = "a71a983c64eb72a2b4a885993cd0675474afe7e92d72b051ab8716b23157daa0";
+        url = "https://huggingface.co/ggml-org/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-mxfp4.gguf";
+        sha256 = "52f57ab7d3df3ba9173827c1c6832e73375553a846f3e32b49f1ae2daad688d4";
       }
     );
     port = service_configs.ports.llama_cpp;

From 7a20035a288d035a8dcca0276c1e0da1e4644261 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 5 Aug 2025 19:56:59 -0700
Subject: [PATCH 306/847] llama-cpp: re-enable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index d6a24dd..66b54b4 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -29,7 +29,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From 789158ece25a3a093adbc011217c2e938684311e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 5 Aug 2025 20:26:17 -0700
Subject: [PATCH 307/847] llama-cpp: update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index c90f5c3..932304d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754348736,
-        "narHash": "sha256-rNJpXydIdOtVdbtN0A8XCgcR2+s8JP5IznEp34gy68s=",
+        "lastModified": 1754436398,
+        "narHash": "sha256-VhIDk/csS3dt2gF2iFtXe4hKZWiKzNfYwvPN2aghTOI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "ec428b02c347767f24c78111309e3f30d2ada289",
+        "rev": "9515c6131aecaccc955fdedcfe16c3e030aaefcb",
         "type": "github"
       },
       "original": {

From 1472dcd660fcce8d03ba6d9a122439a8431fe6f1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 7 Aug 2025 19:17:16 -0700
Subject: [PATCH 308/847] add testing infra

---
 .gitignore      |  1 +
 flake.nix       |  5 +++
 lib.nix         | 54 ++++++++++++++++--------------
 tests/tests.nix |  9 +++++
 tests/zfs.nix   | 87 +++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 131 insertions(+), 25 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 tests/tests.nix
 create mode 100644 tests/zfs.nix

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c4a847d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/result
diff --git a/flake.nix b/flake.nix
index 8c258c3..4e75ea1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -220,5 +220,10 @@
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.muffin;
         };
       };
+
+      tests = import ./tests/tests.nix {
+        inherit pkgs lib;
+        config = self.nixosConfigurations.muffin.config;
+      };
     };
 }
diff --git a/lib.nix b/lib.nix
index 08df3d1..1437931 100644
--- a/lib.nix
+++ b/lib.nix
@@ -9,34 +9,38 @@ inputs.nixpkgs.lib.extend (
     lib = prev;
   in
   {
-    ensureZfsMounts =
-      dirs:
-      pkgs.writeShellApplication {
-        name = "zfslistmounted";
-        runtimeInputs = with pkgs; [
-          zfs
-          gnugrep
-          gawk
-          coreutils
-        ];
+    # Should probably be moved to a package later instead of this
+    ensureZfsMounts = pkgs.writeShellApplication {
+      name = "zfsEnsureMounted";
+      runtimeInputs = with pkgs; [
+        zfs
+        gnugrep
+        gawk
+        coreutils
+      ];
 
-        text = ''
-          #!/bin/sh
+      text = ''
+        #!/bin/sh -x
 
-          TARGETS=$(echo "${lib.strings.concatStringsSep "\n" dirs}" | sort | uniq)
-          MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
-          NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec '${lib.strings.concatStringsSep "\|" dirs}')
-          if [[ "$NUM_MATCHED" -eq "${toString (lib.length dirs)}" ]]; then
-             exit 0
-          fi
+        if [[ "$#" -eq "0" ]]; then
+           echo "no arguments passed"
+           exit 1
+        fi
 
-          FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
-          MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
+        TARGETS=$(echo "$@" | sort | uniq)
+        MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
+        NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec "$(echo "$@" | tr ' ' '\|')") # does not properly handle paths with strings
+        if [[ "$NUM_MATCHED" -eq "$#" ]]; then
+           exit 0
+        fi
 
-          echo "FAILURE, missing: $MISSING" 1>&2
-          exit 1
-        '';
-      };
+        FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
+        MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
+
+        echo "FAILURE, missing: $MISSING" 1>&2
+        exit 1
+      '';
+    };
 
     serviceMountDeps = serviceName: dirs: {
       systemd.services."${serviceName}_mounts" = {
@@ -46,7 +50,7 @@ inputs.nixpkgs.lib.extend (
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          ExecStart = lib.getExe (final.ensureZfsMounts dirs);
+          ExecStart = "${lib.getExe final.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}";
         };
       };
 
diff --git a/tests/tests.nix b/tests/tests.nix
new file mode 100644
index 0000000..b33fdcd
--- /dev/null
+++ b/tests/tests.nix
@@ -0,0 +1,9 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  zfsTest = import ./zfs.nix { inherit config lib pkgs; };
+}
diff --git a/tests/zfs.nix b/tests/zfs.nix
new file mode 100644
index 0000000..4ac0fcd
--- /dev/null
+++ b/tests/zfs.nix
@@ -0,0 +1,87 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+pkgs.testers.runNixOSTest {
+  name = "test of tests";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        (lib.serviceMountDeps "foobar" [ "/mnt/foobar_data" ])
+        (lib.serviceMountDeps "foobarSadge" [
+          "/mnt/foobar_data"
+          "/mnt/does_not_exist_lol"
+        ])
+
+      ];
+      virtualisation = {
+        emptyDiskImages = [
+          4096
+        ];
+        useBootLoader = true;
+        useEFIBoot = true;
+      };
+      boot.loader.systemd-boot.enable = true;
+      boot.loader.timeout = 0;
+      boot.loader.efi.canTouchEfiVariables = true;
+      networking.hostId = "deadbeef";
+      boot.kernelPackages = config.boot.kernelPackages;
+      boot.zfs.package = config.boot.zfs.package;
+      boot.supportedFilesystems = [ "zfs" ];
+
+      environment.systemPackages = [
+        pkgs.parted
+        lib.ensureZfsMounts
+      ];
+
+      systemd.services.foobar = {
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${lib.getExe pkgs.bash} -c \"true\"";
+        };
+      };
+
+      systemd.services.foobarSadge = {
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${lib.getExe pkgs.bash} -c \"true\"";
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed(
+        "parted --script /dev/vdb mklabel msdos",
+        "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+    )
+
+    machine.fail("zfsEnsureMounted")
+    machine.fail("zfsEnsureMounted /mnt/test_mountpoint")
+
+    machine.succeed("zpool create rpool /dev/vdb1")
+    machine.succeed("zfs create -o mountpoint=/mnt/test_mountpoint rpool/test")
+
+    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint")
+
+    machine.fail("zfsEnsureMounted /mnt/does_not_exist_lol")
+    machine.fail("zfsEnsureMounted /mnt/test_mountpoint /mnt/does_not_exist_lol")
+
+    machine.succeed("zfs create -o mountpoint=/mnt/test_mountpoint_dos rpool/test2")
+
+    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint /mnt/test_mountpoint_dos")
+
+
+    machine.succeed("zfs create -o mountpoint=/mnt/foobar_data rpool/foobar")
+    machine.succeed("systemctl start foobar")
+
+    machine.fail("systemctl start foobarSadge")
+  '';
+}

From 40d935a8becefa64875101bbb7fed222ab27008d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 7 Aug 2025 20:25:07 -0700
Subject: [PATCH 309/847] create handleTest function for future tests

---
 tests/tests.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/tests.nix b/tests/tests.nix
index b33fdcd..4ac524c 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -4,6 +4,9 @@
   pkgs,
   ...
 }:
+let
+  handleTest = file: import file { inherit config lib pkgs; };
+in
 {
-  zfsTest = import ./zfs.nix { inherit config lib pkgs; };
+  zfsTest = handleTest ./zfs.nix;
 }

From 4bab4785fb1cd6b4b754a922bea82b7e246dd0b1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 7 Aug 2025 20:50:18 -0700
Subject: [PATCH 310/847] refactor

---
 flake.nix    | 37 +++++++++++++++++++------------------
 hardware.nix |  1 -
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4e75ea1..04ea249 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,6 +62,7 @@
       username = "primary";
       hostname = "muffin";
       eth_interface = "enp4s0";
+      system = "x86_64-linux";
 
       service_configs = rec {
         zpool_ssds = "tank";
@@ -133,12 +134,17 @@
         };
       };
 
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs {
+        inherit system;
+        hostPlatform = system;
+        buildPlatform = builtins.currentSystem;
+      };
       lib = import ./lib.nix { inherit inputs pkgs; };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
       nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
+        inherit system;
         specialArgs = rec {
           inherit
             username
@@ -154,19 +160,17 @@
           (
             { lib, ... }:
             {
-              config = {
-                assertions = [
-                  {
-                    assertion =
-                      let
-                        ports = lib.attrValues service_configs.ports;
-                        uniquePorts = lib.unique ports;
-                      in
-                      (lib.length ports) == (lib.length uniquePorts);
-                    message = "Duplicate ports detected in 'ports' configuration";
-                  }
-                ];
-              };
+              config.assertions = [
+                {
+                  assertion =
+                    let
+                      ports = lib.attrValues service_configs.ports;
+                      uniquePorts = lib.unique ports;
+                    in
+                    (lib.length ports) == (lib.length uniquePorts);
+                  message = "Duplicate ports detected in 'ports' configuration";
+                }
+              ];
             }
           )
 
@@ -193,10 +197,7 @@
           home-manager.nixosModules.home-manager
           (
             {
-              pkgs,
-              username,
               home-manager,
-              stateVersion,
               ...
             }:
             {
@@ -217,7 +218,7 @@
         profiles.system = {
           sshUser = "root";
           user = "root";
-          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.muffin;
+          path = deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.muffin;
         };
       };
 
diff --git a/hardware.nix b/hardware.nix
index 16dc8b5..8978873 100644
--- a/hardware.nix
+++ b/hardware.nix
@@ -19,7 +19,6 @@
 
   swapDevices = [ ];
 
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = true;
   hardware.enableRedistributableFirmware = true;
 }

From f3621a31837a48e04f69704abcaa7344a26c033d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 7 Aug 2025 21:19:22 -0700
Subject: [PATCH 311/847] improve testing infra

---
 flake.nix | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/flake.nix b/flake.nix
index 04ea249..64222f5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -222,9 +222,24 @@
         };
       };
 
-      tests = import ./tests/tests.nix {
-        inherit pkgs lib;
-        config = self.nixosConfigurations.muffin.config;
-      };
+      packages.${system} =
+        let
+          testSuite = import ./tests/tests.nix {
+            inherit pkgs lib;
+            config = self.nixosConfigurations.muffin.config;
+          };
+        in
+        {
+          tests = pkgs.linkFarm "all-tests" (
+            pkgs.lib.mapAttrsToList (name: test: {
+              name = name;
+              path = test;
+            }) testSuite
+          );
+        }
+        // (pkgs.lib.mapAttrs' (name: test: {
+          name = "test-${name}";
+          value = test;
+        }) testSuite);
     };
 }

From bc9bb6ee0192c719a7d6c7ff3976f772d15e35ac Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 7 Aug 2025 21:21:43 -0700
Subject: [PATCH 312/847] thing

---
 tests/testTest.nix | 20 ++++++++++++++++++++
 tests/tests.nix    |  1 +
 tests/zfs.nix      |  2 +-
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 tests/testTest.nix

diff --git a/tests/testTest.nix b/tests/testTest.nix
new file mode 100644
index 0000000..4193b76
--- /dev/null
+++ b/tests/testTest.nix
@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+pkgs.testers.runNixOSTest {
+  name = "test of tests";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("echo hello!")
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index 4ac524c..d729c74 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -9,4 +9,5 @@ let
 in
 {
   zfsTest = handleTest ./zfs.nix;
+  testTest = handleTest ./testTest.nix;
 }
diff --git a/tests/zfs.nix b/tests/zfs.nix
index 4ac0fcd..6bfabfc 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -5,7 +5,7 @@
   ...
 }:
 pkgs.testers.runNixOSTest {
-  name = "test of tests";
+  name = "zfs folder dependency and mounting test";
 
   nodes.machine =
     { pkgs, ... }:

From 2d5c2e27c2ed23a847e35630381e0b934dff1b76 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 10 Aug 2025 20:20:27 -0700
Subject: [PATCH 313/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 932304d..6e394b2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754436398,
-        "narHash": "sha256-VhIDk/csS3dt2gF2iFtXe4hKZWiKzNfYwvPN2aghTOI=",
+        "lastModified": 1754764183,
+        "narHash": "sha256-LKESRUckFe9adcMeAdkVJDljnsdPM99nIzkeRMFYdQU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "9515c6131aecaccc955fdedcfe16c3e030aaefcb",
+        "rev": "79c1160b073b8148a404f3dd2584be1606dccc66",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754360791,
-        "narHash": "sha256-Nn2f13jY3M3v79uGscM3qZW0bqCF1EmOk+8ruaH5Drg=",
+        "lastModified": 1754879077,
+        "narHash": "sha256-Nx16zw0VTd0zSJLvIcB0AUM9xd0+wi8Vt9YP7nn4bOU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "9b109c7db8379df8ae33317c10c29099de91b942",
+        "rev": "83390c41ec4d872e84abcf852b1c5b710a1f4512",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1754316476,
-        "narHash": "sha256-Ry1gd1BQrNVJJfT11cpVP0FY8XFMx4DJV2IDp01CH9w=",
+        "lastModified": 1754564048,
+        "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9368056b73efb46eb14fd4667b99e0f81b805f28",
+        "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754292888,
-        "narHash": "sha256-1ziydHSiDuSnaiPzCQh1mRFBsM2d2yRX9I+5OPGEmIE=",
+        "lastModified": 1754689972,
+        "narHash": "sha256-eogqv6FqZXHgqrbZzHnq43GalnRbLTkbBbFtEfm1RSc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
+        "rev": "fc756aa6f5d3e2e5666efcf865d190701fef150a",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754273897,
-        "narHash": "sha256-l7epHqAcg8Qktu8vO2ZfjSH1wcai01XQOKQA9ADHIk4=",
+        "lastModified": 1754876635,
+        "narHash": "sha256-eU+DxKxVGNC7wjsfxdjDJQcDPx+V+K2qz8YbtSQIuG4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "8e7d3c690975ee6790926bdfd1258016c967d163",
+        "rev": "0fd4b65ae4649ce65a83e00fd39747fe64c5076f",
         "type": "github"
       },
       "original": {

From 1d3760127e5c970cee2a76e96efe533c8d18fd5f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 11 Aug 2025 12:30:32 -0700
Subject: [PATCH 314/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6e394b2..4a5a9c2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754764183,
-        "narHash": "sha256-LKESRUckFe9adcMeAdkVJDljnsdPM99nIzkeRMFYdQU=",
+        "lastModified": 1754923831,
+        "narHash": "sha256-JOSPQVcA51xAM3is92V85PAzF0VHfd8lfU47fN/+AGc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "79c1160b073b8148a404f3dd2584be1606dccc66",
+        "rev": "be48528b068111304e4a0bb82c028558b5705f05",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754689972,
-        "narHash": "sha256-eogqv6FqZXHgqrbZzHnq43GalnRbLTkbBbFtEfm1RSc=",
+        "lastModified": 1754767907,
+        "narHash": "sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fc756aa6f5d3e2e5666efcf865d190701fef150a",
+        "rev": "c5f08b62ed75415439d48152c2a784e36909b1bc",
         "type": "github"
       },
       "original": {

From e29dfcf1118b59e96d1d38dec9373c2f567aa296 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 11 Aug 2025 12:34:03 -0700
Subject: [PATCH 315/847] re-disable llama-cpp

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 66b54b4..d6a24dd 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -29,7 +29,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
   ];
 
   systemd.targets = {

From ca77ee388ad8ba3f08689df358fa1ded7ccd4802 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 11 Aug 2025 15:30:43 -0700
Subject: [PATCH 316/847] add minecraft test

---
 flake.nix           |   2 +-
 tests/minecraft.nix | 118 ++++++++++++++++++++++++++++++++++++++++++++
 tests/tests.nix     |   5 +-
 3 files changed, 122 insertions(+), 3 deletions(-)
 create mode 100644 tests/minecraft.nix

diff --git a/flake.nix b/flake.nix
index 64222f5..9eda8d5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -225,7 +225,7 @@
       packages.${system} =
         let
           testSuite = import ./tests/tests.nix {
-            inherit pkgs lib;
+            inherit pkgs lib inputs;
             config = self.nixosConfigurations.muffin.config;
           };
         in
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
new file mode 100644
index 0000000..9b9c9df
--- /dev/null
+++ b/tests/minecraft.nix
@@ -0,0 +1,118 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  # Create pkgs with nix-minecraft overlay and unfree packages allowed
+  testPkgs = import inputs.nixpkgs {
+    system = pkgs.system;
+    config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
+    overlays = [ inputs.nix-minecraft.overlay ];
+  };
+
+  # Create a wrapper module that imports the actual minecraft service
+  minecraftService =
+    { config, ... }:
+    let
+      # Import the minecraft service configuration
+      serviceConfig = import ../services/minecraft.nix {
+        inherit lib config;
+        pkgs = testPkgs;
+        service_configs = {
+          minecraft = {
+            server_name = "main";
+            parent_dir = "/var/lib/minecraft";
+          };
+          https = {
+            domain = "test.local";
+          };
+        };
+        username = "testuser";
+      };
+    in
+    {
+      imports = [ serviceConfig ];
+      # Override nixpkgs config to prevent conflicts in test environment
+      nixpkgs.config = lib.mkForce {
+        allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
+      };
+    };
+in
+testPkgs.testers.runNixOSTest {
+  name = "minecraft server startup test";
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [
+        inputs.nix-minecraft.nixosModules.minecraft-servers
+        minecraftService
+      ];
+
+      # Enable caddy service (required by minecraft service)
+      services.caddy.enable = true;
+
+      # Disable the ZFS mount dependency service in test environment
+      systemd.services."minecraft-server-main_mounts".enable = lib.mkForce false;
+
+      # Remove service dependencies that require ZFS
+      systemd.services.minecraft-server-main = {
+        wants = lib.mkForce [ ];
+        after = lib.mkForce [ ];
+        requires = lib.mkForce [ ];
+      };
+
+      # Test-specific overrides only - reduce memory for testing
+      services.minecraft-servers.servers.main.jvmOpts = lib.mkForce "-Xmx1G -Xms1G";
+
+      # Create test user
+      users.users.testuser = {
+        isNormalUser = true;
+        uid = 1000;
+        extraGroups = [ "minecraft" ];
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # Wait for minecraft service to be available
+    machine.wait_for_unit("minecraft-server-main.service")
+
+    # Check that the service is active and not failed
+    machine.succeed("systemctl is-active minecraft-server-main.service")
+
+    # Wait for the server to fully start up - minecraft with mods can take longer
+    machine.sleep(60)
+
+    # Verify the service hasn't crashed after startup
+    machine.succeed("systemctl is-active minecraft-server-main.service")
+
+    # Check that the minecraft process is running
+    machine.succeed("pgrep -f minecraft")
+
+    # Verify the server port is listening
+    machine.wait_for_open_port(25565)
+
+    # Check that minecraft data directory was created
+    machine.succeed("test -d /var/lib/minecraft/main")
+
+    # Verify server.properties was created
+    machine.succeed("test -f /var/lib/minecraft/main/server.properties")
+
+    # Check that mods directory exists and contains the expected mods
+    machine.succeed("test -d /var/lib/minecraft/main/mods")
+    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q fabric-api")
+    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q ferritecore")
+    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q lithium")
+
+    # Check that there are no critical errors in the logs
+    machine.succeed("! journalctl -u minecraft-server-main.service --no-pager | grep -i 'error\\|exception\\|failed'")
+
+    print("Minecraft server with specific mods started successfully!")
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index d729c74..e2b6e5e 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -3,11 +3,12 @@
   lib,
   pkgs,
   ...
-}:
+}@args:
 let
-  handleTest = file: import file { inherit config lib pkgs; };
+  handleTest = file: import file (args);
 in
 {
   zfsTest = handleTest ./zfs.nix;
   testTest = handleTest ./testTest.nix;
+  minecraftTest = handleTest ./minecraft.nix;
 }

From 7d29dd4830475d23e20ea83655db7a60a8ffa3eb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 11 Aug 2025 16:18:10 -0700
Subject: [PATCH 317/847] move ensureZfsMounts

---
 flake.nix           |  5 +++-
 lib.nix             | 63 ++++++++++++---------------------------------
 overlays.nix        | 33 ++++++++++++++++++++++++
 tests/minecraft.nix |  5 +++-
 tests/zfs.nix       | 12 +++++++--
 5 files changed, 68 insertions(+), 50 deletions(-)
 create mode 100644 overlays.nix

diff --git a/flake.nix b/flake.nix
index 9eda8d5..6b4496a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -189,7 +189,10 @@
           # get nix-minecraft working!
           nix-minecraft.nixosModules.minecraft-servers
           {
-            nixpkgs.overlays = [ nix-minecraft.overlay ];
+            nixpkgs.overlays = [
+              nix-minecraft.overlay
+              (import ./overlays.nix)
+            ];
           }
 
           lanzaboote.nixosModules.lanzaboote
diff --git a/lib.nix b/lib.nix
index 1437931..ef658f0 100644
--- a/lib.nix
+++ b/lib.nix
@@ -9,58 +9,29 @@ inputs.nixpkgs.lib.extend (
     lib = prev;
   in
   {
-    # Should probably be moved to a package later instead of this
-    ensureZfsMounts = pkgs.writeShellApplication {
-      name = "zfsEnsureMounted";
-      runtimeInputs = with pkgs; [
-        zfs
-        gnugrep
-        gawk
-        coreutils
-      ];
 
-      text = ''
-        #!/bin/sh -x
+    serviceMountDeps =
+      serviceName: dirs:
+      { pkgs, ... }:
+      {
+        systemd.services."${serviceName}_mounts" = {
+          wants = [ "zfs.target" ];
+          before = [ "${serviceName}.service" ];
 
-        if [[ "$#" -eq "0" ]]; then
-           echo "no arguments passed"
-           exit 1
-        fi
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${lib.getExe pkgs.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}";
+          };
+        };
 
-        TARGETS=$(echo "$@" | sort | uniq)
-        MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
-        NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec "$(echo "$@" | tr ' ' '\|')") # does not properly handle paths with strings
-        if [[ "$NUM_MATCHED" -eq "$#" ]]; then
-           exit 0
-        fi
-
-        FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
-        MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
-
-        echo "FAILURE, missing: $MISSING" 1>&2
-        exit 1
-      '';
-    };
-
-    serviceMountDeps = serviceName: dirs: {
-      systemd.services."${serviceName}_mounts" = {
-        wants = [ "zfs.target" ];
-        before = [ "${serviceName}.service" ];
-
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = "${lib.getExe final.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}";
+        systemd.services.${serviceName} = {
+          wants = [ "${serviceName}_mounts.service" ];
+          after = [ "${serviceName}_mounts.service" ];
+          requires = [ "${serviceName}_mounts.service" ];
         };
       };
 
-      systemd.services.${serviceName} = {
-        wants = [ "${serviceName}_mounts.service" ];
-        after = [ "${serviceName}_mounts.service" ];
-        requires = [ "${serviceName}_mounts.service" ];
-      };
-    };
-
     # stolen from: https://stackoverflow.com/a/42398526
     optimizeWithFlags =
       pkg: flags:
diff --git a/overlays.nix b/overlays.nix
new file mode 100644
index 0000000..e64025b
--- /dev/null
+++ b/overlays.nix
@@ -0,0 +1,33 @@
+final: prev: {
+  ensureZfsMounts = prev.writeShellApplication {
+    name = "zfsEnsureMounted";
+    runtimeInputs = with prev; [
+      zfs
+      gnugrep
+      gawk
+      coreutils
+    ];
+
+    text = ''
+      #!/bin/sh -x
+
+      if [[ "$#" -eq "0" ]]; then
+         echo "no arguments passed"
+         exit 1
+      fi
+
+      TARGETS=$(echo "$@" | sort | uniq)
+      MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
+      NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec "$(echo "$@" | tr ' ' '\|')") # does not properly handle paths with strings
+      if [[ "$NUM_MATCHED" -eq "$#" ]]; then
+         exit 0
+      fi
+
+      FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
+      MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
+
+      echo "FAILURE, missing: $MISSING" 1>&2
+      exit 1
+    '';
+  };
+}
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 9b9c9df..a304158 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -10,7 +10,10 @@ let
   testPkgs = import inputs.nixpkgs {
     system = pkgs.system;
     config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
-    overlays = [ inputs.nix-minecraft.overlay ];
+    overlays = [
+      inputs.nix-minecraft.overlay
+      (import ../overlays.nix)
+    ];
   };
 
   # Create a wrapper module that imports the actual minecraft service
diff --git a/tests/zfs.nix b/tests/zfs.nix
index 6bfabfc..ca9d92e 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -2,9 +2,17 @@
   config,
   lib,
   pkgs,
+  inputs,
   ...
 }:
-pkgs.testers.runNixOSTest {
+let
+  # Create pkgs with ensureZfsMounts overlay
+  testPkgs = import inputs.nixpkgs {
+    system = pkgs.system;
+    overlays = [ (import ../overlays.nix) ];
+  };
+in
+testPkgs.testers.runNixOSTest {
   name = "zfs folder dependency and mounting test";
 
   nodes.machine =
@@ -35,7 +43,7 @@ pkgs.testers.runNixOSTest {
 
       environment.systemPackages = [
         pkgs.parted
-        lib.ensureZfsMounts
+        pkgs.ensureZfsMounts
       ];
 
       systemd.services.foobar = {

From 7264cb4629fb81f8fbac8620c972bae69fdab792 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Aug 2025 00:25:07 -0700
Subject: [PATCH 318/847] minecraftTest: edit syntax

---
 tests/minecraft.nix | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index a304158..74f1d7e 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -19,25 +19,23 @@ let
   # Create a wrapper module that imports the actual minecraft service
   minecraftService =
     { config, ... }:
-    let
-      # Import the minecraft service configuration
-      serviceConfig = import ../services/minecraft.nix {
-        inherit lib config;
-        pkgs = testPkgs;
-        service_configs = {
-          minecraft = {
-            server_name = "main";
-            parent_dir = "/var/lib/minecraft";
-          };
-          https = {
-            domain = "test.local";
-          };
-        };
-        username = "testuser";
-      };
-    in
     {
-      imports = [ serviceConfig ];
+      imports = [
+        (import ../services/minecraft.nix {
+          inherit lib config;
+          pkgs = testPkgs;
+          service_configs = {
+            minecraft = {
+              server_name = "main";
+              parent_dir = "/var/lib/minecraft";
+            };
+            https = {
+              domain = "test.local";
+            };
+          };
+          username = "testuser";
+        })
+      ];
       # Override nixpkgs config to prevent conflicts in test environment
       nixpkgs.config = lib.mkForce {
         allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];

From 2d4840f33be544641670ea5f226f4044e7edfb43 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Aug 2025 02:25:44 -0700
Subject: [PATCH 319/847] improve ensureZfsMounted script

---
 overlays.nix  | 32 ++++++++++++++++----------------
 tests/zfs.nix |  9 +++++++++
 2 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/overlays.nix b/overlays.nix
index e64025b..dc58d37 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -3,31 +3,31 @@ final: prev: {
     name = "zfsEnsureMounted";
     runtimeInputs = with prev; [
       zfs
-      gnugrep
       gawk
       coreutils
     ];
 
     text = ''
-      #!/bin/sh -x
+       #!/bin/sh
 
-      if [[ "$#" -eq "0" ]]; then
-         echo "no arguments passed"
-         exit 1
-      fi
+       if [[ "$#" -eq "0" ]]; then
+          echo "no arguments passed"
+          exit 1
+       fi
 
-      TARGETS=$(echo "$@" | sort | uniq)
-      MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$2 == "yes" {print $1}' | sort | uniq)
-      NUM_MATCHED=$(echo "$MOUNTED" | grep -Ec "$(echo "$@" | tr ' ' '\|')") # does not properly handle paths with strings
-      if [[ "$NUM_MATCHED" -eq "$#" ]]; then
-         exit 0
-      fi
+      MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$NF == "yes" {$NF=""; print $0}' | sed 's/[[:space:]]*$//')
 
-      FOUND=$(printf "%s\n%s" "$TARGETS" "$MOUNTED" | sort | uniq -c | awk '$1 == "2" {print $2}' | sort)
-      MISSING=$(printf "%s\n%s" "$FOUND" "$TARGETS" | sort | uniq -u | sort)
+       MISSING=""
+       for target in "$@"; do
+          if ! echo "$MOUNTED" | grep -Fxq "$target"; then
+             MISSING="$MISSING $target"
+          fi
+       done
 
-      echo "FAILURE, missing: $MISSING" 1>&2
-      exit 1
+       if [[ -n "$MISSING" ]]; then
+          echo "FAILURE, missing:$MISSING" 1>&2
+          exit 1
+       fi
     '';
   };
 }
diff --git a/tests/zfs.nix b/tests/zfs.nix
index ca9d92e..79f910c 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -86,6 +86,15 @@ testPkgs.testers.runNixOSTest {
 
     machine.succeed("zfsEnsureMounted /mnt/test_mountpoint /mnt/test_mountpoint_dos")
 
+    machine.succeed("zfs create -o mountpoint='/mnt/test path with spaces' rpool/test3")
+
+    machine.succeed("zfsEnsureMounted '/mnt/test path with spaces'")
+
+    machine.succeed("echo 'ZFS output for escaped spaces:'; zfs list -o mountpoint,mounted -H | grep escaped")
+
+    machine.succeed("zfsEnsureMounted /mnt/test\\ escaped\\ spaces")
+
+    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint '/mnt/test path with spaces' /mnt/test_mountpoint_dos")
 
     machine.succeed("zfs create -o mountpoint=/mnt/foobar_data rpool/foobar")
     machine.succeed("systemctl start foobar")

From 2456d41daf113c4307832eb142a9f5b2a7e1ebef Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Aug 2025 02:36:10 -0700
Subject: [PATCH 320/847] fix zfs test

---
 tests/zfs.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/zfs.nix b/tests/zfs.nix
index 79f910c..aeb4052 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -90,9 +90,7 @@ testPkgs.testers.runNixOSTest {
 
     machine.succeed("zfsEnsureMounted '/mnt/test path with spaces'")
 
-    machine.succeed("echo 'ZFS output for escaped spaces:'; zfs list -o mountpoint,mounted -H | grep escaped")
-
-    machine.succeed("zfsEnsureMounted /mnt/test\\ escaped\\ spaces")
+    # machine.succeed("zfsEnsureMounted /mnt/test\\ escaped\\ spaces") # TODO! fix escaped spaces
 
     machine.succeed("zfsEnsureMounted /mnt/test_mountpoint '/mnt/test path with spaces' /mnt/test_mountpoint_dos")
 

From 257a04c4c2a732ee61536ffa1ef8f5326f62c076 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 12 Aug 2025 11:56:36 -0700
Subject: [PATCH 321/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4a5a9c2..01858e2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753140376,
-        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
+        "lastModified": 1754971456,
+        "narHash": "sha256-p04ZnIBGzerSyiY2dNGmookCldhldWAu03y0s3P8CB0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
+        "rev": "8246829f2e675a46919718f9a64b71afe3bfb22d",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754923831,
-        "narHash": "sha256-JOSPQVcA51xAM3is92V85PAzF0VHfd8lfU47fN/+AGc=",
+        "lastModified": 1754999902,
+        "narHash": "sha256-CtURbL94xEmdL09L8ffsyCd0KgsmPM20TKNeM5cQPlE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "be48528b068111304e4a0bb82c028558b5705f05",
+        "rev": "f4586ee5986d6f965becb37876d6f3666478a961",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754879077,
-        "narHash": "sha256-Nx16zw0VTd0zSJLvIcB0AUM9xd0+wi8Vt9YP7nn4bOU=",
+        "lastModified": 1754964387,
+        "narHash": "sha256-r3mRiVL25AZXNe6ACCgIqWoeoFAa6YJDScdReu0DQ58=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "83390c41ec4d872e84abcf852b1c5b710a1f4512",
+        "rev": "b2cb98ebb0629825c2b38f7a74533cd428bb7983",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754767907,
-        "narHash": "sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g=",
+        "lastModified": 1754937576,
+        "narHash": "sha256-3sWA5WJybUE16kIMZ3+uxcxKZY/JRR4DFBqLdSLBo7w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5f08b62ed75415439d48152c2a784e36909b1bc",
+        "rev": "ddae11e58c0c345bf66efbddbf2192ed0e58f896",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754876635,
-        "narHash": "sha256-eU+DxKxVGNC7wjsfxdjDJQcDPx+V+K2qz8YbtSQIuG4=",
+        "lastModified": 1754976577,
+        "narHash": "sha256-F6h97bTJfEgFoWkACsuOolUmxa4ByXdQ8KfdYMkDQ2Q=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "0fd4b65ae4649ce65a83e00fd39747fe64c5076f",
+        "rev": "83f8666976107a0d84ddc7a3c835d46ffdf83d97",
         "type": "github"
       },
       "original": {

From c24391d575cd82fc8f47d0b116f9b6e379df9712 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 14 Aug 2025 01:14:27 -0700
Subject: [PATCH 322/847] minecraft: lazymc

---
 flake.lock             | 11 ++++++-----
 flake.nix              |  3 ++-
 services/minecraft.nix |  8 +++++++-
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index 01858e2..7bd0e08 100644
--- a/flake.lock
+++ b/flake.lock
@@ -260,16 +260,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1754964387,
-        "narHash": "sha256-r3mRiVL25AZXNe6ACCgIqWoeoFAa6YJDScdReu0DQ58=",
-        "owner": "Infinidoge",
+        "lastModified": 1754714638,
+        "narHash": "sha256-/9sKZOLN/rTAnDVV2KtKNSHXHpt4mvgqA879AvhQ9no=",
+        "owner": "Yeshey",
         "repo": "nix-minecraft",
-        "rev": "b2cb98ebb0629825c2b38f7a74533cd428bb7983",
+        "rev": "95fb235bd93a136b7b3fde1329fa4bead50104a6",
         "type": "github"
       },
       "original": {
-        "owner": "Infinidoge",
+        "owner": "Yeshey",
         "repo": "nix-minecraft",
+        "rev": "95fb235bd93a136b7b3fde1329fa4bead50104a6",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index 6b4496a..b0e2c1a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,7 +12,8 @@
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     nix-minecraft = {
-      url = "github:Infinidoge/nix-minecraft";
+      # url = "github:Infinidoge/nix-minecraft";
+      url = "github:Yeshey/nix-minecraft/95fb235bd93a136b7b3fde1329fa4bead50104a6";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 5ed59e8..2e53a1b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,7 +43,7 @@
         "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
       serverProperties = {
-        server-port = 25565;
+        server-port = 25566;
         enforce-whitelist = true;
         gamemode = "survival";
         white-list = true;
@@ -53,6 +53,12 @@
         simulation-distance = 6;
         sync-chunk-writes = false;
         spawn-protection = 0;
+        max-tick-time = -1; # Recommended with lazymc
+      };
+
+      lazymc = {
+        enable = true;
+        config.public.address = "0.0.0.0:25565";
       };
 
       whitelist = import ../secrets/minecraft-whitelist.nix;

From fa6f9297af64affaa9e7a6889ac652515110e2de Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 14 Aug 2025 01:27:51 -0700
Subject: [PATCH 323/847] Revert "minecraft: lazymc"

This reverts commit a081e6c6ee58f7012bcdc123d0dfe16b574a36bf.
---
 flake.lock             | 11 +++++------
 flake.nix              |  3 +--
 services/minecraft.nix |  8 +-------
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7bd0e08..01858e2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -260,17 +260,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1754714638,
-        "narHash": "sha256-/9sKZOLN/rTAnDVV2KtKNSHXHpt4mvgqA879AvhQ9no=",
-        "owner": "Yeshey",
+        "lastModified": 1754964387,
+        "narHash": "sha256-r3mRiVL25AZXNe6ACCgIqWoeoFAa6YJDScdReu0DQ58=",
+        "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "95fb235bd93a136b7b3fde1329fa4bead50104a6",
+        "rev": "b2cb98ebb0629825c2b38f7a74533cd428bb7983",
         "type": "github"
       },
       "original": {
-        "owner": "Yeshey",
+        "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "95fb235bd93a136b7b3fde1329fa4bead50104a6",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index b0e2c1a..6b4496a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,8 +12,7 @@
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     nix-minecraft = {
-      # url = "github:Infinidoge/nix-minecraft";
-      url = "github:Yeshey/nix-minecraft/95fb235bd93a136b7b3fde1329fa4bead50104a6";
+      url = "github:Infinidoge/nix-minecraft";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 2e53a1b..5ed59e8 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,7 +43,7 @@
         "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
       serverProperties = {
-        server-port = 25566;
+        server-port = 25565;
         enforce-whitelist = true;
         gamemode = "survival";
         white-list = true;
@@ -53,12 +53,6 @@
         simulation-distance = 6;
         sync-chunk-writes = false;
         spawn-protection = 0;
-        max-tick-time = -1; # Recommended with lazymc
-      };
-
-      lazymc = {
-        enable = true;
-        config.public.address = "0.0.0.0:25565";
       };
 
       whitelist = import ../secrets/minecraft-whitelist.nix;

From 03abf4121dfee1edc5d0b88b0517b961bd475c74 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 14 Aug 2025 01:30:59 -0700
Subject: [PATCH 324/847] minecraft: bump better-fabric-console

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 5ed59e8..d87e5e7 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -107,8 +107,8 @@
             };
 
             better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/FTLKiVb8/better-fabric-console-mc1.21.8-1.2.4.jar";
-              sha512 = "1542578e195ddedc3a99a7e23dbda9b79ec795077e85e9cfce3ad7d0812f558c7a5c19b3c5cc0f177c443738afac7690d486c499a02dbe59cf22ef17e887a2fc";
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/DMBZUPjK/better-fabric-console-mc1.21.8-1.2.5.jar";
+              sha512 = "d0de1aec66add0158e5a97424a21fc4bd0d26c54457d1bf15cd19e60939ed5d8b4dc4120a6aeec00925723b7dc431a9b84f60ad96d56a9e50620ef34b091cae6";
             };
           }
         );

From 6c4a3562b64dd4ac396c16c3fb28d01aa360f363 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 15 Aug 2025 01:44:21 -0700
Subject: [PATCH 325/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 01858e2..037685c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754999902,
-        "narHash": "sha256-CtURbL94xEmdL09L8ffsyCd0KgsmPM20TKNeM5cQPlE=",
+        "lastModified": 1755206484,
+        "narHash": "sha256-sYpXLDYSpPBwxsAaPde+PbRasLjYlB4Wzqi3M3IkTYg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "f4586ee5986d6f965becb37876d6f3666478a961",
+        "rev": "4227c9be4268ac844921b90f31595f81236bd317",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754964387,
-        "narHash": "sha256-r3mRiVL25AZXNe6ACCgIqWoeoFAa6YJDScdReu0DQ58=",
+        "lastModified": 1755223770,
+        "narHash": "sha256-PJfiLvHd59Jw/97xTKbc8CFoR0ypg2s8d2pNZXLc18U=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b2cb98ebb0629825c2b38f7a74533cd428bb7983",
+        "rev": "22e7b0d160e59473faac30a64e984c1819875b6d",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754937576,
-        "narHash": "sha256-3sWA5WJybUE16kIMZ3+uxcxKZY/JRR4DFBqLdSLBo7w=",
+        "lastModified": 1755078291,
+        "narHash": "sha256-Hu/gTDoi4uy6TAKISPHQusSMy8U6xUbLSDjKBYdhDIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ddae11e58c0c345bf66efbddbf2192ed0e58f896",
+        "rev": "3385ca0cd7e14c1a1eb80401fe011705ff012323",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754976577,
-        "narHash": "sha256-F6h97bTJfEgFoWkACsuOolUmxa4ByXdQ8KfdYMkDQ2Q=",
+        "lastModified": 1755133551,
+        "narHash": "sha256-WMwREoEq9pBSwoCmv7SNOb3eHNfO8QYc3z7wyprjGHQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "83f8666976107a0d84ddc7a3c835d46ffdf83d97",
+        "rev": "278214ace1f3b099badb7e78e13384f3e0892d9d",
         "type": "github"
       },
       "original": {

From b274cac25df84b75cc0675de17050e18d8da4913 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 16 Aug 2025 01:40:24 -0400
Subject: [PATCH 326/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 037685c..4b28906 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755206484,
-        "narHash": "sha256-sYpXLDYSpPBwxsAaPde+PbRasLjYlB4Wzqi3M3IkTYg=",
+        "lastModified": 1755280252,
+        "narHash": "sha256-0mONJiAOxdLNeBjDlMKMjk0NtrF8oEtVdw+QlDWrRq8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "4227c9be4268ac844921b90f31595f81236bd317",
+        "rev": "5e6229a8409ac786e62cb133d09f1679a9aec13e",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755223770,
-        "narHash": "sha256-PJfiLvHd59Jw/97xTKbc8CFoR0ypg2s8d2pNZXLc18U=",
+        "lastModified": 1755309798,
+        "narHash": "sha256-eE0NI54C8Agj7xVpO+lwJG74u6dzID8HWxCP2sA5U/Y=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "22e7b0d160e59473faac30a64e984c1819875b6d",
+        "rev": "cedd99dd11cb48b4fdf40d69fbcba42acab1b629",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755078291,
-        "narHash": "sha256-Hu/gTDoi4uy6TAKISPHQusSMy8U6xUbLSDjKBYdhDIY=",
+        "lastModified": 1755274400,
+        "narHash": "sha256-rTInmnp/xYrfcMZyFMH3kc8oko5zYfxsowaLv1LVobY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3385ca0cd7e14c1a1eb80401fe011705ff012323",
+        "rev": "ad7196ae55c295f53a7d1ec39e4a06d922f3b899",
         "type": "github"
       },
       "original": {

From 8d04d5abe33b728fce6e2ddb5340a466a796d1f1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 04:29:52 -0400
Subject: [PATCH 327/847] satisfy shellcheck for disk-smart-test

---
 configuration.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d6a24dd..a7fb730 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -182,9 +182,6 @@
         smartmontools
       ];
 
-      # i gotta fix that
-      excludeShellChecks = [ "SC2010" ];
-
       text = ''
         #!/bin/sh
         set -e
@@ -193,8 +190,10 @@
           exit 2
         fi
 
-        DISKS=$(ls /dev/sd* | grep -v "[0-9]$")
-        for i in $DISKS; do
+        for i in /dev/disk/by-id/*; do
+          case "$i" in
+           *\\-part[0-9]*) continue ;;
+          esac
           echo -n "$i "
           smartctl -a "$i" | grep "SMART overall-health self-assessment test result:" | cut -d' ' -f6
         done

From f1efdc5d32a99a67783ae04a22b255726f9fcf66 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 04:31:05 -0400
Subject: [PATCH 328/847] move reflac and disk-smart-test to overlays.nix

---
 configuration.nix | 40 ++--------------------------------------
 overlays.nix      | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 38 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index a7fb730..1a667c4 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -174,44 +174,8 @@
 
     lsof
 
-    (pkgs.writeShellApplication {
-      name = "disk-smart-test";
-      runtimeInputs = with pkgs; [
-        gnugrep
-        coreutils
-        smartmontools
-      ];
-
-      text = ''
-        #!/bin/sh
-        set -e
-        if [[ $EUID -ne 0 ]]; then
-          echo "This command requires root."
-          exit 2
-        fi
-
-        for i in /dev/disk/by-id/*; do
-          case "$i" in
-           *\\-part[0-9]*) continue ;;
-          esac
-          echo -n "$i "
-          smartctl -a "$i" | grep "SMART overall-health self-assessment test result:" | cut -d' ' -f6
-        done
-      '';
-    })
-
-    (pkgs.writeShellApplication {
-      name = "reflac";
-      runtimeInputs = with pkgs; [ flac ];
-      excludeShellChecks = [ "2086" ];
-
-      text = builtins.readFile (
-        pkgs.fetchurl {
-          url = "https://raw.githubusercontent.com/chungy/reflac/refs/heads/master/reflac";
-          sha256 = "61c6cc8be3d276c6714e68b55e5de0e6491f50bbf195233073dbce14a1e278a7";
-        }
-      );
-    })
+    disk-smart-test
+    reflac
 
     pfetch-rs
 
diff --git a/overlays.nix b/overlays.nix
index dc58d37..38d0f99 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -30,4 +30,43 @@ final: prev: {
        fi
     '';
   };
+
+  disk-smart-test = prev.writeShellApplication {
+    name = "disk-smart-test";
+    runtimeInputs = with prev; [
+      gnugrep
+      coreutils
+      smartmontools
+    ];
+
+    text = ''
+      #!/bin/sh
+      set -e
+      if [[ $EUID -ne 0 ]]; then
+        echo "This command requires root."
+        exit 2
+      fi
+
+      for i in /dev/disk/by-id/*; do
+        case "$i" in
+         *\\-part[0-9]*) continue ;;
+        esac
+        echo -n "$i "
+        smartctl -a "$i" | grep "SMART overall-health self-assessment test result:" | cut -d' ' -f6
+      done
+    '';
+  };
+
+  reflac = prev.writeShellApplication {
+    name = "reflac";
+    runtimeInputs = with prev; [ flac ];
+    excludeShellChecks = [ "2086" ];
+
+    text = builtins.readFile (
+      prev.fetchurl {
+        url = "https://raw.githubusercontent.com/chungy/reflac/refs/heads/master/reflac";
+        sha256 = "61c6cc8be3d276c6714e68b55e5de0e6491f50bbf195233073dbce14a1e278a7";
+      }
+    );
+  };
 }

From e62fcf0ff0dad16a013e27927769963ea2eccc74 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 04:50:43 -0400
Subject: [PATCH 329/847] delete smart-smart-test

---
 configuration.nix |  1 -
 overlays.nix      | 26 --------------------------
 2 files changed, 27 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 1a667c4..89d1faf 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -174,7 +174,6 @@
 
     lsof
 
-    disk-smart-test
     reflac
 
     pfetch-rs
diff --git a/overlays.nix b/overlays.nix
index 38d0f99..faf7429 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -31,32 +31,6 @@ final: prev: {
     '';
   };
 
-  disk-smart-test = prev.writeShellApplication {
-    name = "disk-smart-test";
-    runtimeInputs = with prev; [
-      gnugrep
-      coreutils
-      smartmontools
-    ];
-
-    text = ''
-      #!/bin/sh
-      set -e
-      if [[ $EUID -ne 0 ]]; then
-        echo "This command requires root."
-        exit 2
-      fi
-
-      for i in /dev/disk/by-id/*; do
-        case "$i" in
-         *\\-part[0-9]*) continue ;;
-        esac
-        echo -n "$i "
-        smartctl -a "$i" | grep "SMART overall-health self-assessment test result:" | cut -d' ' -f6
-      done
-    '';
-  };
-
   reflac = prev.writeShellApplication {
     name = "reflac";
     runtimeInputs = with prev; [ flac ];

From 4e4e63ed91c8530af60a8fe4737f55478eaede63 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 04:53:58 -0400
Subject: [PATCH 330/847] add libatasmart

---
 configuration.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 89d1faf..a7571f0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -179,6 +179,9 @@
     pfetch-rs
 
     sbctl
+
+    # add `skdump`
+    libatasmart
   ];
 
   systemd.services.no-rgb =

From 72f38b1f8b7ff2ab7201eb2b9641be26fa7bd216 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 04:55:48 -0400
Subject: [PATCH 331/847] no-rgb: use lib.getExe

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index a7571f0..ca98733 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -211,7 +211,7 @@
     {
       description = "disable rgb";
       serviceConfig = {
-        ExecStart = "${no-rgb}/bin/${no-rgb.name}";
+        ExecStart = "${lib.getExe no-rgb}";
         Type = "oneshot";
       };
       wantedBy = [ "multi-user.target" ];

From 5764a78dd7ca2151277a0774bc1f303cea152854 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 10:10:29 -0400
Subject: [PATCH 332/847] ups: init

---
 configuration.nix |  2 ++
 services/ups.nix  | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 services/ups.nix

diff --git a/configuration.nix b/configuration.nix
index ca98733..7ce9232 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -30,6 +30,8 @@
     ./services/soulseek.nix
 
     # ./services/llama-cpp.nix
+
+    ./services/ups.nix
   ];
 
   systemd.targets = {
diff --git a/services/ups.nix b/services/ups.nix
new file mode 100644
index 0000000..b7c19d5
--- /dev/null
+++ b/services/ups.nix
@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  services.apcupsd = {
+    enable = true;
+    configText = ''
+      UPSTYPE usb
+      NISIP 127.0.0.1
+      BATTERYLEVEL 5 # shutdown after reaching 5% battery
+      MINUTES 5 # shutdown if estimated runtime on battery reaches 5 minutes
+    '';
+
+    hooks = {
+      # command to run when shutdown condition is met
+      doshutdown = "systemctl poweroff";
+    };
+  };
+}

From b6dcac448808fbb886f27a36a30c8838a56861dd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 10:12:58 -0400
Subject: [PATCH 333/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4b28906..3974958 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754971456,
-        "narHash": "sha256-p04ZnIBGzerSyiY2dNGmookCldhldWAu03y0s3P8CB0=",
+        "lastModified": 1755519972,
+        "narHash": "sha256-bU4nqi3IpsUZJeyS8Jk85ytlX61i4b0KCxXX9YcOgVc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "8246829f2e675a46919718f9a64b71afe3bfb22d",
+        "rev": "4073ff2f481f9ef3501678ff479ed81402caae6d",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755280252,
-        "narHash": "sha256-0mONJiAOxdLNeBjDlMKMjk0NtrF8oEtVdw+QlDWrRq8=",
+        "lastModified": 1755514248,
+        "narHash": "sha256-uPg3P8pRR1B3/b/ddDvdSOTRm4zUBKU0XhwVFO6K2XM=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "5e6229a8409ac786e62cb133d09f1679a9aec13e",
+        "rev": "618575c5825d7d4f170e686e772178d2aae148ae",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755309798,
-        "narHash": "sha256-eE0NI54C8Agj7xVpO+lwJG74u6dzID8HWxCP2sA5U/Y=",
+        "lastModified": 1755483699,
+        "narHash": "sha256-dj5cNx+WvDv5fbsE4h/Q6UuTttc/BHBE3BVGVn2TUNk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "cedd99dd11cb48b4fdf40d69fbcba42acab1b629",
+        "rev": "aa5ed59e2570c7adfd6f5ca6ec08fff3140d7565",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1754564048,
-        "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=",
+        "lastModified": 1755330281,
+        "narHash": "sha256-aJHFJWP9AuI8jUGzI77LYcSlkA9wJnOIg4ZqftwNGXA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113",
+        "rev": "3dac8a872557e0ca8c083cdcfc2f218d18e113b0",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755274400,
-        "narHash": "sha256-rTInmnp/xYrfcMZyFMH3kc8oko5zYfxsowaLv1LVobY=",
+        "lastModified": 1755471983,
+        "narHash": "sha256-axUoWcm4cNQ36jOlnkD9D40LTfSQgk8ExfHSRm3rTtg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ad7196ae55c295f53a7d1ec39e4a06d922f3b899",
+        "rev": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755133551,
-        "narHash": "sha256-WMwREoEq9pBSwoCmv7SNOb3eHNfO8QYc3z7wyprjGHQ=",
+        "lastModified": 1755479226,
+        "narHash": "sha256-G7AVmVJhqMraf1iqMoyQ/aWuYvcFFFrMMkrMjWwVyHY=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "278214ace1f3b099badb7e78e13384f3e0892d9d",
+        "rev": "b2eeb75153c3e2c7c82991a5c335de3b6c151f51",
         "type": "github"
       },
       "original": {

From ae48b96416d3f7f8a1f508f988e72f0a11e03303 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 18 Aug 2025 10:24:20 -0400
Subject: [PATCH 334/847] cleanup + fix minecraft test

---
 tests/minecraft.nix | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 74f1d7e..12ac132 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -93,27 +93,7 @@ testPkgs.testers.runNixOSTest {
     # Verify the service hasn't crashed after startup
     machine.succeed("systemctl is-active minecraft-server-main.service")
 
-    # Check that the minecraft process is running
-    machine.succeed("pgrep -f minecraft")
-
     # Verify the server port is listening
     machine.wait_for_open_port(25565)
-
-    # Check that minecraft data directory was created
-    machine.succeed("test -d /var/lib/minecraft/main")
-
-    # Verify server.properties was created
-    machine.succeed("test -f /var/lib/minecraft/main/server.properties")
-
-    # Check that mods directory exists and contains the expected mods
-    machine.succeed("test -d /var/lib/minecraft/main/mods")
-    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q fabric-api")
-    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q ferritecore")
-    machine.succeed("ls /var/lib/minecraft/main/mods | grep -q lithium")
-
-    # Check that there are no critical errors in the logs
-    machine.succeed("! journalctl -u minecraft-server-main.service --no-pager | grep -i 'error\\|exception\\|failed'")
-
-    print("Minecraft server with specific mods started successfully!")
   '';
 }

From 51138fd15ed9881c293388e2641e4c8be52e36b9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 19 Aug 2025 01:43:29 -0400
Subject: [PATCH 335/847] initial testing for list-usb-drives

---
 overlays.nix              | 36 ++++++++++++++++++++++++++++++
 tests/list-usb-drives.nix | 46 +++++++++++++++++++++++++++++++++++++++
 tests/tests.nix           |  1 +
 3 files changed, 83 insertions(+)
 create mode 100644 tests/list-usb-drives.nix

diff --git a/overlays.nix b/overlays.nix
index faf7429..4139094 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -43,4 +43,40 @@ final: prev: {
       }
     );
   };
+
+  list-usb-drives = prev.writeShellApplication {
+    name = "list-usb-drives";
+    runtimeInputs = with prev; [
+      findutils
+      gawk
+      coreutils
+      gnugrep
+      util-linux
+    ];
+
+    excludeShellChecks = [
+      "SC2086"
+      "SC2157"
+      "SC2155"
+    ];
+
+    text = ''
+      # Allow overriding the disk-by-id directory for testing
+      DISK_BY_ID_DIR="''${LIST_USB_DRIVES_DISK_DIR:-/dev/disk/by-id}"
+
+      # Mock lsblk for testing
+      if [ -n "''${LIST_USB_DRIVES_TEST_MODE:-}" ]; then
+        lsblk() {
+          echo "''$LIST_USB_DRIVES_MOCK_DATA" | tr '|' '\n' | while IFS=: read -r pattern response; do
+            case "$(basename "$3")" in *"$pattern"*) echo "$response"; return ;; esac
+          done || echo "UNKNOWN_MODEL UNKNOWN_SERIAL"
+        }
+      fi
+
+      # Scan for USB devices in the specified directory
+      if [ -d "$DISK_BY_ID_DIR" ]; then
+        find "$DISK_BY_ID_DIR" -name "usb*" | grep -v "part[0-9]\$" | while read -r drive; do lsblk -no model,serial "$drive" | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo \"$drive\" | cut -d':' -f2-)"; done | column -t --table-columns=DRIVE,BAY | sort -n -k 2
+      fi
+    '';
+  };
 }
diff --git a/tests/list-usb-drives.nix b/tests/list-usb-drives.nix
new file mode 100644
index 0000000..7b9f4f1
--- /dev/null
+++ b/tests/list-usb-drives.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  # Create pkgs with list-usb-drives overlay
+  testPkgs = import inputs.nixpkgs {
+    system = pkgs.system;
+    overlays = [ (import ../overlays.nix) ];
+  };
+in
+testPkgs.testers.runNixOSTest {
+  name = "list-usb-drives test";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        testPkgs.list-usb-drives
+      ];
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # Create mock USB device symlinks
+    machine.succeed("mkdir -p /tmp/mock-by-id")
+    machine.succeed("touch /tmp/mock-by-id/usb-drive1-0:0")
+    machine.succeed("touch /tmp/mock-by-id/usb-drive2-0:1") 
+    machine.succeed("touch /tmp/mock-by-id/usb-drive1-0:0-part1")  # Should be filtered out
+
+    # Test with mock data
+    mock_data = "drive1:Model1 Serial1|drive2:Model2 Serial2"
+    output = machine.succeed(f"LIST_USB_DRIVES_DISK_DIR=/tmp/mock-by-id LIST_USB_DRIVES_TEST_MODE=1 LIST_USB_DRIVES_MOCK_DATA='{mock_data}' list-usb-drives")
+
+    # Expected exact output
+    expected = 'DRIVE           BAY\nModel1_Serial1  0"\nModel2_Serial2  1"\n'
+
+    assert output == expected
+    print("✓ Mock USB device test passed")
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index e2b6e5e..2b6f125 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -11,4 +11,5 @@ in
   zfsTest = handleTest ./zfs.nix;
   testTest = handleTest ./testTest.nix;
   minecraftTest = handleTest ./minecraft.nix;
+  listUsbDrivesTest = handleTest ./list-usb-drives.nix;
 }

From 3349223489bcddfc577fc227897682770bd1bf48 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 19 Aug 2025 01:49:23 -0400
Subject: [PATCH 336/847] add list-usb-drivers

---
 configuration.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configuration.nix b/configuration.nix
index 7ce9232..faeb946 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -177,6 +177,7 @@
     lsof
 
     reflac
+    list-usb-drives
 
     pfetch-rs
 

From 23977c5f7ce8a9df066e41fd7c231ccf44f1c38d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 19 Aug 2025 23:25:15 -0400
Subject: [PATCH 337/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3974958..145111f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755514248,
-        "narHash": "sha256-uPg3P8pRR1B3/b/ddDvdSOTRm4zUBKU0XhwVFO6K2XM=",
+        "lastModified": 1755656257,
+        "narHash": "sha256-5IZbp78APGYBsdfhBWCPVEIH1I0j81sfiN+ctGiHW2o=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "618575c5825d7d4f170e686e772178d2aae148ae",
+        "rev": "a094f381432d92c4bf92d2d6167284316ba73a62",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755483699,
-        "narHash": "sha256-dj5cNx+WvDv5fbsE4h/Q6UuTttc/BHBE3BVGVn2TUNk=",
+        "lastModified": 1755655202,
+        "narHash": "sha256-UeQs2b1u99hthaiEqW/wkhL0aDDhp10/pA0keQqfkcY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "aa5ed59e2570c7adfd6f5ca6ec08fff3140d7565",
+        "rev": "fdd3b8ec61a25e5a1c9bbf2041d64129f51000a5",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755471983,
-        "narHash": "sha256-axUoWcm4cNQ36jOlnkD9D40LTfSQgk8ExfHSRm3rTtg=",
+        "lastModified": 1755593991,
+        "narHash": "sha256-BA9MuPjBDx/WnpTJ0EGhStyfE7hug8g85Y3Ju9oTsM4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb",
+        "rev": "a58390ab6f1aa810eb8e0f0fc74230e7cc06de03",
         "type": "github"
       },
       "original": {

From 5ea91cc19c0ad82f618322e4ba86a4789856dce2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 19 Aug 2025 23:48:04 -0400
Subject: [PATCH 338/847] delete list-usb-drives test

---
 overlays.nix              | 17 +--------------
 tests/list-usb-drives.nix | 46 ---------------------------------------
 tests/tests.nix           |  1 -
 3 files changed, 1 insertion(+), 63 deletions(-)
 delete mode 100644 tests/list-usb-drives.nix

diff --git a/overlays.nix b/overlays.nix
index 4139094..6595e99 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -61,22 +61,7 @@ final: prev: {
     ];
 
     text = ''
-      # Allow overriding the disk-by-id directory for testing
-      DISK_BY_ID_DIR="''${LIST_USB_DRIVES_DISK_DIR:-/dev/disk/by-id}"
-
-      # Mock lsblk for testing
-      if [ -n "''${LIST_USB_DRIVES_TEST_MODE:-}" ]; then
-        lsblk() {
-          echo "''$LIST_USB_DRIVES_MOCK_DATA" | tr '|' '\n' | while IFS=: read -r pattern response; do
-            case "$(basename "$3")" in *"$pattern"*) echo "$response"; return ;; esac
-          done || echo "UNKNOWN_MODEL UNKNOWN_SERIAL"
-        }
-      fi
-
-      # Scan for USB devices in the specified directory
-      if [ -d "$DISK_BY_ID_DIR" ]; then
-        find "$DISK_BY_ID_DIR" -name "usb*" | grep -v "part[0-9]\$" | while read -r drive; do lsblk -no model,serial "$drive" | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo \"$drive\" | cut -d':' -f2-)"; done | column -t --table-columns=DRIVE,BAY | sort -n -k 2
-      fi
+      find "$DISK_BY_ID_DIR" -name "usb*" | grep -v "part[0-9]\$" | while read -r drive; do lsblk -no model,serial "$drive" | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo \"$drive\" | cut -d':' -f2-)"; done | column -t --table-columns=DRIVE,BAY | sort -n -k 2
     '';
   };
 }
diff --git a/tests/list-usb-drives.nix b/tests/list-usb-drives.nix
deleted file mode 100644
index 7b9f4f1..0000000
--- a/tests/list-usb-drives.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  # Create pkgs with list-usb-drives overlay
-  testPkgs = import inputs.nixpkgs {
-    system = pkgs.system;
-    overlays = [ (import ../overlays.nix) ];
-  };
-in
-testPkgs.testers.runNixOSTest {
-  name = "list-usb-drives test";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [
-        testPkgs.list-usb-drives
-      ];
-    };
-
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("multi-user.target")
-
-    # Create mock USB device symlinks
-    machine.succeed("mkdir -p /tmp/mock-by-id")
-    machine.succeed("touch /tmp/mock-by-id/usb-drive1-0:0")
-    machine.succeed("touch /tmp/mock-by-id/usb-drive2-0:1") 
-    machine.succeed("touch /tmp/mock-by-id/usb-drive1-0:0-part1")  # Should be filtered out
-
-    # Test with mock data
-    mock_data = "drive1:Model1 Serial1|drive2:Model2 Serial2"
-    output = machine.succeed(f"LIST_USB_DRIVES_DISK_DIR=/tmp/mock-by-id LIST_USB_DRIVES_TEST_MODE=1 LIST_USB_DRIVES_MOCK_DATA='{mock_data}' list-usb-drives")
-
-    # Expected exact output
-    expected = 'DRIVE           BAY\nModel1_Serial1  0"\nModel2_Serial2  1"\n'
-
-    assert output == expected
-    print("✓ Mock USB device test passed")
-  '';
-}
diff --git a/tests/tests.nix b/tests/tests.nix
index 2b6f125..e2b6e5e 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -11,5 +11,4 @@ in
   zfsTest = handleTest ./zfs.nix;
   testTest = handleTest ./testTest.nix;
   minecraftTest = handleTest ./minecraft.nix;
-  listUsbDrivesTest = handleTest ./list-usb-drives.nix;
 }

From e4c3e88255e0bbb4820825ca1b923688f740c880 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 00:35:36 -0400
Subject: [PATCH 339/847] soulseek: change limits

---
 services/soulseek.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/soulseek.nix b/services/soulseek.nix
index 1d9fe2b..e351f1b 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -50,12 +50,12 @@ in
 
       global = {
         download = {
-          slots = 3;
-          speed_limit = 500;
+          slots = -1;
+          speed_limit = -1;
         };
         upload = {
           slots = 4;
-          speed_limit = 500;
+          speed_limit = 2000;
         };
       };
     };

From d94529bcba3124b4c3a873ec19af867f842e4085 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 05:25:29 -0400
Subject: [PATCH 340/847] add bitwarden

---
 configuration.nix      |  2 ++
 flake.nix              |  5 +++++
 services/bitwarden.nix | 49 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 services/bitwarden.nix

diff --git a/configuration.nix b/configuration.nix
index faeb946..086c9ca 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -32,6 +32,8 @@
     # ./services/llama-cpp.nix
 
     ./services/ups.nix
+
+    ./services/bitwarden.nix
   ];
 
   systemd.targets = {
diff --git a/flake.nix b/flake.nix
index 6b4496a..b18b27f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,6 +83,7 @@
           soulseek_web = 5030;
           soulseek_listen = 50300;
           llama_cpp = 8991;
+          vaultwarden = 8222;
         };
 
         https = {
@@ -132,6 +133,10 @@
           downloads = base + "/downloads";
           incomplete = base + "/incomplete";
         };
+
+        vaultwarden = {
+          path = "/var/lib/vaultwarden";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
new file mode 100644
index 0000000..fb52493
--- /dev/null
+++ b/services/bitwarden.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountDeps "vaultwarden" [
+      service_configs.vaultwarden.path
+      # config.services.vaultwarden.backupDir
+    ])
+    (lib.serviceMountDeps "backup-vaultwarden" [
+      service_configs.vaultwarden.path
+      # config.services.vaultwarden.backupDir
+    ])
+  ];
+
+  services.vaultwarden = {
+    enable = true;
+    # backupDir = "/${service_configs.zpool_ssds}/bak/vaultwarden";
+    # in order to avoid having  ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
+    # be aware that this file must be created by hand (or via secrets management like sops)
+    environmentFile = service_configs.vaultwarden.path + "/vaultwarden.env";
+    config = {
+      # Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
+      DOMAIN = "https://bitwarden.${service_configs.https.domain}";
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = service_configs.ports.vaultwarden;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.caddy.virtualHosts."bitwarden.${service_configs.https.domain}".extraConfig = ''
+    encode zstd gzip
+
+    reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
+        header_up X-Real-IP {remote_host}
+    }
+  '';
+
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
+    # "d ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
+  ];
+}

From 576dde154908f39d3cd4a6134c789244ddbb0245 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 10:11:42 -0400
Subject: [PATCH 341/847] bitwarden: fix backup

---
 services/bitwarden.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index fb52493..eba29fb 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -9,20 +9,17 @@
   imports = [
     (lib.serviceMountDeps "vaultwarden" [
       service_configs.vaultwarden.path
-      # config.services.vaultwarden.backupDir
+      config.services.vaultwarden.backupDir
     ])
     (lib.serviceMountDeps "backup-vaultwarden" [
       service_configs.vaultwarden.path
-      # config.services.vaultwarden.backupDir
+      config.services.vaultwarden.backupDir
     ])
   ];
 
   services.vaultwarden = {
     enable = true;
-    # backupDir = "/${service_configs.zpool_ssds}/bak/vaultwarden";
-    # in order to avoid having  ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
-    # be aware that this file must be created by hand (or via secrets management like sops)
-    environmentFile = service_configs.vaultwarden.path + "/vaultwarden.env";
+    backupDir = "/${service_configs.zpool_ssds}/bak/vaultwarden";
     config = {
       # Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
       DOMAIN = "https://bitwarden.${service_configs.https.domain}";
@@ -44,6 +41,6 @@
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
-    # "d ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
+    "d ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
   ];
 }

From 447982a10a6f6fa0f43ddc3d3c2411960b471be0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 10:28:42 -0400
Subject: [PATCH 342/847] cleanup

---
 configuration.nix        | 10 ++++++----
 flake.nix                |  7 +++----
 home.nix                 | 34 +++++++++++++++-------------------
 services/jellyfin.nix    |  6 ++----
 services/qbittorrent.nix | 11 +++--------
 5 files changed, 29 insertions(+), 39 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 086c9ca..df27387 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -107,6 +107,7 @@
 
   system.activationScripts = {
     # extract all my secureboot keys
+    # TODO! awful secrets management, it's globally readable in /nix/store
     "secureboot-keys".text = ''
       #!/bin/sh
       rm -fr ${config.boot.lanzaboote.pkiBundle} || true
@@ -216,7 +217,7 @@
     {
       description = "disable rgb";
       serviceConfig = {
-        ExecStart = "${lib.getExe no-rgb}";
+        ExecStart = lib.getExe no-rgb;
         Type = "oneshot";
       };
       wantedBy = [ "multi-user.target" ];
@@ -268,7 +269,7 @@
     # };
   };
 
-  users.groups.${service_configs.torrent_group} = { };
+  users.groups.${service_configs.media_group} = { };
 
   users.users.${username} = {
     isNormalUser = true;
@@ -276,10 +277,11 @@
       "wheel"
       "video"
       "render"
-      service_configs.torrent_group
+      service_configs.media_group
     ];
 
-    hashedPasswordFile = builtins.toString ./secrets/hashedPass;
+    # TODO! use proper secrets management
+    # hashedPasswordFile = builtins.toString ./secrets/hashedPass;
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
diff --git a/flake.nix b/flake.nix
index b18b27f..50f9109 100644
--- a/flake.nix
+++ b/flake.nix
@@ -70,7 +70,7 @@
         torrents_path = "/torrents";
         services_dir = "/${zpool_ssds}/services";
         music_dir = "/${zpool_ssds}/music";
-        torrent_group = "media";
+        media_group = "media";
 
         ports = {
           https = 443;
@@ -148,16 +148,15 @@
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
-      nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.${hostname} = lib.nixosSystem {
         inherit system;
-        specialArgs = rec {
+        specialArgs = {
           inherit
             username
             hostname
             eth_interface
             service_configs
             inputs
-            lib
             ;
         };
         modules = [
diff --git a/home.nix b/home.nix
index 893dae0..050e42d 100644
--- a/home.nix
+++ b/home.nix
@@ -1,36 +1,32 @@
 {
   pkgs,
   username,
-  stateVersion,
+  lib,
   ...
 }:
 {
   home.stateVersion = "24.11";
-  programs.fish =
-    let
-      eza = "${pkgs.eza}/bin/eza --color=always --group-directories-first";
-      coreutils = "${pkgs.coreutils}/bin";
-    in
-    {
-      enable = true;
+  programs.fish = {
+    enable = true;
 
-      interactiveShellInit = ''
-        #disable greeting
-        set fish_greeting
+    interactiveShellInit = ''
+      # disable greeting
+      set fish_greeting
 
-        #fixes gnupg password entry
-        export GPG_TTY=(${coreutils}/tty)
+      # pfetch on shell start (disable pkgs because of execution time)
+      PF_INFO="ascii title os host kernel uptime memory editor wm" ${lib.getExe pkgs.pfetch-rs}
+    '';
 
-        #pfetch on shell start (disable pkgs because of execution time)
-        PF_INFO="ascii title os host kernel uptime memory editor wm" ${pkgs.pfetch-rs}/bin/pfetch
-      '';
-
-      shellAliases = {
+    shellAliases =
+      let
+        eza = "${lib.getExe pkgs.eza} --color=always --group-directories-first";
+      in
+      {
         # from DistroTube's dot files: Changing "ls" to "eza"
         ls = "${eza} -al";
         la = "${eza} -a";
         ll = "${eza} -l";
         lt = "${eza} -aT";
       };
-    };
+  };
 }
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 0ca5469..a7f187c 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -20,8 +20,7 @@
     openFirewall = true;
     package = pkgs.jellyfin.override { jellyfin-ffmpeg = (lib.optimizePackage pkgs.jellyfin-ffmpeg); };
 
-    dataDir = service_configs.jellyfin.dataDir;
-    cacheDir = service_configs.jellyfin.cacheDir;
+    inherit (service_configs.jellyfin) dataDir cacheDir;
   };
 
   services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
@@ -39,8 +38,7 @@
   users.users.${config.services.jellyfin.user}.extraGroups = [
     "video"
     "render"
-    service_configs.torrent_group
-    "media"
+    service_configs.media_group
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index d84f445..15d78af 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -215,8 +215,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0750 ${config.services.qbittorrent.user} ${service_configs.torrent_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
   ];
 
   # make qbittorrent use a vpn
@@ -231,11 +231,6 @@
   '';
 
   users.users.${config.services.qbittorrent.user}.extraGroups = [
-    service_configs.torrent_group
+    service_configs.media_group
   ];
-
-  users.users.${username}.extraGroups = [
-    config.services.qbittorrent.group
-  ];
-
 }

From 53ca62737186903ed027e1a20b76f6dc77e47c72 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 10:41:31 -0400
Subject: [PATCH 343/847] cleanup caddy

---
 services/caddy.nix     |  6 +++---
 services/minecraft.nix | 26 +++++++++++++-------------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 8f7ebed..7a6895c 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -9,7 +9,7 @@
 {
   imports = [
     (lib.serviceMountDeps "caddy" [
-      "/var/lib/caddy"
+      config.services.caddy.dataDir
       service_configs.https.data_dir
     ])
   ];
@@ -30,8 +30,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} 750 ${config.services.caddy.user} ${config.services.caddy.group}"
-    "d /var/lib/caddy 750 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${service_configs.https.data_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
+    "d ${config.services.caddy.dataDir} 700 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 
   systemd.packages = with pkgs; [ nssTools ];
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d87e5e7..a0af58b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -116,21 +116,21 @@
     };
   };
 
-  services.caddy.virtualHosts."map.${service_configs.https.domain}".extraConfig = ''
-    root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
-    file_server browse
-  '';
+  services.caddy.virtualHosts = lib.mkIf (config.services.caddy.enable) {
+    "map.${service_configs.https.domain}".extraConfig = ''
+      root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
+      file_server browse
+    '';
+  };
 
-  users.users.${config.services.caddy.user}.extraGroups = [
-    # for `map.gardling.com`
-    "minecraft"
-  ];
+  users.users = lib.mkIf (config.services.caddy.enable) {
+    ${config.services.caddy.user}.extraGroups = [
+      # for `map.gardling.com`
+      "minecraft"
+    ];
+  };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 minecraft minecraft"
-  ];
-
-  users.users.${username}.extraGroups = [
-    "minecraft"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
 }

From f392f87b06a038e70b5bd7cac4be9988bb3805b2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 11:53:29 -0400
Subject: [PATCH 344/847] heavily simplify list-usb-drives

---
 overlays.nix | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/overlays.nix b/overlays.nix
index 6595e99..d8f827b 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -48,20 +48,11 @@ final: prev: {
     name = "list-usb-drives";
     runtimeInputs = with prev; [
       findutils
-      gawk
       coreutils
-      gnugrep
-      util-linux
-    ];
-
-    excludeShellChecks = [
-      "SC2086"
-      "SC2157"
-      "SC2155"
     ];
 
     text = ''
-      find "$DISK_BY_ID_DIR" -name "usb*" | grep -v "part[0-9]\$" | while read -r drive; do lsblk -no model,serial "$drive" | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo \"$drive\" | cut -d':' -f2-)"; done | column -t --table-columns=DRIVE,BAY | sort -n -k 2
+      find "/dev/disk/by-id" -name "usb*" -not -name "*-part[0-9]" -printf "%f\n" | sed 's/^usb\-//g' | sed 's/\-[0-9]*\:/ /g' | column -t --table-columns=DRIVE,BAY | sort -n -k 2
     '';
   };
 }

From 82474060505f89da7f22ec0c42bc102a18f9ebee Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 11:53:47 -0400
Subject: [PATCH 345/847] rm NOTES.md

---
 NOTES.md | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 NOTES.md

diff --git a/NOTES.md b/NOTES.md
deleted file mode 100644
index c54d286..0000000
--- a/NOTES.md
+++ /dev/null
@@ -1,7 +0,0 @@
-## List drives in external usb bay
-
-fish shell script:
-```fish
-find /dev/disk/by-id -name "usb*" | grep -v "part[0-9]\$" | while read drive; lsblk -no model,serial $drive | head -n1 | tr -d '\n' | tr " " "_" && echo -e " $(echo $drive | cut -d':' -f2-)"; end | column -t --table-columns=DRIVE,BAY | sort -n -k 2
-```
-

From 00ca7a4d3b8fa1ddc2b06dbc69bdcd1bd1bd9e29 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 12:15:30 -0400
Subject: [PATCH 346/847] qbt: cleanup

---
 services/qbittorrent.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 15d78af..1b23100 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -11,7 +11,7 @@
     (lib.serviceMountDeps "qbittorrent" [
       service_configs.torrents_path
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
-      "/var/lib/qBittorrent/qBittorrent"
+      "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
   ];
 
@@ -34,8 +34,8 @@
 
   services.qbittorrent = {
     enable = true;
-    package = pkgs.qbittorrent-nox;
     webuiPort = service_configs.ports.torrent;
+    profileDir = "/var/lib/qBittorrent";
 
     serverConfig.LegalNotice.Accepted = true;
 
@@ -44,8 +44,8 @@
         AlternativeUIEnabled = true;
         RootFolder = builtins.toString (
           pkgs.fetchzip {
-            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.26.0/vuetorrent.zip";
-            sha256 = "EFVzsr/OZ/QMJ+NN3kDkmIk6FCCnqgK6DgsLWNonspU=";
+            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.28.2/vuetorrent.zip";
+            sha256 = "8aKmiXcr2pp8qt4w/lYBAIjLPh8tlgYsx6PbovY54KM=";
           }
         );
 
@@ -55,8 +55,7 @@
       };
 
       Downloads = {
-        SavePath = service_configs.torrent.SavePath;
-        TempPath = service_configs.torrent.TempPath;
+        inherit (service_configs.torrent) SavePath TempPath;
       };
     };
 
@@ -67,7 +66,7 @@
 
         IgnoreLimitsOnLAN = true;
 
-        IncludeOverheadInLimits = true;
+        IncludeOverheadInLimits = false;
 
         GlobalMaxRatio = 6.0;
         QueueingSystemEnabled = false; # seed all torrents all the time
@@ -201,7 +200,7 @@
         AnnounceToAllTrackers = true;
 
         # idk why it also has to be specified here too?
-        TempPath = config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath;
+        inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
         # how many connections per sec
@@ -217,6 +216,7 @@
   systemd.tmpfiles.rules = [
     "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
     "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+    "d ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
   ];
 
   # make qbittorrent use a vpn

From c9450383e4cb00531b23713699659b82cd0e37e6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 12:28:13 -0400
Subject: [PATCH 347/847] create 'lib.vpnNamespaceOpenPort'

---
 lib.nix                  | 21 +++++++++++++++++++++
 services/bitmagnet.nix   | 19 ++++---------------
 services/qbittorrent.nix | 18 +-----------------
 3 files changed, 26 insertions(+), 32 deletions(-)

diff --git a/lib.nix b/lib.nix
index ef658f0..45872ba 100644
--- a/lib.nix
+++ b/lib.nix
@@ -54,5 +54,26 @@ inputs.nixpkgs.lib.extend (
         "-march=znver3"
         "-mtune=znver3"
       ];
+
+    vpnNamespaceOpenPort =
+      port:
+      { ... }:
+      {
+        vpnNamespaces.wg = {
+          portMappings = [
+            {
+              from = port;
+              to = port;
+            }
+          ];
+
+          openVPNPorts = [
+            {
+              port = port;
+              protocol = "both";
+            }
+          ];
+        };
+      };
   }
 )
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 5396fe3..571112a 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -2,24 +2,13 @@
   pkgs,
   service_configs,
   config,
+  lib,
   ...
 }:
 {
-  vpnNamespaces.wg = {
-    portMappings = [
-      {
-        from = service_configs.ports.bitmagnet;
-        to = service_configs.ports.bitmagnet;
-      }
-    ];
-
-    openVPNPorts = [
-      {
-        port = service_configs.ports.bitmagnet;
-        protocol = "both";
-      }
-    ];
-  };
+  imports = [
+    (lib.vpnNamespaceOpenPort service_configs.ports.bitmagnet)
+  ];
 
   services.bitmagnet = {
     enable = true;
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 1b23100..dc8482c 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -13,25 +13,9 @@
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
+    (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort)
   ];
 
-  # network namespace that is proxied through mullvad
-  vpnNamespaces.wg = {
-    portMappings = [
-      {
-        from = config.services.qbittorrent.webuiPort;
-        to = config.services.qbittorrent.webuiPort;
-      }
-    ];
-
-    openVPNPorts = [
-      {
-        port = config.services.qbittorrent.webuiPort;
-        protocol = "both";
-      }
-    ];
-  };
-
   services.qbittorrent = {
     enable = true;
     webuiPort = service_configs.ports.torrent;

From 60f4f507baa3c86473884286754d7e7aef573ccb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 12:31:31 -0400
Subject: [PATCH 348/847] format

---
 lib.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib.nix b/lib.nix
index 45872ba..9316287 100644
--- a/lib.nix
+++ b/lib.nix
@@ -9,7 +9,6 @@ inputs.nixpkgs.lib.extend (
     lib = prev;
   in
   {
-
     serviceMountDeps =
       serviceName: dirs:
       { pkgs, ... }:

From 1bfbfdbbba9d362453dbb0550b4ba19b7440df2c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 20 Aug 2025 12:33:27 -0400
Subject: [PATCH 349/847] expand vpnNamespaceOpenPort

---
 lib.nix                  | 6 +++++-
 services/bitmagnet.nix   | 7 +------
 services/qbittorrent.nix | 8 +-------
 3 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/lib.nix b/lib.nix
index 9316287..5fa56af 100644
--- a/lib.nix
+++ b/lib.nix
@@ -55,7 +55,7 @@ inputs.nixpkgs.lib.extend (
       ];
 
     vpnNamespaceOpenPort =
-      port:
+      port: service:
       { ... }:
       {
         vpnNamespaces.wg = {
@@ -73,6 +73,10 @@ inputs.nixpkgs.lib.extend (
             }
           ];
         };
+        systemd.services.${service}.vpnConfinement = {
+          enable = true;
+          vpnNamespace = "wg";
+        };
       };
   }
 )
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 571112a..cebecc6 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -7,7 +7,7 @@
 }:
 {
   imports = [
-    (lib.vpnNamespaceOpenPort service_configs.ports.bitmagnet)
+    (lib.vpnNamespaceOpenPort service_configs.ports.bitmagnet "bitmagnet")
   ];
 
   services.bitmagnet = {
@@ -28,9 +28,4 @@
     ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
   '';
-
-  systemd.services.bitmagnet.vpnConfinement = {
-    enable = true;
-    vpnNamespace = "wg";
-  };
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index dc8482c..f35c061 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -13,7 +13,7 @@
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
-    (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort)
+    (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
   ];
 
   services.qbittorrent = {
@@ -203,12 +203,6 @@
     "d ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
   ];
 
-  # make qbittorrent use a vpn
-  systemd.services.qbittorrent.vpnConfinement = {
-    enable = true;
-    vpnNamespace = "wg";
-  };
-
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
     ${builtins.readFile ../secrets/caddy_auth}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}

From a0cd8e1fdfa6f7943092761234d151448d649022 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 21 Aug 2025 05:02:05 -0400
Subject: [PATCH 350/847] add lib.serviceDependZpool

---
 lib.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib.nix b/lib.nix
index 5fa56af..bb21808 100644
--- a/lib.nix
+++ b/lib.nix
@@ -78,5 +78,24 @@ inputs.nixpkgs.lib.extend (
           vpnNamespace = "wg";
         };
       };
+
+    serviceDependZpool =
+      serviceName: zpool:
+      { config, ... }:
+      {
+        systemd.services.${serviceName} = {
+          wants = [ "zfs-import-${zpool}.service" ];
+          after = [ "zfs-import-${zpool}.service" ];
+          requires = [ "zfs-import-${zpool}.service" ];
+        };
+
+        # assert that the pool is even enabled
+        config.assertions = [
+          {
+            assertion = builtins.elem zpool config.boot.zfs.extraPools;
+            message = "${zpool} is not enabled in `boot.zfs.extraPools`";
+          }
+        ];
+      };
   }
 )

From 747db98795ba91b7bc1b9dce22bc983515f68d3a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 21 Aug 2025 05:06:03 -0400
Subject: [PATCH 351/847] use lib.serviceDependZpool

---
 services/bitwarden.nix   | 2 ++
 services/caddy.nix       | 1 +
 services/gitea.nix       | 1 +
 services/immich.nix      | 2 ++
 services/jellyfin.nix    | 1 +
 services/minecraft.nix   | 1 +
 services/postgresql.nix  | 1 +
 services/qbittorrent.nix | 1 +
 services/soulseek.nix    | 2 ++
 9 files changed, 12 insertions(+)

diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index eba29fb..59f8f3c 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -15,6 +15,8 @@
       service_configs.vaultwarden.path
       config.services.vaultwarden.backupDir
     ])
+    (lib.serviceDependZpool "vaultwarden" service_configs.zpool_ssds)
+    (lib.serviceDependZpool "backup-vaultwarden" service_configs.zpool_ssds)
   ];
 
   services.vaultwarden = {
diff --git a/services/caddy.nix b/services/caddy.nix
index 7a6895c..0cbe8a0 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -12,6 +12,7 @@
       config.services.caddy.dataDir
       service_configs.https.data_dir
     ])
+    (lib.serviceDependZpool "caddy" service_configs.zpool_ssds)
   ];
 
   services.caddy = {
diff --git a/services/gitea.nix b/services/gitea.nix
index 593d2c1..040072d 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -9,6 +9,7 @@
 {
   imports = [
     (lib.serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
+    (lib.serviceDependZpool "gitea" service_configs.zpool_ssds)
   ];
 
   services.gitea = {
diff --git a/services/immich.nix b/services/immich.nix
index f89b149..ad2df48 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -10,6 +10,8 @@
   imports = [
     (lib.serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ])
     (lib.serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ])
+    (lib.serviceDependZpool "immich-server" service_configs.zpool_ssds)
+    (lib.serviceDependZpool "immich-machine-learning" service_configs.zpool_ssds)
   ];
 
   services.immich = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index a7f187c..fedf687 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -12,6 +12,7 @@
       config.services.jellyfin.dataDir
       config.services.jellyfin.cacheDir
     ])
+    (lib.serviceDependZpool "jellyfin" service_configs.zpool_ssds)
   ];
 
   services.jellyfin = {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index a0af58b..4dd5e59 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -11,6 +11,7 @@
     (lib.serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
       "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
     ])
+    (lib.serviceDependZpool "minecraft-server-${service_configs.minecraft.server_name}" service_configs.zpool_ssds)
   ];
 
   environment.systemPackages = [
diff --git a/services/postgresql.nix b/services/postgresql.nix
index 58086a7..5a2207a 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -9,6 +9,7 @@
 {
   imports = [
     (lib.serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ])
+    (lib.serviceDependZpool "postgresql" service_configs.zpool_ssds)
   ];
 
   services.postgresql = {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f35c061..3989d1a 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -14,6 +14,7 @@
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
     (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
+    (lib.serviceDependZpool "qbittorrent" service_configs.zpool_hdds)
   ];
 
   services.qbittorrent = {
diff --git a/services/soulseek.nix b/services/soulseek.nix
index e351f1b..72536e7 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -16,6 +16,8 @@ in
       service_configs.slskd.downloads
       service_configs.slskd.incomplete
     ])
+    (lib.serviceDependZpool "slskd" service_configs.zpool_ssds)
+    (lib.serviceDependZpool "slskd" service_configs.zpool_hdds)
   ];
 
   users.groups."music" = { };

From 39fcf4e93bfd3106da18f24549676265f7fd0d59 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 21 Aug 2025 05:12:31 -0400
Subject: [PATCH 352/847] fix minecraft test

---
 lib.nix             | 26 ++++++++++++++------------
 tests/minecraft.nix |  1 +
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/lib.nix b/lib.nix
index bb21808..64fa140 100644
--- a/lib.nix
+++ b/lib.nix
@@ -83,19 +83,21 @@ inputs.nixpkgs.lib.extend (
       serviceName: zpool:
       { config, ... }:
       {
-        systemd.services.${serviceName} = {
-          wants = [ "zfs-import-${zpool}.service" ];
-          after = [ "zfs-import-${zpool}.service" ];
-          requires = [ "zfs-import-${zpool}.service" ];
-        };
+        config = lib.mkIf (zpool != "") {
+          systemd.services.${serviceName} = {
+            wants = [ "zfs-import-${zpool}.service" ];
+            after = [ "zfs-import-${zpool}.service" ];
+            requires = [ "zfs-import-${zpool}.service" ];
+          };
 
-        # assert that the pool is even enabled
-        config.assertions = [
-          {
-            assertion = builtins.elem zpool config.boot.zfs.extraPools;
-            message = "${zpool} is not enabled in `boot.zfs.extraPools`";
-          }
-        ];
+          # assert that the pool is even enabled
+          assertions = [
+            {
+              assertion = builtins.elem zpool config.boot.zfs.extraPools;
+              message = "${zpool} is not enabled in `boot.zfs.extraPools`";
+            }
+          ];
+        };
       };
   }
 )
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 12ac132..bfb706c 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -32,6 +32,7 @@ let
             https = {
               domain = "test.local";
             };
+            zpool_ssds = "";
           };
           username = "testuser";
         })

From dd59289b2a88f1c9ce50f1bbf84185f92b69c4e1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 21 Aug 2025 18:24:34 -0400
Subject: [PATCH 353/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 145111f..31f2928 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753592768,
-        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
+        "lastModified": 1755776884,
+        "narHash": "sha256-CPM7zm6csUx7vSfKvzMDIjepEJv1u/usmaT7zydzbuI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
+        "rev": "4fb695d10890e9fc6a19deadf85ff79ffb78da86",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755656257,
-        "narHash": "sha256-5IZbp78APGYBsdfhBWCPVEIH1I0j81sfiN+ctGiHW2o=",
+        "lastModified": 1755810572,
+        "narHash": "sha256-rkD7z9FaoRk0X1ZsYZgwggWPHS5kAPf+rsTYrOnSqOo=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "a094f381432d92c4bf92d2d6167284316ba73a62",
+        "rev": "54a241f505d515d625767b993bfd573ecee306b9",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755655202,
-        "narHash": "sha256-UeQs2b1u99hthaiEqW/wkhL0aDDhp10/pA0keQqfkcY=",
+        "lastModified": 1755741527,
+        "narHash": "sha256-XBP8Ld94EsXi/42MQ6H0If1vCdWPf+N6RA9M+2Wuos0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "fdd3b8ec61a25e5a1c9bbf2041d64129f51000a5",
+        "rev": "a13d8cd9cef44144db3bc7333882916f4454aa91",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755593991,
-        "narHash": "sha256-BA9MuPjBDx/WnpTJ0EGhStyfE7hug8g85Y3Ju9oTsM4=",
+        "lastModified": 1755704039,
+        "narHash": "sha256-gKlP0LbyJ3qX0KObfIWcp5nbuHSb5EHwIvU6UcNBg2A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a58390ab6f1aa810eb8e0f0fc74230e7cc06de03",
+        "rev": "9cb344e96d5b6918e94e1bca2d9f3ea1e9615545",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755479226,
-        "narHash": "sha256-G7AVmVJhqMraf1iqMoyQ/aWuYvcFFFrMMkrMjWwVyHY=",
+        "lastModified": 1755770475,
+        "narHash": "sha256-piB4s87GvBJkzWLbzOMyX4adjMBmTMxzMu0SNT/b8hU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "b2eeb75153c3e2c7c82991a5c335de3b6c151f51",
+        "rev": "bebcf12b45df0b7d6f422ebd5da06f92b52169a8",
         "type": "github"
       },
       "original": {

From b9a7fe75dbe03055d253f98871cd356d13cce1a4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 00:37:38 -0400
Subject: [PATCH 354/847] zfs_unstable -> zfs

---
 zfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zfs.nix b/zfs.nix
index 70e4fde..4787dbb 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -17,7 +17,7 @@ in
     '';
   };
 
-  boot.zfs.package = pkgs.zfs_unstable;
+  boot.zfs.package = pkgs.zfs;
   boot.initrd.kernelModules = [ "zfs" ];
 
   boot.kernelParams =

From b062f5d532744b3c611605be62150005b8cbd89d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 00:39:01 -0400
Subject: [PATCH 355/847] zfs: add comments about secrets

---
 zfs.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zfs.nix b/zfs.nix
index 4787dbb..8dd552d 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -4,10 +4,13 @@
   ...
 }:
 let
+  # DO NOT CHANGE
+  # path is set via a zfs property
   zfs-key = "/etc/zfs-key";
 in
 {
   system.activationScripts = {
+    # TODO! replace with proper secrets management
     "zfs-key".text = ''
       #!/bin/sh
       rm -fr ${zfs-key} || true

From b6a66cde0c4731f905442c328fa827b3ef5e47e6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 00:46:59 -0400
Subject: [PATCH 356/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 31f2928..7c95e2b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755776884,
-        "narHash": "sha256-CPM7zm6csUx7vSfKvzMDIjepEJv1u/usmaT7zydzbuI=",
+        "lastModified": 1755928099,
+        "narHash": "sha256-OILVkfhRCm8u18IZ2DKR8gz8CVZM2ZcJmQBXmjFLIfk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4fb695d10890e9fc6a19deadf85ff79ffb78da86",
+        "rev": "4a44fb9f7555da362af9d499817084f4288a957f",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755810572,
-        "narHash": "sha256-rkD7z9FaoRk0X1ZsYZgwggWPHS5kAPf+rsTYrOnSqOo=",
+        "lastModified": 1756089141,
+        "narHash": "sha256-B9mvV4OLk5He3JKWKHFQw+ZgzuMq+mhcsAhYBblyg8w=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "54a241f505d515d625767b993bfd573ecee306b9",
+        "rev": "c247d06f38fc09059c9607a28aa44f5ff6be208d",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755741527,
-        "narHash": "sha256-XBP8Ld94EsXi/42MQ6H0If1vCdWPf+N6RA9M+2Wuos0=",
+        "lastModified": 1756001439,
+        "narHash": "sha256-IdIgQP6nfHgzn+pRSzm+mHiU0mwbQvOmusv+LrpSBrk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a13d8cd9cef44144db3bc7333882916f4454aa91",
+        "rev": "3a015545c12704bdeca89f3e77cacc68acd3ddb1",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755704039,
-        "narHash": "sha256-gKlP0LbyJ3qX0KObfIWcp5nbuHSb5EHwIvU6UcNBg2A=",
+        "lastModified": 1755922037,
+        "narHash": "sha256-wY1+2JPH0ZZC4BQefoZw/k+3+DowFyfOxv17CN/idKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9cb344e96d5b6918e94e1bca2d9f3ea1e9615545",
+        "rev": "b1b3291469652d5a2edb0becc4ef0246fff97a7c",
         "type": "github"
       },
       "original": {

From b6356e791556960c16af25bb856ca228a44c1627 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 11:13:27 -0400
Subject: [PATCH 357/847] qbt: restrict permissions around TempPath

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 3989d1a..0105a02 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -200,7 +200,7 @@
 
   systemd.tmpfiles.rules = [
     "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
     "d ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
   ];
 

From 8a2bb66fd68667078d3d9c3be835b083f0c01ecb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 13:08:27 -0400
Subject: [PATCH 358/847] qbt: use pkgs.vuetorrent

---
 services/qbittorrent.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 0105a02..3de6634 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -27,12 +27,7 @@
     serverConfig.Preferences = {
       WebUI = {
         AlternativeUIEnabled = true;
-        RootFolder = builtins.toString (
-          pkgs.fetchzip {
-            url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.28.2/vuetorrent.zip";
-            sha256 = "8aKmiXcr2pp8qt4w/lYBAIjLPh8tlgYsx6PbovY54KM=";
-          }
-        );
+        RootFolder = builtins.toString pkgs.vuetorrent;
 
         # disable auth because we use caddy for auth
         AuthSubnetWhitelist = "0.0.0.0/0";

From 48566bfdd1b80063347832f6c1016e40fbd67b24 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 13:20:11 -0400
Subject: [PATCH 359/847] zfs: change arc size setting

---
 zfs.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/zfs.nix b/zfs.nix
index 8dd552d..8e5dbe9 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -25,10 +25,13 @@ in
 
   boot.kernelParams =
     let
-      mb = 20000;
+      gb = 20;
+      mb = gb * 1000;
+      kb = mb * 1000;
+      b = kb * 1000;
     in
     [
-      "zfs.zfs_arc_max=${builtins.toString (mb * 1000000)}"
+      "zfs.zfs_arc_max=${builtins.toString b}"
     ];
 
   boot.supportedFilesystems = [ "zfs" ];

From 3770299037e73740c6a1fc7ba2814b99e7c98a6f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 25 Aug 2025 13:29:20 -0400
Subject: [PATCH 360/847] qbt: fix pkgs.vuetorrent path

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 3de6634..28f541e 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -27,7 +27,7 @@
     serverConfig.Preferences = {
       WebUI = {
         AlternativeUIEnabled = true;
-        RootFolder = builtins.toString pkgs.vuetorrent;
+        RootFolder = "${pkgs.vuetorrent}/share/vuetorrent";
 
         # disable auth because we use caddy for auth
         AuthSubnetWhitelist = "0.0.0.0/0";

From fe179c260b12326030a75e120193dfcd94ffe1da Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 28 Aug 2025 21:54:44 -0400
Subject: [PATCH 361/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7c95e2b..42b4ddb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755519972,
-        "narHash": "sha256-bU4nqi3IpsUZJeyS8Jk85ytlX61i4b0KCxXX9YcOgVc=",
+        "lastModified": 1756115622,
+        "narHash": "sha256-iv8xVtmLMNLWFcDM/HcAPLRGONyTRpzL9NS09RnryRM=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4073ff2f481f9ef3501678ff479ed81402caae6d",
+        "rev": "bafad29f89e83b2d861b493aa23034ea16595560",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755928099,
-        "narHash": "sha256-OILVkfhRCm8u18IZ2DKR8gz8CVZM2ZcJmQBXmjFLIfk=",
+        "lastModified": 1756245065,
+        "narHash": "sha256-aAZNbGcWrVRZgWgkQbkabSGcDVRDMgON4BipMy69gvI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4a44fb9f7555da362af9d499817084f4288a957f",
+        "rev": "54b2879ce622d44415e727905925e21b8f833a98",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756089141,
-        "narHash": "sha256-B9mvV4OLk5He3JKWKHFQw+ZgzuMq+mhcsAhYBblyg8w=",
+        "lastModified": 1756427971,
+        "narHash": "sha256-g+GVbZSWXlhBWF2KZk+NYPwpJsXdtbET2AAE3p2VupI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c247d06f38fc09059c9607a28aa44f5ff6be208d",
+        "rev": "e8d99dd0b67f2ecc1e45fca8074a3a18c3e036d2",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756001439,
-        "narHash": "sha256-IdIgQP6nfHgzn+pRSzm+mHiU0mwbQvOmusv+LrpSBrk=",
+        "lastModified": 1756406526,
+        "narHash": "sha256-N2bpIuvXq1vjFU9+CeHu3JMmWYrD9m6mtjx/iWZpxio=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "3a015545c12704bdeca89f3e77cacc68acd3ddb1",
+        "rev": "b0e55f47b8729227eccc8bdb8de2459ac14f69ed",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1755330281,
-        "narHash": "sha256-aJHFJWP9AuI8jUGzI77LYcSlkA9wJnOIg4ZqftwNGXA=",
+        "lastModified": 1756245047,
+        "narHash": "sha256-9bHzrVbjAudbO8q4vYFBWlEkDam31fsz0J7GB8k4AsI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3dac8a872557e0ca8c083cdcfc2f218d18e113b0",
+        "rev": "a65b650d6981e23edd1afa1f01eb942f19cdcbb7",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755922037,
-        "narHash": "sha256-wY1+2JPH0ZZC4BQefoZw/k+3+DowFyfOxv17CN/idKs=",
+        "lastModified": 1756217674,
+        "narHash": "sha256-TH1SfSP523QI7kcPiNtMAEuwZR3Jdz0MCDXPs7TS8uo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b1b3291469652d5a2edb0becc4ef0246fff97a7c",
+        "rev": "4e7667a90c167f7a81d906e5a75cba4ad8bee620",
         "type": "github"
       },
       "original": {

From 950b34bec7dbe216c2acc1f2ba66077cdba0bd6e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 29 Aug 2025 00:43:14 -0400
Subject: [PATCH 362/847] minecraft: restrict permissions more

---
 services/minecraft.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 4dd5e59..d8cbeef 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -132,6 +132,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
 }

From 8bc87d497bad7a4e0702a42c7bb9402feb81a0ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 30 Aug 2025 02:28:10 -0400
Subject: [PATCH 363/847] qbt: adjust settings

---
 services/qbittorrent.nix | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 28f541e..ad1c7d4 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -41,20 +41,24 @@
 
     serverConfig.BitTorrent = {
       Session = {
+        MaxConnectionsPerTorrent = 10;
+        MaxUploadsPerTorrent = 10;
+        MaxConnections = -1;
+        MaxUploads = -1;
+
+        MaxActiveCheckingTorrents = 5;
+
+        # queueing
+        QueueingSystemEnabled = true;
+        MaxActiveDownloads = 2; # num of torrents that can download at the same time
+        MaxActiveUploads = 20;
+        IgnoreSlowTorrentsForQueueing = true;
+
         GlobalUPSpeedLimit = 0; # unlimited upload
         GlobalDLSpeedLimit = 0; # unlimited download
-
-        IgnoreLimitsOnLAN = true;
-
         IncludeOverheadInLimits = false;
 
         GlobalMaxRatio = 6.0;
-        QueueingSystemEnabled = false; # seed all torrents all the time
-
-        MaxConnections = -1;
-        MaxConnectionsPerTorrent = -1;
-        MaxUploads = -1;
-        MaxUploadsPerTorrent = -1;
 
         AddTrackersEnabled = true;
         AdditionalTrackers = (

From 785e454f33f1df9f30bc545e2d092d6041c3b63d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 30 Aug 2025 19:49:55 -0400
Subject: [PATCH 364/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 42b4ddb..8a75894 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756427971,
-        "narHash": "sha256-g+GVbZSWXlhBWF2KZk+NYPwpJsXdtbET2AAE3p2VupI=",
+        "lastModified": 1756569822,
+        "narHash": "sha256-APfXfPGatztK0U9dbjE0sA0cenf1R+ZSV1Rm4xt/gfQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e8d99dd0b67f2ecc1e45fca8074a3a18c3e036d2",
+        "rev": "4d74393bcc956ccd7df68a6a06d1a0575cfa712c",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756406526,
-        "narHash": "sha256-N2bpIuvXq1vjFU9+CeHu3JMmWYrD9m6mtjx/iWZpxio=",
+        "lastModified": 1756518625,
+        "narHash": "sha256-Mxh2wumeSsb968dSDksblubQqHTTdRTC5lH0gmhq9jI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b0e55f47b8729227eccc8bdb8de2459ac14f69ed",
+        "rev": "92654796f8f6c3279e4b7d409a3e5b43b0539a19",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756217674,
-        "narHash": "sha256-TH1SfSP523QI7kcPiNtMAEuwZR3Jdz0MCDXPs7TS8uo=",
+        "lastModified": 1756469547,
+        "narHash": "sha256-YvtD2E7MYsQ3r7K9K2G7nCslCKMPShoSEAtbjHLtH0k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4e7667a90c167f7a81d906e5a75cba4ad8bee620",
+        "rev": "41d292bfc37309790f70f4c120b79280ce40af16",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755770475,
-        "narHash": "sha256-piB4s87GvBJkzWLbzOMyX4adjMBmTMxzMu0SNT/b8hU=",
+        "lastModified": 1756506247,
+        "narHash": "sha256-TUIjIFQXo3ZW5dcofvqGY6FlgttaV/WfEai39gmA4p8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "bebcf12b45df0b7d6f422ebd5da06f92b52169a8",
+        "rev": "a0e1c32a3c44c68b53a6adb2576a6cd749c01eb6",
         "type": "github"
       },
       "original": {

From e45150db58f63137171ab191ae1165f714ddb748 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 30 Aug 2025 22:58:55 -0400
Subject: [PATCH 365/847] qbt: disable queueing

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index ad1c7d4..777ca1a 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -49,7 +49,7 @@
         MaxActiveCheckingTorrents = 5;
 
         # queueing
-        QueueingSystemEnabled = true;
+        QueueingSystemEnabled = false;
         MaxActiveDownloads = 2; # num of torrents that can download at the same time
         MaxActiveUploads = 20;
         IgnoreSlowTorrentsForQueueing = true;

From 7c8310c1130e39673166d5629460d9341f2b6c29 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 1 Sep 2025 02:53:45 -0400
Subject: [PATCH 366/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8a75894..9c94c53 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756245065,
-        "narHash": "sha256-aAZNbGcWrVRZgWgkQbkabSGcDVRDMgON4BipMy69gvI=",
+        "lastModified": 1756679287,
+        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "54b2879ce622d44415e727905925e21b8f833a98",
+        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756569822,
-        "narHash": "sha256-APfXfPGatztK0U9dbjE0sA0cenf1R+ZSV1Rm4xt/gfQ=",
+        "lastModified": 1756689906,
+        "narHash": "sha256-mJTaaHI3MINqVUiBQqCGHcp2DFSrClw5syh6MOSW9y4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "4d74393bcc956ccd7df68a6a06d1a0575cfa712c",
+        "rev": "b66df9d9c942254d03209186ef24ed7c994a576e",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756518625,
-        "narHash": "sha256-Mxh2wumeSsb968dSDksblubQqHTTdRTC5lH0gmhq9jI=",
+        "lastModified": 1756692734,
+        "narHash": "sha256-i+nMeFwG7tHYWGvUYKvmg8FVPVnqLrZey9mLpdypPmA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "92654796f8f6c3279e4b7d409a3e5b43b0539a19",
+        "rev": "3cfb5bddc3479ff7f403fa3d6cdbdfe2d25e54d5",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756469547,
-        "narHash": "sha256-YvtD2E7MYsQ3r7K9K2G7nCslCKMPShoSEAtbjHLtH0k=",
+        "lastModified": 1756617294,
+        "narHash": "sha256-aGnd4AHIYCWQKChAkHPpX+YYCt7pA6y2LFFA/s8q0wQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "41d292bfc37309790f70f4c120b79280ce40af16",
+        "rev": "b4c2c57c31e68544982226d07e4719a2d86302a8",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756506247,
-        "narHash": "sha256-TUIjIFQXo3ZW5dcofvqGY6FlgttaV/WfEai39gmA4p8=",
+        "lastModified": 1756688979,
+        "narHash": "sha256-bVeg9CSlKrAzhwnJBgoPLNhm3GeO64HrLXHDQ4PSnsM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "a0e1c32a3c44c68b53a6adb2576a6cd749c01eb6",
+        "rev": "d6cdf08adfdb0b7f6e4d95075799f59dc6197681",
         "type": "github"
       },
       "original": {

From 62f8c3835cba032a4b61c0deb64a377e558b47bf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 1 Sep 2025 21:59:46 -0400
Subject: [PATCH 367/847] qbt: change limits

---
 services/qbittorrent.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 777ca1a..42a7c7e 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -54,9 +54,9 @@
         MaxActiveUploads = 20;
         IgnoreSlowTorrentsForQueueing = true;
 
-        GlobalUPSpeedLimit = 0; # unlimited upload
-        GlobalDLSpeedLimit = 0; # unlimited download
-        IncludeOverheadInLimits = false;
+        GlobalUPSpeedLimit = 1000;
+        GlobalDLSpeedLimit = 1000;
+        IncludeOverheadInLimits = true;
 
         GlobalMaxRatio = 6.0;
 

From ee7499ce630ff0f46f65991eaa0c781f05417325 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 17:55:28 -0400
Subject: [PATCH 368/847] caddy: move root

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 50f9109..7f7f884 100644
--- a/flake.nix
+++ b/flake.nix
@@ -89,7 +89,7 @@
         https = {
           certs = services_dir + "/http_certs";
           # TODO! generate website from repo directly using hugo
-          data_dir = services_dir + "/http";
+          data_dir = services_dir + "/http/www";
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
           matrix_hostname = "matrix.${service_configs.https.domain}";

From e7183b0cde529b45e45718f08468bc64b763fdff Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 17:59:27 -0400
Subject: [PATCH 369/847] caddy: add senior project things

---
 configuration.nix                 |  3 +++
 flake.nix                         |  4 ++++
 services/caddy_senior_project.nix | 23 +++++++++++++++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 services/caddy_senior_project.nix

diff --git a/configuration.nix b/configuration.nix
index df27387..9378fac 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -34,6 +34,9 @@
     ./services/ups.nix
 
     ./services/bitwarden.nix
+
+    # KEEP UNTIL 2028
+    ./services/caddy_senior_project.nix
   ];
 
   systemd.targets = {
diff --git a/flake.nix b/flake.nix
index 7f7f884..cac6f54 100644
--- a/flake.nix
+++ b/flake.nix
@@ -90,6 +90,10 @@
           certs = services_dir + "/http_certs";
           # TODO! generate website from repo directly using hugo
           data_dir = services_dir + "/http/www";
+
+          # KEEP UNTIL 2028
+          senior_project_dir = services_dir + "/http/senior_project";
+
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
           matrix_hostname = "matrix.${service_configs.https.domain}";
diff --git a/services/caddy_senior_project.nix b/services/caddy_senior_project.nix
new file mode 100644
index 0000000..9fc941e
--- /dev/null
+++ b/services/caddy_senior_project.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountDeps "caddy" [
+      service_configs.https.senior_project_dir
+    ])
+  ];
+
+  services.caddy.virtualHosts."senior-project".extraConfig = ''
+    root * ${service_configs.https.senior_project_dir}
+    file_server browse
+  '';
+
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.https.senior_project_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
+  ];
+}

From e59064778d8aff68f117a68f61ce6cd0b2ef730b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 18:01:54 -0400
Subject: [PATCH 370/847] caddy: TODO fix conflicting def values

---
 services/caddy_senior_project.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/services/caddy_senior_project.nix b/services/caddy_senior_project.nix
index 9fc941e..e37bd67 100644
--- a/services/caddy_senior_project.nix
+++ b/services/caddy_senior_project.nix
@@ -7,9 +7,12 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "caddy" [
-      service_configs.https.senior_project_dir
-    ])
+    # TODO! fix conflicting definition values
+    /*
+      (lib.serviceMountDeps "caddy" [
+        service_configs.https.senior_project_dir
+      ])
+    */
   ];
 
   services.caddy.virtualHosts."senior-project".extraConfig = ''

From 639234e78063d1209bd9786a19840c604b1a4f0f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 19:19:45 -0400
Subject: [PATCH 371/847] caddy: fix senior project site

---
 flake.lock                        | 17 +++++++++++++++++
 flake.nix                         |  5 +++++
 services/caddy_senior_project.nix | 21 +++++++++++++++++++--
 3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9c94c53..7990d18 100644
--- a/flake.lock
+++ b/flake.lock
@@ -353,6 +353,7 @@
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
+        "senior_project-website": "senior_project-website",
         "srvos": "srvos",
         "vpn-confinement": "vpn-confinement"
       }
@@ -378,6 +379,22 @@
         "type": "github"
       }
     },
+    "senior_project-website": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1756849912,
+        "narHash": "sha256-tBSyS/vksHbfeAWWEBIRxitkFx6tFj1QjrjNbnPdW5s=",
+        "owner": "Titaniumtown",
+        "repo": "senior-project-website",
+        "rev": "8c1d000091b0379f0741598a18f55dcbd6d47c66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Titaniumtown",
+        "repo": "senior-project-website",
+        "type": "github"
+      }
+    },
     "srvos": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index cac6f54..6210ab8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,6 +42,11 @@
       url = "github:serokell/deploy-rs";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    senior_project-website = {
+      url = "github:Titaniumtown/senior-project-website";
+      flake = false;
+    };
   };
 
   outputs =
diff --git a/services/caddy_senior_project.nix b/services/caddy_senior_project.nix
index e37bd67..b206bcc 100644
--- a/services/caddy_senior_project.nix
+++ b/services/caddy_senior_project.nix
@@ -3,8 +3,25 @@
   lib,
   pkgs,
   service_configs,
+  inputs,
   ...
 }:
+let
+  hugoWebsite = pkgs.stdenv.mkDerivation {
+    pname = "hugo-site";
+    version = "0.1";
+
+    src = inputs.senior_project-website;
+
+    nativeBuildInputs = with pkgs; [
+      hugo
+    ];
+
+    installPhase = ''
+      hugo --minify -d $out;
+    '';
+  };
+in
 {
   imports = [
     # TODO! fix conflicting definition values
@@ -15,8 +32,8 @@
     */
   ];
 
-  services.caddy.virtualHosts."senior-project".extraConfig = ''
-    root * ${service_configs.https.senior_project_dir}
+  services.caddy.virtualHosts."senior-project.${service_configs.https.domain}".extraConfig = ''
+    root * ${hugoWebsite}
     file_server browse
   '';
 

From bc7c72a74de01f54ba99f30bd861c4cf54ab7536 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 19:49:38 -0400
Subject: [PATCH 372/847] caddy: actually fix senior project webpage

---
 flake.lock                        | 42 +++++++++++++++----------------
 services/caddy_senior_project.nix |  9 +++++++
 2 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7990d18..8302a35 100644
--- a/flake.lock
+++ b/flake.lock
@@ -24,11 +24,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1749105467,
-        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
+        "lastModified": 1756719547,
+        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
+        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756115622,
-        "narHash": "sha256-iv8xVtmLMNLWFcDM/HcAPLRGONyTRpzL9NS09RnryRM=",
+        "lastModified": 1756733629,
+        "narHash": "sha256-dwWGlDhcO5SMIvMSTB4mjQ5Pvo2vtxvpIknhVnSz2I8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "bafad29f89e83b2d861b493aa23034ea16595560",
+        "rev": "a5c4f2ab72e3d1ab43e3e65aa421c6f2bd2e12a1",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1754297745,
-        "narHash": "sha256-aD6/scLN3L4ZszmNbhhd3JQ9Pzv1ScYFphz14wHinfs=",
+        "lastModified": 1756744479,
+        "narHash": "sha256-EyZXusK/wRD3V9vDh00W2Re3Eg8UQ+LjVBQrrH9dq1U=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "892cbdca865d6b42f9c0d222fe309f7720259855",
+        "rev": "747b7912f49e2885090c83364d88cf853a020ac1",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756689906,
-        "narHash": "sha256-mJTaaHI3MINqVUiBQqCGHcp2DFSrClw5syh6MOSW9y4=",
+        "lastModified": 1756841250,
+        "narHash": "sha256-VBFOuaNQZiRux2zNv2DThl10EOpEs8e4lz8xN/gnY2w=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b66df9d9c942254d03209186ef24ed7c994a576e",
+        "rev": "3de008208b9b8a33f49f979097a99b4d59e6e521",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1756245047,
-        "narHash": "sha256-9bHzrVbjAudbO8q4vYFBWlEkDam31fsz0J7GB8k4AsI=",
+        "lastModified": 1756750488,
+        "narHash": "sha256-e4ZAu2sjOtGpvbdS5zo+Va5FUUkAnizl4wb0/JlIL2I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a65b650d6981e23edd1afa1f01eb942f19cdcbb7",
+        "rev": "47eb4856cfd01eaeaa7bb5944a0f27db8fb9b94a",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756617294,
-        "narHash": "sha256-aGnd4AHIYCWQKChAkHPpX+YYCt7pA6y2LFFA/s8q0wQ=",
+        "lastModified": 1756754095,
+        "narHash": "sha256-9Rsn9XEWINExosFkKEqdp8EI6Mujr1gmQiyrEcts2ls=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b4c2c57c31e68544982226d07e4719a2d86302a8",
+        "rev": "7c815e513adbf03c9098b2bd230c1e0525c8a7f9",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1756849912,
-        "narHash": "sha256-tBSyS/vksHbfeAWWEBIRxitkFx6tFj1QjrjNbnPdW5s=",
+        "lastModified": 1756856881,
+        "narHash": "sha256-RMjHSgGJ6h5kRG5OC8k9LStSLTQJNQRT2HOxCz+F0u4=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "8c1d000091b0379f0741598a18f55dcbd6d47c66",
+        "rev": "107e7f82142fd10ccc04eb05f3925a77c55c7bb8",
         "type": "github"
       },
       "original": {
diff --git a/services/caddy_senior_project.nix b/services/caddy_senior_project.nix
index b206bcc..3db0876 100644
--- a/services/caddy_senior_project.nix
+++ b/services/caddy_senior_project.nix
@@ -7,6 +7,13 @@
   ...
 }:
 let
+  theme = pkgs.fetchFromGitHub {
+    owner = "kaiiiz";
+    repo = "hugo-theme-monochrome";
+    rev = "d17e05715e91f41a842f2656e6bdd70cba73de91";
+    sha256 = "h9I2ukugVrldIC3SXefS0L3R245oa+TuRChOCJJgF24=";
+  };
+
   hugoWebsite = pkgs.stdenv.mkDerivation {
     pname = "hugo-site";
     version = "0.1";
@@ -18,6 +25,8 @@ let
     ];
 
     installPhase = ''
+      rm -fr themes/theme
+      cp -rv ${theme} themes/theme
       hugo --minify -d $out;
     '';
   };

From 9a8a9d5e7caf758aceb78edd85e3da9037247d27 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 19:51:01 -0400
Subject: [PATCH 373/847] caddy: remove orphaned options

---
 flake.nix                         |  3 ---
 services/caddy_senior_project.nix | 13 -------------
 2 files changed, 16 deletions(-)

diff --git a/flake.nix b/flake.nix
index 6210ab8..8aa6a0a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -96,9 +96,6 @@
           # TODO! generate website from repo directly using hugo
           data_dir = services_dir + "/http/www";
 
-          # KEEP UNTIL 2028
-          senior_project_dir = services_dir + "/http/senior_project";
-
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
           matrix_hostname = "matrix.${service_configs.https.domain}";
diff --git a/services/caddy_senior_project.nix b/services/caddy_senior_project.nix
index 3db0876..637eafc 100644
--- a/services/caddy_senior_project.nix
+++ b/services/caddy_senior_project.nix
@@ -32,21 +32,8 @@ let
   };
 in
 {
-  imports = [
-    # TODO! fix conflicting definition values
-    /*
-      (lib.serviceMountDeps "caddy" [
-        service_configs.https.senior_project_dir
-      ])
-    */
-  ];
-
   services.caddy.virtualHosts."senior-project.${service_configs.https.domain}".extraConfig = ''
     root * ${hugoWebsite}
     file_server browse
   '';
-
-  systemd.tmpfiles.rules = [
-    "d ${service_configs.https.senior_project_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
-  ];
 }

From 1e2219956f4f8fb145a8910c08b64b3fde8f4ee7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 19:52:30 -0400
Subject: [PATCH 374/847] update senior project website

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8302a35..2191763 100644
--- a/flake.lock
+++ b/flake.lock
@@ -382,11 +382,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1756856881,
-        "narHash": "sha256-RMjHSgGJ6h5kRG5OC8k9LStSLTQJNQRT2HOxCz+F0u4=",
+        "lastModified": 1756857133,
+        "narHash": "sha256-L9uRmF8ybAfMIKwAqrXfd7f1ICqBEu6tBxeWjo4xqRc=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "107e7f82142fd10ccc04eb05f3925a77c55c7bb8",
+        "rev": "410207b70a26784226fb5ecd9b31b725904d3abd",
         "type": "github"
       },
       "original": {

From ec6368e1e7b4189bc72a1f39a52f96122a9d8112 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Sep 2025 23:47:08 -0400
Subject: [PATCH 375/847] caddy: generate from hugo instead

---
 flake.lock         | 31 ++++++++++++++++++++++++-------
 flake.nix          |  8 +++++---
 services/caddy.nix | 41 ++++++++++++++++++++++++++++++++++++++---
 3 files changed, 67 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2191763..87dd72b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756841250,
-        "narHash": "sha256-VBFOuaNQZiRux2zNv2DThl10EOpEs8e4lz8xN/gnY2w=",
+        "lastModified": 1756867433,
+        "narHash": "sha256-/bOq85y2aXjKuu0g9bxp5irM+pXVK+kBT09xwZwBnPE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "3de008208b9b8a33f49f979097a99b4d59e6e521",
+        "rev": "8a2234ea0c89f212190c176d741b7742f0082582",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756692734,
-        "narHash": "sha256-i+nMeFwG7tHYWGvUYKvmg8FVPVnqLrZey9mLpdypPmA=",
+        "lastModified": 1756864213,
+        "narHash": "sha256-eHgsQ9eoJZGnZLJtrYnCynEb5nYhysvMtFrPiTwjHA0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "3cfb5bddc3479ff7f403fa3d6cdbdfe2d25e54d5",
+        "rev": "da421c0fb247d3b1956b0cc68e73a27bcdcf77b5",
         "type": "github"
       },
       "original": {
@@ -355,7 +355,8 @@
         "nixpkgs": "nixpkgs",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
-        "vpn-confinement": "vpn-confinement"
+        "vpn-confinement": "vpn-confinement",
+        "website": "website"
       }
     },
     "rust-overlay": {
@@ -477,6 +478,22 @@
         "repo": "VPN-Confinement",
         "type": "github"
       }
+    },
+    "website": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1756870892,
+        "narHash": "sha256-jPcADOXoREf92sA/wHX9tXfuRRDpwIba4NIqz/Gl8Kg=",
+        "ref": "refs/heads/main",
+        "rev": "890c7633d469862a54b9c5993050b1f287242f2d",
+        "revCount": 20,
+        "type": "git",
+        "url": "https://git.gardling.com/titaniumtown/website"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.gardling.com/titaniumtown/website"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 8aa6a0a..ee2a5db 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,6 +47,11 @@
       url = "github:Titaniumtown/senior-project-website";
       flake = false;
     };
+
+    website = {
+      url = "git+https://git.gardling.com/titaniumtown/website";
+      flake = false;
+    };
   };
 
   outputs =
@@ -93,9 +98,6 @@
 
         https = {
           certs = services_dir + "/http_certs";
-          # TODO! generate website from repo directly using hugo
-          data_dir = services_dir + "/http/www";
-
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
           matrix_hostname = "matrix.${service_configs.https.domain}";
diff --git a/services/caddy.nix b/services/caddy.nix
index 0cbe8a0..9e5869c 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -4,13 +4,49 @@
   username,
   pkgs,
   lib,
+  inputs,
   ...
 }:
+
+let
+  theme = pkgs.fetchFromGitHub {
+    owner = "kaiiiz";
+    repo = "hugo-theme-monochrome";
+    rev = "d17e05715e91f41a842f2656e6bdd70cba73de91";
+    sha256 = "h9I2ukugVrldIC3SXefS0L3R245oa+TuRChOCJJgF24=";
+  };
+
+  hugo-neko = pkgs.fetchFromGitHub {
+    owner = "ystepanoff";
+    repo = "hugo-neko";
+    rev = "5a50034acbb1ae0cec19775af64e7167ca22725e";
+    sha256 = "VLwr4zEeFQU/b+vj0XTLSuEiosuNFu2du4uud7m8bnw=";
+  };
+
+  hugoWebsite = pkgs.stdenv.mkDerivation {
+    pname = "hugo-site";
+    version = "0.1";
+
+    src = inputs.website;
+
+    nativeBuildInputs = with pkgs; [
+      hugo
+      go
+      git
+    ];
+
+    installPhase = ''
+      rm -fr themes/theme modules/hugo-neko
+      cp -r ${theme} themes/theme
+      cp -r ${hugo-neko} modules/hugo-neko
+      hugo --minify -d $out;
+    '';
+  };
+in
 {
   imports = [
     (lib.serviceMountDeps "caddy" [
       config.services.caddy.dataDir
-      service_configs.https.data_dir
     ])
     (lib.serviceDependZpool "caddy" service_configs.zpool_ssds)
   ];
@@ -21,7 +57,7 @@
     virtualHosts = {
       ${service_configs.https.domain} = {
         extraConfig = ''
-          root * ${service_configs.https.data_dir}
+          root * ${hugoWebsite}
           file_server browse
         '';
 
@@ -31,7 +67,6 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.https.data_dir} 770 ${config.services.caddy.user} ${config.services.caddy.group}"
     "d ${config.services.caddy.dataDir} 700 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
 

From b7375176aae4849144374db374c3cb772fb89690 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 3 Sep 2025 10:09:29 -0400
Subject: [PATCH 376/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 87dd72b..35f1526 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756867433,
-        "narHash": "sha256-/bOq85y2aXjKuu0g9bxp5irM+pXVK+kBT09xwZwBnPE=",
+        "lastModified": 1756899349,
+        "narHash": "sha256-6iIolT+FkniWR+1lL8hMmHQWuGh5I+3hL1qe6skGjb8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8a2234ea0c89f212190c176d741b7742f0082582",
+        "rev": "2c8dac72eb6acd4e20c0da251535dfc46d35178b",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756754095,
-        "narHash": "sha256-9Rsn9XEWINExosFkKEqdp8EI6Mujr1gmQiyrEcts2ls=",
+        "lastModified": 1756886854,
+        "narHash": "sha256-6tooT142NLcFjt24Gi4B0G1pgWLvfw7y93sYEfSHlLI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7c815e513adbf03c9098b2bd230c1e0525c8a7f9",
+        "rev": "0e6684e6c5755325f801bda1751a8a4038145d7d",
         "type": "github"
       },
       "original": {

From 954fb371a9b815621a578c9e5574f39f7a1342b6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 5 Sep 2025 10:49:01 -0400
Subject: [PATCH 377/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 35f1526..c1b63a9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756899349,
-        "narHash": "sha256-6iIolT+FkniWR+1lL8hMmHQWuGh5I+3hL1qe6skGjb8=",
+        "lastModified": 1757081222,
+        "narHash": "sha256-q5trmDDZ8IcTI3cDEUULiyFCsOFR1pWJcBz/v/UzOVY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2c8dac72eb6acd4e20c0da251535dfc46d35178b",
+        "rev": "5143fa895e7725c5bd2135daf7d8f793d98fa91c",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756864213,
-        "narHash": "sha256-eHgsQ9eoJZGnZLJtrYnCynEb5nYhysvMtFrPiTwjHA0=",
+        "lastModified": 1756950642,
+        "narHash": "sha256-JybxDkwS6zqIbkFdeACJdUy8UOKeNRSi9fSUWUQB+mM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "da421c0fb247d3b1956b0cc68e73a27bcdcf77b5",
+        "rev": "0ec356a4d55f05ec930f410fb138a45e275f6eec",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1756750488,
-        "narHash": "sha256-e4ZAu2sjOtGpvbdS5zo+Va5FUUkAnizl4wb0/JlIL2I=",
+        "lastModified": 1757081837,
+        "narHash": "sha256-wAgZ+BaRR/cqmKP0bWnJ9rO9KLz91R5aOdJiT+k/J2E=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "47eb4856cfd01eaeaa7bb5944a0f27db8fb9b94a",
+        "rev": "7e56e39db4008521552e9d2b0d9ae9bf8e0cdce2",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756886854,
-        "narHash": "sha256-6tooT142NLcFjt24Gi4B0G1pgWLvfw7y93sYEfSHlLI=",
+        "lastModified": 1757020766,
+        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0e6684e6c5755325f801bda1751a8a4038145d7d",
+        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756688979,
-        "narHash": "sha256-bVeg9CSlKrAzhwnJBgoPLNhm3GeO64HrLXHDQ4PSnsM=",
+        "lastModified": 1756947399,
+        "narHash": "sha256-BP+tghzkQpt5NDcPhUsRjZtPd53jsubSNlmtWJclQZ8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "d6cdf08adfdb0b7f6e4d95075799f59dc6197681",
+        "rev": "27067044062111dfb077e735ee8641f05acaf4dc",
         "type": "github"
       },
       "original": {

From e77cf00e32b61e7fe0fab3b2d62d67b50365f555 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 7 Sep 2025 00:28:38 -0400
Subject: [PATCH 378/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index c1b63a9..b15b420 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757081222,
-        "narHash": "sha256-q5trmDDZ8IcTI3cDEUULiyFCsOFR1pWJcBz/v/UzOVY=",
+        "lastModified": 1757197588,
+        "narHash": "sha256-W4GgoFpKSpEv1uMwncI0nAniHvYKywE8Yy1xHzmENko=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "5143fa895e7725c5bd2135daf7d8f793d98fa91c",
+        "rev": "79bc429262268ad2ac8a364cfe6c2d6b9c5f008a",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756950642,
-        "narHash": "sha256-JybxDkwS6zqIbkFdeACJdUy8UOKeNRSi9fSUWUQB+mM=",
+        "lastModified": 1757210363,
+        "narHash": "sha256-9HMbjEk+/BOsJorm6GWyDYUAnbmCOjiUormYNexjSZU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "0ec356a4d55f05ec930f410fb138a45e275f6eec",
+        "rev": "a5aca63fe1d54a6b2ac4adf11a019d9d064ae98f",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1757081837,
-        "narHash": "sha256-wAgZ+BaRR/cqmKP0bWnJ9rO9KLz91R5aOdJiT+k/J2E=",
+        "lastModified": 1757103352,
+        "narHash": "sha256-PtT7ix43ss8PONJ1VJw3f6t2yAoGH+q462Sn8lrmWmk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7e56e39db4008521552e9d2b0d9ae9bf8e0cdce2",
+        "rev": "11b2a10c7be726321bb854403fdeec391e798bf0",
         "type": "github"
       },
       "original": {

From 0501dbb46054d9c7172c3c89e8d8f1cbb409b53a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 8 Sep 2025 10:19:52 -0400
Subject: [PATCH 379/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index b15b420..face9e5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756733629,
-        "narHash": "sha256-dwWGlDhcO5SMIvMSTB4mjQ5Pvo2vtxvpIknhVnSz2I8=",
+        "lastModified": 1757255839,
+        "narHash": "sha256-XH33B1X888Xc/xEXhF1RPq/kzKElM0D5C9N6YdvOvIc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a5c4f2ab72e3d1ab43e3e65aa421c6f2bd2e12a1",
+        "rev": "c8a0e78d86b12ea67be6ed0f7cae7f9bfabae75a",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757197588,
-        "narHash": "sha256-W4GgoFpKSpEv1uMwncI0nAniHvYKywE8Yy1xHzmENko=",
+        "lastModified": 1757329011,
+        "narHash": "sha256-b5s2MT6Pj20yi4ldPliqLCLha97rTuF8WLyPzbrJGaw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "79bc429262268ad2ac8a364cfe6c2d6b9c5f008a",
+        "rev": "b0d52998b962bd2681c34bf52af993af79f178b8",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757210363,
-        "narHash": "sha256-9HMbjEk+/BOsJorm6GWyDYUAnbmCOjiUormYNexjSZU=",
+        "lastModified": 1757296734,
+        "narHash": "sha256-NRkbte52DMPcDbWEM823CJSApImXLIzRmWCKMMhYVbA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a5aca63fe1d54a6b2ac4adf11a019d9d064ae98f",
+        "rev": "e2915ee5edd4da1fa076ba155f1d539be78340fb",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757020766,
-        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
+        "lastModified": 1757244434,
+        "narHash": "sha256-AeqTqY0Y95K1Fgs6wuT1LafBNcmKxcOkWnm4alD9pqM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
+        "rev": "092c565d333be1e17b4779ac22104338941d913f",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756947399,
-        "narHash": "sha256-BP+tghzkQpt5NDcPhUsRjZtPd53jsubSNlmtWJclQZ8=",
+        "lastModified": 1757298062,
+        "narHash": "sha256-bSaQxOCzj0ky6HYSCJxoT8XEeqwzzJFP6R80bgGJVjM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "27067044062111dfb077e735ee8641f05acaf4dc",
+        "rev": "0070590bf5bd5dc97b8e644720c3c7c90e16f8bc",
         "type": "github"
       },
       "original": {

From b062de279218524815fa5b950699c2980149154a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 8 Sep 2025 22:39:53 -0400
Subject: [PATCH 380/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index face9e5..5c5bcb4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757329011,
-        "narHash": "sha256-b5s2MT6Pj20yi4ldPliqLCLha97rTuF8WLyPzbrJGaw=",
+        "lastModified": 1757366072,
+        "narHash": "sha256-3IfdaUg+UW1C9v8S4VCjI1aLQIGfl00jumEJIr035fw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b0d52998b962bd2681c34bf52af993af79f178b8",
+        "rev": "7057faf64b514e991e2f70147f82bb13d544b1c0",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757244434,
-        "narHash": "sha256-AeqTqY0Y95K1Fgs6wuT1LafBNcmKxcOkWnm4alD9pqM=",
+        "lastModified": 1757341549,
+        "narHash": "sha256-fRnT+bwP1sB6ne7BLw4aXkVYjr+QCZZ+e4MhbokHyd4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "092c565d333be1e17b4779ac22104338941d913f",
+        "rev": "9d1fa9fa266631335618373f8faad570df6f9ede",
         "type": "github"
       },
       "original": {

From c573113afeaa792efceb9d743bdf018056379d41 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 9 Sep 2025 15:48:28 -0400
Subject: [PATCH 381/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5c5bcb4..4a29977 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757366072,
-        "narHash": "sha256-3IfdaUg+UW1C9v8S4VCjI1aLQIGfl00jumEJIr035fw=",
+        "lastModified": 1757421675,
+        "narHash": "sha256-KsOHeyFnb4pCKJuhb89JRTgQFzUlzbPLlUdevCFmJWE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "7057faf64b514e991e2f70147f82bb13d544b1c0",
+        "rev": "4f63cd705c7b6f457f36c63fdc053e07f6f3cc6b",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757341549,
-        "narHash": "sha256-fRnT+bwP1sB6ne7BLw4aXkVYjr+QCZZ+e4MhbokHyd4=",
+        "lastModified": 1757408970,
+        "narHash": "sha256-aSgK4BLNFFGvDTNKPeB28lVXYqVn8RdyXDNAvgGq+k0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9d1fa9fa266631335618373f8faad570df6f9ede",
+        "rev": "d179d77c139e0a3f5c416477f7747e9d6b7ec315",
         "type": "github"
       },
       "original": {

From 7e6a52dcb00bbf76866e484356bc2ea6faef50fe Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 10 Sep 2025 16:03:23 -0400
Subject: [PATCH 382/847] fix minecraft test

---
 tests/minecraft.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index bfb706c..64dde85 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -85,16 +85,9 @@ testPkgs.testers.runNixOSTest {
     # Wait for minecraft service to be available
     machine.wait_for_unit("minecraft-server-main.service")
 
+    machine.sleep(20)
+
     # Check that the service is active and not failed
     machine.succeed("systemctl is-active minecraft-server-main.service")
-
-    # Wait for the server to fully start up - minecraft with mods can take longer
-    machine.sleep(60)
-
-    # Verify the service hasn't crashed after startup
-    machine.succeed("systemctl is-active minecraft-server-main.service")
-
-    # Verify the server port is listening
-    machine.wait_for_open_port(25565)
   '';
 }

From f02d5372daee279e168130a82adae303660950ba Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 11 Sep 2025 16:05:27 -0400
Subject: [PATCH 383/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4a29977..eeb9d04 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757255839,
-        "narHash": "sha256-XH33B1X888Xc/xEXhF1RPq/kzKElM0D5C9N6YdvOvIc=",
+        "lastModified": 1757508292,
+        "narHash": "sha256-7lVWL5bC6xBIMWWDal41LlGAG+9u2zUorqo3QCUL4p4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "c8a0e78d86b12ea67be6ed0f7cae7f9bfabae75a",
+        "rev": "146f45bee02b8bd88812cfce6ffc0f933788875a",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757421675,
-        "narHash": "sha256-KsOHeyFnb4pCKJuhb89JRTgQFzUlzbPLlUdevCFmJWE=",
+        "lastModified": 1757618398,
+        "narHash": "sha256-BlGooRYcF96P356VQZi7SkGEW0Lo8TzxeYZt5CNmLew=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "4f63cd705c7b6f457f36c63fdc053e07f6f3cc6b",
+        "rev": "0e6ff0046f4a2983b2c77950aa75960fe4b4f0e2",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757296734,
-        "narHash": "sha256-NRkbte52DMPcDbWEM823CJSApImXLIzRmWCKMMhYVbA=",
+        "lastModified": 1757555667,
+        "narHash": "sha256-09403AZgH/TR1bpilDm8yJucZ2hYcZm8bzY3t8NgPJQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e2915ee5edd4da1fa076ba155f1d539be78340fb",
+        "rev": "d6d19d54dcec2a6afac3b9442643dd18e8b0566d",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757408970,
-        "narHash": "sha256-aSgK4BLNFFGvDTNKPeB28lVXYqVn8RdyXDNAvgGq+k0=",
+        "lastModified": 1757545623,
+        "narHash": "sha256-mCxPABZ6jRjUQx3bPP4vjA68ETbPLNz9V2pk9tO7pRQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d179d77c139e0a3f5c416477f7747e9d6b7ec315",
+        "rev": "8cd5ce828d5d1d16feff37340171a98fc3bf6526",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757298062,
-        "narHash": "sha256-bSaQxOCzj0ky6HYSCJxoT8XEeqwzzJFP6R80bgGJVjM=",
+        "lastModified": 1757552363,
+        "narHash": "sha256-4dtGagSfwMabRi59g7E8T6FcdghNizLbR4PwU1g8lDI=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "0070590bf5bd5dc97b8e644720c3c7c90e16f8bc",
+        "rev": "ec58f16bdb57cf3a17bba79f687945dca1703c64",
         "type": "github"
       },
       "original": {

From c972ebc259e303acc1365a49ea6216374352a807 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 11 Sep 2025 17:46:08 -0400
Subject: [PATCH 384/847] claude'd jellyfin auto limit qbt upload

---
 secrets/jellyfin-api-key                 | Bin 0 -> 55 bytes
 services/jellyfin-qbittorrent-monitor.py | 326 +++++++++++++++++++++++
 services/qbittorrent.nix                 |   4 +
 services/wg.nix                          |  81 +++---
 4 files changed, 367 insertions(+), 44 deletions(-)
 create mode 100644 secrets/jellyfin-api-key
 create mode 100644 services/jellyfin-qbittorrent-monitor.py

diff --git a/secrets/jellyfin-api-key b/secrets/jellyfin-api-key
new file mode 100644
index 0000000000000000000000000000000000000000..a91e5c31435b72d5cbac7dc2a8d25d0ad4b84183
GIT binary patch
literal 55
zcmZQ@_Y83kiVO&0Sn=qE&=SM6b~ZzsVs`N(DbCGHxR$MJij<L66X;XeByQjTP&I0H
M-htU=;s<8~03Ht%?EnA(

literal 0
HcmV?d00001

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
new file mode 100644
index 0000000..f363c28
--- /dev/null
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -0,0 +1,326 @@
+#!/usr/bin/env python3
+
+import requests
+import time
+import logging
+from datetime import datetime
+import sys
+import signal
+import json
+
+logging.basicConfig(
+    level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
+)
+logger = logging.getLogger(__name__)
+
+
+class JellyfinQBittorrentMonitor:
+    def __init__(
+        self,
+        jellyfin_url="http://localhost:8096",
+        qbittorrent_url="http://localhost:8080",
+        check_interval=30,
+        jellyfin_api_key=None,
+    ):
+        self.jellyfin_url = jellyfin_url
+        self.qbittorrent_url = qbittorrent_url
+        self.check_interval = check_interval
+        self.jellyfin_api_key = jellyfin_api_key
+        self.last_streaming_state = None
+        self.throttle_active = False
+        self.running = True
+        self.session = requests.Session()  # Use session for cookies
+
+        # Hysteresis settings to prevent rapid switching
+        self.streaming_start_delay = 10  # seconds to wait before throttling
+        self.streaming_stop_delay = 60  # seconds to wait before removing throttle
+        self.last_state_change = 0
+
+        # Try to authenticate with qBittorrent
+        self.authenticate_qbittorrent()
+
+    def signal_handler(self, signum, frame):
+        logger.info("Received shutdown signal, cleaning up...")
+        self.running = False
+        self.restore_normal_limits()
+        sys.exit(0)
+
+    def authenticate_qbittorrent(self):
+        """Try to authenticate with qBittorrent using empty credentials (for whitelist)"""
+        logger.info("Attempting to authenticate with qBittorrent...")
+
+        try:
+            # First, try to access a simple endpoint to see if auth is needed
+            test_response = self.session.get(
+                f"{self.qbittorrent_url}/api/v2/app/version", timeout=5
+            )
+            logger.info(
+                f"Version endpoint test: HTTP {test_response.status_code}, Response: {test_response.text}"
+            )
+
+            if test_response.status_code == 200:
+                logger.info(
+                    "qBittorrent accessible without explicit login - subnet whitelist working"
+                )
+                return True
+
+        except Exception as e:
+            logger.info(f"Version endpoint failed: {e}")
+
+        try:
+            # Try login with empty credentials (should work with subnet whitelist)
+            login_data = {"username": "", "password": ""}
+            headers = {
+                "Referer": self.qbittorrent_url,
+                "Content-Type": "application/x-www-form-urlencoded",
+            }
+
+            logger.info(f"Attempting login to {self.qbittorrent_url}/login")
+            response = self.session.post(
+                f"{self.qbittorrent_url}/login",
+                data=login_data,
+                headers=headers,
+                timeout=10,
+            )
+
+            logger.info(
+                f"Login response: HTTP {response.status_code}, Response: '{response.text}'"
+            )
+
+            if response.status_code == 200:
+                if "Ok." in response.text or response.text.strip() == "Ok.":
+                    logger.info("Successfully authenticated with qBittorrent")
+                    return True
+                elif "Fails." in response.text:
+                    logger.warning(
+                        "qBittorrent login failed - authentication may be required"
+                    )
+                else:
+                    logger.info(f"Unexpected login response: '{response.text}'")
+            else:
+                logger.warning(f"Login request failed with HTTP {response.status_code}")
+
+        except Exception as e:
+            logger.error(f"Could not authenticate with qBittorrent: {e}")
+
+        return False
+
+    def check_jellyfin_sessions(self):
+        """Check if anyone is actively streaming from Jellyfin"""
+        try:
+            headers = {}
+            if self.jellyfin_api_key:
+                headers["X-Emby-Token"] = self.jellyfin_api_key
+
+            response = requests.get(
+                f"{self.jellyfin_url}/Sessions", headers=headers, timeout=10
+            )
+            response.raise_for_status()
+            sessions = response.json()
+
+            # Count active streaming sessions
+            active_streams = []
+            for session in sessions:
+                if (
+                    "NowPlayingItem" in session
+                    and session.get("PlayState", {}).get("IsPaused", True) == False
+                ):
+                    item = session["NowPlayingItem"]
+                    user = session.get("UserName", "Unknown")
+                    active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
+
+            return active_streams
+
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Failed to check Jellyfin sessions: {e}")
+            return []
+        except json.JSONDecodeError as e:
+            logger.error(f"Failed to parse Jellyfin response: {e}")
+            return []
+
+    def check_qbittorrent_alternate_limits(self):
+        """Check if alternate speed limits are currently enabled"""
+        # For qBittorrent v5.1.0, use API v2 with GET requests
+        try:
+            # Try the transfer info endpoint first (more reliable)
+            response = self.session.get(
+                f"{self.qbittorrent_url}/api/v2/transfer/info", timeout=10
+            )
+            logger.info(f"Transfer info endpoint: HTTP {response.status_code}")
+
+            if response.status_code == 200:
+                data = response.json()
+                logger.info(f"Transfer info keys: {list(data.keys())}")
+
+                # Check for alternative speed limit status in the response
+                if "use_alt_speed_limits" in data:
+                    is_enabled = data["use_alt_speed_limits"]
+                    logger.info(f"Alternative speed limits enabled: {is_enabled}")
+                    return is_enabled
+
+            response.raise_for_status()
+
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Transfer info endpoint failed: {e}")
+        except json.JSONDecodeError as e:
+            logger.error(f"Failed to parse transfer info JSON: {e}")
+
+        # Fallback: try app preferences endpoint
+        try:
+            response = self.session.get(
+                f"{self.qbittorrent_url}/api/v2/app/preferences", timeout=10
+            )
+            logger.info(f"Preferences endpoint: HTTP {response.status_code}")
+
+            if response.status_code == 200:
+                data = response.json()
+                # Look for alternative speed settings
+                if "alt_up_limit" in data or "scheduler_enabled" in data:
+                    # Check if alternative speeds are currently active
+                    # This is a bit indirect but should work
+                    logger.info(
+                        "Found preferences data, assuming alt speeds not active by default"
+                    )
+                    return False
+
+        except Exception as e:
+            logger.error(f"Preferences endpoint failed: {e}")
+
+        logger.error(
+            "Failed to check qBittorrent alternate limits status: all endpoints failed"
+        )
+        return False
+
+    def toggle_qbittorrent_limits(self, enable_throttle):
+        """Toggle qBittorrent alternate speed limits"""
+        try:
+            # Check current state
+            current_throttle = self.check_qbittorrent_alternate_limits()
+
+            if enable_throttle and not current_throttle:
+                try:
+                    # Use API v2 POST endpoint to toggle alternative speed limits
+                    response = self.session.post(
+                        f"{self.qbittorrent_url}/api/v2/transfer/toggleSpeedLimitsMode",
+                        timeout=10,
+                    )
+                    logger.info(
+                        f"Toggle enable response: HTTP {response.status_code}, {response.text[:100]}"
+                    )
+                    response.raise_for_status()
+                    self.throttle_active = True
+                    logger.info("✓ Enabled alternate speed limits (throttling)")
+                    return
+                except requests.exceptions.RequestException as e:
+                    logger.error(f"Failed to enable alternate speed limits: {e}")
+
+            elif not enable_throttle and current_throttle:
+                try:
+                    # Use API v2 POST endpoint to toggle alternative speed limits
+                    response = self.session.post(
+                        f"{self.qbittorrent_url}/api/v2/transfer/toggleSpeedLimitsMode",
+                        timeout=10,
+                    )
+                    logger.info(
+                        f"Toggle disable response: HTTP {response.status_code}, {response.text[:100]}"
+                    )
+                    response.raise_for_status()
+                    self.throttle_active = False
+                    logger.info("✓ Disabled alternate speed limits (normal)")
+                    return
+                except requests.exceptions.RequestException as e:
+                    logger.error(f"Failed to disable alternate speed limits: {e}")
+
+        except Exception as e:
+            logger.error(f"Failed to toggle qBittorrent limits: {e}")
+
+    def restore_normal_limits(self):
+        """Ensure normal speed limits are restored on shutdown"""
+        if self.throttle_active:
+            logger.info("Restoring normal speed limits before shutdown...")
+            self.toggle_qbittorrent_limits(False)
+
+    def should_change_state(self, new_streaming_state):
+        """Apply hysteresis to prevent rapid state changes"""
+        now = time.time()
+
+        # If state hasn't changed, no action needed
+        if new_streaming_state == self.last_streaming_state:
+            return False
+
+        # Calculate time since last state change
+        time_since_change = now - self.last_state_change
+
+        # If we want to start throttling (streaming started)
+        if new_streaming_state and not self.last_streaming_state:
+            if time_since_change >= self.streaming_start_delay:
+                self.last_state_change = now
+                return True
+
+        # If we want to stop throttling (streaming stopped)
+        elif not new_streaming_state and self.last_streaming_state:
+            if time_since_change >= self.streaming_stop_delay:
+                self.last_state_change = now
+                return True
+
+        return False
+
+    def run(self):
+        """Main monitoring loop"""
+        logger.info("Starting Jellyfin-qBittorrent monitor")
+        logger.info(f"Jellyfin URL: {self.jellyfin_url}")
+        logger.info(f"qBittorrent URL: {self.qbittorrent_url}")
+        logger.info(f"Check interval: {self.check_interval}s")
+
+        # Set up signal handlers
+        signal.signal(signal.SIGINT, self.signal_handler)
+        signal.signal(signal.SIGTERM, self.signal_handler)
+
+        while self.running:
+            try:
+                # Check for active streaming
+                active_streams = self.check_jellyfin_sessions()
+                streaming_active = len(active_streams) > 0
+
+                # Log current status
+                if streaming_active:
+                    logger.info(
+                        f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
+                    )
+                else:
+                    logger.debug("No active streaming sessions")
+
+                # Apply hysteresis and change state if needed
+                if self.should_change_state(streaming_active):
+                    self.last_streaming_state = streaming_active
+                    self.toggle_qbittorrent_limits(streaming_active)
+
+                time.sleep(self.check_interval)
+
+            except KeyboardInterrupt:
+                break
+            except Exception as e:
+                logger.error(f"Unexpected error in monitoring loop: {e}")
+                time.sleep(self.check_interval)
+
+        self.restore_normal_limits()
+        logger.info("Monitor stopped")
+
+
+if __name__ == "__main__":
+    import os
+
+    # Configuration from environment variables
+    jellyfin_url = os.getenv("JELLYFIN_URL", "http://localhost:8096")
+    qbittorrent_url = os.getenv("QBITTORRENT_URL", "http://localhost:8080")
+    check_interval = int(os.getenv("CHECK_INTERVAL", "30"))
+    jellyfin_api_key = os.getenv("JELLYFIN_API_KEY")
+
+    monitor = JellyfinQBittorrentMonitor(
+        jellyfin_url=jellyfin_url,
+        qbittorrent_url=qbittorrent_url,
+        check_interval=check_interval,
+        jellyfin_api_key=jellyfin_api_key,
+    )
+
+    monitor.run()
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 42a7c7e..f6a0589 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -56,6 +56,10 @@
 
         GlobalUPSpeedLimit = 1000;
         GlobalDLSpeedLimit = 1000;
+
+        # Alternate speed limits for when Jellyfin is streaming
+        AlternativeGlobalUPSpeedLimit = 500; # 500 KB/s when throttled
+        AlternativeGlobalDLSpeedLimit = 800; # 800 KB/s when throttled
         IncludeOverheadInLimits = true;
 
         GlobalMaxRatio = 6.0;
diff --git a/services/wg.nix b/services/wg.nix
index 3f22593..540ec58 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -19,51 +19,44 @@
     nload
   ];
 
-  networking.firewall.extraCommands = ''
-    # Exempt local traffic from marking
-    iptables -t mangle -A POSTROUTING -s ${service_configs.https.wg_ip}/24 -d 192.168.1.0/24 -j RETURN
+  systemd.services."jellyfin-qbittorrent-monitor" = {
+    description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
+    after = [
+      "network.target"
+      "jellyfin.service"
+      "qbittorrent.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
 
-    # Mark all other traffic from the VPN namespace
-    iptables -t mangle -A POSTROUTING -s ${service_configs.https.wg_ip}/24 -j MARK --set-mark 1
-  '';
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
+        export JELLYFIN_API_KEY=$(cat ${../secrets/jellyfin-api-key})
+        exec ${
+          pkgs.python3.withPackages (ps: with ps; [ requests ])
+        }/bin/python ${./jellyfin-qbittorrent-monitor.py}
+      '';
+      Restart = "always";
+      RestartSec = "10s";
 
-  systemd.services."traffic-shaping" =
-    let
-      upload_pipe = 44;
-      high_prio = 40;
-      low_prio = 4;
-    in
-    {
-      description = "Apply QoS to prioritize non-VPN traffic";
-      after = [
-        "network.target"
-        "vpn-wg.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = pkgs.writeShellScript "tc-setup" ''
-          # Add HTB qdisc to physical interface
-          ${pkgs.iproute2}/bin/tc qdisc add dev ${eth_interface} root handle 1: htb default 10
-
-          # Define classes:
-          # - Class 1:10 (high priority, unmarked)
-          # - Class 1:20 (low priority, marked VPN traffic)
-          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1: classid 1:1 htb rate ${builtins.toString upload_pipe}mbit ceil ${builtins.toString upload_pipe}mbit
-          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1:1 classid 1:10 htb rate ${builtins.toString high_prio}mbit ceil ${builtins.toString upload_pipe}mbit prio 1
-          ${pkgs.iproute2}/bin/tc class add dev ${eth_interface} parent 1:1 classid 1:20 htb rate ${builtins.toString low_prio}mbit ceil ${builtins.toString upload_pipe}mbit prio 2
-
-          # Direct marked packets to low-priority class
-          ${pkgs.iproute2}/bin/tc filter add dev ${eth_interface} parent 1: protocol ip prio 1 handle 1 fw flowid 1:20
-        '';
-
-        ExecStop = pkgs.writeShellScript "tc-stop" ''
-          ${pkgs.iproute2}/bin/tc filter del dev ${eth_interface} parent 1:
-          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:20
-          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:10
-          ${pkgs.iproute2}/bin/tc class del dev ${eth_interface} parent 1: classid 1:1
-          ${pkgs.iproute2}/bin/tc qdisc del dev ${eth_interface} root
-        '';
-      };
+      # Security hardening
+      DynamicUser = true;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      MemoryDenyWriteExecute = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
     };
+
+    environment = {
+      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
+      QBITTORRENT_URL = "http://${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}";
+      CHECK_INTERVAL = "30";
+    };
+  };
 }

From 719f95cba8554afb9f596bf703cdec25303f660b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 11 Sep 2025 21:51:12 -0400
Subject: [PATCH 385/847] qbt: remove limits

---
 services/qbittorrent.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f6a0589..59b36ee 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -54,8 +54,8 @@
         MaxActiveUploads = 20;
         IgnoreSlowTorrentsForQueueing = true;
 
-        GlobalUPSpeedLimit = 1000;
-        GlobalDLSpeedLimit = 1000;
+        GlobalUPSpeedLimit = 0;
+        GlobalDLSpeedLimit = 0;
 
         # Alternate speed limits for when Jellyfin is streaming
         AlternativeGlobalUPSpeedLimit = 500; # 500 KB/s when throttled

From a54135d10f691c8f05a2d95f2eaa26f9f0545ef1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 01:27:17 -0400
Subject: [PATCH 386/847] fix disabling alternate limits

---
 services/jellyfin-qbittorrent-monitor.py | 169 +++++++++--------------
 1 file changed, 62 insertions(+), 107 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index f363c28..d7f401b 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -32,8 +32,8 @@ class JellyfinQBittorrentMonitor:
         self.session = requests.Session()  # Use session for cookies
 
         # Hysteresis settings to prevent rapid switching
-        self.streaming_start_delay = 10  # seconds to wait before throttling
-        self.streaming_stop_delay = 60  # seconds to wait before removing throttle
+        self.streaming_start_delay = 10
+        self.streaming_stop_delay = 60
         self.last_state_change = 0
 
         # Try to authenticate with qBittorrent
@@ -50,18 +50,11 @@ class JellyfinQBittorrentMonitor:
         logger.info("Attempting to authenticate with qBittorrent...")
 
         try:
-            # First, try to access a simple endpoint to see if auth is needed
             test_response = self.session.get(
                 f"{self.qbittorrent_url}/api/v2/app/version", timeout=5
             )
-            logger.info(
-                f"Version endpoint test: HTTP {test_response.status_code}, Response: {test_response.text}"
-            )
-
             if test_response.status_code == 200:
-                logger.info(
-                    "qBittorrent accessible without explicit login - subnet whitelist working"
-                )
+                logger.info("qBittorrent accessible without explicit login - subnet whitelist working")
                 return True
 
         except Exception as e:
@@ -75,7 +68,6 @@ class JellyfinQBittorrentMonitor:
                 "Content-Type": "application/x-www-form-urlencoded",
             }
 
-            logger.info(f"Attempting login to {self.qbittorrent_url}/login")
             response = self.session.post(
                 f"{self.qbittorrent_url}/login",
                 data=login_data,
@@ -83,22 +75,13 @@ class JellyfinQBittorrentMonitor:
                 timeout=10,
             )
 
-            logger.info(
-                f"Login response: HTTP {response.status_code}, Response: '{response.text}'"
-            )
-
-            if response.status_code == 200:
-                if "Ok." in response.text or response.text.strip() == "Ok.":
-                    logger.info("Successfully authenticated with qBittorrent")
-                    return True
-                elif "Fails." in response.text:
-                    logger.warning(
-                        "qBittorrent login failed - authentication may be required"
-                    )
-                else:
-                    logger.info(f"Unexpected login response: '{response.text}'")
+            if response.status_code == 200 and ("Ok." in response.text or response.text.strip() == "Ok."):
+                logger.info("Successfully authenticated with qBittorrent")
+                return True
+            elif "Fails." in response.text:
+                logger.warning("qBittorrent login failed - authentication may be required")
             else:
-                logger.warning(f"Login request failed with HTTP {response.status_code}")
+                logger.warning(f"Login failed: HTTP {response.status_code}")
 
         except Exception as e:
             logger.error(f"Could not authenticate with qBittorrent: {e}")
@@ -140,97 +123,65 @@ class JellyfinQBittorrentMonitor:
 
     def check_qbittorrent_alternate_limits(self):
         """Check if alternate speed limits are currently enabled"""
-        # For qBittorrent v5.1.0, use API v2 with GET requests
         try:
-            # Try the transfer info endpoint first (more reliable)
+            response = self.session.get(
+                f"{self.qbittorrent_url}/api/v2/transfer/speedLimitsMode", timeout=10
+            )
+            if response.status_code == 200:
+                return response.text.strip() == "1"
+            else:
+                logger.warning(f"SpeedLimitsMode endpoint returned HTTP {response.status_code}")
+
+        except requests.exceptions.RequestException as e:
+            logger.error(f"SpeedLimitsMode endpoint failed: {e}")
+        except Exception as e:
+            logger.error(f"Failed to parse speedLimitsMode response: {e}")
+
+        # Fallback: try transfer info endpoint
+        try:
             response = self.session.get(
                 f"{self.qbittorrent_url}/api/v2/transfer/info", timeout=10
             )
-            logger.info(f"Transfer info endpoint: HTTP {response.status_code}")
-
             if response.status_code == 200:
                 data = response.json()
-                logger.info(f"Transfer info keys: {list(data.keys())}")
-
-                # Check for alternative speed limit status in the response
                 if "use_alt_speed_limits" in data:
-                    is_enabled = data["use_alt_speed_limits"]
-                    logger.info(f"Alternative speed limits enabled: {is_enabled}")
-                    return is_enabled
-
-            response.raise_for_status()
-
-        except requests.exceptions.RequestException as e:
-            logger.error(f"Transfer info endpoint failed: {e}")
-        except json.JSONDecodeError as e:
-            logger.error(f"Failed to parse transfer info JSON: {e}")
-
-        # Fallback: try app preferences endpoint
-        try:
-            response = self.session.get(
-                f"{self.qbittorrent_url}/api/v2/app/preferences", timeout=10
-            )
-            logger.info(f"Preferences endpoint: HTTP {response.status_code}")
-
-            if response.status_code == 200:
-                data = response.json()
-                # Look for alternative speed settings
-                if "alt_up_limit" in data or "scheduler_enabled" in data:
-                    # Check if alternative speeds are currently active
-                    # This is a bit indirect but should work
-                    logger.info(
-                        "Found preferences data, assuming alt speeds not active by default"
-                    )
-                    return False
+                    return data["use_alt_speed_limits"]
 
         except Exception as e:
-            logger.error(f"Preferences endpoint failed: {e}")
+            logger.error(f"Transfer info fallback failed: {e}")
 
-        logger.error(
-            "Failed to check qBittorrent alternate limits status: all endpoints failed"
-        )
-        return False
+        logger.warning("Could not determine qBittorrent alternate limits status, using tracked state")
+        return self.throttle_active
 
     def toggle_qbittorrent_limits(self, enable_throttle):
         """Toggle qBittorrent alternate speed limits"""
         try:
-            # Check current state
             current_throttle = self.check_qbittorrent_alternate_limits()
+            
+            if current_throttle == enable_throttle:
+                action = "enabled" if enable_throttle else "disabled"
+                logger.info(f"Alternate speed limits already {action}, no action needed")
+                return
 
-            if enable_throttle and not current_throttle:
-                try:
-                    # Use API v2 POST endpoint to toggle alternative speed limits
-                    response = self.session.post(
-                        f"{self.qbittorrent_url}/api/v2/transfer/toggleSpeedLimitsMode",
-                        timeout=10,
-                    )
-                    logger.info(
-                        f"Toggle enable response: HTTP {response.status_code}, {response.text[:100]}"
-                    )
-                    response.raise_for_status()
-                    self.throttle_active = True
-                    logger.info("✓ Enabled alternate speed limits (throttling)")
-                    return
-                except requests.exceptions.RequestException as e:
-                    logger.error(f"Failed to enable alternate speed limits: {e}")
-
-            elif not enable_throttle and current_throttle:
-                try:
-                    # Use API v2 POST endpoint to toggle alternative speed limits
-                    response = self.session.post(
-                        f"{self.qbittorrent_url}/api/v2/transfer/toggleSpeedLimitsMode",
-                        timeout=10,
-                    )
-                    logger.info(
-                        f"Toggle disable response: HTTP {response.status_code}, {response.text[:100]}"
-                    )
-                    response.raise_for_status()
-                    self.throttle_active = False
-                    logger.info("✓ Disabled alternate speed limits (normal)")
-                    return
-                except requests.exceptions.RequestException as e:
-                    logger.error(f"Failed to disable alternate speed limits: {e}")
-
+            response = self.session.post(
+                f"{self.qbittorrent_url}/api/v2/transfer/toggleSpeedLimitsMode",
+                timeout=10,
+            )
+            response.raise_for_status()
+            
+            self.throttle_active = enable_throttle
+            
+            # Verify the change took effect
+            new_state = self.check_qbittorrent_alternate_limits()
+            if new_state == enable_throttle:
+                action = "enabled" if enable_throttle else "disabled"
+                logger.info(f"✓ Successfully {action} alternate speed limits")
+            else:
+                logger.warning(f"Toggle may have failed: expected {enable_throttle}, got {new_state}")
+                    
+        except requests.exceptions.RequestException as e:
+            action = "enable" if enable_throttle else "disable"
+            logger.error(f"Failed to {action} alternate speed limits: {e}")
         except Exception as e:
             logger.error(f"Failed to toggle qBittorrent limits: {e}")
 
@@ -244,24 +195,28 @@ class JellyfinQBittorrentMonitor:
         """Apply hysteresis to prevent rapid state changes"""
         now = time.time()
 
-        # If state hasn't changed, no action needed
         if new_streaming_state == self.last_streaming_state:
             return False
 
-        # Calculate time since last state change
         time_since_change = now - self.last_state_change
 
-        # If we want to start throttling (streaming started)
+        # Start throttling (streaming started)
         if new_streaming_state and not self.last_streaming_state:
             if time_since_change >= self.streaming_start_delay:
                 self.last_state_change = now
                 return True
+            else:
+                remaining = self.streaming_start_delay - time_since_change
+                logger.info(f"Streaming started - waiting {remaining:.1f}s before enabling throttling")
 
-        # If we want to stop throttling (streaming stopped)
+        # Stop throttling (streaming stopped)
         elif not new_streaming_state and self.last_streaming_state:
             if time_since_change >= self.streaming_stop_delay:
                 self.last_state_change = now
                 return True
+            else:
+                remaining = self.streaming_stop_delay - time_since_change
+                logger.info(f"Streaming stopped - waiting {remaining:.1f}s before disabling throttling")
 
         return False
 
@@ -287,8 +242,8 @@ class JellyfinQBittorrentMonitor:
                     logger.info(
                         f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
                     )
-                else:
-                    logger.debug("No active streaming sessions")
+                elif len(active_streams) == 0 and self.last_streaming_state:
+                    logger.info("No active streaming sessions")
 
                 # Apply hysteresis and change state if needed
                 if self.should_change_state(streaming_active):

From c3514baea2078d34402fcd7648aa2edaed2dd926 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 01:30:10 -0400
Subject: [PATCH 387/847] jellyfin-monitor: cleanup + remove qbt auth

---
 services/jellyfin-qbittorrent-monitor.py | 78 +++++++-----------------
 1 file changed, 22 insertions(+), 56 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index d7f401b..a883e47 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -36,58 +36,12 @@ class JellyfinQBittorrentMonitor:
         self.streaming_stop_delay = 60
         self.last_state_change = 0
 
-        # Try to authenticate with qBittorrent
-        self.authenticate_qbittorrent()
-
     def signal_handler(self, signum, frame):
         logger.info("Received shutdown signal, cleaning up...")
         self.running = False
         self.restore_normal_limits()
         sys.exit(0)
 
-    def authenticate_qbittorrent(self):
-        """Try to authenticate with qBittorrent using empty credentials (for whitelist)"""
-        logger.info("Attempting to authenticate with qBittorrent...")
-
-        try:
-            test_response = self.session.get(
-                f"{self.qbittorrent_url}/api/v2/app/version", timeout=5
-            )
-            if test_response.status_code == 200:
-                logger.info("qBittorrent accessible without explicit login - subnet whitelist working")
-                return True
-
-        except Exception as e:
-            logger.info(f"Version endpoint failed: {e}")
-
-        try:
-            # Try login with empty credentials (should work with subnet whitelist)
-            login_data = {"username": "", "password": ""}
-            headers = {
-                "Referer": self.qbittorrent_url,
-                "Content-Type": "application/x-www-form-urlencoded",
-            }
-
-            response = self.session.post(
-                f"{self.qbittorrent_url}/login",
-                data=login_data,
-                headers=headers,
-                timeout=10,
-            )
-
-            if response.status_code == 200 and ("Ok." in response.text or response.text.strip() == "Ok."):
-                logger.info("Successfully authenticated with qBittorrent")
-                return True
-            elif "Fails." in response.text:
-                logger.warning("qBittorrent login failed - authentication may be required")
-            else:
-                logger.warning(f"Login failed: HTTP {response.status_code}")
-
-        except Exception as e:
-            logger.error(f"Could not authenticate with qBittorrent: {e}")
-
-        return False
-
     def check_jellyfin_sessions(self):
         """Check if anyone is actively streaming from Jellyfin"""
         try:
@@ -130,7 +84,9 @@ class JellyfinQBittorrentMonitor:
             if response.status_code == 200:
                 return response.text.strip() == "1"
             else:
-                logger.warning(f"SpeedLimitsMode endpoint returned HTTP {response.status_code}")
+                logger.warning(
+                    f"SpeedLimitsMode endpoint returned HTTP {response.status_code}"
+                )
 
         except requests.exceptions.RequestException as e:
             logger.error(f"SpeedLimitsMode endpoint failed: {e}")
@@ -150,17 +106,21 @@ class JellyfinQBittorrentMonitor:
         except Exception as e:
             logger.error(f"Transfer info fallback failed: {e}")
 
-        logger.warning("Could not determine qBittorrent alternate limits status, using tracked state")
+        logger.warning(
+            "Could not determine qBittorrent alternate limits status, using tracked state"
+        )
         return self.throttle_active
 
     def toggle_qbittorrent_limits(self, enable_throttle):
         """Toggle qBittorrent alternate speed limits"""
         try:
             current_throttle = self.check_qbittorrent_alternate_limits()
-            
+
             if current_throttle == enable_throttle:
                 action = "enabled" if enable_throttle else "disabled"
-                logger.info(f"Alternate speed limits already {action}, no action needed")
+                logger.info(
+                    f"Alternate speed limits already {action}, no action needed"
+                )
                 return
 
             response = self.session.post(
@@ -168,17 +128,19 @@ class JellyfinQBittorrentMonitor:
                 timeout=10,
             )
             response.raise_for_status()
-            
+
             self.throttle_active = enable_throttle
-            
+
             # Verify the change took effect
             new_state = self.check_qbittorrent_alternate_limits()
             if new_state == enable_throttle:
                 action = "enabled" if enable_throttle else "disabled"
                 logger.info(f"✓ Successfully {action} alternate speed limits")
             else:
-                logger.warning(f"Toggle may have failed: expected {enable_throttle}, got {new_state}")
-                    
+                logger.warning(
+                    f"Toggle may have failed: expected {enable_throttle}, got {new_state}"
+                )
+
         except requests.exceptions.RequestException as e:
             action = "enable" if enable_throttle else "disable"
             logger.error(f"Failed to {action} alternate speed limits: {e}")
@@ -207,7 +169,9 @@ class JellyfinQBittorrentMonitor:
                 return True
             else:
                 remaining = self.streaming_start_delay - time_since_change
-                logger.info(f"Streaming started - waiting {remaining:.1f}s before enabling throttling")
+                logger.info(
+                    f"Streaming started - waiting {remaining:.1f}s before enabling throttling"
+                )
 
         # Stop throttling (streaming stopped)
         elif not new_streaming_state and self.last_streaming_state:
@@ -216,7 +180,9 @@ class JellyfinQBittorrentMonitor:
                 return True
             else:
                 remaining = self.streaming_stop_delay - time_since_change
-                logger.info(f"Streaming stopped - waiting {remaining:.1f}s before disabling throttling")
+                logger.info(
+                    f"Streaming stopped - waiting {remaining:.1f}s before disabling throttling"
+                )
 
         return False
 

From b6ac5f561cc32632e36bf95357b894419b2e95a8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 01:53:32 -0400
Subject: [PATCH 388/847] remove nload

---
 services/wg.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/services/wg.nix b/services/wg.nix
index 540ec58..36c363e 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -14,11 +14,6 @@
     ];
   };
 
-  environment.systemPackages = with pkgs; [
-    # used to monitor bandwidth usage
-    nload
-  ];
-
   systemd.services."jellyfin-qbittorrent-monitor" = {
     description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
     after = [

From a72eb7b923fc2d6ca80a8b6a179ad518b04f5988 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 10:12:39 -0400
Subject: [PATCH 389/847] jellyfin-monitor: remove datetime

---
 services/jellyfin-qbittorrent-monitor.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index a883e47..7be6c61 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -3,7 +3,6 @@
 import requests
 import time
 import logging
-from datetime import datetime
 import sys
 import signal
 import json

From e8fe7daf46f1613e254efb20d21d8bbede6c3c51 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 11:34:58 -0400
Subject: [PATCH 390/847] jellyfin-monitor: only trigger for video

---
 services/jellyfin-qbittorrent-monitor.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 7be6c61..db336e5 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -54,7 +54,7 @@ class JellyfinQBittorrentMonitor:
             response.raise_for_status()
             sessions = response.json()
 
-            # Count active streaming sessions
+            # Count active streaming sessions (video only)
             active_streams = []
             for session in sessions:
                 if (
@@ -62,8 +62,11 @@ class JellyfinQBittorrentMonitor:
                     and session.get("PlayState", {}).get("IsPaused", True) == False
                 ):
                     item = session["NowPlayingItem"]
-                    user = session.get("UserName", "Unknown")
-                    active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
+                    # Only count video streams (Movies, Episodes, etc.)
+                    item_type = item.get("Type", "").lower()
+                    if item_type in ["movie", "episode", "video"]:
+                        user = session.get("UserName", "Unknown")
+                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
 
             return active_streams
 

From 84ea509ad66393444a5ebbbb7ce6da2129f044ae Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Sep 2025 14:57:53 -0400
Subject: [PATCH 391/847] jellyfin-monitor: only print active streams on change

---
 services/jellyfin-qbittorrent-monitor.py | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index db336e5..9e94e53 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -29,6 +29,7 @@ class JellyfinQBittorrentMonitor:
         self.throttle_active = False
         self.running = True
         self.session = requests.Session()  # Use session for cookies
+        self.last_active_streams = []
 
         # Hysteresis settings to prevent rapid switching
         self.streaming_start_delay = 10
@@ -205,19 +206,21 @@ class JellyfinQBittorrentMonitor:
                 active_streams = self.check_jellyfin_sessions()
                 streaming_active = len(active_streams) > 0
 
-                # Log current status
-                if streaming_active:
-                    logger.info(
-                        f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
-                    )
-                elif len(active_streams) == 0 and self.last_streaming_state:
-                    logger.info("No active streaming sessions")
+                if active_streams != self.last_active_streams:
+                    # Log current status
+                    if streaming_active:
+                        logger.info(
+                            f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
+                        )
+                    elif len(active_streams) == 0 and self.last_streaming_state:
+                        logger.info("No active streaming sessions")
 
                 # Apply hysteresis and change state if needed
                 if self.should_change_state(streaming_active):
                     self.last_streaming_state = streaming_active
                     self.toggle_qbittorrent_limits(streaming_active)
 
+                self.last_active_streams = active_streams
                 time.sleep(self.check_interval)
 
             except KeyboardInterrupt:

From 37aaff99dbabf871f01b22ac32d5488bcef98eb0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 15 Sep 2025 12:30:28 -0400
Subject: [PATCH 392/847] jellyfin-monitor: cleanup

---
 services/jellyfin-qbittorrent-monitor.py | 43 +++++++-----------------
 1 file changed, 12 insertions(+), 31 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 9e94e53..6a0cec5 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -42,7 +42,7 @@ class JellyfinQBittorrentMonitor:
         self.restore_normal_limits()
         sys.exit(0)
 
-    def check_jellyfin_sessions(self):
+    def check_jellyfin_sessions(self) -> list[str]:
         """Check if anyone is actively streaming from Jellyfin"""
         try:
             headers = {}
@@ -95,32 +95,15 @@ class JellyfinQBittorrentMonitor:
             logger.error(f"SpeedLimitsMode endpoint failed: {e}")
         except Exception as e:
             logger.error(f"Failed to parse speedLimitsMode response: {e}")
-
-        # Fallback: try transfer info endpoint
-        try:
-            response = self.session.get(
-                f"{self.qbittorrent_url}/api/v2/transfer/info", timeout=10
-            )
-            if response.status_code == 200:
-                data = response.json()
-                if "use_alt_speed_limits" in data:
-                    return data["use_alt_speed_limits"]
-
-        except Exception as e:
-            logger.error(f"Transfer info fallback failed: {e}")
-
-        logger.warning(
-            "Could not determine qBittorrent alternate limits status, using tracked state"
-        )
         return self.throttle_active
 
-    def toggle_qbittorrent_limits(self, enable_throttle):
+    def use_alt_limits(self, enable: bool) -> None:
         """Toggle qBittorrent alternate speed limits"""
+        action = "enabled" if enable else "disabled"
         try:
             current_throttle = self.check_qbittorrent_alternate_limits()
 
-            if current_throttle == enable_throttle:
-                action = "enabled" if enable_throttle else "disabled"
+            if current_throttle == enable:
                 logger.info(
                     f"Alternate speed limits already {action}, no action needed"
                 )
@@ -132,31 +115,29 @@ class JellyfinQBittorrentMonitor:
             )
             response.raise_for_status()
 
-            self.throttle_active = enable_throttle
+            self.throttle_active = enable
 
             # Verify the change took effect
             new_state = self.check_qbittorrent_alternate_limits()
-            if new_state == enable_throttle:
-                action = "enabled" if enable_throttle else "disabled"
-                logger.info(f"✓ Successfully {action} alternate speed limits")
+            if new_state == enable:
+                logger.info(f"Activated {action} alternate speed limits")
             else:
                 logger.warning(
-                    f"Toggle may have failed: expected {enable_throttle}, got {new_state}"
+                    f"Toggle may have failed: expected {enable}, got {new_state}"
                 )
 
         except requests.exceptions.RequestException as e:
-            action = "enable" if enable_throttle else "disable"
             logger.error(f"Failed to {action} alternate speed limits: {e}")
         except Exception as e:
             logger.error(f"Failed to toggle qBittorrent limits: {e}")
 
-    def restore_normal_limits(self):
+    def restore_normal_limits(self) -> None:
         """Ensure normal speed limits are restored on shutdown"""
         if self.throttle_active:
             logger.info("Restoring normal speed limits before shutdown...")
-            self.toggle_qbittorrent_limits(False)
+            self.use_alt_limits(False)
 
-    def should_change_state(self, new_streaming_state):
+    def should_change_state(self, new_streaming_state: bool) -> bool:
         """Apply hysteresis to prevent rapid state changes"""
         now = time.time()
 
@@ -218,7 +199,7 @@ class JellyfinQBittorrentMonitor:
                 # Apply hysteresis and change state if needed
                 if self.should_change_state(streaming_active):
                     self.last_streaming_state = streaming_active
-                    self.toggle_qbittorrent_limits(streaming_active)
+                    self.use_alt_limits(streaming_active)
 
                 self.last_active_streams = active_streams
                 time.sleep(self.check_interval)

From c2d228c4fffbde932591dffe53024330f4763d88 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 15 Sep 2025 12:30:48 -0400
Subject: [PATCH 393/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index eeb9d04..5b57478 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756679287,
-        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
+        "lastModified": 1757808926,
+        "narHash": "sha256-K6PEI5PYY94TVMH0mX3MbZNYFme7oNRKml/85BpRRAo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
+        "rev": "f21d9167782c086a33ad53e2311854a8f13c281e",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757618398,
-        "narHash": "sha256-BlGooRYcF96P356VQZi7SkGEW0Lo8TzxeYZt5CNmLew=",
+        "lastModified": 1757930910,
+        "narHash": "sha256-8qZoSCgID5bE7xVBzF7gsZc4ekUF0KbjRExpqEm7otE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0e6ff0046f4a2983b2c77950aa75960fe4b4f0e2",
+        "rev": "28c39da7c645185ade5436767929d7ec33006033",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1757103352,
-        "narHash": "sha256-PtT7ix43ss8PONJ1VJw3f6t2yAoGH+q462Sn8lrmWmk=",
+        "lastModified": 1757943327,
+        "narHash": "sha256-w6cDExPBqbq7fTLo4dZ1ozDGeq3yV6dSN4n/sAaS6OM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "11b2a10c7be726321bb854403fdeec391e798bf0",
+        "rev": "67a709cfe5d0643dafd798b0b613ed579de8be05",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757545623,
-        "narHash": "sha256-mCxPABZ6jRjUQx3bPP4vjA68ETbPLNz9V2pk9tO7pRQ=",
+        "lastModified": 1757810152,
+        "narHash": "sha256-Vp9K5ol6h0J90jG7Rm4RWZsCB3x7v5VPx588TQ1dkfs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8cd5ce828d5d1d16feff37340171a98fc3bf6526",
+        "rev": "9a094440e02a699be5c57453a092a8baf569bdad",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757552363,
-        "narHash": "sha256-4dtGagSfwMabRi59g7E8T6FcdghNizLbR4PwU1g8lDI=",
+        "lastModified": 1757898151,
+        "narHash": "sha256-FmI8VUvFKkZrQkJ/oqx0F0CnvXdv2O3nlPhVBtCGqWo=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "ec58f16bdb57cf3a17bba79f687945dca1703c64",
+        "rev": "bffcdb335e9dae8d2242ec0bfe4bab4484870c65",
         "type": "github"
       },
       "original": {

From 373453d936f081c5b85339e129ca4a449dce149c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 17 Sep 2025 10:05:24 -0400
Subject: [PATCH 394/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5b57478..d1280b3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757930910,
-        "narHash": "sha256-8qZoSCgID5bE7xVBzF7gsZc4ekUF0KbjRExpqEm7otE=",
+        "lastModified": 1758115962,
+        "narHash": "sha256-7QrXwyY/Qk6n3LeUKPbRLZ6FoBiQYWegFlRMhykBgmQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "28c39da7c645185ade5436767929d7ec33006033",
+        "rev": "c959b676be29e93f8dbc3bd6056ceba812a9eb72",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757555667,
-        "narHash": "sha256-09403AZgH/TR1bpilDm8yJucZ2hYcZm8bzY3t8NgPJQ=",
+        "lastModified": 1758073856,
+        "narHash": "sha256-2KU4Sb2WynjwKQ/+MkKjc6mpCiGfuRRQozR267cK8WI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d6d19d54dcec2a6afac3b9442643dd18e8b0566d",
+        "rev": "e8c58a920fb430a70498b3c517fd91c768423c4b",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757810152,
-        "narHash": "sha256-Vp9K5ol6h0J90jG7Rm4RWZsCB3x7v5VPx588TQ1dkfs=",
+        "lastModified": 1757941119,
+        "narHash": "sha256-TssJZFzMRYdWgpHySzKv4YQg6DUv5SDENiWbVgNTo0M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9a094440e02a699be5c57453a092a8baf569bdad",
+        "rev": "7ff837017c3b82bd3671932599a119d7bc672ff0",
         "type": "github"
       },
       "original": {

From 446ca941a24f1d99b927f077e3e7cc59ae70a8ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 19 Sep 2025 00:21:19 -0400
Subject: [PATCH 395/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index d1280b3..92fccd0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757508292,
-        "narHash": "sha256-7lVWL5bC6xBIMWWDal41LlGAG+9u2zUorqo3QCUL4p4=",
+        "lastModified": 1758160037,
+        "narHash": "sha256-fXelTdjdILspZ1IUU9aICB1+PXwSFiF8j+7ujwo1VpQ=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "146f45bee02b8bd88812cfce6ffc0f933788875a",
+        "rev": "4f554162fff88e77655073d352eec0cea71103a2",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758115962,
-        "narHash": "sha256-7QrXwyY/Qk6n3LeUKPbRLZ6FoBiQYWegFlRMhykBgmQ=",
+        "lastModified": 1758229646,
+        "narHash": "sha256-cxdqNxebqjwJU0WrEo7oZWPDi0d/m4c3C9nZpBWWuhg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c959b676be29e93f8dbc3bd6056ceba812a9eb72",
+        "rev": "69ffd891631befa9e6b485fd646a16dab4f2c007",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758073856,
-        "narHash": "sha256-2KU4Sb2WynjwKQ/+MkKjc6mpCiGfuRRQozR267cK8WI=",
+        "lastModified": 1758160258,
+        "narHash": "sha256-eI4SDDLcVAyXeap/kToncpa7SSgxRASemGpztLbat3Y=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e8c58a920fb430a70498b3c517fd91c768423c4b",
+        "rev": "d3103cbe7758645a3b757f7f3cd006a2b6a32c87",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757941119,
-        "narHash": "sha256-TssJZFzMRYdWgpHySzKv4YQg6DUv5SDENiWbVgNTo0M=",
+        "lastModified": 1758070117,
+        "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7ff837017c3b82bd3671932599a119d7bc672ff0",
+        "rev": "e9b7f2ff62b35f711568b1f0866243c7c302028d",
         "type": "github"
       },
       "original": {

From 113c6747d18aee23b58330c579ab357ba27f1377 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 19 Sep 2025 14:17:57 -0400
Subject: [PATCH 396/847] minecraft: add disconnect-packet-fix and packet-fixer

---
 services/minecraft.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index d8cbeef..9a256ee 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -111,6 +111,16 @@
               url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/DMBZUPjK/better-fabric-console-mc1.21.8-1.2.5.jar";
               sha512 = "d0de1aec66add0158e5a97424a21fc4bd0d26c54457d1bf15cd19e60939ed5d8b4dc4120a6aeec00925723b7dc431a9b84f60ad96d56a9e50620ef34b091cae6";
             };
+
+            disconnect-packet-fix = fetchurl {
+              url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
+              sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
+            };
+
+            packet-fixer = fetchurl {
+              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/V05RgbEn/packetfixer-3.3.0-1.20.5-1.21.X-merged.jar";
+              sha512 = "17fd46a5edd2ecefb67f346fa1ddd8beebd119f9c1598e91211c5d8a4691ae118d81d6628cb39705c0cf1a4d1f09299b76f72c5d286ca5b707c2508633654c12";
+            };
           }
         );
       };

From 8d21dfebf275878410ec34d19500fa2c5a91669d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 19 Sep 2025 19:51:13 -0400
Subject: [PATCH 397/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 92fccd0..1f914d8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758160037,
-        "narHash": "sha256-fXelTdjdILspZ1IUU9aICB1+PXwSFiF8j+7ujwo1VpQ=",
+        "lastModified": 1758287904,
+        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4f554162fff88e77655073d352eec0cea71103a2",
+        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757808926,
-        "narHash": "sha256-K6PEI5PYY94TVMH0mX3MbZNYFme7oNRKml/85BpRRAo=",
+        "lastModified": 1758313341,
+        "narHash": "sha256-SsI6INUzWwPcRKRaxvi50RttnD9rcC4EjV+67TOEfrQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f21d9167782c086a33ad53e2311854a8f13c281e",
+        "rev": "6f656618ebc71ca82d93d306a8aecb2c5f6f2ab2",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758229646,
-        "narHash": "sha256-cxdqNxebqjwJU0WrEo7oZWPDi0d/m4c3C9nZpBWWuhg=",
+        "lastModified": 1758320121,
+        "narHash": "sha256-K10ioo5BsZIdUhlHZHz+oRI6KqgrS0l9gsYOjJzbzGI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "69ffd891631befa9e6b485fd646a16dab4f2c007",
+        "rev": "be79d9fdd95ab8955527c4aaa67b90e8b9516718",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758070117,
-        "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=",
+        "lastModified": 1758216857,
+        "narHash": "sha256-h1BW2y7CY4LI9w61R02wPaOYfmYo82FyRqHIwukQ6SY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9b7f2ff62b35f711568b1f0866243c7c302028d",
+        "rev": "d2ed99647a4b195f0bcc440f76edfa10aeb3b743",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757898151,
-        "narHash": "sha256-FmI8VUvFKkZrQkJ/oqx0F0CnvXdv2O3nlPhVBtCGqWo=",
+        "lastModified": 1758285369,
+        "narHash": "sha256-WdkeIbq2Bo6l0tzBSCxMDeDMSKBp1iiOX7EdOHrsJCQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "bffcdb335e9dae8d2242ec0bfe4bab4484870c65",
+        "rev": "30e6b4c2e5e7b235c7d0a266994a0c93e86bcf69",
         "type": "github"
       },
       "original": {

From 4d800f4e5c612c9c6929f4f40021b5b41db5a773 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 21 Sep 2025 01:11:58 -0400
Subject: [PATCH 398/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1f914d8..e18616c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758320121,
-        "narHash": "sha256-K10ioo5BsZIdUhlHZHz+oRI6KqgrS0l9gsYOjJzbzGI=",
+        "lastModified": 1758362534,
+        "narHash": "sha256-FF4m18yU7wyRM2pZTJ2mZ1utRtsCyIVI3jSpXwvCrzs=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "be79d9fdd95ab8955527c4aaa67b90e8b9516718",
+        "rev": "7f766929ca8e8e01dcceb1c526ee584f7e5e1408",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758160258,
-        "narHash": "sha256-eI4SDDLcVAyXeap/kToncpa7SSgxRASemGpztLbat3Y=",
+        "lastModified": 1758420117,
+        "narHash": "sha256-NcigCcAmjPuRDm0K9EkH6wU5iav1x5oRjppWs5m9WcA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d3103cbe7758645a3b757f7f3cd006a2b6a32c87",
+        "rev": "95127d3f024fc3aa2e3185ee1e553d58ae111ca7",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758216857,
-        "narHash": "sha256-h1BW2y7CY4LI9w61R02wPaOYfmYo82FyRqHIwukQ6SY=",
+        "lastModified": 1758346548,
+        "narHash": "sha256-afXE7AJ7MY6wY1pg/Y6UPHNYPy5GtUKeBkrZZ/gC71E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d2ed99647a4b195f0bcc440f76edfa10aeb3b743",
+        "rev": "b2a3852bd078e68dd2b3dfa8c00c67af1f0a7d20",
         "type": "github"
       },
       "original": {

From d0836020bfbbdf21f85ab23c8cc508b4e0aebc17 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 23 Sep 2025 11:05:31 -0400
Subject: [PATCH 399/847] qbt: disable port forwarding

---
 services/qbittorrent.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 59b36ee..71cd7ef 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -198,6 +198,12 @@
         PieceExtentAffinity = true;
         SuggestMode = true;
       };
+
+      Network = {
+        # traffic is routed through a vpn, we don't need
+        # port forwarding
+        PortForwardingEnabled = false;
+      };
     };
   };
 

From 04b07f985dc5ca1503f2aa1c9d68d4eaa21a489e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 23 Sep 2025 20:01:48 -0400
Subject: [PATCH 400/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index e18616c..9d98d55 100644
--- a/flake.lock
+++ b/flake.lock
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758313341,
-        "narHash": "sha256-SsI6INUzWwPcRKRaxvi50RttnD9rcC4EjV+67TOEfrQ=",
+        "lastModified": 1758463745,
+        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6f656618ebc71ca82d93d306a8aecb2c5f6f2ab2",
+        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758362534,
-        "narHash": "sha256-FF4m18yU7wyRM2pZTJ2mZ1utRtsCyIVI3jSpXwvCrzs=",
+        "lastModified": 1758649300,
+        "narHash": "sha256-516w/MOF+ZwRXvITQybXFOH0eLUksY+Oq41WEyB1CVo=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "7f766929ca8e8e01dcceb1c526ee584f7e5e1408",
+        "rev": "f505bd83ca7a43c4585ff3d59135e77eae9c793b",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758420117,
-        "narHash": "sha256-NcigCcAmjPuRDm0K9EkH6wU5iav1x5oRjppWs5m9WcA=",
+        "lastModified": 1758592316,
+        "narHash": "sha256-1RXYdsASXZsnwhegIzT7+zmnpIrCQCM+8nfv40M3Yio=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "95127d3f024fc3aa2e3185ee1e553d58ae111ca7",
+        "rev": "f6f93f79b9337ccc089beda439d2a8d5920a9812",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1757943327,
-        "narHash": "sha256-w6cDExPBqbq7fTLo4dZ1ozDGeq3yV6dSN4n/sAaS6OM=",
+        "lastModified": 1758663926,
+        "narHash": "sha256-6CFdj7Xs616t1W4jLDH7IohAAvl5Dyib3qEv/Uqw1rk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "67a709cfe5d0643dafd798b0b613ed579de8be05",
+        "rev": "170ff93c860b2a9868ed1e1102d4e52cb3d934e1",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758346548,
-        "narHash": "sha256-afXE7AJ7MY6wY1pg/Y6UPHNYPy5GtUKeBkrZZ/gC71E=",
+        "lastModified": 1758589230,
+        "narHash": "sha256-zMTCFGe8aVGTEr2RqUi/QzC1nOIQ0N1HRsbqB4f646k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b2a3852bd078e68dd2b3dfa8c00c67af1f0a7d20",
+        "rev": "d1d883129b193f0b495d75c148c2c3a7d95789a0",
         "type": "github"
       },
       "original": {

From 3d9fd2c43f498c3067f9b2b1356c6cc8799b97ca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 26 Sep 2025 23:48:04 -0400
Subject: [PATCH 401/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9d98d55..8cfae21 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758649300,
-        "narHash": "sha256-516w/MOF+ZwRXvITQybXFOH0eLUksY+Oq41WEyB1CVo=",
+        "lastModified": 1758922109,
+        "narHash": "sha256-3S7WFZR7NjUyKjql7eyAXM9TXExYWJV/2vA9690450Y=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "f505bd83ca7a43c4585ff3d59135e77eae9c793b",
+        "rev": "72b24d96c6888c609d562779a23787304ae4609c",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758592316,
-        "narHash": "sha256-1RXYdsASXZsnwhegIzT7+zmnpIrCQCM+8nfv40M3Yio=",
+        "lastModified": 1758765258,
+        "narHash": "sha256-orU21BYUJn/7zMhIYbY7T5EDqZ8NtRMSH/f8Qtu047Q=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f6f93f79b9337ccc089beda439d2a8d5920a9812",
+        "rev": "5a6c66b90ab4519b7578b54300abc308008c544e",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758589230,
-        "narHash": "sha256-zMTCFGe8aVGTEr2RqUi/QzC1nOIQ0N1HRsbqB4f646k=",
+        "lastModified": 1758791193,
+        "narHash": "sha256-F8WmEwFoHsnix7rt290R0rFXNJiMbClMZyIC/e+HYf0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d1d883129b193f0b495d75c148c2c3a7d95789a0",
+        "rev": "25e53aa156d47bad5082ff7618f5feb1f5e02d01",
         "type": "github"
       },
       "original": {

From 27e82aa4e97d1a92e75cf2f746d74d086c0e19ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 28 Sep 2025 22:20:10 -0400
Subject: [PATCH 402/847] senior project website: update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8cfae21..03d16a9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -383,11 +383,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1756857133,
-        "narHash": "sha256-L9uRmF8ybAfMIKwAqrXfd7f1ICqBEu6tBxeWjo4xqRc=",
+        "lastModified": 1759112355,
+        "narHash": "sha256-JDdQ3CcC9u0PWC3etdGv7noYlpiu+tBrb5CVAvXldUY=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "410207b70a26784226fb5ecd9b31b725904d3abd",
+        "rev": "4ac7ed7a8c1fedde1587b0f17933ca8baba729d5",
         "type": "github"
       },
       "original": {

From d1fc515480a8d7c9949da01e70e7ec322ed90131 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 28 Sep 2025 22:28:54 -0400
Subject: [PATCH 403/847] senior project website: update

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 03d16a9..283e7fa 100644
--- a/flake.lock
+++ b/flake.lock
@@ -383,11 +383,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1759112355,
-        "narHash": "sha256-JDdQ3CcC9u0PWC3etdGv7noYlpiu+tBrb5CVAvXldUY=",
+        "lastModified": 1759112913,
+        "narHash": "sha256-5SoOzDT/2W50PrIUfZmwOoiS5VBtqJ+T4jvfMxURAb0=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "4ac7ed7a8c1fedde1587b0f17933ca8baba729d5",
+        "rev": "37284cf4cde9010ddd74b0246813baab28383089",
         "type": "github"
       },
       "original": {

From 1826c0c645ede52e20356571239c3650e582efca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 30 Sep 2025 12:23:30 -0400
Subject: [PATCH 404/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 283e7fa..3e63e21 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758922109,
-        "narHash": "sha256-3S7WFZR7NjUyKjql7eyAXM9TXExYWJV/2vA9690450Y=",
+        "lastModified": 1759243184,
+        "narHash": "sha256-Wiyg6FKuVUUDPGEdDVzZal6jidCwzH0p3AgMeuJlX7g=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "72b24d96c6888c609d562779a23787304ae4609c",
+        "rev": "364a7a6d4a786e98947c8a90430ea581213c0ba9",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758791193,
-        "narHash": "sha256-F8WmEwFoHsnix7rt290R0rFXNJiMbClMZyIC/e+HYf0=",
+        "lastModified": 1759143472,
+        "narHash": "sha256-TvODmeR2W7yX/JmOCmP+lAFNkTT7hAxYcF3Kz8SZV3w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "25e53aa156d47bad5082ff7618f5feb1f5e02d01",
+        "rev": "5ed4e25ab58fd4c028b59d5611e14ea64de51d23",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758285369,
-        "narHash": "sha256-WdkeIbq2Bo6l0tzBSCxMDeDMSKBp1iiOX7EdOHrsJCQ=",
+        "lastModified": 1759107752,
+        "narHash": "sha256-VEdL1J4rk+Z/5wHhLSsvj5QmXWKHHDeN1P8YLGLa1RM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "30e6b4c2e5e7b235c7d0a266994a0c93e86bcf69",
+        "rev": "97708379b1f3b64224632eb49a56e45fe6995e6f",
         "type": "github"
       },
       "original": {

From 2729bb5322df6021a155fb0eccbf979bf979e1bd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Oct 2025 23:45:37 -0400
Subject: [PATCH 405/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3e63e21..3fd81e4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759243184,
-        "narHash": "sha256-Wiyg6FKuVUUDPGEdDVzZal6jidCwzH0p3AgMeuJlX7g=",
+        "lastModified": 1759354359,
+        "narHash": "sha256-KUKkdR1wq8yx0xkAhbIJDWexgEYHW8Ik4HPPJimN9Z4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "364a7a6d4a786e98947c8a90430ea581213c0ba9",
+        "rev": "c8dedc9999eccf7821a9fe5b29f10e8d075e2217",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1758663926,
-        "narHash": "sha256-6CFdj7Xs616t1W4jLDH7IohAAvl5Dyib3qEv/Uqw1rk=",
+        "lastModified": 1759261527,
+        "narHash": "sha256-wPd5oGvBBpUEzMF0kWnXge0WITNsITx/aGI9qLHgJ4g=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "170ff93c860b2a9868ed1e1102d4e52cb3d934e1",
+        "rev": "e087756cf4abbe1a34f3544c480fc1034d68742f",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759143472,
-        "narHash": "sha256-TvODmeR2W7yX/JmOCmP+lAFNkTT7hAxYcF3Kz8SZV3w=",
+        "lastModified": 1759281824,
+        "narHash": "sha256-FIBE1qXv9TKvSNwst6FumyHwCRH3BlWDpfsnqRDCll0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5ed4e25ab58fd4c028b59d5611e14ea64de51d23",
+        "rev": "5b5be50345d4113d04ba58c444348849f5585b4a",
         "type": "github"
       },
       "original": {
@@ -403,11 +403,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759107752,
-        "narHash": "sha256-VEdL1J4rk+Z/5wHhLSsvj5QmXWKHHDeN1P8YLGLa1RM=",
+        "lastModified": 1759366584,
+        "narHash": "sha256-GoeShBq/+xv9g9POP69vbOrObpLtS/mDfF1/pfPIQrU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "97708379b1f3b64224632eb49a56e45fe6995e6f",
+        "rev": "1dbb22b9b15f449a7c8c92a94aec9fe5aea8ef7c",
         "type": "github"
       },
       "original": {

From 05933c9b84c7ef818951110cda8cd9bfb09a776f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Oct 2025 21:29:43 -0400
Subject: [PATCH 406/847] llama-cpp: change model

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 167b073..3272506 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/ggml-org/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-mxfp4.gguf";
-        sha256 = "52f57ab7d3df3ba9173827c1c6832e73375553a846f3e32b49f1ae2daad688d4";
+        url = "https://huggingface.co/rodrigomt/Qwen3-30B-A3B-Thinking-Deepseek-Distill-2507-v3.1-V2-GGUF/resolve/main/Qwen3-30B-A3B-Thinking-Deepseek-Distill-2507-v3.1-V2-UD-Q4_K_XL.gguf";
+        sha256 = "1a3abffc8463041e24cdc43af26c99b6cfab1d2ee78fef0d793033ec0e5b58aa";
       }
     );
     port = service_configs.ports.llama_cpp;

From 386e602697c3aeb31400ae153ceb966ac6fd06c4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Oct 2025 21:30:02 -0400
Subject: [PATCH 407/847] llama-cpp: re-enable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 9378fac..1fc10bc 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -29,7 +29,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
 
     ./services/ups.nix
 

From 16b829ae30328462981796afce8aa16e3cdc3de8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Oct 2025 22:26:25 -0400
Subject: [PATCH 408/847] llama-cpp: fix postPatch phase

---
 services/llama-cpp.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 3272506..208e396 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -18,7 +18,13 @@
     port = service_configs.ports.llama_cpp;
     host = "0.0.0.0";
     # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
+    package = (
+      lib.optimizePackage (
+        inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
+          postPatch = "";
+        })
+      )
+    );
     extraFlags = [
       # "-ngl"
       # "9999"

From 98f27e715d0d49fbc6862cb78f16e6aae51cf3ce Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Oct 2025 22:26:30 -0400
Subject: [PATCH 409/847] Revert "llama-cpp: re-enable"

This reverts commit e98a23934a8cf18fee3dbc98d502fc877e20db9f.
---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 1fc10bc..9378fac 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -29,7 +29,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
 
     ./services/ups.nix
 

From b66cf9ad99385d29bf19380a7ff8fc4d3ebf30af Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Oct 2025 14:05:56 -0400
Subject: [PATCH 410/847] minecraft: update lithium

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 9a256ee..d8eb700 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -73,8 +73,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/pDfTqezk/lithium-fabric-0.18.0%2Bmc1.21.8.jar";
-              sha512 = "6c69950760f48ef88f0c5871e61029b59af03ab5ed9b002b6a470d7adfdf26f0b875dcd360b664e897291002530981c20e0b2890fb889f29ecdaa007f885100f";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/qxIL7Kb8/lithium-fabric-0.18.1%2Bmc1.21.8.jar";
+              sha512 = "ef3e0820c7c831c352cbd5afa4a1f4ff73db0fa3c4e4428ba35ad2faeb8e7bce8ae4805a04934be82099012444a70c0a2cf2049f2af95fe688ca84d94d1c4672";
             };
 
             NoChatReports = fetchurl {

From 141665ee72788a3d268a92a601af621b173fc5f5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 4 Oct 2025 20:05:21 -0400
Subject: [PATCH 411/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3fd81e4..91b4ab6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759354359,
-        "narHash": "sha256-KUKkdR1wq8yx0xkAhbIJDWexgEYHW8Ik4HPPJimN9Z4=",
+        "lastModified": 1759608267,
+        "narHash": "sha256-LzcAxpJ/OWhMDeAw59wu3+Qv91mCXkTv02l5r/1kGlU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c8dedc9999eccf7821a9fe5b29f10e8d075e2217",
+        "rev": "86df2c9ae4f2f1ee63d2558a9dc797b98524639b",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1759261527,
-        "narHash": "sha256-wPd5oGvBBpUEzMF0kWnXge0WITNsITx/aGI9qLHgJ4g=",
+        "lastModified": 1759582739,
+        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "e087756cf4abbe1a34f3544c480fc1034d68742f",
+        "rev": "3441b5242af7577230a78ffb03542add264179ab",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759281824,
-        "narHash": "sha256-FIBE1qXv9TKvSNwst6FumyHwCRH3BlWDpfsnqRDCll0=",
+        "lastModified": 1759439645,
+        "narHash": "sha256-oiAyQaRilPk525Z5aTtTNWNzSrcdJ7IXM0/PL3CGlbI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5b5be50345d4113d04ba58c444348849f5585b4a",
+        "rev": "879bd460b3d3e8571354ce172128fbcbac1ed633",
         "type": "github"
       },
       "original": {

From 556e76617450a2ad605970193436944f47336d71 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 5 Oct 2025 16:11:22 -0400
Subject: [PATCH 412/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 91b4ab6..32e1599 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759608267,
-        "narHash": "sha256-LzcAxpJ/OWhMDeAw59wu3+Qv91mCXkTv02l5r/1kGlU=",
+        "lastModified": 1759669067,
+        "narHash": "sha256-L0R8SAoVvZIGG8zH/7BDWFdgsISzViZJHzeimcIOIqY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "86df2c9ae4f2f1ee63d2558a9dc797b98524639b",
+        "rev": "ca71fb9b368e3db96e028f80c4c9df6b6b370edd",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759439645,
-        "narHash": "sha256-oiAyQaRilPk525Z5aTtTNWNzSrcdJ7IXM0/PL3CGlbI=",
+        "lastModified": 1759580034,
+        "narHash": "sha256-YWo57PL7mGZU7D4WeKFMiW4ex/O6ZolUS6UNBHTZfkI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "879bd460b3d3e8571354ce172128fbcbac1ed633",
+        "rev": "3bcc93c5f7a4b30335d31f21e2f1281cba68c318",
         "type": "github"
       },
       "original": {

From e64520311897e41eac1991d09691bfd9d5f8eb61 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Oct 2025 01:42:37 -0400
Subject: [PATCH 413/847] llama.cpp: testing

---
 services/llama-cpp.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 208e396..dc7a368 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/rodrigomt/Qwen3-30B-A3B-Thinking-Deepseek-Distill-2507-v3.1-V2-GGUF/resolve/main/Qwen3-30B-A3B-Thinking-Deepseek-Distill-2507-v3.1-V2-UD-Q4_K_XL.gguf";
-        sha256 = "1a3abffc8463041e24cdc43af26c99b6cfab1d2ee78fef0d793033ec0e5b58aa";
+        url = "https://huggingface.co/ggml-org/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-mxfp4.gguf";
+        sha256 = "be37a636aca0fc1aae0d32325f82f6b4d21495f06823b5fbc1898ae0303e9935";
       }
     );
     port = service_configs.ports.llama_cpp;
@@ -20,14 +20,16 @@
     # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
     package = (
       lib.optimizePackage (
-        inputs.llamacpp.packages.${pkgs.system}.default.overrideAttrs (old: {
+        inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
           postPatch = "";
         })
       )
     );
     extraFlags = [
-      # "-ngl"
-      # "9999"
+      "-ngl"
+      "5"
+      "-c"
+      "16384"
     ];
   };
 

From c88fbebb88bc14245c98903015f17141e830644a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Oct 2025 01:24:37 -0400
Subject: [PATCH 414/847] impermanence

---
 configuration.nix        |  6 +++--
 disk-config.nix          | 27 +++++++++++++++++++--
 flake.lock               | 28 +++++++++++++++++-----
 flake.nix                |  7 ++++++
 impermanence.nix         | 52 ++++++++++++++++++++++++++++++++++++++++
 services/bitwarden.nix   |  4 ++--
 services/gitea.nix       |  2 +-
 services/immich.nix      |  2 +-
 services/jellyfin.nix    |  4 ++--
 services/matrix.nix      |  2 +-
 services/minecraft.nix   |  4 ++--
 services/owntracks.nix   |  2 +-
 services/postgresql.nix  |  2 +-
 services/qbittorrent.nix |  6 ++---
 services/soulseek.nix    |  8 +++----
 15 files changed, 128 insertions(+), 28 deletions(-)
 create mode 100644 impermanence.nix

diff --git a/configuration.nix b/configuration.nix
index 9378fac..e944a61 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -13,6 +13,7 @@
   imports = [
     ./hardware.nix
     ./zfs.nix
+    ./impermanence.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -97,6 +98,7 @@
 
     initrd = {
       compressor = "zstd";
+      supportedFilesystems = [ "f2fs" ];
     };
 
     loader.systemd-boot.enable = lib.mkForce false;
@@ -284,7 +286,7 @@
     ];
 
     # TODO! use proper secrets management
-    # hashedPasswordFile = builtins.toString ./secrets/hashedPass;
+    hashedPassword = lib.strings.trim (builtins.readFile ./secrets/hashedPass);
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
@@ -339,7 +341,7 @@
   # };
 
   # systemd.tmpfiles.rules = [
-  #   "d /tank/music 775 ${username} users"
+  #   "Z /tank/music 775 ${username} users"
   # ];
 
   system.stateVersion = "24.11";
diff --git a/disk-config.nix b/disk-config.nix
index 25580ff..9a487ca 100644
--- a/disk-config.nix
+++ b/disk-config.nix
@@ -15,17 +15,40 @@
                 mountpoint = "/boot";
               };
             };
-            root = {
+            persistent = {
+              size = "20G";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/persistent";
+              };
+            };
+            nix = {
               size = "100%";
               content = {
                 type = "filesystem";
                 format = "f2fs";
-                mountpoint = "/";
+                mountpoint = "/nix";
               };
             };
+
           };
         };
       };
     };
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=2G"
+          "mode=755"
+        ];
+      };
+    };
   };
+
+  fileSystems."/persistent".neededForBoot = true;
+  fileSystems."/nix".neededForBoot = true;
+
 }
diff --git a/flake.lock b/flake.lock
index 32e1599..5b3b2f5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -205,6 +205,21 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
@@ -238,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759669067,
-        "narHash": "sha256-L0R8SAoVvZIGG8zH/7BDWFdgsISzViZJHzeimcIOIqY=",
+        "lastModified": 1759814657,
+        "narHash": "sha256-AZ8CPyyI4Nn9ietsOKu28zle5r0JiJrwOHy1m9sUmbM=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "ca71fb9b368e3db96e028f80c4c9df6b6b370edd",
+        "rev": "0123ff38f53d34752f29239a29d0e40a6dc4110f",
         "type": "github"
       },
       "original": {
@@ -291,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759580034,
-        "narHash": "sha256-YWo57PL7mGZU7D4WeKFMiW4ex/O6ZolUS6UNBHTZfkI=",
+        "lastModified": 1759735786,
+        "narHash": "sha256-a0+h02lyP2KwSNrZz4wLJTu9ikujNsTWIC874Bv7IJ0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3bcc93c5f7a4b30335d31f21e2f1281cba68c318",
+        "rev": "20c4598c84a671783f741e02bf05cbfaf4907cff",
         "type": "github"
       },
       "original": {
@@ -348,6 +363,7 @@
         "deploy-rs": "deploy-rs",
         "disko": "disko",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
diff --git a/flake.nix b/flake.nix
index ee2a5db..ca52512 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    impermanence = {
+      url = "github:nix-community/impermanence";
+    };
+
     senior_project-website = {
       url = "github:Titaniumtown/senior-project-website";
       flake = false;
@@ -66,6 +70,7 @@
       disko,
       srvos,
       deploy-rs,
+      impermanence,
       ...
     }@inputs:
     let
@@ -196,6 +201,8 @@
           disko.nixosModules.disko
           ./configuration.nix
 
+          impermanence.nixosModules.impermanence
+
           vpn-confinement.nixosModules.default
 
           # get nix-minecraft working!
diff --git a/impermanence.nix b/impermanence.nix
new file mode 100644
index 0000000..112b9cb
--- /dev/null
+++ b/impermanence.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  service_configs,
+  ...
+}:
+{
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/systemd/coredump"
+      "/var/lib/nixos"
+
+      "/var/lib/systemd/timers"
+    ];
+
+    files = [
+      # SSH host keys
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+
+      # Machine ID
+      "/etc/machine-id"
+
+      # ZFS cache
+      "/etc/zfs/zpool.cache"
+    ];
+
+    users.${username} = {
+      files = [
+        ".local/share/fish/fish_history"
+      ];
+    };
+
+    users.root = {
+      home = "/root";
+
+      files = [
+        ".local/share/fish/fish_history"
+      ];
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /etc 755 root"
+  ];
+}
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 59f8f3c..67d41bc 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -42,7 +42,7 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
-    "d ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
+    "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
+    "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
   ];
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index 040072d..38cfc78 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -45,7 +45,7 @@
 
   systemd.tmpfiles.rules = [
     # 0700 for ssh permission reasons
-    "d ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
+    "Z ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
 
   services.postgresql = {
diff --git a/services/immich.nix b/services/immich.nix
index ad2df48..cd0c863 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -30,7 +30,7 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
+    "Z ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
   ];
 
   environment.systemPackages = with pkgs; [
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index fedf687..4e715e9 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -32,8 +32,8 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.jellyfin.dataDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
-    "d ${config.services.jellyfin.cacheDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "Z ${config.services.jellyfin.dataDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "Z ${config.services.jellyfin.cacheDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
   ];
 
   users.users.${config.services.jellyfin.user}.extraGroups = [
diff --git a/services/matrix.nix b/services/matrix.nix
index 88d1e56..dee5cb4 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -50,7 +50,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d /var/lib/private/matrix-conduit 0770 conduit conduit"
+    "Z /var/lib/private/matrix-conduit 0770 conduit conduit"
   ];
 
   # for federation
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d8eb700..274d3c2 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -142,7 +142,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
 }
diff --git a/services/owntracks.nix b/services/owntracks.nix
index 0b59d51..b5734ac 100644
--- a/services/owntracks.nix
+++ b/services/owntracks.nix
@@ -32,7 +32,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
+    "Z ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
   ];
 
   services.caddy.virtualHosts."owntracks.${service_configs.https.domain}".extraConfig = ''
diff --git a/services/postgresql.nix b/services/postgresql.nix
index 5a2207a..bab8ef9 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -20,7 +20,7 @@
 
   systemd.tmpfiles.rules = [
     # postgresql requires 0700
-    "d ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
+    "Z ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
   ];
 
   users.users.${username}.extraGroups = [
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 71cd7ef..f1e36ad 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -208,9 +208,9 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
-    "d ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
-    "d ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+    "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
   ];
 
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 72536e7..b6c42c6 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -68,10 +68,10 @@ in
   users.users.${username}.extraGroups = [ "music" ];
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.music_dir} 0750 ${username} music"
-    "d ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
-    "d ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
-    "d ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
+    "Z ${service_configs.music_dir} 0750 ${username} music"
+    "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
+    "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
+    "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
   ];
 
   # doesn't work with auth????

From 3a4ffd5e1a86d9fc4a9c00e366404d589b964782 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Oct 2025 14:06:38 -0400
Subject: [PATCH 415/847] minecraft 10gb -> 4gb

---
 services/minecraft.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 274d3c2..4af9beb 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -39,7 +39,7 @@
 
       jvmOpts =
         let
-          heap_size = "10000M";
+          heap_size = "4000M";
         in
         "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 

From 288ec6f564860934d6b43207364734e92cc232f4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 8 Oct 2025 12:29:38 -0400
Subject: [PATCH 416/847] qbt: use trackerlist repo instead of managing my own
 trackerlist

---
 flake.lock               |  17 ++++++
 flake.nix                |   5 ++
 services/qbittorrent.nix | 122 +--------------------------------------
 3 files changed, 25 insertions(+), 119 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5b3b2f5..0a1ec35 100644
--- a/flake.lock
+++ b/flake.lock
@@ -371,6 +371,7 @@
         "nixpkgs": "nixpkgs",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
+        "trackerlist": "trackerlist",
         "vpn-confinement": "vpn-confinement",
         "website": "website"
       }
@@ -462,6 +463,22 @@
         "type": "github"
       }
     },
+    "trackerlist": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1759875036,
+        "narHash": "sha256-VMVludE48zR8cAWW5N7dt1MD1NRgH7YQIm3nZXucTHQ=",
+        "owner": "ngosang",
+        "repo": "trackerslist",
+        "rev": "d21a5ba2e7ea0894c63b0369d69aefce4057c8a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ngosang",
+        "repo": "trackerslist",
+        "type": "github"
+      }
+    },
     "utils": {
       "inputs": {
         "systems": "systems"
diff --git a/flake.nix b/flake.nix
index ca52512..7d40bad 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,6 +56,11 @@
       url = "git+https://git.gardling.com/titaniumtown/website";
       flake = false;
     };
+
+    trackerlist = {
+      url = "github:ngosang/trackerslist";
+      flake = false;
+    };
   };
 
   outputs =
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index f1e36ad..577dfe2 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -4,6 +4,7 @@
   service_configs,
   username,
   lib,
+  inputs,
   ...
 }:
 {
@@ -65,126 +66,9 @@
         GlobalMaxRatio = 6.0;
 
         AddTrackersEnabled = true;
-        AdditionalTrackers = (
-          lib.concatStringsSep "\\n" [
-            "http://0123456789nonexistent.com:80/announce"
-            "http://0d.kebhana.mx:443/announce"
-            "http://1337.abcvg.info:80/announce"
-            "http://bittorrent-tracker.e-n-c-r-y-p-t.net:1337/announce"
-            "http://bt1.xxxxbt.cc:6969/announce"
-            "http://bt.poletracker.org:2710/announce"
-            "http://buny.uk:6969/announce"
-            "http://finbytes.org:80/announce.php"
-            "http://highteahop.top:6960/announce"
-            "http://home.yxgz.club:6969/announce"
-            "http://open.tracker.cl:1337/announce"
-            "http://open.trackerlist.xyz:80/announce"
-            "http://p4p.arenabg.com:1337/announce"
-            "http://public.tracker.vraphim.com:6969/announce"
-            "http://region.nl1.privex.cc:6969/announce"
-            "http://retracker.spark-rostov.ru:80/announce"
-            "http://seeders-paradise.org:80/announce"
-            "http://servandroidkino.ru:80/announce"
-            "http://share.hkg-fansub.info:80/announce.php"
-            "http://shubt.net:2710/announce"
-            "https://sparkle.ghostchu-services.top:443/announce"
-            "https://tracker.bt4g.com:443/announce"
-            "https://tracker.expli.top:443/announce"
-            "https://tracker.gcrenwp.top:443/announce"
-            "https://tracker.ghostchu-services.top:443/announce"
-            "https://tracker.leechshield.link:443/announce"
-            "https://tracker.moeblog.cn:443/announce"
-            "https://tracker.pmman.tech:443/announce"
-            "https://tracker.yemekyedim.com:443/announce"
-            "https://tracker.zhuqiy.top:443/announce"
-            "https://tr.zukizuki.org:443/announce"
-            "http://taciturn-shadow.spb.ru:6969/announce"
-            "http://t.jaekr.sh:6969/announce"
-            "http://t.overflow.biz:6969/announce"
-            "http://tracker1.bt.moack.co.kr:80/announce"
-            "http://tracker1.itzmx.com:8080/announce"
-            "http://tracker.23794.top:6969/announce"
-            "http://tracker2.dler.org:80/announce"
-            "http://tracker810.xyz:11450/announce"
-            "http://tracker.bittor.pw:1337/announce"
-            "http://tracker.bt4g.com:2095/announce"
-            "http://tracker.bt-hash.com:80/announce"
-            "http://tracker.bz:80/announce"
-            "http://tracker.corpscorp.online:80/announce"
-            "http://tracker.darkness.services:6969/announce"
-            "http://tracker.dler.com:6969/announce"
-            "http://tracker.dler.org:6969/announce"
-            "http://tracker.dmcomic.org:2710/announce"
-            "http://tracker.files.fm:6969/announce"
-            "http://tracker.ghostchu-services.top:80/announce"
-            "http://tracker.ipv6tracker.org:80/announce"
-            "http://tracker.lintk.me:2710/announce"
-            "http://tracker.moxing.party:6969/announce"
-            "http://tracker.mywaifu.best:6969/announce"
-            "http://tracker.opentrackr.org:1337/announce"
-            "http://tracker.qu.ax:6969/announce"
-            "http://tracker.renfei.net:8080/announce"
-            "http://tracker.sbsub.com:2710/announce"
-            "http://tracker.vanitycore.co:6969/announce"
-            "http://tracker.waaa.moe:6969/announce"
-            "http://tracker.xiaoduola.xyz:6969/announce"
-            "http://tracker.zhuqiy.top:80/announce"
-            "http://tr.kxmp.cf:80/announce"
-            "http://wepzone.net:6969/announce"
-            "http://www.genesis-sp.org:2710/announce"
-            "http://www.torrentsnipe.info:2701/announce"
-            "udp://1c.premierzal.ru:6969/announce"
-            "udp://bandito.byterunner.io:6969/announce"
-            "udp://bittorrent-tracker.e-n-c-r-y-p-t.net:1337/announce"
-            "udp://bt.ktrackers.com:6666/announce"
-            "udp://concen.org:6969/announce"
-            "udp://d40969.acod.regrucolo.ru:6969/announce"
-            "udp://discord.heihachi.pw:6969/announce"
-            "udp://evan.im:6969/announce"
-            "udp://exodus.desync.com:6969/announce"
-            "udp://explodie.org:6969/announce"
-            "udp://inferno.demonoid.is:3391/announce"
-            "udp://ipv4announce.sktorrent.eu:6969/announce"
-            "udp://ipv4.rer.lol:2710/announce"
-            "udp://isk.richardsw.club:6969/announce"
-            "udp://leet-tracker.moe:1337/announce"
-            "udp://martin-gebhardt.eu:25/announce"
-            "udp://ns-1.x-fins.com:6969/announce"
-            "udp://open.demonii.com:1337"
-            "udp://open.demonii.com:1337/announce"
-            "udp://open.dstud.io:6969/announce"
-            "udp://open.free-tracker.ga:6969/announce"
-            "udp://open.stealth.si:80/announce"
-            "udp://open.tracker.cl:1337/announce"
-            "udp://opentracker.io:6969/announce"
-            "udp://p4p.arenabg.com:1337/announce"
-            "udp://public.tracker.vraphim.com:6969/announce"
-            "udp://retracker01-msk-virt.corbina.net:80/announce"
-            "udp://retracker.lanta.me:2710/announce"
-            "udp://t.overflow.biz:6969/announce"
-            "udp://tr4ck3r.duckdns.org:6969/announce"
-            "udp://tracker2.dler.org:80/announce"
-            "udp://tracker.bittor.pw:1337/announce"
-            "udp://tracker.dler.com:6969/announce"
-            "udp://tracker.dler.org:6969/announce"
-            "udp://tracker.filemail.com:6969/announce"
-            "udp://tracker.fnix.net:6969/announce"
-            "udp://tracker.gigantino.net:6969/announce"
-            "udp://tracker.gmi.gd:6969/announce"
-            "udp://tracker.ololosh.space:6969/announce"
-            "udp://tracker.openbittorrent.com:80"
-            "udp://tracker.opentrackr.org:1337/announce"
-            "udp://tracker.srv00.com:6969/announce"
-            "udp://tracker.therarbg.to:6969/announce"
-            "udp://tracker.tiny-vps.com:6969/announce"
-            "udp://tracker.torrent.eu.org:451/announce"
-            "udp://tracker.torrust-demo.com:6969/announce"
-            "udp://tracker.tryhackx.org:6969/announce"
-            "udp://ttk2.nbaonlineservice.com:6969/announce"
-            "udp://wepzone.net:6969/announce"
-          ]
+        AdditionalTrackers = builtins.replaceStrings [ "\n" ] [ "\\n" ] (
+          builtins.readFile "${inputs.trackerlist}/trackers_all.txt"
         );
-
         AnnounceToAllTrackers = true;
 
         # idk why it also has to be specified here too?

From a41fbaab2e268865916c5490e72ceb26183b794f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Oct 2025 11:51:26 -0400
Subject: [PATCH 417/847] minecraft: fix caddy user group

---
 services/minecraft.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 4af9beb..7155ff8 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -137,7 +137,7 @@
   users.users = lib.mkIf (config.services.caddy.enable) {
     ${config.services.caddy.user}.extraGroups = [
       # for `map.gardling.com`
-      "minecraft"
+      config.services.minecraft-servers.group
     ];
   };
 

From 7c20e63a87e162764991e4628400e572b650472f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Oct 2025 12:35:15 -0400
Subject: [PATCH 418/847] minecraft: update to 1.21.10

---
 flake.lock             |  6 +++---
 services/minecraft.nix | 31 +++++++++++++------------------
 2 files changed, 16 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0a1ec35..d445fe5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758765258,
-        "narHash": "sha256-orU21BYUJn/7zMhIYbY7T5EDqZ8NtRMSH/f8Qtu047Q=",
+        "lastModified": 1760076010,
+        "narHash": "sha256-vuVLiuYe9h4abKZuBsMcDIkfZzoB5GnP/+yZVtuAf9U=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "5a6c66b90ab4519b7578b54300abc308008c544e",
+        "rev": "7f793e9a1c4db27ccac6aa934fc500665255614d",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 7155ff8..acedc45 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -35,7 +35,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_8;
+      package = pkgs.fabricServers.fabric-1_21_10;
 
       jvmOpts =
         let
@@ -63,8 +63,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/zhzhM2yQ/fabric-api-0.130.0%2B1.21.8.jar";
-              sha512 = "27399d629d3fb955c8fc1e5e86cacb9b124814bb97ee7fe283336b0e28f5eb9ae31619814ab4aef70c5beea908d2a1ed5a8dd6b8641a53ecd50375d50067f061";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/qNm2IWMn/fabric-api-0.135.0%2B1.21.10.jar";
+              sha512 = "7a3e442ab69be2ce8413580a198e13c87f1135699b5549a12a31b82dc9ddfa9b6731d774ebc36c752387010c51d018ac6aa85fcadfcb6254df8144d7e71235aa";
             };
 
             FerriteCore = fetchurl {
@@ -73,8 +73,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/qxIL7Kb8/lithium-fabric-0.18.1%2Bmc1.21.8.jar";
-              sha512 = "ef3e0820c7c831c352cbd5afa4a1f4ff73db0fa3c4e4428ba35ad2faeb8e7bce8ae4805a04934be82099012444a70c0a2cf2049f2af95fe688ca84d94d1c4672";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/oGKQMdyZ/lithium-fabric-0.20.0%2Bmc1.21.10.jar";
+              sha512 = "755c0e0fc7f6f38ac4d936cc6023d1dce6ecfd8d6bdc2c544c2a3c3d6d04f0d85db53722a089fa8be72ae32fc127e87f5946793ba6e8b4f2c2962ed30d333ed2";
             };
 
             NoChatReports = fetchurl {
@@ -83,8 +83,8 @@
             };
 
             squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/V9xWIMui/squaremap-fabric-mc1.21.8-1.3.8.jar";
-              sha512 = "ed32aca04ef0ad6d46549f9309a342624b64857296515037e5531611d43a7f5d4a6b97f6495f76d2ecfdfac9e4f0bf8a66c938c379cdddae59c8a7f2fe0c03f4";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/f4ZOYenB/squaremap-fabric-mc1.21.10-1.3.9.jar";
+              sha512 = "ddc2105568cb935eb269cfbb82b601189aa0c6c5ac98240188a3196e3e8454c23af86e95765153bd72285e9728dd8d0e587b4bcc3967f2636c5139f363e05f97";
             };
 
             scalablelux = fetchurl {
@@ -93,23 +93,18 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/RzzXyBlx/c2me-fabric-mc1.21.8-0.3.4%2Brc.1.0.jar";
-              sha512 = "4addc9ccbc66b547c96152c7fafcaccde47eefa62b0e99a31f7b4ee5844ac738f2557909bd74e1f755ff4835ce13e8ff6c556f8ebda276370912f50ebd054e3a";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/Bl0VOr1e/c2me-fabric-mc1.21.10-0.3.5%2Bbeta.1.0.jar";
+              sha512 = "8ad90725b9cb79d567f8985e330c2da0a28f4cf9a3556ac078aa2bc4d0b68ca057417ec1f1fd42f92a04f76cdfe72ceab4e5cdec2bbaf443498884a5759d6ee4";
             };
 
             krypton = fetchurl {
-              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/neW85eWt/krypton-0.2.9.jar";
-              sha512 = "2e2304b1b17ecf95783aee92e26e54c9bfad325c7dfcd14deebf9891266eb2933db00ff77885caa083faa96f09c551eb56f93cf73b357789cb31edad4939ffeb";
-            };
-
-            spark = fetchurl {
-              url = "https://cdn.modrinth.com/data/l6YH9Als/versions/3KCl7Vx0/spark-1.10.142-fabric.jar";
-              sha512 = "95b7e4f2416e20abf9d9df41fcbce04f28ebf0aa086374742652789a88642dd6820c8884ab240334555345b49c39f7d0caf23d521cec9516991ef43ba24758af";
+              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/O9LmWYR7/krypton-0.2.10.jar";
+              sha512 = "4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab";
             };
 
             better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/DMBZUPjK/better-fabric-console-mc1.21.8-1.2.5.jar";
-              sha512 = "d0de1aec66add0158e5a97424a21fc4bd0d26c54457d1bf15cd19e60939ed5d8b4dc4120a6aeec00925723b7dc431a9b84f60ad96d56a9e50620ef34b091cae6";
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/laxelUM5/better-fabric-console-mc1.21.10-1.2.6.jar";
+              sha512 = "b458699a2f555db6fb150e7663188b54bc931e1e03c0dd35823aea570e55d0fa844b334ab9d9f605e038eeb65a71350ef2058cd105cca7c154920a8adec17d47";
             };
 
             disconnect-packet-fix = fetchurl {

From c659e3a77c3b891178e07158c7c7560e8ee862bc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Oct 2025 12:35:49 -0400
Subject: [PATCH 419/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index d445fe5..de028be 100644
--- a/flake.lock
+++ b/flake.lock
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759814657,
-        "narHash": "sha256-AZ8CPyyI4Nn9ietsOKu28zle5r0JiJrwOHy1m9sUmbM=",
+        "lastModified": 1760105851,
+        "narHash": "sha256-ke3HP7YlBMpKi4J3sFUszulxcRLVzjchG844pgf+PDw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0123ff38f53d34752f29239a29d0e40a6dc4110f",
+        "rev": "81086cd6a3ca1252f0dc0f938171648399179c53",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1759582739,
-        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
+        "lastModified": 1760106635,
+        "narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3441b5242af7577230a78ffb03542add264179ab",
+        "rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
         "type": "github"
       },
       "original": {
@@ -306,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759735786,
-        "narHash": "sha256-a0+h02lyP2KwSNrZz4wLJTu9ikujNsTWIC874Bv7IJ0=",
+        "lastModified": 1759994382,
+        "narHash": "sha256-wSK+3UkalDZRVHGCRikZ//CyZUJWDJkBDTQX1+G77Ow=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "20c4598c84a671783f741e02bf05cbfaf4907cff",
+        "rev": "5da4a26309e796daa7ffca72df93dbe53b8164c7",
         "type": "github"
       },
       "original": {
@@ -466,11 +466,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1759875036,
-        "narHash": "sha256-VMVludE48zR8cAWW5N7dt1MD1NRgH7YQIm3nZXucTHQ=",
+        "lastModified": 1760047816,
+        "narHash": "sha256-B87Mb+B3QhUJxnlTuupM9mGu2iRRJtBbfi+VL92aiGY=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "d21a5ba2e7ea0894c63b0369d69aefce4057c8a9",
+        "rev": "bc9e4b69ff14a4c17f6c1a4ac6baad8360739075",
         "type": "github"
       },
       "original": {
@@ -499,11 +499,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1749672087,
-        "narHash": "sha256-j8LG0s0QcvNkZZLcItl78lvTZemvsScir0dG3Ii4B1c=",
+        "lastModified": 1759956062,
+        "narHash": "sha256-NUZu0Rb0fwUjfdp51zMm0xM3lcK8Kw4c97LLog7+JjA=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "880b3bd2c864dce4f6afc79f6580ca699294c011",
+        "rev": "fabe7247b720b5eb4c3c053e24a2b3b70e64c52b",
         "type": "github"
       },
       "original": {

From 446bdb86610a2d49f614327a1541e8e07cc92525 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 10 Oct 2025 12:59:39 -0400
Subject: [PATCH 420/847] minecraft: disable scalable lux

---
 services/minecraft.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index acedc45..c66dc41 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -87,10 +87,12 @@
               sha512 = "ddc2105568cb935eb269cfbb82b601189aa0c6c5ac98240188a3196e3e8454c23af86e95765153bd72285e9728dd8d0e587b4bcc3967f2636c5139f363e05f97";
             };
 
-            scalablelux = fetchurl {
-              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PQLHDg2Q/ScalableLux-0.1.5%2Bfabric.e4acdcb-all.jar";
-              sha512 = "ec8fabc3bf991fbcbe064c1e97ded3e70f145a87e436056241cbb1e14c57ea9f59ef312f24c205160ccbda43f693e05d652b7f19aa71f730caec3bb5f7f7820a";
-            };
+            /*
+              scalablelux = fetchurl {
+                url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PQLHDg2Q/ScalableLux-0.1.5%2Bfabric.e4acdcb-all.jar";
+                sha512 = "ec8fabc3bf991fbcbe064c1e97ded3e70f145a87e436056241cbb1e14c57ea9f59ef312f24c205160ccbda43f693e05d652b7f19aa71f730caec3bb5f7f7820a";
+              };
+            */
 
             c2me = fetchurl {
               url = "https://cdn.modrinth.com/data/VSNURh3q/versions/Bl0VOr1e/c2me-fabric-mc1.21.10-0.3.5%2Bbeta.1.0.jar";

From 94737c474f7768394774c7b029ec54d1c249f124 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 11 Oct 2025 02:50:18 -0400
Subject: [PATCH 421/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index de028be..4ba5c96 100644
--- a/flake.lock
+++ b/flake.lock
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760105851,
-        "narHash": "sha256-ke3HP7YlBMpKi4J3sFUszulxcRLVzjchG844pgf+PDw=",
+        "lastModified": 1760123705,
+        "narHash": "sha256-Y0Ih/NwRZCxKfi6q1k1Yyp/s8y+BIQN/QriSNs1xwgI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "81086cd6a3ca1252f0dc0f938171648399179c53",
+        "rev": "e60f01d941bc5b7fae62dd57fee4cec76ec0ea6e",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760076010,
-        "narHash": "sha256-vuVLiuYe9h4abKZuBsMcDIkfZzoB5GnP/+yZVtuAf9U=",
+        "lastModified": 1760147325,
+        "narHash": "sha256-mBHP1GhvuRE/n8ZXh1lfh+Tn+5oOwB2zCuoPs2mM7IQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "7f793e9a1c4db27ccac6aa934fc500665255614d",
+        "rev": "701fd12530b71a059e7a130fb58b28cb15c38bfb",
         "type": "github"
       },
       "original": {
@@ -466,11 +466,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760047816,
-        "narHash": "sha256-B87Mb+B3QhUJxnlTuupM9mGu2iRRJtBbfi+VL92aiGY=",
+        "lastModified": 1760134236,
+        "narHash": "sha256-5bd64rkgd9Efccid/eLxbCvu5ohFJ1BO+SLD/P5eoq4=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "bc9e4b69ff14a4c17f6c1a4ac6baad8360739075",
+        "rev": "f5c3dd9ff3b25b2e5eb804bfcd62d2bb59b20c69",
         "type": "github"
       },
       "original": {

From bb34146f0bba3c7130bf6b2a2961360e4a39a773 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Oct 2025 02:37:20 -0400
Subject: [PATCH 422/847] qbt: improve tracker list parsing

---
 services/qbittorrent.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 577dfe2..256b911 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -66,8 +66,10 @@
         GlobalMaxRatio = 6.0;
 
         AddTrackersEnabled = true;
-        AdditionalTrackers = builtins.replaceStrings [ "\n" ] [ "\\n" ] (
-          builtins.readFile "${inputs.trackerlist}/trackers_all.txt"
+        AdditionalTrackers = lib.concatStringsSep "\\n" (
+          lib.lists.filter (x: x != "") (
+            lib.strings.splitString "\n" (builtins.readFile "${inputs.trackerlist}/trackers_all.txt")
+          )
         );
         AnnounceToAllTrackers = true;
 

From c532ccd652f53f6fe15246b728b73529be799d61 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Oct 2025 02:42:01 -0400
Subject: [PATCH 423/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4ba5c96..97fb018 100644
--- a/flake.lock
+++ b/flake.lock
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760123705,
-        "narHash": "sha256-Y0Ih/NwRZCxKfi6q1k1Yyp/s8y+BIQN/QriSNs1xwgI=",
+        "lastModified": 1760420930,
+        "narHash": "sha256-AZBsyYlfJEiwc87m/niNLnmBJBBQzHjvCZkwQkt6umY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e60f01d941bc5b7fae62dd57fee4cec76ec0ea6e",
+        "rev": "bc07349a7f87ba6eb31ed4b0ea9d9a7352185213",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760147325,
-        "narHash": "sha256-mBHP1GhvuRE/n8ZXh1lfh+Tn+5oOwB2zCuoPs2mM7IQ=",
+        "lastModified": 1760406860,
+        "narHash": "sha256-f8BSmC/juCHkptH7MCI/6rAbgFjnvuNpZFaM79Cz7gI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "701fd12530b71a059e7a130fb58b28cb15c38bfb",
+        "rev": "d7faac42b9378fb328c075d0009bf5360c3b70a3",
         "type": "github"
       },
       "original": {
@@ -306,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759994382,
-        "narHash": "sha256-wSK+3UkalDZRVHGCRikZ//CyZUJWDJkBDTQX1+G77Ow=",
+        "lastModified": 1760139962,
+        "narHash": "sha256-4xggC56Rub3WInz5eD7EZWXuLXpNvJiUPahGtMkwtuc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5da4a26309e796daa7ffca72df93dbe53b8164c7",
+        "rev": "7e297ddff44a3cc93673bb38d0374df8d0ad73e4",
         "type": "github"
       },
       "original": {
@@ -420,11 +420,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759366584,
-        "narHash": "sha256-GoeShBq/+xv9g9POP69vbOrObpLtS/mDfF1/pfPIQrU=",
+        "lastModified": 1760317293,
+        "narHash": "sha256-YvnCBpMW1xii4/r8xVhqwaRQ4QX/XoxwXYkuoSnIFbk=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "1dbb22b9b15f449a7c8c92a94aec9fe5aea8ef7c",
+        "rev": "c9fc31a1e5f8b7cb01a40e1c670649cc95eee290",
         "type": "github"
       },
       "original": {
@@ -466,11 +466,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760134236,
-        "narHash": "sha256-5bd64rkgd9Efccid/eLxbCvu5ohFJ1BO+SLD/P5eoq4=",
+        "lastModified": 1760393437,
+        "narHash": "sha256-c7jY9cnswPy3d+Y/KJeIzHCOjKmRVZzXOO726LFChsI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "f5c3dd9ff3b25b2e5eb804bfcd62d2bb59b20c69",
+        "rev": "2d981a4dc94ceffc97425ca6c4c88701a89f81c7",
         "type": "github"
       },
       "original": {

From bb8d55fcf7d490e23945584304356fcbc09351df Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Oct 2025 22:32:03 -0400
Subject: [PATCH 424/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 97fb018..e066d21 100644
--- a/flake.lock
+++ b/flake.lock
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760420930,
-        "narHash": "sha256-AZBsyYlfJEiwc87m/niNLnmBJBBQzHjvCZkwQkt6umY=",
+        "lastModified": 1760463185,
+        "narHash": "sha256-4HlaeFWnH9vxl5zg84G8skjQ5pIKIJXtXGHTxHCU7SQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "bc07349a7f87ba6eb31ed4b0ea9d9a7352185213",
+        "rev": "fa882fd2b1bcb663de23af06fdc391489d05b007",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760406860,
-        "narHash": "sha256-f8BSmC/juCHkptH7MCI/6rAbgFjnvuNpZFaM79Cz7gI=",
+        "lastModified": 1760493654,
+        "narHash": "sha256-DRJZnMoBw+p6o0XjaAOfAJjwr4s93d1+eCsCRsAP/jY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "d7faac42b9378fb328c075d0009bf5360c3b70a3",
+        "rev": "4ca5164f23948b4b5429d8fdcddc142079c6aa6b",
         "type": "github"
       },
       "original": {
@@ -306,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760139962,
-        "narHash": "sha256-4xggC56Rub3WInz5eD7EZWXuLXpNvJiUPahGtMkwtuc=",
+        "lastModified": 1760423683,
+        "narHash": "sha256-Tb+NYuJhWZieDZUxN6PgglB16yuqBYQeMJyYBGCXlt8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7e297ddff44a3cc93673bb38d0374df8d0ad73e4",
+        "rev": "a493e93b4a259cd9fea8073f89a7ed9b1c5a1da2",
         "type": "github"
       },
       "original": {
@@ -466,11 +466,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760393437,
-        "narHash": "sha256-c7jY9cnswPy3d+Y/KJeIzHCOjKmRVZzXOO726LFChsI=",
+        "lastModified": 1760479836,
+        "narHash": "sha256-Uc63OZLvxDjSigqMjFOe+97JPI7DtQmuM8JR5617SJk=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "2d981a4dc94ceffc97425ca6c4c88701a89f81c7",
+        "rev": "3a3f42edca2d16be9b414b05814114940015713a",
         "type": "github"
       },
       "original": {

From 2fd4c2dec308e402e3887632445839bdb5253a20 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Oct 2025 23:00:55 -0400
Subject: [PATCH 425/847] zfs_ensure_mounted: cleanup sed awk call

---
 overlays.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/overlays.nix b/overlays.nix
index d8f827b..b515e9d 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -15,7 +15,7 @@ final: prev: {
           exit 1
        fi
 
-      MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$NF == "yes" {$NF=""; print $0}' | sed 's/[[:space:]]*$//')
+      MOUNTED=$(zfs list -o mountpoint,mounted -H | awk '$NF == "yes" {NF--; print}')
 
        MISSING=""
        for target in "$@"; do

From 1fc1056f9e4a042346deedf3c7d96a766492f634 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Oct 2025 18:44:05 -0400
Subject: [PATCH 426/847] llama.cpp: reenable + Apriel-1.5-15b-Thinker

---
 configuration.nix      | 2 +-
 services/llama-cpp.nix | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index e944a61..34e811c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -30,7 +30,7 @@
     # ./services/owntracks.nix
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
 
     ./services/ups.nix
 
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index dc7a368..4301bd9 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = builtins.toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/ggml-org/gpt-oss-20b-GGUF/resolve/main/gpt-oss-20b-mxfp4.gguf";
-        sha256 = "be37a636aca0fc1aae0d32325f82f6b4d21495f06823b5fbc1898ae0303e9935";
+        url = "https://huggingface.co/unsloth/Apriel-1.5-15b-Thinker-GGUF/resolve/main/Apriel-1.5-15b-Thinker-Q4_0.gguf";
+        sha256 = "4d9439b76b6f4380ab5205617c1ef3d10b0e8897146a0a7ccb7155bca1771df7";
       }
     );
     port = service_configs.ports.llama_cpp;
@@ -27,7 +27,7 @@
     );
     extraFlags = [
       "-ngl"
-      "5"
+      "8"
       "-c"
       "16384"
     ];

From bd4d35942c7c41f2d46c5cf35b9a47a8b49facdb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Oct 2025 18:44:54 -0400
Subject: [PATCH 427/847] qbt: TimeoutStopSec = 10

---
 services/qbittorrent.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 256b911..4135629 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -93,6 +93,8 @@
     };
   };
 
+  systemd.services.qbittorrent.serviceConfig.TimeoutStopSec = lib.mkForce 10;
+
   systemd.tmpfiles.rules = [
     "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
     "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"

From 5e8a527edf34b72c6581ea1f8c7cd54aa79c4153 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Oct 2025 20:16:03 -0400
Subject: [PATCH 428/847] llama.cpp: ngl 8-> 12

---
 services/llama-cpp.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 4301bd9..8c8256c 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -27,7 +27,7 @@
     );
     extraFlags = [
       "-ngl"
-      "8"
+      "12"
       "-c"
       "16384"
     ];

From eb1e899cc037e94a00129e97354abfed5195f543 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 12:03:11 -0400
Subject: [PATCH 429/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index e066d21..b4fd566 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758287904,
-        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
+        "lastModified": 1760701190,
+        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
+        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760463185,
-        "narHash": "sha256-4HlaeFWnH9vxl5zg84G8skjQ5pIKIJXtXGHTxHCU7SQ=",
+        "lastModified": 1760715669,
+        "narHash": "sha256-skxnsVy2YxXuVvDuX7tWWUtEdnSAcZMqj0em6x8ppuA=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "fa882fd2b1bcb663de23af06fdc391489d05b007",
+        "rev": "66b0dbcb2d462e7b70ba5a69ee8c3899ac2efb1c",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760493654,
-        "narHash": "sha256-DRJZnMoBw+p6o0XjaAOfAJjwr4s93d1+eCsCRsAP/jY=",
+        "lastModified": 1760666084,
+        "narHash": "sha256-mlb1PC69kb6JLL0mj678+wvIeO9sCRn4oCDS+YCGNG0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4ca5164f23948b4b5429d8fdcddc142079c6aa6b",
+        "rev": "800e6a0120315367a5c66189fd53f67fd0257e39",
         "type": "github"
       },
       "original": {
@@ -306,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760423683,
-        "narHash": "sha256-Tb+NYuJhWZieDZUxN6PgglB16yuqBYQeMJyYBGCXlt8=",
+        "lastModified": 1760580664,
+        "narHash": "sha256-/YdfibIrnqXAL8p5kqCU345mzpHoOtuVIkMiI2pF4Dc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a493e93b4a259cd9fea8073f89a7ed9b1c5a1da2",
+        "rev": "98ff3f9af2684f6136c24beef08f5e2033fc5389",
         "type": "github"
       },
       "original": {
@@ -420,11 +420,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760317293,
-        "narHash": "sha256-YvnCBpMW1xii4/r8xVhqwaRQ4QX/XoxwXYkuoSnIFbk=",
+        "lastModified": 1760576393,
+        "narHash": "sha256-QdkymRnXsZamQlT59VuTL7/UW8Kw4Aj8sobMnvygASQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "c9fc31a1e5f8b7cb01a40e1c670649cc95eee290",
+        "rev": "819d29cd71b1b1804e17f2a9de71905235f91f41",
         "type": "github"
       },
       "original": {
@@ -466,11 +466,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760479836,
-        "narHash": "sha256-Uc63OZLvxDjSigqMjFOe+97JPI7DtQmuM8JR5617SJk=",
+        "lastModified": 1760681700,
+        "narHash": "sha256-AmHIHJtEFhiBGcUfwA9VBBQ/wlifF3tn3JSguOHP3Uk=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "3a3f42edca2d16be9b414b05814114940015713a",
+        "rev": "16babe75b73d793b76a694400c22338c37e972a5",
         "type": "github"
       },
       "original": {

From 5c1e861a892f495f137ce54bcb68745831e72239 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 17:25:30 -0400
Subject: [PATCH 430/847] zfs_ensure_mounted: cleanup echo grep pattern

---
 overlays.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/overlays.nix b/overlays.nix
index b515e9d..c798667 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -19,7 +19,7 @@ final: prev: {
 
        MISSING=""
        for target in "$@"; do
-          if ! echo "$MOUNTED" | grep -Fxq "$target"; then
+          if ! grep -Fxq "$target" <<< "$MOUNTED"; then
              MISSING="$MISSING $target"
           fi
        done

From 24691d877e0fed75e28d19c737a8789a3aa61673 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 19:35:58 -0400
Subject: [PATCH 431/847] claude'd better security things

---
 .gitattributes                              |   2 +
 age-secrets.nix                             |  64 ++++++++++++++
 configuration.nix                           |  28 ++++---
 flake.lock                                  |  88 +++++++++++++++++++-
 flake.nix                                   |  14 ++--
 secrets.nix                                 |  22 +++++
 secrets/caddy_auth                          | Bin 106 -> 0 bytes
 secrets/caddy_auth.age                      | Bin 0 -> 318 bytes
 secrets/hashedPass                          | Bin 96 -> 0 bytes
 secrets/hashedPass.age                      | Bin 0 -> 308 bytes
 secrets/jellyfin-api-key                    | Bin 55 -> 0 bytes
 secrets/jellyfin-api-key.age                | Bin 0 -> 267 bytes
 secrets/matrix_reg_token                    | Bin 55 -> 0 bytes
 secrets/owntracks_caddy_auth                | Bin 110 -> 0 bytes
 secrets/secureboot.tar                      | Bin 30742 -> 0 bytes
 secrets/secureboot.tar.age                  | Bin 0 -> 30954 bytes
 secrets/slskd_env.age                       | Bin 0 -> 369 bytes
 secrets/wg0.conf                            | Bin 314 -> 0 bytes
 secrets/wg0.conf.age                        | Bin 0 -> 526 bytes
 secrets/zfs-key                             | Bin 54 -> 0 bytes
 secrets/zfs-key.age                         | Bin 0 -> 266 bytes
 services/bitmagnet.nix                      |   2 +-
 services/caddy.nix                          |   6 ++
 services/llama-cpp.nix                      |   2 +-
 services/matrix.nix                         |  65 ---------------
 services/owntracks.nix                      |  46 ----------
 services/qbittorrent.nix                    |   2 +-
 services/soulseek.nix                       |   8 +-
 services/wg.nix                             |   7 +-
 usb-secrets.nix                             |  58 +++++++++++++
 usb-secrets/setup-usb.sh                    |  44 ++++++++++
 usb-secrets/usb-secrets/usb-secrets-key     | Bin 0 -> 441 bytes
 usb-secrets/usb-secrets/usb-secrets-key.pub |   1 +
 zfs.nix                                     |  12 +--
 34 files changed, 327 insertions(+), 144 deletions(-)
 create mode 100644 age-secrets.nix
 create mode 100644 secrets.nix
 delete mode 100644 secrets/caddy_auth
 create mode 100644 secrets/caddy_auth.age
 delete mode 100644 secrets/hashedPass
 create mode 100644 secrets/hashedPass.age
 delete mode 100644 secrets/jellyfin-api-key
 create mode 100644 secrets/jellyfin-api-key.age
 delete mode 100644 secrets/matrix_reg_token
 delete mode 100644 secrets/owntracks_caddy_auth
 delete mode 100644 secrets/secureboot.tar
 create mode 100644 secrets/secureboot.tar.age
 create mode 100644 secrets/slskd_env.age
 delete mode 100644 secrets/wg0.conf
 create mode 100644 secrets/wg0.conf.age
 delete mode 100644 secrets/zfs-key
 create mode 100644 secrets/zfs-key.age
 delete mode 100644 services/matrix.nix
 delete mode 100644 services/owntracks.nix
 create mode 100644 usb-secrets.nix
 create mode 100755 usb-secrets/setup-usb.sh
 create mode 100644 usb-secrets/usb-secrets/usb-secrets-key
 create mode 100644 usb-secrets/usb-secrets/usb-secrets-key.pub

diff --git a/.gitattributes b/.gitattributes
index 45b5ca3..b1c9c58 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,3 @@
 secrets/** filter=git-crypt diff=git-crypt
+usb-secrets/usb-secrets/usb-secrets-key filter=git-crypt diff=git-crypt
+
diff --git a/age-secrets.nix b/age-secrets.nix
new file mode 100644
index 0000000..7560906
--- /dev/null
+++ b/age-secrets.nix
@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  # Configure all agenix secrets
+  age.secrets = {
+    # ZFS encryption key
+    zfs-key = {
+      file = ./secrets/zfs-key.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # Secureboot keys archive
+    secureboot-tar = {
+      file = ./secrets/secureboot.tar.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # System passwords
+    hashedPass = {
+      file = ./secrets/hashedPass.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # Service authentication
+    caddy_auth = {
+      file = ./secrets/caddy_auth.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    jellyfin-api-key = {
+      file = ./secrets/jellyfin-api-key.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    slskd_env = {
+      file = ./secrets/slskd_env.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # Network configuration
+    wg0-conf = {
+      file = ./secrets/wg0.conf.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+  };
+}
diff --git a/configuration.nix b/configuration.nix
index 34e811c..815384b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -14,6 +14,8 @@
     ./hardware.nix
     ./zfs.nix
     ./impermanence.nix
+    ./usb-secrets.nix
+    ./age-secrets.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -26,8 +28,6 @@
     ./services/qbittorrent.nix
     ./services/bitmagnet.nix
 
-    # ./services/matrix.nix
-    # ./services/owntracks.nix
     ./services/soulseek.nix
 
     ./services/llama-cpp.nix
@@ -111,16 +111,18 @@
   };
 
   system.activationScripts = {
-    # extract all my secureboot keys
-    # TODO! awful secrets management, it's globally readable in /nix/store
-    "secureboot-keys".text = ''
-      #!/bin/sh
-      rm -fr ${config.boot.lanzaboote.pkiBundle} || true
-      mkdir -p ${config.boot.lanzaboote.pkiBundle}
-      ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
-      chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
-      chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
-    '';
+    # extract secureboot keys from agenix-decrypted tar
+    "secureboot-keys" = {
+      deps = [ "agenix" ];
+      text = ''
+        #!/bin/sh
+        rm -fr ${config.boot.lanzaboote.pkiBundle} || true
+        mkdir -p ${config.boot.lanzaboote.pkiBundle}
+        ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
+        chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+        chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
+      '';
+    };
   };
 
   environment.etc = {
@@ -286,7 +288,7 @@
     ];
 
     # TODO! use proper secrets management
-    hashedPassword = lib.strings.trim (builtins.readFile ./secrets/hashedPass);
+    hashedPasswordFile = config.age.secrets.hashedPass.path;
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
diff --git a/flake.lock b/flake.lock
index b4fd566..752925f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,28 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1754433428,
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1754269165,
@@ -15,6 +38,28 @@
         "type": "github"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -146,7 +191,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -185,6 +230,27 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -360,9 +426,10 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "llamacpp": "llamacpp",
@@ -463,6 +530,21 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "trackerlist": {
       "flake": false,
       "locked": {
@@ -481,7 +563,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
diff --git a/flake.nix b/flake.nix
index 7d40bad..246fb1d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,6 +47,11 @@
       url = "github:nix-community/impermanence";
     };
 
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     senior_project-website = {
       url = "github:Titaniumtown/senior-project-website";
       flake = false;
@@ -76,6 +81,7 @@
       srvos,
       deploy-rs,
       impermanence,
+      agenix,
       ...
     }@inputs:
     let
@@ -97,7 +103,6 @@
           jellyfin = 8096; # no services.jellyfin option for this
           torrent = 6011;
           bitmagnet = 3333;
-          owntracks = 3825;
           gitea = 2283;
           immich = 2284;
           soulseek_web = 5030;
@@ -110,7 +115,6 @@
           certs = services_dir + "/http_certs";
           domain = "gardling.com";
           wg_ip = "192.168.15.1";
-          matrix_hostname = "matrix.${service_configs.https.domain}";
         };
 
         gitea = {
@@ -142,10 +146,6 @@
           cacheDir = services_dir + "/jellyfin_cache";
         };
 
-        owntracks = {
-          data_dir = services_dir + "/owntracks";
-        };
-
         slskd = rec {
           base = "/var/lib/slskd";
           downloads = base + "/downloads";
@@ -221,6 +221,8 @@
 
           lanzaboote.nixosModules.lanzaboote
 
+          agenix.nixosModules.default
+
           home-manager.nixosModules.home-manager
           (
             {
diff --git a/secrets.nix b/secrets.nix
new file mode 100644
index 0000000..816c875
--- /dev/null
+++ b/secrets.nix
@@ -0,0 +1,22 @@
+let
+  # USB secrets key - for encrypting/decrypting all secrets
+  usbSecretsKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key";
+in
+{
+  # ZFS encryption key
+  "zfs-key.age".publicKeys = [ usbSecretsKey ];
+
+  # Secureboot keys archive
+  "secureboot.tar.age".publicKeys = [ usbSecretsKey ];
+
+  # System passwords and auth
+  "hashedPass.age".publicKeys = [ usbSecretsKey ];
+
+  # Service authentication
+  "caddy_auth.age".publicKeys = [ usbSecretsKey ];
+  "jellyfin-api-key.age".publicKeys = [ usbSecretsKey ];
+  "slskd_env.age".publicKeys = [ usbSecretsKey ];
+
+  # Network configuration
+  "wg0.conf.age".publicKeys = [ usbSecretsKey ];
+}
diff --git a/secrets/caddy_auth b/secrets/caddy_auth
deleted file mode 100644
index 8871a692382bb62587cfceb82fa96e1f8bbdaf9d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 106
zcmZQ@_Y83kiVO&0SUoX*`6Yqc&|US#cj6)+yl8T>4m~Kg_sIGAoOTNzt4r8?*w@gu
zPuFUd;QRy8`KislYQGk3vpU%KB<X&Rh}O&H4r;GW4$EBXoqqn>*NMf+uTK4E^7wO2
O@Lfo$y#EzTiO&FPq%`6H

diff --git a/secrets/caddy_auth.age b/secrets/caddy_auth.age
new file mode 100644
index 0000000000000000000000000000000000000000..53ebabc5331a0f4cd6c072709fa6e3c81bb018e6
GIT binary patch
literal 318
zcmZQ@_Y83kiVO&0nD|h3^KO^a^#%1$<vW*!CS>_ExIgI&oTL4->POGAEh{Fy;d-BZ
zd*Y#$ty_Z*Wt{l4_By*g&!m5Ixw8)~EdMC_`D9q!#h#Oi**kuIzP{Ps`NIA>g~C58
zq%2GgTGqRZpGs>jSjv>E9$mOVUH|zn+s5UU2l%R9UA(n?fpnjz26Oi16(;>^Dl2om
z4oF6?KhAb%J^Q2ShB}3RGN-ROklc`16?Fd9=QG7gv3)vMgaSLgs~q+Te6&e_F=KZ7
zi}=D^8UDAyn^hOapKg`ic_P#7*0!?0>-RTkU!Cpwk^5$Cuj$_@^Yr|j1<#vzZ7!Aa
zW0H*B+<SaMl=SUl0lmcgnH+sSd4I1@{5|FFsjN9y7Zsjv`R%}UJCRe;sFCZ{Nrjnq
e%3?iX@A6OWS-5!Z8u<`@Mgi4ta(VB&mH+^*@}5rs

literal 0
HcmV?d00001

diff --git a/secrets/hashedPass b/secrets/hashedPass
deleted file mode 100644
index fe3affff75466277bda5c56a5e61ad6fbb110877..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 96
zcmZQ@_Y83kiVO&0@VRxTU2fGot_6>$T6I54-8=Ws!~LDds#YF6@8ptx_E1WC7LU^Q
z0L29L)?Koj=1)$j{>`^NUL^YNs@kre;Nz{f4Zm40+`QXaZ1U`3sQAn)*$-I{@E%?P
E0M<<~XaE2J

diff --git a/secrets/hashedPass.age b/secrets/hashedPass.age
new file mode 100644
index 0000000000000000000000000000000000000000..69fe4ef72a260d6032d45c55f5293079ea1f763a
GIT binary patch
literal 308
zcmZQ@_Y83kiVO&05Ra%>I78%|=RVu%=lhJ)dec@lEqQgmVs-R#Sxes1#`_7yX|k6}
z_>z|J`e}rE?C9(}7%^k-=4nSX>x6_;-ewwSr}F6Ytc?&lptLSBLuQ6g@P;e%>%D^o
z9MukJ+eL=y|MolJQNP0J<H{);e}@HgZ{Np~Y>*uAyX4Spf%U6({xtR;HLuIw+}CV0
zPjww<;E%Q#x$mNL7A@lKoE+KFe3(JfK+zyy=XO$&+oe~#E*PvZPoMHEsQhUBR}C>%
z>8%obCZ1W-xA?hAqG3dEcx&?R#9{-3o{z>&8uID+Z<bldZE=}j89h<|-sgWG_Z*Vm
zaDVlbMYFb*#rS$2{-NI<^y%^Ac~Z>N=5wnAM4OA}MSW<?5I!t(Q|<Qd+h19?P5b?6
Rj*x6Y>;{P`t1~-0MFHQNj?Vx9

literal 0
HcmV?d00001

diff --git a/secrets/jellyfin-api-key b/secrets/jellyfin-api-key
deleted file mode 100644
index a91e5c31435b72d5cbac7dc2a8d25d0ad4b84183..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 55
zcmZQ@_Y83kiVO&0Sn=qE&=SM6b~ZzsVs`N(DbCGHxR$MJij<L66X;XeByQjTP&I0H
M-htU=;s<8~03Ht%?EnA(

diff --git a/secrets/jellyfin-api-key.age b/secrets/jellyfin-api-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..81facfced440a6473f765662d0ab34780e83e770
GIT binary patch
literal 267
zcmZQ@_Y83kiVO&0cpVjdV9iPw#<|DW)HJJV?W?S*_szIp`YG$`O3NJ4$oLY6Uz!Yh
zuU(WQi*Ko)&}Ee0b4yiEq)hKlDMN>}>SOn*!fTk7YE4(XIkjTP!vz|7*DtL*;%XN=
zdCmNYuyAgkg1I(tgsV<WTJ^u<t(m>k!F>P2c?%?p7aW|P<XYnX<$++^yzPae#}{Sn
z+;%c`dc2FjFAuw3n~ucQvvJof@0b7OwfKH8p_SS1$yct^^_IcA4-_%TA90*B;eW)0
z$O+y}3~5~}Hw9!aEqHNO+Hu0Pi#FN(pKm99_1BlWKkGAx_f$iJhpPnKr~eE|?NXex
b?&`-}^DW=?6InUgCug-~lq&4mp|>9Za{+uu

literal 0
HcmV?d00001

diff --git a/secrets/matrix_reg_token b/secrets/matrix_reg_token
deleted file mode 100644
index 206fd319d29af83c6aca65d7d50891833acb1596..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 55
zcmZQ@_Y83kiVO&0h|ItFZvRfPm4EMQ9N2m3hep`}Yi(~A@#v5nZG5j+#b2mh^dLd-
M&&w!{!kJ=I0lldjR{#J2

diff --git a/secrets/owntracks_caddy_auth b/secrets/owntracks_caddy_auth
deleted file mode 100644
index 2cd6cbc0dd4af78dc4c30b9f7223e22f7d8a8840..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 110
zcmZQ@_Y83kiVO&0$eIz5na8s4gYN35!K`=6h1l&Lw6CAof9b5qiFeoT=>45+rh70s
zh1XtP^oQHJdFoGnCCXj}3O3(sthlJGwRdq~o|*pp#di|IxBE}Bn{sA_Y2fGh7}qZ^
S59vK<F^Qa{deSsFC=~#$-7`f1

diff --git a/secrets/secureboot.tar b/secrets/secureboot.tar
deleted file mode 100644
index 7d87891d6937831a36a4dfc1159fb15815666ca6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 30742
zcmZQ@_Y83kiVO&0xYxBrl(X|!!#*34`Yg4b=D$PyPi*z@WXjpA8MVdO?ABEG6tlk~
zF49E{H}JOXG)Ui^E?DEgU*Wbunh0y7{j4=7*MB~){g11d!9u6CNJH%UWd6G)Nx`Nk
z@@?m5rE`D0sM<YSHv9C!2<8t_o3d4nrLUwHmv5h)5*Aq6%jK}`-TH+;e?Nb-|E>^+
zwyq$18sCbQQWF<sN~q>JaF;y1uF9}N<8a)&{_jC8lNI0S+OK-4Z?~&;=Xc|WtU5f;
z`HuPR&D+U%vU!8=%INb4B=<DBGCs}__I~&_HPX@9uxavrZ5i81w<qL&YkJ*M7y5F(
z=PI8W8*Xk3=1COTTFhbMdsuq!(G8vV%_6SnA3gEw`mrUam@{_2ls?GgzHpV-i!C+l
zY}!6(&wP*++v@ZAcmB_f`y`8EcTeq9_UDN-?#Z83<H!9&lsBsQ{v+MBzPf71EVema
zUvy~JRBly$+i7ps9NfQi&YJ~s_gm-wuU!98EUtcG`C?|{htCY}HT{0_D@1Hdsk`yN
z)pw?<ELQic{_U~<)v61p9^2VuZQURJk#oY4zVtdtU)`m@CiXu)bcNYp-qGpobGv-;
zs!v{v^z0)`7aX4PT>G?XZNsdmH5zx1L@wB%^>#y49arI>pkSAO?%OQ`&OSPyS~vZ3
zoy+^J`qSeArWv-*ouF|zxkjnesz5wp#nZlmjI!IQGcVkYsx+)oIpQ1aYU6UrIzDU8
zXCKbS6HX^q@@=UJG+^G<bM3ht<DSCiDo2Lf^AuY3Yj^x{o#8Z5<KVjz)(P<o7x9GL
zo6^frk$N-ny6O45Vk+mEHM#Vh6)rVC>|5D1HAeqOk<+I?{FA?{pPc`;s^*xVlj2b+
z{*|(P2`}4@sy0Rn{hQdgj!8V&owIPp3Qwyr3pov0jwhU9!W?cws*z$IpOmi2v_ART
zTC1SaJo(83mFDTp6RfH_SLeiSUTd2D&^E5Le9QGm$NRcEoeONugR?x|KAZC`wdGF`
zKS#LPWbOqW^Bi*4o7>I3u3qqS*3{Eazxr$GHon$4!zH<1L6@`ncI2lQ8r>&eK3e{6
zwVL^q$<Mz{mV5p7?wr$G84o<Vn*Ly)fc4Lc@+GCw8dhKJPgMMtPhY^1;<|3qWEPIS
z@1OYQOzv!PU<)ZOb$r26CoaEXd%W_)b+@uY?n|l$`p>f4kgYkRUgZ1T-If<sFA7E0
zgsrvEX5uKHdB-8fJ9N*9g!IYhi*+9!p8WW$GspRzlK;G~v>Z%fw_fv0=KZBZ=Ttpx
zRDA*iHg>OJyI*p5QMUbT<*z>?AFqphZ{2?BbNOENtp4dzQj?ss&lodrzdilxdbQx+
zJI*hUF)7<;ytHlW-w7`q7v7qCqRw<t>Z=7;Uw2Cz_&EK|WQgtByE01Bk~blzO=dPr
zjq<h)feTi?=W?E>r^}?2Sh}sRU3aO>W;w2onfzX6(iiSs{jhzBxZF+Sot9VP(@q5O
z@8Uk2Fq8X6kBQ?8k?m*t8O^qFH&;H8G7w%a=y2?>f#`#`C&eq(*zbRfJN;Hz<d~-P
zMOlN~`TynC%KudR!Si&73)jyd;i`5=>`leCeDn5acyx{PBzykjbw+2eDb5P%Wn(;f
zKV9#g?3$|HJB?nCdG^HC9Qz|x>zS5ku~?-qQeACj()px6kt?)IS>C)TXSv-jw`xLp
z?6h^?woJcQdp~Pc%X$xfLCH>m>yv9ztV69*{3rbjIePChuX4oV%`T#+mg-Lpc>7Op
zll83Lg|3zxTo|KRqCYstuI)LZ>-hB1r`ZSP#VbWz@}r|(_DTP{e3VI}x8Zna)T(*H
zAHGcP`eUKEslV~%-z^MZC9d$Vd3C5UF}EPA;NJGtw$F?&NuOQc&$>lf=E*fi%PB8c
zRBVrCdJ*eY)LMOm=hVbokI&20nlf)++HHQV$YJ`%I8)7#{3uQ1r%E$dW{I2<&gu_J
zc35@rOX@XahF`0HvE^@=d4H1P)Bag@C8w9HUG{A8p6`8`ybEp~FScu|PWP61tgB*V
z`a@;uiNBZEEcv-`@loxH&<`f1g}t+HaTn$+c(HVOUZ}m><t3@E9ESUsME^ZvsTEsb
zS|R_Icf}OLE8Cq;-!Go}r9Vrt+CkR%VM*tP&+EUnrupnJs=W0;eeKo9eg-}F1*UN(
zDLh-|^zlM!aO!=})y_$rFJtph9kYDVl~bSZE4!bSm&I(>-Df8bEJ-PPwq#{WC(~b1
zHSRsLPs@Ee_Uf0?_nNtfU9W1gmRlYWGu37L?^~ayUO({y<G~-IQLCnRCV#YDkyve^
zVAZ#4pJ{GNn)x;1Tr1b?6R`=mzp%Amy?RwA|L(zmFJexgtuzlv(LT0Q>a31M?7Ef>
z?2M1D-1)eS-CA}|wA+RAtZg5pIpXDF3p28=9?qHj{E+JtsV$N>w(iqpxM1*nN>$a)
zyoo>6KRCNFtyp_BGSxe1vf8BY5-Vd__f+p)e_QST?#fS(g9Y8s9G!nJt?=2z__9mt
zUsL(79r)dO@8X>cZ&@~Ztc$wI6K$v*$NK&L<V(-9Klf~&VXvjAzBttT^2rvh8N2Qz
zo|f@d)9ebDwZ6W2eZ=L5Ps<NGK9*oCkyd#7ey%aAT+Z#g_50kr&4p)w{`m9W3>NcO
zdDflATkd@qeHgnZW7?W~*J6A^bo)7eHQh?A=sDQ0#AhW@cPC77M)gmHIHRi^?5%xF
z+pQX|=lnCSa<)=s++TB}#^k)~x0-`b3-$y}QU7SV<i#@mGx}W@xmIpF9x88igh}6=
zeRJ9UN1nMGVw}1)KNT!C-X|B3B&fRc;0CE9CI!cAbqzbqe)0cpG<)OZ@%wpG_3e~(
zW$WwuEuJdBcCVfCQ&QeMXXP{nMd@4T*p|Nz-MjuItENt5LS?VCuZ88ZPd$fkn96%(
zG>K<4us3dDG8MS|J-+5>XKBjR$2u=({=Pc#T*kU58-6!!`?>Z<`$<*iRny+Qa(NP&
z;Urk<7y16h;cYSNgkA`?yzYL`YGug2^W67>Kwl4=Z)}kdKii09UN76Yes0GKyU#0v
zQ*9Q?{kU<#<hQRj|M{nnv!tt%8aFI<{M20_yDUSvqkc<UY5bubf-(M;OPtF;xTc0h
zIkp=2Jd!?Q&a&j%yH8JciXFc)ZPn6M0#`di=BH?^*>~Rk>->+kY8BtEwy-m(K6YPT
z?RMoz{rsERfkhfAi`8=KHf8d8{&T;@F1UN@&Q}Mw{B2W9e|9OEja`k|tNE$No3nF_
z4_oj2_l0fp1+K=8N4HGNUD3NP%xzwf5QCrle%?OYtk73VcP~i#-EH|+BG=KswJ`2=
z@PC_YT~k-Se?NQH)~kYcTAZJ69H=@yb>-UGeN{j5b0-Cu>`&y-U(>f*_5P)!{^y@=
z+;}<p<NsRGT>Z@gr>mSao~R}NF!TFj-no8v%;mqIT7%|qh`y`fl9wwj_f4Wxvnr>>
zF!Ge9PMA-*%yjOHj<0`9z7ni**)7G!aC}DipK#W_OSYG7i9a&?K=sNyTbweA+s-Y#
z9w7KqWZKJPj<ttv8#ew@>YaD*`7LSlxZ(xjqF1i&@)4@?opEGh&OR3p!{p-E{5dlU
z57cm-{&qeu?aazM4^oPyFTVYBE9r#r5|wRno0feI*IZldw5&dD@*ky!=)?*uk+;F@
zt3UH;=$RW#ELuOiiR<Sj%hMCKen_p&mYlw=uV%)%S#cK+KHK!O=>NSaX%l{vOW)F5
z%Fo1}>V0W!V)`UJc)3~Gtw|})mZC2O3zAnYX!_f3`8A-xCGCCldG#H9i}vc8$X91h
z5q1bUR-37}X-d-HPDRGL-#ia*uR3{x<6?RB#H-AmItLhp&;Hj??7jSVX4%A<_w664
z28ir_yTI-*Yv{_&6|LX2mPvWd%=5o9si`T6dA6bli)q?H_9bkx&&%FDOnLLHxAw-}
ztpzt1uUvX=eaHD_Yjk7^axLu~|8AXq)#{vq(XGX%?Ij}K)w+{Pz2)5WexBImGvD&g
z*`%b}+P$;x|NnD+|LN=I43Ey*z1L;%czt_~bCZa-;FtYcD>hGE*s5_#=poz8?=KbD
zH0Ap(f9kcAH9Fi<-CFh5?qAH@nR5?txTMA(;NP)<T}(;zMxbzl<t&!cf7aKoTutq}
zvj1Gg7Vqn|8iErt%8%C<oH^*Iop{^LkY)3<pNkzdWDD+w_*SlQQ7fB#YE@XD{FerM
zkr^z_YCn!zww{ZAnZsZG^3>tHvkQDzzTY7E>vpiTmUF<wu$MKJQAIu_SI+nUQY<;a
z7ZM^G(p^~2pk9)5T6^;~w`Hn-B7&#?XV6*Lns3#*{IB4>rGFQ_b>Pmob(!PT(d}tg
z(sb#>`sIsDWnP<veaT63vy@BVP5biVRNGz2lg9gu!)#ZDY)UBMH{uOUX{hRGTi&&H
z-OsM3gO|_zconr}%OSxt+n4P&66&78q|i5$Yqj1xku!&lHu(wduUV4A?5bt$dSN<)
zSB+ZF>Fx_xyOY<gR}MSdczc0jB;$j<`By3x7tTJw)6sviuBp6xfufzaP3g+jCjP5~
zr(F;XKXCfr0<(qe2e-_*A+_~TQP=F~HhIR1TOoB?9a9UAulf|?J$2uDi8&v8R+#a%
zK5+V1&YhCkvPJ6t^S);nSwiH`&FwL7h_Xxx3wd&?{Zi54_4i-wy)yqzyOhvL74zaX
z$G8Q4O=vl_;>J{Cd4ocm9OiA;)?9n~lgr+zapR^#4y{sh`P(*dZ=A^aD@{~q(F4o0
zmv2k=Oudky&RM--e!2hudyUur9aeJ`XXt5Va9FHxsi|q--xNPpUy%iAKQliYS$%cV
zmNA{9FyY5uud6fKmx`b2y%V;>!0!L!^ur+nZwi-Ait3E`9WmG7`q@XRYu<J`NTn-^
z>1%2|55M|IwaNE}{c>A|Z_<6Uw=}ESPR_jMsPjQ*rrYY8T%#*zQaMAm|C)E|%y<6N
zK3ujDKPMSYW8Gu$aF*vSBfl$WpR9W3^Dn(~=e_-No+QL4uU)n0PTmXy#-nG;@((XK
zXg1Y8W&MO%$%+pS8eZI7+`4q_7A@n_Psi1KEhqllmhtnzwHFqx5*2eYt{0dwXC6@Q
zku~0ZVOayqU(HX4syY0wsc!h=%gPhBGN^cR;tJ-ap3E=p3VaS3&y{k&^zL><R(0wN
zfh#{nF7NoJa{Q9t#bf)ww|`n$qPcJq({iWvZ5roJTlgKn?Zw-E*0SENTzjrhh*&T?
z_o>b8*Q6NMa=(msd?;EyWv+q1%kM(GOir>w=TawK;H$nPkP<0y=TAVlb)4yi@{9Ad
z@)f>%?+z=<^O>i~8Is)i%IEUiACq1P$L+c)xQ|JiV?*3!-6V~D2iP+^<~pubK6-BN
z4EC9)8cLE^REvLIG)ZdzI^n%nHYa<DrELFizL&wunDNrx*I%FI>V-+J@V6+~Ewhs2
z)aS5ctCh^ni(Wm{{&_QwDeI1#%Y>(=N&_3+8{NO&Qjpc%_V&kFfeAdy*QJi1Ka+1D
zv~<zIu>2E+o}AZgrziZGA9$p$J^k(WGd6dg?lV7pKH~AuY|&LlA!XjXtrH(IFRs~}
zULH0%@3g?u<vWe9EANZ^oS4b`gqth=AnUd}+%jvvscfFx)OBlXTB+HQ<8wFGK1|-S
z_h;$POfSVp%Wj(;-(~$&|MKT9N#8oAH#5EWH=QfHx?@g}bMbaxlQp8R`)q&iyE$Rv
z&LcbO8+M(p$WaXnUmVr?<@PbpT~evF`W5Uk2kxIZ&*U~WX3?AYC+{?4SpO-!eYdBi
zP3_>ToSf3`!|k6ZJ{CV-)6G>^qOiCyVUhmZfK^`V`~@pg7WjFdTlZ7iC-Lv*Jw7t|
z&+Z#31u3sHdN+U5jbeU<pEKHzT=(i(r>t?qefeLmsYWNI{rv*8Iv?>}TH7>nmULzJ
z2b<%**(<vF(p4lCAEikAe)e1Z;J38rr!0(kuZnGGd(~1MyP<X6(a_?{-@o4!Sv)6m
z!#t<huq$(wj*0Th>~>}I@&7pEguS_eBH!}!hnpwNO`7p@g;SqKcl3rMJ5+?bdv>Jo
zU0<0Hvq6LJ#y$3ejb(q_*IP8k3kFND#}@80X7sVi?a=QrU!vhRLG$>XmnkWY=JFa7
zld2X8xWC_W_|4V_H%)G&823m&H2rGjt^K{)^2Ej`MH~(u3sn=ua{OxM=ub=Fo|}-E
zxAbUd`t}xk7lElWH#s!4>}FjUa8T-7<=6d!LOJW!9uR*yP1k9W!(~~G@3w8Wk@4}m
z>hotR$O@mj$knMYJKIHnvCmI&^Lg_&vhFKkk-oV~^lF2bKl|_4C--^JtEfA_K3*_+
zuBUR><hx6QjwqI0f2ERG{!@Qp(yQx-TDk3o+4Aq!){C&N_HIvWVK~A)#nV;I?LhhD
zPny>hOD}TNU%0|~G>_MC#v9}N1}YcbcU|t{e%#<P>y@op=FS$~X+IWiERTsvTY6^B
z>RA8J@<#-CME5;du_s^H>dcyH?YoOk7_(3IiPMR1NO{ioyx`~w{Yy7xUcEYTylBFc
zPPti9YXWbT?!RxuCCnLmbhmM>t7~TBz3FX>^5g{$TeLdb?%crC=rn<=ZL_@S3C;gX
z=iZ7=3=A%)-?pr2Wv;`=>pKsB?)rAKX6c1(2RpkGLQYlx*~-f?ne}VSk3H8DzZNKn
zq;@CI$x`_(y3we?pg;6P=*=~yU*{JUJIb^uHwrQDyb%9O#BbNp|EKaYl3aY*L*DZ9
zcF75yJ!`d4+vB2esp$IxPX*JM)d`#ywth3X9Jg8C_;^FVdfK$}FHe<lol3I}zi@kr
zvA+BCSEsEQmQN82`x#@yqp4lTQ@r}iE~lxEt+P9KESK#vzWUFeF~;lo-miim`;;fS
z-a2}p?Ll*@==<BQnf)7cQ%x?2*^9DmT$TB6z01=TTUoE(Nz1D=?z|W{cjon-GW=7U
zBx}W@8rv)GDcyg>^q?@sD*VWeils}p`=n&8E4GyWe`rC>v_D1d@1OkpxJ~*%Ncw|`
z^Xs#GAKqH@X`g|@<<lSTUkee?7SG-C#lBilk3+>zaDnCw?%wp@N7GI(pS&?BpZjmb
zVs^3fTig%M`_}eb*?O|p{nLF`#-6EDeh9LzV0da*@o8W0(ZgRR1=qUt&(m9cZ{CAu
z>4GKtx^LD#*dDz4Nz$A%UoScwba%KpchCQ~`_CGGnRc;b^~MPAZSN9!@0?}qcp~?!
zM$mi94%bCZ3;vW(H%pxOQT?UMDTn8Y@={7U(<ZRX{|qhG3Z0N=SSMj(z_soD)O|~(
zBJ&m;k8@qT{$Ll!RwMsZ$<=*-w>I=PSBV(g+}_t2u=+#QE%|L1`m5(T&due>%8JcD
z;Il}lJI-1+D{J?|<yn3Y?HzpMmvlN_tKX{Wp!MpRL}Nj!)#(VSys3Xmrn;8we|EKh
zuCT}aq^uXoukPPAeb_ZCX<_L^3GoQUtB)M&?v{w&*3Yr1iqGWPxYvF6JD(eu0#>j%
z&E>Aw_VHd5ysF4zYJ_vP$N%z)FK_g{^4zlZdzPQ<EtXxmhx{^q+;T!y*PIa6aQM4)
zV!7B|w@K<%HzydDC+EEQr?)NPkNra4EWP^cj5j_<EZ_5K)j}i3h&^hbemN$+RJvWv
za>AoVi^r)y|3?f5|NSL<xL4{n3RFFslWW`5pBip^Cx2@AjAv8pw#J{Hd8^yzfz8+I
z6AbY`_icR~Gw;*IiKk4`f1i>GDd=_$?(NcSbDn2)cE6|{6Zd*OmF16RR%XYR#6Ows
zrQgz2aLI+`^Y)<7i6QgsC#`1UdAm#PhNP=eLwfw5do43>{?;!(d!OAbWJ{OWp0C1z
zVS$&zGLJ-mljscRPnc;g>f|agQ7DP!^pdXFn0XUrOwxaLioa%Q7h+WCpHiMZ=YPz^
zvar)OiJKEH8+c6Ke)w?jEuj;doQCTA=X~Y<S;+L+&+PZ!J?AREm;|b~9=^BRGUe++
z>qkr`te;-!3q=Pz<Ynf*UZXtqi)4N9+LfY@!ekzuU9J$i=u_=O8HG&&fp<3_N}drl
z?GEFTWnry<7oNYl_-g3&@2C0tqOL@pi9Ons;=rTybt_Zku{L*c&#n8S?wnOx(Y$QM
z+M;y_|Jy9|VczuWMcdD+mAh+BJji>0AyD7-;=$aoYObBneZPxkW-JO@5U-f=s(-^N
zwv36J_1`_aVj9?TLhsXG?ftJeukyUuHnHo+!o6CrcYnQ?@!Uu5)S(>~ZNHA^M=bjI
zCHz=swwK9g9ks^}|L&h}7u@1EyQ8FR#t!vu&(;)rov6-P{%*JW`45VgvsnD4oN}G6
z#Kx|0k(FOva9by9!kL{emD+Ji4oTM0u8Vi{-LkZc)|j37`r#Ryqf5j@r!W2YSBE`f
z<9VYAB_%HPe;gmRM3(;hAADKksYsk`>zdCK7X;4Q*zuLaw&T!^IVU~7>Hd6>Fqa{I
z;gv5<Gm{qH<`qqFc&GVxvAo#ky~{3bm=-R(hPg}ln`Xbt!b?AYSF#@TPrbSP`VNhH
zo%eqq%z9H3?K;z(+bvG(mkNJuX~i=ctu40R>%6=>mn?GG_>z53$iMAv-g0bJb5F?|
zoHGv9n`&BMBmeJtW`Rgx#JoQT*023MnX`$(c*f>wpZjh)EsA|y(a&(l>exos2WdCo
z?(W?8XZks(X5Sy$>1=b>e07m?SjKzf@WzOzRf%zpemm!G*gJ>0@83~Z_bXFByomUs
zUNw<7$cl9(-!?BJ(_g$BXDWRT-F;(D)3K*rH_obF-&wo-t@OK`Y2Jos_}*-rqjsz0
zw)vrGjfMjZb-oMCgM=mcO#eF<9FoaR<9xqpVyMB!tO>{G>3&SE>S0fBjkC+_RJ!w~
z$;tD-sI|aDla$|!LSw?3cBG2kdbKgY`Fy<VOxyV9yPwWYYBGN1Vr(<x`*wA)lM}AK
zK6xkN_@2A`;xRw6c%Cvw+;J{@pybf;@Kn>n!v!IaCOgW_{}E&|=|yHf@89KfjO))X
zTD<U?=;b`dpRb#5U!17&+~Ss3^7@}14+`>sPf=OzwTb)rlTW__ckPYz2})e~dfByo
zCt3G@F0|d#VqLAc;`3{TjaggH?e1Jvm2o`K!OfdX@@?9wOWHTSTTP!HeQd$)@REj>
z#Q#~c|EJx5_sd%OobDBtwo`K$Zz($XmImCGPj!5<OYhj}KZ~YZQVMyoBqD2`ZEkR-
z5{uT&eG9)Acp5lZ%{Z|<vt~*6Ud@+N*Ca`#=FU))4vN>Cf3Ena-#6jy;&vLwN7rwP
zwFr{d+ja8$S;<*vs|?d#neUU^X5|sPBR)8^?ERgu#pV)WN1tgw?RjVOLO<(};Ve#v
z-wI#7O#d8`lKaDcd84@a8HpVQJTKxN%(}34&e4~XZ6EE4ue)&6v~e?=w)pZ3tJMFj
z&AnO^bMuwe+lLYLSABNpU3%VYw6A4OMb9DChhfi*qWick)BW$<x*05ca!rccI`%yF
zC8EWrQol&>wr;n*_|oll&Ik6YyM{Kt51+ZR9@wLA*LiRE`v0@mOuVfnas0=jS=<jl
z3ONe-^4-o93Uj_*`Raf3t}Al4A9x8aZCd;8ZQ5mt;Ey5aOdq*_=5S<>*|sx$!v<4T
zA+^otMB?+;WPZA+x53**X69tg<+q%C)GH4eq@>)u^OY@c`<A|jStsMxZgSc9mh+x$
zwPNZo*1g8ZmTT)X?|-$v$m7preIL2ir@mdi+;D0AjP&yi&*y3XaueCQbX}SEmhTm3
zzCGD-w!FLKz?a;W6|=epb@yBs%b4(@=IH0(rf?<B0{@N%4W-_Fk=$?J&Sv*Ip_mb0
zEY)e3T5xj>XV{VJS6H8A-#E(UvLfi{-4loZc1tdH(X+bL(6#H*@9U*;;^{?;ziITJ
zxS6E$RO7PZ#PII30=qt+UKzfW>lFV)1wY5I(~6u+l~!p>J}#KLGSXE&s+(o<oi7Wk
zP2^uR{!x-WG11*hzi|D5=-J{{p$tieMM=LBUq$gHpJ?LO-#*E;SJiCY;>pj~1uhiY
zGr5h&DC=9jBIi!`LgCxX!=|R4llP2?TN9C<*I^u|ymsd5O)+feR`y$HyN5sBV|~R#
zIsOKhxBWj&)2k{PKkLJJq>KvZ|6M&<Kze2=$GKCC{Kk*|adB$An*RK*{oi7a6AM}&
z3ktZrxDw#aJ}*A+@(and$T{NMG6MvR^k#WJUvc9{=T3(;$}vic@}lNb_g-CV)R!r!
zzWAHY&GJk4A7?l{d&zcw#X+g{mvZM!vGSPteW~D&Lkw$OrcKdQY?k6$%((R7o<?4)
zz_OVhsh+v_AGA8u@7xl-%-%@-%Vv$QW%UY?V#~{WZym3x@LRce()Y?+cTP!JNb7Pl
zD!JZbimvmNKEAl4=*Ew~@4kFJaHLMAQY(C4q1P|T1)7J~6!|kn_sy60y(RYHMB0xA
zhV-wRJUP>+{lBT9RCPl-<nr+i2@{<{8`?~5PNjECZ9iZ6SSfASHZP;s_hxNhYG9&y
z&d&eWuL>va>8E<FT6*ud9q^2LnQ~yt-@QxM2`yecU*0uXn*W+*=vE_zT_2^Yt)?VY
zbX?I9RNu0malyKMNku(DIkUcNdhMGQym4|3$LiTH?HaFF6)jj@z`f43yy<@}M`n2A
zZ*xY?>mNfV+<3uaVpnr@nWtLGjGKqsBPLmv1U4OAX?1>%rs__CSu?rzYR&lZ<@JMo
zo3|K#5ZKQhZO-%h5le&YpVucRhO-vfwOyZbW`?iS{R??h&Aho^^H$|fiRX;lQCV}I
zYh_cyrD<GNkI%Q1NUXS*#}@cP%kfXYV8XqP3*IgI$Fu*GeD=3!f%z^)vmPuBe=yh7
zO_I&V>YnqJE9MyibAoTpP3hwl>&kD;?R9+pZ6V*H$qExX9PgEybmRmH+Qy%paKTa3
zKULSBXRFC}-R&E41kx&J9e0}3cfKss_Hg>vEt?es3yxGB5)k37ox;-_xp0x)jdgKu
zlSHjeE-0RpS`@PF{M=hz+icZ}PHwI^edS}mqEFddt@;fszdCcwXNiBp8^tAb{gL2;
zm2;L~x%+|L>HPHt+9xwT^JV9j3Ok5jz25QlQRAx!uH-}hhq7<1|MK;Dn@nAxtM|N(
z7ruRJS~D+AD6i~a)hXR)KO=v??2cDadHHjpzH@-2*sZ`9o^wU_AA3FLTVQ&?PB|gJ
zEi2Q`DQn9X9M8Ca+*-4)L?oPpYXOh6#hIV}H6b1ylj=+-e_mmtzkQ9r+U2A-?&bWh
zR&yu)`PFE*@?{uP;<U1mZB>Dmh1u^XU)fb2)%^4EmRO!-g$Ik*e!doF!r-KTcCK*i
z-ED32PCwDSB0T%S0ga!IAv>q%v?_0ReSFU|<x8#o)LY*yPCtCsP`7odlFQ<tY5sRi
zR?JVH*(JDc?*5xqDRW+1MF=pNmL2;wxw}B=ivA(tHOX`C^WVRbKk-4r;#vNyI}UGq
zdYRktx4jF`7O7m8{Mz{V`bBxgwX=V%-q7IVx!kAE#7J>Azq!lZoQt7Xs}?>waya{G
zn@Z_w@zrJRN4NBJW<)mc);jsEv)ie|cjf0Mck^xHQA`Ion)NgsJL>t5am>}8(>Fg_
zwUuS}@fc&@hOIvzZ4rJg9&&i<l)A1bYt=>SYQ9$TCI*IQ`rdbG{c}}`dFF}>Gqu>~
zDt(BltBsoQ`BP8TwiSylpFPnyS-;VxZdIMINSK=PiH3spnWv_7`W5_SeVg|{qWk&L
z2NSO?P+mPd_|M<t`=-6s?=CWHER1utTJa_4uY%XjXGJ{ftFk|?nzd^7<o3tAwy#MK
zex7--^5eele6EBqS*PFopOX6Y_rsIPE`}W}ssA5E%a^G<T99Vp&zT)zw`5E5GSS1#
zpFiASYFA-VH+*vcjJJ{_)1Dhg0`r#k%CcV9l3v@O9_t!$DrC)-)(dG{V_zKzS||Ja
z{j0olI$zEnnz1J})&JfijsP`fdwcVsIYn*p-GUvbEUm@z!frn;6`374)i>|X<D_S4
zU#|x(fAf{$i}RA(6>IivNy}HcbRz4GLQ3OQweQ)Atlpls_cHHfh|anaYnvVUO-!_^
zP*wj+*O3jIGL!#gUW(s)eUodvf#kZloXP9zmd*@bZ+dr^)xC!56Z)HOnYJ$fH)}<1
zw$r3k??c4~%|UyOWhcH05BvVrKtA)??tJH`zq?{zF<j6OyL?b`M$&q_R-g2JXF{eW
z$#Y69ntx&6$BH~fqm$W7`R3?GOw>7gY{4N@J+)U2UEJ?fGUoh0b>{kl3hD5j(N|S(
z%l3NPhx_hXq<?eWjz5>qo?z9j-_R0!>OWJ0(wgFitX)ZUoAh4BsI;tEwJ+yIisH^t
ztw~x*m2C3A{GR@4b#`K1wyN6Q@qX;rdz*ds^8Rv3mS;L8w^!V(SYXfDuERwWdd%Vu
zE<I|tqHxU?PnXu}h`8>u!1HQ{t_Ga5+ve-yGiPSX%?COEa}K`|UpKMibFe^^P>Nm9
zeAa2j<sTkwC@(ZsXbhcP+x5&SwbqF3%Zd<d)*F}G9-Nx+Zt6Mayhlo18$NQ*k_@_e
z(C)+SkQ~87_X2tJemqOh?bu(lYTM2N<r8{wQ~vl)mWjG@@b6h!cDqk6+E>}}YF)Fo
zS1Z3|F?oY!D*Ih`SBI^&(>T98=z5{nV);{jj_TSbi-$+~rZpX#Gq>V2cZ<o1IgOEz
zn#<-1CT=r+vCN_3?EghJU+QvqU+>EP`z!p8iEn<)zLyJ*_m_q8J->fz+ZTp7q0`&7
z?xdVr&0S=<?;h)+4&Is*Cl_*;-sJz=V9hb>VZ*^6`{Rt7{~Izb@8pl1oG{JZOXm_-
z6!T`QGn=K|m+b!B?zK7m<+7D8-31>@z79-M`?1ruOf|nMI*ivM*yC~2`HzoeP2?C?
zMRc-Ein8Yt&{IhAa5K?WI2)IcCbcWGbnnsK?k^r(x^?>0|H`zTLT{9!bl(2`ef86e
zZ>9Qsq62RxhUV-!`{YARAg3imP66{ORz-<~Z5;<w)-M(kzhzOj@vg4nkE2nAo3<?|
zth`wNf8o&w*CXFdJn>DmWpUM;Cs)~=PJH@bdDr^;<;*o_rfVJ)P}c65TYveK-~*r4
zU5l$iXPql$pTo50*uTo~Q0-YPuU*bsbfn!}asJj6+iN#B7v7h6>1iGyQD(iXB;=;(
zL`KfJE4CD`UnR-&@Y|-JKRx92H|Ot<WSSOyW$}cWJ?~wn*BD3ecUk&#x%AZ6@H}(a
ztok+XZs3n?C*Hd1MzegMuz7N&|FX4KZYM7Xy0I>G3)Ee}xM1e?X_;@nNqkwpeV22P
zy5BSYB?XgJYK#{5{EFHgv88-k+1kew^j2pF%Kr7}y0=tG=4p*Jmt8vNuH0vt&$i9{
zU+X0+c1|zonrFMLx54@a5rxN8J7#71`zQC;>z&&oaM?yx=h1rI;@QhB%Hr5}YrlHA
z*l#V*Ci8cOyJ9lf_U$_=9`{uz!Sac6a5GcFi9p|kb*J*~+|s-07%DwcK9t8pkmu{v
zRS9O>ekDxMdH79_nZ?zn=Ge<xbq}}niUQtw2BQ0InH;QdeW>#h@awie?pHW(9V_Rt
zyk_RYiEPpf3*=>MGWR?ReVTsQd)@^7uNzx-&dlVwF17BznQ4{v)J^vN1z8uK$2?pp
z^LRlVpZfK%3-5Pi?|eA5tzIE9VB=?h?i=d!qT|f%&aw2$E1T&=Us=;Bn9?-0VbiN8
zLE8jR^khxl^gz(!Po0C=?SSxNZeLxW;{mC6+^gh;ja>dm|6K6<#3lcavywd@vAMPe
zoUeWCSMz3e{L4l9dp;gm;K{l#BDu|^i7n&cv=>LyZyor4>S^*z8PzJ5S-!HZua;#n
zXZh3waGojsd6vQM|GUdURR(kaFF5O{A^T}fn)Y?abBT{HUf9r<aj9PXv$>s$41emD
z{!L+0t2>rov2#5%r;H)eOgKu**5OIRr8yG&CiDlkGoRa+xiR=Q=Q(Ttmv@h>zLli<
z;?1+G35Se>d?aRDw;ooK_%-Xd`Ww&6nfrF|_={h+UEXITzs&L9Nil(Wg?g`7zW?2=
z`kCj=-n0Evr~Z2&{(kPdqSF@T=jHhI)3nr|$z99a+1Dn>s_$#>#Pa&7w%6yCW>$ao
z#VdUn+KacJ&@&0!Wu|!Kc>miS{+AXC9-hdZ+1eai{=aZuwAK5r8L_f%B`p&>ZhdEa
zA39fNeeVv#ee<i9?c)oscfUV#p3c6bkLIneWH@n{`Q>ceZr2|NqAK=nn8uVQy!>6P
zj&H#(`_9K_jfMIBixl2S>^f$X$M+)PiitvD`QLwA?!EodxJ-RAdrSX`AX$ku4fAal
zAOFam{Xj<`+`VMh?cl`qis>3Nezebf&E*sPvbu6!k%4Oa6W_O@D>9DF+9b&!7VofY
zZlk@FvEjyfYd9C3X%UcS*!lK*K|$SF(PfWW8GZBW`WW@>6rZ2|@%)itqteBrhhINm
zy};t^q0(aqeSD*Gw~78LaemL`yTy6)tm3kl>S~Jfl$M=)n15g4v*(|X2klM`>Pxf^
za#tT&VA?O<viIc=Yt16%H#%woPjjOgAOFm^f7S1{>B+qHoQ8eeY|L+7yty4a{di}@
zTb<_j4tFz+Im;}#uA7PNyOL$3tTSsy&}Z=<I|81So->&8WS{(Yr56i~0za(Oo2_zr
zw`5M{GjX>DKf_PUX58M%7iu?CvopJdv&-m-dGk`IdFFv1_BY@7cC&^3Vd~nYyPEY5
zI@)t8CJ6cSEuL=u?5YLV8OCq-)>IcSUv8Xr^vRtilB%{EMM3tZw>ovRji1ViYTnG#
z*<+cWn0@KkQ`u$Zzm@8y9D1K@p_=8Sb6eBs?Yak>&n8?DE7fjE$(39BWA}F@rA0-_
zj%9rk`tNir7aV^Uxaxa-(JLD<7LU2B9H+e%lKy;XUb}M*$HWycm3w8RkMyiRrm`k`
zlV{P>{cqN5%kTP}ra9aHUyOn}Q#U(H$0U!xY&XxP*0U$DZmN8mINNW<w7)688xHoK
ztUY$d>x0yfgFha9-&%26rqAh~U=8zcjurPxT0Ta9es;iiV&*jl@w3r^0vw0F)?5^M
zUgCGcO6UGrmMo(cC)YdtQNLvB`+-OKT8#m(+y1LAmb2ZhWotAJhbd%C{NEzl6_Ud7
zKD_e7%Y0|PbKR>eRjuugw)&r4Fx#%PLZde)B>r&OvE#E>DD31_yv_Jqbn&CRsju{I
zPk5skW7W(fev@0}&Zo`$ZFc<sGM(eoh5C0l)yw@Rp5GE-J=;=kf`p@UYaR3MW6%57
zRUeal`daVH;h?J*w4|9gO|Q^@XArKG@o;VAGFx-=?}{OxW)%N5`p)u^-`cEr)Aw7R
zwHBJ+Kg?a9dR5{)``4YlKBt?mZAsUB{Has_<56pk4=b;BOzt{%ru-{UXMX6EgB$xy
z5*EkYPF(HTb0_G)+9OwaHFPC}!zRyV`M=hyW%rMn%$@%uZQmZ9et(nUnJItt=HAJ$
z`Jv{o&ZzRlEX(ZG^pH1Z2Ylp>gkFE-@>yjr<dkTU(?8LK@&D<Dh0|x9TzgOL*OPVc
zjlR2l@wh&7TVdaiSqg8&^6ePB??#(j{{3<%NN@9Dn}D^Sl%KiCck;b@8;}_FBXr+u
zhaZ~?t+SqgWxOeoecs~|=P|=7jvIPf8v}J$pIY#^^kDLH?%N)EGg*%Ly*1f#BKL95
zoGU)}kN7WM{O9AEmw|TTT<%Q`Qit6hZsp!8*7vFYM4D1)?v4{mo2M9e>py#>=uyze
zTJ?v2@8jv28$}kJjcbZ4XHK)e-;x`kX&_b=FtH`%QC?j_+nZ{(-b()!7meNRe)4Gb
zYfZcy@-AieyNTTq1+07iIltMqrTm%elxV{VY=>G)z9&VA^;~nwnd|Yg-*K*O*|KZ7
zc9LTH&zKvoRX81-xZ;DZYk1$cuAGe7p|-XgqnLOf3-vEZ<WycgO<m{4ea#EizZGPD
z*JTvhzT}9Ac7GA(!?Ns&A`i>)j1TF7{MNi(?n)ub2TV3S<7q4m{E@o#qxe+QFL9?F
zOhTqxeB17K?CIW*6aTz7vET8Nb>Fr3HK|gS-(y-+cy~SLxzP4;)x|?U5|w7ltk>A|
zAp7zI!{%1qrpP@zCY)O2`n6$ey-rH(@vgIaa$Kf;7KfOw-2b@6AW%MW$K@oU?vzQT
zw}m*Tt@?3Tzt>Xihjnht!iRa`N8WvxKf7Z=Waupuo0#*y%cQ4I{}dvXVz@tUx3<TE
zur~_HO-`G9gc+77eOva@#_Jxp*Xr(@nR33#KOeU!{Ws(<eem%mulMTXmpu%-=P8wa
zcAaanXk$oxz=um;))zgU{&$!15j_$1OUo7+Y*_j<(udum>(<t9eG5*dmaK8HNt?E0
z+PW>fg8X(`9rTmTopmo~tx8tNIh!QsX)jkD>DWFwKlGXEmenQa^xQ74QkgOH0Q1Fr
zcN<bWLnIpds&9*HRB>y37x{2Yv#+v4EqtZa#OiHVLhM{md#fBO&HVql$49VOaHXKE
zC6BS{l>hes&lqevEm8NeK;J>Mrgdkmrrl1rq&cEJjaM}*TGpGLKf5cy&UfeaRK4g9
ziQa{UN2i`@;aR?1`}7W<8k5$FSra_7Z{<|6e|e^7ZgpPk=g$AzX0ARVzkHL-^M?E<
z;tJ~*OPNf+_;R`X&J}(s?2BEOMM=c{U&zw4*30J81g?NH5mw)Jn)BBExid5JkEi5}
z$ubLrIt^1KkE<5e&%Jnk|FRbgr(T&GSF6Cvt6j!s@H%7irVCq_&3zc2wz0i=;a%}a
zu5T}`+-n=FGK}^tZ{1>T%_1XpVCJ&Pd%V@W^;%pH_GuY?6Rtn-==}8jU(T1di)if-
zKE5^DAWl7XO$&QXU*zXY6EEs=wP<K59=YlzdnohA-g!&aSBkst^*t58cFNoUwVCFZ
z=4S2|78EVp_9Q4E@wF-68UEIyz6j--_r~Hk?iMrgT$Z1`b#c<~uRG?&pY}PXzrXFb
zdZl)$&63KNzy0}lYJ966JUH|*a9&gG-a`8ne~bN9EsEVrrB^=qO!YYIy7QQVORunC
z*h{t}uM1i4ivGSA%KC2gL@uM;dv~IRIX=4YynSl+%iC&;B$>Z!w0}Nx<o^=!gvwRR
zzTKJZxHT*1NQFIH=z~-lrRKboC!;TE9$I2-r}wb_>2LW=or=7`ADNtW1@nCjMVWmB
zuWP>AwpeM+Qt2e_&65OHzBYYyR!?g~#iF3N)6Xw2Z)-Uzt$rq3ojoo6*E)vpC*RF&
zn0}~UUm(zcBjKB|&)prH&OeF&cD~7Tf<|JqxYK`+qbY1sFMeN+@cy%Hk+J6)#l$k#
z>RbOryOd8Sm$UqGKJ@zRSJt~n4S4qQE^X(S`|jMMpKqMG>(mTBnI2Ur+oB@8Ai~h+
zBKvl8jWu_d_nfKS^zymw<)nHKwbWduT?tk`GS3C3927Jcm$lD7_x*Qpva<Cn(Jx6i
z94GNBZ>(88Q)k{`_e<NBY2+WN%~Cn{e$ChQFPub~_U#KY5-GB}|LNiMX%TZ$USGWX
zmt$_m=H1<{fA=YP{hzV1mXjg5Xs&?l=I44s8Sg&SFZ6u7U3ih43e(zzW43vm`kldj
z9(OM+;Lfbrv*N+Ig-<?j-u!PvWhF<0;@t3ydvEIIl%14MlYXh|y7+O8!~wr~8vEU^
z2L8`ayHVFEbgO%9t?I0{uszpL`R(2pZ!ELJ|B=ep_#a;9Ca>C_<-789@zu-zk8{1m
z#iJj0%CSv<%J%EctahoTT}@_7Hm+DL5gkyOJwe?vVE<z=kF|?>JOA#BxZOWz))W!R
zKerV3-I}M8I@3Cllk<l4?JuV;7oPtS>A2tcVaGYQi<1;gjDDUxI(7G@4}BRI{lzz5
z(%#l?{Jf6$omYV96}O9>MPaM{?0D|7`%St<z`yYKt-Z@1SBkX?wXZO>H1S&XVXDP7
zLAl8s2O`U@(;u%tuW0u<<dDmzr94s6Qn3fFy|bOIAMP&_kP?$&G2`Q#^V`3~&S7du
zYfE{OIa$(fv*#gZ<%{+q53hytc86`dP}X`S?cGGHjMy8i{W&^LPrcRe{w7yzpWv#Z
z=Z&&WT|3mDt`D{SC-ZV`U}&f3j~ix}^486F{Q9zNV$r(3)K`vA!sm$n-#6>`QoS4Z
zxZAjcZtJaJcv{P1pZ3%J^TE1vLb7r5cRs#xKSot%)5SHizuP3Y-r~5_suXtcV8bOp
z#ToM#ZEbsf>BLpHsf{mXrAijCW&Y}u-&?hH-lwEBQxxTDY&15XTPQyF{L&*zMZMb9
z(>}VT^ounuJb3X)3-cLY&f_O+%;bN`>^L^3L20q*BB|cfUCcszrtg?38@-mPx9Rib
zwgVi?-zr^R{`a?XU1z{KmY&z`l7G#N4a!%@Zep*UvhQqjR(;98dy5%Pq*R{y+;@JS
zRe0d3NS0%BjB`^e^g`5^{!(~x?c~mRAJ1i<Zt4<RSiJwsuPm<zc2hGJA8fkd+V}3E
z!#UBysO`rW{n>EKB4SH&UP|4pmr}Rd=f(<#y<4a)?a)5!ZO>gVzL4<GmpdP{JUAp^
zGVSf|S94G3e^d=wk;3@9H0rK^kHPcCYfdv?rCFvgRQMxyNiX=}!I))7G(@g*m`o}+
z<F{X+bJ%a;0=e3R1sCkzT)g>jeonL2jSGQGcc{6VJ>K1NwR<l6EOyIs`=a;X?_M}%
zHitV(`nzzLlxW;<JD;RY#=C6pv;3NRzPO6BrukgNhYcmQvI)|ho0k8yKl|a+4(GDH
zhD{7F+?&2GO9`>f`4-N#?6~B)Qr>qxTT3#OEKF<t>a#X}nzsCbT}t=voxe-A`FKXW
zYJ5I_i^cnxITM|?xIbC`_1Xu^YKQ5u7yq}oOn=<9mE&vq{?LO9>h_(p-&4MR`<X9K
z^galgE>4x}`><h)=dDKJ3j(jsckh#ZTlA*(LduthwF;7jszIrD3vPyqHD5Kzkoe&J
z?q|tWmKzWBW}R53WG{9(q%-PZ`R)bH8c&?roA*pxHIHZY8O~`tT)n61t?A9N@)ysJ
zNobqZVwpKv_V8@2zdygNH8!}*Df%<IUfcAd-=ZU)D?cy1_;&8in<82w``Wu_UYp5s
zSMHf?zK;Gg`z72NkxSj&Hd&c1`+aOr(z>m(*J@AnpU`oQ-PUh3`;T{-*RhR(kvn|S
z(>k(PPAs`_#bCGd8?Qw!GirtX4<~&xG&g<r^U}g?c1B_!t-P(`pENfr*#AuO$a;M?
z(`RD-X=cx5T28kPv#vW|kv6GySthI0^UTLPEk$qtw6H#$F{RCOPgnoGH_s-femu#!
zDX~VObd8rj&kWwM&a^X(VN)0Bip*K-<FnoGm8yf2Yy^v@OYDSLq41rP4&U0#sVDV>
zN7T*HT}PLFiT?rFH%XUQND8kywvYeVf<t~+B$Jy=);?O8!80)-zxAliW?LrN;%Bk(
zTf{{c6h2ox9AVF6cB8V_@n%v#?;3{dChxk~yqTsRm^isJ%yPEG`k0<NnY-uz%(Is$
zeR4ueGA8KbOXhDj=MO(zn525rvTT7x!P~66+tj)ney3bNzxayHlgypl^JA8A=Q%KI
zEc^Ik>$yAmG2b&Se*Ri=dad@cDCIX7KWthpBYu6)x$RRnNHv9B;1jN~a%*aTpRqg2
ztKUL?xgf*+!1QQ_XMBpQ-21;zPnVxOCDloze9A+U?b^Kccf`-k>-opK`eNOq(~(Cv
zeNka}{IRb?K;@p7uEwU+$=RA)^yOGx3s&zr_I_d`oBm(fUmyP0NzFT^l9%K+`RLED
zmoM%+EAacZ_Pu>4t!@;pf08TSQ)PB&uKF7R>DANj`2|%ySn_r2=a|k9n-=gLs&(<W
z-{bj7H{-6S$%KQ3IVMr}68<oh*_dC`C@b!<JN|7R*HYQ|?@g=Der+_0{dZ=z$Jg4Y
zlbTZ>IW1wmmeTPs@NT%_uDw^!zj@Q0*R!sl^+Hw$uQji3+5guG8{(w5+1=I7ElYDM
z%2nh3%I(aT(`)=E>|UlfcUfL|-)1?k#SGV1mCt^dFU!GsS@3q=b>S&d;#;i>g;)ih
z6U=Yi%zgSXu2cNutfp!6jh;+gDEw6D$#cbx!ApCOz5VDBZkb(DbLyk$GsRn(tUIKH
zO1l#N%)0cU?abflUxKo?Uc0|%VzXOFPG0qb{YM^d@Ai9jaq~w$&lNlJ-Nm1On=@;d
zKvMt4<x1HTK4cV`a{Dc2*I5*B_iyZ#75ukff3q^`o^o5@;XA&>i&BO=Iy?fh4<2eS
z()?)h>z<p`R>xU(Rll_!t&`Ya((ZR>U1Uh{ztZG{U#>m-OV~YmXBGbZn!o%(tW)R8
z<8xoE@CsWvXHmq9*QTfB9)|QvW(%l!TsqI`-B`M7+tsd*%WWIf&dze{+wo{3?~=_c
zm$|Ujr!*RW*>%bDZr00BUf(<Q75}unJj@Wl(8RWVd!^IP!%HXUGS~l2m_B{N^)LS<
z{@!vAIZ!w~GVg1}%r*CR>}OS#uhL5l3O}dyOses#oS*IP7u)y6O#kC^aZR65!`~9;
z0-cTxI`(zjzxE0quRNXO5#({&Zu-)qzR3(Nf1^+38!qtLlM>dwSpWQ{ug^}}i+q^&
zZ_%gEvCk)Ee=PaPB!B+*r23+H>Kf-PKRWAmm5aaK`O1hfsNk*C-PT!`j(>W4*0{$r
z{jd2v2JZ%+%R49C+ZA-<S`v%4&mYO(Pn6QxMOa>&&fR)DnDI*U-1|BW2hP1evi_=E
z&^!4fzU6I>7vFE6Vpw2#v)69@(mxH0DhzLb&F3^x6%o4dsOiq`XPQsGe^;`-&LJax
zYgfSSU9sLCQya>3F7eu*KCgeRRQKqwL#cwkNe&+cG$yWJ)xTdu%*!p}+xF7Fi{dSN
zHaR_d-JT;kwKi$9tBlqOrP&X*H@)UieP57c*KNejpb};`J7pb@+JQ$?^G<~AT=`8w
zVAreKlNM8c@ch<UVRz%Swy(*4%h?RiwC-PjIN2}w>;GrRPtLJ>+z_Q!<9%&|TK}TP
z-7?=(x&C{8dbafUyBc+`(<`Nf-p$=tqPBnUVc{|bo5+plJ{L|tILA3~hl0rS2WxK1
z6-m$7`+ocRjEacE-$j<5{4LM8Wnt4Sjir5UHWAg^elLIFy>P~f+0N%~i~o$X?#eUy
zb-(Ah=C4bir)*ep{MTHs-c%VipC1youk|<nmx{Xk&?NWay^}{*t*w_?>wT+Muy9l4
z<-|hy28&|<X9a2I?4|J!?yWtu%zJ4Vmnu`bX~fR&(}K4i_^vVM#f55>r~kqt9G6d<
z7hN{v@xO@|>u;a6SYPru<HxI*i=9inSJj)dyS$0MWcU8GebL26Z=K9Y+XcTu^MrS)
zt<^a=Z^DG&7N4ee6=NRfiLVS=mu$J&xMJ(v(07jyB)zZgU_AJTjeUv8t@CHjYJ2@$
z6?;6SBA|(LTB<bL%&YGOEQJ=FX205Qt3A_v`7`&KEXI?RTxA&S${*d|%gB_c(A#yZ
zarqKyeeLyo<RTYtd=hGX`orzJ>%PbAsmXflXZX*|QlfA&<NLk5YZjcG(qP-pbk@po
z+s{o==L|R9RFr->&&Vt8GF$SlzaHXBwhIl;mqr!w@2+J#+P1x*uRA|ds9x0W`#v^r
zhfMF|Ec_w64tYI(7rgq$vS(tv(PtVH?|r?$t!=|YmhDsi`d*)&?sRU2rqRk4A<a!&
z%Ustb{EN^&zw*@$6@!(FsxNf?EY`H=y=k?uigR0x=wJJ!#=9xoCiSk^9<-?M_g)?L
z%kwV2KPh%uck$vw4j)*GADO+G^r6{z`x~cS1-7SB(^XU2F5hOGlGC1dXNkbIj=06A
zYIF|xZ)UKcvgaaKM~e_=^uhx#ntx7+T=>d!<MFevau&TPQ=9xS`^~fWN%K~v+ZU)*
zD{i~y>0=hyyL;h5i%;`jxCxh9HM%UlDshdeq~&pi_R(KYzHDzWI?r(D@W%@wq3a&x
z#0wPFT#DP}z-{wp%G#aJG__hyYh=^q&m5ZnXOHUhbH#3r0m5?wvi!}JckEr}U+l`9
zqw?*APsF0#8`Gw~%zD1omrdf;VUrN{i0m^ri}V6F{5N0Wbah(6UzPpg((i@1mMmB~
zaf>F`>cG9fPaZlg8TemLJA%b(mXwq0|HI5%Uo<q?v~wvf``iC%e*Mz9<-SLg0<Q%M
zy;;EC)^)PdhL8K$`dS64QrRT+bsbxd8lO6IKJdW7t-D*IG|E<Atvup=)P1(@-_U4#
zt{aOl*zCB)xGU_n>*F=EJG(de9G#cC=3HQF;ig#uomtP)<UUNhWqs(-qld3-Z+2H)
zY%}>)elYG|#=GcL(?A2CVkY@oiBk?X&t0s$jCZ-7Hts%pONB>3#${pt&#9j)8`itq
z*pyeS_uTqVeZmiggxVHooBBVq*ZuwOHZT2r{<8maMT+`2A6Uh%uI_*Oe*3~0nOj@y
znLno-`_1MOY4&W-OjqVvE4$ksGtZiSA#3Fl+ul7bb=%8xv(9l9GI5wl|NC|1L}lVG
zgFBsUh7EV0y*bZ0cXf4OQ^00%!|#dlmp^f@{ucM@*S|R&R*uUnSgU+2H_v3d+{Yps
zu(*i1Q}xPrxpObARxVlH?$;q2Gh@|nAC<$LIVF=ioOU=kY*`_gdi-vqa?&|Fl^gF)
z7JrjJ_ln_ovP9YZwqmh>!~3)6pZ#>>bD&CFtlo)D9WRwu`A?OMOw-Dkaef-};slq|
z77i`b&6{scwaM|{B*5#rc|o$ta+6PUF4!DY<XglOciJRPXl1+UoePS#4sP?M#21`o
z&;IgN{!8T1OvB=DO^3@{Tg+1Q6qNJaUW-j%YZbZZ^@@{+_gY>Q@a(T<3|ey4XhPpv
z`AwIEm+W(^VEMnbz;xb@+opl4{IQcxuWS^tyZLVavx$!4&m<=v6Z<})EpPMUG|g%w
zu^R%PtX4dik`?;(@uB30Z|>pym+Vox)v0?t#YedBfJj%`uCw1m{2J8xEkdSpiZYpH
z@Ck10y1c1?Nvhtb*s%YZ-A;=QEK{cjzqruYeC+?R%lz$cWejWif2&^U>$%?{Sa|&K
z^ZaW!JU6^MRJNUM_hXOzBWD_KAMCB$YiFqW_Ml|><SMJh1?ueI6dV>f@Tg7tcSn2j
z{zdOL3e6R=JSh{t`9j0wlsW0YCnX5KJpVCcc9D%s**y-aS1lKJRq^#}?4Nw3?yAp|
z7}xhxE+jm98!p)9xU;tFHs>AA7drpT4qyDS>t(;)-*w9m<gS0`v&ZemXYI>w%ZoqE
zH|p#C_(PzXp)fC?O=3rq-r{oycJ_T=e@bLh$EwW>nSCzaIIy~s<BqSwlZQ8UNExqP
zyQc1R`M;CwJw-8f8Cnq?`xi*A-{Zr*G4s#d{Y<;BTU0+j_3o9flk3{4HEx{s2g3cs
zRrmNwSUysnG<E$oyU4|i7mK~q=C&TID?h&HWGR=p!}VN`yr&Lx7Cw6@IQxM$Q^ZmC
zgDunN6rI|}^y2~B{0o6Wg<XX;OOj((HEv#cFl6JZ?~?MlKgE7E21UdywdLIYKH0WD
z^$^=a#hYx&*R&V7o+^|)yx`!z>L*R_ezvWzUR3gz-PBKI!7{$No(r$tX^7a`9<+5%
z*dm6*Q*GG9f~HKHS7|A|YNf+WiHc<I>?bAn7Y2S1*X|Uavv$pk%g=>MEU)=3^7Ma^
z6S_lfOXr0UhNbZ`chfsW)AwJlS$=!vtcQ_q!VjybOM0J({w4Kq;bHl;p4%B1!fZpI
zE$}yv{>h?utkES_?ss%Tz@iq`Pg;SiF2AZWQeU3dUGs6qpUJwDPlX6qSSRMMmw75E
z8~)#Cz3r*<jxVI=6<9x<993p?HqbZo&Aj|8UDxgw8(u5QS9!5RrDNHC*GTr)X}A7r
zyq0e9b<mz}EHZC%arxT94gsYp_r3P+F%Sznu=$XH-UTC>HIGksE84z)@jF}QhH2^K
z+ws3MQsffs&b(&*b!gA3h4Q_+lNS6mc(BrVe$1b&q|TL-x1N2b^3X)GF<d{*mv?`V
z_ae!oB5HQKo3^a>$qsH@ZQonUaf(wfXD(BCRF1Lm>>P>D!am987X(&cVp{AY5E^v1
zXIGx`nRmOEe*Sitaa~QIq_9Tz8hr-8Gc4<b8J+}gJ^XXI(uu}~nG?h}UHHy=U>Z{m
z$G63;m(5KzC!O||RKCt8-fi3ECG~5?^;N6PUT>b6xLhXo-i=9zW2bM*U#+2j@gb+0
zs(-J+blKBSH+pMwafXEWH=Ve8`TmPl7u<|oxLZ!timkXe<@yG(=Wm|dbBc%CoxNTC
zjP3jDh5u5UB^5Q>8vU(5O#6GWXwl!7Jd+h4$+j$g%JTV+x89B|R=TYRJh*4p?|0nh
zEfjg~<^e8iP6r9w$<jG3rp+e;-tBjl{lcLtXCV4x$roQg&+f`*fyjub{0@PV+k*^d
z+PG|3apS?hSyEvq7WBUOa3=A`gH?MLe5s#i&ok+@h_UDI9VM~moBn-o4t;&_l<zs#
z=l|I+J+XHQWO#ZbbhXUfj5U*c*;8fyuDmeoUZy>h#>#g2gUK&AtJy9v|F!-&(N)YV
zOd??0yc@qF<#iia|NlFEWqPhq@Bib+FUuzQu8VxU+(^}0>{kWfItTSCll&9=u4?~v
zR_B~M(Xn__5%=2Ni!CJ`b05gvXL|5n=<$x!{I}u?YA1Crg(qz9T<D#?_ioxpHX$zG
z6B|v!l}c8B-czS6c75iiYo||gZ7W{$X0^_X?+cqA$Ge?)9FVfttM+Z8`-#+@QLH!F
zk5AumytZZ5m6iib4Yk(=7+VBg%oh9DA|StYf7kQc%-$W26KtB#O1@bhRe!lLaGvE1
zzxxRhd2b#Vz42+<`}yIn)q8iEuJ=9d{#!CT;%@Wh{kD1sc-CJ`%W$!>-}m59`Qn>4
z`9^xd2F14oPE2U!y|4D8+5TgM&+WA)xp{ee!<Y}S+aF5p^RhO&c5^|Slh+IXnuI>H
z>RD^~*WD>72n$;oYhJ!)%dDlPhc=}cct%%+Z*~!F;GD2+j&qL`_gt$R+L@~p{_Ztc
zA(pvi!O^t;yz?)GhFNaCbL-I0?4=I<SI_z^eY|vA>B%MT`%9jOG|e=79mJw@v*fPH
z`wcJG<r#^!dUtG&e$sw$!Q*L-Gan~41+u<=W^r9kWNq1ktori*&bPD;`7(bjIobPd
zzp$9!&521r-dsAloS$pLb<;0OhPS&_i+Z>3R=4+-ylBSoc70z+=f*wN%evxu_>R|<
za(RUxe0$yanTjEEz|-Qk)lU5V*+-4Ml*2vNt93nn|N7CBlWV&5{!Ma-{>bcVdHcH3
zri=?VRTphftA5j)oc@s~E--w$+>YYRWA&TYv@uP%s~7ktZu<G!d%D)OX=1Y#oFd*`
zs5qhj+d$x3F{j&#%9qX=Rsn0mg#NEDd=kFs61Vs+NAYWg>();aov!{>t54w)|CA@;
zavBd^BmI|7eGs_ulAdkS%f%HOi|&~%JTU8^b*eVgf(bj<&7JFCllttCoyFVV**};c
zw%jysU{>Tv{aCDdsPUOB>wSy2IrG<K<{mTodPzBkM^fkW9+o{@TNK%>JTI)c!?Tj9
z-;kM2^T@M+b5gq)*enyTd=1kyXUO2J`jzs$*X3|m*}YWu)*ww$Ik7Zb%@a%)6!#VF
z+ka#2-LpS7?dx*M@U(~!zM!6-(U3nmYwEWBYv#6eU$}g2y|l$oB{}uqabILjr%pTa
z?@0G`X5V*$=k}S*{q>|+WnO#mV!17h3~F<u@44^dsP^$Gao=|<zv$kN$hP8JX7xdD
z=8DeMNn5&m-eFT~p#;^dhwDE%e(Wo8vH6$0?CKTqYeKEDXIw%bhu8QhSJ@t(`#9`d
z)&Kd=uT}MPs|0!92>!M8`t_*m5zqg=y8rg7{@0n&%Iub*9MSy`U(T6!>+VbKRquXZ
zk#bwh`QF$r@vAD2#LR0x(n@QRW-Zp9`}!!SmSy^!ZSti8*Xj!-3KW)Ui{G9+f7*me
zQw3JJ)m*%`OZMTDUybLI_vQB})ZKd>;HT7BxaPvs2{&a9m07NuDD+H2z*zqBwy>Cp
zYX{dYx*>e#cd?Vmlsrp|#)Gc{@3q9(oYM3+miAEUa&2Nf`Qd*b&yN=|8@}%66#w(&
z*n~Zw8Rs{5R%w4_TH<){+vb#&H}u!N@e?UYNiuw4xnJ(z@euu;5BlebT2C*yv$(2L
zHRXEY{X-A;Msx+oxxEvS&63@2-QjS!?2vs7S5E$1fh`J)jGhW|Y>o{z+1>0s%_P+J
zc6R%r=g$suuXr{0kmlt2{XO3g-BP;xxwt4Rz-;%Ua!sEFXJ<T`+ap<O;Jj*TMPt^c
z39bbPub=yJU-{BX--~ZkjxKuh@PwroL-~QGZR!jQ+Gk(<$+v@V@vCT4UCRrh&6j64
zh3@~G{ZuJf&xl`?<9E(#CeN5>b~U`uPDdYz2rt|?Veh%+``$e8X;QenkK=*j4i*F7
zPi%2>W<PL>`76{Mw0Yq=t*sSbg34@W@EqH@ci|(Ut*on81}3vHu3U7FN7Cc8&gq+h
z!V{&L%CBEvy|T5!aYeb1amStIwSUC+rdV0Lvz}X)@uI%k{$SR;14~~nKfHm>vOyyJ
z>n*7{)Bo2>HCZUXoXC9Uenga*pwHPgB54XfUH^jFw5ML5u<V%v>+1c1pJUG^v3!l|
z|Jk|GTQ*Sed#~vAS*!ontX!R-`6fj_>X2Ys-Nz|Ms!G{vrB_W0IZ^xZy0P8Wl$y4y
z9AC`YyS5rdO!?Q8Iq7uJl7|^3OSz>}DvFOs$IYAl>+Topw`c#WN%d{AFPm~kdHENK
zYckKIyp**Mr53%IEnXkZIDz-i4#^d98$6Hwi#E+G{<z8G=--=aThko&)!O-I>`4A?
zFQ{@S;>k&eZ94kTR&G8!QBG7mV5i)rFPlrUi&!~)Yw`rHKA*)RS;?w$IPeQ6+vn0R
z-<pJ`Uis=%;=l9GI&+uL=`ByQ{rQEX7Wi17c*K7&bLaZoYvLvq^DfY7et2`{*<YRS
z9@u3jEi>$Uvct~x#)KTZ_L#UgZb#l)yxAa{(4NWJyi=mUWyAl91@D$V4*%@+Kw{_o
z@(nR7)-Bm}s?Jlbe)>hTkeBc0Y@gQoq+_H1PF9C0^;7J1{|9-cxUY|Nc@=s7)XK`h
z-Fvh84|_injP*Wsa&vfynf?CES(CC2QhqPl?VB`f<)mYU$LADtFVVQP_TSb?RqK>5
zvTwCp{r1eG)?>?=e%+ZT_M@_%d+W@Yb<aO6EH7Te#{N`MKZM&X*JY)?bckZ&k285I
zrGsTNoG+{qJehDgVdc+f6V6=B-?&|<drwXOm1$NJQ;r!~PY!Uo7-#D6b-njnQyGCN
z9@;OSrIoddPKrG<xoP_O%^$hvKRw^S%Kg!+$`7G^vKO*m{q}z7996LHN$KLvN4|VG
zE$*8%h3BS5{XfH*yf1eeobppO4E8*gJCoy)@ul*LJdTppX&+)YhnE-M`l+46lNi~`
zV*R~k*Y5>+Aw^ehMDrYjeU|@C^W(UdyDRITi9^<!?4KtU8x{GMe&70Z_3Vec{YB3_
z%(7p&P=|Fc19Nlr>BURB?j7=ybcyo6{d2d-yn?Kjk4pM4pL~40c*Pf29;aU2(8Ta#
z?_Ap_J=NX0AbYu!-rk^(hc7gy*Uhv!WDvK(<k2FJmPWCkrq6=Y1OsN5NA^oH#4fWE
zn(G|2$XY=ATA}y!bE_9@ylN`_X<b!X&MVdU^}QD=9*NY?m|CtSp}>6JJ+;X-aXPoR
z&8hVz`>qG(p3d6NJN@K`+n-;#AJpGE!@zIhguJvf&(`efvj2Af;O8}E7orO4bygaf
z&GUZrU*qOA)|$$)ke0`$m4{TnU1E})=2{$_E+lQs`1^Oj!QCvnPtRI@K7325K+Zz*
zQMk(nZoU4Tn|cP@clzD^yRP1BLA0&H)wM5$8~byXe`qt)VBd6Y=^>p1mG7E5bbj15
zR?^r$OFnjLmHf%OC!YKikzrDfjP5&E6gRE^oAZZr#lD|ZE2Q-dK3ukVs@=3VdacM?
z%iO2lfz1r|yA<!R^Cur_|IIwN@!;D1`Nr`Ik39|rehdwsTzx!)J0akSnqSC@Tn!~#
z?eP2a6HAlMv-8c_^2y?4?Z(%eXKLvDe*Mp0X|gZ7akY%Znc$TxesoGdz57OLO_FT{
z_lX-%wU^6X(!VVKd46ATwEf!7ymJ*C4E?w6ob@f+b0KG4$`yfI!u#y53LW-ls@Jb!
z*073C^T-LkAhAFrCnGe=W7&j%Pfd$%_{%c|sE1wh2t9V#;r`Slt9+@Qi*K3h#O`xX
z*}34><axptb6-`k>D-jbj4MoRo6fC!uvqNJ8gI+Af5r)_Du*6;eiRUEVikXCQe0CW
zHgCC`xz!GBroyc*J#NVtZ7mC1%lH478DVL@ulC+;Hh-1Bth4U1?!OW7GGI#XDHgYl
zMzs=-F;|PDk4!)IUdL6xZRsrQo~>rC?V73IcAK7-4EX)&e^bD=Lo7v&DQ~#7o2|TO
z6*#$1ZusxLa9VltUfKOOEGKW@d)@Fslhy+Vy;Nph*+UsmCN8`Fob$T(l4Y(ta^Bum
zj4=wkH+5zF&i&oO0ZDPI&0oo0H_O?v@WDKD?l(`}iw>=ksXUi;{F=&hv8^`C@7yj5
z6@K<=jcx6z**6Qg4(z%k=ebXM4%6bTH`$8i&BNqW4js_HUaz-x?)kLNRd4joK0Z$N
zt=*kC$$hhU>!~f0OEmlCr}S{|yEV7sult-Y`bF&#pZO-+KYx9ay|3Co=@he4;kMM&
zu3K~eD{j~k^@s6@=#l==8fj(LZ;9u7MD^5LZ|lsh<lM-z%JfJI`?a}ZA6}o3T37kZ
z<b3kn<h~7I?j}|@DpqJts#h`je{$n5*(n9TGXBX{T`K55eEOxyCsz0DJJoYd&)wTK
z#n54gR&n`?r3-fm-BR>f?CQISGtA{pNrz*`h1)kAPc4dYdd2bS@o$|*@d?bIZ+Chs
zujwtlasK#p)B9V)?oQCy7;RZJ@4CyZCuQ+*L1#PXyKt#*ICx}V?87eqbx*qAdLCeO
z(1~{mzp1z0bF!^lAoKP9>f(LZ)fesgy)E?b$-j~_L^nk8uIbfEi*BC&Wbda(>%9vv
zY3wd9m^5SUvOmizPN`LA&#G2V@Sbrqkd=*n{UJRr`Le`}f(0$g!cWz%e$=|J-*#ld
z-29%I+o$c3dsDq_YK!Zn#ZxY2SQj3cRX?qW^^K$CE?XCu_bWF3>@;N1oFXQE>qwF^
ztEtH}*XEeI+8<~9vW}-@iTvHIQDOYL_}PrJ43mGCEz9|<fA;wmR=<N%M<*K|2@1{I
z>MQgn^XAp#A2O7tHuJDO|G)KR+Y!z;{Kv!}dU-6<{3Og#+2y7a>6?1|)wVOjOQ-KQ
zn$yDj%k0ywV`bAn%ry%2%0Ha6X{VL-r;EnVKmCngJ)<|H@qgV0eUaPNaW>Zqw<r|d
zn3B1Br{u=ycvqM8>R%0RPTd*EIj_3sq^(uV;ah9iIl>~ZZ!$@9E(|i*>wf)e{>FS&
zxr86@4X=E&(`}Y0DxVhh>+c$-gI<QMMLN3_ID(pAR<CFIH6`tr6_-K9LBR`&IZlf#
zZ`(&*aAgZ#x~pU1uKq7Fx$~EI_~+|wYH>ODerM;hd!;6KF7)&=t1jR1al`oqPebLj
z=DVb+Ua+j=2@mmU-&AtBA?i_8t2$3jzU<2ro!$3m70thKxVN`BEFu4lwAHIe?Yw$t
z&%~efe<c&PR7*hpS<m~He$(3r?r-`zVPmL^*<%?|?ZWk5W+FoBQb(g(mv5Y*Q#9N5
z*sJdeR^96Bmdr2v;-@p`be7S2LraT)xmVeny3M#B8oA8hIp0+5>)E244F??A6ICo~
z0#Y*K#N!$IOpZQW?smfQW2JM~&drZEdq;<bW?r&oo#$9yeM$a{m+Qy<8FQ9;ELM{F
z@Ru*`eqsKrwd?zSN6$HWAl{DEJNMSMK!=TnhYlvFA1nQN!tB0b*7xNco&5THlebmw
zS^E1+%c+urk5Ao~U*~J*K7HHejnuM>>Y)z;kM8KQ-5~ULiFDs5voyw82l-!w{hMm_
z=~(`Z`-WT1-nk?^%VSnF6)l;j!u4SB>V#W+^rt@EcChU5gqp}_O({}K^&G8>&$_&7
z+wA$_S%hLxfUlLn-TRXgHj0#py?oob$Ljy4lAfvSeyGNa9c}pfQ+7jy`fH`)x@8C7
z=7v6ssJ0IF)tzyx$>P{vhMm3P6<T6V^G;-zhVK#nbf7sXRYzlChrFFpzkbq{)zvr5
zxy!SAe_G4yhd6ZncK9hV>HW&S8CQ>#bJz#W=m=!>b33{8PyOk(K-(+9PYqt1Z2Y+4
zZCvtM*{i7y#-HN$98g}_YhSygqSdWed~S-h{oK8aw*IXM6<Ko7x6FXs<o52_SLfer
z_qN%#O;y76@8^H#A8!;*?)|c-JE6;7FVE(LY?MOj{$D3e)6Q_OaQw~sPi@wrqb5Zs
z=aq%^wYVyH<^S9EXx%lRq6r2E{h6jShqXU@wTP*%Uu|lyWB%t5hx4vKX3dV)bYAYi
z=jbVS-@^%|sc%b{o{!nV)uQ))wat+&YgZlRT4QT<EN*)ei@eCsPWkukM`I_wslIdO
z_?f+0%Z`RgUi<a<%;&2Q+NxqK=Y^QH3RN2`{mRao*nCUoYIkXG%Kq;{+G{s(E^MD1
z;oH6Y`idFh^R6@-Yn5GP_&7a%%YC<&-TDcg2W}~>+2NoiShYD!c)kA>DgXS=E2iwl
zoKEwU>{GY27hB$qF})FY;)eaxjaOX1bSqbQuCY9m5qRsv-6$U0GCsaNQ+=9lmbJfJ
zVXA4k&}vKH+v~-S(zk0ZZ!Y~Am@2$1m065y=ftPHylYPyJ)aSCYNfOM<A&%Mp=3Lg
zF2A4qd{>%9ZQxpOyf3<=Ve-+7VMUXg&ziYKdRe^u)&J%2)u|VfvKMh&Ufoq=plz0%
zeeub{ijagiwbE{TL|$o3Q`_4SseZ`aZMrIhgg*Q1OTrEJEVo`~-N}0YCi|LupAvcu
zUOMpoGt7uMyNhda&#UP(l&)`FzG}tQdtcIQeZ(Up6AgNoyyQ65)xPQ0^@M|R-EBrm
zS*yEZjV-clTXeWj_U25e7hIdYXx*<B^=l&C_N;te>*pf=;_@v+q1N2>K|fXMCBEDh
zzjOOVY8%hY%l{Y5%GjpiIF~p4QSJZfhwC_&-F94eT2|oS8L4M`Tt5D7(X5$zGykIa
zp^1+#iFfTcu)U$Ha^v~Zmv5uH^4FB!{*`oUZ`%JfmHIPR<e~y1JcB0xYPcuFo8xc4
zzW0Ja*S4DVz9tu^EqHS4_{laq&ncOjKQxV)X0K_y%lW=G<NLxK)8$W}>z~;BdF?-Q
ztGPjXrDwh~ok%;HEwt^wRry(^``d4=)ID)Qyr6pZCi^Kz=IskRC1!PAW`EDZDK2_5
zFRap$VwmYWtK`^ZWfj?qHtzEuszMf8atn8?=iIty#<Z`y%vbib@^%MsDK*y1&APTz
zxP$e-fPTH+|8yzMS=C};7lfM{RuyC&dF%TB$#nOKlL{3NkDN8Fzt=o#>o?J<{?_)7
zr03t>cjTdv)Y{eWR5xorJr(e?qB*oFFj;(e)`V3$50iV}T{c^+JN1FLaL4-WKpEk5
zPSJ<U3+lCX6CcI<l`PiEy`<0RuBL9Y$a3!gWs}}Kyw0rn?+Z7h^(4Q$`m^sXj=LD#
zJS!+F?D@eEr{_kuI8>K7wwqUYe{}d;d{@&>YF1Xdm#1iS^p|FX(6cLdrkGo0E%sdC
zr<Pe#7SO@Lb*ES{fQ$8U?_LFq-_L)jG$s7;Sh;^eOM_4S2Vef)R*iWq+uXh9Z>?BU
zKjl+IaJkjBD-Yc_CoKwD5uL&xSmZv5PybZLlJla)>E~97Z7P`Vn>O#tA?c6%_O3t4
zC+PcWM&vxV{e@w?^G-AT_dnY2UMXGnQNQYw_OkSoE0|hLvclMB*oPf?Rxi0irPbxP
ztH)&<sh-A*kG=~Z%UUeVbvyOfrLto)JAXX9bKa^fz*LxR-O69PV*+iQFXi`TdO5l!
znQWWBQgv&^Tprajr;jWCu*+@v;M1}zE`L)@N|$bK!ji*p-X2-;arWB9cb6Le-&Au}
z_Y~vCX`AL2>)-tKddaCHEITgA8vHwcadGpVn-5D>>kcTenLT^-*4_WL_eW2g-lu0j
za5)_liDLTkB);eUGdr8M`A;%;PMW~`Y_WDyeZ}@8i|=h*wcuCl#iTd=eC<rzVs-RB
z2u{w~Z>ebWr+L21l0RQoC+H-uS$g=LkpApHNo8?W2{|Hs7K;{4cJh4~X>~9E?H+@d
z$0j=_F3kR*=q;cs@;o#7>60W;UE%jj6MNNf-q^OOCh__+18FUWl}olK?fSML_sViU
z<$cTh^J?cem1y13{l3)k;<{f!_NDnpn{1*!>@L{P_WN>tkzO|c6_)EaR(@}Bye=|p
zb@c3n)1q_cr_Ia%bmfGr`Kya3|K%=Zv=^VHZPNUC?}SrtBc8eKcoqG10T-WE$Z2~y
zjbta=+h^a+G~lV&I$7b(xono(nfz~ORvcuDP`Y|Dx@EFrr<Ih%=d`pW^=C{1U)^jr
z|G99rOxsy-x%;QD`I8cFGvB*^C_+5F&ND&4xzt8X{Z{M^*_lsN7ih%vTu<j`+fu&t
zc*2IOQJg9JI_^x(Qi<d|8|1~l^2YgPdl`2<iQ}&4Q<?rhMA7|7z{MQX$MTKe{Gv4;
zKE122zv&2Ds=ZQa?Kg*W0z1MBGM8^Vy)%?QDd7G2n-AZy7%G|f96onXoO6@l)aLKe
z0fD`%t>sL)i!3;Jue2ZBJICeF)b7uRbF5Czdi6KD#!t9q{h~RS<Da|neY?8$P0Hqj
z2Yu!>P5!+^aO>j#f6fUrt9_WhhB0fRne!(v0ns1@_Fj?42^WLoTW6-7RPiy9PZRzv
z-}|)xj)U=C_ET5G%igM$D171<Y$=cnZ7=+mZ2JGvj+w?Y6YE9Hcj&x3zESv78N)_D
zl?|=x8>Ho$I%K@&+WeJSWW*K_Sn=V=x}dTmr%K%eLJB6Y)P3)&*6h-HC+xs=@rKRY
zw2u>w=A37q>1=YinaOY6$-w<frRwf36w^8*HE;il7Oh_k_g4jMEWM+@C};QoACBr=
zd7D!8yw<D{iYsPuF8|RZuxgdfi=?}Wzniw^%;#7wGpXDpD|WT<(uj)_)~#EqD0Rs@
zGV<ajw|6UxN;?=*f9slFnlodq?}_?Pvmcydd1m^(^ykGDf8QUwEy5M1#*m_JSQ=2>
zf1~Eto0(pPFXPtj`n>XLMOtjNTzL&^SK;=92g_!yxqI^M>e|y&&N4UJtMO*4&$S74
zdEL_`e?z}?)t`>tKN?SQ&*e~!IF-1N>Elba+RKkx7N6~?{FA-V<CI0xM7yFNtD{@`
zA5~9!SvYe>u1V|9sc)TkN4`I}HCp}4o-_JO-e0t~D9pKW{KN+1$7~lkKbNoJ=H9m@
zfc5s3!!qyn?g}d~@6%FV;3R4>eb1qkw(PHS17x;z#jp5v{nP8{sU2^!qd(4CJK^uM
z&?_YY`tf@uUpxDkUC&*q{^Od!Dlv9fx6@xbM2v-}K1*(#Tezd+y?oo>RkHiG>juVc
zJ`xeScb<UQ302Jpui1PoG-b^f>=baQ6uuUCm^(``YZ9yR>%Ff%8Dx*|RP@ZeAY?DL
zqVvH4i@*mtQ)(j$mu`IhQjlBCwST6?E~AIDFYmv?U96V+?9zp^`lip7B%2LX3b%Z^
z>2I<9nvLshMZ0YxGfLk5@BDe3duEjN^Q&z4Sz_-`UT-O-`L-eZbgH{Y<Sy>@*(*Cz
zHWY2pUvN_7O*N0qtd%ooy*$*`-F2pQuD9rf1)g7K+NvGUvC)0E#qWxX;kzIDH!aU>
zJCi*B#+kd4$!j{I`>#AW?v}dUo9Vz5|3-C}=k->Z3t#z~Cop?gO2lcz)+|1@ATVmP
z-5Z~^W^;36V@^yL5jk(NX|tBDm}JhX$H&e@^O@doyBvF1_FqzjePEbP$n`(Mi;8$=
zBulZ(l6>QTfOCOuvDl$mzYl~=V$yp1w$W2Fy6}s=%5(dL4a}1Bmv?`^u$^<q)YF@;
z_iu<+OijC!xaGiM#hP_WM-S(2;QFt9@k!b4U$<Vet?1`UbX>jWo({iJW2|7Phxz)A
z;@^Gcesev$?d-PqltRPB<8Kr5Bs=31xT;k1l0F^3Zg}?S%c$yUVaaJe?_PxO+SSvO
zw^q}AO_|8msh4`wE%n<h7Ob;68ZElu&;`-#x>=uBWIVh&<DY?~^4+*+g4dH-7MPYC
zcG<|x@qVt$M-DcI2Qn>MCz98kmQY(W&sL!|IAfR6(O*+$&8_OnF_!%P=ZDQ?mH2KC
z8>i*7*w3{7nQ~U-?);jKMjOvD98O)-c7BDKZr`UW9;P1C-z+Ec-j(G^CC_I3alAI^
z>Gj2)tNB+*%Sz5v_6>V9m&0WFE~UM9d|s?K`0>X!T;XnopvB6^(=V=z%Q*4e?T%AW
zuzd=X*zT{(gV$fNOgPHmSDTx4w}tf<6WfHpGhcT}{bBr<cD>$rX3o^TH%r7`Zl5nZ
zGyc|o?zHdfGw&GxlHRxQQ}>kcPL=6~JRb@**9ER<u<N*K{I=Np(KlQ5o#x3l8`(Yf
zFmOFQCba4B;k2poVvbsApB4vQskNOjZ@zzzdtyVW^Rl9YDmPiy?OOOk(%W_Sf}c?v
zG*a?KPx*N3Tz6f2+c<X0WXHAk>8C_?Zuy{JIqg1=#Ic>3;<LV0ib#ucUHmY=RR4^b
z>S2W~5_h;JE!p0=-0X7QOMyH|wmjV+ca4M7SGx0CXH4NuwK!~d#Ot>%_fwaDG8*SR
zczixCzUzA5*}$lG)9=GQ-sjG*mC-x&(N}Bb;g>%W_8t(_JJikiVPf)JYwy4Ood<<Q
zK0n%eAX?udC^ahb%O-}Ibw@=O-<_+WuGPQQB)EI#%<6+nKR-9y?Pnza(8OV~giWq+
zZ1F<wj~*hk1!HQGuX1ndILX{lw^u7ncIpAP>@Ur1*PZ_>^=Ei#p7xy;;Pm{{wyljU
z$$8IojtTBMb!1ZGSrMyEZSHaAMHAQrWP;QUf<AEmHWs<Q>-)Rxe@l)<K5i|v?iJdl
z5j;=ZO>ANQ+KROb8Y>fzyuH2ArmJkyq1j9hwx(Z;7gZIlvM<{zC6F5YOYD2NPPovA
zdp#1ej>3DsDJ14wujZRHuUuHC|J2HYmtLtU!c}LOJ;aqJOm9`YwZ7CrL#f#~;NA8$
zc})7Jj-Ts4Gv(C2dnZ*sU%kIR)ADUo>@qutsYfe&?fDcrrY3(4R(({b;-I_#e`NOi
z6>@QTPrtwT-QOEm5?b5McBO4M+hm)G!4(JF?su5%Si1Gk3AfBJAy=NTPC?rhUr)Es
zc5~|8WB2~b>O%)UyzV-2Y+>k>_kAjYnHlXGha0sew`$+@j`$m_;rIKEmTj-WpH1R{
zFDqY1-@fNr6?Ek8)x}W>b2d8dyP)`TvwdDqoWr{AhA$<L`ll_4Ycb<+vk&hx-+B1_
ztw&o$O&4BH>R&pO`NqE1)e;|`F|VC^eAm~+*2HuA$ILf<GRb|!qQBYY`9q_HGwR+l
ze!TJFwP?dFxB0;avpW`>Un_F5+^iBc<F)rRffqA7%G>=amY=&-T&{WQgLpwfhOyiZ
z=V{fe*N5)T3upT{Q+TJJq;1~y==-JHSENrp!hePTg->;;m~`XfvTG{I&Q50cyc$A%
z*5%FVog28+RQ$oIPSvJQuVqdLwBG6dy!C~{%WSpwms@!h3@a=JTRZJ^K9$X#n!7i9
zl4otlx{RA5?Kf4mUEWGPG~1-q$jj-(vE))*gsnrhS^Bc}ZzdV`@(aHuUERAN@vYDF
zy;r@=&(4t3HkkQ-quU%^fq+oyZIUxLm`*>E&-8f#%jL@jx7yY}FnO6@X6gL+amMP~
zB1+AXVG+T~QaY=S{V`ze@%&--R4_|2iY@w2vyjn+onoIQ%IqTUrEh<)-@Qva?qg1C
zyXd{AVMolobgZ9b<vXNYV>K$<%9K_(bKYh-*$0Xf`DMA@c^=K*KUc6r>cWc)DOpc#
zJDxuNHGge_*JO{ce?C@UZxU=>Ve#A9@O$*b`)!{*xAkB1-TTp`tGO_AYD$7C|Hdne
zgr{EXFmO6A^6+T$o?UCiIUjBHoVwhk%W}naAEg=#S)1R^J8Q3QJ(D!qWrowq4K5pf
zpJ)ngJ^uB>(Nhk>Mtx4Rw)g(N=f1GC{l|H`<=0u?`tqa%Zi{)Q8rX3ElXT+|=Q&3n
z$~|Vg`-<s#%U9OdZ*|XRFZje{ayIkHo~+B;{ipu3Ns;=;&U^O6j`i1K7rL^qF*xvK
z7u)V=tJIpCtZ4!J6E#?8{Oz4K-FK<xN`cSKe~PB3FWGfobjSSpZWYgkWiKVYI^d<(
zbuanD+2@-BwO<L?%zx`u87in}a{OyP?``Q1Zg<<+^YZS=Hz)=x`$-?EW4JUg_`HB;
z6l3RS1*>Ck|7@||;qG~V!5iPV3ZmBA1<DJ}jV`I}Z#TZfp~uUvBC@(ubKb>sJ`%><
zVrN&!{bc*~`gM<j+x?SI&g(YSUU+p{`q?q}_i{_uR`^%%EAC+{4QNu6)n34I=5xpD
zo%1SYvTx$t96hP&@-Mll#!LHyi;Z8o?Vq+g?bKe0)eTR$|4)7NMqM~c!zS`s)Mv(o
zg3qTkf>VxkwdQ;&j6E9XFwxQ@vfBLT44Jz1bE6l3vboZhdZBMytoG*o)z1^H7{3Im
z)XUFpGU`3CYJ<wML$NBGb*?sXB{kkO-0<)NFL&?Wf09Px9(F>%*F9IewjprZ_wMBn
zGgLaH5@k9oFNrM)NbHvGDt{h-XsN11ljr36w<o8|Zm5{(^3$eDx1aCU->dvD^H#9G
z3SxfXQOmy~eG<1R>$}<Vj#7L#*yNteI{etUl|AQya~p5Ti_<1wZu&00HCOyzU-irN
zU$kmD_AJOu^5Zym`+xJA`^|RiL?gU&|J_wsQu}r`-?Rs7xu!I1dm4VAf?037rO1iN
zVJ@#qO1M;-Zf{*;VEN4N8%xR+jhHUCNi{9D<@Z(c3!=6}94mif?>HyxgjHqh?b?Q`
z{Fkk4-n$5@WxjrN-<vJ*-KT#!X+;e4=Sv-HzRT1%X%pY2&o_!9McS&~yq4To^k25l
zTVvP3Pziqb@}G~>7fKlU2z*a(m37u<nf@<c`u*&+hI!xo?gy0`DyOkTR4Xs+o%!_g
zT29Bk$vo;Bb$(0FFue-PW^(4Kskh(Vm)7!_$za>ZkZWr{TH5~<JH7ptyvJ{^cV6px
zw_Uk*f2jf6ql)+1*AmY>sG4hg|L6H8OMadA$%+4Usyi%RvYt*{lC5y&$w`|}*A_Z0
ztxVD``dPg9K)BG!yNeiC{pj?+A^L6hCm*Jpg}>(iJTPHR&AF?+`%KD|Dv!>d^FzC2
z`DML^WtCQiuPRsiKjr+St@`VTa*XTilG`tDZTTCq?Cs_W?ceX5Fy_dQpQf*rVxN}W
z`NA)A&&M4l>1V%HOyn?~_Tqwj9M6Z2Eh=jS=1o-9i_)vk+U&i{(T3q>?3exLUX@JU
zW)T#*mE&wm?4LU4Q*wO=^5k|il<n|3A@M_cUGeNSvSD!rJo7KzIsY?Zx1mQ%!nyZi
z2H6agUvz4%XRrM{EvURuRL_HNp|hajLY=tfx>F9FDh<0hqp)f#gBiz($l33Xee*MN
z<#u#r|75h@qx-b*6h^7$4c%hf`Cjkg_hol=bo<I)vf6&LQepP<xT|Yjr9RK%m^bVB
zEt><a`$J@TH)xnoSJIfJANXO3M`CEdSZh&^*bm)(PG+5Xo2O0LD-rr2BXZmQ=ZXim
zaTM9H@%O3jYzRnqw$D)SI-z?eVs9SXqncJjql_@N1-A~l7{|9vH|jnnb|ff&^}QF>
z9&u8U_cl+SoPUr>K}^-3@9)7)Hz$4L<!+fJ{bGM{)VGV>%ConM#8^##?6vTyIp+;0
z&qe+*Znm43&)=?d;P58Pdz&0R6L<K9NLOl}R#83}^;WV<#{2a1*<Yg8H%1zoMln0@
z&Jvkyd{{_yhMUdJ&k{Lj+h#aEQmmUbSAW$qQ#lbU%|F?~`y%FjSgHN}NoB*VgSF2-
z9C&ANqFZi~*vYj#eo=-p+XQy`E`KrgvYH87bU2gE_bjiuoU^9aOrKM&@bRZg$ohW^
zLXxHQf+QZ62&QkesF?WZLgd3ORT~sFb59!_by+#Pr{zxgp3)N^f_sYhy#Ev)^H^YQ
z?wT3e`bTC~yT7iO)2h^E<}vAw`XjZccYQ=cFMd(G=ie&4BK%il<q5G3=aQ?>*Ic+8
z>ScTMk>On9Q0bpWS#nH@Z8AOkIIrKBt#MkFTj9muyL^HwEW9_)p1WoLA^!c0`4`yz
z+OMqEz7)GEV6WmM*ICDXyklPF+O9XTna#rWcg<nG=C8>Mo0h!#A+bg(_t;0@<)RB?
z-~8Q^RCmeu4%@$jQ`5>L?tVCQ`^GeNmgNO+wpOQaUTemF(s1eSrHwBg*=AhR4e#P<
zIKprE`J>k%!=xh`W(ybDPu=&vFu-|{di0UZj8jft%(HfFY!RK4J!uzHO+BCWfiH%g
zu9|Wu-lQcgFX8El)rfx0)1@tOwxjph1I7w5mTiv|KiH?8p1)(4Z?CIV-v2bO{v-TF
z57zWOb2aWcytehPrLgGoX&n)})PnCiEnRiF<(p)fLZM3HviE0Kq;{GvFWnM)xRj;-
z-xc;n<zHQS_HR@^^6Z41Ncx+em2Sl`O!I!sbQjh6vH4<Icv9>MRd)BqXXUQSm%QfA
z^)l~T=i&I<bmpngyWX#uc(382Xxv<v_Q`Lrf1D?kwcBS2!}bLWx#g`7b>wt39G(5_
zTJl>f<#YPxtfo29X093@4hR2Mp1+ee@2sudDIUd#B9qQby<#!C>>Kg2Wn)<T>z-d}
zS64jo3clj%^d{Jfp^#<o>u<?7Y;U|j&SUAc?&e?jc&*2GPPrXy$lAYN%Wc}@$+}Wm
zZ>$|Awak93H2r7b%HrZ2el@?pW+o4oO^n>W-`~Eampf!PbIs(J)BCf&J+gPJNPar?
z-HchC+-IMvJa0J5a^89Irg_`<hCcqh(OKb)J&Wff-PUI|e*%SauWpsM)y~~J_rTE^
z$BzEqmGo<N_tOpL>s>#--}FV2_rgy8r3bW~w$?SKE%<S`;Ypt2VucAjkB+o?J#H;_
z^m8&u^oq#h@_q4+tz+J;yH@x7cJ6T8eQ^GC?)|R}#f6M@UxmGj=b2tJZ~L#mZ=bl_
zGyXBF@Ff2?BWA9)Ejbg#=kN<3<oz+-<o#CVxHU<uqMwz1yC$}wae~F&U8;3Ly31^s
zc{lF*bJ(yk^3iqSH9XUmn(fj~_}-|k)(B7KI%0Fbv0vvLf2`<Zr^{FCZNDF7iklNX
z^DN_hy%+9v=1l5aE4Q;c9lLfTKHGtJ(-V=4j*^1mfy~^$ib_71=PHE%E9DK1jySuz
zFK<SFtNCZGXOaHWQc1;g;*We;dBfwO>5`PvYyWtP4&3K_uB?7sq-)=@Wircb4R-Jy
z2%DjE`-RjxpO^(kuHThwPX~M{*kY6X@_&EH5)Co+e+<b+=OS;u6_$zJX2G!Q)tYBs
zeQB~gK9$zitzq62QWtZ2v8bwj{#F)`nJ16FTmPM*)ly|P)4Q3Q&ffXD|NIwCjX2YP
zTvG4eG`D<Yb3FK_ErQv2)2lZEJg26`T;Mw2*!SenKhM>PuX;W{-Lde=jr2CQmTMo&
zYaFNZ<_l^yy$d<H@?^Ya((VQU)7kCEKX^~_4-h^1d!^5gteEGP7yY~V1!N;X%m4j1
z>#+2_4e1p-wVXAMhh9m279n(9{(IR3O=ISH-ID74zj_Rpv{=_K?%tfWH%x_XSM{|s
zN>Ow3s+L-uzM6NISM01ezp8k|_n#A*f_RiJze!>hU9J;;|L~$oY|FQqZkVCWdi5*A
zy%yP{A43u@>^s7DIgU|PJjmO=Rbu<TdH&b0WS!X5cO<#+`U;O72iqgFcDc9IG+bR)
zIs1my_I->}kqfpSE36ZdQ+4L}xxRDBn?G~@`+XF6An`-pEc)}}O=~MuOsiyVwbaAA
z&F%E%6g$Ib9$}XiJFUpQ_uw6`K(SL1_rg0X45qECeD%e-D0livj-vW0`foQbTxux6
z9;!S2(cHI*_pR<fH|sk5Ztg-+w#L1`+2$9{JK(c;&w=jW{1xRV<W`6sxGFD{^6K}6
zz1q=t|J0UjTNd|Vnopwf#vZ1l61U%M=57;GoD$$)d&<dZa{q!3`^K4F6Ye?Zm&GhE
z7T&VdvhQE{8_{E5y95ocA5&U#;pfEay<e_Ro3XUciAzN78UKovvP<9DU40>5`o<;p
z&GJe)Rw=VLjnb3PF5LEU+Tu-JHZ^k(y*FEAuy~4mq7m1Ny_?;`Dxa?idlaRzYueN4
zZ#U=EEAGGh_PU*DEbC=A5znhvRNsH?w|@OLlXYvz+mbnx+1~79FEjYvF=?07@0$$o
z_`?3YR$9@#-0IbZwfh<We_gQp_l-jHkE*g^e-{|9{k}`WKYH4ao9W_fTPAgc`2Rmv
zclTS{KjE_JMOSA!ik@)aUu-b%;oV^O^P5h3s{EKJ>MZ%1X`{T0<F%}_k@=2`bK>g7
z7jG3W+G_vmT3a@s1;6$KUB?L`&7bscU7W*b{#szo1s}%m!k3>vobr@;hk<2(f!X!K
zyA1UfMt5G>S*;JK*uBj1NAvVIf{QsWYA<{6=7m#&YSpbR+8>`3#-Dj@cT6=T>Gei2
zn{}188&<|7i#o25k13bZIQF$xhB5p}!(GL^COhu`d%qp{!t%fK48xQKCp%TxRA<J$
zF|x|pv9@g@gHl+t?LVu1Qh%6Eef9aG*J0v){%z7Cq430~^ERJV4*K2mVC9wxD(pi4
zYixZltFC`1wqw!dqc@E^=WSkaE~2Pp$G6~q-pqiQm%LgkOKaZTOgf~;ThuviW9;)6
zEK4R`IQcVCZld_-XAu(lJs|~uGyVryJvyzwJ?;8*ZjYO>)-3VGXSSpt=)Lb=cqlAt
zbJxy!vHuPBx-1AeE4914<t3;3%e!?pi}{M$nKp#UHZRoWFubk)EoJXnQD2@H9P7<k
z!v6l1*tbji*1E{XlI0z1<zBHZd~<n?YQ@~kTs&JE1s2^-RL;4YYQ;UhVw2yRF3YK#
zR(;rVyFP8x1C^$gUOY!XhCXh(QuTYyy8QumlQ{O7dhHFeik8c(D0siO*6ixf`c+cV
z{Oo(Q%pO#S^7!inO+9ZIZQtYdT$X$B{+a%}jZ7Fnhh~55wZ7S=d(iOXirLNWYu<9d
zblFkTT-Cmlo87jr_WseCUG9%R7G4wk<rf%H7XMUP=i#Hn)wi$3J1z@X-eDO3w!QPs
zi%T+P8@T)Deq6Ecz^UD*%cEH9=UouAc`qlfx=N?E)S|miB=Fi@t)@MjxmIL{)wF#p
zWaL#-TgDiwbV_pG0m(@T!Bg3cI9i^4+$*@>@_X=>?GxXAhz?jC5_2gr^<!48RUQ+!
zg^7jrN==!JEB{`UuU?iQcO>WKrh68J<<nnegcUTNcFt2Qdi(gKjTg)Ixff2Jo3V3o
z>(+d}^4vvpZ6a>p{9&1T?a?XgPlb9cAO4^J@bJNQnI%uy=Q8h1I<chr!PmUcPCs|%
zCp{?5U;Mpr&0P`x2lj#c*PIkFoD|w##wHuSSU`!7)4S|UwR>EBZjH&76Swaj`Y0P~
zJ&$|Eu`Bb!ZHw>n%t=kyxbS!G=GKdBGEo=aS+@1n@U>)Sv)(*+GUwP%?Uz1cXB{gu
zY*>`Fp6ol({B-Jx`}>zDZ?{<3&)EMr;ELqpSKc!xJvq#^C-~*>nfpaqjukDFe$Vsc
z+36{U-#m`~sNlN4y40ZS<Z7AiJ9cI6Gu^R#6YFn9hyNTCbrmx^Ub3vqdt2yKd}pTO
zw8uC8&+nX+9q0R0{nxAAHG2)@o*bAW`@?bm{9g?T*-VBXD%GR-%9a&ynnd#b_^^}j
zmaX~vlv&;ilWKeZS1$|Iv0T6Vc#&#ySJ(x9m*BP&F0QIQ5t;nyd)Mj2TH1B;T{3o_
z(Rm}{eNv`Iiye2z`3vrSWq0o%csoBYo2xgq=0r*D)hDIe9B;ape!ZR(J87-vCy&0g
zy$=<yZ#<h-ezn5xd__Ia#{)5^?yUQ>?Z4O@jWe@j^^VDE&v+QF^?y=k$F+A86i*bM
zZJ(QcV$teQCXJi(@-=0zwLaau>P_?WGf!vKURr6oqHR{wuNiZe8Jm}N76xbP`Zra5
zZD)NGe&^YP_8<YNmleN@PIoO<t?^4$Gg5we?~A~eg<(mvc?(|zct^Z!_*F9Dt69!Q
zm6_+AOwX%T)L-86D*Huj0N2liC5+QLQ!Zb6&i6W<lSyLR_4>m{cErChd%s^{4_EN{
z0Jo1E-2D1q?B_AuOnozb<CBbcMooEtUw`4SZ~y%-MYsKjWy)Ru$X1{EeeRDBFR|!O
zW1G#G6?($|ujB9BB~wgJy|9iteED>r$hyaOdMtYX^i;nvdHyk)sa9ERbuaH6y$t|J
Cn=_LD

diff --git a/secrets/secureboot.tar.age b/secrets/secureboot.tar.age
new file mode 100644
index 0000000000000000000000000000000000000000..362b256e89cfa47dd84152dfbad253692177c64d
GIT binary patch
literal 30954
zcmZQ@_Y83kiVO&0cve_pc#ZRr>|BMCIhjp?rDb70EQOs}L915weRa#WU+UIsdG&C8
zb@SDO0lD1!j|jZqb;Wv`=|-p4CtH=a{Nt_b_1Mx7Q-3D&ZMBnW%~YdhJDhcwTRhZ%
zBwxX{`Nj{iXa5YB_uTEfu#(wqDZlY0@lQ>2nk}xL{(W!Pvx+bFvwYN+^Gf#YpOO6c
z^w#@A4+JNg8<vRdSgts;@z+#aiQ5&uS1KMiT<y~O;gexHwY2=z$#YZA6~C-gvFM&+
zVt?<<w#f~LMbka%^sdFG?|tAfW4)2#nfte_^U9jv>A86RV*4+bwxH<BvgSZWDaEtA
zzh@}caOLy5m7isrl{oQ6S)ub~h0LE~cKm`<R$X`_cHxxu`gf7*#G5;|a8_*e?)v*o
zKSVS6hV;Gu(7A{BUccM&N3{93^+qwf)6Hkp^&V_(7r3*@=JDo^jo-KW#g<1J{|-&R
z?Do+_*mGL9yO(}P?w_lHeiAV!PUlEo?6k018TesONMwjsjKk;rx$OCI%lLMkwM#Kx
z;Te~IHQCr^ulMSp%)qpn-v0fsB{F`;e7?IgM(~_<)P;?Tx<#A3{_CFB2>!+uzxdCT
z<`{d^FVaRw*LrnY-8EDHv93p3d#BUFOAl_mZV0qIB(gN_)+eu0!8Pv7t1Z@FKcs8h
z?pp0WtF`ybOQ+eBZiK#n>o9%#yyd<+w>JKMzx$|jQnXmFuu8Oscag>a44J35j4GK|
zgiqd+Q?c|<x&7Dat0Nf=i;XwEnjWw|d);J_yr9n~`uOj^o)d6Bcm1vm4VU9J6{SbY
zHCe;&#-BL1<lc|T|9)S!5VTKvx!f{5L|<*YEyF(3jyG-1U#4c+Z|K~cIf2*B>p}E}
zIJvvULD7GLmu4#e>lRz@Ki_idqs0r}EYuFZJK^9zmrv}+_pNN+W)@oc^Ae|}&Kltb
zLCr~N7ozi~bf@y1IlOqoqOg*=3G<kXvRu#dXBg}(IyRg8S^ew8e^Gw9Wm@_yC#S3K
z(mQ55Gq*za*dEt2r<eXTb6Zm6eeUSLLzf<ZC_jF*cGZGhsXb5XuTFAVoqX^`_U%>Y
zJ8orESe^W3p);qpR6R!d_AHl6b;VvU-lW7>9+)`Y#9)g1|LQ4k1w92nhZe2q-Rtvr
z%{14EmzW=mbB8`(yP&Sx%Jbt7gXLdcJ~hl_ayF7mFRr}srL8aa|KzJjDk3bV_ujn!
z+w<24n_Y5WU+TL5^j2)(y<_0WG56GA7X>j-VYTqX#b$0-OBnRn!tzWW_(taXsFaDj
zNNmn$+s`Xe@Akd2{6&^nzi8K8$8+<Ugk)oLou(#4o%%N|R&jH02iN6Fsl?43@!FrV
z%QzzEhd%tf*EM4D?sc8IU5B?TBzdmi7biMt#rC?#=6Ry6p9)<oXZdJ+{`Z@ge`D$0
zIcvnfDju82GskU8)yz#dU*Eeh@wi9OrpSXg9=I9{`Y3C~USZi^9DQoZWR1D(f-G@6
zPSps>xgWXQ9;R|^cDa6VigU)^5|8tJ{f|4>J>vORwa#IMrdr%%3Aa|~#Iuh>nZMqf
z^f388Q|gU6yN-3oChqYl$x+^+_FSA_=B=)1SnAcw9rB;famV@H+A!(bh9xh)En+*Q
zS}QekiQcqQ20u^cA8O9;^h_s*u6eRi%D2VvCG&Tcujv6k6V65coj=F>WK4(au2y-z
zavQaz54X#VR?p449?V)HbpDeHXSR7&ZHM{-)+y1y3QoSh5clzh;>3y%nKG@Czdtg&
z=*?cRneD~A8#ft+X1@3QR^V}=wj=oAY`M}ik5+{FZmEAA>$G6mXJ2NYo2N}rIz8WR
zBxn3FJ)mU$!b}U7-p7^fesj2EZ!Phiw!!~=ZS~f-J4{2Z=B91A{x#o!UV&cH@nDUu
zg?k(_K1VAGs9zF3YsSB2=7p`|%}ZWM-kvD`QZ<%YX~!k=#Jy4eUp_BSh@QZAbk4mE
zmj1hR3yyx9lz#rM=gfouo_QU~SRpcPwZ(q!id2t2^>@FP860`%oVWgHTV7=2Iic#M
zt-X_79YRBPJK8yR%X56HiueAr(_4l&%D(i+wS7v$+bXZUu|2W<e#Z@u2$`4%hQHq^
zx5x57`?%uP>;o^}WIfedDAOaj@?zGe9<_gJj%$M>dd{Dm!<)bV_>I3>x5_!zm4DcI
zDg1lNr`n)h5gQ)w%zE^s(BqSjT+s6OPrbt&=7ycukeKTEF|1@w`BEiK)1Uq7vn$UP
zENE|^XS!ycm8iFKI^TsAEy>?*>hGUmk`mZy*>Y;Kna&!6C&Fv}d?h_47(aWjobfVm
zm7?$ZC6f;P*s2j-_D{ZSW7O|`fqYNYtTU7qgX5lWZI=Hl=Dnh$>3mYF?P8-7Yi2Lm
z*>IxFPl4r1so_#Z7vAXKjkgNt_o=7d<CrV%>R9DE)q-7Xb=;NDudYqZd|SS1Q^Iqn
zN}Wsdy>xcPF)lh?+065u*UjYAgHNr>-*v*uZPQs-SMXZ&6-8~B_>W&A^`5{ZnYepb
zgyg)dCrnY9&wE+zxQ)T*`Mb8o&Ew;cEs;33b9W=x6UT&|{LXV1GG(l?Zz-s`a?k(i
z2G;(+2f8F4YQ(?2Ub5cZ*wCQx^vCAd606IBSx3{;zsGKGogP=Gl&GQZ5Vqpb^Ho0D
z`ARAeAJ5G2|DB~6UVlU8@ZG}ev;RNy|J1VjO*{J%9-}`>hMdtyws@R;b#>-B*=D-~
zPA4~fernYpy2IgPQ|T+;lpEi@4UX~0uy}jlvURZA<|C1LwfMoxg8Dh!dCMivEuA-;
z;rfRDXN%(A?$vuWKU#Ic!ZXjm|M6Ha!ZGpMdeyogM%x&}CA57e&KI9DJ)ZxEm{OzZ
zvZbPG*E)Szjqfg0?c6r)bN2Pu$Fj_&%C5&4M!ZlA+^}+g>$IKR0&x=W_#$rc?Yeq#
zk(IKU^A3yMrov7IpC_`%6il2Xb(lT%zVW}WFF4dS885D8v=o$>zi(OPRk2i-_H!I3
zdzUn|T3@=)pqAd2QoAG9j>Y}KH^bh@jmI7LDZa7ue=@nIcboRS3BCL?E`QRvwz+bt
z>=bGH*TsF2CoXgE5;-?Pf9c+Ho^Q+#zZaUHoWRlgS&?&<1AG436RYQ(X?XEkduHT9
z@2pUp@T$Ch-!^pqTefxzW3A-zsXscm+}?J6l|J`8sh%_HGQzjcn4QnReSYuX1i5EP
z&Z^fgrf=|b6uNm@GDuIA_i2>={?3$FLEHZxkqs6IU~E*mH-GM$&OcAr)ZPyCKdbjn
zR_x#M)o;V6847Ls_O3OVy;*@#s&~P0e)(&QB_2KHIc{;}U_@tD?i+`urHdY&TmC)5
zdZzLW?e6am`oUIua#N~8)xJ%c|1b61M61fyB=wU1lB??{bd_!u^SAVOXT1IYsrAlJ
zJBtO5mKp1RUpD#iq__VkmG(QD{E|8N_kUrg_5KCj*Yu)Gp6n^q-hI=Hqw_|7ZeZY6
zZS#FvFWa7N=xN`k_-}1V%^#sT4=%W~*4&MeIi1?t`#xE^*yrnH?FD~hd)6|{@8MOL
z+_6&EZiSG*gFZtmwfj#0me1JGseU58Y|WHazvLWtaHWTpzMp;kwxlWJu77Lpy*Ru&
z)2{v4p9@^3e!DgLoVUMw9zEfq{zQABxB1*J_KHq0e%B&iI;A;w+B{y-L;t@kC;zy$
z{%6g8xfauc$Su+d)nP%Zzr3Z6v&ii7`=4s_<kZUW83&FCF3WLksC@hTsF|hbqqx00
zERSephKfAyUcE*{#nkulw!g(sv=#P#vzN+#m%?;7{?_C5ajWLtTi)ZF@yIWtAm7X&
z=)>Mg?Pb6IO(}huR{u*Z{-dvZx#ym_w&L9`-`HxhnD2Kl_kKTLIW^^xvdIRm2k$p)
zX<YqL!_mg)|2Eb#-B4%7$JJ-FXG$|1&y`uZL1$i7H{Z&tzK8L%cUP8APcH30@@Hk*
zgU}TX+Uqri@2`lDS*-YOIj?C{aDTJNU4eVr^J<iWgvBoIe08l${=%AbnzBOMYmXd|
zTt5Hcp1mG(8gB}9vLsY?XMJ0g=+oWSeC4Smk2MeLv44|J@|dPwxfhd=aqiIEHQT%2
zG?iRGd+yH3OEwZeeA72Sy>RGAtJ_mYzPn{IKY48CYGlu?nV<A0v^8b=1(x$UG51WL
z8_j?EvuGi=g^~YD`TsxX?zMW6eDFd@^ySl6cW>a^xnerQ+pXo!XO=dY&bZJrUqaWu
zcvI-(til;jFP{nD*}Y$=<G`{FzEM4&4ZR+3WjVXiM}3yM%EWT>nNzF0+2`K;@x(XS
zRa%18tK{cIkqVO-({<0x?G=|8w$9G=OylHE;@YvGzrJ_I_WIbDRx8-&@0zEPUw=06
z3D31BDU;@|a-OWO5qFPOVzxg6_x8GlKHs7*o_jPkK{;yf*EJ6=2ux|Vo10&GZ`oeC
zzD>-hLu&3CT)$9wbgB0&pSs6^ZKa#j7`@+bo3=D;)2e?C_uYjxqf__o3b?#8PvPhB
zqe6)(MZr`4{QT;9<@mblEsNxz+X-mQntZPQ!I6uv9%Y)YyD-C{Zs8@{rb~XkyP4~@
zWU;H51)lwICF_Y)eott|j3<uA*kb0z?g*I3A@s4QDB|xom%V>XKk-I9x)NZaR{mpo
zmPt*pYhPotY{nLyvmXjBzn$B8B*k7>EhNh1&PDBKHgB)oF#OQ}bH-6leW~m3r>c22
zmL1-vD4@7YllyA-*Y1p<cask^pA*+%t9iW8(|hqJPsRV8OkWnx%{Xq&8kX*vwbS2y
zx<-Aw<JT#B<J#BPC0~6Ubo)`qjL2q{6W^-q?c;8D6$IM~ZFqP4N+rWHan&7%)*p3}
z__|9=S<Egf>;C_V1@BDe{r9>M*6`X#cE86I$60NsCnq1M4VcdV=dbbvN#Bhw+x1zq
zw}0Nze*E|aP1T>Df4mbqWLkXocW>N+|C~o9u3FmgDtw!8c*X3#i=U!-B`qHCyj3rM
zQXFc`wzmD^+kDm14P0r)eIHWvKN$*h*ggDZt~c*<d1TN!7FpLbllT5)i>kAIfAQ*1
zPT7rKm9Bf``~9?j=)cf#3HWuz`8fBBqt6TuzUu8%ec9OiKq7DVkE#Qww^Xln3y<HI
za>QJ_>Da5g?ZLb1lz2KW-4L4m#^>WpI|H_u%U%A-k6ULR{hWBd-@^On-&voIceO6Q
z-So$C$2L*x9#PS~uTTAFiR=2PmEEXkY?HN@^JTb09{(Yw{+?s1@4OczJhYm8CpTuV
zk+HfjYl`&W<Dt{`|4BS+k=lMRb5}y?gmPtHM?ap~i?}CUGQP3!&y{M^Bfh7C-EQn*
zG=28Ecj;19y~!V>Lp&x-TI%wGYliWU87{ZC%@Naj>ewTsdU0yJsMD57$7*&ovo4sa
zpTy7<p{pdE^KY-~<Z>yO4`%m%XwDRkynSoQ@dH`O8W}y0Z|Ys#u&}%$X0mXNWnq8+
z-u%wvKQ*?c>vouaOP(b4$h?-%al*y=lPBUu<yZH94BO-T==P!NN(BSIi;JU|FG@PN
zc;@2gqB5f9KYEPM++i}`SlszZJW~0)oW{J5epkACH;3EuZJQ<7zc|abPJ7Nap{`gT
z3HEpYTv;y7-oMUu=a$8L-xp-}zL_9qa{kt1J;$5Ty^m+;h&oDG3$0wS+2#pH<cWh~
zZ@$hCigJ27?Pjf|d(Yz;JjL<9>wg$VTL%1^m@+Xs!|6bhna%2=g-6@$;#oFo9sFfg
z@US$}bz8$R*$T&*br}_vo)0`ieO@S92F+OS?yP*3ZAW1DRGVer<dv9Jvnsv`M|$qQ
zkvDbMiB2iT*_$dC+&s*-xqYo_zU9LuXH2@C%?x`5|1YmyUjB0Sqm=<|2lnf{d#GG^
z+~Cu~&D(#v*MAn#yQ*U~CFTyB`8%_D$`(n?D(|OTGx*&-%X=zsmyd3*N`<+ys=<uX
zYE`M$#lMb<uHJh~GGA`yw$F!jCmp_X#WFFpYULZ|yQb3nh0pBR60-cl)+-P4UfpLr
zxtv+cbnT5N^BQNJaPhs^;QFyS&`hTHsDx>spMJ#*or5Y-O$xhgH!h!-6P=Tu!n41G
zLGb_LBdc{@FMpTE5+b>~dsoum*f>wI!V@)R$F}eP7`JnSMQhkIE!}A6lG~2!61PeA
zdaG}B-`zIFulSOnYpzn;{_`fU<&2c>76mdMEcX1ImNTg|PeiW&dYN&=s-+D-SY&H9
zbVbX=$6VfYtiR?_&4H)g&GU7SCvBE_axeAD0q0jr7rKux`y{hNmEX}|!+VWy>i>Sf
zbblmeCfZ#8WNpa?1*@F3>!196+NoW3=zAJt$h6g~|0|zgtRLKcpY3Jv2Su-ZBi&rR
zmIX>YSD2)h>it>HIi)`BhmTio@#_E81yW4@iWjmOcVB1nZmrbhemJE<wMm#o*?N_W
z?Zo_wnn<w&lUAQh{NH{nLTjd(UbO$zE&9&CXY$|nvo&Yy_6#-pGSkkU>(!q}8qpdD
z5?UUr9rw9=fm6%P_vtlp-s2}9ygs(FIC`y`w$q(UyWTTIWxvhrieXePvkLg-oz3)s
zMdc~~R;`WGCo>$qU6~ybKI725pQlx7jre8uZDCq{sQusP7yC;>mv^Z9+AeE4Y2o)O
zVnt<g(;AO02Ob${%qd>6ncYuEE=zW&{MTI(96zq@t`+&}Vq^QtI4$Rr-0#09z0$H$
z`m(HleK(%oxb&bahs>^})xq;4Z~OAuUMRbyWB=gFL8s=G-!I)=#D25f<GJ8*Rn0Jm
z%Zheu4*W>GIx+B@?lZI1wfEZe%mfc`t!O@PFXZ!m*WH!1d;4EF3B>GRv0<5c_;tIf
z-q|}nyKP-$HOmw_CJA?5cJq2AsG6{1?{S~0m;G2gxB^o61g^C+%u-mp+RiK~bDf51
ztZ#f`gQc7Px{Q$ZhI3q_9c!#^vp396FPbW2@pzRoukp{cSYDPjJD;^4Ytp}_8UOk7
zk%s@aXIh_#KE9IeCGo}Nmg(aDRgya<E&lXy(U%*U%U-G|Ub^@^WtKhrU%ia<ouSDa
zE26#^pPRXSW&a+Lnv%C?B_ijF)hV7XS$&Cdx#E$tiL$8^&aW%V*DMv2cz?p%@6Gk=
zK1U2>c1+0g|1P^CLO!lcEZTa)w;PwIeBV{|cIGtex*9W`38{%ztZb?#XKz;VD(F2u
zAnlSCX5aAFd{R`-OliH<MOH5}*&B3v#IEi<899C8;j`cWFWdUs{djPK7>C@B3Ewv4
zcm56XTCrzmf_}%m<T!q|TBAo(_d6U*kl;R;@h93rwI=$Q`G%Xfd)39d_DrkD=gEi=
zT~>cB<Z||+j2{W+U#Hv*_s`q6Fvp^Ge`i~X<>b%0{u`gHKfYy+7^~VD2b-^HW|m^#
z4uqv_+HyqIpmk}HMQ&t8d1!p~r(;haly;tf9(nXzc&Nvg+lROx^H{vumc_N~mr;+j
zL5!U3)LDDvLL^=|vj#5B+U)%MpYi(5e^TGSWb(W`Q)hqcL>ATB{Vd-zJ|}I+`k>L0
zu9cd6w&<OB=lAdzDkrOi3zGjv2-w>mmwzPm%HO6dc6;Wb?VYc8^S__tcl!t1a^K_4
zGkKRBTP>B)^uZxK{ZzxOMW!bf*DqQ$>q~LTtCKg2XNU{k4HHneY-6+iWpkAMd!nRe
zdmfiq^zB_XCJgBloQ{ds{3!OU(drM;(p8jlxv`sTs>MqGM2TC?S^plEbxe5rOW3Bo
zk|WHxO?ukJeeSy?3VmANnM=KkbhtTN`u3$YGbXB-Ilq<sWvF!Uk^fQk`DP!&rtLD_
zT2lD^VW_Fau}OlLm06lg_5=#5eA)P7?ibh0t<|kUK8&7<+j-_K@}4~JqyAgr9|k7M
zvvLL0@4C!MU$Ey-itc*Fwy$rkCmKp$4E!6XY}X$zy#BM?22F;tkfl$gwLRKxW+a|<
zHJls~u|S$V@bZioVpqGbJvND|zqR4foGIaaSM+opu4XUZT_qB6LoFzWeQWe<mZg2a
zm)v@B?(U6clG<~YoH6QGk+jL4|J}}>Yx;xK?Mp*nJ+$gDFF2pIuTW?93@+{D!oWST
zd|lUUet%s!<65nAXF&PWeWIyF??10<Ws*+IN!_L%86Dr~c7=^WpVRi2;^F6;H!fq&
zkZGJKrgv7qBb_hd`5zgU+^8e#?q#t0)CgxJor|3k_~^{>U4qXVYOC8W<*MmQn_l9X
zTEcn0%wgk6=A2ntw?74F`7CIUkvkgSCGuCO#i4G-UpA4>MG^9kjKZ}i?%O?A{Kj-?
zFJ~6UCJrBuX>OgDBBhL<X!V7cOr6bPlX9bRmFn_S9!7`57aj1?S<PB>(r%O8!*6Ac
z5nE#99n+iMFHgBuxb}|u_eS|ccQ$xEpSCco)A`g~@#I-0jd?fh{uZvCTd7@LuThnJ
zvC4UJ{(>D}+f16K?vUNqVX^n6PjW<aC9mPTQ}b`#{dkZ|zIW>JS-}m@xHR|*WZZH;
zdMuyhzizL{4vD7k^MmV8n&uqLFM5%}xV`D-;yZOm4dd7Un_4ApG22K=c9(TgIQMLi
zGQmf$%qnXWrc^Y)^)A|`H+fI!m#B@NuKO+YZp8n%bvSrWX3+9#<!`4mla#-2zPa$K
z#8vz5ciGc(x=T-$TB)e*`#DeV>aqs`tx^Hs+<R|IXI(tGl1owYV_NB{*}q#V6N6d!
z1-`f4S8nqUH=fGM)W^Mb+5roXw!@OU(oY@w74@9+BQJB&C)OX+)lb@gxOHM~&!<VV
zbqwn@jL#)8oBdV(W6@c5_mYf-fQsnp>mQGAXlFBY6cDyw#CX&D#FVunbM1c`B{N-^
z8^@#hhH2TpA7AxmgcY7{KXpxHvT6O!yB^013^bP2B}@(K5_P@Vy7}~pUwI3~U%dNP
zR#j}VD<w=ov*xEx;kxDpJ7)0BJi-1eDsai7lT4i#&MaN9)7HwEZS(v@!IbVgbuEn-
zP8`A2b>;s;3q^ADFKVmaSR$!!rj-?X(?Cs$Lw&`DS02kRUOdoaGxM55s_1$3$$$M?
zUwIzzyE~uxO~<~N89A)3vJ*Z!t|=^F_b`=D;IrXA<-^nyY(6LW#-oCa`G0ky7q7Gt
zk5O3oCBpjl&fu$J7vDU7RCD`d`qa>j&1ZADoN`VUIxbzom6EtU%bNY;*NZIIU#mGk
zdvCF2ovcOWX2q^m>L1fKF&zJ&X#QO(N_?qh@8O#bwWrn!?wq*BV8;|k@smxy<!jzf
z(yaR1R`CAs{ddv&{FC+;zq-kAaML#Pt8K*zsmr;_74kRxo?5m=DMs}TFQ@k+FW0Sp
z(h8PgnG=`R$tcUmI2Fya->s?O_3!6D6P>IVTdwf!u~y2o-Me)`A@4d--b<Z(H$)%%
z7^L$h`{waoj#g32H7iY?_FAtvrs%>EnzqhuWx&?`v%;b-wg!J|N%p>_Zm-XLOz_aR
zyhlgRX*oT;Vrc%)a{kMn>6KymtA0;mOh|vop<BISwNdi2fKZkj%seS~{w4~|UMu7{
z%hx)TSIx}7_?^F<&-2*F0k7|hXXT#fC};9xo65zyEv#+f{lq!}<M=--r)B)=Q_w6e
zS+rYfZJ31e{iepqfFG;2Jr@6*9ctKia=GCBg8gbrkrRA*xPm(re$HO($3C+?+c~2s
z<%nzZneOiw*)$?!gXh?-$qy}D_;`Ks6V1c#q`3`kRc)Q-H$R-r>z12UvEg+lv(V-R
zoO-vE?>bzS?w!%6^6)v6|N4`PHVzeBjHUl2maIPTy6gMSjX9An^ItZLzkK;|S?=;5
z?xnx4ZA{5<y#DRjCa;~}CpS$yFn!&D>y|%X*MC!F{Ms|8r0wIc<0r#ZRz71pHnWN0
zeY4!HFI}^XBzBi6UpaI>m&<(RxAK?Q?zj2yIrcN3iu`tc-=wmm8Q=a+is)Ls<zlC3
z!7E$Q#<d?xStfYstbgWe^K_bK@DJ`~Tl6xYb0*AGc1t{^`Pl!*qy(*G&oj$>pC3!T
z*K4zB{_UGTCv~J)?WldnV4I!Gsj2_8JG%CMtfxV^b4S}5wujpGE#_ygh@O!w{o>H?
zInjrwV%OUnpV%gQtg~QR=W)SaI!5jk<MC<V&T(f5DZeVIbvtV7eouBA|M~shzkV*{
zT&#0W{(-NI(1tAxue9U;oVXqLYVo^_eB~F4$9Kf6*!EwOA$oz*CpL%F`*)_^vMvl`
z-Xi;;we`gTpLg<nT<jko2nX|Dn6||?w&31*@s>NCC)<Q)$o>1LRBN+B^Ur~E6#-sW
zs~0f$W}R$Qh*Mgj;UPDzR%vHG>t@~$PXwz&XKFrl@(|>c(VDbXxh3lRi=a}Df+qo4
zDq#=%?A#vR_&f2(&(P|&!2Mh^%roBk@4ar&aU(nJS6@Q3rly4S^7~6fL<4xk?w_!<
ztaCrvJpHxM?XQ#PRUXsNU0L?qZOdCv7XON`JaaFfsea;Fxs^e>B(<SX<Hpf*yBv~#
zePEM_GvUcyX_YGQtL@O!B~h1|zwKnz;C}Mw=gN>}oC#?cy~8Cq+k`KFP4)WqiKon)
zn}<z?gW;iphjqpO^&BQjo@-Wg+8S2yd~9lTQe7;y^slhQ@8<!+Z?DfP^!}w*uz&Vb
zQ$f$9q~}d8L0N_?e&pO+WtesT-JKK1zT6KK(h+_q^kb)iX<zGwf;kRH{@TQrD6{^(
zy=j8hOrc{@Qro<|j;4H#w!3Ys#O-9~YP*{E+viPn_1~J;9Z_4qJ~`g?en_{$r`Mh(
zy>}l6M{b=w(SrNSRNs?RyR<qsxt#eV?mz88XNu;O-hAV)b|n|*HFu^m9`rvG`?9(!
zaL4nhXKu!+Pv>ow4hf&Nifx_RmCB{In*%#`)^5)zw>7%wv4hX9Wo2Zj^*J5JBO$A;
zoaOFuhW~BSi7u*eW_o%>=KTXUpA$^V2@m(OIGFH?SPQpUY;e0+_+Q`uh|$?_*6***
z^2SXw^5I);a`n!-(whN`t{2Nj9sOAzDkA#(+qdL{%hzahD1EMfz1NQMak&WlCFB0Z
zziJjOdh7mRUwXN_tzd^hR>aCStsTzqZ!8N+sLfFPf8*7bT&wLJkL4DuE>m48KIc|^
zG3R3&g>|A12a4Y@w*~y=2#~rc7%6>Rsafwy`+S|EpK0%SCiSR1k)5OS(7g8;v&5@Y
zD*^+3y!TCiY`(^HTc4oXS&3ywStE3_1!9k#y!y;;`>Q7|tNSiZ<C8SpzhY8I$&?cl
zYL{MKnZAa-bPc~^c~S4YMW^l8Z@T))=hU==jnn2Ry$<?$Ibc5f(mxr|PG1%{J$rY>
zqx94BSIH`qlDeZAwn{JQo%S~3_=@+}9!j?!J$7%_<TXoX-BnR;vaPT=$+*nHRnO!?
z$g~fxHP6%kxhntDU;i@nMbs_twzK8hZ`hLCYo0&uySj``Z%K@q^vRE`LNhnK@(-MG
z^4O#=8>T)#BC<udIyUoL{o4;S_W8Nqk=FK~o|`(CTU736DW9hICufmGO=5d2wd(|S
zmwb)X&tdo<$}Q46S>`jdg^^f$$+XwCuWGq3w@t|KZo7I-X7;(=d4W${zY6YTiMhC3
z^J+)?#6Jha16SOfuDP{m(KpY{D(Sv&wDfQ2hTV|)FY~#$u+1Vk>Zg3nC5Cx50&#Qi
zOuSkxrgUtoE>pJ)PtuYsjU@$pmPJIz=esQUqGQ^UtKaKdxn7P%D176k=g}5v>}xVx
zUn?oij;+|RG-C(z@uz<qc(*><&e6Hz>)nFYZz2y0?`e&Eoxc3k!ocOCH$3L&NlkR>
zWtubBrGO!GM#r>kvw}^{3KA8LUB0?O<M{bWx9$l0&+9K?owYA&lh5h?^HU^Ezs|fh
zsn2WIYQF1l(}E3h&a){NayL!RI<GXH*VSUVb$=yuftDvv%tx>3o9zofDD&*xzBe=b
zw?UlKhZ4h13FpLDlQ-l<{d;ib%Zn)&EG^}i?c8=Zy>!dZOH1x9+0!5xl`wCWwOao3
zDz1&SDf^zTkgz?l{!`|DTLzB8_xnATUi>$Sht)-{<d~1b^}8xLyT9dV_usbN_-s?X
zrTSi3_qM<B<r3^^rDs|$Z@m>?`d`1~_t{NRhTZEj?Edrqn;Ri^%PB2abjgfOyVai>
z9;y1BkXN@xRpIj?!Pd1Ioh~K)Mrpi_rtc$foL!hTJM>HZp97zswzT)`P@DQXd4B9}
zwF1kk^~O0oGmD&W{`@pUWbRXmCI5c8?PzKB5>h$+p=K+~2bO&mPwwlzT)IF&T76mP
z|F5$*M>c7l{KXW(;=^UUwo2x?^5Zw!-NhDBJ(n&$lgtk&{vtKm&FDX~@>H)owVHgQ
z&l#p)Tw8kfMV#7HmAI?f42QxO&XYaA%w_d^_u|LTb|^*mzt@?hU-lvVTr#WNv>D%b
zn?HQ<jQQiDxrgu1QaJg4x>=@F>FJ=WKV=OpqOV@m{#I8ZIU)T0*Ds&7?%dFNZ5${j
ze%sh*8H0>)V!)~l2Fd@fH$LR=-W0dt$%gr+fp4vz+c=tVSw&PfmBwt}`K7_<p+(>N
zf7yERx_fw9r}X+{?s>Xh(06BnMqTW)y-6RovpG)et+(B_>+o6odkTk7PXENKXspXH
zdE<>s@0d6uzIisVY+ACSM1a$eVakbs@KuKjyYsH8-L@9Iv+TOcv<b&vEMM<)qj$j_
zX~k!;@k^z=HttX7;E2^sEBgI9Wa1vHDRCbd!+dP~e@WyyRA@Ec6?Lw;Dzhj(@`%AM
z32UzR)j0|tEUO+piS+y;-5cTm%uekpfBRJ}Ba8f})<%yGMxUHf7b+||@lng9iA(ES
zJ;NVt{KK^4;y2ye4Leu9WM1LUdUa+;tB$`_N92j~8xLh@o7}rG!|`HK$lGVvO2S_4
zw|vk!H)L|6M4`x|C;SO#zGZ*CKc~xauUh4YgL%_8i*8-9xo^w7KZTa8dnWIiA8_aj
zyV}FKzS~%WR$f=x+<1M0+J>tKIX5pq@q6*roS)6grDu;`X;)WYmHRDv>Av@O&#pct
z@T}(X(jT?_*6Rz(CQHp(e~R;Qvs~@VgGLO;XSS|!TjVlr(X$CH#{+F<-RW64Lt<&m
zMxV=Ed&;u+OyJ%zf8l;J)!^B4y@W)clwEb7mr}p_2>1Pvdq#R)mjw4)1ZL?<M#L&B
z_3tX4^tfnOMP$$24G$-6xHv7J@$t{pmplFDe6L8mKHJ~PTjk!*<XD?OFVA~hXW6Yt
zlIjf5)Vls)@{x?7#s9-x&nv2@Y6Y*eRGqD>^vX|xu_$GG;X)SP|J+v(?BmYmlwM-^
z?dA0L#EDk*9lwpciybX4?Z212Zl})V9dg;}=21;`Tb_FUn75!b{rpb>^H~AT>aIIZ
z{<ajXv$uOMz{|cw_sR_Ry>Xrfr`=RfeY~%^CU#cuWY1-$i6PHaCO5Wn?rnH#cxQ8G
zqWgKhEw9e^iGS^8iF?RydH0H2Sl6NY+4JgMF3#Qd{;c*o*Aws4o@_O{vS9hyla1S}
zBtwel#rC*t<JYmhrl+zao@dVEJ-criJW45zjpSX@d^LrCQrpHC+!+U%{)o@*nU);D
zKR?MMsxp0=!y&%ERowG#x;U>6*)qjwdx*K`Z;#Ev9B)iG_Xq6ybLHq>{@vf)U(bv$
zHL0+e{Va6)0|#-Jig&Buo&2uTQ9Hp*K*fx2g~D5gEU7oQc9=NWwKdD$cpJ8<^GxK$
zS1ml7nneF}w7WeKaO{}8_00m&YN7mO_2mx|B>&`Q?V0N*zbA0nGN<iV1aqIrxoMs_
zB~)|n@g?IaJxg}%6EoWJ#i?@hv&%=<&iH$L%lD5H^p}+}J$;vxr`k8YUu6sPv!t~=
zoDWTppNp#cn8v}(T-WBd{toLcnHQ{ac^anj@&X#2X{VESUf8@)ZKch(GryGk)N;a3
zNbRpIRQk~78Mm4za_ct#e_Q^{ak!;(^mXN`_X=#<v-w_pQ*!RwyQRePwb>JUF^OAZ
z`z9Y(*ZVU$z9Y}@qTRP9$Da2sO;7H!>8#rs?G<MDbHn!H4JU1sb_o57?pS^8FF*5=
z*3+!BL<^?L94lgZq%`SM^HipWPqXC~naX;YD<(9574&$wTsz+3%@4VnygpAxm-qj;
zJkz-TZ&~rvJi@p@;EIy^rYZIk9GMGj=CvBw?G%3gd7sYA1+U-#jyZqAc0<zI)u)6S
zBNt@21kY=`oobYGD{0q?mkT=$4B3pdkBGlj|9J07mt`6E3MbF&%x-e?yXuavJ=8M$
zY0#_PYbPw)6dOPH^-s&Ea-qw=+-T6tPTh3sr9b1N|K~S7_~2xCNX4?@lcdaVv!d?R
zg{vMg7TR5nJ}H*HB$<={ea#VbA(Q3#8sB#coH%p!3|~|qt4E$k8{h344UYr%yE3*e
z5O{hj>`+!b^Q<XZ{GLvSFKEpR^s{+(`A_`g5XVh(?>Uyv?M!-6+f%(x?$MOjOTS5!
zDz6pl*V?w@So_}{$E#U4z4s~U4WGj#**o!6i<UK~iO_N3JMZ#6S!KE$uWstJzing`
z8FWYSlhub)Zv^MoZ+-XNCzrK0@{ijsEy0zE!6t@bcRIfaS52E28d&w?rG(#(BXi<>
zk3C#a`dgzt`5C9PzIgr}m&3s<<$r}%wWw>w_)nOrpVYtVW%kowYOL=<<1>{ngw;ny
zC3JM_GS6_ivp$*qvsTOb`lgHn-ha9jJ;b;7$jzH{sLQD>t1sE9OM=PZ{=&KMSw2O6
zmREXtTcY~?mDNkUzkS}JQMqYGWWVKU&(r5`eJBWsKJ!M<#jD7Z!T!qC-$r?EZ)Wdb
z;J+q3@d3j-4I8J=tNrt@e7Sr+o5Sk+0--eH>K|vzHD}(}ET|QcQvJFqvCUUQwTHcH
zi`|PW+RoPwyj1(*oOf>0wx83NUTHthe{#QbBWIk?6|=P(pRE<YnCuj3EqVHRk<Pyo
zmkoC$c{r25{r0atvcfL?%dyC?BeK0eYdvhI>bwYf^h!f6V8_OTx@>;EJS%L|>iaU}
zKC9N4uC{#Ndgtl0<=j=P&TLgxb_+^<yIg-}&R(wL?5y`LKEJ~nYiP(J*K&G!K-Pwh
z%Y+?%rhJY)b-rJ5`k`-`_UoK-yq-?E)6Q^qTI&bV<GT{GQ{&l}osNB>to=hGuO#>G
ze}~$;yMA1lWxa5Fp#HCoXZJjM=JT1wP-ga_5+9+WQ$E)-Dx5`?lKvg~61w8(HiJjs
zCtfk*T&>5S;rRca))T|Btf=i@GGF`N6k27_q_>!Z<Hz&OAC55G7SMlkWXh%NBWw5)
zDkkSYcTfyJ|6ZuiZXR!Y-R!CYg{>YgZ?#W5xr#s5+tZ)V>e08+rcOMZv$;WedJKn1
zq{il!YQgC`_ZZ(LiT<6vUL<|9`OQRcpSL!$%%Y!PIfe6n{VAwW5I^1Elf;dqcVhPb
zIil9RsYPn*i&ebYPhTXTo2m1qSh6>2v&Pd`4`qUHoSS3Wk(b!3Y|(Ku>lBy%WP?1N
zU6aiwKG9RzW%g%d;HvG4!cuoP1{*y;B6Qb}?_>EamlVmHSI$N%{8YZARo-|j<LRQt
z8GcjhSA5r=x9*bv0_l8-vi!4atta0)<@`@)=B$*LK~~d!Pgl=2W^a}8lihA{vF-Hv
zw;9hi+DA9c<oBA=$2^g<z@9JjP4R>|O;@i;MpkTKEo2Z-iL%UXYr46aLF$vU*pfb$
zzY`n$qaCF$S4i1!pLbbK?^)i9-$CyG;!O>?-W+{C`$A5j=Rp&>#`cs@gVix--#gfU
zDtZ-De|tgR{q+s$5jWSQc)pt^)8Cx6^!gnid53RLi<lX#+IH)-Ci><&)L)E!xa#h8
zMh@HEl{tJhx3unk6T0`i;gEB8*_ARzzKORkt^Mr%TW9|&v)`O^8%%iC9~9g6Ytfo)
z@mBU{2HQ1esdA^4E%W4c{9an|QYbx5$m(RK&!HLLL$0l!WP8~0?|yM5i|wAQyM$S$
z%vrpo(SW}+)$>})>NO$p8xl04IutagH5zqyr!~llhx0i!#HQV9y52Np>fI;Rr#HSY
z>z?*&@?FdB%0G5-f}f7OlGz|xRBc(z+!|rOh%3_EN4hF#mPg66+nMIaCwRJYyKwsC
zvaDNMe^2o0Vz#}luXktrU0=<)Cq(?~^{{mAxi|T%)E=j-Xu1EVw|%Xbdr$6<h!B;1
zMW^e!8=TZ`*KD4ypJX)m>OQF(o2u(>+}QcHhBry{bJT6|W{X!-nRyI*9xLB{d+NNs
z!O5aP(exc{9kqP7@)Z4S7G0Eoz`)P+b3)Ct(x<i8nj<&IY*ybrH`Q<TeU(ov7miNn
z`E<!8!Elr7gAZFxrUu^Yf3#c3&T#UVR@oi=e?=yr`p8%qwMMXe!xqEVwfzewd0D$2
zPnq@Nr^%;N4=uJyJ~UnTb-VRrZP^qb@zq;6*f0LqvOB{xW6tB-uCXGi3)VIFswL{b
zpBpV~+x^Nk(4Z*eYSG6`mFtp8vG2ssznyn5<c``c%Z;AN{eM1PJO00tH@U{*qg}b6
zf82_6c?WaT;^6b2R#^W{uloNbu6xnXU%$C`26U_LU8eO;TZ}PVh$;G=(}e#24x*1)
zf0_u+vGcg|*HWyk{p`s(0*h0AxahoXD^rZs&i%jSmQ3}ng_`?44gTCTJhJi1b8S_g
zAnvsf_BFN6+Z3R?Ij3_{<)+EMbSqD=S6Z!6a5`2{=FPlQ?%B@m%A0=19WCz`51$kD
zNn*c@|MI+R%5SR{&92<KrTe<_&SFNDUAuNmO*yA^;@L-KX+}41$EDE|w2kyQthPE;
zAH7mJqw&M5%`fK4G;a>mxO?-?8txq}SD)_LF2JoRmVQ;<`|44(w>IJ>rq@bm<mKJY
zTlQq7%p;%t+ia&9GT2fZw-`TLG+87u;IeS?gW%TBGo(dNy*RQca__yrA+`OFPH*x(
zdUX2BTW9U!)|hmhuAcT-)aBOixqlnCt)KHHH1WX<gU4Mw?xt}K{pS}kJbV}OF6zg;
z=k8}UIs+^Oey827Sm1SzJ>ejm<d&4#t8Vs9432Yq;QjH)>2-SptvOe!r~BCoSzSAJ
z;hopC%;;}Blyp8g>9sxKX8o4MIoVJ8s_$HF-7|$H%z90k|BVDqcu(yA$NczY!mPWJ
z?J)<|Df&)x{AU*3CttYyh*_Q1#e}7~&8xPreOx}za@vn|eNrB_Z}(qX=oAwc&t?<<
zdcB<RJU(w_Cg({%JzZ0z!s|DEZ&hz#af@ELgH`?8`e#wEHX4@AxoogGJ7MYK$p<G~
zTHGZ1+<dph1>27kZ{4)wo_2TEETI`oUhw4R7$mrOmS<J{{}Nj=yEj2X>Sxf&C5^cv
z*QU*1n|o>Vs`5#v|9h1$KO%L|``6h<rp!YsvxNd(ciAm6Fg41w+kfC(i2MnS6>qd=
zHQ)Fc>e>F_?AMCSXOkDC<Q-NN+QRQ&;k@x+lfTP3>tc?-y}J)?wzr?X<@>Xab%)Yo
z_v#cc%a)UyotixPOk(JYJ6l|?%ZKDKpOjQRxHM(!F7^e%VvB!$o2I!>@a*m0<qPjJ
z%-W>3IyIJO*`L4R-3Q$Ftvb|I&Bw)BeL{y-Y~kK3HO-M<Qc|CFmiw&MsZGqtdssbt
zQkJsTH*LGnS61OWmgkFaN#)@-=J~7A>1M9yl5iv7qW|5y1z&>~?2>(XWV^q*p~zhG
z-WTGUhizu9-{D<<tF!sykDx{KzHm(5ac$4q2Rpyo7(|*SXkFdS+7KM{<y7@IOY!7a
z{73sz>*IBNHZ^w4k8kA^f19>AYg)R%!-Q2enfHVhJ|;=nX{MUb>|vUtv$<sEZ_oKm
zSCwrQxMp|mJ{h1ElI`zT_=}V8W#2+R{VQwFDlWQoN$AX5r_Bw1))#80T7B5HKi0VU
zj*4EvtHK*|`c8OsopZGOzC<XF`Q}+`YxfyxXKGsh`Wt-RRA0IK*vegdg=N~*&5Ahk
zu3lkb-WkEOtEf9C^cZt+^OE&H>bDgK-S$5`WufK%Y|k|tp5!QY>OGSD_oyqZZc@4*
zQ`StAJ5%Rh-+5=s<H^!jTD0XCoalM#e>mkpaQ{2?^@mN;9JWq0|7-f6vvGy#Hu?G6
zN`G-KVmjyfdnH#E$7!{{o6lP&2Fl)g6O?lF)U!#crafssw>GXVWHH;Z{&Z`|bCYL`
z_YN+3zH0aV{&kGaA^q>_=DwQHbMe)zuL|`O)3cU}GP&tV$1VL~Z@lR(&x9kVLT0ip
z+5W{p?anuI+4jR4)3>iPSRPcu!lD=@TPJoPZm(gU=Ci~56wE$fdT(TVuiA6cyX#5c
z4{o$Q(|j{x_pL2TD{~$vvRDQD+RDX|6)zmi&?_(VN$bSCP`63)Z2EzZZbU5p7jJ%Y
zZ)d-G&g1+=l5Qr;*j%FbpUa&zt?#v%pqqNaBrzMYoqlEQfwjt3sdWllE4Sp!eY~^q
zk>Hj)W$vyoPwU2Q)e^o}-?sX{^Fp@Z$ItJ~t?4vAy*F;bhFupX88G-{t((@GE%m)-
zvU$_j?sXskO*8dKYVWwVajNRw{a0(k6us`vHJrIBpr>w^R_%cjdH(egCojhC4LY)%
zr(w2$+oylOyftD=3x8z)bbM*~>-ld*sRH9=S$!#dTlTn!eR=eW=fT5=HF~GED%sqN
zog@5?`#1Bt+J!z3PBcuMD6iGey5l~#3~R%e+y5rDE42$*i_NY-bG_L`K!!^qesR&B
zE$55<-b_yN*DJ}A=<u`GeOqWD{h*%V$A!0VK89XxdYIp`u7^Q&K~0IrC!?r0vMzR7
zed0gbycu2|{ygPEv-s|pHgl?S_Dxw{bN<Gyy#BAJbYAHeGc2(4weHbX`8HeSN-^uq
z0|FgE8hf}zKNijKOPwg>@Pj*0aK`EMZ|m3F?>f$M;$4UJ>-UNbbGOa0Hx2TA9%UDs
zwPR0dz5KB+dqmFr8(Yt~sW?l8tN5eMvEb=D4J@N3+ZW$j9jTEdxvymIgUqj$To;ej
zit%oF!0XnXx%|y`23PC1xf`06YMnoR=7gTA*R7{fmsZ*Ox>mei@nh~<?m8VFcK-i$
z(<{H2ywX>Hni9WkTJg#i9S^_H415-$Fx$^sMt1A3Ieb6nwC&e?q$VAGaaV%v=a!@I
ze@_TjUb0Dlbw^jloX>w)i*vMI87I!?h*YdqVVz=q!j!qE{EyM3NlVLeb2fCHkCN`c
zvnXau!K$-jPolppwBwzz;m~d7H@Z7#b?jGua(j#9N^Rb6_V0u<s~1I{mFIu@pYN!G
zuiWX@j=0ASF8>qehp%pCyj~G6w4-L$*Pw{@b1t#XGdI6jlVrs8>%o%7z@L9>!vYdZ
zLRKAcx^sP>&{EDAh6)!3F$q?W#BUE&eILCGX5^Y%pub^@f{l;cSy7hhCno+a@-?j5
zZ?jzgw~uDPt%5iIZ^l1ZX8Gbzg`B3D4*S)6(oJc9SeMPvIrb`YRYIqWW&ag5lN*K~
z9<6y5^EY|sW&MTo6h3`*7n#45d9SJ4iN08;;{`&$jNfgKp5%VFatWuu<@Lg>PA~4>
zb*(dUHA0s?cq(~x?!(R-ztV1%#wh=>RN@n=x|AaIWyPC_#M${<h1It1IC$;ttBZG8
zrgWKYyT$A^H8VBY+MFfnhvvn%!YN5Xi_51=uG@M3x=6Zc#gxo!p-9Q68Oyp>a=hJ?
zrLuI{inXQ5{;Y4<em#@WT@l7SP0{_i%e{oQ-w|$++^_48cj~By-**1J*SJl!FCjI0
zle+z$&kLC5PMvBj-B=v+<3`8B(9el0Tf<LVc$)gk`35xXVAWfCb)ia3<U*COUVWA8
zD^}jky=S}ls=;gbOjGk*o~Ihd{lZbvpKU+)adG!J?oPR&8vZi!L6*@y&9~>?>{-1v
zxR9g8d{?2W|JD=*u`h2giHR*y|IYMlZg{R}Eo1Dz&GXm3k`B5*!zsM$Xz;c<1}@d2
zU&VO2AKz5Ga!$o>+20f!+m01m{!2I9nSL+(<B7?7QVuVDHSZLCW#`#fEOv#xu~&-Q
zpyKDjhdIhO?ea8UJ+r(mo>kcvarDAT-LKnf!)|S0t>|smp4HlWn5}eU_kptl5lKPH
zT0#CLO(Ef4%QN?$J?;FL^}!`=1_h0`?{4j}&7aGCxsomH|BJHkBGdHS(hf_Qp5~t>
zah>b=+Y^6mz4!t|SRcM-$nab7>Yw*piP;mjSzd7bC$QO+Swx$s;M9^;sqyo!*HtcY
zdh%zls_k_Dr(KNepG~^PvnkYGZsNc6%+gJdKMF7T?(Qur@}h&&=hENkjFZLQulL<q
z>3rC}h&TF+RBXE2_iLj2?sRPHjF35YT}C^gaq6E*t)9v8cb3#hI9=4WtI_J;%vDq?
za8jwxB~pJvq6W*!eP_A)XZ{yW3#)&YzU4}8+tM5NlZ_m-R|S1<6lL`b54opTx3{!Y
zBOrI#l$CnVStkG5w*2yjcloZzCtkJUy0NkNY>1gG=Y^2xv)%4LT-@L-^f>LfQLUSt
zLElx)BtBn*w%M8Sw->Bke6CaYeeeB`dSAHrvK^Wl*&xDmZr<y%2>aO<wk5OjjvVwq
z&MvCmVDt5a@G}2RSy4_~`P|;u<#TXr*D%kUwo+3&(7M!l>9S?g+h+7WzPZMCW28{+
z38M)IC!PMa*Khse1D75zvYd2({=VEw*Uugs3tcwvl$oP(s{C-VzP0d8MHkO!LC3%R
ze|7$aPXFpyInSWK)hP#VX#LH*_{%aqckj*2B$d@ybq$XxvvONkFF77~ZAt0tjh1W0
zemBb;ocJ&I?w!NT8<@I8l$b;(tSwzHyszQ=<we(f_ixl`-JiN3NKYrF?_jaxQETa(
zyDwI1OgX-2&VotlwtwG9FW;}nzu4{7?y?4xdDg}3i?Y3}J&#MPsadgT?wDky8-Dgj
z|B6j6vR@w*#q2+ywYcH+IVWc!rx>fXN3U(Vwmf9U-7nh;!p>&jjDNJb{A1RmZ7#38
zb6@DJKXX^?TW9_R3BkiW(}c?Q-I7mWG?96ALb<N7MpwdUW!_Gu%a62Mr4tsNZ4&xi
zC-uU6_I%FRYt7kNlT%|8C%50bWis`_-S@#EPr?|q^!R=keZ6#4UU=oPB?}GI_7s~t
z&C5}9ntW%0o!XvQ&1pJrysO+xPrZH6aAk>R$c!1!uJ1Np+q3f1Omo96ZnKw}HHOYH
z6ymx5F|<08JLF{c@7vEiTSdJjJT?V(PI=?LQ1Hjma{U8K!yfA0o}0C4;?Fy??yj~K
zX{*aRDDhfV{jc52JlVwphfHSGJh;a9hNa=)j=Zk@jw^0I*6fylW8N7M)3tTK^F!~K
zjmL#gne*)Jes*Me&ZJM_cM{}U&fDwn-0N2uZfLM6KymH$M_X$=V%7#l=_YZT-Q3b5
z@j>j9OX(4A!2{Ys$JGNwb)O_U=&`SCJ{5DJo6%O`;-+37vxEC5-(qZ>eZ!FD@#l98
zX`c@Zp4=`U{O7cW>63KbZEX%MUFF9*<`#s=$1SYqXItx$wqVK;-4*9`wln^C=ux|>
zX8wGePe&PNtM1mnDlJ!Sf5zt7iRadyg^f=h8H<1Ao{%H?<Iah5GYWn5Y^~*`IKI`p
zySp&6EjBMY?CqT)rR=%(o-^CCN&Q_B#^29G=hn?ozg|{YHJ9VzvHjPlIq%t&x&4mb
z;tR!3+z%Zul|84|mU4i7(}izMb5GT}dQQ)o{dQ7&O!JTO-;WzEgv`))xXJT!#=n(y
z=R}_|@o%p%n07ZhZpUrrLbV9S)H5FWW}H(D_IwL*JS1`K%!ZYj%Z1put|*4yI~MO!
z`$;Bfmn-+$D9P|%l@C_}Z+zVLSma%LyH)UZkGyy{O|j(dcXgIt(b-=*`K9LEsy6?q
zol;%l=N5S_=RZBW>yGtXop$zbZTIaR(#uyIvo49fZL@Uy--T{|8Lh4fCAufQeNXa9
zZ?@D9m5=)Rew$Ns%7Mt|6>as#Pm{A5cAfWM=4P$8G&Jqk56wx};_W4w^|n9zb+pb<
zTIolBZvHgRX?7*kLeGf!Z9VVX-qgqNDsb(wOY8T#8%y=Bd6KZ}mP-E=n@Md}PwXxm
zO!NQsLNcmO>z?T@-&gN)c4q5WxI41ObUlq-yvpsoTl<?u$8MaBy?uqRd+LW<Y*!y#
zQW4H!T&DWWV^hqJOMjN^Z^*WP+Yq!)SXgE8+P(k1ucoZl&2yKK(z?5wXVHP?)sG97
z<OWS&YEXOM<=~AI&pM7RD3;(4YPMILTC{zK8_($rww!DK{1(vP{f_JSfj2)RReq}!
zU0HOwnl(D;O|<jvsJ;I<d&9RW3ohNTcl$2B_=uYsO_8s6w^zj1WpL{x^UM`~utJB+
z^7FiX5)9^#4ti_*cDluWxWk$7Q7msoxDvzl-VaC2be3^yUo>G3-h1+VMx4~@clQMr
zg}1Da=R5B`J8fG?*Y|br6Lb}iC5ro8Og`P#wfmsn=~Y_#vEPH9sNLPe-qJixFPbmf
zfN6hKh?98pqW24L?*8>A@$iH>3xkAK#<+iNy=mI8@@q_#-t1McybY|BA9Q_<k7YZ0
zHt}b+!_rM3o<=rXYz^X=@cV%3gPzz~r)#}Te)A_yZv9&m9{EhG%wef!_4Vn~zrOy|
zmvOgL^!g!f?b|cH_1A_v-J4*r?bEZnA&<)a{hZRw^hKV!T{$N#|MljE8S{&_eS6p2
zJLyeF(Fzsm<9D~7xRV_yT2*V~RlfhH$&3<dh4&X%=-v8tes5p`uSIdw=5JA7&r0k*
z_~kW|eAC&p6@E5P%+E;Nae8rmcjbE5y;o#Ugo>Q!I62$z%*udgafhUSO}e=4&i4L)
zU(fu^*zA-4{_D2pdZUf^Z>t$J%g#0b^uy(f)}L)+rzh&4Jj)~D`SP%p%gMTLSF;OW
zCHrYJ{x-N2x%NrjW65={u|8KPoCsF<@PK_K8wZy|cg=}EpLm#V9I4P=`;<L}g}>vT
z{-asv6boKPF^WuDtGw)R+qxV1;_*j2eGb>>KJVNWxksa9-3^U6w)PmiCEtB4Z|%;S
zu_6BFpYj?R5pK2b-ZQ6vYSh-v|9w2OyWW3o)VEoxw}NJ|*KXJIw70$f`RW4=jqt^t
z^1td{_A7^ma)$kz&SIQlP~haMGmq~`wlSAR?{1TW)4dLb>KuqMSYgei%MfY7Y4GUJ
zq}EOUr-sb%JKw<ddheYV<!{wCel~n`O*D8BQ@@_l!n${@e>S~ea<bvP{f)Hv#VgGJ
zHg13DTs%vl$=PXHQ>ZY5u+HJ=u+(P3?f)}lx4oHn#Ar^)gIl4Ye<gqC%>4FiLwJbu
z_UUqMOUfhiQ)Q;qOpJMWHSvJY;R!4E1zisbtDe5RyWz{GXkiXVXQP+viVD?rcIH1g
zbYS17m~|`Jf6Q6(Ihe1-+w;J|r<eU+e@W2a7-Z(mv^xHcdGyq;&-ZY;8t$E;vv7gN
zn`y44O=qtuR`1n#^Qce5fFVcBSMaWK$ki1rEfXImm&-2tYX0aFd&Qx<Dku8B)dx?X
z7P9ls@0U?}Pv7Z25BCZ6sN0^ijH`NM+&9kT;G&t&n^WV|7hl#lT<s&l!`ZY{<An1)
z(?dBKN1hZeoi3I9<j0dka<jIrT%>)3r)6Pb!`|yJPD(xK-FxA~anT#Uic;A411jH2
zn<hkSEb99@T~2=Uwjj-OHdP<y_08%q&$<{Us<>*}ubUUnhyKyNbNI@Z8KPBx(-rf6
z+kAWTJ>u@7=e}3n#GbmmS|B3u-$-_Mx3j}%U%T!Hmo23qgdfzKIqNIS{tt1F9NA~<
z7(VzD`0VBP3O4V1ey;-`9h#Q0R^^tA@1u2dB9^_o?cZK6`Msd#x%Wi(>eM4=&TsLI
zZ+X2oE#O|kiPE_?7mV7Z&lkU%d?2d-%<eG#BDI7Q!XL8tAM(0weubSy<(0&WJ;i^{
zU31Ola#x&r^~ujR{foaGKA5Rw#-w(JtjtT|F|RN_a*1cjSJu=$XM5FBpNT)3Zn?y7
zp-5&+Wx@T@D<ZK<D^ot&PradFtd{I(s~GaS`QJv%rTStIYToQ&QhIQ>^Xk5`SXZ7u
z0cz(iJj+nvzG{@hWOH!N{g<-@`m;|9ZeAqhz)~(<=D#j$L7tyW&a>P7Ee?O0O0Rfr
zQFy%4QXuI(SKhng5C_E=E|v*l7xtt~uU-E-|IH_d``f)`yAspBMcn^=bf>G=|0~Nl
zj@^my+2wE~AUX8i>a&OT)R^zPbb<BGo|I!p_+RT(b6I^f{=?;KZ}j%eGNqJX$y==_
zvN+72CuvnEwWq&F;Ol|b*zDqr`S%$Z(|a@n-4p#bzw>^-u(!GW*zbdDH4bc@ned&F
ztL6RMdsmB(oOwQ9t!!1&-<`{*Ynh)rojGIjo7B*a4wsG;{cOo!_Q*`lEytzGY0~<6
z6KCF?kn+Fs-&~h7UixKou6F)dZq@hGLT$=~+_h%8p>l^V3VKhT=;6EX^dZrsKHO6d
z+7{GR9(C5b`S{4)Fz!1c#SV9SkESkeXTJUGYT71;FzFQ>T0g}fPChsD{0+gWJpDDb
z3ui0|TbW+m<~W6Ee_X0gf27>!Enm#9@&B_?-DEAee8=arT`SeTxi~G?>pXV&z(TXs
z{$rs<JPBL}AE?$;p4F9TYm|uceDq}9-Ltnls<V2-%d_sTIna7Wuqj}s!rR5aQa|}F
zOxxpqa-onPH%rs5#X?5!IghIBabns%{ol3#AH}NVbBozjgm%nkZQ<WG)9ZHd`L{0&
zgF;F*_Imp%z1|c5DdWe-jk#f~%%zW*GYHx9UkO>T;<Wn|=X<4h-)V&OZ+oAn8yjYM
zJ+eTx&3{Vv`IWEk-KgKL(YUgG@<f+k26=&hMNRGga&X&N8Lj-LVc6^(qvz|OYjT&R
zN%sAT{hyp)o(n58a_*V1CORx`XILQHFU`sgcdS00y#D6u;Q*GqXESvVSA<>9^HiJ9
zd#C3KbLi>1DW@}?Zra>PUtP%GFZZ{;;?nVb40)j!rPIXUcH~KkxxY<X)EAx8&-&uK
zTTJuY%Ka~SXRNAiS5rN)cr&M7%m=2&{j8x4m$uJi`!B8L^l*zU!?|<&q)hIHPhC*n
ztspGOzm(5Ue@&8t{FgwbdDYwZY;ulVxUEYqRChgx=hb&Vie2X%kX~WBbGlZ$Xx%jt
zms!D{z8Z-Z(YG304Hg$|tz=F~U(0c?LAvU-RnC#C*)?0uZ44PTuE&N?oyQ^8Ct6v*
zQ2U0^`@T)pdeav3&i~WgVwfJk<)B{ZmNgYO-q|uHyBIdli@PuVgTbSE4NH=UJY%li
zZRfd-mv|$lNAK3qet&$4xoI;;N$6aO^GlZ6<|px7;c6?ps$#;d`X$b0((Jih<_h1f
zo?0)8IT`<ySE66`_Px6<Z(qNfHSzT<)(cL{KW-JNmfE?k$Z4CX&f@nS2G?rxl4R@h
z-mA!48U@r=YQJ4D!}CZ<acH(@YD3|TOpo0$L62{=%nbj0wQibcMcaZeryY#e-`e)G
z)`z?MOl{@@%ad<pHs$kpP6~hd=A+Jv*}K;MVw&e<wa4Ih)w{<3OD@m(Eudc6dU7l0
z)=OI@j!Lm8`N-UB+}kO$^IGuQ<^LbL&f|-|$#y$o&Sw+u>lfTxq8as$J>Ik88t1pA
zzMhW0{4q86HKuPas;!jKx*ubr_UT_`z|s0??b8yn|ITY~kWv3rvHXm{^fxSfXKBRT
z>6#&)GPC{56n{C+3TXptzI*EPzm*p$Z@X|}!QcBCi|Q(8$iLX&DExlL!V6~#rwOM1
zS?2cd*v(=YbIyo)1+z69PlbF+JjY|0{%w{O-@4vPuTZ0fKOF_X*P5S7fAZtT=TjS<
zlkcQeZdH9F<6k#RpoNz;EB>pN6Jx{u!||f4`{oPsbG$OU=Y9B3-%`7nU((AmZ+W-z
zsorkwzWV0G!wb*576%zzDb|nEPJLjQQoQxn1D%&lAHVUpKmI(!>Sl=2N=+H9#BI!b
zuN3E=IDT^1n**|bk`_DOIz5UyaCIK<v~K3_TG#(*RXc~+^fIc2|CKIy`e$+q|5Ts+
zKLG(3y<{`bc@$KtZTv2-bLZ8~tsAfO6&5BQ-N^m+-K=dpjrKpZjPSWNqmm_m)xDX9
zpYB!Ls@>mn@@{mU<=HN!o9kIwxuo_4UH0z?Z~v3<S<7_Z$*{X-hD>$bm(P6DcV2m|
z;CX{>gL+C@eIP@|m&`9G@6{Q(eTZUIpA{H$d574_ua{2n?6tm{E|SLet@fVGg!&7`
z;;LaXg}d}!cxE_n=DcDle`Kxfk&hoHse5mkR}wlWPBJOtpjvxF?bBWt&tJ?NpZxqH
zovZPt-+s4l@1(Mg3l~59=9M%__CwozxwR8I*f#t1Gv1cGeL|yq@6#1WSD)I_!>iot
zRrWezVIAAzWnWtZ0{;8_JQ%;(>BEQFSE85-ll|)TRjzEcdG@g&bJnxt%&)(gl)mbZ
z6wRIN@V8pFUv1a<f}=rqj9I*TBBdfOvXr}>`>1(-hI-9Ku0)4NQf~48yi%8C_?jAh
zs&8oVv-9%iFHmM{*lf(9dTD>3Yf!Uy@7L!(e$j_+n@nF~dG*=G>Q{9$;&VM*m3)qG
z{*nE{O<C|}_~E6DP47#mF_j4%iPt%3y(QymQ`YwHXXgEPH+g?P>|kNEVylW=%T^hk
z+zr)&SIi6ct6a2N_T%e!Ne{8`UAw$yMrM4!*ko36_Ni~SVoKocqV<#94k};zo~C@$
zK}mYTg$Y{^Jm~Dv7G2JGa^}hjlN<%DUj%wHxOIO0>DxH7vEuX;Z^NBo3fk>S2Cvo}
z%d>Av5&FJ=VL{RKbtlZ9+?f@9j6+8}n(cVhrx#ouWqmJt%C{BY^;oyVWOmKmzjs$X
z(_66A&^2M768EYg#qxK{>jk26Hgauc*w7foaJAX1AVBQI-r}GW4L+{*Yog`%JG7pt
z@(q~$Op4#@-Kv9DmTbSD-PSsK!7NYP!D)MQQ2)D#bu!$X0V;13lB$Hh&sWyDr>fng
zw(x3Lnn2Vh&$L=yCA02?+D%K<B*Z_Y7B2sLJ)~LxX3Z4FedgXvvkyCL)SCF+;Ql!!
zGj8{tO&?mFf}gxj6K5!y&i){5t**G6{U-fKE4czsYl&L_53%)giWj*MP#j?Y;;!H2
zAK&6DxaOGN&RA;D$-cQeS%Y)?s;)B;bNnvY)?Hhfb^1-f&D{5w6#jMH&zIQqa>xA(
z?7k9JauW0Bm)!9<kh@`hP~ZVszrW^=-AccG-4|5vxBIKURnUL`%qi^r+S4wt)@krK
z@<gvZcH-L8r`d#s;<!p(y;cVbWN@;seSY$r@h^odH`jNpxG#GC&vcF6aIrwU!Uxu>
zg?7eD%hNOX(=YFQ-FPuzkKC~tj_#?NtM1PGwKQ?v2AfX@R^HkYab@bqhVNe-Yos=W
zDt8I2xw_8st=W|N{<@EoHWoeDC^zx*hW+l3L+S%=N?e_}g|pvGGb^%r?fx^3b#<4P
zU17563H@Wqs!?U&ch7rQ+J}olVZob&mMTBsyS(JRt0`Y~Uyl89v!B+sM`wsRl`wi~
zRv*<}zw35Ue5m$Ei$-3JydP0&^B?*i$=<Q$L+9yN!8P8Rr}Cc~UFwu5KJ?hZO}JS8
z9P^%!9t9cU?CT^uULS2(ZF>B##?li$j#H#;-Cjr59zFW>w7Lz4>q^bYw!Ql{&tBiX
zJ^u{*qRAd23$JZg%vS0s;<<fX@wE0lMdtf%N1r_nDoJi$!N?W&Y3cF3a_JEcS`7O)
zznoKO$guRNr|@d=Z>2Xna^o^h|NpuqdU&<TrsKbh`^2u#{5VV1X3l2T@4<J~g3Fy*
z?$kzYdab<f@sB4S?839W9T&=5x#UOADtVOb9p0Fnd8#<+V^5z;VDa&5?Yhx+(+)p;
z>{jr6s$07G@x1aR>xO+dr2|h!|2thRdiBS;{*%^8Z1XupOwN4%Z=K0tc{r-&zs){@
z6*n(2D9l%XT(w}={@6hGr24BT)^@*gRdn@QKeyk;{(V$`gciGlLC<=V`P08}Oi(qR
z)jsFB<%Z@ZBI&6bMSd@5rQKUGM|thz7Y?VGZr|v<Va6I~$jSfMFny<ol;f;J&uYAX
zoAk1~zn=2XnbU_aH^=46RQu!oRVSyk3Y<Rw_d#n(sts>(@2h*e4r`uWkWwPgaeDdL
z`}d2v^eu~~-CoJ=C%)%?PkzMfyiIBMqQo7S$re9pd+fUSz_Xz8Q@5)UZ@K(9_vXN}
zPnKG>-_Knuls8<vGRNd9%jZ&Y*{vGPqORZH-fwkeF|T6ue8p!OSlAz&zRNdMLPw!e
z!se6N0*%;ilUj!<3cpy_o_X}JyF=>pB)>b1`QH`i6)d+ZG5caEdSPM6lFQKtvPF87
zw9G#r4tyf?!zt@&tWxIWPiOt=?<v3GI@I6jelgPGu9N!inj_o39p5d`zivt0&eGsQ
zmOp#uX+>xETnjzF;IHV(IF2_CB~n|gSIRBoWK2}pv@~q>{L4v9Oz+v)G`Vw|nh&X6
zc$9gQiCL-dZK*8#u5X=lmzN%KIrjG2RN-Cjk9039uW5f*x$(m<xrO3K6OZkkQozG~
zE!Fb8*hl@c<!|=MiiJ*?R&mB@JD*p}HJz1frX@AL|Ev7_RGr>Q|C!C-8s{DS`*@Gp
zA)!Bs6GHgiE&7EUc327DdSkAru+!DbqyDo&&!@hPN0I~|9=j1G(CYLpYl4lC^QKRN
z-)v-ZT~5~vKUOMTDIAiTw=c+gfzHZK2Cs*rdlnqkTG-=drPHgrFk85$L+qqX?^J7r
zBMqk$8nzhk3l59Bd~!;q^LBTxS2s0W;=JeB+$}CPe6ajM(ELY<u2FLPo~#ybF<hU|
z@LV=xW`S2$P9xK91EoKz?}9I%2$d9_sQ&h&l1{|ji_7m@DPDTLQ?uyqx5PCa_65gN
zXT8cW6?VMYb>sQD8r{(5WnBA99(g_M{`vHI+}a3{S2vzFRy&DUr3<oTdAzUhdQw&z
zyG>iCV2y@VWzmk`pB}#0UbW`&iBCaxFaAG&#3b^a`NF2c?~@ugyv$hg*lQkJ&AZ9`
zi`N?FpXqy@CNsbK!Ux%!euW4Py92LpzG_QbE&BGh_5z+9ahH{UZa3|`DzG5-+lHr4
zUNmp{DsLEEo)p=4fyu5WSN&OOwRu<Nv!7j$-m2G0pKH4BxYqOaypwxtSIF?#Gz84J
zdWKtK1D8=&%e}dKn;w4;T6JLAhfD4oPk0^dlGCxt`0S`>b8Gse)_034eNM~_5Z?VM
zHE#d0N@2$Ly8n)(p8R_F!#1xvUQ02XNiJt6G8DR7iq5@$X<1WhjJ5r=j>bpdTfg0y
zmMd{qa{ZA<#s9?4_lM>_y%JwIXKBwa$K}!tdTNiRuF?MKpYk+c^IOk}oVle9)}^sa
zi@&*4iKN_RZ@#d7Lgcf`ufaC;;#@cUvZfeZeshvr<I;*oIS1Aw&!(w=ynK6}@=smH
zq$62HdHtKO=}*r;YrOsslRvv-`#+}|m8sK1I`<mx^18l$_txXeo44+-KItmYpfdGH
z-;6IUGAaAr7yjCqc_~Td#L}+z`0MO<em!YF@G|j8==yDoUN#8MaL#D`t+)EcH?>2p
zXLK`bA6h*7U6XhDmhuJN1>5`ft-qaqUwHBUFCH8Rrk9(3VAyg0%~8e~&!_o4&3ezE
zRrX}55AWVyzB^7QjYTZfpWIm47qC!}+5OZ1`W<)v{GTDnr9AOJx3s!nQD9G!4EtfV
zYc_L5CQO{PF0j6mJ-?!0ZMztI-`4bJ+dJ;u-l5N6-!J1f!#S*=T)o8d*_PAlmjl~p
zU3+@;&8i1CO)fMq`24?8rC>Tw&0XWKi_UyGd)~PIi3O+btdzYx<!!&)HN96@a<M8I
zYigc)xS`9hCjO7^nKcUqgYtG;i!Jhas<-6p^qHK7b9Y@{qNTC*)@Po?7uUOt15;o9
zu3$Z#^dV(SUqMN$;PjOS(aSd%=_Sow(_H#3`owpUv$Bq7J|141Ja1xOFq7Si(5H6$
zt=IB<9!kyJ<ug%Y@02L92L1_bsn=#-;mwqouxP#6X8*@}inYQU`dGDumuPKM<=RzJ
z^K<&v?)kTj<-`Ac7G1H#>0zC}Qo`v_Mv*<Xw$CdMb~tXiHDza4%8f%@yZyHZggCe)
zoYJY#_vCWg!4x9o+o<LBb9aZ=KY#m4brr1A*~fjozJ&c&cu{k-cY<rS>nEO#Z_jyd
zV(81;xGwL!$-$aaU&WF+=PzoS{J7p^$>Z5Go8K86{@#}#^7Dn1&azbjm-*g4IcacT
zP~Zm3>t^+XuH{^XmIWW#Ocid6e2KhgdUE^yl^b=QuIILW)hMsB@wJVL?&ps8GiEF|
zUMBIgZT)`M|NiyYC$)O~EfEMk@j>kR$DLaurI~lK1a0Q(v|#o3V2}(y{cx}IhpO#&
z3Q~Scr`srhk-ltT5W1_kwE1FLN-m4Vj1n=0hpBTO26k>J2()9X{Ux?A-gK$wW`jMZ
zUWZ*zf6?w!cjEf(&*dL@X4jsST*E5Pb4R@^w){AKtnvPn^)BjqTl^-a9zEJA_`GmE
zyKwu22PGYaHMhKfdCI=;+8^<JL)8xjx8xtoPBKnSs;fD1JU(ch@{QV#P0JU5^gBA4
z^TXEQ{wJ&NUrKz~KdZZL(`@h6SsTkVZ(Lc$5*-kqzKp~D-jTaXGD<aJ)6&eHCWI-@
zI`o6jMV_a-w`N-}_v2u09iyANtCZUgvV41Yge}O;ddGev&tsZw(-u^|T)us7(w;|R
z>(pJ%H`gqw_GDOn!A4G5e}dKf=iK3vi$0up{Iw_W)KnjNStEsWHwA8l9MNCRp}$Q)
zjAe%O{xf%LCa<m9w84?TE%@P+H=O$vdv7c36TD|)IIVl@_P*X22_~K|s>U;SU+n3;
z{!aHpddHpX?rZ!4?j%b+dUJJW<Oc7|uJxRE><-umn;5TsCARtYowJ&@e}dvgb9*yS
z2Cc9=5hMBGUE?n4tBGL=r<d*deP!SC^!w%umb?p$_St>^C4YkR?uNbFAN*gstmdxz
z^RG-HTjEwu<5{usZ1a)n+8*3fZ`?NNZAib%&QasZZV{!K5tA*H!}5CLmRF(7D@Br?
z+&;h5MUC^=)$-K&1tv_#Qtk^j+<0|l`rNM!53b)jw^!)ZNxMI9Y*i|2u6|{?KeKqt
zr7Xu-2`{Iv8<qwV^V%P~KQfRCyRx=v^1FSar}`#W^<B|jrfZ}z&%D>Y`w7qbpK9m2
zE1s~;INNNx{`=mWw=YC!)~mni(kghc$9tKr<ce?0PWiU7F|1tECzjZDtZa$nCl2}l
zPcOTtoHh+BRymXR&}QnFyr@+b6++F)iY{yU&+Fw(Y+}5_|IhiAo1f*!3%xr%4J%yy
z<$42|3{R+T57??(e?v=dTKk)lNuMUxsr|mb$m~IpLY~s3RdH`O{Y=x}z0t@2n`8I9
zTL}lHC2Y!a58laQ=&HYCA#S7=yZ&y#u9&LT%O`wzcUPI^Pwvf&hw95$t&)t~aWYS2
zon^gn>r~%!+isX|v|i)vl=(Y$gW##!Zyb7O)~ol<49gT=vi8Wt7?HqDyPFTZQ4^k{
zrETB8YQr%p-~IoN?l|-O`s3;UwWIjTy;<4rFnQL+EO_R0)j_l^YxeuAwe=$B;xc`0
zpH3`)xp#@L@oKesFE35BirRYIBqr2=Q@45f!VQ(je0?0|u)E7x^sYId-{b7OCckn1
zh3hP7i}z|iHrV096Ta)>iK+e5UEcY~*~!P;aBnVN;CugwjNnVjP9wkPmxI3U-2Ly_
zZV&hNnHePx7J~P(B8|laz83yfwrqNmdX8~!%o8zR!Mww<LUGOqo^SoK!y|CYsgj+q
z-I*ub^ZwM?aid#2`^kM_>qQ5*%s8TwxaR%(|IyjoJLhb_Vo+h7aob~^d1dR|-)+jz
z?U$Wq3%gU*RMNPE@!@)Q8~3)yE0}-R)ix(|<`n!9U9au%F*&HaE1ElFW1Q&3FNTfV
z(z^qT9{u>l|1Eiz$jsdS@B9A5JZ;V?p3%uaMIqtJ(v0nOEt}@s#$0ZfR?roEQ1s*W
z&2_5Lg*%&0%8Pz^uAz3S;={eYGJ4h77J)H^Jj>2as|k4d+j-V8m2=4vY+2h2+<vbM
zIPyZPKw|0}&x!f_Qd|XI2JKmul6^qJ#PP=Z>$Z-ECyKdl<ExK)7_nIF&9ArNcRKeg
zY;KHOs?Ywj@nQX*Z#m9s1<zV^rde$-+q=f{w4MXcg_HO0PUxO!TX8b^yj9TA*fsNJ
z`sN>ZE^x_twPDGvbE({yzdX0wedoH*gJrFYSZ*A){<P)F8v9v`H_jKiEn;!zK<VPN
zb(VrX0t=GnY-7yOaxiuHn7cuDX*YXD$^k8&-$k<~u4}$Oy_>VY!KRTb>iZJLjLdzT
zinm9Ef4$fHuO>c=*?Md3p2K`v=XII)us7_;l_*{3RVevz3LjsTcJ99YiF-mepRQ6p
z#2%b<vSW$e1C4m$Z_l2+*OWLJyJrV`;+0F=e&v)ief9hjHs#FrCD$y&_8o9A>X`AO
zX8&XTv$9uL?ef&KY?vMNj)&nyc`Lt2^0A$>*l#a-Tce%ye|AkUBcmegr=Q7s|4X~C
zhzb_}T^=aRCNH&p+bJF^Ey+(3q5)TSoA<0p@Mv0n^UvqSYfrCwC3D~1(eJFYVrhk&
z{kl$758a7bY-_wTZ??z8w)`?QY5IIp(*GsT8--0DEWT>bu@n6!vx{kU*gS#XnWaHr
z_vfwbU&`+-8`q(H@ce#r&D(`1(>X6PWm-;uHE-rUrdx%14_EHJ_CGQ@c0T9BC12Qo
z&AoWH@WLv4c787Zm#-UFFOlcHb2E+e($sl}7A$cU2!F87huP%Uy{JX}8xIw%k8qji
zlX1u1&Z>0tT=}hgro`1<?`Ga`KD6Qcy@O7ix4%ET^{YZt=`gFOqxt;%`4?V9w6RXF
z=r}XyQ*dJFL4m}QMW%k`2C1CyO_uCnU-8uPYw?cXuV#D`m~8(z;PIZPS6ND4@o-Ky
zoRD9wlQ3;lR!Y|z9{GegCf{0?-mt%4mR{~ZFk?dXqx4s1Q;QBwIln@^zQ)>b>V4*%
znFrsj*8AtCFPrvwp1mn+ReeiX?4DJBnI9j@Y}MFrr#&r9(jid7(6!-Z_Th~Y3ocDA
zh%?DN6}+6wWPM$p$Ly646V+T!?ws3u+G+j9>Km`lDAg=-(w+PxKF=;(X1Q~W1AoT8
z+al|h^{wa@(7ey@a!0@HP5q&JY}_|1Urqk_-F$oTqw0wGxxMaOcU3dmXHRe2_|8rF
z?+c0fiZ)f7{&L#I#LESHUv`{h-?r%d(F?~XuKGBoV&-&KC+_Wf0hJ9$7qxYi6_lNt
z_fatGmC@7RR*N$Vg2Rn&pVxa6{p$JZnJ*mn{;zr>tZI2bY|4rUe|Gy!ia9#_w8eoW
ze`jYqsm{pmwA$Q!r^|a+oOJd*cxPu%{*9Jn>z{<GANE_Va3h$xvtIkd)zrKS?K@5)
z8G^0c$BmNIVo$DGUp8^hv<US@XTz3kTFSm)NqWzTJ#X_@IOZ~K3l!UxCXn=Y<;t0N
zUEfHZYdSaY!O43k_wMwr5o1bC%i4IN!Kjw=$&d1hd<|VfGh&XuzaNw0I`Qk3r^i3W
zNN(Kc#iQuEzOnSp*?(JgCrKSYp<7z6bh7{JL7UK}Gtw@7;olsrKWmktP1#i&W&i%x
znGRD@?%eB&ZJu)A(cVA%HZ1a4EAmg)Ol9VDE9Q41t1C<=oYS&7->Q~8Yg2>Y`{Lfq
ze5&qCqZckbRU>=EKF_f2YK%W)&LdVmrIx2A9$~o?XQ$-xU%fbgZ+_#KMY|Zk{Bx4x
zxf<@eGLbp(Fz?jjb2FF4zHZxkY|YWtr&3vVH)<&Un)ktT{p)R;mnrcdx{^>?yWXH@
zAM@n%#gY-p{Q1f{l^4RY%HBCG&&$YP-M#gaq@GpW)u{egISv;B^%as=pE6FE@7*2x
zxS{&S*@aQvf+g3Ji`SS3HhmRZewy3W+UP;vu?b51grA%(oVMrDnp<Cft9#9vG^_Mu
z&g5L*qUfJ%+7i|zH9QYLa&i+#&6){?_n&@~KD4{$_kw4U#dn-IRPX!=`O|ZJarlZ^
zfo2yyKdn`B+%5afm$Sm}i!5{Fj+ZYQBHYWKCcm1%vC2zgqsY82PwRiTyUfeVwK7(%
zU2rnWp7&Bssne|o62`yR_RfFA67?!b<)6v7=<wIOX2=I?E4iF3a6a;UoyF0U4b}JT
zQ;p~5pJadZJ<0B6OqJI$i8EZ9sVBXj@$N}oGc_ScyyMQb;*%j&3$Oe%_KaFPNywv7
z@592D#xspN+5NQ+jbf+tgXE$gf3i3)_r$(B;-}cNi`Qp19=`K0a<g+Jcg0pi&zEs&
z-r@nLzB}L7R0{P77F@g8RdxaA)o(ex$<9$03pd1wOuP5NR55FLs>QUOPqaM(&GiKC
z`n&L}Eb(mp!&Id2v7?B2yVdc-%Q%=FvV&{RPn6^R!YBT{NiWKB>YGJ-POD!u%Zt3=
z^F2rLQTp>t{VNS0C4aneJpAnZ#rvsxJ*D3+e0EzoTT(;(c-FoHChFSW)zLrVT^s^S
z8M4_XSZQ;}KRS3quK5DjBM*bfHdAMbd(+=VSDaFQ;J>D1aw@;L`_49-2OoO9xG(yg
z@e7)}eqx}M`qrbbc$^qc*R->3@cDk|8v9?tyDOq}{kij`R&0v-H1Gb&+T{!-4A-56
zE0<~S{(pia{=wDH*XMkh8T;tv-_18=9&>y%-8tc2I+x*mZRTS}d-fgs;_$A#@ZnQd
zIkknI#)m8urD|AJycV2&dB<<w%e9M*s+M#vU`)T|yyU0B+GEEU`{Vw^RL<c@*^tc9
z{-;c^PR)HX<7&lYJf-?SgnzPF-@LTqSo<uW8|U;^obluFQR<z1w_}ac?ehWube!9F
zo!e8bk^k$jLzmN+C$pY?j;S*Y4G62*{wPAnY4K$?)=NiI1lVG}Ugol%UYF$bsNbo3
z!uii750v%S?^!H#goACR@6<~9xJU0FtKU;jbEx$T5nO+~;z5tc|Ls$KguIQq*182f
zjP7pDy_cd~wj=5M*KOJ_imrUTz*#c?-Sk-^H{!NU=jcBuaJP9~zwE~JU4|Q#wLagP
zaOiIIm3ddv`xN35r+j4Fp!wf}=lO$ezRDG+PG`U7TCD0kFE!-6M_0`~KCQAff9~I1
zv+6F7;nH8L47Yv_sn9r7a_6GN(FfO(_0FcRT=2E&(7)GxyJpOr@%ncC#=|S$NxVI%
zt~0H5S;(@_xsitLt;}bfWq3>T)mM01Y{)s?^P^+^9tT}x9!_aDu^nHp$of3iH$A#!
zgD9i9hhWOayh%-6=X{p!(GaaYI)CX?2G<5jn=b}3iWYW8^IJ>3^lo-P-M8X+b#Pwm
zt2eujxjS)&`%f^-&|UDuEA*eW(kH=B6Owi<{Vrkr_jPr!uchdJ;SNs2`Gt|+>@p{G
zUOnP+*XUnu2ZMo*g^Znx%;Bqlf@+Q&Yb!RM<M!{@vkeR0y6|TIIQS!S;=`{GOCqe>
zc9(b^i3u!>Ui1F!qMTC|I}1bGJ|5oseCDM2?mKjae;6<+dt@rA-E^FB?NjlQd+B}s
zMn4aq-Ic+ay71(IXEBq%O4j}2w=Mg&SU%?im*O=}yDec?TR4uNdphOEEg94336uQy
zuCKKEtn}T;z$MQvig8`3{Z5ZWg+(VHB_}RE(w?~WhL&?}!nr#ZUNOm0mH`5*YwMS3
z8?(kp9eKtg6XCFFR!zd=#k*eYt@p8aIOfdHAz{7SaY5>`XTilhM|W2AWQOtoFgUq(
zd-Jy|TA6$f^QZZEuam!U*!t)CNqOH3Y(;iy=}rio;M5-T`m0#~rp1evRyFI&hg8ge
zy)lH@Wqvv%hqv#!%__$Ommf{`Vs5#{eD935+J$_J(q!W^`{tg%R;}rBKWgo!B@-sp
zyWLWKJmra$faK|oi<O(6T7TUCe$lpQ8TEt~rHc_O*WA}-vgYa#`*^z~Al+yF!6&zN
z)JK@ldu6*V$h11@(&hPk#Pp|MQP}=CX<|g|rfJ4y5s!~Z>g_XW{>T0;Wv+#&u5{Z?
z<?nTZ)`#}<Nl3OyFQ~t{;n<Arv+epTl+TtnO56B8xw-gz(TUdh6fZZ|g%S3#%DL0~
zr_R45^l-<rqy0yhoIU<^-Npk~ySS#7ioTnxXs3O1+mZ5Z5?P;L_p@(!czNOU?~%{0
z39nnjmiU=HXPV*N+F9rC9h#%^X64SK2Vxi7amk-g$l73e`RFU96wVK4-W~9_Vw%Y{
z&oeAD(7NhVq4=_Q`;LdMIvgI6*6{mwLvPZQ<Lw;Yy~hJ>H@|!RMSpgZ)ZVylKe^^D
zn7Cgu&*#_YrETY?=dXF#b)w<3=6A!Owx^d@7rj{%-QHqYXgE3byf%+*pWoiVr3%~F
zg_r(n{4lforlfZK)H{F0_-0Ig@B8nZI%iw)_o)Y8TPjUG`a|p2l<Ti-F6;WWKIGDk
zI`WGzd1vm*RpNCH4;DHkN!&H}3;*}~R!DQydYcy6?_3j_r-*qeUsR5C+1{|MPHL9>
zMZdRpE?m0n!<NZ1*8H?^4V;uOx7$$EL-$J2mPHrX-lS9*$_mB%T3&R2#VM#XarfT1
zYn{vYX|`3rI<oAB__-G$#}p-3&3Uxz%-Isvjy3gaOsg4mE3dL0($aSGc-}GlsPOyu
znSVby3;%K5pxK@7_rtmD)YOy$W2LJmrLX=mdwahTQCeuFbzew%XMb~Y%%nO2;VDzR
zEEl&XS1x)|lkA)F(DcO5^0@BIzS#vGTY9g4zWvokkJ})>bV=^*m&<PVD*b$<SoQ6p
z(?K<jidk1rHnZmSmDMm59khG)aW?bqg;AZ4FZ6C(Ci__EDYs|k(QQu~7Z*=De96XX
zm-3f0POtKu^_>!S9+s=h`5=|QF=xjemMv@or?ne@{o;75A!8^}&whyYt>NPP^1(c<
z`@YWX|2oyp=jq+4Y`Lx)8~O@DUU+$%>;IPc%Ok2T*-#}t%`p4&^Y4QDpK&KFchWJ8
z`ZeX}=BnF!Ewml4tn$f!I{Wn}KdEVIa;q2I_*!3DI{VsE{~s5^mhvv)+{3?c%8i%r
zIbAjz7oHGVc=Bq=qF>kg_BP*GJ!8|S$hM^{0dD5)t7Cgvceow95_)HipRD;yu0KZ~
zevD$i$;HRv?fEFxNTo*OxqxBuwY?qd&O3fQFU_wU9hO+tn7N->t2q01-yZGz_2+Yh
zt1t5{PB>?Ee$Azw$#>?w^U3=EBWuTQ_6e)x=1<s`b$5|eg>O#D-ycdf%b9~u=~;=0
zHg5jPuQ+#Exb!V<iwGH$@XPOZD*p=bW4aNyL1${!B{K;}1&?j6$8XNLzwr071*t!5
zGFcazU*GqrfZ^(d_SLiQt7^8~H{Ct0TJXioRq_v{#l%Z}D|^@1&J-(Tii|5tRkJ^s
zn#8%x^O)ONKUTx-)>U86mZ)rADp+3MyE#8POX98_gHC*A++KBO$MsuOd4#>E*QK7=
z_WVrqD~a77S$}XXcXDpc<P^W_?)T5Es$5-ge-X#+Inf>*({?4fF1uT?RN?M3)#|(L
z%8XCB=ce!Z@u9b(=Y^?v#=m{P7~l5zsvN5B*t)gseaViiqF2_3lshOXZ(E&mpGW@i
zzxbcet^cXV`0th3vggZcRW-JTjqX!-xQX{MOX_;@8!NE!t(1Ond;jdZNe_PI+;^z!
zxYH%5zMS8=Z$-?8le-0i-~3Kbxje08^ZCBq@IUJXt{q!bnkMVpaJ~EQbbY;m)AEn~
z57uw%Z?^krv^K@VjcHBhYR5bJJ^P-8%nr$#Uj5gQlY3e5zAu;LrkLBlV)|7vnZw3m
z%V`4+={hN<)ACLG3nbb$uG1@FxhweC;@oWGgyrvNKe?rL`?J{nhrfUJTP)gFaQu$j
z5ht^P$$I*Q=l_ZoJl^t8_KZi^W)9bw!1nBvU0NEfztSFG-7tske4bncSJ8{W`LZ7;
z-g?~|_WHL}Pr*{<-8tq4IT9L?OM)3EHrU*}>8rV?XTe3O#O-WF{Ret`mWQc@@Lt=c
zULJWiTe>c<^WovP5{nt)ya|@+!MA@X8?*c}nQZ!EmS^&JyL&G^Hl055Cc-C>@yU<s
zxVWQTvL_j|--JXRd!c;d@QO&K7!}V?oWaq{3)=Y$dfxKi-n3}hjY?53U8~&qS<Xu@
zJc?mfa-a7uyFTfoFqaUMrHik^?l<Wgv98}g&A4N-XXmYx^-|NdoO?JrovS9ET|7bS
z&Y!Mp3vbpiX|LaZ=Avlrg_qwyoD*zbyl2POOA00dD>WC}8LTd0yK1#(#@*HL&GjDW
zpOVjBcQ@v|XiCbGi5I^3EIYJLG2~#k?8!QY_5PmMvaP-?-n#M43=`LP*LbuHxK<gM
z2GzN!$qRJ+4Jxcl?0Q_-TNnQHh2)#$oeV2%H=CP_?D=n!J%=M-((ka^Rvw;f{s}6Z
z--)E8b%xe{R^+eQrnyFIyV6=Vg@b9UyVg9N6vlS=yu@>tge<<&XkiEaxl{C~xZ2d7
z?9jMkYHOvccxcLcj_pYa>fsX0o+YKtQ`6ZnsV|pP=;G~<ohn)K4q}V81}?eiSbFx|
z0Y6R)TQ_^tl0&b5ma><x%>29a@`dx?VgtWFKcC3%ba>ay#UeF(CeED^B`$StiQaLk
zi(Ce+dp2#dFD`AJF;7#l_x<L=fPi}m^K;H^x$#!UtNi!d&prQpe*LjIXz=v>jo3#E
z7(*}ald#C{58HY~%l7*9&hxB0-ToiE`?6?F{1fvn4)e2fZhzAF6>D<Ubfc%hp`a^b
zrN*;w<kzaiJ$W%#)a%iLS$#LM;@`5R85zF&l*k@_%=~rRB}qQdrqaEJkC%krljuL4
zIQwJcQNK+6kd|8Q1u6O!*0)Y5@Bhm2;z_}Q8*dKTS{hqS{Mc99zDlfdrTH}3ZwL7{
z>BQ|1e{t<hpx2k>k`p*qsEHT|8(;U_(>S@f{rjYRiSAlf4%xXL8aK|p6e;TWEnyTt
zbG*Jib?us0hY#EgmymtvbJ6kLqa|Y3T~2>E63xF;V=4nPm-8{R;HZ=dUlQEKHAN?Q
zf36K!#udEjO^}UI^6j3jHyJO-r6_%zaqtdnzj@n?%ZC^mw)tqYTde=md34)>j$l`*
z{9>ths`WWnFGsEHzN<cG<wNUh>mNL>yuI#GUhvY*;g6Q+SIPQ|v7GF@qB*Ul;rkz_
zzjeC<=Iu%Q!+5DCY@Mc#Qjf}e|D#v)eO8D0v~|0xMK?*6G|lpw_%v-htKY;`aUbq~
zYI|1wIw!sCnBA($!QHE@&zoHT`#n4HP|=#j@!ObRXGyaeR)ifB%n3i8m@7FgMa1sp
z!{i^eOU@qmtVriGaFN$37diQ<`r^Nc7fpZPa7S#tZ``%^@rmzQKkvk6t(@bq!DWhC
z=bzo4S1x4jOaH&Xq{GeLY5K8J#pDXntNMlM#?O=Xv`*eOGfVi&-v{&0^xiwVmQ_er
zv*dgQx5eYDCY>UJUYEp_qfdDM>h4&?Y<ybpL-DppY)2(*{q1M1w`k65bU%9Axv06)
zf5F#pcg*&s7fTz>wpv&4WdFt`;%|RF5(%G?Vf=Qt`R3alj^<VA69Q+Zn`ZPR+WpSY
zzsBXeCTfTJYq46F&8fK=mC5J4M2x0incey&K>x(oI#KDTHn+FWliTm6f7e-b<(uPK
z%eH7qdW41PrES+xZMrifm3c<z=P&$at9qi|NwNq`=9<)R^1kNimH%nqXTDn|p!bmX
z^=82j)nX-e$?e<Np1gi5uruLmhtgqBu^+O%Gb)vLaYvfPU)NvRm?FOVz%ScAInLGU
zA`x5i4y?U;QrAY)>Qw*T;1f~z)fW`X+Angsydd*<)-3j{PiHfOB6xOxT|aZjaXB|_
zb^pTP7zx=BkN0y9@?ZX0uJWhQ#ODz2GuPkY+F$prluLZro_T~RuI97AEQg0`tM<-a
zzWk^*&-0v3-`rYu7J2%!>h9UqzO5;*Zrk542lGxS9I%j)Z!(->Qky*K-K-}!xHBex
zc&QRPr>s!lJn1>-YscW--OntPmA08&oG@2L&UN;$s*O^Mgk(Lv@+<EM9y=$+_W6ko
z^GjYcH(vF7EXQAZMo-BwZQhXh`1JO$rECprmxsIDWMi3R=5>`Z-SK>C$$kNolwan*
za-)hH4K!ZIm}ISrI$YJnC6QTw;+1wxW?I&yjd>1ovP&kts7P3*rdl&ma3Xh97*B{}
zt7Q5ru@`gBdlcN?s`Yfra`vbG^A)f1M6z<Q-FPkbFz2+)lG^flF;_OGz7W`=G~wi#
z-u8KF$M&5z+-}sijx})3jEM%>c84cRmMUGjX7DZV()>yHdq2m|G=99)^o*+YLiyk|
z!7b+N9ejS4p6$HZwEuSR`W5^yEu|{_17m&8GQ=NzaC7o;v5&tO{z!@0vd@cg2lI#0
zm!il2iYxlPW`BOe*QI#%KEL)X=T+QmkHs}@aGQOpv4~UJCWA}YEnjX&Xw}qhd#vW}
zzch1#J*%8+GSAv*^Y-$~vMXo*nip_s|1Dv+pL>^-StxOpOlNg|zUM*GyYlIeeYP#!
zF{LO<pLc@H>3RAo23s_^+t;{ltY4V2GduXLtouf`wyaeJzh1HxDW0o|sZ-*;krMhO
zJ^uXV<~v)M9zA1q=KI4@#Fd#?u=>{8jQL)d@>;HozIoapr75Zs&XQ2ay)S-SjpF)E
z?_7?GUYjA1vF5b)TfIOd7YozJEpmTe?bw$V`2Nuovkm`O>K=(Yx8ZURw?oDG{}mk%
zz8k;gY5kTkliwxj&K1cSHEuOd^TQVV<#|mLjBZz%@>p6q;@JV4Z3iy@xq3iAJ!RIK
z$Ss#%uBlkH>X1pmq;<=p)z9k**(c49N|t?oK)0~9Z?2}F#uV8CyOqcJdRKcMvOlF*
z?DuEKy#EzVK1$|aA3V8eUHk0q;r*xo-Pq|??XgrUsHu(DrE;^NHQR$PcV+f$`#4*V
zLB>^`w{Pw}Y00ZQ&6fnIo)y)r=jt$3>Q2^B6LRb^Ssl$}UCwW>cj$$OJ==@Jyj&9c
zzb9lU%L+D$&v7t1`{es~kF6plflK&0JZxD$A3FI{FL%Wh`M8(uyb8~%JG*ztZN9T)
zQs|~P8~@&XQTcRIp7jC2Szq^69M!q<|L0Bv1$o}rwafIjRo~jMurPD~qb+~`H_r5Q
zSXS`b^hQELjgaF8vr0q1N~>>re6NkBWcJM2r1tL#L(c5!My3T}2}+qC9gE&g3p#JT
zCotD$wnVqfr|A~2J9)OORBhPvX0k4;@TtWyEq^B%%$j4F&Q;(r+b3OhbKyn7NPXkR
z|GIOcWg}KB;=Fp#$tzdlS-`Iidk=gUX}-CHtGrF|Q;D@}zL(I{+28K<ca%Sp$@?T1
z>AR1W_oD7Wd%p(O#C^<*pB%iHlbFolqR_;1NFj8s&@01rp3^vf@8qp&)L^TamuA5D
zN8z6OrzP6vd?ymKsuM!9uI#w~cK6ODZQdO0SwT7}>1X!e*;Mgza+c>>r+weA^Igv~
z?|3OOL*T!^mGs+BJ=OoDcIpP6{Sn*C>>yDPbg;(!?Z>*gK5M>*%;0bm)Y~=n$o9tE
z=KL9Yd%AX69jz}*lP_%Y4AEbF<nxT>4Xb7yU29wv_xQ>O>9<O3t(WraE`;eF{m(7V
zm4C>S!)(qR!-V9&k8H|sER4^V3h6oFVE=y_XWyiwuD`w{PB0Z^2oQa0VHtRjBXQ!R
ztG^0%9ea7_?8!4ie|C6nGq}FU%s=h1dxxLL^U}8PtDHB(>~}1@wzKy1EEzM;jJWVP
zHla7KW#_NhvH4zESH1GSm2>)yz2^(oE0*40QEM&yVqv+ks%5p^)QgAT&;O|u*1I%e
z@xS-dCi7n{RI|$b$tLf|bVbs*Oyhmqquq+TB~1%=m@fapud{1|VdEXeSH3^DtrYM$
z9{VTce&4daN2YsmWqK~(QZn;psL1jZ%gZT62RNq&<+jY#pICa?VYbo&^Lyr3wp3jZ
z&z#;{B64-kf7!D3j|yfN>b>`@jIgMTIRE2GN6p1a`wNbyEMQRI`YW{hN7BKLncrWk
z)H^nxF38P)@<CkV(-xm46K72MFtu){R9*Fz|KC>I{ybyx{Z(T`=aT)qr^=iE%`#+W
z<~w`;?#C~u4}WYr`tV}7c=*P&r<*IbzGB&b^hx4`mmDW`k18GeldN4IaKEoAYk}Fq
zVn4HlKj|w@hA)}LwsoI*lBV?5?F+7j9r5=6sdaU0$yuii-~2YQ{Dh#2OS5kA?qD^3
zAnLMRP4n4lZo%)VGg6xZKPaC&@@@XS_FGZAPjsAZ?1^7JD^#y2#@*bs^^3r_XB$lP
ze6y!}%C6sdd41HWt&GX1Hw&%fD!8pTKd!)Y>zdpo(G6Grtz=4HQ}`?_^}&tTj0`$&
zQ`Wz`e(;*7VB*)V^mS2I&$_RR*{SfTcg;E3>(o4d2j`hBMM{f<{KVdbe9$O#KYiFF
zrlcwMK&SjFor2Q)<vaXmAIZvia^&X4m`Ij`3h!QMJ#5X{qjccN-^c0Ck{^EN5;MQi
z{l_lioui=A$(u{={ocu7_wHUL&&G}`qR+R>aIAa0<7WMewa@fYr>WhXn-cbyz4O3=
z$CHf@xi+f)dY`8J_|&-zJJ)M+o$)fLOv{ZdYE*yz@DP`Z=hmp??!8T4yu%OvN{Fr8
zdr0j2o^o01q#1gVH^17fdhnZZb4u<^)hyNLwGYcR%+4;3{8V`8!K|A<+D-_qOxyXv
zmg!aDiYXU_Cs)SCc1fiyP_>`uB|2?RVdzZDqhZ!7`tqa;^vzbM|Ju~XV|7Ke?Hr?7
z!on9f^_TB6&rb<0@c$lDzh&Ms2j8;u&rkk$-|zZuiL%q{H=pZ#94}woyunmTb=lY3
sS0<$yJ$9e5T5pZ=lqZZwc6y3#k)2+`x%j8-`W`z;eaF6n?R#bd07s)g(f|Me

literal 0
HcmV?d00001

diff --git a/secrets/slskd_env.age b/secrets/slskd_env.age
new file mode 100644
index 0000000000000000000000000000000000000000..0900a5791232f4d2c866b856f2282fdbd4a69edd
GIT binary patch
literal 369
zcmZQ@_Y83kiVO&0NcKu=iAs6@%keUAzqDjtY)sJZWj%t@HP-*LE0Rw$>i4D{;AwK@
zKYF3<um^9>#a}ZXm`Ays_WL9iEBo?6uG`II@qncLkDfY~`(@nP@cP?q2dyVX&S^zq
z>#i!?FP^bnusTjYDEP0$C83koo7Q_jkma^Kl>10Q=V|+Pu0_*ctoN9*xZ~lm$A#Ne
zFCWqDNh_V0U66M=bxXa0L-%G`euWyl@PF?<m^<Vfc`&cdY(Ji^YVeck&T99zEWW5V
z^*<%b)luK3_@_Qrxu)G9bG}xmYtxda(%a&uMS2|2xnr19S*&+b@Xee5KY4hw#Wg~D
zYyJPLbDz61|M}@-2kx}l$e8jxlTqXPTNl%F$~jIfR&>_;Hw(J&PnEuz?`E@Uah#uR
zQJvz2zmis>mkbR<zdxQD5kKqv?FIkJ*#BJMZ#d;DCYN!2x~-0<+52**gV!1FzdZZ(
eq=WY62b<Fuo=7pgv9s3w!0UoLS8my-@&f?C@3XW3

literal 0
HcmV?d00001

diff --git a/secrets/wg0.conf b/secrets/wg0.conf
deleted file mode 100644
index 0707030259b7c6b4ece89a5c38ad5c3ed60ef142..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 314
zcmZQ@_Y83kiVO&0_>(@5p)OQT<lDoaGxbdVFRfCl317}RqkDfQfAB7WuTojX^&ake
z8^e{@lOIiMQr6wdv-#y&VZES?6fcpZ4BOI|zvPR^Y5kLYyGQS>!jn1a(}I}OStL>)
zPi^o!6zt%sdy?(0<HoAGvy(J7<%I@C=RcVI`tE|Jz>N<l{@JjZ>1IH&^<$qO)=X0}
z+W$>Zt8b6;-8(NP*)8SQwEEM^F2_3CS=Ej9*sP45W|`h&_^6{+bTWs=e6<-z|HfV`
zoW5b(1GkcSW{-`hADObWb-v-!ZyqMgU9Ydn&@FXYw0`#f-)=L{ePY^ldH%y&+xK6Y
za<#l!_Hq8#+q2%<mv*h5?x1$^*;m(C^Qn7y!XEy*6uUuPEkM6p+pA)W{)O4EwPbn1
a{LeDheY_rh?EdKu!fs2~Zmv0!ZwLTn2%4Ax

diff --git a/secrets/wg0.conf.age b/secrets/wg0.conf.age
new file mode 100644
index 0000000000000000000000000000000000000000..0e20308440e7d2ccd4217901388b07f9c1b031c1
GIT binary patch
literal 526
zcmZQ@_Y83kiVO&0n9R|&amkG(3^NLLJb1d>`s|*JkM2S%dNoeX+snCU#pxGk8~avm
zRu$Pg?ci?-XWrveS4UjDFpb;!>i1QS(F@WR@eAIwH!5DP&h=gUdhiUXj1<WO+@F~8
z-c*Ka7p^#wt9V^~MSQ}WDW(dQD)+1UKeVr#E}QUFeLnBKFKex4HM$ynjyO5JVVBvH
zZOvQTI({iiGL_lJ?^IZO>J012CE<}j)gNoWWSg8ik@={DqC-$<#nH33WS$-g?Nd;5
z`T6(He4ezTPPUrW4`2Ei+fTne@AaFQ^4}ekL}wSMy_1rc4;9(wb$;ER2Y$}m`@7RP
zj%$ZFhFt0SoiNR`V`)Y2tKM$mNW0CJJ6<fD*z9JVcuUg0q)ftw{kKAIjg;tyOFg%C
z&tK##vzO(YNqW<1cMrC<#w%|Z@>k1DO^Mdpe&eI}!)aSpkG?!SS^JYf!oJGYk>L&#
zxwPzW^p(lK-fMH|efQO+R)_Md_WfZ$>bQAx!tEa4O;($)$A3I9kC{8F<qq>}ZJX8Q
za?hL(xfmJ7t@ZwDzbouV`oo`=EfNm)CLG)^yI!!c@y<Wf?pJ5O^oGgoIa}|4-`T>d
z^P7F%Ch1e374u&oX$g71tE_O+)!nt*xGV3e6wWaUsAt~SmECv0epQ~awcv`q3$yzD
px~=jL)tbDD%g?FW*s9NVXwl)uXICerow=hpySQ<2y~>RDQ2=Wf1vdZy

literal 0
HcmV?d00001

diff --git a/secrets/zfs-key b/secrets/zfs-key
deleted file mode 100644
index 35c226ca6a103c08dc5a1eac710b115d11661f17..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 54
zcmZQ@_Y83kiVO&0$dsAJ>AfhyekHr^{=JN%av`rGmeg&u&tICYD5!U1a&+s-gB;xs
K=Gqx2Dg^-et`q(M

diff --git a/secrets/zfs-key.age b/secrets/zfs-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..3682980b6c8155c0634470b761244038c87241e4
GIT binary patch
literal 266
zcmZQ@_Y83kiVO&0*x9mvYUY{j$y0vjUlmRl?BZX3?10=ymA}Tn9>*NMXwz$Pg85@e
zokQV;>lr(}r|#o@ek&mEg3xlt&fB5w*-XW!7#ox4DCe0pTs?ix<z4QUCx)zR@`3~<
zdavA?vS)kDrx!Z~ecQgd+V=du)Doolim@-$jZ1O)`!>(VvBnwoT?-|rX!c4U7hI=5
z?Sb&-+A9JjTtc@u-aj?VuD;;2oqM@>f69!4#Rnw+C@OvYFkiT3k{z$${os^aQ~MNq
zJQv^G{EzdOPPgyU%f34Q>}~(KxOC*mO_DaBF-J^omV>Ndvt95XfrPjjCtpt&ZMZ2C
adAGrAaYy_ovrp$vNPT?ju7AvI+cy9KeSrS}

literal 0
HcmV?d00001

diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index cebecc6..9d03a74 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -25,7 +25,7 @@
   };
 
   services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
-    ${builtins.readFile ../secrets/caddy_auth}
+    import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
   '';
 }
diff --git a/services/caddy.nix b/services/caddy.nix
index 9e5869c..d0e5c9c 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -66,6 +66,12 @@ in
     };
   };
 
+  # Add agenix dependency for caddy service
+  systemd.services.caddy = {
+    after = [ "agenix.service" ];
+    requires = [ "agenix.service" ];
+  };
+
   systemd.tmpfiles.rules = [
     "d ${config.services.caddy.dataDir} 700 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 8c8256c..9a57449 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -37,7 +37,7 @@
   systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
 
   services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
-    ${builtins.readFile ../secrets/caddy_auth}
+    import ${config.age.secrets.caddy_auth.path}
     reverse_proxy :${builtins.toString config.services.llama-cpp.port}
   '';
 }
diff --git a/services/matrix.nix b/services/matrix.nix
deleted file mode 100644
index dee5cb4..0000000
--- a/services/matrix.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  pkgs,
-  config,
-  service_configs,
-  lib,
-  ...
-}:
-{
-  services.matrix-conduit.settings.global.registration_token =
-    builtins.readFile ../secrets/matrix_reg_token;
-
-  services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
-    header /.well-known/matrix/* Content-Type application/json
-    header /.well-known/matrix/* Access-Control-Allow-Origin *
-    respond /.well-known/matrix/server `{"m.server": "${service_configs.https.matrix_hostname}:${service_configs.ports.https}"}`
-    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.https.matrix_hostname}"},"m.homeserver":{"base_url":"https://${service_configs.https.matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
-  '';
-
-  services.caddy.virtualHosts."${service_configs.https.matrix_hostname}".extraConfig = ''
-    reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
-  '';
-
-  # Exact duplicate
-  services.caddy.virtualHosts."${service_configs.https.matrix_hostname}:8448".extraConfig =
-    config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
-    }".extraConfig;
-
-  services.matrix-conduit = {
-    enable = true;
-    package = pkgs.conduwuit;
-
-    settings.global = {
-      port = 6167;
-      server_name = service_configs.https.domain;
-      database_backend = "rocksdb";
-      allow_registration = true;
-
-      new_user_displayname_suffix = "";
-
-      trusted_servers = [
-        "matrix.org"
-        "constellatory.net"
-        "tchncs.de"
-        "envs.net"
-      ];
-
-      # without this, conduit fails to start
-      address = "0.0.0.0";
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "Z /var/lib/private/matrix-conduit 0770 conduit conduit"
-  ];
-
-  # for federation
-  networking.firewall.allowedTCPPorts = [
-    8448
-  ];
-
-  # for federation
-  networking.firewall.allowedUDPPorts = [
-    8448
-  ];
-}
diff --git a/services/owntracks.nix b/services/owntracks.nix
deleted file mode 100644
index b5734ac..0000000
--- a/services/owntracks.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  pkgs,
-  service_configs,
-  username,
-  ...
-}:
-let
-  owntracks_pkg = pkgs.owntracks-recorder.overrideAttrs (old: {
-    installPhase = old.installPhase + ''
-      mkdir -p $out/usr/share/ot-recorder
-      cp -R docroot/* $out/usr/share/ot-recorder'';
-  });
-in
-{
-  users.groups.owntracks = { };
-  users.users.owntracks = {
-    isNormalUser = true;
-    group = "owntracks";
-  };
-
-  systemd.services.owntracks = {
-    enable = true;
-    description = "Store and access data published by OwnTracks apps";
-    wantedBy = [ "multi-user.target" ];
-
-    serviceConfig = {
-      User = "owntracks";
-      Group = "owntracks";
-      WorkingDirectory = "${owntracks_pkg}";
-      ExecStart = "${owntracks_pkg}/bin/ot-recorder -S ${service_configs.owntracks.data_dir} --doc-root usr/share/ot-recorder --http-port ${builtins.toString service_configs.ports.owntracks} --port 0";
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "Z ${service_configs.owntracks.data_dir} 0770 owntracks owntracks"
-  ];
-
-  services.caddy.virtualHosts."owntracks.${service_configs.https.domain}".extraConfig = ''
-    ${builtins.readFile ../secrets/owntracks_caddy_auth}
-    reverse_proxy :${builtins.toString service_configs.ports.owntracks}
-  '';
-
-  users.users.${username}.extraGroups = [
-    "owntracks"
-  ];
-}
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4135629..e7d6ba3 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -102,7 +102,7 @@
   ];
 
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
-    ${builtins.readFile ../secrets/caddy_auth}
+    import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
   '';
 
diff --git a/services/soulseek.nix b/services/soulseek.nix
index b6c42c6..8795687 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -26,7 +26,7 @@ in
     "skskd_env".text = ''
       #!/bin/sh
       rm -fr ${slskd_env} || true
-      cp ${../secrets/slskd_env} ${slskd_env}
+      cp ${config.age.secrets.slskd_env.path} ${slskd_env}
       chmod 0500 ${slskd_env}
       chown ${config.services.slskd.user}:${config.services.slskd.group} ${slskd_env}
     '';
@@ -67,6 +67,12 @@ in
   users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
   users.users.${username}.extraGroups = [ "music" ];
 
+  # Add agenix dependencies for slskd service
+  systemd.services.slskd = {
+    after = [ "agenix.service" ];
+    requires = [ "agenix.service" ];
+  };
+
   systemd.tmpfiles.rules = [
     "Z ${service_configs.music_dir} 0750 ${username} music"
     "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
diff --git a/services/wg.nix b/services/wg.nix
index 36c363e..1e9d7f5 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -2,13 +2,14 @@
   pkgs,
   service_configs,
   eth_interface,
+  config,
   ...
 }:
 {
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     enable = true;
-    wireguardConfigFile = ../secrets/wg0.conf;
+    wireguardConfigFile = config.age.secrets.wg0-conf.path;
     accessibleFrom = [
       # "192.168.0.0/24"
     ];
@@ -20,13 +21,15 @@
       "network.target"
       "jellyfin.service"
       "qbittorrent.service"
+      "agenix.service"
     ];
+    requires = [ "agenix.service" ];
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
       Type = "simple";
       ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
-        export JELLYFIN_API_KEY=$(cat ${../secrets/jellyfin-api-key})
+        export JELLYFIN_API_KEY=$(cat ${config.age.secrets.jellyfin-api-key.path})
         exec ${
           pkgs.python3.withPackages (ps: with ps; [ requests ])
         }/bin/python ${./jellyfin-qbittorrent-monitor.py}
diff --git a/usb-secrets.nix b/usb-secrets.nix
new file mode 100644
index 0000000..07f8a4a
--- /dev/null
+++ b/usb-secrets.nix
@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  # Extract USB secrets key in main system before agenix
+  systemd.services.usb-secrets = {
+    description = "Extract USB secrets key";
+    wantedBy = [ "sysinit.target" ];
+    before = [ "agenix.service" ];
+    wants = [ "local-fs.target" ];
+    after = [ "local-fs.target" ];
+    unitConfig.DefaultDependencies = false;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      mkdir -p /run/secrets /mnt/usb
+
+      # Check if key already exists
+      if [ -f /run/secrets/usb-secrets-key ]; then
+        echo "USB secrets key already loaded"
+        exit 0
+      fi
+
+      # Wait for USB devices
+      for i in {1..30}; do
+        [ -e /dev/disk/by-label/SECRETS ] && break
+        sleep 1
+      done
+
+      # Mount USB and copy key
+      if mount /dev/disk/by-label/SECRETS /mnt/usb 2>/dev/null; then
+        if [ -f /mnt/usb/usb-secrets-key ]; then
+          install -m 600 /mnt/usb/usb-secrets-key /run/secrets/usb-secrets-key
+          umount /mnt/usb
+          echo "USB secrets key loaded"
+        else
+          umount /mnt/usb
+          echo "Key file not found"
+          exit 1
+        fi
+      else
+        echo "USB not found"
+        exit 1
+      fi
+    '';
+  };
+
+  age.identityPaths = [ "/run/secrets/usb-secrets-key" ];
+
+  systemd.tmpfiles.rules = [
+    "d /run/secrets 0700 root root -"
+  ];
+}
\ No newline at end of file
diff --git a/usb-secrets/setup-usb.sh b/usb-secrets/setup-usb.sh
new file mode 100755
index 0000000..67e38ef
--- /dev/null
+++ b/usb-secrets/setup-usb.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p parted dosfstools
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "$(realpath "$0")")"
+USB_DEVICE="$1"
+if [[ -z "${USB_DEVICE:-}" ]]; then
+    echo "Usage: $0 <usb_device>"
+    echo "Example: $0 /dev/sdb"
+    exit 1
+fi
+
+if [[ ! -b "$USB_DEVICE" ]]; then
+    echo "Error: $USB_DEVICE is not a block device"
+    exit 1
+fi
+
+if [[ ! -f "$SCRIPT_DIR/usb-secrets/usb-secrets-key" ]]; then
+    echo "Error: usb-secrets-key not found at $SCRIPT_DIR/usb-secrets/usb-secrets-key"
+    exit 1
+fi
+
+echo "WARNING: This will completely wipe $USB_DEVICE"
+echo "Press Ctrl+C to abort, or Enter to continue..."
+read
+
+echo "Creating partition and formatting as FAT32..."
+parted -s "$USB_DEVICE" mklabel msdos
+parted -s "$USB_DEVICE" mkpart primary fat32 0% 100%
+parted -s "$USB_DEVICE" set 1 boot on
+
+USB_PARTITION="${USB_DEVICE}1"
+mkfs.fat -F 32 -n "SECRETS" "$USB_PARTITION"
+
+echo "Copying key to USB..."
+MOUNT_POINT=$(mktemp -d)
+trap "umount $MOUNT_POINT 2>/dev/null || true; rmdir $MOUNT_POINT" EXIT
+
+mount "$USB_PARTITION" "$MOUNT_POINT"
+cp "$SCRIPT_DIR/usb-secrets/usb-secrets-key" "$MOUNT_POINT/"
+umount "$MOUNT_POINT"
+
+echo "USB setup complete! Label: SECRETS"
+echo "Create multiple backup USB keys for redundancy."
\ No newline at end of file
diff --git a/usb-secrets/usb-secrets/usb-secrets-key b/usb-secrets/usb-secrets/usb-secrets-key
new file mode 100644
index 0000000000000000000000000000000000000000..7f7eed7a083d81b1a3bd43e9d82fb395844b5b90
GIT binary patch
literal 441
zcmZQ@_Y83kiVO&0@HwzBexi+2a#;M_H(XZQ(H>84?K`uRtG9E~&STlv=E!gDD|^zU
z6y+@&wr|7r74P+?zFN%57wu|gtJlkteD2JZ(mAhhdj6Wcu<8z%a&ga;8M|Jdj+lJO
zVqJUo^u&j6g4*IOW_85<Tj*D{;+Mkx({8%w9P1i6&rbVt*YMFHlY1YE_%>);`~S9R
zyj8KkMB+*ON^M(*y?INQWG_DFQ|{QEJmGJYWN|`X{$96P;))?VCq3EY@%ux+$JV>2
zmYy*-WH`c;D&Z1(sdjq4L3ovP;-PlV^nUe}t>U(xE$uUQ@a=KnPIByLKW;6j`6JGp
zQ~Ksp4UK-AV#fD99!Kvk&i^MQV6M&QS>|;l-B0m=NX}zT9Rs`5vJKs~LT^qe2Tz+<
zbSBJ6;P0J@9R7kgRTik~X<hc4QndW<s?HLlZ6DHdZf=<QXzO<|E^X#K#hm^Xcbhtc
z7Vlp6RyWQ!^+wT==3h?RlA?`oYJKWHaQBCuyc>hcqcsz@b3Ikydlhvi?%V~g7>BB&
zg+k6}%5z=Y&fH{YKExkq-`4Ot&E)BnCju9jhpgkh+0cDi)nm=RGGC^1QPa*%`vL&X
CG1IdE

literal 0
HcmV?d00001

diff --git a/usb-secrets/usb-secrets/usb-secrets-key.pub b/usb-secrets/usb-secrets/usb-secrets-key.pub
new file mode 100644
index 0000000..f6df05a
--- /dev/null
+++ b/usb-secrets/usb-secrets/usb-secrets-key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key
diff --git a/zfs.nix b/zfs.nix
index 8e5dbe9..abec78f 100644
--- a/zfs.nix
+++ b/zfs.nix
@@ -1,4 +1,5 @@
 {
+  config,
   service_configs,
   pkgs,
   ...
@@ -10,13 +11,14 @@ let
 in
 {
   system.activationScripts = {
-    # TODO! replace with proper secrets management
+    # Copy decrypted ZFS key from agenix to expected location
+    # /etc is on tmpfs due to impermanence, so no persistent storage risk
     "zfs-key".text = ''
       #!/bin/sh
-      rm -fr ${zfs-key} || true
-      cp ${./secrets/zfs-key} ${zfs-key}
-      chmod 0500 ${zfs-key}
-      chown root:wheel ${zfs-key}
+      rm -f ${zfs-key} || true
+      cp ${config.age.secrets.zfs-key.path} ${zfs-key}
+      chmod 0400 ${zfs-key}
+      chown root:root ${zfs-key}
     '';
   };
 

From 580a8aafac7758bf1c77f035671c8a427a6318bc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 22:28:02 -0400
Subject: [PATCH 432/847] fix script

---
 usb-secrets.nix | 39 +++++++++++++++++++++++++++++++--------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/usb-secrets.nix b/usb-secrets.nix
index 07f8a4a..5d7c47a 100644
--- a/usb-secrets.nix
+++ b/usb-secrets.nix
@@ -5,13 +5,18 @@
   ...
 }:
 {
+  systemd.services.agenix-install-secrets.after = [ "usb-secrets.service" ];
+
   # Extract USB secrets key in main system before agenix
   systemd.services.usb-secrets = {
     description = "Extract USB secrets key";
     wantedBy = [ "sysinit.target" ];
-    before = [ "agenix.service" ];
+    before = [ "sysinit.target" ];
     wants = [ "local-fs.target" ];
-    after = [ "local-fs.target" ];
+    after = [
+      "local-fs.target"
+      "systemd-udev-settle.service"
+    ];
     unitConfig.DefaultDependencies = false;
     serviceConfig = {
       Type = "oneshot";
@@ -27,19 +32,37 @@
       fi
 
       # Wait for USB devices
+      echo "Waiting for USB device /dev/disk/by-label/SECRETS..."
       for i in {1..30}; do
-        [ -e /dev/disk/by-label/SECRETS ] && break
+        if [ -e /dev/disk/by-label/SECRETS ]; then
+          echo "USB device found after $i seconds"
+          break
+        fi
+        echo "Attempt $i: USB device not found, waiting..."
         sleep 1
       done
 
+      if [ ! -e /dev/disk/by-label/SECRETS ]; then
+        echo "ERROR: USB device /dev/disk/by-label/SECRETS not found after 30 seconds"
+        echo "Available devices:"
+        ls -la /dev/disk/by-label/ || true
+        exit 1
+      fi
+
+      # Give device a moment to be fully ready for mounting
+      echo "Device found, waiting 2 seconds for device to be ready..."
+      sleep 2
+
       # Mount USB and copy key
-      if mount /dev/disk/by-label/SECRETS /mnt/usb 2>/dev/null; then
+      echo "Attempting to mount /dev/disk/by-label/SECRETS to /mnt/usb..."
+      if ${pkgs.util-linux}/bin/mount /dev/disk/by-label/SECRETS /mnt/usb; then
+        echo "Mount successful"
         if [ -f /mnt/usb/usb-secrets-key ]; then
-          install -m 600 /mnt/usb/usb-secrets-key /run/secrets/usb-secrets-key
-          umount /mnt/usb
+          ${pkgs.coreutils}/bin/install -m 600 /mnt/usb/usb-secrets-key /run/secrets/usb-secrets-key
+          ${pkgs.util-linux}/bin/umount /mnt/usb
           echo "USB secrets key loaded"
         else
-          umount /mnt/usb
+          ${pkgs.util-linux}/bin/umount /mnt/usb
           echo "Key file not found"
           exit 1
         fi
@@ -55,4 +78,4 @@
   systemd.tmpfiles.rules = [
     "d /run/secrets 0700 root root -"
   ];
-}
\ No newline at end of file
+}

From 8fed1c19b61bb188601c896210cd758773194d17 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 22:34:35 -0400
Subject: [PATCH 433/847] remove service that doesn't exist

---
 usb-secrets.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/usb-secrets.nix b/usb-secrets.nix
index 5d7c47a..4c11837 100644
--- a/usb-secrets.nix
+++ b/usb-secrets.nix
@@ -5,8 +5,6 @@
   ...
 }:
 {
-  systemd.services.agenix-install-secrets.after = [ "usb-secrets.service" ];
-
   # Extract USB secrets key in main system before agenix
   systemd.services.usb-secrets = {
     description = "Extract USB secrets key";

From 3edf345faa7ff3bf85474bdb4368c7d96d6d2306 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 22:34:52 -0400
Subject: [PATCH 434/847] remove various references to ${username}

---
 home.nix                 | 1 -
 services/caddy.nix       | 5 -----
 services/gitea.nix       | 5 -----
 services/immich.nix      | 5 -----
 services/jellyfin.nix    | 5 -----
 services/minecraft.nix   | 1 -
 services/postgresql.nix  | 5 -----
 services/qbittorrent.nix | 1 -
 8 files changed, 28 deletions(-)

diff --git a/home.nix b/home.nix
index 050e42d..cb59b11 100644
--- a/home.nix
+++ b/home.nix
@@ -1,6 +1,5 @@
 {
   pkgs,
-  username,
   lib,
   ...
 }:
diff --git a/services/caddy.nix b/services/caddy.nix
index d0e5c9c..9fd0f32 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -1,7 +1,6 @@
 {
   config,
   service_configs,
-  username,
   pkgs,
   lib,
   inputs,
@@ -88,8 +87,4 @@ in
   networking.firewall.allowedUDPPorts = [
     service_configs.ports.https
   ];
-
-  users.users.${username}.extraGroups = [
-    config.services.caddy.group
-  ];
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index 38cfc78..dd9f8d5 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -3,7 +3,6 @@
   lib,
   config,
   service_configs,
-  username,
   ...
 }:
 {
@@ -60,8 +59,4 @@
   };
 
   services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
-
-  users.users.${username}.extraGroups = [
-    config.services.gitea.group
-  ];
 }
diff --git a/services/immich.nix b/services/immich.nix
index cd0c863..183b0d4 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -2,7 +2,6 @@
   service_configs,
   pkgs,
   config,
-  username,
   lib,
   ...
 }:
@@ -41,8 +40,4 @@
     "video"
     "render"
   ];
-
-  users.users.${username}.extraGroups = [
-    config.services.immich.group
-  ];
 }
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 4e715e9..e27e50b 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   service_configs,
-  username,
   lib,
   ...
 }:
@@ -41,8 +40,4 @@
     "render"
     service_configs.media_group
   ];
-
-  users.users.${username}.extraGroups = [
-    config.services.jellyfin.group
-  ];
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index c66dc41..8485d40 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -2,7 +2,6 @@
   pkgs,
   service_configs,
   lib,
-  username,
   config,
   ...
 }:
diff --git a/services/postgresql.nix b/services/postgresql.nix
index bab8ef9..b773a60 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -1,7 +1,6 @@
 {
   pkgs,
   config,
-  username,
   service_configs,
   lib,
   ...
@@ -22,8 +21,4 @@
     # postgresql requires 0700
     "Z ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
   ];
-
-  users.users.${username}.extraGroups = [
-    "postgresql"
-  ];
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index e7d6ba3..10cf619 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -2,7 +2,6 @@
   pkgs,
   config,
   service_configs,
-  username,
   lib,
   inputs,
   ...

From ea031349f82f549314e652f07a23ef63674d448a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 22:55:02 -0400
Subject: [PATCH 435/847] use filesystems logic

---
 usb-secrets.nix | 73 +++++--------------------------------------------
 1 file changed, 7 insertions(+), 66 deletions(-)

diff --git a/usb-secrets.nix b/usb-secrets.nix
index 4c11837..b3082d0 100644
--- a/usb-secrets.nix
+++ b/usb-secrets.nix
@@ -5,75 +5,16 @@
   ...
 }:
 {
-  # Extract USB secrets key in main system before agenix
-  systemd.services.usb-secrets = {
-    description = "Extract USB secrets key";
-    wantedBy = [ "sysinit.target" ];
-    before = [ "sysinit.target" ];
-    wants = [ "local-fs.target" ];
-    after = [
-      "local-fs.target"
-      "systemd-udev-settle.service"
-    ];
-    unitConfig.DefaultDependencies = false;
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      mkdir -p /run/secrets /mnt/usb
-
-      # Check if key already exists
-      if [ -f /run/secrets/usb-secrets-key ]; then
-        echo "USB secrets key already loaded"
-        exit 0
-      fi
-
-      # Wait for USB devices
-      echo "Waiting for USB device /dev/disk/by-label/SECRETS..."
-      for i in {1..30}; do
-        if [ -e /dev/disk/by-label/SECRETS ]; then
-          echo "USB device found after $i seconds"
-          break
-        fi
-        echo "Attempt $i: USB device not found, waiting..."
-        sleep 1
-      done
-
-      if [ ! -e /dev/disk/by-label/SECRETS ]; then
-        echo "ERROR: USB device /dev/disk/by-label/SECRETS not found after 30 seconds"
-        echo "Available devices:"
-        ls -la /dev/disk/by-label/ || true
-        exit 1
-      fi
-
-      # Give device a moment to be fully ready for mounting
-      echo "Device found, waiting 2 seconds for device to be ready..."
-      sleep 2
-
-      # Mount USB and copy key
-      echo "Attempting to mount /dev/disk/by-label/SECRETS to /mnt/usb..."
-      if ${pkgs.util-linux}/bin/mount /dev/disk/by-label/SECRETS /mnt/usb; then
-        echo "Mount successful"
-        if [ -f /mnt/usb/usb-secrets-key ]; then
-          ${pkgs.coreutils}/bin/install -m 600 /mnt/usb/usb-secrets-key /run/secrets/usb-secrets-key
-          ${pkgs.util-linux}/bin/umount /mnt/usb
-          echo "USB secrets key loaded"
-        else
-          ${pkgs.util-linux}/bin/umount /mnt/usb
-          echo "Key file not found"
-          exit 1
-        fi
-      else
-        echo "USB not found"
-        exit 1
-      fi
-    '';
+  # Mount USB secrets drive via fileSystems
+  fileSystems."/mnt/usb-secrets" = {
+    device = "/dev/disk/by-label/SECRETS";
+    fsType = "vfat";
+    options = [ "noauto" "user" "rw" ];
   };
 
-  age.identityPaths = [ "/run/secrets/usb-secrets-key" ];
+  age.identityPaths = [ "/mnt/usb-secrets/usb-secrets-key" ];
 
   systemd.tmpfiles.rules = [
-    "d /run/secrets 0700 root root -"
+    "d /mnt/usb-secrets 0755 root root -"
   ];
 }

From e53518daef20e971977ed57e73877818468e8197 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 23:12:18 -0400
Subject: [PATCH 436/847] fix various agenix things

---
 services/caddy.nix    |  6 ------
 services/soulseek.nix |  6 ------
 services/wg.nix       |  2 --
 usb-secrets.nix       | 12 +++++++-----
 4 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 9fd0f32..53126d3 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -65,12 +65,6 @@ in
     };
   };
 
-  # Add agenix dependency for caddy service
-  systemd.services.caddy = {
-    after = [ "agenix.service" ];
-    requires = [ "agenix.service" ];
-  };
-
   systemd.tmpfiles.rules = [
     "d ${config.services.caddy.dataDir} 700 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 8795687..f936e58 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -67,12 +67,6 @@ in
   users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
   users.users.${username}.extraGroups = [ "music" ];
 
-  # Add agenix dependencies for slskd service
-  systemd.services.slskd = {
-    after = [ "agenix.service" ];
-    requires = [ "agenix.service" ];
-  };
-
   systemd.tmpfiles.rules = [
     "Z ${service_configs.music_dir} 0750 ${username} music"
     "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
diff --git a/services/wg.nix b/services/wg.nix
index 1e9d7f5..9ac529d 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -21,9 +21,7 @@
       "network.target"
       "jellyfin.service"
       "qbittorrent.service"
-      "agenix.service"
     ];
-    requires = [ "agenix.service" ];
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
diff --git a/usb-secrets.nix b/usb-secrets.nix
index b3082d0..b8a8fd6 100644
--- a/usb-secrets.nix
+++ b/usb-secrets.nix
@@ -9,12 +9,14 @@
   fileSystems."/mnt/usb-secrets" = {
     device = "/dev/disk/by-label/SECRETS";
     fsType = "vfat";
-    options = [ "noauto" "user" "rw" ];
+    options = [
+      "ro"
+      "uid=root"
+      "gid=root"
+      "umask=377"
+    ];
+    neededForBoot = true;
   };
 
   age.identityPaths = [ "/mnt/usb-secrets/usb-secrets-key" ];
-
-  systemd.tmpfiles.rules = [
-    "d /mnt/usb-secrets 0755 root root -"
-  ];
 }

From cfe525ff31bf4aba9d2879340c450e23707124d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Oct 2025 23:27:19 -0400
Subject: [PATCH 437/847] fix caddy_auth perms

---
 age-secrets.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/age-secrets.nix b/age-secrets.nix
index 7560906..db2b772 100644
--- a/age-secrets.nix
+++ b/age-secrets.nix
@@ -35,8 +35,8 @@
     caddy_auth = {
       file = ./secrets/caddy_auth.age;
       mode = "0400";
-      owner = "root";
-      group = "root";
+      owner = "caddy";
+      group = "caddy";
     };
 
     jellyfin-api-key = {

From 570db0b9dafa07e0e14d0575bb01242328efeffd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 18 Oct 2025 00:25:15 -0400
Subject: [PATCH 438/847] split up no-rgb and secureboot

---
 configuration.nix | 67 ++---------------------------------------------
 no-rgb.nix        | 49 ++++++++++++++++++++++++++++++++++
 secureboot.nix    | 33 +++++++++++++++++++++++
 3 files changed, 84 insertions(+), 65 deletions(-)
 create mode 100644 no-rgb.nix
 create mode 100644 secureboot.nix

diff --git a/configuration.nix b/configuration.nix
index 815384b..e05d14a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -16,6 +16,8 @@
     ./impermanence.nix
     ./usb-secrets.nix
     ./age-secrets.nix
+    ./secureboot.nix
+    ./no-rgb.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -100,29 +102,6 @@
       compressor = "zstd";
       supportedFilesystems = [ "f2fs" ];
     };
-
-    loader.systemd-boot.enable = lib.mkForce false;
-
-    lanzaboote = {
-      enable = true;
-      # needed to be in `/etc/secureboot` for sbctl to work
-      pkiBundle = "/etc/secureboot";
-    };
-  };
-
-  system.activationScripts = {
-    # extract secureboot keys from agenix-decrypted tar
-    "secureboot-keys" = {
-      deps = [ "agenix" ];
-      text = ''
-        #!/bin/sh
-        rm -fr ${config.boot.lanzaboote.pkiBundle} || true
-        mkdir -p ${config.boot.lanzaboote.pkiBundle}
-        ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
-        chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
-        chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
-      '';
-    };
   };
 
   environment.etc = {
@@ -197,48 +176,6 @@
     libatasmart
   ];
 
-  systemd.services.no-rgb =
-    let
-      no-rgb = (
-        pkgs.writeShellApplication {
-          name = "no-rgb";
-          runtimeInputs = with pkgs; [
-            openrgb
-            coreutils
-            gnugrep
-          ];
-
-          text = ''
-            #!/bin/sh
-            set -e
-
-            NUM_DEVICES=$(openrgb --noautoconnect --list-devices | grep -cE '^[0-9]+: ')
-
-            for i in $(seq 0 $((NUM_DEVICES - 1))); do
-              openrgb --noautoconnect --device "$i" --mode direct --color 000000
-            done
-          '';
-        }
-      );
-    in
-    {
-      description = "disable rgb";
-      serviceConfig = {
-        ExecStart = lib.getExe no-rgb;
-        Type = "oneshot";
-      };
-      wantedBy = [ "multi-user.target" ];
-    };
-
-  services.hardware.openrgb = {
-    enable = true;
-    package = pkgs.openrgb-with-all-plugins;
-    motherboard = "amd";
-  };
-
-  services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
-  hardware.i2c.enable = true;
-
   networking = {
     nameservers = [
       "1.1.1.1"
diff --git a/no-rgb.nix b/no-rgb.nix
new file mode 100644
index 0000000..b304ecf
--- /dev/null
+++ b/no-rgb.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  systemd.services.no-rgb =
+    let
+      no-rgb = (
+        pkgs.writeShellApplication {
+          name = "no-rgb";
+          runtimeInputs = with pkgs; [
+            openrgb
+            coreutils
+            gnugrep
+          ];
+
+          text = ''
+            #!/bin/sh
+            set -e
+
+            NUM_DEVICES=$(openrgb --noautoconnect --list-devices | grep -cE '^[0-9]+: ')
+
+            for i in $(seq 0 $((NUM_DEVICES - 1))); do
+              openrgb --noautoconnect --device "$i" --mode direct --color 000000
+            done
+          '';
+        }
+      );
+    in
+    {
+      description = "disable rgb";
+      serviceConfig = {
+        ExecStart = lib.getExe no-rgb;
+        Type = "oneshot";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+  services.hardware.openrgb = {
+    enable = true;
+    package = pkgs.openrgb-with-all-plugins;
+    motherboard = "amd";
+  };
+
+  services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
+  hardware.i2c.enable = true;
+}
diff --git a/secureboot.nix b/secureboot.nix
new file mode 100644
index 0000000..ac78827
--- /dev/null
+++ b/secureboot.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  boot = {
+    loader.systemd-boot.enable = lib.mkForce false;
+
+    lanzaboote = {
+      enable = true;
+      # needed to be in `/etc/secureboot` for sbctl to work
+      pkiBundle = "/etc/secureboot";
+    };
+
+  };
+  system.activationScripts = {
+    # extract secureboot keys from agenix-decrypted tar
+    "secureboot-keys" = {
+      deps = [ "agenix" ];
+      text = ''
+        #!/bin/sh
+        rm -fr ${config.boot.lanzaboote.pkiBundle} || true
+        mkdir -p ${config.boot.lanzaboote.pkiBundle}
+        ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
+        chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+        chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
+      '';
+    };
+  };
+}

From 27b805d09521d130d801645c9031539c87ff6a56 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 18 Oct 2025 00:26:59 -0400
Subject: [PATCH 439/847] disable flakes (not needed)

---
 configuration.nix | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index e05d14a..2cfab0e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -76,14 +76,6 @@
   nix = {
     # optimize the store
     optimise.automatic = true;
-
-    # enable flakes!
-    settings = {
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-    };
   };
 
   boot = {

From ba1879390748e997cb15ad8985f25cbc628f5226 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 18 Oct 2025 03:10:49 -0400
Subject: [PATCH 440/847] fix jellyfin api key

---
 age-secrets.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/age-secrets.nix b/age-secrets.nix
index db2b772..709c59f 100644
--- a/age-secrets.nix
+++ b/age-secrets.nix
@@ -39,9 +39,10 @@
       group = "caddy";
     };
 
+    # TODO! fix permissions
     jellyfin-api-key = {
       file = ./secrets/jellyfin-api-key.age;
-      mode = "0400";
+      mode = "0444";
       owner = "root";
       group = "root";
     };

From 9238ec3dde783ee2cff37bc7e2bc61b465784e84 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 19 Oct 2025 17:48:17 -0400
Subject: [PATCH 441/847] llama.cpp: disable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 2cfab0e..dc099b5 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -32,7 +32,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
 
     ./services/ups.nix
 

From 1a567cb3032e0f59be632bff2aec374ecb7da191 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 19 Oct 2025 18:03:14 -0400
Subject: [PATCH 442/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 752925f..5e4c91a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1760836749,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760715669,
-        "narHash": "sha256-skxnsVy2YxXuVvDuX7tWWUtEdnSAcZMqj0em6x8ppuA=",
+        "lastModified": 1760910871,
+        "narHash": "sha256-C5yv3dB1ybut0/y4IE3c/9rvw4BYgw9f+CmvUuSK1J4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "66b0dbcb2d462e7b70ba5a69ee8c3899ac2efb1c",
+        "rev": "0398752dd450dfabdd1b9e289f6364c2600f6ab5",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760666084,
-        "narHash": "sha256-mlb1PC69kb6JLL0mj678+wvIeO9sCRn4oCDS+YCGNG0=",
+        "lastModified": 1760839663,
+        "narHash": "sha256-S/33f5aNfnTPsW0uD4ufa7m0GyHRWPB3oCLa8RD3TBg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "800e6a0120315367a5c66189fd53f67fd0257e39",
+        "rev": "57a5fafb117ba998e0aaa4209118466ccbc647ff",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760580664,
-        "narHash": "sha256-/YdfibIrnqXAL8p5kqCU345mzpHoOtuVIkMiI2pF4Dc=",
+        "lastModified": 1760725957,
+        "narHash": "sha256-tdoIhL/NlER290HfSjOkgi4jfmjeqmqrzgnmiMtGepE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "98ff3f9af2684f6136c24beef08f5e2033fc5389",
+        "rev": "81b927b14b7b3988334d5282ef9cba802e193fe1",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760681700,
-        "narHash": "sha256-AmHIHJtEFhiBGcUfwA9VBBQ/wlifF3tn3JSguOHP3Uk=",
+        "lastModified": 1760825436,
+        "narHash": "sha256-dhNjNqhjIl1ZuzJCmKE00fXvVdioZZwBpYjD5tbuMkU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "16babe75b73d793b76a694400c22338c37e972a5",
+        "rev": "93c9414abf3ffc727bf049535c0e2771c5d47681",
         "type": "github"
       },
       "original": {

From 5fd3ab4d72e10684ac9597d0d124526591d89dc0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 21 Oct 2025 21:07:02 -0400
Subject: [PATCH 443/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5e4c91a..6a6c620 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760910871,
-        "narHash": "sha256-C5yv3dB1ybut0/y4IE3c/9rvw4BYgw9f+CmvUuSK1J4=",
+        "lastModified": 1761057638,
+        "narHash": "sha256-3J1izkjoa+oQYYwS4bSlZPoSwTzd4JjIqPyaFQvTrQc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0398752dd450dfabdd1b9e289f6364c2600f6ab5",
+        "rev": "03792ad93609fc67e41041c6347d9aa14e5e0d74",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760839663,
-        "narHash": "sha256-S/33f5aNfnTPsW0uD4ufa7m0GyHRWPB3oCLa8RD3TBg=",
+        "lastModified": 1761011864,
+        "narHash": "sha256-x1mJJuLDeJCA7ptCpkmJYrYaeBlUQc4A4WnOKDJ0MFg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "57a5fafb117ba998e0aaa4209118466ccbc647ff",
+        "rev": "15115a47e7de2321a81ecd3075e5e0043c28aaac",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1760106635,
-        "narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
+        "lastModified": 1760958188,
+        "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
+        "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760725957,
-        "narHash": "sha256-tdoIhL/NlER290HfSjOkgi4jfmjeqmqrzgnmiMtGepE=",
+        "lastModified": 1760862643,
+        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "81b927b14b7b3988334d5282ef9cba802e193fe1",
+        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760576393,
-        "narHash": "sha256-QdkymRnXsZamQlT59VuTL7/UW8Kw4Aj8sobMnvygASQ=",
+        "lastModified": 1760922144,
+        "narHash": "sha256-ADsQVmSAY259esy7EeCaLXt9rpYFDFykPc3RMLCfKnw=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "819d29cd71b1b1804e17f2a9de71905235f91f41",
+        "rev": "7e800af781e8138b298adda70208a9130e462058",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1760825436,
-        "narHash": "sha256-dhNjNqhjIl1ZuzJCmKE00fXvVdioZZwBpYjD5tbuMkU=",
+        "lastModified": 1761084638,
+        "narHash": "sha256-EtcaCPCzMFo6rHVO1zHpAss58kITJN6MtYP3nJVi99k=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "93c9414abf3ffc727bf049535c0e2771c5d47681",
+        "rev": "63805e9681a2881e36f7419418ecb267c9c2a597",
         "type": "github"
       },
       "original": {

From 1ab5c2c7e96eb6ecf0799c0ee82c2b6c6cbda4f5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 21 Oct 2025 23:39:44 -0400
Subject: [PATCH 444/847] jellyfin-qbittorrent-monitor: only count external
 networks

---
 services/jellyfin-qbittorrent-monitor.py | 33 +++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 6a0cec5..27bc167 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -6,6 +6,7 @@ import logging
 import sys
 import signal
 import json
+import ipaddress
 
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
@@ -36,6 +37,25 @@ class JellyfinQBittorrentMonitor:
         self.streaming_stop_delay = 60
         self.last_state_change = 0
 
+        # Local network ranges (RFC 1918 private networks + localhost)
+        self.local_networks = [
+            ipaddress.ip_network("10.0.0.0/8"),
+            ipaddress.ip_network("172.16.0.0/12"),
+            ipaddress.ip_network("192.168.0.0/16"),
+            ipaddress.ip_network("127.0.0.0/8"),
+            ipaddress.ip_network("::1/128"),  # IPv6 localhost
+            ipaddress.ip_network("fe80::/10"),  # IPv6 link-local
+        ]
+
+    def is_local_ip(self, ip_address: str) -> bool:
+        """Check if an IP address is from a local network"""
+        try:
+            ip = ipaddress.ip_address(ip_address)
+            return any(ip in network for network in self.local_networks)
+        except ValueError:
+            logger.warning(f"Invalid IP address format: {ip_address}")
+            return True  # Treat invalid IPs as local for safety
+
     def signal_handler(self, signum, frame):
         logger.info("Received shutdown signal, cleaning up...")
         self.running = False
@@ -43,7 +63,7 @@ class JellyfinQBittorrentMonitor:
         sys.exit(0)
 
     def check_jellyfin_sessions(self) -> list[str]:
-        """Check if anyone is actively streaming from Jellyfin"""
+        """Check if anyone is actively streaming from Jellyfin (external networks only)"""
         try:
             headers = {}
             if self.jellyfin_api_key:
@@ -55,19 +75,26 @@ class JellyfinQBittorrentMonitor:
             response.raise_for_status()
             sessions = response.json()
 
-            # Count active streaming sessions (video only)
+            # Count active streaming sessions (video only, external networks only)
             active_streams = []
             for session in sessions:
                 if (
                     "NowPlayingItem" in session
                     and session.get("PlayState", {}).get("IsPaused", True) == False
                 ):
+                    # Check if session is from external network
+                    remote_endpoint = session.get("RemoteEndPoint", "")
+                    if remote_endpoint and self.is_local_ip(remote_endpoint):
+                        logger.debug(f"Skipping local session from {remote_endpoint}")
+                        continue
+
                     item = session["NowPlayingItem"]
                     # Only count video streams (Movies, Episodes, etc.)
                     item_type = item.get("Type", "").lower()
                     if item_type in ["movie", "episode", "video"]:
                         user = session.get("UserName", "Unknown")
-                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
+                        client_info = f" (from {remote_endpoint})" if remote_endpoint else ""
+                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}{client_info}")
 
             return active_streams
 

From ee0889abf135ecadc349cf069e99dbdb9662b4f0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 23 Oct 2025 15:40:47 -0400
Subject: [PATCH 445/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6a6c620..080338e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761057638,
-        "narHash": "sha256-3J1izkjoa+oQYYwS4bSlZPoSwTzd4JjIqPyaFQvTrQc=",
+        "lastModified": 1761247817,
+        "narHash": "sha256-+cK37gDW7FSU4DfKZ/NWEWcNgV/pDpi/DjG8fzSs/uo=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "03792ad93609fc67e41041c6347d9aa14e5e0d74",
+        "rev": "0bf47a1dbba4d36f2aff4e8c34b06210ba34e688",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761011864,
-        "narHash": "sha256-x1mJJuLDeJCA7ptCpkmJYrYaeBlUQc4A4WnOKDJ0MFg=",
+        "lastModified": 1761098484,
+        "narHash": "sha256-1CWvNp7sjAijTwbawENQtzh2I36z+K4QHgnlm8fXULA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "15115a47e7de2321a81ecd3075e5e0043c28aaac",
+        "rev": "4aa18ac239b378bed4d07eb012c6edaa5e34f1d1",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760862643,
-        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
+        "lastModified": 1761016216,
+        "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
+        "rev": "481cf557888e05d3128a76f14c76397b7d7cc869",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760922144,
-        "narHash": "sha256-ADsQVmSAY259esy7EeCaLXt9rpYFDFykPc3RMLCfKnw=",
+        "lastModified": 1761201560,
+        "narHash": "sha256-l0IRzcO4DlBPsheig/LIxdNLK7b0dCw+xDz+8smoOzs=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "7e800af781e8138b298adda70208a9130e462058",
+        "rev": "bfa539938ff13d48aad3da1bece8d0b47ed5bb77",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761084638,
-        "narHash": "sha256-EtcaCPCzMFo6rHVO1zHpAss58kITJN6MtYP3nJVi99k=",
+        "lastModified": 1761171037,
+        "narHash": "sha256-L8kJV5lrOe4yE2dHsByLGxXaZaiNgVPBG6rzjyb0TXA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "63805e9681a2881e36f7419418ecb267c9c2a597",
+        "rev": "49171cd110b6f02471045d21099bd84cfc99e412",
         "type": "github"
       },
       "original": {

From 274474037ae4eb1e4cc3dd86173a30b428a43236 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 23 Oct 2025 16:22:49 -0400
Subject: [PATCH 446/847] openrgb: override mbedtls_2 with mbedtls

---
 no-rgb.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/no-rgb.nix b/no-rgb.nix
index b304ecf..25f5d8e 100644
--- a/no-rgb.nix
+++ b/no-rgb.nix
@@ -4,6 +4,11 @@
   pkgs,
   ...
 }:
+let
+  # mbedtls_2 is deprecated, override to fix build
+  openrgb_package = pkgs.openrgb.override { mbedtls_2 = pkgs.mbedtls; };
+in
+
 {
   systemd.services.no-rgb =
     let
@@ -11,7 +16,7 @@
         pkgs.writeShellApplication {
           name = "no-rgb";
           runtimeInputs = with pkgs; [
-            openrgb
+            openrgb_package
             coreutils
             gnugrep
           ];
@@ -40,10 +45,10 @@
 
   services.hardware.openrgb = {
     enable = true;
-    package = pkgs.openrgb-with-all-plugins;
+    package = openrgb_package;
     motherboard = "amd";
   };
 
-  services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
+  services.udev.packages = [ openrgb_package ];
   hardware.i2c.enable = true;
 }

From 78dd3e01dfe161c10c4a44612a91be3c790a27f3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 00:12:42 -0400
Subject: [PATCH 447/847] jellyfin-qbittorrent-monitor: write proper test

---
 configuration.nix                         |   1 +
 services/jellyfin-qbittorrent-monitor.nix |  48 ++++++
 services/wg.nix                           |  40 -----
 tests/jellyfin-qbittorrent-monitor.nix    | 201 ++++++++++++++++++++++
 tests/tests.nix                           |   1 +
 5 files changed, 251 insertions(+), 40 deletions(-)
 create mode 100644 services/jellyfin-qbittorrent-monitor.nix
 create mode 100644 tests/jellyfin-qbittorrent-monitor.nix

diff --git a/configuration.nix b/configuration.nix
index dc099b5..4dd49c9 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -28,6 +28,7 @@
 
     ./services/wg.nix
     ./services/qbittorrent.nix
+    ./services/jellyfin-qbittorrent-monitor.nix
     ./services/bitmagnet.nix
 
     ./services/soulseek.nix
diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
new file mode 100644
index 0000000..a660b11
--- /dev/null
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -0,0 +1,48 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  ...
+}:
+{
+  systemd.services."jellyfin-qbittorrent-monitor" = {
+    description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
+    after = [
+      "network.target"
+      "jellyfin.service"
+      "qbittorrent.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
+        export JELLYFIN_API_KEY=$(cat ${config.age.secrets.jellyfin-api-key.path})
+        exec ${
+          pkgs.python3.withPackages (ps: with ps; [ requests ])
+        }/bin/python ${./jellyfin-qbittorrent-monitor.py}
+      '';
+      Restart = "always";
+      RestartSec = "10s";
+
+      # Security hardening
+      DynamicUser = true;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      MemoryDenyWriteExecute = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
+    };
+
+    environment = {
+      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
+      QBITTORRENT_URL = "http://${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}";
+      CHECK_INTERVAL = "30";
+    };
+  };
+}
\ No newline at end of file
diff --git a/services/wg.nix b/services/wg.nix
index 9ac529d..2688da0 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -15,44 +15,4 @@
     ];
   };
 
-  systemd.services."jellyfin-qbittorrent-monitor" = {
-    description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
-    after = [
-      "network.target"
-      "jellyfin.service"
-      "qbittorrent.service"
-    ];
-    wantedBy = [ "multi-user.target" ];
-
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
-        export JELLYFIN_API_KEY=$(cat ${config.age.secrets.jellyfin-api-key.path})
-        exec ${
-          pkgs.python3.withPackages (ps: with ps; [ requests ])
-        }/bin/python ${./jellyfin-qbittorrent-monitor.py}
-      '';
-      Restart = "always";
-      RestartSec = "10s";
-
-      # Security hardening
-      DynamicUser = true;
-      NoNewPrivileges = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectControlGroups = true;
-      MemoryDenyWriteExecute = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      RemoveIPC = true;
-    };
-
-    environment = {
-      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
-      QBITTORRENT_URL = "http://${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}";
-      CHECK_INTERVAL = "30";
-    };
-  };
 }
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
new file mode 100644
index 0000000..3def72a
--- /dev/null
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -0,0 +1,201 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+pkgs.testers.runNixOSTest {
+  name = "jellyfin-qbittorrent-monitor";
+
+  nodes = {
+    server =
+      { pkgs, config, ... }:
+      {
+        # Mock qBittorrent service
+        systemd.services.mock-qbittorrent = {
+          description = "Mock qBittorrent API server";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = lib.getExe (
+              pkgs.writers.writePython3Bin "mock-qbt" { flakeIgnore = [ "E501" ]; } ''
+                import http.server
+                import socketserver
+
+
+                class MockQBittorrentHandler(http.server.BaseHTTPRequestHandler):
+                    def do_GET(self):
+                        if self.path == '/api/v2/transfer/speedLimitsMode':
+                            self.send_response(200)
+                            self.send_header('Content-type', 'text/plain')
+                            self.end_headers()
+                            response = '1' if getattr(self.server, 'speed_limits_mode', False) else '0'
+                            self.wfile.write(response.encode())
+                        else:
+                            self.send_response(404)
+                            self.end_headers()
+
+                    def do_POST(self):
+                        if self.path == '/api/v2/transfer/toggleSpeedLimitsMode':
+                            self.server.speed_limits_mode = not getattr(self.server, 'speed_limits_mode', False)
+                            self.send_response(200)
+                            self.end_headers()
+                            print(f'MONITOR_TEST: Speed limits toggled to {self.server.speed_limits_mode}')
+                        else:
+                            self.send_response(404)
+                            self.end_headers()
+
+                    def log_message(self, format, *args):
+                        print(f'qBittorrent Mock: {format % args}')
+
+
+                with socketserver.TCPServer(('127.0.0.1', 8080), MockQBittorrentHandler) as httpd:
+                    httpd.speed_limits_mode = False
+                    print('Mock qBittorrent server started on port 8080')
+                    httpd.serve_forever()
+              ''
+            );
+            Restart = "always";
+            RestartSec = "5s";
+          };
+        };
+
+        # Mock Jellyfin service with controllable streaming state
+        systemd.services.mock-jellyfin = {
+          description = "Mock Jellyfin API server";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = lib.getExe (
+              pkgs.writers.writePython3Bin "mock-jellyfin" { } ''
+                import http.server
+                import socketserver
+                import os
+                import json
+
+
+                class MockJellyfinHandler(http.server.BaseHTTPRequestHandler):
+                    def do_GET(self):
+                        if self.path == '/Sessions':
+                            self.send_response(200)
+                            self.send_header('Content-type', 'application/json')
+                            self.end_headers()
+
+                            # Check if we should simulate streaming
+                            streaming_file = '/tmp/jellyfin_streaming'
+                            if os.path.exists(streaming_file):
+                                # Simulate external streaming session
+                                sessions = [{
+                                    'Id': 'test-session-1',
+                                    'UserName': 'ExternalUser',
+                                    'RemoteEndPoint': '203.0.113.42',  # External IP
+                                    'NowPlayingItem': {
+                                        'Name': 'Test Movie',
+                                        'Type': 'Movie'
+                                    },
+                                    'PlayState': {
+                                        'IsPaused': False
+                                    }
+                                }]
+                            else:
+                                # No streaming sessions
+                                sessions = []
+
+                            self.wfile.write(json.dumps(sessions).encode())
+                        else:
+                            self.send_response(404)
+                            self.end_headers()
+
+                    def log_message(self, format, *args):
+                        print(f'Jellyfin Mock: {format % args}')
+
+
+                with socketserver.TCPServer(('127.0.0.1', 8096), MockJellyfinHandler) as httpd:
+                    print('Mock Jellyfin server started on port 8096')
+                    httpd.serve_forever()
+              ''
+            );
+            Restart = "always";
+            RestartSec = "5s";
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          python3
+        ];
+
+        networking.firewall.allowedTCPPorts = [
+          8096
+          8080
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    # Wait for services to start
+    server.wait_for_unit("multi-user.target")
+    server.wait_for_unit("mock-jellyfin.service")
+    server.wait_for_unit("mock-qbittorrent.service")
+
+    # Wait for services to be accessible
+    server.wait_for_open_port(8096)  # Mock Jellyfin
+    server.wait_for_open_port(8080)  # Mock qBittorrent
+
+    import time
+    time.sleep(5)
+
+    # TEST 1: Verify initial state - no streaming, normal speed limits
+    qbt_result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+    assert qbt_result.strip() == "0", "qBittorrent should start with normal speed limits"
+
+    # Verify no streaming sessions initially
+    sessions_result = server.succeed("curl -s http://localhost:8096/Sessions")
+    print(f"Initial Jellyfin sessions: {sessions_result}")
+    assert "[]" in sessions_result, "Should be no streaming sessions initially"
+
+    # Start the monitor
+    python_path = "${pkgs.python3.withPackages (ps: with ps; [ requests ])}/bin/python"
+    monitor_path = "${../services/jellyfin-qbittorrent-monitor.py}"
+    server.succeed(f"""
+      systemd-run --unit=jellyfin-qbittorrent-monitor-test \\
+        --setenv=JELLYFIN_URL=http://localhost:8096 \\
+        --setenv=QBITTORRENT_URL=http://localhost:8080 \\
+        --setenv=CHECK_INTERVAL=2 \\
+        {python_path} {monitor_path}
+    """)
+
+    # Wait for monitor to start
+    time.sleep(3)
+
+    # TEST 2: Verify monitor runs and keeps normal limits with no streaming
+    qbt_result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+    assert qbt_result.strip() == "0", "Should maintain normal speed limits with no streaming"
+
+    # TEST 3: Simulate external streaming and verify throttling
+    print("\\nSimulating external streaming session...")
+    server.succeed("touch /tmp/jellyfin_streaming")  # Signal mock to return streaming session
+
+    # Wait for monitor to detect streaming and apply throttling (includes hysteresis delay)
+    time.sleep(15)
+
+    qbt_result_streaming = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+
+    # Check if throttling was enabled
+    assert qbt_result_streaming.strip() == "1", "External streaming should enable qBittorrent throttling"
+
+    # TEST 4: Stop streaming and verify throttling is removed
+    print("\\nStopping streaming session...")
+    server.succeed("rm -f /tmp/jellyfin_streaming")  # Signal mock to return no sessions
+
+    # Wait for monitor to detect no streaming and remove throttling (includes hysteresis delay)
+    time.sleep(65)
+
+    qbt_result_no_streaming = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+    assert qbt_result_no_streaming.strip() == "0", "No streaming should disable qBittorrent throttling"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index e2b6e5e..d1be6a6 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -11,4 +11,5 @@ in
   zfsTest = handleTest ./zfs.nix;
   testTest = handleTest ./testTest.nix;
   minecraftTest = handleTest ./minecraft.nix;
+  jellyfinQbittorrentMonitorTest = handleTest ./jellyfin-qbittorrent-monitor.nix;
 }

From 331b73ee2861524944f1c742a817ed8f5acc22cd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 10:06:51 -0400
Subject: [PATCH 448/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 080338e..7e2e758 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761247817,
-        "narHash": "sha256-+cK37gDW7FSU4DfKZ/NWEWcNgV/pDpi/DjG8fzSs/uo=",
+        "lastModified": 1761309979,
+        "narHash": "sha256-N6gHgA7jwehiVnvNIGyoDJ4UCGadktOdH74vPrtdZo4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0bf47a1dbba4d36f2aff4e8c34b06210ba34e688",
+        "rev": "0bcb40b48c6fc6f17ba9672625e526ab2574344b",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761098484,
-        "narHash": "sha256-1CWvNp7sjAijTwbawENQtzh2I36z+K4QHgnlm8fXULA=",
+        "lastModified": 1761270771,
+        "narHash": "sha256-/gqQ1x4RCIk0Fsfq6a2489M7El79LJttsV1P7pIZn5o=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4aa18ac239b378bed4d07eb012c6edaa5e34f1d1",
+        "rev": "651d677a7ae913c792629437f77278997770a231",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761016216,
-        "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",
+        "lastModified": 1761173472,
+        "narHash": "sha256-m9W0dYXflzeGgKNravKJvTMR4Qqa2MVD11AwlGMufeE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "481cf557888e05d3128a76f14c76397b7d7cc869",
+        "rev": "c8aa8cc00a5cb57fada0851a038d35c08a36a2bb",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761171037,
-        "narHash": "sha256-L8kJV5lrOe4yE2dHsByLGxXaZaiNgVPBG6rzjyb0TXA=",
+        "lastModified": 1761257439,
+        "narHash": "sha256-SrprqjKqKFiOiZKIw74nlFx4srZlBe5ehrTNHZXXxnc=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "49171cd110b6f02471045d21099bd84cfc99e412",
+        "rev": "2e2b8b6655c7f28b9caf3a52802273127b9264ec",
         "type": "github"
       },
       "original": {

From 6da421d3fd945234d40cc9cb6d90d34e300ebc3d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 12:31:41 -0400
Subject: [PATCH 449/847] jellyfin-qbittorrent-monitor: improve testing infra

---
 services/jellyfin-qbittorrent-monitor.py |  12 +-
 tests/jellyfin-qbittorrent-monitor.nix   | 177 ++++++++++++++++++-----
 2 files changed, 151 insertions(+), 38 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 27bc167..6d19c61 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -21,6 +21,8 @@ class JellyfinQBittorrentMonitor:
         qbittorrent_url="http://localhost:8080",
         check_interval=30,
         jellyfin_api_key=None,
+        streaming_start_delay=10,
+        streaming_stop_delay=60,
     ):
         self.jellyfin_url = jellyfin_url
         self.qbittorrent_url = qbittorrent_url
@@ -33,8 +35,8 @@ class JellyfinQBittorrentMonitor:
         self.last_active_streams = []
 
         # Hysteresis settings to prevent rapid switching
-        self.streaming_start_delay = 10
-        self.streaming_stop_delay = 60
+        self.streaming_start_delay = streaming_start_delay
+        self.streaming_stop_delay = streaming_stop_delay
         self.last_state_change = 0
 
         # Local network ranges (RFC 1918 private networks + localhost)
@@ -80,7 +82,7 @@ class JellyfinQBittorrentMonitor:
             for session in sessions:
                 if (
                     "NowPlayingItem" in session
-                    and session.get("PlayState", {}).get("IsPaused", True) == False
+                    and not session.get("PlayState", {}).get("IsPaused", True)
                 ):
                     # Check if session is from external network
                     remote_endpoint = session.get("RemoteEndPoint", "")
@@ -249,12 +251,16 @@ if __name__ == "__main__":
     qbittorrent_url = os.getenv("QBITTORRENT_URL", "http://localhost:8080")
     check_interval = int(os.getenv("CHECK_INTERVAL", "30"))
     jellyfin_api_key = os.getenv("JELLYFIN_API_KEY")
+    streaming_start_delay = int(os.getenv("STREAMING_START_DELAY", "10"))
+    streaming_stop_delay = int(os.getenv("STREAMING_STOP_DELAY", "60"))
 
     monitor = JellyfinQBittorrentMonitor(
         jellyfin_url=jellyfin_url,
         qbittorrent_url=qbittorrent_url,
         check_interval=check_interval,
         jellyfin_api_key=jellyfin_api_key,
+        streaming_start_delay=streaming_start_delay,
+        streaming_stop_delay=streaming_stop_delay,
     )
 
     monitor.run()
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 3def72a..c2c09d1 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -69,10 +69,9 @@ pkgs.testers.runNixOSTest {
           serviceConfig = {
             Type = "simple";
             ExecStart = lib.getExe (
-              pkgs.writers.writePython3Bin "mock-jellyfin" { } ''
+              pkgs.writers.writePython3Bin "mock-jellyfin" { flakeIgnore = [ "E501" ]; } ''
                 import http.server
                 import socketserver
-                import os
                 import json
 
 
@@ -83,24 +82,42 @@ pkgs.testers.runNixOSTest {
                             self.send_header('Content-type', 'application/json')
                             self.end_headers()
 
-                            # Check if we should simulate streaming
-                            streaming_file = '/tmp/jellyfin_streaming'
-                            if os.path.exists(streaming_file):
-                                # Simulate external streaming session
+                            state = getattr(self.server, 'test_state', {
+                                'streaming': False,
+                                'paused': False,
+                                'local': False,
+                                'media_type': 'Movie'
+                            })
+
+                            if state['streaming']:
+                                if state['local']:
+                                    remote_ip = '192.168.1.100'
+                                else:
+                                    remote_ip = '203.0.113.42'
+
+                                # Map media types to names
+                                type_names = {
+                                    'Movie': 'Test Movie',
+                                    'Episode': 'Test Episode S01E01',
+                                    'Video': 'Test Video',
+                                    'Audio': 'Test Song'
+                                }
+
                                 sessions = [{
                                     'Id': 'test-session-1',
                                     'UserName': 'ExternalUser',
-                                    'RemoteEndPoint': '203.0.113.42',  # External IP
+                                    'RemoteEndPoint': remote_ip,
                                     'NowPlayingItem': {
-                                        'Name': 'Test Movie',
-                                        'Type': 'Movie'
+                                        'Name': type_names.get(
+                                            state['media_type'], 'Test Content'
+                                        ),
+                                        'Type': state['media_type']
                                     },
                                     'PlayState': {
-                                        'IsPaused': False
+                                        'IsPaused': state['paused']
                                     }
                                 }]
                             else:
-                                # No streaming sessions
                                 sessions = []
 
                             self.wfile.write(json.dumps(sessions).encode())
@@ -108,6 +125,52 @@ pkgs.testers.runNixOSTest {
                             self.send_response(404)
                             self.end_headers()
 
+                    def do_POST(self):
+                        if self.path.startswith('/control/'):
+                            try:
+                                content_length = int(self.headers.get('Content-Length', 0))
+                                post_data = self.rfile.read(content_length)
+                                data = json.loads(post_data.decode()) if post_data else {}
+
+                                if not hasattr(self.server, 'test_state'):
+                                    self.server.test_state = {
+                                        'streaming': False,
+                                        'paused': False,
+                                        'local': False,
+                                        'media_type': 'Movie'
+                                    }
+
+                                if self.path == '/control/state':
+                                    # Set complete state
+                                    self.server.test_state.update(data)
+                                    self.send_response(200)
+                                    self.end_headers()
+                                    self.wfile.write(b'OK')
+                                    state_str = str(self.server.test_state)
+                                    print(f'Jellyfin Mock: State updated to {state_str}')
+                                elif self.path == '/control/reset':
+                                    # Reset to default state
+                                    self.server.test_state = {
+                                        'streaming': False,
+                                        'paused': False,
+                                        'local': False,
+                                        'media_type': 'Movie'
+                                    }
+                                    self.send_response(200)
+                                    self.end_headers()
+                                    self.wfile.write(b'OK')
+                                    print('Jellyfin Mock: State reset')
+                                else:
+                                    self.send_response(404)
+                                    self.end_headers()
+                            except Exception as e:
+                                print(f'Jellyfin Mock: Control error: {e}')
+                                self.send_response(500)
+                                self.end_headers()
+                        else:
+                            self.send_response(404)
+                            self.end_headers()
+
                     def log_message(self, format, *args):
                         print(f'Jellyfin Mock: {format % args}')
 
@@ -147,18 +210,33 @@ pkgs.testers.runNixOSTest {
     server.wait_for_open_port(8080)  # Mock qBittorrent
 
     import time
+    import json
+
     time.sleep(5)
 
-    # TEST 1: Verify initial state - no streaming, normal speed limits
-    qbt_result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
-    assert qbt_result.strip() == "0", "qBittorrent should start with normal speed limits"
+    # Helper function to set mock server state
+    def set_jellyfin_state(streaming=False, paused=False, local=False, media_type="Movie"):
+        state = {
+            "streaming": streaming,
+            "paused": paused,
+            "local": local,
+            "media_type": media_type
+        }
+        server.succeed(f"curl -s -X POST -H 'Content-Type: application/json' -d '{json.dumps(state)}' http://localhost:8096/control/state")
+
+    # Helper function to get current qBittorrent throttling state
+    def get_throttling_state():
+        result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+        return result.strip() == "1"
+
+    print("\\nTesting initial state...")
+    assert not get_throttling_state(), "qBittorrent should start with normal speed limits"
 
-    # Verify no streaming sessions initially
     sessions_result = server.succeed("curl -s http://localhost:8096/Sessions")
     print(f"Initial Jellyfin sessions: {sessions_result}")
     assert "[]" in sessions_result, "Should be no streaming sessions initially"
 
-    # Start the monitor
+    # Start the monitor with fast delays for testing
     python_path = "${pkgs.python3.withPackages (ps: with ps; [ requests ])}/bin/python"
     monitor_path = "${../services/jellyfin-qbittorrent-monitor.py}"
     server.succeed(f"""
@@ -166,36 +244,65 @@ pkgs.testers.runNixOSTest {
         --setenv=JELLYFIN_URL=http://localhost:8096 \\
         --setenv=QBITTORRENT_URL=http://localhost:8080 \\
         --setenv=CHECK_INTERVAL=2 \\
+        --setenv=STREAMING_START_DELAY=2 \\
+        --setenv=STREAMING_STOP_DELAY=3 \\
         {python_path} {monitor_path}
     """)
 
-    # Wait for monitor to start
     time.sleep(3)
 
-    # TEST 2: Verify monitor runs and keeps normal limits with no streaming
-    qbt_result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
-    assert qbt_result.strip() == "0", "Should maintain normal speed limits with no streaming"
+    # Define test scenarios
+    media_types = ["Movie", "Episode", "Video", "Audio"]
+    playback_states = [False, True]  # False=playing, True=paused
+    network_locations = [False, True]  # False=external, True=local
 
-    # TEST 3: Simulate external streaming and verify throttling
-    print("\\nSimulating external streaming session...")
-    server.succeed("touch /tmp/jellyfin_streaming")  # Signal mock to return streaming session
+    test_count = 0
+    for media_type in media_types:
+        for is_paused in playback_states:
+            for is_local in network_locations:
+                test_count += 1
+                print(f"\\nTest {test_count}: {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}")
 
-    # Wait for monitor to detect streaming and apply throttling (includes hysteresis delay)
-    time.sleep(15)
+                # Set streaming state
+                set_jellyfin_state(streaming=True, paused=is_paused, local=is_local, media_type=media_type)
+                time.sleep(6)  # Wait for monitor to detect and apply changes
 
-    qbt_result_streaming = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
+                throttling_active = get_throttling_state()
 
-    # Check if throttling was enabled
-    assert qbt_result_streaming.strip() == "1", "External streaming should enable qBittorrent throttling"
+                # Determine expected behavior:
+                # Throttling should be active only if:
+                # - Not paused AND
+                # - Not local AND
+                # - Media type is video (Movie, Episode, Video) - NOT Audio
+                should_throttle = (
+                    not is_paused and
+                    not is_local and
+                    media_type in ["Movie", "Episode", "Video"]
+                )
 
-    # TEST 4: Stop streaming and verify throttling is removed
-    print("\\nStopping streaming session...")
-    server.succeed("rm -f /tmp/jellyfin_streaming")  # Signal mock to return no sessions
+                if should_throttle:
+                    assert throttling_active, f"Expected throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
+                else:
+                    assert not throttling_active, f"Expected no throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
 
-    # Wait for monitor to detect no streaming and remove throttling (includes hysteresis delay)
-    time.sleep(65)
+    set_jellyfin_state(streaming=False)
+    time.sleep(7)  # Wait for stop delay
 
-    qbt_result_no_streaming = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
-    assert qbt_result_no_streaming.strip() == "0", "No streaming should disable qBittorrent throttling"
+    assert not get_throttling_state(), "No streaming should disable throttling"
+
+    # Start with throttling-enabled state
+    set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
+    time.sleep(6)
+    assert get_throttling_state(), "Should enable throttling for external Movie"
+
+    # Switch to paused (should disable throttling)
+    set_jellyfin_state(streaming=True, paused=True, local=False, media_type="Movie")
+    time.sleep(6)
+    assert not get_throttling_state(), "Should disable throttling when paused"
+
+    # Switch back to playing (should re-enable throttling)
+    set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
+    time.sleep(6)
+    assert get_throttling_state(), "Should re-enable throttling when unpaused"
   '';
 }

From cca3dc90a57c3e976cae54099b4de0813fb4b8ab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 13:04:31 -0400
Subject: [PATCH 450/847] jellyfin-qbittorrent-monitor: cleanup

---
 services/jellyfin-qbittorrent-monitor.nix |  2 +-
 services/jellyfin-qbittorrent-monitor.py  | 14 +++-----------
 tests/jellyfin-qbittorrent-monitor.nix    | 16 ++++++++--------
 3 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index a660b11..430cc15 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -45,4 +45,4 @@
       CHECK_INTERVAL = "30";
     };
   };
-}
\ No newline at end of file
+}
diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 6d19c61..b749e27 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -67,9 +67,7 @@ class JellyfinQBittorrentMonitor:
     def check_jellyfin_sessions(self) -> list[str]:
         """Check if anyone is actively streaming from Jellyfin (external networks only)"""
         try:
-            headers = {}
-            if self.jellyfin_api_key:
-                headers["X-Emby-Token"] = self.jellyfin_api_key
+            headers = {"X-Emby-Token": self.jellyfin_api_key} if self.jellyfin_api_key else {}
 
             response = requests.get(
                 f"{self.jellyfin_url}/Sessions", headers=headers, timeout=10
@@ -83,20 +81,14 @@ class JellyfinQBittorrentMonitor:
                 if (
                     "NowPlayingItem" in session
                     and not session.get("PlayState", {}).get("IsPaused", True)
+                    and not self.is_local_ip(session.get("RemoteEndPoint", ""))
                 ):
-                    # Check if session is from external network
-                    remote_endpoint = session.get("RemoteEndPoint", "")
-                    if remote_endpoint and self.is_local_ip(remote_endpoint):
-                        logger.debug(f"Skipping local session from {remote_endpoint}")
-                        continue
-
                     item = session["NowPlayingItem"]
                     # Only count video streams (Movies, Episodes, etc.)
                     item_type = item.get("Type", "").lower()
                     if item_type in ["movie", "episode", "video"]:
                         user = session.get("UserName", "Unknown")
-                        client_info = f" (from {remote_endpoint})" if remote_endpoint else ""
-                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}{client_info}")
+                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
 
             return active_streams
 
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index c2c09d1..aba0634 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -243,9 +243,9 @@ pkgs.testers.runNixOSTest {
       systemd-run --unit=jellyfin-qbittorrent-monitor-test \\
         --setenv=JELLYFIN_URL=http://localhost:8096 \\
         --setenv=QBITTORRENT_URL=http://localhost:8080 \\
-        --setenv=CHECK_INTERVAL=2 \\
-        --setenv=STREAMING_START_DELAY=2 \\
-        --setenv=STREAMING_STOP_DELAY=3 \\
+        --setenv=CHECK_INTERVAL=1 \\
+        --setenv=STREAMING_START_DELAY=1 \\
+        --setenv=STREAMING_STOP_DELAY=1 \\
         {python_path} {monitor_path}
     """)
 
@@ -265,7 +265,7 @@ pkgs.testers.runNixOSTest {
 
                 # Set streaming state
                 set_jellyfin_state(streaming=True, paused=is_paused, local=is_local, media_type=media_type)
-                time.sleep(6)  # Wait for monitor to detect and apply changes
+                time.sleep(1.5)  # Wait for monitor to detect and apply changes
 
                 throttling_active = get_throttling_state()
 
@@ -286,23 +286,23 @@ pkgs.testers.runNixOSTest {
                     assert not throttling_active, f"Expected no throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
 
     set_jellyfin_state(streaming=False)
-    time.sleep(7)  # Wait for stop delay
+    time.sleep(1.5)  # Wait for stop delay
 
     assert not get_throttling_state(), "No streaming should disable throttling"
 
     # Start with throttling-enabled state
     set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
-    time.sleep(6)
+    time.sleep(1.5)
     assert get_throttling_state(), "Should enable throttling for external Movie"
 
     # Switch to paused (should disable throttling)
     set_jellyfin_state(streaming=True, paused=True, local=False, media_type="Movie")
-    time.sleep(6)
+    time.sleep(1.5)
     assert not get_throttling_state(), "Should disable throttling when paused"
 
     # Switch back to playing (should re-enable throttling)
     set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
-    time.sleep(6)
+    time.sleep(1.5)
     assert get_throttling_state(), "Should re-enable throttling when unpaused"
   '';
 }

From 1411ea66b9905070ff1c0f3c0a5f3506072246e3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 13:46:22 -0400
Subject: [PATCH 451/847] zfs_ensure_mounted: cleanup test

---
 tests/zfs.nix | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/tests/zfs.nix b/tests/zfs.nix
index aeb4052..f82e3f2 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -30,27 +30,22 @@ testPkgs.testers.runNixOSTest {
         emptyDiskImages = [
           4096
         ];
-        useBootLoader = true;
-        useEFIBoot = true;
       };
-      boot.loader.systemd-boot.enable = true;
-      boot.loader.timeout = 0;
-      boot.loader.efi.canTouchEfiVariables = true;
       networking.hostId = "deadbeef";
       boot.kernelPackages = config.boot.kernelPackages;
       boot.zfs.package = config.boot.zfs.package;
       boot.supportedFilesystems = [ "zfs" ];
 
-      environment.systemPackages = [
-        pkgs.parted
-        pkgs.ensureZfsMounts
+      environment.systemPackages = with pkgs; [
+        parted
+        ensureZfsMounts
       ];
 
       systemd.services.foobar = {
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          ExecStart = "${lib.getExe pkgs.bash} -c \"true\"";
+          ExecStart = lib.getExe pkgs.bash;
         };
       };
 
@@ -58,7 +53,7 @@ testPkgs.testers.runNixOSTest {
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
-          ExecStart = "${lib.getExe pkgs.bash} -c \"true\"";
+          ExecStart = lib.getExe pkgs.bash;
         };
       };
     };

From 0608faeac3b6579f95618091488bc56099f4be9d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 14:40:28 -0400
Subject: [PATCH 452/847] minecraft: fix nix test

---
 tests/minecraft.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 64dde85..24a88ce 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -57,6 +57,9 @@ testPkgs.testers.runNixOSTest {
       # Enable caddy service (required by minecraft service)
       services.caddy.enable = true;
 
+      # Enable networking for the test (needed for minecraft mods to download mappings)
+      networking.dhcpcd.enable = true;
+
       # Disable the ZFS mount dependency service in test environment
       systemd.services."minecraft-server-main_mounts".enable = lib.mkForce false;
 
@@ -85,9 +88,12 @@ testPkgs.testers.runNixOSTest {
     # Wait for minecraft service to be available
     machine.wait_for_unit("minecraft-server-main.service")
 
-    machine.sleep(20)
+    machine.sleep(60)
 
     # Check that the service is active and not failed
     machine.succeed("systemctl is-active minecraft-server-main.service")
+
+    # Check for the Minecraft server startup completion message
+    machine.succeed("grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log")
   '';
 }

From f47d0c253320503ed7f00ab4942c118f140ee607 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 24 Oct 2025 18:14:40 -0400
Subject: [PATCH 453/847] jellyfin-qbittorrent-monitor: nit with test

---
 tests/jellyfin-qbittorrent-monitor.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index aba0634..830fa25 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -280,10 +280,7 @@ pkgs.testers.runNixOSTest {
                     media_type in ["Movie", "Episode", "Video"]
                 )
 
-                if should_throttle:
-                    assert throttling_active, f"Expected throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
-                else:
-                    assert not throttling_active, f"Expected no throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
+                assert throttling_active == should_throttle, f"Expected {"no " if not should_throttle else ""} throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
 
     set_jellyfin_state(streaming=False)
     time.sleep(1.5)  # Wait for stop delay

From 19f47f84fd82ffd7791b36c6811e7e2eadac0714 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 26 Oct 2025 15:50:35 -0400
Subject: [PATCH 454/847] minecraft: update mods

---
 services/minecraft.nix | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 8485d40..0e48b09 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -62,8 +62,8 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/qNm2IWMn/fabric-api-0.135.0%2B1.21.10.jar";
-              sha512 = "7a3e442ab69be2ce8413580a198e13c87f1135699b5549a12a31b82dc9ddfa9b6731d774ebc36c752387010c51d018ac6aa85fcadfcb6254df8144d7e71235aa";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/lxeiLRwe/fabric-api-0.136.0%2B1.21.10.jar";
+              sha512 = "d6ad5afeb57dc6dbe17a948990fc8441fbbc13a748814a71566404d919384df8bd7abebda52a58a41eb66370a86b8c4f910b64733b135946ecd47e53271310b5";
             };
 
             FerriteCore = fetchurl {
@@ -86,16 +86,14 @@
               sha512 = "ddc2105568cb935eb269cfbb82b601189aa0c6c5ac98240188a3196e3e8454c23af86e95765153bd72285e9728dd8d0e587b4bcc3967f2636c5139f363e05f97";
             };
 
-            /*
-              scalablelux = fetchurl {
-                url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PQLHDg2Q/ScalableLux-0.1.5%2Bfabric.e4acdcb-all.jar";
-                sha512 = "ec8fabc3bf991fbcbe064c1e97ded3e70f145a87e436056241cbb1e14c57ea9f59ef312f24c205160ccbda43f693e05d652b7f19aa71f730caec3bb5f7f7820a";
-              };
-            */
+            scalablelux = fetchurl {
+              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PV9KcrYQ/ScalableLux-0.1.6%2Bfabric.c25518a-all.jar";
+              sha512 = "729515c1e75cf8d9cd704f12b3487ddb9664cf9928e7b85b12289c8fbbc7ed82d0211e1851375cbd5b385820b4fedbc3f617038fff5e30b302047b0937042ae7";
+            };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/Bl0VOr1e/c2me-fabric-mc1.21.10-0.3.5%2Bbeta.1.0.jar";
-              sha512 = "8ad90725b9cb79d567f8985e330c2da0a28f4cf9a3556ac078aa2bc4d0b68ca057417ec1f1fd42f92a04f76cdfe72ceab4e5cdec2bbaf443498884a5759d6ee4";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/eY3dbqLu/c2me-fabric-mc1.21.10-0.3.5.0.0.jar";
+              sha512 = "a3422b75899a9355aa13128651ed2815ff83ff698c4c22a94ea7f275c656aff247440085a47de20353ff54469574c84adc9b428c2e963a80a3c6657fb849825d";
             };
 
             krypton = fetchurl {
@@ -104,8 +102,8 @@
             };
 
             better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/laxelUM5/better-fabric-console-mc1.21.10-1.2.6.jar";
-              sha512 = "b458699a2f555db6fb150e7663188b54bc931e1e03c0dd35823aea570e55d0fa844b334ab9d9f605e038eeb65a71350ef2058cd105cca7c154920a8adec17d47";
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/fZprQjU4/better-fabric-console-mc1.21.10-1.2.7.jar";
+              sha512 = "0321e4a687ba5ed4dcb081aa48909d45c4e153f8b6217cd807f280f33250151b97ac80a122a83d48535c788d3c1e08a7ee882da3b20cf06021e03c1ddc943278";
             };
 
             disconnect-packet-fix = fetchurl {
@@ -114,8 +112,8 @@
             };
 
             packet-fixer = fetchurl {
-              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/V05RgbEn/packetfixer-3.3.0-1.20.5-1.21.X-merged.jar";
-              sha512 = "17fd46a5edd2ecefb67f346fa1ddd8beebd119f9c1598e91211c5d8a4691ae118d81d6628cb39705c0cf1a4d1f09299b76f72c5d286ca5b707c2508633654c12";
+              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/5Qk1yjvA/packetfixer-fabric-3.3.1-1.21.10.jar";
+              sha512 = "a57ee4a4b9f75c1cedafb191d0eb3da419962f08145ccbd9d6544b7e91b72a52aba1eebeb76d60fb23bf0177472473a90097c2d73306f698aff084cd9a290af8";
             };
           }
         );

From e0ec932aed492f1256f3865dd65b2ae9f940172e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 26 Oct 2025 21:49:00 -0400
Subject: [PATCH 455/847] minecraft: speedup test

---
 tests/minecraft.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 24a88ce..cc0285f 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -88,12 +88,11 @@ testPkgs.testers.runNixOSTest {
     # Wait for minecraft service to be available
     machine.wait_for_unit("minecraft-server-main.service")
 
-    machine.sleep(60)
-
-    # Check that the service is active and not failed
-    machine.succeed("systemctl is-active minecraft-server-main.service")
-
-    # Check for the Minecraft server startup completion message
-    machine.succeed("grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log")
+    # Wait up to 60 seconds for the server to complete startup
+    with machine.nested("Waiting for minecraft server startup completion"):
+        machine.wait_until_succeeds(
+            "grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log",
+            timeout=60
+        )
   '';
 }

From 2c9d24df381da9c2330f62d12a696bb5bcb76fb2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 27 Oct 2025 00:54:00 -0400
Subject: [PATCH 456/847] update

---
 flake.lock             | 30 +++++++++++++++---------------
 services/minecraft.nix | 10 ++++++----
 tests/minecraft.nix    | 12 ++++++++----
 3 files changed, 29 insertions(+), 23 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7e2e758..6864adf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761309979,
-        "narHash": "sha256-N6gHgA7jwehiVnvNIGyoDJ4UCGadktOdH74vPrtdZo4=",
+        "lastModified": 1761528310,
+        "narHash": "sha256-yUSr9xEJCt5JZjhQyzotu0KmNzykQlbsGe4mnqsR+SU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "0bcb40b48c6fc6f17ba9672625e526ab2574344b",
+        "rev": "75cbdd3fce38ea12d50cd19e73a069aa5dbbd5fa",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761270771,
-        "narHash": "sha256-/gqQ1x4RCIk0Fsfq6a2489M7El79LJttsV1P7pIZn5o=",
+        "lastModified": 1761530861,
+        "narHash": "sha256-VMhre9pdUAT6TDo0KV1kOjtZywCEoBowKRYSaa7KHP0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "651d677a7ae913c792629437f77278997770a231",
+        "rev": "c90769ae2c7d46fdadcdb81e09a97137b3b87891",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761173472,
-        "narHash": "sha256-m9W0dYXflzeGgKNravKJvTMR4Qqa2MVD11AwlGMufeE=",
+        "lastModified": 1761468971,
+        "narHash": "sha256-vY2OLVg5ZTobdroQKQQSipSIkHlxOTrIF1fsMzPh8w8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c8aa8cc00a5cb57fada0851a038d35c08a36a2bb",
+        "rev": "78e34d1667d32d8a0ffc3eba4591ff256e80576e",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761201560,
-        "narHash": "sha256-l0IRzcO4DlBPsheig/LIxdNLK7b0dCw+xDz+8smoOzs=",
+        "lastModified": 1761526984,
+        "narHash": "sha256-o63BGWD4HtDEGdhzJwW6Sa7zTB1b3NA35QKM03VtL64=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "bfa539938ff13d48aad3da1bece8d0b47ed5bb77",
+        "rev": "109abf3c735c3cde590f22c484e28a71cca8b27c",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761257439,
-        "narHash": "sha256-SrprqjKqKFiOiZKIw74nlFx4srZlBe5ehrTNHZXXxnc=",
+        "lastModified": 1761520240,
+        "narHash": "sha256-3zsEtl77eQD61/7s9zJ9K3AuY7YQ7q41R4jK43ZZ8Ao=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "2e2b8b6655c7f28b9caf3a52802273127b9264ec",
+        "rev": "5de358f0163906c3d7e542f0406473defb349d09",
         "type": "github"
       },
       "original": {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 0e48b09..cd9cd85 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -101,10 +101,12 @@
               sha512 = "4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab";
             };
 
-            better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/fZprQjU4/better-fabric-console-mc1.21.10-1.2.7.jar";
-              sha512 = "0321e4a687ba5ed4dcb081aa48909d45c4e153f8b6217cd807f280f33250151b97ac80a122a83d48535c788d3c1e08a7ee882da3b20cf06021e03c1ddc943278";
-            };
+            /*
+              better-fabric-console = fetchurl {
+                url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/fZprQjU4/better-fabric-console-mc1.21.10-1.2.7.jar";
+                sha512 = "0321e4a687ba5ed4dcb081aa48909d45c4e153f8b6217cd807f280f33250151b97ac80a122a83d48535c788d3c1e08a7ee882da3b20cf06021e03c1ddc943278";
+              };
+            */
 
             disconnect-packet-fix = fetchurl {
               url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index cc0285f..b80913e 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -90,9 +90,13 @@ testPkgs.testers.runNixOSTest {
 
     # Wait up to 60 seconds for the server to complete startup
     with machine.nested("Waiting for minecraft server startup completion"):
-        machine.wait_until_succeeds(
-            "grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log",
-            timeout=60
-        )
+        try:
+            machine.wait_until_succeeds(
+                "grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log",
+                timeout=60
+            )
+        except Exception:
+            print(machine.succeed("cat /var/lib/minecraft/main/logs/latest.log"))
+            raise
   '';
 }

From d5e94d44e54d2b6da5a351b6d02609f5de8f2189 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 27 Oct 2025 15:05:03 -0400
Subject: [PATCH 457/847] update senior project website

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6864adf..1bcb84e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -467,11 +467,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1759112913,
-        "narHash": "sha256-5SoOzDT/2W50PrIUfZmwOoiS5VBtqJ+T4jvfMxURAb0=",
+        "lastModified": 1761591870,
+        "narHash": "sha256-9R1fCiKLbZ9/B67cSqmGWKa9iF6SQGZLCAJSh5bJyyo=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "37284cf4cde9010ddd74b0246813baab28383089",
+        "rev": "329eed8d82f688dadbecf6b6e6e0f924b1383f79",
         "type": "github"
       },
       "original": {

From 493412017371f2382ff4f801ae018bba109e68e5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 29 Oct 2025 21:31:04 -0400
Subject: [PATCH 458/847] networking: temporarily use 192 address

---
 configuration.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 4dd49c9..ac9313f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -184,7 +184,8 @@
     interfaces.${eth_interface} = {
       ipv4.addresses = [
         {
-          address = "10.1.1.102";
+          address = "192.168.1.50";
+          # address = "10.1.1.102";
           prefixLength = 24;
         }
       ];
@@ -196,7 +197,8 @@
       ];
     };
     defaultGateway = {
-      address = "10.1.1.1";
+      #address = "10.1.1.1";
+      address = "192.168.1.1";
       interface = eth_interface;
     };
     # TODO! fix this

From 042d92df45ea990499500802784deffa8faa2190 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 30 Oct 2025 00:23:32 -0400
Subject: [PATCH 459/847] secureboot fixes I think

---
 install.sh     | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++
 secureboot.nix | 18 ++++++++++-----
 2 files changed, 72 insertions(+), 5 deletions(-)
 create mode 100755 install.sh

diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..66f5bd4
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DISK="${1:-}"
+FLAKE_DIR="$(dirname "$(realpath "$0")")"
+
+if [[ -z "$DISK" ]]; then
+    echo "Usage: $0 <disk_device>"
+    echo "Example: $0 /dev/nvme0n1"
+    echo "         $0 /dev/sda"
+    exit 1
+fi
+
+if [[ ! -b "$DISK" ]]; then
+    echo "Error: $DISK is not a block device"
+    exit 1
+fi
+
+echo "Installing NixOS to $DISK using flake at $FLAKE_DIR"
+
+# Create temporary directory for secureboot keys
+mkdir -p /tmp/secureboot
+
+# Function to cleanup on exit
+cleanup() {
+    echo "Cleaning up..."
+    rm -rf /tmp/secureboot 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# Decrypt secureboot keys using the key in the repo
+echo "Decrypting secureboot keys..."
+if [[ ! -f "$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key" ]]; then
+    echo "Error: usb-secrets-key not found at $FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key"
+    exit 1
+fi
+
+nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key' '$FLAKE_DIR/secrets/secureboot.tar.age'" | \
+    tar -x -C /tmp/secureboot
+
+echo "Secureboot keys extracted"
+
+# Check if disko-install is available
+if ! command -v disko-install >/dev/null 2>&1; then
+    echo "Running disko-install via nix..."
+    DISKO_INSTALL="nix run github:nix-community/disko#disko-install --"
+else
+    DISKO_INSTALL="disko-install"
+fi
+
+echo "Running disko-install to partition, format, and install NixOS..."
+
+# Run disko-install with secureboot keys available
+sudo $DISKO_INSTALL \
+    --mode format \
+    --flake "$FLAKE_DIR#muffin" \
+    --disk main "$DISK" \
+    --extra-files /tmp/secureboot /etc/secureboot \
+    --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets" /mnt/usb-secrets
diff --git a/secureboot.nix b/secureboot.nix
index ac78827..472a602 100644
--- a/secureboot.nix
+++ b/secureboot.nix
@@ -22,11 +22,19 @@
       deps = [ "agenix" ];
       text = ''
         #!/bin/sh
-        rm -fr ${config.boot.lanzaboote.pkiBundle} || true
-        mkdir -p ${config.boot.lanzaboote.pkiBundle}
-        ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
-        chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
-        chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
+        # Check if keys already exist (e.g., from disko-install)
+        if [[ -d ${config.boot.lanzaboote.pkiBundle} && -f ${config.boot.lanzaboote.pkiBundle}/db.key ]]; then
+          echo "Secureboot keys already present, skipping extraction"
+          chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+          chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
+        else
+          echo "Extracting secureboot keys from agenix"
+          rm -fr ${config.boot.lanzaboote.pkiBundle} || true
+          mkdir -p ${config.boot.lanzaboote.pkiBundle}
+          ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
+          chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+          chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
+        fi
       '';
     };
   };

From 5d5a5e2790398c9e3b8ceb679dfdca68f5323558 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 30 Oct 2025 14:48:00 -0400
Subject: [PATCH 460/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1bcb84e..06cb445 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1760836749,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1761656077,
+        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
+        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761528310,
-        "narHash": "sha256-yUSr9xEJCt5JZjhQyzotu0KmNzykQlbsGe4mnqsR+SU=",
+        "lastModified": 1761848543,
+        "narHash": "sha256-DvFpvmtFMeXUNxzd7OZ/Nzj0PeXKe3Sh8gN8xgRb8+I=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "75cbdd3fce38ea12d50cd19e73a069aa5dbbd5fa",
+        "rev": "16724b5b6836a2d4b8936a5824d2ff27c52b4517",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761530861,
-        "narHash": "sha256-VMhre9pdUAT6TDo0KV1kOjtZywCEoBowKRYSaa7KHP0=",
+        "lastModified": 1761703457,
+        "narHash": "sha256-nXOEEmPmE3RSzNntpDu17p2SpQ1rNDCXlHpMucJCef0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c90769ae2c7d46fdadcdb81e09a97137b3b87891",
+        "rev": "8b74b9b65a97d9e2541a9fd28d79d91413e9bda1",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1760958188,
-        "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=",
+        "lastModified": 1761827175,
+        "narHash": "sha256-XdPVSYyIBK4/ruoqujaQmmSGg3J2/EenexV9IEXhr6o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",
+        "rev": "43ffe9ac82567512abb83187cb673de1091bdfa8",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761468971,
-        "narHash": "sha256-vY2OLVg5ZTobdroQKQQSipSIkHlxOTrIF1fsMzPh8w8=",
+        "lastModified": 1761597516,
+        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "78e34d1667d32d8a0ffc3eba4591ff256e80576e",
+        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761526984,
-        "narHash": "sha256-o63BGWD4HtDEGdhzJwW6Sa7zTB1b3NA35QKM03VtL64=",
+        "lastModified": 1761825566,
+        "narHash": "sha256-RG1Z8nkvFcZzuIavlVfUsRISBFKET12yUVaLqvtX+SI=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "109abf3c735c3cde590f22c484e28a71cca8b27c",
+        "rev": "6b4d766155b07e5d9c14a0c761b495ac9d25a8ae",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761520240,
-        "narHash": "sha256-3zsEtl77eQD61/7s9zJ9K3AuY7YQ7q41R4jK43ZZ8Ao=",
+        "lastModified": 1761779437,
+        "narHash": "sha256-hYHo/6/5t909MtrZBvhM8a6+Ahdg2rd3y7oaRok1QSg=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "5de358f0163906c3d7e542f0406473defb349d09",
+        "rev": "f33b8a170f1faf6b51d208868a884413d5e5d980",
         "type": "github"
       },
       "original": {

From 4a5aedbc0e5dbf8373f2abbe2e3f41a3257fa751 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 31 Oct 2025 14:50:49 -0400
Subject: [PATCH 461/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 06cb445..1858b18 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760701190,
-        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
+        "lastModified": 1761899396,
+        "narHash": "sha256-XOpKBp6HLzzMCbzW50TEuXN35zN5WGQREC7n34DcNMM=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
+        "rev": "6f4cf5abbe318e4cd1e879506f6eeafd83f7b998",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761848543,
-        "narHash": "sha256-DvFpvmtFMeXUNxzd7OZ/Nzj0PeXKe3Sh8gN8xgRb8+I=",
+        "lastModified": 1761922639,
+        "narHash": "sha256-UIVakL0kxdQlrXbehqqfV9uDJTZBCWIsJ4aEoOYQ87U=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "16724b5b6836a2d4b8936a5824d2ff27c52b4517",
+        "rev": "31c511a968348281e11d590446bb815048a1e912",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1761827175,
-        "narHash": "sha256-XdPVSYyIBK4/ruoqujaQmmSGg3J2/EenexV9IEXhr6o=",
+        "lastModified": 1761933221,
+        "narHash": "sha256-rNHeoG3ZrA94jczyLSjxCtu67YYPYIlXXr0uhG3wNxM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "43ffe9ac82567512abb83187cb673de1091bdfa8",
+        "rev": "7467f155fcba189eb088a7601f44fbef7688669b",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761825566,
-        "narHash": "sha256-RG1Z8nkvFcZzuIavlVfUsRISBFKET12yUVaLqvtX+SI=",
+        "lastModified": 1761869910,
+        "narHash": "sha256-ogo46cmshLzXOOz1YO7KKAXaQNVsU5witFSNLWIULpU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6b4d766155b07e5d9c14a0c761b495ac9d25a8ae",
+        "rev": "412e15bdb690c5e4ad99dbc9cc91692393120c57",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761779437,
-        "narHash": "sha256-hYHo/6/5t909MtrZBvhM8a6+Ahdg2rd3y7oaRok1QSg=",
+        "lastModified": 1761865838,
+        "narHash": "sha256-y9R3Wo4oxYodZb7fHzcF4qdyf7RaHBieC84YVPb4Sak=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "f33b8a170f1faf6b51d208868a884413d5e5d980",
+        "rev": "90d75fb3f6d3631ba4a4519dcace629711dfcb19",
         "type": "github"
       },
       "original": {

From 6a73b2f4f42c1fe99863e58103286f74d0607336 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 2 Nov 2025 19:50:05 -0500
Subject: [PATCH 462/847] update

---
 flake.lock          | 24 ++++++++++++------------
 tests/minecraft.nix |  2 +-
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1858b18..05343c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761922639,
-        "narHash": "sha256-UIVakL0kxdQlrXbehqqfV9uDJTZBCWIsJ4aEoOYQ87U=",
+        "lastModified": 1762126868,
+        "narHash": "sha256-IzKOmbsRqeucVlw6EE/Y/Td2oPaGMC1N+H931q669ag=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "31c511a968348281e11d590446bb815048a1e912",
+        "rev": "bcfa87622ae46be6345a8e3dfdbdc5ba5414042b",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761703457,
-        "narHash": "sha256-nXOEEmPmE3RSzNntpDu17p2SpQ1rNDCXlHpMucJCef0=",
+        "lastModified": 1762049192,
+        "narHash": "sha256-4zTar274c7NXC3WA8UFXrRfFp/Clo7dixyogMJcHXw0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8b74b9b65a97d9e2541a9fd28d79d91413e9bda1",
+        "rev": "e8092a7c5eb7f03612bd9eaff5d57652dfe0e7a8",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761597516,
-        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "lastModified": 1761999846,
+        "narHash": "sha256-IYlYnp4O4dzEpL77BD/lj5NnJy2J8qbHkNSFiPBCbqo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "rev": "3de8f8d73e35724bf9abef41f1bdbedda1e14a31",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1761865838,
-        "narHash": "sha256-y9R3Wo4oxYodZb7fHzcF4qdyf7RaHBieC84YVPb4Sak=",
+        "lastModified": 1762124868,
+        "narHash": "sha256-1B/0tIFlsNdE4M7AWKT7h9Y++LZB6mu0AfCNT5chPjI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "90d75fb3f6d3631ba4a4519dcace629711dfcb19",
+        "rev": "0a8beace7a975a40a370026d3fed4cd479a81a2e",
         "type": "github"
       },
       "original": {
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index b80913e..ca2d18a 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -93,7 +93,7 @@ testPkgs.testers.runNixOSTest {
         try:
             machine.wait_until_succeeds(
                 "grep -Eq '\\[[0-9]+:[0-9]+:[0-9]+\\] \\[Server thread/INFO\\]: Done \\([0-9]+\\.[0-9]+s\\)! For help, type \"help\"' /var/lib/minecraft/main/logs/latest.log",
-                timeout=60
+                timeout=120
             )
         except Exception:
             print(machine.succeed("cat /var/lib/minecraft/main/logs/latest.log"))

From 19c384f00934dd8b9ed0843ed096a7aa91c3d812 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 3 Nov 2025 13:21:05 -0500
Subject: [PATCH 463/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 05343c1..92c0c54 100644
--- a/flake.lock
+++ b/flake.lock
@@ -298,11 +298,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1756744479,
-        "narHash": "sha256-EyZXusK/wRD3V9vDh00W2Re3Eg8UQ+LjVBQrrH9dq1U=",
+        "lastModified": 1762179568,
+        "narHash": "sha256-sv6YY19xIweeRwos41cvT92+SZcF6d6o4BcSuPnrPwQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "747b7912f49e2885090c83364d88cf853a020ac1",
+        "rev": "cbe4178bf694a9081d51e8ac55e5baadc1d4fa40",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762126868,
-        "narHash": "sha256-IzKOmbsRqeucVlw6EE/Y/Td2oPaGMC1N+H931q669ag=",
+        "lastModified": 1762192406,
+        "narHash": "sha256-HYrKS55wUpVf7gAuMKwNiIwmntAaShVVnl8wIm5zmEs=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "bcfa87622ae46be6345a8e3dfdbdc5ba5414042b",
+        "rev": "e7da30b584dc1f2ee0414c4a1298ce64eef97e8d",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1761933221,
-        "narHash": "sha256-rNHeoG3ZrA94jczyLSjxCtu67YYPYIlXXr0uhG3wNxM=",
+        "lastModified": 1762179181,
+        "narHash": "sha256-T4+TNfXlF/gHbcNCC2HY7sMGBKgqNzyYeMBWmcbH7/o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7467f155fcba189eb088a7601f44fbef7688669b",
+        "rev": "256770618502d2eda892af3ae91da5e386ce9586",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754189623,
-        "narHash": "sha256-fstu5eb30UYwsxow0aQqkzxNxGn80UZjyehQVNVHuBk=",
+        "lastModified": 1761791894,
+        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c582ff7f0d8a7ea689ae836dfb1773f1814f472a",
+        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761869910,
-        "narHash": "sha256-ogo46cmshLzXOOz1YO7KKAXaQNVsU5witFSNLWIULpU=",
+        "lastModified": 1762132580,
+        "narHash": "sha256-wyz5URCnImTGCvKFi1lL7hLUsAnkhOCT8hbEwTya0Lk=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "412e15bdb690c5e4ad99dbc9cc91692393120c57",
+        "rev": "38df2ab11fa831d0715e3d58f934e385a871ca49",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762124868,
-        "narHash": "sha256-1B/0tIFlsNdE4M7AWKT7h9Y++LZB6mu0AfCNT5chPjI=",
+        "lastModified": 1762191794,
+        "narHash": "sha256-GAM7Dwzfk8xg5UqBNZ4J4mmEgsuQM0L1cnMppnIXWu0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "0a8beace7a975a40a370026d3fed4cd479a81a2e",
+        "rev": "3d63f271726eb1a4a4c00056b25d693415f3f6f5",
         "type": "github"
       },
       "original": {

From b89b84ceca770e5ebf5d12c708f49c7b644b0edc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 5 Nov 2025 00:42:23 -0500
Subject: [PATCH 464/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 92c0c54..5509003 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1756719547,
-        "narHash": "sha256-N9gBKUmjwRKPxAafXEk1EGadfk2qDZPBQp4vXWPHINQ=",
+        "lastModified": 1762286984,
+        "narHash": "sha256-9I2H9x5We6Pl+DBYHjR1s3UT8wgwcpAH03kn9CqtdQc=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "125ae9e3ecf62fb2c0fd4f2d894eb971f1ecaed2",
+        "rev": "9c870f63e28ec1e83305f7f6cb73c941e699f74f",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761899396,
-        "narHash": "sha256-XOpKBp6HLzzMCbzW50TEuXN35zN5WGQREC7n34DcNMM=",
+        "lastModified": 1762276996,
+        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "6f4cf5abbe318e4cd1e879506f6eeafd83f7b998",
+        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
         "type": "github"
       },
       "original": {
@@ -298,11 +298,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1762179568,
-        "narHash": "sha256-sv6YY19xIweeRwos41cvT92+SZcF6d6o4BcSuPnrPwQ=",
+        "lastModified": 1762205063,
+        "narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "cbe4178bf694a9081d51e8ac55e5baadc1d4fa40",
+        "rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762192406,
-        "narHash": "sha256-HYrKS55wUpVf7gAuMKwNiIwmntAaShVVnl8wIm5zmEs=",
+        "lastModified": 1762311675,
+        "narHash": "sha256-zDawh2lcjumzVWHKWjkrAS+bam9ES9OLr67KGOM6onU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e7da30b584dc1f2ee0414c4a1298ce64eef97e8d",
+        "rev": "9aa63374f2101f4eaef425888699907b238ed2c0",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762049192,
-        "narHash": "sha256-4zTar274c7NXC3WA8UFXrRfFp/Clo7dixyogMJcHXw0=",
+        "lastModified": 1762308139,
+        "narHash": "sha256-h+2rffSCJePpff0kJbT1OYWaiYz0gffUUrPrbs0z4Ec=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e8092a7c5eb7f03612bd9eaff5d57652dfe0e7a8",
+        "rev": "b0b7832d17eca6d2146f15d544b5729b637828cd",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762179181,
-        "narHash": "sha256-T4+TNfXlF/gHbcNCC2HY7sMGBKgqNzyYeMBWmcbH7/o=",
+        "lastModified": 1762267440,
+        "narHash": "sha256-WHjEJ80oYbWyNu0dxysBs5oMlBc5w7YYzL1/UPj4iGo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "256770618502d2eda892af3ae91da5e386ce9586",
+        "rev": "2e85ae1b7030df39269d29118b1f74944d0c8f15",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762191794,
-        "narHash": "sha256-GAM7Dwzfk8xg5UqBNZ4J4mmEgsuQM0L1cnMppnIXWu0=",
+        "lastModified": 1762297661,
+        "narHash": "sha256-Sx9fNTCvN8NNFFIIoJW9yEjJ30OSqRZ6983+hnn4yQA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "3d63f271726eb1a4a4c00056b25d693415f3f6f5",
+        "rev": "025cac18cf2b63a3ac3e366fd43257568ae5c340",
         "type": "github"
       },
       "original": {

From 10df13228eaf630c52597b9b53f174fd6aebc639 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 5 Nov 2025 13:20:42 -0500
Subject: [PATCH 465/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5509003..d7d5602 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762311675,
-        "narHash": "sha256-zDawh2lcjumzVWHKWjkrAS+bam9ES9OLr67KGOM6onU=",
+        "lastModified": 1762365496,
+        "narHash": "sha256-be6fPe1Yz3ba86OprqprZXR8qZjMVpWM1yj6z0/7hyY=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "9aa63374f2101f4eaef425888699907b238ed2c0",
+        "rev": "5886f4f545591dafbbd9d6117a46d7399ce13bfa",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762267440,
-        "narHash": "sha256-WHjEJ80oYbWyNu0dxysBs5oMlBc5w7YYzL1/UPj4iGo=",
+        "lastModified": 1762336257,
+        "narHash": "sha256-2u5rstcMTqpAr4UF+exs5WGOT62VJRb4yauR6JJHJXs=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2e85ae1b7030df39269d29118b1f74944d0c8f15",
+        "rev": "d48e8f0e1691e0200a675c13df7c85e275090a15",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761999846,
-        "narHash": "sha256-IYlYnp4O4dzEpL77BD/lj5NnJy2J8qbHkNSFiPBCbqo=",
+        "lastModified": 1762233356,
+        "narHash": "sha256-cGS3lLTYusbEP/IJIWGgnkzIl+FA5xDvtiHyjalGr4k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3de8f8d73e35724bf9abef41f1bdbedda1e14a31",
+        "rev": "ca534a76c4afb2bdc07b681dbc11b453bab21af8",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762132580,
-        "narHash": "sha256-wyz5URCnImTGCvKFi1lL7hLUsAnkhOCT8hbEwTya0Lk=",
+        "lastModified": 1762364531,
+        "narHash": "sha256-SGO1H60JNT/UYTs9Ab0otFBB4slt6p1+zBx69mrbK1s=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "38df2ab11fa831d0715e3d58f934e385a871ca49",
+        "rev": "a45c12f0242460f37ad221cb7119a10e35aa3bcb",
         "type": "github"
       },
       "original": {

From b6dbf97c4ceb41e4b857d0b30508cb593f465a59 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 6 Nov 2025 16:32:23 -0500
Subject: [PATCH 466/847] set gpu module to "xe"

Possibly could fix i915 driver issues I'm having
with my arc a380?

Panic:
```
Unexpected send: action=0x1000
WARNING: CPU: 7 PID: 62977 at drivers/gpu/drm/i915/gt/uc/intel_guc_ct.c:844 intel_guc_ct_send+0x67a/0x7d0 [i915]
Modules linked in: bluetooth ecdh_generic ecc crc16 xt_nat nft_chain_nat nf_nat veth wireguard curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305
_x86_64 libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel msr af_packet mei_hdcp mei_pxp cfg80211 mei_gsc mei_me rfkill mei xe snd_hda_codec_hdmi e
dac_mce_amd edac_core intel_rapl_msr amd_atl intel_rapl_common snd_hda_intel crct10dif_pclmul polyval_clmulni polyval_generic snd_intel_dspcfg ghash_clmuln
i_intel snd_intel_sdw_acpi r8169 sha512_ssse3 sha256_ssse3 snd_hda_codec sha1_ssse3 snd_hda_core aesni_intel drm_gpuvm snd_hwdep gf128mul drm_exec realtek
gpu_sched snd_pcm crypto_simd drm_suballoc_helper cryptd mdio_devres drm_ttm_helper wmi_bmof snd_timer of_mdio snd fixed_phy soundcore fwnode_mdio rapl sp5
100_tco libphy watchdog xt_conntrack input_leds joydev led_class evdev mac_hid tiny_power_button rtc_cmos nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 gpio_a
mdpt onboard_usb_dev gpio_generic xt_tcpudp button uas ipt_rpfilter xt_pkttype nft_compat
 nf_tables libcrc32c crc32c_generic crc32c_intel sch_fq_codel ee1004 i2c_piix4 i2c_smbus i2c_dev atkbd libps2 serio vivaldi_fmap loop cpufreq_powersave tun
 tap macvlan bridge stp llc zenpower(O) kvm_amd ccp rng_core kvm irqbypass fuse efi_pstore configfs nfnetlink dmi_sysfs ip_tables x_tables nls_iso8859_1 nl
s_cp437 vfat f2fs fat dm_snapshot dm_bufio hid_generic dm_mod dax crc32_generic lz4hc_compress sd_mod usbhid hid usb_storage lz4_compress i915 ahci i2c_alg
o_bit drm_buddy libahci video libata ttm intel_gtt nvme scsi_mod drm_display_helper nvme_core xhci_pci nvme_auth cec xhci_hcd crc32_pclmul scsi_common wmi
zfs(PO) spl(O) efivarfs autofs4
CPU: 7 UID: 995 PID: 62977 Comm: av:hevc:df0 Tainted: P        W  O       6.12.50-hardened1 #1-NixOS
Tainted: [P]=PROPRIETARY_MODULE, [W]=WARN, [O]=OOT_MODULE
Hardware name: To Be Filled By O.E.M. B550M Pro4/B550M Pro4, BIOS P3.40 01/18/2024
RIP: 0010:intel_guc_ct_send+0x67a/0x7d0 [i915]
Code: 87 d0 06 00 00 3c 01 0f 87 d7 2f 17 00 a8 01 0f 85 42 ff ff ff 90 48 8b 44 24 18 48 c7 c7 50 43 34 c1 8b 30 e8 07 bf 89 d7 90 <0f> 0b 90 90 e9 24 ff
ff ff 48 8b 7c 24 20 e8 63 45 5d d8 48 8d 7c
RSP: 0018:ffffd57551c770c0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8e019b6b8508 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffd57551c77158 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8e01a5680b80
R13: ffff8e019b6b82a0 R14: ffff8e018b0c7004 R15: ffff8e019b6b82a0
FS:  00006b26fb1596c0(0000) GS:ffff8e107ef80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00006b26cc2b8438 CR3: 00000003c0dde000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? srso_alias_return_thunk+0x5/0xfbef5
 __guc_add_request+0xd2/0x2c0 [i915]
 guc_submit_request+0x1bc/0x210 [i915]
 submit_notify+0xfd/0x150 [i915]
 __i915_sw_fence_complete+0x3a/0x210 [i915]
 __i915_request_queue+0x51/0x70 [i915]
 i915_request_add+0x64/0xe0 [i915]
 intel_context_migrate_copy+0x39e/0xac0 [i915]
 __i915_ttm_move+0x821/0xa00 [i915]
 i915_ttm_move+0x348/0x470 [i915]
 ? unmap_mapping_range+0x85/0x150
 ttm_bo_handle_move_mem+0xe1/0x1d0 [ttm]
 ttm_bo_validate+0xde/0x190 [ttm]
 ? srso_alias_return_thunk+0x5/0xfbef5
 __i915_ttm_get_pages+0x9f/0x1b0 [i915]
 i915_ttm_get_pages+0xca/0x180 [i915]
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? srso_alias_return_thunk+0x5/0xfbef5
 __i915_gem_object_get_pages+0x3a/0x50 [i915]
 i915_vma_pin_ww+0x718/0x9c0 [i915]
 eb_validate_vmas+0x192/0xaa0 [i915]
 ? srso_alias_return_thunk+0x5/0xfbef5
 i915_gem_do_execbuffer+0xfc9/0x2890 [i915]
 i915_gem_execbuffer2_ioctl+0x16b/0x290 [i915]
 ? __pfx_i915_gem_execbuffer2_ioctl+0x10/0x10 [i915]
 drm_ioctl_kernel+0xb8/0x110
 drm_ioctl+0x2c6/0x550
 ? __pfx_i915_gem_execbuffer2_ioctl+0x10/0x10 [i915]
 __x64_sys_ioctl+0x9c/0xe0
 do_syscall_64+0xd5/0x210
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x6b270a88cf0f
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 28 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00006b26fb13f560 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00006b26cc2b4540 RCX: 00006b270a88cf0f
RDX: 00006b26fb13f650 RSI: 00000000c0406469 RDI: 0000000000000003
RBP: 00006b26fb13f650 R08: 0000000000000000 R09: 0000000000000000
R10: 00006b26cc263d10 R11: 0000000000000246 R12: 00000000c0406469
R13: 0000000000000003 R14: 000000003c959460 R15: 000000003c948860
 </TASK>
---[ end trace 0000000000000000 ]---
```
---
 configuration.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index ac9313f..cde558c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -79,6 +79,8 @@
     optimise.automatic = true;
   };
 
+  hardware.intelgpu.driver = "xe";
+
   boot = {
     # 6.12 LTS until 2026
     kernelPackages = pkgs.linuxPackages_6_12_hardened;

From 9b6c5fc17da1bfeaa5df63cb5845dad48fdd38de Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 7 Nov 2025 00:38:40 -0500
Subject: [PATCH 467/847] minecraft: update mods

---
 services/minecraft.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index cd9cd85..6322f53 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -62,13 +62,13 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/lxeiLRwe/fabric-api-0.136.0%2B1.21.10.jar";
-              sha512 = "d6ad5afeb57dc6dbe17a948990fc8441fbbc13a748814a71566404d919384df8bd7abebda52a58a41eb66370a86b8c4f910b64733b135946ecd47e53271310b5";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/UuXf1NbU/fabric-api-0.138.0%2B1.21.10.jar";
+              sha512 = "723e0c4fcd8287f085344cde87aeac23d4b13652a50404a42363417e1bd47fe79038c304c92327728b7c96b9216cff5eb9091ce41aeca535aa93a543a1039c9d";
             };
 
             FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/CtMpt7Jr/ferritecore-8.0.0-fabric.jar";
-              sha512 = "131b82d1d366f0966435bfcb38c362d604d68ecf30c106d31a6261bfc868ca3a82425bb3faebaa2e5ea17d8eed5c92843810eb2df4790f2f8b1e6c1bdc9b7745";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/MGoveONm/ferritecore-8.0.2-fabric.jar";
+              sha512 = "8c3890fb116dfaf681f5f483ea0d1bfecfb87dd584cc72e772fe43ea6ecf15a09c782fedbe5cea3b8bf7e930bd5c00753a619ac5ce7afa7fd092769d68e9beec";
             };
 
             Lithium = fetchurl {
@@ -77,8 +77,8 @@
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/LhwpK0O6/NoChatReports-FABRIC-1.21.7-v2.14.0.jar";
-              sha512 = "6e93c822e606ad12cb650801be1b3f39fcd2fef64a9bb905f357eb01a28451afddb3a6cadb39c112463519df0a07b9ff374d39223e9bf189aee7e7182077a7ae";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/78RjC1gi/NoChatReports-FABRIC-1.21.10-v2.16.0.jar";
+              sha512 = "39b2f284f73f8290012b8b9cc70085d59668547fc7b4ec43ab34e4bca6b39a6691fbe32bc3326e40353ba9c16a06320e52818315be77799a5aad526370cbc773";
             };
 
             squaremap = fetchurl {
@@ -92,8 +92,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/eY3dbqLu/c2me-fabric-mc1.21.10-0.3.5.0.0.jar";
-              sha512 = "a3422b75899a9355aa13128651ed2815ff83ff698c4c22a94ea7f275c656aff247440085a47de20353ff54469574c84adc9b428c2e963a80a3c6657fb849825d";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/uNick7oj/c2me-fabric-mc1.21.10-0.3.5.1.0.jar";
+              sha512 = "4d079c872ab910fd65a6c9e8709c7050178626f7125c849389ca38388e19995bd874e071e86e6acf6fbefaa2f294fdbebecb9af8444a908b9a3de894d807c4db";
             };
 
             krypton = fetchurl {

From c9f29beba5ec7b796e0093633de2b2449f3d0ea3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 7 Nov 2025 02:07:01 -0500
Subject: [PATCH 468/847] update

---
 flake.lock | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/flake.lock b/flake.lock
index d7d5602..206f347 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762365496,
-        "narHash": "sha256-be6fPe1Yz3ba86OprqprZXR8qZjMVpWM1yj6z0/7hyY=",
+        "lastModified": 1762445565,
+        "narHash": "sha256-RRloaQrYmq3vqV3EOVLFsTBYt3atTCnQu6KNnt3RYes=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "5886f4f545591dafbbd9d6117a46d7399ce13bfa",
+        "rev": "7f09a680af6e0ef612de81018e1d19c19b8651e8",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762308139,
-        "narHash": "sha256-h+2rffSCJePpff0kJbT1OYWaiYz0gffUUrPrbs0z4Ec=",
+        "lastModified": 1762480864,
+        "narHash": "sha256-OD3/2nATIXFEyTq3cxGUjZyBf8YlCSpIX/iJzSJbWag=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b0b7832d17eca6d2146f15d544b5729b637828cd",
+        "rev": "4f3414fdfce0ddf85c35e95d07809aeb93d2f0ad",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762336257,
-        "narHash": "sha256-2u5rstcMTqpAr4UF+exs5WGOT62VJRb4yauR6JJHJXs=",
+        "lastModified": 1762463231,
+        "narHash": "sha256-hv1mG5j5PTbnWbtHHomzTus77pIxsc4x8VrMjc7+/YE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d48e8f0e1691e0200a675c13df7c85e275090a15",
+        "rev": "52113c4f5cfd1e823001310e56d9c8d0699a6226",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762364531,
-        "narHash": "sha256-SGO1H60JNT/UYTs9Ab0otFBB4slt6p1+zBx69mrbK1s=",
+        "lastModified": 1762390828,
+        "narHash": "sha256-ZwK+G3/M7UcaLfRC8ZE6ZF6w9ixoS8Gfv85zm+1ArgY=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "a45c12f0242460f37ad221cb7119a10e35aa3bcb",
+        "rev": "21ac46dae9657315a799402aad92a432548bb99f",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762297661,
-        "narHash": "sha256-Sx9fNTCvN8NNFFIIoJW9yEjJ30OSqRZ6983+hnn4yQA=",
+        "lastModified": 1762470454,
+        "narHash": "sha256-muU918mAyasT07AQcZUqsZg1kMe7mdyQ4IhkwJsHWTQ=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "025cac18cf2b63a3ac3e366fd43257568ae5c340",
+        "rev": "952b7a2eb96d5ec6018fdcaa12e43858eab0ca84",
         "type": "github"
       },
       "original": {
@@ -597,11 +597,11 @@
     "website": {
       "flake": false,
       "locked": {
-        "lastModified": 1756870892,
-        "narHash": "sha256-jPcADOXoREf92sA/wHX9tXfuRRDpwIba4NIqz/Gl8Kg=",
+        "lastModified": 1762499206,
+        "narHash": "sha256-xJ7aYls8CcUwmIavPSt1V9lm2NDiR9ybz1VPG+NALT4=",
         "ref": "refs/heads/main",
-        "rev": "890c7633d469862a54b9c5993050b1f287242f2d",
-        "revCount": 20,
+        "rev": "c30dfe73bdeeec3dfeff09b8a0d9e40ce3a02995",
+        "revCount": 22,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/website"
       },

From 4ddb38abfe180d17fa8bc9a4aba307e5c3e553ce Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 7 Nov 2025 13:14:51 -0500
Subject: [PATCH 469/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 206f347..7855ac7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762445565,
-        "narHash": "sha256-RRloaQrYmq3vqV3EOVLFsTBYt3atTCnQu6KNnt3RYes=",
+        "lastModified": 1762538605,
+        "narHash": "sha256-V+pGCO03qq97zAmS+wrCsJDpqcfwt2pSiB9oKq8Q2CI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "7f09a680af6e0ef612de81018e1d19c19b8651e8",
+        "rev": "16bcc1259d311d0fd37fe00fefcc7900324d38cb",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762233356,
-        "narHash": "sha256-cGS3lLTYusbEP/IJIWGgnkzIl+FA5xDvtiHyjalGr4k=",
+        "lastModified": 1762498405,
+        "narHash": "sha256-Zg/SCgCaAioc0/SVZQJxuECGPJy+OAeBcGeA5okdYDc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ca534a76c4afb2bdc07b681dbc11b453bab21af8",
+        "rev": "6faeb062ee4cf4f105989d490831713cc5a43ee1",
         "type": "github"
       },
       "original": {

From 25f63fe3e656b5f05f8492058ce83c2bdb0ee417 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 9 Nov 2025 14:35:35 -0500
Subject: [PATCH 470/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7855ac7..f00c4c4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1761656077,
-        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762538605,
-        "narHash": "sha256-V+pGCO03qq97zAmS+wrCsJDpqcfwt2pSiB9oKq8Q2CI=",
+        "lastModified": 1762705862,
+        "narHash": "sha256-XgUhFKe64OwCXShxKCvqsq3F7nVAFM6DFdUUbL7iQYA=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "16bcc1259d311d0fd37fe00fefcc7900324d38cb",
+        "rev": "b8595b16e69e3029e06be3b8f6635f9812b2bc3f",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762480864,
-        "narHash": "sha256-OD3/2nATIXFEyTq3cxGUjZyBf8YlCSpIX/iJzSJbWag=",
+        "lastModified": 1762653944,
+        "narHash": "sha256-zAgyqF6bPFGCe9WcZdskvxS3qmMPOh15TBF6yxbai78=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4f3414fdfce0ddf85c35e95d07809aeb93d2f0ad",
+        "rev": "8fa3e5e2763f7dfc7ab665609167a4e6796518f4",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762390828,
-        "narHash": "sha256-ZwK+G3/M7UcaLfRC8ZE6ZF6w9ixoS8Gfv85zm+1ArgY=",
+        "lastModified": 1762630873,
+        "narHash": "sha256-3oBDTcYuTFk2e5xINUvXkmGy/NCosajTeFFZIgyrpZE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "21ac46dae9657315a799402aad92a432548bb99f",
+        "rev": "84e1e515d32e2d92098ed2a8d102d71ac58676e5",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762470454,
-        "narHash": "sha256-muU918mAyasT07AQcZUqsZg1kMe7mdyQ4IhkwJsHWTQ=",
+        "lastModified": 1762643267,
+        "narHash": "sha256-sUIPE5DEQlFNsL6v5msPrep8hiPGmu7EqLmyyPS80F8=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "952b7a2eb96d5ec6018fdcaa12e43858eab0ca84",
+        "rev": "bcc072876c90e230ade099b14e8ddbbe06df40c6",
         "type": "github"
       },
       "original": {

From 268b648de4c0ec78714221b3da4f414f757b74f3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 11 Nov 2025 00:12:49 -0500
Subject: [PATCH 471/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index f00c4c4..56ba4f6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762705862,
-        "narHash": "sha256-XgUhFKe64OwCXShxKCvqsq3F7nVAFM6DFdUUbL7iQYA=",
+        "lastModified": 1762815613,
+        "narHash": "sha256-a9IT5scvHH8TrL73dp0eoMNU9hEvHwglxj2rXviBHdg=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b8595b16e69e3029e06be3b8f6635f9812b2bc3f",
+        "rev": "ece0f5c1771f1835e66900d4168233f0430d819d",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762653944,
-        "narHash": "sha256-zAgyqF6bPFGCe9WcZdskvxS3qmMPOh15TBF6yxbai78=",
+        "lastModified": 1762826586,
+        "narHash": "sha256-KlPcXOxxyv+KNcf7yNFQ4DGVFbOpITqHfvMcAUYrL7E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8fa3e5e2763f7dfc7ab665609167a4e6796518f4",
+        "rev": "1a4fa22ec6e9f2ece24fca273352463b75f6f7c0",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762498405,
-        "narHash": "sha256-Zg/SCgCaAioc0/SVZQJxuECGPJy+OAeBcGeA5okdYDc=",
+        "lastModified": 1762756533,
+        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6faeb062ee4cf4f105989d490831713cc5a43ee1",
+        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762630873,
-        "narHash": "sha256-3oBDTcYuTFk2e5xINUvXkmGy/NCosajTeFFZIgyrpZE=",
+        "lastModified": 1762737305,
+        "narHash": "sha256-5zN6jJ6KKBGiJeK3Q4+afZfJU7VyyUgehOAA3zYegTc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "84e1e515d32e2d92098ed2a8d102d71ac58676e5",
+        "rev": "c04379f95fca70b38cdd45a1a7affe6d4226912b",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762643267,
-        "narHash": "sha256-sUIPE5DEQlFNsL6v5msPrep8hiPGmu7EqLmyyPS80F8=",
+        "lastModified": 1762816066,
+        "narHash": "sha256-cY7ZBS+09UjIOxsNplSgNT/3eTViWPPt2f73N++mx30=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "bcc072876c90e230ade099b14e8ddbbe06df40c6",
+        "rev": "98f6c0dc02dff860f7750b920a35d038d264586e",
         "type": "github"
       },
       "original": {

From c06969f84903fbe448571b82726b3cefc38e1653 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 11 Nov 2025 00:46:39 -0500
Subject: [PATCH 472/847] Revert "openrgb: override mbedtls_2 with mbedtls"

This reverts commit b1b9a3755f31e834b1a58c0e6259fd92fc7c60fd.
---
 no-rgb.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/no-rgb.nix b/no-rgb.nix
index 25f5d8e..b304ecf 100644
--- a/no-rgb.nix
+++ b/no-rgb.nix
@@ -4,11 +4,6 @@
   pkgs,
   ...
 }:
-let
-  # mbedtls_2 is deprecated, override to fix build
-  openrgb_package = pkgs.openrgb.override { mbedtls_2 = pkgs.mbedtls; };
-in
-
 {
   systemd.services.no-rgb =
     let
@@ -16,7 +11,7 @@ in
         pkgs.writeShellApplication {
           name = "no-rgb";
           runtimeInputs = with pkgs; [
-            openrgb_package
+            openrgb
             coreutils
             gnugrep
           ];
@@ -45,10 +40,10 @@ in
 
   services.hardware.openrgb = {
     enable = true;
-    package = openrgb_package;
+    package = pkgs.openrgb-with-all-plugins;
     motherboard = "amd";
   };
 
-  services.udev.packages = [ openrgb_package ];
+  services.udev.packages = [ pkgs.openrgb-with-all-plugins ];
   hardware.i2c.enable = true;
 }

From 78712780795105ead01b8f38729e153627243e14 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 13 Nov 2025 02:43:42 -0500
Subject: [PATCH 473/847] jellyfin-qbittorrent-monitor: fix jellyfin api key
 file perms

---
 age-secrets.nix                           | 3 +--
 services/jellyfin-qbittorrent-monitor.nix | 5 ++++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/age-secrets.nix b/age-secrets.nix
index 709c59f..db2b772 100644
--- a/age-secrets.nix
+++ b/age-secrets.nix
@@ -39,10 +39,9 @@
       group = "caddy";
     };
 
-    # TODO! fix permissions
     jellyfin-api-key = {
       file = ./secrets/jellyfin-api-key.age;
-      mode = "0444";
+      mode = "0400";
       owner = "root";
       group = "root";
     };
diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index 430cc15..3ca0818 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -17,7 +17,7 @@
     serviceConfig = {
       Type = "simple";
       ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
-        export JELLYFIN_API_KEY=$(cat ${config.age.secrets.jellyfin-api-key.path})
+        export JELLYFIN_API_KEY=$(cat $CREDENTIALS_DIRECTORY/jellyfin-api-key)
         exec ${
           pkgs.python3.withPackages (ps: with ps; [ requests ])
         }/bin/python ${./jellyfin-qbittorrent-monitor.py}
@@ -37,6 +37,9 @@
       RestrictRealtime = true;
       RestrictSUIDSGID = true;
       RemoveIPC = true;
+
+      # Load credentials from agenix secrets
+      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
     };
 
     environment = {

From b6872cccf3bc698d9de3adb6e307dae52b3b93c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 14 Nov 2025 12:03:45 -0500
Subject: [PATCH 474/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 56ba4f6..3e6531d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -319,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762815613,
-        "narHash": "sha256-a9IT5scvHH8TrL73dp0eoMNU9hEvHwglxj2rXviBHdg=",
+        "lastModified": 1763132179,
+        "narHash": "sha256-oPB8WFvBHSfXPhSsOv9Tb5Way/y0JUzcucl72G0tZSQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "ece0f5c1771f1835e66900d4168233f0430d819d",
+        "rev": "9b17d74ab7d31cb7d15ee7eec1616c3d825a84c0",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762826586,
-        "narHash": "sha256-KlPcXOxxyv+KNcf7yNFQ4DGVFbOpITqHfvMcAUYrL7E=",
+        "lastModified": 1763085759,
+        "narHash": "sha256-nuw3iMywcsIpt39KNylc7ZA+GfJTyfIr6MWfbTeOlPw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1a4fa22ec6e9f2ece24fca273352463b75f6f7c0",
+        "rev": "166af74b5bb283a9b567416aa6ed62bdbef95b32",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762463231,
-        "narHash": "sha256-hv1mG5j5PTbnWbtHHomzTus77pIxsc4x8VrMjc7+/YE=",
+        "lastModified": 1762847253,
+        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "52113c4f5cfd1e823001310e56d9c8d0699a6226",
+        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
         "type": "github"
       },
       "original": {
@@ -372,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
+        "lastModified": 1763049705,
+        "narHash": "sha256-A5LS0AJZ1yDPTa2fHxufZN++n8MCmtgrJDtxFxrH4S8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
+        "rev": "3acb677ea67d4c6218f33de0db0955f116b7588c",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1762816066,
-        "narHash": "sha256-cY7ZBS+09UjIOxsNplSgNT/3eTViWPPt2f73N++mx30=",
+        "lastModified": 1763075262,
+        "narHash": "sha256-0J1d4/IzVEjaLky4xPb3mJkP0/pFqB0nkw777ZOpQno=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "98f6c0dc02dff860f7750b920a35d038d264586e",
+        "rev": "38a2e4af2352e7396b4320f40738da899f092e1e",
         "type": "github"
       },
       "original": {

From 668fb9df479a4b1d01e148116252ba7c0d374def Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 14 Nov 2025 12:11:13 -0500
Subject: [PATCH 475/847] enable kmscon

---
 configuration.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index cde558c..e46c4e8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -43,6 +43,8 @@
     ./services/caddy_senior_project.nix
   ];
 
+  services.kmscon.enable = true;
+
   systemd.targets = {
     sleep.enable = false;
     suspend.enable = false;

From a07f70ee3eb4e0279f2c7610b3d826016b1fb170 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 17 Nov 2025 08:30:36 -0500
Subject: [PATCH 476/847] update

---
 flake.lock | 104 +++++++++++++++++++++++++++++++----------------------
 1 file changed, 61 insertions(+), 43 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3e6531d..70a4c0d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -25,11 +25,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1754269165,
-        "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
+        "lastModified": 1762538466,
+        "narHash": "sha256-8zrIPl6J+wLm9MH5ksHcW7BUHo7jSNOu0/hA0ohOOaM=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "444e81206df3f7d92780680e45858e31d2f07a08",
+        "rev": "0cea393fffb39575c46b7a0318386467272182fe",
         "type": "github"
       },
       "original": {
@@ -102,6 +102,28 @@
         "type": "github"
       }
     },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1763361733,
+        "narHash": "sha256-ka7dpwH3HIXCyD2wl5F7cPLeRbqZoY2ullALsvxdPt8=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "6c8d48e3b0ae371b19ac1485744687b788e80193",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -121,11 +143,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -158,11 +180,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754091436,
-        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
+        "lastModified": 1762980239,
+        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
+        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
         "type": "github"
       },
       "original": {
@@ -289,20 +311,20 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
+        "fenix": "fenix",
         "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix"
       },
       "locked": {
-        "lastModified": 1762205063,
-        "narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=",
+        "lastModified": 1763376718,
+        "narHash": "sha256-bIYjIla2w6bzozkohYxsU/BP0hLs9w48ZwxBfg3cShE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05",
+        "rev": "0859944b08039342a9bb069e7edc1e62bb4d0e65",
         "type": "github"
       },
       "original": {
@@ -319,11 +341,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763132179,
-        "narHash": "sha256-oPB8WFvBHSfXPhSsOv9Tb5Way/y0JUzcucl72G0tZSQ=",
+        "lastModified": 1763377920,
+        "narHash": "sha256-vdmV1UpfepbGibWrUDuKGOuGIz/XJf4zOYWJ6ctVEoI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "9b17d74ab7d31cb7d15ee7eec1616c3d825a84c0",
+        "rev": "cb623de3fc61011e5062522b4d05721a22f2e916",
         "type": "github"
       },
       "original": {
@@ -341,11 +363,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763085759,
-        "narHash": "sha256-nuw3iMywcsIpt39KNylc7ZA+GfJTyfIr6MWfbTeOlPw=",
+        "lastModified": 1763171892,
+        "narHash": "sha256-6cg9zSiqKA89yJzVtYhBaBptqq6bX4pr4g7WLAHOD4Y=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "166af74b5bb283a9b567416aa6ed62bdbef95b32",
+        "rev": "316858c27d278b20e776cd4dd8f787812f587ba2",
         "type": "github"
       },
       "original": {
@@ -411,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "lastModified": 1763319842,
+        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
         "type": "github"
       },
       "original": {
@@ -443,24 +465,20 @@
         "website": "website"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
+    "rust-analyzer-src": {
+      "flake": false,
       "locked": {
-        "lastModified": 1761791894,
-        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
+        "lastModified": 1762860488,
+        "narHash": "sha256-rMfWMCOo/pPefM2We0iMBLi2kLBAnYoB9thi4qS7uk4=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "2efc80078029894eec0699f62ec8d5c1a56af763",
         "type": "github"
       },
       "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
         "type": "github"
       }
     },
@@ -487,11 +505,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762737305,
-        "narHash": "sha256-5zN6jJ6KKBGiJeK3Q4+afZfJU7VyyUgehOAA3zYegTc=",
+        "lastModified": 1763341292,
+        "narHash": "sha256-Cdn4V/Gljk4x9dn6vU7PE8iDOHOayxbtXXKJBfpunUM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "c04379f95fca70b38cdd45a1a7affe6d4226912b",
+        "rev": "4d555d1649dc4344e62a4e796197dcf6186cf587",
         "type": "github"
       },
       "original": {
@@ -548,11 +566,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763075262,
-        "narHash": "sha256-0J1d4/IzVEjaLky4xPb3mJkP0/pFqB0nkw777ZOpQno=",
+        "lastModified": 1763334474,
+        "narHash": "sha256-FRuOS1b0pc8QnEzWyrk2r/28k/SZaltxV2wivoISlUs=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "38a2e4af2352e7396b4320f40738da899f092e1e",
+        "rev": "55f07a6aae7228a2bbe0dc58e64800345fc0e237",
         "type": "github"
       },
       "original": {

From 7f9cd75902882f0c3ff823b12f79696eeaa30275 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 17 Nov 2025 10:37:45 -0500
Subject: [PATCH 477/847] zfs: fix zfs escaped spaces test

---
 tests/zfs.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/zfs.nix b/tests/zfs.nix
index f82e3f2..98c8574 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -85,7 +85,8 @@ testPkgs.testers.runNixOSTest {
 
     machine.succeed("zfsEnsureMounted '/mnt/test path with spaces'")
 
-    # machine.succeed("zfsEnsureMounted /mnt/test\\ escaped\\ spaces") # TODO! fix escaped spaces
+    machine.succeed("zfs create -o mountpoint='/mnt/test escaped spaces' rpool/test4")
+    machine.succeed("zfsEnsureMounted /mnt/test\ escaped\ spaces")
 
     machine.succeed("zfsEnsureMounted /mnt/test_mountpoint '/mnt/test path with spaces' /mnt/test_mountpoint_dos")
 

From c405ce7ac9204cece6f71675c939994727707155 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 18 Nov 2025 13:12:09 -0500
Subject: [PATCH 478/847] update

---
 flake.lock | 74 +++++++++++++++++++++---------------------------------
 1 file changed, 28 insertions(+), 46 deletions(-)

diff --git a/flake.lock b/flake.lock
index 70a4c0d..0495653 100644
--- a/flake.lock
+++ b/flake.lock
@@ -102,28 +102,6 @@
         "type": "github"
       }
     },
-    "fenix": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ],
-        "rust-analyzer-src": "rust-analyzer-src"
-      },
-      "locked": {
-        "lastModified": 1763361733,
-        "narHash": "sha256-ka7dpwH3HIXCyD2wl5F7cPLeRbqZoY2ullALsvxdPt8=",
-        "owner": "nix-community",
-        "repo": "fenix",
-        "rev": "6c8d48e3b0ae371b19ac1485744687b788e80193",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "fenix",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -311,20 +289,20 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "fenix": "fenix",
         "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1763376718,
-        "narHash": "sha256-bIYjIla2w6bzozkohYxsU/BP0hLs9w48ZwxBfg3cShE=",
+        "lastModified": 1763485704,
+        "narHash": "sha256-3er/jo34r75PesrkI939JC0g1MqsMZQZgVtNzSKYoaE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "0859944b08039342a9bb069e7edc1e62bb4d0e65",
+        "rev": "1a6b487e3045b916240ca52c22ebb22263bf1cff",
         "type": "github"
       },
       "original": {
@@ -341,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763377920,
-        "narHash": "sha256-vdmV1UpfepbGibWrUDuKGOuGIz/XJf4zOYWJ6ctVEoI=",
+        "lastModified": 1763488702,
+        "narHash": "sha256-FT14nM/z9k4ksGlEE4tI1H2l0MUSuHMihn9Hyx3fEhc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "cb623de3fc61011e5062522b4d05721a22f2e916",
+        "rev": "a045492088dd105231cc5f8bfaae2d527ce47344",
         "type": "github"
       },
       "original": {
@@ -394,11 +372,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763049705,
-        "narHash": "sha256-A5LS0AJZ1yDPTa2fHxufZN++n8MCmtgrJDtxFxrH4S8=",
+        "lastModified": 1763334038,
+        "narHash": "sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3acb677ea67d4c6218f33de0db0955f116b7588c",
+        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
         "type": "github"
       },
       "original": {
@@ -465,20 +443,24 @@
         "website": "website"
       }
     },
-    "rust-analyzer-src": {
-      "flake": false,
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1762860488,
-        "narHash": "sha256-rMfWMCOo/pPefM2We0iMBLi2kLBAnYoB9thi4qS7uk4=",
-        "owner": "rust-lang",
-        "repo": "rust-analyzer",
-        "rev": "2efc80078029894eec0699f62ec8d5c1a56af763",
+        "lastModified": 1763347184,
+        "narHash": "sha256-6QH8hpCYJxifvyHEYg+Da0BotUn03BwLIvYo3JAxuqQ=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "08895cce80433978d5bfd668efa41c5e24578cbd",
         "type": "github"
       },
       "original": {
-        "owner": "rust-lang",
-        "ref": "nightly",
-        "repo": "rust-analyzer",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
         "type": "github"
       }
     },
@@ -566,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763334474,
-        "narHash": "sha256-FRuOS1b0pc8QnEzWyrk2r/28k/SZaltxV2wivoISlUs=",
+        "lastModified": 1763420869,
+        "narHash": "sha256-DUUiidF5aSWlaKW1jcuw3DjqcFYPZm+sV8ADwIJQJ7M=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "55f07a6aae7228a2bbe0dc58e64800345fc0e237",
+        "rev": "f50bcb308db9e0af9f629d11fe0ff3f9b61dfcb9",
         "type": "github"
       },
       "original": {

From d9573a2f530398323ed6f4f4c43060cedf575820 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 19 Nov 2025 11:13:59 -0500
Subject: [PATCH 479/847] update

---
 flake.lock | 60 ++++++++++++++++--------------------------------------
 1 file changed, 17 insertions(+), 43 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0495653..c1345e2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -121,11 +121,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1761588595,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -151,27 +151,6 @@
       }
     },
     "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1762980239,
-        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
@@ -211,7 +190,7 @@
       "inputs": {
         "nixpkgs": [
           "lanzaboote",
-          "pre-commit-hooks-nix",
+          "pre-commit",
           "nixpkgs"
         ]
       },
@@ -289,20 +268,18 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat_2",
-        "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "pre-commit": "pre-commit",
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1763485704,
-        "narHash": "sha256-3er/jo34r75PesrkI939JC0g1MqsMZQZgVtNzSKYoaE=",
+        "lastModified": 1763563389,
+        "narHash": "sha256-ATuiSBINBTjVXiGOYJAX6ttiDElV9MmjkqG4A8a/J8g=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "1a6b487e3045b916240ca52c22ebb22263bf1cff",
+        "rev": "b2f781751764ff57d54f7cf1910ae1bbf268ed1c",
         "type": "github"
       },
       "original": {
@@ -313,17 +290,17 @@
     },
     "llamacpp": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1763488702,
-        "narHash": "sha256-FT14nM/z9k4ksGlEE4tI1H2l0MUSuHMihn9Hyx3fEhc=",
+        "lastModified": 1763567443,
+        "narHash": "sha256-VBfKRclwbF8+nBdcQK8EZ/qnNwM17y34h6Q/usxvWL4=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "a045492088dd105231cc5f8bfaae2d527ce47344",
+        "rev": "2eba631b8127a5a4853ea625a0eac4a7449bc7b8",
         "type": "github"
       },
       "original": {
@@ -398,12 +375,9 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
       }
     },
-    "pre-commit-hooks-nix": {
+    "pre-commit": {
       "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
+        "flake-compat": "flake-compat_2",
         "gitignore": "gitignore",
         "nixpkgs": [
           "lanzaboote",
@@ -548,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763420869,
-        "narHash": "sha256-DUUiidF5aSWlaKW1jcuw3DjqcFYPZm+sV8ADwIJQJ7M=",
+        "lastModified": 1763507267,
+        "narHash": "sha256-D5gAmg4b6wX1BgHJhKb3Byh4JgwzFwD5HjTjOhV/9q0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "f50bcb308db9e0af9f629d11fe0ff3f9b61dfcb9",
+        "rev": "9fddbaf49a4a226b0d0c9b8304ed02637438c450",
         "type": "github"
       },
       "original": {

From 88d656e3a316d1d3527b34292d58ff0fa54096c5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 00:52:26 -0500
Subject: [PATCH 480/847] add monero service

---
 configuration.nix   |  2 ++
 flake.nix           |  4 ++++
 services/monero.nix | 25 +++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 services/monero.nix

diff --git a/configuration.nix b/configuration.nix
index e46c4e8..426bc42 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -39,6 +39,8 @@
 
     ./services/bitwarden.nix
 
+    ./services/monero.nix
+
     # KEEP UNTIL 2028
     ./services/caddy_senior_project.nix
   ];
diff --git a/flake.nix b/flake.nix
index 246fb1d..e2546c6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -155,6 +155,10 @@
         vaultwarden = {
           path = "/var/lib/vaultwarden";
         };
+
+        monero = {
+          dataDir = "/services/monero";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/monero.nix b/services/monero.nix
new file mode 100644
index 0000000..cbc2c7b
--- /dev/null
+++ b/services/monero.nix
@@ -0,0 +1,25 @@
+{
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountDeps "monero" [
+      service_configs.monero.dataDir
+    ])
+    (lib.serviceDependZpool "monero" service_configs.zpool_hdds)
+  ];
+
+  services.monero = {
+    enable = true;
+    dataDir = service_configs.monero.dataDir;
+    rpc = {
+      restricted = true;
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z ${service_configs.monero.dataDir} 0700 monero monero"
+  ];
+}

From 4ce1cb862e9ada9e7eefe0982f08271ffd3aed11 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 16:06:29 -0500
Subject: [PATCH 481/847] zfs: HEAVILY REFACTOR subvolume handling

---
 lib.nix                  | 128 ++++++++++++++++++++++++++++-----------
 services/bitwarden.nix   |   6 +-
 services/caddy.nix       |   3 +-
 services/gitea.nix       |   3 +-
 services/immich.nix      |  10 +--
 services/jellyfin.nix    |   3 +-
 services/minecraft.nix   |  10 +--
 services/monero.nix      |   3 +-
 services/postgresql.nix  |   5 +-
 services/qbittorrent.nix |   3 +-
 services/soulseek.nix    |   4 +-
 tests/zfs.nix            |  74 ++++++++++++----------
 12 files changed, 157 insertions(+), 95 deletions(-)

diff --git a/lib.nix b/lib.nix
index 64fa140..7ee6ae3 100644
--- a/lib.nix
+++ b/lib.nix
@@ -9,28 +9,6 @@ inputs.nixpkgs.lib.extend (
     lib = prev;
   in
   {
-    serviceMountDeps =
-      serviceName: dirs:
-      { pkgs, ... }:
-      {
-        systemd.services."${serviceName}_mounts" = {
-          wants = [ "zfs.target" ];
-          before = [ "${serviceName}.service" ];
-
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = "${lib.getExe pkgs.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}";
-          };
-        };
-
-        systemd.services.${serviceName} = {
-          wants = [ "${serviceName}_mounts.service" ];
-          after = [ "${serviceName}_mounts.service" ];
-          requires = [ "${serviceName}_mounts.service" ];
-        };
-      };
-
     # stolen from: https://stackoverflow.com/a/42398526
     optimizeWithFlags =
       pkg: flags:
@@ -79,25 +57,101 @@ inputs.nixpkgs.lib.extend (
         };
       };
 
-    serviceDependZpool =
-      serviceName: zpool:
-      { config, ... }:
+    serviceMountWithZpool =
+      serviceName: zpool: dirs:
+      { pkgs, config, ... }:
       {
-        config = lib.mkIf (zpool != "") {
-          systemd.services.${serviceName} = {
-            wants = [ "zfs-import-${zpool}.service" ];
-            after = [ "zfs-import-${zpool}.service" ];
-            requires = [ "zfs-import-${zpool}.service" ];
-          };
+        systemd.services."${serviceName}-mounts" = {
+          wants = [ "zfs.target" ] ++ lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
+          after = lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
+          before = [ "${serviceName}.service" ];
 
-          # assert that the pool is even enabled
-          assertions = [
-            {
-              assertion = builtins.elem zpool config.boot.zfs.extraPools;
-              message = "${zpool} is not enabled in `boot.zfs.extraPools`";
-            }
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = lib.getExe (
+              pkgs.writeShellApplication {
+                name = "ensure-zfs-mounts-with-pool-${serviceName}";
+                runtimeInputs = with pkgs; [
+                  gawk
+                  coreutils
+                  config.boot.zfs.package
+                ];
+
+                text = ''
+                  set -euo pipefail
+
+                  echo "Ensuring ZFS mounts for service: ${serviceName}"
+                  echo "Directories: ${lib.strings.concatStringsSep ", " dirs}"
+
+                  # Validate mounts exist (ensureZfsMounts already has proper PATH)
+                  ${lib.getExe pkgs.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}
+
+                  # Additional runtime check: verify paths are on correct zpool
+                  ${lib.optionalString (zpool != "") ''
+                    echo "Verifying ZFS mountpoints are on pool '${zpool}'..."
+
+                    if ! zfs_list_output=$(zfs list -H -o name,mountpoint 2>&1); then
+                      echo "ERROR: Failed to query ZFS datasets: $zfs_list_output" >&2
+                      exit 1
+                    fi
+
+                    # This loop handles variable number of directories, shellcheck false positive
+                    # shellcheck disable=SC2043
+                    for target in ${lib.strings.concatStringsSep " " dirs}; do
+                      echo "Checking: $target"
+
+                      # Find dataset that has this mountpoint
+                      dataset=$(echo "$zfs_list_output" | awk -v target="$target" '$2 == target {print $1; exit}')
+
+                      if [ -z "$dataset" ]; then
+                        echo "ERROR: No ZFS dataset found for mountpoint: $target" >&2
+                        exit 1
+                      fi
+
+                      # Extract pool name from dataset (first part before /)
+                      actual_pool=$(echo "$dataset" | cut -d'/' -f1)
+
+                      if [ "$actual_pool" != "${zpool}" ]; then
+                        echo "ERROR: ZFS pool mismatch for $target" >&2
+                        echo " Expected pool: ${zpool}" >&2
+                        echo " Actual pool:   $actual_pool" >&2
+                        echo " Dataset:       $dataset" >&2
+                        exit 1
+                      fi
+
+                      echo "$target is on $dataset (pool: $actual_pool)"
+                    done
+
+                    echo "All paths verified successfully on pool '${zpool}'"
+                  ''}
+
+                  echo "Mount validation completed for ${serviceName}"
+                '';
+              }
+            );
+          };
+        };
+
+        systemd.services.${serviceName} = {
+          wants = [
+            "${serviceName}-mounts.service"
+          ];
+          after = [
+            "${serviceName}-mounts.service"
+          ];
+          requires = [
+            "${serviceName}-mounts.service"
           ];
         };
+
+        # assert that the pool is even enabled
+        #assertions = lib.optionals (zpool != "") [
+        #  {
+        #    assertion = builtins.elem zpool config.boot.zfs.extraPools;
+        #    message = "${zpool} is not enabled in `boot.zfs.extraPools`";
+        #  }
+        #];
       };
   }
 )
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 67d41bc..8028662 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -7,16 +7,14 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "vaultwarden" [
+    (lib.serviceMountWithZpool "vaultwarden" service_configs.zpool_ssds [
       service_configs.vaultwarden.path
       config.services.vaultwarden.backupDir
     ])
-    (lib.serviceMountDeps "backup-vaultwarden" [
+    (lib.serviceMountWithZpool "backup-vaultwarden" service_configs.zpool_ssds [
       service_configs.vaultwarden.path
       config.services.vaultwarden.backupDir
     ])
-    (lib.serviceDependZpool "vaultwarden" service_configs.zpool_ssds)
-    (lib.serviceDependZpool "backup-vaultwarden" service_configs.zpool_ssds)
   ];
 
   services.vaultwarden = {
diff --git a/services/caddy.nix b/services/caddy.nix
index 53126d3..b81a8e9 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -44,10 +44,9 @@ let
 in
 {
   imports = [
-    (lib.serviceMountDeps "caddy" [
+    (lib.serviceMountWithZpool "caddy" service_configs.zpool_ssds [
       config.services.caddy.dataDir
     ])
-    (lib.serviceDependZpool "caddy" service_configs.zpool_ssds)
   ];
 
   services.caddy = {
diff --git a/services/gitea.nix b/services/gitea.nix
index dd9f8d5..aae4fbb 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -7,8 +7,7 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
-    (lib.serviceDependZpool "gitea" service_configs.zpool_ssds)
+    (lib.serviceMountWithZpool "gitea" service_configs.zpool_ssds [ config.services.gitea.stateDir ])
   ];
 
   services.gitea = {
diff --git a/services/immich.nix b/services/immich.nix
index 183b0d4..b9b0e2f 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -7,10 +7,12 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "immich-server" [ config.services.immich.mediaLocation ])
-    (lib.serviceMountDeps "immich-machine-learning" [ config.services.immich.mediaLocation ])
-    (lib.serviceDependZpool "immich-server" service_configs.zpool_ssds)
-    (lib.serviceDependZpool "immich-machine-learning" service_configs.zpool_ssds)
+    (lib.serviceMountWithZpool "immich-server" service_configs.zpool_ssds [
+      config.services.immich.mediaLocation
+    ])
+    (lib.serviceMountWithZpool "immich-machine-learning" service_configs.zpool_ssds [
+      config.services.immich.mediaLocation
+    ])
   ];
 
   services.immich = {
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index e27e50b..3a75770 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -7,11 +7,10 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "jellyfin" [
+    (lib.serviceMountWithZpool "jellyfin" service_configs.zpool_ssds [
       config.services.jellyfin.dataDir
       config.services.jellyfin.cacheDir
     ])
-    (lib.serviceDependZpool "jellyfin" service_configs.zpool_ssds)
   ];
 
   services.jellyfin = {
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 6322f53..a75b3d6 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -7,10 +7,12 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "minecraft-server-${service_configs.minecraft.server_name}" [
-      "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
-    ])
-    (lib.serviceDependZpool "minecraft-server-${service_configs.minecraft.server_name}" service_configs.zpool_ssds)
+    (lib.serviceMountWithZpool "minecraft-server-${service_configs.minecraft.server_name}"
+      service_configs.zpool_ssds
+      [
+        "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
+      ]
+    )
   ];
 
   environment.systemPackages = [
diff --git a/services/monero.nix b/services/monero.nix
index cbc2c7b..1792ecf 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -5,10 +5,9 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "monero" [
+    (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
       service_configs.monero.dataDir
     ])
-    (lib.serviceDependZpool "monero" service_configs.zpool_hdds)
   ];
 
   services.monero = {
diff --git a/services/postgresql.nix b/services/postgresql.nix
index b773a60..c7a5d4b 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -7,8 +7,9 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "postgresql" [ config.services.postgresql.dataDir ])
-    (lib.serviceDependZpool "postgresql" service_configs.zpool_ssds)
+    (lib.serviceMountWithZpool "postgresql" service_configs.zpool_ssds [
+      config.services.postgresql.dataDir
+    ])
   ];
 
   services.postgresql = {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 10cf619..064662c 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -8,13 +8,12 @@
 }:
 {
   imports = [
-    (lib.serviceMountDeps "qbittorrent" [
+    (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_hdds [
       service_configs.torrents_path
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
     (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
-    (lib.serviceDependZpool "qbittorrent" service_configs.zpool_hdds)
   ];
 
   services.qbittorrent = {
diff --git a/services/soulseek.nix b/services/soulseek.nix
index f936e58..86a508c 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -11,13 +11,11 @@ let
 in
 {
   imports = [
-    (lib.serviceMountDeps "slskd" [
+    (lib.serviceMountWithZpool "slskd" "" [
       service_configs.slskd.base
       service_configs.slskd.downloads
       service_configs.slskd.incomplete
     ])
-    (lib.serviceDependZpool "slskd" service_configs.zpool_ssds)
-    (lib.serviceDependZpool "slskd" service_configs.zpool_hdds)
   ];
 
   users.groups."music" = { };
diff --git a/tests/zfs.nix b/tests/zfs.nix
index 98c8574..8d7350f 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -7,29 +7,29 @@
 }:
 let
   # Create pkgs with ensureZfsMounts overlay
-  testPkgs = import inputs.nixpkgs {
-    system = pkgs.system;
-    overlays = [ (import ../overlays.nix) ];
-  };
+  testPkgs = pkgs.appendOverlays [ (import ../overlays.nix) ];
 in
 testPkgs.testers.runNixOSTest {
-  name = "zfs folder dependency and mounting test";
+  name = "zfs test";
 
   nodes.machine =
     { pkgs, ... }:
     {
       imports = [
-        (lib.serviceMountDeps "foobar" [ "/mnt/foobar_data" ])
-        (lib.serviceMountDeps "foobarSadge" [
-          "/mnt/foobar_data"
-          "/mnt/does_not_exist_lol"
-        ])
+        # Test valid paths within zpool
+        (lib.serviceMountWithZpool "test-service" "rpool" [ "/mnt/rpool_data" ])
 
+        # Test service with paths outside zpool (should fail assertion)
+        (lib.serviceMountWithZpool "invalid-service" "rpool2" [ "/mnt/rpool_data" ])
       ];
+
       virtualisation = {
         emptyDiskImages = [
           4096
+          4096
         ];
+        # Add this to avoid ZFS hanging issues
+        additionalPaths = [ pkgs.zfs ];
       };
       networking.hostId = "deadbeef";
       boot.kernelPackages = config.boot.kernelPackages;
@@ -41,7 +41,7 @@ testPkgs.testers.runNixOSTest {
         ensureZfsMounts
       ];
 
-      systemd.services.foobar = {
+      systemd.services."test-service" = {
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
@@ -49,7 +49,7 @@ testPkgs.testers.runNixOSTest {
         };
       };
 
-      systemd.services.foobarSadge = {
+      systemd.services."invalid-service" = {
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
@@ -61,38 +61,50 @@ testPkgs.testers.runNixOSTest {
   testScript = ''
     start_all()
     machine.wait_for_unit("multi-user.target")
+
+    # Setup ZFS pool
     machine.succeed(
         "parted --script /dev/vdb mklabel msdos",
         "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+        "zpool create rpool /dev/vdb1"
     )
 
-    machine.fail("zfsEnsureMounted")
-    machine.fail("zfsEnsureMounted /mnt/test_mountpoint")
+    # Setup ZFS pool 2
+    machine.succeed(
+        "parted --script /dev/vdc mklabel msdos",
+        "parted --script /dev/vdc -- mkpart primary 1024M -1s",
+        "zpool create rpool2 /dev/vdc1"
+    )
 
-    machine.succeed("zpool create rpool /dev/vdb1")
-    machine.succeed("zfs create -o mountpoint=/mnt/test_mountpoint rpool/test")
+    machine.succeed("zfs create -o mountpoint=/mnt/rpool_data rpool/data")
 
-    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint")
+    machine.succeed("zfs create -o mountpoint=/mnt/rpool2_data rpool2/data")
 
-    machine.fail("zfsEnsureMounted /mnt/does_not_exist_lol")
-    machine.fail("zfsEnsureMounted /mnt/test_mountpoint /mnt/does_not_exist_lol")
+    # Test that valid service starts successfully
+    machine.succeed("systemctl start test-service")
 
-    machine.succeed("zfs create -o mountpoint=/mnt/test_mountpoint_dos rpool/test2")
+    # Manually test our validation logic by checking the debug output
+    zfs_output = machine.succeed("zfs list -H -o name,mountpoint")
+    print("ZFS LIST OUTPUT:")
+    print(zfs_output)
 
-    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint /mnt/test_mountpoint_dos")
+    dataset = machine.succeed("zfs list -H -o name,mountpoint | awk '/\\/mnt\\/rpool_data/ { print $1 }'")
+    print("DATASET FOR /mnt/rpool_data:")
+    print(dataset)
 
-    machine.succeed("zfs create -o mountpoint='/mnt/test path with spaces' rpool/test3")
+    # Test that invalid-service mount service fails validation
+    machine.fail("systemctl start invalid-service.service")
 
-    machine.succeed("zfsEnsureMounted '/mnt/test path with spaces'")
+    # Check the journal for our detailed validation error message
+    journal_output = machine.succeed("journalctl -u invalid-service-mounts.service --no-pager")
+    print("JOURNAL OUTPUT:")
+    print(journal_output)
 
-    machine.succeed("zfs create -o mountpoint='/mnt/test escaped spaces' rpool/test4")
-    machine.succeed("zfsEnsureMounted /mnt/test\ escaped\ spaces")
+    # Verify our validation error is in the journal using Python string matching
+    assert "ERROR: ZFS pool mismatch for /mnt/rpool_data" in journal_output
+    assert "Expected pool: rpool2" in journal_output
+    assert "Actual pool:   rpool" in journal_output
 
-    machine.succeed("zfsEnsureMounted /mnt/test_mountpoint '/mnt/test path with spaces' /mnt/test_mountpoint_dos")
-
-    machine.succeed("zfs create -o mountpoint=/mnt/foobar_data rpool/foobar")
-    machine.succeed("systemctl start foobar")
-
-    machine.fail("systemctl start foobarSadge")
+    print("SUCCESS: Runtime validation correctly detected zpool mismatch!")
   '';
 }

From e891d6f1abe6e20a5d0af23645090f776905df3e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 16:17:09 -0500
Subject: [PATCH 482/847] zfs: fix qbittorrent

---
 lib.nix                  | 99 ++++++++++++++++++++--------------------
 services/qbittorrent.nix |  3 ++
 tests/zfs.nix            | 15 +++++-
 3 files changed, 67 insertions(+), 50 deletions(-)

diff --git a/lib.nix b/lib.nix
index 7ee6ae3..5fed152 100644
--- a/lib.nix
+++ b/lib.nix
@@ -69,67 +69,68 @@ inputs.nixpkgs.lib.extend (
           serviceConfig = {
             Type = "oneshot";
             RemainAfterExit = true;
-            ExecStart = lib.getExe (
-              pkgs.writeShellApplication {
-                name = "ensure-zfs-mounts-with-pool-${serviceName}";
-                runtimeInputs = with pkgs; [
-                  gawk
-                  coreutils
-                  config.boot.zfs.package
-                ];
+            ExecStart = [
+              (lib.getExe (
+                pkgs.writeShellApplication {
+                  name = "ensure-zfs-mounts-with-pool-${serviceName}-${zpool}";
+                  runtimeInputs = with pkgs; [
+                    gawk
+                    coreutils
+                    config.boot.zfs.package
+                  ];
 
-                text = ''
-                  set -euo pipefail
+                  text = ''
+                    set -euo pipefail
 
-                  echo "Ensuring ZFS mounts for service: ${serviceName}"
-                  echo "Directories: ${lib.strings.concatStringsSep ", " dirs}"
+                    echo "Ensuring ZFS mounts for service: ${serviceName} (pool: ${zpool})"
+                    echo "Directories: ${lib.strings.concatStringsSep ", " dirs}"
 
-                  # Validate mounts exist (ensureZfsMounts already has proper PATH)
-                  ${lib.getExe pkgs.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}
+                    # Validate mounts exist (ensureZfsMounts already has proper PATH)
+                    ${lib.getExe pkgs.ensureZfsMounts} ${lib.strings.concatStringsSep " " dirs}
 
-                  # Additional runtime check: verify paths are on correct zpool
-                  ${lib.optionalString (zpool != "") ''
-                    echo "Verifying ZFS mountpoints are on pool '${zpool}'..."
+                    # Additional runtime check: verify paths are on correct zpool
+                    ${lib.optionalString (zpool != "") ''
+                      echo "Verifying ZFS mountpoints are on pool '${zpool}'..."
 
-                    if ! zfs_list_output=$(zfs list -H -o name,mountpoint 2>&1); then
-                      echo "ERROR: Failed to query ZFS datasets: $zfs_list_output" >&2
-                      exit 1
-                    fi
-
-                    # This loop handles variable number of directories, shellcheck false positive
-                    # shellcheck disable=SC2043
-                    for target in ${lib.strings.concatStringsSep " " dirs}; do
-                      echo "Checking: $target"
-
-                      # Find dataset that has this mountpoint
-                      dataset=$(echo "$zfs_list_output" | awk -v target="$target" '$2 == target {print $1; exit}')
-
-                      if [ -z "$dataset" ]; then
-                        echo "ERROR: No ZFS dataset found for mountpoint: $target" >&2
+                      if ! zfs_list_output=$(zfs list -H -o name,mountpoint 2>&1); then
+                        echo "ERROR: Failed to query ZFS datasets: $zfs_list_output" >&2
                         exit 1
                       fi
 
-                      # Extract pool name from dataset (first part before /)
-                      actual_pool=$(echo "$dataset" | cut -d'/' -f1)
+                      # shellcheck disable=SC2043
+                      for target in ${lib.strings.concatStringsSep " " dirs}; do
+                        echo "Checking: $target"
 
-                      if [ "$actual_pool" != "${zpool}" ]; then
-                        echo "ERROR: ZFS pool mismatch for $target" >&2
-                        echo " Expected pool: ${zpool}" >&2
-                        echo " Actual pool:   $actual_pool" >&2
-                        echo " Dataset:       $dataset" >&2
-                        exit 1
-                      fi
+                        # Find dataset that has this mountpoint
+                        dataset=$(echo "$zfs_list_output" | awk -v target="$target" '$2 == target {print $1; exit}')
 
-                      echo "$target is on $dataset (pool: $actual_pool)"
-                    done
+                        if [ -z "$dataset" ]; then
+                          echo "ERROR: No ZFS dataset found for mountpoint: $target" >&2
+                          exit 1
+                        fi
 
-                    echo "All paths verified successfully on pool '${zpool}'"
-                  ''}
+                        # Extract pool name from dataset (first part before /)
+                        actual_pool=$(echo "$dataset" | cut -d'/' -f1)
 
-                  echo "Mount validation completed for ${serviceName}"
-                '';
-              }
-            );
+                        if [ "$actual_pool" != "${zpool}" ]; then
+                          echo "ERROR: ZFS pool mismatch for $target" >&2
+                          echo " Expected pool: ${zpool}" >&2
+                          echo " Actual pool:   $actual_pool" >&2
+                          echo " Dataset:       $dataset" >&2
+                          exit 1
+                        fi
+
+                        echo "$target is on $dataset (pool: $actual_pool)"
+                      done
+
+                      echo "All paths verified successfully on pool '${zpool}'"
+                    ''}
+
+                    echo "Mount validation completed for ${serviceName} (pool: ${zpool})"
+                  '';
+                }
+              ))
+            ];
           };
         };
 
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 064662c..0ae94a6 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -11,6 +11,9 @@
     (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_hdds [
       service_configs.torrents_path
       config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
+
+    ])
+    (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_ssds [
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
     (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
diff --git a/tests/zfs.nix b/tests/zfs.nix
index 8d7350f..7d3c746 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -21,6 +21,10 @@ testPkgs.testers.runNixOSTest {
 
         # Test service with paths outside zpool (should fail assertion)
         (lib.serviceMountWithZpool "invalid-service" "rpool2" [ "/mnt/rpool_data" ])
+
+        # Test multi-command logic: service with multiple serviceMountWithZpool calls
+        (lib.serviceMountWithZpool "multi-service" "rpool" [ "/mnt/rpool_data" ])
+        (lib.serviceMountWithZpool "multi-service" "rpool2" [ "/mnt/rpool2_data" ])
       ];
 
       virtualisation = {
@@ -56,6 +60,14 @@ testPkgs.testers.runNixOSTest {
           ExecStart = lib.getExe pkgs.bash;
         };
       };
+
+      systemd.services."multi-service" = {
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = lib.getExe pkgs.bash;
+        };
+      };
     };
 
   testScript = ''
@@ -105,6 +117,7 @@ testPkgs.testers.runNixOSTest {
     assert "Expected pool: rpool2" in journal_output
     assert "Actual pool:   rpool" in journal_output
 
-    print("SUCCESS: Runtime validation correctly detected zpool mismatch!")
+    machine.succeed("systemctl start multi-service")
+    machine.succeed("systemctl is-active multi-service-mounts.service")
   '';
 }

From 90c4215ae655e02a03da92ce744cff7a24bc9cde Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 16:34:47 -0500
Subject: [PATCH 483/847] fix: disable serial-getty

keeps spamming dmesg with stupid messages.
---
 configuration.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 426bc42..6964446 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -54,6 +54,9 @@
     hybrid-sleep.enable = false;
   };
 
+  # Disable serial getty on ttyS0 to prevent dmesg warnings
+  systemd.services."serial-getty@ttyS0".enable = false;
+
   # srvos enables vim, i don't want to use vim, disable it here:
   programs.vim = {
     defaultEditor = false;

From 050e4f947c0fd550ddf28c6a5f64f1236a51ca10 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 16:57:38 -0500
Subject: [PATCH 484/847] move to generic /services

---
 flake.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index e2546c6..7e28d5e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -94,7 +94,7 @@
         zpool_ssds = "tank";
         zpool_hdds = "hdds";
         torrents_path = "/torrents";
-        services_dir = "/${zpool_ssds}/services";
+        services_dir = "/services";
         music_dir = "/${zpool_ssds}/music";
         media_group = "media";
 
@@ -157,7 +157,7 @@
         };
 
         monero = {
-          dataDir = "/services/monero";
+          dataDir = services_dir + "/monero";
         };
       };
 

From c6a112857688bc2dc5acec564273ee5860703531 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 19:12:40 -0500
Subject: [PATCH 485/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index c1345e2..e16550e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762276996,
-        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
+        "lastModified": 1763651264,
+        "narHash": "sha256-8vvwZbw0s7YvBMJeyPVpWke6lg6ROgtts5N2/SMCcv4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
+        "rev": "e86a89079587497174ccab6d0d142a65811a4fd9",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763567443,
-        "narHash": "sha256-VBfKRclwbF8+nBdcQK8EZ/qnNwM17y34h6Q/usxvWL4=",
+        "lastModified": 1763682305,
+        "narHash": "sha256-2Gp78v1QaIfdildYxJGdSWwNHAJB7hEEwNCo6pK/qS8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "2eba631b8127a5a4853ea625a0eac4a7449bc7b8",
+        "rev": "21d31e0810d398f75ddd7d7c4cec9907a5576f26",
         "type": "github"
       },
       "original": {
@@ -318,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763171892,
-        "narHash": "sha256-6cg9zSiqKA89yJzVtYhBaBptqq6bX4pr4g7WLAHOD4Y=",
+        "lastModified": 1763604001,
+        "narHash": "sha256-GSE9eXex9LEanIrG93Ktc4Vo8gOSNfz6heT9VOEg0dQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "316858c27d278b20e776cd4dd8f787812f587ba2",
+        "rev": "3a6f7d58530e64bdc2b26af7a529111967fef2cf",
         "type": "github"
       },
       "original": {
@@ -349,11 +349,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763334038,
-        "narHash": "sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ=",
+        "lastModified": 1763622513,
+        "narHash": "sha256-1jQnuyu82FpiSxowrF/iFK6Toh9BYprfDqfs4BB+19M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
+        "rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763341292,
-        "narHash": "sha256-Cdn4V/Gljk4x9dn6vU7PE8iDOHOayxbtXXKJBfpunUM=",
+        "lastModified": 1763600374,
+        "narHash": "sha256-CPBFJSZrHD/TguhjBzXKaqwtMGz7ac8bX5KZ9dJfdu0=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "4d555d1649dc4344e62a4e796197dcf6186cf587",
+        "rev": "66d01f019faeacda79b8d81cb37c8094685cb333",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763507267,
-        "narHash": "sha256-D5gAmg4b6wX1BgHJhKb3Byh4JgwzFwD5HjTjOhV/9q0=",
+        "lastModified": 1763680057,
+        "narHash": "sha256-cqaGAyC0GK76CBp6hk9bXtyxdcGc39G/qCP32nkIdZk=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "9fddbaf49a4a226b0d0c9b8304ed02637438c450",
+        "rev": "7cd1d49aaf0923f4b0bd27908f6fd53ecec80843",
         "type": "github"
       },
       "original": {

From af638e4734d2d8c3bb2a2482a01cf01ec7a24c22 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 21:02:33 -0500
Subject: [PATCH 486/847] install: cleanup key and secrets handling

---
 .gitattributes                                |   2 +-
 install.sh                                    |   8 ++++----
 usb-secrets/{usb-secrets => }/usb-secrets-key | Bin
 usb-secrets/usb-secrets/usb-secrets-key.pub   |   1 -
 4 files changed, 5 insertions(+), 6 deletions(-)
 rename usb-secrets/{usb-secrets => }/usb-secrets-key (100%)
 delete mode 100644 usb-secrets/usb-secrets/usb-secrets-key.pub

diff --git a/.gitattributes b/.gitattributes
index b1c9c58..c41bb62 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,3 @@
 secrets/** filter=git-crypt diff=git-crypt
-usb-secrets/usb-secrets/usb-secrets-key filter=git-crypt diff=git-crypt
+usb-secrets/usb-secrets-key* filter=git-crypt diff=git-crypt
 
diff --git a/install.sh b/install.sh
index 66f5bd4..4ce0ac2 100755
--- a/install.sh
+++ b/install.sh
@@ -30,12 +30,12 @@ trap cleanup EXIT
 
 # Decrypt secureboot keys using the key in the repo
 echo "Decrypting secureboot keys..."
-if [[ ! -f "$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key" ]]; then
-    echo "Error: usb-secrets-key not found at $FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key"
+if [[ ! -f "$FLAKE_DIR/usb-secrets/usb-secrets-key" ]]; then
+    echo "Error: usb-secrets-key not found at $FLAKE_DIR/usb-secrets/usb-secrets-key"
     exit 1
 fi
 
-nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets/usb-secrets-key' '$FLAKE_DIR/secrets/secureboot.tar.age'" | \
+nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets-key' '$FLAKE_DIR/secrets/secureboot.tar.age'" | \
     tar -x -C /tmp/secureboot
 
 echo "Secureboot keys extracted"
@@ -56,4 +56,4 @@ sudo $DISKO_INSTALL \
     --flake "$FLAKE_DIR#muffin" \
     --disk main "$DISK" \
     --extra-files /tmp/secureboot /etc/secureboot \
-    --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets" /mnt/usb-secrets
+    --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key
diff --git a/usb-secrets/usb-secrets/usb-secrets-key b/usb-secrets/usb-secrets-key
similarity index 100%
rename from usb-secrets/usb-secrets/usb-secrets-key
rename to usb-secrets/usb-secrets-key
diff --git a/usb-secrets/usb-secrets/usb-secrets-key.pub b/usb-secrets/usb-secrets/usb-secrets-key.pub
deleted file mode 100644
index f6df05a..0000000
--- a/usb-secrets/usb-secrets/usb-secrets-key.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key

From 9631b1d0ef05047074077d4a118983453a1d9de6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 20 Nov 2025 21:59:09 -0500
Subject: [PATCH 487/847] secrets: delete old file

---
 secrets.nix | 22 ----------------------
 1 file changed, 22 deletions(-)
 delete mode 100644 secrets.nix

diff --git a/secrets.nix b/secrets.nix
deleted file mode 100644
index 816c875..0000000
--- a/secrets.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-let
-  # USB secrets key - for encrypting/decrypting all secrets
-  usbSecretsKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key";
-in
-{
-  # ZFS encryption key
-  "zfs-key.age".publicKeys = [ usbSecretsKey ];
-
-  # Secureboot keys archive
-  "secureboot.tar.age".publicKeys = [ usbSecretsKey ];
-
-  # System passwords and auth
-  "hashedPass.age".publicKeys = [ usbSecretsKey ];
-
-  # Service authentication
-  "caddy_auth.age".publicKeys = [ usbSecretsKey ];
-  "jellyfin-api-key.age".publicKeys = [ usbSecretsKey ];
-  "slskd_env.age".publicKeys = [ usbSecretsKey ];
-
-  # Network configuration
-  "wg0.conf.age".publicKeys = [ usbSecretsKey ];
-}

From d3f5b761961b02ba0fdcb086a7ea7c0996c9386d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Nov 2025 12:06:35 -0500
Subject: [PATCH 488/847] minecraft: update lithium

---
 services/minecraft.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index a75b3d6..ddabda5 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -74,8 +74,8 @@
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/oGKQMdyZ/lithium-fabric-0.20.0%2Bmc1.21.10.jar";
-              sha512 = "755c0e0fc7f6f38ac4d936cc6023d1dce6ecfd8d6bdc2c544c2a3c3d6d04f0d85db53722a089fa8be72ae32fc127e87f5946793ba6e8b4f2c2962ed30d333ed2";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/NsswKiwi/lithium-fabric-0.20.1%2Bmc1.21.10.jar";
+              sha512 = "79b2892d123f3bb12649927dd8fccc25c955ff38a19f3aba7cd0180c4cf5506c2a76d49418b13050f90bba7bb59f3623af06e8a275e2ae8c63808084043902bb";
             };
 
             NoChatReports = fetchurl {

From 560e298983b54b52c5f7333c962d1646d92dea5f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 21 Nov 2025 12:06:43 -0500
Subject: [PATCH 489/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index e16550e..56861bf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763682305,
-        "narHash": "sha256-2Gp78v1QaIfdildYxJGdSWwNHAJB7hEEwNCo6pK/qS8=",
+        "lastModified": 1763733098,
+        "narHash": "sha256-3zdG2R5MuL9xdgFA7uvFVLgSFWd5LWuVca8JNouRzyc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "21d31e0810d398f75ddd7d7c4cec9907a5576f26",
+        "rev": "23bc779a6e58762ea892eca1801b2ea1b9050c00",
         "type": "github"
       },
       "original": {
@@ -318,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763604001,
-        "narHash": "sha256-GSE9eXex9LEanIrG93Ktc4Vo8gOSNfz6heT9VOEg0dQ=",
+        "lastModified": 1763690461,
+        "narHash": "sha256-q3tHxrMu5BjSG8pE53dOevl4JmyhR73sICy/kJ0fYNk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "3a6f7d58530e64bdc2b26af7a529111967fef2cf",
+        "rev": "106ec777ce9fb7e98c9d68d717c91d5d59ce497b",
         "type": "github"
       },
       "original": {

From 942074b853b0b96039bc51f4922fa6b31beecac7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 24 Nov 2025 11:38:40 -0500
Subject: [PATCH 490/847] update + senior project website

---
 flake.lock | 60 +++++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/flake.lock b/flake.lock
index 56861bf..bf1b0b6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -25,11 +25,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1762538466,
-        "narHash": "sha256-8zrIPl6J+wLm9MH5ksHcW7BUHo7jSNOu0/hA0ohOOaM=",
+        "lastModified": 1763938834,
+        "narHash": "sha256-j8iB0Yr4zAvQLueCZ5abxfk6fnG/SJ5JnGUziETjwfg=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "0cea393fffb39575c46b7a0318386467272182fe",
+        "rev": "d9e753122e51cee64eb8d2dddfe11148f339f5a2",
         "type": "github"
       },
       "original": {
@@ -236,11 +236,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758463745,
-        "narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+        "lastModified": 1763992789,
+        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1763563389,
-        "narHash": "sha256-ATuiSBINBTjVXiGOYJAX6ttiDElV9MmjkqG4A8a/J8g=",
+        "lastModified": 1763975256,
+        "narHash": "sha256-IhdDL+0YwlLz5Ty0EnAxWN/btemN9FxcQbYs/V/8jvs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "b2f781751764ff57d54f7cf1910ae1bbf268ed1c",
+        "rev": "6803b15c4ab9df2dcc478254b4adb55524746ac7",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763733098,
-        "narHash": "sha256-3zdG2R5MuL9xdgFA7uvFVLgSFWd5LWuVca8JNouRzyc=",
+        "lastModified": 1763995855,
+        "narHash": "sha256-BAlUHkN6RI8al2Qj5G6YOnzWIXQY4OdpndwINGj7OIE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "23bc779a6e58762ea892eca1801b2ea1b9050c00",
+        "rev": "b61de2b2df4ff07e6d6de96320fb311d96908b7a",
         "type": "github"
       },
       "original": {
@@ -318,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763690461,
-        "narHash": "sha256-q3tHxrMu5BjSG8pE53dOevl4JmyhR73sICy/kJ0fYNk=",
+        "lastModified": 1763776632,
+        "narHash": "sha256-mvumw4Djwi6BgMKVKw5cpNt8a80+h/LvPy2AHOtzBzE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "106ec777ce9fb7e98c9d68d717c91d5d59ce497b",
+        "rev": "e6d3b589d9f1f869e68142f44654e59fcb47390c",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763319842,
-        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
+        "lastModified": 1763741496,
+        "narHash": "sha256-uIRqs/H18YEtMOn1OkbnPH+aNTwXKx+iU3qnxEkVUd0=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
+        "rev": "20e71a403c5de9ce5bd799031440da9728c1cda1",
         "type": "github"
       },
       "original": {
@@ -425,11 +425,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763347184,
-        "narHash": "sha256-6QH8hpCYJxifvyHEYg+Da0BotUn03BwLIvYo3JAxuqQ=",
+        "lastModified": 1763865987,
+        "narHash": "sha256-DJpzM8Jz3B0azJcAoF+YFHr8rEbxYLJ0wy1kWZ29HOw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "08895cce80433978d5bfd668efa41c5e24578cbd",
+        "rev": "042d905c01a6eec3bcae8530dacb19cda9758a63",
         "type": "github"
       },
       "original": {
@@ -441,11 +441,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1761591870,
-        "narHash": "sha256-9R1fCiKLbZ9/B67cSqmGWKa9iF6SQGZLCAJSh5bJyyo=",
+        "lastModified": 1764002257,
+        "narHash": "sha256-Bsbas68aT/lbna3FsaKUuYMexGXVLGSq7lQmdFHukME=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "329eed8d82f688dadbecf6b6e6e0f924b1383f79",
+        "rev": "4b21030bb28cde9cccc8b6e5b902b72d58c99559",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763600374,
-        "narHash": "sha256-CPBFJSZrHD/TguhjBzXKaqwtMGz7ac8bX5KZ9dJfdu0=",
+        "lastModified": 1763947799,
+        "narHash": "sha256-r7JBnL8Ujvb+cAzcTawPXaFsBw0/WM9IKVu2p9uYJ2c=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "66d01f019faeacda79b8d81cb37c8094685cb333",
+        "rev": "da459c0cd80ec9695026a21cea10c49307ba0893",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763680057,
-        "narHash": "sha256-cqaGAyC0GK76CBp6hk9bXtyxdcGc39G/qCP32nkIdZk=",
+        "lastModified": 1763939273,
+        "narHash": "sha256-nLr7EPtYmwnptz2fCq3hetmS+UCuUkJ2htB94XQe2Zs=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "7cd1d49aaf0923f4b0bd27908f6fd53ecec80843",
+        "rev": "8c3dc121c78b049d238866fc2e8940ffdac62f99",
         "type": "github"
       },
       "original": {

From 5723288f6b2a44763cba689cd81519bf8806ba1e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 24 Nov 2025 13:18:35 -0500
Subject: [PATCH 491/847] update (again)

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index bf1b0b6..5b59a78 100644
--- a/flake.lock
+++ b/flake.lock
@@ -349,11 +349,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763622513,
-        "narHash": "sha256-1jQnuyu82FpiSxowrF/iFK6Toh9BYprfDqfs4BB+19M=",
+        "lastModified": 1763948260,
+        "narHash": "sha256-dY9qLD0H0zOUgU3vWacPY6Qc421BeQAfm8kBuBtPVE0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b",
+        "rev": "1c8ba8d3f7634acac4a2094eef7c32ad9106532c",
         "type": "github"
       },
       "original": {
@@ -441,11 +441,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1764002257,
-        "narHash": "sha256-Bsbas68aT/lbna3FsaKUuYMexGXVLGSq7lQmdFHukME=",
+        "lastModified": 1764002298,
+        "narHash": "sha256-+AkWLsRQVKWIV0ub+SiP4rB2NavloORWHlGPmvggbfU=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "4b21030bb28cde9cccc8b6e5b902b72d58c99559",
+        "rev": "3896d733ba16c0fc38bf6d7e8aed4b0aa08aa11c",
         "type": "github"
       },
       "original": {

From 14539caad4797b79311935ed30ddd604080897c4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 24 Nov 2025 16:19:25 -0500
Subject: [PATCH 492/847] zfs: expand testing to include a failing multi case

---
 tests/zfs.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/zfs.nix b/tests/zfs.nix
index 7d3c746..d14bb55 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -25,6 +25,11 @@ testPkgs.testers.runNixOSTest {
         # Test multi-command logic: service with multiple serviceMountWithZpool calls
         (lib.serviceMountWithZpool "multi-service" "rpool" [ "/mnt/rpool_data" ])
         (lib.serviceMountWithZpool "multi-service" "rpool2" [ "/mnt/rpool2_data" ])
+
+        # Test multi-command logic: service with multiple serviceMountWithZpool calls
+        # BUT this one should fail as `/mnt/rpool_moar_data` is not on rpool2
+        (lib.serviceMountWithZpool "multi-service-fail" "rpool" [ "/mnt/rpool_data" ])
+        (lib.serviceMountWithZpool "multi-service-fail" "rpool2" [ "/mnt/rpool_moar_data" ])
       ];
 
       virtualisation = {
@@ -68,6 +73,14 @@ testPkgs.testers.runNixOSTest {
           ExecStart = lib.getExe pkgs.bash;
         };
       };
+
+      systemd.services."multi-service-fail" = {
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = lib.getExe pkgs.bash;
+        };
+      };
     };
 
   testScript = ''
@@ -92,6 +105,8 @@ testPkgs.testers.runNixOSTest {
 
     machine.succeed("zfs create -o mountpoint=/mnt/rpool2_data rpool2/data")
 
+    machine.succeed("zfs create -o mountpoint=/mnt/rpool_moar_data rpool/moar_data")
+
     # Test that valid service starts successfully
     machine.succeed("systemctl start test-service")
 
@@ -117,6 +132,21 @@ testPkgs.testers.runNixOSTest {
     assert "Expected pool: rpool2" in journal_output
     assert "Actual pool:   rpool" in journal_output
 
+
+    # Test that invalid-service mount service fails validation
+    machine.fail("systemctl start multi-service-fail.service")
+
+    # Check the journal for our detailed validation error message
+    journal_output = machine.succeed("journalctl -u multi-service-fail-mounts.service --no-pager")
+    print("JOURNAL OUTPUT:")
+    print(journal_output)
+
+    # Verify our validation error is in the journal using Python string matching
+    assert "ERROR: ZFS pool mismatch for /mnt/rpool_moar_data" in journal_output, "no zfs pool mismatch found (1)"
+    assert "Expected pool: rpool2" in journal_output, "no zfs pool mismatch found (2)"
+    assert "Actual pool:   rpool" in journal_output, "no zfs pool mismatch found (3)"
+
+
     machine.succeed("systemctl start multi-service")
     machine.succeed("systemctl is-active multi-service-mounts.service")
   '';

From c16c619b701671fdf35f41bb0b3e72cd65f05975 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 25 Nov 2025 13:08:08 -0500
Subject: [PATCH 493/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5b59a78..cbe86c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763651264,
-        "narHash": "sha256-8vvwZbw0s7YvBMJeyPVpWke6lg6ROgtts5N2/SMCcv4=",
+        "lastModified": 1764017209,
+        "narHash": "sha256-RoJGCtKExXXkNCZUmmxezG3eOczEOTBw38DaZGSYJC0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "e86a89079587497174ccab6d0d142a65811a4fd9",
+        "rev": "ec8eabe00c4ee9a2ddc50162c125f0ec2a7099e1",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763995855,
-        "narHash": "sha256-BAlUHkN6RI8al2Qj5G6YOnzWIXQY4OdpndwINGj7OIE=",
+        "lastModified": 1764077503,
+        "narHash": "sha256-+9DJnUQBWucoGTGurnZUtFuBvoajxUzF1NeCX6RpXQM=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "b61de2b2df4ff07e6d6de96320fb311d96908b7a",
+        "rev": "583cb83416467e8abf9b37349dcf1f6a0083745a",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762847253,
-        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
+        "lastModified": 1764080039,
+        "narHash": "sha256-b1MtLQsQc4Ji1u08f+C6g5XrmLPkJQ1fhNkCt+0AERQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
+        "rev": "da17006633ca9cda369be82893ae36824a2ddf1a",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763947799,
-        "narHash": "sha256-r7JBnL8Ujvb+cAzcTawPXaFsBw0/WM9IKVu2p9uYJ2c=",
+        "lastModified": 1764020063,
+        "narHash": "sha256-5+oHgKPH9F6/yUhIL9R2GZdobsguddow4lcINnYF9P4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "da459c0cd80ec9695026a21cea10c49307ba0893",
+        "rev": "369f4af7c83b1277e310dc5cad5bfa9780a18020",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1763939273,
-        "narHash": "sha256-nLr7EPtYmwnptz2fCq3hetmS+UCuUkJ2htB94XQe2Zs=",
+        "lastModified": 1764025670,
+        "narHash": "sha256-UjF074z/hUVObKEOG+rhVp8h+IslBmbPROUQKupOgtg=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "8c3dc121c78b049d238866fc2e8940ffdac62f99",
+        "rev": "160684d4c1c0135b1765cf91ab1aad6dc37470c5",
         "type": "github"
       },
       "original": {

From e55b3480b0690009e99306457bd46b2e18329cc4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 29 Nov 2025 23:35:46 -0500
Subject: [PATCH 494/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index cbe86c1..82e1450 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764017209,
-        "narHash": "sha256-RoJGCtKExXXkNCZUmmxezG3eOczEOTBw38DaZGSYJC0=",
+        "lastModified": 1764350888,
+        "narHash": "sha256-6Rp18zavTlnlZzcoLoBTJMBahL2FycVkw2rAEs3cQvo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ec8eabe00c4ee9a2ddc50162c125f0ec2a7099e1",
+        "rev": "2055a08fd0e2fd41318279a5355eb8a161accf26",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764077503,
-        "narHash": "sha256-+9DJnUQBWucoGTGurnZUtFuBvoajxUzF1NeCX6RpXQM=",
+        "lastModified": 1764468059,
+        "narHash": "sha256-TDTGxcD20odFm2hiEzmPRCCz3O4VZVf9TDeJWsL/0NI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "583cb83416467e8abf9b37349dcf1f6a0083745a",
+        "rev": "fa0465954faef9d7170b967ad89f8bc5303a32f3",
         "type": "github"
       },
       "original": {
@@ -318,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763776632,
-        "narHash": "sha256-mvumw4Djwi6BgMKVKw5cpNt8a80+h/LvPy2AHOtzBzE=",
+        "lastModified": 1764208886,
+        "narHash": "sha256-voOx8RsK3miw3EHw05nwuOS4ltzeH8tKJnVr+mxtTPQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e6d3b589d9f1f869e68142f44654e59fcb47390c",
+        "rev": "7da8a2d675f9cc56b3f6d654b4cccdca5016ac8e",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1764080039,
-        "narHash": "sha256-b1MtLQsQc4Ji1u08f+C6g5XrmLPkJQ1fhNkCt+0AERQ=",
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "da17006633ca9cda369be82893ae36824a2ddf1a",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
         "type": "github"
       },
       "original": {
@@ -349,11 +349,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763948260,
-        "narHash": "sha256-dY9qLD0H0zOUgU3vWacPY6Qc421BeQAfm8kBuBtPVE0=",
+        "lastModified": 1764316264,
+        "narHash": "sha256-82L+EJU+40+FIdeG4gmUlOF1jeSwlf2AwMarrpdHF6o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1c8ba8d3f7634acac4a2094eef7c32ad9106532c",
+        "rev": "9a7b80b6f82a71ea04270d7ba11b48855681c4b0",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764020063,
-        "narHash": "sha256-5+oHgKPH9F6/yUhIL9R2GZdobsguddow4lcINnYF9P4=",
+        "lastModified": 1764205213,
+        "narHash": "sha256-VWKPkM4m5kGgJ0HY1WKfvlPkKka6tYwUR8snetAFTu8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "369f4af7c83b1277e310dc5cad5bfa9780a18020",
+        "rev": "8b90cbaadae462563297a2d08870cccfd986ca28",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764025670,
-        "narHash": "sha256-UjF074z/hUVObKEOG+rhVp8h+IslBmbPROUQKupOgtg=",
+        "lastModified": 1764457673,
+        "narHash": "sha256-3eta8tVWkg2Vea27NACYVI1J59E3v8Rs+M6IjtOK1CI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "160684d4c1c0135b1765cf91ab1aad6dc37470c5",
+        "rev": "ad5c140ae1547e2983de373e618f236af04a329e",
         "type": "github"
       },
       "original": {

From f1f265becf5f4b54473177f04b69f706f2a3db87 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 1 Dec 2025 10:53:11 -0500
Subject: [PATCH 495/847] update + senior project website

---
 flake.lock | 60 +++++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/flake.lock b/flake.lock
index 82e1450..b032a4b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -121,11 +121,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1763975256,
-        "narHash": "sha256-IhdDL+0YwlLz5Ty0EnAxWN/btemN9FxcQbYs/V/8jvs=",
+        "lastModified": 1764578750,
+        "narHash": "sha256-4twV5EanZLNUuWcd/XzLVcn/gd/QRxQ093xlMum9OFQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "6803b15c4ab9df2dcc478254b4adb55524746ac7",
+        "rev": "012a6070936168440e6208703c5500b26a9bc5a2",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764468059,
-        "narHash": "sha256-TDTGxcD20odFm2hiEzmPRCCz3O4VZVf9TDeJWsL/0NI=",
+        "lastModified": 1764596293,
+        "narHash": "sha256-qIYjxwDqIwuhD8C2Xo4IOKOYRLJSRFv1/ll8ntbOo5A=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "fa0465954faef9d7170b967ad89f8bc5303a32f3",
+        "rev": "773340973473952df872b179f97b5a484a0b063d",
         "type": "github"
       },
       "original": {
@@ -318,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764208886,
-        "narHash": "sha256-voOx8RsK3miw3EHw05nwuOS4ltzeH8tKJnVr+mxtTPQ=",
+        "lastModified": 1764556167,
+        "narHash": "sha256-/b+oEls56HDRzsSp60tsRfPFRjFebBPHq6k1I+hfPqw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "7da8a2d675f9cc56b3f6d654b4cccdca5016ac8e",
+        "rev": "849d1b2b1adddfc7bddbd3be6bffd218a3f5a6fe",
         "type": "github"
       },
       "original": {
@@ -349,11 +349,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764316264,
-        "narHash": "sha256-82L+EJU+40+FIdeG4gmUlOF1jeSwlf2AwMarrpdHF6o=",
+        "lastModified": 1764560356,
+        "narHash": "sha256-M5aFEFPppI4UhdOxwdmceJ9bDJC4T6C6CzCK1E2FZyo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9a7b80b6f82a71ea04270d7ba11b48855681c4b0",
+        "rev": "6c8f0cca84510cc79e09ea99a299c9bc17d03cb6",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763741496,
-        "narHash": "sha256-uIRqs/H18YEtMOn1OkbnPH+aNTwXKx+iU3qnxEkVUd0=",
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "20e71a403c5de9ce5bd799031440da9728c1cda1",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
         "type": "github"
       },
       "original": {
@@ -425,11 +425,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763865987,
-        "narHash": "sha256-DJpzM8Jz3B0azJcAoF+YFHr8rEbxYLJ0wy1kWZ29HOw=",
+        "lastModified": 1764470739,
+        "narHash": "sha256-sa9f81B1dWO16QtgDTWHX8DQbiHKzHndpaunY5EQtwE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "042d905c01a6eec3bcae8530dacb19cda9758a63",
+        "rev": "3bfa664055e1a09c6aedab5533c5fc8d6ca5741a",
         "type": "github"
       },
       "original": {
@@ -441,11 +441,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1764002298,
-        "narHash": "sha256-+AkWLsRQVKWIV0ub+SiP4rB2NavloORWHlGPmvggbfU=",
+        "lastModified": 1764604089,
+        "narHash": "sha256-n1Dw2o5I0h+8hroIrkyqZWAK6usAQg3zdOVDhjLA4DY=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "3896d733ba16c0fc38bf6d7e8aed4b0aa08aa11c",
+        "rev": "d11badd0f8fe24a37e81439f60eb9c1ce3eb2c22",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764205213,
-        "narHash": "sha256-VWKPkM4m5kGgJ0HY1WKfvlPkKka6tYwUR8snetAFTu8=",
+        "lastModified": 1764551162,
+        "narHash": "sha256-DV/iPK0EL1vEvz5Qzl6WHVzeIJB0SCFCVrIpr0Ocfwc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "8b90cbaadae462563297a2d08870cccfd986ca28",
+        "rev": "ed9d5a032c701cb1534acbcad348d42df12cbc26",
         "type": "github"
       },
       "original": {
@@ -522,11 +522,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764457673,
-        "narHash": "sha256-3eta8tVWkg2Vea27NACYVI1J59E3v8Rs+M6IjtOK1CI=",
+        "lastModified": 1764544068,
+        "narHash": "sha256-vGiFMU7+nnCOLIZJYoH/P9uA4Wasb+Vq3J+ovmr/LS4=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "ad5c140ae1547e2983de373e618f236af04a329e",
+        "rev": "5b1f7b8984a1108847faa325c59a803f087c1220",
         "type": "github"
       },
       "original": {

From 4e03d707641c2bde8097de9a3e3983737523f068 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 2 Dec 2025 00:56:44 -0500
Subject: [PATCH 496/847] persistent: streamline installation process with
 persistent.tar

---
 install.sh             |  35 ++++++++++++++++++++++++++++++++---
 secrets/persistent.tar | Bin 0 -> 4702 bytes
 2 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 secrets/persistent.tar

diff --git a/install.sh b/install.sh
index 4ce0ac2..384f6c2 100755
--- a/install.sh
+++ b/install.sh
@@ -18,13 +18,15 @@ fi
 
 echo "Installing NixOS to $DISK using flake at $FLAKE_DIR"
 
-# Create temporary directory for secureboot keys
+# Create temporary directories
 mkdir -p /tmp/secureboot
+mkdir -p /tmp/persistent
 
 # Function to cleanup on exit
 cleanup() {
     echo "Cleaning up..."
     rm -rf /tmp/secureboot 2>/dev/null || true
+    rm -rf /tmp/persistent 2>/dev/null || true
 }
 trap cleanup EXIT
 
@@ -40,6 +42,15 @@ nix-shell -p age --run "age -d -i '$FLAKE_DIR/usb-secrets/usb-secrets-key' '$FLA
 
 echo "Secureboot keys extracted"
 
+# Extract persistent partition secrets
+echo "Extracting persistent partition contents..."
+if [[ -f "$FLAKE_DIR/secrets/persistent.tar" ]]; then
+    tar -xzf "$FLAKE_DIR/secrets/persistent.tar" -C /tmp/persistent
+    echo "Persistent partition contents extracted"
+else
+    echo "Warning: persistent.tar not found, skipping persistent secrets"
+fi
+
 # Check if disko-install is available
 if ! command -v disko-install >/dev/null 2>&1; then
     echo "Running disko-install via nix..."
@@ -50,10 +61,28 @@ fi
 
 echo "Running disko-install to partition, format, and install NixOS..."
 
+# Build the extra-files arguments
+EXTRA_FILES_ARGS=(
+    --extra-files /tmp/secureboot /etc/secureboot
+    --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key
+)
+
+# Add each top-level item from persistent separately to avoid nesting
+# cp -ar creates /dst/src when copying directories, so we need to copy each item
+#
+# Also disko-install actually copies the files from extra-files, so we are good here
+if [[ -d /tmp/persistent ]] && [[ -n "$(ls -A /tmp/persistent 2>/dev/null)" ]]; then
+    for item in /tmp/persistent/*; do
+        if [[ -e "$item" ]]; then
+            basename=$(basename "$item")
+            EXTRA_FILES_ARGS+=(--extra-files "$item" "/persistent/$basename")
+        fi
+    done
+fi
+
 # Run disko-install with secureboot keys available
 sudo $DISKO_INSTALL \
     --mode format \
     --flake "$FLAKE_DIR#muffin" \
     --disk main "$DISK" \
-    --extra-files /tmp/secureboot /etc/secureboot \
-    --extra-files "$FLAKE_DIR/usb-secrets/usb-secrets-key" /mnt/usb-secrets/usb-secrets-key
+    "${EXTRA_FILES_ARGS[@]}"
diff --git a/secrets/persistent.tar b/secrets/persistent.tar
new file mode 100644
index 0000000000000000000000000000000000000000..aa191e5b4d31c39e0840532b4a65adfd07546e3d
GIT binary patch
literal 4702
zcmZQ@_Y83kiVO&0;CD^w|L{OqHzV*{#EBU~v+tj&dZ?j#Lg7Y0)HKPvCmhTk81SE+
z=;Y70BRuJlzxHJFK4JUon|voa^n}^!YpE_+_=;`b&7#uX{nDrE*36pwdzHZJaMPKd
zfB(-7T75q+kYTgrD)SjVl6$3phZ}EyK1cXs9gF?_9#N0<BR)<^?Rvf%!CVt<<OEH<
z+I?s4Ps};Fn@f~$-xhnpK&jF_Q_X%I_^ICa*5^}*tZ2;awAKuDCiCO+uia$otz)-e
zz3iM-X?MD{AnL!%v*R1sv^~CX$U0w;bTRN{l0U^FE3#{Q*ty7UOHWkkDXl%sTP1bW
z?9|33-;y?5m>|}szsYz_`034QciDuWc!YmS=-*Z+!nt4l*}8?{N!vm*gOg`WPxvc)
zCgPNGt7e17&H~kkvpZ@`vQ8*|n=LE(Z_&K1ISKQXtm?9yY;+l4h_&sG(ondfsB_0=
zWwp0T+p?ts>HhD!@81j&**Mk1xZ%oj$vbS@j&InM|M^pa@b((R<twz!#XYWwE>$m#
zo!2;3qVNR!9*fDf??3!t<-5M@?ZjnQ=CqsL{d<cy$9%f@Qrni-x#uI=W7Upd{AYS*
zj?1IK{RJu0To|6%%B+YusN1ovy*%WYsT;$c%QqrT?Sn2n6#dF#G*wIW#P@H~cHIw8
zH7s7dAuWCNPsKkGvNhsdsaIwgFZyG#vApQ~hBx9fO!oxMFf*Rf@UQhxuKI!XWnX2b
z_Y0R9279hswNCh_$XstrRW{y6ZIw!fzi;)l{v~tnJ|?1Y?PtLLvkMk7D{NeGEWNG&
zh~&cmTSYEgq@UUNy?^cAoEM%qEp(J`Y19=>_<TKd`}WG`g;@^UPw)Nu@KxkWFV3ay
zF~-l0cd_SbY;51Q@~>9?%oTB`Jyr#6Nzo4Cyy)n9+n}udxQJ6mL~Lsm-*f4cC%<e-
zUH$e!zW(;ODE<jvJ5T>yw0Gu$GtS4%4)5idbZF0vzg<;trfgg{mCxQ~i};_`*;Yxc
zQQr$*+ev=bZ9H*L#&XuNyHn53&kNrnJlAsC@qe<-iyuBwoPSwgx%ttZgp+Hk*C|9s
zeRxp1!ejq&jY;idYlF?LJX6G~f3hy_epI>5(#gzzxh6YHmf`HT+RP11C)VBYxIg7c
z=9hHajWxzMdGBX^OKr^HXXm=h_h@VKWHBkDD*?@oMJbj{yvKV|6CTQ*4{9&@;#nYk
zc(X$2)!p_HXHR;psB4u=xv+qhr|11!{nPvH*7sZ#VB4=<aO=Z0{giJUPr4)DyjS~q
zL0)d_)un!~?y>ATl~Zvpd0Iut)iA@edrmnzBp69@Ox$+u{hB+M_RX5S=j`Q3-lN?-
zD`$F4um02<yz$a?*;^;BexFny(yG~hFPFXlt<vsrrjPS?N$RT#J>I^nB;0Yeghh-{
zZteZA5>IYw&tI*+Ghx%I*7tloELu;eRLOTUF*^7CU&eot<GRjf*{xgN|NO%;bG5)j
zR^dI{Tbk6@{p;Dp_xs6*7>)JvncBz0x1HX7;Om)v4;TOQKk0l}p)yuT;a}psjQY8a
z9Wh5(&V7@-lKaht-QibP2W$Mz8F6=#SeFTYntR?bwsfx6Zm~@98FTNpbMoagb=O|E
zd$4+4+QjPEy-PlKW^Al9PMd7$*7RLBKKX}*@vm)~wOf6wds;XCD7*UJIm)r>$E4?h
zsj-fm6|cFNc&BVX?BU*;x#20#viFr=Yu~wqt(D&S<8V+%oN3hiUCZ9xUg^~yd|E|c
zE#LO&!pg$g%C|k&$xq^5^p08nSDQiT*}osn=A|v%>XzF2p>D^y*|P7~-OgAZc0Bb(
zW?7W{MBm`BP4g01ZMmYX#b>kBdMy?1dL6-fzR6?C%cyY2&brd2;d{^j)%)=Keu`^i
z<-aeB^+ZHoKQLb!5Vdd9UDy5h_;lW}y2<{}JZd3r`s9MVN3Ge<^jw`j-3dnN8JSmv
zW-*<-D;NGn*8iW;@~I{l_N}n8ja7P3TM<$q>$mRV6wSZ<i`O>(fBA*?O10`Ok=*Rl
zX^(i<oxYmn*JG!s?e@T={D#uJ4F6L_L6@G?esX^N%{x!n^!D`1*dXn?dDoY_Z(E#j
z_O|5%i|x@|%MJ&#mRgFIIBolLy{=DyE&0Gtd+x;jrW+nN{*$~@&$w;2ONr*OYK_Ny
zq09eAwAU*<Rc2f>b<M7)AJ$$rtjcGezu58WjkdWtu1g;u&#F#;eSDo?(@S+OPjkU5
zU$Pc%{iM$0n-LRnwQ#PCz$)<u0}JzC5C8BUSoi(dZmT$xb!O+jl{=o!mwLVOPV!X=
z??qX+?&(at-Nc$Gnh~|^T&Lcng?gS_y-rA|<ea}7a$UXBRcTwiwC4Z(8N9lp`sx=s
zpU7RZoVI%Xzi%fZzbw^Mxxn<Te4pvm0trRI(~45Rg877IYb@*e8}WD9)_Biw$<Gf@
z>}uY!Q)PjHAM5=ahmSf0E@!*!I(@zCV-xXZ&)p2=QqNs-j{KnX_ovrw-f1G$<#RPl
zV)EwS<7D5^{IfZrIrFQ`>F4t~nEY4UOzqxK_xyCfRlK{|<{6P6el6a7zAL!b;z@`?
z&GLU-e5a~S)59MLc26<b(ec<d#w=%%MbH0d((4a)eS4CmkRkf%-@K-lv@89F_o6;L
zuU~kS|6W<NQG;I;U*Czx*?U|rUM-rIYiIS_<-3vf>d0?m?d>05Sp2&BNayE?-fgO{
zUmiX9*o|-QCUHe~w};^+Dn0Ud@))F&atuCyu-hf{x^lT~P*CWS$<L;^a;htp1@A6;
z(ZR%KEz3}{ddg=Z!B2($Wp|2I7N1&RH))cZz1`MyA<cc${oUkd{0kT4-Q9eO*|}wQ
zhtTchS?>=l<TlB9|8WM-NozmeCZ9L^o)q&(&fg<=KKv1r_VNic9_*|(jLLKrxU<rB
z#iyBzp3g0N>KWXWmu}{KCd7Q%!2{n9``PJt72DO^)>Bzg9$Ogx@WRj6Uuy;4%re%M
z_3v-lGU+6r?Zvx?)n?zGaZmdG@+piKEm2~}blevHTfR%9>l)96QzjoZ=KNRFvtTHi
z`DIdi`hqm+BW4@BpLjS#E>&(TxV&ukK7ov*R%d3Kv`_0O+A_O6W{<Cfkl}i}rpRZ`
zr3<niH5Jat{CAk)!PUE4IDTwqw0_WKb@|LTlY_7IEB4>#X?hm=_Uo3s*(Z!cyJa8A
zp7N}CQQp42A<_2JU)Ez%o^Fvl->UY?^9dy^Y_ho5xAo%52O8)1GF<4~z2j%Z7mM&K
z4L_Z_cYe9WsG}r%zN(;T2hX9s-=FQNX1rU!z?9#Y?f1ELmwx8kTvkoJvqwMWmiZ>F
zL|KuCQzl72mX-f|P=xokhT%lLlQT}tQJf#LyKdLlm<I2;EsF!EIBt1$=HSvx@;!3-
z(rmBJuPTu!`sttDP#nI@Xae8)hz(nICN5ccoFlpM@b^qzx1`mJmKto7)Hd09|I#AE
zRXh83m(>=}cdeS7p;L6-HD+64<K$%lVcGMt*6AgDKU<)$(!c7=1I0*@@2j^YOnxx0
znu(d)ms2wG<h{%sXHAd1&R4CUgB*SQS6q0kT{6jyT_f4zXlPfCzJg;blSaJ5%@u*k
zof{ujDak#b@MPh6j<;cY7v`F@_M|(frr8$c?rX95b8p2B6_@ji&gU=UI3*y=*lE8a
z#g94r-Gt{?cT_9At+>ImV%H7V;O?;Soi)dH?9_aF@{gD1^}5Mw%LHwwIB>aMP*y8c
zJ{M4$`r(!2t`!qLt$UgFXWP@{h8r=_PfD9ax3Bn6clO=fnJ;ZP?_K$noqsi2OZc;&
zEt{opq$=mcS<Vv^-^_}2*V**%5Yvq{&s6q?{@i(tdBUmIz|D(g%0BCsP0*jqTKcuH
zAV<i9@2uCpjQyYN4f*X~Mx6d{RAzbRU!jmdgXyJv=f5v$?(vikW81!j<87|B24fWm
z|KgPMK~h`Zd49b*apB|OpN$;RI*a6A)}(CsFSK^1l+1(U)}K6|96Kt!Iz@V)<O-8@
zt&<{u%w-VS-~Y0!hxc0>M`p|E<h>4(MqE=kldf9|>|qQ)67xG=@Mm4VOu@{E0|8mD
z1isz!7p-cjIvZa8QnK~S(y0pqf?6xqoc+JM((&N7I*q?iQ~po?Q7vR4?C{6>QLTAs
zu<DLmQOj4jBweZ6wZ&p*?IwZ#mYI9^Gas1NbVopO4zp;;!j$->cUl^lkEk5&)LQIt
zYHow04Aayl4kxy9{NT=B`sZd&T>Z)h%Uz4DTYhP?ZGXgATb|`OrTp=%U0RjLKhAG^
zaPOwezlUwxzaOd1?a^W^dw3&t^WMW}zn<-%R&SFhr?b~s{PeuA^6MGP-g0kO*SG30
zKN73?J4d{i|K0N3JDN9aFJE26uJ9tUVb0``<*R?!mMdzzvu@H8JpS=OU0-n#x5%Q*
z&7CuBwfz&NV&5Kp?a$P;?m@1%a8}vE+f!tpv3GgS?7l2kfAB~VSNJJW``uRq(pKK`
zcptFmzwR!_$){H)wqz_n?|*l9aO8Xo>r6Ythjq4m7HRrV6a~d!=sn)BGwB^m&55#m
zjZ1dS%IxShdofSo_|%EhuKkwap5I-QK5=zW;>%Q?f2-YZuIE;|YWiT!X2GqOZ|(3<
z|Lz=K!e4DSCo|NS<xS!Qt_NG}qiwS{=geGQ{xP6EZgS}H))iY;{}MkJ7aQ-Xw7D&{
zUoAKHbjrKnCI6Jn;*VcCIVs(reTP%)G0&9`C(UC>^w=34aQO1#cPGyz-uJ59S|rLo
zfkpAqeb&u_fr~6^dPT#ti$mOG-S>RZGud*L?Zb5KM=8!B?lTuoXx?-{N<q*?J8Hrq
zy_Qh*oNozHHy%8h<@){V6|2i#jlYj~fA8VrEV{l{X5lx-+4~rm2!uE;Gxjp;elGLi
zUiV$LrJGj9o=csq{+Hq1IpcjF_q{)DaB;@Z0-?*24|cCx^l(eG;o^651y*0`SjhgA
zO*{I%Qh*zuB2(hBXoI5v_m;*jSk<G#=v2InC#n2*+RO>jXWq^^Ss)`gcTJUm?cZxG
zyX!88{n?Oz&E;OsDc|Q^hXa>?opJv&%a12VC5`VabC#A$;uGOduXg%zKv({({A!&9
z!RnqrcBiYpd^zu<<;-zvgV9!Jy{EHYTi)t%nzLAV*~cR>PwPVE{r<$??9T7ICL+SE
zqii^>pl|89v@IU-a~qa=%w?YSaz|O-M3vWf)$=X=_*=~aERUC@ZJ$xh%_--VxS`=%
z58sKpS<m+Ff41<*26l<Q688V=EbLEvuH>El#p>CM3#(ph{CPVyp)TswBF5&OJ7(6-
zvCREBWnE^hO@5wrx$fzxU_O8AsYefn_Lgq8u=w2+`bH_jd|8CW^yJw5b$ex#%Ca`U
zy62Mly-_S{{UeQ48|9vJa)%Vk+}huHobS+`TuZBYf5f`<V^1nBNZVm~Z@cg-RnZ*w
zV>|yw|6iiNL9jiv+bpu`V$YrFvN7=r#?Q7(?>+d>WMOmC#@HWk9u{}r%Jh92cwUxm
z*@n0SjNe|_Mb-aYd{^LimfCy8$2;DBNo!5JBV@vPF>Q12f*-l&9;$8cwk_#i=`Xoy
z3R7g<wzfY<GQ$@=^>+Hl?|A0fzHLfJ;%;X8AANdvW<*)2VAPb_B;_5UiV5M1TUsuu
zMBNSkt2iS*LHux-#)4}cyAqz|Zl7|5X}+%6ipf^SqRmzZ?e6K;Bt;*LI6kQ^`4(S`
zrITN?>E{cVugu<JzQlQ+^CsoAlP0U)eQ?=gCFA~M?j6;YMe!c*W5s3(H#Qkm8u|3h
zIK#28D=GVA(L#-<0>@gt{hm&(v-ut|xvsfN=El#?Uo1Yy)*qZ5w)J4H?Ydh94RwyI
z{QOfn=KRaQyXeA9mI(IZy;u6UN=`3YQ|aroSw<w=C`3%vk$+QX{?DsHo#*(I-{y8M
zY~xR=-SNSxPbq)iw=_-_kB0X3dp~M#zxRK$!fEAZ!#uM|3pC<OpR*r1!})EOoa6o9
zxBP@Zo378$`VhzUTy0gW%O<8@JM`Ij^)1yZR{H42<t1_c<6dEZsF$sXHTlDFn}xcr
zC3~0xFRwD0y+Ux=+8utm@0zb(n7Gd^@MmXOb@Aj|oIN&ia;-N!+Jwqp-u}N_WpB%;
z*16B*on#-oKXxeKyL)NwmA{XIr)V<kN_*Rv@V#~|OyOytf6nIB0k64646K*A?^j<?
zK3o&H$K0y*bd`p2YwWY>LR*VpH%+e!JKUtE?OZi&x_{{+#^NX6l|CBOX1A?AY@yzH
zX3@pqGcrrHYqTdmvOiSVSnmETnWb-&@<#QHkXu#jO`R7jv+uen`?1nXKH8so<GtOA
zi$$FM-4{PTIN_Ad8{2Iba?4x`b6*{HKi_*{ar=tPuFfW#59iGKu<G<T<z~B6l{a(E
z@6@TUVL3l%s}GyGb;-(o3x517X!+zAAHO!}NV&e9qC4lF7`;Bb_{-r%?oAuA&Ir|R
Z*F7%(<@8NOZowxLYS(5Sby~={9RNNh9kc)d

literal 0
HcmV?d00001


From e0568408d00482327e19b50d7d2429761d78d394 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 3 Dec 2025 14:10:50 -0500
Subject: [PATCH 497/847] graphing-calculator: init

---
 configuration.nix                |  2 +
 flake.lock                       | 93 +++++++++++++++++++++++++++++++-
 flake.nix                        |  4 ++
 services/graphing-calculator.nix | 15 ++++++
 4 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 services/graphing-calculator.nix

diff --git a/configuration.nix b/configuration.nix
index 6964446..00d8e64 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -43,6 +43,8 @@
 
     # KEEP UNTIL 2028
     ./services/caddy_senior_project.nix
+
+    ./services/graphing-calculator.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/flake.lock b/flake.lock
index b032a4b..3c22474 100644
--- a/flake.lock
+++ b/flake.lock
@@ -186,6 +186,24 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -375,6 +393,22 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -414,7 +448,8 @@
         "srvos": "srvos",
         "trackerlist": "trackerlist",
         "vpn-confinement": "vpn-confinement",
-        "website": "website"
+        "website": "website",
+        "ytbn-graphing-software": "ytbn-graphing-software"
       }
     },
     "rust-overlay": {
@@ -438,6 +473,27 @@
         "type": "github"
       }
     },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ytbn-graphing-software",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764729618,
+        "narHash": "sha256-z4RA80HCWv2los1KD346c+PwNPzMl79qgl7bCVgz8X0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "52764074a85145d5001bf0aa30cb71936e9ad5b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "senior_project-website": {
       "flake": false,
       "locked": {
@@ -519,6 +575,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "trackerlist": {
       "flake": false,
       "locked": {
@@ -583,6 +654,26 @@
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/website"
       }
+    },
+    "ytbn-graphing-software": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1764788919,
+        "narHash": "sha256-ssFiVs95TfYSypd9z0DOfg9Uxca95gS5YRIk/smOzis=",
+        "ref": "refs/heads/main",
+        "rev": "a21fc048ad7fd54947ee62c3d8e2d5c4371121dd",
+        "revCount": 1079,
+        "type": "git",
+        "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 7e28d5e..54f8dfe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -66,6 +66,10 @@
       url = "github:ngosang/trackerslist";
       flake = false;
     };
+
+    ytbn-graphing-software = {
+      url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
+    };
   };
 
   outputs =
diff --git a/services/graphing-calculator.nix b/services/graphing-calculator.nix
new file mode 100644
index 0000000..51bd6d9
--- /dev/null
+++ b/services/graphing-calculator.nix
@@ -0,0 +1,15 @@
+{
+  service_configs,
+  inputs,
+  pkgs,
+  ...
+}:
+let
+  graphing-calculator = inputs.ytbn-graphing-software.packages.${pkgs.system}.web;
+in
+{
+  services.caddy.virtualHosts."graphing.${service_configs.https.domain}".extraConfig = ''
+    root * ${graphing-calculator}
+    file_server browse
+  '';
+}

From 64c0dff4be7eb1f3ccd496377c08bb616b94d7d7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 3 Dec 2025 18:19:57 -0500
Subject: [PATCH 498/847] update

---
 flake.lock | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3c22474..20486df 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764350888,
-        "narHash": "sha256-6Rp18zavTlnlZzcoLoBTJMBahL2FycVkw2rAEs3cQvo=",
+        "lastModified": 1764627417,
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "2055a08fd0e2fd41318279a5355eb8a161accf26",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
         "type": "github"
       },
       "original": {
@@ -293,11 +293,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1764578750,
-        "narHash": "sha256-4twV5EanZLNUuWcd/XzLVcn/gd/QRxQ093xlMum9OFQ=",
+        "lastModified": 1764622702,
+        "narHash": "sha256-HggOVvg2U3EwT44wPHEwFKromf9qR9rTqfV1i3q7rYs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "012a6070936168440e6208703c5500b26a9bc5a2",
+        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764596293,
-        "narHash": "sha256-qIYjxwDqIwuhD8C2Xo4IOKOYRLJSRFv1/ll8ntbOo5A=",
+        "lastModified": 1764795799,
+        "narHash": "sha256-WFoc65fvtx1Vp1g1UP7AK0frXa47hT4c0BH0Mzw/4FI=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "773340973473952df872b179f97b5a484a0b063d",
+        "rev": "dea9ba27cbcbdeaf516a252b77860e5eb9579892",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764556167,
-        "narHash": "sha256-/b+oEls56HDRzsSp60tsRfPFRjFebBPHq6k1I+hfPqw=",
+        "lastModified": 1764727518,
+        "narHash": "sha256-aJ/C+VffRK4XompIml/ij5cDIyi7M2Tuxe5xVJQNFnk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "849d1b2b1adddfc7bddbd3be6bffd218a3f5a6fe",
+        "rev": "b2308427a4bfd4643abb727b6755e63dd7c7a4ac",
         "type": "github"
       },
       "original": {
@@ -593,11 +593,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764544068,
-        "narHash": "sha256-vGiFMU7+nnCOLIZJYoH/P9uA4Wasb+Vq3J+ovmr/LS4=",
+        "lastModified": 1764803269,
+        "narHash": "sha256-DW6AS+mwbWNDQ/WbyxvChGP5ysj0CBEWX3Ecr4ihiGw=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "5b1f7b8984a1108847faa325c59a803f087c1220",
+        "rev": "feb3ac6f615a43a6951b09e9228e90b5e8f74b66",
         "type": "github"
       },
       "original": {
@@ -662,11 +662,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764788919,
-        "narHash": "sha256-ssFiVs95TfYSypd9z0DOfg9Uxca95gS5YRIk/smOzis=",
+        "lastModified": 1764803967,
+        "narHash": "sha256-z1/tm/Ephx9J9D/OEWl1cKKMFsMSpSmuhm4hphshF24=",
         "ref": "refs/heads/main",
-        "rev": "a21fc048ad7fd54947ee62c3d8e2d5c4371121dd",
-        "revCount": 1079,
+        "rev": "7f9a962ff7ef9643825e03d7a6851cd0918b6036",
+        "revCount": 1088,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From c480476a2937ae869450ddd33b8a9386ea53e055 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 3 Dec 2025 20:33:34 -0500
Subject: [PATCH 499/847] update

---
 flake.lock | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index 20486df..f6d20f0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -517,11 +517,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764551162,
-        "narHash": "sha256-DV/iPK0EL1vEvz5Qzl6WHVzeIJB0SCFCVrIpr0Ocfwc=",
+        "lastModified": 1764811239,
+        "narHash": "sha256-O98nsREqOegA/ckOi1lj5cC8+FlzZmgE2q2RD9eKrnw=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "ed9d5a032c701cb1534acbcad348d42df12cbc26",
+        "rev": "0ed5a0abca19cb199796e77180499cb9b6cca493",
         "type": "github"
       },
       "original": {
@@ -662,11 +662,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764803967,
-        "narHash": "sha256-z1/tm/Ephx9J9D/OEWl1cKKMFsMSpSmuhm4hphshF24=",
+        "lastModified": 1764811702,
+        "narHash": "sha256-4n3MPr91pB9ljtv1SZn6dUFTq37Js0FL39xtpAbxoXM=",
         "ref": "refs/heads/main",
-        "rev": "7f9a962ff7ef9643825e03d7a6851cd0918b6036",
-        "revCount": 1088,
+        "rev": "abfe5480e5dbc896715a57c2faab7f24360bc65b",
+        "revCount": 1095,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From c93b5fb36e6a58fdf5ea00e8ef81a7002cf14a1b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 4 Dec 2025 18:26:06 -0500
Subject: [PATCH 500/847] update

---
 flake.lock | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index f6d20f0..6aed560 100644
--- a/flake.lock
+++ b/flake.lock
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764795799,
-        "narHash": "sha256-WFoc65fvtx1Vp1g1UP7AK0frXa47hT4c0BH0Mzw/4FI=",
+        "lastModified": 1764883191,
+        "narHash": "sha256-zXoqyZqT9tyFzqkt1RppdgrbEpS/zumwbXZIktHQswU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "dea9ba27cbcbdeaf516a252b77860e5eb9579892",
+        "rev": "96fe9badfc5235ff0a049aca647bff8c448055aa",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764727518,
-        "narHash": "sha256-aJ/C+VffRK4XompIml/ij5cDIyi7M2Tuxe5xVJQNFnk=",
+        "lastModified": 1764813963,
+        "narHash": "sha256-Vs7Mamto+T8r1evk9myHepgHGNJkS2Kr0BF64NIei94=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b2308427a4bfd4643abb727b6755e63dd7c7a4ac",
+        "rev": "491200d6848402bbab1421cccbc15a46f08c7f78",
         "type": "github"
       },
       "original": {
@@ -593,11 +593,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764803269,
-        "narHash": "sha256-DW6AS+mwbWNDQ/WbyxvChGP5ysj0CBEWX3Ecr4ihiGw=",
+        "lastModified": 1764889828,
+        "narHash": "sha256-VRAYr+2qOURhc2gq4hxoCmfm7Ympi89C/jSoD5zCLSU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "feb3ac6f615a43a6951b09e9228e90b5e8f74b66",
+        "rev": "69ad1a065cb355b8619a7ea3961f98a832faa661",
         "type": "github"
       },
       "original": {
@@ -662,11 +662,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764811702,
-        "narHash": "sha256-4n3MPr91pB9ljtv1SZn6dUFTq37Js0FL39xtpAbxoXM=",
+        "lastModified": 1764834738,
+        "narHash": "sha256-8wq+jxy7HCNfVXuyOWUZQFIIkcEB+X1Mrhfekye0MhA=",
         "ref": "refs/heads/main",
-        "rev": "abfe5480e5dbc896715a57c2faab7f24360bc65b",
-        "revCount": 1095,
+        "rev": "66f0bd5b0260e280bbd69ad2168a3f947c5b3b13",
+        "revCount": 1096,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From ba622dd5227d7d2600179032c31ec78ea1c253a8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 5 Dec 2025 14:13:40 -0500
Subject: [PATCH 501/847] update

---
 flake.lock | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6aed560..9ee1537 100644
--- a/flake.lock
+++ b/flake.lock
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764883191,
-        "narHash": "sha256-zXoqyZqT9tyFzqkt1RppdgrbEpS/zumwbXZIktHQswU=",
+        "lastModified": 1764956344,
+        "narHash": "sha256-bMOFkfh/8NksYfeM0tTTp8wp+KgbHjIvkbVn1aMWrmc=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "96fe9badfc5235ff0a049aca647bff8c448055aa",
+        "rev": "8160b38a5fa8a25490ca33ffdd200cda51405688",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764813963,
-        "narHash": "sha256-Vs7Mamto+T8r1evk9myHepgHGNJkS2Kr0BF64NIei94=",
+        "lastModified": 1764900372,
+        "narHash": "sha256-kTXDohz28PWDyjH+7O6UkXtKwaP0JkCmjMTLc/wbjmk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "491200d6848402bbab1421cccbc15a46f08c7f78",
+        "rev": "777ee6af79272a1302815a2ea62b2a951aa9a6fe",
         "type": "github"
       },
       "original": {
@@ -367,11 +367,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764560356,
-        "narHash": "sha256-M5aFEFPppI4UhdOxwdmceJ9bDJC4T6C6CzCK1E2FZyo=",
+        "lastModified": 1764836381,
+        "narHash": "sha256-8jemYbbW9EBttQKHep7Rj8kzXaxsrk/lACdXA2DN5Xk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c8f0cca84510cc79e09ea99a299c9bc17d03cb6",
+        "rev": "ff06bd3398fb1bea6c937039ece7e7c8aa396ebf",
         "type": "github"
       },
       "original": {
@@ -662,11 +662,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764834738,
-        "narHash": "sha256-8wq+jxy7HCNfVXuyOWUZQFIIkcEB+X1Mrhfekye0MhA=",
+        "lastModified": 1764961869,
+        "narHash": "sha256-JPGOm+iHkAo3sQMpbcj1825m8nKwVb28ESExHEW0VTI=",
         "ref": "refs/heads/main",
-        "rev": "66f0bd5b0260e280bbd69ad2168a3f947c5b3b13",
-        "revCount": 1096,
+        "rev": "dab002bd1585b0b4390dda8ecd47e2b614afc393",
+        "revCount": 1114,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From eeff7ba9d64f7c45514f455283db72da7969e98e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 5 Dec 2025 23:22:11 -0500
Subject: [PATCH 502/847] nix: add gc

---
 configuration.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 00d8e64..fc608e0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -86,6 +86,13 @@
   nix = {
     # optimize the store
     optimise.automatic = true;
+
+    # garbage collection
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
   };
 
   hardware.intelgpu.driver = "xe";

From 9a7432906bc135e5245bfafc8bcbdf3c69c8e75f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 5 Dec 2025 23:55:58 -0500
Subject: [PATCH 503/847] update

---
 flake.lock | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9ee1537..3b3cbd0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764956344,
-        "narHash": "sha256-bMOFkfh/8NksYfeM0tTTp8wp+KgbHjIvkbVn1aMWrmc=",
+        "lastModified": 1764968936,
+        "narHash": "sha256-1L7UhoGnSOfAGvbH4+W9oILqqmrAqZCg2KDx7hBKQdE=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "8160b38a5fa8a25490ca33ffdd200cda51405688",
+        "rev": "933414c0b6f21af269bdb4fa2fa1b257b9c0fc53",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764900372,
-        "narHash": "sha256-kTXDohz28PWDyjH+7O6UkXtKwaP0JkCmjMTLc/wbjmk=",
+        "lastModified": 1764986396,
+        "narHash": "sha256-HYBvpziKGvKY/XfMCBRCTuUUqhPWjWiWaPthIsPzGDk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "777ee6af79272a1302815a2ea62b2a951aa9a6fe",
+        "rev": "70b931d67256ad7ebfced45ed797c016943bbff2",
         "type": "github"
       },
       "original": {
@@ -593,11 +593,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764889828,
-        "narHash": "sha256-VRAYr+2qOURhc2gq4hxoCmfm7Ympi89C/jSoD5zCLSU=",
+        "lastModified": 1764976075,
+        "narHash": "sha256-X8SOqqlaTWsCoU/Pfe9oEF7J8E+aKD7ZFwcfZxNMr5M=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "69ad1a065cb355b8619a7ea3961f98a832faa661",
+        "rev": "12fcc52a33d87b84b83e0b9c7671c62cf3906874",
         "type": "github"
       },
       "original": {
@@ -662,11 +662,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764961869,
-        "narHash": "sha256-JPGOm+iHkAo3sQMpbcj1825m8nKwVb28ESExHEW0VTI=",
+        "lastModified": 1764996871,
+        "narHash": "sha256-mYwXqLQ+sBGkUT4WrEJs6WjorkcV5m+x8gUk1JJrB5g=",
         "ref": "refs/heads/main",
-        "rev": "dab002bd1585b0b4390dda8ecd47e2b614afc393",
-        "revCount": 1114,
+        "rev": "41b50eb893537d46b99fdb5e38338d0698a16f42",
+        "revCount": 1127,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From c7511a5cdf3a68350fe3062c00350d41b662ccb7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 8 Dec 2025 22:11:30 -0500
Subject: [PATCH 504/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3b3cbd0..e5af5a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -293,11 +293,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1764622702,
-        "narHash": "sha256-HggOVvg2U3EwT44wPHEwFKromf9qR9rTqfV1i3q7rYs=",
+        "lastModified": 1765062926,
+        "narHash": "sha256-p0DkyfrMae/6SVPCb/XY5f9fOFc+fwtOCteRqD297QE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
+        "rev": "4f5fc14c175cd0574ca0f4c5a05fae63758f0c47",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764968936,
-        "narHash": "sha256-1L7UhoGnSOfAGvbH4+W9oILqqmrAqZCg2KDx7hBKQdE=",
+        "lastModified": 1765225799,
+        "narHash": "sha256-KVmXm5JOf9nydqW6XKwIMnoSXIM3eW4PnLamZq0vPaU=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "933414c0b6f21af269bdb4fa2fa1b257b9c0fc53",
+        "rev": "c8554b66e0ed397f7457ed5f3ce3b466dd508d5c",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764986396,
-        "narHash": "sha256-HYBvpziKGvKY/XfMCBRCTuUUqhPWjWiWaPthIsPzGDk=",
+        "lastModified": 1765245994,
+        "narHash": "sha256-6mra5F/nfee/MXqSXMSxSpjll6U/jfo8D9X+5H2ldmM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "70b931d67256ad7ebfced45ed797c016943bbff2",
+        "rev": "b83769c7fd3f3ab87221fdfda23f454ae95efc46",
         "type": "github"
       },
       "original": {
@@ -367,11 +367,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764836381,
-        "narHash": "sha256-8jemYbbW9EBttQKHep7Rj8kzXaxsrk/lACdXA2DN5Xk=",
+        "lastModified": 1764939437,
+        "narHash": "sha256-4TLFHUwXraw9Df5mXC/vCrJgb50CRr3CzUzF0Mn3CII=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ff06bd3398fb1bea6c937039ece7e7c8aa396ebf",
+        "rev": "00d2457e2f608b4be6fe8b470b0a36816324b0ae",
         "type": "github"
       },
       "original": {
@@ -517,11 +517,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764811239,
-        "narHash": "sha256-O98nsREqOegA/ckOi1lj5cC8+FlzZmgE2q2RD9eKrnw=",
+        "lastModified": 1765156605,
+        "narHash": "sha256-dH66lgYsikQlCVs+Vf6qaVAKaS8+fWX8qwvk5XOSELA=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "0ed5a0abca19cb199796e77180499cb9b6cca493",
+        "rev": "eab576cec5e21e0ab7767b2542e833edfdc17283",
         "type": "github"
       },
       "original": {
@@ -593,11 +593,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1764976075,
-        "narHash": "sha256-X8SOqqlaTWsCoU/Pfe9oEF7J8E+aKD7ZFwcfZxNMr5M=",
+        "lastModified": 1765235267,
+        "narHash": "sha256-3WmboyoGGhQM/gqR5hM+O2mHcpIhNO1BKL3bCSlXsV4=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "12fcc52a33d87b84b83e0b9c7671c62cf3906874",
+        "rev": "42643f66c914e674a9d1fb3a6f5cbf3a2cd6c80b",
         "type": "github"
       },
       "original": {
@@ -626,11 +626,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1759956062,
-        "narHash": "sha256-NUZu0Rb0fwUjfdp51zMm0xM3lcK8Kw4c97LLog7+JjA=",
+        "lastModified": 1765185554,
+        "narHash": "sha256-W9OqhyaTk4AjQ5o2yNupi09eJcNn65a4ulBSLr2a81U=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "fabe7247b720b5eb4c3c053e24a2b3b70e64c52b",
+        "rev": "08cdda8013611e874ac6d3d59d508e56dfee0405",
         "type": "github"
       },
       "original": {

From b4fdf318548163a40b873220aaf10d44d40b102f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 8 Dec 2025 22:20:37 -0500
Subject: [PATCH 505/847] Pin lanzaboote version to fix upstream issue

See: https://github.com/nix-community/lanzaboote/issues/518
---
 flake.lock | 7 ++++---
 flake.nix  | 3 ++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index e5af5a8..732e165 100644
--- a/flake.lock
+++ b/flake.lock
@@ -293,16 +293,17 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1765062926,
-        "narHash": "sha256-p0DkyfrMae/6SVPCb/XY5f9fOFc+fwtOCteRqD297QE=",
+        "lastModified": 1764622702,
+        "narHash": "sha256-HggOVvg2U3EwT44wPHEwFKromf9qR9rTqfV1i3q7rYs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "4f5fc14c175cd0574ca0f4c5a05fae63758f0c47",
+        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
         "repo": "lanzaboote",
+        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index 54f8dfe..39379d3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,8 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     lanzaboote = {
-      url = "github:nix-community/lanzaboote";
+      # Pin to commit to fix: https://github.com/nix-community/lanzaboote/issues/518
+      url = "github:nix-community/lanzaboote/6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

From fba8ae74bc4d031914137766349d377ef8313f87 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 8 Dec 2025 23:19:25 -0500
Subject: [PATCH 506/847] monero: move to ssds

---
 services/monero.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/monero.nix b/services/monero.nix
index 1792ecf..efa4951 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -5,7 +5,7 @@
 }:
 {
   imports = [
-    (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
+    (lib.serviceMountWithZpool "monero" service_configs.zpool_ssds [
       service_configs.monero.dataDir
     ])
   ];

From 15a3ce1ad6d3b4bca0f7511eb7ba01325521107d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Dec 2025 15:53:53 -0500
Subject: [PATCH 507/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 732e165..4ba0bd0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764627417,
-        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
+        "lastModified": 1765326679,
+        "narHash": "sha256-fTLX9kDwLr9Y0rH/nG+h1XG5UU+jBcy0PFYn5eneRX8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
+        "rev": "d64e5cdca35b5fad7c504f615357a7afe6d9c49e",
         "type": "github"
       },
       "original": {
@@ -315,11 +315,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765225799,
-        "narHash": "sha256-KVmXm5JOf9nydqW6XKwIMnoSXIM3eW4PnLamZq0vPaU=",
+        "lastModified": 1765570488,
+        "narHash": "sha256-NRjxrG+dog+IrnsimWIdf55iw/JKuyLSLi0mtpzhwsQ=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "c8554b66e0ed397f7457ed5f3ce3b466dd508d5c",
+        "rev": "e39a2ce66d0a61915f22097e5453e291618b3518",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765245994,
-        "narHash": "sha256-6mra5F/nfee/MXqSXMSxSpjll6U/jfo8D9X+5H2ldmM=",
+        "lastModified": 1765332486,
+        "narHash": "sha256-nVTejyI8w3ePrX4tW3lBLLg3DheqhRuxtiRefT+ynrk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b83769c7fd3f3ab87221fdfda23f454ae95efc46",
+        "rev": "a3bdc14045dc7e5fb7a94ab11064766f472279eb",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1764939437,
-        "narHash": "sha256-4TLFHUwXraw9Df5mXC/vCrJgb50CRr3CzUzF0Mn3CII=",
+        "lastModified": 1765363881,
+        "narHash": "sha256-3C3xWn8/2Zzr7sxVBmpc1H1QfxjNfta5IMFe3O9ZEPw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00d2457e2f608b4be6fe8b470b0a36816324b0ae",
+        "rev": "d2b1213bf5ec5e62d96b003ab4b5cbc42abfc0d0",
         "type": "github"
       },
       "original": {
@@ -518,11 +518,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765156605,
-        "narHash": "sha256-dH66lgYsikQlCVs+Vf6qaVAKaS8+fWX8qwvk5XOSELA=",
+        "lastModified": 1765415765,
+        "narHash": "sha256-DNEUksb+s7DbwahAlIZ4v/BUFUacOqGklCbjgAHZb4k=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "eab576cec5e21e0ab7767b2542e833edfdc17283",
+        "rev": "a9e46dc439591c67337a0caf0beebb5a73ed9a86",
         "type": "github"
       },
       "original": {
@@ -594,11 +594,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1765235267,
-        "narHash": "sha256-3WmboyoGGhQM/gqR5hM+O2mHcpIhNO1BKL3bCSlXsV4=",
+        "lastModified": 1765537992,
+        "narHash": "sha256-hJRdbxE5P3ze7Y9GtXMGuntZbTk8u5bYUYO/4l0fMAw=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "42643f66c914e674a9d1fb3a6f5cbf3a2cd6c80b",
+        "rev": "78a497bc7f81b395a4453ea5e5c24cab86bd4a54",
         "type": "github"
       },
       "original": {

From 8e4de73518fe8b490a493f66e64ecacca1175185 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Dec 2025 21:09:39 -0500
Subject: [PATCH 508/847] ssh: move to seperate file

---
 configuration.nix | 26 ++------------------------
 services/ssh.nix  | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 24 deletions(-)
 create mode 100644 services/ssh.nix

diff --git a/configuration.nix b/configuration.nix
index fc608e0..862ab94 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -45,6 +45,8 @@
     ./services/caddy_senior_project.nix
 
     ./services/graphing-calculator.nix
+
+    ./services/ssh.nix
   ];
 
   services.kmscon.enable = true;
@@ -122,19 +124,6 @@
   # Set your time zone.
   time.timeZone = "America/New_York";
 
-  # Enable the OpenSSH daemon.
-  services.openssh = {
-    enable = true;
-    settings = {
-      AllowUsers = [
-        username
-        "root"
-      ];
-      PasswordAuthentication = false;
-      PermitRootLogin = "yes"; # for deploying configs
-    };
-  };
-
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
@@ -236,20 +225,9 @@
       "render"
       service_configs.media_group
     ];
-
-    # TODO! use proper secrets management
     hashedPasswordFile = config.age.secrets.hashedPass.path;
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJjT5QZ3zRDb+V6Em20EYpSEgPW5e/U+06uQGJdraxi" # desktop
-    ];
   };
 
-  # used for deploying configs to server
-  users.users.root.openssh.authorizedKeys.keys =
-    config.users.users.${username}.openssh.authorizedKeys.keys;
-
   # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
   programs.fish.enable = true;
   programs.bash = {
diff --git a/services/ssh.nix b/services/ssh.nix
new file mode 100644
index 0000000..71646ef
--- /dev/null
+++ b/services/ssh.nix
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+{
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings = {
+      AllowUsers = [
+        username
+        "root"
+      ];
+      PasswordAuthentication = false;
+      PermitRootLogin = "yes"; # for deploying configs
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "Z /etc/ssh 755 root root"
+  ];
+
+  users.users.${username}.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJjT5QZ3zRDb+V6Em20EYpSEgPW5e/U+06uQGJdraxi" # desktop
+  ];
+
+  # used for deploying configs to server
+  users.users.root.openssh.authorizedKeys.keys =
+    config.users.users.${username}.openssh.authorizedKeys.keys;
+
+}

From 90c9348d24ea5df47db45e254240eecb4eecbcd1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 12 Dec 2025 21:18:51 -0500
Subject: [PATCH 509/847] ssh: fix ssh_host_key perms

---
 services/ssh.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/ssh.nix b/services/ssh.nix
index 71646ef..9f15931 100644
--- a/services/ssh.nix
+++ b/services/ssh.nix
@@ -21,6 +21,7 @@
 
   systemd.tmpfiles.rules = [
     "Z /etc/ssh 755 root root"
+    "Z /etc/ssh/ssh_host_* 600 root root"
   ];
 
   users.users.${username}.openssh.authorizedKeys.keys = [

From 547d64a1e25ded80f08043888b514e89e5d8379a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 13 Dec 2025 02:24:46 -0500
Subject: [PATCH 510/847] list-usb-drives: remove (never worked)

---
 configuration.nix |  1 -
 overlays.nix      | 12 ------------
 2 files changed, 13 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 862ab94..fdcfed6 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -166,7 +166,6 @@
     lsof
 
     reflac
-    list-usb-drives
 
     pfetch-rs
 
diff --git a/overlays.nix b/overlays.nix
index c798667..4b705b2 100644
--- a/overlays.nix
+++ b/overlays.nix
@@ -43,16 +43,4 @@ final: prev: {
       }
     );
   };
-
-  list-usb-drives = prev.writeShellApplication {
-    name = "list-usb-drives";
-    runtimeInputs = with prev; [
-      findutils
-      coreutils
-    ];
-
-    text = ''
-      find "/dev/disk/by-id" -name "usb*" -not -name "*-part[0-9]" -printf "%f\n" | sed 's/^usb\-//g' | sed 's/\-[0-9]*\:/ /g' | column -t --table-columns=DRIVE,BAY | sort -n -k 2
-    '';
-  };
 }

From cf1d65540c2c2e586236aad4a2c435f177ab6316 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 13 Dec 2025 21:35:37 -0500
Subject: [PATCH 511/847] minecraft: update to 1.21.11

---
 services/minecraft.nix | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index ddabda5..e416655 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -36,7 +36,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_10;
+      package = pkgs.fabricServers.fabric-1_21_11;
 
       jvmOpts =
         let
@@ -64,18 +64,18 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/UuXf1NbU/fabric-api-0.138.0%2B1.21.10.jar";
-              sha512 = "723e0c4fcd8287f085344cde87aeac23d4b13652a50404a42363417e1bd47fe79038c304c92327728b7c96b9216cff5eb9091ce41aeca535aa93a543a1039c9d";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/KhCFoeip/fabric-api-0.139.5%2B1.21.11.jar";
+              sha512 = "852c9e76175b2d51cea191bfcc0005b824de433f1a6de01d672b9e82ca1cab8478b180670bc6c4811744ef4abec8bd2ff3ab0f9c1aa5644713d06f3fbcc278f0";
             };
 
             FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/MGoveONm/ferritecore-8.0.2-fabric.jar";
-              sha512 = "8c3890fb116dfaf681f5f483ea0d1bfecfb87dd584cc72e772fe43ea6ecf15a09c782fedbe5cea3b8bf7e930bd5c00753a619ac5ce7afa7fd092769d68e9beec";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/eRLwt73x/ferritecore-8.0.3-fabric.jar";
+              sha512 = "be600543e499b59286f9409f46497570adc51939ae63eaa12ac29e6778da27d8c7c6cd0b3340d8bcca1cc99ce61779b1a8f52b990f9e4e9a93aa9c6482905231";
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/NsswKiwi/lithium-fabric-0.20.1%2Bmc1.21.10.jar";
-              sha512 = "79b2892d123f3bb12649927dd8fccc25c955ff38a19f3aba7cd0180c4cf5506c2a76d49418b13050f90bba7bb59f3623af06e8a275e2ae8c63808084043902bb";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/4DdLmtyz/lithium-fabric-0.21.1%2Bmc1.21.11.jar";
+              sha512 = "0857d30d063dc704a264b2fe774a7e641926193cfdcde72fe2cd603043d8548045b955e30c05b1b2b96ef7d1c0f85d55269da26f44a0644c984b45623e976794";
             };
 
             NoChatReports = fetchurl {
@@ -84,8 +84,8 @@
             };
 
             squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/f4ZOYenB/squaremap-fabric-mc1.21.10-1.3.9.jar";
-              sha512 = "ddc2105568cb935eb269cfbb82b601189aa0c6c5ac98240188a3196e3e8454c23af86e95765153bd72285e9728dd8d0e587b4bcc3967f2636c5139f363e05f97";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/BW8lMXBi/squaremap-fabric-mc1.21.11-1.3.12.jar";
+              sha512 = "f62eb791a3f5812eb174565d318f2e6925353f846ef8ac56b4e595f481494e0c281f26b9e9fcfdefa855093c96b735b12f67ee17c07c2477aa7a3439238670d9";
             };
 
             scalablelux = fetchurl {
@@ -94,8 +94,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/uNick7oj/c2me-fabric-mc1.21.10-0.3.5.1.0.jar";
-              sha512 = "4d079c872ab910fd65a6c9e8709c7050178626f7125c849389ca38388e19995bd874e071e86e6acf6fbefaa2f294fdbebecb9af8444a908b9a3de894d807c4db";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/DLKF3HZk/c2me-fabric-mc1.21.11-0.3.6%2Bbeta.1.0.jar";
+              sha512 = "d4f983aeb5083033b525522e623a9a9ba86b6fc9c83db008cc0575d0077e736ac9bee0b6b0e03b8d1c89ae27a4e5cdc269041f61eb0d1a10757de4c30b065467";
             };
 
             krypton = fetchurl {
@@ -115,10 +115,13 @@
               sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
             };
 
-            packet-fixer = fetchurl {
-              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/5Qk1yjvA/packetfixer-fabric-3.3.1-1.21.10.jar";
-              sha512 = "a57ee4a4b9f75c1cedafb191d0eb3da419962f08145ccbd9d6544b7e91b72a52aba1eebeb76d60fb23bf0177472473a90097c2d73306f698aff084cd9a290af8";
-            };
+            # Mixin apply for mod packetfixer failed
+            /*
+              packet-fixer = fetchurl {
+                url = "https://cdn.modrinth.com/data/c7m1mi73/versions/LFMYVIc7/packetfixer-fabric-3.3.2-1.21.11.jar";
+                sha512 = "a7cdc4b81653ca7c823c91ffd29092365feff78b8d8e019f35ab6c47a0f18661768656cc5fe73f802ab7097d828d8173cc23d32b454a7acd64ff6b7118789413";
+              };
+            */
           }
         );
       };

From 67e507f4d8c361f16d60ccd6b776b768fae329f2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 16 Dec 2025 02:37:12 -0500
Subject: [PATCH 512/847] update

---
 flake.lock | 50 +++++++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4ba0bd0..409bcf9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765326679,
-        "narHash": "sha256-fTLX9kDwLr9Y0rH/nG+h1XG5UU+jBcy0PFYn5eneRX8=",
+        "lastModified": 1765794845,
+        "narHash": "sha256-YD5QWlGnusNbZCqR3pxG8tRxx9yUXayLZfAJRWspq2s=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d64e5cdca35b5fad7c504f615357a7afe6d9c49e",
+        "rev": "7194cfe5b7a3660726b0fe7296070eaef601cae9",
         "type": "github"
       },
       "original": {
@@ -315,11 +315,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765570488,
-        "narHash": "sha256-NRjxrG+dog+IrnsimWIdf55iw/JKuyLSLi0mtpzhwsQ=",
+        "lastModified": 1765869446,
+        "narHash": "sha256-1sR0DIh41+BMzAbx9rY7XUkqIaHUiThDeKf1ggLUC2M=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "e39a2ce66d0a61915f22097e5453e291618b3518",
+        "rev": "d6742125c317b7daafec038ab54a7c2fb1e2beaf",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765332486,
-        "narHash": "sha256-nVTejyI8w3ePrX4tW3lBLLg3DheqhRuxtiRefT+ynrk=",
+        "lastModified": 1765591348,
+        "narHash": "sha256-GI5eC3BWNBnYk+FV1cTYrjPLrqv1Q5HXD7kwHkqnZ8c=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a3bdc14045dc7e5fb7a94ab11064766f472279eb",
+        "rev": "37f2aad139533c27689c00cef0d43f7c51d0b14e",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765363881,
-        "narHash": "sha256-3C3xWn8/2Zzr7sxVBmpc1H1QfxjNfta5IMFe3O9ZEPw=",
+        "lastModified": 1765687488,
+        "narHash": "sha256-7YAJ6xgBAQ/Nr+7MI13Tui1ULflgAdKh63m1tfYV7+M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d2b1213bf5ec5e62d96b003ab4b5cbc42abfc0d0",
+        "rev": "d02bcc33948ca19b0aaa0213fe987ceec1f4ebe1",
         "type": "github"
       },
       "original": {
@@ -518,11 +518,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765415765,
-        "narHash": "sha256-DNEUksb+s7DbwahAlIZ4v/BUFUacOqGklCbjgAHZb4k=",
+        "lastModified": 1765840762,
+        "narHash": "sha256-4/FBert3MYpKjwEM85tXDi9OQkdLKygoFSmKJ8pEkro=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "a9e46dc439591c67337a0caf0beebb5a73ed9a86",
+        "rev": "e6c8b81a7eabacf6b93c7fe18f7a0bf6a7493f33",
         "type": "github"
       },
       "original": {
@@ -594,11 +594,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1765537992,
-        "narHash": "sha256-hJRdbxE5P3ze7Y9GtXMGuntZbTk8u5bYUYO/4l0fMAw=",
+        "lastModified": 1765840086,
+        "narHash": "sha256-e9e1C1f6S+NpEKMuypBj8i2qZLpgfPs3WoXhjddcedk=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "78a497bc7f81b395a4453ea5e5c24cab86bd4a54",
+        "rev": "8c5f9496510b9a3e1060568443bcd4174b57a914",
         "type": "github"
       },
       "original": {
@@ -627,11 +627,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1765185554,
-        "narHash": "sha256-W9OqhyaTk4AjQ5o2yNupi09eJcNn65a4ulBSLr2a81U=",
+        "lastModified": 1765634578,
+        "narHash": "sha256-Fujb9sn1cj+u/bzfo2RbQkcAvJ7Ch1pimJzFie4ptb4=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "08cdda8013611e874ac6d3d59d508e56dfee0405",
+        "rev": "f2989e1e3cb06c7185939e9ddc368f88b998616a",
         "type": "github"
       },
       "original": {
@@ -663,11 +663,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1764996871,
-        "narHash": "sha256-mYwXqLQ+sBGkUT4WrEJs6WjorkcV5m+x8gUk1JJrB5g=",
+        "lastModified": 1765615270,
+        "narHash": "sha256-12C6LccKRe5ys0iRd+ob+BliswUSmqOKWhMTI8fNpr0=",
         "ref": "refs/heads/main",
-        "rev": "41b50eb893537d46b99fdb5e38338d0698a16f42",
-        "revCount": 1127,
+        "rev": "ac6265eae734363f95909df9a3739bf6360fa721",
+        "revCount": 1130,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
       },

From 6bccf410e943fab61419577752311f5d4d89413d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 17 Dec 2025 23:44:20 -0500
Subject: [PATCH 513/847] wg.conf: us-mia-wg-002 -> us-mia-wg-001

There are issues with mullvad's us-mia-wg-002 node
I emailed then about it. For now, moving to
us-mia-wg-001.
---
 secrets/wg0.conf.age | Bin 526 -> 527 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/wg0.conf.age b/secrets/wg0.conf.age
index 0e20308440e7d2ccd4217901388b07f9c1b031c1..756a6b0c19b8a0ec9ff4918772173ff77a1252b3 100644
GIT binary patch
literal 527
zcmZQ@_Y83kiVO&0nCx`O{DS_<n15Cl4ae5peRer=2TM?KrT&V&>wn(waPiM{)xGsU
zRd7}(XF_s)v2|Lg?`@ah?|n{FqF0(1GH++=`lo7@>0Xqo{P*lBUY7LWviI6)=l``n
ze{rb8bfKp9ltnFp?`524#6900>bo!Ya!q{x!B47uDv{-v7aHe(dmvV|S}kCad3Mx0
zk!2=oK8B73!m3T&zi*_>>{-RH`7P`Im3M84Di<RaE*wp_Tf`;ye{0EI%ZFmBDgO?v
zyLuzN$L;n1@>PFUtgbk<$VmOUdh{;8kIyn^Ol#UQ|7!gv)thfw1-x#YT@gEL`(Lg!
zpZk-7!@5McuH8|49mQwA^ZDW())TTrd~Uwn{Bpq>Cr>l&Ygb--Bn$twxDd;u&XguR
z`_re6*u!zxN}u&e#O1Ix-uA!s@@UD$7LK33FJ>GNT3dJYeG!Lk=H&E$|Dvp|wm51o
z-0<v5e&Et5u?zAiddsX{l}+Gl|7dw|dhe`VvyZ*@RMdOPy!=_Xu-viWS08nh4m|qV
znX_l5d)_+RCvTXpviUdY2-hZ7R98F9;`WnNb7s4ye(?CQ_|2DF%7t!kYpHoWbMMP1
zvV}=`f0^IP@oPU3RG!=|6=Yh$Jl#aoDEQU?pU*>s_b`?o4DV^-ow!HwW0yIHjHO@b
p{yB@iI<AWpGn6!bKY8-zYVY=&qWNKSzCPanEBH>PlR&E44*=Am1^fU2

literal 526
zcmZQ@_Y83kiVO&0n9R|&amkG(3^NLLJb1d>`s|*JkM2S%dNoeX+snCU#pxGk8~avm
zRu$Pg?ci?-XWrveS4UjDFpb;!>i1QS(F@WR@eAIwH!5DP&h=gUdhiUXj1<WO+@F~8
z-c*Ka7p^#wt9V^~MSQ}WDW(dQD)+1UKeVr#E}QUFeLnBKFKex4HM$ynjyO5JVVBvH
zZOvQTI({iiGL_lJ?^IZO>J012CE<}j)gNoWWSg8ik@={DqC-$<#nH33WS$-g?Nd;5
z`T6(He4ezTPPUrW4`2Ei+fTne@AaFQ^4}ekL}wSMy_1rc4;9(wb$;ER2Y$}m`@7RP
zj%$ZFhFt0SoiNR`V`)Y2tKM$mNW0CJJ6<fD*z9JVcuUg0q)ftw{kKAIjg;tyOFg%C
z&tK##vzO(YNqW<1cMrC<#w%|Z@>k1DO^Mdpe&eI}!)aSpkG?!SS^JYf!oJGYk>L&#
zxwPzW^p(lK-fMH|efQO+R)_Md_WfZ$>bQAx!tEa4O;($)$A3I9kC{8F<qq>}ZJX8Q
za?hL(xfmJ7t@ZwDzbouV`oo`=EfNm)CLG)^yI!!c@y<Wf?pJ5O^oGgoIa}|4-`T>d
z^P7F%Ch1e374u&oX$g71tE_O+)!nt*xGV3e6wWaUsAt~SmECv0epQ~awcv`q3$yzD
px~=jL)tbDD%g?FW*s9NVXwl)uXICerow=hpySQ<2y~>RDQ2=Wf1vdZy


From 6524a1f6554750dc9efaa22acdaeb5f13e1f0ef8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 18 Dec 2025 01:31:19 -0500
Subject: [PATCH 514/847] Revert "wg.conf: us-mia-wg-002 -> us-mia-wg-001"

This reverts commit 507ee6d57aba0bb2064ee2322bcd41f7fd5c600b.
---
 secrets/wg0.conf.age | Bin 527 -> 526 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/wg0.conf.age b/secrets/wg0.conf.age
index 756a6b0c19b8a0ec9ff4918772173ff77a1252b3..0e20308440e7d2ccd4217901388b07f9c1b031c1 100644
GIT binary patch
literal 526
zcmZQ@_Y83kiVO&0n9R|&amkG(3^NLLJb1d>`s|*JkM2S%dNoeX+snCU#pxGk8~avm
zRu$Pg?ci?-XWrveS4UjDFpb;!>i1QS(F@WR@eAIwH!5DP&h=gUdhiUXj1<WO+@F~8
z-c*Ka7p^#wt9V^~MSQ}WDW(dQD)+1UKeVr#E}QUFeLnBKFKex4HM$ynjyO5JVVBvH
zZOvQTI({iiGL_lJ?^IZO>J012CE<}j)gNoWWSg8ik@={DqC-$<#nH33WS$-g?Nd;5
z`T6(He4ezTPPUrW4`2Ei+fTne@AaFQ^4}ekL}wSMy_1rc4;9(wb$;ER2Y$}m`@7RP
zj%$ZFhFt0SoiNR`V`)Y2tKM$mNW0CJJ6<fD*z9JVcuUg0q)ftw{kKAIjg;tyOFg%C
z&tK##vzO(YNqW<1cMrC<#w%|Z@>k1DO^Mdpe&eI}!)aSpkG?!SS^JYf!oJGYk>L&#
zxwPzW^p(lK-fMH|efQO+R)_Md_WfZ$>bQAx!tEa4O;($)$A3I9kC{8F<qq>}ZJX8Q
za?hL(xfmJ7t@ZwDzbouV`oo`=EfNm)CLG)^yI!!c@y<Wf?pJ5O^oGgoIa}|4-`T>d
z^P7F%Ch1e374u&oX$g71tE_O+)!nt*xGV3e6wWaUsAt~SmECv0epQ~awcv`q3$yzD
px~=jL)tbDD%g?FW*s9NVXwl)uXICerow=hpySQ<2y~>RDQ2=Wf1vdZy

literal 527
zcmZQ@_Y83kiVO&0nCx`O{DS_<n15Cl4ae5peRer=2TM?KrT&V&>wn(waPiM{)xGsU
zRd7}(XF_s)v2|Lg?`@ah?|n{FqF0(1GH++=`lo7@>0Xqo{P*lBUY7LWviI6)=l``n
ze{rb8bfKp9ltnFp?`524#6900>bo!Ya!q{x!B47uDv{-v7aHe(dmvV|S}kCad3Mx0
zk!2=oK8B73!m3T&zi*_>>{-RH`7P`Im3M84Di<RaE*wp_Tf`;ye{0EI%ZFmBDgO?v
zyLuzN$L;n1@>PFUtgbk<$VmOUdh{;8kIyn^Ol#UQ|7!gv)thfw1-x#YT@gEL`(Lg!
zpZk-7!@5McuH8|49mQwA^ZDW())TTrd~Uwn{Bpq>Cr>l&Ygb--Bn$twxDd;u&XguR
z`_re6*u!zxN}u&e#O1Ix-uA!s@@UD$7LK33FJ>GNT3dJYeG!Lk=H&E$|Dvp|wm51o
z-0<v5e&Et5u?zAiddsX{l}+Gl|7dw|dhe`VvyZ*@RMdOPy!=_Xu-viWS08nh4m|qV
znX_l5d)_+RCvTXpviUdY2-hZ7R98F9;`WnNb7s4ye(?CQ_|2DF%7t!kYpHoWbMMP1
zvV}=`f0^IP@oPU3RG!=|6=Yh$Jl#aoDEQU?pU*>s_b`?o4DV^-ow!HwW0yIHjHO@b
p{yB@iI<AWpGn6!bKY8-zYVY=&qWNKSzCPanEBH>PlR&E44*=Am1^fU2


From f056e5138f6ebb927eda2c640fe726e37b0828b8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 20 Dec 2025 01:17:09 -0500
Subject: [PATCH 515/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 409bcf9..0dcf711 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1762286984,
-        "narHash": "sha256-9I2H9x5We6Pl+DBYHjR1s3UT8wgwcpAH03kn9CqtdQc=",
+        "lastModified": 1766051518,
+        "narHash": "sha256-znKOwPXQnt3o7lDb3hdf19oDo0BLP4MfBOYiWkEHoik=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "9c870f63e28ec1e83305f7f6cb73c941e699f74f",
+        "rev": "d5eff7f948535b9c723d60cd8239f8f11ddc90fa",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765794845,
-        "narHash": "sha256-YD5QWlGnusNbZCqR3pxG8tRxx9yUXayLZfAJRWspq2s=",
+        "lastModified": 1766150702,
+        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "7194cfe5b7a3660726b0fe7296070eaef601cae9",
+        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
         "type": "github"
       },
       "original": {
@@ -315,11 +315,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765869446,
-        "narHash": "sha256-1sR0DIh41+BMzAbx9rY7XUkqIaHUiThDeKf1ggLUC2M=",
+        "lastModified": 1766179786,
+        "narHash": "sha256-LIjfrSnXzrSbEZNU8tJZwbpf96fNKuoZ78mJ9gCH7P8=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "d6742125c317b7daafec038ab54a7c2fb1e2beaf",
+        "rev": "74e05131e98661d56b30a1a9a1165165a0c70230",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765591348,
-        "narHash": "sha256-GI5eC3BWNBnYk+FV1cTYrjPLrqv1Q5HXD7kwHkqnZ8c=",
+        "lastModified": 1766196161,
+        "narHash": "sha256-gldP7pWe29YQfMak++vpwjrU9JCDT4qEG4dj0QnMXm4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "37f2aad139533c27689c00cef0d43f7c51d0b14e",
+        "rev": "247497d989cf134a186e68d447610e4d000fd59d",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765687488,
-        "narHash": "sha256-7YAJ6xgBAQ/Nr+7MI13Tui1ULflgAdKh63m1tfYV7+M=",
+        "lastModified": 1766014764,
+        "narHash": "sha256-+73VffE5GP5fvbib6Hs1Su6LehG+9UV1Kzs90T2gBLA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d02bcc33948ca19b0aaa0213fe987ceec1f4ebe1",
+        "rev": "2b0d2b456e4e8452cf1c16d00118d145f31160f9",
         "type": "github"
       },
       "original": {
@@ -518,11 +518,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765840762,
-        "narHash": "sha256-4/FBert3MYpKjwEM85tXDi9OQkdLKygoFSmKJ8pEkro=",
+        "lastModified": 1766020451,
+        "narHash": "sha256-Jy7rX7sMbSJEX0KKwvNcGUfRVZ0SDWo3Zk2e5LGyqw0=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "e6c8b81a7eabacf6b93c7fe18f7a0bf6a7493f33",
+        "rev": "5ecd4a56da963480db305e56ab3a42d13597c0a7",
         "type": "github"
       },
       "original": {
@@ -594,11 +594,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1765840086,
-        "narHash": "sha256-e9e1C1f6S+NpEKMuypBj8i2qZLpgfPs3WoXhjddcedk=",
+        "lastModified": 1766185682,
+        "narHash": "sha256-jtgUr6u/UTgafG+i8JGMP37iXo2zvYVxLNxoDBkxX7w=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "8c5f9496510b9a3e1060568443bcd4174b57a914",
+        "rev": "a2df0704fe2d51290d3b209f87f8a4fa1e73bb36",
         "type": "github"
       },
       "original": {

From 7159e9018683d2d39c2596744355bee1721623eb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 28 Dec 2025 15:49:18 -0500
Subject: [PATCH 516/847] organize

---
 configuration.nix                            | 14 +++++++-------
 flake.nix                                    |  6 +++---
 age-secrets.nix => modules/age-secrets.nix   | 14 +++++++-------
 hardware.nix => modules/hardware.nix         |  0
 home.nix => modules/home.nix                 |  0
 impermanence.nix => modules/impermanence.nix |  0
 lib.nix => modules/lib.nix                   |  0
 no-rgb.nix => modules/no-rgb.nix             |  0
 overlays.nix => modules/overlays.nix         |  0
 secureboot.nix => modules/secureboot.nix     |  0
 usb-secrets.nix => modules/usb-secrets.nix   |  0
 zfs.nix => modules/zfs.nix                   |  0
 install.sh => scripts/install.sh             |  0
 tests/minecraft.nix                          |  2 +-
 tests/zfs.nix                                |  2 +-
 15 files changed, 19 insertions(+), 19 deletions(-)
 rename age-secrets.nix => modules/age-secrets.nix (75%)
 rename hardware.nix => modules/hardware.nix (100%)
 rename home.nix => modules/home.nix (100%)
 rename impermanence.nix => modules/impermanence.nix (100%)
 rename lib.nix => modules/lib.nix (100%)
 rename no-rgb.nix => modules/no-rgb.nix (100%)
 rename overlays.nix => modules/overlays.nix (100%)
 rename secureboot.nix => modules/secureboot.nix (100%)
 rename usb-secrets.nix => modules/usb-secrets.nix (100%)
 rename zfs.nix => modules/zfs.nix (100%)
 rename install.sh => scripts/install.sh (100%)

diff --git a/configuration.nix b/configuration.nix
index fdcfed6..7f4ef5e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -11,13 +11,13 @@
 }:
 {
   imports = [
-    ./hardware.nix
-    ./zfs.nix
-    ./impermanence.nix
-    ./usb-secrets.nix
-    ./age-secrets.nix
-    ./secureboot.nix
-    ./no-rgb.nix
+    ./modules/hardware.nix
+    ./modules/zfs.nix
+    ./modules/impermanence.nix
+    ./modules/usb-secrets.nix
+    ./modules/age-secrets.nix
+    ./modules/secureboot.nix
+    ./modules/no-rgb.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
diff --git a/flake.nix b/flake.nix
index 39379d3..1b0d254 100644
--- a/flake.nix
+++ b/flake.nix
@@ -171,7 +171,7 @@
         hostPlatform = system;
         buildPlatform = builtins.currentSystem;
       };
-      lib = import ./lib.nix { inherit inputs pkgs; };
+      lib = import ./modules/lib.nix { inherit inputs pkgs; };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
@@ -224,7 +224,7 @@
           {
             nixpkgs.overlays = [
               nix-minecraft.overlay
-              (import ./overlays.nix)
+              (import ./modules/overlays.nix)
             ];
           }
 
@@ -239,7 +239,7 @@
               ...
             }:
             {
-              home-manager.users.${username} = import ./home.nix;
+              home-manager.users.${username} = import ./modules/home.nix;
             }
           )
         ]
diff --git a/age-secrets.nix b/modules/age-secrets.nix
similarity index 75%
rename from age-secrets.nix
rename to modules/age-secrets.nix
index db2b772..a4088dc 100644
--- a/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -9,7 +9,7 @@
   age.secrets = {
     # ZFS encryption key
     zfs-key = {
-      file = ./secrets/zfs-key.age;
+      file = ../secrets/zfs-key.age;
       mode = "0400";
       owner = "root";
       group = "root";
@@ -17,7 +17,7 @@
 
     # Secureboot keys archive
     secureboot-tar = {
-      file = ./secrets/secureboot.tar.age;
+      file = ../secrets/secureboot.tar.age;
       mode = "0400";
       owner = "root";
       group = "root";
@@ -25,7 +25,7 @@
 
     # System passwords
     hashedPass = {
-      file = ./secrets/hashedPass.age;
+      file = ../secrets/hashedPass.age;
       mode = "0400";
       owner = "root";
       group = "root";
@@ -33,21 +33,21 @@
 
     # Service authentication
     caddy_auth = {
-      file = ./secrets/caddy_auth.age;
+      file = ../secrets/caddy_auth.age;
       mode = "0400";
       owner = "caddy";
       group = "caddy";
     };
 
     jellyfin-api-key = {
-      file = ./secrets/jellyfin-api-key.age;
+      file = ../secrets/jellyfin-api-key.age;
       mode = "0400";
       owner = "root";
       group = "root";
     };
 
     slskd_env = {
-      file = ./secrets/slskd_env.age;
+      file = ../secrets/slskd_env.age;
       mode = "0400";
       owner = "root";
       group = "root";
@@ -55,7 +55,7 @@
 
     # Network configuration
     wg0-conf = {
-      file = ./secrets/wg0.conf.age;
+      file = ../secrets/wg0.conf.age;
       mode = "0400";
       owner = "root";
       group = "root";
diff --git a/hardware.nix b/modules/hardware.nix
similarity index 100%
rename from hardware.nix
rename to modules/hardware.nix
diff --git a/home.nix b/modules/home.nix
similarity index 100%
rename from home.nix
rename to modules/home.nix
diff --git a/impermanence.nix b/modules/impermanence.nix
similarity index 100%
rename from impermanence.nix
rename to modules/impermanence.nix
diff --git a/lib.nix b/modules/lib.nix
similarity index 100%
rename from lib.nix
rename to modules/lib.nix
diff --git a/no-rgb.nix b/modules/no-rgb.nix
similarity index 100%
rename from no-rgb.nix
rename to modules/no-rgb.nix
diff --git a/overlays.nix b/modules/overlays.nix
similarity index 100%
rename from overlays.nix
rename to modules/overlays.nix
diff --git a/secureboot.nix b/modules/secureboot.nix
similarity index 100%
rename from secureboot.nix
rename to modules/secureboot.nix
diff --git a/usb-secrets.nix b/modules/usb-secrets.nix
similarity index 100%
rename from usb-secrets.nix
rename to modules/usb-secrets.nix
diff --git a/zfs.nix b/modules/zfs.nix
similarity index 100%
rename from zfs.nix
rename to modules/zfs.nix
diff --git a/install.sh b/scripts/install.sh
similarity index 100%
rename from install.sh
rename to scripts/install.sh
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index ca2d18a..bc71db8 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -12,7 +12,7 @@ let
     config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
     overlays = [
       inputs.nix-minecraft.overlay
-      (import ../overlays.nix)
+      (import ../modules/overlays.nix)
     ];
   };
 
diff --git a/tests/zfs.nix b/tests/zfs.nix
index d14bb55..a712ccc 100644
--- a/tests/zfs.nix
+++ b/tests/zfs.nix
@@ -7,7 +7,7 @@
 }:
 let
   # Create pkgs with ensureZfsMounts overlay
-  testPkgs = pkgs.appendOverlays [ (import ../overlays.nix) ];
+  testPkgs = pkgs.appendOverlays [ (import ../modules/overlays.nix) ];
 in
 testPkgs.testers.runNixOSTest {
   name = "zfs test";

From 7f0823f8c295253a52160dbd7c85c9d061cd2cf0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 30 Dec 2025 16:38:30 -0500
Subject: [PATCH 517/847] 25.05 -> 25.11

---
 flake.lock | 71 +++++++++++++++++++++++++++---------------------------
 flake.nix  |  7 +++---
 2 files changed, 38 insertions(+), 40 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0dcf711..5d5b3ba 100644
--- a/flake.lock
+++ b/flake.lock
@@ -25,11 +25,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1763938834,
-        "narHash": "sha256-j8iB0Yr4zAvQLueCZ5abxfk6fnG/SJ5JnGUziETjwfg=",
+        "lastModified": 1766774972,
+        "narHash": "sha256-8qxEFpj4dVmIuPn9j9z6NTbU+hrcGjBOvaxTzre5HmM=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "d9e753122e51cee64eb8d2dddfe11148f339f5a2",
+        "rev": "01bc1d404a51a0a07e9d8759cd50a7903e218c82",
         "type": "github"
       },
       "original": {
@@ -254,16 +254,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1763992789,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "lastModified": 1767024057,
+        "narHash": "sha256-B1aycRjMRvb6QOGbnqDhiDzZwMebj5jxZ5qyJzaKvpI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "34578a2fdfce4257ce5f5baf6e7efbd4e4e252b1",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -293,17 +293,16 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1764622702,
-        "narHash": "sha256-HggOVvg2U3EwT44wPHEwFKromf9qR9rTqfV1i3q7rYs=",
+        "lastModified": 1767013031,
+        "narHash": "sha256-p8ANXBakAtfX/aEhLbU6w0tuQe3nrBvLdHbKirJP7ug=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
+        "rev": "c2a82339373daee8cbbcad5f51f22ae6b71069e0",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1",
         "type": "github"
       }
     },
@@ -315,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766179786,
-        "narHash": "sha256-LIjfrSnXzrSbEZNU8tJZwbpf96fNKuoZ78mJ9gCH7P8=",
+        "lastModified": 1767130133,
+        "narHash": "sha256-L53uKmj5eTaZXjR0UgUSMFNV2VWw7dHgfF0v4YoOpzw=",
         "owner": "ggml-org",
         "repo": "llama.cpp",
-        "rev": "74e05131e98661d56b30a1a9a1165165a0c70230",
+        "rev": "4849661d9898ac3caf59ddd62044185805084370",
         "type": "github"
       },
       "original": {
@@ -337,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766196161,
-        "narHash": "sha256-gldP7pWe29YQfMak++vpwjrU9JCDT4qEG4dj0QnMXm4=",
+        "lastModified": 1767060660,
+        "narHash": "sha256-8sqnhJcmHZ4OzLxmTtblQgpazosuhggeGZ2yeMvWOi0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "247497d989cf134a186e68d447610e4d000fd59d",
+        "rev": "1d3efec981bcb162a7921b29502ad369056295cb",
         "type": "github"
       },
       "original": {
@@ -352,11 +351,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1767070591,
+        "narHash": "sha256-b0aM3221Pw6vbACFqZrVzZjMNqXVPi1dvgLr8QTbajc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "9b3c38bf6c260d0e88154ef07fa833fa845bfd14",
         "type": "github"
       },
       "original": {
@@ -368,16 +367,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766014764,
-        "narHash": "sha256-+73VffE5GP5fvbib6Hs1Su6LehG+9UV1Kzs90T2gBLA=",
+        "lastModified": 1766885793,
+        "narHash": "sha256-P6RVkrM9JLCW6xBjSwHfgTOQ1JwBUma5xe5LI8xAPC0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2b0d2b456e4e8452cf1c16d00118d145f31160f9",
+        "rev": "9ef261221d1e72399f2036786498d78c38185c46",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -420,11 +419,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763988335,
-        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "lastModified": 1765911976,
+        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
         "type": "github"
       },
       "original": {
@@ -461,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764470739,
-        "narHash": "sha256-sa9f81B1dWO16QtgDTWHX8DQbiHKzHndpaunY5EQtwE=",
+        "lastModified": 1766976750,
+        "narHash": "sha256-w+o3AIBI56tzfMJRqRXg9tSXnpQRN5hAT15o2t9rxYw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "3bfa664055e1a09c6aedab5533c5fc8d6ca5741a",
+        "rev": "9fe44e7f05b734a64a01f92fc51ad064fb0a884f",
         "type": "github"
       },
       "original": {
@@ -518,11 +517,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766020451,
-        "narHash": "sha256-Jy7rX7sMbSJEX0KKwvNcGUfRVZ0SDWo3Zk2e5LGyqw0=",
+        "lastModified": 1767067175,
+        "narHash": "sha256-pmnvcklSTYPAQJvAy1QsGK4Tr/7WZ1J2fF88NRQsSUw=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "5ecd4a56da963480db305e56ab3a42d13597c0a7",
+        "rev": "de0050496c97708afa2b32b68885fae640b65ca8",
         "type": "github"
       },
       "original": {
@@ -594,11 +593,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1766185682,
-        "narHash": "sha256-jtgUr6u/UTgafG+i8JGMP37iXo2zvYVxLNxoDBkxX7w=",
+        "lastModified": 1767049717,
+        "narHash": "sha256-fbAPIVXdbMxrKHQcc2WG4qUmSAsEHTUCp/37gN/uN24=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "a2df0704fe2d51290d3b209f87f8a4fa1e73bb36",
+        "rev": "ca756d1e9d586024f96bb6f3d60b5ea781384a36",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 1b0d254..bb7096f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,11 +2,10 @@
   description = "Flake for server muffin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
     lanzaboote = {
-      # Pin to commit to fix: https://github.com/nix-community/lanzaboote/issues/518
-      url = "github:nix-community/lanzaboote/6242b3b2b5e5afcf329027ed4eb5fa6e2eab10f1";
+      url = "github:nix-community/lanzaboote";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -20,7 +19,7 @@
     vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

From e2529aadc37fc06fb1c4b15c8ba648cd7b71348b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 05:41:10 -0500
Subject: [PATCH 518/847] fully remove llama-cpp

---
 configuration.nix      |  2 --
 flake.nix              |  5 -----
 services/llama-cpp.nix | 43 ------------------------------------------
 3 files changed, 50 deletions(-)
 delete mode 100644 services/llama-cpp.nix

diff --git a/configuration.nix b/configuration.nix
index 7f4ef5e..3f496a2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -33,8 +33,6 @@
 
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
-
     ./services/ups.nix
 
     ./services/bitwarden.nix
diff --git a/flake.nix b/flake.nix
index bb7096f..cff2c74 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,11 +28,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    llamacpp = {
-      url = "github:ggml-org/llama.cpp";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     srvos = {
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
deleted file mode 100644
index 9a57449..0000000
--- a/services/llama-cpp.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  pkgs,
-  service_configs,
-  config,
-  inputs,
-  lib,
-  ...
-}:
-{
-  services.llama-cpp = {
-    enable = true;
-    model = builtins.toString (
-      pkgs.fetchurl {
-        url = "https://huggingface.co/unsloth/Apriel-1.5-15b-Thinker-GGUF/resolve/main/Apriel-1.5-15b-Thinker-Q4_0.gguf";
-        sha256 = "4d9439b76b6f4380ab5205617c1ef3d10b0e8897146a0a7ccb7155bca1771df7";
-      }
-    );
-    port = service_configs.ports.llama_cpp;
-    host = "0.0.0.0";
-    # vulkan broken: https://github.com/ggml-org/llama.cpp/issues/13801
-    package = (
-      lib.optimizePackage (
-        inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
-          postPatch = "";
-        })
-      )
-    );
-    extraFlags = [
-      "-ngl"
-      "12"
-      "-c"
-      "16384"
-    ];
-  };
-
-  # have to do this in order to get vulkan to work
-  systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
-
-  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString config.services.llama-cpp.port}
-  '';
-}

From bcf6df238cfdaa6d39d75767bce0b647535e196a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 06:17:48 -0500
Subject: [PATCH 519/847] vaapiVdpau -> libva-vdpau-driver

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 3f496a2..d2d520c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -125,7 +125,7 @@
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
-      vaapiVdpau
+      libva-vdpau-driver
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       vpl-gpu-rt # QSV on 11th gen or newer
     ];

From b8489fab61a093096064591905e37824cf71017b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 06:24:58 -0500
Subject: [PATCH 520/847] cleanup flake deps

---
 flake.lock | 123 ++++-------------------------------------------------
 flake.nix  |   3 ++
 2 files changed, 11 insertions(+), 115 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5d5b3ba..05c5ae0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,8 +2,10 @@
   "nodes": {
     "agenix": {
       "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
+        "darwin": [],
+        "home-manager": [
+          "home-manager"
+        ],
         "nixpkgs": [
           "nixpkgs"
         ],
@@ -38,28 +40,6 @@
         "type": "github"
       }
     },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -150,24 +130,6 @@
         "type": "github"
       }
     },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_3"
@@ -227,27 +189,6 @@
       }
     },
     "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -306,27 +247,6 @@
         "type": "github"
       }
     },
-    "llamacpp": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1767130133,
-        "narHash": "sha256-L53uKmj5eTaZXjR0UgUSMFNV2VWw7dHgfF0v4YoOpzw=",
-        "owner": "ggml-org",
-        "repo": "llama.cpp",
-        "rev": "4849661d9898ac3caf59ddd62044185805084370",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ggml-org",
-        "repo": "llama.cpp",
-        "type": "github"
-      }
-    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
@@ -381,34 +301,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1730504152,
-        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1764517877,
-        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -437,10 +329,9 @@
         "agenix": "agenix",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
-        "home-manager": "home-manager_2",
+        "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
-        "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
@@ -658,7 +549,9 @@
     "ytbn-graphing-software": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
diff --git a/flake.nix b/flake.nix
index cff2c74..70e9897 100644
--- a/flake.nix
+++ b/flake.nix
@@ -45,6 +45,8 @@
     agenix = {
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+      inputs.darwin.follows = "";
     };
 
     senior_project-website = {
@@ -64,6 +66,7 @@
 
     ytbn-graphing-software = {
       url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 

From 6f0bc05aeae7194264e0f01292a3abf891e873dc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 21:46:01 -0500
Subject: [PATCH 521/847] update

---
 flake.lock | 127 +++++++++++++++++++++++++++++++++++------------------
 1 file changed, 84 insertions(+), 43 deletions(-)

diff --git a/flake.lock b/flake.lock
index 05c5ae0..728b4c9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1766774972,
-        "narHash": "sha256-8qxEFpj4dVmIuPn9j9z6NTbU+hrcGjBOvaxTzre5HmM=",
+        "lastModified": 1767461147,
+        "narHash": "sha256-TH/xTeq/RI+DOzo+c+4F431eVuBpYVwQwBxzURe7kcI=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "01bc1d404a51a0a07e9d8759cd50a7903e218c82",
+        "rev": "7d59256814085fd9666a2ae3e774dc5ee216b630",
         "type": "github"
       },
       "original": {
@@ -101,15 +101,15 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1761588595,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -195,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767024057,
-        "narHash": "sha256-B1aycRjMRvb6QOGbnqDhiDzZwMebj5jxZ5qyJzaKvpI=",
+        "lastModified": 1767910483,
+        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "34578a2fdfce4257ce5f5baf6e7efbd4e4e252b1",
+        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
         "type": "github"
       },
       "original": {
@@ -209,13 +209,38 @@
         "type": "github"
       }
     },
-    "impermanence": {
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "lastModified": 1747978958,
+        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1767822991,
+        "narHash": "sha256-iyrn9AcPZCoyxX4OT8eMkBsjG7SRUQXXS/V1JzxS7rA=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "82e5bc4508cab9e8d5a136626276eb5bbce5e9c5",
         "type": "github"
       },
       "original": {
@@ -234,11 +259,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1767013031,
-        "narHash": "sha256-p8ANXBakAtfX/aEhLbU6w0tuQe3nrBvLdHbKirJP7ug=",
+        "lastModified": 1767697030,
+        "narHash": "sha256-0iVZ99H3kR5h6Lhw8kDDuUc5C/k6iismeWgCS1qWTQ4=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "c2a82339373daee8cbbcad5f51f22ae6b71069e0",
+        "rev": "657469e8f036334db768daaf7732b1174676054b",
         "type": "github"
       },
       "original": {
@@ -256,11 +281,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767060660,
-        "narHash": "sha256-8sqnhJcmHZ4OzLxmTtblQgpazosuhggeGZ2yeMvWOi0=",
+        "lastModified": 1767838769,
+        "narHash": "sha256-KCLU6SUU80tEBKIVZsBrSjRYX6kn1eVIYI3fEEqOp24=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1d3efec981bcb162a7921b29502ad369056295cb",
+        "rev": "4da21f019f6443f513f16af7f220ba4db1cdfc04",
         "type": "github"
       },
       "original": {
@@ -271,11 +296,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1767070591,
-        "narHash": "sha256-b0aM3221Pw6vbACFqZrVzZjMNqXVPi1dvgLr8QTbajc=",
+        "lastModified": 1767185284,
+        "narHash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9b3c38bf6c260d0e88154ef07fa833fa845bfd14",
+        "rev": "40b1a28dce561bea34858287fbb23052c3ee63fe",
         "type": "github"
       },
       "original": {
@@ -287,11 +312,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766885793,
-        "narHash": "sha256-P6RVkrM9JLCW6xBjSwHfgTOQ1JwBUma5xe5LI8xAPC0=",
+        "lastModified": 1748026106,
+        "narHash": "sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "063f43f2dbdef86376cc29ad646c45c46e93234c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1767799921,
+        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ef261221d1e72399f2036786498d78c38185c46",
+        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
         "type": "github"
       },
       "original": {
@@ -311,11 +352,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765911976,
-        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
+        "lastModified": 1767281941,
+        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
         "type": "github"
       },
       "original": {
@@ -334,7 +375,7 @@
         "lanzaboote": "lanzaboote",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
         "trackerlist": "trackerlist",
@@ -351,11 +392,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766976750,
-        "narHash": "sha256-w+o3AIBI56tzfMJRqRXg9tSXnpQRN5hAT15o2t9rxYw=",
+        "lastModified": 1767495280,
+        "narHash": "sha256-hEEgtE/RSRigw8xscchGymf/t1nluZwTfru4QF6O1CQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9fe44e7f05b734a64a01f92fc51ad064fb0a884f",
+        "rev": "cb24c5cc207ba8e9a4ce245eedd2d37c3a988bc1",
         "type": "github"
       },
       "original": {
@@ -408,11 +449,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767067175,
-        "narHash": "sha256-pmnvcklSTYPAQJvAy1QsGK4Tr/7WZ1J2fF88NRQsSUw=",
+        "lastModified": 1767835990,
+        "narHash": "sha256-SJVH9fySPFqE8lYEQ5JsggGgSxTJQuhXpg/BrvlaOcc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "de0050496c97708afa2b32b68885fae640b65ca8",
+        "rev": "23022726b63ebef9d28dba289f1fac4f6d5a527f",
         "type": "github"
       },
       "original": {
@@ -484,11 +525,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1767049717,
-        "narHash": "sha256-fbAPIVXdbMxrKHQcc2WG4qUmSAsEHTUCp/37gN/uN24=",
+        "lastModified": 1767913709,
+        "narHash": "sha256-F/KKwb1xsWtWIt0VG+TBHSpQGTJV/y5uzv1im+Yc08w=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "ca756d1e9d586024f96bb6f3d60b5ea781384a36",
+        "rev": "963d4fec850035e9f65e1e7d4936c779598cf13e",
         "type": "github"
       },
       "original": {
@@ -517,11 +558,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1765634578,
-        "narHash": "sha256-Fujb9sn1cj+u/bzfo2RbQkcAvJ7Ch1pimJzFie4ptb4=",
+        "lastModified": 1767604552,
+        "narHash": "sha256-FddhMxnc99KYOZ/S3YNqtDSoxisIhVtJ7L4s8XD2u0A=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "f2989e1e3cb06c7185939e9ddc368f88b998616a",
+        "rev": "a6b2da727853886876fd1081d6bb2880752937f3",
         "type": "github"
       },
       "original": {

From d7a8e25811b97deb726525bf5d1e44c27c27dd7f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 21:47:22 -0500
Subject: [PATCH 522/847] impermanence: fix home directory declaration

---
 modules/impermanence.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 112b9cb..4fbe6f6 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -38,8 +38,6 @@
     };
 
     users.root = {
-      home = "/root";
-
       files = [
         ".local/share/fish/fish_history"
       ];

From 5b6ad32f633e1df482249feaab76baa4956fc8bf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 8 Jan 2026 21:50:22 -0500
Subject: [PATCH 523/847] ytbn: use own nixpkgs

---
 flake.lock | 20 +++++++++++++++++---
 flake.nix  |  1 -
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 728b4c9..36f9847 100644
--- a/flake.lock
+++ b/flake.lock
@@ -342,6 +342,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1764517877,
+        "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2d293cbfa5a793b4c50d17c05ef9e385b90edf6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -590,9 +606,7 @@
     "ytbn-graphing-software": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
+        "nixpkgs": "nixpkgs_3",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
diff --git a/flake.nix b/flake.nix
index 70e9897..f7052e3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -66,7 +66,6 @@
 
     ytbn-graphing-software = {
       url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 

From 165532bae3c03c8320d089859ffaef403e587d62 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 9 Jan 2026 12:52:16 -0500
Subject: [PATCH 524/847] nit: cleanup imports

---
 disk-config.nix          | 5 +++++
 flake.nix                | 9 ---------
 modules/age-secrets.nix  | 5 +++++
 modules/impermanence.nix | 5 +++++
 services/minecraft.nix   | 2 ++
 services/wg.nix          | 8 +++++---
 tests/minecraft.nix      | 3 +--
 7 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/disk-config.nix b/disk-config.nix
index 9a487ca..b3eb30d 100644
--- a/disk-config.nix
+++ b/disk-config.nix
@@ -1,4 +1,9 @@
+{ inputs, ... }:
 {
+  imports = [
+    inputs.disko.nixosModules.disko
+  ];
+
   disko.devices = {
     disk = {
       main = {
diff --git a/flake.nix b/flake.nix
index f7052e3..309aa81 100644
--- a/flake.nix
+++ b/flake.nix
@@ -208,15 +208,8 @@
           srvos.nixosModules.mixins-terminfo
 
           ./disk-config.nix
-          disko.nixosModules.disko
           ./configuration.nix
 
-          impermanence.nixosModules.impermanence
-
-          vpn-confinement.nixosModules.default
-
-          # get nix-minecraft working!
-          nix-minecraft.nixosModules.minecraft-servers
           {
             nixpkgs.overlays = [
               nix-minecraft.overlay
@@ -226,8 +219,6 @@
 
           lanzaboote.nixosModules.lanzaboote
 
-          agenix.nixosModules.default
-
           home-manager.nixosModules.home-manager
           (
             {
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index a4088dc..bdc56eb 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -2,9 +2,14 @@
   config,
   lib,
   pkgs,
+  inputs,
   ...
 }:
 {
+  imports = [
+    inputs.agenix.nixosModules.default
+  ];
+
   # Configure all agenix secrets
   age.secrets = {
     # ZFS encryption key
diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 4fbe6f6..9fd5fde 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -4,9 +4,14 @@
   pkgs,
   username,
   service_configs,
+  inputs,
   ...
 }:
 {
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
   environment.persistence."/persistent" = {
     hideMounts = true;
     directories = [
diff --git a/services/minecraft.nix b/services/minecraft.nix
index e416655..f94d979 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -3,6 +3,7 @@
   service_configs,
   lib,
   config,
+  inputs,
   ...
 }:
 {
@@ -13,6 +14,7 @@
         "${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}"
       ]
     )
+    inputs.nix-minecraft.nixosModules.minecraft-servers
   ];
 
   environment.systemPackages = [
diff --git a/services/wg.nix b/services/wg.nix
index 2688da0..283e381 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -1,11 +1,14 @@
 {
   pkgs,
-  service_configs,
-  eth_interface,
   config,
+  inputs,
   ...
 }:
 {
+  imports = [
+    inputs.vpn-confinement.nixosModules.default
+  ];
+
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     enable = true;
@@ -14,5 +17,4 @@
       # "192.168.0.0/24"
     ];
   };
-
 }
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index bc71db8..aa65ec9 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -22,7 +22,7 @@ let
     {
       imports = [
         (import ../services/minecraft.nix {
-          inherit lib config;
+          inherit lib config inputs;
           pkgs = testPkgs;
           service_configs = {
             minecraft = {
@@ -50,7 +50,6 @@ testPkgs.testers.runNixOSTest {
     { ... }:
     {
       imports = [
-        inputs.nix-minecraft.nixosModules.minecraft-servers
         minecraftService
       ];
 

From 5800a9cde03cb4ed1e6496324290c181216ccfcc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 Jan 2026 13:07:25 -0500
Subject: [PATCH 525/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 36f9847..5c40364 100644
--- a/flake.lock
+++ b/flake.lock
@@ -259,11 +259,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1767697030,
-        "narHash": "sha256-0iVZ99H3kR5h6Lhw8kDDuUc5C/k6iismeWgCS1qWTQ4=",
+        "lastModified": 1768208826,
+        "narHash": "sha256-HWnVcDDuBCHUDoDpNADw1LybfF4jKofGAynV4HDRRrg=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "657469e8f036334db768daaf7732b1174676054b",
+        "rev": "ba5f08218d4f14bf1baeeb69eaadb7a2f2d995af",
         "type": "github"
       },
       "original": {
@@ -328,11 +328,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1767799921,
-        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
+        "lastModified": 1768028080,
+        "narHash": "sha256-50aDK+8eLvsLK39TzQhKNq50/HcXyP4hyxOYoPoVxjo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
+        "rev": "d03088749a110d52a4739348f39a63f84bb0be14",
         "type": "github"
       },
       "original": {
@@ -465,11 +465,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767835990,
-        "narHash": "sha256-SJVH9fySPFqE8lYEQ5JsggGgSxTJQuhXpg/BrvlaOcc=",
+        "lastModified": 1768182633,
+        "narHash": "sha256-hH2yT/KOwvw6kpJ9S68KEqq4G//o3tisL/1y1W3QbMA=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "23022726b63ebef9d28dba289f1fac4f6d5a527f",
+        "rev": "43dd76be5957fea8db9a1948c182597c7db81f97",
         "type": "github"
       },
       "original": {
@@ -541,11 +541,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1767913709,
-        "narHash": "sha256-F/KKwb1xsWtWIt0VG+TBHSpQGTJV/y5uzv1im+Yc08w=",
+        "lastModified": 1768172918,
+        "narHash": "sha256-31ob5YhAem7ORlwEIo7VviS7wUKrwCv8loHqcdQigiA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "963d4fec850035e9f65e1e7d4936c779598cf13e",
+        "rev": "bb1a0aebaa6db1133b66f5b55278cc76cfda98cc",
         "type": "github"
       },
       "original": {

From 9a27557121db397e07ed60b01cbd4b6e6c13719b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 Jan 2026 15:23:28 -0500
Subject: [PATCH 526/847] nixfmt-rfc-style -> nixfmt-tree

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 309aa81..05d5f0f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -170,7 +170,7 @@
       lib = import ./modules/lib.nix { inherit inputs pkgs; };
     in
     {
-      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
+      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
       nixosConfigurations.${hostname} = lib.nixosSystem {
         inherit system;
         specialArgs = {

From da585978895d37d326f97afb53cec2cdfd4f1672 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 Jan 2026 15:28:38 -0500
Subject: [PATCH 527/847] fix pkgs.system deprecation

---
 services/graphing-calculator.nix | 2 +-
 tests/minecraft.nix              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/graphing-calculator.nix b/services/graphing-calculator.nix
index 51bd6d9..32e548c 100644
--- a/services/graphing-calculator.nix
+++ b/services/graphing-calculator.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  graphing-calculator = inputs.ytbn-graphing-software.packages.${pkgs.system}.web;
+  graphing-calculator = inputs.ytbn-graphing-software.packages.${pkgs.stdenv.hostPlatform.system}.web;
 in
 {
   services.caddy.virtualHosts."graphing.${service_configs.https.domain}".extraConfig = ''
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index aa65ec9..dacd5f6 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -8,7 +8,7 @@
 let
   # Create pkgs with nix-minecraft overlay and unfree packages allowed
   testPkgs = import inputs.nixpkgs {
-    system = pkgs.system;
+    system = pkgs.stdenv.hostPlatform.system;
     config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
     overlays = [
       inputs.nix-minecraft.overlay

From 3552642a3c3dd335feeb722490ba2fd0b2b83eef Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 12 Jan 2026 20:08:03 -0500
Subject: [PATCH 528/847] update webpage

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5c40364..dbb4138 100644
--- a/flake.lock
+++ b/flake.lock
@@ -590,11 +590,11 @@
     "website": {
       "flake": false,
       "locked": {
-        "lastModified": 1762499206,
-        "narHash": "sha256-xJ7aYls8CcUwmIavPSt1V9lm2NDiR9ybz1VPG+NALT4=",
+        "lastModified": 1768266466,
+        "narHash": "sha256-d4dZzEcIKuq4DhNtXczaflpRifAtcOgNr45W2Bexnps=",
         "ref": "refs/heads/main",
-        "rev": "c30dfe73bdeeec3dfeff09b8a0d9e40ce3a02995",
-        "revCount": 22,
+        "rev": "06011a27456b3b9f983ef1aa142b5773bcb52b6e",
+        "revCount": 23,
         "type": "git",
         "url": "https://git.gardling.com/titaniumtown/website"
       },

From 6f97c73cf6b38e58ebbfa659c245f6088af72891 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 12:39:29 -0500
Subject: [PATCH 529/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index dbb4138..af706de 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1767461147,
-        "narHash": "sha256-TH/xTeq/RI+DOzo+c+4F431eVuBpYVwQwBxzURe7kcI=",
+        "lastModified": 1767744144,
+        "narHash": "sha256-9/9ntI0D+HbN4G0TrK3KmHbTvwgswz7p8IEJsWyef8Q=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "7d59256814085fd9666a2ae3e774dc5ee216b630",
+        "rev": "2fb033290bf6b23f226d4c8b32f7f7a16b043d7e",
         "type": "github"
       },
       "original": {
@@ -259,11 +259,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1768208826,
-        "narHash": "sha256-HWnVcDDuBCHUDoDpNADw1LybfF4jKofGAynV4HDRRrg=",
+        "lastModified": 1768307256,
+        "narHash": "sha256-3yDvlAqWa0Vk3B9hFRJJrSs1xc+FwVQFLtu//VrTR4c=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "ba5f08218d4f14bf1baeeb69eaadb7a2f2d995af",
+        "rev": "7e031eb535a494582f4fc58735b5aecba7b57058",
         "type": "github"
       },
       "original": {
@@ -328,11 +328,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1768028080,
-        "narHash": "sha256-50aDK+8eLvsLK39TzQhKNq50/HcXyP4hyxOYoPoVxjo=",
+        "lastModified": 1768242861,
+        "narHash": "sha256-F4IIxa5xDHjtrmMcayM8lHctUq1oGltfBQu2+oqDWP4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d03088749a110d52a4739348f39a63f84bb0be14",
+        "rev": "1327e798cb055f96f92685df444e9a2c326ab5ed",
         "type": "github"
       },
       "original": {
@@ -408,11 +408,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767495280,
-        "narHash": "sha256-hEEgtE/RSRigw8xscchGymf/t1nluZwTfru4QF6O1CQ=",
+        "lastModified": 1768272338,
+        "narHash": "sha256-Tg/kL8eKMpZtceDvBDQYU8zowgpr7ucFRnpP/AtfuRM=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "cb24c5cc207ba8e9a4ce245eedd2d37c3a988bc1",
+        "rev": "03dda130a8701b08b0347fcaf850a190c53a3c1e",
         "type": "github"
       },
       "original": {
@@ -445,11 +445,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1764604089,
-        "narHash": "sha256-n1Dw2o5I0h+8hroIrkyqZWAK6usAQg3zdOVDhjLA4DY=",
+        "lastModified": 1768253064,
+        "narHash": "sha256-Lp3k2BhOWo7bYRcGuV0ltgVYr+0+1QCcpuB7kK4pvOE=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "d11badd0f8fe24a37e81439f60eb9c1ce3eb2c22",
+        "rev": "f86a1c80c58d1c292b4673e28e892de13fb78a25",
         "type": "github"
       },
       "original": {
@@ -541,11 +541,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1768172918,
-        "narHash": "sha256-31ob5YhAem7ORlwEIo7VviS7wUKrwCv8loHqcdQigiA=",
+        "lastModified": 1768259319,
+        "narHash": "sha256-kB+XRKahig2LTD14ypfYbR1QsOel6E35lIxLENleV/E=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "bb1a0aebaa6db1133b66f5b55278cc76cfda98cc",
+        "rev": "3f5537d696a42c5a4a97dc9c7abf0a82fcce40eb",
         "type": "github"
       },
       "original": {

From 65b49488d1db003a2e45fbfb7e2f92041952f376 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 13:10:19 -0500
Subject: [PATCH 530/847] impermanence: fix persistant ssh host keys

---
 modules/impermanence.nix | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 9fd5fde..6d78b55 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -23,12 +23,6 @@
     ];
 
     files = [
-      # SSH host keys
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-      "/etc/ssh/ssh_host_rsa_key"
-      "/etc/ssh/ssh_host_rsa_key.pub"
-
       # Machine ID
       "/etc/machine-id"
 
@@ -49,6 +43,20 @@
     };
   };
 
+  # Store SSH host keys directly in /persistent to survive tmpfs root wipes.
+  # This is more reliable than bind mounts for service-generated files.
+  services.openssh.hostKeys = [
+    {
+      path = "/persistent/etc/ssh/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+    {
+      path = "/persistent/etc/ssh/ssh_host_rsa_key";
+      type = "rsa";
+      bits = 4096;
+    }
+  ];
+
   systemd.tmpfiles.rules = [
     "d /etc 755 root"
   ];

From 5fe233e05e511fdac4a6012ab7a3394969482102 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 13:13:49 -0500
Subject: [PATCH 531/847] impermanence: fix /etc/zfs cache

---
 modules/impermanence.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 6d78b55..5849d47 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -20,14 +20,15 @@
       "/var/lib/nixos"
 
       "/var/lib/systemd/timers"
+
+      # ZFS cache directory - persisting the directory instead of the file
+      # avoids "device busy" errors when ZFS atomically updates the cache
+      "/etc/zfs"
     ];
 
     files = [
       # Machine ID
       "/etc/machine-id"
-
-      # ZFS cache
-      "/etc/zfs/zpool.cache"
     ];
 
     users.${username} = {

From ecfc282526d946f946d969215ab400c6e9a38a2b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 13:41:23 -0500
Subject: [PATCH 532/847] rework qbittorrent jellyfin monitor test

---
 tests/jellyfin-qbittorrent-monitor.nix | 433 +++++++++----------------
 1 file changed, 157 insertions(+), 276 deletions(-)

diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 830fa25..4868d83 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -1,305 +1,186 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
+let
+  mockQBittorrent = pkgs.writers.writePython3Bin "mock-qbt" { flakeIgnore = [ "E501" ]; } ''
+    import http.server
+    import socketserver
+
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, fmt, *args):
+            print(f"qbt: {fmt % args}")
+
+        def do_GET(self):
+            if self.path == "/api/v2/transfer/speedLimitsMode":
+                self.send_response(200)
+                self.send_header("Content-type", "text/plain")
+                self.end_headers()
+                self.wfile.write(("1" if getattr(self.server, "alt_speed", False) else "0").encode())
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self):
+            if self.path == "/api/v2/transfer/toggleSpeedLimitsMode":
+                self.server.alt_speed = not getattr(self.server, "alt_speed", False)
+                self.send_response(200)
+                self.end_headers()
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+
+    with socketserver.TCPServer(("127.0.0.1", 8080), Handler) as s:
+        print("Mock qBittorrent on port 8080")
+        s.serve_forever()
+  '';
+
+  mockJellyfin = pkgs.writers.writePython3Bin "mock-jellyfin" { flakeIgnore = [ "E501" ]; } ''
+    import http.server
+    import socketserver
+    import json
+
+    DEFAULT = {"streaming": False, "paused": False, "local": False, "media_type": "Movie"}
+
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, fmt, *args):
+            print(f"jellyfin: {fmt % args}")
+
+        def do_GET(self):
+            if self.path == "/Sessions":
+                self.send_response(200)
+                self.send_header("Content-type", "application/json")
+                self.end_headers()
+                state = getattr(self.server, "state", DEFAULT.copy())
+                sessions = []
+                if state["streaming"]:
+                    sessions = [{
+                        "Id": "test-1",
+                        "UserName": "User",
+                        "RemoteEndPoint": "192.168.1.100" if state["local"] else "203.0.113.42",
+                        "NowPlayingItem": {"Name": f"Test {state['media_type']}", "Type": state["media_type"]},
+                        "PlayState": {"IsPaused": state["paused"]}
+                    }]
+                self.wfile.write(json.dumps(sessions).encode())
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self):
+            if self.path == "/control/state":
+                data = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))).decode() or "{}")
+                if not hasattr(self.server, "state"):
+                    self.server.state = DEFAULT.copy()
+                self.server.state.update(data)
+                self.send_response(200)
+                self.end_headers()
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+
+    with socketserver.TCPServer(("127.0.0.1", 8096), Handler) as s:
+        print("Mock Jellyfin on port 8096")
+        s.serve_forever()
+  '';
+in
 pkgs.testers.runNixOSTest {
   name = "jellyfin-qbittorrent-monitor";
 
-  nodes = {
-    server =
-      { pkgs, config, ... }:
-      {
-        # Mock qBittorrent service
-        systemd.services.mock-qbittorrent = {
-          description = "Mock qBittorrent API server";
-          after = [ "network.target" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "simple";
-            ExecStart = lib.getExe (
-              pkgs.writers.writePython3Bin "mock-qbt" { flakeIgnore = [ "E501" ]; } ''
-                import http.server
-                import socketserver
-
-
-                class MockQBittorrentHandler(http.server.BaseHTTPRequestHandler):
-                    def do_GET(self):
-                        if self.path == '/api/v2/transfer/speedLimitsMode':
-                            self.send_response(200)
-                            self.send_header('Content-type', 'text/plain')
-                            self.end_headers()
-                            response = '1' if getattr(self.server, 'speed_limits_mode', False) else '0'
-                            self.wfile.write(response.encode())
-                        else:
-                            self.send_response(404)
-                            self.end_headers()
-
-                    def do_POST(self):
-                        if self.path == '/api/v2/transfer/toggleSpeedLimitsMode':
-                            self.server.speed_limits_mode = not getattr(self.server, 'speed_limits_mode', False)
-                            self.send_response(200)
-                            self.end_headers()
-                            print(f'MONITOR_TEST: Speed limits toggled to {self.server.speed_limits_mode}')
-                        else:
-                            self.send_response(404)
-                            self.end_headers()
-
-                    def log_message(self, format, *args):
-                        print(f'qBittorrent Mock: {format % args}')
-
-
-                with socketserver.TCPServer(('127.0.0.1', 8080), MockQBittorrentHandler) as httpd:
-                    httpd.speed_limits_mode = False
-                    print('Mock qBittorrent server started on port 8080')
-                    httpd.serve_forever()
-              ''
-            );
-            Restart = "always";
-            RestartSec = "5s";
-          };
-        };
-
-        # Mock Jellyfin service with controllable streaming state
-        systemd.services.mock-jellyfin = {
-          description = "Mock Jellyfin API server";
-          after = [ "network.target" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "simple";
-            ExecStart = lib.getExe (
-              pkgs.writers.writePython3Bin "mock-jellyfin" { flakeIgnore = [ "E501" ]; } ''
-                import http.server
-                import socketserver
-                import json
-
-
-                class MockJellyfinHandler(http.server.BaseHTTPRequestHandler):
-                    def do_GET(self):
-                        if self.path == '/Sessions':
-                            self.send_response(200)
-                            self.send_header('Content-type', 'application/json')
-                            self.end_headers()
-
-                            state = getattr(self.server, 'test_state', {
-                                'streaming': False,
-                                'paused': False,
-                                'local': False,
-                                'media_type': 'Movie'
-                            })
-
-                            if state['streaming']:
-                                if state['local']:
-                                    remote_ip = '192.168.1.100'
-                                else:
-                                    remote_ip = '203.0.113.42'
-
-                                # Map media types to names
-                                type_names = {
-                                    'Movie': 'Test Movie',
-                                    'Episode': 'Test Episode S01E01',
-                                    'Video': 'Test Video',
-                                    'Audio': 'Test Song'
-                                }
-
-                                sessions = [{
-                                    'Id': 'test-session-1',
-                                    'UserName': 'ExternalUser',
-                                    'RemoteEndPoint': remote_ip,
-                                    'NowPlayingItem': {
-                                        'Name': type_names.get(
-                                            state['media_type'], 'Test Content'
-                                        ),
-                                        'Type': state['media_type']
-                                    },
-                                    'PlayState': {
-                                        'IsPaused': state['paused']
-                                    }
-                                }]
-                            else:
-                                sessions = []
-
-                            self.wfile.write(json.dumps(sessions).encode())
-                        else:
-                            self.send_response(404)
-                            self.end_headers()
-
-                    def do_POST(self):
-                        if self.path.startswith('/control/'):
-                            try:
-                                content_length = int(self.headers.get('Content-Length', 0))
-                                post_data = self.rfile.read(content_length)
-                                data = json.loads(post_data.decode()) if post_data else {}
-
-                                if not hasattr(self.server, 'test_state'):
-                                    self.server.test_state = {
-                                        'streaming': False,
-                                        'paused': False,
-                                        'local': False,
-                                        'media_type': 'Movie'
-                                    }
-
-                                if self.path == '/control/state':
-                                    # Set complete state
-                                    self.server.test_state.update(data)
-                                    self.send_response(200)
-                                    self.end_headers()
-                                    self.wfile.write(b'OK')
-                                    state_str = str(self.server.test_state)
-                                    print(f'Jellyfin Mock: State updated to {state_str}')
-                                elif self.path == '/control/reset':
-                                    # Reset to default state
-                                    self.server.test_state = {
-                                        'streaming': False,
-                                        'paused': False,
-                                        'local': False,
-                                        'media_type': 'Movie'
-                                    }
-                                    self.send_response(200)
-                                    self.end_headers()
-                                    self.wfile.write(b'OK')
-                                    print('Jellyfin Mock: State reset')
-                                else:
-                                    self.send_response(404)
-                                    self.end_headers()
-                            except Exception as e:
-                                print(f'Jellyfin Mock: Control error: {e}')
-                                self.send_response(500)
-                                self.end_headers()
-                        else:
-                            self.send_response(404)
-                            self.end_headers()
-
-                    def log_message(self, format, *args):
-                        print(f'Jellyfin Mock: {format % args}')
-
-
-                with socketserver.TCPServer(('127.0.0.1', 8096), MockJellyfinHandler) as httpd:
-                    print('Mock Jellyfin server started on port 8096')
-                    httpd.serve_forever()
-              ''
-            );
-            Restart = "always";
-            RestartSec = "5s";
-          };
-        };
-
-        environment.systemPackages = with pkgs; [
-          curl
-          python3
-        ];
-
-        networking.firewall.allowedTCPPorts = [
-          8096
-          8080
-        ];
-      };
+  nodes.server = {
+    systemd.services.mock-qbittorrent = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStart = lib.getExe mockQBittorrent;
+    };
+    systemd.services.mock-jellyfin = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStart = lib.getExe mockJellyfin;
+    };
+    environment.systemPackages = [ pkgs.curl ];
+    networking.firewall.allowedTCPPorts = [
+      8096
+      8080
+    ];
   };
 
   testScript = ''
+    import time, json
+
     start_all()
-
-    # Wait for services to start
     server.wait_for_unit("multi-user.target")
-    server.wait_for_unit("mock-jellyfin.service")
-    server.wait_for_unit("mock-qbittorrent.service")
+    for svc in ["mock-jellyfin", "mock-qbittorrent"]:
+        server.wait_for_unit(f"{svc}.service")
+    for port in [8096, 8080]:
+        server.wait_for_open_port(port)
+    time.sleep(2)
 
-    # Wait for services to be accessible
-    server.wait_for_open_port(8096)  # Mock Jellyfin
-    server.wait_for_open_port(8080)  # Mock qBittorrent
+    def set_state(**kwargs):
+        server.succeed(f"curl -sX POST -H 'Content-Type: application/json' -d '{json.dumps(kwargs)}' http://localhost:8096/control/state")
 
-    import time
-    import json
+    def is_throttled():
+        return server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode").strip() == "1"
 
-    time.sleep(5)
+    # Verify initial state
+    assert not is_throttled(), "Should start unthrottled"
+    assert "[]" in server.succeed("curl -s http://localhost:8096/Sessions"), "No initial sessions"
 
-    # Helper function to set mock server state
-    def set_jellyfin_state(streaming=False, paused=False, local=False, media_type="Movie"):
-        state = {
-            "streaming": streaming,
-            "paused": paused,
-            "local": local,
-            "media_type": media_type
-        }
-        server.succeed(f"curl -s -X POST -H 'Content-Type: application/json' -d '{json.dumps(state)}' http://localhost:8096/control/state")
-
-    # Helper function to get current qBittorrent throttling state
-    def get_throttling_state():
-        result = server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode")
-        return result.strip() == "1"
-
-    print("\\nTesting initial state...")
-    assert not get_throttling_state(), "qBittorrent should start with normal speed limits"
-
-    sessions_result = server.succeed("curl -s http://localhost:8096/Sessions")
-    print(f"Initial Jellyfin sessions: {sessions_result}")
-    assert "[]" in sessions_result, "Should be no streaming sessions initially"
-
-    # Start the monitor with fast delays for testing
-    python_path = "${pkgs.python3.withPackages (ps: with ps; [ requests ])}/bin/python"
-    monitor_path = "${../services/jellyfin-qbittorrent-monitor.py}"
+    # Start monitor with fast intervals
+    python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
+    monitor = "${../services/jellyfin-qbittorrent-monitor.py}"
     server.succeed(f"""
-      systemd-run --unit=jellyfin-qbittorrent-monitor-test \\
-        --setenv=JELLYFIN_URL=http://localhost:8096 \\
-        --setenv=QBITTORRENT_URL=http://localhost:8080 \\
-        --setenv=CHECK_INTERVAL=1 \\
-        --setenv=STREAMING_START_DELAY=1 \\
-        --setenv=STREAMING_STOP_DELAY=1 \\
-        {python_path} {monitor_path}
+      systemd-run --unit=monitor-test \
+        --setenv=JELLYFIN_URL=http://localhost:8096 \
+        --setenv=QBITTORRENT_URL=http://localhost:8080 \
+        --setenv=CHECK_INTERVAL=1 \
+        --setenv=STREAMING_START_DELAY=1 \
+        --setenv=STREAMING_STOP_DELAY=1 \
+        {python} {monitor}
     """)
+    time.sleep(2)
 
-    time.sleep(3)
+    # Test cases: (streaming, media_type, paused, local, expected_throttle)
+    # Throttle only when: external + playing + video content (not audio)
+    test_cases: list[tuple[bool, str, bool, bool, bool]] = [
+        # Video types, external, playing -> THROTTLE
+        (True, "Movie", False, False, True),
+        (True, "Episode", False, False, True),
+        (True, "Video", False, False, True),
+        # Audio external playing -> NO throttle
+        (True, "Audio", False, False, False),
+        # Paused -> NO throttle
+        (True, "Movie", True, False, False),
+        # Local -> NO throttle
+        (True, "Movie", False, True, False),
+        # Local + paused -> NO throttle
+        (True, "Movie", True, True, False),
+        # No streaming -> NO throttle
+        (False, "Movie", False, False, False),
+    ]
 
-    # Define test scenarios
-    media_types = ["Movie", "Episode", "Video", "Audio"]
-    playback_states = [False, True]  # False=playing, True=paused
-    network_locations = [False, True]  # False=external, True=local
+    for i, (streaming, media_type, paused, local, expected) in enumerate(test_cases, 1):
+        desc = f"Test {i}: streaming={streaming}, type={media_type}, paused={paused}, local={local}"
+        print(f"\n{desc}")
+        set_state(streaming=streaming, media_type=media_type, paused=paused, local=local)
+        time.sleep(1.5)
+        actual = is_throttled()
+        assert actual == expected, f"FAIL {desc}: got {actual}, expected {expected}"
 
-    test_count = 0
-    for media_type in media_types:
-        for is_paused in playback_states:
-            for is_local in network_locations:
-                test_count += 1
-                print(f"\\nTest {test_count}: {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}")
-
-                # Set streaming state
-                set_jellyfin_state(streaming=True, paused=is_paused, local=is_local, media_type=media_type)
-                time.sleep(1.5)  # Wait for monitor to detect and apply changes
-
-                throttling_active = get_throttling_state()
-
-                # Determine expected behavior:
-                # Throttling should be active only if:
-                # - Not paused AND
-                # - Not local AND
-                # - Media type is video (Movie, Episode, Video) - NOT Audio
-                should_throttle = (
-                    not is_paused and
-                    not is_local and
-                    media_type in ["Movie", "Episode", "Video"]
-                )
-
-                assert throttling_active == should_throttle, f"Expected {"no " if not should_throttle else ""} throttling for {media_type}, {'paused' if is_paused else 'playing'}, {'local' if is_local else 'external'}"
-
-    set_jellyfin_state(streaming=False)
-    time.sleep(1.5)  # Wait for stop delay
-
-    assert not get_throttling_state(), "No streaming should disable throttling"
-
-    # Start with throttling-enabled state
-    set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
+    # Transition tests: pause/unpause while streaming
+    print("\nTransition: external movie playing -> paused -> playing")
+    set_state(streaming=True, media_type="Movie", paused=False, local=False)
     time.sleep(1.5)
-    assert get_throttling_state(), "Should enable throttling for external Movie"
+    assert is_throttled(), "Should throttle external movie"
 
-    # Switch to paused (should disable throttling)
-    set_jellyfin_state(streaming=True, paused=True, local=False, media_type="Movie")
+    set_state(streaming=True, media_type="Movie", paused=True, local=False)
     time.sleep(1.5)
-    assert not get_throttling_state(), "Should disable throttling when paused"
+    assert not is_throttled(), "Should unthrottle when paused"
 
-    # Switch back to playing (should re-enable throttling)
-    set_jellyfin_state(streaming=True, paused=False, local=False, media_type="Movie")
+    set_state(streaming=True, media_type="Movie", paused=False, local=False)
     time.sleep(1.5)
-    assert get_throttling_state(), "Should re-enable throttling when unpaused"
+    assert is_throttled(), "Should re-throttle when unpaused"
   '';
 }

From 0c677db3e071eb42f16cac564dd106815dbbfc6e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 14:08:20 -0500
Subject: [PATCH 533/847] jellyfin-qbittorrent-monitor: don't mock out jellyfin
 for testing

---
 tests/jellyfin-qbittorrent-monitor.nix | 323 +++++++++++++++----------
 1 file changed, 199 insertions(+), 124 deletions(-)

diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 4868d83..0d74119 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -4,6 +4,7 @@
   ...
 }:
 let
+  # Mock qBittorrent - simple enough to keep mocked
   mockQBittorrent = pkgs.writers.writePython3Bin "mock-qbt" { flakeIgnore = [ "E501" ]; } ''
     import http.server
     import socketserver
@@ -33,154 +34,228 @@ let
                 self.end_headers()
 
 
-    with socketserver.TCPServer(("127.0.0.1", 8080), Handler) as s:
+    with socketserver.TCPServer(("0.0.0.0", 8080), Handler) as s:
         print("Mock qBittorrent on port 8080")
         s.serve_forever()
   '';
 
-  mockJellyfin = pkgs.writers.writePython3Bin "mock-jellyfin" { flakeIgnore = [ "E501" ]; } ''
-    import http.server
-    import socketserver
-    import json
-
-    DEFAULT = {"streaming": False, "paused": False, "local": False, "media_type": "Movie"}
-
-
-    class Handler(http.server.BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            print(f"jellyfin: {fmt % args}")
-
-        def do_GET(self):
-            if self.path == "/Sessions":
-                self.send_response(200)
-                self.send_header("Content-type", "application/json")
-                self.end_headers()
-                state = getattr(self.server, "state", DEFAULT.copy())
-                sessions = []
-                if state["streaming"]:
-                    sessions = [{
-                        "Id": "test-1",
-                        "UserName": "User",
-                        "RemoteEndPoint": "192.168.1.100" if state["local"] else "203.0.113.42",
-                        "NowPlayingItem": {"Name": f"Test {state['media_type']}", "Type": state["media_type"]},
-                        "PlayState": {"IsPaused": state["paused"]}
-                    }]
-                self.wfile.write(json.dumps(sessions).encode())
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-        def do_POST(self):
-            if self.path == "/control/state":
-                data = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))).decode() or "{}")
-                if not hasattr(self.server, "state"):
-                    self.server.state = DEFAULT.copy()
-                self.server.state.update(data)
-                self.send_response(200)
-                self.end_headers()
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-
-    with socketserver.TCPServer(("127.0.0.1", 8096), Handler) as s:
-        print("Mock Jellyfin on port 8096")
-        s.serve_forever()
-  '';
+  payloads = {
+    auth = pkgs.writeText "auth.json" (builtins.toJSON { Username = "jellyfin"; });
+    empty = pkgs.writeText "empty.json" (builtins.toJSON { });
+  };
 in
 pkgs.testers.runNixOSTest {
   name = "jellyfin-qbittorrent-monitor";
 
-  nodes.server = {
-    systemd.services.mock-qbittorrent = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = lib.getExe mockQBittorrent;
+  nodes = {
+    server = {
+      services.jellyfin.enable = true;
+      environment.systemPackages = with pkgs; [
+        curl
+        ffmpeg
+      ];
+      virtualisation.diskSize = 3 * 1024;
+      networking.firewall.allowedTCPPorts = [
+        8096
+        8080
+      ];
+      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+        {
+          address = "192.168.1.1";
+          prefixLength = 24;
+        }
+      ];
+      networking.interfaces.eth1.ipv4.routes = [
+        {
+          address = "203.0.113.0";
+          prefixLength = 24;
+        }
+      ];
+      systemd.services.mock-qbittorrent = {
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.ExecStart = lib.getExe mockQBittorrent;
+      };
     };
-    systemd.services.mock-jellyfin = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = lib.getExe mockJellyfin;
+
+    # Public test IP (RFC 5737 TEST-NET-3) so Jellyfin sees it as external
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+        {
+          address = "203.0.113.10";
+          prefixLength = 24;
+        }
+      ];
+      networking.interfaces.eth1.ipv4.routes = [
+        {
+          address = "192.168.1.0";
+          prefixLength = 24;
+        }
+      ];
     };
-    environment.systemPackages = [ pkgs.curl ];
-    networking.firewall.allowedTCPPorts = [
-      8096
-      8080
-    ];
   };
 
   testScript = ''
-    import time, json
+    import json
+    import time
+    from urllib.parse import urlencode
 
-    start_all()
-    server.wait_for_unit("multi-user.target")
-    for svc in ["mock-jellyfin", "mock-qbittorrent"]:
-        server.wait_for_unit(f"{svc}.service")
-    for port in [8096, 8080]:
-        server.wait_for_open_port(port)
-    time.sleep(2)
+    auth_header = 'MediaBrowser Client="NixOS Test", DeviceId="test-1337", Device="TestDevice", Version="1.0"'
 
-    def set_state(**kwargs):
-        server.succeed(f"curl -sX POST -H 'Content-Type: application/json' -d '{json.dumps(kwargs)}' http://localhost:8096/control/state")
+    def api_get(path, token=None):
+        header = auth_header + (f", Token={token}" if token else "")
+        return f"curl -sf 'http://server:8096{path}' -H 'X-Emby-Authorization:{header}'"
+
+    def api_post(path, json_file=None, token=None):
+        header = auth_header + (f", Token={token}" if token else "")
+        if json_file:
+            return f"curl -sf -X POST 'http://server:8096{path}' -d '@{json_file}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{header}'"
+        return f"curl -sf -X POST 'http://server:8096{path}' -H 'X-Emby-Authorization:{header}'"
 
     def is_throttled():
         return server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode").strip() == "1"
 
-    # Verify initial state
-    assert not is_throttled(), "Should start unthrottled"
-    assert "[]" in server.succeed("curl -s http://localhost:8096/Sessions"), "No initial sessions"
+    movie_id: str = ""
+    media_source_id: str = ""
 
-    # Start monitor with fast intervals
-    python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
-    monitor = "${../services/jellyfin-qbittorrent-monitor.py}"
-    server.succeed(f"""
-      systemd-run --unit=monitor-test \
-        --setenv=JELLYFIN_URL=http://localhost:8096 \
-        --setenv=QBITTORRENT_URL=http://localhost:8080 \
-        --setenv=CHECK_INTERVAL=1 \
-        --setenv=STREAMING_START_DELAY=1 \
-        --setenv=STREAMING_STOP_DELAY=1 \
-        {python} {monitor}
-    """)
-    time.sleep(2)
+    start_all()
+    server.wait_for_unit("jellyfin.service")
+    server.wait_for_open_port(8096)
+    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+    server.wait_for_unit("mock-qbittorrent.service")
+    server.wait_for_open_port(8080)
 
-    # Test cases: (streaming, media_type, paused, local, expected_throttle)
-    # Throttle only when: external + playing + video content (not audio)
-    test_cases: list[tuple[bool, str, bool, bool, bool]] = [
-        # Video types, external, playing -> THROTTLE
-        (True, "Movie", False, False, True),
-        (True, "Episode", False, False, True),
-        (True, "Video", False, False, True),
-        # Audio external playing -> NO throttle
-        (True, "Audio", False, False, False),
-        # Paused -> NO throttle
-        (True, "Movie", True, False, False),
-        # Local -> NO throttle
-        (True, "Movie", False, True, False),
-        # Local + paused -> NO throttle
-        (True, "Movie", True, True, False),
-        # No streaming -> NO throttle
-        (False, "Movie", False, False, False),
-    ]
+    with subtest("Complete Jellyfin setup wizard"):
+        server.wait_until_succeeds(api_get("/Startup/Configuration"))
+        server.succeed(api_get("/Startup/FirstUser"))
+        server.succeed(api_post("/Startup/Complete"))
 
-    for i, (streaming, media_type, paused, local, expected) in enumerate(test_cases, 1):
-        desc = f"Test {i}: streaming={streaming}, type={media_type}, paused={paused}, local={local}"
-        print(f"\n{desc}")
-        set_state(streaming=streaming, media_type=media_type, paused=paused, local=local)
-        time.sleep(1.5)
-        actual = is_throttled()
-        assert actual == expected, f"FAIL {desc}: got {actual}, expected {expected}"
+    with subtest("Authenticate and get token"):
+        auth_result = json.loads(server.succeed(api_post("/Users/AuthenticateByName", "${payloads.auth}")))
+        token = auth_result["AccessToken"]
+        user_id = auth_result["User"]["Id"]
 
-    # Transition tests: pause/unpause while streaming
-    print("\nTransition: external movie playing -> paused -> playing")
-    set_state(streaming=True, media_type="Movie", paused=False, local=False)
-    time.sleep(1.5)
-    assert is_throttled(), "Should throttle external movie"
+    with subtest("Create test video library"):
+        tempdir = server.succeed("mktemp -d -p /var/lib/jellyfin").strip()
+        server.succeed(f"chmod 755 '{tempdir}'")
+        server.succeed(f"ffmpeg -f lavfi -i testsrc2=duration=5 '{tempdir}/Test Movie (2024) [1080p].mkv'")
 
-    set_state(streaming=True, media_type="Movie", paused=True, local=False)
-    time.sleep(1.5)
-    assert not is_throttled(), "Should unthrottle when paused"
+        add_folder_query = urlencode({
+            "name": "Test Library",
+            "collectionType": "Movies",
+            "paths": tempdir,
+            "refreshLibrary": "true",
+        })
+        server.succeed(api_post(f"/Library/VirtualFolders?{add_folder_query}", "${payloads.empty}", token))
 
-    set_state(streaming=True, media_type="Movie", paused=False, local=False)
-    time.sleep(1.5)
-    assert is_throttled(), "Should re-throttle when unpaused"
+        def is_library_ready(_):
+            folders = json.loads(server.succeed(api_get("/Library/VirtualFolders", token)))
+            return all(f.get("RefreshStatus") == "Idle" for f in folders)
+        retry(is_library_ready, timeout=60)
+
+        def get_movie(_):
+            global movie_id, media_source_id
+            items = json.loads(server.succeed(api_get(f"/Users/{user_id}/Items?IncludeItemTypes=Movie&Recursive=true", token)))
+            if items["TotalRecordCount"] > 0:
+                movie_id = items["Items"][0]["Id"]
+                item_info = json.loads(server.succeed(api_get(f"/Users/{user_id}/Items/{movie_id}", token)))
+                media_source_id = item_info["MediaSources"][0]["Id"]
+                return True
+            return False
+        retry(get_movie, timeout=60)
+
+    with subtest("Start monitor service"):
+        python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
+        monitor = "${../services/jellyfin-qbittorrent-monitor.py}"
+        server.succeed(f"""
+          systemd-run --unit=monitor-test \\
+            --setenv=JELLYFIN_URL=http://localhost:8096 \\
+            --setenv=JELLYFIN_API_KEY={token} \\
+            --setenv=QBITTORRENT_URL=http://localhost:8080 \\
+            --setenv=CHECK_INTERVAL=1 \\
+            --setenv=STREAMING_START_DELAY=1 \\
+            --setenv=STREAMING_STOP_DELAY=1 \\
+            {python} {monitor}
+        """)
+        time.sleep(2)
+        assert not is_throttled(), "Should start unthrottled"
+
+    client_auth = 'MediaBrowser Client="External Client", DeviceId="external-9999", Device="ExternalDevice", Version="1.0"'
+    server_ip = "192.168.1.1"
+
+    with subtest("Client authenticates from external network"):
+        auth_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+        client_auth_result = json.loads(client.succeed(auth_cmd))
+        client_token = client_auth_result["AccessToken"]
+
+    with subtest("External video playback triggers throttling"):
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-1",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(2)
+        assert is_throttled(), "Should throttle for external video playback"
+
+    with subtest("Pausing disables throttling"):
+        playback_progress = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-1",
+            "IsPaused": True,
+            "PositionTicks": 10000000,
+        }
+        progress_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Progress' -d '{json.dumps(playback_progress)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(progress_cmd)
+        time.sleep(2)
+
+        assert not is_throttled(), "Should unthrottle when paused"
+
+    with subtest("Resuming re-enables throttling"):
+        playback_progress["IsPaused"] = False
+        playback_progress["PositionTicks"] = 20000000
+        progress_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Progress' -d '{json.dumps(playback_progress)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(progress_cmd)
+        time.sleep(2)
+
+        assert is_throttled(), "Should re-throttle when resumed"
+
+    with subtest("Stopping playback disables throttling"):
+        playback_stop = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-1",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(playback_stop)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd)
+        time.sleep(2)
+
+        assert not is_throttled(), "Should unthrottle when playback stops"
+
+    with subtest("Local playback does NOT trigger throttling"):
+        local_auth = 'MediaBrowser Client="Local Client", DeviceId="local-1111", Device="LocalDevice", Version="1.0"'
+        local_auth_result = json.loads(server.succeed(
+            f"curl -sf -X POST 'http://localhost:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}'"
+        ))
+        local_token = local_auth_result["AccessToken"]
+
+        local_playback = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-local",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        server.succeed(f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' -d '{json.dumps(local_playback)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}, Token={local_token}'")
+        time.sleep(2)
+        assert not is_throttled(), "Should NOT throttle for local playback"
+
+        local_playback["PositionTicks"] = 50000000
+        server.succeed(f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing/Stopped' -d '{json.dumps(local_playback)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}, Token={local_token}'")
   '';
 }

From 1144b94259ef51ff821d1c09f093783017fa63ff Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 13 Jan 2026 14:49:48 -0500
Subject: [PATCH 534/847] syncthing

---
 configuration.nix      |  2 ++
 flake.nix              |  8 +++++++
 services/syncthing.nix | 52 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+)
 create mode 100644 services/syncthing.nix

diff --git a/configuration.nix b/configuration.nix
index d2d520c..ae71767 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -45,6 +45,8 @@
     ./services/graphing-calculator.nix
 
     ./services/ssh.nix
+
+    ./services/syncthing.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/flake.nix b/flake.nix
index 05d5f0f..b7cb414 100644
--- a/flake.nix
+++ b/flake.nix
@@ -110,6 +110,9 @@
           soulseek_listen = 50300;
           llama_cpp = 8991;
           vaultwarden = 8222;
+          syncthing_gui = 8384;
+          syncthing_protocol = 22000;
+          syncthing_discovery = 21027;
         };
 
         https = {
@@ -160,6 +163,11 @@
         monero = {
           dataDir = services_dir + "/monero";
         };
+
+        syncthing = {
+          dataDir = services_dir + "/syncthing";
+          signalBackupDir = "/${zpool_ssds}/bak/signal";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/syncthing.nix b/services/syncthing.nix
new file mode 100644
index 0000000..cc00227
--- /dev/null
+++ b/services/syncthing.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "syncthing" service_configs.zpool_ssds [
+      service_configs.syncthing.dataDir
+      service_configs.syncthing.signalBackupDir
+    ])
+  ];
+
+  services.syncthing = {
+    enable = true;
+
+    dataDir = service_configs.syncthing.dataDir;
+
+    guiAddress = "127.0.0.1:${toString service_configs.ports.syncthing_gui}";
+
+    overrideDevices = false;
+    overrideFolders = false;
+
+    settings = {
+      gui = {
+        insecureSkipHostcheck = true; # Allow access via reverse proxy
+      };
+      options = {
+        urAccepted = 1; # enable usage reporting
+        relaysEnabled = true;
+      };
+    };
+  };
+
+  # Open firewall ports for syncthing protocol
+  networking.firewall = {
+    allowedTCPPorts = [ service_configs.ports.syncthing_protocol ];
+    allowedUDPPorts = [ service_configs.ports.syncthing_discovery ];
+  };
+
+  services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${toString service_configs.ports.syncthing_gui}
+  '';
+
+  systemd.tmpfiles.rules = [
+    "Z ${service_configs.syncthing.dataDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+    "Z ${service_configs.syncthing.signalBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+  ];
+}

From 1070e8c54d22ed6f9a6a62ffdb066bac4c63d5a2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 15 Jan 2026 13:51:25 -0500
Subject: [PATCH 535/847] monero: move back to hdds

---
 services/monero.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/monero.nix b/services/monero.nix
index efa4951..1792ecf 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -5,7 +5,7 @@
 }:
 {
   imports = [
-    (lib.serviceMountWithZpool "monero" service_configs.zpool_ssds [
+    (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
       service_configs.monero.dataDir
     ])
   ];

From 212e3b5c7b2b97ac46d2d2af74d523a626e5bc50 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 15 Jan 2026 14:01:27 -0500
Subject: [PATCH 536/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index af706de..7f07696 100644
--- a/flake.lock
+++ b/flake.lock
@@ -281,11 +281,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767838769,
-        "narHash": "sha256-KCLU6SUU80tEBKIVZsBrSjRYX6kn1eVIYI3fEEqOp24=",
+        "lastModified": 1768357481,
+        "narHash": "sha256-LpOWVXsHx20x8eRIhn23Q0icmV3Z6ZeFpAPzEqldXFk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4da21f019f6443f513f16af7f220ba4db1cdfc04",
+        "rev": "f888492aa1a1eeb0114cf78af40d44e8300e002e",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1767185284,
-        "narHash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q=",
+        "lastModified": 1768499669,
+        "narHash": "sha256-jJr/zDxu5evfQxlXtMrFFF68/RNj1UrctS/eIsay4k0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "40b1a28dce561bea34858287fbb23052c3ee63fe",
+        "rev": "7297dfc69ae9b06e984a6f69900ce25e67c76f46",
         "type": "github"
       },
       "original": {
@@ -328,11 +328,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1768242861,
-        "narHash": "sha256-F4IIxa5xDHjtrmMcayM8lHctUq1oGltfBQu2+oqDWP4=",
+        "lastModified": 1768323494,
+        "narHash": "sha256-yBXJLE6WCtrGo7LKiB6NOt6nisBEEkguC/lq/rP3zRQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1327e798cb055f96f92685df444e9a2c326ab5ed",
+        "rev": "2c3e5ec5df46d3aeee2a1da0bfedd74e21f4bf3a",
         "type": "github"
       },
       "original": {
@@ -465,11 +465,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768182633,
-        "narHash": "sha256-hH2yT/KOwvw6kpJ9S68KEqq4G//o3tisL/1y1W3QbMA=",
+        "lastModified": 1768440751,
+        "narHash": "sha256-knz1rmABSqexRmUVWSXJvvl1eDCjyjIW1uW4oxVCpn0=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "43dd76be5957fea8db9a1948c182597c7db81f97",
+        "rev": "01120041b929c1e4160cdcd733cac7f02fb98881",
         "type": "github"
       },
       "original": {
@@ -541,11 +541,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1768259319,
-        "narHash": "sha256-kB+XRKahig2LTD14ypfYbR1QsOel6E35lIxLENleV/E=",
+        "lastModified": 1768432115,
+        "narHash": "sha256-UMu8BPvtjNFnccvxPHvefgboCqov98T+R8pXlaxg4y8=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "3f5537d696a42c5a4a97dc9c7abf0a82fcce40eb",
+        "rev": "00a9f5521ff521c023439e36f44b2d022432f0e1",
         "type": "github"
       },
       "original": {

From aa1f24f5734da563f7e1b448529b87867ea90ad3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 18 Jan 2026 01:03:18 -0500
Subject: [PATCH 537/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7f07696..9c3badc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -195,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767910483,
-        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
+        "lastModified": 1768603898,
+        "narHash": "sha256-vRV1dWJOCpCal3PRr86wE2WTOMfAhTu6G7bSvOsryUo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
+        "rev": "2a63d0e9d2c72ac4d4150ebb242cf8d86f488c8c",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1768499669,
-        "narHash": "sha256-jJr/zDxu5evfQxlXtMrFFF68/RNj1UrctS/eIsay4k0=",
+        "lastModified": 1768584846,
+        "narHash": "sha256-IRPmIOV2tPwxbhP/I9M5AmwhTC0lMPtoPStC+8T6xl0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7297dfc69ae9b06e984a6f69900ce25e67c76f46",
+        "rev": "cce68f4a54fa4e3d633358364477f5cc1d782440",
         "type": "github"
       },
       "original": {
@@ -328,11 +328,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1768323494,
-        "narHash": "sha256-yBXJLE6WCtrGo7LKiB6NOt6nisBEEkguC/lq/rP3zRQ=",
+        "lastModified": 1768621446,
+        "narHash": "sha256-6YwHV1cjv6arXdF/PQc365h1j+Qje3Pydk501Rm4Q+4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2c3e5ec5df46d3aeee2a1da0bfedd74e21f4bf3a",
+        "rev": "72ac591e737060deab2b86d6952babd1f896d7c5",
         "type": "github"
       },
       "original": {
@@ -465,11 +465,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768440751,
-        "narHash": "sha256-knz1rmABSqexRmUVWSXJvvl1eDCjyjIW1uW4oxVCpn0=",
+        "lastModified": 1768523683,
+        "narHash": "sha256-UbkyPXPPAbz0gHIWvHZ+jrPTruZqkpuwTFo5JXPnIgU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "01120041b929c1e4160cdcd733cac7f02fb98881",
+        "rev": "90e9331fd79d4c3bb5c1e7cd2df2e560565fe543",
         "type": "github"
       },
       "original": {
@@ -541,11 +541,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1768432115,
-        "narHash": "sha256-UMu8BPvtjNFnccvxPHvefgboCqov98T+R8pXlaxg4y8=",
+        "lastModified": 1768691318,
+        "narHash": "sha256-5EirwywNrdoEadu5cmjzk8VILVOZslHHesxvaGl287w=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "00a9f5521ff521c023439e36f44b2d022432f0e1",
+        "rev": "f925e0b82781958d1f53ea1e9e305e1c27cefced",
         "type": "github"
       },
       "original": {

From 3db2728dbe58cbbd3cd31a4f5e9a1df36faf100a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 18 Jan 2026 02:29:13 -0500
Subject: [PATCH 538/847] security things

---
 configuration.nix    |  1 +
 modules/security.nix | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 modules/security.nix

diff --git a/configuration.nix b/configuration.nix
index ae71767..e9d1265 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -18,6 +18,7 @@
     ./modules/age-secrets.nix
     ./modules/secureboot.nix
     ./modules/no-rgb.nix
+    ./modules/security.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
diff --git a/modules/security.nix b/modules/security.nix
new file mode 100644
index 0000000..d4d057b
--- /dev/null
+++ b/modules/security.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  # memory allocator
+  # BREAKS REDIS-IMMICH
+  # environment.memoryAllocator.provider = "graphene-hardened";
+
+  # disable coredumps
+  systemd.coredump.enable = false;
+
+  services = {
+    dbus.implementation = "broker";
+    /*
+      logrotate.enable = true;
+      journald = {
+        storage = "volatile"; # Store logs in memory
+        upload.enable = false; # Disable remote log upload (the default)
+        extraConfig = ''
+          SystemMaxUse=500M
+          SystemMaxFileSize=50M
+        '';
+      };
+    */
+  };
+}

From dc71dbc188b2cfead2fd108f23857934d7b06eeb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 19 Jan 2026 02:40:43 -0500
Subject: [PATCH 539/847] jellyfin-qbittorrent-monitor: handle qbittorrent
 going down state

---
 services/jellyfin-qbittorrent-monitor.py | 106 ++++++++++++--------
 tests/jellyfin-qbittorrent-monitor.nix   | 122 +++++++++++++++++++++++
 2 files changed, 185 insertions(+), 43 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index b749e27..39de95b 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -14,6 +14,12 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)
 
 
+class ServiceUnavailable(Exception):
+    """Raised when a monitored service is temporarily unavailable."""
+
+    pass
+
+
 class JellyfinQBittorrentMonitor:
     def __init__(
         self,
@@ -65,42 +71,41 @@ class JellyfinQBittorrentMonitor:
         sys.exit(0)
 
     def check_jellyfin_sessions(self) -> list[str]:
-        """Check if anyone is actively streaming from Jellyfin (external networks only)"""
-        try:
-            headers = {"X-Emby-Token": self.jellyfin_api_key} if self.jellyfin_api_key else {}
+        headers = (
+            {"X-Emby-Token": self.jellyfin_api_key} if self.jellyfin_api_key else {}
+        )
 
+        try:
             response = requests.get(
                 f"{self.jellyfin_url}/Sessions", headers=headers, timeout=10
             )
             response.raise_for_status()
-            sessions = response.json()
-
-            # Count active streaming sessions (video only, external networks only)
-            active_streams = []
-            for session in sessions:
-                if (
-                    "NowPlayingItem" in session
-                    and not session.get("PlayState", {}).get("IsPaused", True)
-                    and not self.is_local_ip(session.get("RemoteEndPoint", ""))
-                ):
-                    item = session["NowPlayingItem"]
-                    # Only count video streams (Movies, Episodes, etc.)
-                    item_type = item.get("Type", "").lower()
-                    if item_type in ["movie", "episode", "video"]:
-                        user = session.get("UserName", "Unknown")
-                        active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
-
-            return active_streams
-
         except requests.exceptions.RequestException as e:
             logger.error(f"Failed to check Jellyfin sessions: {e}")
-            return []
+            raise ServiceUnavailable(f"Jellyfin unavailable: {e}") from e
+
+        try:
+            sessions = response.json()
         except json.JSONDecodeError as e:
             logger.error(f"Failed to parse Jellyfin response: {e}")
-            return []
+            raise ServiceUnavailable(f"Jellyfin returned invalid JSON: {e}") from e
 
-    def check_qbittorrent_alternate_limits(self):
-        """Check if alternate speed limits are currently enabled"""
+        active_streams = []
+        for session in sessions:
+            if (
+                "NowPlayingItem" in session
+                and not session.get("PlayState", {}).get("IsPaused", True)
+                and not self.is_local_ip(session.get("RemoteEndPoint", ""))
+            ):
+                item = session["NowPlayingItem"]
+                item_type = item.get("Type", "").lower()
+                if item_type in ["movie", "episode", "video"]:
+                    user = session.get("UserName", "Unknown")
+                    active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
+
+        return active_streams
+
+    def check_qbittorrent_alternate_limits(self) -> bool:
         try:
             response = self.session.get(
                 f"{self.qbittorrent_url}/api/v2/transfer/speedLimitsMode", timeout=10
@@ -111,21 +116,20 @@ class JellyfinQBittorrentMonitor:
                 logger.warning(
                     f"SpeedLimitsMode endpoint returned HTTP {response.status_code}"
                 )
-
+                raise ServiceUnavailable(
+                    f"qBittorrent returned HTTP {response.status_code}"
+                )
         except requests.exceptions.RequestException as e:
             logger.error(f"SpeedLimitsMode endpoint failed: {e}")
-        except Exception as e:
-            logger.error(f"Failed to parse speedLimitsMode response: {e}")
-        return self.throttle_active
+            raise ServiceUnavailable(f"qBittorrent unavailable: {e}") from e
 
     def use_alt_limits(self, enable: bool) -> None:
-        """Toggle qBittorrent alternate speed limits"""
         action = "enabled" if enable else "disabled"
         try:
             current_throttle = self.check_qbittorrent_alternate_limits()
 
             if current_throttle == enable:
-                logger.info(
+                logger.debug(
                     f"Alternate speed limits already {action}, no action needed"
                 )
                 return
@@ -138,26 +142,37 @@ class JellyfinQBittorrentMonitor:
 
             self.throttle_active = enable
 
-            # Verify the change took effect
             new_state = self.check_qbittorrent_alternate_limits()
             if new_state == enable:
-                logger.info(f"Activated {action} alternate speed limits")
+                logger.info(f"Alternate speed limits {action}")
             else:
                 logger.warning(
                     f"Toggle may have failed: expected {enable}, got {new_state}"
                 )
 
+        except ServiceUnavailable:
+            logger.warning(
+                f"qBittorrent unavailable, cannot {action} alternate speed limits"
+            )
         except requests.exceptions.RequestException as e:
             logger.error(f"Failed to {action} alternate speed limits: {e}")
-        except Exception as e:
-            logger.error(f"Failed to toggle qBittorrent limits: {e}")
 
     def restore_normal_limits(self) -> None:
-        """Ensure normal speed limits are restored on shutdown"""
         if self.throttle_active:
             logger.info("Restoring normal speed limits before shutdown...")
             self.use_alt_limits(False)
 
+    def sync_qbittorrent_state(self) -> None:
+        try:
+            actual_state = self.check_qbittorrent_alternate_limits()
+            if actual_state != self.throttle_active:
+                logger.warning(
+                    f"qBittorrent state mismatch detected: expected {self.throttle_active}, got {actual_state}. Re-syncing..."
+                )
+                self.use_alt_limits(self.throttle_active)
+        except ServiceUnavailable:
+            pass
+
     def should_change_state(self, new_streaming_state: bool) -> bool:
         """Apply hysteresis to prevent rapid state changes"""
         now = time.time()
@@ -192,24 +207,30 @@ class JellyfinQBittorrentMonitor:
         return False
 
     def run(self):
-        """Main monitoring loop"""
         logger.info("Starting Jellyfin-qBittorrent monitor")
         logger.info(f"Jellyfin URL: {self.jellyfin_url}")
         logger.info(f"qBittorrent URL: {self.qbittorrent_url}")
         logger.info(f"Check interval: {self.check_interval}s")
 
-        # Set up signal handlers
         signal.signal(signal.SIGINT, self.signal_handler)
         signal.signal(signal.SIGTERM, self.signal_handler)
 
         while self.running:
             try:
-                # Check for active streaming
-                active_streams = self.check_jellyfin_sessions()
+                self.sync_qbittorrent_state()
+
+                try:
+                    active_streams = self.check_jellyfin_sessions()
+                except ServiceUnavailable:
+                    logger.warning(
+                        "Jellyfin unavailable, maintaining current throttle state"
+                    )
+                    time.sleep(self.check_interval)
+                    continue
+
                 streaming_active = len(active_streams) > 0
 
                 if active_streams != self.last_active_streams:
-                    # Log current status
                     if streaming_active:
                         logger.info(
                             f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
@@ -217,7 +238,6 @@ class JellyfinQBittorrentMonitor:
                     elif len(active_streams) == 0 and self.last_streaming_state:
                         logger.info("No active streaming sessions")
 
-                # Apply hysteresis and change state if needed
                 if self.should_change_state(streaming_active):
                     self.last_streaming_state = streaming_active
                     self.use_alt_limits(streaming_active)
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 0d74119..281bf61 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -257,5 +257,127 @@ pkgs.testers.runNixOSTest {
 
         local_playback["PositionTicks"] = 50000000
         server.succeed(f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing/Stopped' -d '{json.dumps(local_playback)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}, Token={local_token}'")
+
+    # === SERVICE RESTART TESTS ===
+
+    with subtest("qBittorrent restart during throttled state re-applies throttling"):
+        # Start external playback to trigger throttling
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-restart-1",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(2)
+        assert is_throttled(), "Should be throttled before qBittorrent restart"
+
+        # Restart mock-qbittorrent (this resets alt_speed to False)
+        server.succeed("systemctl restart mock-qbittorrent.service")
+        server.wait_for_unit("mock-qbittorrent.service")
+        server.wait_for_open_port(8080)
+
+        # qBittorrent restarted - alt_speed is now False (default)
+        # The monitor should detect this and re-apply throttling
+        time.sleep(3)  # Give monitor time to detect and re-apply
+        assert is_throttled(), "Monitor should re-apply throttling after qBittorrent restart"
+
+        # Stop playback to clean up
+        playback_stop = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-restart-1",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(playback_stop)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd)
+        time.sleep(2)
+
+    with subtest("qBittorrent restart during unthrottled state stays unthrottled"):
+        # Verify we're unthrottled (no active streams)
+        assert not is_throttled(), "Should be unthrottled before test"
+
+        # Restart mock-qbittorrent
+        server.succeed("systemctl restart mock-qbittorrent.service")
+        server.wait_for_unit("mock-qbittorrent.service")
+        server.wait_for_open_port(8080)
+
+        # Give monitor time to check state
+        time.sleep(3)
+        assert not is_throttled(), "Should remain unthrottled after qBittorrent restart with no streams"
+
+    with subtest("Jellyfin restart during throttled state maintains throttling"):
+        # Start external playback to trigger throttling
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-restart-2",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(2)
+        assert is_throttled(), "Should be throttled before Jellyfin restart"
+
+        # Restart Jellyfin
+        server.succeed("systemctl restart jellyfin.service")
+        server.wait_for_unit("jellyfin.service")
+        server.wait_for_open_port(8096)
+        server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+
+        # During Jellyfin restart, monitor can't reach Jellyfin
+        # After restart, sessions are cleared - monitor should eventually unthrottle
+        # But during the unavailability window, throttling should be maintained (fail-safe)
+        time.sleep(3)
+
+        # Re-authenticate (old token invalid after restart)
+        client_auth_result = json.loads(client.succeed(
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+        ))
+        client_token = client_auth_result["AccessToken"]
+
+        # No active streams after Jellyfin restart, should eventually unthrottle
+        time.sleep(3)
+        assert not is_throttled(), "Should unthrottle after Jellyfin restart clears sessions"
+
+    with subtest("Monitor recovers after Jellyfin temporary unavailability"):
+        # Re-authenticate with fresh token
+        client_auth_result = json.loads(client.succeed(
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+        ))
+        client_token = client_auth_result["AccessToken"]
+
+        # Start playback
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-restart-3",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(2)
+        assert is_throttled(), "Should be throttled"
+
+        # Stop Jellyfin briefly (simulating temporary unavailability)
+        server.succeed("systemctl stop jellyfin.service")
+        time.sleep(2)
+
+        # During unavailability, throttle state should be maintained (fail-safe)
+        assert is_throttled(), "Should maintain throttle during Jellyfin unavailability"
+
+        # Bring Jellyfin back
+        server.succeed("systemctl start jellyfin.service")
+        server.wait_for_unit("jellyfin.service")
+        server.wait_for_open_port(8096)
+        server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+
+        # After Jellyfin comes back, sessions are gone - should unthrottle
+        time.sleep(3)
+        assert not is_throttled(), "Should unthrottle after Jellyfin returns with no sessions"
   '';
 }

From b2a0d3216c595764e908384c9a3721dab3c083b8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:05:02 -0500
Subject: [PATCH 540/847] ssh: add fail2ban

---
 services/ssh.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/ssh.nix b/services/ssh.nix
index 9f15931..82f2594 100644
--- a/services/ssh.nix
+++ b/services/ssh.nix
@@ -33,4 +33,5 @@
   users.users.root.openssh.authorizedKeys.keys =
     config.users.users.${username}.openssh.authorizedKeys.keys;
 
+  services.fail2ban.enable = true;
 }

From 0e1aa6fe0e5697b15c0e5a84d2a53e0a28991912 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:11:15 -0500
Subject: [PATCH 541/847] nit: move fail2ban to security module

---
 modules/security.nix | 2 ++
 services/ssh.nix     | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/security.nix b/modules/security.nix
index d4d057b..4db4587 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -27,4 +27,6 @@
       };
     */
   };
+
+  services.fail2ban.enable = true;
 }
diff --git a/services/ssh.nix b/services/ssh.nix
index 82f2594..d5b0730 100644
--- a/services/ssh.nix
+++ b/services/ssh.nix
@@ -32,6 +32,4 @@
   # used for deploying configs to server
   users.users.root.openssh.authorizedKeys.keys =
     config.users.users.${username}.openssh.authorizedKeys.keys;
-
-  services.fail2ban.enable = true;
 }

From 2ddde076fae7a8f8f6cd82e04e01955540950a8d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:35:20 -0500
Subject: [PATCH 542/847] fail2ban: implement for caddy basic auth

---
 services/caddy.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/services/caddy.nix b/services/caddy.nix
index b81a8e9..cbfea99 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -80,4 +80,21 @@ in
   networking.firewall.allowedUDPPorts = [
     service_configs.ports.https
   ];
+
+  # Protect Caddy basic auth endpoints from brute force attacks
+  services.fail2ban.jails.caddy-auth = {
+    enabled = true;
+    settings = {
+      backend = "auto";
+      port = "http,https";
+      logpath = "/var/log/caddy/access-*.log";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      # Match Caddy JSON logs with 401 Unauthorized status (failed basic auth)
+      failregex = ''^.*"remote_ip":"<HOST>".*"status":401.*$'';
+      ignoreregex = "";
+      datepattern = ''"ts":{Epoch}\.'';
+    };
+  };
 }

From bacdb42a37ab1267d3c20f9fa2fa7cc576c6b198 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:39:23 -0500
Subject: [PATCH 543/847] fail2ban: implement for bitwarden

---
 services/bitwarden.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 8028662..85bba39 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -43,4 +43,19 @@
     "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
     "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
   ];
+
+  # Protect Vaultwarden login from brute force attacks
+  services.fail2ban.jails.vaultwarden = {
+    enabled = true;
+    settings = {
+      backend = "systemd";
+      port = "http,https";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Username or password is incorrect\. Try again\. IP: <HOST>\..*$'';
+      ignoreregex = "";
+      journalmatch = "_SYSTEMD_UNIT=vaultwarden.service";
+    };
+  };
 }

From 9b891b46a6a7068cac9625320e26ac85c42a36d8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:39:29 -0500
Subject: [PATCH 544/847] fail2ban: implement for gitea

---
 services/gitea.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/gitea.nix b/services/gitea.nix
index aae4fbb..e64f218 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -58,4 +58,19 @@
   };
 
   services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
+
+  # Protect Gitea login from brute force attacks
+  services.fail2ban.jails.gitea = {
+    enabled = true;
+    settings = {
+      backend = "systemd";
+      port = "http,https";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Failed authentication attempt for .* from <HOST>:.*$'';
+      ignoreregex = "";
+      journalmatch = "_SYSTEMD_UNIT=gitea.service";
+    };
+  };
 }

From 8b78320cbb312544e5b0398601b4c7ba0706b4b4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:39:38 -0500
Subject: [PATCH 545/847] fail2ban: implement for immich

---
 services/immich.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/immich.nix b/services/immich.nix
index b9b0e2f..ed9a21d 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -42,4 +42,19 @@
     "video"
     "render"
   ];
+
+  # Protect Immich login from brute force attacks
+  services.fail2ban.jails.immich = {
+    enabled = true;
+    settings = {
+      backend = "systemd";
+      port = "http,https";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Failed login attempt for user .* from ip address <HOST>.*$'';
+      ignoreregex = "";
+      journalmatch = "_SYSTEMD_UNIT=immich-server.service";
+    };
+  };
 }

From 323a267c5a0bb76ff3c3bc54a201f516054c2528 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:39:43 -0500
Subject: [PATCH 546/847] fail2ban: implement for jellyfin

---
 services/jellyfin.nix | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 3a75770..3e6fe6f 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -23,7 +23,11 @@
   };
 
   services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
+    reverse_proxy :${builtins.toString service_configs.ports.jellyfin} {
+      header_up X-Real-IP {remote_host}
+      header_up X-Forwarded-For {remote_host}
+      header_up X-Forwarded-Proto {scheme}
+    }
     request_body {
     	max_size 4096MB
     }
@@ -39,4 +43,19 @@
     "render"
     service_configs.media_group
   ];
+
+  # Protect Jellyfin login from brute force attacks
+  services.fail2ban.jails.jellyfin = {
+    enabled = true;
+    settings = {
+      backend = "auto";
+      port = "http,https";
+      logpath = "${config.services.jellyfin.dataDir}/log/log_*.log";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Authentication request for .* has been denied \(IP: "<ADDR>"\)\..*$'';
+      ignoreregex = "";
+    };
+  };
 }

From bd0c7cde6dd0f853d170e45b0e19509cfb6fb6f2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 18:41:01 -0500
Subject: [PATCH 547/847] tests: fix all fail2ban NixOS VM tests

- Add explicit iptables banaction in security.nix for test compatibility
- Force IPv4 in all curl requests to prevent IPv4/IPv6 mismatch issues
- Fix caddy test: use basic_auth directive (not basicauth)
- Override service ports in tests to match direct connections (not via Caddy)
- Vaultwarden: override ROCKET_ADDRESS and ROCKET_LOG for external access
- Immich: increase VM memory to 4GB for stability
- Jellyfin: create placeholder log file and reload fail2ban after startup
- Add tests.nix entries for all 6 fail2ban tests

All tests now pass: ssh, caddy, gitea, vaultwarden, immich, jellyfin
---
 modules/security.nix           |   7 +-
 tests/fail2ban-caddy.nix       | 103 ++++++++++++++++++++++++
 tests/fail2ban-gitea.nix       | 114 +++++++++++++++++++++++++++
 tests/fail2ban-immich.nix      | 126 ++++++++++++++++++++++++++++++
 tests/fail2ban-jellyfin.nix    | 138 +++++++++++++++++++++++++++++++++
 tests/fail2ban-ssh.nix         |  91 ++++++++++++++++++++++
 tests/fail2ban-vaultwarden.nix | 128 ++++++++++++++++++++++++++++++
 tests/tests.nix                |   8 ++
 8 files changed, 714 insertions(+), 1 deletion(-)
 create mode 100644 tests/fail2ban-caddy.nix
 create mode 100644 tests/fail2ban-gitea.nix
 create mode 100644 tests/fail2ban-immich.nix
 create mode 100644 tests/fail2ban-jellyfin.nix
 create mode 100644 tests/fail2ban-ssh.nix
 create mode 100644 tests/fail2ban-vaultwarden.nix

diff --git a/modules/security.nix b/modules/security.nix
index 4db4587..f1bebcd 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -28,5 +28,10 @@
     */
   };
 
-  services.fail2ban.enable = true;
+  services.fail2ban = {
+    enable = true;
+    # Use iptables actions for compatibility
+    banaction = "iptables-multiport";
+    banaction-allports = "iptables-allports";
+  };
 }
diff --git a/tests/fail2ban-caddy.nix b/tests/fail2ban-caddy.nix
new file mode 100644
index 0000000..34e46a9
--- /dev/null
+++ b/tests/fail2ban-caddy.nix
@@ -0,0 +1,103 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-caddy";
+
+  nodes = {
+    server =
+      { config, pkgs, lib, ... }:
+      {
+        imports = [
+          ../modules/security.nix
+        ];
+
+        # Set up Caddy with basic auth (minimal config, no production stuff)
+        # Using bcrypt hash generated with: caddy hash-password --plaintext testpass
+        services.caddy = {
+          enable = true;
+          virtualHosts.":80".extraConfig = ''
+            log {
+              output file /var/log/caddy/access-server.log
+              format json
+            }
+            basic_auth {
+              testuser $2a$14$XqaQlGTdmofswciqrLlMz.rv0/jiGQq8aU.fP6mh6gCGiLf6Cl3.a
+            }
+            respond "Authenticated!" 200
+          '';
+        };
+
+        # Add the fail2ban jail for caddy-auth (same as in services/caddy.nix)
+        services.fail2ban.jails.caddy-auth = {
+          enabled = true;
+          settings = {
+            backend = "auto";
+            port = "http,https";
+            logpath = "/var/log/caddy/access-*.log";
+            maxretry = 3; # Lower for testing
+          };
+          filter.Definition = {
+            failregex = ''^.*"remote_ip":"<HOST>".*"status":401.*$'';
+            ignoreregex = "";
+            datepattern = ''"ts":{Epoch}\.'';
+          };
+        };
+
+        # Create log directory and initial log file so fail2ban can start
+        systemd.tmpfiles.rules = [
+          "d /var/log/caddy 755 caddy caddy"
+          "f /var/log/caddy/access-server.log 644 caddy caddy"
+        ];
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
+
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+  };
+
+  testScript = ''
+    import time
+    import re
+
+    start_all()
+    server.wait_for_unit("caddy.service")
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(80)
+    time.sleep(2)
+
+    with subtest("Verify caddy-auth jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "caddy-auth" in status, f"caddy-auth jail not found in: {status}"
+
+    with subtest("Verify correct password works"):
+        # Use -4 to force IPv4 for consistency
+        result = client.succeed("curl -4 -s -u testuser:testpass http://server/")
+        print(f"Curl result: {result}")
+        assert "Authenticated" in result, f"Auth should succeed: {result}"
+
+    with subtest("Generate failed basic auth attempts"):
+        # Use -4 to force IPv4 for consistent IP tracking
+        for i in range(4):
+            client.execute("curl -4 -s -u testuser:wrongpass http://server/ || true")
+            time.sleep(1)
+
+    with subtest("Verify IP is banned"):
+        time.sleep(5)
+        status = server.succeed("fail2ban-client status caddy-auth")
+        print(f"caddy-auth jail status: {status}")
+        # Check that at least 1 IP is banned
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("curl -4 -s --max-time 3 http://server/ 2>&1")[0]
+        assert exit_code != 0, "Connection should be blocked"
+  '';
+}
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
new file mode 100644
index 0000000..f0688aa
--- /dev/null
+++ b/tests/fail2ban-gitea.nix
@@ -0,0 +1,114 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testServiceConfigs = {
+    zpool_ssds = "";
+    gitea = {
+      dir = "/var/lib/gitea";
+      domain = "git.test.local";
+    };
+    postgres = {
+      socket = "/run/postgresql";
+    };
+    ports = {
+      gitea = 3000;
+    };
+  };
+
+  testLib = lib.extend (
+    final: prev: {
+      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+    }
+  );
+
+  giteaModule =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        (import ../services/gitea.nix {
+          inherit config pkgs;
+          lib = testLib;
+          service_configs = testServiceConfigs;
+        })
+      ];
+    };
+in
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-gitea";
+
+  nodes = {
+    server =
+      { config, lib, pkgs, ... }:
+      {
+        imports = [
+          ../modules/security.nix
+          giteaModule
+        ];
+
+        # Enable postgres for gitea
+        services.postgresql.enable = true;
+
+        # Disable ZFS mount dependency
+        systemd.services."gitea-mounts".enable = lib.mkForce false;
+        systemd.services.gitea = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ "postgresql.service" ];
+          requires = lib.mkForce [ ];
+        };
+
+        # Override for faster testing and correct port
+        services.fail2ban.jails.gitea.settings = {
+          maxretry = lib.mkForce 3;
+          # In test, we connect directly to Gitea port, not via Caddy
+          port = lib.mkForce "3000";
+        };
+
+        networking.firewall.allowedTCPPorts = [ 3000 ];
+      };
+
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+  };
+
+  testScript = ''
+    import time
+    import re
+
+    start_all()
+    server.wait_for_unit("postgresql.service")
+    server.wait_for_unit("gitea.service")
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(3000)
+    time.sleep(3)
+
+    with subtest("Verify gitea jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "gitea" in status, f"gitea jail not found in: {status}"
+
+    with subtest("Generate failed login attempts"):
+        # Use -4 to force IPv4 for consistent IP tracking
+        for i in range(4):
+            client.execute(
+                "curl -4 -s -X POST http://server:3000/user/login -d 'user_name=baduser&password=badpass' || true"
+            )
+            time.sleep(0.5)
+
+    with subtest("Verify IP is banned"):
+        time.sleep(3)
+        status = server.succeed("fail2ban-client status gitea")
+        print(f"gitea jail status: {status}")
+        # Check that at least 1 IP is banned
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("curl -4 -s --max-time 3 http://server:3000/ 2>&1")[0]
+        assert exit_code != 0, "Connection should be blocked"
+  '';
+}
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
new file mode 100644
index 0000000..eae85a8
--- /dev/null
+++ b/tests/fail2ban-immich.nix
@@ -0,0 +1,126 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testServiceConfigs = {
+    zpool_ssds = "";
+    https = {
+      domain = "test.local";
+    };
+    ports = {
+      immich = 2283;
+    };
+    immich = {
+      dir = "/var/lib/immich";
+    };
+  };
+
+  testLib = lib.extend (
+    final: prev: {
+      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+    }
+  );
+
+  immichModule =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        (import ../services/immich.nix {
+          inherit config pkgs;
+          lib = testLib;
+          service_configs = testServiceConfigs;
+        })
+      ];
+    };
+in
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-immich";
+
+  nodes = {
+    server =
+      { config, lib, pkgs, ... }:
+      {
+        imports = [
+          ../modules/security.nix
+          immichModule
+        ];
+
+        # Immich needs postgres
+        services.postgresql.enable = true;
+
+        # Let immich create its own DB for testing
+        services.immich.database.createDB = lib.mkForce true;
+
+        # Disable ZFS mount dependencies
+        systemd.services."immich-server-mounts".enable = lib.mkForce false;
+        systemd.services."immich-machine-learning-mounts".enable = lib.mkForce false;
+        systemd.services.immich-server = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ "postgresql.service" ];
+          requires = lib.mkForce [ ];
+        };
+        systemd.services.immich-machine-learning = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ ];
+          requires = lib.mkForce [ ];
+        };
+
+        # Override for faster testing and correct port
+        services.fail2ban.jails.immich.settings = {
+          maxretry = lib.mkForce 3;
+          # In test, we connect directly to Immich port, not via Caddy
+          port = lib.mkForce "2283";
+        };
+
+        networking.firewall.allowedTCPPorts = [ 2283 ];
+
+        # Immich needs more resources
+        virtualisation.diskSize = 4 * 1024;
+        virtualisation.memorySize = 4 * 1024;  # 4GB RAM for Immich
+      };
+
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+  };
+
+  testScript = ''
+    import time
+    import re
+
+    start_all()
+    server.wait_for_unit("postgresql.service")
+    server.wait_for_unit("immich-server.service", timeout=120)
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(2283, timeout=60)
+    time.sleep(3)
+
+    with subtest("Verify immich jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "immich" in status, f"immich jail not found in: {status}"
+
+    with subtest("Generate failed login attempts"):
+        # Use -4 to force IPv4 for consistent IP tracking
+        for i in range(4):
+            client.execute(
+                "curl -4 -s -X POST http://server:2283/api/auth/login -H 'Content-Type: application/json' -d '{\"email\":\"bad@user.com\",\"password\":\"badpass\"}' || true"
+            )
+            time.sleep(0.5)
+
+    with subtest("Verify IP is banned"):
+        time.sleep(3)
+        status = server.succeed("fail2ban-client status immich")
+        print(f"immich jail status: {status}")
+        # Check that at least 1 IP is banned
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("curl -4 -s --max-time 3 http://server:2283/ 2>&1")[0]
+        assert exit_code != 0, "Connection should be blocked"
+  '';
+}
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
new file mode 100644
index 0000000..5fe2ea4
--- /dev/null
+++ b/tests/fail2ban-jellyfin.nix
@@ -0,0 +1,138 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testServiceConfigs = {
+    zpool_ssds = "";
+    https = {
+      domain = "test.local";
+    };
+    ports = {
+      jellyfin = 8096;
+    };
+    jellyfin = {
+      dataDir = "/var/lib/jellyfin";
+      cacheDir = "/var/cache/jellyfin";
+    };
+    media_group = "media";
+  };
+
+  testLib = lib.extend (
+    final: prev: {
+      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+      optimizePackage = pkg: pkg; # No-op for testing
+    }
+  );
+
+  jellyfinModule =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        (import ../services/jellyfin.nix {
+          inherit config pkgs;
+          lib = testLib;
+          service_configs = testServiceConfigs;
+        })
+      ];
+    };
+in
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-jellyfin";
+
+  nodes = {
+    server =
+      { config, lib, pkgs, ... }:
+      {
+        imports = [
+          ../modules/security.nix
+          jellyfinModule
+        ];
+
+        # Create the media group
+        users.groups.media = { };
+
+        # Disable ZFS mount dependency
+        systemd.services."jellyfin-mounts".enable = lib.mkForce false;
+        systemd.services.jellyfin = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ ];
+          requires = lib.mkForce [ ];
+        };
+
+        # Override for faster testing and correct port
+        services.fail2ban.jails.jellyfin.settings = {
+          maxretry = lib.mkForce 3;
+          # In test, we connect directly to Jellyfin port, not via Caddy
+          port = lib.mkForce "8096";
+        };
+
+        # Create log directory and placeholder log file for fail2ban
+        # Jellyfin logs to files, not systemd journal
+        systemd.tmpfiles.rules = [
+          "d /var/lib/jellyfin/log 0755 jellyfin jellyfin"
+          "f /var/lib/jellyfin/log/log_placeholder.log 0644 jellyfin jellyfin"
+        ];
+
+        # Make fail2ban start after Jellyfin
+        systemd.services.fail2ban = {
+          wants = [ "jellyfin.service" ];
+          after = [ "jellyfin.service" ];
+        };
+
+        # Give jellyfin more disk space and memory
+        virtualisation.diskSize = 3 * 1024;
+        virtualisation.memorySize = 2 * 1024;
+      };
+
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+  };
+
+  testScript = ''
+    import time
+    import re
+
+    start_all()
+    server.wait_for_unit("jellyfin.service")
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(8096)
+    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+    time.sleep(2)
+
+    # Wait for Jellyfin to create real log files and reload fail2ban
+    server.wait_until_succeeds("ls /var/lib/jellyfin/log/log_2*.log", timeout=30)
+    server.succeed("fail2ban-client reload jellyfin")
+
+    with subtest("Verify jellyfin jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "jellyfin" in status, f"jellyfin jail not found in: {status}"
+
+    with subtest("Generate failed login attempts"):
+        # Use -4 to force IPv4 for consistent IP tracking
+        for i in range(4):
+            client.execute("""
+                curl -4 -s -X POST http://server:8096/Users/authenticatebyname \
+                  -H 'Content-Type: application/json' \
+                  -H 'X-Emby-Authorization: MediaBrowser Client="test", Device="test", DeviceId="test", Version="1.0"' \
+                  -d '{"Username":"baduser","Pw":"badpass"}' || true
+            """)
+            time.sleep(0.5)
+
+    with subtest("Verify IP is banned"):
+        time.sleep(3)
+        status = server.succeed("fail2ban-client status jellyfin")
+        print(f"jellyfin jail status: {status}")
+        # Check that at least 1 IP is banned
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("curl -4 -s --max-time 3 http://server:8096/ 2>&1")[0]
+        assert exit_code != 0, "Connection should be blocked"
+  '';
+}
diff --git a/tests/fail2ban-ssh.nix b/tests/fail2ban-ssh.nix
new file mode 100644
index 0000000..15e8ecf
--- /dev/null
+++ b/tests/fail2ban-ssh.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testServiceConfigs = {
+    zpool_ssds = "";
+    zpool_hdds = "";
+  };
+
+  securityModule = import ../modules/security.nix;
+
+  sshModule =
+    { config, lib, pkgs, ... }:
+    {
+      imports = [
+        (import ../services/ssh.nix {
+          inherit config lib pkgs;
+          username = "testuser";
+        })
+      ];
+    };
+in
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-ssh";
+
+  nodes = {
+    server =
+      { config, lib, pkgs, ... }:
+      {
+        imports = [
+          securityModule
+          sshModule
+        ];
+
+        # Override for testing - enable password auth
+        services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+
+        users.users.testuser = {
+          isNormalUser = true;
+          password = "correctpassword";
+        };
+
+        networking.firewall.allowedTCPPorts = [ 22 ];
+      };
+
+    client = {
+      environment.systemPackages = with pkgs; [ sshpass openssh ];
+    };
+  };
+
+  testScript = ''
+    import time
+
+    start_all()
+    server.wait_for_unit("sshd.service")
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(22)
+    time.sleep(2)
+
+    with subtest("Verify sshd jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "sshd" in status, f"sshd jail not found in: {status}"
+
+    with subtest("Generate failed SSH login attempts"):
+        # Use -4 to force IPv4, timeout and NumberOfPasswordPrompts=1 to ensure quick failure
+        # maxRetry is 3 in our config, so 4 attempts should trigger a ban
+        for i in range(4):
+            client.execute(
+                "timeout 5 sshpass -p 'wrongpassword' ssh -4 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 -o NumberOfPasswordPrompts=1 testuser@server echo test 2>/dev/null || true"
+            )
+            time.sleep(1)
+
+    with subtest("Verify IP is banned"):
+        # Wait for fail2ban to process the logs and apply the ban
+        time.sleep(5)
+        status = server.succeed("fail2ban-client status sshd")
+        print(f"sshd jail status: {status}")
+        # Check that at least 1 IP is banned
+        import re
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("timeout 3 nc -4 -z -w 2 server 22")[0]
+        assert exit_code != 0, "Connection should be blocked for banned IP"
+  '';
+}
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban-vaultwarden.nix
new file mode 100644
index 0000000..802c589
--- /dev/null
+++ b/tests/fail2ban-vaultwarden.nix
@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testServiceConfigs = {
+    zpool_ssds = "";
+    https = {
+      domain = "test.local";
+    };
+    ports = {
+      vaultwarden = 8222;
+    };
+    vaultwarden = {
+      path = "/var/lib/vaultwarden";
+    };
+  };
+
+  testLib = lib.extend (
+    final: prev: {
+      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+    }
+  );
+
+  vaultwardenModule =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        (import ../services/bitwarden.nix {
+          inherit config pkgs;
+          lib = testLib;
+          service_configs = testServiceConfigs;
+        })
+      ];
+    };
+in
+pkgs.testers.runNixOSTest {
+  name = "fail2ban-vaultwarden";
+
+  nodes = {
+    server =
+      { config, lib, pkgs, ... }:
+      {
+        imports = [
+          ../modules/security.nix
+          vaultwardenModule
+        ];
+
+        # Disable ZFS mount dependencies
+        systemd.services."vaultwarden-mounts".enable = lib.mkForce false;
+        systemd.services."backup-vaultwarden-mounts".enable = lib.mkForce false;
+        systemd.services.vaultwarden = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ ];
+          requires = lib.mkForce [ ];
+        };
+        systemd.services.backup-vaultwarden = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ ];
+          requires = lib.mkForce [ ];
+        };
+
+        # Override Vaultwarden settings for testing
+        # - Listen on all interfaces (not just localhost)
+        # - Enable logging at info level to capture failed login attempts
+        services.vaultwarden.config = {
+          ROCKET_ADDRESS = lib.mkForce "0.0.0.0";
+          ROCKET_LOG = lib.mkForce "info";
+        };
+
+        # Override for faster testing and correct port
+        services.fail2ban.jails.vaultwarden.settings = {
+          maxretry = lib.mkForce 3;
+          # In test, we connect directly to Vaultwarden port, not via Caddy
+          port = lib.mkForce "8222";
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8222 ];
+      };
+
+    client = {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+  };
+
+  testScript = ''
+    import time
+    import re
+
+    start_all()
+    server.wait_for_unit("vaultwarden.service")
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(8222)
+    time.sleep(2)
+
+    with subtest("Verify vaultwarden jail is active"):
+        status = server.succeed("fail2ban-client status")
+        assert "vaultwarden" in status, f"vaultwarden jail not found in: {status}"
+
+    with subtest("Generate failed login attempts"):
+        # Use -4 to force IPv4 for consistent IP tracking
+        for i in range(4):
+            client.execute("""
+                curl -4 -s -X POST 'http://server:8222/identity/connect/token' \
+                  -H 'Content-Type: application/x-www-form-urlencoded' \
+                  -H 'Bitwarden-Client-Name: web' \
+                  -H 'Bitwarden-Client-Version: 2024.1.0' \
+                  -d 'grant_type=password&username=bad@user.com&password=badpass&scope=api+offline_access&client_id=web&deviceType=10&deviceIdentifier=test&deviceName=test' \
+                  || true
+            """)
+            time.sleep(0.5)
+
+    with subtest("Verify IP is banned"):
+        time.sleep(3)
+        status = server.succeed("fail2ban-client status vaultwarden")
+        print(f"vaultwarden jail status: {status}")
+        # Check that at least 1 IP is banned
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        assert match and int(match.group(1)) >= 1, f"Expected at least 1 banned IP, got: {status}"
+
+    with subtest("Verify banned client cannot connect"):
+        # Use -4 to test with same IP that was banned
+        exit_code = client.execute("curl -4 -s --max-time 3 http://server:8222/ 2>&1")[0]
+        assert exit_code != 0, "Connection should be blocked"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index d1be6a6..fcc29e1 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -12,4 +12,12 @@ in
   testTest = handleTest ./testTest.nix;
   minecraftTest = handleTest ./minecraft.nix;
   jellyfinQbittorrentMonitorTest = handleTest ./jellyfin-qbittorrent-monitor.nix;
+
+  # fail2ban tests
+  fail2banSshTest = handleTest ./fail2ban-ssh.nix;
+  fail2banCaddyTest = handleTest ./fail2ban-caddy.nix;
+  fail2banGiteaTest = handleTest ./fail2ban-gitea.nix;
+  fail2banVaultwardenTest = handleTest ./fail2ban-vaultwarden.nix;
+  fail2banImmichTest = handleTest ./fail2ban-immich.nix;
+  fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
 }

From a6a9196137240a77f9930db0d55014c6bc6e19d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 19:48:20 -0500
Subject: [PATCH 548/847] fmt

---
 services/gitea.nix             |  2 +-
 services/immich.nix            |  2 +-
 tests/fail2ban-caddy.nix       |  7 ++++++-
 tests/fail2ban-gitea.nix       | 12 ++++++++++--
 tests/fail2ban-immich.nix      | 14 +++++++++++---
 tests/fail2ban-jellyfin.nix    | 12 ++++++++++--
 tests/fail2ban-ssh.nix         | 19 ++++++++++++++++---
 tests/fail2ban-vaultwarden.nix | 12 ++++++++++--
 8 files changed, 65 insertions(+), 15 deletions(-)

diff --git a/services/gitea.nix b/services/gitea.nix
index e64f218..5f938df 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -68,7 +68,7 @@
       # defaults: maxretry=5, findtime=10m, bantime=10m
     };
     filter.Definition = {
-      failregex = ''^.*Failed authentication attempt for .* from <HOST>:.*$'';
+      failregex = "^.*Failed authentication attempt for .* from <HOST>:.*$";
       ignoreregex = "";
       journalmatch = "_SYSTEMD_UNIT=gitea.service";
     };
diff --git a/services/immich.nix b/services/immich.nix
index ed9a21d..fddd106 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -52,7 +52,7 @@
       # defaults: maxretry=5, findtime=10m, bantime=10m
     };
     filter.Definition = {
-      failregex = ''^.*Failed login attempt for user .* from ip address <HOST>.*$'';
+      failregex = "^.*Failed login attempt for user .* from ip address <HOST>.*$";
       ignoreregex = "";
       journalmatch = "_SYSTEMD_UNIT=immich-server.service";
     };
diff --git a/tests/fail2ban-caddy.nix b/tests/fail2ban-caddy.nix
index 34e46a9..baf7829 100644
--- a/tests/fail2ban-caddy.nix
+++ b/tests/fail2ban-caddy.nix
@@ -9,7 +9,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, pkgs, lib, ... }:
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
       {
         imports = [
           ../modules/security.nix
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
index f0688aa..d39b9fd 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban-gitea.nix
@@ -21,7 +21,10 @@ let
 
   testLib = lib.extend (
     final: prev: {
-      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+      serviceMountWithZpool =
+        serviceName: zpool: dirs:
+        { ... }:
+        { };
     }
   );
 
@@ -42,7 +45,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, lib, pkgs, ... }:
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
       {
         imports = [
           ../modules/security.nix
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
index eae85a8..df4b8a5 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban-immich.nix
@@ -20,7 +20,10 @@ let
 
   testLib = lib.extend (
     final: prev: {
-      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+      serviceMountWithZpool =
+        serviceName: zpool: dirs:
+        { ... }:
+        { };
     }
   );
 
@@ -41,7 +44,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, lib, pkgs, ... }:
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
       {
         imports = [
           ../modules/security.nix
@@ -79,7 +87,7 @@ pkgs.testers.runNixOSTest {
 
         # Immich needs more resources
         virtualisation.diskSize = 4 * 1024;
-        virtualisation.memorySize = 4 * 1024;  # 4GB RAM for Immich
+        virtualisation.memorySize = 4 * 1024; # 4GB RAM for Immich
       };
 
     client = {
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 5fe2ea4..5d88a7f 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -22,7 +22,10 @@ let
 
   testLib = lib.extend (
     final: prev: {
-      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+      serviceMountWithZpool =
+        serviceName: zpool: dirs:
+        { ... }:
+        { };
       optimizePackage = pkg: pkg; # No-op for testing
     }
   );
@@ -44,7 +47,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, lib, pkgs, ... }:
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
       {
         imports = [
           ../modules/security.nix
diff --git a/tests/fail2ban-ssh.nix b/tests/fail2ban-ssh.nix
index 15e8ecf..9730fff 100644
--- a/tests/fail2ban-ssh.nix
+++ b/tests/fail2ban-ssh.nix
@@ -13,7 +13,12 @@ let
   securityModule = import ../modules/security.nix;
 
   sshModule =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     {
       imports = [
         (import ../services/ssh.nix {
@@ -28,7 +33,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, lib, pkgs, ... }:
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
       {
         imports = [
           securityModule
@@ -47,7 +57,10 @@ pkgs.testers.runNixOSTest {
       };
 
     client = {
-      environment.systemPackages = with pkgs; [ sshpass openssh ];
+      environment.systemPackages = with pkgs; [
+        sshpass
+        openssh
+      ];
     };
   };
 
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban-vaultwarden.nix
index 802c589..dcb7749 100644
--- a/tests/fail2ban-vaultwarden.nix
+++ b/tests/fail2ban-vaultwarden.nix
@@ -20,7 +20,10 @@ let
 
   testLib = lib.extend (
     final: prev: {
-      serviceMountWithZpool = serviceName: zpool: dirs: { ... }: { };
+      serviceMountWithZpool =
+        serviceName: zpool: dirs:
+        { ... }:
+        { };
     }
   );
 
@@ -41,7 +44,12 @@ pkgs.testers.runNixOSTest {
 
   nodes = {
     server =
-      { config, lib, pkgs, ... }:
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
       {
         imports = [
           ../modules/security.nix

From 9874c13052901e6dab2fb045dc411560f9cf728c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 22:38:18 -0500
Subject: [PATCH 549/847] jellyfin-qbittorrent-monitor: fix mock qbittorrent

---
 tests/jellyfin-qbittorrent-monitor.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 281bf61..d52be5b 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -34,6 +34,7 @@ let
                 self.end_headers()
 
 
+    socketserver.TCPServer.allow_reuse_address = True
     with socketserver.TCPServer(("0.0.0.0", 8080), Handler) as s:
         print("Mock qBittorrent on port 8080")
         s.serve_forever()

From c6c96528a9cb3d644c2a53befafad67497190427 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 23:05:15 -0500
Subject: [PATCH 550/847] jellyfin-qbittorrent-monitor: don't use mock
 qbittorrent

---
 tests/jellyfin-qbittorrent-monitor.nix | 168 +++++++++++++------------
 1 file changed, 90 insertions(+), 78 deletions(-)

diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index d52be5b..45dee94 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -1,45 +1,10 @@
 {
   lib,
   pkgs,
+  inputs,
   ...
 }:
 let
-  # Mock qBittorrent - simple enough to keep mocked
-  mockQBittorrent = pkgs.writers.writePython3Bin "mock-qbt" { flakeIgnore = [ "E501" ]; } ''
-    import http.server
-    import socketserver
-
-
-    class Handler(http.server.BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            print(f"qbt: {fmt % args}")
-
-        def do_GET(self):
-            if self.path == "/api/v2/transfer/speedLimitsMode":
-                self.send_response(200)
-                self.send_header("Content-type", "text/plain")
-                self.end_headers()
-                self.wfile.write(("1" if getattr(self.server, "alt_speed", False) else "0").encode())
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-        def do_POST(self):
-            if self.path == "/api/v2/transfer/toggleSpeedLimitsMode":
-                self.server.alt_speed = not getattr(self.server, "alt_speed", False)
-                self.send_response(200)
-                self.end_headers()
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-
-    socketserver.TCPServer.allow_reuse_address = True
-    with socketserver.TCPServer(("0.0.0.0", 8080), Handler) as s:
-        print("Mock qBittorrent on port 8080")
-        s.serve_forever()
-  '';
-
   payloads = {
     auth = pkgs.writeText "auth.json" (builtins.toJSON { Username = "jellyfin"; });
     empty = pkgs.writeText "empty.json" (builtins.toJSON { });
@@ -49,34 +14,76 @@ pkgs.testers.runNixOSTest {
   name = "jellyfin-qbittorrent-monitor";
 
   nodes = {
-    server = {
-      services.jellyfin.enable = true;
-      environment.systemPackages = with pkgs; [
-        curl
-        ffmpeg
-      ];
-      virtualisation.diskSize = 3 * 1024;
-      networking.firewall.allowedTCPPorts = [
-        8096
-        8080
-      ];
-      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-        {
-          address = "192.168.1.1";
-          prefixLength = 24;
-        }
-      ];
-      networking.interfaces.eth1.ipv4.routes = [
-        {
-          address = "203.0.113.0";
-          prefixLength = 24;
-        }
-      ];
-      systemd.services.mock-qbittorrent = {
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = lib.getExe mockQBittorrent;
+    server =
+      { ... }:
+      {
+        imports = [
+          inputs.vpn-confinement.nixosModules.default
+        ];
+
+        services.jellyfin.enable = true;
+
+        # Real qBittorrent service
+        services.qbittorrent = {
+          enable = true;
+          webuiPort = 8080;
+          openFirewall = true;
+
+          serverConfig.LegalNotice.Accepted = true;
+
+          serverConfig.Preferences = {
+            WebUI = {
+              # Disable authentication for testing
+              AuthSubnetWhitelist = "0.0.0.0/0,::/0";
+              AuthSubnetWhitelistEnabled = true;
+              LocalHostAuth = false;
+            };
+
+            Downloads = {
+              SavePath = "/var/lib/qbittorrent/downloads";
+              TempPath = "/var/lib/qbittorrent/incomplete";
+            };
+          };
+
+          serverConfig.BitTorrent.Session = {
+            # Normal speed - unlimited
+            GlobalUPSpeedLimit = 0;
+            GlobalDLSpeedLimit = 0;
+
+            # Alternate speed limits for when Jellyfin is streaming
+            AlternativeGlobalUPSpeedLimit = 100;
+            AlternativeGlobalDLSpeedLimit = 100;
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          ffmpeg
+        ];
+        virtualisation.diskSize = 3 * 1024;
+        networking.firewall.allowedTCPPorts = [
+          8096
+          8080
+        ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
+        networking.interfaces.eth1.ipv4.routes = [
+          {
+            address = "203.0.113.0";
+            prefixLength = 24;
+          }
+        ];
+
+        # Create directories for qBittorrent
+        systemd.tmpfiles.rules = [
+          "d /var/lib/qbittorrent/downloads 0755 qbittorrent qbittorrent"
+          "d /var/lib/qbittorrent/incomplete 0755 qbittorrent qbittorrent"
+        ];
       };
-    };
 
     # Public test IP (RFC 5737 TEST-NET-3) so Jellyfin sees it as external
     client = {
@@ -123,9 +130,12 @@ pkgs.testers.runNixOSTest {
     server.wait_for_unit("jellyfin.service")
     server.wait_for_open_port(8096)
     server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
-    server.wait_for_unit("mock-qbittorrent.service")
+    server.wait_for_unit("qbittorrent.service")
     server.wait_for_open_port(8080)
 
+    # Wait for qBittorrent WebUI to be responsive
+    server.wait_until_succeeds("curl -sf http://localhost:8080/api/v2/app/version", timeout=30)
+
     with subtest("Complete Jellyfin setup wizard"):
         server.wait_until_succeeds(api_get("/Startup/Configuration"))
         server.succeed(api_get("/Startup/FirstUser"))
@@ -169,13 +179,13 @@ pkgs.testers.runNixOSTest {
         python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
         monitor = "${../services/jellyfin-qbittorrent-monitor.py}"
         server.succeed(f"""
-          systemd-run --unit=monitor-test \\
-            --setenv=JELLYFIN_URL=http://localhost:8096 \\
-            --setenv=JELLYFIN_API_KEY={token} \\
-            --setenv=QBITTORRENT_URL=http://localhost:8080 \\
-            --setenv=CHECK_INTERVAL=1 \\
-            --setenv=STREAMING_START_DELAY=1 \\
-            --setenv=STREAMING_STOP_DELAY=1 \\
+          systemd-run --unit=monitor-test \
+            --setenv=JELLYFIN_URL=http://localhost:8096 \
+            --setenv=JELLYFIN_API_KEY={token} \
+            --setenv=QBITTORRENT_URL=http://localhost:8080 \
+            --setenv=CHECK_INTERVAL=1 \
+            --setenv=STREAMING_START_DELAY=1 \
+            --setenv=STREAMING_STOP_DELAY=1 \
             {python} {monitor}
         """)
         time.sleep(2)
@@ -275,12 +285,13 @@ pkgs.testers.runNixOSTest {
         time.sleep(2)
         assert is_throttled(), "Should be throttled before qBittorrent restart"
 
-        # Restart mock-qbittorrent (this resets alt_speed to False)
-        server.succeed("systemctl restart mock-qbittorrent.service")
-        server.wait_for_unit("mock-qbittorrent.service")
+        # Restart qBittorrent (this resets alt_speed to its config default - disabled)
+        server.succeed("systemctl restart qbittorrent.service")
+        server.wait_for_unit("qbittorrent.service")
         server.wait_for_open_port(8080)
+        server.wait_until_succeeds("curl -sf http://localhost:8080/api/v2/app/version", timeout=30)
 
-        # qBittorrent restarted - alt_speed is now False (default)
+        # qBittorrent restarted - alt_speed is now False (default on startup)
         # The monitor should detect this and re-apply throttling
         time.sleep(3)  # Give monitor time to detect and re-apply
         assert is_throttled(), "Monitor should re-apply throttling after qBittorrent restart"
@@ -300,10 +311,11 @@ pkgs.testers.runNixOSTest {
         # Verify we're unthrottled (no active streams)
         assert not is_throttled(), "Should be unthrottled before test"
 
-        # Restart mock-qbittorrent
-        server.succeed("systemctl restart mock-qbittorrent.service")
-        server.wait_for_unit("mock-qbittorrent.service")
+        # Restart qBittorrent
+        server.succeed("systemctl restart qbittorrent.service")
+        server.wait_for_unit("qbittorrent.service")
         server.wait_for_open_port(8080)
+        server.wait_until_succeeds("curl -sf http://localhost:8080/api/v2/app/version", timeout=30)
 
         # Give monitor time to check state
         time.sleep(3)

From 93c8f4a244db65197ad649ac8676b669d89e109a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 23:08:41 -0500
Subject: [PATCH 551/847] flake: impermanence nixpkgs follow nixpkgs

---
 flake.lock | 26 ++++++--------------------
 flake.nix  |  1 +
 2 files changed, 7 insertions(+), 20 deletions(-)

diff --git a/flake.lock b/flake.lock
index 9c3badc..0e2674e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -233,7 +233,9 @@
     "impermanence": {
       "inputs": {
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1767822991,
@@ -311,22 +313,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1748026106,
-        "narHash": "sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "063f43f2dbdef86376cc29ad646c45c46e93234c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1768621446,
         "narHash": "sha256-6YwHV1cjv6arXdF/PQc365h1j+Qje3Pydk501Rm4Q+4=",
@@ -342,7 +328,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1764517877,
         "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
@@ -391,7 +377,7 @@
         "lanzaboote": "lanzaboote",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
         "trackerlist": "trackerlist",
@@ -606,7 +592,7 @@
     "ytbn-graphing-software": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
diff --git a/flake.nix b/flake.nix
index b7cb414..054d8b3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -40,6 +40,7 @@
 
     impermanence = {
       url = "github:nix-community/impermanence";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     agenix = {

From ed6fc66fde710be373e25fe3a2d4df475f8c971b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 23:08:55 -0500
Subject: [PATCH 552/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0e2674e..c06032c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "lastModified": 1768923567,
+        "narHash": "sha256-GVJ0jKsyXLuBzRMXCDY6D5J8wVdwP1DuQmmvYL/Vw/Q=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "00395d188e3594a1507f214a2f15d4ce5c07cb28",
         "type": "github"
       },
       "original": {
@@ -195,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768603898,
-        "narHash": "sha256-vRV1dWJOCpCal3PRr86wE2WTOMfAhTu6G7bSvOsryUo=",
+        "lastModified": 1768949235,
+        "narHash": "sha256-TtjKgXyg1lMfh374w5uxutd6Vx2P/hU81aEhTxrO2cg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2a63d0e9d2c72ac4d4150ebb242cf8d86f488c8c",
+        "rev": "75ed713570ca17427119e7e204ab3590cc3bf2a5",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747978958,
-        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767822991,
-        "narHash": "sha256-iyrn9AcPZCoyxX4OT8eMkBsjG7SRUQXXS/V1JzxS7rA=",
+        "lastModified": 1768941735,
+        "narHash": "sha256-OyxsfXNcOkt06/kM+4bnuC8moDx+t7Qr+RB0BBa83Ig=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "82e5bc4508cab9e8d5a136626276eb5bbce5e9c5",
+        "rev": "69ecf31e8fddc9354a4b418f3a517445d486bb54",
         "type": "github"
       },
       "original": {
@@ -283,11 +283,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768357481,
-        "narHash": "sha256-LpOWVXsHx20x8eRIhn23Q0icmV3Z6ZeFpAPzEqldXFk=",
+        "lastModified": 1768962252,
+        "narHash": "sha256-HyWOOHcySV8rl36gs4+n0sxPinxpwWOgwXibfFPYeZ0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f888492aa1a1eeb0114cf78af40d44e8300e002e",
+        "rev": "433cf697394104123e1fd02fa689534ac1733bfa",
         "type": "github"
       },
       "original": {
@@ -298,11 +298,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1768584846,
-        "narHash": "sha256-IRPmIOV2tPwxbhP/I9M5AmwhTC0lMPtoPStC+8T6xl0=",
+        "lastModified": 1768736227,
+        "narHash": "sha256-qgGq7CfrYKc3IBYQ7qp0Z/ZXndQVC5Bj0N8HW9mS2rM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cce68f4a54fa4e3d633358364477f5cc1d782440",
+        "rev": "d447553bcbc6a178618d37e61648b19e744370df",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768621446,
-        "narHash": "sha256-6YwHV1cjv6arXdF/PQc365h1j+Qje3Pydk501Rm4Q+4=",
+        "lastModified": 1768773494,
+        "narHash": "sha256-XsM7GP3jHlephymxhDE+/TKKO1Q16phz/vQiLBGhpF4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "72ac591e737060deab2b86d6952babd1f896d7c5",
+        "rev": "77ef7a29d276c6d8303aece3444d61118ef71ac2",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768523683,
-        "narHash": "sha256-UbkyPXPPAbz0gHIWvHZ+jrPTruZqkpuwTFo5JXPnIgU=",
+        "lastModified": 1768787308,
+        "narHash": "sha256-APjg428/Z6m6iPBgSrwOSYiN0lvidsprqeNoM1t3/YE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "90e9331fd79d4c3bb5c1e7cd2df2e560565fe543",
+        "rev": "da43b223b02bc097aa23543bf7e26e53435f46b0",
         "type": "github"
       },
       "original": {
@@ -527,11 +527,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1768691318,
-        "narHash": "sha256-5EirwywNrdoEadu5cmjzk8VILVOZslHHesxvaGl287w=",
+        "lastModified": 1768950514,
+        "narHash": "sha256-9SHdImlqC2PaMtMYFhnhj3bGDVoww5NSwHPVNr5lU2s=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "f925e0b82781958d1f53ea1e9e305e1c27cefced",
+        "rev": "f227bbb9e75cc967e5a87694538dbb7506b05369",
         "type": "github"
       },
       "original": {

From 482190519b6057d129cd649ba457f82f0d81677b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 21 Jan 2026 14:26:39 -0500
Subject: [PATCH 553/847] fix squaremap

---
 services/minecraft.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index f94d979..ed8eac2 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -146,6 +146,9 @@
 
   systemd.tmpfiles.rules = [
     "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    # Allow caddy (in minecraft group) to traverse to squaremap/web for map.gardling.com
+    "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
 }

From c9fc1b028efe163d6c6a250273a13e4129104fa2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 21 Jan 2026 15:24:33 -0500
Subject: [PATCH 554/847] hostPlatform -> targetPlatform

---
 flake.nix                        | 2 +-
 services/graphing-calculator.nix | 3 ++-
 tests/minecraft.nix              | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 054d8b3..67da812 100644
--- a/flake.nix
+++ b/flake.nix
@@ -173,7 +173,7 @@
 
       pkgs = import nixpkgs {
         inherit system;
-        hostPlatform = system;
+        targetPlatform = system;
         buildPlatform = builtins.currentSystem;
       };
       lib = import ./modules/lib.nix { inherit inputs pkgs; };
diff --git a/services/graphing-calculator.nix b/services/graphing-calculator.nix
index 32e548c..95aa1e2 100644
--- a/services/graphing-calculator.nix
+++ b/services/graphing-calculator.nix
@@ -5,7 +5,8 @@
   ...
 }:
 let
-  graphing-calculator = inputs.ytbn-graphing-software.packages.${pkgs.stdenv.hostPlatform.system}.web;
+  graphing-calculator =
+    inputs.ytbn-graphing-software.packages.${pkgs.stdenv.targetPlatform.system}.web;
 in
 {
   services.caddy.virtualHosts."graphing.${service_configs.https.domain}".extraConfig = ''
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index dacd5f6..cac381b 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -8,7 +8,7 @@
 let
   # Create pkgs with nix-minecraft overlay and unfree packages allowed
   testPkgs = import inputs.nixpkgs {
-    system = pkgs.stdenv.hostPlatform.system;
+    system = pkgs.stdenv.targetPlatform.system;
     config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
     overlays = [
       inputs.nix-minecraft.overlay

From a184dcee5bc964e57fbac821ac3e44248815f2ba Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 21 Jan 2026 20:21:23 -0500
Subject: [PATCH 555/847] minecraft: fail2ban

---
 services/minecraft.nix       |  20 +++++
 tests/fail2ban-minecraft.nix | 170 +++++++++++++++++++++++++++++++++++
 tests/tests.nix              |   1 +
 3 files changed, 191 insertions(+)
 create mode 100644 tests/fail2ban-minecraft.nix

diff --git a/services/minecraft.nix b/services/minecraft.nix
index ed8eac2..2b13448 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -151,4 +151,24 @@
     "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
+
+  # Protect Minecraft server from connection spam / brute force attempts
+  # Based on https://github.com/fail2ban/fail2ban/pull/2852#issuecomment-3105039910
+  # Only bans IPs that fail whitelist/ban checks - NOT legitimate player disconnects
+  services.fail2ban.jails.minecraft = {
+    enabled = true;
+    settings = {
+      backend = "auto";
+      port = builtins.toString config.services.minecraft-servers.servers.${service_configs.minecraft.server_name}.serverProperties.server-port;
+      logpath = "${config.services.minecraft-servers.dataDir}/${service_configs.minecraft.server_name}/logs/latest.log";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      # Only match whitelist rejections and bans - safe patterns that won't affect legitimate players
+      # Format: [HH:MM:SS] [Server thread/INFO]: Disconnecting <name> (/<IP>:<PORT>): <reason>
+      datepattern = "^\\[%%H:%%M:%%S\\]";
+      failregex = "^\\s*\\[Server thread/INFO\\]: Disconnecting .+ \\(/<HOST>:\\d+\\): (?:You are not white-listed on this server|You are banned from this server)";
+      ignoreregex = "";
+    };
+  };
 }
diff --git a/tests/fail2ban-minecraft.nix b/tests/fail2ban-minecraft.nix
new file mode 100644
index 0000000..6a80412
--- /dev/null
+++ b/tests/fail2ban-minecraft.nix
@@ -0,0 +1,170 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  testServerName = "testserver";
+
+  # Create pkgs with nix-minecraft overlay and unfree packages allowed
+  testPkgs = import inputs.nixpkgs {
+    system = pkgs.stdenv.targetPlatform.system;
+    config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
+    overlays = [
+      inputs.nix-minecraft.overlay
+      (import ../modules/overlays.nix)
+    ];
+  };
+
+  testServiceConfigs = {
+    zpool_ssds = "";
+    https = {
+      domain = "test.local";
+    };
+    minecraft = {
+      parent_dir = "/var/lib/minecraft";
+      server_name = testServerName;
+    };
+  };
+
+  testLib = lib.extend (
+    final: prev: {
+      serviceMountWithZpool =
+        serviceName: zpool: dirs:
+        { ... }:
+        { };
+    }
+  );
+
+  minecraftModule =
+    { config, lib, ... }:
+    {
+      imports = [
+        (import ../services/minecraft.nix {
+          inherit config inputs;
+          pkgs = testPkgs;
+          lib = testLib;
+          service_configs = testServiceConfigs;
+        })
+      ];
+      # Override nixpkgs config to prevent conflicts in test environment
+      nixpkgs.config = lib.mkForce {
+        allowUnfreePredicate = pkg: builtins.elem (testPkgs.lib.getName pkg) [ "minecraft-server" ];
+      };
+      # Disable whitelist import to avoid missing secrets file and reduce memory
+      services.minecraft-servers.servers.${testServerName} = {
+        whitelist = lib.mkForce { };
+        jvmOpts = lib.mkForce "-Xmx1G -Xms1G";
+      };
+    };
+in
+testPkgs.testers.runNixOSTest {
+  name = "fail2ban-minecraft";
+
+  nodes = {
+    server =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        imports = [
+          ../modules/security.nix
+          minecraftModule
+        ];
+
+        # Disable ZFS mount dependency
+        systemd.services."minecraft-server-${testServerName}-mounts".enable = lib.mkForce false;
+        systemd.services."minecraft-server-${testServerName}" = {
+          wants = lib.mkForce [ ];
+          after = lib.mkForce [ ];
+          requires = lib.mkForce [ ];
+        };
+
+        # Override for faster testing
+        services.fail2ban.jails.minecraft.settings = {
+          maxretry = lib.mkForce 3;
+          findtime = lib.mkForce "5m";
+          bantime = lib.mkForce "10m";
+        };
+
+        # Create log directory and placeholder for fail2ban
+        systemd.tmpfiles.rules = [
+          "d /var/lib/minecraft/${testServerName}/logs 0755 minecraft minecraft"
+          "f /var/lib/minecraft/${testServerName}/logs/latest.log 0644 minecraft minecraft"
+        ];
+
+        # Make fail2ban start after minecraft
+        systemd.services.fail2ban = {
+          wants = [ "minecraft-server-${testServerName}.service" ];
+          after = [ "minecraft-server-${testServerName}.service" ];
+        };
+
+        # Give minecraft server more resources
+        virtualisation.diskSize = 4 * 1024;
+        virtualisation.memorySize = 4 * 1024;
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.python3.withPackages (ps: [ ps.mcstatus ]))
+        ];
+      };
+  };
+
+  testScript = ''
+    import time
+
+    start_all()
+
+    # Wait for minecraft server to fully start
+    server.wait_for_unit("minecraft-server-${testServerName}.service", timeout=180)
+    server.wait_for_unit("fail2ban.service")
+    server.wait_for_open_port(25565, timeout=120)
+
+    # Wait for server to be ready (shows "Done" in logs)
+    server.wait_until_succeeds(
+        "grep -q 'Done' /var/lib/minecraft/${testServerName}/logs/latest.log",
+        timeout=120
+    )
+    time.sleep(2)
+
+    # Reload fail2ban now that the real log file exists
+    server.succeed("fail2ban-client reload minecraft")
+    time.sleep(2)
+
+    with subtest("Verify minecraft jail is active"):
+        status = server.succeed("fail2ban-client status")
+        print(f"fail2ban status:\n{status}")
+        assert "minecraft" in status, f"minecraft jail not found in: {status}"
+
+    with subtest("Verify jail configuration"):
+        # Check jail status shows it's monitoring the log file
+        status = server.succeed("fail2ban-client status minecraft")
+        print(f"Jail status:\n{status}")
+        assert "minecraft" in status, "minecraft jail not properly configured"
+
+    with subtest("Check server logs"):
+        logs = server.succeed("tail -20 /var/lib/minecraft/${testServerName}/logs/latest.log")
+        print(f"Server logs:\n{logs}")
+
+    with subtest("Test regex with fail2ban-regex"):
+        # Test the filter regex against the log file
+        result = server.execute("fail2ban-regex /var/lib/minecraft/${testServerName}/logs/latest.log /etc/fail2ban/filter.d/minecraft.local 2>&1")
+        print(f"Regex test result:\n{result}")
+
+    with subtest("Verify jail is functional"):
+        # The jail should be running and monitoring - mcstatus won't trigger bans
+        # since it only does status pings, not login attempts that would fail whitelist
+        status = server.succeed("fail2ban-client status minecraft")
+        print(f"Final jail status:\n{status}")
+        # Verify the jail is running (has filter file loaded)
+        assert "Filter" in status or "File list" in status or "Currently" in status, "Jail not properly running"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index fcc29e1..3b71c8f 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -20,4 +20,5 @@ in
   fail2banVaultwardenTest = handleTest ./fail2ban-vaultwarden.nix;
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
+  fail2banMinecraftTest = handleTest ./fail2ban-minecraft.nix;
 }

From 4de717a20dfe49b96f57dd81dda7892a9e2d38e6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 22 Jan 2026 14:25:52 -0500
Subject: [PATCH 556/847] Revert "minecraft: fail2ban"

This reverts commit a23b3d8c5f1786204e3de18c3b8ba579a0e0e693.
---
 services/minecraft.nix       |  20 -----
 tests/fail2ban-minecraft.nix | 170 -----------------------------------
 tests/tests.nix              |   1 -
 3 files changed, 191 deletions(-)
 delete mode 100644 tests/fail2ban-minecraft.nix

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 2b13448..ed8eac2 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -151,24 +151,4 @@
     "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
-
-  # Protect Minecraft server from connection spam / brute force attempts
-  # Based on https://github.com/fail2ban/fail2ban/pull/2852#issuecomment-3105039910
-  # Only bans IPs that fail whitelist/ban checks - NOT legitimate player disconnects
-  services.fail2ban.jails.minecraft = {
-    enabled = true;
-    settings = {
-      backend = "auto";
-      port = builtins.toString config.services.minecraft-servers.servers.${service_configs.minecraft.server_name}.serverProperties.server-port;
-      logpath = "${config.services.minecraft-servers.dataDir}/${service_configs.minecraft.server_name}/logs/latest.log";
-      # defaults: maxretry=5, findtime=10m, bantime=10m
-    };
-    filter.Definition = {
-      # Only match whitelist rejections and bans - safe patterns that won't affect legitimate players
-      # Format: [HH:MM:SS] [Server thread/INFO]: Disconnecting <name> (/<IP>:<PORT>): <reason>
-      datepattern = "^\\[%%H:%%M:%%S\\]";
-      failregex = "^\\s*\\[Server thread/INFO\\]: Disconnecting .+ \\(/<HOST>:\\d+\\): (?:You are not white-listed on this server|You are banned from this server)";
-      ignoreregex = "";
-    };
-  };
 }
diff --git a/tests/fail2ban-minecraft.nix b/tests/fail2ban-minecraft.nix
deleted file mode 100644
index 6a80412..0000000
--- a/tests/fail2ban-minecraft.nix
+++ /dev/null
@@ -1,170 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  testServerName = "testserver";
-
-  # Create pkgs with nix-minecraft overlay and unfree packages allowed
-  testPkgs = import inputs.nixpkgs {
-    system = pkgs.stdenv.targetPlatform.system;
-    config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
-    overlays = [
-      inputs.nix-minecraft.overlay
-      (import ../modules/overlays.nix)
-    ];
-  };
-
-  testServiceConfigs = {
-    zpool_ssds = "";
-    https = {
-      domain = "test.local";
-    };
-    minecraft = {
-      parent_dir = "/var/lib/minecraft";
-      server_name = testServerName;
-    };
-  };
-
-  testLib = lib.extend (
-    final: prev: {
-      serviceMountWithZpool =
-        serviceName: zpool: dirs:
-        { ... }:
-        { };
-    }
-  );
-
-  minecraftModule =
-    { config, lib, ... }:
-    {
-      imports = [
-        (import ../services/minecraft.nix {
-          inherit config inputs;
-          pkgs = testPkgs;
-          lib = testLib;
-          service_configs = testServiceConfigs;
-        })
-      ];
-      # Override nixpkgs config to prevent conflicts in test environment
-      nixpkgs.config = lib.mkForce {
-        allowUnfreePredicate = pkg: builtins.elem (testPkgs.lib.getName pkg) [ "minecraft-server" ];
-      };
-      # Disable whitelist import to avoid missing secrets file and reduce memory
-      services.minecraft-servers.servers.${testServerName} = {
-        whitelist = lib.mkForce { };
-        jvmOpts = lib.mkForce "-Xmx1G -Xms1G";
-      };
-    };
-in
-testPkgs.testers.runNixOSTest {
-  name = "fail2ban-minecraft";
-
-  nodes = {
-    server =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        imports = [
-          ../modules/security.nix
-          minecraftModule
-        ];
-
-        # Disable ZFS mount dependency
-        systemd.services."minecraft-server-${testServerName}-mounts".enable = lib.mkForce false;
-        systemd.services."minecraft-server-${testServerName}" = {
-          wants = lib.mkForce [ ];
-          after = lib.mkForce [ ];
-          requires = lib.mkForce [ ];
-        };
-
-        # Override for faster testing
-        services.fail2ban.jails.minecraft.settings = {
-          maxretry = lib.mkForce 3;
-          findtime = lib.mkForce "5m";
-          bantime = lib.mkForce "10m";
-        };
-
-        # Create log directory and placeholder for fail2ban
-        systemd.tmpfiles.rules = [
-          "d /var/lib/minecraft/${testServerName}/logs 0755 minecraft minecraft"
-          "f /var/lib/minecraft/${testServerName}/logs/latest.log 0644 minecraft minecraft"
-        ];
-
-        # Make fail2ban start after minecraft
-        systemd.services.fail2ban = {
-          wants = [ "minecraft-server-${testServerName}.service" ];
-          after = [ "minecraft-server-${testServerName}.service" ];
-        };
-
-        # Give minecraft server more resources
-        virtualisation.diskSize = 4 * 1024;
-        virtualisation.memorySize = 4 * 1024;
-      };
-
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          (pkgs.python3.withPackages (ps: [ ps.mcstatus ]))
-        ];
-      };
-  };
-
-  testScript = ''
-    import time
-
-    start_all()
-
-    # Wait for minecraft server to fully start
-    server.wait_for_unit("minecraft-server-${testServerName}.service", timeout=180)
-    server.wait_for_unit("fail2ban.service")
-    server.wait_for_open_port(25565, timeout=120)
-
-    # Wait for server to be ready (shows "Done" in logs)
-    server.wait_until_succeeds(
-        "grep -q 'Done' /var/lib/minecraft/${testServerName}/logs/latest.log",
-        timeout=120
-    )
-    time.sleep(2)
-
-    # Reload fail2ban now that the real log file exists
-    server.succeed("fail2ban-client reload minecraft")
-    time.sleep(2)
-
-    with subtest("Verify minecraft jail is active"):
-        status = server.succeed("fail2ban-client status")
-        print(f"fail2ban status:\n{status}")
-        assert "minecraft" in status, f"minecraft jail not found in: {status}"
-
-    with subtest("Verify jail configuration"):
-        # Check jail status shows it's monitoring the log file
-        status = server.succeed("fail2ban-client status minecraft")
-        print(f"Jail status:\n{status}")
-        assert "minecraft" in status, "minecraft jail not properly configured"
-
-    with subtest("Check server logs"):
-        logs = server.succeed("tail -20 /var/lib/minecraft/${testServerName}/logs/latest.log")
-        print(f"Server logs:\n{logs}")
-
-    with subtest("Test regex with fail2ban-regex"):
-        # Test the filter regex against the log file
-        result = server.execute("fail2ban-regex /var/lib/minecraft/${testServerName}/logs/latest.log /etc/fail2ban/filter.d/minecraft.local 2>&1")
-        print(f"Regex test result:\n{result}")
-
-    with subtest("Verify jail is functional"):
-        # The jail should be running and monitoring - mcstatus won't trigger bans
-        # since it only does status pings, not login attempts that would fail whitelist
-        status = server.succeed("fail2ban-client status minecraft")
-        print(f"Final jail status:\n{status}")
-        # Verify the jail is running (has filter file loaded)
-        assert "Filter" in status or "File list" in status or "Currently" in status, "Jail not properly running"
-  '';
-}
diff --git a/tests/tests.nix b/tests/tests.nix
index 3b71c8f..fcc29e1 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -20,5 +20,4 @@ in
   fail2banVaultwardenTest = handleTest ./fail2ban-vaultwarden.nix;
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
-  fail2banMinecraftTest = handleTest ./fail2ban-minecraft.nix;
 }

From d16c081c51eb998eb5c9f0640e84e3d662250a69 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 22 Jan 2026 14:56:36 -0500
Subject: [PATCH 557/847] wg: don't hardcode namespaceAddress

---
 flake.nix                                 | 1 -
 services/bitmagnet.nix                    | 2 +-
 services/jellyfin-qbittorrent-monitor.nix | 2 +-
 services/qbittorrent.nix                  | 2 +-
 4 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/flake.nix b/flake.nix
index 67da812..29e069c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -119,7 +119,6 @@
         https = {
           certs = services_dir + "/http_certs";
           domain = "gardling.com";
-          wg_ip = "192.168.15.1";
         };
 
         gitea = {
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 9d03a74..d537315 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -26,6 +26,6 @@
 
   services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.bitmagnet}
   '';
 }
diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index 3ca0818..c1f89cc 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -44,7 +44,7 @@
 
     environment = {
       JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
-      QBITTORRENT_URL = "http://${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}";
+      QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.torrent}";
       CHECK_INTERVAL = "30";
     };
   };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 0ae94a6..bcd1ebb 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -104,7 +104,7 @@
 
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString config.services.qbittorrent.webuiPort}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString config.services.qbittorrent.webuiPort}
   '';
 
   users.users.${config.services.qbittorrent.user}.extraGroups = [

From f7a0eef88f974ba83f04e64104f5b8c8a70d54bf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 22 Jan 2026 22:40:40 -0500
Subject: [PATCH 558/847] cleanup minecraft test

---
 flake.nix              |  5 +++++
 services/minecraft.nix | 13 ------------
 tests/minecraft.nix    | 48 +++++++++++++++++-------------------------
 3 files changed, 24 insertions(+), 42 deletions(-)

diff --git a/flake.nix b/flake.nix
index 29e069c..c867667 100644
--- a/flake.nix
+++ b/flake.nix
@@ -223,6 +223,11 @@
               nix-minecraft.overlay
               (import ./modules/overlays.nix)
             ];
+            nixpkgs.config.allowUnfreePredicate =
+              pkg:
+              builtins.elem (nixpkgs.lib.getName pkg) [
+                "minecraft-server"
+              ];
           }
 
           lanzaboote.nixosModules.lanzaboote
diff --git a/services/minecraft.nix b/services/minecraft.nix
index ed8eac2..ea35718 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -17,19 +17,6 @@
     inputs.nix-minecraft.nixosModules.minecraft-servers
   ];
 
-  environment.systemPackages = [
-    (pkgs.writeScriptBin "mc-console" ''
-      #!/bin/sh
-      ${pkgs.tmux}/bin/tmux -S /run/minecraft/${service_configs.minecraft.server_name}.sock attach
-    '')
-  ];
-
-  nixpkgs.config.allowUnfreePredicate =
-    pkg:
-    builtins.elem (lib.getName pkg) [
-      "minecraft-server"
-    ];
-
   services.minecraft-servers = {
     enable = true;
     eula = true;
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index cac381b..020abc4 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -6,6 +6,17 @@
   ...
 }:
 let
+  testServiceConfigs = {
+    minecraft = {
+      server_name = "main";
+      parent_dir = "/var/lib/minecraft";
+    };
+    https = {
+      domain = "test.local";
+    };
+    zpool_ssds = "";
+  };
+
   # Create pkgs with nix-minecraft overlay and unfree packages allowed
   testPkgs = import inputs.nixpkgs {
     system = pkgs.stdenv.targetPlatform.system;
@@ -15,42 +26,21 @@ let
       (import ../modules/overlays.nix)
     ];
   };
-
-  # Create a wrapper module that imports the actual minecraft service
-  minecraftService =
-    { config, ... }:
-    {
-      imports = [
-        (import ../services/minecraft.nix {
-          inherit lib config inputs;
-          pkgs = testPkgs;
-          service_configs = {
-            minecraft = {
-              server_name = "main";
-              parent_dir = "/var/lib/minecraft";
-            };
-            https = {
-              domain = "test.local";
-            };
-            zpool_ssds = "";
-          };
-          username = "testuser";
-        })
-      ];
-      # Override nixpkgs config to prevent conflicts in test environment
-      nixpkgs.config = lib.mkForce {
-        allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "minecraft-server" ];
-      };
-    };
 in
 testPkgs.testers.runNixOSTest {
   name = "minecraft server startup test";
 
+  node.specialArgs = {
+    inherit inputs lib;
+    service_configs = testServiceConfigs;
+    username = "testuser";
+  };
+
   nodes.machine =
-    { ... }:
+    { lib, ... }:
     {
       imports = [
-        minecraftService
+        ../services/minecraft.nix
       ];
 
       # Enable caddy service (required by minecraft service)

From 12b681c8f2e3760d9308407aa6555d66c1ad45b9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 23 Jan 2026 00:29:24 -0500
Subject: [PATCH 559/847] cleanup

---
 flake.nix              | 6 +++++-
 modules/lib.nix        | 5 +++--
 services/caddy.nix     | 2 +-
 services/minecraft.nix | 2 +-
 tests/minecraft.nix    | 3 +++
 5 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/flake.nix b/flake.nix
index c867667..ca97a4b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -100,7 +100,10 @@
         music_dir = "/${zpool_ssds}/music";
         media_group = "media";
 
+        cpu_arch = "znver3";
+
         ports = {
+          http = 80;
           https = 443;
           jellyfin = 8096; # no services.jellyfin option for this
           torrent = 6011;
@@ -114,6 +117,7 @@
           syncthing_gui = 8384;
           syncthing_protocol = 22000;
           syncthing_discovery = 21027;
+          minecraft = 25565;
         };
 
         https = {
@@ -175,7 +179,7 @@
         targetPlatform = system;
         buildPlatform = builtins.currentSystem;
       };
-      lib = import ./modules/lib.nix { inherit inputs pkgs; };
+      lib = import ./modules/lib.nix { inherit inputs pkgs service_configs; };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
diff --git a/modules/lib.nix b/modules/lib.nix
index 5fed152..9497534 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -1,6 +1,7 @@
 {
   inputs,
   pkgs,
+  service_configs,
   ...
 }:
 inputs.nixpkgs.lib.extend (
@@ -28,8 +29,8 @@ inputs.nixpkgs.lib.extend (
       pkg:
       final.optimizeWithFlags pkg [
         "-O3"
-        "-march=znver3"
-        "-mtune=znver3"
+        "-march=${service_configs.cpu_arch}"
+        "-mtune=${service_configs.cpu_arch}"
       ];
 
     vpnNamespaceOpenPort =
diff --git a/services/caddy.nix b/services/caddy.nix
index cbfea99..1e4095a 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -74,7 +74,7 @@ in
     service_configs.ports.https
 
     # http (but really acmeCA challenges)
-    80
+    service_configs.ports.http
   ];
 
   networking.firewall.allowedUDPPorts = [
diff --git a/services/minecraft.nix b/services/minecraft.nix
index ea35718..45de8fa 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -34,7 +34,7 @@
         "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
 
       serverProperties = {
-        server-port = 25565;
+        server-port = service_configs.ports.minecraft;
         enforce-whitelist = true;
         gamemode = "survival";
         white-list = true;
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 020abc4..b2e0956 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -14,6 +14,9 @@ let
     https = {
       domain = "test.local";
     };
+    ports = {
+      minecraft = 25565;
+    };
     zpool_ssds = "";
   };
 

From 3ccb31f6b42c0387017d2f0915b13259b3a5c127 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 23 Jan 2026 12:56:54 -0500
Subject: [PATCH 560/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index c06032c..fa272be 100644
--- a/flake.lock
+++ b/flake.lock
@@ -261,11 +261,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1768307256,
-        "narHash": "sha256-3yDvlAqWa0Vk3B9hFRJJrSs1xc+FwVQFLtu//VrTR4c=",
+        "lastModified": 1769175598,
+        "narHash": "sha256-xGlAdk2c1mVxOTMzzCYHDYuXaBMoH1BTr2nJOGkY/SQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "7e031eb535a494582f4fc58735b5aecba7b57058",
+        "rev": "1bea6e953d06da77729edd0004291ced527bcb4a",
         "type": "github"
       },
       "original": {
@@ -298,11 +298,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1768736227,
-        "narHash": "sha256-qgGq7CfrYKc3IBYQ7qp0Z/ZXndQVC5Bj0N8HW9mS2rM=",
+        "lastModified": 1769086393,
+        "narHash": "sha256-3ymIZ8s3+hu7sDl/Y48o6bwMxorfKrmn97KuWiw1vjY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d447553bcbc6a178618d37e61648b19e744370df",
+        "rev": "9f7ba891ea5fc3ededd7804f1a23fafadbcb26ca",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768773494,
-        "narHash": "sha256-XsM7GP3jHlephymxhDE+/TKKO1Q16phz/vQiLBGhpF4=",
+        "lastModified": 1769089682,
+        "narHash": "sha256-9yA/LIuAVQq0lXelrZPjLuLVuZdm03p8tfmHhnDIkms=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "77ef7a29d276c6d8303aece3444d61118ef71ac2",
+        "rev": "078d69f03934859a181e81ba987c2bb033eebfc5",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768787308,
-        "narHash": "sha256-APjg428/Z6m6iPBgSrwOSYiN0lvidsprqeNoM1t3/YE=",
+        "lastModified": 1769046412,
+        "narHash": "sha256-LbjKkSB4Nar9pX+AxHs2FGH2ZAFpKWUvr79uyEhFVqc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "da43b223b02bc097aa23543bf7e26e53435f46b0",
+        "rev": "a78abbc16a5352ee848e454c99166c97415fbf39",
         "type": "github"
       },
       "original": {
@@ -527,11 +527,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1768950514,
-        "narHash": "sha256-9SHdImlqC2PaMtMYFhnhj3bGDVoww5NSwHPVNr5lU2s=",
+        "lastModified": 1769123324,
+        "narHash": "sha256-g40TfMs546p8m16XSwN0xE87hV92/mOkSWDkXvTPlvo=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "f227bbb9e75cc967e5a87694538dbb7506b05369",
+        "rev": "7b512a6935fa5b1cd93bf990887c082512249f01",
         "type": "github"
       },
       "original": {

From 66cfc65099420bc6bffd3cf80f48235dc7f5127a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 Jan 2026 02:01:06 -0500
Subject: [PATCH 561/847] xmrig

---
 configuration.nix    |   1 +
 secrets/xmrig-wallet | Bin 0 -> 118 bytes
 services/xmrig.nix   |  53 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 secrets/xmrig-wallet
 create mode 100644 services/xmrig.nix

diff --git a/configuration.nix b/configuration.nix
index e9d1265..7ce700a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -39,6 +39,7 @@
     ./services/bitwarden.nix
 
     ./services/monero.nix
+    ./services/xmrig.nix
 
     # KEEP UNTIL 2028
     ./services/caddy_senior_project.nix
diff --git a/secrets/xmrig-wallet b/secrets/xmrig-wallet
new file mode 100644
index 0000000000000000000000000000000000000000..64676de3957c531104e763574304134d498f9fab
GIT binary patch
literal 118
zcmZQ@_Y83kiVO&0aF019cA@{w{e^ohwsfnN#Fs8-v^{nCZ?xL{E31#+s}|ZB#l-8%
zp#MB;b5Bmy{`Tuz-fvc3c<zq;R*|<VYF84kU;TAml%+bVMR{`Q9+9-dAm7kyQ#^9~
bp85H3DurwP+_@z_$b8C?BYty5{#^tByp1?K

literal 0
HcmV?d00001

diff --git a/services/xmrig.nix b/services/xmrig.nix
new file mode 100644
index 0000000..0763655
--- /dev/null
+++ b/services/xmrig.nix
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostname,
+  ...
+}:
+let
+  walletAddress = lib.strings.trim (builtins.readFile ../secrets/xmrig-wallet);
+  threadCount = 2;
+in
+{
+  services.xmrig = {
+    enable = true;
+    package = pkgs.xmrig;
+
+    settings = {
+      autosave = true;
+
+      cpu = {
+        enabled = true;
+        huge-pages = true;
+        hw-aes = true;
+        rx = lib.range 0 (threadCount - 1);
+      };
+
+      opencl = false;
+      cuda = false;
+
+      pools = [
+        {
+          url = "gulf.moneroocean.stream:20128";
+          user = walletAddress;
+          pass = hostname + "~rx/0";
+          keepalive = true;
+          tls = true;
+        }
+      ];
+    };
+  };
+
+  systemd.services.xmrig.serviceConfig = {
+    Nice = 19;
+    CPUSchedulingPolicy = "idle";
+    IOSchedulingClass = "idle";
+  };
+
+  # Stop mining on UPS battery to conserve power
+  services.apcupsd.hooks = lib.mkIf config.services.apcupsd.enable {
+    onbattery = "systemctl stop xmrig";
+    offbattery = "systemctl start xmrig";
+  };
+}

From f6dffc3718df215c21da9c7279c4430bad543038 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 Jan 2026 14:25:25 -0500
Subject: [PATCH 562/847] xmrig: 1gb pages

---
 services/xmrig.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/xmrig.nix b/services/xmrig.nix
index 0763655..a60b6bd 100644
--- a/services/xmrig.nix
+++ b/services/xmrig.nix
@@ -20,6 +20,7 @@ in
       cpu = {
         enabled = true;
         huge-pages = true;
+        "1gb-pages" = true;
         hw-aes = true;
         rx = lib.range 0 (threadCount - 1);
       };
@@ -50,4 +51,10 @@ in
     onbattery = "systemctl stop xmrig";
     offbattery = "systemctl start xmrig";
   };
+
+  # Reserve 1GB huge pages for RandomX (dataset is ~2GB)
+  boot.kernelParams = [
+    "hugepagesz=1G"
+    "hugepages=3"
+  ];
 }

From 78ed353a0f90c466d7c307e1e5d38d0bb1dc77de Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 Jan 2026 17:51:16 -0500
Subject: [PATCH 563/847] xmrig: 12 threads

---
 services/xmrig.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/services/xmrig.nix b/services/xmrig.nix
index a60b6bd..376d4d4 100644
--- a/services/xmrig.nix
+++ b/services/xmrig.nix
@@ -7,7 +7,7 @@
 }:
 let
   walletAddress = lib.strings.trim (builtins.readFile ../secrets/xmrig-wallet);
-  threadCount = 2;
+  threadCount = 12;
 in
 {
   services.xmrig = {
@@ -20,11 +20,14 @@ in
       cpu = {
         enabled = true;
         huge-pages = true;
-        "1gb-pages" = true;
         hw-aes = true;
         rx = lib.range 0 (threadCount - 1);
       };
 
+      randomx = {
+        "1gb-pages" = true;
+      };
+
       opencl = false;
       cuda = false;
 

From f106871fa2d25d9db27db69c55c66447f4cfa3a1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 26 Jan 2026 23:09:22 -0500
Subject: [PATCH 564/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index fa272be..ecf296c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1767744144,
-        "narHash": "sha256-9/9ntI0D+HbN4G0TrK3KmHbTvwgswz7p8IEJsWyef8Q=",
+        "lastModified": 1769287525,
+        "narHash": "sha256-gABuYA6BzoRMLuPaeO5p7SLrpd4qExgkwEmYaYQY4bM=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "2fb033290bf6b23f226d4c8b32f7f7a16b043d7e",
+        "rev": "0314e365877a85c9e5758f9ea77a9972afbb4c21",
         "type": "github"
       },
       "original": {
@@ -261,11 +261,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1769175598,
-        "narHash": "sha256-xGlAdk2c1mVxOTMzzCYHDYuXaBMoH1BTr2nJOGkY/SQ=",
+        "lastModified": 1769417433,
+        "narHash": "sha256-0WZ7I/N9InaBHL96/qdiJxg8mqFW3vRla8Z062JmQFE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "1bea6e953d06da77729edd0004291ced527bcb4a",
+        "rev": "1902463415745b992dbaf301b2a35a1277be1584",
         "type": "github"
       },
       "original": {
@@ -298,11 +298,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1769086393,
-        "narHash": "sha256-3ymIZ8s3+hu7sDl/Y48o6bwMxorfKrmn97KuWiw1vjY=",
+        "lastModified": 1769302137,
+        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9f7ba891ea5fc3ededd7804f1a23fafadbcb26ca",
+        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769089682,
-        "narHash": "sha256-9yA/LIuAVQq0lXelrZPjLuLVuZdm03p8tfmHhnDIkms=",
+        "lastModified": 1769318308,
+        "narHash": "sha256-Mjx6p96Pkefks3+aA+72lu1xVehb6mv2yTUUqmSet6Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "078d69f03934859a181e81ba987c2bb033eebfc5",
+        "rev": "1cd347bf3355fce6c64ab37d3967b4a2cb4b878c",
         "type": "github"
       },
       "original": {
@@ -354,11 +354,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767281941,
-        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
+        "lastModified": 1769069492,
+        "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
+        "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768272338,
-        "narHash": "sha256-Tg/kL8eKMpZtceDvBDQYU8zowgpr7ucFRnpP/AtfuRM=",
+        "lastModified": 1769309768,
+        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "03dda130a8701b08b0347fcaf850a190c53a3c1e",
+        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
         "type": "github"
       },
       "original": {
@@ -431,11 +431,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1768253064,
-        "narHash": "sha256-Lp3k2BhOWo7bYRcGuV0ltgVYr+0+1QCcpuB7kK4pvOE=",
+        "lastModified": 1769471280,
+        "narHash": "sha256-6BADVRSHHwO3NcAua44hagAJTqPNDxEhPjBMehURiHQ=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "f86a1c80c58d1c292b4673e28e892de13fb78a25",
+        "rev": "d6f443ede6c90a049085b4598e438849e19e74f4",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769046412,
-        "narHash": "sha256-LbjKkSB4Nar9pX+AxHs2FGH2ZAFpKWUvr79uyEhFVqc=",
+        "lastModified": 1769398903,
+        "narHash": "sha256-/+blNRtYT7yGRa73cMNdSe4okAUXewxyTkTaIqXCVKE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "a78abbc16a5352ee848e454c99166c97415fbf39",
+        "rev": "7f3bc435bdcb4856dacc06ca924ee7dad21f3917",
         "type": "github"
       },
       "original": {
@@ -527,11 +527,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1769123324,
-        "narHash": "sha256-g40TfMs546p8m16XSwN0xE87hV92/mOkSWDkXvTPlvo=",
+        "lastModified": 1769468910,
+        "narHash": "sha256-vBkmeymF2QhjFgg2EM6iSer9BBEfSucUNG09iRZ1Vp0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "7b512a6935fa5b1cd93bf990887c082512249f01",
+        "rev": "a3f5b299d0e1623652652d58c4d9836e2c4ac1e8",
         "type": "github"
       },
       "original": {

From a5c14ce3067bc4b14c55d466f4c84452cc42d1bb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 27 Jan 2026 18:51:08 -0500
Subject: [PATCH 565/847] fail2ban: ignoreip from local network

---
 services/caddy.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/caddy.nix b/services/caddy.nix
index 1e4095a..f31ea1d 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -89,6 +89,12 @@ in
       port = "http,https";
       logpath = "/var/log/caddy/access-*.log";
       # defaults: maxretry=5, findtime=10m, bantime=10m
+
+      # Ignore local network IPs - NAT hairpinning causes all LAN traffic to
+      # appear from the router IP (192.168.1.1). Banning it blocks all internal access.
+      # Browser subrequests for static assets (favicon.ico, etc.) without Authorization
+      # headers cause 401s that quickly trigger the ban threshold.
+      ignoreip = "127.0.0.1/8 ::1 192.168.1.0/24";
     };
     filter.Definition = {
       # Match Caddy JSON logs with 401 Unauthorized status (failed basic auth)

From c008aee5ea2a7ec3db57836682115e59b9d512e2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 30 Jan 2026 00:43:28 -0500
Subject: [PATCH 566/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index ecf296c..ddbafca 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768923567,
-        "narHash": "sha256-GVJ0jKsyXLuBzRMXCDY6D5J8wVdwP1DuQmmvYL/Vw/Q=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "00395d188e3594a1507f214a2f15d4ce5c07cb28",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
         "type": "github"
       },
       "original": {
@@ -195,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768949235,
-        "narHash": "sha256-TtjKgXyg1lMfh374w5uxutd6Vx2P/hU81aEhTxrO2cg=",
+        "lastModified": 1769580047,
+        "narHash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "75ed713570ca17427119e7e204ab3590cc3bf2a5",
+        "rev": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768941735,
-        "narHash": "sha256-OyxsfXNcOkt06/kM+4bnuC8moDx+t7Qr+RB0BBa83Ig=",
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "69ecf31e8fddc9354a4b418f3a517445d486bb54",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
         "type": "github"
       },
       "original": {
@@ -283,11 +283,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768962252,
-        "narHash": "sha256-HyWOOHcySV8rl36gs4+n0sxPinxpwWOgwXibfFPYeZ0=",
+        "lastModified": 1769567010,
+        "narHash": "sha256-R4ESxjCluQQlSIPw4NaRYVvEtvsnKGRwmACcXU1at6g=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "433cf697394104123e1fd02fa689534ac1733bfa",
+        "rev": "1c9c95fea177a4f8430c34dc1f974394e72bca1f",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769318308,
-        "narHash": "sha256-Mjx6p96Pkefks3+aA+72lu1xVehb6mv2yTUUqmSet6Q=",
+        "lastModified": 1769598131,
+        "narHash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1cd347bf3355fce6c64ab37d3967b4a2cb4b878c",
+        "rev": "fa83fd837f3098e3e678e6cf017b2b36102c7211",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769398903,
-        "narHash": "sha256-/+blNRtYT7yGRa73cMNdSe4okAUXewxyTkTaIqXCVKE=",
+        "lastModified": 1769681123,
+        "narHash": "sha256-i29n0IDa5nR8O9w7QsajWNy/dfgfnGF7/nJY+/OdjEY=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "7f3bc435bdcb4856dacc06ca924ee7dad21f3917",
+        "rev": "861710611463c47190345f09f6959c9230def555",
         "type": "github"
       },
       "original": {
@@ -527,11 +527,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1769468910,
-        "narHash": "sha256-vBkmeymF2QhjFgg2EM6iSer9BBEfSucUNG09iRZ1Vp0=",
+        "lastModified": 1769728114,
+        "narHash": "sha256-8cr7w5S7U7myY2Xjk+W3cZcn3MZAWHe348syBuXghK8=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "a3f5b299d0e1623652652d58c4d9836e2c4ac1e8",
+        "rev": "0619a5206300aee182727ccc82034e3f7dc7e10d",
         "type": "github"
       },
       "original": {

From f6be10e0198c6255db75380b341e626833fb823c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 1 Feb 2026 21:30:50 -0500
Subject: [PATCH 567/847] update

---
 flake.lock | 54 ++++++++++++++++++------------------------------------
 1 file changed, 18 insertions(+), 36 deletions(-)

diff --git a/flake.lock b/flake.lock
index ddbafca..b365470 100644
--- a/flake.lock
+++ b/flake.lock
@@ -131,24 +131,6 @@
       }
     },
     "flake-utils": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "inputs": {
         "systems": "systems_4"
       },
@@ -261,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1769417433,
-        "narHash": "sha256-0WZ7I/N9InaBHL96/qdiJxg8mqFW3vRla8Z062JmQFE=",
+        "lastModified": 1769949118,
+        "narHash": "sha256-Ue9kYZenqMw9yHGFnBpoWxQqhs2tlH/el4AxKVicXBE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "1902463415745b992dbaf301b2a35a1277be1584",
+        "rev": "0be0641613a13323a61a6406c46b6f28b8894395",
         "type": "github"
       },
       "original": {
@@ -277,17 +259,17 @@
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1769567010,
-        "narHash": "sha256-R4ESxjCluQQlSIPw4NaRYVvEtvsnKGRwmACcXU1at6g=",
+        "lastModified": 1769936216,
+        "narHash": "sha256-ezgoxbHXGQMufga7aaZNhYZYiXQhaGV4jLAZy0fBhzA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1c9c95fea177a4f8430c34dc1f974394e72bca1f",
+        "rev": "ff6604fa8d25c1e1c135a261ddd6b3dcc4443129",
         "type": "github"
       },
       "original": {
@@ -314,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769598131,
-        "narHash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=",
+        "lastModified": 1769900590,
+        "narHash": "sha256-I7Lmgj3owOTBGuauy9FL6qdpeK2umDoe07lM4V+PnyA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fa83fd837f3098e3e678e6cf017b2b36102c7211",
+        "rev": "41e216c0ca66c83b12ab7a98cc326b5db01db646",
         "type": "github"
       },
       "original": {
@@ -451,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769681123,
-        "narHash": "sha256-i29n0IDa5nR8O9w7QsajWNy/dfgfnGF7/nJY+/OdjEY=",
+        "lastModified": 1769966911,
+        "narHash": "sha256-XAkzg+OUOLanRTA5XjxlxZZqCV9SbrLXctuqZJt98Ss=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "861710611463c47190345f09f6959c9230def555",
+        "rev": "bd652e39593fffa6360df1709888ed72918f199b",
         "type": "github"
       },
       "original": {
@@ -527,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1769728114,
-        "narHash": "sha256-8cr7w5S7U7myY2Xjk+W3cZcn3MZAWHe348syBuXghK8=",
+        "lastModified": 1769987302,
+        "narHash": "sha256-Vs1pQl1dnKCvYa33eyTlkW3ygS9fwdCUFQRwyhseklo=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "0619a5206300aee182727ccc82034e3f7dc7e10d",
+        "rev": "56b95fd4d690b26b4d6cc0dde3beef41a090cc78",
         "type": "github"
       },
       "original": {
@@ -591,7 +573,7 @@
     },
     "ytbn-graphing-software": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs_2",
         "rust-overlay": "rust-overlay_2"
       },

From 9e15ae84b070d6e7b44c738bd0c1ab8292f29f76 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Feb 2026 12:25:24 -0500
Subject: [PATCH 568/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index b365470..27c5e0b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1769287525,
-        "narHash": "sha256-gABuYA6BzoRMLuPaeO5p7SLrpd4qExgkwEmYaYQY4bM=",
+        "lastModified": 1769737823,
+        "narHash": "sha256-DrBaNpZ+sJ4stXm+0nBX7zqZT9t9P22zbk6m5YhQxS4=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "0314e365877a85c9e5758f9ea77a9972afbb4c21",
+        "rev": "b2f45c3830aa96b7456a4c4bc327d04d7a43e1ba",
         "type": "github"
       },
       "original": {
@@ -49,11 +49,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1766051518,
-        "narHash": "sha256-znKOwPXQnt3o7lDb3hdf19oDo0BLP4MfBOYiWkEHoik=",
+        "lastModified": 1770019181,
+        "narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "d5eff7f948535b9c723d60cd8239f8f11ddc90fa",
+        "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1769949118,
-        "narHash": "sha256-Ue9kYZenqMw9yHGFnBpoWxQqhs2tlH/el4AxKVicXBE=",
+        "lastModified": 1770064250,
+        "narHash": "sha256-3HB6gfnKZnwDoH77lnJktJtQWEZ+D35Oi53pNF6YwO4=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "0be0641613a13323a61a6406c46b6f28b8894395",
+        "rev": "9985b98c74dcc7b1c7ccfe8693daf37caa4ed2ea",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1769936216,
-        "narHash": "sha256-ezgoxbHXGQMufga7aaZNhYZYiXQhaGV4jLAZy0fBhzA=",
+        "lastModified": 1770000653,
+        "narHash": "sha256-QO/twGynxjOSUDtxbqJLshc/Q5/wImLH5O6KV2p9eoE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ff6604fa8d25c1e1c135a261ddd6b3dcc4443129",
+        "rev": "6a2ddb643aaf7949caa6158e718c5efc3dda7dc1",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769900590,
-        "narHash": "sha256-I7Lmgj3owOTBGuauy9FL6qdpeK2umDoe07lM4V+PnyA=",
+        "lastModified": 1770056022,
+        "narHash": "sha256-yvCz+Qmci1bVucXEyac3TdoSPMtjqVJmVy5wro6j/70=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "41e216c0ca66c83b12ab7a98cc326b5db01db646",
+        "rev": "d04d8548aed39902419f14a8537006426dc1e4fa",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769069492,
-        "narHash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U=",
+        "lastModified": 1769939035,
+        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
+        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769309768,
-        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
+        "lastModified": 1770001842,
+        "narHash": "sha256-ZAyTeILfdWwDp1nuF0RK3McBduMi49qnJvrS+3Ezpac=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
+        "rev": "5018343419ea808f8a413241381976b7e60951f2",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769966911,
-        "narHash": "sha256-XAkzg+OUOLanRTA5XjxlxZZqCV9SbrLXctuqZJt98Ss=",
+        "lastModified": 1769997974,
+        "narHash": "sha256-Fn94xsChIy3XcefUq8rY1ylbyUfN5NYyo3Ul0Bu3A7o=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "bd652e39593fffa6360df1709888ed72918f199b",
+        "rev": "c4a21c42efec0506ec352891fec84490dae2ded0",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1769987302,
-        "narHash": "sha256-Vs1pQl1dnKCvYa33eyTlkW3ygS9fwdCUFQRwyhseklo=",
+        "lastModified": 1770073708,
+        "narHash": "sha256-13zvfVCtFHu91GpCn9PIESaHyZBiLVADEStKeHUjRyA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "56b95fd4d690b26b4d6cc0dde3beef41a090cc78",
+        "rev": "2a2922998a878209d687dece9d7ca01eca76595e",
         "type": "github"
       },
       "original": {

From f7cbfa56c8b838b1ea63e81d021a7155594a1f69 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 5 Feb 2026 01:33:55 -0500
Subject: [PATCH 569/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 27c5e0b..d77145e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -12,11 +12,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1762618334,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769580047,
-        "narHash": "sha256-tNqCP/+2+peAXXQ2V8RwsBkenlfWMERb+Uy6xmevyhM=",
+        "lastModified": 1770260404,
+        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "366d78c2856de6ab3411c15c1cb4fb4c2bf5c826",
+        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1770000653,
-        "narHash": "sha256-QO/twGynxjOSUDtxbqJLshc/Q5/wImLH5O6KV2p9eoE=",
+        "lastModified": 1770172907,
+        "narHash": "sha256-rqYl9B+4shcM5b6OYjT+qdsdQNJ7SY64/xcPIb96NzU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "6a2ddb643aaf7949caa6158e718c5efc3dda7dc1",
+        "rev": "8958a5a4259e1aebf4916823bf463faaf2538566",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770056022,
-        "narHash": "sha256-yvCz+Qmci1bVucXEyac3TdoSPMtjqVJmVy5wro6j/70=",
+        "lastModified": 1770136044,
+        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d04d8548aed39902419f14a8537006426dc1e4fa",
+        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769997974,
-        "narHash": "sha256-Fn94xsChIy3XcefUq8rY1ylbyUfN5NYyo3Ul0Bu3A7o=",
+        "lastModified": 1770257911,
+        "narHash": "sha256-yCsQ6UJNWyrLc6OI41uA8R3u2z60aNYCzcVzM1AG3qY=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "c4a21c42efec0506ec352891fec84490dae2ded0",
+        "rev": "5086dcb3f4212c90ab0e5c30391c92116db7e035",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1770073708,
-        "narHash": "sha256-13zvfVCtFHu91GpCn9PIESaHyZBiLVADEStKeHUjRyA=",
+        "lastModified": 1770246524,
+        "narHash": "sha256-ZZCgWu4ZR4p6GltHl5AWgITWm8LAXIe9z1tJ04eW8E0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "2a2922998a878209d687dece9d7ca01eca76595e",
+        "rev": "4838353ac4f4fca954b9e53f28585eafe6a6943e",
         "type": "github"
       },
       "original": {

From 683a4f903d6e3c66ff902796ab012c46caa48257 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 5 Feb 2026 15:11:17 -0500
Subject: [PATCH 570/847] potentially fix fail2ban

---
 services/caddy.nix       |  9 +++++----
 tests/fail2ban-caddy.nix | 22 +++++++++++++++++++---
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index f31ea1d..856bb8b 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -92,13 +92,14 @@ in
 
       # Ignore local network IPs - NAT hairpinning causes all LAN traffic to
       # appear from the router IP (192.168.1.1). Banning it blocks all internal access.
-      # Browser subrequests for static assets (favicon.ico, etc.) without Authorization
-      # headers cause 401s that quickly trigger the ban threshold.
       ignoreip = "127.0.0.1/8 ::1 192.168.1.0/24";
     };
     filter.Definition = {
-      # Match Caddy JSON logs with 401 Unauthorized status (failed basic auth)
-      failregex = ''^.*"remote_ip":"<HOST>".*"status":401.*$'';
+      # Only match 401s where an Authorization header was actually sent.
+      # Without this, the normal HTTP Basic Auth challenge-response flow
+      # (browser probes without credentials, gets 401, then resends with
+      # credentials) counts every page visit as a "failure."
+      failregex = ''^.*"remote_ip":"<HOST>".*"Authorization":\["REDACTED"\].*"status":401.*$'';
       ignoreregex = "";
       datepattern = ''"ts":{Epoch}\.'';
     };
diff --git a/tests/fail2ban-caddy.nix b/tests/fail2ban-caddy.nix
index baf7829..54b11a9 100644
--- a/tests/fail2ban-caddy.nix
+++ b/tests/fail2ban-caddy.nix
@@ -46,7 +46,8 @@ pkgs.testers.runNixOSTest {
             maxretry = 3; # Lower for testing
           };
           filter.Definition = {
-            failregex = ''^.*"remote_ip":"<HOST>".*"status":401.*$'';
+            # Only match 401s where an Authorization header was actually sent
+            failregex = ''^.*"remote_ip":"<HOST>".*"Authorization":\["REDACTED"\].*"status":401.*$'';
             ignoreregex = "";
             datepattern = ''"ts":{Epoch}\.'';
           };
@@ -86,13 +87,28 @@ pkgs.testers.runNixOSTest {
         print(f"Curl result: {result}")
         assert "Authenticated" in result, f"Auth should succeed: {result}"
 
-    with subtest("Generate failed basic auth attempts"):
+    with subtest("Unauthenticated requests (browser probes) should not trigger ban"):
+        # Simulate browser probe requests - no Authorization header sent
+        # This is the normal HTTP Basic Auth challenge-response flow:
+        # browser sends request without credentials, gets 401, then resends with credentials
+        for i in range(5):
+            client.execute("curl -4 -s http://server/ || true")
+            time.sleep(0.5)
+        time.sleep(3)
+        status = server.succeed("fail2ban-client status caddy-auth")
+        print(f"caddy-auth jail status after unauthenticated requests: {status}")
+        match = re.search(r"Currently banned:\s*(\d+)", status)
+        banned = int(match.group(1)) if match else 0
+        assert banned == 0, f"Unauthenticated 401s should NOT trigger ban, but {banned} IPs were banned: {status}"
+
+    with subtest("Generate failed basic auth attempts (wrong password)"):
         # Use -4 to force IPv4 for consistent IP tracking
+        # These send an Authorization header with wrong credentials
         for i in range(4):
             client.execute("curl -4 -s -u testuser:wrongpass http://server/ || true")
             time.sleep(1)
 
-    with subtest("Verify IP is banned"):
+    with subtest("Verify IP is banned after wrong password attempts"):
         time.sleep(5)
         status = server.succeed("fail2ban-client status caddy-auth")
         print(f"caddy-auth jail status: {status}")

From e3c35a67d78cb96398fabffe9cabd0254558717e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Feb 2026 14:43:08 -0500
Subject: [PATCH 571/847] syncthing: add grayjay backups

---
 flake.nix              | 1 +
 services/syncthing.nix | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/flake.nix b/flake.nix
index ca97a4b..0123adf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -171,6 +171,7 @@
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";
+          grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";
         };
       };
 
diff --git a/services/syncthing.nix b/services/syncthing.nix
index cc00227..d73713a 100644
--- a/services/syncthing.nix
+++ b/services/syncthing.nix
@@ -10,6 +10,7 @@
     (lib.serviceMountWithZpool "syncthing" service_configs.zpool_ssds [
       service_configs.syncthing.dataDir
       service_configs.syncthing.signalBackupDir
+      service_configs.syncthing.grayjayBackupDir
     ])
   ];
 
@@ -48,5 +49,6 @@
   systemd.tmpfiles.rules = [
     "Z ${service_configs.syncthing.dataDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
     "Z ${service_configs.syncthing.signalBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+    "Z ${service_configs.syncthing.grayjayBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
   ];
 }

From 5203ee6ac258e857ffef66933870696c0bd225b6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 12:45:40 -0500
Subject: [PATCH 572/847] re-add matrix

---
 configuration.nix        |   2 ++
 flake.nix                |   7 ++++
 secrets/matrix_reg_token | Bin 0 -> 87 bytes
 services/matrix.nix      |  68 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 77 insertions(+)
 create mode 100644 secrets/matrix_reg_token
 create mode 100644 services/matrix.nix

diff --git a/configuration.nix b/configuration.nix
index 7ce700a..c7350cb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -38,6 +38,8 @@
 
     ./services/bitwarden.nix
 
+    ./services/matrix.nix
+
     ./services/monero.nix
     ./services/xmrig.nix
 
diff --git a/flake.nix b/flake.nix
index 0123adf..f9e5f8f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -118,6 +118,8 @@
           syncthing_protocol = 22000;
           syncthing_discovery = 21027;
           minecraft = 25565;
+          matrix = 6167;
+          matrix_federation = 8448;
         };
 
         https = {
@@ -168,6 +170,11 @@
           dataDir = services_dir + "/monero";
         };
 
+        matrix = {
+          dataDir = "/var/lib/private/matrix-conduit";
+          domain = "matrix.${https.domain}";
+        };
+
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";
diff --git a/secrets/matrix_reg_token b/secrets/matrix_reg_token
new file mode 100644
index 0000000000000000000000000000000000000000..87488e9777643b7a6cb749275069f0782431bc4d
GIT binary patch
literal 87
zcmZQ@_Y83kiVO&0m@B>Ve10(Nq>w53ZX)J;fA2XVaAJv8l+bn0d)Gvw_XuveA9=WI
u=CJ_3>dcPU0c#eTrSR}Ix~<@@{=30+*5hjr_HJ*=x$jfB&}H+{cYFYT@+pM?

literal 0
HcmV?d00001

diff --git a/services/matrix.nix b/services/matrix.nix
new file mode 100644
index 0000000..41849da
--- /dev/null
+++ b/services/matrix.nix
@@ -0,0 +1,68 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "matrix-conduit" service_configs.zpool_ssds [
+      service_configs.matrix.dataDir
+    ])
+  ];
+
+  services.matrix-conduit = {
+    enable = true;
+    package = pkgs.matrix-continuwuity;
+
+    settings.global = {
+      port = service_configs.ports.matrix;
+      server_name = service_configs.https.domain;
+      database_backend = "rocksdb";
+      allow_registration = true;
+      registration_token = builtins.readFile ../secrets/matrix_reg_token;
+
+      new_user_displayname_suffix = "";
+
+      trusted_servers = [
+        "matrix.org"
+        "constellatory.net"
+        "tchncs.de"
+        "envs.net"
+      ];
+
+      # without this, conduit fails to start
+      address = "0.0.0.0";
+    };
+  };
+
+  services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
+    header /.well-known/matrix/* Content-Type application/json
+    header /.well-known/matrix/* Access-Control-Allow-Origin *
+    respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}`
+    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
+  '';
+
+  services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.matrix}
+  '';
+
+  # Exact duplicate for federation port
+  services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.matrix_federation}".extraConfig =
+    config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
+
+  systemd.tmpfiles.rules = [
+    "Z ${service_configs.matrix.dataDir} 0770 ${config.systemd.services.conduit.serviceConfig.User} ${config.systemd.services.conduit.serviceConfig.User}"
+  ];
+
+  # for federation
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.matrix_federation
+  ];
+
+  # for federation
+  networking.firewall.allowedUDPPorts = [
+    service_configs.ports.matrix_federation
+  ];
+}

From 3a5d8fd3cd105ef19e5409ff1a0559f43cb63b0c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 12:56:12 -0500
Subject: [PATCH 573/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index d77145e..998174b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1769737823,
-        "narHash": "sha256-DrBaNpZ+sJ4stXm+0nBX7zqZT9t9P22zbk6m5YhQxS4=",
+        "lastModified": 1770419512,
+        "narHash": "sha256-o8Vcdz6B6bkiGUYkZqFwH3Pv1JwZyXht3dMtS7RchIo=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "b2f45c3830aa96b7456a4c4bc327d04d7a43e1ba",
+        "rev": "2510f2cbc3ccd237f700bb213756a8f35c32d8d7",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1770064250,
-        "narHash": "sha256-3HB6gfnKZnwDoH77lnJktJtQWEZ+D35Oi53pNF6YwO4=",
+        "lastModified": 1770734117,
+        "narHash": "sha256-PNXSnK507MRj+hYMgnUR7InNJzVCmOfsjHV4YXZgpwQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "9985b98c74dcc7b1c7ccfe8693daf37caa4ed2ea",
+        "rev": "2038a9a19adb886eccba775321b055fdbdc5029d",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1770172907,
-        "narHash": "sha256-rqYl9B+4shcM5b6OYjT+qdsdQNJ7SY64/xcPIb96NzU=",
+        "lastModified": 1770520993,
+        "narHash": "sha256-ks1ZFBYlBmQ4CAM4WSmCFUtkUJzbmJ0VJH/JkKVMPqY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8958a5a4259e1aebf4916823bf463faaf2538566",
+        "rev": "b32f4325880b4fac47b8736161a8f032dd248b70",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1769302137,
-        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
+        "lastModified": 1770631810,
+        "narHash": "sha256-b7iK/x+zOXbjhRqa+XBlYla4zFvPZyU5Ln2HJkiSnzc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
+        "rev": "2889685785848de940375bf7fea5e7c5a3c8d502",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770136044,
-        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
+        "lastModified": 1770617025,
+        "narHash": "sha256-1jZvgZoAagZZB6NwGRv2T2ezPy+X6EFDsJm+YSlsvEs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
+        "rev": "2db38e08fdadcc0ce3232f7279bab59a15b94482",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770001842,
-        "narHash": "sha256-ZAyTeILfdWwDp1nuF0RK3McBduMi49qnJvrS+3Ezpac=",
+        "lastModified": 1770520253,
+        "narHash": "sha256-6rWuHgSENXKnC6HGGAdRolQrnp/8IzscDn7FQEo1uEQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5018343419ea808f8a413241381976b7e60951f2",
+        "rev": "ebb8a141f60bb0ec33836333e0ca7928a072217f",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770257911,
-        "narHash": "sha256-yCsQ6UJNWyrLc6OI41uA8R3u2z60aNYCzcVzM1AG3qY=",
+        "lastModified": 1770603164,
+        "narHash": "sha256-2jJNzobNvy307k/FJxDWR6aO6FmClILFdA78CzdW9zY=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "5086dcb3f4212c90ab0e5c30391c92116db7e035",
+        "rev": "aa7bed2868237fad33b5ba12fca8f4f7a4dc07c5",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1770246524,
-        "narHash": "sha256-ZZCgWu4ZR4p6GltHl5AWgITWm8LAXIe9z1tJ04eW8E0=",
+        "lastModified": 1770678576,
+        "narHash": "sha256-1X28j4RPLpmwztbF9+H8T5Ah/DRK9kslXdvM0t6W3YU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "4838353ac4f4fca954b9e53f28585eafe6a6943e",
+        "rev": "661532984bab7bd41430566e248fa96513673c4f",
         "type": "github"
       },
       "original": {

From ea5399eb07ae7ac00583f7eed884fab61650ffde Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 13:54:22 -0500
Subject: [PATCH 574/847] matrix: fix continuwuity module

---
 flake.nix           |  2 +-
 services/matrix.nix | 20 +++++++++-----------
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/flake.nix b/flake.nix
index f9e5f8f..c23ab0c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -171,7 +171,7 @@
         };
 
         matrix = {
-          dataDir = "/var/lib/private/matrix-conduit";
+          dataDir = "/var/lib/continuwuity";
           domain = "matrix.${https.domain}";
         };
 
diff --git a/services/matrix.nix b/services/matrix.nix
index 41849da..d8bfe34 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -1,5 +1,4 @@
 {
-  pkgs,
   config,
   service_configs,
   lib,
@@ -7,21 +6,19 @@
 }:
 {
   imports = [
-    (lib.serviceMountWithZpool "matrix-conduit" service_configs.zpool_ssds [
+    (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
       service_configs.matrix.dataDir
     ])
   ];
 
-  services.matrix-conduit = {
+  services.matrix-continuwuity = {
     enable = true;
-    package = pkgs.matrix-continuwuity;
 
     settings.global = {
-      port = service_configs.ports.matrix;
+      port = [ service_configs.ports.matrix ];
       server_name = service_configs.https.domain;
-      database_backend = "rocksdb";
       allow_registration = true;
-      registration_token = builtins.readFile ../secrets/matrix_reg_token;
+      registration_token_file = ../secrets/matrix_reg_token;
 
       new_user_displayname_suffix = "";
 
@@ -32,8 +29,9 @@
         "envs.net"
       ];
 
-      # without this, conduit fails to start
-      address = "0.0.0.0";
+      address = [
+        "0.0.0.0"
+      ];
     };
   };
 
@@ -41,7 +39,7 @@
     header /.well-known/matrix/* Content-Type application/json
     header /.well-known/matrix/* Access-Control-Allow-Origin *
     respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}`
-    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
+    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"}}`
   '';
 
   services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
@@ -53,7 +51,7 @@
     config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
 
   systemd.tmpfiles.rules = [
-    "Z ${service_configs.matrix.dataDir} 0770 ${config.systemd.services.conduit.serviceConfig.User} ${config.systemd.services.conduit.serviceConfig.User}"
+    "Z ${service_configs.matrix.dataDir} 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
   ];
 
   # for federation

From 57c0d07044b8b91c51eac78b06f4b2f86e292d2a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 13:55:45 -0500
Subject: [PATCH 575/847] matrix: disable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index c7350cb..2127958 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -38,7 +38,7 @@
 
     ./services/bitwarden.nix
 
-    ./services/matrix.nix
+    # ./services/matrix.nix
 
     ./services/monero.nix
     ./services/xmrig.nix

From 604fddefe4d188f3ac64664a0d13aedec31c2d16 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 14:08:43 -0500
Subject: [PATCH 576/847] Revert "matrix: disable"

This reverts commit a887edf510fe783bf8e333f2e18b00ac51a207fa.
---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 2127958..c7350cb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -38,7 +38,7 @@
 
     ./services/bitwarden.nix
 
-    # ./services/matrix.nix
+    ./services/matrix.nix
 
     ./services/monero.nix
     ./services/xmrig.nix

From e8793780abb7b1bd51e89c9c232a98b1d6e6746a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 14:22:53 -0500
Subject: [PATCH 577/847] matrix: fix private folder

---
 services/matrix.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index d8bfe34..aa15048 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -7,7 +7,7 @@
 {
   imports = [
     (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
-      service_configs.matrix.dataDir
+      "/var/lib/private/continuwuity"
     ])
   ];
 
@@ -51,7 +51,7 @@
     config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
 
   systemd.tmpfiles.rules = [
-    "Z ${service_configs.matrix.dataDir} 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
+    "Z /var/lib/private/continuwuity 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
   ];
 
   # for federation

From e5e27158247b621e9cb36f76949557e0e390ace5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 14:49:50 -0500
Subject: [PATCH 578/847] matrix: add coturn

---
 configuration.nix                 |   1 +
 flake.nix                         |   2 +
 secrets/coturn_static_auth_secret | Bin 0 -> 87 bytes
 services/coturn.nix               |  59 ++++++++++++++++++++++++++++++
 services/matrix.nix               |   8 ++++
 5 files changed, 70 insertions(+)
 create mode 100644 secrets/coturn_static_auth_secret
 create mode 100644 services/coturn.nix

diff --git a/configuration.nix b/configuration.nix
index c7350cb..fd649f8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -39,6 +39,7 @@
     ./services/bitwarden.nix
 
     ./services/matrix.nix
+    ./services/coturn.nix
 
     ./services/monero.nix
     ./services/xmrig.nix
diff --git a/flake.nix b/flake.nix
index c23ab0c..3dff900 100644
--- a/flake.nix
+++ b/flake.nix
@@ -120,6 +120,8 @@
           minecraft = 25565;
           matrix = 6167;
           matrix_federation = 8448;
+          coturn = 3478;
+          coturn_tls = 5349;
         };
 
         https = {
diff --git a/secrets/coturn_static_auth_secret b/secrets/coturn_static_auth_secret
new file mode 100644
index 0000000000000000000000000000000000000000..3685e68ee08f4c71d779a914a788c006671be6f8
GIT binary patch
literal 87
zcmZQ@_Y83kiVO&0ID7N=#3kJ6LG#OhF7rDj*`hl|@U&CV^!-8UjB*Z#_At53c$K6h
uec%m;{o2~XZ{}wb8dvn}xV(5xM{QI~q^6j$&AqDMu6K@F-HUR+{0{(^J}E2!

literal 0
HcmV?d00001

diff --git a/services/coturn.nix b/services/coturn.nix
new file mode 100644
index 0000000..78cc40d
--- /dev/null
+++ b/services/coturn.nix
@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  service_configs,
+  ...
+}:
+{
+  services.coturn = {
+    enable = true;
+    realm = service_configs.https.domain;
+    use-auth-secret = true;
+    static-auth-secret = lib.strings.trim (builtins.readFile ../secrets/coturn_static_auth_secret);
+    listening-port = service_configs.ports.coturn;
+    tls-listening-port = service_configs.ports.coturn_tls;
+    no-cli = true;
+
+    # recommended security settings from Synapse's coturn docs
+    extraConfig = ''
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  # coturn needs these ports open
+  networking.firewall = {
+    allowedTCPPorts = [
+      service_configs.ports.coturn
+      service_configs.ports.coturn_tls
+    ];
+    allowedUDPPorts = [
+      service_configs.ports.coturn
+      service_configs.ports.coturn_tls
+    ];
+    # relay port range
+    allowedUDPPortRanges = [
+      {
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }
+    ];
+  };
+}
diff --git a/services/matrix.nix b/services/matrix.nix
index aa15048..b2f114e 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -32,6 +32,14 @@
       address = [
         "0.0.0.0"
       ];
+
+      # TURN server config (coturn)
+      turn_secret = config.services.coturn.static-auth-secret;
+      turn_uris = [
+        "turn:${service_configs.https.domain}?transport=udp"
+        "turn:${service_configs.https.domain}?transport=tcp"
+      ];
+      turn_ttl = 86400;
     };
   };
 

From f764b1c18f78fbf636b74218b67a48e68e4a36d4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 14:49:58 -0500
Subject: [PATCH 579/847] matrix: fix registration

---
 services/matrix.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index b2f114e..8f5bb25 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -18,7 +18,7 @@
       port = [ service_configs.ports.matrix ];
       server_name = service_configs.https.domain;
       allow_registration = true;
-      registration_token_file = ../secrets/matrix_reg_token;
+      registration_token = lib.strings.trim (builtins.readFile ../secrets/matrix_reg_token);
 
       new_user_displayname_suffix = "";
 

From e05aa307ac47b4f4fac6a33674421ea91bb21200 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 17:39:01 -0500
Subject: [PATCH 580/847] ntfy

---
 configuration.nix |  2 ++
 flake.nix         |  5 +++++
 services/ntfy.nix | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 services/ntfy.nix

diff --git a/configuration.nix b/configuration.nix
index fd649f8..16b7b19 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -52,6 +52,8 @@
     ./services/ssh.nix
 
     ./services/syncthing.nix
+
+    ./services/ntfy.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/flake.nix b/flake.nix
index 3dff900..64d1cb8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -122,6 +122,7 @@
           matrix_federation = 8448;
           coturn = 3478;
           coturn_tls = 5349;
+          ntfy = 2586;
         };
 
         https = {
@@ -177,6 +178,10 @@
           domain = "matrix.${https.domain}";
         };
 
+        ntfy = {
+          domain = "ntfy.${https.domain}";
+        };
+
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";
diff --git a/services/ntfy.nix b/services/ntfy.nix
new file mode 100644
index 0000000..fbbb543
--- /dev/null
+++ b/services/ntfy.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "ntfy-sh" service_configs.zpool_ssds [
+      "/var/lib/ntfy-sh"
+    ])
+  ];
+
+  services.ntfy-sh = {
+    enable = true;
+
+    settings = {
+      base-url = "https://${service_configs.ntfy.domain}";
+      listen-http = "127.0.0.1:${builtins.toString service_configs.ports.ntfy}";
+      behind-proxy = true;
+      auth-default-access = "deny-all";
+    };
+  };
+
+  services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.ntfy}
+  '';
+
+  systemd.tmpfiles.rules = [
+    "Z /var/lib/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
+  ];
+}

From 85812b719c65f3062fdc0beb2c57aad80c2b3c1d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Feb 2026 18:47:17 -0500
Subject: [PATCH 581/847] ntfy: fix directory

---
 services/ntfy.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/services/ntfy.nix b/services/ntfy.nix
index fbbb543..84afd94 100644
--- a/services/ntfy.nix
+++ b/services/ntfy.nix
@@ -7,7 +7,7 @@
 {
   imports = [
     (lib.serviceMountWithZpool "ntfy-sh" service_configs.zpool_ssds [
-      "/var/lib/ntfy-sh"
+      "/var/lib/private/ntfy-sh"
     ])
   ];
 
@@ -19,6 +19,8 @@
       listen-http = "127.0.0.1:${builtins.toString service_configs.ports.ntfy}";
       behind-proxy = true;
       auth-default-access = "deny-all";
+      enable-login = true;
+      enable-signup = false;
     };
   };
 
@@ -27,6 +29,6 @@
   '';
 
   systemd.tmpfiles.rules = [
-    "Z /var/lib/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
+    "Z /var/lib/private/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
   ];
 }

From 1db214aee5457e3c6e9491c4069d719c7dd2bc8d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Feb 2026 15:41:30 -0500
Subject: [PATCH 582/847] impermanence: fix /etc permissions after re-deploy

---
 modules/impermanence.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 5849d47..86d36f0 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -58,7 +58,13 @@
     }
   ];
 
+  # Enforce root ownership on /persistent/etc. The impermanence activation
+  # script copies ownership from /persistent/etc to /etc via
+  # `chown --reference`. If /persistent/etc ever gets non-root ownership,
+  # sshd StrictModes rejects /etc/ssh/authorized_keys.d/root and root SSH
+  # breaks while non-root users still work.
+  # Use "z" (set ownership, non-recursive) not "d" (create only, no-op on existing).
   systemd.tmpfiles.rules = [
-    "d /etc 755 root"
+    "z /persistent/etc 0755 root root"
   ];
 }

From 9a51af6293034b9ab8d33a93222023ceb9a46aab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Feb 2026 22:14:12 -0500
Subject: [PATCH 583/847] matrix: setup livekit

Needed for element X calls.
---
 configuration.nix    |   1 +
 flake.nix            |   6 +++++
 secrets/livekit_keys | Bin 0 -> 84 bytes
 services/livekit.nix |  53 +++++++++++++++++++++++++++++++++++++++++++
 services/matrix.nix  |   2 +-
 5 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 secrets/livekit_keys
 create mode 100644 services/livekit.nix

diff --git a/configuration.nix b/configuration.nix
index 16b7b19..07a1713 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -40,6 +40,7 @@
 
     ./services/matrix.nix
     ./services/coturn.nix
+    ./services/livekit.nix
 
     ./services/monero.nix
     ./services/xmrig.nix
diff --git a/flake.nix b/flake.nix
index 64d1cb8..5d84f04 100644
--- a/flake.nix
+++ b/flake.nix
@@ -123,6 +123,8 @@
           coturn = 3478;
           coturn_tls = 5349;
           ntfy = 2586;
+          livekit = 7880;
+          lk_jwt = 8081;
         };
 
         https = {
@@ -182,6 +184,10 @@
           domain = "ntfy.${https.domain}";
         };
 
+        livekit = {
+          domain = "livekit.${https.domain}";
+        };
+
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";
diff --git a/secrets/livekit_keys b/secrets/livekit_keys
new file mode 100644
index 0000000000000000000000000000000000000000..f3bc827ba90ea1b8a4fd5f81273da7a7da4dcd21
GIT binary patch
literal 84
zcmZQ@_Y83kiVO&0P?%PBCe%M_-r<jOhXilNTvvP?y>p$+1p!U<ZMx63|J}H%9#Ffh
rYk8agmF-tUW%!F;XfS0MF!8ZlZJg#}wp03LU2@&6?wX$w7k>i){01f}

literal 0
HcmV?d00001

diff --git a/services/livekit.nix b/services/livekit.nix
new file mode 100644
index 0000000..c1579d7
--- /dev/null
+++ b/services/livekit.nix
@@ -0,0 +1,53 @@
+{
+  service_configs,
+  ...
+}:
+let
+  keyFile = ../secrets/livekit_keys;
+
+  ports = service_configs.ports;
+in
+{
+  services.livekit = {
+    enable = true;
+    inherit keyFile;
+    openFirewall = true;
+
+    settings = {
+      port = ports.livekit;
+      bind_addresses = [ "127.0.0.1" ];
+
+      rtc = {
+        port_range_start = 50100;
+        port_range_end = 50200;
+        use_external_ip = true;
+      };
+
+      # Disable LiveKit's built-in TURN; coturn is already running
+      turn = {
+        enabled = false;
+      };
+
+      logging = {
+        level = "info";
+      };
+    };
+  };
+
+  services.lk-jwt-service = {
+    enable = true;
+    inherit keyFile;
+    livekitUrl = "wss://${service_configs.livekit.domain}";
+    port = ports.lk_jwt;
+  };
+
+  services.caddy.virtualHosts."${service_configs.livekit.domain}".extraConfig = ''
+    @jwt path /sfu/get /healthz
+    handle @jwt {
+      reverse_proxy :${builtins.toString ports.lk_jwt}
+    }
+    handle {
+      reverse_proxy :${builtins.toString ports.livekit}
+    }
+  '';
+}
diff --git a/services/matrix.nix b/services/matrix.nix
index 8f5bb25..fe9b0ea 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -47,7 +47,7 @@
     header /.well-known/matrix/* Content-Type application/json
     header /.well-known/matrix/* Access-Control-Allow-Origin *
     respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}`
-    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"}}`
+    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}`
   '';
 
   services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''

From 38361ffae0b8ebdbda393838a93b15e7b2714c88 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 12 Feb 2026 12:45:28 -0500
Subject: [PATCH 584/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 998174b..2f4464e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1770520993,
-        "narHash": "sha256-ks1ZFBYlBmQ4CAM4WSmCFUtkUJzbmJ0VJH/JkKVMPqY=",
+        "lastModified": 1770864818,
+        "narHash": "sha256-VsRzFJ8+ndGgcwguZSQGHed/gragpW478qMqdNpm75k=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b32f4325880b4fac47b8736161a8f032dd248b70",
+        "rev": "ca04d472340d6a3c8fe4f4a9c0d74faad048c204",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1770631810,
-        "narHash": "sha256-b7iK/x+zOXbjhRqa+XBlYla4zFvPZyU5Ln2HJkiSnzc=",
+        "lastModified": 1770882871,
+        "narHash": "sha256-nw5g+xl3veea+maxJ2/81tMEA/rPq9aF1H5XF35X+OE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2889685785848de940375bf7fea5e7c5a3c8d502",
+        "rev": "af04cb78aa85b2a4d1c15fc7270347e0d0eda97b",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770617025,
-        "narHash": "sha256-1jZvgZoAagZZB6NwGRv2T2ezPy+X6EFDsJm+YSlsvEs=",
+        "lastModified": 1770770419,
+        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2db38e08fdadcc0ce3232f7279bab59a15b94482",
+        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770603164,
-        "narHash": "sha256-2jJNzobNvy307k/FJxDWR6aO6FmClILFdA78CzdW9zY=",
+        "lastModified": 1770891763,
+        "narHash": "sha256-Ojjyo+W6hjRwvMjqlVuUnht9HzkCDfKJUL5A9zl1KcQ=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "aa7bed2868237fad33b5ba12fca8f4f7a4dc07c5",
+        "rev": "6c9ab8473c11c6ab113aa61b86595cbd5ec8aed7",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1770678576,
-        "narHash": "sha256-1X28j4RPLpmwztbF9+H8T5Ah/DRK9kslXdvM0t6W3YU=",
+        "lastModified": 1770851384,
+        "narHash": "sha256-BWxwBWi/FZegNOSwvwjmo/7JaYppwSMLjCvEBxoL90E=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "661532984bab7bd41430566e248fa96513673c4f",
+        "rev": "c38ed0d4ce262e2dc699d15ccca260fc869452d9",
         "type": "github"
       },
       "original": {

From 0d1205210d5949efcf711b6c3b01c0d4167ee103 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 12 Feb 2026 18:48:29 -0500
Subject: [PATCH 585/847] feat(tmpfiles): defer per-service file permissions to
 reduce boot time

---
 modules/lib.nix                | 23 +++++++++++++++
 services/bitwarden.nix         |  9 +++---
 services/gitea.nix             |  8 ++---
 services/immich.nix            |  7 ++---
 services/jellyfin.nix          |  9 +++---
 services/matrix.nix            |  7 ++---
 services/minecraft.nix         |  6 ++--
 services/monero.nix            |  6 ++--
 services/ntfy.nix              |  6 ++--
 services/postgresql.nix        |  7 ++---
 services/qbittorrent.nix       | 11 ++++---
 services/soulseek.nix          | 13 ++++-----
 services/syncthing.nix         | 10 +++----
 tests/fail2ban-gitea.nix       |  4 +++
 tests/fail2ban-immich.nix      |  4 +++
 tests/fail2ban-jellyfin.nix    |  4 +++
 tests/fail2ban-vaultwarden.nix |  4 +++
 tests/file-perms.nix           | 53 ++++++++++++++++++++++++++++++++++
 tests/tests.nix                |  1 +
 19 files changed, 139 insertions(+), 53 deletions(-)
 create mode 100644 tests/file-perms.nix

diff --git a/modules/lib.nix b/modules/lib.nix
index 9497534..a248041 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -155,5 +155,28 @@ inputs.nixpkgs.lib.extend (
         #  }
         #];
       };
+
+    serviceFilePerms =
+      serviceName: tmpfilesRules:
+      { pkgs, ... }:
+      let
+        confFile = pkgs.writeText "${serviceName}-file-perms.conf" (lib.concatStringsSep "\n" tmpfilesRules);
+      in
+      {
+        systemd.services."${serviceName}-file-perms" = {
+          after = [ "${serviceName}-mounts.service" ];
+          before = [ "${serviceName}.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.systemd}/bin/systemd-tmpfiles --create ${confFile}";
+          };
+        };
+
+        systemd.services.${serviceName} = {
+          wants = [ "${serviceName}-file-perms.service" ];
+          after = [ "${serviceName}-file-perms.service" ];
+        };
+      };
   }
 )
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 85bba39..a600db9 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -15,6 +15,10 @@
       service_configs.vaultwarden.path
       config.services.vaultwarden.backupDir
     ])
+    (lib.serviceFilePerms "vaultwarden" [
+      "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
+      "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
+    ])
   ];
 
   services.vaultwarden = {
@@ -39,11 +43,6 @@
     }
   '';
 
-  systemd.tmpfiles.rules = [
-    "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
-    "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
-  ];
-
   # Protect Vaultwarden login from brute force attacks
   services.fail2ban.jails.vaultwarden = {
     enabled = true;
diff --git a/services/gitea.nix b/services/gitea.nix
index 5f938df..77a1a43 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -8,6 +8,9 @@
 {
   imports = [
     (lib.serviceMountWithZpool "gitea" service_configs.zpool_ssds [ config.services.gitea.stateDir ])
+    (lib.serviceFilePerms "gitea" [
+      "Z ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
+    ])
   ];
 
   services.gitea = {
@@ -41,11 +44,6 @@
     reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
   '';
 
-  systemd.tmpfiles.rules = [
-    # 0700 for ssh permission reasons
-    "Z ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
-  ];
-
   services.postgresql = {
     ensureDatabases = [ config.services.gitea.user ];
     ensureUsers = [
diff --git a/services/immich.nix b/services/immich.nix
index fddd106..363d09e 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -13,6 +13,9 @@
     (lib.serviceMountWithZpool "immich-machine-learning" service_configs.zpool_ssds [
       config.services.immich.mediaLocation
     ])
+    (lib.serviceFilePerms "immich-server" [
+      "Z ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
+    ])
   ];
 
   services.immich = {
@@ -30,10 +33,6 @@
     reverse_proxy :${builtins.toString config.services.immich.port}
   '';
 
-  systemd.tmpfiles.rules = [
-    "Z ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
-  ];
-
   environment.systemPackages = with pkgs; [
     immich-go
   ];
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 3e6fe6f..6761c1a 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -11,6 +11,10 @@
       config.services.jellyfin.dataDir
       config.services.jellyfin.cacheDir
     ])
+    (lib.serviceFilePerms "jellyfin" [
+      "Z ${config.services.jellyfin.dataDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+      "Z ${config.services.jellyfin.cacheDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    ])
   ];
 
   services.jellyfin = {
@@ -33,11 +37,6 @@
     }
   '';
 
-  systemd.tmpfiles.rules = [
-    "Z ${config.services.jellyfin.dataDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
-    "Z ${config.services.jellyfin.cacheDir} 0700 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
-  ];
-
   users.users.${config.services.jellyfin.user}.extraGroups = [
     "video"
     "render"
diff --git a/services/matrix.nix b/services/matrix.nix
index fe9b0ea..e1d3b17 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -9,6 +9,9 @@
     (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
       "/var/lib/private/continuwuity"
     ])
+    (lib.serviceFilePerms "continuwuity" [
+      "Z /var/lib/private/continuwuity 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
+    ])
   ];
 
   services.matrix-continuwuity = {
@@ -58,10 +61,6 @@
   services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.matrix_federation}".extraConfig =
     config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
 
-  systemd.tmpfiles.rules = [
-    "Z /var/lib/private/continuwuity 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
-  ];
-
   # for federation
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.matrix_federation
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 45de8fa..47028a1 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -15,6 +15,10 @@
       ]
     )
     inputs.nix-minecraft.nixosModules.minecraft-servers
+    (lib.serviceFilePerms "minecraft-server-${service_configs.minecraft.server_name}" [
+      "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+      "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+    ])
   ];
 
   services.minecraft-servers = {
@@ -132,10 +136,8 @@
   };
 
   systemd.tmpfiles.rules = [
-    "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     # Allow caddy (in minecraft group) to traverse to squaremap/web for map.gardling.com
     "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
-    "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
   ];
 }
diff --git a/services/monero.nix b/services/monero.nix
index 1792ecf..ce4869b 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -8,6 +8,9 @@
     (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
       service_configs.monero.dataDir
     ])
+    (lib.serviceFilePerms "monero" [
+      "Z ${service_configs.monero.dataDir} 0700 monero monero"
+    ])
   ];
 
   services.monero = {
@@ -18,7 +21,4 @@
     };
   };
 
-  systemd.tmpfiles.rules = [
-    "Z ${service_configs.monero.dataDir} 0700 monero monero"
-  ];
 }
diff --git a/services/ntfy.nix b/services/ntfy.nix
index 84afd94..3b7dd1b 100644
--- a/services/ntfy.nix
+++ b/services/ntfy.nix
@@ -9,6 +9,9 @@
     (lib.serviceMountWithZpool "ntfy-sh" service_configs.zpool_ssds [
       "/var/lib/private/ntfy-sh"
     ])
+    (lib.serviceFilePerms "ntfy-sh" [
+      "Z /var/lib/private/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
+    ])
   ];
 
   services.ntfy-sh = {
@@ -28,7 +31,4 @@
     reverse_proxy :${builtins.toString service_configs.ports.ntfy}
   '';
 
-  systemd.tmpfiles.rules = [
-    "Z /var/lib/private/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
-  ];
 }
diff --git a/services/postgresql.nix b/services/postgresql.nix
index c7a5d4b..474ebe2 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -10,6 +10,9 @@
     (lib.serviceMountWithZpool "postgresql" service_configs.zpool_ssds [
       config.services.postgresql.dataDir
     ])
+    (lib.serviceFilePerms "postgresql" [
+      "Z ${config.services.postgresql.dataDir} 0700 postgres postgres"
+    ])
   ];
 
   services.postgresql = {
@@ -18,8 +21,4 @@
     dataDir = service_configs.postgres.dataDir;
   };
 
-  systemd.tmpfiles.rules = [
-    # postgresql requires 0700
-    "Z ${config.services.postgresql.dataDir} 0700 postgresql postgresql"
-  ];
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index bcd1ebb..303f877 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -17,6 +17,11 @@
       "${config.services.qbittorrent.profileDir}/qBittorrent"
     ])
     (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
+    (lib.serviceFilePerms "qbittorrent" [
+      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+      "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+    ])
   ];
 
   services.qbittorrent = {
@@ -96,12 +101,6 @@
 
   systemd.services.qbittorrent.serviceConfig.TimeoutStopSec = lib.mkForce 10;
 
-  systemd.tmpfiles.rules = [
-    "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
-    "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
-    "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
-  ];
-
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString config.services.qbittorrent.webuiPort}
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 86a508c..f2aa999 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -16,6 +16,12 @@ in
       service_configs.slskd.downloads
       service_configs.slskd.incomplete
     ])
+    (lib.serviceFilePerms "slskd" [
+      "Z ${service_configs.music_dir} 0750 ${username} music"
+      "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
+      "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
+      "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
+    ])
   ];
 
   users.groups."music" = { };
@@ -65,13 +71,6 @@ in
   users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
   users.users.${username}.extraGroups = [ "music" ];
 
-  systemd.tmpfiles.rules = [
-    "Z ${service_configs.music_dir} 0750 ${username} music"
-    "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
-    "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
-    "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
-  ];
-
   # doesn't work with auth????
   services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
     reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
diff --git a/services/syncthing.nix b/services/syncthing.nix
index d73713a..33d03ee 100644
--- a/services/syncthing.nix
+++ b/services/syncthing.nix
@@ -12,6 +12,11 @@
       service_configs.syncthing.signalBackupDir
       service_configs.syncthing.grayjayBackupDir
     ])
+    (lib.serviceFilePerms "syncthing" [
+      "Z ${service_configs.syncthing.dataDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+      "Z ${service_configs.syncthing.signalBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+      "Z ${service_configs.syncthing.grayjayBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
+    ])
   ];
 
   services.syncthing = {
@@ -46,9 +51,4 @@
     reverse_proxy :${toString service_configs.ports.syncthing_gui}
   '';
 
-  systemd.tmpfiles.rules = [
-    "Z ${service_configs.syncthing.dataDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
-    "Z ${service_configs.syncthing.signalBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
-    "Z ${service_configs.syncthing.grayjayBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
-  ];
 }
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
index d39b9fd..c91ab0f 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban-gitea.nix
@@ -25,6 +25,10 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
+      serviceFilePerms =
+        serviceName: tmpfilesRules:
+        { ... }:
+        { };
     }
   );
 
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
index df4b8a5..7f95808 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban-immich.nix
@@ -24,6 +24,10 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
+      serviceFilePerms =
+        serviceName: tmpfilesRules:
+        { ... }:
+        { };
     }
   );
 
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 5d88a7f..82b003b 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -26,6 +26,10 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
+      serviceFilePerms =
+        serviceName: tmpfilesRules:
+        { ... }:
+        { };
       optimizePackage = pkg: pkg; # No-op for testing
     }
   );
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban-vaultwarden.nix
index dcb7749..82036be 100644
--- a/tests/fail2ban-vaultwarden.nix
+++ b/tests/fail2ban-vaultwarden.nix
@@ -24,6 +24,10 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
+      serviceFilePerms =
+        serviceName: tmpfilesRules:
+        { ... }:
+        { };
     }
   );
 
diff --git a/tests/file-perms.nix b/tests/file-perms.nix
new file mode 100644
index 0000000..dd6b3b7
--- /dev/null
+++ b/tests/file-perms.nix
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testPkgs = pkgs.appendOverlays [ (import ../modules/overlays.nix) ];
+in
+testPkgs.testers.runNixOSTest {
+  name = "file-perms test";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        (lib.serviceFilePerms "test-service" [
+          "Z /tmp/test-perms-dir 0750 nobody nogroup"
+        ])
+      ];
+
+      systemd.services."test-service" = {
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = lib.getExe pkgs.bash;
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # Create test directory with wrong permissions
+    machine.succeed("mkdir -p /tmp/test-perms-dir")
+    machine.succeed("chown root:root /tmp/test-perms-dir")
+    machine.succeed("chmod 700 /tmp/test-perms-dir")
+
+    # Start service -- this should pull in test-service-file-perms
+    machine.succeed("systemctl start test-service")
+
+    # Verify file-perms service ran and is active
+    machine.succeed("systemctl is-active test-service-file-perms.service")
+
+    # Verify permissions were fixed by tmpfiles
+    result = machine.succeed("stat -c '%U:%G' /tmp/test-perms-dir").strip()
+    assert result == "nobody:nogroup", f"Expected nobody:nogroup, got {result}"
+
+    result = machine.succeed("stat -c '%a' /tmp/test-perms-dir").strip()
+    assert result == "750", f"Expected 750, got {result}"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index fcc29e1..f7a2e93 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -12,6 +12,7 @@ in
   testTest = handleTest ./testTest.nix;
   minecraftTest = handleTest ./minecraft.nix;
   jellyfinQbittorrentMonitorTest = handleTest ./jellyfin-qbittorrent-monitor.nix;
+  filePermsTest = handleTest ./file-perms.nix;
 
   # fail2ban tests
   fail2banSshTest = handleTest ./fail2ban-ssh.nix;

From a9e8ce09d13dd8b171cda8228098346d4f3cadbf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 12 Feb 2026 18:48:41 -0500
Subject: [PATCH 586/847] fix(no-rgb): handle transient hardware unavailability
 during deploy

---
 modules/no-rgb.nix | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/modules/no-rgb.nix b/modules/no-rgb.nix
index b304ecf..9b73ee5 100644
--- a/modules/no-rgb.nix
+++ b/modules/no-rgb.nix
@@ -17,13 +17,27 @@
           ];
 
           text = ''
-            #!/bin/sh
-            set -e
+            # Retry loop to wait for hardware to be ready
+            NUM_DEVICES=0
+            for attempt in 1 2 3 4 5; do
+              DEVICE_LIST=$(openrgb --noautoconnect --list-devices 2>/dev/null) || DEVICE_LIST=""
+              NUM_DEVICES=$(echo "$DEVICE_LIST" | grep -cE '^[0-9]+: ') || NUM_DEVICES=0
+              if [ "$NUM_DEVICES" -gt 0 ]; then
+                break
+              fi
+              if [ "$attempt" -lt 5 ]; then
+                sleep 2
+              fi
+            done
 
-            NUM_DEVICES=$(openrgb --noautoconnect --list-devices | grep -cE '^[0-9]+: ')
+            # If no devices found after retries, exit gracefully
+            if [ "$NUM_DEVICES" -eq 0 ]; then
+              exit 0
+            fi
 
+            # Disable RGB on each device
             for i in $(seq 0 $((NUM_DEVICES - 1))); do
-              openrgb --noautoconnect --device "$i" --mode direct --color 000000
+              openrgb --noautoconnect --device "$i" --mode direct --color 000000 || true
             done
           '';
         }
@@ -31,9 +45,12 @@
     in
     {
       description = "disable rgb";
+      after = [ "systemd-udev-settle.service" ];
       serviceConfig = {
         ExecStart = lib.getExe no-rgb;
         Type = "oneshot";
+        Restart = "on-failure";
+        RestartSec = 5;
       };
       wantedBy = [ "multi-user.target" ];
     };

From 9bd90972450cf56250ad59ef4e6490a827c651d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 13 Feb 2026 15:25:26 -0500
Subject: [PATCH 587/847] matrix: fix elementx calls

Applies patch from: https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370
That I am working on. Also updates version to latest (at this time) git
---
 services/matrix.nix             | 26 +++++++++
 services/sliding-sync-fix.patch | 93 +++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+)
 create mode 100644 services/sliding-sync-fix.patch

diff --git a/services/matrix.nix b/services/matrix.nix
index e1d3b17..20db87b 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -1,9 +1,34 @@
 {
   config,
+  pkgs,
   service_configs,
   lib,
   ...
 }:
+let
+  package =
+    let
+      src = pkgs.fetchFromGitea {
+        domain = "forgejo.ellis.link";
+        owner = "continuwuation";
+        repo = "continuwuity";
+        rev = "89ad809270dc0dbf428858a466aa9b90e9a8dccf";
+        hash = "sha256-fXLbuCkRGYljWXbCyDvczezZ3Zo8SCPh5sx1gZChccw=";
+      };
+    in
+    pkgs.matrix-continuwuity.overrideAttrs (old: {
+      inherit src;
+      cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+        inherit src;
+        name = "${old.pname}-vendor";
+        hash = "sha256-cRdjFCxk9oYKyAOB+OaFGZzpWnyKgkdz5d5XXM/QzD4=";
+      };
+
+      patches = (old.patches or [ ]) ++ [
+        ./sliding-sync-fix.patch
+      ];
+    });
+in
 {
   imports = [
     (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
@@ -16,6 +41,7 @@
 
   services.matrix-continuwuity = {
     enable = true;
+    inherit package;
 
     settings.global = {
       port = [ service_configs.ports.matrix ];
diff --git a/services/sliding-sync-fix.patch b/services/sliding-sync-fix.patch
new file mode 100644
index 0000000..8a28a1f
--- /dev/null
+++ b/services/sliding-sync-fix.patch
@@ -0,0 +1,93 @@
+diff --git a/src/api/client/sync/v5.rs b/src/api/client/sync/v5.rs
+index 8976fd02..df2f5844 100644
+--- a/src/api/client/sync/v5.rs
++++ b/src/api/client/sync/v5.rs
+@@ -30,7 +30,8 @@
+ 	api::client::sync::sync_events::{self, DeviceLists, UnreadNotificationsCount},
+ 	directory::RoomTypeFilter,
+ 	events::{
+-		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, StateEventType, TimelineEventType,
++		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, AnySyncStateEvent, StateEventType,
++		TimelineEventType,
+ 		room::member::{MembershipState, RoomMemberEventContent},
+ 		typing::TypingEventContent,
+ 	},
+@@ -533,6 +534,9 @@ async fn process_rooms<'a, Rooms>(
+ 				}
+ 			});
+ 
++		let required_state =
++			collect_required_state(services, room_id, required_state_request).await;
++
+ 		let room_events: Vec<_> = timeline_pdus
+ 			.iter()
+ 			.stream()
+@@ -551,21 +555,6 @@ async fn process_rooms<'a, Rooms>(
+ 			}
+ 		}
+ 
+-		let required_state = required_state_request
+-			.iter()
+-			.stream()
+-			.filter_map(|state| async move {
+-				services
+-					.rooms
+-					.state_accessor
+-					.room_state_get(room_id, &state.0, &state.1)
+-					.await
+-					.map(Event::into_format)
+-					.ok()
+-			})
+-			.collect()
+-			.await;
+-
+ 		// Heroes
+ 		let heroes: Vec<_> = services
+ 			.rooms
+@@ -689,6 +678,46 @@ async fn process_rooms<'a, Rooms>(
+ 	Ok(rooms)
+ }
+ 
++/// Collect the required state events for a room
++async fn collect_required_state(
++	services: &Services,
++	room_id: &RoomId,
++	required_state_request: &BTreeSet<TypeStateKey>,
++) -> Vec<Raw<AnySyncStateEvent>> {
++	let mut required_state = Vec::new();
++	for (event_type, state_key) in required_state_request {
++		// Resolve wild-card sentinel issue
++		// Addresses: https://forgejo.ellis.link/continuwuation/continuwuity/issues/1306
++		if state_key.as_str() == "*" {
++			if let Ok(keys) = services
++				.rooms
++				.state_accessor
++				.room_state_keys(room_id, event_type)
++				.await
++			{
++				for key in keys {
++					if let Ok(event) = services
++						.rooms
++						.state_accessor
++						.room_state_get(room_id, event_type, &key)
++						.await
++					{
++						required_state.push(Event::into_format(event));
++					}
++				}
++			}
++		} else if let Ok(event) = services
++			.rooms
++			.state_accessor
++			.room_state_get(room_id, event_type, state_key)
++			.await
++		{
++			required_state.push(Event::into_format(event));
++		}
++	}
++	required_state
++}
++
+ async fn collect_typing_events(
+ 	services: &Services,
+ 	sender_user: &UserId,

From fb305cc9f492e8f872ee69994a06b0f22c996347 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 13 Feb 2026 15:26:27 -0500
Subject: [PATCH 588/847] fmt

---
 modules/lib.nix                | 4 +++-
 tests/fail2ban-gitea.nix       | 5 +----
 tests/fail2ban-immich.nix      | 5 +----
 tests/fail2ban-jellyfin.nix    | 5 +----
 tests/fail2ban-vaultwarden.nix | 5 +----
 5 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/modules/lib.nix b/modules/lib.nix
index a248041..8f36a9d 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -160,7 +160,9 @@ inputs.nixpkgs.lib.extend (
       serviceName: tmpfilesRules:
       { pkgs, ... }:
       let
-        confFile = pkgs.writeText "${serviceName}-file-perms.conf" (lib.concatStringsSep "\n" tmpfilesRules);
+        confFile = pkgs.writeText "${serviceName}-file-perms.conf" (
+          lib.concatStringsSep "\n" tmpfilesRules
+        );
       in
       {
         systemd.services."${serviceName}-file-perms" = {
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
index c91ab0f..82b3595 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban-gitea.nix
@@ -25,10 +25,7 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
-      serviceFilePerms =
-        serviceName: tmpfilesRules:
-        { ... }:
-        { };
+      serviceFilePerms = serviceName: tmpfilesRules: { ... }: { };
     }
   );
 
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
index 7f95808..64052d5 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban-immich.nix
@@ -24,10 +24,7 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
-      serviceFilePerms =
-        serviceName: tmpfilesRules:
-        { ... }:
-        { };
+      serviceFilePerms = serviceName: tmpfilesRules: { ... }: { };
     }
   );
 
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 82b003b..8c1d53e 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -26,10 +26,7 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
-      serviceFilePerms =
-        serviceName: tmpfilesRules:
-        { ... }:
-        { };
+      serviceFilePerms = serviceName: tmpfilesRules: { ... }: { };
       optimizePackage = pkg: pkg; # No-op for testing
     }
   );
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban-vaultwarden.nix
index 82036be..fc871f2 100644
--- a/tests/fail2ban-vaultwarden.nix
+++ b/tests/fail2ban-vaultwarden.nix
@@ -24,10 +24,7 @@ let
         serviceName: zpool: dirs:
         { ... }:
         { };
-      serviceFilePerms =
-        serviceName: tmpfilesRules:
-        { ... }:
-        { };
+      serviceFilePerms = serviceName: tmpfilesRules: { ... }: { };
     }
   );
 

From 18aba0319856af892880b25909510c574db4cd20 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 14 Feb 2026 22:49:50 -0500
Subject: [PATCH 589/847] matrix: update

---
 services/matrix.nix             |  6 +--
 services/sliding-sync-fix.patch | 93 ---------------------------------
 2 files changed, 3 insertions(+), 96 deletions(-)
 delete mode 100644 services/sliding-sync-fix.patch

diff --git a/services/matrix.nix b/services/matrix.nix
index 20db87b..e0fe7ea 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "89ad809270dc0dbf428858a466aa9b90e9a8dccf";
-        hash = "sha256-fXLbuCkRGYljWXbCyDvczezZ3Zo8SCPh5sx1gZChccw=";
+        rev = "57b21c1b322bd6ab9650c04e9b5d81932b9e35c3";
+        hash = "sha256-ehrRlx15Of2XVPC6kNFx/f9lpn0SHkbtqkNZAskOv18=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {
@@ -25,7 +25,7 @@ let
       };
 
       patches = (old.patches or [ ]) ++ [
-        ./sliding-sync-fix.patch
+
       ];
     });
 in
diff --git a/services/sliding-sync-fix.patch b/services/sliding-sync-fix.patch
deleted file mode 100644
index 8a28a1f..0000000
--- a/services/sliding-sync-fix.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-diff --git a/src/api/client/sync/v5.rs b/src/api/client/sync/v5.rs
-index 8976fd02..df2f5844 100644
---- a/src/api/client/sync/v5.rs
-+++ b/src/api/client/sync/v5.rs
-@@ -30,7 +30,8 @@
- 	api::client::sync::sync_events::{self, DeviceLists, UnreadNotificationsCount},
- 	directory::RoomTypeFilter,
- 	events::{
--		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, StateEventType, TimelineEventType,
-+		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, AnySyncStateEvent, StateEventType,
-+		TimelineEventType,
- 		room::member::{MembershipState, RoomMemberEventContent},
- 		typing::TypingEventContent,
- 	},
-@@ -533,6 +534,9 @@ async fn process_rooms<'a, Rooms>(
- 				}
- 			});
- 
-+		let required_state =
-+			collect_required_state(services, room_id, required_state_request).await;
-+
- 		let room_events: Vec<_> = timeline_pdus
- 			.iter()
- 			.stream()
-@@ -551,21 +555,6 @@ async fn process_rooms<'a, Rooms>(
- 			}
- 		}
- 
--		let required_state = required_state_request
--			.iter()
--			.stream()
--			.filter_map(|state| async move {
--				services
--					.rooms
--					.state_accessor
--					.room_state_get(room_id, &state.0, &state.1)
--					.await
--					.map(Event::into_format)
--					.ok()
--			})
--			.collect()
--			.await;
--
- 		// Heroes
- 		let heroes: Vec<_> = services
- 			.rooms
-@@ -689,6 +678,46 @@ async fn process_rooms<'a, Rooms>(
- 	Ok(rooms)
- }
- 
-+/// Collect the required state events for a room
-+async fn collect_required_state(
-+	services: &Services,
-+	room_id: &RoomId,
-+	required_state_request: &BTreeSet<TypeStateKey>,
-+) -> Vec<Raw<AnySyncStateEvent>> {
-+	let mut required_state = Vec::new();
-+	for (event_type, state_key) in required_state_request {
-+		// Resolve wild-card sentinel issue
-+		// Addresses: https://forgejo.ellis.link/continuwuation/continuwuity/issues/1306
-+		if state_key.as_str() == "*" {
-+			if let Ok(keys) = services
-+				.rooms
-+				.state_accessor
-+				.room_state_keys(room_id, event_type)
-+				.await
-+			{
-+				for key in keys {
-+					if let Ok(event) = services
-+						.rooms
-+						.state_accessor
-+						.room_state_get(room_id, event_type, &key)
-+						.await
-+					{
-+						required_state.push(Event::into_format(event));
-+					}
-+				}
-+			}
-+		} else if let Ok(event) = services
-+			.rooms
-+			.state_accessor
-+			.room_state_get(room_id, event_type, state_key)
-+			.await
-+		{
-+			required_state.push(Event::into_format(event));
-+		}
-+	}
-+	required_state
-+}
-+
- async fn collect_typing_events(
- 	services: &Services,
- 	sender_user: &UserId,

From 6125bba4c9ee6900b963437dbe3194f02a67f5c4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 14 Feb 2026 22:50:45 -0500
Subject: [PATCH 590/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2f4464e..956f104 100644
--- a/flake.lock
+++ b/flake.lock
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770770419,
-        "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=",
+        "lastModified": 1771043024,
+        "narHash": "sha256-O1XDr7EWbRp+kHrNNgLWgIrB0/US5wvw9K6RERWAj6I=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a",
+        "rev": "3aadb7ca9eac2891d52a9dec199d9580a6e2bf44",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1770851384,
-        "narHash": "sha256-BWxwBWi/FZegNOSwvwjmo/7JaYppwSMLjCvEBxoL90E=",
+        "lastModified": 1771110581,
+        "narHash": "sha256-+mY1FxEjjrbmrmVIlSoD9D9kzjGYx2g64RfgHr4UNIA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "c38ed0d4ce262e2dc699d15ccca260fc869452d9",
+        "rev": "1ff36864c5130200f1783982d6743042f01fde73",
         "type": "github"
       },
       "original": {

From a755f6a96b892e8fa6eed550c32339505724204f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Feb 2026 11:51:38 -0500
Subject: [PATCH 591/847] matrix: update

---
 services/matrix.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index e0fe7ea..02025f9 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "57b21c1b322bd6ab9650c04e9b5d81932b9e35c3";
-        hash = "sha256-ehrRlx15Of2XVPC6kNFx/f9lpn0SHkbtqkNZAskOv18=";
+        rev = "082c44f3556e4e939c31cb66dda261af4f70bea8";
+        hash = "sha256-v7W6ZqSYB2TSkRj6Hte/UxBTCad94b+uzpROQ9jlwdQ=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {
@@ -21,7 +21,7 @@ let
       cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
         inherit src;
         name = "${old.pname}-vendor";
-        hash = "sha256-cRdjFCxk9oYKyAOB+OaFGZzpWnyKgkdz5d5XXM/QzD4=";
+        hash = "sha256-Ib4yAT0Ncch8QT8CioF9s3fN34E50ZhbcX7m0lgwJkI=";
       };
 
       patches = (old.patches or [ ]) ++ [

From a8905082671b0c66efa092bf79ec75154d6c85c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Feb 2026 23:33:45 -0500
Subject: [PATCH 592/847] jellyfin-qbittorrent-monitor: dynamic bandwidth
 management

---
 services/jellyfin-qbittorrent-monitor.nix |   5 +
 services/jellyfin-qbittorrent-monitor.py  | 200 +++++++++++++++++++---
 tests/jellyfin-qbittorrent-monitor.nix    | 188 ++++++++++++++++++++
 3 files changed, 370 insertions(+), 23 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index c1f89cc..68ab406 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -46,6 +46,11 @@
       JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
       QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.torrent}";
       CHECK_INTERVAL = "30";
+      # Bandwidth budget configuration
+      TOTAL_BANDWIDTH_BUDGET = "30000000"; # 30 Mbps in bits per second
+      SERVICE_BUFFER = "5000000"; # 5 Mbps reserved for other services (bps)
+      DEFAULT_STREAM_BITRATE = "10000000"; # 10 Mbps fallback when bitrate unknown (bps)
+      MIN_TORRENT_SPEED = "100"; # KB/s - below this, pause torrents instead
     };
   };
 }
diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 39de95b..99f3205 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -29,13 +29,23 @@ class JellyfinQBittorrentMonitor:
         jellyfin_api_key=None,
         streaming_start_delay=10,
         streaming_stop_delay=60,
+        total_bandwidth_budget=30000000,
+        service_buffer=5000000,
+        default_stream_bitrate=10000000,
+        min_torrent_speed=100,
     ):
         self.jellyfin_url = jellyfin_url
         self.qbittorrent_url = qbittorrent_url
         self.check_interval = check_interval
         self.jellyfin_api_key = jellyfin_api_key
+        self.total_bandwidth_budget = total_bandwidth_budget
+        self.service_buffer = service_buffer
+        self.default_stream_bitrate = default_stream_bitrate
+        self.min_torrent_speed = min_torrent_speed
         self.last_streaming_state = None
-        self.throttle_active = False
+        self.current_state = "unlimited"
+        self.torrents_paused = False
+        self.last_alt_limits = None
         self.running = True
         self.session = requests.Session()  # Use session for cookies
         self.last_active_streams = []
@@ -70,7 +80,7 @@ class JellyfinQBittorrentMonitor:
         self.restore_normal_limits()
         sys.exit(0)
 
-    def check_jellyfin_sessions(self) -> list[str]:
+    def check_jellyfin_sessions(self) -> list[dict]:
         headers = (
             {"X-Emby-Token": self.jellyfin_api_key} if self.jellyfin_api_key else {}
         )
@@ -101,7 +111,20 @@ class JellyfinQBittorrentMonitor:
                 item_type = item.get("Type", "").lower()
                 if item_type in ["movie", "episode", "video"]:
                     user = session.get("UserName", "Unknown")
-                    active_streams.append(f"{user}: {item.get('Name', 'Unknown')}")
+                    stream_name = f"{user}: {item.get('Name', 'Unknown')}"
+                    if session.get("TranscodingInfo") and session[
+                        "TranscodingInfo"
+                    ].get("Bitrate"):
+                        bitrate = session["TranscodingInfo"]["Bitrate"]
+                    elif item.get("Bitrate"):
+                        bitrate = item["Bitrate"]
+                    elif item.get("MediaSources", [{}])[0].get("Bitrate"):
+                        bitrate = item["MediaSources"][0]["Bitrate"]
+                    else:
+                        bitrate = self.default_stream_bitrate
+
+                    bitrate = min(int(bitrate), 100_000_000)
+                    active_streams.append({"name": stream_name, "bitrate_bps": bitrate})
 
         return active_streams
 
@@ -139,9 +162,6 @@ class JellyfinQBittorrentMonitor:
                 timeout=10,
             )
             response.raise_for_status()
-
-            self.throttle_active = enable
-
             new_state = self.check_qbittorrent_alternate_limits()
             if new_state == enable:
                 logger.info(f"Alternate speed limits {action}")
@@ -157,19 +177,76 @@ class JellyfinQBittorrentMonitor:
         except requests.exceptions.RequestException as e:
             logger.error(f"Failed to {action} alternate speed limits: {e}")
 
+    def pause_all_torrents(self) -> None:
+        try:
+            response = self.session.post(
+                f"{self.qbittorrent_url}/api/v2/torrents/stop",
+                data={"hashes": "all"},
+                timeout=10,
+            )
+            response.raise_for_status()
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Failed to pause torrents: {e}")
+
+    def resume_all_torrents(self) -> None:
+        try:
+            response = self.session.post(
+                f"{self.qbittorrent_url}/api/v2/torrents/start",
+                data={"hashes": "all"},
+                timeout=10,
+            )
+            response.raise_for_status()
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Failed to resume torrents: {e}")
+
+    def set_alt_speed_limits(self, dl_kbs: float, ul_kbs: float) -> None:
+        try:
+            payload = {
+                "alt_dl_limit": int(dl_kbs * 1024),
+                "alt_up_limit": int(ul_kbs * 1024),
+            }
+            response = self.session.post(
+                f"{self.qbittorrent_url}/api/v2/app/setPreferences",
+                data={"json": json.dumps(payload)},
+                timeout=10,
+            )
+            response.raise_for_status()
+            self.last_alt_limits = (dl_kbs, ul_kbs)
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Failed to set alternate speed limits: {e}")
+
     def restore_normal_limits(self) -> None:
-        if self.throttle_active:
+        if self.torrents_paused:
+            logger.info("Resuming all torrents before shutdown...")
+            self.resume_all_torrents()
+            self.torrents_paused = False
+
+        if self.current_state != "unlimited":
             logger.info("Restoring normal speed limits before shutdown...")
-            self.use_alt_limits(False)
+        self.use_alt_limits(False)
+        self.current_state = "unlimited"
 
     def sync_qbittorrent_state(self) -> None:
         try:
-            actual_state = self.check_qbittorrent_alternate_limits()
-            if actual_state != self.throttle_active:
-                logger.warning(
-                    f"qBittorrent state mismatch detected: expected {self.throttle_active}, got {actual_state}. Re-syncing..."
-                )
-                self.use_alt_limits(self.throttle_active)
+            if self.current_state == "unlimited":
+                actual_state = self.check_qbittorrent_alternate_limits()
+                if actual_state:
+                    logger.warning(
+                        "qBittorrent state mismatch detected: expected alt speed OFF, got ON. Re-syncing..."
+                    )
+                    self.use_alt_limits(False)
+            elif self.current_state == "throttled":
+                if self.last_alt_limits:
+                    self.set_alt_speed_limits(*self.last_alt_limits)
+                actual_state = self.check_qbittorrent_alternate_limits()
+                if not actual_state:
+                    logger.warning(
+                        "qBittorrent state mismatch detected: expected alt speed ON, got OFF. Re-syncing..."
+                    )
+                    self.use_alt_limits(True)
+            elif self.current_state == "paused":
+                self.pause_all_torrents()
+                self.torrents_paused = True
         except ServiceUnavailable:
             pass
 
@@ -182,7 +259,6 @@ class JellyfinQBittorrentMonitor:
 
         time_since_change = now - self.last_state_change
 
-        # Start throttling (streaming started)
         if new_streaming_state and not self.last_streaming_state:
             if time_since_change >= self.streaming_start_delay:
                 self.last_state_change = now
@@ -190,10 +266,9 @@ class JellyfinQBittorrentMonitor:
             else:
                 remaining = self.streaming_start_delay - time_since_change
                 logger.info(
-                    f"Streaming started - waiting {remaining:.1f}s before enabling throttling"
+                    f"Streaming started - waiting {remaining:.1f}s before enforcing limits"
                 )
 
-        # Stop throttling (streaming stopped)
         elif not new_streaming_state and self.last_streaming_state:
             if time_since_change >= self.streaming_stop_delay:
                 self.last_state_change = now
@@ -201,7 +276,7 @@ class JellyfinQBittorrentMonitor:
             else:
                 remaining = self.streaming_stop_delay - time_since_change
                 logger.info(
-                    f"Streaming stopped - waiting {remaining:.1f}s before disabling throttling"
+                    f"Streaming stopped - waiting {remaining:.1f}s before restoring unlimited mode"
                 )
 
         return False
@@ -211,6 +286,12 @@ class JellyfinQBittorrentMonitor:
         logger.info(f"Jellyfin URL: {self.jellyfin_url}")
         logger.info(f"qBittorrent URL: {self.qbittorrent_url}")
         logger.info(f"Check interval: {self.check_interval}s")
+        logger.info(f"Streaming start delay: {self.streaming_start_delay}s")
+        logger.info(f"Streaming stop delay: {self.streaming_stop_delay}s")
+        logger.info(f"Total bandwidth budget: {self.total_bandwidth_budget} bps")
+        logger.info(f"Service buffer: {self.service_buffer} bps")
+        logger.info(f"Default stream bitrate: {self.default_stream_bitrate} bps")
+        logger.info(f"Minimum torrent speed: {self.min_torrent_speed} KB/s")
 
         signal.signal(signal.SIGINT, self.signal_handler)
         signal.signal(signal.SIGTERM, self.signal_handler)
@@ -222,26 +303,91 @@ class JellyfinQBittorrentMonitor:
                 try:
                     active_streams = self.check_jellyfin_sessions()
                 except ServiceUnavailable:
-                    logger.warning(
-                        "Jellyfin unavailable, maintaining current throttle state"
-                    )
+                    logger.warning("Jellyfin unavailable, maintaining current state")
                     time.sleep(self.check_interval)
                     continue
 
                 streaming_active = len(active_streams) > 0
 
+                if active_streams:
+                    for stream in active_streams:
+                        logger.debug(
+                            f"Active stream: {stream['name']} ({stream['bitrate_bps']} bps)"
+                        )
+
                 if active_streams != self.last_active_streams:
                     if streaming_active:
+                        stream_names = ", ".join(
+                            stream["name"] for stream in active_streams
+                        )
                         logger.info(
-                            f"Active streams ({len(active_streams)}): {', '.join(active_streams)}"
+                            f"Active streams ({len(active_streams)}): {stream_names}"
                         )
                     elif len(active_streams) == 0 and self.last_streaming_state:
                         logger.info("No active streaming sessions")
 
                 if self.should_change_state(streaming_active):
                     self.last_streaming_state = streaming_active
-                    self.use_alt_limits(streaming_active)
 
+                streaming_state = bool(self.last_streaming_state)
+                total_streaming_bps = sum(
+                    stream["bitrate_bps"] for stream in active_streams
+                )
+                remaining_bps = (
+                    self.total_bandwidth_budget
+                    - self.service_buffer
+                    - total_streaming_bps
+                )
+                remaining_kbs = max(0, remaining_bps) / 8 / 1024
+
+                if not streaming_state:
+                    desired_state = "unlimited"
+                elif streaming_active:
+                    if remaining_kbs >= self.min_torrent_speed:
+                        desired_state = "throttled"
+                    else:
+                        desired_state = "paused"
+                else:
+                    desired_state = self.current_state
+
+                if desired_state != self.current_state:
+                    if desired_state == "unlimited":
+                        action = "resume torrents, disable alt speed"
+                    elif desired_state == "throttled":
+                        action = (
+                            "set alt limits "
+                            f"dl={int(remaining_kbs)}KB/s ul=1KB/s, enable alt speed"
+                        )
+                    else:
+                        action = "pause torrents"
+
+                    logger.info(
+                        "State change %s -> %s | streams=%d total_bps=%d remaining_bps=%d action=%s",
+                        self.current_state,
+                        desired_state,
+                        len(active_streams),
+                        total_streaming_bps,
+                        remaining_bps,
+                        action,
+                    )
+
+                if desired_state == "unlimited":
+                    if self.torrents_paused:
+                        self.resume_all_torrents()
+                        self.torrents_paused = False
+                    self.use_alt_limits(False)
+                elif desired_state == "throttled":
+                    if self.torrents_paused:
+                        self.resume_all_torrents()
+                        self.torrents_paused = False
+                    self.set_alt_speed_limits(remaining_kbs, 1)
+                    self.use_alt_limits(True)
+                else:
+                    if not self.torrents_paused:
+                        self.pause_all_torrents()
+                        self.torrents_paused = True
+
+                self.current_state = desired_state
                 self.last_active_streams = active_streams
                 time.sleep(self.check_interval)
 
@@ -265,6 +411,10 @@ if __name__ == "__main__":
     jellyfin_api_key = os.getenv("JELLYFIN_API_KEY")
     streaming_start_delay = int(os.getenv("STREAMING_START_DELAY", "10"))
     streaming_stop_delay = int(os.getenv("STREAMING_STOP_DELAY", "60"))
+    total_bandwidth_budget = int(os.getenv("TOTAL_BANDWIDTH_BUDGET", "30000000"))
+    service_buffer = int(os.getenv("SERVICE_BUFFER", "5000000"))
+    default_stream_bitrate = int(os.getenv("DEFAULT_STREAM_BITRATE", "10000000"))
+    min_torrent_speed = int(os.getenv("MIN_TORRENT_SPEED", "100"))
 
     monitor = JellyfinQBittorrentMonitor(
         jellyfin_url=jellyfin_url,
@@ -273,6 +423,10 @@ if __name__ == "__main__":
         jellyfin_api_key=jellyfin_api_key,
         streaming_start_delay=streaming_start_delay,
         streaming_stop_delay=streaming_stop_delay,
+        total_bandwidth_budget=total_bandwidth_budget,
+        service_buffer=service_buffer,
+        default_stream_bitrate=default_stream_bitrate,
+        min_torrent_speed=min_torrent_speed,
     )
 
     monitor.run()
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 45dee94..eb5a474 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -123,6 +123,20 @@ pkgs.testers.runNixOSTest {
     def is_throttled():
         return server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode").strip() == "1"
 
+    def get_alt_dl_limit():
+        prefs = json.loads(server.succeed("curl -s http://localhost:8080/api/v2/app/preferences"))
+        return prefs["alt_dl_limit"]
+
+    def get_alt_up_limit():
+        prefs = json.loads(server.succeed("curl -s http://localhost:8080/api/v2/app/preferences"))
+        return prefs["alt_up_limit"]
+
+    def are_torrents_paused():
+        torrents = json.loads(server.succeed("curl -s 'http://localhost:8080/api/v2/torrents/info'"))
+        if not torrents:
+            return False
+        return all(t["state"].startswith("stopped") for t in torrents)
+
     movie_id: str = ""
     media_source_id: str = ""
 
@@ -186,12 +200,17 @@ pkgs.testers.runNixOSTest {
             --setenv=CHECK_INTERVAL=1 \
             --setenv=STREAMING_START_DELAY=1 \
             --setenv=STREAMING_STOP_DELAY=1 \
+            --setenv=TOTAL_BANDWIDTH_BUDGET=50000000 \
+            --setenv=SERVICE_BUFFER=2000000 \
+            --setenv=DEFAULT_STREAM_BITRATE=10000000 \
+            --setenv=MIN_TORRENT_SPEED=100 \
             {python} {monitor}
         """)
         time.sleep(2)
         assert not is_throttled(), "Should start unthrottled"
 
     client_auth = 'MediaBrowser Client="External Client", DeviceId="external-9999", Device="ExternalDevice", Version="1.0"'
+    client_auth2 = 'MediaBrowser Client="External Client 2", DeviceId="external-8888", Device="ExternalDevice2", Version="1.0"'
     server_ip = "192.168.1.1"
 
     with subtest("Client authenticates from external network"):
@@ -199,6 +218,11 @@ pkgs.testers.runNixOSTest {
         client_auth_result = json.loads(client.succeed(auth_cmd))
         client_token = client_auth_result["AccessToken"]
 
+    with subtest("Second client authenticates from external network"):
+        auth_cmd2 = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+        client_auth_result2 = json.loads(client.succeed(auth_cmd2))
+        client_token2 = client_auth_result2["AccessToken"]
+
     with subtest("External video playback triggers throttling"):
         playback_start = {
             "ItemId": movie_id,
@@ -248,6 +272,162 @@ pkgs.testers.runNixOSTest {
 
         assert not is_throttled(), "Should unthrottle when playback stops"
 
+    with subtest("Single stream sets proportional alt speed limits"):
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-proportional",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(3)
+
+        assert is_throttled(), "Should be in alt speed mode during streaming"
+        dl_limit = get_alt_dl_limit()
+        ul_limit = get_alt_up_limit()
+        # Upload should be minimal (1 KB/s = 1024 bytes/s)
+        assert ul_limit == 1024, f"Upload limit should be 1024 bytes/s, got {ul_limit}"
+        # Download limit should be > 0 (budget not exhausted for a single stream)
+        assert dl_limit > 0, f"Download limit should be > 0, got {dl_limit}"
+
+        # Stop playback
+        playback_stop = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-proportional",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(playback_stop)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd)
+        time.sleep(3)
+
+    with subtest("Multiple streams reduce available bandwidth"):
+        # Start first stream
+        playback1 = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-multi-1",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd1 = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback1)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd1)
+        time.sleep(3)
+
+        single_dl_limit = get_alt_dl_limit()
+
+        # Start second stream with different client identity
+        playback2 = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-multi-2",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd2 = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback2)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}, Token={client_token2}'"
+        client.succeed(start_cmd2)
+        time.sleep(3)
+
+        dual_dl_limit = get_alt_dl_limit()
+        # Two streams should leave less bandwidth than one stream
+        assert dual_dl_limit < single_dl_limit, f"Two streams ({dual_dl_limit}) should have lower limit than one ({single_dl_limit})"
+
+        # Stop both streams
+        stop1 = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-multi-1",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd1 = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(stop1)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd1)
+
+        stop2 = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-multi-2",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd2 = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(stop2)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}, Token={client_token2}'"
+        client.succeed(stop_cmd2)
+        time.sleep(3)
+
+    with subtest("Budget exhaustion pauses all torrents"):
+        # Stop current monitor
+        server.succeed("systemctl stop monitor-test || true")
+        time.sleep(1)
+
+        # Add a dummy torrent so we can check pause state
+        server.succeed("curl -sf -X POST 'http://localhost:8080/api/v2/torrents/add' -d 'urls=magnet:?xt=urn:btih:0000000000000000000000000000000000000001%26dn=test-torrent'")
+        time.sleep(2)
+
+        # Start monitor with impossibly low budget
+        server.succeed(f"""
+          systemd-run --unit=monitor-exhaust \
+            --setenv=JELLYFIN_URL=http://localhost:8096 \
+            --setenv=JELLYFIN_API_KEY={token} \
+            --setenv=QBITTORRENT_URL=http://localhost:8080 \
+            --setenv=CHECK_INTERVAL=1 \
+            --setenv=STREAMING_START_DELAY=1 \
+            --setenv=STREAMING_STOP_DELAY=1 \
+            --setenv=TOTAL_BANDWIDTH_BUDGET=1000 \
+            --setenv=SERVICE_BUFFER=500 \
+            --setenv=DEFAULT_STREAM_BITRATE=10000000 \
+            --setenv=MIN_TORRENT_SPEED=100 \
+            {python} {monitor}
+        """)
+        time.sleep(2)
+
+        # Start a stream - this will exceed the tiny budget
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-exhaust",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        time.sleep(3)
+
+        assert are_torrents_paused(), "Torrents should be paused when budget is exhausted"
+
+    with subtest("Recovery from pause restores unlimited"):
+        # Stop the stream
+        playback_stop = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-session-exhaust",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(playback_stop)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd)
+        time.sleep(3)
+
+        assert not is_throttled(), "Should return to unlimited after streams stop"
+        assert not are_torrents_paused(), "Torrents should be resumed after streams stop"
+
+        # Clean up: stop exhaust monitor, restart normal monitor
+        server.succeed("systemctl stop monitor-exhaust || true")
+        time.sleep(1)
+        server.succeed(f"""
+          systemd-run --unit=monitor-test \
+            --setenv=JELLYFIN_URL=http://localhost:8096 \
+            --setenv=JELLYFIN_API_KEY={token} \
+            --setenv=QBITTORRENT_URL=http://localhost:8080 \
+            --setenv=CHECK_INTERVAL=1 \
+            --setenv=STREAMING_START_DELAY=1 \
+            --setenv=STREAMING_STOP_DELAY=1 \
+            --setenv=TOTAL_BANDWIDTH_BUDGET=50000000 \
+            --setenv=SERVICE_BUFFER=2000000 \
+            --setenv=DEFAULT_STREAM_BITRATE=10000000 \
+            --setenv=MIN_TORRENT_SPEED=100 \
+            {python} {monitor}
+        """)
+        time.sleep(2)
+
     with subtest("Local playback does NOT trigger throttling"):
         local_auth = 'MediaBrowser Client="Local Client", DeviceId="local-1111", Device="LocalDevice", Version="1.0"'
         local_auth_result = json.loads(server.succeed(
@@ -351,6 +531,10 @@ pkgs.testers.runNixOSTest {
             f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
         ))
         client_token = client_auth_result["AccessToken"]
+        client_auth_result2 = json.loads(client.succeed(
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+        ))
+        client_token2 = client_auth_result2["AccessToken"]
 
         # No active streams after Jellyfin restart, should eventually unthrottle
         time.sleep(3)
@@ -362,6 +546,10 @@ pkgs.testers.runNixOSTest {
             f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
         ))
         client_token = client_auth_result["AccessToken"]
+        client_auth_result2 = json.loads(client.succeed(
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+        ))
+        client_token2 = client_auth_result2["AccessToken"]
 
         # Start playback
         playback_start = {

From 7eda9035951b3885aea5cbb339a5fcd8f89810af Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 16 Feb 2026 21:57:49 -0500
Subject: [PATCH 593/847] minecraft: update mods

---
 services/minecraft.nix | 37 ++++++++++++++++---------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 47028a1..78eefa9 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -57,23 +57,23 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/KhCFoeip/fabric-api-0.139.5%2B1.21.11.jar";
-              sha512 = "852c9e76175b2d51cea191bfcc0005b824de433f1a6de01d672b9e82ca1cab8478b180670bc6c4811744ef4abec8bd2ff3ab0f9c1aa5644713d06f3fbcc278f0";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/i5tSkVBH/fabric-api-0.141.3%2B1.21.11.jar";
+              sha512 = "c20c017e23d6d2774690d0dd774cec84c16bfac5461da2d9345a1cd95eee495b1954333c421e3d1c66186284d24a433f6b0cced8021f62e0bfa617d2384d0471";
             };
 
             FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/eRLwt73x/ferritecore-8.0.3-fabric.jar";
-              sha512 = "be600543e499b59286f9409f46497570adc51939ae63eaa12ac29e6778da27d8c7c6cd0b3340d8bcca1cc99ce61779b1a8f52b990f9e4e9a93aa9c6482905231";
+              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/Ii0gP3D8/ferritecore-8.2.0-fabric.jar";
+              sha512 = "3210926a82eb32efd9bcebabe2f6c053daf5c4337eebc6d5bacba96d283510afbde646e7e195751de795ec70a2ea44fef77cb54bf22c8e57bb832d6217418869";
             };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/4DdLmtyz/lithium-fabric-0.21.1%2Bmc1.21.11.jar";
-              sha512 = "0857d30d063dc704a264b2fe774a7e641926193cfdcde72fe2cd603043d8548045b955e30c05b1b2b96ef7d1c0f85d55269da26f44a0644c984b45623e976794";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/qvNsoO3l/lithium-fabric-0.21.3%2Bmc1.21.11.jar";
+              sha512 = "2883739303f0bb602d3797cc601ed86ce6833e5ec313ddce675f3d6af3ee6a40b9b0a06dafe39d308d919669325e95c0aafd08d78c97acd976efde899c7810fd";
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/78RjC1gi/NoChatReports-FABRIC-1.21.10-v2.16.0.jar";
-              sha512 = "39b2f284f73f8290012b8b9cc70085d59668547fc7b4ec43ab34e4bca6b39a6691fbe32bc3326e40353ba9c16a06320e52818315be77799a5aad526370cbc773";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/rhykGstm/NoChatReports-FABRIC-1.21.11-v2.18.0.jar";
+              sha512 = "d2c35cc8d624616f441665aff67c0e366e4101dba243bad25ed3518170942c1a3c1a477b28805cd1a36c44513693b1c55e76bea627d3fced13927a3d67022ccc";
             };
 
             squaremap = fetchurl {
@@ -96,25 +96,20 @@
               sha512 = "4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab";
             };
 
-            /*
-              better-fabric-console = fetchurl {
-                url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/fZprQjU4/better-fabric-console-mc1.21.10-1.2.7.jar";
-                sha512 = "0321e4a687ba5ed4dcb081aa48909d45c4e153f8b6217cd807f280f33250151b97ac80a122a83d48535c788d3c1e08a7ee882da3b20cf06021e03c1ddc943278";
-              };
-            */
+            better-fabric-console = fetchurl {
+              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/6aIKl5wy/better-fabric-console-mc1.21.11-1.2.9.jar";
+              sha512 = "427247dafd99df202ee10b4bf60ffcbbecbabfadb01c167097ffb5b85670edb811f4d061c2551be816295cbbc6b8ec5ec464c14a6ff41912ef1f6c57b038d320";
+            };
 
             disconnect-packet-fix = fetchurl {
               url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
               sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
             };
 
-            # Mixin apply for mod packetfixer failed
-            /*
-              packet-fixer = fetchurl {
-                url = "https://cdn.modrinth.com/data/c7m1mi73/versions/LFMYVIc7/packetfixer-fabric-3.3.2-1.21.11.jar";
-                sha512 = "a7cdc4b81653ca7c823c91ffd29092365feff78b8d8e019f35ab6c47a0f18661768656cc5fe73f802ab7097d828d8173cc23d32b454a7acd64ff6b7118789413";
-              };
-            */
+            packet-fixer = fetchurl {
+              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/CUh1DWeO/packetfixer-fabric-3.3.4-1.21.11.jar";
+              sha512 = "33331b16cb40c5e6fbaade3cacc26f3a0e8fa5805a7186f94d7366a0e14dbeee9de2d2e8c76fa71f5e9dd24eb1c261667c35447e32570ea965ca0f154fdfba0a";
+            };
           }
         );
       };

From 2ee0d04464ece5246996deb155a2efea1d248aca Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Feb 2026 00:27:56 -0500
Subject: [PATCH 594/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 956f104..916d63b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769524058,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "lastModified": 1771271879,
+        "narHash": "sha256-Vn32sMuvV35ChjVGZE4d8NNmCq3E/6HjaK2uVUUp2JI=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "e963ed5aea88ad0c093adde7c1c2abd4e1b48beb",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1770864818,
-        "narHash": "sha256-VsRzFJ8+ndGgcwguZSQGHed/gragpW478qMqdNpm75k=",
+        "lastModified": 1771296409,
+        "narHash": "sha256-p0fEFcqNnhYBKsHTint5pwkcnQk1b68OeQJh95B9Adg=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ca04d472340d6a3c8fe4f4a9c0d74faad048c204",
+        "rev": "22cb60087e549a90f6b0347e84ac178c0c9085ad",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1770882871,
-        "narHash": "sha256-nw5g+xl3veea+maxJ2/81tMEA/rPq9aF1H5XF35X+OE=",
+        "lastModified": 1771257191,
+        "narHash": "sha256-H1l+zHq+ZinWH7F1IidpJ2farmbfHXjaxAm1RKWE1KI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "af04cb78aa85b2a4d1c15fc7270347e0d0eda97b",
+        "rev": "66e1a090ded57a0f88e2b381a7d4daf4a5722c3f",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771043024,
-        "narHash": "sha256-O1XDr7EWbRp+kHrNNgLWgIrB0/US5wvw9K6RERWAj6I=",
+        "lastModified": 1771208521,
+        "narHash": "sha256-X01Q3DgSpjeBpapoGA4rzKOn25qdKxbPnxHeMLNoHTU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3aadb7ca9eac2891d52a9dec199d9580a6e2bf44",
+        "rev": "fa56d7d6de78f5a7f997b0ea2bc6efd5868ad9e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770891763,
-        "narHash": "sha256-Ojjyo+W6hjRwvMjqlVuUnht9HzkCDfKJUL5A9zl1KcQ=",
+        "lastModified": 1771207491,
+        "narHash": "sha256-08s9LKq9Et4y9r6FSJLJUnRCyJHZMauAIok45ulQo0k=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6c9ab8473c11c6ab113aa61b86595cbd5ec8aed7",
+        "rev": "434ed3900e9a7b23638da97ebe16ab0e0be7fef5",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771110581,
-        "narHash": "sha256-+mY1FxEjjrbmrmVIlSoD9D9kzjGYx2g64RfgHr4UNIA=",
+        "lastModified": 1771283390,
+        "narHash": "sha256-rkSYYntpKP/OD1vXWw/W+GGRBSaC5OoHLR/yqJhlq/M=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "1ff36864c5130200f1783982d6743042f01fde73",
+        "rev": "a7c87dd33cacc627b67447bdef591bd9a8b7d878",
         "type": "github"
       },
       "original": {

From 5f6aa2e200ca4b5300a17403f2778435058bf57d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Feb 2026 14:00:05 -0500
Subject: [PATCH 595/847] jellyfin-qbittorrent-monitor: fix upload

---
 services/jellyfin-qbittorrent-monitor.py | 4 ++--
 tests/jellyfin-qbittorrent-monitor.nix   | 5 ++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index 99f3205..f1548bb 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -356,7 +356,7 @@ class JellyfinQBittorrentMonitor:
                     elif desired_state == "throttled":
                         action = (
                             "set alt limits "
-                            f"dl={int(remaining_kbs)}KB/s ul=1KB/s, enable alt speed"
+                            f"dl={int(remaining_kbs)}KB/s ul={int(remaining_kbs)}KB/s, enable alt speed"
                         )
                     else:
                         action = "pause torrents"
@@ -380,7 +380,7 @@ class JellyfinQBittorrentMonitor:
                     if self.torrents_paused:
                         self.resume_all_torrents()
                         self.torrents_paused = False
-                    self.set_alt_speed_limits(remaining_kbs, 1)
+                    self.set_alt_speed_limits(remaining_kbs, remaining_kbs)
                     self.use_alt_limits(True)
                 else:
                     if not self.torrents_paused:
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index eb5a474..3cb8b64 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -287,10 +287,9 @@ pkgs.testers.runNixOSTest {
         assert is_throttled(), "Should be in alt speed mode during streaming"
         dl_limit = get_alt_dl_limit()
         ul_limit = get_alt_up_limit()
-        # Upload should be minimal (1 KB/s = 1024 bytes/s)
-        assert ul_limit == 1024, f"Upload limit should be 1024 bytes/s, got {ul_limit}"
-        # Download limit should be > 0 (budget not exhausted for a single stream)
+        # Both upload and download should get remaining bandwidth (proportional)
         assert dl_limit > 0, f"Download limit should be > 0, got {dl_limit}"
+        assert ul_limit == dl_limit, f"Upload limit ({ul_limit}) should equal download limit ({dl_limit})"
 
         # Stop playback
         playback_stop = {

From 71fc3688bb6417d0e72ebe73adb2cf21d2931aa8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Feb 2026 14:31:34 -0500
Subject: [PATCH 596/847] jellyfin-qbittorrent-monitor: add stream headroom

---
 services/jellyfin-qbittorrent-monitor.nix | 1 +
 services/jellyfin-qbittorrent-monitor.py  | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index 68ab406..307e07b 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -51,6 +51,7 @@
       SERVICE_BUFFER = "5000000"; # 5 Mbps reserved for other services (bps)
       DEFAULT_STREAM_BITRATE = "10000000"; # 10 Mbps fallback when bitrate unknown (bps)
       MIN_TORRENT_SPEED = "100"; # KB/s - below this, pause torrents instead
+      STREAM_BITRATE_HEADROOM = "1.1"; # multiplier per stream for bitrate fluctuations
     };
   };
 }
diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin-qbittorrent-monitor.py
index f1548bb..3c01cee 100644
--- a/services/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin-qbittorrent-monitor.py
@@ -33,6 +33,7 @@ class JellyfinQBittorrentMonitor:
         service_buffer=5000000,
         default_stream_bitrate=10000000,
         min_torrent_speed=100,
+        stream_bitrate_headroom=1.1,
     ):
         self.jellyfin_url = jellyfin_url
         self.qbittorrent_url = qbittorrent_url
@@ -42,6 +43,7 @@ class JellyfinQBittorrentMonitor:
         self.service_buffer = service_buffer
         self.default_stream_bitrate = default_stream_bitrate
         self.min_torrent_speed = min_torrent_speed
+        self.stream_bitrate_headroom = stream_bitrate_headroom
         self.last_streaming_state = None
         self.current_state = "unlimited"
         self.torrents_paused = False
@@ -124,6 +126,8 @@ class JellyfinQBittorrentMonitor:
                         bitrate = self.default_stream_bitrate
 
                     bitrate = min(int(bitrate), 100_000_000)
+                    # Add headroom to account for bitrate fluctuations
+                    bitrate = int(bitrate * self.stream_bitrate_headroom)
                     active_streams.append({"name": stream_name, "bitrate_bps": bitrate})
 
         return active_streams
@@ -292,6 +296,7 @@ class JellyfinQBittorrentMonitor:
         logger.info(f"Service buffer: {self.service_buffer} bps")
         logger.info(f"Default stream bitrate: {self.default_stream_bitrate} bps")
         logger.info(f"Minimum torrent speed: {self.min_torrent_speed} KB/s")
+        logger.info(f"Stream bitrate headroom: {self.stream_bitrate_headroom}x")
 
         signal.signal(signal.SIGINT, self.signal_handler)
         signal.signal(signal.SIGTERM, self.signal_handler)
@@ -415,6 +420,7 @@ if __name__ == "__main__":
     service_buffer = int(os.getenv("SERVICE_BUFFER", "5000000"))
     default_stream_bitrate = int(os.getenv("DEFAULT_STREAM_BITRATE", "10000000"))
     min_torrent_speed = int(os.getenv("MIN_TORRENT_SPEED", "100"))
+    stream_bitrate_headroom = float(os.getenv("STREAM_BITRATE_HEADROOM", "1.1"))
 
     monitor = JellyfinQBittorrentMonitor(
         jellyfin_url=jellyfin_url,
@@ -427,6 +433,7 @@ if __name__ == "__main__":
         service_buffer=service_buffer,
         default_stream_bitrate=default_stream_bitrate,
         min_torrent_speed=min_torrent_speed,
+        stream_bitrate_headroom=stream_bitrate_headroom,
     )
 
     monitor.run()

From 406e512fd3502c0a57cafd1e85c00d9e6b6e8607 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Feb 2026 22:56:48 -0500
Subject: [PATCH 597/847] qbt: GlobalMaxRatio 6.0 -> 7.0

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 303f877..c366222 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -69,7 +69,7 @@
         AlternativeGlobalDLSpeedLimit = 800; # 800 KB/s when throttled
         IncludeOverheadInLimits = true;
 
-        GlobalMaxRatio = 6.0;
+        GlobalMaxRatio = 7.0;
 
         AddTrackersEnabled = true;
         AdditionalTrackers = lib.concatStringsSep "\\n" (

From 6f2f8736dde4398ee70ecd4a0f7946481e27333f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:01 -0500
Subject: [PATCH 598/847] prowlarr: init

---
 configuration.nix         |  2 ++
 flake.nix                 |  5 +++++
 services/arr/prowlarr.nix | 26 ++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100644 services/arr/prowlarr.nix

diff --git a/configuration.nix b/configuration.nix
index 07a1713..c13c951 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -32,6 +32,8 @@
     ./services/jellyfin-qbittorrent-monitor.nix
     ./services/bitmagnet.nix
 
+    ./services/arr/prowlarr.nix
+
     ./services/soulseek.nix
 
     ./services/ups.nix
diff --git a/flake.nix b/flake.nix
index 5d84f04..4fde2ff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -125,6 +125,7 @@
           ntfy = 2586;
           livekit = 7880;
           lk_jwt = 8081;
+          prowlarr = 9696;
         };
 
         https = {
@@ -193,6 +194,10 @@
           signalBackupDir = "/${zpool_ssds}/bak/signal";
           grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";
         };
+
+        prowlarr = {
+          dataDir = services_dir + "/prowlarr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
new file mode 100644
index 0000000..c5e9c69
--- /dev/null
+++ b/services/arr/prowlarr.nix
@@ -0,0 +1,26 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [
+      service_configs.prowlarr.dataDir
+    ])
+    (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
+  ];
+
+  services.prowlarr = {
+    enable = true;
+    dataDir = service_configs.prowlarr.dataDir;
+    settings.server.port = service_configs.ports.prowlarr;
+  };
+
+  services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}
+  '';
+}

From e2416a100d699be26d88df67f58fec5b87d7d13b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:19 -0500
Subject: [PATCH 599/847] sonarr: init

---
 configuration.nix       |  1 +
 flake.nix               |  5 +++++
 services/arr/sonarr.nix | 42 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 48 insertions(+)
 create mode 100644 services/arr/sonarr.nix

diff --git a/configuration.nix b/configuration.nix
index c13c951..a37204a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -33,6 +33,7 @@
     ./services/bitmagnet.nix
 
     ./services/arr/prowlarr.nix
+    ./services/arr/sonarr.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index 4fde2ff..ce80fad 100644
--- a/flake.nix
+++ b/flake.nix
@@ -126,6 +126,7 @@
           livekit = 7880;
           lk_jwt = 8081;
           prowlarr = 9696;
+          sonarr = 8989;
         };
 
         https = {
@@ -198,6 +199,10 @@
         prowlarr = {
           dataDir = services_dir + "/prowlarr";
         };
+
+        sonarr = {
+          dataDir = services_dir + "/sonarr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/sonarr.nix b/services/arr/sonarr.nix
new file mode 100644
index 0000000..ac3da89
--- /dev/null
+++ b/services/arr/sonarr.nix
@@ -0,0 +1,42 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "sonarr" service_configs.zpool_ssds [
+      service_configs.sonarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "sonarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "sonarr" [
+      "Z ${service_configs.sonarr.dataDir} 0700 ${config.services.sonarr.user} ${config.services.sonarr.group}"
+    ])
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d /torrents/media 2775 root ${service_configs.media_group} -"
+    "d ${service_configs.media.tvDir} 2775 root ${service_configs.media_group} -"
+    "d ${service_configs.media.moviesDir} 2775 root ${service_configs.media_group} -"
+  ];
+
+  services.sonarr = {
+    enable = true;
+    dataDir = service_configs.sonarr.dataDir;
+    settings.server.port = service_configs.ports.sonarr;
+    settings.update.mechanism = "external";
+  };
+
+  services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.sonarr}
+  '';
+
+  users.users.${config.services.sonarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}

From 0bb562ac261cfcb6780a78a9c6dc33f3a134d924 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:19 -0500
Subject: [PATCH 600/847] radarr: init

---
 configuration.nix       |  1 +
 flake.nix               |  5 +++++
 services/arr/radarr.nix | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 services/arr/radarr.nix

diff --git a/configuration.nix b/configuration.nix
index a37204a..195552b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -34,6 +34,7 @@
 
     ./services/arr/prowlarr.nix
     ./services/arr/sonarr.nix
+    ./services/arr/radarr.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index ce80fad..9e00b3f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -127,6 +127,7 @@
           lk_jwt = 8081;
           prowlarr = 9696;
           sonarr = 8989;
+          radarr = 7878;
         };
 
         https = {
@@ -203,6 +204,10 @@
         sonarr = {
           dataDir = services_dir + "/sonarr";
         };
+
+        radarr = {
+          dataDir = services_dir + "/radarr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/radarr.nix b/services/arr/radarr.nix
new file mode 100644
index 0000000..fbd20e6
--- /dev/null
+++ b/services/arr/radarr.nix
@@ -0,0 +1,36 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "radarr" service_configs.zpool_ssds [
+      service_configs.radarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "radarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "radarr" [
+      "Z ${service_configs.radarr.dataDir} 0700 ${config.services.radarr.user} ${config.services.radarr.group}"
+    ])
+  ];
+
+  services.radarr = {
+    enable = true;
+    dataDir = service_configs.radarr.dataDir;
+    settings.server.port = service_configs.ports.radarr;
+    settings.update.mechanism = "external";
+  };
+
+  services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.radarr}
+  '';
+
+  users.users.${config.services.radarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}

From 801a33ab3e7d6fac427d04413f4a05e8aeeffa3d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:19 -0500
Subject: [PATCH 601/847] bazarr: init

---
 configuration.nix       |  1 +
 flake.nix               |  5 +++++
 services/arr/bazarr.nix | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 services/arr/bazarr.nix

diff --git a/configuration.nix b/configuration.nix
index 195552b..410a496 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -35,6 +35,7 @@
     ./services/arr/prowlarr.nix
     ./services/arr/sonarr.nix
     ./services/arr/radarr.nix
+    ./services/arr/bazarr.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index 9e00b3f..5ad7173 100644
--- a/flake.nix
+++ b/flake.nix
@@ -128,6 +128,7 @@
           prowlarr = 9696;
           sonarr = 8989;
           radarr = 7878;
+          bazarr = 6767;
         };
 
         https = {
@@ -208,6 +209,10 @@
         radarr = {
           dataDir = services_dir + "/radarr";
         };
+
+        bazarr = {
+          dataDir = services_dir + "/bazarr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/bazarr.nix b/services/arr/bazarr.nix
new file mode 100644
index 0000000..c857ad6
--- /dev/null
+++ b/services/arr/bazarr.nix
@@ -0,0 +1,34 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "bazarr" service_configs.zpool_ssds [
+      service_configs.bazarr.dataDir
+    ])
+    (lib.serviceMountWithZpool "bazarr" service_configs.zpool_hdds [
+      service_configs.torrents_path
+    ])
+    (lib.serviceFilePerms "bazarr" [
+      "Z ${service_configs.bazarr.dataDir} 0700 ${config.services.bazarr.user} ${config.services.bazarr.group}"
+    ])
+  ];
+
+  services.bazarr = {
+    enable = true;
+    listenPort = service_configs.ports.bazarr;
+  };
+
+  services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.bazarr}
+  '';
+
+  users.users.${config.services.bazarr.user}.extraGroups = [
+    service_configs.media_group
+  ];
+}

From ccfa66f861196ff32d9ab7e977136163204bfb86 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:19 -0500
Subject: [PATCH 602/847] jellyseerr: init

---
 configuration.nix           |  1 +
 flake.nix                   |  5 +++++
 services/arr/jellyseerr.nix | 43 +++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 services/arr/jellyseerr.nix

diff --git a/configuration.nix b/configuration.nix
index 410a496..4e29949 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -36,6 +36,7 @@
     ./services/arr/sonarr.nix
     ./services/arr/radarr.nix
     ./services/arr/bazarr.nix
+    ./services/arr/jellyseerr.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index 5ad7173..2919f8f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -129,6 +129,7 @@
           sonarr = 8989;
           radarr = 7878;
           bazarr = 6767;
+          jellyseerr = 5055;
         };
 
         https = {
@@ -213,6 +214,10 @@
         bazarr = {
           dataDir = services_dir + "/bazarr";
         };
+
+        jellyseerr = {
+          configDir = services_dir + "/jellyseerr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/jellyseerr.nix b/services/arr/jellyseerr.nix
new file mode 100644
index 0000000..6433d04
--- /dev/null
+++ b/services/arr/jellyseerr.nix
@@ -0,0 +1,43 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "jellyseerr" service_configs.zpool_ssds [
+      service_configs.jellyseerr.configDir
+    ])
+    (lib.serviceFilePerms "jellyseerr" [
+      "Z ${service_configs.jellyseerr.configDir} 0700 jellyseerr jellyseerr"
+    ])
+  ];
+
+  services.jellyseerr = {
+    enable = true;
+    port = service_configs.ports.jellyseerr;
+    configDir = service_configs.jellyseerr.configDir;
+  };
+
+  systemd.services.jellyseerr.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "jellyseerr";
+    Group = "jellyseerr";
+    ReadWritePaths = [ service_configs.jellyseerr.configDir ];
+  };
+
+  users.users.jellyseerr = {
+    isSystemUser = true;
+    group = "jellyseerr";
+    home = service_configs.jellyseerr.configDir;
+  };
+
+  users.groups.jellyseerr = { };
+
+  services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = ''
+    # import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.jellyseerr}
+  '';
+}

From 9fb30183a67dce7dfbbe55e3f558cc81f734b5a5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:19 -0500
Subject: [PATCH 603/847] recyclarr: init

---
 configuration.nix          |   1 +
 flake.nix                  |   4 +
 services/arr/recyclarr.nix | 202 +++++++++++++++++++++++++++++++++++++
 3 files changed, 207 insertions(+)
 create mode 100644 services/arr/recyclarr.nix

diff --git a/configuration.nix b/configuration.nix
index 4e29949..48980b2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -37,6 +37,7 @@
     ./services/arr/radarr.nix
     ./services/arr/bazarr.nix
     ./services/arr/jellyseerr.nix
+    ./services/arr/recyclarr.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index 2919f8f..3f96036 100644
--- a/flake.nix
+++ b/flake.nix
@@ -218,6 +218,10 @@
         jellyseerr = {
           configDir = services_dir + "/jellyseerr";
         };
+
+        recyclarr = {
+          dataDir = services_dir + "/recyclarr";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
new file mode 100644
index 0000000..6727e52
--- /dev/null
+++ b/services/arr/recyclarr.nix
@@ -0,0 +1,202 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
+  sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
+  appDataDir = "${service_configs.recyclarr.dataDir}/data";
+
+  # Runs as root (via + prefix) to read API keys, writes secrets.yml for recyclarr
+  generateSecrets = pkgs.writeShellScript "recyclarr-generate-secrets" ''
+    RADARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
+    SONARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    cat > ${appDataDir}/secrets.yml <<EOF
+    movies_api_key: $RADARR_KEY
+    series_api_key: $SONARR_KEY
+    EOF
+    chown recyclarr:recyclarr ${appDataDir}/secrets.yml
+    chmod 600 ${appDataDir}/secrets.yml
+  '';
+in
+{
+  imports = [
+    (lib.serviceMountWithZpool "recyclarr" service_configs.zpool_ssds [
+      service_configs.recyclarr.dataDir
+    ])
+  ];
+
+  systemd.tmpfiles.rules = [
+    "d ${service_configs.recyclarr.dataDir} 0755 recyclarr recyclarr -"
+    "d ${appDataDir} 0755 recyclarr recyclarr -"
+  ];
+
+  services.recyclarr = {
+    enable = true;
+    command = "sync";
+    schedule = "daily";
+    user = "recyclarr";
+    group = "recyclarr";
+
+    configuration = {
+      radarr.movies = {
+        base_url = "http://localhost:${builtins.toString service_configs.ports.radarr}";
+
+        include = [
+          { template = "radarr-quality-definition-movie"; }
+          { template = "radarr-quality-profile-remux-web-2160p"; }
+          { template = "radarr-custom-formats-remux-web-2160p"; }
+        ];
+
+        quality_profiles = [
+          {
+            name = "Remux + WEB 2160p";
+            upgrade = {
+              allowed = true;
+              until_quality = "Remux-2160p";
+            };
+            qualities = [
+              { name = "Remux-2160p"; }
+              {
+                name = "WEB 2160p";
+                qualities = [
+                  "WEBDL-2160p"
+                  "WEBRip-2160p"
+                ];
+              }
+              { name = "Remux-1080p"; }
+              { name = "Bluray-1080p"; }
+              {
+                name = "WEB 1080p";
+                qualities = [
+                  "WEBDL-1080p"
+                  "WEBRip-1080p"
+                ];
+              }
+              { name = "HDTV-1080p"; }
+            ];
+          }
+        ];
+
+        custom_formats = [
+          # Upscaled
+          {
+            trash_ids = [ "bfd8eb01832d646a0a89c4deb46f8564" ];
+            assign_scores_to = [
+              {
+                name = "Remux + WEB 2160p";
+                score = -10000;
+              }
+            ];
+          }
+          # x265 (HD) - override template -10000 penalty
+          {
+            trash_ids = [ "dc98083864ea246d05a42df0d05f81cc" ];
+            assign_scores_to = [
+              {
+                name = "Remux + WEB 2160p";
+                score = 0;
+              }
+            ];
+          }
+          # x265 (no HDR/DV) - override template -10000 penalty
+          {
+            trash_ids = [ "839bea857ed2c0a8e084f3cbdbd65ecb" ];
+            assign_scores_to = [
+              {
+                name = "Remux + WEB 2160p";
+                score = 0;
+              }
+            ];
+          }
+        ];
+      };
+
+      sonarr.series = {
+        base_url = "http://localhost:${builtins.toString service_configs.ports.sonarr}";
+
+        include = [
+          { template = "sonarr-quality-definition-series"; }
+          { template = "sonarr-v4-quality-profile-web-2160p"; }
+          { template = "sonarr-v4-custom-formats-web-2160p"; }
+        ];
+
+        quality_profiles = [
+          {
+            name = "WEB-2160p";
+            upgrade = {
+              allowed = true;
+              until_quality = "WEB 2160p";
+            };
+            qualities = [
+              {
+                name = "WEB 2160p";
+                qualities = [
+                  "WEBDL-2160p"
+                  "WEBRip-2160p"
+                ];
+              }
+              { name = "Bluray-1080p Remux"; }
+              { name = "Bluray-1080p"; }
+              {
+                name = "WEB 1080p";
+                qualities = [
+                  "WEBDL-1080p"
+                  "WEBRip-1080p"
+                ];
+              }
+              { name = "HDTV-1080p"; }
+            ];
+          }
+        ];
+
+        custom_formats = [
+          # Upscaled
+          {
+            trash_ids = [ "23297a736ca77c0fc8e70f8edd7ee56c" ];
+            assign_scores_to = [
+              {
+                name = "WEB-2160p";
+                score = -10000;
+              }
+            ];
+          }
+          # x265 (HD) - override template -10000 penalty
+          {
+            trash_ids = [ "47435ece6b99a0b477caf360e79ba0bb" ];
+            assign_scores_to = [
+              {
+                name = "WEB-2160p";
+                score = 0;
+              }
+            ];
+          }
+          # x265 (no HDR/DV) - override template -10000 penalty
+          {
+            trash_ids = [ "9b64dff695c2115facf1b6ea59c9bd07" ];
+            assign_scores_to = [
+              {
+                name = "WEB-2160p";
+                score = 0;
+              }
+            ];
+          }
+        ];
+      };
+    };
+  };
+
+  # Add secrets generation before recyclarr runs
+  systemd.services.recyclarr = {
+    after = [
+      "network-online.target"
+      "radarr.service"
+      "sonarr.service"
+    ];
+    wants = [ "network-online.target" ];
+    serviceConfig.ExecStartPre = "+${generateSecrets}";
+  };
+}

From 745d0ea4c254ca86bbe5acd0c395d06f879b27b0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:28 -0500
Subject: [PATCH 604/847] arr-init: add module for API-based configuration

---
 configuration.nix         |   2 +
 flake.nix                 |   5 +
 modules/arr-init.nix      | 497 ++++++++++++++++++++++++++++++++++++++
 services/arr/init.nix     | 115 +++++++++
 services/arr/prowlarr.nix |   4 +
 tests/arr-init.nix        | 419 ++++++++++++++++++++++++++++++++
 tests/tests.nix           |   3 +
 7 files changed, 1045 insertions(+)
 create mode 100644 modules/arr-init.nix
 create mode 100644 services/arr/init.nix
 create mode 100644 tests/arr-init.nix

diff --git a/configuration.nix b/configuration.nix
index 48980b2..a181410 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,6 +19,7 @@
     ./modules/secureboot.nix
     ./modules/no-rgb.nix
     ./modules/security.nix
+    ./modules/arr-init.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -38,6 +39,7 @@
     ./services/arr/bazarr.nix
     ./services/arr/jellyseerr.nix
     ./services/arr/recyclarr.nix
+    ./services/arr/init.nix
 
     ./services/soulseek.nix
 
diff --git a/flake.nix b/flake.nix
index 3f96036..edd15c6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -222,6 +222,11 @@
         recyclarr = {
           dataDir = services_dir + "/recyclarr";
         };
+
+        media = {
+          moviesDir = torrents_path + "/media/movies";
+          tvDir = torrents_path + "/media/tv";
+        };
       };
 
       pkgs = import nixpkgs {
diff --git a/modules/arr-init.nix b/modules/arr-init.nix
new file mode 100644
index 0000000..67ac081
--- /dev/null
+++ b/modules/arr-init.nix
@@ -0,0 +1,497 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.arrInit;
+  bazarrCfg = config.services.bazarrInit;
+
+  downloadClientModule = lib.types.submodule {
+    options = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = "Display name of the download client (e.g. \"qBittorrent\").";
+        example = "qBittorrent";
+      };
+
+      implementation = lib.mkOption {
+        type = lib.types.str;
+        description = "Implementation identifier for the Servarr API.";
+        example = "QBittorrent";
+      };
+
+      configContract = lib.mkOption {
+        type = lib.types.str;
+        description = "Config contract identifier for the Servarr API.";
+        example = "QBittorrentSettings";
+      };
+
+      protocol = lib.mkOption {
+        type = lib.types.enum [
+          "torrent"
+          "usenet"
+        ];
+        default = "torrent";
+        description = "Download protocol type.";
+      };
+
+      fields = lib.mkOption {
+        type = lib.types.attrsOf lib.types.anything;
+        default = { };
+        description = ''
+          Flat key/value pairs for the download client configuration.
+          These are converted to the API's [{name, value}] array format.
+        '';
+        example = {
+          host = "192.168.15.1";
+          port = 6011;
+          useSsl = false;
+          tvCategory = "tvshows";
+        };
+      };
+    };
+  };
+
+  syncedAppModule = lib.types.submodule {
+    options = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = "Display name of the application to sync (e.g. \"Sonarr\").";
+        example = "Sonarr";
+      };
+
+      implementation = lib.mkOption {
+        type = lib.types.str;
+        description = "Implementation identifier for the Prowlarr application API.";
+        example = "Sonarr";
+      };
+
+      configContract = lib.mkOption {
+        type = lib.types.str;
+        description = "Config contract identifier for the Prowlarr application API.";
+        example = "SonarrSettings";
+      };
+
+      syncLevel = lib.mkOption {
+        type = lib.types.str;
+        default = "fullSync";
+        description = "Sync level for the application.";
+      };
+
+      prowlarrUrl = lib.mkOption {
+        type = lib.types.str;
+        description = "URL of the Prowlarr instance.";
+        example = "http://localhost:9696";
+      };
+
+      baseUrl = lib.mkOption {
+        type = lib.types.str;
+        description = "URL of the target application.";
+        example = "http://localhost:8989";
+      };
+
+      apiKeyFrom = lib.mkOption {
+        type = lib.types.str;
+        description = "Path to the config.xml file to read the API key from at runtime.";
+        example = "/services/sonarr/config.xml";
+      };
+
+      syncCategories = lib.mkOption {
+        type = lib.types.listOf lib.types.int;
+        default = [ ];
+        description = "List of sync category IDs for the application.";
+        example = [
+          5000
+          5010
+          5020
+        ];
+      };
+
+      serviceName = lib.mkOption {
+        type = lib.types.str;
+        description = "Name of the systemd service to depend on for reading the API key.";
+        example = "sonarr";
+      };
+    };
+  };
+
+  instanceModule = lib.types.submodule {
+    options = {
+      enable = lib.mkEnableOption "Servarr application API initialization";
+
+      serviceName = lib.mkOption {
+        type = lib.types.str;
+        description = "Name of the systemd service this init depends on.";
+        example = "sonarr";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        description = "Path to the application data directory containing config.xml.";
+        example = "/var/lib/sonarr";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = "API port of the Servarr application.";
+        example = 8989;
+      };
+
+      apiVersion = lib.mkOption {
+        type = lib.types.str;
+        default = "v3";
+        description = "API version string used in the base URL.";
+      };
+
+      networkNamespacePath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "If set, run this init service inside the given network namespace path (e.g. /run/netns/wg).";
+      };
+
+      downloadClients = lib.mkOption {
+        type = lib.types.listOf downloadClientModule;
+        default = [ ];
+        description = "List of download clients to configure via the API.";
+      };
+
+      rootFolders = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "List of root folder paths to configure via the API.";
+        example = [
+          "/media/tv"
+          "/media/movies"
+        ];
+      };
+
+      syncedApps = lib.mkOption {
+        type = lib.types.listOf syncedAppModule;
+        default = [ ];
+        description = "Applications to register for indexer sync (Prowlarr only).";
+      };
+    };
+  };
+
+  bazarrProviderModule = lib.types.submodule {
+    options = {
+      enable = lib.mkEnableOption "provider connection";
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        description = "Path to the provider's data directory containing config.xml.";
+        example = "/services/sonarr";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        description = "API port of the provider.";
+        example = 8989;
+      };
+
+      serviceName = lib.mkOption {
+        type = lib.types.str;
+        description = "Name of the systemd service to depend on.";
+        example = "sonarr";
+      };
+    };
+  };
+
+  bazarrInitModule = lib.types.submodule {
+    options = {
+      enable = lib.mkEnableOption "Bazarr API initialization";
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        description = "Path to Bazarr's data directory containing config/config.ini.";
+        example = "/services/bazarr";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 6767;
+        description = "API port of Bazarr.";
+      };
+
+      sonarr = lib.mkOption {
+        type = bazarrProviderModule;
+        default = {
+          enable = false;
+        };
+        description = "Sonarr provider configuration.";
+      };
+
+      radarr = lib.mkOption {
+        type = bazarrProviderModule;
+        default = {
+          enable = false;
+        };
+        description = "Radarr provider configuration.";
+      };
+    };
+  };
+
+  curl = "${pkgs.curl}/bin/curl";
+  jq = "${pkgs.jq}/bin/jq";
+  grep = "${pkgs.gnugrep}/bin/grep";
+  awk = "${pkgs.gawk}/bin/awk";
+
+  mkDownloadClientPayload =
+    dc:
+    builtins.toJSON {
+      enable = true;
+      protocol = dc.protocol;
+      priority = 1;
+      name = dc.name;
+      implementation = dc.implementation;
+      configContract = dc.configContract;
+      fields = lib.mapAttrsToList (n: v: {
+        name = n;
+        value = v;
+      }) dc.fields;
+      tags = [ ];
+    };
+
+  mkDownloadClientSection = dc: ''
+    # Download client: ${dc.name}
+    echo "Checking download client '${dc.name}'..."
+    EXISTING_DC=$(${curl} -sf "$BASE_URL/downloadclient" -H "X-Api-Key: $API_KEY")
+    if echo "$EXISTING_DC" | ${jq} -e --arg name ${lib.escapeShellArg dc.name} '.[] | select(.name == $name)' > /dev/null 2>&1; then
+      echo "Download client '${dc.name}' already exists, skipping"
+    else
+      echo "Adding download client '${dc.name}'..."
+      ${curl} -sf -X POST "$BASE_URL/downloadclient?forceSave=true" \
+        -H "X-Api-Key: $API_KEY" \
+        -H "Content-Type: application/json" \
+        -d ${lib.escapeShellArg (mkDownloadClientPayload dc)}
+      echo "Download client '${dc.name}' added"
+    fi
+  '';
+
+  mkRootFolderSection = path: ''
+    # Root folder: ${path}
+    echo "Checking root folder '${path}'..."
+    EXISTING_RF=$(${curl} -sf "$BASE_URL/rootfolder" -H "X-Api-Key: $API_KEY")
+    if echo "$EXISTING_RF" | ${jq} -e --arg path ${lib.escapeShellArg path} '.[] | select(.path == $path)' > /dev/null 2>&1; then
+      echo "Root folder '${path}' already exists, skipping"
+    else
+      echo "Adding root folder '${path}'..."
+      ${curl} -sf -X POST "$BASE_URL/rootfolder" \
+        -H "X-Api-Key: $API_KEY" \
+        -H "Content-Type: application/json" \
+        -d ${lib.escapeShellArg (builtins.toJSON { inherit path; })}
+      echo "Root folder '${path}' added"
+    fi
+  '';
+
+  mkSyncedAppSection = app: ''
+    # Synced app: ${app.name}
+    echo "Checking synced app '${app.name}'..."
+    TARGET_API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${lib.escapeShellArg app.apiKeyFrom})
+    EXISTING_APPS=$(${curl} -sf "$BASE_URL/applications" -H "X-Api-Key: $API_KEY")
+    if echo "$EXISTING_APPS" | ${jq} -e --arg name ${lib.escapeShellArg app.name} '.[] | select(.name == $name)' > /dev/null 2>&1; then
+      echo "Synced app '${app.name}' already exists, skipping"
+    else
+      echo "Adding synced app '${app.name}'..."
+      PAYLOAD=$(${jq} -n \
+        --arg name ${lib.escapeShellArg app.name} \
+        --arg implementation ${lib.escapeShellArg app.implementation} \
+        --arg configContract ${lib.escapeShellArg app.configContract} \
+        --arg syncLevel ${lib.escapeShellArg app.syncLevel} \
+        --arg prowlarrUrl ${lib.escapeShellArg app.prowlarrUrl} \
+        --arg baseUrl ${lib.escapeShellArg app.baseUrl} \
+        --arg apiKey "$TARGET_API_KEY" \
+        --argjson syncCategories ${builtins.toJSON app.syncCategories} \
+        '{
+          name: $name,
+          implementation: $implementation,
+          configContract: $configContract,
+          syncLevel: $syncLevel,
+          fields: [
+            {name: "prowlarrUrl", value: $prowlarrUrl},
+            {name: "baseUrl", value: $baseUrl},
+            {name: "apiKey", value: $apiKey},
+            {name: "syncCategories", value: $syncCategories}
+          ],
+          tags: []
+        }')
+      ${curl} -sf -X POST "$BASE_URL/applications?forceSave=true" \
+        -H "X-Api-Key: $API_KEY" \
+        -H "Content-Type: application/json" \
+        -d "$PAYLOAD"
+      echo "Synced app '${app.name}' added"
+    fi
+  '';
+
+  mkInitScript =
+    name: inst:
+    pkgs.writeShellScript "${name}-init" ''
+      set -euo pipefail
+
+      CONFIG_XML="${inst.dataDir}/config.xml"
+
+      if [ ! -f "$CONFIG_XML" ]; then
+        echo "Config file $CONFIG_XML not found, skipping ${name} init"
+        exit 0
+      fi
+
+      API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' "$CONFIG_XML")
+      BASE_URL="http://localhost:${builtins.toString inst.port}/api/${inst.apiVersion}"
+
+      # Wait for API to become available
+      echo "Waiting for ${name} API..."
+      for i in $(seq 1 90); do
+        if ${curl} -sf "$BASE_URL/system/status" -H "X-Api-Key: $API_KEY" > /dev/null 2>&1; then
+          echo "${name} API is ready"
+          break
+        fi
+        if [ "$i" -eq 90 ]; then
+          echo "${name} API not available after 90 seconds" >&2
+          exit 1
+        fi
+        sleep 1
+      done
+
+      ${lib.concatMapStringsSep "\n" mkDownloadClientSection inst.downloadClients}
+      ${lib.concatMapStringsSep "\n" mkRootFolderSection inst.rootFolders}
+      ${lib.concatMapStringsSep "\n" mkSyncedAppSection inst.syncedApps}
+
+      echo "${name} init complete"
+    '';
+
+  # Get list of service names that syncedApps depend on
+  getSyncedAppDeps = inst: map (app: "${app.serviceName}.service") inst.syncedApps;
+
+  enabledInstances = lib.filterAttrs (_: inst: inst.enable) cfg;
+
+  mkBazarrProviderSection =
+    type: provider:
+    let
+      ltype = lib.toLower type;
+    in
+    ''
+      # ${type} provider
+      echo "Checking ${type} provider..."
+      PROVIDER_API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${lib.escapeShellArg "${provider.dataDir}/config.xml"})
+      EXISTING=$(${curl} -sf "$BASE_URL/api/system/settings" -H "X-API-KEY: $API_KEY")
+      USE_FLAG=$(echo "$EXISTING" | ${jq} -r '.general.use_${ltype}')
+      EXISTING_KEY=$(echo "$EXISTING" | ${jq} -r '.${ltype}.apikey // ""')
+      if [ "$USE_FLAG" = "true" ] && [ -n "$EXISTING_KEY" ]; then
+        echo "${type} provider already configured, skipping"
+      else
+        echo "Adding ${type} provider..."
+        ${curl} -sf -X POST "$BASE_URL/api/system/settings" \
+          -H "X-API-KEY: $API_KEY" \
+          -d "settings-general-use_${ltype}=true" \
+          -d "settings-${ltype}-ip=localhost" \
+          -d "settings-${ltype}-port=${builtins.toString provider.port}" \
+          -d "settings-${ltype}-apikey=$PROVIDER_API_KEY" \
+          -d "settings-${ltype}-ssl=false" \
+          -d "settings-${ltype}-base_url=/"
+        echo "${type} provider added"
+      fi
+    '';
+
+  mkBazarrInitScript = pkgs.writeShellScript "bazarr-init" ''
+    set -euo pipefail
+
+    CONFIG_YAML="${bazarrCfg.dataDir}/config/config.yaml"
+
+    if [ ! -f "$CONFIG_YAML" ]; then
+      echo "Config file $CONFIG_YAML not found, skipping bazarr init"
+      exit 0
+    fi
+
+    API_KEY=$(${awk} '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, ""); print; exit}' "$CONFIG_YAML")
+    BASE_URL="http://localhost:${builtins.toString bazarrCfg.port}"
+
+    # Wait for API to become available
+    echo "Waiting for Bazarr API..."
+    for i in $(seq 1 90); do
+      if ${curl} -sf "$BASE_URL/api/system/status" -H "X-API-KEY: $API_KEY" > /dev/null 2>&1; then
+        echo "Bazarr API is ready"
+        break
+      fi
+      if [ "$i" -eq 90 ]; then
+        echo "Bazarr API not available after 90 seconds" >&2
+        exit 1
+      fi
+      sleep 1
+    done
+
+    ${lib.optionalString bazarrCfg.sonarr.enable (mkBazarrProviderSection "Sonarr" bazarrCfg.sonarr)}
+    ${lib.optionalString bazarrCfg.radarr.enable (mkBazarrProviderSection "Radarr" bazarrCfg.radarr)}
+
+    echo "Bazarr init complete"
+  '';
+
+  bazarrDeps = [
+    "bazarr.service"
+  ]
+  ++ (lib.optional bazarrCfg.sonarr.enable "${bazarrCfg.sonarr.serviceName}.service")
+  ++ (lib.optional bazarrCfg.radarr.enable "${bazarrCfg.radarr.serviceName}.service");
+in
+{
+  options.services.arrInit = lib.mkOption {
+    type = lib.types.attrsOf instanceModule;
+    default = { };
+    description = ''
+      Attribute set of Servarr application instances to initialize via their APIs.
+      Each instance generates a systemd oneshot service that idempotently configures
+      download clients, root folders, and synced applications.
+    '';
+  };
+
+  options.services.bazarrInit = lib.mkOption {
+    type = bazarrInitModule;
+    default = {
+      enable = false;
+    };
+    description = ''
+      Bazarr API initialization for connecting Sonarr and Radarr providers.
+      Bazarr uses a different API than Servarr applications, so it has its own module.
+    '';
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf (enabledInstances != { }) {
+      systemd.services = lib.mapAttrs' (
+        name: inst:
+        lib.nameValuePair "${inst.serviceName}-init" {
+          description = "Initialize ${name} API connections";
+          after = [
+            "${inst.serviceName}.service"
+          ]
+          ++ (getSyncedAppDeps inst)
+          ++ (lib.optional (inst.networkNamespacePath != null) "wg.service");
+          requires = [ "${inst.serviceName}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${mkInitScript name inst}";
+          }
+          // lib.optionalAttrs (inst.networkNamespacePath != null) {
+            NetworkNamespacePath = inst.networkNamespacePath;
+          };
+        }
+      ) enabledInstances;
+    })
+
+    (lib.mkIf bazarrCfg.enable {
+      systemd.services.bazarr-init = {
+        description = "Initialize Bazarr API connections";
+        after = bazarrDeps;
+        requires = bazarrDeps;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${mkBazarrInitScript}";
+        };
+      };
+    })
+  ];
+}
diff --git a/services/arr/init.nix b/services/arr/init.nix
new file mode 100644
index 0000000..e7c5a84
--- /dev/null
+++ b/services/arr/init.nix
@@ -0,0 +1,115 @@
+{ config, service_configs, ... }:
+{
+  services.arrInit = {
+    prowlarr = {
+      enable = true;
+      serviceName = "prowlarr";
+      port = service_configs.ports.prowlarr;
+      dataDir = service_configs.prowlarr.dataDir;
+      apiVersion = "v1";
+      networkNamespacePath = "/run/netns/wg";
+      syncedApps = [
+        {
+          name = "Sonarr";
+          implementation = "Sonarr";
+          configContract = "SonarrSettings";
+          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}";
+          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.sonarr}";
+          apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml";
+          syncCategories = [
+            5000
+            5010
+            5020
+            5030
+            5040
+            5045
+            5050
+            5090
+          ];
+          serviceName = "sonarr";
+        }
+        {
+          name = "Radarr";
+          implementation = "Radarr";
+          configContract = "RadarrSettings";
+          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}";
+          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.radarr}";
+          apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml";
+          syncCategories = [
+            2000
+            2010
+            2020
+            2030
+            2040
+            2045
+            2050
+            2060
+            2070
+            2080
+          ];
+          serviceName = "radarr";
+        }
+      ];
+    };
+
+    sonarr = {
+      enable = true;
+      serviceName = "sonarr";
+      port = service_configs.ports.sonarr;
+      dataDir = service_configs.sonarr.dataDir;
+      rootFolders = [ service_configs.media.tvDir ];
+      downloadClients = [
+        {
+          name = "qBittorrent";
+          implementation = "QBittorrent";
+          configContract = "QBittorrentSettings";
+          fields = {
+            host = config.vpnNamespaces.wg.namespaceAddress;
+            port = service_configs.ports.torrent;
+            useSsl = false;
+            tvCategory = "tvshows";
+          };
+        }
+      ];
+    };
+
+    radarr = {
+      enable = true;
+      serviceName = "radarr";
+      port = service_configs.ports.radarr;
+      dataDir = service_configs.radarr.dataDir;
+      rootFolders = [ service_configs.media.moviesDir ];
+      downloadClients = [
+        {
+          name = "qBittorrent";
+          implementation = "QBittorrent";
+          configContract = "QBittorrentSettings";
+          fields = {
+            host = config.vpnNamespaces.wg.namespaceAddress;
+            port = service_configs.ports.torrent;
+            useSsl = false;
+            movieCategory = "movies";
+          };
+        }
+      ];
+    };
+  };
+
+  services.bazarrInit = {
+    enable = true;
+    dataDir = "/var/lib/bazarr";
+    port = service_configs.ports.bazarr;
+    sonarr = {
+      enable = true;
+      dataDir = service_configs.sonarr.dataDir;
+      port = service_configs.ports.sonarr;
+      serviceName = "sonarr";
+    };
+    radarr = {
+      enable = true;
+      dataDir = service_configs.radarr.dataDir;
+      port = service_configs.ports.radarr;
+      serviceName = "radarr";
+    };
+  };
+}
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index c5e9c69..a2ad767 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -19,6 +19,10 @@
     settings.server.port = service_configs.ports.prowlarr;
   };
 
+  systemd.services.prowlarr.serviceConfig = {
+    ExecStartPre = "+${pkgs.coreutils}/bin/chown -R prowlarr /var/lib/prowlarr";
+  };
+
   services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}
diff --git a/tests/arr-init.nix b/tests/arr-init.nix
new file mode 100644
index 0000000..be94be1
--- /dev/null
+++ b/tests/arr-init.nix
@@ -0,0 +1,419 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testPkgs = pkgs.appendOverlays [ (import ../modules/overlays.nix) ];
+in
+testPkgs.testers.runNixOSTest {
+  name = "arr-init";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ../modules/arr-init.nix
+      ];
+
+      system.stateVersion = config.system.stateVersion;
+
+      virtualisation.memorySize = 4096;
+
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+        gnugrep
+      ];
+
+      systemd.services.mock-qbittorrent =
+        let
+          mockQbitScript = pkgs.writeScript "mock-qbittorrent.py" ''
+            import json
+            from http.server import HTTPServer, BaseHTTPRequestHandler
+            from urllib.parse import parse_qs, urlparse
+
+
+            CATEGORIES = {
+                "tv": {"name": "tv", "savePath": "/downloads"},
+                "movies": {"name": "movies", "savePath": "/downloads"},
+            }
+
+
+            class QBitMock(BaseHTTPRequestHandler):
+                def _respond(self, code=200, body=b"Ok.", content_type="text/plain"):
+                    self.send_response(code)
+                    self.send_header("Content-Type", content_type)
+                    self.send_header("Set-Cookie", "SID=mock_session_id; Path=/")
+                    self.end_headers()
+                    self.wfile.write(body if isinstance(body, bytes) else body.encode())
+
+                def do_GET(self):
+                    path = self.path.split("?")[0]
+                    if path == "/api/v2/app/webapiVersion":
+                        self._respond(body=b"2.9.3")
+                    elif path == "/api/v2/app/version":
+                        self._respond(body=b"v5.0.0")
+                    elif path == "/api/v2/torrents/info":
+                        self._respond(body=b"[]", content_type="application/json")
+                    elif path == "/api/v2/torrents/categories":
+                        body = json.dumps(CATEGORIES).encode()
+                        self._respond(body=body, content_type="application/json")
+                    elif path == "/api/v2/app/preferences":
+                        body = json.dumps({"save_path": "/tmp"}).encode()
+                        self._respond(body=body, content_type="application/json")
+                    else:
+                        self._respond()
+
+                def do_POST(self):
+                    content_length = int(self.headers.get("Content-Length", 0))
+                    body = self.rfile.read(content_length).decode()
+                    path = urlparse(self.path).path
+                    query = parse_qs(urlparse(self.path).query)
+                    form = parse_qs(body)
+                    params = {**query, **form}
+                    if path == "/api/v2/torrents/createCategory":
+                        name = params.get("category", [""])[0]
+                        save_path = params.get("savePath", params.get("save_path", [""]))[0] or "/downloads"
+                        if name:
+                            CATEGORIES[name] = {"name": name, "savePath": save_path}
+                    if path in ["/api/v2/torrents/editCategory", "/api/v2/torrents/removeCategory"]:
+                        self._respond()
+                        return
+                    self._respond()
+
+                def log_message(self, format, *args):
+                    pass
+
+
+            HTTPServer(("0.0.0.0", 6011), QBitMock).serve_forever()
+          '';
+        in
+        {
+          description = "Mock qBittorrent API";
+          wantedBy = [ "multi-user.target" ];
+          before = [
+            "sonarr-init.service"
+            "radarr-init.service"
+          ];
+          serviceConfig = {
+            ExecStart = "${pkgs.python3}/bin/python3 ${mockQbitScript}";
+            Type = "simple";
+          };
+        };
+
+      systemd.tmpfiles.rules = [
+        "d /media/tv 0755 sonarr sonarr -"
+        "d /media/movies 0755 radarr radarr -"
+      ];
+
+      services.sonarr = {
+        enable = true;
+        dataDir = "/var/lib/sonarr/.config/NzbDrone";
+        settings.server.port = lib.mkDefault 8989;
+      };
+
+      services.radarr = {
+        enable = true;
+        dataDir = "/var/lib/radarr/.config/Radarr";
+        settings.server.port = lib.mkDefault 7878;
+      };
+
+      services.prowlarr = {
+        enable = true;
+      };
+
+      services.bazarr = {
+        enable = true;
+        listenPort = 6767;
+      };
+
+      services.arrInit.sonarr = {
+        enable = true;
+        serviceName = "sonarr";
+        dataDir = "/var/lib/sonarr/.config/NzbDrone";
+        port = 8989;
+        downloadClients = [
+          {
+            name = "qBittorrent";
+            implementation = "QBittorrent";
+            configContract = "QBittorrentSettings";
+            protocol = "torrent";
+            fields = {
+              host = "127.0.0.1";
+              port = 6011;
+              useSsl = false;
+              tvCategory = "tv";
+            };
+          }
+        ];
+        rootFolders = [ "/media/tv" ];
+      };
+
+      services.arrInit.radarr = {
+        enable = true;
+        serviceName = "radarr";
+        dataDir = "/var/lib/radarr/.config/Radarr";
+        port = 7878;
+        downloadClients = [
+          {
+            name = "qBittorrent";
+            implementation = "QBittorrent";
+            configContract = "QBittorrentSettings";
+            protocol = "torrent";
+            fields = {
+              host = "127.0.0.1";
+              port = 6011;
+              useSsl = false;
+              movieCategory = "movies";
+            };
+          }
+        ];
+        rootFolders = [ "/media/movies" ];
+      };
+
+      services.arrInit.prowlarr = {
+        enable = true;
+        serviceName = "prowlarr";
+        dataDir = "/var/lib/prowlarr";
+        port = 9696;
+        apiVersion = "v1";
+        syncedApps = [
+          {
+            name = "Sonarr";
+            implementation = "Sonarr";
+            configContract = "SonarrSettings";
+            prowlarrUrl = "http://localhost:9696";
+            baseUrl = "http://localhost:8989";
+            apiKeyFrom = "/var/lib/sonarr/.config/NzbDrone/config.xml";
+            syncCategories = [
+              5000
+              5010
+              5020
+              5030
+              5040
+              5045
+              5050
+              5090
+            ];
+            serviceName = "sonarr";
+          }
+          {
+            name = "Radarr";
+            implementation = "Radarr";
+            configContract = "RadarrSettings";
+            prowlarrUrl = "http://localhost:9696";
+            baseUrl = "http://localhost:7878";
+            apiKeyFrom = "/var/lib/radarr/.config/Radarr/config.xml";
+            syncCategories = [
+              2000
+              2010
+              2020
+              2030
+              2040
+              2045
+              2050
+              2060
+              2070
+              2080
+            ];
+            serviceName = "radarr";
+          }
+        ];
+      };
+
+      services.bazarrInit = {
+        enable = true;
+        dataDir = "/var/lib/bazarr";
+        port = 6767;
+        sonarr = {
+          enable = true;
+          dataDir = "/var/lib/sonarr/.config/NzbDrone";
+          port = 8989;
+          serviceName = "sonarr";
+        };
+        radarr = {
+          enable = true;
+          dataDir = "/var/lib/radarr/.config/Radarr";
+          port = 7878;
+          serviceName = "radarr";
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+
+    # Wait for services to start
+    machine.wait_for_unit("mock-qbittorrent.service")
+    machine.wait_until_succeeds("curl -sf http://localhost:6011/api/v2/app/version", timeout=30)
+    machine.wait_for_unit("sonarr.service")
+    machine.wait_for_unit("radarr.service")
+    machine.wait_for_unit("prowlarr.service")
+    machine.wait_for_unit("bazarr.service")
+
+    # Wait for Sonarr API to be ready (config.xml is auto-generated on first start)
+    machine.wait_until_succeeds(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
+        "curl -sf http://localhost:8989/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
+        timeout=120,
+    )
+
+    # Wait for Radarr API to be ready
+    machine.wait_until_succeeds(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
+        "curl -sf http://localhost:7878/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
+        timeout=120,
+    )
+
+    # Wait for Prowlarr API to be ready
+    machine.wait_until_succeeds(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
+        "curl -sf http://localhost:9696/api/v1/system/status -H \"X-Api-Key: $API_KEY\"",
+        timeout=180,
+    )
+
+    # Ensure init services run after config.xml exists
+    machine.succeed("systemctl restart sonarr-init.service")
+    machine.succeed("systemctl restart radarr-init.service")
+    machine.wait_for_unit("sonarr-init.service")
+    machine.wait_for_unit("radarr-init.service")
+
+    # Wait for init services to complete
+    machine.wait_for_unit("sonarr-init.service")
+    machine.wait_for_unit("radarr-init.service")
+
+    # Verify Sonarr download clients
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
+        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.name == \"qBittorrent\")'"
+    )
+
+    # Verify Sonarr root folders
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
+        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.path == \"/media/tv\")'"
+    )
+
+    # Verify Radarr download clients
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
+        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.name == \"qBittorrent\")'"
+    )
+
+    # Verify Radarr root folders
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
+        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.path == \"/media/movies\")'"
+    )
+
+    # Restart prowlarr-init now that all config.xml files exist
+    machine.succeed("systemctl restart prowlarr-init.service")
+    machine.wait_for_unit("prowlarr-init.service")
+
+    # Verify Sonarr registered as synced app in Prowlarr
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
+        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.name == \"Sonarr\")'"
+    )
+
+    # Verify Radarr registered as synced app in Prowlarr
+    machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
+        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
+        "jq -e '.[] | select(.name == \"Radarr\")'"
+    )
+
+    # Idempotency test: restart init services and verify no duplicate entries
+    machine.succeed("systemctl restart sonarr-init.service")
+    machine.succeed("systemctl restart radarr-init.service")
+    machine.succeed("systemctl restart prowlarr-init.service")
+
+    # Verify Sonarr still has exactly 1 download client
+    result = machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
+        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
+        "jq '. | length'"
+    ).strip()
+    assert result == "1", f"Expected 1 Sonarr download client, got {result}"
+
+    # Verify Sonarr still has exactly 1 root folder
+    result = machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
+        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
+        "jq '. | length'"
+    ).strip()
+    assert result == "1", f"Expected 1 Sonarr root folder, got {result}"
+
+    # Verify Radarr still has exactly 1 download client
+    result = machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
+        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
+        "jq '. | length'"
+    ).strip()
+    assert result == "1", f"Expected 1 Radarr download client, got {result}"
+
+    # Verify Radarr still has exactly 1 root folder
+    result = machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
+        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
+        "jq '. | length'"
+    ).strip()
+    assert result == "1", f"Expected 1 Radarr root folder, got {result}"
+
+    # Verify Prowlarr still has exactly 2 synced apps
+    result = machine.succeed(
+        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
+        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
+        "jq '. | length'"
+    ).strip()
+    assert result == "2", f"Expected 2 Prowlarr synced apps, got {result}"
+
+    # Wait for Bazarr to generate config.yaml
+    machine.wait_until_succeeds(
+        "test -f /var/lib/bazarr/config/config.yaml",
+        timeout=120,
+    )
+
+    # Wait for Bazarr API to be ready
+    machine.wait_until_succeeds(
+        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
+        "curl -sf http://localhost:6767/api/system/status -H \"X-API-KEY: $API_KEY\"",
+        timeout=120,
+    )
+
+    # Restart bazarr-init now that config.yaml exists
+    machine.succeed("systemctl restart bazarr-init.service")
+    machine.wait_for_unit("bazarr-init.service")
+
+    # Verify Sonarr provider configured in Bazarr
+    machine.succeed(
+        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
+        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
+        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
+    )
+
+    # Verify Radarr provider configured in Bazarr
+    machine.succeed(
+        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
+        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
+        "jq -e '.general.use_radarr == true and (.radarr.apikey // \"\") != \"\"'"
+    )
+
+    # Idempotency: restart bazarr-init and verify no duplicate config
+    machine.succeed("systemctl restart bazarr-init.service")
+    machine.wait_for_unit("bazarr-init.service")
+
+    machine.succeed(
+        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
+        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
+        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
+    )
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index f7a2e93..5b1e57b 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -21,4 +21,7 @@ in
   fail2banVaultwardenTest = handleTest ./fail2ban-vaultwarden.nix;
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
+
+  # arr tests
+  arrInitTest = handleTest ./arr-init.nix;
 }

From 6cf417f687f21250db40675069f6d060f88a5424 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:28 -0500
Subject: [PATCH 605/847] firewall: trust wg-br interface

---
 configuration.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configuration.nix b/configuration.nix
index a181410..7ba9c5e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -201,6 +201,7 @@
     hostName = hostname;
     hostId = "0f712d56";
     firewall.enable = true;
+    firewall.trustedInterfaces = [ "wg-br" ];
     useDHCP = false;
     enableIPv6 = false;
 

From d5235a498ba773b9b7ad4f732373229eaf3319c0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 19:12:28 -0500
Subject: [PATCH 606/847] qbittorrent: enable queueing and AutoTMM

---
 services/qbittorrent.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index c366222..4d18eb0 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -48,7 +48,7 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        MaxConnectionsPerTorrent = 10;
+        MaxConnectionsPerTorrent = 100;
         MaxUploadsPerTorrent = 10;
         MaxConnections = -1;
         MaxUploads = -1;
@@ -56,9 +56,10 @@
         MaxActiveCheckingTorrents = 5;
 
         # queueing
-        QueueingSystemEnabled = false;
-        MaxActiveDownloads = 2; # num of torrents that can download at the same time
-        MaxActiveUploads = 20;
+        QueueingSystemEnabled = true;
+        MaxActiveDownloads = 8; # num of torrents that can download at the same time
+        MaxActiveUploads = -1;
+        MaxActiveTorrents = -1;
         IgnoreSlowTorrentsForQueueing = true;
 
         GlobalUPSpeedLimit = 0;
@@ -86,6 +87,11 @@
         # how many connections per sec
         ConnectionSpeed = 300;
 
+        # Automatic Torrent Management: use category save paths for new torrents
+        DisableAutoTMMByDefault = false;
+        DisableAutoTMMTriggers.CategorySavePathChanged = false;
+        DisableAutoTMMTriggers.DefaultSavePathChanged = false;
+
         ChokingAlgorithm = "RateBased";
         PieceExtentAffinity = true;
         SuggestMode = true;

From 1a6472e77484a9071b9e148fcf5bc73ea7a7518a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 23:14:27 -0500
Subject: [PATCH 607/847] qbt: Coalesce Read Write

---
 services/qbittorrent.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4d18eb0..587d671 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -95,6 +95,7 @@
         ChokingAlgorithm = "RateBased";
         PieceExtentAffinity = true;
         SuggestMode = true;
+        CoalesceReadWrite = true;
       };
 
       Network = {

From 5e81d5e1feeb67783473de3874b2644df1b45177 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 19 Feb 2026 23:15:26 -0500
Subject: [PATCH 608/847] update

---
 flake.lock | 60 +++++++++++++++++++++++++++---------------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/flake.lock b/flake.lock
index 916d63b..95b0d63 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1770419512,
-        "narHash": "sha256-o8Vcdz6B6bkiGUYkZqFwH3Pv1JwZyXht3dMtS7RchIo=",
+        "lastModified": 1771121070,
+        "narHash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "2510f2cbc3ccd237f700bb213756a8f35c32d8d7",
+        "rev": "a2812c19f1ed2e5ed5ce2ef7109798b575c180e1",
         "type": "github"
       },
       "original": {
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771271879,
-        "narHash": "sha256-Vn32sMuvV35ChjVGZE4d8NNmCq3E/6HjaK2uVUUp2JI=",
+        "lastModified": 1771469470,
+        "narHash": "sha256-GnqdqhrguKNN3HtVfl6z+zbV9R9jhHFm3Z8nu7R6ml0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "e963ed5aea88ad0c093adde7c1c2abd4e1b48beb",
+        "rev": "4707eec8d1d2db5182ea06ed48c820a86a42dc13",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1770734117,
-        "narHash": "sha256-PNXSnK507MRj+hYMgnUR7InNJzVCmOfsjHV4YXZgpwQ=",
+        "lastModified": 1771492583,
+        "narHash": "sha256-nQzvnU4BGu8dA6BsPPCqmVcab/3ebVmHtX3ZWbW3Hxc=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "2038a9a19adb886eccba775321b055fdbdc5029d",
+        "rev": "5e9380994665ef66c87ab8e22c913ff837174ce4",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1771296409,
-        "narHash": "sha256-p0fEFcqNnhYBKsHTint5pwkcnQk1b68OeQJh95B9Adg=",
+        "lastModified": 1771469368,
+        "narHash": "sha256-yGRHre2BINQJBDAyUwxyzvgAce22J4pNdpLS8roo6fY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "22cb60087e549a90f6b0347e84ac178c0c9085ad",
+        "rev": "a708458be9b9421e377c54d86807d3490db53816",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1771257191,
-        "narHash": "sha256-H1l+zHq+ZinWH7F1IidpJ2farmbfHXjaxAm1RKWE1KI=",
+        "lastModified": 1771423359,
+        "narHash": "sha256-yRKJ7gpVmXbX2ZcA8nFi6CMPkJXZGjie2unsiMzj3Ig=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "66e1a090ded57a0f88e2b381a7d4daf4a5722c3f",
+        "rev": "740a22363033e9f1bb6270fbfb5a9574067af15b",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771208521,
-        "narHash": "sha256-X01Q3DgSpjeBpapoGA4rzKOn25qdKxbPnxHeMLNoHTU=",
+        "lastModified": 1771419570,
+        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fa56d7d6de78f5a7f997b0ea2bc6efd5868ad9e8",
+        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769939035,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "lastModified": 1770726378,
+        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770520253,
-        "narHash": "sha256-6rWuHgSENXKnC6HGGAdRolQrnp/8IzscDn7FQEo1uEQ=",
+        "lastModified": 1771125043,
+        "narHash": "sha256-ldf/s49n6rOAxl7pYLJGGS1N/assoHkCOWdEdLyNZkc=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ebb8a141f60bb0ec33836333e0ca7928a072217f",
+        "rev": "4912f951a26dc8142b176be2c2ad834319dc06e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771207491,
-        "narHash": "sha256-08s9LKq9Et4y9r6FSJLJUnRCyJHZMauAIok45ulQo0k=",
+        "lastModified": 1771501715,
+        "narHash": "sha256-U0P7KvlJZ3XLB8DhwnISmc5xEQWj9p9shRmCWAgT94k=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "434ed3900e9a7b23638da97ebe16ab0e0be7fef5",
+        "rev": "4744487ba359133ac2b04ea49aa0eb90841b8c67",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771283390,
-        "narHash": "sha256-rkSYYntpKP/OD1vXWw/W+GGRBSaC5OoHLR/yqJhlq/M=",
+        "lastModified": 1771542582,
+        "narHash": "sha256-sFWG+t8U1JuHViV2ESrtXf1kVq3GFHihmGSoAIAJjUQ=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "a7c87dd33cacc627b67447bdef591bd9a8b7d878",
+        "rev": "de994ca82ae92dca5ef1ea16cdcf7761ca1deff0",
         "type": "github"
       },
       "original": {

From f28302d219bdc4e57b43bc7b3f0fc6587ba0ee35 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Feb 2026 11:05:53 -0500
Subject: [PATCH 609/847] qbt: tweak

---
 configuration.nix        | 25 +++++++++++++++++++++++++
 services/qbittorrent.nix |  9 +++++----
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 7ba9c5e..1a7af64 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -132,6 +132,31 @@
       compressor = "zstd";
       supportedFilesystems = [ "f2fs" ];
     };
+
+    # BBR congestion control handles variable-latency VPN connections much
+    # better than CUBIC by probing bandwidth continuously rather than
+    # reacting to packet loss.
+    kernelModules = [ "tcp_bbr" ];
+
+    kernel.sysctl = {
+      # Use BBR + fair queuing for smooth throughput through the WireGuard VPN
+      "net.core.default_qdisc" = "fq";
+      "net.ipv4.tcp_congestion_control" = "bbr";
+
+      # Disable slow-start after idle: prevents TCP from resetting window
+      # size on each burst cycle (the primary cause of the 0 -> 40 MB/s spikes)
+      "net.ipv4.tcp_slow_start_after_idle" = 0;
+
+      # Larger socket buffers to accommodate the VPN bandwidth-delay product
+      # (22ms RTT * target throughput). Current 2.5MB max is too small.
+      "net.core.rmem_max" = 16777216;
+      "net.core.wmem_max" = 16777216;
+      "net.ipv4.tcp_rmem" = "4096 87380 16777216";
+      "net.ipv4.tcp_wmem" = "4096 65536 16777216";
+
+      # Higher backlog for the large number of concurrent torrent connections
+      "net.core.netdev_max_backlog" = 5000;
+    };
   };
 
   environment.etc = {
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 587d671..16a8d34 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -48,7 +48,7 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        MaxConnectionsPerTorrent = 100;
+        MaxConnectionsPerTorrent = 50;
         MaxUploadsPerTorrent = 10;
         MaxConnections = -1;
         MaxUploads = -1;
@@ -57,7 +57,7 @@
 
         # queueing
         QueueingSystemEnabled = true;
-        MaxActiveDownloads = 8; # num of torrents that can download at the same time
+        MaxActiveDownloads = 5; # keep focused: fewer torrents, each gets more bandwidth
         MaxActiveUploads = -1;
         MaxActiveTorrents = -1;
         IgnoreSlowTorrentsForQueueing = true;
@@ -84,8 +84,9 @@
         inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
-        # how many connections per sec
-        ConnectionSpeed = 300;
+        # Reduced from 300: that rate floods the VPN tunnel with SYN packets,
+        # starving actual data transfer and causing the 0->40MB/s spike pattern.
+        ConnectionSpeed = 20;
 
         # Automatic Torrent Management: use category save paths for new torrents
         DisableAutoTMMByDefault = false;

From 1c70bec43575e08ded7105c6b9f04fcc4d5aca48 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Feb 2026 14:12:13 -0500
Subject: [PATCH 610/847] qbt: fix permissions

---
 services/qbittorrent.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 16a8d34..8235273 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -18,7 +18,9 @@
     ])
     (lib.vpnNamespaceOpenPort config.services.qbittorrent.webuiPort "qbittorrent")
     (lib.serviceFilePerms "qbittorrent" [
-      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0750 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+      # 0770: group (media) needs write to delete files during upgrades —
+      # Radarr/Sonarr must unlink the old file before placing the new one.
+      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group}"
       "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
       "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
     ])
@@ -28,6 +30,11 @@
     enable = true;
     webuiPort = service_configs.ports.torrent;
     profileDir = "/var/lib/qBittorrent";
+    # Set the service group to 'media' so the systemd unit runs with media as
+    # the primary GID. Linux assigns new file ownership from the process's GID
+    # (set by systemd's Group= directive), not from /etc/passwd. Without this,
+    # downloads land as qbittorrent:qbittorrent (0700), blocking Radarr/Sonarr.
+    group = service_configs.media_group;
 
     serverConfig.LegalNotice.Accepted = true;
 

From ccf52777bbfef83559844eb6bff77ad904174345 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Feb 2026 15:19:46 -0500
Subject: [PATCH 611/847] formating

---
 services/monero.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/services/monero.nix b/services/monero.nix
index ce4869b..7b7f0bc 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -20,5 +20,4 @@
       restricted = true;
     };
   };
-
 }

From 4842c49ef41737383643fd5f192ff63d50dd0eae Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Feb 2026 15:25:44 -0500
Subject: [PATCH 612/847] matrix: update

---
 services/matrix.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 02025f9..774020d 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "082c44f3556e4e939c31cb66dda261af4f70bea8";
-        hash = "sha256-v7W6ZqSYB2TSkRj6Hte/UxBTCad94b+uzpROQ9jlwdQ=";
+        rev = "efd879fcd8013e359d398bb495ee5520d0e5156b";
+        hash = "sha256-7hS6Mi8iOrJqRnQvfbg7MM4SWf1ntMCe3uVGb2Gq7l8=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {
@@ -21,7 +21,7 @@ let
       cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
         inherit src;
         name = "${old.pname}-vendor";
-        hash = "sha256-Ib4yAT0Ncch8QT8CioF9s3fN34E50ZhbcX7m0lgwJkI=";
+        hash = "sha256-N7PdVPKnXAUZx1GElAolxTFWCU1MSmFjzZrEAsedCnU=";
       };
 
       patches = (old.patches or [ ]) ++ [

From cb368d588ec38142d6f8fe0e054f36a2fa9df168 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Feb 2026 15:27:56 -0500
Subject: [PATCH 613/847] qbt: increase ConnectionSpeed

---
 services/qbittorrent.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 8235273..7b8658d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -91,9 +91,7 @@
         inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
-        # Reduced from 300: that rate floods the VPN tunnel with SYN packets,
-        # starving actual data transfer and causing the 0->40MB/s spike pattern.
-        ConnectionSpeed = 20;
+        ConnectionSpeed = 200;
 
         # Automatic Torrent Management: use category save paths for new torrents
         DisableAutoTMMByDefault = false;

From 1be16bf49fe9359b9343d4cf9fc4b3421235f714 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Feb 2026 22:19:36 -0500
Subject: [PATCH 614/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 95b0d63..61c996d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1771469368,
-        "narHash": "sha256-yGRHre2BINQJBDAyUwxyzvgAce22J4pNdpLS8roo6fY=",
+        "lastModified": 1771641457,
+        "narHash": "sha256-TIekRGfeCwuEmYcWex40RTx0Gd46pqmyUtxdFKb5juI=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a708458be9b9421e377c54d86807d3490db53816",
+        "rev": "c4e2b8969e09067da9d44b6b5762e1e896418f40",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771419570,
-        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
+        "lastModified": 1771574726,
+        "narHash": "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
+        "rev": "c217913993d6c6f6805c3b1a3bda5e639adfde6d",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771542582,
-        "narHash": "sha256-sFWG+t8U1JuHViV2ESrtXf1kVq3GFHihmGSoAIAJjUQ=",
+        "lastModified": 1771715376,
+        "narHash": "sha256-jNn24ZKdTNYkna7w6ajmFK30/wiKu7iFOCB9MSq9pxE=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "de994ca82ae92dca5ef1ea16cdcf7761ca1deff0",
+        "rev": "11421fb1650b845452a5e00cb2c8d931a7fd6c02",
         "type": "github"
       },
       "original": {

From c8c52592da5dcdbbfa074fc39ec5e91e081b49d8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Feb 2026 22:47:33 -0500
Subject: [PATCH 615/847] matrix: update

---
 services/matrix.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 774020d..574e8a5 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "efd879fcd8013e359d398bb495ee5520d0e5156b";
-        hash = "sha256-7hS6Mi8iOrJqRnQvfbg7MM4SWf1ntMCe3uVGb2Gq7l8=";
+        rev = "688ef727e5f2b04812f79bd5507e02f17f70b699";
+        hash = "sha256-mLcz20Gd5cYOCox0vDWYepFYenBD72klcDM1ARxk1dA=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {
@@ -21,7 +21,7 @@ let
       cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
         inherit src;
         name = "${old.pname}-vendor";
-        hash = "sha256-N7PdVPKnXAUZx1GElAolxTFWCU1MSmFjzZrEAsedCnU=";
+        hash = "sha256-V7OEvZxRe4Hg/XNp4PtQWxxQS8a5ONUw5X+6n7DIaCI=";
       };
 
       patches = (old.patches or [ ]) ++ [

From 50c08d419083e067dc2814d8fb928470b5ae4a20 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 23 Feb 2026 15:13:47 -0500
Subject: [PATCH 616/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 61c996d..5c0a0f8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770260404,
-        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
+        "lastModified": 1771744638,
+        "narHash": "sha256-EDLi+YAsEEAmMeZe1v6GccuGRbCkpSZp/+A6g+pivR8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
+        "rev": "cb6c151f5c9db4df0b69d06894dc8484de1f16a0",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1771492583,
-        "narHash": "sha256-nQzvnU4BGu8dA6BsPPCqmVcab/3ebVmHtX3ZWbW3Hxc=",
+        "lastModified": 1771834715,
+        "narHash": "sha256-5VI2KiMifx3Dca7nDJzctO3HpnS6zrvesdkLoZBrQRY=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "5e9380994665ef66c87ab8e22c913ff837174ce4",
+        "rev": "b798c53da0f7e521317a5413335096a21070cf0b",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771574726,
-        "narHash": "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=",
+        "lastModified": 1771714954,
+        "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c217913993d6c6f6805c3b1a3bda5e639adfde6d",
+        "rev": "afbbf774e2087c3d734266c22f96fca2e78d3620",
         "type": "github"
       },
       "original": {
@@ -413,11 +413,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1769471280,
-        "narHash": "sha256-6BADVRSHHwO3NcAua44hagAJTqPNDxEhPjBMehURiHQ=",
+        "lastModified": 1771869552,
+        "narHash": "sha256-veaVrRWCSy7HYAAjUFLw8HASKcj+3f0W+sCwS3QiaM4=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "d6f443ede6c90a049085b4598e438849e19e74f4",
+        "rev": "28a2b93492dac877dce0b38f078eacf74fce26e7",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771501715,
-        "narHash": "sha256-U0P7KvlJZ3XLB8DhwnISmc5xEQWj9p9shRmCWAgT94k=",
+        "lastModified": 1771812348,
+        "narHash": "sha256-d8LL7nSpFueYtZhK29t7j3JiaKLA4lqW8neJv/uZGQc=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "4744487ba359133ac2b04ea49aa0eb90841b8c67",
+        "rev": "ffc8fceb1e3cad06b5074cda30f88132b4fb4869",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771715376,
-        "narHash": "sha256-jNn24ZKdTNYkna7w6ajmFK30/wiKu7iFOCB9MSq9pxE=",
+        "lastModified": 1771801782,
+        "narHash": "sha256-bwNSnudbgtknL3qhWw42JmYlLPiVPx37krjH+m8jsrA=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "11421fb1650b845452a5e00cb2c8d931a7fd6c02",
+        "rev": "2e524b3ddb3919427c9d264cfa442b3c2b8d7eb0",
         "type": "github"
       },
       "original": {

From 34775791dacfa2987ccecdb2c986b7d5ac69ec92 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 23 Feb 2026 15:24:31 -0500
Subject: [PATCH 617/847] matrix: update

---
 services/matrix.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 574e8a5..3a59e63 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "688ef727e5f2b04812f79bd5507e02f17f70b699";
-        hash = "sha256-mLcz20Gd5cYOCox0vDWYepFYenBD72klcDM1ARxk1dA=";
+        rev = "cb9786466bee299c1260171cee2a5ca407bda108";
+        hash = "sha256-uKntvmaXyeuqpeFTv0k4IjMu/fCdYlKiKJQ6JC/z7Yk=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {

From 5c4cc0b3fc6b7c60b3d429534924dcb10814ef5d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Feb 2026 13:04:55 -0500
Subject: [PATCH 618/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5c0a0f8..cd95573 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771469470,
-        "narHash": "sha256-GnqdqhrguKNN3HtVfl6z+zbV9R9jhHFm3Z8nu7R6ml0=",
+        "lastModified": 1771881364,
+        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4707eec8d1d2db5182ea06ed48c820a86a42dc13",
+        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
         "type": "github"
       },
       "original": {
@@ -296,11 +296,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771714954,
-        "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
+        "lastModified": 1771903837,
+        "narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "afbbf774e2087c3d734266c22f96fca2e78d3620",
+        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771801782,
-        "narHash": "sha256-bwNSnudbgtknL3qhWw42JmYlLPiVPx37krjH+m8jsrA=",
+        "lastModified": 1771888186,
+        "narHash": "sha256-CTaSxzIwkuhHl/gjvRbDJ3KZKaf2sZkay26aNeHOiBQ=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "2e524b3ddb3919427c9d264cfa442b3c2b8d7eb0",
+        "rev": "956a14978525f21b75ef4d1103226e70ae7f7896",
         "type": "github"
       },
       "original": {

From 03c0cd0110095398ec923e2ad0c66564154e2384 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Feb 2026 13:05:00 -0500
Subject: [PATCH 619/847] matrix: update

---
 services/matrix.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 3a59e63..10a4ebf 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -12,8 +12,8 @@ let
         domain = "forgejo.ellis.link";
         owner = "continuwuation";
         repo = "continuwuity";
-        rev = "cb9786466bee299c1260171cee2a5ca407bda108";
-        hash = "sha256-uKntvmaXyeuqpeFTv0k4IjMu/fCdYlKiKJQ6JC/z7Yk=";
+        rev = "052c4dfa2165fdc4839fed95b71446120273cf23";
+        hash = "sha256-kQV4glRrKczoJpn9QIMgB5ac+saZQjSZPel+9K9Ykcs=";
       };
     in
     pkgs.matrix-continuwuity.overrideAttrs (old: {
@@ -21,7 +21,7 @@ let
       cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
         inherit src;
         name = "${old.pname}-vendor";
-        hash = "sha256-V7OEvZxRe4Hg/XNp4PtQWxxQS8a5ONUw5X+6n7DIaCI=";
+        hash = "sha256-vlOXQL8wwEGFX+w0G/eIeHW3J1UDzhJ501kYhAghDV8=";
       };
 
       patches = (old.patches or [ ]) ++ [

From 294cb6453e4f74b65007949e9acb5df4d4925e3d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Feb 2026 14:43:15 -0500
Subject: [PATCH 620/847] ntfy-alerts: init

---
 configuration.nix             |   2 +
 modules/age-secrets.nix       |  15 +++
 modules/ntfy-alerts.nix       | 121 +++++++++++++++++++++++
 secrets/ntfy-alerts-token.age | Bin 0 -> 266 bytes
 secrets/ntfy-alerts-topic.age | Bin 0 -> 254 bytes
 services/ntfy-alerts.nix      |  10 ++
 tests/ntfy-alerts.nix         | 174 ++++++++++++++++++++++++++++++++++
 tests/tests.nix               |   2 +
 8 files changed, 324 insertions(+)
 create mode 100644 modules/ntfy-alerts.nix
 create mode 100644 secrets/ntfy-alerts-token.age
 create mode 100644 secrets/ntfy-alerts-topic.age
 create mode 100644 services/ntfy-alerts.nix
 create mode 100644 tests/ntfy-alerts.nix

diff --git a/configuration.nix b/configuration.nix
index 1a7af64..aad090a 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -20,6 +20,7 @@
     ./modules/no-rgb.nix
     ./modules/security.nix
     ./modules/arr-init.nix
+    ./modules/ntfy-alerts.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -64,6 +65,7 @@
     ./services/syncthing.nix
 
     ./services/ntfy.nix
+    ./services/ntfy-alerts.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index bdc56eb..fea3c05 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -65,5 +65,20 @@
       owner = "root";
       group = "root";
     };
+
+    # ntfy-alerts secrets
+    ntfy-alerts-topic = {
+      file = ../secrets/ntfy-alerts-topic.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    ntfy-alerts-token = {
+      file = ../secrets/ntfy-alerts-token.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
   };
 }
diff --git a/modules/ntfy-alerts.nix b/modules/ntfy-alerts.nix
new file mode 100644
index 0000000..6446e05
--- /dev/null
+++ b/modules/ntfy-alerts.nix
@@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.ntfyAlerts;
+
+  curl = "${pkgs.curl}/bin/curl";
+  hostname = config.networking.hostName;
+
+  # Build the curl auth args as a proper bash array fragment
+  authCurlArgs =
+    if cfg.tokenFile != null then
+      ''
+        if [ -f "${cfg.tokenFile}" ]; then
+          TOKEN=$(cat "${cfg.tokenFile}" 2>/dev/null || echo "")
+          if [ -n "$TOKEN" ]; then
+            AUTH_ARGS=(-H "Authorization: Bearer $TOKEN")
+          fi
+        fi
+      ''
+    else
+      "";
+
+  # Systemd failure alert script
+  systemdAlertScript = pkgs.writeShellScript "ntfy-systemd-alert" ''
+    set -euo pipefail
+
+    UNIT_NAME="$1"
+    SERVER_URL="${cfg.serverUrl}"
+    TOPIC=$(cat "${cfg.topicFile}" 2>/dev/null | tr -d '[:space:]')
+    if [ -z "$TOPIC" ]; then
+      echo "ERROR: Could not read topic from ${cfg.topicFile}"
+      exit 1
+    fi
+
+    # Get journal output for context
+    JOURNAL_OUTPUT=$(${pkgs.systemd}/bin/journalctl -u "$UNIT_NAME" -n 15 --no-pager 2>/dev/null || echo "No journal output available")
+
+    # Build auth args
+    AUTH_ARGS=()
+    ${authCurlArgs}
+
+    # Send notification
+    ${curl} -sf --max-time 15 -X POST \
+      "$SERVER_URL/$TOPIC" \
+      -H "Title: [${hostname}] Service failed: $UNIT_NAME" \
+      -H "Priority: high" \
+      -H "Tags: warning" \
+      "''${AUTH_ARGS[@]}" \
+      -d "$JOURNAL_OUTPUT" || true
+  '';
+
+in
+{
+  options.services.ntfyAlerts = {
+    enable = lib.mkEnableOption "ntfy push notifications for system alerts";
+
+    serverUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "The ntfy server URL (e.g. https://ntfy.example.com)";
+      example = "https://ntfy.example.com";
+    };
+
+    topicFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to a file containing the ntfy topic name to publish alerts to.";
+      example = "/run/agenix/ntfy-alerts-topic";
+    };
+
+    tokenFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file containing the ntfy auth token.
+        If set, uses Authorization: Bearer header for authentication.
+      '';
+      example = "/run/secrets/ntfy-token";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Per-service OnFailure for monitored services
+    systemd.services = {
+      "ntfy-alert@" = {
+        description = "Send ntfy notification for failed service %i";
+
+        unitConfig.OnFailure = lib.mkForce "";
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${systemdAlertScript} %i";
+          TimeoutSec = 30;
+        };
+      };
+
+    };
+
+    # Global OnFailure drop-in for all services
+    systemd.packages = [
+      (pkgs.writeTextDir "etc/systemd/system/service.d/onfailure.conf" ''
+        [Unit]
+        OnFailure=ntfy-alert@%p.service
+      '')
+    ];
+    # ZED (ZFS Event Daemon) ntfy notification settings
+    services.zfs.zed = {
+      enableMail = false;
+      settings = {
+        ZED_NTFY_URL = cfg.serverUrl;
+        ZED_NTFY_TOPIC = "$(cat ${cfg.topicFile} | tr -d '[:space:]')";
+        ZED_NTFY_ACCESS_TOKEN = lib.mkIf (cfg.tokenFile != null) "$(cat ${cfg.tokenFile})";
+        ZED_NOTIFY_VERBOSE = true;
+      };
+    };
+
+  };
+}
diff --git a/secrets/ntfy-alerts-token.age b/secrets/ntfy-alerts-token.age
new file mode 100644
index 0000000000000000000000000000000000000000..f3f31aea9463bc8d92251fcd2fec4e23a7102e20
GIT binary patch
literal 266
zcmZQ@_Y83kiVO&0xG`sKxN?h%L~f4M_r;v1d$zT&+$E5`C?V5jF1tSCN$&0vrO9=B
z?@RNG35eYe`#-6m^XR3D#3#ReUO9CfR6g)Zc|$v2IjhpQ$(wha+RKu1&u@lS*|{4F
zN;8ft>8gnZ9C>~AufV*Aza`WzeF&TUT844)wh66AXHA;Fz}~CPr{jk8JTosBy(3YR
zyf3ljUzJt5*%#1fBVTa2?D5S`hRVAgSHf;On_hbyv*+C1a_M(fmAXfkPExJx<*+T`
z?Wy?odXj_CxeAd(Tr;}E;ye?>U5uZv>Yg<3eDp-sdN+oIq?owqTV+QdY_Qn1>Bx(`
b7Yj7y<4gT#{*at&H=C#C%7G6l8#V#}lt6%B

literal 0
HcmV?d00001

diff --git a/secrets/ntfy-alerts-topic.age b/secrets/ntfy-alerts-topic.age
new file mode 100644
index 0000000000000000000000000000000000000000..2fc770fbbef742c789afc491d5ff04bbf238bc69
GIT binary patch
literal 254
zcmZQ@_Y83kiVO&0*c!KaUy|7piG9M~mgGh(+v>pAvf!UerPvJjt)}bq6u8Y_ZT#i9
z{6NKyla}v7V<L|pY3yHDHQ!t9<BNrp9Oga}*EEc34}Lwf)3){BgOhspE}eP`GoINA
zS$5mp%_#YPF3>dfiMIs*PyR*gK3J@6@8&g?Okw@Or~HC9c2%J4uK8!DAH8QfBkoj9
ze?sO2v3dW^+J4{5GJNg-PWZ0<@^sGCm9|fGwtl)-^7_Ohi7L6Nf-kP@oFj8($|-xB
znFszeCtk|G{;1n%wwAHdSMS5S51)TNKjFN9!_(6VMFJ1q_swaWxF>qzs%6dpPH`1v
PFzhV!RS1{4RV)qw<<))X

literal 0
HcmV?d00001

diff --git a/services/ntfy-alerts.nix b/services/ntfy-alerts.nix
new file mode 100644
index 0000000..089b270
--- /dev/null
+++ b/services/ntfy-alerts.nix
@@ -0,0 +1,10 @@
+{ config, service_configs, ... }:
+{
+  services.ntfyAlerts = {
+    enable = true;
+    serverUrl = "https://${service_configs.ntfy.domain}";
+    topicFile = config.age.secrets.ntfy-alerts-topic.path;
+
+    tokenFile = config.age.secrets.ntfy-alerts-token.path;
+  };
+}
diff --git a/tests/ntfy-alerts.nix b/tests/ntfy-alerts.nix
new file mode 100644
index 0000000..c9b72cf
--- /dev/null
+++ b/tests/ntfy-alerts.nix
@@ -0,0 +1,174 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  testPkgs = pkgs.appendOverlays [ (import ../modules/overlays.nix) ];
+in
+testPkgs.testers.runNixOSTest {
+  name = "ntfy-alerts";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [
+        ../modules/ntfy-alerts.nix
+      ];
+
+      system.stateVersion = config.system.stateVersion;
+
+      virtualisation.memorySize = 2048;
+
+      environment.systemPackages = with pkgs; [
+        curl
+        jq
+      ];
+
+      # Create test topic file
+      systemd.tmpfiles.rules = [
+        "f /run/ntfy-test-topic 0644 root root - test-alerts"
+      ];
+
+      # Mock ntfy server that records POST requests
+      systemd.services.mock-ntfy =
+        let
+          mockNtfyScript = pkgs.writeScript "mock-ntfy.py" ''
+            import json
+            import os
+            from http.server import HTTPServer, BaseHTTPRequestHandler
+            from datetime import datetime
+
+            REQUESTS_FILE = "/tmp/ntfy-requests.json"
+
+            class MockNtfy(BaseHTTPRequestHandler):
+                def _respond(self, code=200, body=b"Ok"):
+                    self.send_response(code)
+                    self.send_header("Content-Type", "application/json")
+                    self.end_headers()
+                    self.wfile.write(body if isinstance(body, bytes) else body.encode())
+
+                def do_GET(self):
+                    self._respond()
+
+                def do_POST(self):
+                    content_length = int(self.headers.get("Content-Length", 0))
+                    body = self.rfile.read(content_length).decode() if content_length > 0 else ""
+
+                    request_data = {
+                        "timestamp": datetime.now().isoformat(),
+                        "path": self.path,
+                        "headers": dict(self.headers),
+                        "body": body,
+                    }
+
+                    # Load existing requests or start new list
+                    requests = []
+                    if os.path.exists(REQUESTS_FILE):
+                        try:
+                            with open(REQUESTS_FILE, "r") as f:
+                                requests = json.load(f)
+                        except:
+                            requests = []
+
+                    requests.append(request_data)
+
+                    with open(REQUESTS_FILE, "w") as f:
+                        json.dump(requests, f, indent=2)
+
+                    self._respond()
+
+                def log_message(self, format, *args):
+                    pass
+
+            HTTPServer(("0.0.0.0", 8080), MockNtfy).serve_forever()
+          '';
+        in
+        {
+          description = "Mock ntfy server";
+          wantedBy = [ "multi-user.target" ];
+          before = [ "ntfy-alert@test-fail.service" ];
+          serviceConfig = {
+            ExecStart = "${pkgs.python3}/bin/python3 ${mockNtfyScript}";
+            Type = "simple";
+          };
+        };
+
+      # Test service that will fail
+      systemd.services.test-fail = {
+        description = "Test service that fails";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.coreutils}/bin/false";
+        };
+      };
+
+      # Configure ntfy-alerts to use mock server
+      services.ntfyAlerts = {
+        enable = true;
+        serverUrl = "http://localhost:8080";
+        topicFile = "/run/ntfy-test-topic";
+
+      };
+    };
+
+  testScript = ''
+    import json
+    import time
+
+    start_all()
+
+    # Wait for mock ntfy server to be ready
+    machine.wait_for_unit("mock-ntfy.service")
+    machine.wait_until_succeeds("curl -sf http://localhost:8080/", timeout=30)
+
+    # Verify the ntfy-alert@ template service exists
+    machine.succeed("systemctl list-unit-files | grep ntfy-alert@")
+
+    # Verify the global OnFailure drop-in is configured
+    machine.succeed("cat /etc/systemd/system/service.d/onfailure.conf | grep -q 'OnFailure=ntfy-alert@%p.service'")
+
+    # Trigger the test-fail service
+    machine.succeed("systemctl start test-fail.service || true")
+
+    # Wait a moment for the failure notification to be sent
+    time.sleep(2)
+
+    # Verify the ntfy-alert@test-fail service ran
+    machine.succeed("systemctl is-active ntfy-alert@test-fail.service || systemctl is-failed ntfy-alert@test-fail.service || true")
+
+    # Check that the mock server received a POST request
+    machine.wait_until_succeeds("test -f /tmp/ntfy-requests.json", timeout=30)
+
+    # Verify the request content
+    result = machine.succeed("cat /tmp/ntfy-requests.json")
+    requests = json.loads(result)
+
+    assert len(requests) >= 1, f"Expected at least 1 request, got {len(requests)}"
+
+    # Check the first request
+    req = requests[0]
+    assert "/test-alerts" in req["path"], f"Expected path to contain /test-alerts, got {req['path']}"
+    assert "Title" in req["headers"], "Expected Title header"
+    assert "test-fail" in req["headers"]["Title"], f"Expected Title to contain 'test-fail', got {req['headers']['Title']}"
+    assert req["headers"]["Priority"] == "high", f"Expected Priority 'high', got {req['headers'].get('Priority')}"
+    assert req["headers"]["Tags"] == "warning", f"Expected Tags 'warning', got {req['headers'].get('Tags')}"
+
+    print(f"Received notification: Title={req['headers']['Title']}, Body={req['body'][:100]}...")
+
+    # Idempotency test: trigger failure again
+    machine.succeed("rm /tmp/ntfy-requests.json")
+    machine.succeed("systemctl reset-failed test-fail.service || true")
+    machine.succeed("systemctl start test-fail.service || true")
+    time.sleep(2)
+
+    # Verify another notification was sent
+    machine.wait_until_succeeds("test -f /tmp/ntfy-requests.json", timeout=30)
+    result = machine.succeed("cat /tmp/ntfy-requests.json")
+    requests = json.loads(result)
+    assert len(requests) >= 1, f"Expected at least 1 request after second failure, got {len(requests)}"
+
+    print("All tests passed!")
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index 5b1e57b..295485d 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -24,4 +24,6 @@ in
 
   # arr tests
   arrInitTest = handleTest ./arr-init.nix;
+  # ntfy alerts test
+  ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 }

From 9a4571a25fa7bd7177e53d300b1a41539c8961cc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Feb 2026 14:51:11 -0500
Subject: [PATCH 621/847] flake: expose tests as checks output

---
 flake.nix | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/flake.nix b/flake.nix
index edd15c6..5251504 100644
--- a/flake.nix
+++ b/flake.nix
@@ -235,6 +235,10 @@
         buildPlatform = builtins.currentSystem;
       };
       lib = import ./modules/lib.nix { inherit inputs pkgs service_configs; };
+      testSuite = import ./tests/tests.nix {
+        inherit pkgs lib inputs;
+        config = self.nixosConfigurations.muffin.config;
+      };
     in
     {
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
@@ -319,14 +323,9 @@
         };
       };
 
-      packages.${system} =
-        let
-          testSuite = import ./tests/tests.nix {
-            inherit pkgs lib inputs;
-            config = self.nixosConfigurations.muffin.config;
-          };
-        in
-        {
+      checks.${system} = testSuite;
+
+      packages.${system} = {
           tests = pkgs.linkFarm "all-tests" (
             pkgs.lib.mapAttrsToList (name: test: {
               name = name;

From 39a76a3265beb78707f21efa5af5bf1655c56600 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 24 Feb 2026 21:21:24 -0500
Subject: [PATCH 622/847] zfs: fix sanoid dataset name for jellyfin cache

---
 modules/zfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index abec78f..e5e55b3 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -64,7 +64,7 @@ in
       yearly = 0;
     };
 
-    datasets."${service_configs.zpool_ssds}/services/jellyfin_cache" = {
+    datasets."${service_configs.zpool_ssds}/services/jellyfin/cache" = {
       recursive = true;
       autoprune = true;
       autosnap = true;

From dc9d58a5432a64e78500476a1f6c149dc54d58f9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 25 Feb 2026 00:43:34 -0500
Subject: [PATCH 623/847] ntfy-alerts: suppress notifications for sanoid

---
 modules/ntfy-alerts.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/modules/ntfy-alerts.nix b/modules/ntfy-alerts.nix
index 6446e05..baaa193 100644
--- a/modules/ntfy-alerts.nix
+++ b/modules/ntfy-alerts.nix
@@ -97,6 +97,11 @@ in
         };
       };
 
+      # TODO: sanoid's ExecStartPre runs `zfs allow` which blocks on TXG sync;
+      # on the hdds pool (slow spinning disks + large async frees) this causes
+      # 30+ minute hangs and guaranteed timeouts. Suppress until we fix sanoid
+      # to run as root without `zfs allow`. See: nixpkgs#72060, openzfs/zfs#14180
+      "sanoid".unitConfig.OnFailure = lib.mkForce "";
     };
 
     # Global OnFailure drop-in for all services
@@ -105,6 +110,12 @@ in
         [Unit]
         OnFailure=ntfy-alert@%p.service
       '')
+
+      # Sanoid-specific drop-in to override the global OnFailure (see TODO above)
+      (pkgs.writeTextDir "etc/systemd/system/sanoid.service.d/onfailure.conf" ''
+        [Unit]
+        OnFailure=
+      '')
     ];
     # ZED (ZFS Event Daemon) ntfy notification settings
     services.zfs.zed = {

From e545c1c775c39f24f4dc08493c31b0c32ef327df Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 25 Feb 2026 19:01:56 -0500
Subject: [PATCH 624/847] update

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index cd95573..4d89aeb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,11 +27,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1771121070,
-        "narHash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI=",
+        "lastModified": 1771796463,
+        "narHash": "sha256-9bCDuUzpwJXcHMQYMS1yNuzYMmKO/CCwCexpjWOl62I=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "a2812c19f1ed2e5ed5ce2ef7109798b575c180e1",
+        "rev": "3d3de3313e263e04894f284ac18177bd26169bad",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771744638,
-        "narHash": "sha256-EDLi+YAsEEAmMeZe1v6GccuGRbCkpSZp/+A6g+pivR8=",
+        "lastModified": 1772020340,
+        "narHash": "sha256-aqBl3GNpCadMoJ/hVkWTijM1Aeilc278MjM+LA3jK6g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cb6c151f5c9db4df0b69d06894dc8484de1f16a0",
+        "rev": "36e38ca0d9afe4c55405fdf22179a5212243eecc",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1771834715,
-        "narHash": "sha256-5VI2KiMifx3Dca7nDJzctO3HpnS6zrvesdkLoZBrQRY=",
+        "lastModified": 1772039686,
+        "narHash": "sha256-pXZ2hQ/m256aC/+ufwXclGSN6CGMm7Lgf0aCNStulno=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "b798c53da0f7e521317a5413335096a21070cf0b",
+        "rev": "5999351aa57d6b0a2d38078dd4ec075e73c48115",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1771641457,
-        "narHash": "sha256-TIekRGfeCwuEmYcWex40RTx0Gd46pqmyUtxdFKb5juI=",
+        "lastModified": 1771987719,
+        "narHash": "sha256-A7pRC7rhAz89dJsn0vjboPxXqpUzMGowlj4K0byFnUk=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c4e2b8969e09067da9d44b6b5762e1e896418f40",
+        "rev": "69edebc75286af9cf8175c866a41834b459eab3e",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1771423359,
-        "narHash": "sha256-yRKJ7gpVmXbX2ZcA8nFi6CMPkJXZGjie2unsiMzj3Ig=",
+        "lastModified": 1771969195,
+        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "740a22363033e9f1bb6270fbfb5a9574067af15b",
+        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770726378,
-        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
+        "lastModified": 1771858127,
+        "narHash": "sha256-Gtre9YoYl3n25tJH2AoSdjuwcqij5CPxL3U3xysYD08=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
+        "rev": "49bbbfc218bf3856dfa631cead3b052d78248b83",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771125043,
-        "narHash": "sha256-ldf/s49n6rOAxl7pYLJGGS1N/assoHkCOWdEdLyNZkc=",
+        "lastModified": 1771988922,
+        "narHash": "sha256-Fc6FHXtfEkLtuVJzd0B6tFYMhmcPLuxr90rWfb/2jtQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4912f951a26dc8142b176be2c2ad834319dc06e8",
+        "rev": "f4443dc3f0b6c5e6b77d923156943ce816d1fcb9",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1771888186,
-        "narHash": "sha256-CTaSxzIwkuhHl/gjvRbDJ3KZKaf2sZkay26aNeHOiBQ=",
+        "lastModified": 1772060981,
+        "narHash": "sha256-Q+99+w6LY8B0loDP3sPlcjasFVknyu9WAGOmmeDgj+E=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "956a14978525f21b75ef4d1103226e70ae7f7896",
+        "rev": "be435c797e4dfbdf7c39aa101ad98cb3e00d1950",
         "type": "github"
       },
       "original": {

From ad33f94e3256ab4670dd01e8074726c1119a734e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Feb 2026 00:04:07 -0500
Subject: [PATCH 625/847] minecraft: make more responsive

---
 configuration.nix      |  6 ++++++
 flake.nix              | 22 +++++++++++-----------
 services/minecraft.nix | 41 ++++++++++++++++++++++++++++++++++++++++-
 tests/minecraft.nix    |  4 ++++
 4 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index aad090a..6212c0c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -158,6 +158,12 @@
 
       # Higher backlog for the large number of concurrent torrent connections
       "net.core.netdev_max_backlog" = 5000;
+
+      # Minecraft server optimizations
+      # Disable autogroup for better scheduling of game server threads
+      "kernel.sched_autogroup_enabled" = 0;
+      # Huge pages for Minecraft JVM (4000MB heap / 2MB per page + ~200 overhead)
+      "vm.nr_hugepages" = 2200;
     };
   };
 
diff --git a/flake.nix b/flake.nix
index 5251504..2285cc2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -326,16 +326,16 @@
       checks.${system} = testSuite;
 
       packages.${system} = {
-          tests = pkgs.linkFarm "all-tests" (
-            pkgs.lib.mapAttrsToList (name: test: {
-              name = name;
-              path = test;
-            }) testSuite
-          );
-        }
-        // (pkgs.lib.mapAttrs' (name: test: {
-          name = "test-${name}";
-          value = test;
-        }) testSuite);
+        tests = pkgs.linkFarm "all-tests" (
+          pkgs.lib.mapAttrsToList (name: test: {
+            name = name;
+            path = test;
+          }) testSuite
+        );
+      }
+      // (pkgs.lib.mapAttrs' (name: test: {
+        name = "test-${name}";
+        value = test;
+      }) testSuite);
     };
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index 78eefa9..3b94e8c 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -35,7 +35,38 @@
         let
           heap_size = "4000M";
         in
-        "-Xmx${heap_size} -Xms${heap_size} -XX:+UseZGC -XX:+ZGenerational";
+        lib.concatStringsSep " " [
+          # Memory
+          "-Xmx${heap_size}"
+          "-Xms${heap_size}"
+          # GC
+          "-XX:+UseZGC"
+          "-XX:+ZGenerational"
+          # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
+          "-XX:+UnlockExperimentalVMOptions"
+          "-XX:+UnlockDiagnosticVMOptions"
+          "-XX:+AlwaysActAsServerClassMachine"
+          "-XX:+AlwaysPreTouch"
+          "-XX:+DisableExplicitGC"
+          "-XX:+UseNUMA"
+          "-XX:+PerfDisableSharedMem"
+          "-XX:+UseFastUnorderedTimeStamps"
+          "-XX:+UseCriticalJavaThreadPriority"
+          "-XX:ThreadPriorityPolicy=1"
+          "-XX:AllocatePrefetchStyle=3"
+          "-XX:-DontCompileHugeMethods"
+          "-XX:MaxNodeLimit=240000"
+          "-XX:NodeLimitFudgeFactor=8000"
+          "-XX:ReservedCodeCacheSize=400M"
+          "-XX:NonNMethodCodeHeapSize=12M"
+          "-XX:ProfiledCodeHeapSize=194M"
+          "-XX:NonProfiledCodeHeapSize=194M"
+          "-XX:NmethodSweepActivity=1"
+          "-XX:+UseVectorCmov"
+          # Large pages (requires vm.nr_hugepages sysctl)
+          "-XX:+UseLargePages"
+          "-XX:LargePageSizeInBytes=2m"
+        ];
 
       serverProperties = {
         server-port = service_configs.ports.minecraft;
@@ -116,6 +147,14 @@
     };
   };
 
+  systemd.services.minecraft-server-main = {
+    serviceConfig = {
+      Nice = -5;
+      IOSchedulingPriority = 0;
+      LimitMEMLOCK = "infinity"; # Required for large pages
+    };
+  };
+
   services.caddy.virtualHosts = lib.mkIf (config.services.caddy.enable) {
     "map.${service_configs.https.domain}".extraConfig = ''
       root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index b2e0956..7a27d21 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -60,6 +60,10 @@ testPkgs.testers.runNixOSTest {
         wants = lib.mkForce [ ];
         after = lib.mkForce [ ];
         requires = lib.mkForce [ ];
+        serviceConfig = {
+          Nice = lib.mkForce 0;
+          LimitMEMLOCK = lib.mkForce "infinity";
+        };
       };
 
       # Test-specific overrides only - reduce memory for testing

From b977b578e0c9cc4879082475d9e51c1028175334 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Feb 2026 15:39:19 -0500
Subject: [PATCH 626/847] arr-init: extract to standalone flake repo

---
 configuration.nix    |   1 -
 flake.lock           |  21 ++
 flake.nix            |   9 +-
 modules/arr-init.nix | 497 -------------------------------------------
 tests/arr-init.nix   | 419 ------------------------------------
 tests/tests.nix      |   3 +-
 6 files changed, 30 insertions(+), 920 deletions(-)
 delete mode 100644 modules/arr-init.nix
 delete mode 100644 tests/arr-init.nix

diff --git a/configuration.nix b/configuration.nix
index 6212c0c..61ecae2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -19,7 +19,6 @@
     ./modules/secureboot.nix
     ./modules/no-rgb.nix
     ./modules/security.nix
-    ./modules/arr-init.nix
     ./modules/ntfy-alerts.nix
 
     ./services/postgresql.nix
diff --git a/flake.lock b/flake.lock
index 4d89aeb..0141f0c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -25,6 +25,26 @@
         "type": "github"
       }
     },
+    "arr-init": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772224010,
+        "narHash": "sha256-nCchZRcIU2IRRjXUi/7jAfKZFtWD4NZqshAKqNJP+Mg=",
+        "ref": "refs/heads/main",
+        "rev": "e9d5d8e0c92ef408f3340933d9109738675d64b8",
+        "revCount": 1,
+        "type": "git",
+        "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1771796463,
@@ -352,6 +372,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "arr-init": "arr-init",
         "deploy-rs": "deploy-rs",
         "disko": "disko",
         "home-manager": "home-manager",
diff --git a/flake.nix b/flake.nix
index 2285cc2..1a0fbd7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -68,6 +68,11 @@
     ytbn-graphing-software = {
       url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
     };
+
+    arr-init = {
+      url = "git+ssh://gitea@git.gardling.com/titaniumtown/arr-init";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -83,7 +88,7 @@
       srvos,
       deploy-rs,
       impermanence,
-      agenix,
+      arr-init,
       ...
     }@inputs:
     let
@@ -295,6 +300,8 @@
 
           lanzaboote.nixosModules.lanzaboote
 
+          arr-init.nixosModules.default
+
           home-manager.nixosModules.home-manager
           (
             {
diff --git a/modules/arr-init.nix b/modules/arr-init.nix
deleted file mode 100644
index 67ac081..0000000
--- a/modules/arr-init.nix
+++ /dev/null
@@ -1,497 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.arrInit;
-  bazarrCfg = config.services.bazarrInit;
-
-  downloadClientModule = lib.types.submodule {
-    options = {
-      name = lib.mkOption {
-        type = lib.types.str;
-        description = "Display name of the download client (e.g. \"qBittorrent\").";
-        example = "qBittorrent";
-      };
-
-      implementation = lib.mkOption {
-        type = lib.types.str;
-        description = "Implementation identifier for the Servarr API.";
-        example = "QBittorrent";
-      };
-
-      configContract = lib.mkOption {
-        type = lib.types.str;
-        description = "Config contract identifier for the Servarr API.";
-        example = "QBittorrentSettings";
-      };
-
-      protocol = lib.mkOption {
-        type = lib.types.enum [
-          "torrent"
-          "usenet"
-        ];
-        default = "torrent";
-        description = "Download protocol type.";
-      };
-
-      fields = lib.mkOption {
-        type = lib.types.attrsOf lib.types.anything;
-        default = { };
-        description = ''
-          Flat key/value pairs for the download client configuration.
-          These are converted to the API's [{name, value}] array format.
-        '';
-        example = {
-          host = "192.168.15.1";
-          port = 6011;
-          useSsl = false;
-          tvCategory = "tvshows";
-        };
-      };
-    };
-  };
-
-  syncedAppModule = lib.types.submodule {
-    options = {
-      name = lib.mkOption {
-        type = lib.types.str;
-        description = "Display name of the application to sync (e.g. \"Sonarr\").";
-        example = "Sonarr";
-      };
-
-      implementation = lib.mkOption {
-        type = lib.types.str;
-        description = "Implementation identifier for the Prowlarr application API.";
-        example = "Sonarr";
-      };
-
-      configContract = lib.mkOption {
-        type = lib.types.str;
-        description = "Config contract identifier for the Prowlarr application API.";
-        example = "SonarrSettings";
-      };
-
-      syncLevel = lib.mkOption {
-        type = lib.types.str;
-        default = "fullSync";
-        description = "Sync level for the application.";
-      };
-
-      prowlarrUrl = lib.mkOption {
-        type = lib.types.str;
-        description = "URL of the Prowlarr instance.";
-        example = "http://localhost:9696";
-      };
-
-      baseUrl = lib.mkOption {
-        type = lib.types.str;
-        description = "URL of the target application.";
-        example = "http://localhost:8989";
-      };
-
-      apiKeyFrom = lib.mkOption {
-        type = lib.types.str;
-        description = "Path to the config.xml file to read the API key from at runtime.";
-        example = "/services/sonarr/config.xml";
-      };
-
-      syncCategories = lib.mkOption {
-        type = lib.types.listOf lib.types.int;
-        default = [ ];
-        description = "List of sync category IDs for the application.";
-        example = [
-          5000
-          5010
-          5020
-        ];
-      };
-
-      serviceName = lib.mkOption {
-        type = lib.types.str;
-        description = "Name of the systemd service to depend on for reading the API key.";
-        example = "sonarr";
-      };
-    };
-  };
-
-  instanceModule = lib.types.submodule {
-    options = {
-      enable = lib.mkEnableOption "Servarr application API initialization";
-
-      serviceName = lib.mkOption {
-        type = lib.types.str;
-        description = "Name of the systemd service this init depends on.";
-        example = "sonarr";
-      };
-
-      dataDir = lib.mkOption {
-        type = lib.types.str;
-        description = "Path to the application data directory containing config.xml.";
-        example = "/var/lib/sonarr";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        description = "API port of the Servarr application.";
-        example = 8989;
-      };
-
-      apiVersion = lib.mkOption {
-        type = lib.types.str;
-        default = "v3";
-        description = "API version string used in the base URL.";
-      };
-
-      networkNamespacePath = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "If set, run this init service inside the given network namespace path (e.g. /run/netns/wg).";
-      };
-
-      downloadClients = lib.mkOption {
-        type = lib.types.listOf downloadClientModule;
-        default = [ ];
-        description = "List of download clients to configure via the API.";
-      };
-
-      rootFolders = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = "List of root folder paths to configure via the API.";
-        example = [
-          "/media/tv"
-          "/media/movies"
-        ];
-      };
-
-      syncedApps = lib.mkOption {
-        type = lib.types.listOf syncedAppModule;
-        default = [ ];
-        description = "Applications to register for indexer sync (Prowlarr only).";
-      };
-    };
-  };
-
-  bazarrProviderModule = lib.types.submodule {
-    options = {
-      enable = lib.mkEnableOption "provider connection";
-
-      dataDir = lib.mkOption {
-        type = lib.types.str;
-        description = "Path to the provider's data directory containing config.xml.";
-        example = "/services/sonarr";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        description = "API port of the provider.";
-        example = 8989;
-      };
-
-      serviceName = lib.mkOption {
-        type = lib.types.str;
-        description = "Name of the systemd service to depend on.";
-        example = "sonarr";
-      };
-    };
-  };
-
-  bazarrInitModule = lib.types.submodule {
-    options = {
-      enable = lib.mkEnableOption "Bazarr API initialization";
-
-      dataDir = lib.mkOption {
-        type = lib.types.str;
-        description = "Path to Bazarr's data directory containing config/config.ini.";
-        example = "/services/bazarr";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 6767;
-        description = "API port of Bazarr.";
-      };
-
-      sonarr = lib.mkOption {
-        type = bazarrProviderModule;
-        default = {
-          enable = false;
-        };
-        description = "Sonarr provider configuration.";
-      };
-
-      radarr = lib.mkOption {
-        type = bazarrProviderModule;
-        default = {
-          enable = false;
-        };
-        description = "Radarr provider configuration.";
-      };
-    };
-  };
-
-  curl = "${pkgs.curl}/bin/curl";
-  jq = "${pkgs.jq}/bin/jq";
-  grep = "${pkgs.gnugrep}/bin/grep";
-  awk = "${pkgs.gawk}/bin/awk";
-
-  mkDownloadClientPayload =
-    dc:
-    builtins.toJSON {
-      enable = true;
-      protocol = dc.protocol;
-      priority = 1;
-      name = dc.name;
-      implementation = dc.implementation;
-      configContract = dc.configContract;
-      fields = lib.mapAttrsToList (n: v: {
-        name = n;
-        value = v;
-      }) dc.fields;
-      tags = [ ];
-    };
-
-  mkDownloadClientSection = dc: ''
-    # Download client: ${dc.name}
-    echo "Checking download client '${dc.name}'..."
-    EXISTING_DC=$(${curl} -sf "$BASE_URL/downloadclient" -H "X-Api-Key: $API_KEY")
-    if echo "$EXISTING_DC" | ${jq} -e --arg name ${lib.escapeShellArg dc.name} '.[] | select(.name == $name)' > /dev/null 2>&1; then
-      echo "Download client '${dc.name}' already exists, skipping"
-    else
-      echo "Adding download client '${dc.name}'..."
-      ${curl} -sf -X POST "$BASE_URL/downloadclient?forceSave=true" \
-        -H "X-Api-Key: $API_KEY" \
-        -H "Content-Type: application/json" \
-        -d ${lib.escapeShellArg (mkDownloadClientPayload dc)}
-      echo "Download client '${dc.name}' added"
-    fi
-  '';
-
-  mkRootFolderSection = path: ''
-    # Root folder: ${path}
-    echo "Checking root folder '${path}'..."
-    EXISTING_RF=$(${curl} -sf "$BASE_URL/rootfolder" -H "X-Api-Key: $API_KEY")
-    if echo "$EXISTING_RF" | ${jq} -e --arg path ${lib.escapeShellArg path} '.[] | select(.path == $path)' > /dev/null 2>&1; then
-      echo "Root folder '${path}' already exists, skipping"
-    else
-      echo "Adding root folder '${path}'..."
-      ${curl} -sf -X POST "$BASE_URL/rootfolder" \
-        -H "X-Api-Key: $API_KEY" \
-        -H "Content-Type: application/json" \
-        -d ${lib.escapeShellArg (builtins.toJSON { inherit path; })}
-      echo "Root folder '${path}' added"
-    fi
-  '';
-
-  mkSyncedAppSection = app: ''
-    # Synced app: ${app.name}
-    echo "Checking synced app '${app.name}'..."
-    TARGET_API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${lib.escapeShellArg app.apiKeyFrom})
-    EXISTING_APPS=$(${curl} -sf "$BASE_URL/applications" -H "X-Api-Key: $API_KEY")
-    if echo "$EXISTING_APPS" | ${jq} -e --arg name ${lib.escapeShellArg app.name} '.[] | select(.name == $name)' > /dev/null 2>&1; then
-      echo "Synced app '${app.name}' already exists, skipping"
-    else
-      echo "Adding synced app '${app.name}'..."
-      PAYLOAD=$(${jq} -n \
-        --arg name ${lib.escapeShellArg app.name} \
-        --arg implementation ${lib.escapeShellArg app.implementation} \
-        --arg configContract ${lib.escapeShellArg app.configContract} \
-        --arg syncLevel ${lib.escapeShellArg app.syncLevel} \
-        --arg prowlarrUrl ${lib.escapeShellArg app.prowlarrUrl} \
-        --arg baseUrl ${lib.escapeShellArg app.baseUrl} \
-        --arg apiKey "$TARGET_API_KEY" \
-        --argjson syncCategories ${builtins.toJSON app.syncCategories} \
-        '{
-          name: $name,
-          implementation: $implementation,
-          configContract: $configContract,
-          syncLevel: $syncLevel,
-          fields: [
-            {name: "prowlarrUrl", value: $prowlarrUrl},
-            {name: "baseUrl", value: $baseUrl},
-            {name: "apiKey", value: $apiKey},
-            {name: "syncCategories", value: $syncCategories}
-          ],
-          tags: []
-        }')
-      ${curl} -sf -X POST "$BASE_URL/applications?forceSave=true" \
-        -H "X-Api-Key: $API_KEY" \
-        -H "Content-Type: application/json" \
-        -d "$PAYLOAD"
-      echo "Synced app '${app.name}' added"
-    fi
-  '';
-
-  mkInitScript =
-    name: inst:
-    pkgs.writeShellScript "${name}-init" ''
-      set -euo pipefail
-
-      CONFIG_XML="${inst.dataDir}/config.xml"
-
-      if [ ! -f "$CONFIG_XML" ]; then
-        echo "Config file $CONFIG_XML not found, skipping ${name} init"
-        exit 0
-      fi
-
-      API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' "$CONFIG_XML")
-      BASE_URL="http://localhost:${builtins.toString inst.port}/api/${inst.apiVersion}"
-
-      # Wait for API to become available
-      echo "Waiting for ${name} API..."
-      for i in $(seq 1 90); do
-        if ${curl} -sf "$BASE_URL/system/status" -H "X-Api-Key: $API_KEY" > /dev/null 2>&1; then
-          echo "${name} API is ready"
-          break
-        fi
-        if [ "$i" -eq 90 ]; then
-          echo "${name} API not available after 90 seconds" >&2
-          exit 1
-        fi
-        sleep 1
-      done
-
-      ${lib.concatMapStringsSep "\n" mkDownloadClientSection inst.downloadClients}
-      ${lib.concatMapStringsSep "\n" mkRootFolderSection inst.rootFolders}
-      ${lib.concatMapStringsSep "\n" mkSyncedAppSection inst.syncedApps}
-
-      echo "${name} init complete"
-    '';
-
-  # Get list of service names that syncedApps depend on
-  getSyncedAppDeps = inst: map (app: "${app.serviceName}.service") inst.syncedApps;
-
-  enabledInstances = lib.filterAttrs (_: inst: inst.enable) cfg;
-
-  mkBazarrProviderSection =
-    type: provider:
-    let
-      ltype = lib.toLower type;
-    in
-    ''
-      # ${type} provider
-      echo "Checking ${type} provider..."
-      PROVIDER_API_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${lib.escapeShellArg "${provider.dataDir}/config.xml"})
-      EXISTING=$(${curl} -sf "$BASE_URL/api/system/settings" -H "X-API-KEY: $API_KEY")
-      USE_FLAG=$(echo "$EXISTING" | ${jq} -r '.general.use_${ltype}')
-      EXISTING_KEY=$(echo "$EXISTING" | ${jq} -r '.${ltype}.apikey // ""')
-      if [ "$USE_FLAG" = "true" ] && [ -n "$EXISTING_KEY" ]; then
-        echo "${type} provider already configured, skipping"
-      else
-        echo "Adding ${type} provider..."
-        ${curl} -sf -X POST "$BASE_URL/api/system/settings" \
-          -H "X-API-KEY: $API_KEY" \
-          -d "settings-general-use_${ltype}=true" \
-          -d "settings-${ltype}-ip=localhost" \
-          -d "settings-${ltype}-port=${builtins.toString provider.port}" \
-          -d "settings-${ltype}-apikey=$PROVIDER_API_KEY" \
-          -d "settings-${ltype}-ssl=false" \
-          -d "settings-${ltype}-base_url=/"
-        echo "${type} provider added"
-      fi
-    '';
-
-  mkBazarrInitScript = pkgs.writeShellScript "bazarr-init" ''
-    set -euo pipefail
-
-    CONFIG_YAML="${bazarrCfg.dataDir}/config/config.yaml"
-
-    if [ ! -f "$CONFIG_YAML" ]; then
-      echo "Config file $CONFIG_YAML not found, skipping bazarr init"
-      exit 0
-    fi
-
-    API_KEY=$(${awk} '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, ""); print; exit}' "$CONFIG_YAML")
-    BASE_URL="http://localhost:${builtins.toString bazarrCfg.port}"
-
-    # Wait for API to become available
-    echo "Waiting for Bazarr API..."
-    for i in $(seq 1 90); do
-      if ${curl} -sf "$BASE_URL/api/system/status" -H "X-API-KEY: $API_KEY" > /dev/null 2>&1; then
-        echo "Bazarr API is ready"
-        break
-      fi
-      if [ "$i" -eq 90 ]; then
-        echo "Bazarr API not available after 90 seconds" >&2
-        exit 1
-      fi
-      sleep 1
-    done
-
-    ${lib.optionalString bazarrCfg.sonarr.enable (mkBazarrProviderSection "Sonarr" bazarrCfg.sonarr)}
-    ${lib.optionalString bazarrCfg.radarr.enable (mkBazarrProviderSection "Radarr" bazarrCfg.radarr)}
-
-    echo "Bazarr init complete"
-  '';
-
-  bazarrDeps = [
-    "bazarr.service"
-  ]
-  ++ (lib.optional bazarrCfg.sonarr.enable "${bazarrCfg.sonarr.serviceName}.service")
-  ++ (lib.optional bazarrCfg.radarr.enable "${bazarrCfg.radarr.serviceName}.service");
-in
-{
-  options.services.arrInit = lib.mkOption {
-    type = lib.types.attrsOf instanceModule;
-    default = { };
-    description = ''
-      Attribute set of Servarr application instances to initialize via their APIs.
-      Each instance generates a systemd oneshot service that idempotently configures
-      download clients, root folders, and synced applications.
-    '';
-  };
-
-  options.services.bazarrInit = lib.mkOption {
-    type = bazarrInitModule;
-    default = {
-      enable = false;
-    };
-    description = ''
-      Bazarr API initialization for connecting Sonarr and Radarr providers.
-      Bazarr uses a different API than Servarr applications, so it has its own module.
-    '';
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf (enabledInstances != { }) {
-      systemd.services = lib.mapAttrs' (
-        name: inst:
-        lib.nameValuePair "${inst.serviceName}-init" {
-          description = "Initialize ${name} API connections";
-          after = [
-            "${inst.serviceName}.service"
-          ]
-          ++ (getSyncedAppDeps inst)
-          ++ (lib.optional (inst.networkNamespacePath != null) "wg.service");
-          requires = [ "${inst.serviceName}.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = "${mkInitScript name inst}";
-          }
-          // lib.optionalAttrs (inst.networkNamespacePath != null) {
-            NetworkNamespacePath = inst.networkNamespacePath;
-          };
-        }
-      ) enabledInstances;
-    })
-
-    (lib.mkIf bazarrCfg.enable {
-      systemd.services.bazarr-init = {
-        description = "Initialize Bazarr API connections";
-        after = bazarrDeps;
-        requires = bazarrDeps;
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = "${mkBazarrInitScript}";
-        };
-      };
-    })
-  ];
-}
diff --git a/tests/arr-init.nix b/tests/arr-init.nix
deleted file mode 100644
index be94be1..0000000
--- a/tests/arr-init.nix
+++ /dev/null
@@ -1,419 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  testPkgs = pkgs.appendOverlays [ (import ../modules/overlays.nix) ];
-in
-testPkgs.testers.runNixOSTest {
-  name = "arr-init";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      imports = [
-        ../modules/arr-init.nix
-      ];
-
-      system.stateVersion = config.system.stateVersion;
-
-      virtualisation.memorySize = 4096;
-
-      environment.systemPackages = with pkgs; [
-        curl
-        jq
-        gnugrep
-      ];
-
-      systemd.services.mock-qbittorrent =
-        let
-          mockQbitScript = pkgs.writeScript "mock-qbittorrent.py" ''
-            import json
-            from http.server import HTTPServer, BaseHTTPRequestHandler
-            from urllib.parse import parse_qs, urlparse
-
-
-            CATEGORIES = {
-                "tv": {"name": "tv", "savePath": "/downloads"},
-                "movies": {"name": "movies", "savePath": "/downloads"},
-            }
-
-
-            class QBitMock(BaseHTTPRequestHandler):
-                def _respond(self, code=200, body=b"Ok.", content_type="text/plain"):
-                    self.send_response(code)
-                    self.send_header("Content-Type", content_type)
-                    self.send_header("Set-Cookie", "SID=mock_session_id; Path=/")
-                    self.end_headers()
-                    self.wfile.write(body if isinstance(body, bytes) else body.encode())
-
-                def do_GET(self):
-                    path = self.path.split("?")[0]
-                    if path == "/api/v2/app/webapiVersion":
-                        self._respond(body=b"2.9.3")
-                    elif path == "/api/v2/app/version":
-                        self._respond(body=b"v5.0.0")
-                    elif path == "/api/v2/torrents/info":
-                        self._respond(body=b"[]", content_type="application/json")
-                    elif path == "/api/v2/torrents/categories":
-                        body = json.dumps(CATEGORIES).encode()
-                        self._respond(body=body, content_type="application/json")
-                    elif path == "/api/v2/app/preferences":
-                        body = json.dumps({"save_path": "/tmp"}).encode()
-                        self._respond(body=body, content_type="application/json")
-                    else:
-                        self._respond()
-
-                def do_POST(self):
-                    content_length = int(self.headers.get("Content-Length", 0))
-                    body = self.rfile.read(content_length).decode()
-                    path = urlparse(self.path).path
-                    query = parse_qs(urlparse(self.path).query)
-                    form = parse_qs(body)
-                    params = {**query, **form}
-                    if path == "/api/v2/torrents/createCategory":
-                        name = params.get("category", [""])[0]
-                        save_path = params.get("savePath", params.get("save_path", [""]))[0] or "/downloads"
-                        if name:
-                            CATEGORIES[name] = {"name": name, "savePath": save_path}
-                    if path in ["/api/v2/torrents/editCategory", "/api/v2/torrents/removeCategory"]:
-                        self._respond()
-                        return
-                    self._respond()
-
-                def log_message(self, format, *args):
-                    pass
-
-
-            HTTPServer(("0.0.0.0", 6011), QBitMock).serve_forever()
-          '';
-        in
-        {
-          description = "Mock qBittorrent API";
-          wantedBy = [ "multi-user.target" ];
-          before = [
-            "sonarr-init.service"
-            "radarr-init.service"
-          ];
-          serviceConfig = {
-            ExecStart = "${pkgs.python3}/bin/python3 ${mockQbitScript}";
-            Type = "simple";
-          };
-        };
-
-      systemd.tmpfiles.rules = [
-        "d /media/tv 0755 sonarr sonarr -"
-        "d /media/movies 0755 radarr radarr -"
-      ];
-
-      services.sonarr = {
-        enable = true;
-        dataDir = "/var/lib/sonarr/.config/NzbDrone";
-        settings.server.port = lib.mkDefault 8989;
-      };
-
-      services.radarr = {
-        enable = true;
-        dataDir = "/var/lib/radarr/.config/Radarr";
-        settings.server.port = lib.mkDefault 7878;
-      };
-
-      services.prowlarr = {
-        enable = true;
-      };
-
-      services.bazarr = {
-        enable = true;
-        listenPort = 6767;
-      };
-
-      services.arrInit.sonarr = {
-        enable = true;
-        serviceName = "sonarr";
-        dataDir = "/var/lib/sonarr/.config/NzbDrone";
-        port = 8989;
-        downloadClients = [
-          {
-            name = "qBittorrent";
-            implementation = "QBittorrent";
-            configContract = "QBittorrentSettings";
-            protocol = "torrent";
-            fields = {
-              host = "127.0.0.1";
-              port = 6011;
-              useSsl = false;
-              tvCategory = "tv";
-            };
-          }
-        ];
-        rootFolders = [ "/media/tv" ];
-      };
-
-      services.arrInit.radarr = {
-        enable = true;
-        serviceName = "radarr";
-        dataDir = "/var/lib/radarr/.config/Radarr";
-        port = 7878;
-        downloadClients = [
-          {
-            name = "qBittorrent";
-            implementation = "QBittorrent";
-            configContract = "QBittorrentSettings";
-            protocol = "torrent";
-            fields = {
-              host = "127.0.0.1";
-              port = 6011;
-              useSsl = false;
-              movieCategory = "movies";
-            };
-          }
-        ];
-        rootFolders = [ "/media/movies" ];
-      };
-
-      services.arrInit.prowlarr = {
-        enable = true;
-        serviceName = "prowlarr";
-        dataDir = "/var/lib/prowlarr";
-        port = 9696;
-        apiVersion = "v1";
-        syncedApps = [
-          {
-            name = "Sonarr";
-            implementation = "Sonarr";
-            configContract = "SonarrSettings";
-            prowlarrUrl = "http://localhost:9696";
-            baseUrl = "http://localhost:8989";
-            apiKeyFrom = "/var/lib/sonarr/.config/NzbDrone/config.xml";
-            syncCategories = [
-              5000
-              5010
-              5020
-              5030
-              5040
-              5045
-              5050
-              5090
-            ];
-            serviceName = "sonarr";
-          }
-          {
-            name = "Radarr";
-            implementation = "Radarr";
-            configContract = "RadarrSettings";
-            prowlarrUrl = "http://localhost:9696";
-            baseUrl = "http://localhost:7878";
-            apiKeyFrom = "/var/lib/radarr/.config/Radarr/config.xml";
-            syncCategories = [
-              2000
-              2010
-              2020
-              2030
-              2040
-              2045
-              2050
-              2060
-              2070
-              2080
-            ];
-            serviceName = "radarr";
-          }
-        ];
-      };
-
-      services.bazarrInit = {
-        enable = true;
-        dataDir = "/var/lib/bazarr";
-        port = 6767;
-        sonarr = {
-          enable = true;
-          dataDir = "/var/lib/sonarr/.config/NzbDrone";
-          port = 8989;
-          serviceName = "sonarr";
-        };
-        radarr = {
-          enable = true;
-          dataDir = "/var/lib/radarr/.config/Radarr";
-          port = 7878;
-          serviceName = "radarr";
-        };
-      };
-    };
-
-  testScript = ''
-    start_all()
-
-    # Wait for services to start
-    machine.wait_for_unit("mock-qbittorrent.service")
-    machine.wait_until_succeeds("curl -sf http://localhost:6011/api/v2/app/version", timeout=30)
-    machine.wait_for_unit("sonarr.service")
-    machine.wait_for_unit("radarr.service")
-    machine.wait_for_unit("prowlarr.service")
-    machine.wait_for_unit("bazarr.service")
-
-    # Wait for Sonarr API to be ready (config.xml is auto-generated on first start)
-    machine.wait_until_succeeds(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
-        "curl -sf http://localhost:8989/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
-        timeout=120,
-    )
-
-    # Wait for Radarr API to be ready
-    machine.wait_until_succeeds(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
-        "curl -sf http://localhost:7878/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
-        timeout=120,
-    )
-
-    # Wait for Prowlarr API to be ready
-    machine.wait_until_succeeds(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
-        "curl -sf http://localhost:9696/api/v1/system/status -H \"X-Api-Key: $API_KEY\"",
-        timeout=180,
-    )
-
-    # Ensure init services run after config.xml exists
-    machine.succeed("systemctl restart sonarr-init.service")
-    machine.succeed("systemctl restart radarr-init.service")
-    machine.wait_for_unit("sonarr-init.service")
-    machine.wait_for_unit("radarr-init.service")
-
-    # Wait for init services to complete
-    machine.wait_for_unit("sonarr-init.service")
-    machine.wait_for_unit("radarr-init.service")
-
-    # Verify Sonarr download clients
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
-        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.name == \"qBittorrent\")'"
-    )
-
-    # Verify Sonarr root folders
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
-        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.path == \"/media/tv\")'"
-    )
-
-    # Verify Radarr download clients
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
-        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.name == \"qBittorrent\")'"
-    )
-
-    # Verify Radarr root folders
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
-        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.path == \"/media/movies\")'"
-    )
-
-    # Restart prowlarr-init now that all config.xml files exist
-    machine.succeed("systemctl restart prowlarr-init.service")
-    machine.wait_for_unit("prowlarr-init.service")
-
-    # Verify Sonarr registered as synced app in Prowlarr
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
-        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.name == \"Sonarr\")'"
-    )
-
-    # Verify Radarr registered as synced app in Prowlarr
-    machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
-        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
-        "jq -e '.[] | select(.name == \"Radarr\")'"
-    )
-
-    # Idempotency test: restart init services and verify no duplicate entries
-    machine.succeed("systemctl restart sonarr-init.service")
-    machine.succeed("systemctl restart radarr-init.service")
-    machine.succeed("systemctl restart prowlarr-init.service")
-
-    # Verify Sonarr still has exactly 1 download client
-    result = machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
-        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
-        "jq '. | length'"
-    ).strip()
-    assert result == "1", f"Expected 1 Sonarr download client, got {result}"
-
-    # Verify Sonarr still has exactly 1 root folder
-    result = machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
-        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
-        "jq '. | length'"
-    ).strip()
-    assert result == "1", f"Expected 1 Sonarr root folder, got {result}"
-
-    # Verify Radarr still has exactly 1 download client
-    result = machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
-        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
-        "jq '. | length'"
-    ).strip()
-    assert result == "1", f"Expected 1 Radarr download client, got {result}"
-
-    # Verify Radarr still has exactly 1 root folder
-    result = machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
-        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
-        "jq '. | length'"
-    ).strip()
-    assert result == "1", f"Expected 1 Radarr root folder, got {result}"
-
-    # Verify Prowlarr still has exactly 2 synced apps
-    result = machine.succeed(
-        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
-        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
-        "jq '. | length'"
-    ).strip()
-    assert result == "2", f"Expected 2 Prowlarr synced apps, got {result}"
-
-    # Wait for Bazarr to generate config.yaml
-    machine.wait_until_succeeds(
-        "test -f /var/lib/bazarr/config/config.yaml",
-        timeout=120,
-    )
-
-    # Wait for Bazarr API to be ready
-    machine.wait_until_succeeds(
-        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
-        "curl -sf http://localhost:6767/api/system/status -H \"X-API-KEY: $API_KEY\"",
-        timeout=120,
-    )
-
-    # Restart bazarr-init now that config.yaml exists
-    machine.succeed("systemctl restart bazarr-init.service")
-    machine.wait_for_unit("bazarr-init.service")
-
-    # Verify Sonarr provider configured in Bazarr
-    machine.succeed(
-        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
-        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
-        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
-    )
-
-    # Verify Radarr provider configured in Bazarr
-    machine.succeed(
-        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
-        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
-        "jq -e '.general.use_radarr == true and (.radarr.apikey // \"\") != \"\"'"
-    )
-
-    # Idempotency: restart bazarr-init and verify no duplicate config
-    machine.succeed("systemctl restart bazarr-init.service")
-    machine.wait_for_unit("bazarr-init.service")
-
-    machine.succeed(
-        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
-        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
-        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
-    )
-  '';
-}
diff --git a/tests/tests.nix b/tests/tests.nix
index 295485d..40a8fcf 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -22,8 +22,7 @@ in
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
 
-  # arr tests
-  arrInitTest = handleTest ./arr-init.nix;
+
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 }

From c88be536491aaa5a031575b7569336800b3f4969 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Feb 2026 01:57:42 -0500
Subject: [PATCH 627/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0141f0c..8dbe4ee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,10 +32,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1772224010,
-        "narHash": "sha256-nCchZRcIU2IRRjXUi/7jAfKZFtWD4NZqshAKqNJP+Mg=",
+        "lastModified": 1772249948,
+        "narHash": "sha256-v68tO12mTCET68eZG583U+OlBL4f6kAoHS9iKA/xLzQ=",
         "ref": "refs/heads/main",
-        "rev": "e9d5d8e0c92ef408f3340933d9109738675d64b8",
+        "rev": "d21eb9f5b0a30bb487de7c0afbbbaf19324eaa49",
         "revCount": 1,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
@@ -263,11 +263,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1772039686,
-        "narHash": "sha256-pXZ2hQ/m256aC/+ufwXclGSN6CGMm7Lgf0aCNStulno=",
+        "lastModified": 1772216104,
+        "narHash": "sha256-1TnGN26vnCEQk5m4AavJZxGZTb/6aZyphemRPRwFUfs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "5999351aa57d6b0a2d38078dd4ec075e73c48115",
+        "rev": "dbe5112de965bbbbff9f0729a9789c20a65ab047",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1771987719,
-        "narHash": "sha256-A7pRC7rhAz89dJsn0vjboPxXqpUzMGowlj4K0byFnUk=",
+        "lastModified": 1772160153,
+        "narHash": "sha256-lk5IxQzY9ZeeEyjKNT7P6dFnlRpQgkus4Ekc/+slypY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "69edebc75286af9cf8175c866a41834b459eab3e",
+        "rev": "deca3fb710b502ba10cd5cdc8f66c2cc184b92df",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
+        "lastModified": 1772047000,
+        "narHash": "sha256-7DaQVv4R97cii/Qdfy4tmDZMB2xxtyIvNGSwXBBhSmo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "rev": "1267bb4920d0fc06ea916734c11b0bf004bbe17e",
         "type": "github"
       },
       "original": {
@@ -454,11 +454,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771812348,
-        "narHash": "sha256-d8LL7nSpFueYtZhK29t7j3JiaKLA4lqW8neJv/uZGQc=",
+        "lastModified": 1772071250,
+        "narHash": "sha256-LDWvJDR1J8xE8TBJjzWnOA0oVP/l9xBFC4npQPJDHN4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "ffc8fceb1e3cad06b5074cda30f88132b4fb4869",
+        "rev": "5cd73bcf984b72d8046e1175d13753de255adfb9",
         "type": "github"
       },
       "original": {
@@ -530,11 +530,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1772060981,
-        "narHash": "sha256-Q+99+w6LY8B0loDP3sPlcjasFVknyu9WAGOmmeDgj+E=",
+        "lastModified": 1772233783,
+        "narHash": "sha256-2jPUBKpPuT4dCXwVFuZvTH3QyURixsfJZD7Zqs0atPY=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "be435c797e4dfbdf7c39aa101ad98cb3e00d1950",
+        "rev": "85c4f103f130b070a192343c334f50c2f56b61a9",
         "type": "github"
       },
       "original": {

From c34bd1626f1667e8f033aff62baeb8093e305cf5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Feb 2026 02:25:38 -0500
Subject: [PATCH 628/847] fmt

---
 tests/tests.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/tests.nix b/tests/tests.nix
index 40a8fcf..8a7178d 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -22,7 +22,6 @@ in
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
 
-
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 }

From a062c8d59c9f88389f823818a660513f98466762 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Feb 2026 02:30:19 -0500
Subject: [PATCH 629/847] minecraft: update mods + add modernfix + debugify

---
 services/minecraft.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 3b94e8c..bc2750a 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -118,8 +118,8 @@
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/DLKF3HZk/c2me-fabric-mc1.21.11-0.3.6%2Bbeta.1.0.jar";
-              sha512 = "d4f983aeb5083033b525522e623a9a9ba86b6fc9c83db008cc0575d0077e736ac9bee0b6b0e03b8d1c89ae27a4e5cdc269041f61eb0d1a10757de4c30b065467";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/QdLiMUjx/c2me-fabric-mc1.21.11-0.3.7%2Balpha.0.7.jar";
+              sha512 = "f9543febe2d649a82acd6d5b66189b6a3d820cf24aa503ba493fdb3bbd4e52e30912c4c763fe50006f9a46947ae8cd737d420838c61b93429542573ed67f958e";
             };
 
             krypton = fetchurl {
@@ -141,6 +141,18 @@
               url = "https://cdn.modrinth.com/data/c7m1mi73/versions/CUh1DWeO/packetfixer-fabric-3.3.4-1.21.11.jar";
               sha512 = "33331b16cb40c5e6fbaade3cacc26f3a0e8fa5805a7186f94d7366a0e14dbeee9de2d2e8c76fa71f5e9dd24eb1c261667c35447e32570ea965ca0f154fdfba0a";
             };
+
+            # fork of Modernfix for 1.21.11 (upstream will support 26.1)
+            modernfix = fetchurl {
+              url = "https://cdn.modrinth.com/data/TjSm1wrD/versions/JwSO8JCN/modernfix-5.25.2-build.4.jar";
+              sha512 = "0d65c05ac0475408c58ef54215714e6301113101bf98bfe4bb2ba949fbfddd98225ac4e2093a5f9206a9e01ba80a931424b237bdfa3b6e178c741ca6f7f8c6a3";
+            };
+
+            debugify = fetchurl {
+              url = "https://cdn.modrinth.com/data/QwxR6Gcd/versions/8Q49lnaU/debugify-1.21.11%2B1.0.jar";
+              sha512 = "04d82dd33f44ced37045f1f9a54ad4eacd70861ff74a8800f2d2df358579e6cb0ea86a34b0086b3e87026b1a0691dd6594b4fdc49f89106466eea840518beb03";
+            };
+
           }
         );
       };

From 5fb686378428542c01b310b13d4371c3b0d4ae2d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Mar 2026 14:22:17 -0500
Subject: [PATCH 630/847] qbt: delete incomplete subvolume + tweaks

---
 configuration.nix        |  3 +++
 services/qbittorrent.nix | 26 ++++++++++++++++++++------
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 61ecae2..e1f3adb 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -157,6 +157,9 @@
 
       # Higher backlog for the large number of concurrent torrent connections
       "net.core.netdev_max_backlog" = 5000;
+      # Faster cleanup of dead connections from torrent peer churn
+      "net.ipv4.tcp_fin_timeout" = 15; # default 60
+      "net.ipv4.tcp_tw_reuse" = 1;
 
       # Minecraft server optimizations
       # Disable autogroup for better scheduling of game server threads
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 7b8658d..3bbf36f 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -10,8 +10,6 @@
   imports = [
     (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_hdds [
       service_configs.torrents_path
-      config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath
-
     ])
     (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_ssds [
       "${config.services.qbittorrent.profileDir}/qBittorrent"
@@ -55,12 +53,12 @@
 
     serverConfig.BitTorrent = {
       Session = {
-        MaxConnectionsPerTorrent = 50;
-        MaxUploadsPerTorrent = 10;
+        MaxConnectionsPerTorrent = 100;
+        MaxUploadsPerTorrent = 15;
         MaxConnections = -1;
         MaxUploads = -1;
 
-        MaxActiveCheckingTorrents = 5;
+        MaxActiveCheckingTorrents = 2; # reduce disk pressure from concurrent hash checks
 
         # queueing
         QueueingSystemEnabled = true;
@@ -91,7 +89,7 @@
         inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
-        ConnectionSpeed = 200;
+        ConnectionSpeed = 30;
 
         # Automatic Torrent Management: use category save paths for new torrents
         DisableAutoTMMByDefault = false;
@@ -102,6 +100,22 @@
         PieceExtentAffinity = true;
         SuggestMode = true;
         CoalesceReadWrite = true;
+
+        # max_queued_disk_bytes: the max bytes waiting in the disk I/O queue.
+        # When this limit is reached, peer connections stop reading from their
+        # sockets until the disk thread catches up -- causing the spike-then-zero
+        # pattern. Default is 1MB; high_performance_seed() uses 7MB.
+        # 64MB is above the preset but justified for slow raidz1 HDD random writes
+        # where ZFS txg commits cause periodic I/O stalls.
+        DiskQueueSize = 67108864; # 64MB
+
+        # === Network buffer tuning (from libtorrent high_performance_seed preset) ===
+        # "always stuff at least 1 MiB down each peer pipe, to quickly ramp up send rates"
+        SendBufferLowWatermark = 1024; # 1MB (KiB) -- matches high_performance_seed
+        # "of 500 ms, and a send rate of 4 MB/s, the upper limit should be 2 MB"
+        SendBufferWatermark = 3072; # 3MB (KiB) -- matches high_performance_seed
+        # "put 1.5 seconds worth of data in the send buffer"
+        SendBufferWatermarkFactor = 150; # percent -- matches high_performance_seed
       };
 
       Network = {

From 1285a9c6f2b13a2b5b8654ba6b5ea8a3e42ea606 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Mar 2026 20:01:54 -0500
Subject: [PATCH 631/847] qbt: disable UPnP

---
 services/qbittorrent.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 3bbf36f..c09bb35 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -123,6 +123,8 @@
         # port forwarding
         PortForwardingEnabled = false;
       };
+
+      Session.UseUPnP = false;
     };
   };
 

From ce4d1c0ef2b28a3debbcaa931da756902ad02098 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Mar 2026 23:33:15 -0500
Subject: [PATCH 632/847] zfs: tuning

---
 modules/zfs.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index e5e55b3..b2a9b6d 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -27,13 +27,17 @@ in
 
   boot.kernelParams =
     let
-      gb = 20;
+      gb = 32;
       mb = gb * 1000;
       kb = mb * 1000;
       b = kb * 1000;
     in
     [
       "zfs.zfs_arc_max=${builtins.toString b}"
+      "zfs.zfs_txg_timeout=30" # longer TXG open time = larger sequential writes = better HDD throughput
+      "zfs.zfs_dirty_data_max=8589934592" # 8GB dirty data buffer (default 4GB) for USB HDD write smoothing
+      "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
+      "zfs.zfs_vdev_async_write_max_active=30" # more concurrent async writes to vdevs (default 10)
     ];
 
   boot.supportedFilesystems = [ "zfs" ];

From 56daf661d5d38601d9ddfc33eb90ece9c08b9243 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 2 Mar 2026 23:33:55 -0500
Subject: [PATCH 633/847] qbt: tune

---
 services/qbittorrent.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index c09bb35..927d083 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -62,13 +62,13 @@
 
         # queueing
         QueueingSystemEnabled = true;
-        MaxActiveDownloads = 5; # keep focused: fewer torrents, each gets more bandwidth
+        MaxActiveDownloads = 15;
         MaxActiveUploads = -1;
         MaxActiveTorrents = -1;
         IgnoreSlowTorrentsForQueueing = true;
 
         GlobalUPSpeedLimit = 0;
-        GlobalDLSpeedLimit = 0;
+        GlobalDLSpeedLimit = 10000;
 
         # Alternate speed limits for when Jellyfin is streaming
         AlternativeGlobalUPSpeedLimit = 500; # 500 KB/s when throttled
@@ -89,7 +89,10 @@
         inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
-        ConnectionSpeed = 30;
+        ConnectionSpeed = 100;
+
+        SaveResumeDataInterval = 300; # save resume data every 5 min (default 60s)
+        ResumeDataStorageType = "SQLite"; # SQLite is more efficient than legacy per-file .fastresume storage
 
         # Automatic Torrent Management: use category save paths for new torrents
         DisableAutoTMMByDefault = false;

From b594b9554e2020a9f5b6321516e093dcacc4a1f4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 10:50:09 -0500
Subject: [PATCH 634/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8dbe4ee..3b60921 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771881364,
-        "narHash": "sha256-A5uE/hMium5of/QGC6JwF5TGoDAfpNtW00T0s9u/PN8=",
+        "lastModified": 1772420042,
+        "narHash": "sha256-naZz40TUFMa0E0CutvwWsSPhgD5JldyTUDEgP9ADpfU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a4cb7bf73f264d40560ba527f9280469f1f081c6",
+        "rev": "5af7af10f14706e4095bd6bc0d9373eb097283c6",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772020340,
-        "narHash": "sha256-aqBl3GNpCadMoJ/hVkWTijM1Aeilc278MjM+LA3jK6g=",
+        "lastModified": 1772380125,
+        "narHash": "sha256-8C+y46xA9bxcchj9GeDPJaRUDApaA3sy2fhJr1bTbUw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "36e38ca0d9afe4c55405fdf22179a5212243eecc",
+        "rev": "a07a44a839eb036e950bf397d9b782916f8dcab3",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1772160153,
-        "narHash": "sha256-lk5IxQzY9ZeeEyjKNT7P6dFnlRpQgkus4Ekc/+slypY=",
+        "lastModified": 1772334875,
+        "narHash": "sha256-AveYVY2plEJ62Br6iAd4fB5PDYyjJoTEmgdWRV3m+Vo=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "deca3fb710b502ba10cd5cdc8f66c2cc184b92df",
+        "rev": "a852ac73a4f9bf8270bdac90a72a28fef5df846b",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772047000,
-        "narHash": "sha256-7DaQVv4R97cii/Qdfy4tmDZMB2xxtyIvNGSwXBBhSmo=",
+        "lastModified": 1772465433,
+        "narHash": "sha256-ywy9troNEfpgh0Ee+zaV1UTgU8kYBVKtvPSxh6clYGU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1267bb4920d0fc06ea916734c11b0bf004bbe17e",
+        "rev": "c581273b8d5bdf1c6ce7e0a54da9841e6a763913",
         "type": "github"
       },
       "original": {
@@ -454,11 +454,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772071250,
-        "narHash": "sha256-LDWvJDR1J8xE8TBJjzWnOA0oVP/l9xBFC4npQPJDHN4=",
+        "lastModified": 1772416961,
+        "narHash": "sha256-/IiEGGjy0e8Ljo6418fFlqMJs7VLuLxU5pDR5uE+GLE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "5cd73bcf984b72d8046e1175d13753de255adfb9",
+        "rev": "bcdbafece2815d32c8dfc51ef17f2858f3d4cfbc",
         "type": "github"
       },
       "original": {
@@ -530,11 +530,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1772233783,
-        "narHash": "sha256-2jPUBKpPuT4dCXwVFuZvTH3QyURixsfJZD7Zqs0atPY=",
+        "lastModified": 1772492983,
+        "narHash": "sha256-Rzlqp+7hu6dJ/Uc/iYBu5F9QCU8zMjKbPs6NJGKjL3g=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "85c4f103f130b070a192343c334f50c2f56b61a9",
+        "rev": "3240f44d1c072058919e18fb112a2ee87c54e484",
         "type": "github"
       },
       "original": {

From a9df39606ba6507ecb08e9adbcd0c5f9f231710f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 12:23:05 -0500
Subject: [PATCH 635/847] increase huge pages size

---
 configuration.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index e1f3adb..c4c2b28 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -164,8 +164,9 @@
       # Minecraft server optimizations
       # Disable autogroup for better scheduling of game server threads
       "kernel.sched_autogroup_enabled" = 0;
-      # Huge pages for Minecraft JVM (4000MB heap / 2MB per page + ~200 overhead)
-      "vm.nr_hugepages" = 2200;
+      # Huge pages for Minecraft JVM (ZGC ZGenerational needs heap + ~15% overhead)
+      # 4000MB heap = 2000 pages, plus ~285 for ZGC metadata = ~2285 needed
+      "vm.nr_hugepages" = 2600;
     };
   };
 

From 71c3e499bd8e65d10c6a3dd136bb650005aa4778 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 13:37:08 -0500
Subject: [PATCH 636/847] update: arr-init

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3b60921..08c62a4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772249948,
-        "narHash": "sha256-v68tO12mTCET68eZG583U+OlBL4f6kAoHS9iKA/xLzQ=",
+        "lastModified": 1772563009,
+        "narHash": "sha256-+LExMzFXahgoFYayrmqK4MhT9QkUplVwurcTDjk8kGI=",
         "ref": "refs/heads/main",
-        "rev": "d21eb9f5b0a30bb487de7c0afbbbaf19324eaa49",
-        "revCount": 1,
+        "rev": "9159444f332da049909632e294d58e91dc61d38c",
+        "revCount": 3,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },

From 514ccb4258b9810f899ceacc0cb6d6485bcbee1f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 15:05:59 -0500
Subject: [PATCH 637/847] postgresql: disable full_page_writes

---
 services/postgresql.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/services/postgresql.nix b/services/postgresql.nix
index 474ebe2..3fb4463 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -19,6 +19,14 @@
     enable = true;
     package = pkgs.postgresql_16;
     dataDir = service_configs.postgres.dataDir;
+    settings = {
+      # ZFS provides checksumming and atomic writes, making PostgreSQL's
+      # full_page_writes redundant. Disabling reduces write amplification
+      # and SSD wear on the zpool.
+      # Did this in conjunction with setting recordsize=8k
+      # on the zvolume this is on
+      full_page_writes = false;
+    };
   };
 
 }

From cdccab855db6299282055ed801e47cd7376b8e52 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 15:06:13 -0500
Subject: [PATCH 638/847] zfs: zfs_txg_timeout 30 -> 120

---
 modules/zfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index b2a9b6d..ae377bc 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -34,7 +34,7 @@ in
     in
     [
       "zfs.zfs_arc_max=${builtins.toString b}"
-      "zfs.zfs_txg_timeout=30" # longer TXG open time = larger sequential writes = better HDD throughput
+      "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
       "zfs.zfs_dirty_data_max=8589934592" # 8GB dirty data buffer (default 4GB) for USB HDD write smoothing
       "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
       "zfs.zfs_vdev_async_write_max_active=30" # more concurrent async writes to vdevs (default 10)

From d4b679d1a52ed0f70d685122ba7c808095185697 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 19:21:31 -0500
Subject: [PATCH 639/847] cleanup

---
 configuration.nix              |  39 +--------
 flake.nix                      | 137 +-------------------------------
 modules/zfs.nix                |  17 ++--
 service-configs.nix            | 140 +++++++++++++++++++++++++++++++++
 services/minecraft.nix         |  81 ++++++++++---------
 services/wg.nix                |  32 ++++++++
 tests/fail2ban-gitea.nix       |  10 +--
 tests/fail2ban-immich.nix      |  15 ++--
 tests/fail2ban-jellyfin.nix    |  11 +--
 tests/fail2ban-ssh.nix         |   5 --
 tests/fail2ban-vaultwarden.nix |  13 +--
 tests/minecraft.nix            |  21 +++--
 12 files changed, 256 insertions(+), 265 deletions(-)
 create mode 100644 service-configs.nix

diff --git a/configuration.nix b/configuration.nix
index c4c2b28..4181355 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -133,41 +133,6 @@
       compressor = "zstd";
       supportedFilesystems = [ "f2fs" ];
     };
-
-    # BBR congestion control handles variable-latency VPN connections much
-    # better than CUBIC by probing bandwidth continuously rather than
-    # reacting to packet loss.
-    kernelModules = [ "tcp_bbr" ];
-
-    kernel.sysctl = {
-      # Use BBR + fair queuing for smooth throughput through the WireGuard VPN
-      "net.core.default_qdisc" = "fq";
-      "net.ipv4.tcp_congestion_control" = "bbr";
-
-      # Disable slow-start after idle: prevents TCP from resetting window
-      # size on each burst cycle (the primary cause of the 0 -> 40 MB/s spikes)
-      "net.ipv4.tcp_slow_start_after_idle" = 0;
-
-      # Larger socket buffers to accommodate the VPN bandwidth-delay product
-      # (22ms RTT * target throughput). Current 2.5MB max is too small.
-      "net.core.rmem_max" = 16777216;
-      "net.core.wmem_max" = 16777216;
-      "net.ipv4.tcp_rmem" = "4096 87380 16777216";
-      "net.ipv4.tcp_wmem" = "4096 65536 16777216";
-
-      # Higher backlog for the large number of concurrent torrent connections
-      "net.core.netdev_max_backlog" = 5000;
-      # Faster cleanup of dead connections from torrent peer churn
-      "net.ipv4.tcp_fin_timeout" = 15; # default 60
-      "net.ipv4.tcp_tw_reuse" = 1;
-
-      # Minecraft server optimizations
-      # Disable autogroup for better scheduling of game server threads
-      "kernel.sched_autogroup_enabled" = 0;
-      # Huge pages for Minecraft JVM (ZGC ZGenerational needs heap + ~15% overhead)
-      # 4000MB heap = 2000 pages, plus ~285 for ZGC metadata = ~2285 needed
-      "vm.nr_hugepages" = 2600;
-    };
   };
 
   environment.etc = {
@@ -237,8 +202,10 @@
     hostName = hostname;
     hostId = "0f712d56";
     firewall.enable = true;
-    firewall.trustedInterfaces = [ "wg-br" ];
+
     useDHCP = false;
+
+    # Disabled because of Jellyfin (various issues)
     enableIPv6 = false;
 
     interfaces.${eth_interface} = {
diff --git a/flake.nix b/flake.nix
index 1a0fbd7..4fee0c2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -97,142 +97,7 @@
       eth_interface = "enp4s0";
       system = "x86_64-linux";
 
-      service_configs = rec {
-        zpool_ssds = "tank";
-        zpool_hdds = "hdds";
-        torrents_path = "/torrents";
-        services_dir = "/services";
-        music_dir = "/${zpool_ssds}/music";
-        media_group = "media";
-
-        cpu_arch = "znver3";
-
-        ports = {
-          http = 80;
-          https = 443;
-          jellyfin = 8096; # no services.jellyfin option for this
-          torrent = 6011;
-          bitmagnet = 3333;
-          gitea = 2283;
-          immich = 2284;
-          soulseek_web = 5030;
-          soulseek_listen = 50300;
-          llama_cpp = 8991;
-          vaultwarden = 8222;
-          syncthing_gui = 8384;
-          syncthing_protocol = 22000;
-          syncthing_discovery = 21027;
-          minecraft = 25565;
-          matrix = 6167;
-          matrix_federation = 8448;
-          coturn = 3478;
-          coturn_tls = 5349;
-          ntfy = 2586;
-          livekit = 7880;
-          lk_jwt = 8081;
-          prowlarr = 9696;
-          sonarr = 8989;
-          radarr = 7878;
-          bazarr = 6767;
-          jellyseerr = 5055;
-        };
-
-        https = {
-          certs = services_dir + "/http_certs";
-          domain = "gardling.com";
-        };
-
-        gitea = {
-          dir = services_dir + "/gitea";
-          domain = "git.${https.domain}";
-        };
-
-        postgres = {
-          socket = "/run/postgresql";
-          dataDir = services_dir + "/sql";
-        };
-
-        immich = {
-          dir = services_dir + "/immich";
-        };
-
-        minecraft = {
-          parent_dir = services_dir + "/minecraft";
-          server_name = "main";
-        };
-
-        torrent = {
-          SavePath = torrents_path;
-          TempPath = torrents_path + "/incomplete";
-        };
-
-        jellyfin = {
-          dataDir = services_dir + "/jellyfin";
-          cacheDir = services_dir + "/jellyfin_cache";
-        };
-
-        slskd = rec {
-          base = "/var/lib/slskd";
-          downloads = base + "/downloads";
-          incomplete = base + "/incomplete";
-        };
-
-        vaultwarden = {
-          path = "/var/lib/vaultwarden";
-        };
-
-        monero = {
-          dataDir = services_dir + "/monero";
-        };
-
-        matrix = {
-          dataDir = "/var/lib/continuwuity";
-          domain = "matrix.${https.domain}";
-        };
-
-        ntfy = {
-          domain = "ntfy.${https.domain}";
-        };
-
-        livekit = {
-          domain = "livekit.${https.domain}";
-        };
-
-        syncthing = {
-          dataDir = services_dir + "/syncthing";
-          signalBackupDir = "/${zpool_ssds}/bak/signal";
-          grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";
-        };
-
-        prowlarr = {
-          dataDir = services_dir + "/prowlarr";
-        };
-
-        sonarr = {
-          dataDir = services_dir + "/sonarr";
-        };
-
-        radarr = {
-          dataDir = services_dir + "/radarr";
-        };
-
-        bazarr = {
-          dataDir = services_dir + "/bazarr";
-        };
-
-        jellyseerr = {
-          configDir = services_dir + "/jellyseerr";
-        };
-
-        recyclarr = {
-          dataDir = services_dir + "/recyclarr";
-        };
-
-        media = {
-          moviesDir = torrents_path + "/media/movies";
-          tvDir = torrents_path + "/media/tv";
-        };
-      };
+      service_configs = import ./service-configs.nix;
 
       pkgs = import nixpkgs {
         inherit system;
diff --git a/modules/zfs.nix b/modules/zfs.nix
index ae377bc..1df7971 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -27,15 +27,20 @@ in
 
   boot.kernelParams =
     let
-      gb = 32;
-      mb = gb * 1000;
-      kb = mb * 1000;
-      b = kb * 1000;
+      arc_gb = 32;
+      arc_mb = arc_gb * 1000;
+      arc_kb = arc_mb * 1000;
+      arc_b = arc_kb * 1000;
+
+      dirty_gb = 8; # Default value is 4GB, helps smooth writes
+      dirty_mb = dirty_gb * 1000;
+      dirty_kb = dirty_mb * 1000;
+      dirty_b = dirty_kb * 1000;
     in
     [
-      "zfs.zfs_arc_max=${builtins.toString b}"
+      "zfs.zfs_arc_max=${builtins.toString arc_b}"
       "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
-      "zfs.zfs_dirty_data_max=8589934592" # 8GB dirty data buffer (default 4GB) for USB HDD write smoothing
+      "zfs.zfs_dirty_data_max=${builtins.toString dirty_b}"
       "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
       "zfs.zfs_vdev_async_write_max_active=30" # more concurrent async writes to vdevs (default 10)
     ];
diff --git a/service-configs.nix b/service-configs.nix
new file mode 100644
index 0000000..d53ed7c
--- /dev/null
+++ b/service-configs.nix
@@ -0,0 +1,140 @@
+rec {
+  zpool_ssds = "tank";
+  zpool_hdds = "hdds";
+  torrents_path = "/torrents";
+  services_dir = "/services";
+  music_dir = "/${zpool_ssds}/music";
+  media_group = "media";
+
+  cpu_arch = "znver3";
+
+  ports = {
+    http = 80;
+    https = 443;
+    jellyfin = 8096; # no services.jellyfin option for this
+    torrent = 6011;
+    bitmagnet = 3333;
+    gitea = 2283;
+    immich = 2284;
+    soulseek_web = 5030;
+    soulseek_listen = 50300;
+    llama_cpp = 8991;
+    vaultwarden = 8222;
+    syncthing_gui = 8384;
+    syncthing_protocol = 22000;
+    syncthing_discovery = 21027;
+    minecraft = 25565;
+    matrix = 6167;
+    matrix_federation = 8448;
+    coturn = 3478;
+    coturn_tls = 5349;
+    ntfy = 2586;
+    livekit = 7880;
+    lk_jwt = 8081;
+    prowlarr = 9696;
+    sonarr = 8989;
+    radarr = 7878;
+    bazarr = 6767;
+    jellyseerr = 5055;
+  };
+
+  https = {
+    certs = services_dir + "/http_certs";
+    domain = "gardling.com";
+  };
+
+  gitea = {
+    dir = services_dir + "/gitea";
+    domain = "git.${https.domain}";
+  };
+
+  postgres = {
+    socket = "/run/postgresql";
+    dataDir = services_dir + "/sql";
+  };
+
+  immich = {
+    dir = services_dir + "/immich";
+  };
+
+  minecraft = {
+    parent_dir = services_dir + "/minecraft";
+    server_name = "main";
+    memory = rec {
+      heap_size_m = 4000;
+      large_page_size_m = 2;
+    };
+  };
+
+  torrent = {
+    SavePath = torrents_path;
+    TempPath = torrents_path + "/incomplete";
+  };
+
+  jellyfin = {
+    dataDir = services_dir + "/jellyfin";
+    cacheDir = services_dir + "/jellyfin_cache";
+  };
+
+  slskd = rec {
+    base = "/var/lib/slskd";
+    downloads = base + "/downloads";
+    incomplete = base + "/incomplete";
+  };
+
+  vaultwarden = {
+    path = "/var/lib/vaultwarden";
+  };
+
+  monero = {
+    dataDir = services_dir + "/monero";
+  };
+
+  matrix = {
+    dataDir = "/var/lib/continuwuity";
+    domain = "matrix.${https.domain}";
+  };
+
+  ntfy = {
+    domain = "ntfy.${https.domain}";
+  };
+
+  livekit = {
+    domain = "livekit.${https.domain}";
+  };
+
+  syncthing = {
+    dataDir = services_dir + "/syncthing";
+    signalBackupDir = "/${zpool_ssds}/bak/signal";
+    grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";
+  };
+
+  prowlarr = {
+    dataDir = services_dir + "/prowlarr";
+  };
+
+  sonarr = {
+    dataDir = services_dir + "/sonarr";
+  };
+
+  radarr = {
+    dataDir = services_dir + "/radarr";
+  };
+
+  bazarr = {
+    dataDir = services_dir + "/bazarr";
+  };
+
+  jellyseerr = {
+    configDir = services_dir + "/jellyseerr";
+  };
+
+  recyclarr = {
+    dataDir = services_dir + "/recyclarr";
+  };
+
+  media = {
+    moviesDir = torrents_path + "/media/movies";
+    tvDir = torrents_path + "/media/tv";
+  };
+}
diff --git a/services/minecraft.nix b/services/minecraft.nix
index bc2750a..6a733ea 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -21,6 +21,19 @@
     ])
   ];
 
+  boot.kernel.sysctl = {
+    # Disable autogroup for better scheduling of game server threads
+    "kernel.sched_autogroup_enabled" = 0;
+
+    # We want to determine the number of hugepages based on how many minecraft needs.
+    # This can be determined by dividing the heap size by the size of a large page.
+    # Doing this gives us how many large pages are needed.
+    # Then we add 300 to give some headroom.
+    "vm.nr_hugepages" =
+      (service_configs.minecraft.memory.heap_size_m / service_configs.minecraft.memory.large_page_size_m)
+      + 300;
+  };
+
   services.minecraft-servers = {
     enable = true;
     eula = true;
@@ -31,42 +44,38 @@
       enable = true;
       package = pkgs.fabricServers.fabric-1_21_11;
 
-      jvmOpts =
-        let
-          heap_size = "4000M";
-        in
-        lib.concatStringsSep " " [
-          # Memory
-          "-Xmx${heap_size}"
-          "-Xms${heap_size}"
-          # GC
-          "-XX:+UseZGC"
-          "-XX:+ZGenerational"
-          # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
-          "-XX:+UnlockExperimentalVMOptions"
-          "-XX:+UnlockDiagnosticVMOptions"
-          "-XX:+AlwaysActAsServerClassMachine"
-          "-XX:+AlwaysPreTouch"
-          "-XX:+DisableExplicitGC"
-          "-XX:+UseNUMA"
-          "-XX:+PerfDisableSharedMem"
-          "-XX:+UseFastUnorderedTimeStamps"
-          "-XX:+UseCriticalJavaThreadPriority"
-          "-XX:ThreadPriorityPolicy=1"
-          "-XX:AllocatePrefetchStyle=3"
-          "-XX:-DontCompileHugeMethods"
-          "-XX:MaxNodeLimit=240000"
-          "-XX:NodeLimitFudgeFactor=8000"
-          "-XX:ReservedCodeCacheSize=400M"
-          "-XX:NonNMethodCodeHeapSize=12M"
-          "-XX:ProfiledCodeHeapSize=194M"
-          "-XX:NonProfiledCodeHeapSize=194M"
-          "-XX:NmethodSweepActivity=1"
-          "-XX:+UseVectorCmov"
-          # Large pages (requires vm.nr_hugepages sysctl)
-          "-XX:+UseLargePages"
-          "-XX:LargePageSizeInBytes=2m"
-        ];
+      jvmOpts = lib.concatStringsSep " " [
+        # Memory
+        "-Xmx${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
+        "-Xms${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
+        # GC
+        "-XX:+UseZGC"
+        "-XX:+ZGenerational"
+        # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
+        "-XX:+UnlockExperimentalVMOptions"
+        "-XX:+UnlockDiagnosticVMOptions"
+        "-XX:+AlwaysActAsServerClassMachine"
+        "-XX:+AlwaysPreTouch"
+        "-XX:+DisableExplicitGC"
+        "-XX:+UseNUMA"
+        "-XX:+PerfDisableSharedMem"
+        "-XX:+UseFastUnorderedTimeStamps"
+        "-XX:+UseCriticalJavaThreadPriority"
+        "-XX:ThreadPriorityPolicy=1"
+        "-XX:AllocatePrefetchStyle=3"
+        "-XX:-DontCompileHugeMethods"
+        "-XX:MaxNodeLimit=240000"
+        "-XX:NodeLimitFudgeFactor=8000"
+        "-XX:ReservedCodeCacheSize=400M"
+        "-XX:NonNMethodCodeHeapSize=12M"
+        "-XX:ProfiledCodeHeapSize=194M"
+        "-XX:NonProfiledCodeHeapSize=194M"
+        "-XX:NmethodSweepActivity=1"
+        "-XX:+UseVectorCmov"
+        # Large pages (requires vm.nr_hugepages sysctl)
+        "-XX:+UseLargePages"
+        "-XX:LargePageSizeInBytes=${builtins.toString service_configs.minecraft.memory.large_page_size_m}M"
+      ];
 
       serverProperties = {
         server-port = service_configs.ports.minecraft;
diff --git a/services/wg.nix b/services/wg.nix
index 283e381..05d67ce 100644
--- a/services/wg.nix
+++ b/services/wg.nix
@@ -17,4 +17,36 @@
       # "192.168.0.0/24"
     ];
   };
+
+  boot = {
+    # BBR congestion control handles variable-latency VPN connections much
+    # better than CUBIC by probing bandwidth continuously rather than
+    # reacting to packet loss.
+    kernelModules = [ "tcp_bbr" ];
+
+    kernel.sysctl = {
+      # Use BBR + fair queuing for smooth throughput through the WireGuard VPN
+      "net.core.default_qdisc" = "fq";
+      "net.ipv4.tcp_congestion_control" = "bbr";
+
+      # Disable slow-start after idle: prevents TCP from resetting window
+      # size on each burst cycle (the primary cause of the 0 -> 40 MB/s spikes)
+      "net.ipv4.tcp_slow_start_after_idle" = 0;
+
+      # Larger socket buffers to accommodate the VPN bandwidth-delay product
+      # (22ms RTT * target throughput). Current 2.5MB max is too small.
+      "net.core.rmem_max" = 16777216;
+      "net.core.wmem_max" = 16777216;
+      "net.ipv4.tcp_rmem" = "4096 87380 16777216";
+      "net.ipv4.tcp_wmem" = "4096 65536 16777216";
+
+      # Higher backlog for the large number of concurrent torrent connections
+      "net.core.netdev_max_backlog" = 5000;
+      # Faster cleanup of dead connections from torrent peer churn
+      "net.ipv4.tcp_fin_timeout" = 15; # default 60
+      "net.ipv4.tcp_tw_reuse" = 1;
+    };
+  };
+
+  networking.firewall.trustedInterfaces = [ "wg-br" ];
 }
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
index 82b3595..0022c06 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban-gitea.nix
@@ -5,18 +5,14 @@
   ...
 }:
 let
-  testServiceConfigs = {
+  baseServiceConfigs = import ../service-configs.nix;
+  testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     gitea = {
       dir = "/var/lib/gitea";
       domain = "git.test.local";
     };
-    postgres = {
-      socket = "/run/postgresql";
-    };
-    ports = {
-      gitea = 3000;
-    };
+    ports.gitea = 3000;
   };
 
   testLib = lib.extend (
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
index 64052d5..2fefa0a 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban-immich.nix
@@ -5,17 +5,12 @@
   ...
 }:
 let
-  testServiceConfigs = {
+  baseServiceConfigs = import ../service-configs.nix;
+  testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
-    https = {
-      domain = "test.local";
-    };
-    ports = {
-      immich = 2283;
-    };
-    immich = {
-      dir = "/var/lib/immich";
-    };
+    https.domain = "test.local";
+    ports.immich = 2283;
+    immich.dir = "/var/lib/immich";
   };
 
   testLib = lib.extend (
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 8c1d53e..165dcd0 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -5,19 +5,14 @@
   ...
 }:
 let
-  testServiceConfigs = {
+  baseServiceConfigs = import ../service-configs.nix;
+  testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
-    https = {
-      domain = "test.local";
-    };
-    ports = {
-      jellyfin = 8096;
-    };
+    https.domain = "test.local";
     jellyfin = {
       dataDir = "/var/lib/jellyfin";
       cacheDir = "/var/cache/jellyfin";
     };
-    media_group = "media";
   };
 
   testLib = lib.extend (
diff --git a/tests/fail2ban-ssh.nix b/tests/fail2ban-ssh.nix
index 9730fff..758820f 100644
--- a/tests/fail2ban-ssh.nix
+++ b/tests/fail2ban-ssh.nix
@@ -5,11 +5,6 @@
   ...
 }:
 let
-  testServiceConfigs = {
-    zpool_ssds = "";
-    zpool_hdds = "";
-  };
-
   securityModule = import ../modules/security.nix;
 
   sshModule =
diff --git a/tests/fail2ban-vaultwarden.nix b/tests/fail2ban-vaultwarden.nix
index fc871f2..5869a71 100644
--- a/tests/fail2ban-vaultwarden.nix
+++ b/tests/fail2ban-vaultwarden.nix
@@ -5,17 +5,10 @@
   ...
 }:
 let
-  testServiceConfigs = {
+  baseServiceConfigs = import ../service-configs.nix;
+  testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
-    https = {
-      domain = "test.local";
-    };
-    ports = {
-      vaultwarden = 8222;
-    };
-    vaultwarden = {
-      path = "/var/lib/vaultwarden";
-    };
+    https.domain = "test.local";
   };
 
   testLib = lib.extend (
diff --git a/tests/minecraft.nix b/tests/minecraft.nix
index 7a27d21..40dbfa9 100644
--- a/tests/minecraft.nix
+++ b/tests/minecraft.nix
@@ -6,18 +6,14 @@
   ...
 }:
 let
-  testServiceConfigs = {
-    minecraft = {
-      server_name = "main";
-      parent_dir = "/var/lib/minecraft";
-    };
-    https = {
-      domain = "test.local";
-    };
-    ports = {
-      minecraft = 25565;
-    };
+  baseServiceConfigs = import ../service-configs.nix;
+  testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
+    https.domain = "test.local";
+    minecraft.parent_dir = "/var/lib/minecraft";
+    minecraft.memory = rec {
+      heap_size_m = 1000;
+    };
   };
 
   # Create pkgs with nix-minecraft overlay and unfree packages allowed
@@ -46,6 +42,9 @@ testPkgs.testers.runNixOSTest {
         ../services/minecraft.nix
       ];
 
+      # Force to 0 because no huge pages in vms ?
+      boot.kernel.sysctl."vm.nr_hugepages" = lib.mkForce 0;
+
       # Enable caddy service (required by minecraft service)
       services.caddy.enable = true;
 

From a2e05d4827b64105033b6cd831a55d10c3a71bf9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 19:54:19 -0500
Subject: [PATCH 640/847] cleanup port list

---
 service-configs.nix   | 20 +++++++++++---------
 services/soulseek.nix |  4 ++++
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/service-configs.nix b/service-configs.nix
index d53ed7c..883c84e 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -9,27 +9,29 @@ rec {
   cpu_arch = "znver3";
 
   ports = {
+    # public
     http = 80;
     https = 443;
+    minecraft = 25565;
+    syncthing_protocol = 22000;
+    syncthing_discovery = 21027;
+    matrix_federation = 8448;
+    coturn = 3478;
+    coturn_tls = 5349;
+    livekit = 7880;
+    soulseek_listen = 50300;
+
+    # private
     jellyfin = 8096; # no services.jellyfin option for this
     torrent = 6011;
     bitmagnet = 3333;
     gitea = 2283;
     immich = 2284;
     soulseek_web = 5030;
-    soulseek_listen = 50300;
-    llama_cpp = 8991;
     vaultwarden = 8222;
     syncthing_gui = 8384;
-    syncthing_protocol = 22000;
-    syncthing_discovery = 21027;
-    minecraft = 25565;
     matrix = 6167;
-    matrix_federation = 8448;
-    coturn = 3478;
-    coturn_tls = 5349;
     ntfy = 2586;
-    livekit = 7880;
     lk_jwt = 8081;
     prowlarr = 9696;
     sonarr = 8989;
diff --git a/services/soulseek.nix b/services/soulseek.nix
index f2aa999..f9ad21b 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -75,4 +75,8 @@ in
   services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
     reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
   '';
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.soulseek_listen
+  ];
 }

From c6aae99c9e09f86740938d4ded1468f9f6173649 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 20:01:03 -0500
Subject: [PATCH 641/847] monero: hook up to `ports`

---
 service-configs.nix | 2 ++
 services/monero.nix | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/service-configs.nix b/service-configs.nix
index 883c84e..9242b1e 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -20,6 +20,7 @@ rec {
     coturn_tls = 5349;
     livekit = 7880;
     soulseek_listen = 50300;
+    monero = 18080;
 
     # private
     jellyfin = 8096; # no services.jellyfin option for this
@@ -38,6 +39,7 @@ rec {
     radarr = 7878;
     bazarr = 6767;
     jellyseerr = 5055;
+    monero_rpc = 18081;
   };
 
   https = {
diff --git a/services/monero.nix b/services/monero.nix
index 7b7f0bc..16a5b9a 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -17,7 +17,15 @@
     enable = true;
     dataDir = service_configs.monero.dataDir;
     rpc = {
+      port = service_configs.ports.monero_rpc;
       restricted = true;
     };
+    extraConfig = ''
+      p2p-bind-port=${builtins.toString service_configs.ports.monero}
+    '';
   };
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.monero
+  ];
 }

From 9c632e08762ea9ee6efb44001ba37ca06467d1dd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 20:19:05 -0500
Subject: [PATCH 642/847] syncthing: forgot about UDP protocol

---
 services/syncthing.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/services/syncthing.nix b/services/syncthing.nix
index 33d03ee..a7cf2bf 100644
--- a/services/syncthing.nix
+++ b/services/syncthing.nix
@@ -43,7 +43,10 @@
   # Open firewall ports for syncthing protocol
   networking.firewall = {
     allowedTCPPorts = [ service_configs.ports.syncthing_protocol ];
-    allowedUDPPorts = [ service_configs.ports.syncthing_discovery ];
+    allowedUDPPorts = [
+      service_configs.ports.syncthing_discovery
+      service_configs.ports.syncthing_protocol
+    ];
   };
 
   services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = ''

From e9fe722308b778cfaecad7d8df6c370b85e89fff Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 20:19:28 -0500
Subject: [PATCH 643/847] add notes next to ports in service-configs

---
 service-configs.nix | 56 ++++++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/service-configs.nix b/service-configs.nix
index 9242b1e..da9a37d 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -10,36 +10,36 @@ rec {
 
   ports = {
     # public
-    http = 80;
-    https = 443;
-    minecraft = 25565;
-    syncthing_protocol = 22000;
-    syncthing_discovery = 21027;
-    matrix_federation = 8448;
-    coturn = 3478;
-    coturn_tls = 5349;
-    livekit = 7880;
-    soulseek_listen = 50300;
-    monero = 18080;
+    http = 80; # TCP
+    https = 443; # TCP+UDP (HTTP/3 QUIC)
+    minecraft = 25565; # TCP
+    syncthing_protocol = 22000; # TCP+UDP (QUIC)
+    syncthing_discovery = 21027; # UDP
+    matrix_federation = 8448; # TCP+UDP (HTTP/3 QUIC)
+    coturn = 3478; # TCP+UDP
+    coturn_tls = 5349; # TCP+UDP
+    livekit = 7880; # TCP
+    soulseek_listen = 50300; # TCP
+    monero = 18080; # TCP
 
     # private
-    jellyfin = 8096; # no services.jellyfin option for this
-    torrent = 6011;
-    bitmagnet = 3333;
-    gitea = 2283;
-    immich = 2284;
-    soulseek_web = 5030;
-    vaultwarden = 8222;
-    syncthing_gui = 8384;
-    matrix = 6167;
-    ntfy = 2586;
-    lk_jwt = 8081;
-    prowlarr = 9696;
-    sonarr = 8989;
-    radarr = 7878;
-    bazarr = 6767;
-    jellyseerr = 5055;
-    monero_rpc = 18081;
+    jellyfin = 8096; # TCP - no services.jellyfin option for this
+    torrent = 6011; # TCP
+    bitmagnet = 3333; # TCP
+    gitea = 2283; # TCP
+    immich = 2284; # TCP
+    soulseek_web = 5030; # TCP
+    vaultwarden = 8222; # TCP
+    syncthing_gui = 8384; # TCP
+    matrix = 6167; # TCP
+    ntfy = 2586; # TCP
+    lk_jwt = 8081; # TCP
+    prowlarr = 9696; # TCP
+    sonarr = 8989; # TCP
+    radarr = 7878; # TCP
+    bazarr = 6767; # TCP
+    jellyseerr = 5055; # TCP
+    monero_rpc = 18081; # TCP
   };
 
   https = {

From 5f790d6c47f818e270bd15f28d663a32e9cd8ae7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 3 Mar 2026 21:59:41 -0500
Subject: [PATCH 644/847] update

---
 flake.lock | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/flake.lock b/flake.lock
index 08c62a4..08d1775 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,10 +32,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1772563009,
+        "lastModified": 1772566016,
         "narHash": "sha256-+LExMzFXahgoFYayrmqK4MhT9QkUplVwurcTDjk8kGI=",
         "ref": "refs/heads/main",
-        "rev": "9159444f332da049909632e294d58e91dc61d38c",
+        "rev": "4cc1ae4e00844d2bd80da3869f17649c1cef3f8a",
         "revCount": 3,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1772334875,
-        "narHash": "sha256-AveYVY2plEJ62Br6iAd4fB5PDYyjJoTEmgdWRV3m+Vo=",
+        "lastModified": 1772592046,
+        "narHash": "sha256-+Lyl+mGVd0t2nlR6ODK/gvUHzMtF5qLlbTK+x5tCenU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "a852ac73a4f9bf8270bdac90a72a28fef5df846b",
+        "rev": "483abf9ad6aeac1d61f2a5419ded2879f0c4795e",
         "type": "github"
       },
       "original": {
@@ -530,11 +530,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1772492983,
-        "narHash": "sha256-Rzlqp+7hu6dJ/Uc/iYBu5F9QCU8zMjKbPs6NJGKjL3g=",
+        "lastModified": 1772579383,
+        "narHash": "sha256-uWJcem+KJZ1xBWv3WYwpYoW/xrie67h47DVUhQl3GcI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "3240f44d1c072058919e18fb112a2ee87c54e484",
+        "rev": "6eed267b7044a39b1ccc66437cb56ec38373f288",
         "type": "github"
       },
       "original": {

From 719e1c83d0bea7ee2ca1c9e9059822eb1d7ab646 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 11:45:59 -0500
Subject: [PATCH 645/847] update

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 08d1775..6560fef 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772380125,
-        "narHash": "sha256-8C+y46xA9bxcchj9GeDPJaRUDApaA3sy2fhJr1bTbUw=",
+        "lastModified": 1772633058,
+        "narHash": "sha256-SO7JapRy2HPhgmqiLbfnW1kMx5rakPMKZ9z3wtRLQjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a07a44a839eb036e950bf397d9b782916f8dcab3",
+        "rev": "080657a04188aca25f8a6c70a0fb2ea7e37f1865",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772465433,
-        "narHash": "sha256-ywy9troNEfpgh0Ee+zaV1UTgU8kYBVKtvPSxh6clYGU=",
+        "lastModified": 1772598333,
+        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c581273b8d5bdf1c6ce7e0a54da9841e6a763913",
+        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
         "type": "github"
       },
       "original": {

From 643df612ad0c734fcc36495e89cda08bffdd37b1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 13:29:54 -0500
Subject: [PATCH 646/847] jellyfin: patch port 8096 being open

All jellyfin traffic should actually go through caddy.
This port being open caused a lot of confusion for me.
As I was getting traffic from typo'd domain names,
such as `jellfin.gardling.com`, which made NO SENSE!
But since it was going directly via port 8096, it
skipped caddy entirely so the traffic went through.
---
 services/jellyfin.nix       | 2 --
 tests/fail2ban-jellyfin.nix | 3 +++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 6761c1a..2ab9b12 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -19,8 +19,6 @@
 
   services.jellyfin = {
     enable = true;
-    # used for local streaming
-    openFirewall = true;
     package = pkgs.jellyfin.override { jellyfin-ffmpeg = (lib.optimizePackage pkgs.jellyfin-ffmpeg); };
 
     inherit (service_configs.jellyfin) dataDir cacheDir;
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 165dcd0..195c5f7 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -55,6 +55,9 @@ pkgs.testers.runNixOSTest {
           jellyfinModule
         ];
 
+        # needed for testing
+        services.jellyfin.openFirewall = true;
+
         # Create the media group
         users.groups.media = { };
 

From bf3c949b70ebd5fe06f4e8dd18e45e599ec913a1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 13:31:19 -0500
Subject: [PATCH 647/847] service-configs: add murmur port

---
 configuration.nix   | 1 +
 service-configs.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 4181355..b744729 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -279,6 +279,7 @@
     openFirewall = true;
     welcometext = "meow meow meow meow meow :3 xd";
     password = builtins.readFile ./secrets/murmur_password;
+    port = service_configs.ports.murmur;
   };
 
   # services.botamusique = {
diff --git a/service-configs.nix b/service-configs.nix
index da9a37d..cee64ee 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -21,6 +21,7 @@ rec {
     livekit = 7880; # TCP
     soulseek_listen = 50300; # TCP
     monero = 18080; # TCP
+    murmur = 64738; # TCP + UDP
 
     # private
     jellyfin = 8096; # TCP - no services.jellyfin option for this

From b5be21ff8c59aa3338f22e4d0d60aa2d3ab7775d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 17:35:49 -0500
Subject: [PATCH 648/847] secrets: cleanup activation scripts

---
 modules/age-secrets.nix |  8 +++++---
 modules/zfs.nix         | 17 -----------------
 services/soulseek.nix   | 15 +--------------
 3 files changed, 6 insertions(+), 34 deletions(-)

diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index fea3c05..c4af393 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -13,11 +13,13 @@
   # Configure all agenix secrets
   age.secrets = {
     # ZFS encryption key
+    # path is set to /etc/zfs-key to match the ZFS dataset keylocation property
     zfs-key = {
       file = ../secrets/zfs-key.age;
       mode = "0400";
       owner = "root";
       group = "root";
+      path = "/etc/zfs-key";
     };
 
     # Secureboot keys archive
@@ -53,9 +55,9 @@
 
     slskd_env = {
       file = ../secrets/slskd_env.age;
-      mode = "0400";
-      owner = "root";
-      group = "root";
+      mode = "0500";
+      owner = config.services.slskd.user;
+      group = config.services.slskd.group;
     };
 
     # Network configuration
diff --git a/modules/zfs.nix b/modules/zfs.nix
index 1df7971..2da4c73 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -4,24 +4,7 @@
   pkgs,
   ...
 }:
-let
-  # DO NOT CHANGE
-  # path is set via a zfs property
-  zfs-key = "/etc/zfs-key";
-in
 {
-  system.activationScripts = {
-    # Copy decrypted ZFS key from agenix to expected location
-    # /etc is on tmpfs due to impermanence, so no persistent storage risk
-    "zfs-key".text = ''
-      #!/bin/sh
-      rm -f ${zfs-key} || true
-      cp ${config.age.secrets.zfs-key.path} ${zfs-key}
-      chmod 0400 ${zfs-key}
-      chown root:root ${zfs-key}
-    '';
-  };
-
   boot.zfs.package = pkgs.zfs;
   boot.initrd.kernelModules = [ "zfs" ];
 
diff --git a/services/soulseek.nix b/services/soulseek.nix
index f9ad21b..21e9bff 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -6,9 +6,6 @@
   username,
   ...
 }:
-let
-  slskd_env = "/etc/slskd_env";
-in
 {
   imports = [
     (lib.serviceMountWithZpool "slskd" "" [
@@ -26,20 +23,10 @@ in
 
   users.groups."music" = { };
 
-  system.activationScripts = {
-    "skskd_env".text = ''
-      #!/bin/sh
-      rm -fr ${slskd_env} || true
-      cp ${config.age.secrets.slskd_env.path} ${slskd_env}
-      chmod 0500 ${slskd_env}
-      chown ${config.services.slskd.user}:${config.services.slskd.group} ${slskd_env}
-    '';
-  };
-
   services.slskd = {
     enable = true;
     domain = null; # null so we don't use nginx reverse proxy
-    environmentFile = slskd_env;
+    environmentFile = config.age.secrets.slskd_env.path;
 
     settings = {
       web = {

From f784f268485a0d369533dc0818a0af2c7f63bac5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 18:56:55 -0500
Subject: [PATCH 649/847] monero: changes

---
 modules/zfs.nix     | 1 +
 services/monero.nix | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index 2da4c73..29c00c0 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -26,6 +26,7 @@
       "zfs.zfs_dirty_data_max=${builtins.toString dirty_b}"
       "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
       "zfs.zfs_vdev_async_write_max_active=30" # more concurrent async writes to vdevs (default 10)
+      "zfs.zfs_vdev_async_read_max_active=10" # more concurrent async reads for random I/O (default 3)
     ];
 
   boot.supportedFilesystems = [ "zfs" ];
diff --git a/services/monero.nix b/services/monero.nix
index 16a5b9a..a8bea8d 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -17,15 +17,18 @@
     enable = true;
     dataDir = service_configs.monero.dataDir;
     rpc = {
+      address = "0.0.0.0";
       port = service_configs.ports.monero_rpc;
       restricted = true;
     };
     extraConfig = ''
       p2p-bind-port=${builtins.toString service_configs.ports.monero}
+      db-sync-mode=fast:async:1000000000bytes
     '';
   };
 
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.monero
+    service_configs.ports.monero_rpc
   ];
 }

From 08cbc37f940e624e758c66168d740195f311b690 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 4 Mar 2026 19:40:18 -0500
Subject: [PATCH 650/847] minecraft: fix map perms

---
 services/minecraft.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 6a733ea..8b57230 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -18,6 +18,9 @@
     (lib.serviceFilePerms "minecraft-server-${service_configs.minecraft.server_name}" [
       "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 700 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
       "Z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web 750 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+      # Allow caddy (in minecraft group) to traverse to squaremap/web for map.gardling.com
+      "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
+      "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
     ])
   ];
 
@@ -190,9 +193,4 @@
     ];
   };
 
-  systemd.tmpfiles.rules = [
-    # Allow caddy (in minecraft group) to traverse to squaremap/web for map.gardling.com
-    "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
-    "z ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap 710 ${config.services.minecraft-servers.user} ${config.services.minecraft-servers.group}"
-  ];
 }

From 65f5d64c1af8313c092ce7a8c2c27156d97b25f1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Mar 2026 13:09:10 -0500
Subject: [PATCH 651/847] monero: public node

---
 services/monero.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/monero.nix b/services/monero.nix
index a8bea8d..1e4d792 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -24,6 +24,8 @@
     extraConfig = ''
       p2p-bind-port=${builtins.toString service_configs.ports.monero}
       db-sync-mode=fast:async:1000000000bytes
+      public-node=1
+      confirm-external-bind=1
     '';
   };
 

From ad4d2d41fb692764d67d9de59b417fabe10c2979 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Mar 2026 13:44:07 -0500
Subject: [PATCH 652/847] zfs: tweak arc settings

---
 modules/zfs.nix     | 18 +++++++++++++-----
 service-configs.nix |  1 +
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index 29c00c0..0a16ebc 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -10,10 +10,17 @@
 
   boot.kernelParams =
     let
-      arc_gb = 32;
-      arc_mb = arc_gb * 1000;
-      arc_kb = arc_mb * 1000;
-      arc_b = arc_kb * 1000;
+      # SEE: https://github.com/openzfs/zfs/pull/15437
+      # and https://blog.thalheim.io/2025/10/17/zfs-ate-my-ram-understanding-the-arc-cache/
+      arc_max_gb = (service_configs.gb_ram * 5) / 8;
+      arc_max_mb = arc_max_gb * 1000;
+      arc_max_kb = arc_max_mb * 1000;
+      arc_max_b = arc_max_kb * 1000;
+
+      arc_min_gb = 4;
+      arc_min_mb = arc_min_gb * 1000;
+      arc_min_kb = arc_min_mb * 1000;
+      arc_min_b = arc_min_kb * 1000;
 
       dirty_gb = 8; # Default value is 4GB, helps smooth writes
       dirty_mb = dirty_gb * 1000;
@@ -21,7 +28,8 @@
       dirty_b = dirty_kb * 1000;
     in
     [
-      "zfs.zfs_arc_max=${builtins.toString arc_b}"
+      "zfs.zfs_arc_max=${builtins.toString arc_max_b}"
+      "zfs.zfs_arc_min=${builtins.toString arc_min_b}"
       "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
       "zfs.zfs_dirty_data_max=${builtins.toString dirty_b}"
       "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
diff --git a/service-configs.nix b/service-configs.nix
index cee64ee..1636b13 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -7,6 +7,7 @@ rec {
   media_group = "media";
 
   cpu_arch = "znver3";
+  gb_ram = 64;
 
   ports = {
     # public

From 3ccce88040368133e6add903384c000fc4c82886 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Mar 2026 13:47:06 -0500
Subject: [PATCH 653/847] zfs: remove unneeded options

---
 modules/zfs.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index 0a16ebc..58e9099 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -21,20 +21,11 @@
       arc_min_mb = arc_min_gb * 1000;
       arc_min_kb = arc_min_mb * 1000;
       arc_min_b = arc_min_kb * 1000;
-
-      dirty_gb = 8; # Default value is 4GB, helps smooth writes
-      dirty_mb = dirty_gb * 1000;
-      dirty_kb = dirty_mb * 1000;
-      dirty_b = dirty_kb * 1000;
     in
     [
       "zfs.zfs_arc_max=${builtins.toString arc_max_b}"
       "zfs.zfs_arc_min=${builtins.toString arc_min_b}"
       "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
-      "zfs.zfs_dirty_data_max=${builtins.toString dirty_b}"
-      "zfs.zfs_delay_min_dirty_percent=80" # delay write throttling until 80% dirty (default 60%)
-      "zfs.zfs_vdev_async_write_max_active=30" # more concurrent async writes to vdevs (default 10)
-      "zfs.zfs_vdev_async_read_max_active=10" # more concurrent async reads for random I/O (default 3)
     ];
 
   boot.supportedFilesystems = [ "zfs" ];

From c008fd2b18a9ec67e9f19dc3c4b55b9869af53be Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 6 Mar 2026 14:11:14 -0500
Subject: [PATCH 654/847] zfs: don't specify zfs arc cache

Turns out, zfs is smart!
ZFS already has sane defaults, no sense in limiting the size of the cache.
---
 modules/zfs.nix     | 22 +++-------------------
 service-configs.nix |  1 -
 2 files changed, 3 insertions(+), 20 deletions(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index 58e9099..5d7478a 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -8,25 +8,9 @@
   boot.zfs.package = pkgs.zfs;
   boot.initrd.kernelModules = [ "zfs" ];
 
-  boot.kernelParams =
-    let
-      # SEE: https://github.com/openzfs/zfs/pull/15437
-      # and https://blog.thalheim.io/2025/10/17/zfs-ate-my-ram-understanding-the-arc-cache/
-      arc_max_gb = (service_configs.gb_ram * 5) / 8;
-      arc_max_mb = arc_max_gb * 1000;
-      arc_max_kb = arc_max_mb * 1000;
-      arc_max_b = arc_max_kb * 1000;
-
-      arc_min_gb = 4;
-      arc_min_mb = arc_min_gb * 1000;
-      arc_min_kb = arc_min_mb * 1000;
-      arc_min_b = arc_min_kb * 1000;
-    in
-    [
-      "zfs.zfs_arc_max=${builtins.toString arc_max_b}"
-      "zfs.zfs_arc_min=${builtins.toString arc_min_b}"
-      "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
-    ];
+  boot.kernelParams = [
+    "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
+  ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.extraPools = [
diff --git a/service-configs.nix b/service-configs.nix
index 1636b13..cee64ee 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -7,7 +7,6 @@ rec {
   media_group = "media";
 
   cpu_arch = "znver3";
-  gb_ram = 64;
 
   ports = {
     # public

From f1f92703c1f0bca55c2ddad9e17b76d91c6e9b52 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 7 Mar 2026 23:25:58 -0500
Subject: [PATCH 655/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6560fef..103c0a5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772420042,
-        "narHash": "sha256-naZz40TUFMa0E0CutvwWsSPhgD5JldyTUDEgP9ADpfU=",
+        "lastModified": 1772867152,
+        "narHash": "sha256-RIFgZ4O6Eg+5ysZ8Tqb3YvcqiRaNy440GEY22ltjRrs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5af7af10f14706e4095bd6bc0d9373eb097283c6",
+        "rev": "eaafb89b56e948661d618eefd4757d9ea8d77514",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772598333,
-        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
+        "lastModified": 1772822230,
+        "narHash": "sha256-yf3iYLGbGVlIthlQIk5/4/EQDZNNEmuqKZkQssMljuw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
+        "rev": "71caefce12ba78d84fe618cf61644dce01cf3a96",
         "type": "github"
       },
       "original": {
@@ -454,11 +454,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772416961,
-        "narHash": "sha256-/IiEGGjy0e8Ljo6418fFlqMJs7VLuLxU5pDR5uE+GLE=",
+        "lastModified": 1772799438,
+        "narHash": "sha256-81/Ow6L5azplWp9p8gtl/Q1m5s2gCX4iuKNF5ujwxBA=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "bcdbafece2815d32c8dfc51ef17f2858f3d4cfbc",
+        "rev": "e6ec80588a07aea2cdb67c2865759e02d85b94b2",
         "type": "github"
       },
       "original": {
@@ -530,11 +530,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1772579383,
-        "narHash": "sha256-uWJcem+KJZ1xBWv3WYwpYoW/xrie67h47DVUhQl3GcI=",
+        "lastModified": 1772924980,
+        "narHash": "sha256-47Q6O7vNQZy2hMImW06jwaZvRVV/YzXMAPIbYyhSHN0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "6eed267b7044a39b1ccc66437cb56ec38373f288",
+        "rev": "01092a95d06dccfe822fcded7bd33b32b5021f52",
         "type": "github"
       },
       "original": {

From b3a40797b68156723bf22c2cffa99102170cc5ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 7 Mar 2026 23:48:53 -0500
Subject: [PATCH 656/847] matrix: remove pinned commit

---
 services/matrix.nix | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/services/matrix.nix b/services/matrix.nix
index 10a4ebf..e1d3b17 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -1,34 +1,9 @@
 {
   config,
-  pkgs,
   service_configs,
   lib,
   ...
 }:
-let
-  package =
-    let
-      src = pkgs.fetchFromGitea {
-        domain = "forgejo.ellis.link";
-        owner = "continuwuation";
-        repo = "continuwuity";
-        rev = "052c4dfa2165fdc4839fed95b71446120273cf23";
-        hash = "sha256-kQV4glRrKczoJpn9QIMgB5ac+saZQjSZPel+9K9Ykcs=";
-      };
-    in
-    pkgs.matrix-continuwuity.overrideAttrs (old: {
-      inherit src;
-      cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
-        inherit src;
-        name = "${old.pname}-vendor";
-        hash = "sha256-vlOXQL8wwEGFX+w0G/eIeHW3J1UDzhJ501kYhAghDV8=";
-      };
-
-      patches = (old.patches or [ ]) ++ [
-
-      ];
-    });
-in
 {
   imports = [
     (lib.serviceMountWithZpool "continuwuity" service_configs.zpool_ssds [
@@ -41,7 +16,6 @@ in
 
   services.matrix-continuwuity = {
     enable = true;
-    inherit package;
 
     settings.global = {
       port = [ service_configs.ports.matrix ];

From d56697b60b16889baaee5f51bc252eabe6349ee6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 02:20:27 -0400
Subject: [PATCH 657/847] qbt: remove CoalesceReadWrite (old)

---
 services/qbittorrent.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 927d083..ead19db 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -102,7 +102,6 @@
         ChokingAlgorithm = "RateBased";
         PieceExtentAffinity = true;
         SuggestMode = true;
-        CoalesceReadWrite = true;
 
         # max_queued_disk_bytes: the max bytes waiting in the disk I/O queue.
         # When this limit is reached, peer connections stop reading from their

From 04d6a9b546c4a9fea79e4aa6f9d36077018cd5d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 03:01:58 -0400
Subject: [PATCH 658/847] qbt: DiskIOType = Posix

---
 services/qbittorrent.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index ead19db..4ea5c57 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -111,6 +111,12 @@
         # where ZFS txg commits cause periodic I/O stalls.
         DiskQueueSize = 67108864; # 64MB
 
+        # POSIX-compliant disk I/O: uses pread/pwrite instead of mmap.
+        # On ZFS, mmap forces data into BOTH ARC and Linux page cache (double-caching),
+        # wasting RAM. pread/pwrite goes only through ARC, maximizing its effectiveness.
+        # Saved 26 gb of memory!!
+        DiskIOType = "Posix";
+
         # === Network buffer tuning (from libtorrent high_performance_seed preset) ===
         # "always stuff at least 1 MiB down each peer pipe, to quickly ramp up send rates"
         SendBufferLowWatermark = 1024; # 1MB (KiB) -- matches high_performance_seed

From 3d4aea8c5bca56d3b610d3333d9ccd321f3cebf3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 14:30:23 -0400
Subject: [PATCH 659/847] caddy: move to new domain

---
 service-configs.nix |  3 ++-
 services/caddy.nix  | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/service-configs.nix b/service-configs.nix
index cee64ee..aa90032 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -45,7 +45,8 @@ rec {
 
   https = {
     certs = services_dir + "/http_certs";
-    domain = "gardling.com";
+    domain = "sigkill.computer";
+    old_domain = "gardling.com"; # Redirect traffic from old domain
   };
 
   gitea = {
diff --git a/services/caddy.nix b/services/caddy.nix
index 856bb8b..1269acd 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -61,6 +61,22 @@ in
 
         serverAliases = [ "www.${service_configs.https.domain}" ];
       };
+
+      # Redirect old domain (bare) to new domain
+      ${service_configs.https.old_domain} = {
+        extraConfig = ''
+          redir https://${service_configs.https.domain}{uri} permanent
+        '';
+        serverAliases = [ "www.${service_configs.https.old_domain}" ];
+      };
+
+      # Redirect old domain (wildcard subdomains) to new domain
+      "*.${service_configs.https.old_domain}" = {
+        extraConfig = ''
+          # {labels.2} extracts the subdomain from *.gardling.com
+          redir https://{labels.2}.${service_configs.https.domain}{uri} permanent
+        '';
+      };
     };
   };
 

From f3f5a9c726939e980c0bdd6e41fc1d61d7ad6e2b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 14:52:29 -0400
Subject: [PATCH 660/847] caddy: add redirect from old domain

---
 services/caddy.nix | 46 ++++++++++++++++++++++++++++++++++++----------
 1 file changed, 36 insertions(+), 10 deletions(-)

diff --git a/services/caddy.nix b/services/caddy.nix
index 1269acd..c6adaf2 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -41,6 +41,9 @@ let
       hugo --minify -d $out;
     '';
   };
+
+  newDomain = service_configs.https.domain;
+  oldDomain = service_configs.https.old_domain;
 in
 {
   imports = [
@@ -52,29 +55,52 @@ in
   services.caddy = {
     enable = true;
     email = "titaniumtown@proton.me";
+
+    # Enable on-demand TLS for old domain redirects
+    # Certs are issued dynamically when subdomains are accessed
+    globalConfig = ''
+      on_demand_tls {
+        ask http://localhost:9123/check
+      }
+    '';
+
+    # Internal endpoint to validate on-demand TLS requests
+    # Only allows certs for *.${oldDomain}
+    extraConfig = ''
+      http://localhost:9123 {
+        @allowed expression {query.domain}.endsWith(".${oldDomain}") || {query.domain} == "${oldDomain}" || {query.domain} == "www.${oldDomain}"
+        respond @allowed 200
+        respond 403
+      }
+    '';
+
     virtualHosts = {
-      ${service_configs.https.domain} = {
+      ${newDomain} = {
         extraConfig = ''
           root * ${hugoWebsite}
           file_server browse
         '';
 
-        serverAliases = [ "www.${service_configs.https.domain}" ];
+        serverAliases = [ "www.${newDomain}" ];
       };
 
-      # Redirect old domain (bare) to new domain
-      ${service_configs.https.old_domain} = {
+      # Redirect old domain (bare + www) to new domain
+      ${oldDomain} = {
         extraConfig = ''
-          redir https://${service_configs.https.domain}{uri} permanent
+          redir https://${newDomain}{uri} permanent
         '';
-        serverAliases = [ "www.${service_configs.https.old_domain}" ];
+        serverAliases = [ "www.${oldDomain}" ];
       };
 
-      # Redirect old domain (wildcard subdomains) to new domain
-      "*.${service_configs.https.old_domain}" = {
+      # Wildcard redirect for all old domain subdomains
+      # Uses on-demand TLS - certs issued automatically on first request
+      "*.${oldDomain}" = {
         extraConfig = ''
-          # {labels.2} extracts the subdomain from *.gardling.com
-          redir https://{labels.2}.${service_configs.https.domain}{uri} permanent
+          tls {
+            on_demand
+          }
+          # {labels.2} extracts subdomain from *.gardling.com
+          redir https://{labels.2}.${newDomain}{uri} permanent
         '';
       };
     };

From 3d8e47689c699610886cc2f88372c97a0c08dc9b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 15:05:48 -0400
Subject: [PATCH 661/847] transition domain name website + sources

---
 flake.lock | 16 ++++++++--------
 flake.nix  |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index 103c0a5..6002ce7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -579,17 +579,17 @@
     "website": {
       "flake": false,
       "locked": {
-        "lastModified": 1768266466,
-        "narHash": "sha256-d4dZzEcIKuq4DhNtXczaflpRifAtcOgNr45W2Bexnps=",
+        "lastModified": 1773169503,
+        "narHash": "sha256-P+T2H18k3zmEHxu7ZIDYyTrK5G3KUcZYW1AzVMKyCMs=",
         "ref": "refs/heads/main",
-        "rev": "06011a27456b3b9f983ef1aa142b5773bcb52b6e",
-        "revCount": 23,
+        "rev": "ae7a7d8325f841c52efb6fd81c4956b84631aa06",
+        "revCount": 24,
         "type": "git",
-        "url": "https://git.gardling.com/titaniumtown/website"
+        "url": "https://git.sigkill.computer/titaniumtown/website"
       },
       "original": {
         "type": "git",
-        "url": "https://git.gardling.com/titaniumtown/website"
+        "url": "https://git.sigkill.computer/titaniumtown/website"
       }
     },
     "ytbn-graphing-software": {
@@ -605,11 +605,11 @@
         "rev": "ac6265eae734363f95909df9a3739bf6360fa721",
         "revCount": 1130,
         "type": "git",
-        "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
+        "url": "https://git.sigkill.computer/titaniumtown/YTBN-Graphing-Software"
       },
       "original": {
         "type": "git",
-        "url": "https://git.gardling.com/titaniumtown/YTBN-Graphing-Software"
+        "url": "https://git.sigkill.computer/titaniumtown/YTBN-Graphing-Software"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 4fee0c2..65817d5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,7 +56,7 @@
     };
 
     website = {
-      url = "git+https://git.gardling.com/titaniumtown/website";
+      url = "git+https://git.sigkill.computer/titaniumtown/website";
       flake = false;
     };
 
@@ -66,7 +66,7 @@
     };
 
     ytbn-graphing-software = {
-      url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
+      url = "git+https://git.sigkill.computer/titaniumtown/YTBN-Graphing-Software";
     };
 
     arr-init = {

From 393553c6c505d739cf6f4e881eeb5b4c23f7b3b7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 10 Mar 2026 19:36:18 -0400
Subject: [PATCH 662/847] update

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6002ce7..be196fa 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772867152,
-        "narHash": "sha256-RIFgZ4O6Eg+5ysZ8Tqb3YvcqiRaNy440GEY22ltjRrs=",
+        "lastModified": 1773025010,
+        "narHash": "sha256-khlHllTsovXgT2GZ0WxT4+RvuMjNeR5OW0UYeEHPYQo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "eaafb89b56e948661d618eefd4757d9ea8d77514",
+        "rev": "7b9f7f88ab3b339f8142dc246445abb3c370d3d3",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772633058,
-        "narHash": "sha256-SO7JapRy2HPhgmqiLbfnW1kMx5rakPMKZ9z3wtRLQjI=",
+        "lastModified": 1772985280,
+        "narHash": "sha256-FdrNykOoY9VStevU4zjSUdvsL9SzJTcXt4omdEDZDLk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "080657a04188aca25f8a6c70a0fb2ea7e37f1865",
+        "rev": "8f736f007139d7f70752657dff6a401a585d6cbc",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1771969195,
-        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
+        "lastModified": 1772972630,
+        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
+        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772822230,
-        "narHash": "sha256-yf3iYLGbGVlIthlQIk5/4/EQDZNNEmuqKZkQssMljuw=",
+        "lastModified": 1773068389,
+        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "71caefce12ba78d84fe618cf61644dce01cf3a96",
+        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
         "type": "github"
       },
       "original": {
@@ -454,11 +454,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772799438,
-        "narHash": "sha256-81/Ow6L5azplWp9p8gtl/Q1m5s2gCX4iuKNF5ujwxBA=",
+        "lastModified": 1773021923,
+        "narHash": "sha256-ro+i3wNoD2p5FloGGlkCzdmzgBDeq2LJwaIpaI9Dk7Q=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "e6ec80588a07aea2cdb67c2865759e02d85b94b2",
+        "rev": "7f92c2bcbeb42ce87770a7565f0e6f92c8134354",
         "type": "github"
       },
       "original": {
@@ -530,11 +530,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1772924980,
-        "narHash": "sha256-47Q6O7vNQZy2hMImW06jwaZvRVV/YzXMAPIbYyhSHN0=",
+        "lastModified": 1773184165,
+        "narHash": "sha256-uGD+QgYZD1ntXl43523bKziyBUs1c3ONi+n5FeFZre0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "01092a95d06dccfe822fcded7bd33b32b5021f52",
+        "rev": "448eba328ad00172a4ba049ec9f9f073b9cd278b",
         "type": "github"
       },
       "original": {

From 01dbfc69a51a2cad0b391300282a99c4cddf199b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Mar 2026 11:01:25 -0400
Subject: [PATCH 663/847] p2pool: init

---
 configuration.nix   |  1 +
 flake.lock          | 18 +++++++++++++++++
 flake.nix           |  8 ++++++++
 service-configs.nix |  7 +++++++
 services/monero.nix |  1 +
 services/p2pool.nix | 48 +++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 83 insertions(+)
 create mode 100644 services/p2pool.nix

diff --git a/configuration.nix b/configuration.nix
index b744729..674ca57 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -52,6 +52,7 @@
     ./services/livekit.nix
 
     ./services/monero.nix
+    ./services/p2pool.nix
     ./services/xmrig.nix
 
     # KEEP UNTIL 2028
diff --git a/flake.lock b/flake.lock
index be196fa..ee14063 100644
--- a/flake.lock
+++ b/flake.lock
@@ -330,6 +330,23 @@
         "type": "github"
       }
     },
+    "nixpkgs-p2pool-module": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1764744779,
+        "narHash": "sha256-15mhGU8HZq4e6U2WnIhQvJNuUmU5aIO0RHMjzv9gVZs=",
+        "owner": "JacoMalan1",
+        "repo": "nixpkgs",
+        "rev": "3784f8a0dc56806ffbc550701d3aa27436ebb3e5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "JacoMalan1",
+        "ref": "create-p2pool-service",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1764517877,
@@ -381,6 +398,7 @@
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-p2pool-module": "nixpkgs-p2pool-module",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
         "trackerlist": "trackerlist",
diff --git a/flake.nix b/flake.nix
index 65817d5..5fb257a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -73,6 +73,11 @@
       url = "git+ssh://gitea@git.gardling.com/titaniumtown/arr-init";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    nixpkgs-p2pool-module = {
+      url = "github:JacoMalan1/nixpkgs/create-p2pool-service";
+      flake = false;
+    };
   };
 
   outputs =
@@ -89,6 +94,7 @@
       deploy-rs,
       impermanence,
       arr-init,
+      nixpkgs-p2pool-module,
       ...
     }@inputs:
     let
@@ -167,6 +173,8 @@
 
           arr-init.nixosModules.default
 
+          (import "${nixpkgs-p2pool-module}/nixos/modules/services/networking/p2pool.nix")
+
           home-manager.nixosModules.home-manager
           (
             {
diff --git a/service-configs.nix b/service-configs.nix
index aa90032..f96d603 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -21,6 +21,7 @@ rec {
     livekit = 7880; # TCP
     soulseek_listen = 50300; # TCP
     monero = 18080; # TCP
+    p2pool_p2p = 37889; # TCP
     murmur = 64738; # TCP + UDP
 
     # private
@@ -41,6 +42,8 @@ rec {
     bazarr = 6767; # TCP
     jellyseerr = 5055; # TCP
     monero_rpc = 18081; # TCP
+    monero_zmq = 18083; # TCP
+    p2pool_stratum = 3334; # TCP
   };
 
   https = {
@@ -96,6 +99,10 @@ rec {
     dataDir = services_dir + "/monero";
   };
 
+  p2pool = {
+    dataDir = services_dir + "/p2pool";
+  };
+
   matrix = {
     dataDir = "/var/lib/continuwuity";
     domain = "matrix.${https.domain}";
diff --git a/services/monero.nix b/services/monero.nix
index 1e4d792..e7820ea 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -23,6 +23,7 @@
     };
     extraConfig = ''
       p2p-bind-port=${builtins.toString service_configs.ports.monero}
+      zmq-pub=tcp://127.0.0.1:${builtins.toString service_configs.ports.monero_zmq}
       db-sync-mode=fast:async:1000000000bytes
       public-node=1
       confirm-external-bind=1
diff --git a/services/p2pool.nix b/services/p2pool.nix
new file mode 100644
index 0000000..6609050
--- /dev/null
+++ b/services/p2pool.nix
@@ -0,0 +1,48 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  walletAddress = lib.strings.trim (builtins.readFile ../secrets/xmrig-wallet);
+in
+{
+  imports = [
+    (lib.serviceMountWithZpool "p2pool" service_configs.zpool_hdds [
+      service_configs.p2pool.dataDir
+    ])
+    (lib.serviceFilePerms "p2pool" [
+      "Z ${service_configs.p2pool.dataDir} 0700 p2pool p2pool"
+    ])
+  ];
+
+  services.p2pool = {
+    enable = true;
+    dataDir = service_configs.p2pool.dataDir;
+    walletAddress = walletAddress;
+    sidechain = "nano";
+    host = "127.0.0.1";
+    rpcPort = service_configs.ports.monero_rpc;
+    zmqPort = service_configs.ports.monero_zmq;
+    extraArgs = [
+      "--stratum 0.0.0.0:${builtins.toString service_configs.ports.p2pool_stratum}"
+    ];
+  };
+
+  # Ensure p2pool starts after monero is ready
+  systemd.services.p2pool = {
+    after = [ "monero.service" ];
+    wants = [ "monero.service" ];
+  };
+
+  # Stop p2pool on UPS battery to conserve power
+  services.apcupsd.hooks = lib.mkIf config.services.apcupsd.enable {
+    onbattery = "systemctl stop p2pool";
+    offbattery = "systemctl start p2pool";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.p2pool_p2p
+  ];
+}

From 3e46e16f0f260d8ab2caecba3a5678f3dc95d847 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Mar 2026 11:02:56 -0400
Subject: [PATCH 664/847] xmrig: switch to p2pool

---
 services/xmrig.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/services/xmrig.nix b/services/xmrig.nix
index 376d4d4..2d4dc04 100644
--- a/services/xmrig.nix
+++ b/services/xmrig.nix
@@ -2,11 +2,10 @@
   config,
   lib,
   pkgs,
-  hostname,
+  service_configs,
   ...
 }:
 let
-  walletAddress = lib.strings.trim (builtins.readFile ../secrets/xmrig-wallet);
   threadCount = 12;
 in
 {
@@ -33,11 +32,8 @@ in
 
       pools = [
         {
-          url = "gulf.moneroocean.stream:20128";
-          user = walletAddress;
-          pass = hostname + "~rx/0";
-          keepalive = true;
-          tls = true;
+          url = "127.0.0.1:${builtins.toString service_configs.ports.p2pool_stratum}";
+          tls = false;
         }
       ];
     };

From 7396150fa31e21d79a9da78020637ff1622f03ae Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Mar 2026 11:04:32 -0400
Subject: [PATCH 665/847] p2pool: nano -> mini

---
 services/p2pool.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/p2pool.nix b/services/p2pool.nix
index 6609050..c4ce382 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -21,7 +21,7 @@ in
     enable = true;
     dataDir = service_configs.p2pool.dataDir;
     walletAddress = walletAddress;
-    sidechain = "nano";
+    sidechain = "mini";
     host = "127.0.0.1";
     rpcPort = service_configs.ports.monero_rpc;
     zmqPort = service_configs.ports.monero_zmq;

From 3f636a332fc5dc07f517e6a8e06aa7ca115decdd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Mar 2026 11:13:56 -0400
Subject: [PATCH 666/847] p2pool: fix args

https://github.com/NixOS/nixpkgs/pull/427723/changes#r2919054771
---
 services/p2pool.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/p2pool.nix b/services/p2pool.nix
index c4ce382..9953d62 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -26,7 +26,7 @@ in
     rpcPort = service_configs.ports.monero_rpc;
     zmqPort = service_configs.ports.monero_zmq;
     extraArgs = [
-      "--stratum 0.0.0.0:${builtins.toString service_configs.ports.p2pool_stratum}"
+      " --stratum 0.0.0.0:${builtins.toString service_configs.ports.p2pool_stratum}"
     ];
   };
 

From e536daa8f26a81cd420148c769d8c2806d03961a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 11 Mar 2026 13:36:46 -0400
Subject: [PATCH 667/847] p2pool: mini -> nano

---
 services/p2pool.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/p2pool.nix b/services/p2pool.nix
index 9953d62..e2d22ef 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -21,7 +21,7 @@ in
     enable = true;
     dataDir = service_configs.p2pool.dataDir;
     walletAddress = walletAddress;
-    sidechain = "mini";
+    sidechain = "nano";
     host = "127.0.0.1";
     rpcPort = service_configs.ports.monero_rpc;
     zmqPort = service_configs.ports.monero_zmq;

From bf47574b8cc217d33bf1d26bf15774e299500479 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 12 Mar 2026 12:27:03 -0400
Subject: [PATCH 668/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index ee14063..7f26b40 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772985280,
-        "narHash": "sha256-FdrNykOoY9VStevU4zjSUdvsL9SzJTcXt4omdEDZDLk=",
+        "lastModified": 1773264488,
+        "narHash": "sha256-rK0507bDuWBrZo+0zts9bCs/+RRUEHuvFE5DHWPxX/Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8f736f007139d7f70752657dff6a401a585d6cbc",
+        "rev": "5c0f63f8d55040a7eed69df7e3fcdd15dfb5a04c",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1772592046,
-        "narHash": "sha256-+Lyl+mGVd0t2nlR6ODK/gvUHzMtF5qLlbTK+x5tCenU=",
+        "lastModified": 1773196765,
+        "narHash": "sha256-GvveRb/AiCb/dKXculKiNiAMW4CXMPwpeyi6c/S/a7o=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "483abf9ad6aeac1d61f2a5419ded2879f0c4795e",
+        "rev": "4d744dff3d8e0d9e7f85e06244ad353bdcf424ff",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773068389,
-        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
+        "lastModified": 1773222311,
+        "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
+        "rev": "0590cd39f728e129122770c029970378a79d076a",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
     "nixpkgs-p2pool-module": {
       "flake": false,
       "locked": {
-        "lastModified": 1764744779,
-        "narHash": "sha256-15mhGU8HZq4e6U2WnIhQvJNuUmU5aIO0RHMjzv9gVZs=",
+        "lastModified": 1773298780,
+        "narHash": "sha256-7awJKfaH2uTuuW6gyA/lmPPfSruObm7bIkiYADxZBro=",
         "owner": "JacoMalan1",
         "repo": "nixpkgs",
-        "rev": "3784f8a0dc56806ffbc550701d3aa27436ebb3e5",
+        "rev": "501e6bb1697590473c87c2ff9d2a92043a8d0e06",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773184165,
-        "narHash": "sha256-uGD+QgYZD1ntXl43523bKziyBUs1c3ONi+n5FeFZre0=",
+        "lastModified": 1773270572,
+        "narHash": "sha256-JGnuoUcV8PVf+SWrtw84QBO6KOWZfcYRlfKGO+kamkM=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "448eba328ad00172a4ba049ec9f9f073b9cd278b",
+        "rev": "fd4474c172081e8b7fd043c395628c4949688423",
         "type": "github"
       },
       "original": {

From 131a2440c8e2bcc5fd973f58a0c6831874ddfb0c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 14 Mar 2026 19:09:43 -0400
Subject: [PATCH 669/847] minecraft: update lithium

---
 services/minecraft.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 8b57230..5ef8f94 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -109,10 +109,7 @@
               sha512 = "3210926a82eb32efd9bcebabe2f6c053daf5c4337eebc6d5bacba96d283510afbde646e7e195751de795ec70a2ea44fef77cb54bf22c8e57bb832d6217418869";
             };
 
-            Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/qvNsoO3l/lithium-fabric-0.21.3%2Bmc1.21.11.jar";
-              sha512 = "2883739303f0bb602d3797cc601ed86ce6833e5ec313ddce675f3d6af3ee6a40b9b0a06dafe39d308d919669325e95c0aafd08d78c97acd976efde899c7810fd";
-            };
+            Lithium = fetchurl { url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/Ow7wA0kG/lithium-fabric-0.21.4%2Bmc1.21.11.jar"; sha512 = "f14a5c3d2fad786347ca25083f902139694f618b7c103947f2fd067a7c5ee88a63e1ef8926f7d693ea79ed7d00f57317bae77ef9c2d630bf5ed01ac97a752b94"; };
 
             NoChatReports = fetchurl {
               url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/rhykGstm/NoChatReports-FABRIC-1.21.11-v2.18.0.jar";

From 594ecdfef754d9aa7c3a6467d21381689f7051b4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 14 Mar 2026 19:11:04 -0400
Subject: [PATCH 670/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7f26b40..fef3d59 100644
--- a/flake.lock
+++ b/flake.lock
@@ -47,11 +47,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1771796463,
-        "narHash": "sha256-9bCDuUzpwJXcHMQYMS1yNuzYMmKO/CCwCexpjWOl62I=",
+        "lastModified": 1772080396,
+        "narHash": "sha256-84W9UNtSk9DNMh43WBkOjpkbfODlmg+RDi854PnNgLE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "3d3de3313e263e04894f284ac18177bd26169bad",
+        "rev": "8525580bc0316c39dbfa18bd09a1331e98c9e463",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773025010,
-        "narHash": "sha256-khlHllTsovXgT2GZ0WxT4+RvuMjNeR5OW0UYeEHPYQo=",
+        "lastModified": 1773506317,
+        "narHash": "sha256-qWKbLUJpavIpvOdX1fhHYm0WGerytFHRoh9lVck6Bh0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "7b9f7f88ab3b339f8142dc246445abb3c370d3d3",
+        "rev": "878ec37d6a8f52c6c801d0e2a2ad554c75b9353c",
         "type": "github"
       },
       "original": {
@@ -263,11 +263,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1772216104,
-        "narHash": "sha256-1TnGN26vnCEQk5m4AavJZxGZTb/6aZyphemRPRwFUfs=",
+        "lastModified": 1773344150,
+        "narHash": "sha256-JSsXufJy2zdg5XS5pRGlkwF1dqN+sWPmCgrvJsnhEzg=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "dbe5112de965bbbbff9f0729a9789c20a65ab047",
+        "rev": "d21013305ef39e1d9d2d06b161c3785ffad82281",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1773196765,
-        "narHash": "sha256-GvveRb/AiCb/dKXculKiNiAMW4CXMPwpeyi6c/S/a7o=",
+        "lastModified": 1773456096,
+        "narHash": "sha256-vlV3HnHBxnfW4a2ifabH3L/3iGGjA5ejEP7XD7EOC+E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "4d744dff3d8e0d9e7f85e06244ad353bdcf424ff",
+        "rev": "ce7440a5fced512773e8e695d8a7bd57f33c7e6d",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773222311,
-        "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
+        "lastModified": 1773375660,
+        "narHash": "sha256-SEzUWw2Rf5Ki3bcM26nSKgbeoqi2uYy8IHVBqOKjX3w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0590cd39f728e129122770c029970378a79d076a",
+        "rev": "3e20095fe3c6cbb1ddcef89b26969a69a1570776",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771858127,
-        "narHash": "sha256-Gtre9YoYl3n25tJH2AoSdjuwcqij5CPxL3U3xysYD08=",
+        "lastModified": 1772024342,
+        "narHash": "sha256-+eXlIc4/7dE6EcPs9a2DaSY3fTA9AE526hGqkNID3Wg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "49bbbfc218bf3856dfa631cead3b052d78248b83",
+        "rev": "6e34e97ed9788b17796ee43ccdbaf871a5c2b476",
         "type": "github"
       },
       "original": {
@@ -415,11 +415,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771988922,
-        "narHash": "sha256-Fc6FHXtfEkLtuVJzd0B6tFYMhmcPLuxr90rWfb/2jtQ=",
+        "lastModified": 1772334676,
+        "narHash": "sha256-Jrc0J3AH+iNJDlUze3+FJZv2R0BZnhANFnD52V4kyvI=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "f4443dc3f0b6c5e6b77d923156943ce816d1fcb9",
+        "rev": "9879be11f30fd3bbf848e653a7f991549e8973b5",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773021923,
-        "narHash": "sha256-ro+i3wNoD2p5FloGGlkCzdmzgBDeq2LJwaIpaI9Dk7Q=",
+        "lastModified": 1773369348,
+        "narHash": "sha256-6UwMEAi6X3oMjKQm51i0+3i10DrsrSdXi/4YgmJxfhE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "7f92c2bcbeb42ce87770a7565f0e6f92c8134354",
+        "rev": "f3f0277b1dee1bfd058c5b8b98cb25558d95f03f",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773270572,
-        "narHash": "sha256-JGnuoUcV8PVf+SWrtw84QBO6KOWZfcYRlfKGO+kamkM=",
+        "lastModified": 1773529772,
+        "narHash": "sha256-I+K0BCc7fNQp6N7mTE/3SIHfencR4l0+sRsom4xaZ8Y=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "fd4474c172081e8b7fd043c395628c4949688423",
+        "rev": "7e16f4f09851ef5e196806bddc0526281f913d3e",
         "type": "github"
       },
       "original": {

From ac564d4d9617de3b103619204821f18abd396204 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 02:10:11 -0400
Subject: [PATCH 671/847] nix fmt

---
 services/minecraft.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 5ef8f94..d6462de 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -109,7 +109,10 @@
               sha512 = "3210926a82eb32efd9bcebabe2f6c053daf5c4337eebc6d5bacba96d283510afbde646e7e195751de795ec70a2ea44fef77cb54bf22c8e57bb832d6217418869";
             };
 
-            Lithium = fetchurl { url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/Ow7wA0kG/lithium-fabric-0.21.4%2Bmc1.21.11.jar"; sha512 = "f14a5c3d2fad786347ca25083f902139694f618b7c103947f2fd067a7c5ee88a63e1ef8926f7d693ea79ed7d00f57317bae77ef9c2d630bf5ed01ac97a752b94"; };
+            Lithium = fetchurl {
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/Ow7wA0kG/lithium-fabric-0.21.4%2Bmc1.21.11.jar";
+              sha512 = "f14a5c3d2fad786347ca25083f902139694f618b7c103947f2fd067a7c5ee88a63e1ef8926f7d693ea79ed7d00f57317bae77ef9c2d630bf5ed01ac97a752b94";
+            };
 
             NoChatReports = fetchurl {
               url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/rhykGstm/NoChatReports-FABRIC-1.21.11-v2.18.0.jar";

From 4ccab1f61c4b439716585822a2422b8e438f4fc0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 02:10:20 -0400
Subject: [PATCH 672/847] hugepages changes

---
 configuration.nix      |  3 +++
 service-configs.nix    | 22 ++++++++++++++++++++++
 services/minecraft.nix |  8 --------
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 674ca57..18f1e25 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -118,6 +118,9 @@
 
   hardware.intelgpu.driver = "xe";
 
+  # Per-service 2MB hugepage budget calculated in service-configs.nix.
+  boot.kernel.sysctl."vm.nr_hugepages" = service_configs.hugepages_2m.total_pages;
+
   boot = {
     # 6.12 LTS until 2026
     kernelPackages = pkgs.linuxPackages_6_12_hardened;
diff --git a/service-configs.nix b/service-configs.nix
index f96d603..e1fb0c1 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -60,6 +60,7 @@ rec {
   postgres = {
     socket = "/run/postgresql";
     dataDir = services_dir + "/sql";
+    shared_buffers_m = 128; # PostgreSQL default; update if you change shared_buffers
   };
 
   immich = {
@@ -150,4 +151,25 @@ rec {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
   };
+
+  # Per-service 2MB hugepage budget.
+  # Each value is the service's hugepage consumption in MB, derived from
+  # its actual memory configuration. The kernel sysctl vm.nr_hugepages
+  # is set to total_pages so every service gets what it needs.
+  hugepages_2m = rec {
+    page_size_m = 2;
+
+    # RandomX dataset (2048MB) + cache (256MB) = 2304MB per instance.
+    # Both monerod and p2pool allocate their own full copy via MAP_HUGETLB.
+    randomx_instance_m = 2048 + 256;
+
+    services = {
+      minecraft_m = minecraft.memory.heap_size_m; # JVM heap via -XX:+UseLargePages
+      monerod_m = randomx_instance_m; # block verification dataset
+      p2pool_m = randomx_instance_m; # mining dataset
+      postgres_m = postgres.shared_buffers_m; # huge_pages = try (default)
+    };
+
+    total_pages = builtins.foldl' (a: b: a + b) 0 (builtins.attrValues services) / page_size_m;
+  };
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index d6462de..e08919f 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -27,14 +27,6 @@
   boot.kernel.sysctl = {
     # Disable autogroup for better scheduling of game server threads
     "kernel.sched_autogroup_enabled" = 0;
-
-    # We want to determine the number of hugepages based on how many minecraft needs.
-    # This can be determined by dividing the heap size by the size of a large page.
-    # Doing this gives us how many large pages are needed.
-    # Then we add 300 to give some headroom.
-    "vm.nr_hugepages" =
-      (service_configs.minecraft.memory.heap_size_m / service_configs.minecraft.memory.large_page_size_m)
-      + 300;
   };
 
   services.minecraft-servers = {

From 4d1ec4b6e1a26020ef83a9b389549c2eab13b455 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 02:38:13 -0400
Subject: [PATCH 673/847] AGENTS.md: init

---
 AGENTS.md | 136 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 136 insertions(+)
 create mode 100644 AGENTS.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..c64cd12
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,136 @@
+# AGENTS.md - server-config (NixOS server "muffin")
+
+## Overview
+
+NixOS flake-based server configuration for host **muffin** (deployed to `root@server-public`).
+Uses deploy-rs for remote deployment, disko for disk management, impermanence (tmpfs root),
+agenix for secrets, lanzaboote for secure boot, and ZFS for data storage.
+
+## Target Hardware
+
+- **CPU**: AMD Ryzen 5 5600X (6C/12T, Zen 3 / `znver3`)
+- **RAM**: 64 GB DDR4, no swap
+- **Motherboard**: ASRock B550M Pro4
+- **Boot drive**: WD_BLACK SN770 1TB NVMe (f2fs: 20G /persistent, 911G /nix; root is tmpfs)
+- **SSD pool `tank`**: 4x 2TB SATA SSDs (raidz2, 7.27T raw, ~2.2T free) -- services, backups, music
+- **HDD pool `hdds`**: 4x 18TB Seagate Exos X18 (raidz1, 65.5T raw, ~17.9T free) -- torrents, monero
+- **USB**: 8GB VFAT drive mounted at /mnt/usb-secrets (agenix identity key)
+- **GPU**: Intel (integrated, xe driver) -- used for Jellyfin hardware transcoding
+- **NIC**: enp4s0 (static 192.168.1.50/24)
+
+## Build / Deploy / Test Commands
+
+```bash
+# Format code (nixfmt-tree)
+nix fmt
+
+# Build the system configuration (check for eval errors)
+nix build .#nixosConfigurations.muffin.config.system.build.toplevel -L
+
+# Deploy to server
+nix run .#deploy -- .#muffin
+
+# Run ALL tests (NixOS VM tests, takes a long time)
+nix build .#packages.x86_64-linux.tests -L
+
+# Run a SINGLE test by name (preferred during development)
+nix build .#test-zfsTest -L
+nix build .#test-testTest -L
+nix build .#test-fail2banSshTest -L
+nix build .#test-ntfyAlertsTest -L
+nix build .#test-filePermsTest -L
+# Pattern: nix build .#test-<testName> -L
+# Test names are defined in tests/tests.nix (keys of the returned attrset)
+
+# Check flake outputs (list what's available)
+nix flake show
+
+# Evaluate without building (fast syntax/eval check)
+nix eval .#nixosConfigurations.muffin.config.system.build.toplevel --no-build 2>&1 | head -5
+```
+
+## Code Style
+
+### Nix Formatting
+- **Formatter**: `nixfmt-tree` (declared in flake.nix). Always run `nix fmt` before committing.
+- **Indentation**: 2 spaces (enforced by nixfmt-tree).
+
+### Module Pattern
+Every `.nix` file is a function taking an attrset with named args and `...`:
+```nix
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  # module body
+}
+```
+- Function args on separate lines, one per line, with trailing comma.
+- Opening brace on its own line for multi-line arg lists.
+- Use `service_configs` (from `service-configs.nix`) for all ports, paths, domains -- never hardcode.
+
+### Service File Convention
+Each service file in `services/` follows this structure:
+1. `imports` block with `lib.serviceMountWithZpool` and optionally `lib.serviceFilePerms`
+2. Service configuration (`services.<name> = { ... }`)
+3. Caddy reverse proxy vhost (`services.caddy.virtualHosts."subdomain.${service_configs.https.domain}"`)
+4. Firewall rules if needed (`networking.firewall.allowed{TCP,UDP}Ports`)
+5. fail2ban jail if the service has authentication (`services.fail2ban.jails.<name>`)
+
+### Custom Lib Functions (modules/lib.nix)
+- `lib.serviceMountWithZpool serviceName zpoolName [dirs]` -- ensures ZFS datasets are mounted before service starts, validates pool membership
+- `lib.serviceFilePerms serviceName [tmpfilesRules]` -- sets file permissions via systemd-tmpfiles before service starts
+- `lib.optimizePackage pkg` -- applies `-O3 -march=znver3 -mtune=znver3` compiler flags
+- `lib.vpnNamespaceOpenPort port serviceName` -- confines service to WireGuard VPN namespace
+
+### Naming Conventions
+- **Files**: lowercase with hyphens (`jellyfin-qbittorrent-monitor.nix`)
+- **Test names**: camelCase with `Test` suffix in `tests/tests.nix` (`fail2banSshTest`, `zfsTest`)
+- **Ports**: all declared in `service-configs.nix` under `ports.*`, referenced as `service_configs.ports.<name>`
+- **ZFS datasets**: `tank/services/<name>` for SSD-backed, `hdds/services/<name>` for HDD-backed
+- **Commit messages**: terse, lowercase; prefix with service/module name when scoped (`caddy: add redirect`, `zfs: remove unneeded options`). Generic changes use `update` or short description.
+
+### Secrets
+- **git-crypt**: `secrets/` directory and `usb-secrets/usb-secrets-key*` are encrypted (see `.gitattributes`)
+- **agenix**: secrets declared in `modules/age-secrets.nix`, decrypted at runtime to `/run/agenix/`
+- **Identity**: USB drive at `/mnt/usb-secrets/usb-secrets-key`
+- Never read or commit plaintext secrets. Never log secret values.
+
+### Important Patterns
+- **Impermanence**: Root `/` is tmpfs. Only `/persistent`, `/nix`, and ZFS mounts survive reboots. Any new persistent state must be declared in `modules/impermanence.nix`.
+- **Port uniqueness**: `flake.nix` has an assertion that all ports in `service_configs.ports` are unique. Always add new ports there.
+- **Hugepages**: Services needing large pages declare their budget in `service-configs.nix` under `hugepages_2m.services`. The kernel sysctl is set automatically from the total.
+- **Domain**: Primary domain is `sigkill.computer`. Old domain `gardling.com` redirects automatically.
+- **Hardened kernel**: Uses `linuxPackages_6_12_hardened`. Security-sensitive defaults apply.
+
+### Test Pattern
+Tests use `pkgs.testers.runNixOSTest` (NixOS VM tests):
+```nix
+{ config, lib, pkgs, ... }:
+pkgs.testers.runNixOSTest {
+  name = "descriptive-test-name";
+  nodes.machine = { pkgs, ... }: {
+    imports = [ /* modules under test */ ];
+    # VM config
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    # Python test script using machine.succeed/machine.fail
+  '';
+}
+```
+- Register new tests in `tests/tests.nix` with `handleTest ./filename.nix`
+- Tests needing the overlay should use `pkgs.appendOverlays [ (import ../modules/overlays.nix) ]`
+- Test scripts are Python; use `machine.succeed(...)`, `machine.fail(...)`, `assert`, `subtest`
+
+## SSH Access
+
+```bash
+ssh root@server-public    # deploy user
+ssh primary@server-public # normal user (doas instead of sudo)
+```

From 6318e90a36f15a9a7c182519825128e91d2ee283 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 02:50:19 -0400
Subject: [PATCH 674/847] qbt: things

---
 services/qbittorrent.nix | 27 +++++++++------------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 4ea5c57..1064651 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -54,11 +54,11 @@
     serverConfig.BitTorrent = {
       Session = {
         MaxConnectionsPerTorrent = 100;
-        MaxUploadsPerTorrent = 15;
+        MaxUploadsPerTorrent = 50;
         MaxConnections = -1;
         MaxUploads = -1;
 
-        MaxActiveCheckingTorrents = 2; # reduce disk pressure from concurrent hash checks
+        MaxActiveCheckingTorrents = 2;
 
         # queueing
         QueueingSystemEnabled = true;
@@ -89,7 +89,7 @@
         inherit (config.services.qbittorrent.serverConfig.Preferences.Downloads) TempPath;
         TempPathEnabled = true;
 
-        ConnectionSpeed = 100;
+        ConnectionSpeed = 200; # half-open connections/s; faster peer discovery
 
         SaveResumeDataInterval = 300; # save resume data every 5 min (default 60s)
         ResumeDataStorageType = "SQLite"; # SQLite is more efficient than legacy per-file .fastresume storage
@@ -100,29 +100,20 @@
         DisableAutoTMMTriggers.DefaultSavePathChanged = false;
 
         ChokingAlgorithm = "RateBased";
+        SeedChokingAlgorithm = "FastestUpload"; # unchoke peers we upload to fastest
         PieceExtentAffinity = true;
         SuggestMode = true;
 
-        # max_queued_disk_bytes: the max bytes waiting in the disk I/O queue.
-        # When this limit is reached, peer connections stop reading from their
-        # sockets until the disk thread catches up -- causing the spike-then-zero
-        # pattern. Default is 1MB; high_performance_seed() uses 7MB.
-        # 64MB is above the preset but justified for slow raidz1 HDD random writes
-        # where ZFS txg commits cause periodic I/O stalls.
-        DiskQueueSize = 67108864; # 64MB
-
         # POSIX-compliant disk I/O: uses pread/pwrite instead of mmap.
         # On ZFS, mmap forces data into BOTH ARC and Linux page cache (double-caching),
         # wasting RAM. pread/pwrite goes only through ARC, maximizing its effectiveness.
-        # Saved 26 gb of memory!!
         DiskIOType = "Posix";
 
-        # === Network buffer tuning (from libtorrent high_performance_seed preset) ===
-        # "always stuff at least 1 MiB down each peer pipe, to quickly ramp up send rates"
-        SendBufferLowWatermark = 1024; # 1MB (KiB) -- matches high_performance_seed
-        # "of 500 ms, and a send rate of 4 MB/s, the upper limit should be 2 MB"
-        SendBufferWatermark = 3072; # 3MB (KiB) -- matches high_performance_seed
-        # "put 1.5 seconds worth of data in the send buffer"
+        FilePoolSize = 500; # keep more files open to reduce open/close overhead
+        AioThreads = 24; # 6 cores * 4; better disk I/O parallelism
+
+        SendBufferLowWatermark = 512; # 512 KiB -- trigger reads sooner to prevent upload stalls
+        SendBufferWatermark = 3072; # 3 MiB -- matches high_performance_seed
         SendBufferWatermarkFactor = 150; # percent -- matches high_performance_seed
       };
 

From bd192e4803a3a1d8b89dcb292685e9d9ed8388c9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 13:23:49 -0400
Subject: [PATCH 675/847] fix arr services

---
 services/arr/init.nix     | 3 +++
 services/arr/prowlarr.nix | 7 +++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/services/arr/init.nix b/services/arr/init.nix
index e7c5a84..37ef2a2 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -8,6 +8,7 @@
       dataDir = service_configs.prowlarr.dataDir;
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
+      healthChecks = true;
       syncedApps = [
         {
           name = "Sonarr";
@@ -57,6 +58,7 @@
       serviceName = "sonarr";
       port = service_configs.ports.sonarr;
       dataDir = service_configs.sonarr.dataDir;
+      healthChecks = true;
       rootFolders = [ service_configs.media.tvDir ];
       downloadClients = [
         {
@@ -78,6 +80,7 @@
       serviceName = "radarr";
       port = service_configs.ports.radarr;
       dataDir = service_configs.radarr.dataDir;
+      healthChecks = true;
       rootFolders = [ service_configs.media.moviesDir ];
       downloadClients = [
         {
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index a2ad767..2403504 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -11,6 +11,9 @@
       service_configs.prowlarr.dataDir
     ])
     (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
+    (lib.serviceFilePerms "prowlarr" [
+      "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
+    ])
   ];
 
   services.prowlarr = {
@@ -19,10 +22,6 @@
     settings.server.port = service_configs.ports.prowlarr;
   };
 
-  systemd.services.prowlarr.serviceConfig = {
-    ExecStartPre = "+${pkgs.coreutils}/bin/chown -R prowlarr /var/lib/prowlarr";
-  };
-
   services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}

From 0dc307874d7130831a04cf0e8c989b091cc29011 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 13:25:54 -0400
Subject: [PATCH 676/847] update

---
 flake.lock | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index fef3d59..101cbac 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772566016,
-        "narHash": "sha256-+LExMzFXahgoFYayrmqK4MhT9QkUplVwurcTDjk8kGI=",
+        "lastModified": 1773595529,
+        "narHash": "sha256-fueNL7zKHnWNkOCNTjDowUfsUS4ERXrrL+HAWDKrhsQ=",
         "ref": "refs/heads/main",
-        "rev": "4cc1ae4e00844d2bd80da3869f17649c1cef3f8a",
-        "revCount": 3,
+        "rev": "7c0a6176407a228a8363723f14f4d41c7cf1ea29",
+        "revCount": 4,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1772972630,
-        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
+        "lastModified": 1773533765,
+        "narHash": "sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
+        "rev": "f8e82243fd601afb9f59ad230958bd073795cbfe",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773375660,
-        "narHash": "sha256-SEzUWw2Rf5Ki3bcM26nSKgbeoqi2uYy8IHVBqOKjX3w=",
+        "lastModified": 1773524153,
+        "narHash": "sha256-Jms57zzlFf64ayKzzBWSE2SGvJmK+NGt8Gli71d9kmY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e20095fe3c6cbb1ddcef89b26969a69a1570776",
+        "rev": "e9f278faa1d0c2fc835bd331d4666b59b505a410",
         "type": "github"
       },
       "original": {

From a6d13bc9dc2fa3defdf1472a70bd8b50196fb483 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 13:45:24 -0400
Subject: [PATCH 677/847] arr-init: wait on qbt

---
 flake.lock            | 8 ++++----
 services/arr/init.nix | 2 ++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 101cbac..62b5314 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773595529,
-        "narHash": "sha256-fueNL7zKHnWNkOCNTjDowUfsUS4ERXrrL+HAWDKrhsQ=",
+        "lastModified": 1773596707,
+        "narHash": "sha256-EiAfZo8iTgCgMbJihNnwZGISCVb3Ue/5uU1XtF9CfkA=",
         "ref": "refs/heads/main",
-        "rev": "7c0a6176407a228a8363723f14f4d41c7cf1ea29",
-        "revCount": 4,
+        "rev": "ef0da7582c830910620114ce02b4041f32993a53",
+        "revCount": 5,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
diff --git a/services/arr/init.nix b/services/arr/init.nix
index 37ef2a2..d929c7f 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -65,6 +65,7 @@
           name = "qBittorrent";
           implementation = "QBittorrent";
           configContract = "QBittorrentSettings";
+          serviceName = "qbittorrent";
           fields = {
             host = config.vpnNamespaces.wg.namespaceAddress;
             port = service_configs.ports.torrent;
@@ -87,6 +88,7 @@
           name = "qBittorrent";
           implementation = "QBittorrent";
           configContract = "QBittorrentSettings";
+          serviceName = "qbittorrent";
           fields = {
             host = config.vpnNamespaces.wg.namespaceAddress;
             port = service_configs.ports.torrent;

From 812a9705e6c4379a092a6f676bd099ca3737d55b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 13:49:43 -0400
Subject: [PATCH 678/847] AGENTS.md: add Learning section

---
 AGENTS.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index c64cd12..9bfd8c9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -134,3 +134,10 @@ pkgs.testers.runNixOSTest {
 ssh root@server-public    # deploy user
 ssh primary@server-public # normal user (doas instead of sudo)
 ```
+
+## Learnings
+
+Discoveries, gotchas, and patterns found during sessions. Add new entries at the bottom.
+
+<!-- Format: ### YYYY-MM-DD: Short title \n Description of the learning. -->
+

From 576d35ac0b4d9b078caa7ffd446b58f51d0e1e99 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 13:53:14 -0400
Subject: [PATCH 679/847] recylcarr: add min format score

---
 services/arr/recyclarr.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 6727e52..da7414f 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -54,6 +54,7 @@ in
         quality_profiles = [
           {
             name = "Remux + WEB 2160p";
+            min_format_score = 0;
             upgrade = {
               allowed = true;
               until_quality = "Remux-2160p";
@@ -127,6 +128,7 @@ in
         quality_profiles = [
           {
             name = "WEB-2160p";
+            min_format_score = 0;
             upgrade = {
               allowed = true;
               until_quality = "WEB 2160p";

From ea735d380b7f253d12da2217fa4361e36dc23ab4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 15 Mar 2026 20:09:46 -0400
Subject: [PATCH 680/847] arr: search for missing and cutoff-unmet media

---
 configuration.nix           |   1 +
 services/arr/arr-search.nix | 115 ++++++++++++++++++++++++++++++++++++
 services/arr/recyclarr.nix  |   2 +
 3 files changed, 118 insertions(+)
 create mode 100644 services/arr/arr-search.nix

diff --git a/configuration.nix b/configuration.nix
index 18f1e25..2c19e8b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -39,6 +39,7 @@
     ./services/arr/bazarr.nix
     ./services/arr/jellyseerr.nix
     ./services/arr/recyclarr.nix
+    ./services/arr/arr-search.nix
     ./services/arr/init.nix
 
     ./services/soulseek.nix
diff --git a/services/arr/arr-search.nix b/services/arr/arr-search.nix
new file mode 100644
index 0000000..e2ee7ca
--- /dev/null
+++ b/services/arr/arr-search.nix
@@ -0,0 +1,115 @@
+{
+  pkgs,
+  service_configs,
+  ...
+}:
+let
+  radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
+  sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
+
+  radarrUrl = "http://localhost:${builtins.toString service_configs.ports.radarr}";
+  sonarrUrl = "http://localhost:${builtins.toString service_configs.ports.sonarr}";
+
+  curl = "${pkgs.curl}/bin/curl";
+  jq = "${pkgs.jq}/bin/jq";
+  grep = "${pkgs.gnugrep}/bin/grep";
+
+  # Max items to search per cycle per category (missing + cutoff) per app
+  maxPerCycle = 5;
+
+  searchScript = pkgs.writeShellScript "arr-search" ''
+    set -euo pipefail
+
+    RADARR_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
+    SONARR_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+
+    search_radarr() {
+      local endpoint="$1"
+      local label="$2"
+
+      local ids
+      ids=$(${curl} -sf --max-time 30 \
+        -H "X-Api-Key: $RADARR_KEY" \
+        "${radarrUrl}/api/v3/wanted/$endpoint?page=1&pageSize=${builtins.toString maxPerCycle}&monitored=true&sortKey=title&sortDirection=ascending" \
+        | ${jq} -r '.records[].id // empty')
+
+      if [ -z "$ids" ]; then
+        echo "radarr: no $label items"
+        return
+      fi
+
+      local id_array
+      id_array=$(echo "$ids" | ${jq} -Rs '[split("\n") | .[] | select(. != "") | tonumber]')
+      echo "radarr: searching $label: $id_array"
+
+      ${curl} -sf --max-time 60 \
+        -H "X-Api-Key: $RADARR_KEY" \
+        -H "Content-Type: application/json" \
+        -X POST "${radarrUrl}/api/v3/command" \
+        -d "{\"name\": \"MoviesSearch\", \"movieIds\": $id_array}" > /dev/null
+    }
+
+    search_sonarr() {
+      local endpoint="$1"
+      local label="$2"
+
+      local series_ids
+      series_ids=$(${curl} -sf --max-time 30 \
+        -H "X-Api-Key: $SONARR_KEY" \
+        "${sonarrUrl}/api/v3/wanted/$endpoint?page=1&pageSize=${builtins.toString maxPerCycle}&monitored=true&sortKey=title&sortDirection=ascending&includeSeries=true" \
+        | ${jq} -r '[.records[].seriesId] | unique | .[] // empty')
+
+      if [ -z "$series_ids" ]; then
+        echo "sonarr: no $label items"
+        return
+      fi
+
+      # search per series (sonarr searches by series, not episode)
+      for sid in $series_ids; do
+        echo "sonarr: searching $label series $sid"
+        ${curl} -sf --max-time 60 \
+          -H "X-Api-Key: $SONARR_KEY" \
+          -H "Content-Type: application/json" \
+          -X POST "${sonarrUrl}/api/v3/command" \
+          -d "{\"name\": \"SeriesSearch\", \"seriesId\": $sid}" > /dev/null
+      done
+    }
+
+    echo "=== arr-search $(date -Iseconds) ==="
+
+    search_radarr "missing" "missing"
+    search_radarr "cutoff" "cutoff-unmet"
+
+    search_sonarr "missing" "missing"
+    search_sonarr "cutoff" "cutoff-unmet"
+
+    echo "=== done ==="
+  '';
+in
+{
+  systemd.services.arr-search = {
+    description = "Search for missing and cutoff-unmet media in Radarr/Sonarr";
+    after = [
+      "network-online.target"
+      "radarr.service"
+      "sonarr.service"
+    ];
+    wants = [ "network-online.target" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "+${searchScript}"; # + prefix: runs as root to read API keys from config.xml
+      TimeoutSec = 300;
+    };
+  };
+
+  systemd.timers.arr-search = {
+    description = "Periodically search for missing and cutoff-unmet media";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*-*-* 03:00:00"; # daily at 3 AM
+      Persistent = true; # run on boot if missed
+      RandomizedDelaySec = "30m";
+    };
+  };
+}
diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index da7414f..1dd9876 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -58,6 +58,7 @@ in
             upgrade = {
               allowed = true;
               until_quality = "Remux-2160p";
+              until_score = 0;
             };
             qualities = [
               { name = "Remux-2160p"; }
@@ -132,6 +133,7 @@ in
             upgrade = {
               allowed = true;
               until_quality = "WEB 2160p";
+              until_score = 0;
             };
             qualities = [
               {

From d009daf2916ed0248292b1bb96749d797909371c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 16 Mar 2026 12:42:07 -0400
Subject: [PATCH 681/847] qbt: disable DL speed limit

---
 services/qbittorrent.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 1064651..e8c00a7 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -68,7 +68,7 @@
         IgnoreSlowTorrentsForQueueing = true;
 
         GlobalUPSpeedLimit = 0;
-        GlobalDLSpeedLimit = 10000;
+        GlobalDLSpeedLimit = 0;
 
         # Alternate speed limits for when Jellyfin is streaming
         AlternativeGlobalUPSpeedLimit = 500; # 500 KB/s when throttled

From c9835227655290f7bb4cb7187d9df15fbc5205bd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 16 Mar 2026 12:42:32 -0400
Subject: [PATCH 682/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 62b5314..2111ae8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773264488,
-        "narHash": "sha256-rK0507bDuWBrZo+0zts9bCs/+RRUEHuvFE5DHWPxX/Q=",
+        "lastModified": 1773666808,
+        "narHash": "sha256-1o8CNQhMqsfimOXQEaLhHGQEleZDivK/jEjgZHjYSSU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5c0f63f8d55040a7eed69df7e3fcdd15dfb5a04c",
+        "rev": "4326ce5373187a611004c1d88ba5d7da7e0ed0c4",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773524153,
-        "narHash": "sha256-Jms57zzlFf64ayKzzBWSE2SGvJmK+NGt8Gli71d9kmY=",
+        "lastModified": 1773610124,
+        "narHash": "sha256-EpC7ELOKmb+xXaqpK5ZRpJ5g9fxxg6tWny7/rUBfrwk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9f278faa1d0c2fc835bd331d4666b59b505a410",
+        "rev": "9fe1300f4360e13f39d6d1d006e54fd5093e9ad5",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773369348,
-        "narHash": "sha256-6UwMEAi6X3oMjKQm51i0+3i10DrsrSdXi/4YgmJxfhE=",
+        "lastModified": 1773627349,
+        "narHash": "sha256-p/3pOD2IrmJwTffWioL6JnFAdaS+9hctmQ+mEt29KrE=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "f3f0277b1dee1bfd058c5b8b98cb25558d95f03f",
+        "rev": "2ddaafd0f85df0d1acf0f1d79cc2b5a53381965c",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773529772,
-        "narHash": "sha256-I+K0BCc7fNQp6N7mTE/3SIHfencR4l0+sRsom4xaZ8Y=",
+        "lastModified": 1773616170,
+        "narHash": "sha256-3hWKevWv2Ns+emJqMTetOsgHG81I0Xd0GI9tdUN3+I0=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "7e16f4f09851ef5e196806bddc0526281f913d3e",
+        "rev": "a4b8c85ead1f867bc66bdd88a9e33061199b6f49",
         "type": "github"
       },
       "original": {

From 29336f1f77d661a6b03532922a54a120db7623c0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Mar 2026 02:03:32 -0400
Subject: [PATCH 683/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2111ae8..b9e72f5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773666808,
-        "narHash": "sha256-1o8CNQhMqsfimOXQEaLhHGQEleZDivK/jEjgZHjYSSU=",
+        "lastModified": 1773681845,
+        "narHash": "sha256-o8hrZrigP0JYcwnglCp8Zi8jQafWsxbDtRRPzuVwFxY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4326ce5373187a611004c1d88ba5d7da7e0ed0c4",
+        "rev": "0759e0e137305bc9d0c52c204c6d8dffe6f601a6",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1773456096,
-        "narHash": "sha256-vlV3HnHBxnfW4a2ifabH3L/3iGGjA5ejEP7XD7EOC+E=",
+        "lastModified": 1773715509,
+        "narHash": "sha256-b5BsanYeM4EzV1vhVvVWpE5nqBZ1ZjYxn4N56ncoGJ0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "ce7440a5fced512773e8e695d8a7bd57f33c7e6d",
+        "rev": "27420d2c7217d3b0f07d8f1478b668ba826b2c87",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773610124,
-        "narHash": "sha256-EpC7ELOKmb+xXaqpK5ZRpJ5g9fxxg6tWny7/rUBfrwk=",
+        "lastModified": 1773705440,
+        "narHash": "sha256-xB30bbAp0e7ogSEYyc126mAJMt4FRFh8wtm6ADE1xuM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9fe1300f4360e13f39d6d1d006e54fd5093e9ad5",
+        "rev": "48652e9d5aea46e555b3df87354280d4f29cd3a3",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773627349,
-        "narHash": "sha256-p/3pOD2IrmJwTffWioL6JnFAdaS+9hctmQ+mEt29KrE=",
+        "lastModified": 1773702072,
+        "narHash": "sha256-oBBOi77u+uUX47xdYmerpk0cRXVlYOPR1+LsTidFvzg=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "2ddaafd0f85df0d1acf0f1d79cc2b5a53381965c",
+        "rev": "6810cbd27b8e9eac561997ee98cf30844c4ed282",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773616170,
-        "narHash": "sha256-3hWKevWv2Ns+emJqMTetOsgHG81I0Xd0GI9tdUN3+I0=",
+        "lastModified": 1773702577,
+        "narHash": "sha256-UVXLe8dXmucRyRfcqtgKVh2lCjiJeALezo4y8xveotI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "a4b8c85ead1f867bc66bdd88a9e33061199b6f49",
+        "rev": "0c36cb83b74930c6abe162600d8071843c147680",
         "type": "github"
       },
       "original": {

From 60a20c33b4280a9846a9396905f74302c386731a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Mar 2026 14:04:50 -0400
Subject: [PATCH 684/847] prowlarr: remove serviceFilePerms

---
 services/arr/prowlarr.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index 2403504..c5e9c69 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -11,9 +11,6 @@
       service_configs.prowlarr.dataDir
     ])
     (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
-    (lib.serviceFilePerms "prowlarr" [
-      "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
-    ])
   ];
 
   services.prowlarr = {

From 96e02457ff4a63a9104d6ae21b7d088d6fe72d1a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 17 Mar 2026 14:56:18 -0400
Subject: [PATCH 685/847] AGENTS.md: update

---
 AGENTS.md | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 9bfd8c9..31661b3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -102,10 +102,10 @@ Each service file in `services/` follows this structure:
 
 ### Important Patterns
 - **Impermanence**: Root `/` is tmpfs. Only `/persistent`, `/nix`, and ZFS mounts survive reboots. Any new persistent state must be declared in `modules/impermanence.nix`.
-- **Port uniqueness**: `flake.nix` has an assertion that all ports in `service_configs.ports` are unique. Always add new ports there.
+- **Port uniqueness**: `flake.nix` has an assertion that all ports in `service_configs.ports` are unique. Always add new ports there. Make sure to put them in the specific "Public" and "Private" sections that are seperated by comments.
 - **Hugepages**: Services needing large pages declare their budget in `service-configs.nix` under `hugepages_2m.services`. The kernel sysctl is set automatically from the total.
 - **Domain**: Primary domain is `sigkill.computer`. Old domain `gardling.com` redirects automatically.
-- **Hardened kernel**: Uses `linuxPackages_6_12_hardened`. Security-sensitive defaults apply.
+- **Hardened kernel**: Uses `_hardened` kernel. Security-sensitive defaults apply.
 
 ### Test Pattern
 Tests use `pkgs.testers.runNixOSTest` (NixOS VM tests):
@@ -135,9 +135,3 @@ ssh root@server-public    # deploy user
 ssh primary@server-public # normal user (doas instead of sudo)
 ```
 
-## Learnings
-
-Discoveries, gotchas, and patterns found during sessions. Add new entries at the bottom.
-
-<!-- Format: ### YYYY-MM-DD: Short title \n Description of the learning. -->
-

From 00c1d3078aa85339e2ca8ce41d67556b4bb44396 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Mar 2026 15:01:29 -0400
Subject: [PATCH 686/847] recylcarr: fix

---
 services/arr/recyclarr.nix | 39 +++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 1dd9876..4d2d61a 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -8,18 +8,20 @@
 let
   radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
   sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
-  appDataDir = "${service_configs.recyclarr.dataDir}/data";
+  configPath = "/var/lib/recyclarr/config.json";
 
-  # Runs as root (via + prefix) to read API keys, writes secrets.yml for recyclarr
-  generateSecrets = pkgs.writeShellScript "recyclarr-generate-secrets" ''
-    RADARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
-    SONARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
-    cat > ${appDataDir}/secrets.yml <<EOF
-    movies_api_key: $RADARR_KEY
-    series_api_key: $SONARR_KEY
-    EOF
-    chown recyclarr:recyclarr ${appDataDir}/secrets.yml
-    chmod 600 ${appDataDir}/secrets.yml
+  # Runs as root (via + prefix) after the NixOS module writes config.json.
+  # Extracts API keys from radarr/sonarr config.xml and injects them via jq.
+  injectApiKeys = pkgs.writeShellScript "recyclarr-inject-api-keys" ''
+    RADARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
+    SONARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    ${pkgs.jq}/bin/jq \
+      --arg rk "$RADARR_KEY" \
+      --arg sk "$SONARR_KEY" \
+      '.radarr.movies.api_key = $rk | .sonarr.series.api_key = $sk' \
+      ${configPath} > ${configPath}.tmp
+    mv ${configPath}.tmp ${configPath}
+    chown recyclarr:recyclarr ${configPath}
   '';
 in
 {
@@ -31,7 +33,6 @@ in
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.recyclarr.dataDir} 0755 recyclarr recyclarr -"
-    "d ${appDataDir} 0755 recyclarr recyclarr -"
   ];
 
   services.recyclarr = {
@@ -55,11 +56,15 @@ in
           {
             name = "Remux + WEB 2160p";
             min_format_score = 0;
+            reset_unmatched_scores = {
+              enabled = true;
+            };
             upgrade = {
               allowed = true;
               until_quality = "Remux-2160p";
-              until_score = 0;
+              until_score = 10000;
             };
+            quality_sort = "top";
             qualities = [
               { name = "Remux-2160p"; }
               {
@@ -130,11 +135,15 @@ in
           {
             name = "WEB-2160p";
             min_format_score = 0;
+            reset_unmatched_scores = {
+              enabled = true;
+            };
             upgrade = {
               allowed = true;
               until_quality = "WEB 2160p";
-              until_score = 0;
+              until_score = 10000;
             };
+            quality_sort = "top";
             qualities = [
               {
                 name = "WEB 2160p";
@@ -201,6 +210,6 @@ in
       "sonarr.service"
     ];
     wants = [ "network-online.target" ];
-    serviceConfig.ExecStartPre = "+${generateSecrets}";
+    serviceConfig.ExecStartPre = [ "+${injectApiKeys}" ];
   };
 }

From e56456d7b21ce67242b152219d217dc12eefdd69 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 18 Mar 2026 15:02:52 -0400
Subject: [PATCH 687/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index b9e72f5..f568387 100644
--- a/flake.lock
+++ b/flake.lock
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1773715509,
-        "narHash": "sha256-b5BsanYeM4EzV1vhVvVWpE5nqBZ1ZjYxn4N56ncoGJ0=",
+        "lastModified": 1773802295,
+        "narHash": "sha256-luPLLgS8VR2fHo3xT04KbJm0RU2wep6SDh3smwF8e5E=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "27420d2c7217d3b0f07d8f1478b668ba826b2c87",
+        "rev": "41870283e080c46a6d33b6c3b3923e90348254c3",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773705440,
-        "narHash": "sha256-xB30bbAp0e7ogSEYyc126mAJMt4FRFh8wtm6ADE1xuM=",
+        "lastModified": 1773814637,
+        "narHash": "sha256-GNU+ooRmrHLfjlMsKdn0prEKVa0faVanm0jrgu1J/gY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "48652e9d5aea46e555b3df87354280d4f29cd3a3",
+        "rev": "fea3b367d61c1a6592bc47c72f40a9f3e6a53e96",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773702577,
-        "narHash": "sha256-UVXLe8dXmucRyRfcqtgKVh2lCjiJeALezo4y8xveotI=",
+        "lastModified": 1773788980,
+        "narHash": "sha256-CuD+g/MNgcAlbZ2OXZUzZfPHwXzzKM8qovdkIVhHy+A=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "0c36cb83b74930c6abe162600d8071843c147680",
+        "rev": "03ae4d7ea81606a88aee4bef8683d61c288763f9",
         "type": "github"
       },
       "original": {

From 3b23aea3741e9e3d701d39789819f56e0f4f29ab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 20 Mar 2026 14:04:15 -0400
Subject: [PATCH 688/847] monero+p2pool: move to ssds

I tried running these on my hdd array because I have more storage there
but it is WAY too slow. So I need to have it on the ssds instead, as much
as it pains me to use my valuable ssd space.
---
 modules/zfs.nix     | 20 ++++++++++++++++++++
 services/monero.nix |  2 +-
 services/p2pool.nix |  2 +-
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index 5d7478a..07d72f7 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -50,6 +50,26 @@
       yearly = 0;
     };
 
+    datasets."${service_configs.zpool_ssds}/services/monero" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 0;
+      daily = 0;
+      monthly = 0;
+      yearly = 0;
+    };
+
+    datasets."${service_configs.zpool_ssds}/services/p2pool" = {
+      recursive = true;
+      autoprune = true;
+      autosnap = true;
+      hourly = 0;
+      daily = 0;
+      monthly = 0;
+      yearly = 0;
+    };
+
     datasets."${service_configs.zpool_hdds}" = {
       recursive = true;
       autoprune = true;
diff --git a/services/monero.nix b/services/monero.nix
index e7820ea..6556ce5 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -5,7 +5,7 @@
 }:
 {
   imports = [
-    (lib.serviceMountWithZpool "monero" service_configs.zpool_hdds [
+    (lib.serviceMountWithZpool "monero" service_configs.zpool_ssds [
       service_configs.monero.dataDir
     ])
     (lib.serviceFilePerms "monero" [
diff --git a/services/p2pool.nix b/services/p2pool.nix
index e2d22ef..3cc07b8 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -9,7 +9,7 @@ let
 in
 {
   imports = [
-    (lib.serviceMountWithZpool "p2pool" service_configs.zpool_hdds [
+    (lib.serviceMountWithZpool "p2pool" service_configs.zpool_ssds [
       service_configs.p2pool.dataDir
     ])
     (lib.serviceFilePerms "p2pool" [

From fd3df23a76014acc345a126b27af80da63bf0948 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 08:44:57 -0400
Subject: [PATCH 689/847] firefox-syncserver: init

---
 AGENTS.md                                     |   1 +
 configuration.nix                             |   1 +
 flake.nix                                     |  25 +-
 modules/age-secrets.nix                       |   6 +
 ...erver-add-postgresql-backend-support.patch | 379 ++++++++++++++++++
 secrets/firefox-syncserver-env.age            | Bin 0 -> 306 bytes
 service-configs.nix                           |   5 +
 services/firefox-syncserver.nix               |  39 ++
 8 files changed, 455 insertions(+), 1 deletion(-)
 create mode 100644 patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
 create mode 100644 secrets/firefox-syncserver-env.age
 create mode 100644 services/firefox-syncserver.nix

diff --git a/AGENTS.md b/AGENTS.md
index 31661b3..9dbb460 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -98,6 +98,7 @@ Each service file in `services/` follows this structure:
 - **git-crypt**: `secrets/` directory and `usb-secrets/usb-secrets-key*` are encrypted (see `.gitattributes`)
 - **agenix**: secrets declared in `modules/age-secrets.nix`, decrypted at runtime to `/run/agenix/`
 - **Identity**: USB drive at `/mnt/usb-secrets/usb-secrets-key`
+- **Encrypting new secrets**: The agenix encryption key is in `usb-secrets/usb-secrets-key` (SSH private key, git-crypt encrypted). To create a new secret: derive the age public key with `ssh-keygen -y -f usb-secrets/usb-secrets-key | ssh-to-age`, then encrypt with `age -r <public-key> -o secrets/<name>.age`.
 - Never read or commit plaintext secrets. Never log secret values.
 
 ### Important Patterns
diff --git a/configuration.nix b/configuration.nix
index 2c19e8b..066cf4f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -47,6 +47,7 @@
     ./services/ups.nix
 
     ./services/bitwarden.nix
+    ./services/firefox-syncserver.nix
 
     ./services/matrix.nix
     ./services/coturn.nix
diff --git a/flake.nix b/flake.nix
index 5fb257a..e62b269 100644
--- a/flake.nix
+++ b/flake.nix
@@ -105,7 +105,19 @@
 
       service_configs = import ./service-configs.nix;
 
-      pkgs = import nixpkgs {
+      # Bootstrap pkgs used only to apply patches to nixpkgs source.
+      bootstrapPkgs = import nixpkgs { inherit system; };
+
+      # Patch nixpkgs to add PostgreSQL backend support for firefox-syncserver.
+      patchedNixpkgsSrc = bootstrapPkgs.applyPatches {
+        name = "nixpkgs-patched";
+        src = nixpkgs;
+        patches = [
+          ./patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
+        ];
+      };
+
+      pkgs = import patchedNixpkgsSrc {
         inherit system;
         targetPlatform = system;
         buildPlatform = builtins.currentSystem;
@@ -157,10 +169,21 @@
           ./disk-config.nix
           ./configuration.nix
 
+          # Replace upstream firefox-syncserver module + package with patched
+          # versions that add PostgreSQL backend support.
           {
+            disabledModules = [ "services/networking/firefox-syncserver.nix" ];
+            imports = [
+              "${patchedNixpkgsSrc}/nixos/modules/services/networking/firefox-syncserver.nix"
+            ];
             nixpkgs.overlays = [
               nix-minecraft.overlay
               (import ./modules/overlays.nix)
+              (_final: prev: {
+                syncstorage-rs =
+                  prev.callPackage "${patchedNixpkgsSrc}/pkgs/by-name/sy/syncstorage-rs/package.nix"
+                    { };
+              })
             ];
             nixpkgs.config.allowUnfreePredicate =
               pkg:
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index c4af393..ab42655 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -82,5 +82,11 @@
       owner = "root";
       group = "root";
     };
+
+    # Firefox Sync server secrets (SYNC_MASTER_SECRET)
+    firefox-syncserver-env = {
+      file = ../secrets/firefox-syncserver-env.age;
+      mode = "0400";
+    };
   };
 }
diff --git a/patches/0001-firefox-syncserver-add-postgresql-backend-support.patch b/patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
new file mode 100644
index 0000000..67c59db
--- /dev/null
+++ b/patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
@@ -0,0 +1,379 @@
+From ab57092a60123e361cf0de1c1a314a9888c45219 Mon Sep 17 00:00:00 2001
+From: Simon Gardling <titaniumtown@proton.me>
+Date: Sat, 21 Mar 2026 09:24:39 -0400
+Subject: [PATCH] temp
+
+---
+ .../services/networking/firefox-syncserver.md |  23 +++
+ .../networking/firefox-syncserver.nix         | 140 ++++++++++++++----
+ pkgs/by-name/sy/syncstorage-rs/package.nix    |  49 ++++--
+ 3 files changed, 174 insertions(+), 38 deletions(-)
+
+diff --git a/nixos/modules/services/networking/firefox-syncserver.md b/nixos/modules/services/networking/firefox-syncserver.md
+index 991e97f799d6..3bc45cfa5640 100644
+--- a/nixos/modules/services/networking/firefox-syncserver.md
++++ b/nixos/modules/services/networking/firefox-syncserver.md
+@@ -32,6 +32,29 @@ This configuration should never be used in production. It is not encrypted and
+ stores its secrets in a world-readable location.
+ :::
+ 
++## Database backends {#module-services-firefox-syncserver-database}
++
++The sync server supports MySQL/MariaDB (the default) and PostgreSQL as database
++backends. Set `database.type` to choose the backend:
++
++```nix
++{
++  services.firefox-syncserver = {
++    enable = true;
++    database.type = "postgresql";
++    secrets = "/run/secrets/firefox-syncserver";
++    singleNode = {
++      enable = true;
++      hostname = "localhost";
++      url = "http://localhost:5000";
++    };
++  };
++}
++```
++
++When `database.createLocally` is `true` (the default), the module will
++automatically enable and configure the corresponding database service.
++
+ ## More detailed setup {#module-services-firefox-syncserver-configuration}
+ 
+ The `firefox-syncserver` service provides a number of options to make setting up
+diff --git a/nixos/modules/services/networking/firefox-syncserver.nix b/nixos/modules/services/networking/firefox-syncserver.nix
+index 6a50e49fc096..70a56314e323 100644
+--- a/nixos/modules/services/networking/firefox-syncserver.nix
++++ b/nixos/modules/services/networking/firefox-syncserver.nix
+@@ -13,7 +13,21 @@ let
+   defaultUser = "firefox-syncserver";
+ 
+   dbIsLocal = cfg.database.host == "localhost";
+-  dbURL = "mysql://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}${lib.optionalString dbIsLocal "?socket=/run/mysqld/mysqld.sock"}";
++  dbIsMySQL = cfg.database.type == "mysql";
++  dbIsPostgreSQL = cfg.database.type == "postgresql";
++
++  dbURL =
++    if dbIsMySQL then
++      "mysql://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}${lib.optionalString dbIsLocal "?socket=/run/mysqld/mysqld.sock"}"
++    else
++      "postgres://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}${lib.optionalString dbIsLocal "?host=/run/postgresql"}";
++
++  # postgresql.target waits for postgresql-setup.service (which runs
++  # ensureDatabases / ensureUsers) to complete, avoiding race conditions
++  # where the syncserver starts before its database and role exist.
++  dbService = if dbIsMySQL then "mysql.service" else "postgresql.target";
++
++  syncserver = cfg.package.override { dbBackend = cfg.database.type; };
+ 
+   format = pkgs.formats.toml { };
+   settings = {
+@@ -22,7 +36,7 @@ let
+       database_url = dbURL;
+     };
+     tokenserver = {
+-      node_type = "mysql";
++      node_type = if dbIsMySQL then "mysql" else "postgres";
+       database_url = dbURL;
+       fxa_email_domain = "api.accounts.firefox.com";
+       fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
+@@ -41,7 +55,8 @@ let
+     };
+   };
+   configFile = format.generate "syncstorage.toml" (lib.recursiveUpdate settings cfg.settings);
+-  setupScript = pkgs.writeShellScript "firefox-syncserver-setup" ''
++
++  mysqlSetupScript = pkgs.writeShellScript "firefox-syncserver-setup" ''
+     set -euo pipefail
+     shopt -s inherit_errexit
+ 
+@@ -79,6 +94,47 @@ let
+     echo "Single-node setup failed"
+     exit 1
+   '';
++
++  postgresqlSetupScript = pkgs.writeShellScript "firefox-syncserver-setup" ''
++    set -euo pipefail
++    shopt -s inherit_errexit
++
++    schema_configured() {
++      psql -d ${cfg.database.name} -tAc "SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'services')" | grep -q t
++    }
++
++    update_config() {
++      psql -d ${cfg.database.name} <<'EOF'
++        BEGIN;
++
++        INSERT INTO services (id, service, pattern)
++          VALUES (1, 'sync-1.5', '{node}/1.5/{uid}')
++          ON CONFLICT (id) DO UPDATE SET service = 'sync-1.5', pattern = '{node}/1.5/{uid}';
++        INSERT INTO nodes (id, service, node, available, current_load,
++                           capacity, downed, backoff)
++          VALUES (1, 1, '${cfg.singleNode.url}', ${toString cfg.singleNode.capacity},
++          0, ${toString cfg.singleNode.capacity}, 0, 0)
++          ON CONFLICT (id) DO UPDATE SET node = '${cfg.singleNode.url}', capacity = ${toString cfg.singleNode.capacity};
++
++        COMMIT;
++    EOF
++    }
++
++
++    for (( try = 0; try < 60; try++ )); do
++      if ! schema_configured; then
++        sleep 2
++      else
++        update_config
++        exit 0
++      fi
++    done
++
++    echo "Single-node setup failed"
++    exit 1
++  '';
++
++  setupScript = if dbIsMySQL then mysqlSetupScript else postgresqlSetupScript;
+ in
+ 
+ {
+@@ -88,25 +144,26 @@ in
+         the Firefox Sync storage service.
+ 
+         Out of the box this will not be very useful unless you also configure at least
+-        one service and one nodes by inserting them into the mysql database manually, e.g.
+-        by running
+-
+-        ```
+-          INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
+-          INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
+-              `capacity`, `downed`, `backoff`)
+-            VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0');
+-        ```
++        one service and one nodes by inserting them into the database manually, e.g.
++        by running the equivalent SQL for your database backend.
+ 
+         {option}`${opt.singleNode.enable}` does this automatically when enabled
+       '';
+ 
+       package = lib.mkPackageOption pkgs "syncstorage-rs" { };
+ 
++      database.type = lib.mkOption {
++        type = lib.types.enum [
++          "mysql"
++          "postgresql"
++        ];
++        default = "mysql";
++        description = ''
++          Which database backend to use for storage.
++        '';
++      };
++
+       database.name = lib.mkOption {
+-        # the mysql module does not allow `-quoting without resorting to shell
+-        # escaping, so we restrict db names for forward compaitiblity should this
+-        # behavior ever change.
+         type = lib.types.strMatching "[a-z_][a-z0-9_]*";
+         default = defaultDatabase;
+         description = ''
+@@ -117,9 +174,15 @@ in
+ 
+       database.user = lib.mkOption {
+         type = lib.types.str;
+-        default = defaultUser;
++        default = if dbIsPostgreSQL then defaultDatabase else defaultUser;
++        defaultText = lib.literalExpression ''
++          if database.type == "postgresql" then "${defaultDatabase}" else "${defaultUser}"
++        '';
+         description = ''
+-          Username for database connections.
++          Username for database connections.  When using PostgreSQL with
++          `createLocally`, this defaults to the database name so that
++          `ensureDBOwnership` works (it requires user and database names
++          to match).
+         '';
+       };
+ 
+@@ -137,7 +200,8 @@ in
+         default = true;
+         description = ''
+           Whether to create database and user on the local machine if they do not exist.
+-          This includes enabling unix domain socket authentication for the configured user.
++          This includes enabling the configured database service and setting up
++          authentication for the configured user.
+         '';
+       };
+ 
+@@ -237,7 +301,7 @@ in
+   };
+ 
+   config = lib.mkIf cfg.enable {
+-    services.mysql = lib.mkIf cfg.database.createLocally {
++    services.mysql = lib.mkIf (cfg.database.createLocally && dbIsMySQL) {
+       enable = true;
+       ensureDatabases = [ cfg.database.name ];
+       ensureUsers = [
+@@ -250,16 +314,27 @@ in
+       ];
+     };
+ 
++    services.postgresql = lib.mkIf (cfg.database.createLocally && dbIsPostgreSQL) {
++      enable = true;
++      ensureDatabases = [ cfg.database.name ];
++      ensureUsers = [
++        {
++          name = cfg.database.user;
++          ensureDBOwnership = true;
++        }
++      ];
++    };
++
+     systemd.services.firefox-syncserver = {
+       wantedBy = [ "multi-user.target" ];
+-      requires = lib.mkIf dbIsLocal [ "mysql.service" ];
+-      after = lib.mkIf dbIsLocal [ "mysql.service" ];
++      requires = lib.mkIf dbIsLocal [ dbService ];
++      after = lib.mkIf dbIsLocal [ dbService ];
+       restartTriggers = lib.optional cfg.singleNode.enable setupScript;
+       environment.RUST_LOG = cfg.logLevel;
+       serviceConfig = {
+-        User = defaultUser;
+-        Group = defaultUser;
+-        ExecStart = "${cfg.package}/bin/syncserver --config ${configFile}";
++        User = cfg.database.user;
++        Group = cfg.database.user;
++        ExecStart = "${syncserver}/bin/syncserver --config ${configFile}";
+         EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
+ 
+         # hardening
+@@ -303,10 +378,19 @@ in
+ 
+     systemd.services.firefox-syncserver-setup = lib.mkIf cfg.singleNode.enable {
+       wantedBy = [ "firefox-syncserver.service" ];
+-      requires = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
+-      after = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
+-      path = [ config.services.mysql.package ];
+-      serviceConfig.ExecStart = [ "${setupScript}" ];
++      requires = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal dbService;
++      after = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal dbService;
++      path =
++        if dbIsMySQL then [ config.services.mysql.package ] else [ config.services.postgresql.package ];
++      serviceConfig = {
++        ExecStart = [ "${setupScript}" ];
++      }
++      // lib.optionalAttrs dbIsPostgreSQL {
++        # PostgreSQL peer authentication requires the system user to match the
++        # database user. Run as the superuser so we can access all databases.
++        User = "postgres";
++        Group = "postgres";
++      };
+     };
+ 
+     services.nginx.virtualHosts = lib.mkIf cfg.singleNode.enableNginx {
+diff --git a/pkgs/by-name/sy/syncstorage-rs/package.nix b/pkgs/by-name/sy/syncstorage-rs/package.nix
+index 39b2b53ab03c..944ed72525af 100644
+--- a/pkgs/by-name/sy/syncstorage-rs/package.nix
++++ b/pkgs/by-name/sy/syncstorage-rs/package.nix
+@@ -1,14 +1,18 @@
+ {
+   fetchFromGitHub,
++  fetchurl,
+   rustPlatform,
+   pkg-config,
+   python3,
+   cmake,
+   libmysqlclient,
++  libpq,
++  openssl,
+   makeBinaryWrapper,
+   lib,
+   nix-update-script,
+   nixosTests,
++  dbBackend ? "mysql",
+ }:
+ 
+ let
+@@ -19,17 +23,23 @@ let
+     p.tokenlib
+     p.cryptography
+   ]);
++  # utoipa-swagger-ui downloads Swagger UI assets at build time.
++  # Prefetch the archive for sandboxed builds.
++  swaggerUi = fetchurl {
++    url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.17.14.zip";
++    hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
++  };
+ in
+ 
+-rustPlatform.buildRustPackage rec {
++rustPlatform.buildRustPackage (finalAttrs: {
+   pname = "syncstorage-rs";
+-  version = "0.21.1-unstable-2026-01-26";
++  version = "0.21.1-unstable-2026-02-24";
+ 
+   src = fetchFromGitHub {
+     owner = "mozilla-services";
+     repo = "syncstorage-rs";
+-    rev = "11659d98f9c69948a0aab353437ce2036c388711";
+-    hash = "sha256-G37QvxTNh/C3gmKG0UYHI6QBr0F+KLGRNI/Sx33uOsc=";
++    rev = "50a739b58dc9ec81995f86e71d992aa14ccc450e";
++    hash = "sha256-idq0RGdwoV6GVuq36IVVVCFbyMTe8i/EpVWE59D/dhM=";
+   };
+ 
+   nativeBuildInputs = [
+@@ -39,16 +49,35 @@ rustPlatform.buildRustPackage rec {
+     python3
+   ];
+ 
+-  buildInputs = [
+-    libmysqlclient
+-  ];
++  buildInputs =
++    lib.optional (dbBackend == "mysql") libmysqlclient
++    ++ lib.optionals (dbBackend == "postgresql") [
++      libpq
++      openssl
++    ];
++
++  buildNoDefaultFeatures = true;
++  # The syncserver "postgres" feature only enables syncstorage-db/postgres.
++  # tokenserver-db/postgres must be enabled separately so the tokenserver
++  # can also connect to PostgreSQL (it dispatches on the URL scheme at runtime).
++  buildFeatures =
++    let
++      cargoFeature = if dbBackend == "postgresql" then "postgres" else dbBackend;
++    in
++    [
++      cargoFeature
++      "tokenserver-db/${cargoFeature}"
++      "py_verifier"
++    ];
++
++  SWAGGER_UI_DOWNLOAD_URL = "file://${swaggerUi}";
+ 
+   preFixup = ''
+     wrapProgram $out/bin/syncserver \
+       --prefix PATH : ${lib.makeBinPath [ pyFxADeps ]}
+   '';
+ 
+-  cargoHash = "sha256-9Dcf5mDyK/XjsKTlCPXTHoBkIq+FFPDg1zfK24Y9nHQ=";
++  cargoHash = "sha256-80EztkSX+SnmqsRWIXbChUB8AeV1Tp9WXoWNbDY8rUE=";
+ 
+   # almost all tests need a DB to test against
+   doCheck = false;
+@@ -60,10 +89,10 @@ rustPlatform.buildRustPackage rec {
+   meta = {
+     description = "Mozilla Sync Storage built with Rust";
+     homepage = "https://github.com/mozilla-services/syncstorage-rs";
+-    changelog = "https://github.com/mozilla-services/syncstorage-rs/releases/tag/${version}";
++    changelog = "https://github.com/mozilla-services/syncstorage-rs/releases/tag/${finalAttrs.version}";
+     license = lib.licenses.mpl20;
+     maintainers = [ ];
+     platforms = lib.platforms.linux;
+     mainProgram = "syncserver";
+   };
+-}
++})
+-- 
+2.53.0
+
diff --git a/secrets/firefox-syncserver-env.age b/secrets/firefox-syncserver-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..bd2cfc252e2de6e6878b4f2197192979474cc702
GIT binary patch
literal 306
zcmZQ@_Y83kiVO&0D39&m<-sWB=IOBTL*2KAFO#ztYENs)f9xToZ+G&4z*SQf?RU?4
zneE*4K5YnnRK&YT-g<wlxC`gJ_9>BlZ+|h}nG-PWhGWp;`){3&I;^P+I<TbI_nvu3
zX3L4(%(rTL&q^&8UT?i*W`@+Wi05Y-P2K*<Znzw>V8*4NjXRYkA`6*QJ+j@W|L^aA
zR8a9{Nsr~Vca|PKE7uk?PtJVsjGy(%md6%9mIOUyuj#*df8U;VY2Lm|7d#Eh7ae{O
z-NYo}zptEO3A5w#6{?!Hs;{QmJGGaz{Rx}8r0AyCE7L3cgC2g>d+2l_<HEf-TOFrv
z3+_3`v#NEcPb*yeWXcUj)h*tUc_*4Dm}-jFNy>f_b6W0J)*tuvX;}09M~YFkdm0iX
QrfjI3RG=5?-pPL#0QlXMkN^Mx

literal 0
HcmV?d00001

diff --git a/service-configs.nix b/service-configs.nix
index e1fb0c1..93d0f1a 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -44,6 +44,7 @@ rec {
     monero_rpc = 18081; # TCP
     monero_zmq = 18083; # TCP
     p2pool_stratum = 3334; # TCP
+    firefox_syncserver = 5000; # TCP
   };
 
   https = {
@@ -147,6 +148,10 @@ rec {
     dataDir = services_dir + "/recyclarr";
   };
 
+  firefox_syncserver = {
+    domain = "firefox-sync.${https.domain}";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/firefox-syncserver.nix b/services/firefox-syncserver.nix
new file mode 100644
index 0000000..8e783bc
--- /dev/null
+++ b/services/firefox-syncserver.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  services.firefox-syncserver = {
+    enable = true;
+    database = {
+      type = "postgresql";
+      createLocally = false;
+      user = "firefox_syncserver";
+    };
+    secrets = config.age.secrets.firefox-syncserver-env.path;
+    settings.port = service_configs.ports.firefox_syncserver;
+    singleNode = {
+      enable = true;
+      hostname = service_configs.firefox_syncserver.domain;
+      url = "https://${service_configs.firefox_syncserver.domain}";
+      capacity = 10;
+    };
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "firefox_syncserver" ];
+    ensureUsers = [
+      {
+        name = "firefox_syncserver";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+
+  services.caddy.virtualHosts."${service_configs.firefox_syncserver.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.firefox_syncserver}
+  '';
+}

From 5ced648bd699a774267ea9ef681b55dae3cb1a76 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 10:28:15 -0400
Subject: [PATCH 690/847] service-configs: remove unneeded rec

---
 service-configs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service-configs.nix b/service-configs.nix
index 93d0f1a..dcada63 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -71,7 +71,7 @@ rec {
   minecraft = {
     parent_dir = services_dir + "/minecraft";
     server_name = "main";
-    memory = rec {
+    memory = {
       heap_size_m = 4000;
       large_page_size_m = 2;
     };

From a5f3af5ff3a37bdd6b487d2c26899d9d16b3c5ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 11:54:40 -0400
Subject: [PATCH 691/847] ports refactor

---
 configuration.nix                         |   2 +-
 flake.nix                                 |  45 ++++--
 service-configs.nix                       | 175 +++++++++++++++++-----
 services/arr/arr-search.nix               |   4 +-
 services/arr/bazarr.nix                   |   4 +-
 services/arr/init.nix                     |  24 +--
 services/arr/jellyseerr.nix               |   4 +-
 services/arr/prowlarr.nix                 |   6 +-
 services/arr/radarr.nix                   |   4 +-
 services/arr/recyclarr.nix                |   4 +-
 services/arr/sonarr.nix                   |   4 +-
 services/bitmagnet.nix                    |   6 +-
 services/bitwarden.nix                    |   2 +-
 services/caddy.nix                        |   6 +-
 services/coturn.nix                       |  12 +-
 services/firefox-syncserver.nix           |   4 +-
 services/gitea.nix                        |   2 +-
 services/immich.nix                       |   2 +-
 services/jellyfin-qbittorrent-monitor.nix |   4 +-
 services/jellyfin.nix                     |   2 +-
 services/livekit.nix                      |  10 +-
 services/matrix.nix                       |  12 +-
 services/minecraft.nix                    |   2 +-
 services/monero.nix                       |  10 +-
 services/ntfy.nix                         |   4 +-
 services/p2pool.nix                       |   8 +-
 services/qbittorrent.nix                  |   2 +-
 services/soulseek.nix                     |   6 +-
 services/syncthing.nix                    |  10 +-
 services/xmrig.nix                        |   2 +-
 tests/fail2ban-gitea.nix                  |   5 +-
 tests/fail2ban-immich.nix                 |   5 +-
 32 files changed, 264 insertions(+), 128 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 066cf4f..5b5ea80 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -285,7 +285,7 @@
     openFirewall = true;
     welcometext = "meow meow meow meow meow :3 xd";
     password = builtins.readFile ./secrets/murmur_password;
-    port = service_configs.ports.murmur;
+    port = service_configs.ports.public.murmur.port;
   };
 
   # services.botamusique = {
diff --git a/flake.nix b/flake.nix
index e62b269..e8c4ba9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -142,19 +142,46 @@
             ;
         };
         modules = [
-          # SAFETY! make sure no ports collide
+          # SAFETY! port sanity checks
           (
-            { lib, ... }:
+            { config, lib, ... }:
+            let
+              publicPorts = lib.attrValues service_configs.ports.public;
+              privatePorts = lib.attrValues service_configs.ports.private;
+              allPortNumbers = map (p: p.port) (publicPorts ++ privatePorts);
+              uniquePortNumbers = lib.unique allPortNumbers;
+
+              # Which public ports must be in each firewall list
+              publicTcp = map (p: p.port) (lib.filter (p: p.proto == "tcp" || p.proto == "both") publicPorts);
+              publicUdp = map (p: p.port) (lib.filter (p: p.proto == "udp" || p.proto == "both") publicPorts);
+
+              privatePortNumbers = map (p: p.port) privatePorts;
+
+              fwTcp = config.networking.firewall.allowedTCPPorts;
+              fwUdp = config.networking.firewall.allowedUDPPorts;
+
+              missingTcp = lib.filter (p: !(builtins.elem p fwTcp)) publicTcp;
+              missingUdp = lib.filter (p: !(builtins.elem p fwUdp)) publicUdp;
+              leakedTcp = lib.filter (p: builtins.elem p fwTcp) privatePortNumbers;
+              leakedUdp = lib.filter (p: builtins.elem p fwUdp) privatePortNumbers;
+            in
             {
               config.assertions = [
                 {
-                  assertion =
-                    let
-                      ports = lib.attrValues service_configs.ports;
-                      uniquePorts = lib.unique ports;
-                    in
-                    (lib.length ports) == (lib.length uniquePorts);
-                  message = "Duplicate ports detected in 'ports' configuration";
+                  assertion = (lib.length allPortNumbers) == (lib.length uniquePortNumbers);
+                  message = "Duplicate port numbers detected in ports.public / ports.private";
+                }
+                {
+                  assertion = missingTcp == [ ];
+                  message = "Public ports missing from allowedTCPPorts: ${builtins.toString missingTcp}";
+                }
+                {
+                  assertion = missingUdp == [ ];
+                  message = "Public ports missing from allowedUDPPorts: ${builtins.toString missingUdp}";
+                }
+                {
+                  assertion = leakedTcp == [ ] && leakedUdp == [ ];
+                  message = "Private ports leaked into firewall allow-lists — TCP: ${builtins.toString leakedTcp}, UDP: ${builtins.toString leakedUdp}";
                 }
               ];
             }
diff --git a/service-configs.nix b/service-configs.nix
index dcada63..ea35cf5 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -9,42 +9,147 @@ rec {
   cpu_arch = "znver3";
 
   ports = {
-    # public
-    http = 80; # TCP
-    https = 443; # TCP+UDP (HTTP/3 QUIC)
-    minecraft = 25565; # TCP
-    syncthing_protocol = 22000; # TCP+UDP (QUIC)
-    syncthing_discovery = 21027; # UDP
-    matrix_federation = 8448; # TCP+UDP (HTTP/3 QUIC)
-    coturn = 3478; # TCP+UDP
-    coturn_tls = 5349; # TCP+UDP
-    livekit = 7880; # TCP
-    soulseek_listen = 50300; # TCP
-    monero = 18080; # TCP
-    p2pool_p2p = 37889; # TCP
-    murmur = 64738; # TCP + UDP
+    # Ports exposed to the internet. The flake asserts every public port
+    # appears in the corresponding firewall allow-list (TCP, UDP, or both).
+    public = {
+      http = {
+        port = 80;
+        proto = "tcp";
+      };
+      https = {
+        port = 443;
+        proto = "both";
+      }; # HTTP/3 QUIC
+      minecraft = {
+        port = 25565;
+        proto = "tcp";
+      };
+      syncthing_protocol = {
+        port = 22000;
+        proto = "both";
+      }; # QUIC
+      syncthing_discovery = {
+        port = 21027;
+        proto = "udp";
+      };
+      matrix_federation = {
+        port = 8448;
+        proto = "both";
+      }; # HTTP/3 QUIC
+      coturn = {
+        port = 3478;
+        proto = "both";
+      };
+      coturn_tls = {
+        port = 5349;
+        proto = "both";
+      };
+      livekit = {
+        port = 7880;
+        proto = "tcp";
+      };
+      soulseek_listen = {
+        port = 50300;
+        proto = "tcp";
+      };
+      monero = {
+        port = 18080;
+        proto = "tcp";
+      };
+      monero_rpc = {
+        port = 18081;
+        proto = "tcp";
+      }; # restricted public RPC
+      p2pool_p2p = {
+        port = 37889;
+        proto = "tcp";
+      };
+      murmur = {
+        port = 64738;
+        proto = "both";
+      };
+    };
 
-    # private
-    jellyfin = 8096; # TCP - no services.jellyfin option for this
-    torrent = 6011; # TCP
-    bitmagnet = 3333; # TCP
-    gitea = 2283; # TCP
-    immich = 2284; # TCP
-    soulseek_web = 5030; # TCP
-    vaultwarden = 8222; # TCP
-    syncthing_gui = 8384; # TCP
-    matrix = 6167; # TCP
-    ntfy = 2586; # TCP
-    lk_jwt = 8081; # TCP
-    prowlarr = 9696; # TCP
-    sonarr = 8989; # TCP
-    radarr = 7878; # TCP
-    bazarr = 6767; # TCP
-    jellyseerr = 5055; # TCP
-    monero_rpc = 18081; # TCP
-    monero_zmq = 18083; # TCP
-    p2pool_stratum = 3334; # TCP
-    firefox_syncserver = 5000; # TCP
+    # Ports bound to localhost / VPN only. The flake asserts none of
+    # these appear in the firewall allow-lists.
+    private = {
+      jellyfin = {
+        port = 8096;
+        proto = "tcp";
+      };
+      torrent = {
+        port = 6011;
+        proto = "tcp";
+      };
+      bitmagnet = {
+        port = 3333;
+        proto = "tcp";
+      };
+      gitea = {
+        port = 2283;
+        proto = "tcp";
+      };
+      immich = {
+        port = 2284;
+        proto = "tcp";
+      };
+      soulseek_web = {
+        port = 5030;
+        proto = "tcp";
+      };
+      vaultwarden = {
+        port = 8222;
+        proto = "tcp";
+      };
+      syncthing_gui = {
+        port = 8384;
+        proto = "tcp";
+      };
+      matrix = {
+        port = 6167;
+        proto = "tcp";
+      };
+      ntfy = {
+        port = 2586;
+        proto = "tcp";
+      };
+      lk_jwt = {
+        port = 8081;
+        proto = "tcp";
+      };
+      prowlarr = {
+        port = 9696;
+        proto = "tcp";
+      };
+      sonarr = {
+        port = 8989;
+        proto = "tcp";
+      };
+      radarr = {
+        port = 7878;
+        proto = "tcp";
+      };
+      bazarr = {
+        port = 6767;
+        proto = "tcp";
+      };
+      jellyseerr = {
+        port = 5055;
+        proto = "tcp";
+      };
+      monero_zmq = {
+        port = 18083;
+        proto = "tcp";
+      };
+      p2pool_stratum = {
+        port = 3334;
+        proto = "tcp";
+      };
+      firefox_syncserver = {
+        port = 5000;
+        proto = "tcp";
+      };
+    };
   };
 
   https = {
diff --git a/services/arr/arr-search.nix b/services/arr/arr-search.nix
index e2ee7ca..e9af616 100644
--- a/services/arr/arr-search.nix
+++ b/services/arr/arr-search.nix
@@ -7,8 +7,8 @@ let
   radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
   sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
 
-  radarrUrl = "http://localhost:${builtins.toString service_configs.ports.radarr}";
-  sonarrUrl = "http://localhost:${builtins.toString service_configs.ports.sonarr}";
+  radarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
+  sonarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
 
   curl = "${pkgs.curl}/bin/curl";
   jq = "${pkgs.jq}/bin/jq";
diff --git a/services/arr/bazarr.nix b/services/arr/bazarr.nix
index c857ad6..1c7e0ad 100644
--- a/services/arr/bazarr.nix
+++ b/services/arr/bazarr.nix
@@ -20,12 +20,12 @@
 
   services.bazarr = {
     enable = true;
-    listenPort = service_configs.ports.bazarr;
+    listenPort = service_configs.ports.private.bazarr.port;
   };
 
   services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.bazarr}
+    reverse_proxy :${builtins.toString service_configs.ports.private.bazarr.port}
   '';
 
   users.users.${config.services.bazarr.user}.extraGroups = [
diff --git a/services/arr/init.nix b/services/arr/init.nix
index d929c7f..d52a989 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -4,7 +4,7 @@
     prowlarr = {
       enable = true;
       serviceName = "prowlarr";
-      port = service_configs.ports.prowlarr;
+      port = service_configs.ports.private.prowlarr.port;
       dataDir = service_configs.prowlarr.dataDir;
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
@@ -14,8 +14,8 @@
           name = "Sonarr";
           implementation = "Sonarr";
           configContract = "SonarrSettings";
-          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}";
-          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.sonarr}";
+          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
+          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.sonarr.port}";
           apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml";
           syncCategories = [
             5000
@@ -33,8 +33,8 @@
           name = "Radarr";
           implementation = "Radarr";
           configContract = "RadarrSettings";
-          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}";
-          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.radarr}";
+          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
+          baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.radarr.port}";
           apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml";
           syncCategories = [
             2000
@@ -56,7 +56,7 @@
     sonarr = {
       enable = true;
       serviceName = "sonarr";
-      port = service_configs.ports.sonarr;
+      port = service_configs.ports.private.sonarr.port;
       dataDir = service_configs.sonarr.dataDir;
       healthChecks = true;
       rootFolders = [ service_configs.media.tvDir ];
@@ -68,7 +68,7 @@
           serviceName = "qbittorrent";
           fields = {
             host = config.vpnNamespaces.wg.namespaceAddress;
-            port = service_configs.ports.torrent;
+            port = service_configs.ports.private.torrent.port;
             useSsl = false;
             tvCategory = "tvshows";
           };
@@ -79,7 +79,7 @@
     radarr = {
       enable = true;
       serviceName = "radarr";
-      port = service_configs.ports.radarr;
+      port = service_configs.ports.private.radarr.port;
       dataDir = service_configs.radarr.dataDir;
       healthChecks = true;
       rootFolders = [ service_configs.media.moviesDir ];
@@ -91,7 +91,7 @@
           serviceName = "qbittorrent";
           fields = {
             host = config.vpnNamespaces.wg.namespaceAddress;
-            port = service_configs.ports.torrent;
+            port = service_configs.ports.private.torrent.port;
             useSsl = false;
             movieCategory = "movies";
           };
@@ -103,17 +103,17 @@
   services.bazarrInit = {
     enable = true;
     dataDir = "/var/lib/bazarr";
-    port = service_configs.ports.bazarr;
+    port = service_configs.ports.private.bazarr.port;
     sonarr = {
       enable = true;
       dataDir = service_configs.sonarr.dataDir;
-      port = service_configs.ports.sonarr;
+      port = service_configs.ports.private.sonarr.port;
       serviceName = "sonarr";
     };
     radarr = {
       enable = true;
       dataDir = service_configs.radarr.dataDir;
-      port = service_configs.ports.radarr;
+      port = service_configs.ports.private.radarr.port;
       serviceName = "radarr";
     };
   };
diff --git a/services/arr/jellyseerr.nix b/services/arr/jellyseerr.nix
index 6433d04..ea0223b 100644
--- a/services/arr/jellyseerr.nix
+++ b/services/arr/jellyseerr.nix
@@ -17,7 +17,7 @@
 
   services.jellyseerr = {
     enable = true;
-    port = service_configs.ports.jellyseerr;
+    port = service_configs.ports.private.jellyseerr.port;
     configDir = service_configs.jellyseerr.configDir;
   };
 
@@ -38,6 +38,6 @@
 
   services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = ''
     # import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.jellyseerr}
+    reverse_proxy :${builtins.toString service_configs.ports.private.jellyseerr.port}
   '';
 }
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index c5e9c69..7561c87 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -10,17 +10,17 @@
     (lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [
       service_configs.prowlarr.dataDir
     ])
-    (lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr")
+    (lib.vpnNamespaceOpenPort service_configs.ports.private.prowlarr.port "prowlarr")
   ];
 
   services.prowlarr = {
     enable = true;
     dataDir = service_configs.prowlarr.dataDir;
-    settings.server.port = service_configs.ports.prowlarr;
+    settings.server.port = service_configs.ports.private.prowlarr.port;
   };
 
   services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}
   '';
 }
diff --git a/services/arr/radarr.nix b/services/arr/radarr.nix
index fbd20e6..7a62e52 100644
--- a/services/arr/radarr.nix
+++ b/services/arr/radarr.nix
@@ -21,13 +21,13 @@
   services.radarr = {
     enable = true;
     dataDir = service_configs.radarr.dataDir;
-    settings.server.port = service_configs.ports.radarr;
+    settings.server.port = service_configs.ports.private.radarr.port;
     settings.update.mechanism = "external";
   };
 
   services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.radarr}
+    reverse_proxy :${builtins.toString service_configs.ports.private.radarr.port}
   '';
 
   users.users.${config.services.radarr.user}.extraGroups = [
diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 4d2d61a..6fd6697 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -44,7 +44,7 @@ in
 
     configuration = {
       radarr.movies = {
-        base_url = "http://localhost:${builtins.toString service_configs.ports.radarr}";
+        base_url = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
 
         include = [
           { template = "radarr-quality-definition-movie"; }
@@ -123,7 +123,7 @@ in
       };
 
       sonarr.series = {
-        base_url = "http://localhost:${builtins.toString service_configs.ports.sonarr}";
+        base_url = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
 
         include = [
           { template = "sonarr-quality-definition-series"; }
diff --git a/services/arr/sonarr.nix b/services/arr/sonarr.nix
index ac3da89..44dc196 100644
--- a/services/arr/sonarr.nix
+++ b/services/arr/sonarr.nix
@@ -27,13 +27,13 @@
   services.sonarr = {
     enable = true;
     dataDir = service_configs.sonarr.dataDir;
-    settings.server.port = service_configs.ports.sonarr;
+    settings.server.port = service_configs.ports.private.sonarr.port;
     settings.update.mechanism = "external";
   };
 
   services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.sonarr}
+    reverse_proxy :${builtins.toString service_configs.ports.private.sonarr.port}
   '';
 
   users.users.${config.services.sonarr.user}.extraGroups = [
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index d537315..9d27503 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -7,7 +7,7 @@
 }:
 {
   imports = [
-    (lib.vpnNamespaceOpenPort service_configs.ports.bitmagnet "bitmagnet")
+    (lib.vpnNamespaceOpenPort service_configs.ports.private.bitmagnet.port "bitmagnet")
   ];
 
   services.bitmagnet = {
@@ -19,13 +19,13 @@
       };
       http_server = {
         # TODO! make issue about this being a string and not a `port` type
-        port = ":" + (builtins.toString service_configs.ports.bitmagnet);
+        port = ":" + (builtins.toString service_configs.ports.private.bitmagnet.port);
       };
     };
   };
 
   services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.bitmagnet}
+    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.bitmagnet.port}
   '';
 }
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index a600db9..5068db8 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -30,7 +30,7 @@
       SIGNUPS_ALLOWED = false;
 
       ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = service_configs.ports.vaultwarden;
+      ROCKET_PORT = service_configs.ports.private.vaultwarden.port;
       ROCKET_LOG = "critical";
     };
   };
diff --git a/services/caddy.nix b/services/caddy.nix
index c6adaf2..f77644f 100644
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -113,14 +113,14 @@ in
   systemd.packages = with pkgs; [ nssTools ];
 
   networking.firewall.allowedTCPPorts = [
-    service_configs.ports.https
+    service_configs.ports.public.https.port
 
     # http (but really acmeCA challenges)
-    service_configs.ports.http
+    service_configs.ports.public.http.port
   ];
 
   networking.firewall.allowedUDPPorts = [
-    service_configs.ports.https
+    service_configs.ports.public.https.port
   ];
 
   # Protect Caddy basic auth endpoints from brute force attacks
diff --git a/services/coturn.nix b/services/coturn.nix
index 78cc40d..9f11ff7 100644
--- a/services/coturn.nix
+++ b/services/coturn.nix
@@ -10,8 +10,8 @@
     realm = service_configs.https.domain;
     use-auth-secret = true;
     static-auth-secret = lib.strings.trim (builtins.readFile ../secrets/coturn_static_auth_secret);
-    listening-port = service_configs.ports.coturn;
-    tls-listening-port = service_configs.ports.coturn_tls;
+    listening-port = service_configs.ports.public.coturn.port;
+    tls-listening-port = service_configs.ports.public.coturn_tls.port;
     no-cli = true;
 
     # recommended security settings from Synapse's coturn docs
@@ -41,12 +41,12 @@
   # coturn needs these ports open
   networking.firewall = {
     allowedTCPPorts = [
-      service_configs.ports.coturn
-      service_configs.ports.coturn_tls
+      service_configs.ports.public.coturn.port
+      service_configs.ports.public.coturn_tls.port
     ];
     allowedUDPPorts = [
-      service_configs.ports.coturn
-      service_configs.ports.coturn_tls
+      service_configs.ports.public.coturn.port
+      service_configs.ports.public.coturn_tls.port
     ];
     # relay port range
     allowedUDPPortRanges = [
diff --git a/services/firefox-syncserver.nix b/services/firefox-syncserver.nix
index 8e783bc..5c077c5 100644
--- a/services/firefox-syncserver.nix
+++ b/services/firefox-syncserver.nix
@@ -14,7 +14,7 @@
       user = "firefox_syncserver";
     };
     secrets = config.age.secrets.firefox-syncserver-env.path;
-    settings.port = service_configs.ports.firefox_syncserver;
+    settings.port = service_configs.ports.private.firefox_syncserver.port;
     singleNode = {
       enable = true;
       hostname = service_configs.firefox_syncserver.domain;
@@ -34,6 +34,6 @@
   };
 
   services.caddy.virtualHosts."${service_configs.firefox_syncserver.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.firefox_syncserver}
+    reverse_proxy :${builtins.toString service_configs.ports.private.firefox_syncserver.port}
   '';
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index 77a1a43..dff1abe 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -27,7 +27,7 @@
         SSH_USER = "gitea";
         DOMAIN = service_configs.gitea.domain;
         ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
-        HTTP_PORT = service_configs.ports.gitea;
+        HTTP_PORT = service_configs.ports.private.gitea.port;
         LANDING_PAGE = "/explore/repos";
         DISABLE_HTTP_GIT = true;
       };
diff --git a/services/immich.nix b/services/immich.nix
index 363d09e..c01dafe 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -21,7 +21,7 @@
   services.immich = {
     enable = true;
     mediaLocation = service_configs.immich.dir;
-    port = service_configs.ports.immich;
+    port = service_configs.ports.private.immich.port;
     # openFirewall = true;
     host = "0.0.0.0";
     database = {
diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin-qbittorrent-monitor.nix
index 307e07b..9d73adc 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin-qbittorrent-monitor.nix
@@ -43,8 +43,8 @@
     };
 
     environment = {
-      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}";
-      QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.torrent}";
+      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.private.jellyfin.port}";
+      QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.torrent.port}";
       CHECK_INTERVAL = "30";
       # Bandwidth budget configuration
       TOTAL_BANDWIDTH_BUDGET = "30000000"; # 30 Mbps in bits per second
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
index 2ab9b12..b80e842 100644
--- a/services/jellyfin.nix
+++ b/services/jellyfin.nix
@@ -25,7 +25,7 @@
   };
 
   services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.jellyfin} {
+    reverse_proxy :${builtins.toString service_configs.ports.private.jellyfin.port} {
       header_up X-Real-IP {remote_host}
       header_up X-Forwarded-For {remote_host}
       header_up X-Forwarded-Proto {scheme}
diff --git a/services/livekit.nix b/services/livekit.nix
index c1579d7..4573780 100644
--- a/services/livekit.nix
+++ b/services/livekit.nix
@@ -4,8 +4,6 @@
 }:
 let
   keyFile = ../secrets/livekit_keys;
-
-  ports = service_configs.ports;
 in
 {
   services.livekit = {
@@ -14,7 +12,7 @@ in
     openFirewall = true;
 
     settings = {
-      port = ports.livekit;
+      port = service_configs.ports.public.livekit.port;
       bind_addresses = [ "127.0.0.1" ];
 
       rtc = {
@@ -38,16 +36,16 @@ in
     enable = true;
     inherit keyFile;
     livekitUrl = "wss://${service_configs.livekit.domain}";
-    port = ports.lk_jwt;
+    port = service_configs.ports.private.lk_jwt.port;
   };
 
   services.caddy.virtualHosts."${service_configs.livekit.domain}".extraConfig = ''
     @jwt path /sfu/get /healthz
     handle @jwt {
-      reverse_proxy :${builtins.toString ports.lk_jwt}
+      reverse_proxy :${builtins.toString service_configs.ports.private.lk_jwt.port}
     }
     handle {
-      reverse_proxy :${builtins.toString ports.livekit}
+      reverse_proxy :${builtins.toString service_configs.ports.public.livekit.port}
     }
   '';
 }
diff --git a/services/matrix.nix b/services/matrix.nix
index e1d3b17..3aaee5b 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -18,7 +18,7 @@
     enable = true;
 
     settings.global = {
-      port = [ service_configs.ports.matrix ];
+      port = [ service_configs.ports.private.matrix.port ];
       server_name = service_configs.https.domain;
       allow_registration = true;
       registration_token = lib.strings.trim (builtins.readFile ../secrets/matrix_reg_token);
@@ -49,25 +49,25 @@
   services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
     header /.well-known/matrix/* Content-Type application/json
     header /.well-known/matrix/* Access-Control-Allow-Origin *
-    respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}`
+    respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.https.port}"}`
     respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}`
   '';
 
   services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.matrix}
+    reverse_proxy :${builtins.toString service_configs.ports.private.matrix.port}
   '';
 
   # Exact duplicate for federation port
-  services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.matrix_federation}".extraConfig =
+  services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.matrix_federation.port}".extraConfig =
     config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
 
   # for federation
   networking.firewall.allowedTCPPorts = [
-    service_configs.ports.matrix_federation
+    service_configs.ports.public.matrix_federation.port
   ];
 
   # for federation
   networking.firewall.allowedUDPPorts = [
-    service_configs.ports.matrix_federation
+    service_configs.ports.public.matrix_federation.port
   ];
 }
diff --git a/services/minecraft.nix b/services/minecraft.nix
index e08919f..adfd500 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -73,7 +73,7 @@
       ];
 
       serverProperties = {
-        server-port = service_configs.ports.minecraft;
+        server-port = service_configs.ports.public.minecraft.port;
         enforce-whitelist = true;
         gamemode = "survival";
         white-list = true;
diff --git a/services/monero.nix b/services/monero.nix
index 6556ce5..7025c3d 100644
--- a/services/monero.nix
+++ b/services/monero.nix
@@ -18,12 +18,12 @@
     dataDir = service_configs.monero.dataDir;
     rpc = {
       address = "0.0.0.0";
-      port = service_configs.ports.monero_rpc;
+      port = service_configs.ports.public.monero_rpc.port;
       restricted = true;
     };
     extraConfig = ''
-      p2p-bind-port=${builtins.toString service_configs.ports.monero}
-      zmq-pub=tcp://127.0.0.1:${builtins.toString service_configs.ports.monero_zmq}
+      p2p-bind-port=${builtins.toString service_configs.ports.public.monero.port}
+      zmq-pub=tcp://127.0.0.1:${builtins.toString service_configs.ports.private.monero_zmq.port}
       db-sync-mode=fast:async:1000000000bytes
       public-node=1
       confirm-external-bind=1
@@ -31,7 +31,7 @@
   };
 
   networking.firewall.allowedTCPPorts = [
-    service_configs.ports.monero
-    service_configs.ports.monero_rpc
+    service_configs.ports.public.monero.port
+    service_configs.ports.public.monero_rpc.port
   ];
 }
diff --git a/services/ntfy.nix b/services/ntfy.nix
index 3b7dd1b..ef26330 100644
--- a/services/ntfy.nix
+++ b/services/ntfy.nix
@@ -19,7 +19,7 @@
 
     settings = {
       base-url = "https://${service_configs.ntfy.domain}";
-      listen-http = "127.0.0.1:${builtins.toString service_configs.ports.ntfy}";
+      listen-http = "127.0.0.1:${builtins.toString service_configs.ports.private.ntfy.port}";
       behind-proxy = true;
       auth-default-access = "deny-all";
       enable-login = true;
@@ -28,7 +28,7 @@
   };
 
   services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.ntfy}
+    reverse_proxy :${builtins.toString service_configs.ports.private.ntfy.port}
   '';
 
 }
diff --git a/services/p2pool.nix b/services/p2pool.nix
index 3cc07b8..99101ab 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -23,10 +23,10 @@ in
     walletAddress = walletAddress;
     sidechain = "nano";
     host = "127.0.0.1";
-    rpcPort = service_configs.ports.monero_rpc;
-    zmqPort = service_configs.ports.monero_zmq;
+    rpcPort = service_configs.ports.public.monero_rpc.port;
+    zmqPort = service_configs.ports.private.monero_zmq.port;
     extraArgs = [
-      " --stratum 0.0.0.0:${builtins.toString service_configs.ports.p2pool_stratum}"
+      " --stratum 0.0.0.0:${builtins.toString service_configs.ports.private.p2pool_stratum.port}"
     ];
   };
 
@@ -43,6 +43,6 @@ in
   };
 
   networking.firewall.allowedTCPPorts = [
-    service_configs.ports.p2pool_p2p
+    service_configs.ports.public.p2pool_p2p.port
   ];
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index e8c00a7..606eefe 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -26,7 +26,7 @@
 
   services.qbittorrent = {
     enable = true;
-    webuiPort = service_configs.ports.torrent;
+    webuiPort = service_configs.ports.private.torrent.port;
     profileDir = "/var/lib/qBittorrent";
     # Set the service group to 'media' so the systemd unit runs with media as
     # the primary GID. Linux assigns new file ownership from the process's GID
diff --git a/services/soulseek.nix b/services/soulseek.nix
index 21e9bff..f8c4f62 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -30,11 +30,11 @@
 
     settings = {
       web = {
-        port = service_configs.ports.soulseek_web;
+        port = service_configs.ports.private.soulseek_web.port;
       };
       soulseek = {
         # description = "smth idk";
-        listen_port = service_configs.ports.soulseek_listen;
+        listen_port = service_configs.ports.public.soulseek_listen.port;
       };
 
       shares = {
@@ -64,6 +64,6 @@
   '';
 
   networking.firewall.allowedTCPPorts = [
-    service_configs.ports.soulseek_listen
+    service_configs.ports.public.soulseek_listen.port
   ];
 }
diff --git a/services/syncthing.nix b/services/syncthing.nix
index a7cf2bf..6200737 100644
--- a/services/syncthing.nix
+++ b/services/syncthing.nix
@@ -24,7 +24,7 @@
 
     dataDir = service_configs.syncthing.dataDir;
 
-    guiAddress = "127.0.0.1:${toString service_configs.ports.syncthing_gui}";
+    guiAddress = "127.0.0.1:${toString service_configs.ports.private.syncthing_gui.port}";
 
     overrideDevices = false;
     overrideFolders = false;
@@ -42,16 +42,16 @@
 
   # Open firewall ports for syncthing protocol
   networking.firewall = {
-    allowedTCPPorts = [ service_configs.ports.syncthing_protocol ];
+    allowedTCPPorts = [ service_configs.ports.public.syncthing_protocol.port ];
     allowedUDPPorts = [
-      service_configs.ports.syncthing_discovery
-      service_configs.ports.syncthing_protocol
+      service_configs.ports.public.syncthing_discovery.port
+      service_configs.ports.public.syncthing_protocol.port
     ];
   };
 
   services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${toString service_configs.ports.syncthing_gui}
+    reverse_proxy :${toString service_configs.ports.private.syncthing_gui.port}
   '';
 
 }
diff --git a/services/xmrig.nix b/services/xmrig.nix
index 2d4dc04..6793f1d 100644
--- a/services/xmrig.nix
+++ b/services/xmrig.nix
@@ -32,7 +32,7 @@ in
 
       pools = [
         {
-          url = "127.0.0.1:${builtins.toString service_configs.ports.p2pool_stratum}";
+          url = "127.0.0.1:${builtins.toString service_configs.ports.private.p2pool_stratum.port}";
           tls = false;
         }
       ];
diff --git a/tests/fail2ban-gitea.nix b/tests/fail2ban-gitea.nix
index 0022c06..b9fe355 100644
--- a/tests/fail2ban-gitea.nix
+++ b/tests/fail2ban-gitea.nix
@@ -12,7 +12,10 @@ let
       dir = "/var/lib/gitea";
       domain = "git.test.local";
     };
-    ports.gitea = 3000;
+    ports.private.gitea = {
+      port = 3000;
+      proto = "tcp";
+    };
   };
 
   testLib = lib.extend (
diff --git a/tests/fail2ban-immich.nix b/tests/fail2ban-immich.nix
index 2fefa0a..04a8530 100644
--- a/tests/fail2ban-immich.nix
+++ b/tests/fail2ban-immich.nix
@@ -9,7 +9,10 @@ let
   testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
     zpool_ssds = "";
     https.domain = "test.local";
-    ports.immich = 2283;
+    ports.private.immich = {
+      port = 2283;
+      proto = "tcp";
+    };
     immich.dir = "/var/lib/immich";
   };
 

From f94c04a9c41494c3dffc934306dc010dde5cdad6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 12:23:29 -0400
Subject: [PATCH 692/847] firefox-syncserver: fix secret and capacity

---
 secrets/firefox-syncserver-env.age | Bin 306 -> 318 bytes
 services/firefox-syncserver.nix    |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/secrets/firefox-syncserver-env.age b/secrets/firefox-syncserver-env.age
index bd2cfc252e2de6e6878b4f2197192979474cc702..aafe811d34904776d97716e92a7e6b6cc5944ec3 100644
GIT binary patch
literal 318
zcmZQ@_Y83kiVO&0=n*a2$ddT$j?y0C88>x=Yci)Z<tIwV{9ZSi?~VO>vyx|aoYvuO
z_TH2C9f^2Zy^yQ9U(7yMS?B%!>ZR<0f0bsq>C_3%<Y1mt6m#VB>Q&+f#@ep?au)8b
zx%lYPvr`6Y-=p1kD^Iyw_Lk+p+$62J=6C1sj#?d;Y4!hotorVsYmX*|NUV3b@YlZO
zclF$NB3BcRxH0FJsY%(Z{JH4-en*N3XWRRg_P^$*wY{2?lpl6wv+J8ZO18dB*Somw
z3;A%b%6M7zu2n|NN&)lt1-+QVY>?X+qszRm<;$fAw&Pt*RWn_`JllNHcI#6m6=N$A
zt7pln6$djM!;aT4|6D!g(RN<XC8vbV4<+OYtq+!*bGa~#^I`Mkwf##z%_#cbaw$bg
d<jL<^whw25R61wO+RCxTx#>gqY{^IOq5&7*nppq<

literal 306
zcmZQ@_Y83kiVO&0D39&m<-sWB=IOBTL*2KAFO#ztYENs)f9xToZ+G&4z*SQf?RU?4
zneE*4K5YnnRK&YT-g<wlxC`gJ_9>BlZ+|h}nG-PWhGWp;`){3&I;^P+I<TbI_nvu3
zX3L4(%(rTL&q^&8UT?i*W`@+Wi05Y-P2K*<Znzw>V8*4NjXRYkA`6*QJ+j@W|L^aA
zR8a9{Nsr~Vca|PKE7uk?PtJVsjGy(%md6%9mIOUyuj#*df8U;VY2Lm|7d#Eh7ae{O
z-NYo}zptEO3A5w#6{?!Hs;{QmJGGaz{Rx}8r0AyCE7L3cgC2g>d+2l_<HEf-TOFrv
z3+_3`v#NEcPb*yeWXcUj)h*tUc_*4Dm}-jFNy>f_b6W0J)*tuvX;}09M~YFkdm0iX
QrfjI3RG=5?-pPL#0QlXMkN^Mx

diff --git a/services/firefox-syncserver.nix b/services/firefox-syncserver.nix
index 5c077c5..d7f31a6 100644
--- a/services/firefox-syncserver.nix
+++ b/services/firefox-syncserver.nix
@@ -19,7 +19,7 @@
       enable = true;
       hostname = service_configs.firefox_syncserver.domain;
       url = "https://${service_configs.firefox_syncserver.domain}";
-      capacity = 10;
+      capacity = 1;
     };
   };
 

From 41b574a3c7062bc210f92b44430a25a3f31b4492 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 13:28:18 -0400
Subject: [PATCH 693/847] bitwarden: move to postgresql

---
 services/bitwarden.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 5068db8..18d3f0b 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -9,21 +9,16 @@
   imports = [
     (lib.serviceMountWithZpool "vaultwarden" service_configs.zpool_ssds [
       service_configs.vaultwarden.path
-      config.services.vaultwarden.backupDir
-    ])
-    (lib.serviceMountWithZpool "backup-vaultwarden" service_configs.zpool_ssds [
-      service_configs.vaultwarden.path
-      config.services.vaultwarden.backupDir
     ])
     (lib.serviceFilePerms "vaultwarden" [
       "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
-      "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
     ])
   ];
 
   services.vaultwarden = {
     enable = true;
-    backupDir = "/${service_configs.zpool_ssds}/bak/vaultwarden";
+    dbBackend = "postgresql";
+    configurePostgres = true;
     config = {
       # Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
       DOMAIN = "https://bitwarden.${service_configs.https.domain}";

From dfefec5baa036ab25bf01240ac2d9f41082db1fc Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 13:31:03 -0400
Subject: [PATCH 694/847] postgresql: safer snapshot backups

---
 services/postgresql.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/services/postgresql.nix b/services/postgresql.nix
index 3fb4463..3757e7b 100644
--- a/services/postgresql.nix
+++ b/services/postgresql.nix
@@ -5,6 +5,30 @@
   lib,
   ...
 }:
+let
+  pgCheckpoint = pkgs.writeShellScript "pg-checkpoint" ''
+    # Flush PostgreSQL dirty buffers to disk before ZFS snapshot so the
+    # on-disk state is consistent and the snapshot is recoverable.
+    # On failure: log a warning but exit 0 so sanoid still takes the
+    # snapshot (an inconsistent snapshot beats no snapshot).
+    if ! ${pkgs.systemd}/bin/systemctl is-active --quiet postgresql.service; then
+      echo "postgresql is not running, skipping checkpoint" >&2
+      exit 0
+    fi
+
+    if ${pkgs.coreutils}/bin/timeout 120 \
+      ${pkgs.util-linux}/bin/runuser -u postgres -- \
+        ${lib.getExe' config.services.postgresql.package "psql"} \
+          -v ON_ERROR_STOP=1 -c "CHECKPOINT" 2>&1; then
+      echo "postgresql checkpoint completed"
+    else
+      echo "WARNING: postgresql checkpoint failed, snapshot may be inconsistent" >&2
+    fi
+
+    # Always exit 0 — sanoid must run regardless
+    exit 0
+  '';
+in
 {
   imports = [
     (lib.serviceMountWithZpool "postgresql" service_configs.zpool_ssds [
@@ -29,4 +53,10 @@
     };
   };
 
+  # Run a PostgreSQL CHECKPOINT before sanoid snapshots so the on-disk
+  # state is consistent (required since full_page_writes = false).
+  systemd.services.sanoid.serviceConfig = {
+    ExecStartPre = lib.mkAfter [ "+${pgCheckpoint}" ];
+    TimeoutStartSec = lib.mkForce 300; # checkpoint can be slow with large txg_timeout
+  };
 }

From aee4d30c3d6395fc5d320aa06cec60ad95f07b76 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 21 Mar 2026 13:46:11 -0400
Subject: [PATCH 695/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index f568387..683061e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -89,11 +89,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773506317,
-        "narHash": "sha256-qWKbLUJpavIpvOdX1fhHYm0WGerytFHRoh9lVck6Bh0=",
+        "lastModified": 1773889306,
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "878ec37d6a8f52c6c801d0e2a2ad554c75b9353c",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773681845,
-        "narHash": "sha256-o8hrZrigP0JYcwnglCp8Zi8jQafWsxbDtRRPzuVwFxY=",
+        "lastModified": 1773963144,
+        "narHash": "sha256-WzBOBfSay3GYilUfKaUa1Mbf8/jtuAiJIedx7fWuIX4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0759e0e137305bc9d0c52c204c6d8dffe6f601a6",
+        "rev": "a91b3ea73a765614d90360580b689c48102d1d33",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1773802295,
-        "narHash": "sha256-luPLLgS8VR2fHo3xT04KbJm0RU2wep6SDh3smwF8e5E=",
+        "lastModified": 1774060651,
+        "narHash": "sha256-sZiam+rmNcOZGnlbnqDD9oTwfMdQUM+uQmFqqSoe194=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "41870283e080c46a6d33b6c3b3923e90348254c3",
+        "rev": "46727bd27d32d63069ed26a690554373ae2b4702",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1773533765,
-        "narHash": "sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY=",
+        "lastModified": 1774018263,
+        "narHash": "sha256-HHYEwK1A22aSaxv2ibhMMkKvrDGKGlA/qObG4smrSqc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f8e82243fd601afb9f59ad230958bd073795cbfe",
+        "rev": "2d4b4717b2534fad5c715968c1cece04a172b365",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773814637,
-        "narHash": "sha256-GNU+ooRmrHLfjlMsKdn0prEKVa0faVanm0jrgu1J/gY=",
+        "lastModified": 1773964973,
+        "narHash": "sha256-NV/J+tTER0P5iJhUDL/8HO5MDjDceLQPRUYgdmy5wXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fea3b367d61c1a6592bc47c72f40a9f3e6a53e96",
+        "rev": "812b3986fd1568f7a858f97fcf425ad996ba7d25",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773702072,
-        "narHash": "sha256-oBBOi77u+uUX47xdYmerpk0cRXVlYOPR1+LsTidFvzg=",
+        "lastModified": 1773886077,
+        "narHash": "sha256-A6jO6OEESZJ0+44Z0LmhnUi32VRfb8rdg/ralEamWDU=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "6810cbd27b8e9eac561997ee98cf30844c4ed282",
+        "rev": "cb48be23fc3d90cdd5a4ab6a27a7536481a4cf63",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1773788980,
-        "narHash": "sha256-CuD+g/MNgcAlbZ2OXZUzZfPHwXzzKM8qovdkIVhHy+A=",
+        "lastModified": 1774048185,
+        "narHash": "sha256-OGKxauB88rUdPv9ByZlY2M1H0iFMerg3Ln4vXx8u0Iw=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "03ae4d7ea81606a88aee4bef8683d61c288763f9",
+        "rev": "307ae67495ad02871c8e5add41fd9e7b85fec167",
         "type": "github"
       },
       "original": {

From e6ee0bbf592e3305638aa00b3e4a0aef6f8e1b71 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 22 Mar 2026 01:17:37 -0400
Subject: [PATCH 696/847] AGENTS.md: cleanup pool spec

---
 AGENTS.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 9dbb460..e109cf4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,8 +12,9 @@ agenix for secrets, lanzaboote for secure boot, and ZFS for data storage.
 - **RAM**: 64 GB DDR4, no swap
 - **Motherboard**: ASRock B550M Pro4
 - **Boot drive**: WD_BLACK SN770 1TB NVMe (f2fs: 20G /persistent, 911G /nix; root is tmpfs)
-- **SSD pool `tank`**: 4x 2TB SATA SSDs (raidz2, 7.27T raw, ~2.2T free) -- services, backups, music
-- **HDD pool `hdds`**: 4x 18TB Seagate Exos X18 (raidz1, 65.5T raw, ~17.9T free) -- torrents, monero
+- **SSD pool `tank`**: 4x 2TB SATA SSDs (raidz2) -- services, backups, music, misc
+- **HDD pool `hdds`**: 4x 18TB Seagate Exos X18 (raidz1)-- torrents
+    - Connected via esata to external enclosure
 - **USB**: 8GB VFAT drive mounted at /mnt/usb-secrets (agenix identity key)
 - **GPU**: Intel (integrated, xe driver) -- used for Jellyfin hardware transcoding
 - **NIC**: enp4s0 (static 192.168.1.50/24)

From 429ac598a3336b8e67d9a8894b2d83609963fbe8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 22 Mar 2026 01:18:33 -0400
Subject: [PATCH 697/847] boot: disable canTouchEfiVariables due to corruption
 issue

This gave me a lot of panic and grief. JetKVM got NO monitor output
I was panicing and away from home. Was awful. After letting it sit off
for a few hours it fixed itself, inline with nvram state draining over
time.
---
 configuration.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 5b5ea80..26602a5 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -129,7 +129,10 @@
 
     loader = {
       # Use the systemd-boot EFI boot loader.
-      efi.canTouchEfiVariables = true;
+      # Disabled: ASRock B550M Pro4 AMI UEFI hangs on POST when NixOS
+      # writes EFI variables (NVRAM corruption). Lanzaboote boot entries
+      # are discovered via BLS Type #2 on the ESP, so this is not needed.
+      efi.canTouchEfiVariables = false;
 
       # 1s timeout
       timeout = 1;

From 43ecd1609544f434bbe547f24982fb7040314702 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 23 Mar 2026 19:43:16 -0700
Subject: [PATCH 698/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 683061e..4dbdcfe 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773963144,
-        "narHash": "sha256-WzBOBfSay3GYilUfKaUa1Mbf8/jtuAiJIedx7fWuIX4=",
+        "lastModified": 1774274588,
+        "narHash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a91b3ea73a765614d90360580b689c48102d1d33",
+        "rev": "cf9686ba26f5ef788226843bc31fda4cf72e373b",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773964973,
-        "narHash": "sha256-NV/J+tTER0P5iJhUDL/8HO5MDjDceLQPRUYgdmy5wXw=",
+        "lastModified": 1774244481,
+        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "812b3986fd1568f7a858f97fcf425ad996ba7d25",
+        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773886077,
-        "narHash": "sha256-A6jO6OEESZJ0+44Z0LmhnUi32VRfb8rdg/ralEamWDU=",
+        "lastModified": 1774231921,
+        "narHash": "sha256-yueFy5kx0rvtVwkXSIitDyz/HmsfHsE8AJT9YS+l6Bs=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "cb48be23fc3d90cdd5a4ab6a27a7536481a4cf63",
+        "rev": "510e0e01bf343151baa28020fd0ed08b8aa649cb",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774048185,
-        "narHash": "sha256-OGKxauB88rUdPv9ByZlY2M1H0iFMerg3Ln4vXx8u0Iw=",
+        "lastModified": 1774220983,
+        "narHash": "sha256-CCCQovLCFNwlOhiH49tFJPi4Mb54hV7jKFiDBcz8Yhg=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "307ae67495ad02871c8e5add41fd9e7b85fec167",
+        "rev": "55c6f66dc7e17cf547956c5fd10cb122c1fa4c90",
         "type": "github"
       },
       "original": {

From b5a59d75ef8491efa75a939528c35e4314f8b447 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 25 Mar 2026 22:15:58 -0700
Subject: [PATCH 699/847] arr: fix naming?

---
 flake.lock            |  8 ++++----
 services/arr/init.nix | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4dbdcfe..af52f2f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773596707,
-        "narHash": "sha256-EiAfZo8iTgCgMbJihNnwZGISCVb3Ue/5uU1XtF9CfkA=",
+        "lastModified": 1774458847,
+        "narHash": "sha256-u0Gs2XBFd1tStEfTXqXJ/RpsDWrGUu5NfdWH/z98LUk=",
         "ref": "refs/heads/main",
-        "rev": "ef0da7582c830910620114ce02b4041f32993a53",
-        "revCount": 5,
+        "rev": "7f395bd9b3e6af2de6b17d9383bd621ad3849f1c",
+        "revCount": 6,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
diff --git a/services/arr/init.nix b/services/arr/init.nix
index d52a989..f6ff386 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -60,6 +60,18 @@
       dataDir = service_configs.sonarr.dataDir;
       healthChecks = true;
       rootFolders = [ service_configs.media.tvDir ];
+      naming = {
+        renameEpisodes = true;
+        replaceIllegalCharacters = true;
+        standardEpisodeFormat =
+          "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
+        dailyEpisodeFormat =
+          "{Series Title} - {Air-Date} - {Episode Title} {Quality Full}";
+        animeEpisodeFormat =
+          "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
+        seasonFolderFormat = "Season {season}";
+        seriesFolderFormat = "{Series Title}";
+      };
       downloadClients = [
         {
           name = "qBittorrent";
@@ -83,6 +95,12 @@
       dataDir = service_configs.radarr.dataDir;
       healthChecks = true;
       rootFolders = [ service_configs.media.moviesDir ];
+      naming = {
+        renameMovies = true;
+        replaceIllegalCharacters = true;
+        standardMovieFormat = "{Movie Title} ({Release Year}) {Quality Full}";
+        movieFolderFormat = "{Movie Title} ({Release Year})";
+      };
       downloadClients = [
         {
           name = "qBittorrent";

From afd3e93328f8658c9c70895de593e044db3bb1d4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 26 Mar 2026 10:00:23 -0700
Subject: [PATCH 700/847] update

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index af52f2f..4b96111 100644
--- a/flake.lock
+++ b/flake.lock
@@ -47,11 +47,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1772080396,
-        "narHash": "sha256-84W9UNtSk9DNMh43WBkOjpkbfODlmg+RDi854PnNgLE=",
+        "lastModified": 1773189535,
+        "narHash": "sha256-E1G/Or6MWeP+L6mpQ0iTFLpzSzlpGrITfU2220Gq47g=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "8525580bc0316c39dbfa18bd09a1331e98c9e463",
+        "rev": "6fa2fb4cf4a89ba49fc9dd5a3eb6cde99d388269",
         "type": "github"
       },
       "original": {
@@ -263,11 +263,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1773344150,
-        "narHash": "sha256-JSsXufJy2zdg5XS5pRGlkwF1dqN+sWPmCgrvJsnhEzg=",
+        "lastModified": 1774433292,
+        "narHash": "sha256-wFeQPKZfSSVv7BAYpRK31UBy1V9/pPJ9/hLaLJIgIp0=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "d21013305ef39e1d9d2d06b161c3785ffad82281",
+        "rev": "1e7ee8915a87c0675aa4532d70eb1a26e9b94cd8",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1774060651,
-        "narHash": "sha256-sZiam+rmNcOZGnlbnqDD9oTwfMdQUM+uQmFqqSoe194=",
+        "lastModified": 1774407052,
+        "narHash": "sha256-rUkn7Bo3PAlpcZl8+0FDsTwFyDwvS4xwMT9+RJ+XJoE=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "46727bd27d32d63069ed26a690554373ae2b4702",
+        "rev": "70daf1f48885f0b4a70797076cd2ff5d9139b46e",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774018263,
-        "narHash": "sha256-HHYEwK1A22aSaxv2ibhMMkKvrDGKGlA/qObG4smrSqc=",
+        "lastModified": 1774465523,
+        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2d4b4717b2534fad5c715968c1cece04a172b365",
+        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1774244481,
-        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
+        "lastModified": 1774388614,
+        "narHash": "sha256-tFwzTI0DdDzovdE9+Ras6CUss0yn8P9XV4Ja6RjA+nU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
+        "rev": "1073dad219cb244572b74da2b20c7fe39cb3fa9e",
         "type": "github"
       },
       "original": {
@@ -373,11 +373,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772024342,
-        "narHash": "sha256-+eXlIc4/7dE6EcPs9a2DaSY3fTA9AE526hGqkNID3Wg=",
+        "lastModified": 1772893680,
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "6e34e97ed9788b17796ee43ccdbaf871a5c2b476",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
         "type": "github"
       },
       "original": {
@@ -415,11 +415,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772334676,
-        "narHash": "sha256-Jrc0J3AH+iNJDlUze3+FJZv2R0BZnhANFnD52V4kyvI=",
+        "lastModified": 1773544328,
+        "narHash": "sha256-Iv+qez54LAz+isij4APBk31VWA//Go81hwFOXr5iWTw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9879be11f30fd3bbf848e653a7f991549e8973b5",
+        "rev": "4f977d776793c8bfbfdd7eca7835847ccc48874e",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774231921,
-        "narHash": "sha256-yueFy5kx0rvtVwkXSIitDyz/HmsfHsE8AJT9YS+l6Bs=",
+        "lastModified": 1774517972,
+        "narHash": "sha256-oPIVzGlMmfWuJlRbr87yU3cnV8NxtwTG92GqpQczlkw=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "510e0e01bf343151baa28020fd0ed08b8aa649cb",
+        "rev": "0ddba2fbd72bb60f8b35b7de1ad67590f454d402",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774220983,
-        "narHash": "sha256-CCCQovLCFNwlOhiH49tFJPi4Mb54hV7jKFiDBcz8Yhg=",
+        "lastModified": 1774480183,
+        "narHash": "sha256-MCHf8kXli88XoVFfiA5E3iR4LPrUDp8efoQLNqP/Il8=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "55c6f66dc7e17cf547956c5fd10cb122c1fa4c90",
+        "rev": "0b178b413075b716cce75b8eedc15535d669b0c8",
         "type": "github"
       },
       "original": {

From 96c6171952be73bbe06a286f291fc6a1e3eb9964 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 10:38:13 -0700
Subject: [PATCH 701/847] fmt

---
 services/arr/init.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/services/arr/init.nix b/services/arr/init.nix
index f6ff386..0f7204a 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -63,12 +63,9 @@
       naming = {
         renameEpisodes = true;
         replaceIllegalCharacters = true;
-        standardEpisodeFormat =
-          "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
-        dailyEpisodeFormat =
-          "{Series Title} - {Air-Date} - {Episode Title} {Quality Full}";
-        animeEpisodeFormat =
-          "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
+        standardEpisodeFormat = "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
+        dailyEpisodeFormat = "{Series Title} - {Air-Date} - {Episode Title} {Quality Full}";
+        animeEpisodeFormat = "{Series Title} - S{season:00}E{episode:00} - {Episode Title} {Quality Full}";
         seasonFolderFormat = "Season {season}";
         seriesFolderFormat = "{Series Title}";
       };

From cc8761a304cc75a2df3155966cb4e94298941faf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 18:13:21 -0700
Subject: [PATCH 702/847] torrent-audit: init

---
 configuration.nix              |   1 +
 services/arr/torrent-audit.nix |  40 ++++
 services/arr/torrent-audit.py  | 333 ++++++++++++++++++++++++++
 tests/tests.nix                |   3 +
 tests/torrent-audit.nix        | 422 +++++++++++++++++++++++++++++++++
 5 files changed, 799 insertions(+)
 create mode 100644 services/arr/torrent-audit.nix
 create mode 100644 services/arr/torrent-audit.py
 create mode 100644 tests/torrent-audit.nix

diff --git a/configuration.nix b/configuration.nix
index 26602a5..515fa79 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -40,6 +40,7 @@
     ./services/arr/jellyseerr.nix
     ./services/arr/recyclarr.nix
     ./services/arr/arr-search.nix
+    ./services/arr/torrent-audit.nix
     ./services/arr/init.nix
 
     ./services/soulseek.nix
diff --git a/services/arr/torrent-audit.nix b/services/arr/torrent-audit.nix
new file mode 100644
index 0000000..9217074
--- /dev/null
+++ b/services/arr/torrent-audit.nix
@@ -0,0 +1,40 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  ...
+}:
+{
+  systemd.services.torrent-audit = {
+    description = "Audit qBittorrent for unmanaged and abandoned upgrade torrents";
+    after = [
+      "network-online.target"
+      "sonarr.service"
+      "radarr.service"
+      "qbittorrent.service"
+    ];
+    wants = [ "network-online.target" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "+${
+        pkgs.python3.withPackages (
+          ps: with ps; [
+            pyarr
+            qbittorrent-api
+          ]
+        )
+      }/bin/python ${./torrent-audit.py}";
+      TimeoutSec = 300;
+    };
+
+    environment = {
+      QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.torrent.port}";
+      RADARR_URL = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
+      RADARR_CONFIG = "${service_configs.radarr.dataDir}/config.xml";
+      SONARR_URL = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
+      SONARR_CONFIG = "${service_configs.sonarr.dataDir}/config.xml";
+      CATEGORIES = "tvshows,movies,anime";
+    };
+  };
+}
diff --git a/services/arr/torrent-audit.py b/services/arr/torrent-audit.py
new file mode 100644
index 0000000..0d0830f
--- /dev/null
+++ b/services/arr/torrent-audit.py
@@ -0,0 +1,333 @@
+#!/usr/bin/env python3
+"""
+Audit qBittorrent torrents against Radarr/Sonarr.
+
+Reports two categories:
+
+  UNMANAGED  -- torrents in qBittorrent that no *arr service has ever touched.
+                These were added manually or by some other tool.
+
+  ABANDONED  -- torrents that *arr grabbed but later replaced with a better
+                version.  The old torrent is still seeding while the library
+                points to the new one.
+
+Abandoned detection uses API cross-referencing (not filesystem hardlinks) and
+verifies against the *arr's current file state:
+
+  1. HISTORY   -- group imports by content unit (movieId / episodeId); the
+                  most recent import is the keeper, older ones are candidates.
+  2. CURRENT   -- verify against the *arr's active file mapping.
+"""
+
+import logging
+import os
+import sys
+from collections import defaultdict
+from xml.etree import ElementTree
+
+import qbittorrentapi
+from pyarr import RadarrAPI, SonarrAPI
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s %(levelname)s %(message)s",
+    stream=sys.stderr,
+)
+log = logging.getLogger(__name__)
+
+
+def get_api_key(config_path: str) -> str:
+    tree = ElementTree.parse(config_path)
+    return tree.find(".//ApiKey").text
+
+
+def paginate(arr_client, endpoint: str, page_size: int = 1000):
+    method = getattr(arr_client, f"get_{endpoint}")
+    page = 1
+    while True:
+        data = method(page=page, page_size=page_size)
+        yield from data["records"]
+        if page * page_size >= data["totalRecords"]:
+            break
+        page += 1
+
+
+def get_qbit_torrents(qbit_client, category: str) -> dict[str, dict]:
+    torrents = qbit_client.torrents_info(category=category)
+    return {t["hash"].upper(): t for t in torrents}
+
+
+def gib(size_bytes: int) -> str:
+    return f"{size_bytes / 1073741824:.1f}"
+
+
+# ---------------------------------------------------------------------------
+# Collect all known hashes from *arr history + queue
+# ---------------------------------------------------------------------------
+
+
+def collect_all_known_hashes(arr_client, page_size: int = 1000) -> set[str]:
+    hashes = set()
+    for endpoint in ("queue", "history"):
+        for rec in paginate(arr_client, endpoint, page_size):
+            did = (rec.get("downloadId") or "").upper()
+            if did:
+                hashes.add(did)
+    return hashes
+
+
+# ---------------------------------------------------------------------------
+# Unmanaged: torrents with hashes not in any *arr history/queue
+# ---------------------------------------------------------------------------
+
+
+def find_unmanaged(qbit_torrents: dict, known_hashes: set) -> list[dict]:
+    results = []
+    for uhash, torrent in qbit_torrents.items():
+        if uhash not in known_hashes:
+            results.append(torrent)
+    return sorted(results, key=lambda t: t["added_on"])
+
+
+# ---------------------------------------------------------------------------
+# Abandoned movies: group imports by movieId, older = abandoned
+# ---------------------------------------------------------------------------
+
+
+def find_movie_abandoned(radarr, qbit_movies):
+    log.info("Analysing Radarr import history ...")
+    imports_by_movie = defaultdict(list)
+    for rec in paginate(radarr, "history"):
+        if rec.get("eventType") != "downloadFolderImported":
+            continue
+        did = (rec.get("downloadId") or "").upper()
+        if not did:
+            continue
+        mid = rec.get("movieId")
+        if not mid:
+            continue
+        imports_by_movie[mid].append(
+            {"downloadId": did, "date": rec["date"]}
+        )
+
+    # Identify keeper (latest) and abandoned (older) hashes per movie.
+    abandoned_hashes: set[str] = set()
+    keeper_hashes: set[str] = set()
+    hash_to_movie: dict[str, int] = {}
+
+    for mid, events in imports_by_movie.items():
+        ordered = sorted(events, key=lambda e: e["date"])
+        keeper_hashes.add(ordered[-1]["downloadId"])
+        for e in ordered[:-1]:
+            abandoned_hashes.add(e["downloadId"])
+            hash_to_movie[e["downloadId"]] = mid
+
+    # A hash that is a keeper for *any* movie must not be deleted.
+    abandoned_hashes -= keeper_hashes
+
+    log.info("Fetching Radarr current movie state ...")
+    radarr_movies = {m["id"]: m for m in radarr.get_movie()}
+
+    results = []
+    for ahash in abandoned_hashes:
+        torrent = qbit_movies.get(ahash)
+        if torrent is None:
+            continue
+
+        mid = hash_to_movie.get(ahash)
+        movie = radarr_movies.get(mid) if mid else None
+        mf = (movie or {}).get("movieFile") or {}
+
+        current_quality = (mf.get("quality") or {}).get("quality", {}).get("name", "?")
+        current_size = mf.get("size", 0)
+
+        status = "SAFE"
+        notes = []
+
+        if not movie or not movie.get("hasFile"):
+            notes.append("movie removed or has no file in Radarr")
+            status = "REVIEW"
+        elif torrent["size"] > current_size * 1.05:
+            notes.append(
+                f"abandoned is larger than current "
+                f"({gib(torrent['size'])} > {gib(current_size)} GiB)"
+            )
+            status = "REVIEW"
+
+        results.append(
+            {
+                "name": torrent["name"],
+                "size": torrent["size"],
+                "state": torrent["state"],
+                "hash": torrent["hash"],
+                "added_on": torrent["added_on"],
+                "status": status,
+                "notes": notes,
+                "current_quality": current_quality,
+            }
+        )
+
+    return sorted(results, key=lambda r: r["added_on"])
+
+
+# ---------------------------------------------------------------------------
+# Abandoned TV: group imports by episodeId, a hash is abandoned only when
+# it is NOT the latest import for ANY episode it covers.
+# ---------------------------------------------------------------------------
+
+
+def find_tv_abandoned(sonarr, qbit_tvshows):
+    log.info("Analysing Sonarr import history ...")
+    episode_imports = defaultdict(list)
+    all_download_ids: set[str] = set()
+    hash_to_series: dict[str, int] = {}
+
+    for rec in paginate(sonarr, "history"):
+        if rec.get("eventType") != "downloadFolderImported":
+            continue
+        did = (rec.get("downloadId") or "").upper()
+        eid = rec.get("episodeId")
+        if not did or not eid:
+            continue
+        episode_imports[eid].append({"downloadId": did, "date": rec["date"]})
+        all_download_ids.add(did)
+        sid = rec.get("seriesId")
+        if sid:
+            hash_to_series[did] = sid
+
+    # A hash is "active" if it is the latest import for *any* episode.
+    active_hashes: set[str] = set()
+    for events in episode_imports.values():
+        latest = max(events, key=lambda e: e["date"])
+        active_hashes.add(latest["downloadId"])
+
+    abandoned_hashes = all_download_ids - active_hashes
+
+    log.info("Fetching Sonarr current series state ...")
+    current_series = {s["id"] for s in sonarr.get_series()}
+
+    results = []
+    for ahash in abandoned_hashes:
+        torrent = qbit_tvshows.get(ahash)
+        if torrent is None:
+            continue
+
+        status = "SAFE"
+        notes = []
+        sid = hash_to_series.get(ahash)
+        if sid and sid not in current_series:
+            notes.append("series removed from Sonarr")
+            status = "REVIEW"
+
+        results.append(
+            {
+                "name": torrent["name"],
+                "size": torrent["size"],
+                "state": torrent["state"],
+                "hash": torrent["hash"],
+                "added_on": torrent["added_on"],
+                "status": status,
+                "notes": notes,
+            }
+        )
+
+    return sorted(results, key=lambda r: r["added_on"])
+
+
+# ---------------------------------------------------------------------------
+# Report
+# ---------------------------------------------------------------------------
+
+
+def print_section(torrents, show_status=False):
+    if not torrents:
+        print("  (none)\n")
+        return
+
+    total_size = sum(t["size"] for t in torrents)
+    for t in torrents:
+        prefix = f"[{t['status']:6s}]  " if show_status else "  "
+        print(f"  {prefix}{t['name']}")
+        extra = f"{gib(t['size'])} GiB | {t['state']}"
+        print(f"  {' ' * len(prefix)}{extra}")
+        for note in t.get("notes", []):
+            print(f"  {' ' * len(prefix)}** {note}")
+        print()
+
+    if show_status:
+        safe = [t for t in torrents if t["status"] == "SAFE"]
+        review = [t for t in torrents if t["status"] == "REVIEW"]
+        print(
+            f"  total={len(torrents)} ({gib(total_size)} GiB) | "
+            f"safe={len(safe)} | review={len(review)}"
+        )
+    else:
+        print(f"  total={len(torrents)} ({gib(total_size)} GiB)")
+    print()
+
+
+def main():
+    qbit_url = os.environ["QBITTORRENT_URL"]
+    radarr_url = os.environ["RADARR_URL"]
+    radarr_config = os.environ["RADARR_CONFIG"]
+    sonarr_url = os.environ["SONARR_URL"]
+    sonarr_config = os.environ["SONARR_CONFIG"]
+    categories = os.environ.get("CATEGORIES", "tvshows,movies,anime").split(",")
+
+    radarr_key = get_api_key(radarr_config)
+    sonarr_key = get_api_key(sonarr_config)
+
+    radarr = RadarrAPI(radarr_url, radarr_key)
+    sonarr = SonarrAPI(sonarr_url, sonarr_key)
+    qbit = qbittorrentapi.Client(host=qbit_url)
+
+    log.info("Getting qBittorrent state ...")
+    qbit_torrents = {cat: get_qbit_torrents(qbit, cat) for cat in categories}
+    for cat, torrents in qbit_torrents.items():
+        log.info("  %s: %d torrents", cat, len(torrents))
+
+    log.info("Collecting known hashes from Sonarr ...")
+    sonarr_hashes = collect_all_known_hashes(sonarr)
+    log.info("  %d unique hashes", len(sonarr_hashes))
+
+    log.info("Collecting known hashes from Radarr ...")
+    radarr_hashes = collect_all_known_hashes(radarr)
+    log.info("  %d unique hashes", len(radarr_hashes))
+
+    all_known = sonarr_hashes | radarr_hashes
+
+    # -- Unmanaged --
+    print("\n========== UNMANAGED TORRENTS ==========\n")
+    for cat in categories:
+        unmanaged = find_unmanaged(qbit_torrents[cat], all_known)
+        print(f"--- {cat} ({len(unmanaged)} unmanaged / {len(qbit_torrents[cat])} total) ---\n")
+        print_section(unmanaged)
+
+    # -- Abandoned --
+    print("========== ABANDONED UPGRADE LEFTOVERS ==========\n")
+
+    movie_abandoned = find_movie_abandoned(
+        radarr, qbit_torrents.get("movies", {})
+    )
+    print(f"--- movies ({len(movie_abandoned)} abandoned) ---\n")
+    print_section(movie_abandoned, show_status=True)
+
+    tv_abandoned = find_tv_abandoned(
+        sonarr, qbit_torrents.get("tvshows", {})
+    )
+    print(f"--- tvshows ({len(tv_abandoned)} abandoned) ---\n")
+    print_section(tv_abandoned, show_status=True)
+
+    # -- Summary --
+    all_abandoned = movie_abandoned + tv_abandoned
+    safe = [t for t in all_abandoned if t["status"] == "SAFE"]
+
+    print("=" * 50)
+    print(
+        f"ABANDONED: {len(all_abandoned)} total ({len(safe)} safe to delete)"
+    )
+    print(f"SAFE TO RECLAIM: {gib(sum(t['size'] for t in safe))} GiB")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/tests.nix b/tests/tests.nix
index 8a7178d..27684a2 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -24,4 +24,7 @@ in
 
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
+
+  # torrent audit test
+  torrentAuditTest = handleTest ./torrent-audit.nix;
 }
diff --git a/tests/torrent-audit.nix b/tests/torrent-audit.nix
new file mode 100644
index 0000000..0c9e014
--- /dev/null
+++ b/tests/torrent-audit.nix
@@ -0,0 +1,422 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  qbitPort = 18080;
+  radarrPort = 17878;
+  sonarrPort = 18989;
+
+  radarrConfig = pkgs.writeText "radarr-config.xml" ''
+    <Config><ApiKey>test-radarr-key</ApiKey></Config>
+  '';
+
+  sonarrConfig = pkgs.writeText "sonarr-config.xml" ''
+    <Config><ApiKey>test-sonarr-key</ApiKey></Config>
+  '';
+
+  python = "${
+    pkgs.python3.withPackages (ps: [
+      ps.pyarr
+      ps.qbittorrent-api
+    ])
+  }/bin/python3";
+  auditScript = ../services/arr/torrent-audit.py;
+
+  # Single mock API server script -- accepts SERVICE and PORT as CLI args.
+  # Routes responses based on SERVICE type (qbit / radarr / sonarr).
+  mockScript = pkgs.writeText "mock-api-server.py" ''
+    import json
+    import sys
+    from http.server import HTTPServer, BaseHTTPRequestHandler
+    from urllib.parse import urlparse, parse_qs
+
+    SERVICE = sys.argv[1]
+    PORT = int(sys.argv[2])
+
+    # ── Hash constants (uppercase, 40 hex chars) ──────────────────────────
+    # Movies
+    UNMANAGED_MOV   = "A" * 38 + "01"
+    MANAGED_MOV     = "A" * 38 + "02"
+    OLD_MOV         = "A" * 38 + "03"  # movieId=2, older import → abandoned SAFE
+    NEW_MOV         = "A" * 38 + "04"  # movieId=2, newer import → keeper
+    KEEPER_CROSS    = "A" * 38 + "05"  # keeper for movieId=3, old for movieId=4
+    KEEPER3_OLD     = "A" * 38 + "0B"  # movieId=3, older import (not in qBit)
+    KEEPER4_NEW     = "A" * 38 + "06"  # movieId=4, newer import → keeper
+    REMOVED_OLD     = "A" * 38 + "07"  # movieId=5, older import (movie removed)
+    REMOVED_NEW     = "A" * 38 + "08"  # movieId=5, newer import → keeper (not in qBit)
+    LARGER_OLD      = "A" * 38 + "09"  # movieId=6, older import (larger than current)
+    LARGER_NEW      = "A" * 38 + "0A"  # movieId=6, newer import → keeper
+    SINGLE_CROSS    = "A" * 38 + "0C"  # movieId=7 single import AND older import for movieId=8
+    SINGLE8_NEW     = "A" * 38 + "0D"  # movieId=8, newer import → keeper (not in qBit)
+    QUEUED_MOV      = "A" * 38 + "0E"  # in Radarr queue, not in history
+
+    # TV
+    UNMANAGED_TV    = "B" * 38 + "01"
+    MANAGED_TV      = "B" * 38 + "02"  # episodeId=100, single import
+    OLD_TV          = "B" * 38 + "03"  # episodeId=200, older import → abandoned SAFE
+    NEW_TV          = "B" * 38 + "04"  # episodeId=200, newer import → active
+    SEASON_PACK     = "B" * 38 + "05"  # episodeIds 300,301,302 (still active for 301,302)
+    REPACK          = "B" * 38 + "06"  # episodeId=300, newer import → active
+    REMOVED_TV      = "B" * 38 + "07"  # episodeId=400, older import (series removed)
+    REMOVED_TV_NEW  = "B" * 38 + "08"  # episodeId=400, newer import (not in qBit)
+
+    def make_torrent(h, name, size, added_on, state="uploading"):
+        return {
+            "hash": h.lower(),
+            "name": name,
+            "size": size,
+            "state": state,
+            "added_on": added_on,
+            "content_path": f"/downloads/{name}",
+        }
+
+    QBIT_DATA = {
+        "movies": [
+            make_torrent(UNMANAGED_MOV,  "Unmanaged.Movie.2024",      5_000_000_000, 1704067200),
+            make_torrent(MANAGED_MOV,    "Managed.Movie.2024",         4_000_000_000, 1704067201),
+            make_torrent(OLD_MOV,        "Old.Movie.Quality.2024",     3_000_000_000, 1704067202),
+            make_torrent(NEW_MOV,        "New.Movie.Quality.2024",     6_000_000_000, 1704067203),
+            make_torrent(KEEPER_CROSS,   "CrossRef.Movie.2024",        4_500_000_000, 1704067204),
+            make_torrent(REMOVED_OLD,    "Removed.Movie.2024",         3_500_000_000, 1704067205),
+            make_torrent(LARGER_OLD,     "Larger.Movie.2024",         10_737_418_240, 1704067206),
+            make_torrent(SINGLE_CROSS,   "SingleCross.Movie.2024",    4_000_000_000, 1704067207),
+            make_torrent(QUEUED_MOV,     "Queued.Movie.2024",         2_000_000_000, 1704067208),
+        ],
+        "tvshows": [
+            make_torrent(UNMANAGED_TV,   "Unmanaged.Show.S01E01",     1_000_000_000, 1704067200),
+            make_torrent(MANAGED_TV,     "Managed.Show.S01E01",         800_000_000, 1704067201),
+            make_torrent(OLD_TV,         "Old.Show.S01E01",              700_000_000, 1704067202),
+            make_torrent(NEW_TV,         "New.Show.S01E01",            1_200_000_000, 1704067203),
+            make_torrent(SEASON_PACK,    "Season.Pack.S02",            5_000_000_000, 1704067204),
+            make_torrent(REMOVED_TV,    "Removed.Show.S01E01",         900_000_000, 1704067205),
+        ],
+    }
+
+    # ── Radarr mock data ──────────────────────────────────────────────────
+    RADARR_HISTORY = [
+        {"movieId": 1, "downloadId": MANAGED_MOV,  "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 2, "downloadId": OLD_MOV,       "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 2, "downloadId": NEW_MOV,       "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        {"movieId": 3, "downloadId": KEEPER3_OLD,   "eventType": "downloadFolderImported", "date": "2023-01-01T00:00:00Z"},
+        {"movieId": 3, "downloadId": KEEPER_CROSS,  "eventType": "downloadFolderImported", "date": "2024-03-01T00:00:00Z"},
+        {"movieId": 4, "downloadId": KEEPER_CROSS,  "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 4, "downloadId": KEEPER4_NEW,   "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        {"movieId": 5, "downloadId": REMOVED_OLD,   "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 5, "downloadId": REMOVED_NEW,   "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        {"movieId": 6, "downloadId": LARGER_OLD,    "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 6, "downloadId": LARGER_NEW,    "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        # Non-import event (should be ignored by abandoned detection)
+        {"movieId": 2, "downloadId": NEW_MOV,       "eventType": "grabbed",                "date": "2024-05-31T00:00:00Z"},
+        # Single-import keeper test (Fix 13): SINGLE_CROSS is only import for movieId=7
+        # AND an older import for movieId=8 (SINGLE8_NEW is newer for movieId=8)
+        {"movieId": 7, "downloadId": SINGLE_CROSS,  "eventType": "downloadFolderImported", "date": "2024-03-01T00:00:00Z"},
+        {"movieId": 8, "downloadId": SINGLE_CROSS,  "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"movieId": 8, "downloadId": SINGLE8_NEW,   "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+    ]
+
+    RADARR_MOVIES = [
+        {"id": 1, "hasFile": True, "movieFile": {"size": 4_000_000_000, "quality": {"quality": {"name": "Bluray-1080p"}}}},
+        {"id": 2, "hasFile": True, "movieFile": {"size": 6_000_000_000, "quality": {"quality": {"name": "Remux-1080p"}}}},
+        {"id": 3, "hasFile": True, "movieFile": {"size": 4_500_000_000, "quality": {"quality": {"name": "Bluray-1080p"}}}},
+        {"id": 4, "hasFile": True, "movieFile": {"size": 5_000_000_000, "quality": {"quality": {"name": "Remux-1080p"}}}},
+        # id=5 intentionally MISSING -- movie removed from Radarr
+        {"id": 6, "hasFile": True, "movieFile": {"size": 5_368_709_120, "quality": {"quality": {"name": "Bluray-720p"}}}},
+        {"id": 7, "hasFile": True, "movieFile": {"size": 4_000_000_000, "quality": {"quality": {"name": "Bluray-1080p"}}}},
+        {"id": 8, "hasFile": True, "movieFile": {"size": 5_000_000_000, "quality": {"quality": {"name": "Remux-1080p"}}}},
+    ]
+
+    # ── Sonarr mock data ──────────────────────────────────────────────────
+    # Page 1 records (returned on page=1, with totalRecords=1001 to force pagination)
+    SONARR_HISTORY_PAGE1 = [
+        {"episodeId": 100, "seriesId": 1, "downloadId": MANAGED_TV,   "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"episodeId": 200, "seriesId": 1, "downloadId": OLD_TV,        "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"episodeId": 200, "seriesId": 1, "downloadId": NEW_TV,        "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        # Season pack covers 3 episodes
+        {"episodeId": 300, "seriesId": 2, "downloadId": SEASON_PACK,   "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"episodeId": 301, "seriesId": 2, "downloadId": SEASON_PACK,   "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"episodeId": 302, "seriesId": 2, "downloadId": SEASON_PACK,   "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        # Non-import event (should be ignored)
+        {"episodeId": 200, "seriesId": 1, "downloadId": NEW_TV,        "eventType": "grabbed",                "date": "2024-05-31T00:00:00Z"},
+    ]
+    # Page 2 records (critical data only available via pagination)
+    SONARR_HISTORY_PAGE2 = [
+        # Episode 300 re-imported from a repack -- but 301,302 still reference SEASON_PACK
+        {"episodeId": 300, "seriesId": 2, "downloadId": REPACK,        "eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+        # Removed series scenario
+        {"episodeId": 400, "seriesId": 99, "downloadId": REMOVED_TV,    "eventType": "downloadFolderImported", "date": "2024-01-01T00:00:00Z"},
+        {"episodeId": 400, "seriesId": 99, "downloadId": REMOVED_TV_NEW,"eventType": "downloadFolderImported", "date": "2024-06-01T00:00:00Z"},
+    ]
+    SONARR_HISTORY_ALL = SONARR_HISTORY_PAGE1 + SONARR_HISTORY_PAGE2
+
+    # seriesId=99 intentionally MISSING -- series removed from Sonarr
+    SONARR_SERIES = [
+        {"id": 1, "title": "Managed Show"},
+        {"id": 2, "title": "Season Pack Show"},
+    ]
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_POST(self):
+            if self.path.startswith("/api/v2/auth/login"):
+                self.send_response(200)
+                self.send_header("Content-Type", "text/plain")
+                self.send_header("Set-Cookie", "SID=test; path=/")
+                self.end_headers()
+                self.wfile.write(b"Ok.")
+            else:
+                self._handle_json()
+
+        def do_GET(self):
+            self._handle_json()
+
+        def _handle_json(self):
+            parsed = urlparse(self.path)
+            path = parsed.path
+            params = parse_qs(parsed.query)
+
+            content_length = int(self.headers.get("Content-Length", 0))
+            if content_length:
+                body = self.rfile.read(content_length).decode()
+                params.update(parse_qs(body))
+
+            response = self._route(path, params)
+
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(json.dumps(response).encode())
+
+        def _route(self, path, params):
+            if SERVICE == "qbit":
+                category = params.get("category", [""])[0]
+                return QBIT_DATA.get(category, [])
+
+            elif SERVICE == "radarr":
+                if path == "/api/v3/history":
+                    return {"records": RADARR_HISTORY, "totalRecords": len(RADARR_HISTORY)}
+                elif path == "/api/v3/queue":
+                    return {"records": [{"downloadId": QUEUED_MOV}], "totalRecords": 1}
+                elif path == "/api/v3/movie":
+                    return RADARR_MOVIES
+                return {}
+
+            elif SERVICE == "sonarr":
+                if path == "/api/v3/history":
+                    page = int(params.get("page", ["1"])[0])
+                    if page == 1:
+                        return {"records": SONARR_HISTORY_PAGE1, "totalRecords": 1001}
+                    else:
+                        return {"records": SONARR_HISTORY_PAGE2, "totalRecords": 1001}
+                elif path == "/api/v3/queue":
+                    return {"records": [], "totalRecords": 0}
+                elif path == "/api/v3/series":
+                    return SONARR_SERIES
+                return {}
+
+            return {}
+
+        def log_message(self, fmt, *args):
+            pass
+
+    HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
+  '';
+in
+pkgs.testers.runNixOSTest {
+  name = "torrent-audit";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+
+      systemd.services.mock-qbittorrent = {
+        description = "Mock qBittorrent API";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.python3}/bin/python3 ${mockScript} qbit ${toString qbitPort}";
+          Type = "simple";
+        };
+      };
+
+      systemd.services.mock-radarr = {
+        description = "Mock Radarr API";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.python3}/bin/python3 ${mockScript} radarr ${toString radarrPort}";
+          Type = "simple";
+        };
+      };
+
+      systemd.services.mock-sonarr = {
+        description = "Mock Sonarr API";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.python3}/bin/python3 ${mockScript} sonarr ${toString sonarrPort}";
+          Type = "simple";
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    # Wait for all mock services to be responsive
+    machine.wait_for_unit("mock-qbittorrent.service")
+    machine.wait_for_unit("mock-radarr.service")
+    machine.wait_for_unit("mock-sonarr.service")
+    machine.wait_until_succeeds(
+        "curl -sf http://localhost:${toString qbitPort}/api/v2/torrents/info?category=movies",
+        timeout=30,
+    )
+    machine.wait_until_succeeds(
+        "curl -sf http://localhost:${toString radarrPort}/api/v3/movie",
+        timeout=30,
+    )
+    machine.wait_until_succeeds(
+        "curl -sf http://localhost:${toString sonarrPort}/api/v3/queue",
+        timeout=30,
+    )
+
+    # Run the audit script and capture stdout
+    output = machine.succeed(
+        "QBITTORRENT_URL=http://localhost:${toString qbitPort} "
+        "RADARR_URL=http://localhost:${toString radarrPort} "
+        "RADARR_CONFIG=${radarrConfig} "
+        "SONARR_URL=http://localhost:${toString sonarrPort} "
+        "SONARR_CONFIG=${sonarrConfig} "
+        "CATEGORIES=movies,tvshows,anime "
+        "${python} ${auditScript}"
+    )
+
+    print("=== SCRIPT OUTPUT ===")
+    print(output)
+    print("=== END OUTPUT ===")
+
+    # Fix 10: Assert section heading exists before splitting
+    assert "ABANDONED UPGRADE LEFTOVERS" in output, \
+        "Output must contain ABANDONED UPGRADE LEFTOVERS heading"
+
+    # Split output into sections for targeted assertions
+    unmanaged_section = output.split("ABANDONED UPGRADE LEFTOVERS")[0]
+    abandoned_section = output.split("ABANDONED UPGRADE LEFTOVERS")[1]
+
+    # Helper: find a torrent name line and check nearby lines (within 3) for a note
+    def assert_note_near(section, torrent_name, note_text):
+        lines = section.splitlines()
+        found_idx = None
+        for i, line in enumerate(lines):
+            if torrent_name in line:
+                found_idx = i
+                break
+        assert found_idx is not None, f"{torrent_name} not found in section"
+        nearby = "\n".join(lines[max(0, found_idx):found_idx + 4])
+        assert note_text in nearby, \
+            f"Expected '{note_text}' near '{torrent_name}', got:\n{nearby}"
+
+    with subtest("Detects unmanaged movie torrent"):
+        assert "Unmanaged.Movie.2024" in unmanaged_section, \
+            "Should detect unmanaged movie"
+        assert "1 unmanaged / 9 total" in unmanaged_section, \
+            "Should show 1 unmanaged movie out of 9"
+
+    with subtest("Detects unmanaged TV torrent"):
+        assert "Unmanaged.Show.S01E01" in unmanaged_section, \
+            "Should detect unmanaged TV show"
+        assert "1 unmanaged / 6 total" in unmanaged_section, \
+            "Should show 1 unmanaged TV show out of 6"
+
+    with subtest("Empty category shows zero counts"):
+        assert "0 unmanaged / 0 total" in unmanaged_section, \
+            "anime category should show 0 unmanaged / 0 total"
+
+    with subtest("Managed torrents are NOT listed as unmanaged"):
+        assert "Managed.Movie.2024" not in unmanaged_section, \
+            "Managed movie should not appear in unmanaged section"
+        assert "Managed.Show.S01E01" not in unmanaged_section, \
+            "Managed TV show should not appear in unmanaged section"
+
+    with subtest("Queue-known hash is NOT listed as unmanaged"):
+        assert "Queued.Movie.2024" not in unmanaged_section, \
+            "Torrent in Radarr queue should not appear as unmanaged"
+
+    with subtest("Detects abandoned movie upgrade as SAFE"):
+        assert "Old.Movie.Quality.2024" in abandoned_section, \
+            "Should detect abandoned movie"
+        for line in abandoned_section.splitlines():
+            if "Old.Movie.Quality.2024" in line:
+                assert "SAFE" in line, f"Old movie should be SAFE, got: {line}"
+                break
+
+    with subtest("Detects abandoned TV episode as SAFE"):
+        assert "Old.Show.S01E01" in abandoned_section, \
+            "Should detect abandoned TV episode"
+        for line in abandoned_section.splitlines():
+            if "Old.Show.S01E01" in line:
+                assert "SAFE" in line, f"Old TV should be SAFE, got: {line}"
+                break
+
+    with subtest("Keeper-also-abandoned hash is NOT listed as abandoned"):
+        assert "CrossRef.Movie.2024" not in abandoned_section, \
+            "Hash that is keeper for another movie must not appear as abandoned"
+
+    with subtest("Season pack NOT abandoned when still active for other episodes"):
+        assert "Season.Pack.S02" not in abandoned_section, \
+            "Season pack still active for episodes 301/302 must not be abandoned"
+
+    with subtest("Negative assertions for keepers"):
+        assert "New.Movie.Quality.2024" not in abandoned_section, \
+            "Keeper for movieId=2 must not appear as abandoned"
+        assert "New.Show.S01E01" not in abandoned_section, \
+            "Keeper for episodeId=200 must not appear as abandoned"
+        assert "Managed.Movie.2024" not in abandoned_section, \
+            "Single-import movie must not appear as abandoned"
+        assert "Managed.Show.S01E01" not in abandoned_section, \
+            "Single-import TV show must not appear as abandoned"
+
+    with subtest("Single-import keeper not abandoned (Bug 1 regression)"):
+        assert "SingleCross.Movie.2024" not in abandoned_section, \
+            "Hash that is sole import for movieId=7 must be in keeper set, not abandoned"
+
+    with subtest("Removed movie triggers REVIEW status"):
+        assert "Removed.Movie.2024" in abandoned_section, \
+            "Should detect abandoned torrent for removed movie"
+        assert_note_near(abandoned_section, "Removed.Movie.2024", "movie removed")
+        for line in abandoned_section.splitlines():
+            if "Removed.Movie.2024" in line:
+                assert "REVIEW" in line, f"Removed movie should be REVIEW, got: {line}"
+                break
+
+    with subtest("Abandoned larger than current triggers REVIEW"):
+        assert "Larger.Movie.2024" in abandoned_section, \
+            "Should detect larger abandoned torrent"
+        assert_note_near(abandoned_section, "Larger.Movie.2024", "abandoned is larger")
+        for line in abandoned_section.splitlines():
+            if "Larger.Movie.2024" in line:
+                assert "REVIEW" in line, f"Larger abandoned should be REVIEW, got: {line}"
+                break
+
+    with subtest("Removed series triggers REVIEW status for TV"):
+        assert "Removed.Show.S01E01" in abandoned_section, \
+            "Should detect abandoned torrent for removed series"
+        assert_note_near(abandoned_section, "Removed.Show.S01E01", "series removed")
+        for line in abandoned_section.splitlines():
+            if "Removed.Show.S01E01" in line:
+                assert "REVIEW" in line, f"Removed series should be REVIEW, got: {line}"
+                break
+
+    with subtest("Correct abandoned counts per category"):
+        assert "movies (3 abandoned)" in abandoned_section, \
+            "Should show 3 abandoned movies"
+        assert "tvshows (2 abandoned)" in abandoned_section, \
+            "Should show 2 abandoned TV shows"
+
+    with subtest("Correct summary totals"):
+        assert "ABANDONED: 5 total (2 safe to delete)" in output, \
+            "Summary should show 5 total abandoned, 2 safe to delete"
+        assert "SAFE TO RECLAIM: 3.4 GiB" in output, \
+            "Should report 3.4 GiB reclaimable (2.8 GiB movie + 0.7 GiB TV)"
+  '';
+}

From d3ede84bd380d30002fbe520421dda2555e4c973 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 20:52:20 -0700
Subject: [PATCH 703/847] prowlarr: fix user things

---
 services/arr/prowlarr.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index 7561c87..fc2001f 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -11,6 +11,9 @@
       service_configs.prowlarr.dataDir
     ])
     (lib.vpnNamespaceOpenPort service_configs.ports.private.prowlarr.port "prowlarr")
+    (lib.serviceFilePerms "prowlarr" [
+      "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
+    ])
   ];
 
   services.prowlarr = {
@@ -19,6 +22,24 @@
     settings.server.port = service_configs.ports.private.prowlarr.port;
   };
 
+  # The upstream prowlarr module uses DynamicUser=true which is incompatible
+  # with ZFS-backed persistent storage — the dynamic user can't access files
+  # on the ZFS mount. Override with a static user to match sonarr/radarr.
+  users.users.prowlarr = {
+    isSystemUser = true;
+    group = "prowlarr";
+    home = service_configs.prowlarr.dataDir;
+  };
+  users.groups.prowlarr = { };
+
+  systemd.services.prowlarr.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "prowlarr";
+    Group = "prowlarr";
+    StateDirectory = lib.mkForce "";
+    ExecStart = lib.mkForce "${lib.getExe pkgs.prowlarr} -nobrowser -data=${service_configs.prowlarr.dataDir}";
+  };
+
   services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}

From e049cba3c4b19ef59d92ea31dc90ee7ca77ee2c2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 21:01:23 -0700
Subject: [PATCH 704/847] torrent-audit: tag torrents in qbt

---
 services/arr/torrent-audit.nix |  1 +
 services/arr/torrent-audit.py  | 49 ++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/services/arr/torrent-audit.nix b/services/arr/torrent-audit.nix
index 9217074..e59e211 100644
--- a/services/arr/torrent-audit.nix
+++ b/services/arr/torrent-audit.nix
@@ -35,6 +35,7 @@
       SONARR_URL = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
       SONARR_CONFIG = "${service_configs.sonarr.dataDir}/config.xml";
       CATEGORIES = "tvshows,movies,anime";
+      TAG_TORRENTS = "true";
     };
   };
 }
diff --git a/services/arr/torrent-audit.py b/services/arr/torrent-audit.py
index 0d0830f..cc4baaf 100644
--- a/services/arr/torrent-audit.py
+++ b/services/arr/torrent-audit.py
@@ -266,6 +266,51 @@ def print_section(torrents, show_status=False):
     print()
 
 
+AUDIT_TAGS = {"audit:unmanaged", "audit:abandoned-safe", "audit:abandoned-review"}
+
+
+def tag_torrents(qbit_client, qbit_torrents, all_known, all_abandoned):
+    log.info("Tagging torrents ...")
+
+    abandoned_by_hash = {t["hash"].upper(): t for t in all_abandoned}
+
+    all_hashes = []
+    for torrents in qbit_torrents.values():
+        all_hashes.extend(torrents.keys())
+
+    for h in all_hashes:
+        current_tags = set()
+        torrent_info = None
+        for torrents in qbit_torrents.values():
+            if h in torrents:
+                torrent_info = torrents[h]
+                break
+        if not torrent_info:
+            continue
+
+        existing_tags = {t.strip() for t in torrent_info.get("tags", "").split(",") if t.strip()}
+        existing_audit_tags = existing_tags & AUDIT_TAGS
+
+        if h in abandoned_by_hash:
+            status = abandoned_by_hash[h]["status"]
+            desired = "audit:abandoned-safe" if status == "SAFE" else "audit:abandoned-review"
+        elif h not in all_known:
+            desired = "audit:unmanaged"
+        else:
+            desired = None
+
+        tags_to_remove = existing_audit_tags - ({desired} if desired else set())
+        tags_to_add = ({desired} if desired else set()) - existing_audit_tags
+
+        low_hash = torrent_info["hash"]
+        for tag in tags_to_remove:
+            qbit_client.torrents_remove_tags(tags=tag, torrent_hashes=low_hash)
+        for tag in tags_to_add:
+            qbit_client.torrents_add_tags(tags=tag, torrent_hashes=low_hash)
+
+    log.info("Tagging complete")
+
+
 def main():
     qbit_url = os.environ["QBITTORRENT_URL"]
     radarr_url = os.environ["RADARR_URL"]
@@ -328,6 +373,10 @@ def main():
     )
     print(f"SAFE TO RECLAIM: {gib(sum(t['size'] for t in safe))} GiB")
 
+    # -- Tagging --
+    if os.environ.get("TAG_TORRENTS", "").lower() in ("1", "true", "yes"):
+        tag_torrents(qbit, qbit_torrents, all_known, all_abandoned)
+
 
 if __name__ == "__main__":
     main()

From ba836b1237f6c14b6601451bd93af1e1376bca34 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 22:49:10 -0700
Subject: [PATCH 705/847] arr-init: update

---
 flake.lock            |  8 ++++----
 services/arr/init.nix | 22 ----------------------
 2 files changed, 4 insertions(+), 26 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4b96111..02ac8e0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774458847,
-        "narHash": "sha256-u0Gs2XBFd1tStEfTXqXJ/RpsDWrGUu5NfdWH/z98LUk=",
+        "lastModified": 1774676805,
+        "narHash": "sha256-14s2/KdLIr7w3A5WmVf5vaZMnNSUkVs42P7ByMgK7vY=",
         "ref": "refs/heads/main",
-        "rev": "7f395bd9b3e6af2de6b17d9383bd621ad3849f1c",
-        "revCount": 6,
+        "rev": "35c6d1b82101e846646b46622b2875a9f0694a9b",
+        "revCount": 7,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
diff --git a/services/arr/init.nix b/services/arr/init.nix
index 0f7204a..d54699b 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -17,16 +17,6 @@
           prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
           baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.sonarr.port}";
           apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml";
-          syncCategories = [
-            5000
-            5010
-            5020
-            5030
-            5040
-            5045
-            5050
-            5090
-          ];
           serviceName = "sonarr";
         }
         {
@@ -36,18 +26,6 @@
           prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
           baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.radarr.port}";
           apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml";
-          syncCategories = [
-            2000
-            2010
-            2020
-            2030
-            2040
-            2045
-            2050
-            2060
-            2070
-            2080
-          ];
           serviceName = "radarr";
         }
       ];

From 04892cf5af2d36315b9d3f2be6bc60c2f24eccb4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 27 Mar 2026 23:05:55 -0700
Subject: [PATCH 706/847] arr-init: update

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 02ac8e0..508ec34 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774676805,
-        "narHash": "sha256-14s2/KdLIr7w3A5WmVf5vaZMnNSUkVs42P7ByMgK7vY=",
+        "lastModified": 1774677939,
+        "narHash": "sha256-VTblmaG1ac+SF8lSPcifgbjg3KistqNuUT7+AmWTkjg=",
         "ref": "refs/heads/main",
-        "rev": "35c6d1b82101e846646b46622b2875a9f0694a9b",
-        "revCount": 7,
+        "rev": "c5ff0808d2a47ae3d076e2daf06ac30413fefd91",
+        "revCount": 8,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },

From 84898a1ee72bc83dc82d9fe734a56663800b285e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Mar 2026 00:06:20 -0700
Subject: [PATCH 707/847] arr-init: update

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 508ec34..c0185ea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774677939,
-        "narHash": "sha256-VTblmaG1ac+SF8lSPcifgbjg3KistqNuUT7+AmWTkjg=",
+        "lastModified": 1774681523,
+        "narHash": "sha256-K49RohIwbgzVeOdStfVDO83qy5K5ZLKWk4EsHJKj/k4=",
         "ref": "refs/heads/main",
-        "rev": "c5ff0808d2a47ae3d076e2daf06ac30413fefd91",
-        "revCount": 8,
+        "rev": "f8475f6cb4d4d4df99002d07cf9583fb33b87876",
+        "revCount": 11,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },

From 2409d1b01b161e4319f89177ac347fcf9ad80889 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Mar 2026 01:21:48 -0700
Subject: [PATCH 708/847] zfs: tune hdds pool

---
 modules/hardware.nix | 11 +++++++++++
 modules/zfs.nix      | 15 +++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/modules/hardware.nix b/modules/hardware.nix
index 8978873..e2cdbf6 100644
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@@ -21,4 +21,15 @@
 
   hardware.cpu.amd.updateMicrocode = true;
   hardware.enableRedistributableFirmware = true;
+
+  # HDD I/O tuning for torrent seeding workload (high-concurrency random reads).
+  # mq-deadline sorts requests into elevator sweeps, reducing seek distance.
+  # Aggressive deadlines (15s) let the scheduler accumulate more ops before dispatching,
+  # maximizing coalescence — latency is irrelevant since torrent peers tolerate 30-60s.
+  # fifo_batch=128 keeps sweeps long; writes_starved=16 heavily favors reads.
+  # 4 MiB readahead matches libtorrent piece extent affinity for sequential prefetch.
+  services.udev.extraRules = ''
+    ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="mq-deadline", ATTR{queue/read_ahead_kb}="4096", ATTR{queue/nr_requests}="512"
+    ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ENV{ID_ATA_ROTATION_RATE_RPM}!="0", RUN+="${pkgs.bash}/bin/bash -c 'echo 15000 > /sys$devpath/queue/iosched/read_expire; echo 15000 > /sys$devpath/queue/iosched/write_expire; echo 128 > /sys$devpath/queue/iosched/fifo_batch; echo 16 > /sys$devpath/queue/iosched/writes_starved; echo 4096 > /sys$devpath/queue/max_sectors_kb 2>/dev/null || true'"
+  '';
 }
diff --git a/modules/zfs.nix b/modules/zfs.nix
index 07d72f7..c447c34 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -10,6 +10,21 @@
 
   boot.kernelParams = [
     "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
+
+    # vdev I/O scheduler: feed more concurrent reads to the block scheduler so
+    # mq-deadline has a larger pool of requests to sort and merge into elevator sweeps.
+    # Default async_read_max is 3 — far too few for effective coalescence.
+    # 32 was empirically optimal (64 overwhelmed the drives, 3 gave near-zero merges).
+    "zfs.zfs_vdev_async_read_max_active=32"
+    "zfs.zfs_vdev_async_read_min_active=4"
+
+    # Merge reads within 128 KiB of each other (default 32 KiB). On HDDs, reading a
+    # 128 KiB gap is far cheaper than a mechanical seek (~8 ms).
+    "zfs.zfs_vdev_read_gap_limit=131072"
+
+    # Allow ZFS to aggregate I/Os up to 4 MiB (default 1 MiB), matching the
+    # libtorrent piece extent size for larger sequential disk operations.
+    "zfs.zfs_vdev_aggregation_limit=4194304"
   ];
 
   boot.supportedFilesystems = [ "zfs" ];

From 834f28f89863b226c0b1e60a9cff38efecefaf29 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 28 Mar 2026 04:15:26 -0700
Subject: [PATCH 709/847] secureboot: cleanup script permissions

---
 modules/secureboot.nix | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/modules/secureboot.nix b/modules/secureboot.nix
index 472a602..d425c40 100644
--- a/modules/secureboot.nix
+++ b/modules/secureboot.nix
@@ -22,19 +22,20 @@
       deps = [ "agenix" ];
       text = ''
         #!/bin/sh
-        # Check if keys already exist (e.g., from disko-install)
-        if [[ -d ${config.boot.lanzaboote.pkiBundle} && -f ${config.boot.lanzaboote.pkiBundle}/db.key ]]; then
-          echo "Secureboot keys already present, skipping extraction"
+        (
+          umask 077
+          # Check if keys already exist (e.g., from disko-install)
+          if [[ -d ${config.boot.lanzaboote.pkiBundle} && -f ${config.boot.lanzaboote.pkiBundle}/db.key ]]; then
+            echo "Secureboot keys already present, skipping extraction"
+          else
+            echo "Extracting secureboot keys from agenix"
+            rm -fr ${config.boot.lanzaboote.pkiBundle} || true
+            install -d -o root -g wheel -m 0500 ${config.boot.lanzaboote.pkiBundle}
+            ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
+          fi
           chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
           chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
-        else
-          echo "Extracting secureboot keys from agenix"
-          rm -fr ${config.boot.lanzaboote.pkiBundle} || true
-          mkdir -p ${config.boot.lanzaboote.pkiBundle}
-          ${pkgs.gnutar}/bin/tar xf ${config.age.secrets.secureboot-tar.path} -C ${config.boot.lanzaboote.pkiBundle}
-          chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
-          chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
-        fi
+        )
       '';
     };
   };

From dfc1b48b4fe748144004cdadc8fac3059551de28 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Mar 2026 15:42:20 -0400
Subject: [PATCH 710/847] qbt: fix file permissions

---
 services/qbittorrent.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 606eefe..c69f64b 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -19,7 +19,7 @@
       # 0770: group (media) needs write to delete files during upgrades —
       # Radarr/Sonarr must unlink the old file before placing the new one.
       "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group}"
-      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
+      "z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
       "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
     ])
   ];
@@ -127,7 +127,13 @@
     };
   };
 
-  systemd.services.qbittorrent.serviceConfig.TimeoutStopSec = lib.mkForce 10;
+  systemd.services.qbittorrent.serviceConfig = {
+    TimeoutStopSec = lib.mkForce 10;
+    # Default UMask=0022 creates files as 0644 (group read-only). With 0007,
+    # new files get 0660/0770 so the media group has read+write immediately
+    # instead of relying on the tmpfiles Z rule to fix permissions at restart.
+    UMask = lib.mkForce "0007";
+  };
 
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}

From a2b16be399b830431cd4ae202aefb108cba66dc2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 29 Mar 2026 23:42:09 -0400
Subject: [PATCH 711/847] minecraft: tweak jvm args

---
 services/minecraft.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index adfd500..434c73b 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,9 +43,15 @@
         # Memory
         "-Xmx${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
         "-Xms${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
+
         # GC
         "-XX:+UseZGC"
         "-XX:+ZGenerational"
+
+        # added in new minecraft version
+        "-XX:+UseCompactObjectHeaders"
+        "-XX:+UseStringDeduplication"
+
         # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
         "-XX:+UnlockExperimentalVMOptions"
         "-XX:+UnlockDiagnosticVMOptions"
@@ -67,6 +73,7 @@
         "-XX:NonProfiledCodeHeapSize=194M"
         "-XX:NmethodSweepActivity=1"
         "-XX:+UseVectorCmov"
+
         # Large pages (requires vm.nr_hugepages sysctl)
         "-XX:+UseLargePages"
         "-XX:LargePageSizeInBytes=${builtins.toString service_configs.minecraft.memory.large_page_size_m}M"

From 943fa2f531c8c3e5ea9548571889638f5dbeb265 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 02:03:05 -0400
Subject: [PATCH 712/847] re-add llama.cpp (test?)

---
 configuration.nix      |  2 ++
 flake.lock             | 52 ++++++++++++++++++++++++++++++++++++++++++
 flake.nix              |  5 ++++
 service-configs.nix    |  4 ++++
 services/llama-cpp.nix | 36 +++++++++++++++++++++++++++++
 5 files changed, 99 insertions(+)
 create mode 100644 services/llama-cpp.nix

diff --git a/configuration.nix b/configuration.nix
index 515fa79..f318840 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -45,6 +45,8 @@
 
     ./services/soulseek.nix
 
+    ./services/llama-cpp.nix
+
     ./services/ups.nix
 
     ./services/bitwarden.nix
diff --git a/flake.lock b/flake.lock
index c0185ea..7125090 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,6 +150,24 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_4"
@@ -276,6 +294,27 @@
         "type": "github"
       }
     },
+    "llamacpp": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774806340,
+        "narHash": "sha256-KC0ZkqR8HYHOjQbX3+kxIPv0fsYcjNFYDU9WgZZwNE4=",
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "rev": "7c203670f8d746382247ed369fea7fbf10df8ae0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
@@ -330,6 +369,18 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      }
+    },
     "nixpkgs-p2pool-module": {
       "flake": false,
       "locked": {
@@ -395,6 +446,7 @@
         "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
+        "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index e8c4ba9..ec32b6b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,6 +28,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    llamacpp = {
+      url = "github:ggml-org/llama.cpp";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     srvos = {
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/service-configs.nix b/service-configs.nix
index ea35cf5..7ad7830 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -149,6 +149,10 @@ rec {
         port = 5000;
         proto = "tcp";
       };
+      llama_cpp = {
+        port = 6688;
+        proto = "tcp";
+      };
     };
   };
 
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
new file mode 100644
index 0000000..de2501c
--- /dev/null
+++ b/services/llama-cpp.nix
@@ -0,0 +1,36 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  inputs,
+  lib,
+  ...
+}:
+{
+  services.llama-cpp = {
+    enable = true;
+    model = builtins.toString (
+      pkgs.fetchurl {
+        url = "https://huggingface.co/mradermacher/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled-GGUF/resolve/main/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled.Q5_K_M.gguf";
+        sha256 = "1b08df702dc729104de8894d3f6c6f52505e9f07c5d9b236b3efda3ae187bda2";
+      }
+    );
+    port = service_configs.ports.private.llama_cpp.port;
+    host = "0.0.0.0";
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    extraFlags = [
+      "-ngl"
+      "12"
+      "-c"
+      "16384"
+    ];
+  };
+
+  # have to do this in order to get vulkan to work
+  systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
+
+  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString config.services.llama-cpp.port}
+  '';
+}

From 82a383482e1c534d1793c021a6d85a5e441f4870 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 02:39:27 -0400
Subject: [PATCH 713/847] Revert "minecraft: tweak jvm args"

This reverts commit a2b16be399b830431cd4ae202aefb108cba66dc2.

This only applies to newer jvm versions. I have to wait for mc 26.1
---
 services/minecraft.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index 434c73b..adfd500 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,15 +43,9 @@
         # Memory
         "-Xmx${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
         "-Xms${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
-
         # GC
         "-XX:+UseZGC"
         "-XX:+ZGenerational"
-
-        # added in new minecraft version
-        "-XX:+UseCompactObjectHeaders"
-        "-XX:+UseStringDeduplication"
-
         # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
         "-XX:+UnlockExperimentalVMOptions"
         "-XX:+UnlockDiagnosticVMOptions"
@@ -73,7 +67,6 @@
         "-XX:NonProfiledCodeHeapSize=194M"
         "-XX:NmethodSweepActivity=1"
         "-XX:+UseVectorCmov"
-
         # Large pages (requires vm.nr_hugepages sysctl)
         "-XX:+UseLargePages"
         "-XX:LargePageSizeInBytes=${builtins.toString service_configs.minecraft.memory.large_page_size_m}M"

From 65c13babac0ee850ff913c86d746fc21f72bf60f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 02:41:39 -0400
Subject: [PATCH 714/847] Revert "re-add llama.cpp (test?)"

This reverts commit 943fa2f531c8c3e5ea9548571889638f5dbeb265.

Maybe will un-revert once turboquant becomes a thing?
---
 configuration.nix      |  2 --
 flake.lock             | 52 ------------------------------------------
 flake.nix              |  5 ----
 service-configs.nix    |  4 ----
 services/llama-cpp.nix | 36 -----------------------------
 5 files changed, 99 deletions(-)
 delete mode 100644 services/llama-cpp.nix

diff --git a/configuration.nix b/configuration.nix
index f318840..515fa79 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -45,8 +45,6 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
-
     ./services/ups.nix
 
     ./services/bitwarden.nix
diff --git a/flake.lock b/flake.lock
index 7125090..c0185ea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,24 +150,6 @@
         "type": "github"
       }
     },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_4"
@@ -294,27 +276,6 @@
         "type": "github"
       }
     },
-    "llamacpp": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1774806340,
-        "narHash": "sha256-KC0ZkqR8HYHOjQbX3+kxIPv0fsYcjNFYDU9WgZZwNE4=",
-        "owner": "ggml-org",
-        "repo": "llama.cpp",
-        "rev": "7c203670f8d746382247ed369fea7fbf10df8ae0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ggml-org",
-        "repo": "llama.cpp",
-        "type": "github"
-      }
-    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
@@ -369,18 +330,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1730504152,
-        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-      }
-    },
     "nixpkgs-p2pool-module": {
       "flake": false,
       "locked": {
@@ -446,7 +395,6 @@
         "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
-        "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index ec32b6b..e8c4ba9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,11 +28,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    llamacpp = {
-      url = "github:ggml-org/llama.cpp";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     srvos = {
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/service-configs.nix b/service-configs.nix
index 7ad7830..ea35cf5 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -149,10 +149,6 @@ rec {
         port = 5000;
         proto = "tcp";
       };
-      llama_cpp = {
-        port = 6688;
-        proto = "tcp";
-      };
     };
   };
 
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
deleted file mode 100644
index de2501c..0000000
--- a/services/llama-cpp.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  pkgs,
-  service_configs,
-  config,
-  inputs,
-  lib,
-  ...
-}:
-{
-  services.llama-cpp = {
-    enable = true;
-    model = builtins.toString (
-      pkgs.fetchurl {
-        url = "https://huggingface.co/mradermacher/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled-GGUF/resolve/main/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled.Q5_K_M.gguf";
-        sha256 = "1b08df702dc729104de8894d3f6c6f52505e9f07c5d9b236b3efda3ae187bda2";
-      }
-    );
-    port = service_configs.ports.private.llama_cpp.port;
-    host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
-    extraFlags = [
-      "-ngl"
-      "12"
-      "-c"
-      "16384"
-    ];
-  };
-
-  # have to do this in order to get vulkan to work
-  systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
-
-  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString config.services.llama-cpp.port}
-  '';
-}

From 9392749e66504c9df73c5c9b3ef489eeb088c4a6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 13:05:22 -0400
Subject: [PATCH 715/847] mollysocket: init

Add mollysocket so we can use ntfy for molly (signal)
---
 configuration.nix           |   2 ++
 modules/age-secrets.nix     |   6 ++++++
 secrets/mollysocket-env.age | Bin 0 -> 359 bytes
 service-configs.nix         |   8 ++++++++
 services/mollysocket.nix    |  36 ++++++++++++++++++++++++++++++++++++
 5 files changed, 52 insertions(+)
 create mode 100644 secrets/mollysocket-env.age
 create mode 100644 services/mollysocket.nix

diff --git a/configuration.nix b/configuration.nix
index 515fa79..a72df29 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -69,6 +69,8 @@
 
     ./services/ntfy.nix
     ./services/ntfy-alerts.nix
+
+    ./services/mollysocket.nix
   ];
 
   services.kmscon.enable = true;
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index ab42655..c380aba 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -88,5 +88,11 @@
       file = ../secrets/firefox-syncserver-env.age;
       mode = "0400";
     };
+
+    # MollySocket env (MOLLY_VAPID_PRIVKEY + MOLLY_ALLOWED_UUIDS)
+    mollysocket-env = {
+      file = ../secrets/mollysocket-env.age;
+      mode = "0400";
+    };
   };
 }
diff --git a/secrets/mollysocket-env.age b/secrets/mollysocket-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..15bcdbd23c22ea9f67e6aa7ab588a754a86dea2f
GIT binary patch
literal 359
zcmZQ@_Y83kiVO&0Fr4IXvSV50dxiJ+et!+D{oPQOBv#qvzfH0FoAja|ytA`vpRBOY
zUG+%D_q)oq<LayA=KnhJ#pV*XY5GJ9;k6HMJDnA&vVLIaIxq7;$ir!Cl$(BUJiC%T
z@!!K4_slj1Upc1jE4^sXg@2|o+RnA6s&X?|-1zgsnrBk(oz!)+9z<X2eBLG6;%H@i
zxb42;S}|oCN8b&+`$hg&UX|CKwB}N?(cZEg+Xt@_&Hb;2>vpd5pE&ze5leS(aGGoU
zf{z!N+$GbFg_?;N7qM#g>v;X+c=<1&MD=}n+1jgod_0`<y}P#eb$85N9kb=|yR%Q1
zZHkaoyL5;1nP9r#^Gy@Btew-m@}mBO4o8_^%4fEnl~w!UtNtwW{=}4*TSAv@dU~Ak
zz|rN8#XIh}zf*l#&}=Ym@%>A?C&cipltm^suFG<FOtA`VI@odg({v%uWARINE^dwZ
V5dMPowSquvhqGtIzy7WxjsQi^v+w`_

literal 0
HcmV?d00001

diff --git a/service-configs.nix b/service-configs.nix
index ea35cf5..b6d0502 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -149,6 +149,10 @@ rec {
         port = 5000;
         proto = "tcp";
       };
+      mollysocket = {
+        port = 8020;
+        proto = "tcp";
+      };
     };
   };
 
@@ -219,6 +223,10 @@ rec {
     domain = "ntfy.${https.domain}";
   };
 
+  mollysocket = {
+    domain = "mollysocket.${https.domain}";
+  };
+
   livekit = {
     domain = "livekit.${https.domain}";
   };
diff --git a/services/mollysocket.nix b/services/mollysocket.nix
new file mode 100644
index 0000000..e35c01b
--- /dev/null
+++ b/services/mollysocket.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "mollysocket" service_configs.zpool_ssds [
+      "/var/lib/private/mollysocket"
+    ])
+    (lib.serviceFilePerms "mollysocket" [
+      "Z /var/lib/private/mollysocket 0700 root root"
+    ])
+  ];
+
+  services.mollysocket = {
+    enable = true;
+
+    settings = {
+      host = "127.0.0.1";
+      port = service_configs.ports.private.mollysocket.port;
+
+      # Explicitly allow our self-hosted ntfy instance.
+      # Local-network endpoints are denied by default for security.
+      allowed_endpoints = [ "https://${service_configs.ntfy.domain}" ];
+      # allowed_uuids set via MOLLY_ALLOWED_UUIDS in environmentFile
+    };
+
+    environmentFile = config.age.secrets.mollysocket-env.path;
+  };
+
+  services.caddy.virtualHosts."${service_configs.mollysocket.domain}".extraConfig = ''
+    reverse_proxy h2c://127.0.0.1:${builtins.toString service_configs.ports.private.mollysocket.port}
+  '';
+}

From eeab5de886166fd11e0c70fde81da555aed0e59e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 13:21:33 -0400
Subject: [PATCH 716/847] fix mq-deadline for hdds

---
 modules/hardware.nix | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/modules/hardware.nix b/modules/hardware.nix
index e2cdbf6..f0ba280 100644
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@@ -23,13 +23,48 @@
   hardware.enableRedistributableFirmware = true;
 
   # HDD I/O tuning for torrent seeding workload (high-concurrency random reads).
+  #
   # mq-deadline sorts requests into elevator sweeps, reducing seek distance.
   # Aggressive deadlines (15s) let the scheduler accumulate more ops before dispatching,
   # maximizing coalescence — latency is irrelevant since torrent peers tolerate 30-60s.
   # fifo_batch=128 keeps sweeps long; writes_starved=16 heavily favors reads.
   # 4 MiB readahead matches libtorrent piece extent affinity for sequential prefetch.
-  services.udev.extraRules = ''
-    ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="mq-deadline", ATTR{queue/read_ahead_kb}="4096", ATTR{queue/nr_requests}="512"
-    ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ENV{ID_ATA_ROTATION_RATE_RPM}!="0", RUN+="${pkgs.bash}/bin/bash -c 'echo 15000 > /sys$devpath/queue/iosched/read_expire; echo 15000 > /sys$devpath/queue/iosched/write_expire; echo 128 > /sys$devpath/queue/iosched/fifo_batch; echo 16 > /sys$devpath/queue/iosched/writes_starved; echo 4096 > /sys$devpath/queue/max_sectors_kb 2>/dev/null || true'"
-  '';
+  #
+  # This runs as a systemd oneshot rather than udev rules because the NixOS ZFS module
+  # hardcodes a udev rule that forces scheduler="none" on all ZFS member partitions'
+  # parent disks, overriding any scheduler set via udev on the disk event.
+  systemd.services.hdd-io-tuning = {
+    description = "HDD I/O scheduler and queue tuning";
+    after = [
+      "zfs-import.target"
+      "systemd-udev-settle.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      for dev in /sys/block/sd*; do
+        [ -f "$dev/queue/rotational" ] || continue
+        [ "$(cat "$dev/queue/rotational")" = "1" ] || continue
+
+        # skip removable devices (USB sticks report removable=1)
+        [ "$(cat "$dev/removable")" = "0" ] || continue
+
+        echo mq-deadline > "$dev/queue/scheduler"
+        echo 4096 > "$dev/queue/read_ahead_kb"
+        echo 512 > "$dev/queue/nr_requests"
+
+        echo 15000 > "$dev/queue/iosched/read_expire"
+        echo 15000 > "$dev/queue/iosched/write_expire"
+        echo 128 > "$dev/queue/iosched/fifo_batch"
+        echo 16 > "$dev/queue/iosched/writes_starved"
+
+        echo 4096 > "$dev/queue/max_sectors_kb" 2>/dev/null || true
+
+        echo "Tuned $(basename "$dev"): mq-deadline, 4M readahead, 15s deadlines"
+      done
+    '';
+  };
 }

From 1a798612aa24022752251c8016abb9ffe659cc58 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 15:12:44 -0400
Subject: [PATCH 717/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index c0185ea..c350d36 100644
--- a/flake.lock
+++ b/flake.lock
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774274588,
-        "narHash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=",
+        "lastModified": 1774875830,
+        "narHash": "sha256-WPYlTmZvVa9dWlAziFkVjBdv1Z6giNIq40O1DxsBmiI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cf9686ba26f5ef788226843bc31fda4cf72e373b",
+        "rev": "7afd8cebb99e25a64a745765920e663478eb8830",
         "type": "github"
       },
       "original": {
@@ -263,11 +263,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1774433292,
-        "narHash": "sha256-wFeQPKZfSSVv7BAYpRK31UBy1V9/pPJ9/hLaLJIgIp0=",
+        "lastModified": 1774858933,
+        "narHash": "sha256-rgHUoE4QhOvK3Rcl9cbuIVdjPjFjfhcTm/uPs8Y7+2w=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "1e7ee8915a87c0675aa4532d70eb1a26e9b94cd8",
+        "rev": "45338aab3013924c75305f5cb3543b9cda993183",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1774407052,
-        "narHash": "sha256-rUkn7Bo3PAlpcZl8+0FDsTwFyDwvS4xwMT9+RJ+XJoE=",
+        "lastModified": 1774896109,
+        "narHash": "sha256-0ue9vbpiLP5ZHZd5e7eQAplM9Rb4tunV+u5xcJDJ+lc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "70daf1f48885f0b4a70797076cd2ff5d9139b46e",
+        "rev": "cb646a9e33cfa6b7d5facd9b7d4ca738ad1ff953",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774465523,
-        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "lastModified": 1774777275,
+        "narHash": "sha256-qogBiYFq8hZusDPeeKRqzelBAhZvREc7Cl+qlewGUCg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "rev": "b8f81636927f1af0cca812d22c876bad0a883ccd",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774480183,
-        "narHash": "sha256-MCHf8kXli88XoVFfiA5E3iR4LPrUDp8efoQLNqP/Il8=",
+        "lastModified": 1774822185,
+        "narHash": "sha256-vEVjI/PWBfxLd1dzlo1MUSqeH5J33OLU7a5dfuzOKu4=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "0b178b413075b716cce75b8eedc15535d669b0c8",
+        "rev": "c77ccbef4be871a37dcbd3465d62bb8b5c7bc025",
         "type": "github"
       },
       "original": {

From 7de24b887022d8944e4be0e7615e6365c37c9db5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 15:37:46 -0400
Subject: [PATCH 718/847] fix mq-deadline for hdds: 2

---
 modules/hardware.nix | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/modules/hardware.nix b/modules/hardware.nix
index f0ba280..907729c 100644
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@@ -44,13 +44,20 @@
       Type = "oneshot";
       RemainAfterExit = true;
     };
+    path = with pkgs; [
+      coreutils
+      gawk
+      zfs
+    ];
     script = ''
-      for dev in /sys/block/sd*; do
-        [ -f "$dev/queue/rotational" ] || continue
-        [ "$(cat "$dev/queue/rotational")" = "1" ] || continue
-
-        # skip removable devices (USB sticks report removable=1)
-        [ "$(cat "$dev/removable")" = "0" ] || continue
+      # Only tune disks in the hdds pool — not all rotational disks.
+      # zpool status gives by-id device names; we resolve to /sys/block/<name>.
+      zpool status hdds | awk '/^\t/ && $1 ~ /^(ata-|nvme-|scsi-)/ {print $1}' | while read -r id; do
+        link="/dev/disk/by-id/$id"
+        [ -L "$link" ] || continue
+        name=$(basename "$(readlink -f "$link")")
+        dev="/sys/block/$name"
+        [ -d "$dev" ] || continue
 
         echo mq-deadline > "$dev/queue/scheduler"
         echo 4096 > "$dev/queue/read_ahead_kb"
@@ -63,7 +70,7 @@
 
         echo 4096 > "$dev/queue/max_sectors_kb" 2>/dev/null || true
 
-        echo "Tuned $(basename "$dev"): mq-deadline, 4M readahead, 15s deadlines"
+        echo "Tuned $id -> $name: mq-deadline, 4M readahead, 15s deadlines"
       done
     '';
   };

From eaeeed7f4527850ed2dfc52327ccf9576663354d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 21:44:05 -0400
Subject: [PATCH 719/847] fix mq-deadline for hdds: 3

---
 modules/hardware.nix | 67 +++++++++++++++-----------------------------
 1 file changed, 23 insertions(+), 44 deletions(-)

diff --git a/modules/hardware.nix b/modules/hardware.nix
index 907729c..32ac735 100644
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@@ -5,6 +5,20 @@
   service_configs,
   ...
 }:
+let
+  hddTuneIosched = pkgs.writeShellScript "hdd-tune-iosched" ''
+    # Called by udev with the partition kernel name (e.g. sdb1).
+    # Derives the parent disk and applies mq-deadline iosched params.
+    parent=''${1%%[0-9]*}
+    dev="/sys/block/$parent"
+    [ -d "$dev/queue/iosched" ] || exit 0
+    echo 15000 > "$dev/queue/iosched/read_expire"
+    echo 15000 > "$dev/queue/iosched/write_expire"
+    echo 128 > "$dev/queue/iosched/fifo_batch"
+    echo 16 > "$dev/queue/iosched/writes_starved"
+    echo 4096 > "$dev/queue/max_sectors_kb" 2>/dev/null || true
+  '';
+in
 {
   boot.initrd.availableKernelModules = [
     "xhci_pci"
@@ -30,48 +44,13 @@
   # fifo_batch=128 keeps sweeps long; writes_starved=16 heavily favors reads.
   # 4 MiB readahead matches libtorrent piece extent affinity for sequential prefetch.
   #
-  # This runs as a systemd oneshot rather than udev rules because the NixOS ZFS module
-  # hardcodes a udev rule that forces scheduler="none" on all ZFS member partitions'
-  # parent disks, overriding any scheduler set via udev on the disk event.
-  systemd.services.hdd-io-tuning = {
-    description = "HDD I/O scheduler and queue tuning";
-    after = [
-      "zfs-import.target"
-      "systemd-udev-settle.service"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    path = with pkgs; [
-      coreutils
-      gawk
-      zfs
-    ];
-    script = ''
-      # Only tune disks in the hdds pool — not all rotational disks.
-      # zpool status gives by-id device names; we resolve to /sys/block/<name>.
-      zpool status hdds | awk '/^\t/ && $1 ~ /^(ata-|nvme-|scsi-)/ {print $1}' | while read -r id; do
-        link="/dev/disk/by-id/$id"
-        [ -L "$link" ] || continue
-        name=$(basename "$(readlink -f "$link")")
-        dev="/sys/block/$name"
-        [ -d "$dev" ] || continue
-
-        echo mq-deadline > "$dev/queue/scheduler"
-        echo 4096 > "$dev/queue/read_ahead_kb"
-        echo 512 > "$dev/queue/nr_requests"
-
-        echo 15000 > "$dev/queue/iosched/read_expire"
-        echo 15000 > "$dev/queue/iosched/write_expire"
-        echo 128 > "$dev/queue/iosched/fifo_batch"
-        echo 16 > "$dev/queue/iosched/writes_starved"
-
-        echo 4096 > "$dev/queue/max_sectors_kb" 2>/dev/null || true
-
-        echo "Tuned $id -> $name: mq-deadline, 4M readahead, 15s deadlines"
-      done
-    '';
-  };
+  # The NixOS ZFS module hardcodes a udev rule that forces scheduler="none" on all
+  # ZFS member partitions' parent disks (on both add AND change events). We counter
+  # it with lib.mkAfter so our rule appears after theirs in 99-local.rules — our
+  # rule matches the same partition events and sets mq-deadline back, then a RUN
+  # script applies the iosched params. Only targets rotational, non-removable disks
+  # (i.e. HDDs, not SSDs or USB).
+  services.udev.extraRules = lib.mkAfter ''
+    ACTION=="add|change", KERNEL=="sd[a-z]*[0-9]*", ENV{ID_FS_TYPE}=="zfs_member", ATTR{../queue/rotational}=="1", ATTR{../removable}=="0", ATTR{../queue/scheduler}="mq-deadline", ATTR{../queue/read_ahead_kb}="4096", ATTR{../queue/nr_requests}="512", RUN+="${hddTuneIosched} %k"
+  '';
 }

From e4feaa35adc77d913053b737f57a57d047cfe5e3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 17:14:47 -0400
Subject: [PATCH 720/847] secrets: migrate build-time secrets to agenix runtime

- coturn: switch static-auth-secret to static-auth-secret-file
- matrix: switch registration_token and turn_secret to file-based
- murmur: switch password to environmentFile with agenix
- p2pool: move public wallet address to service-configs.nix
---
 configuration.nix               |   3 ++-
 modules/age-secrets.nix         |  34 ++++++++++++++++++++++++++++++++
 secrets/coturn-auth-secret.age  | Bin 0 -> 286 bytes
 secrets/matrix-reg-token.age    | Bin 0 -> 286 bytes
 secrets/murmur-password-env.age | Bin 0 -> 255 bytes
 service-configs.nix             |   1 +
 services/coturn.nix             |   2 +-
 services/matrix.nix             |   4 ++--
 services/p2pool.nix             |   5 +----
 9 files changed, 41 insertions(+), 8 deletions(-)
 create mode 100644 secrets/coturn-auth-secret.age
 create mode 100644 secrets/matrix-reg-token.age
 create mode 100644 secrets/murmur-password-env.age

diff --git a/configuration.nix b/configuration.nix
index a72df29..9af329f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -290,7 +290,8 @@
     enable = true;
     openFirewall = true;
     welcometext = "meow meow meow meow meow :3 xd";
-    password = builtins.readFile ./secrets/murmur_password;
+    password = "$MURMURD_PASSWORD";
+    environmentFile = config.age.secrets.murmur-password-env.path;
     port = service_configs.ports.public.murmur.port;
   };
 
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index c380aba..81cb4be 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -94,5 +94,39 @@
       file = ../secrets/mollysocket-env.age;
       mode = "0400";
     };
+
+    # Murmur (Mumble) server password
+    murmur-password-env = {
+      file = ../secrets/murmur-password-env.age;
+      mode = "0400";
+      owner = "murmur";
+      group = "murmur";
+    };
+
+    # Coturn static auth secret
+    coturn-auth-secret = {
+      file = ../secrets/coturn-auth-secret.age;
+      mode = "0400";
+      owner = "turnserver";
+      group = "turnserver";
+    };
+
+    # Matrix (continuwuity) registration token
+    matrix-reg-token = {
+      file = ../secrets/matrix-reg-token.age;
+      mode = "0400";
+      owner = "continuwuity";
+      group = "continuwuity";
+    };
+
+    # Matrix (continuwuity) TURN secret — same secret as coturn-auth-secret,
+    # decrypted separately so continuwuity can read it with its own ownership
+    matrix-turn-secret = {
+      file = ../secrets/coturn-auth-secret.age;
+      mode = "0400";
+      owner = "continuwuity";
+      group = "continuwuity";
+    };
+
   };
 }
diff --git a/secrets/coturn-auth-secret.age b/secrets/coturn-auth-secret.age
new file mode 100644
index 0000000000000000000000000000000000000000..d70dd043f1b21fae969159e7c60a47b7318b0147
GIT binary patch
literal 286
zcmZQ@_Y83kiVO&0xI5oQ>6z@D`1@>GiFcX!ZydSasrTyW@(<D_Q6Ks@wDd`M|5viO
zsP@2z(>w9P4xV32Sk5O`Fa&-N&Ptzb|54@3jR|4%m0528W<J8dJ@UEvXWLUP8<sf-
z80Nm6+wfztI-gd}(%G*|zdBY|bvB;LV{Z--Zhkx0aqhWY&llUOXKk(ExzetzIj2*_
zeP&>t=C+<{*&PxO)~xM$f6ePw|KvA;dB<K=*INH}u|L>-#i`&+bsB@T^1+bAM|}Cq
zBR{>lXsG)CW^2EK!ZwZ$I|e;xy_1t~SbvfF^`qM5mz+W370)J*8nbZc{F;3%c8*(e
vXIaXpU#j8xeem>whqsHCT}jPe%-#5z>EH>e8Rb&zJ#u0iqoRKEo!SckVpEI2

literal 0
HcmV?d00001

diff --git a/secrets/matrix-reg-token.age b/secrets/matrix-reg-token.age
new file mode 100644
index 0000000000000000000000000000000000000000..e5a73988daae62b7a2bd5084d60fc6cdf5270f5a
GIT binary patch
literal 286
zcmZQ@_Y83kiVO&0U@FKK*HmKKwCUX6>dfg&*?OjPdAiP!J(l?EoL%CBy^k5T2mIGO
z5qaZY?8ElQA??eX@6EY=WAE<^$9nVM)wxw%J%8-Rk$LYAH<eCe_~}s1V10O9fb`=3
z1!s?`+lnpIGjlX~v|Y4l$M5%N1dF}=0)$y|D*o*?W8;l6=1~yalqZlNv)QfkTjYdY
zJ7%Z7G|)fw#Xmpq@cXF-O8fuG@4R?8c$$V;|7yl>)7SK*Z?fBRPyJG}N8{qd6Z`ay
zTUCl@PCaXN`o%^0$BUbjFV~!RsSRO1@kDLM{Jl$#+`4muZ-aPQ`pKSSRyBvFuJf49
xT`BNNKU{l4cCy#0slK)x%X?3A<X_yRkrEqt&S~MUKaY2{<;m#$-MvP$7yyizkGTK<

literal 0
HcmV?d00001

diff --git a/secrets/murmur-password-env.age b/secrets/murmur-password-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..615f9122ac6474c1b004ff9b11666b47c7aa2b22
GIT binary patch
literal 255
zcmZQ@_Y83kiVO&0Fi-Evj#iw0zS;cz`}KM6l$T}cmgmS;yGh1)*H+X%>{j_M<TPWd
z_~%{5`8!3}c&&cw6(!o(tj}LLjo~4qw_Se5J_#M$g5Os+9e)`uvin})<7GeDZ0}m}
zKYrrszjd;0h@0STC7&s8j!MV<e%LI$Q|$-S{vyk@uHkVvZXXnndVW}8V$m1dJ>f<L
zO9W0`Ub7`(*OH*1V_CsAMh>Q`XQeKmQWcYt@IPa`sqEY&YZs03h)GtCSq@$@^={{@
z7BmOgnBNx)KfNSlbNM$mJzM6Fg3_LKavQc6R)<gB8LE@h8F2Gt-{tvkExZ97Epjf?
NwOY>bhb^rP005IxaU=i$

literal 0
HcmV?d00001

diff --git a/service-configs.nix b/service-configs.nix
index b6d0502..a79a16c 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -212,6 +212,7 @@ rec {
 
   p2pool = {
     dataDir = services_dir + "/p2pool";
+    walletAddress = "49b6NT2k7fQHs8JvF7naUvchYwTQmRpoMMXb1KJTg5UcZVmyPJ7n6jgiH8DrvEsMg5GvMjJqPB1c1PTBAYtUTsbeHe5YMBx";
   };
 
   matrix = {
diff --git a/services/coturn.nix b/services/coturn.nix
index 9f11ff7..4dfd8d3 100644
--- a/services/coturn.nix
+++ b/services/coturn.nix
@@ -9,7 +9,7 @@
     enable = true;
     realm = service_configs.https.domain;
     use-auth-secret = true;
-    static-auth-secret = lib.strings.trim (builtins.readFile ../secrets/coturn_static_auth_secret);
+    static-auth-secret-file = config.age.secrets.coturn-auth-secret.path;
     listening-port = service_configs.ports.public.coturn.port;
     tls-listening-port = service_configs.ports.public.coturn_tls.port;
     no-cli = true;
diff --git a/services/matrix.nix b/services/matrix.nix
index 3aaee5b..c8952d8 100644
--- a/services/matrix.nix
+++ b/services/matrix.nix
@@ -21,7 +21,7 @@
       port = [ service_configs.ports.private.matrix.port ];
       server_name = service_configs.https.domain;
       allow_registration = true;
-      registration_token = lib.strings.trim (builtins.readFile ../secrets/matrix_reg_token);
+      registration_token_file = config.age.secrets.matrix-reg-token.path;
 
       new_user_displayname_suffix = "";
 
@@ -37,7 +37,7 @@
       ];
 
       # TURN server config (coturn)
-      turn_secret = config.services.coturn.static-auth-secret;
+      turn_secret_file = config.age.secrets.matrix-turn-secret.path;
       turn_uris = [
         "turn:${service_configs.https.domain}?transport=udp"
         "turn:${service_configs.https.domain}?transport=tcp"
diff --git a/services/p2pool.nix b/services/p2pool.nix
index 99101ab..4550451 100644
--- a/services/p2pool.nix
+++ b/services/p2pool.nix
@@ -4,9 +4,6 @@
   lib,
   ...
 }:
-let
-  walletAddress = lib.strings.trim (builtins.readFile ../secrets/xmrig-wallet);
-in
 {
   imports = [
     (lib.serviceMountWithZpool "p2pool" service_configs.zpool_ssds [
@@ -20,7 +17,7 @@ in
   services.p2pool = {
     enable = true;
     dataDir = service_configs.p2pool.dataDir;
-    walletAddress = walletAddress;
+    walletAddress = service_configs.p2pool.walletAddress;
     sidechain = "nano";
     host = "127.0.0.1";
     rpcPort = service_configs.ports.public.monero_rpc.port;

From 5375f8ee345d53954cb8000729bc021b45f3ac49 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 30 Mar 2026 17:26:21 -0400
Subject: [PATCH 721/847] gitea: add actions runner and CI/CD deploy workflow

This will avoid me having to run "deploy" myself on my laptop.
All I will need to do is push a commit and it will self-deploy.
---
 .gitea/workflows/deploy.yml             |  60 ++++++++++++++++++++++++
 AGENTS.md                               |   6 ++-
 configuration.nix                       |  21 +++++++++
 modules/age-secrets.nix                 |  41 ++++++++++++++--
 modules/impermanence.nix                |   1 +
 secrets/ci-deploy-key.age               | Bin 0 -> 645 bytes
 secrets/coturn-auth-secret.age          | Bin 286 -> 298 bytes
 secrets/git-crypt-key-dotfiles.age      | Bin 0 -> 382 bytes
 secrets/git-crypt-key-server-config.age | Bin 0 -> 382 bytes
 secrets/gitea-runner-token.age          | Bin 0 -> 281 bytes
 secrets/matrix-reg-token.age            | Bin 286 -> 298 bytes
 secrets/murmur-password-env.age         | Bin 255 -> 267 bytes
 secrets/ntfy-alerts-topic.age           | Bin 254 -> 254 bytes
 services/gitea-actions-runner.nix       |  46 ++++++++++++++++++
 services/gitea.nix                      |   1 +
 services/ssh.nix                        |   5 +-
 tests/gitea-runner.nix                  |  60 ++++++++++++++++++++++++
 tests/tests.nix                         |   3 ++
 18 files changed, 237 insertions(+), 7 deletions(-)
 create mode 100644 .gitea/workflows/deploy.yml
 create mode 100644 secrets/ci-deploy-key.age
 create mode 100644 secrets/git-crypt-key-dotfiles.age
 create mode 100644 secrets/git-crypt-key-server-config.age
 create mode 100644 secrets/gitea-runner-token.age
 create mode 100644 services/gitea-actions-runner.nix
 create mode 100644 tests/gitea-runner.nix

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..a31cd96
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,60 @@
+name: Build and Deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: nix
+    env:
+      GIT_SSH_COMMAND: "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Unlock git-crypt
+        run: |
+          git-crypt unlock /run/agenix/git-crypt-key-server-config
+
+      - name: Build NixOS configuration
+        run: |
+          nix build .#nixosConfigurations.muffin.config.system.build.toplevel -L
+
+      - name: Deploy via deploy-rs
+        run: |
+          eval $(ssh-agent -s)
+          ssh-add /run/agenix/ci-deploy-key
+          nix run github:serokell/deploy-rs -- .#muffin --skip-checks --ssh-opts="-o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
+
+      - name: Health check
+        run: |
+          sleep 10
+          ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts root@server-public \
+            "systemctl is-active gitea && systemctl is-active caddy && systemctl is-active continuwuity && systemctl is-active coturn"
+
+      - name: Notify success
+        if: success()
+        run: |
+          TOPIC=$(cat /run/agenix/ntfy-alerts-topic | tr -d '[:space:]')
+          TOKEN=$(cat /run/agenix/ntfy-alerts-token | tr -d '[:space:]')
+          curl -sf -o /dev/null -X POST \
+            "https://ntfy.sigkill.computer/$TOPIC" \
+            -H "Authorization: Bearer $TOKEN" \
+            -H "Title: [muffin] Deploy succeeded" \
+            -H "Priority: default" \
+            -H "Tags: white_check_mark" \
+            -d "server-config deployed from commit ${GITHUB_SHA::8}"
+
+      - name: Notify failure
+        if: failure()
+        run: |
+          TOPIC=$(cat /run/agenix/ntfy-alerts-topic 2>/dev/null | tr -d '[:space:]')
+          TOKEN=$(cat /run/agenix/ntfy-alerts-token 2>/dev/null | tr -d '[:space:]')
+          curl -sf -o /dev/null -X POST \
+            "https://ntfy.sigkill.computer/$TOPIC" \
+            -H "Authorization: Bearer $TOKEN" \
+            -H "Title: [muffin] Deploy FAILED" \
+            -H "Priority: urgent" \
+            -H "Tags: rotating_light" \
+            -d "server-config deploy failed at commit ${GITHUB_SHA::8}" || true
diff --git a/AGENTS.md b/AGENTS.md
index e109cf4..356feab 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -99,7 +99,11 @@ Each service file in `services/` follows this structure:
 - **git-crypt**: `secrets/` directory and `usb-secrets/usb-secrets-key*` are encrypted (see `.gitattributes`)
 - **agenix**: secrets declared in `modules/age-secrets.nix`, decrypted at runtime to `/run/agenix/`
 - **Identity**: USB drive at `/mnt/usb-secrets/usb-secrets-key`
-- **Encrypting new secrets**: The agenix encryption key is in `usb-secrets/usb-secrets-key` (SSH private key, git-crypt encrypted). To create a new secret: derive the age public key with `ssh-keygen -y -f usb-secrets/usb-secrets-key | ssh-to-age`, then encrypt with `age -r <public-key> -o secrets/<name>.age`.
+- **Encrypting new secrets**: The agenix identity is an SSH private key at `usb-secrets/usb-secrets-key` (git-crypt encrypted). To encrypt a new secret, use the SSH public key directly with `age -R`:
+  ```bash
+  age -R <(ssh-keygen -y -f usb-secrets/usb-secrets-key) -o secrets/<name>.age /path/to/plaintext
+  ```
+- **DO NOT use `ssh-to-age`**. Using `ssh-to-age` to derive a native age public key and then encrypting with `age -r age1...` produces `X25519` recipient stanzas. The SSH private key identity on the server can only decrypt `ssh-ed25519` stanzas. This mismatch causes `age: error: no identity matched any of the recipients` at deploy time. Always use `age -R` with the SSH public key directly.
 - Never read or commit plaintext secrets. Never log secret values.
 
 ### Important Patterns
diff --git a/configuration.nix b/configuration.nix
index 9af329f..65d960f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -26,6 +26,7 @@
     ./services/caddy.nix
     ./services/immich.nix
     ./services/gitea.nix
+    ./services/gitea-actions-runner.nix
     ./services/minecraft.nix
 
     ./services/wg.nix
@@ -73,6 +74,18 @@
     ./services/mollysocket.nix
   ];
 
+  # Hosts entries for CI/CD deploy targets
+  networking.hosts."192.168.1.50" = [ "server-public" ];
+  networking.hosts."192.168.1.223" = [ "desktop" ];
+
+  # SSH known_hosts for CI runner (pinned host keys)
+  environment.etc."ci-known-hosts".text = ''
+    server-public ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
+    192.168.1.50 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
+    git.sigkill.computer ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
+    git.gardling.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
+  '';
+
   services.kmscon.enable = true;
 
   systemd.targets = {
@@ -249,6 +262,14 @@
 
   users.groups.${service_configs.media_group} = { };
 
+  users.users.gitea-runner = {
+    isSystemUser = true;
+    group = "gitea-runner";
+    home = "/var/lib/gitea-runner";
+    description = "Gitea Actions CI runner";
+  };
+  users.groups.gitea-runner = { };
+
   users.users.${username} = {
     isNormalUser = true;
     extraGroups = [
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index 81cb4be..2effde8 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -68,19 +68,19 @@
       group = "root";
     };
 
-    # ntfy-alerts secrets
+    # ntfy-alerts secrets (group-readable for CI runner notifications)
     ntfy-alerts-topic = {
       file = ../secrets/ntfy-alerts-topic.age;
-      mode = "0400";
+      mode = "0440";
       owner = "root";
-      group = "root";
+      group = "gitea-runner";
     };
 
     ntfy-alerts-token = {
       file = ../secrets/ntfy-alerts-token.age;
-      mode = "0400";
+      mode = "0440";
       owner = "root";
-      group = "root";
+      group = "gitea-runner";
     };
 
     # Firefox Sync server secrets (SYNC_MASTER_SECRET)
@@ -128,5 +128,36 @@
       group = "continuwuity";
     };
 
+    # CI deploy SSH key
+    ci-deploy-key = {
+      file = ../secrets/ci-deploy-key.age;
+      mode = "0400";
+      owner = "gitea-runner";
+      group = "gitea-runner";
+    };
+
+    # Git-crypt symmetric key for dotfiles repo
+    git-crypt-key-dotfiles = {
+      file = ../secrets/git-crypt-key-dotfiles.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # Git-crypt symmetric key for server-config repo
+    git-crypt-key-server-config = {
+      file = ../secrets/git-crypt-key-server-config.age;
+      mode = "0400";
+      owner = "gitea-runner";
+      group = "gitea-runner";
+    };
+
+    # Gitea Actions runner registration token
+    gitea-runner-token = {
+      file = ../secrets/gitea-runner-token.age;
+      mode = "0400";
+      owner = "gitea-runner";
+      group = "gitea-runner";
+    };
   };
 }
diff --git a/modules/impermanence.nix b/modules/impermanence.nix
index 86d36f0..0eee73c 100644
--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -24,6 +24,7 @@
       # ZFS cache directory - persisting the directory instead of the file
       # avoids "device busy" errors when ZFS atomically updates the cache
       "/etc/zfs"
+      "/var/lib/gitea-runner"
     ];
 
     files = [
diff --git a/secrets/ci-deploy-key.age b/secrets/ci-deploy-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..5c52818c617b7e9d4db8ea218df564fab4531ed9
GIT binary patch
literal 645
zcmZQ@_Y83kiVO&0SoD@xlIixJB(WBTN%!x*U!QL`yY*cE^<8;w$GEiSd%yal)+M|4
zfc}cz%<Hojc)qJRwD(G$or`+>?}Kb#jy$}~Jz?V2MW4T&xa*Ow&0w!nQ!!J1ZQmt}
z*8KawJg3H4l&$bKe!<zY^u%0kiP?LX-0<7EH%IJ)`rg8VL-H;R)ote6)Usbai+FOy
zKOx=6Sm=r3dF@S=2Du_^uZtL^RX<))6ug?f(f{pJt$O9vvz68NoI92qd)|Gn-T`IN
zunYb_A{aI&-1{kOwRU$zh<}i%&%+6EY=sp!e?IT_`uF!&-<xUM*y32{f1c3bms-xT
z_{)pOg_n=Wxrt0Y|EhH28zYa3Ce`pLiCf*v^42==r1JA>RfyXZNSTHjC28;a9`Aj&
z`Pn1aws+5%CjT{mqHOZ=;#turytUeq)ieKYob<xQwCi?(-qx0iz6bohMQ2K<z1F`N
z?`!yjW2Thj_VRTstDZ)y2b$S#%4yquF|32*2G1keX;)-iHLtRpovAU|Z(g~2b?q@x
zhJ;hECk5TlQ^~W*F^}|qsJ}a=>f?l+Osi~f=<Gc-`IW4K*TX93?Lzti2MgUbjkdCI
z{fu}Jc6nXN=Z3oQ+8sCT&WfZbUEqIsmu3Cd(p}3JMENcf+@jvb5h(e)-G@OrP4)4C
z7m=!$wx%abE<W<mI(_w?dyYF3<X(JTGD~jSw8{rZ6zWYo8%wqBhe+2fy|>`;#`eC3
z=LLJGFa#|~>HPj|zj9joJXfWJ_*a}I?E;#Y*r$ZtQIlTVqd2!9Qe3vaQ~1B%leDN`
zrCuMxxmx%()ozwP#JK70OcC$P8uE!Mo!%|#p~5xsyN-X3xGQpiGkRXq1)C20<Ki0)
Jlz$x)1OU6HH%R~h

literal 0
HcmV?d00001

diff --git a/secrets/coturn-auth-secret.age b/secrets/coturn-auth-secret.age
index d70dd043f1b21fae969159e7c60a47b7318b0147..6c2046b4730b78423a74f873385378b8eb62468e 100644
GIT binary patch
literal 298
zcmZQ@_Y83kiVO&0SWx|3TK>9wOV|BRr~N<P^w3@7{os7twvY3dKU3PMH{qbaRZeAL
zi}C55Wf_ML?9jgU=8NCdOq(CxUCUql1^L%GYW}Fdcki2b$y(O=5p@~u<(wyCnr!4}
zMQb}cf7`b1irSaF{M&IwPhS6h{pRPK3#ZrwlD6?&{CI4&ZT1}&z6tM2(lzT(8w)Cb
zQ{FIl-}c!@7QLK&<LzXxN7@O$`H$W1$bM3EytU_3)WN@Zw%hf7H@fk5`Jo$2H5~T7
zQrU5AF4H+SnI{k0CNw`ZJ<n`i{piecpS#NG%#Q1N1v$Rmk)2m7{<GP)<lzDT#0R(2
zUnsRD{d3iOacj+tjHC-U&I`^w@l<nN!Y{|gxx8H>krLaP%$}W&JK(0K{Xg63#N6N?
LSvAL&?QQ@7(z>7@

literal 286
zcmZQ@_Y83kiVO&0xI5oQ>6z@D`1@>GiFcX!ZydSasrTyW@(<D_Q6Ks@wDd`M|5viO
zsP@2z(>w9P4xV32Sk5O`Fa&-N&Ptzb|54@3jR|4%m0528W<J8dJ@UEvXWLUP8<sf-
z80Nm6+wfztI-gd}(%G*|zdBY|bvB;LV{Z--Zhkx0aqhWY&llUOXKk(ExzetzIj2*_
zeP&>t=C+<{*&PxO)~xM$f6ePw|KvA;dB<K=*INH}u|L>-#i`&+bsB@T^1+bAM|}Cq
zBR{>lXsG)CW^2EK!ZwZ$I|e;xy_1t~SbvfF^`qM5mz+W370)J*8nbZc{F;3%c8*(e
vXIaXpU#j8xeem>whqsHCT}jPe%-#5z>EH>e8Rb&zJ#u0iqoRKEo!SckVpEI2

diff --git a/secrets/git-crypt-key-dotfiles.age b/secrets/git-crypt-key-dotfiles.age
new file mode 100644
index 0000000000000000000000000000000000000000..2547cfef9cc9272125eaf30aec31cc91d087e8b5
GIT binary patch
literal 382
zcmZQ@_Y83kiVO&0$jy7;bwawToG~x%+zRcKj!(DVXRp8h@`$X^73JNRzI1CGY!z+1
z%CSVAUraK5{qfMS$ha@;UQ90w<R0y5eU|9rH7kuJ#7w*Hl;0I8lZG7Us#<Li?k$(=
zZXTYQ8PZa;)qa+K>fykgIbyl4g}WTKN%QhwPfY21V5aJqF>}*;jZI<~v+}j#cR#3o
z`}fr`)2sZcaTCIQ56&%#`)<BZsLaVr()hwVzL=e#Cow&eDEo4F{qB>$opRq?`>B64
z_|}}>AGyT~Z7#V*TuRySzJFT!lH&O_EYtVtyg#@2n_Q9h(zA+1%psj3rLUG3pO_FD
zbz`|iu&Go<)O_v`^Y}|M=Nwn!2s|FD>K-Xsv&ZOo@d>l<4T`t6rJ2dE;nmLk@58QG
zw{BfRd(f`q9xaMmJ3TU^DnCkcfAbWM74HAwE3$u<M!evcJyxRcj=y@Iq_FGNf=z}U
rK6a{YvsL#pIqvG_FXM4>dG&G6vb6ISOTMNyWZ&m2-uW%=zIhY?@>sPx

literal 0
HcmV?d00001

diff --git a/secrets/git-crypt-key-server-config.age b/secrets/git-crypt-key-server-config.age
new file mode 100644
index 0000000000000000000000000000000000000000..19931fe507a756a4e2633973abb4301b5491acb9
GIT binary patch
literal 382
zcmZQ@_Y83kiVO&0c+0nbafa%PjN><xKP(6m|5G8u6dqsmJ>>DE`IQsiPBMSxpOpKs
z_l%m-@AMz8mK`cKuim{B?>ZFby<Fc|uJ`M$Zzmd>P6QgZ``oY6^3gaRk!mzQ>WkDn
zzs3n|sf@XH%}XbVFAV84UAZB57n7Ic>!1A$(osQQj)y#-8FsM2T5<KU)Fu3W+Uw)*
z#9W=4+3HmFir?)q>zVV`NBh%4=XjqJm09<5ha;!LEAicpt0FDF?EdX5Wo>=@=IvWs
zPbPf4K7mhcZQEIy+}Y0;uAN(-__;_+{=IvUNcGamTw9B`7m6gk-^~0hT3DiL%h~`B
z)u~r6h6()g^EcMte){2c=R+@B*IPN<NXRMETgVnAR#CO~)a|v+$rVKj_J6jvwG>26
zuwU6XSHW%ll*YZ2POjmMnyw*TAh>tuPZ7)Vnl%SS4%$_<?i1AMu94W9U3b3l&mLCp
sm;J@7r?YVfX;!E)uPZJ%{lGhJYxu_Qobc%DE0T_{{3M#h*jcRu077!PWdHyG

literal 0
HcmV?d00001

diff --git a/secrets/gitea-runner-token.age b/secrets/gitea-runner-token.age
new file mode 100644
index 0000000000000000000000000000000000000000..3c9d38e7dfcf8e5b1dcb04b3317009232c069219
GIT binary patch
literal 281
zcmZQ@_Y83kiVO&0Sn~L=Q=W;bpY@W^K!elUwB^kDJ~5`&8!87VeOk5SVD^niaScCM
zpWSXdTWV+}w9fk<r>DY~OYI-!d((H8Z|yiQylQ@)@tjRxpLd+DZ1a+ToMPJ@{b;A|
z{%R)M<c_+jCZ#GH-|@*CGk?mk63>5^{ZzX1-mx#6FZb$i@Jxul^5ECYQ?IvPI)6v>
z*;MbnQ3r(TGC24AH(EWr*g?ETD=l3|eQKVR#W&ZJiLY~ZFWvV;{v+d2eSw>Y9XT!)
zH#;m0Em#)&RqSc;r{g!KY!H+c3XGSE-;lGoU1UmUu;HqsJD)4A`(5F>r)$m9ocX1D
qg3MkB9@RT(8}eTJelyqNV$c74B2p%wKb>TF@5pv%)g7zPXKVo10E;C6

literal 0
HcmV?d00001

diff --git a/secrets/matrix-reg-token.age b/secrets/matrix-reg-token.age
index e5a73988daae62b7a2bd5084d60fc6cdf5270f5a..e2e74054faceb1fb33af1d2abfcea53d10e4cec4 100644
GIT binary patch
literal 298
zcmZQ@_Y83kiVO&0xM#1;yrr(>+T*fxeMyI=UpefHI1Sx8m}3`z(1|RYl(0|S>*dCj
zf3_2(`T3`-?&p5d(`FJhWpm<xP7V)#ezhr^CeA*W66x)%ey!PUD?{xSqpW<n_g}8e
zpK5r!+2}WGP1lL%s-oRmH;?&#6`E&k=3;W4)n?Jfx1l>7k01ENw%|dr*$%<4hA;W6
zK69|_VA9}v&%ZPM`>)d%rN5?Bq|{!2mdO@YAwN0e+{*Qg)BRfK@EI&xZ@$mB($i$F
zLC9>0{5{qkeCODAP5F91i8DY)ar>=#HSd34nJjieKlVR^^0ke++x;%wmFf5{b9UyY
z1jBQwjsab#XP$K3yL-*-3C=7+@-Y`1JJ$9b6BU+ldY9_JuxDAJqpIU?m#~x8Hcg+i
It~y)-0Mt#1@&Et;

literal 286
zcmZQ@_Y83kiVO&0U@FKK*HmKKwCUX6>dfg&*?OjPdAiP!J(l?EoL%CBy^k5T2mIGO
z5qaZY?8ElQA??eX@6EY=WAE<^$9nVM)wxw%J%8-Rk$LYAH<eCe_~}s1V10O9fb`=3
z1!s?`+lnpIGjlX~v|Y4l$M5%N1dF}=0)$y|D*o*?W8;l6=1~yalqZlNv)QfkTjYdY
zJ7%Z7G|)fw#Xmpq@cXF-O8fuG@4R?8c$$V;|7yl>)7SK*Z?fBRPyJG}N8{qd6Z`ay
zTUCl@PCaXN`o%^0$BUbjFV~!RsSRO1@kDLM{Jl$#+`4muZ-aPQ`pKSSRyBvFuJf49
xT`BNNKU{l4cCy#0slK)x%X?3A<X_yRkrEqt&S~MUKaY2{<;m#$-MvP$7yyizkGTK<

diff --git a/secrets/murmur-password-env.age b/secrets/murmur-password-env.age
index 615f9122ac6474c1b004ff9b11666b47c7aa2b22..825b10e2cf154d191125a52621005c6d19d78eff 100644
GIT binary patch
literal 267
zcmZQ@_Y83kiVO&02&iLfTDE+V)(abH>*y&j%P;8W<lZv4qbx17@wvfC*L^dL6*)d0
z^7=Vznp~)T(J>>@ZvwUFV=LQzvqR-W%3G>GZetO?aNp;F?sPi|(G4Y>sSZ5HWo*5S
zWK}vsL;tI+H06-sT)1jW{G9L`i}aG6CU=N*Z2#zZZ0VgvlQ!u`2&gak`n=w2hT{<(
zd2a!ITi^AyXALLqE%UjW^(*!8y_(5EW$O)g<j!BnSfdm8yX>1@GuHvL$mge+x8K<p
z-L<2x(j~dtr6gi<a)!qHH~FrtnX6(l>Yw##I(zD*U3;DH$L^$H6vbJlc)XVNjP~ZG
Z*A7eadE2>2`IpKZepcu3D>BNy4FHg)b%g)`

literal 255
zcmZQ@_Y83kiVO&0Fi-Evj#iw0zS;cz`}KM6l$T}cmgmS;yGh1)*H+X%>{j_M<TPWd
z_~%{5`8!3}c&&cw6(!o(tj}LLjo~4qw_Se5J_#M$g5Os+9e)`uvin})<7GeDZ0}m}
zKYrrszjd;0h@0STC7&s8j!MV<e%LI$Q|$-S{vyk@uHkVvZXXnndVW}8V$m1dJ>f<L
zO9W0`Ub7`(*OH*1V_CsAMh>Q`XQeKmQWcYt@IPa`sqEY&YZs03h)GtCSq@$@^={{@
z7BmOgnBNx)KfNSlbNM$mJzM6Fg3_LKavQc6R)<gB8LE@h8F2Gt-{tvkExZ97Epjf?
NwOY>bhb^rP005IxaU=i$

diff --git a/secrets/ntfy-alerts-topic.age b/secrets/ntfy-alerts-topic.age
index 2fc770fbbef742c789afc491d5ff04bbf238bc69..0e67825c07a9dc89bc9edee77788d951ee07dc23 100644
GIT binary patch
literal 254
zcmZQ@_Y83kiVO&0aFy_m+aTcdCGS+d{>8+k?5iAHJ+*66HUDueetbzZxYPBAQedE-
z@k8%`Uk@~M&tLHQ;cAfT+_9p0^TE!Qwl~imasJ}B^_a82%jV9zX~*gqE#uQ`)vez%
zw0{V_m6?(3`goBd*SWj=$6wXdYOaa3zn*(X`d%NC^@rb$Yu+#CSe)pez2L~jt|LqO
zcyomOYu>n?s+T?O=}}g*U~;{Q!R*aCic0EvPv=kBedNyvzB^UAs=9ZNSn$64$fEpI
zEwJ_OB#(xexVEr#<2A7}HvQUY(7){6zl7jp{zuKa9tpZ06MCLopr3E`VOGPEiY8B6
MzSg|td*O};0f8`jh5!Hn

literal 254
zcmZQ@_Y83kiVO&0*c!KaUy|7piG9M~mgGh(+v>pAvf!UerPvJjt)}bq6u8Y_ZT#i9
z{6NKyla}v7V<L|pY3yHDHQ!t9<BNrp9Oga}*EEc34}Lwf)3){BgOhspE}eP`GoINA
zS$5mp%_#YPF3>dfiMIs*PyR*gK3J@6@8&g?Okw@Or~HC9c2%J4uK8!DAH8QfBkoj9
ze?sO2v3dW^+J4{5GJNg-PWZ0<@^sGCm9|fGwtl)-^7_Ohi7L6Nf-kP@oFj8($|-xB
znFszeCtk|G{;1n%wwAHdSMS5S51)TNKjFN9!_(6VMFJ1q_swaWxF>qzs%6dpPH`1v
PFzhV!RS1{4RV)qw<<))X

diff --git a/services/gitea-actions-runner.nix b/services/gitea-actions-runner.nix
new file mode 100644
index 0000000..748d47b
--- /dev/null
+++ b/services/gitea-actions-runner.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  services.gitea-actions-runner.instances.muffin = {
+    enable = true;
+    name = "muffin";
+    url = config.services.gitea.settings.server.ROOT_URL;
+    tokenFile = config.age.secrets.gitea-runner-token.path;
+    labels = [ "nix:host" ];
+    hostPackages = with pkgs; [
+      bash
+      coreutils
+      curl
+      gawk
+      git
+      git-crypt
+      gnugrep
+      gnused
+      jq
+      nix
+      nodejs
+      openssh
+    ];
+    settings = {
+      runner = {
+        capacity = 1;
+        timeout = "3h";
+      };
+    };
+  };
+
+  # Override DynamicUser to use our static gitea-runner user
+  systemd.services."gitea-runner-muffin" = {
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "gitea-runner";
+      Group = "gitea-runner";
+    };
+    environment.GIT_SSH_COMMAND = "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts";
+  };
+}
diff --git a/services/gitea.nix b/services/gitea.nix
index dff1abe..907abe5 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -37,6 +37,7 @@
       };
       # only I shall use gitea
       service.DISABLE_REGISTRATION = true;
+      actions.ENABLED = true;
     };
   };
 
diff --git a/services/ssh.nix b/services/ssh.nix
index d5b0730..e0f2a4f 100644
--- a/services/ssh.nix
+++ b/services/ssh.nix
@@ -31,5 +31,8 @@
 
   # used for deploying configs to server
   users.users.root.openssh.authorizedKeys.keys =
-    config.users.users.${username}.openssh.authorizedKeys.keys;
+    config.users.users.${username}.openssh.authorizedKeys.keys
+    ++ [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5ZYN6idL/w/mUIfPOH1i+Q/SQXuzAMQUEuWpipx1Pc ci-deploy@muffin"
+    ];
 }
diff --git a/tests/gitea-runner.nix b/tests/gitea-runner.nix
new file mode 100644
index 0000000..dbf98d3
--- /dev/null
+++ b/tests/gitea-runner.nix
@@ -0,0 +1,60 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+pkgs.testers.runNixOSTest {
+  name = "gitea-runner";
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.gitea = {
+        enable = true;
+        database.type = "sqlite3";
+        settings = {
+          server = {
+            HTTP_PORT = 3000;
+            ROOT_URL = "http://localhost:3000";
+            DOMAIN = "localhost";
+          };
+          actions.ENABLED = true;
+          service.DISABLE_REGISTRATION = true;
+        };
+      };
+
+      specialisation.runner = {
+        inheritParentConfig = true;
+        configuration.services.gitea-actions-runner.instances.test = {
+          enable = true;
+          name = "ci";
+          url = "http://localhost:3000";
+          labels = [ "native:host" ];
+          tokenFile = "/var/lib/gitea/runner_token";
+        };
+      };
+    };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("gitea.service")
+    machine.wait_for_open_port(3000)
+
+    # Generate runner token
+    machine.succeed(
+        "su -l gitea -s /bin/sh -c '${pkgs.gitea}/bin/gitea actions generate-runner-token --work-path /var/lib/gitea' | tail -1 | sed 's/^/TOKEN=/' > /var/lib/gitea/runner_token"
+    )
+
+    # Switch to runner specialisation
+    machine.succeed(
+        "/run/current-system/specialisation/runner/bin/switch-to-configuration test"
+    )
+
+    # Start the runner (specialisation switch doesn't auto-start new services)
+    machine.succeed("systemctl start gitea-runner-test.service")
+    machine.wait_for_unit("gitea-runner-test.service")
+    machine.succeed("sleep 5")
+    machine.succeed("test -f /var/lib/gitea-runner/test/.runner")
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index 27684a2..44b1db0 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -27,4 +27,7 @@ in
 
   # torrent audit test
   torrentAuditTest = handleTest ./torrent-audit.nix;
+
+  # gitea runner test
+  giteaRunnerTest = handleTest ./gitea-runner.nix;
 }

From e3be112b8215955402b85c720ff4896aa3e0d8b8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 10:57:40 -0400
Subject: [PATCH 722/847] grafana: init

Shows powerdraw, temps, uptime, and jellyfin streams
---
 configuration.nix       |   1 +
 service-configs.nix     |  21 ++
 services/monitoring.nix | 530 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 552 insertions(+)
 create mode 100644 services/monitoring.nix

diff --git a/configuration.nix b/configuration.nix
index 65d960f..cad6b63 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -47,6 +47,7 @@
     ./services/soulseek.nix
 
     ./services/ups.nix
+    ./services/monitoring.nix
 
     ./services/bitwarden.nix
     ./services/firefox-syncserver.nix
diff --git a/service-configs.nix b/service-configs.nix
index a79a16c..e48a910 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -153,6 +153,22 @@ rec {
         port = 8020;
         proto = "tcp";
       };
+      grafana = {
+        port = 3000;
+        proto = "tcp";
+      };
+      prometheus = {
+        port = 9090;
+        proto = "tcp";
+      };
+      prometheus_node = {
+        port = 9100;
+        proto = "tcp";
+      };
+      prometheus_apcupsd = {
+        port = 9162;
+        proto = "tcp";
+      };
     };
   };
 
@@ -266,6 +282,11 @@ rec {
     domain = "firefox-sync.${https.domain}";
   };
 
+  grafana = {
+    dir = services_dir + "/grafana";
+    domain = "grafana.${https.domain}";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/monitoring.nix b/services/monitoring.nix
new file mode 100644
index 0000000..8dc9ed9
--- /dev/null
+++ b/services/monitoring.nix
@@ -0,0 +1,530 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+
+  promDs = {
+    type = "prometheus";
+    uid = "prometheus";
+  };
+
+  jellyfinCollector = pkgs.writeShellApplication {
+    name = "jellyfin-metrics-collector";
+    runtimeInputs = with pkgs; [
+      curl
+      jq
+    ];
+    text = ''
+      API_KEY=$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")
+      JELLYFIN="http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}"
+
+      if response=$(curl -sf --max-time 5 "''${JELLYFIN}/Sessions?api_key=''${API_KEY}"); then
+        active_streams=$(echo "$response" | jq '[.[] | select(.NowPlayingItem != null)] | length')
+      else
+        active_streams=0
+      fi
+
+      {
+        echo '# HELP jellyfin_active_streams Number of currently active Jellyfin streams'
+        echo '# TYPE jellyfin_active_streams gauge'
+        echo "jellyfin_active_streams $active_streams"
+      } > "${textfileDir}/jellyfin.prom.$$.tmp"
+      mv "${textfileDir}/jellyfin.prom.$$.tmp" "${textfileDir}/jellyfin.prom"
+    '';
+  };
+
+  dashboard = {
+    editable = true;
+    graphTooltip = 1;
+    schemaVersion = 39;
+    tags = [
+      "system"
+      "monitoring"
+    ];
+    time = {
+      from = "now-6h";
+      to = "now";
+    };
+    timezone = "browser";
+    title = "System Overview";
+    uid = "system-overview";
+
+    panels = [
+      # -- Row 1: UPS --
+      {
+        id = 1;
+        type = "timeseries";
+        title = "UPS Power Draw";
+        gridPos = {
+          h = 8;
+          w = 8;
+          x = 0;
+          y = 0;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts";
+            legendFormat = "Power (W)";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "watt";
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 20;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
+      {
+        id = 7;
+        type = "stat";
+        title = "Energy Usage (24h)";
+        gridPos = {
+          h = 8;
+          w = 4;
+          x = 8;
+          y = 0;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts)[24h:]) * 24 / 1000";
+            legendFormat = "";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "kwatth";
+            decimals = 2;
+            thresholds = {
+              mode = "absolute";
+              steps = [
+                {
+                  color = "green";
+                  value = null;
+                }
+                {
+                  color = "yellow";
+                  value = 5;
+                }
+                {
+                  color = "red";
+                  value = 10;
+                }
+              ];
+            };
+          };
+          overrides = [ ];
+        };
+        options = {
+          reduceOptions = {
+            calcs = [ "lastNotNull" ];
+            fields = "";
+            values = false;
+          };
+          colorMode = "value";
+          graphMode = "none";
+        };
+      }
+      {
+        id = 2;
+        type = "gauge";
+        title = "UPS Load";
+        gridPos = {
+          h = 8;
+          w = 6;
+          x = 12;
+          y = 0;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "apcupsd_ups_load_percent";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "percent";
+            min = 0;
+            max = 100;
+            thresholds = {
+              mode = "absolute";
+              steps = [
+                {
+                  color = "green";
+                  value = null;
+                }
+                {
+                  color = "yellow";
+                  value = 70;
+                }
+                {
+                  color = "red";
+                  value = 90;
+                }
+              ];
+            };
+          };
+          overrides = [ ];
+        };
+        options.reduceOptions = {
+          calcs = [ "lastNotNull" ];
+          fields = "";
+          values = false;
+        };
+      }
+      {
+        id = 3;
+        type = "gauge";
+        title = "UPS Battery";
+        gridPos = {
+          h = 8;
+          w = 6;
+          x = 18;
+          y = 0;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "apcupsd_battery_charge_percent";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "percent";
+            min = 0;
+            max = 100;
+            thresholds = {
+              mode = "absolute";
+              steps = [
+                {
+                  color = "red";
+                  value = null;
+                }
+                {
+                  color = "yellow";
+                  value = 20;
+                }
+                {
+                  color = "green";
+                  value = 50;
+                }
+              ];
+            };
+          };
+          overrides = [ ];
+        };
+        options.reduceOptions = {
+          calcs = [ "lastNotNull" ];
+          fields = "";
+          values = false;
+        };
+      }
+
+      # -- Row 2: System --
+      {
+        id = 4;
+        type = "timeseries";
+        title = "CPU Temperature";
+        gridPos = {
+          h = 8;
+          w = 12;
+          x = 0;
+          y = 8;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = ''node_hwmon_temp_celsius{chip=~"pci.*"}'';
+            legendFormat = "CPU {{sensor}}";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "celsius";
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 10;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
+      {
+        id = 5;
+        type = "stat";
+        title = "System Uptime";
+        gridPos = {
+          h = 8;
+          w = 6;
+          x = 12;
+          y = 8;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "time() - node_boot_time_seconds";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "s";
+            thresholds = {
+              mode = "absolute";
+              steps = [
+                {
+                  color = "green";
+                  value = null;
+                }
+              ];
+            };
+          };
+          overrides = [ ];
+        };
+        options = {
+          reduceOptions = {
+            calcs = [ "lastNotNull" ];
+            fields = "";
+            values = false;
+          };
+          colorMode = "value";
+          graphMode = "none";
+        };
+      }
+      {
+        id = 6;
+        type = "stat";
+        title = "Jellyfin Active Streams";
+        gridPos = {
+          h = 8;
+          w = 6;
+          x = 18;
+          y = 8;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "jellyfin_active_streams";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            thresholds = {
+              mode = "absolute";
+              steps = [
+                {
+                  color = "green";
+                  value = null;
+                }
+                {
+                  color = "yellow";
+                  value = 3;
+                }
+                {
+                  color = "red";
+                  value = 6;
+                }
+              ];
+            };
+          };
+          overrides = [ ];
+        };
+        options = {
+          reduceOptions = {
+            calcs = [ "lastNotNull" ];
+            fields = "";
+            values = false;
+          };
+          colorMode = "value";
+          graphMode = "area";
+        };
+      }
+    ];
+  };
+in
+{
+  imports = [
+    (lib.serviceMountWithZpool "grafana" service_configs.zpool_ssds [
+      service_configs.grafana.dir
+    ])
+    (lib.serviceFilePerms "grafana" [
+      "Z ${service_configs.grafana.dir} 0700 grafana grafana"
+    ])
+    (lib.serviceMountWithZpool "prometheus" service_configs.zpool_ssds [
+      "/var/lib/prometheus"
+    ])
+    (lib.serviceFilePerms "prometheus" [
+      "Z /var/lib/prometheus 0700 prometheus prometheus"
+    ])
+  ];
+
+  # -- Prometheus --
+  services.prometheus = {
+    enable = true;
+    port = service_configs.ports.private.prometheus.port;
+    listenAddress = "127.0.0.1";
+    stateDir = "prometheus";
+    retentionTime = "90d";
+
+    exporters = {
+      node = {
+        enable = true;
+        port = service_configs.ports.private.prometheus_node.port;
+        listenAddress = "127.0.0.1";
+        enabledCollectors = [
+          "hwmon"
+          "systemd"
+          "textfile"
+        ];
+        extraFlags = [
+          "--collector.textfile.directory=${textfileDir}"
+        ];
+      };
+
+      apcupsd = {
+        enable = true;
+        port = service_configs.ports.private.prometheus_apcupsd.port;
+        listenAddress = "127.0.0.1";
+        apcupsdAddress = "127.0.0.1:3551";
+      };
+    };
+
+    scrapeConfigs = [
+      {
+        job_name = "prometheus";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus.port}" ]; }
+        ];
+      }
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_node.port}" ]; }
+        ];
+      }
+      {
+        job_name = "apcupsd";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_apcupsd.port}" ]; }
+        ];
+      }
+    ];
+  };
+
+  # -- Grafana --
+  services.grafana = {
+    enable = true;
+    dataDir = service_configs.grafana.dir;
+
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = service_configs.ports.private.grafana.port;
+        domain = service_configs.grafana.domain;
+        root_url = "https://${service_configs.grafana.domain}";
+      };
+
+      # Caddy handles auth -- disable Grafana login entirely
+      "auth.anonymous" = {
+        enabled = true;
+        org_role = "Admin";
+      };
+      "auth.basic".enabled = false;
+      "auth".disable_login_form = true;
+
+      analytics.reporting_enabled = false;
+    };
+
+    provision = {
+      datasources.settings = {
+        apiVersion = 1;
+        datasources = [
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://127.0.0.1:${toString service_configs.ports.private.prometheus.port}";
+            access = "proxy";
+            isDefault = true;
+            editable = false;
+            uid = "prometheus";
+          }
+        ];
+      };
+
+      dashboards.settings.providers = [
+        {
+          name = "system";
+          type = "file";
+          options.path = "/etc/grafana-dashboards";
+          disableDeletion = true;
+          updateIntervalSeconds = 60;
+        }
+      ];
+    };
+  };
+
+  # Provision dashboard JSON
+  environment.etc."grafana-dashboards/system-overview.json" = {
+    text = builtins.toJSON dashboard;
+    mode = "0444";
+  };
+
+  # Caddy reverse proxy with auth
+  services.caddy.virtualHosts."${service_configs.grafana.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${builtins.toString service_configs.ports.private.grafana.port}
+  '';
+
+  # -- Jellyfin metrics collector --
+  # Queries the Jellyfin API for active streams and writes a .prom file
+  # for the node_exporter textfile collector.
+  systemd.services.jellyfin-metrics-collector = {
+    description = "Collect Jellyfin metrics for Prometheus";
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe jellyfinCollector;
+      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+    };
+  };
+
+  systemd.timers.jellyfin-metrics-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/30";
+      RandomizedDelaySec = "5s";
+    };
+  };
+
+  # Ensure textfile collector directory exists (tmpfs root -- recreated on boot)
+  systemd.tmpfiles.rules = [
+    "d ${textfileDir} 0755 root root -"
+  ];
+}

From bc227a89c1e55ad70363f9d1d206f3fc4e767620 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 12:46:18 -0400
Subject: [PATCH 723/847] remove old secrets

---
 secrets/coturn_static_auth_secret | Bin 87 -> 0 bytes
 secrets/matrix_reg_token          | Bin 87 -> 0 bytes
 secrets/murmur_password           | Bin 39 -> 0 bytes
 secrets/slskd_env                 | Bin 157 -> 0 bytes
 secrets/xmrig-wallet              | Bin 118 -> 0 bytes
 5 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 secrets/coturn_static_auth_secret
 delete mode 100644 secrets/matrix_reg_token
 delete mode 100644 secrets/murmur_password
 delete mode 100644 secrets/slskd_env
 delete mode 100644 secrets/xmrig-wallet

diff --git a/secrets/coturn_static_auth_secret b/secrets/coturn_static_auth_secret
deleted file mode 100644
index 3685e68ee08f4c71d779a914a788c006671be6f8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 87
zcmZQ@_Y83kiVO&0ID7N=#3kJ6LG#OhF7rDj*`hl|@U&CV^!-8UjB*Z#_At53c$K6h
uec%m;{o2~XZ{}wb8dvn}xV(5xM{QI~q^6j$&AqDMu6K@F-HUR+{0{(^J}E2!

diff --git a/secrets/matrix_reg_token b/secrets/matrix_reg_token
deleted file mode 100644
index 87488e9777643b7a6cb749275069f0782431bc4d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 87
zcmZQ@_Y83kiVO&0m@B>Ve10(Nq>w53ZX)J;fA2XVaAJv8l+bn0d)Gvw_XuveA9=WI
u=CJ_3>dcPU0c#eTrSR}Ix~<@@{=30+*5hjr_HJ*=x$jfB&}H+{cYFYT@+pM?

diff --git a/secrets/murmur_password b/secrets/murmur_password
deleted file mode 100644
index d1dd0c80284b03aa851d8dd7602c99ab7ac4a0be..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 39
vcmZQ@_Y83kiVO&0IB`5$soc=q?oPuWji6M?8SlP!%6<rc<@1-}<io`PD|->x

diff --git a/secrets/slskd_env b/secrets/slskd_env
deleted file mode 100644
index b0fc4661b5140543a548fcd489d05789ab9c8c66..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 157
zcmZQ@_Y83kiVO&0I4dRSyfr5~dF6!7duH9)p*wqi`ri}#Qa*S$iY`=ZR-M7G#NeIl
z^5P<Qdvis7>e*#}?dv8gc$j6@O!j}=u`Ng9pVW+4-}u0{=OP{IcRT;|Fz^1Z#$7z;
z!Hk0Vca!|qSS8vVU34Rgxw~FS$uvPP;N?l}^XfGxH~d@dw(WAc)Mmf0(|p9DW;bwo
P3py{b<o%x1Z*m6!?VLzC

diff --git a/secrets/xmrig-wallet b/secrets/xmrig-wallet
deleted file mode 100644
index 64676de3957c531104e763574304134d498f9fab..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 118
zcmZQ@_Y83kiVO&0aF019cA@{w{e^ohwsfnN#Fs8-v^{nCZ?xL{E31#+s}|ZB#l-8%
zp#MB;b5Bmy{`Tuz-fvc3c<zq;R*|<VYF84kU;TAml%+bVMR{`Q9+9-dAm7kyQ#^9~
bp85H3DurwP+_@z_$b8C?BYty5{#^tByp1?K


From ebc4c66fc3586adbbdc8271b56f3933cbb867b6d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 12:52:21 -0400
Subject: [PATCH 724/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index c350d36..dfc132f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1774896109,
-        "narHash": "sha256-0ue9vbpiLP5ZHZd5e7eQAplM9Rb4tunV+u5xcJDJ+lc=",
+        "lastModified": 1774899286,
+        "narHash": "sha256-fuHDpWYjyc0Dxq0iH310vmdyfdTTj3ufSIZ6vbwuQzU=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "cb646a9e33cfa6b7d5facd9b7d4ca738ad1ff953",
+        "rev": "676dec3b72efdae4a27b46e6059aa094f5069eca",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774777275,
-        "narHash": "sha256-qogBiYFq8hZusDPeeKRqzelBAhZvREc7Cl+qlewGUCg=",
+        "lastModified": 1774933469,
+        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b8f81636927f1af0cca812d22c876bad0a883ccd",
+        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1774388614,
-        "narHash": "sha256-tFwzTI0DdDzovdE9+Ras6CUss0yn8P9XV4Ja6RjA+nU=",
+        "lastModified": 1774799055,
+        "narHash": "sha256-Tsq9BCz0q47ej1uFF39m4tuhcwru/ls6vCCJzutEpaw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1073dad219cb244572b74da2b20c7fe39cb3fa9e",
+        "rev": "107cba9eb4a8d8c9f8e9e61266d78d340867913a",
         "type": "github"
       },
       "original": {
@@ -472,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774517972,
-        "narHash": "sha256-oPIVzGlMmfWuJlRbr87yU3cnV8NxtwTG92GqpQczlkw=",
+        "lastModified": 1774909327,
+        "narHash": "sha256-P0L3fYEiQHp2bKrBF+H9GCPYKhLohE32Bu5OgnGYh7o=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "0ddba2fbd72bb60f8b35b7de1ad67590f454d402",
+        "rev": "154666bca66525a3f6cc206df1cc5ae84e1450b6",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774822185,
-        "narHash": "sha256-vEVjI/PWBfxLd1dzlo1MUSqeH5J33OLU7a5dfuzOKu4=",
+        "lastModified": 1774908585,
+        "narHash": "sha256-Jf3dbkZOwe0/7l4CNg2UDkOYEH+Z/yoYBTrx5RrN2Ss=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "c77ccbef4be871a37dcbd3465d62bb8b5c7bc025",
+        "rev": "29d08b113aa65020968dd5cd9207c7479c8c28ff",
         "type": "github"
       },
       "original": {

From 0027489052604f2dd0fb04b2433c853e7d0e001e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 13:20:07 -0400
Subject: [PATCH 725/847] grafana: smooth power draw

---
 services/monitoring.nix | 51 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 50 insertions(+), 1 deletion(-)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index 8dc9ed9..a87c578 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -74,6 +74,12 @@ let
             legendFormat = "Power (W)";
             refId = "A";
           }
+          {
+            datasource = promDs;
+            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts)[1h:])";
+            legendFormat = "1h average (W)";
+            refId = "B";
+          }
         ];
         fieldConfig = {
           defaults = {
@@ -85,7 +91,50 @@ let
               spanNulls = true;
             };
           };
-          overrides = [ ];
+          overrides = [
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "A";
+              };
+              properties = [
+                {
+                  id = "custom.lineStyle";
+                  value = {
+                    fill = "dot";
+                  };
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 10;
+                }
+                {
+                  id = "custom.lineWidth";
+                  value = 1;
+                }
+                {
+                  id = "custom.pointSize";
+                  value = 1;
+                }
+              ];
+            }
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "B";
+              };
+              properties = [
+                {
+                  id = "custom.lineWidth";
+                  value = 4;
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 0;
+                }
+              ];
+            }
+          ];
         };
       }
       {

From c6b889cea3d44758525e2f249e76c57dbcd411cf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 17:25:06 -0400
Subject: [PATCH 726/847] grafana: more things

1. Smoothed out power draw
- UPS only reports on 9 watt intervals, so smoothing it out gives more
relative detail on trends
2. Add jellyfin integration
- Good for seeing correlations between statistics and jellyfin streams
3. intel gpu stats
- Provides info on utilization of the gpu
---
 configuration.nix                 |   1 +
 services/intel-gpu-collector.py   |  78 ++++++++++
 services/jellyfin-annotations.nix |  40 +++++
 services/jellyfin-annotations.py  | 233 ++++++++++++++++++++++++++++
 services/monitoring.nix           |  88 ++++++++++-
 tests/jellyfin-annotations.nix    | 243 ++++++++++++++++++++++++++++++
 tests/tests.nix                   |   3 +
 7 files changed, 679 insertions(+), 7 deletions(-)
 create mode 100644 services/intel-gpu-collector.py
 create mode 100644 services/jellyfin-annotations.nix
 create mode 100644 services/jellyfin-annotations.py
 create mode 100644 tests/jellyfin-annotations.nix

diff --git a/configuration.nix b/configuration.nix
index cad6b63..adbd64e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -48,6 +48,7 @@
 
     ./services/ups.nix
     ./services/monitoring.nix
+    ./services/jellyfin-annotations.nix
 
     ./services/bitwarden.nix
     ./services/firefox-syncserver.nix
diff --git a/services/intel-gpu-collector.py b/services/intel-gpu-collector.py
new file mode 100644
index 0000000..97aacec
--- /dev/null
+++ b/services/intel-gpu-collector.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+import json
+import os
+import subprocess
+import sys
+import time
+
+TEXTFILE = os.environ.get(
+    "TEXTFILE",
+    "/var/lib/prometheus-node-exporter-textfiles/intel-gpu.prom",
+)
+
+
+def read_one_sample():
+    proc = subprocess.Popen(
+        ["intel_gpu_top", "-J", "-s", "1000"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.DEVNULL,
+    )
+    buf = b""
+    depth = 0
+    in_obj = False
+    deadline = time.monotonic() + 5.0
+    try:
+        while time.monotonic() < deadline:
+            byte = proc.stdout.read(1)
+            if not byte:
+                break
+            if byte == b"{":
+                in_obj = True
+                depth += 1
+            if in_obj:
+                buf += byte
+            if in_obj and byte == b"}":
+                depth -= 1
+                if depth == 0:
+                    break
+    finally:
+        proc.terminate()
+        proc.wait()
+    return json.loads(buf) if buf else None
+
+
+def write_metrics(sample):
+    lines = [
+        "# HELP intel_gpu_engine_busy_percent Intel GPU engine busy percentage",
+        "# TYPE intel_gpu_engine_busy_percent gauge",
+    ]
+    for engine, data in sample.get("engines", {}).items():
+        lines.append(
+            f'intel_gpu_engine_busy_percent{{engine="{engine}"}} {data.get("busy", 0)}'
+        )
+    freq = sample.get("frequency", {})
+    lines += [
+        "# HELP intel_gpu_frequency_mhz Intel GPU actual frequency in MHz",
+        "# TYPE intel_gpu_frequency_mhz gauge",
+        f'intel_gpu_frequency_mhz {freq.get("actual", 0)}',
+        "# HELP intel_gpu_rc6_percent Intel GPU RC6 power-saving state percentage",
+        "# TYPE intel_gpu_rc6_percent gauge",
+        f'intel_gpu_rc6_percent {sample.get("rc6", {}).get("value", 0)}',
+    ]
+
+    tmp = TEXTFILE + ".tmp"
+    with open(tmp, "w") as f:
+        f.write("\n".join(lines) + "\n")
+    os.replace(tmp, TEXTFILE)
+
+
+def main():
+    sample = read_one_sample()
+    if sample is None:
+        print("Failed to read intel_gpu_top sample", file=sys.stderr)
+        sys.exit(1)
+    write_metrics(sample)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/services/jellyfin-annotations.nix b/services/jellyfin-annotations.nix
new file mode 100644
index 0000000..93abea2
--- /dev/null
+++ b/services/jellyfin-annotations.nix
@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  systemd.services.jellyfin-annotations = {
+    description = "Jellyfin stream annotation service for Grafana";
+    after = [
+      "network.target"
+      "grafana.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.python3}/bin/python3 ${./jellyfin-annotations.py}";
+      Restart = "always";
+      RestartSec = "10s";
+      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+      DynamicUser = true;
+      StateDirectory = "jellyfin-annotations";
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      MemoryDenyWriteExecute = true;
+    };
+    environment = {
+      JELLYFIN_URL = "http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}";
+      GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
+      STATE_FILE = "/var/lib/jellyfin-annotations/state.json";
+      POLL_INTERVAL = "30";
+    };
+  };
+}
diff --git a/services/jellyfin-annotations.py b/services/jellyfin-annotations.py
new file mode 100644
index 0000000..edd2ba1
--- /dev/null
+++ b/services/jellyfin-annotations.py
@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+import json
+import os
+import sys
+import time
+import urllib.request
+from pathlib import Path
+
+JELLYFIN_URL = os.environ.get("JELLYFIN_URL", "http://127.0.0.1:8096")
+GRAFANA_URL = os.environ.get("GRAFANA_URL", "http://127.0.0.1:3000")
+STATE_FILE = os.environ.get("STATE_FILE", "/var/lib/jellyfin-annotations/state.json")
+POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "30"))
+
+
+def get_api_key():
+    cred_dir = os.environ.get("CREDENTIALS_DIRECTORY")
+    if cred_dir:
+        return Path(cred_dir, "jellyfin-api-key").read_text().strip()
+    for p in ["/run/agenix/jellyfin-api-key"]:
+        if Path(p).exists():
+            return Path(p).read_text().strip()
+    sys.exit("ERROR: Cannot find jellyfin-api-key")
+
+
+def http_json(method, url, body=None):
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(
+        url,
+        data=data,
+        headers={"Content-Type": "application/json", "Accept": "application/json"},
+        method=method,
+    )
+    with urllib.request.urlopen(req, timeout=5) as resp:
+        return json.loads(resp.read())
+
+
+def get_active_sessions(api_key):
+    try:
+        req = urllib.request.Request(
+            f"{JELLYFIN_URL}/Sessions?api_key={api_key}",
+            headers={"Accept": "application/json"},
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            sessions = json.loads(resp.read())
+        return [s for s in sessions if s.get("NowPlayingItem")]
+    except Exception as e:
+        print(f"Error fetching sessions: {e}", file=sys.stderr)
+        return None
+
+
+def _codec(name):
+    if not name:
+        return ""
+    aliases = {"h264": "H.264", "h265": "H.265", "hevc": "H.265", "av1": "AV1",
+               "vp9": "VP9", "vp8": "VP8", "mpeg4": "MPEG-4", "mpeg2video": "MPEG-2",
+               "aac": "AAC", "ac3": "AC3", "eac3": "EAC3", "dts": "DTS",
+               "truehd": "TrueHD", "mp3": "MP3", "opus": "Opus", "flac": "FLAC",
+               "vorbis": "Vorbis"}
+    return aliases.get(name.lower(), name.upper())
+
+
+def _res(width, height):
+    if not height:
+        return ""
+    common = {2160: "4K", 1440: "1440p", 1080: "1080p", 720: "720p",
+              480: "480p", 360: "360p"}
+    return common.get(height, f"{height}p")
+
+
+def _channels(n):
+    labels = {1: "Mono", 2: "Stereo", 6: "5.1", 7: "6.1", 8: "7.1"}
+    return labels.get(n, f"{n}ch") if n else ""
+
+
+def format_label(session):
+    user = session.get("UserName", "Unknown")
+    item = session.get("NowPlayingItem", {}) or {}
+    transcode = session.get("TranscodingInfo") or {}
+    play_state = session.get("PlayState") or {}
+    client = session.get("Client", "")
+    device = session.get("DeviceName", "")
+
+    name = item.get("Name", "Unknown")
+    series = item.get("SeriesName", "")
+    season = item.get("ParentIndexNumber")
+    episode = item.get("IndexNumber")
+    media_type = item.get("Type", "")
+
+    if series and season and episode:
+        title = f"{series} S{season:02d}E{episode:02d} \u2013 {name}"
+    elif series:
+        title = f"{series} \u2013 {name}"
+    elif media_type == "Movie":
+        title = f"{name} (movie)"
+    else:
+        title = name
+
+    play_method = play_state.get("PlayMethod", "")
+    if play_method == "DirectPlay":
+        method = "Direct Play"
+    elif play_method == "DirectStream":
+        method = "Direct Stream"
+    elif play_method == "Transcode" or transcode:
+        method = "Transcode"
+    else:
+        method = "Direct Play"
+
+    media_streams = item.get("MediaStreams") or []
+    video_streams = [s for s in media_streams if s.get("Type") == "Video"]
+    audio_streams = [s for s in media_streams if s.get("Type") == "Audio"]
+    default_audio = next((s for s in audio_streams if s.get("IsDefault")), None)
+    audio_stream = default_audio or (audio_streams[0] if audio_streams else {})
+    video_stream = video_streams[0] if video_streams else {}
+
+    src_vcodec = _codec(video_stream.get("Codec", ""))
+    src_res = _res(video_stream.get("Width") or item.get("Width"),
+                   video_stream.get("Height") or item.get("Height"))
+    src_acodec = _codec(audio_stream.get("Codec", ""))
+    src_channels = _channels(audio_stream.get("Channels"))
+
+    is_video_direct = transcode.get("IsVideoDirect", True)
+    is_audio_direct = transcode.get("IsAudioDirect", True)
+
+    if transcode and not is_video_direct:
+        dst_vcodec = _codec(transcode.get("VideoCodec", ""))
+        dst_res = _res(transcode.get("Width"), transcode.get("Height")) or src_res
+        if src_vcodec and dst_vcodec and src_vcodec != dst_vcodec:
+            video_part = f"{src_vcodec}\u2192{dst_vcodec} {dst_res}".strip()
+        else:
+            video_part = f"{dst_vcodec or src_vcodec} {dst_res}".strip()
+    else:
+        video_part = f"{src_vcodec} {src_res}".strip()
+
+    if transcode and not is_audio_direct:
+        dst_acodec = _codec(transcode.get("AudioCodec", ""))
+        dst_channels = _channels(transcode.get("AudioChannels")) or src_channels
+        if src_acodec and dst_acodec and src_acodec != dst_acodec:
+            audio_part = f"{src_acodec}\u2192{dst_acodec} {dst_channels}".strip()
+        else:
+            audio_part = f"{dst_acodec or src_acodec} {dst_channels}".strip()
+    else:
+        audio_part = f"{src_acodec} {src_channels}".strip()
+
+    bitrate = transcode.get("Bitrate") or item.get("Bitrate")
+    bitrate_part = f"{bitrate / 1_000_000:.1f} Mbps" if bitrate else ""
+
+    reasons = transcode.get("TranscodeReasons") or []
+    reason_part = f"[{', '.join(reasons)}]" if reasons else ""
+
+    stream_parts = [p for p in [method, video_part, audio_part, bitrate_part, reason_part] if p]
+    client_str = " \u00b7 ".join(filter(None, [client, device]))
+
+    lines = [f"{user}: {title}", " | ".join(stream_parts)]
+    if client_str:
+        lines.append(client_str)
+
+    return "\n".join(lines)
+
+
+def load_state():
+    try:
+        with open(STATE_FILE) as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError):
+        return {}
+
+
+def save_state(state):
+    os.makedirs(os.path.dirname(STATE_FILE), exist_ok=True)
+    tmp = STATE_FILE + ".tmp"
+    with open(tmp, "w") as f:
+        json.dump(state, f)
+    os.replace(tmp, STATE_FILE)
+
+
+def grafana_post(label, start_ms):
+    try:
+        result = http_json(
+            "POST",
+            f"{GRAFANA_URL}/api/annotations",
+            {"time": start_ms, "text": label, "tags": ["jellyfin"]},
+        )
+        return result.get("id")
+    except Exception as e:
+        print(f"Error posting annotation: {e}", file=sys.stderr)
+        return None
+
+
+def grafana_close(grafana_id, end_ms):
+    try:
+        http_json(
+            "PATCH",
+            f"{GRAFANA_URL}/api/annotations/{grafana_id}",
+            {"timeEnd": end_ms},
+        )
+    except Exception as e:
+        print(f"Error closing annotation {grafana_id}: {e}", file=sys.stderr)
+
+
+def main():
+    api_key = get_api_key()
+    state = load_state()
+
+    while True:
+        now_ms = int(time.time() * 1000)
+        sessions = get_active_sessions(api_key)
+
+        if sessions is not None:
+            current_ids = {s["Id"] for s in sessions}
+
+            for s in sessions:
+                sid = s["Id"]
+                if sid not in state:
+                    label = format_label(s)
+                    grafana_id = grafana_post(label, now_ms)
+                    if grafana_id is not None:
+                        state[sid] = {
+                            "grafana_id": grafana_id,
+                            "label": label,
+                            "start_ms": now_ms,
+                        }
+                        save_state(state)
+
+            for sid in [k for k in state if k not in current_ids]:
+                info = state.pop(sid)
+                grafana_close(info["grafana_id"], now_ms)
+                save_state(state)
+
+        time.sleep(POLL_INTERVAL)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/services/monitoring.nix b/services/monitoring.nix
index a87c578..b80be0b 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -38,6 +38,17 @@ let
     '';
   };
 
+  intelGpuCollector = pkgs.writeShellApplication {
+    name = "intel-gpu-collector";
+    runtimeInputs = with pkgs; [
+      python3
+      intel-gpu-tools
+    ];
+    text = ''
+      exec python3 ${./intel-gpu-collector.py}
+    '';
+  };
+
   dashboard = {
     editable = true;
     graphTooltip = 1;
@@ -54,6 +65,21 @@ let
     title = "System Overview";
     uid = "system-overview";
 
+    annotations.list = [
+      {
+        name = "Jellyfin Streams";
+        datasource = {
+          type = "grafana";
+          uid = "-- Grafana --";
+        };
+        enable = true;
+        iconColor = "green";
+        showIn = 0;
+        type = "tags";
+        tags = [ "jellyfin" ];
+      }
+    ];
+
     panels = [
       # -- Row 1: UPS --
       {
@@ -415,6 +441,42 @@ let
           graphMode = "area";
         };
       }
+
+      # -- Row 3: Intel GPU --
+      {
+        id = 8;
+        type = "timeseries";
+        title = "Intel GPU Utilization";
+        gridPos = {
+          h = 8;
+          w = 24;
+          x = 0;
+          y = 16;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "intel_gpu_engine_busy_percent";
+            legendFormat = "{{engine}}";
+            refId = "A";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "percent";
+            min = 0;
+            max = 100;
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 10;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
     ];
   };
 in
@@ -500,7 +562,6 @@ in
         root_url = "https://${service_configs.grafana.domain}";
       };
 
-      # Caddy handles auth -- disable Grafana login entirely
       "auth.anonymous" = {
         enabled = true;
         org_role = "Admin";
@@ -539,21 +600,17 @@ in
     };
   };
 
-  # Provision dashboard JSON
   environment.etc."grafana-dashboards/system-overview.json" = {
     text = builtins.toJSON dashboard;
     mode = "0444";
   };
 
-  # Caddy reverse proxy with auth
   services.caddy.virtualHosts."${service_configs.grafana.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy :${builtins.toString service_configs.ports.private.grafana.port}
   '';
 
-  # -- Jellyfin metrics collector --
-  # Queries the Jellyfin API for active streams and writes a .prom file
-  # for the node_exporter textfile collector.
+  # -- Jellyfin active-stream prometheus textfile collector --
   systemd.services.jellyfin-metrics-collector = {
     description = "Collect Jellyfin metrics for Prometheus";
     after = [ "network.target" ];
@@ -572,7 +629,24 @@ in
     };
   };
 
-  # Ensure textfile collector directory exists (tmpfs root -- recreated on boot)
+  # -- Intel GPU textfile collector --
+  systemd.services.intel-gpu-collector = {
+    description = "Collect Intel GPU metrics for Prometheus";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe intelGpuCollector;
+    };
+    environment.TEXTFILE = "${textfileDir}/intel-gpu.prom";
+  };
+
+  systemd.timers.intel-gpu-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/30";
+      RandomizedDelaySec = "10s";
+    };
+  };
+
   systemd.tmpfiles.rules = [
     "d ${textfileDir} 0755 root root -"
   ];
diff --git a/tests/jellyfin-annotations.nix b/tests/jellyfin-annotations.nix
new file mode 100644
index 0000000..36b6252
--- /dev/null
+++ b/tests/jellyfin-annotations.nix
@@ -0,0 +1,243 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  mockServer = pkgs.writeText "mock-server.py" ''
+    import http.server, json, os, sys
+    from urllib.parse import urlparse
+
+    MODE = sys.argv[1]
+    PORT = int(sys.argv[2])
+    DATA_FILE = sys.argv[3]
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, fmt, *args):
+            pass
+
+        def _read_body(self):
+            length = int(self.headers.get("Content-Length", 0))
+            return json.loads(self.rfile.read(length)) if length else {}
+
+        def _json(self, code, body):
+            data = json.dumps(body).encode()
+            self.send_response(code)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(data)
+
+        def do_GET(self):
+            if MODE == "jellyfin" and self.path.startswith("/Sessions"):
+                try:
+                    with open(DATA_FILE) as f:
+                        sessions = json.load(f)
+                except Exception:
+                    sessions = []
+                self._json(200, sessions)
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self):
+            if MODE == "grafana" and self.path == "/api/annotations":
+                body = self._read_body()
+                try:
+                    with open(DATA_FILE) as f:
+                        annotations = json.load(f)
+                except Exception:
+                    annotations = []
+                aid = len(annotations) + 1
+                body["id"] = aid
+                annotations.append(body)
+                with open(DATA_FILE, "w") as f:
+                    json.dump(annotations, f)
+                self._json(200, {"id": aid, "message": "Annotation added"})
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_PATCH(self):
+            if MODE == "grafana" and self.path.startswith("/api/annotations/"):
+                aid = int(self.path.rsplit("/", 1)[-1])
+                body = self._read_body()
+                try:
+                    with open(DATA_FILE) as f:
+                        annotations = json.load(f)
+                except Exception:
+                    annotations = []
+                for a in annotations:
+                    if a["id"] == aid:
+                        a.update(body)
+                with open(DATA_FILE, "w") as f:
+                    json.dump(annotations, f)
+                self._json(200, {"message": "Annotation patched"})
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+    http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
+  '';
+
+  script = ../services/jellyfin-annotations.py;
+  python = pkgs.python3;
+in
+pkgs.testers.runNixOSTest {
+  name = "jellyfin-annotations";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.python3 ];
+    };
+
+  testScript = ''
+    import json
+    import time
+
+    JELLYFIN_PORT = 18096
+    GRAFANA_PORT  = 13000
+    SESSIONS_FILE = "/tmp/sessions.json"
+    ANNOTS_FILE   = "/tmp/annotations.json"
+    STATE_FILE    = "/tmp/annotations-state.json"
+    CREDS_DIR     = "/tmp/test-creds"
+    PYTHON        = "${python}/bin/python3"
+    MOCK          = "${mockServer}"
+    SCRIPT        = "${script}"
+
+    def read_annotations():
+        out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
+        return json.loads(out.strip())
+
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Setup mock credentials and data files"):
+        machine.succeed(f"mkdir -p {CREDS_DIR} && echo 'fake-api-key' > {CREDS_DIR}/jellyfin-api-key")
+        machine.succeed(f"echo '[]' > {SESSIONS_FILE}")
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+
+    with subtest("Start mock Jellyfin and Grafana servers"):
+        machine.succeed(
+            f"systemd-run --unit=mock-jellyfin {PYTHON} {MOCK} jellyfin {JELLYFIN_PORT} {SESSIONS_FILE}"
+        )
+        machine.succeed(
+            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK} grafana {GRAFANA_PORT} {ANNOTS_FILE}"
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf http://127.0.0.1:{JELLYFIN_PORT}/Sessions", timeout=10
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf -X POST http://127.0.0.1:{GRAFANA_PORT}/api/annotations "
+            f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
+            timeout=10,
+        )
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+
+    with subtest("Start annotation service pointing at mock servers"):
+        machine.succeed(
+            f"systemd-run --unit=annotations-svc "
+            f"--setenv=JELLYFIN_URL=http://127.0.0.1:{JELLYFIN_PORT} "
+            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
+            f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
+            f"--setenv=STATE_FILE={STATE_FILE} "
+            f"--setenv=POLL_INTERVAL=3 "
+            f"{PYTHON} {SCRIPT}"
+        )
+        time.sleep(2)
+
+    with subtest("No annotations pushed when no streams active"):
+        time.sleep(4)
+        annots = read_annotations()
+        assert annots == [], f"Expected no annotations, got: {annots}"
+
+    with subtest("Annotation created when stream starts"):
+        rich_session = json.dumps([{
+            "Id": "sess-1",
+            "UserName": "alice",
+            "Client": "Infuse",
+            "DeviceName": "iPhone",
+            "PlayState": {"PlayMethod": "Transcode"},
+            "NowPlayingItem": {
+                "Name": "Inception",
+                "Type": "Movie",
+                "Bitrate": 20000000,
+                "MediaStreams": [
+                    {"Type": "Video", "Codec": "h264", "Width": 1920, "Height": 1080},
+                    {"Type": "Audio", "Codec": "dts", "Channels": 6, "IsDefault": True},
+                ],
+            },
+            "TranscodingInfo": {
+                "IsVideoDirect": True,
+                "IsAudioDirect": False,
+                "VideoCodec": "h264",
+                "AudioCodec": "aac",
+                "AudioChannels": 2,
+                "Bitrate": 8000000,
+                "TranscodeReasons": ["AudioCodecNotSupported"],
+            },
+        }])
+        machine.succeed(f"echo {repr(rich_session)} > {SESSIONS_FILE}")
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
+            timeout=15,
+        )
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
+        text = annots[0]["text"]
+        assert "alice: Inception (movie)" in text, f"Missing title in: {text}"
+        assert "Transcode" in text, f"Missing method in: {text}"
+        assert "H.264" in text, f"Missing video codec in: {text}"
+        assert "DTS" in text and "AAC" in text, f"Missing audio codec in: {text}"
+        assert "8.0 Mbps" in text, f"Missing bitrate in: {text}"
+        assert "AudioCodecNotSupported" in text, f"Missing transcode reason in: {text}"
+        assert "Infuse" in text and "iPhone" in text, f"Missing client in: {text}"
+        assert "jellyfin" in annots[0].get("tags", []), f"Missing jellyfin tag: {annots[0]}"
+        assert "timeEnd" not in annots[0], f"timeEnd should not be set yet: {annots[0]}"
+
+    with subtest("Annotation closed when stream ends"):
+        machine.succeed(f"echo '[]' > {SESSIONS_FILE}")
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
+            timeout=15,
+        )
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
+        assert "timeEnd" in annots[0], f"timeEnd should be set: {annots[0]}"
+        assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"
+
+    with subtest("Multiple concurrent streams each get their own annotation"):
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+        machine.succeed(
+            f"""echo '[
+              {{"Id":"sess-2","UserName":"bob","NowPlayingItem":{{"Name":"Breaking Bad","SeriesName":"Breaking Bad","ParentIndexNumber":1,"IndexNumber":1}}}},
+              {{"Id":"sess-3","UserName":"carol","NowPlayingItem":{{"Name":"Inception","Type":"Movie"}}}}
+            ]' > {SESSIONS_FILE}"""
+        )
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
+            timeout=15,
+        )
+        annots = read_annotations()
+        assert len(annots) == 2, f"Expected 2 annotations, got: {annots}"
+        texts = sorted(a["text"] for a in annots)
+        assert any("Breaking Bad" in t and "S01E01" in t for t in texts), f"Missing Bob's annotation: {texts}"
+        assert any("carol" in t and "Inception" in t for t in texts), f"Missing Carol's annotation: {texts}"
+
+    with subtest("State survives service restart (no duplicate annotations)"):
+        machine.succeed("systemctl stop annotations-svc || true")
+        time.sleep(1)
+        machine.succeed(
+            f"systemd-run --unit=annotations-svc-2 "
+            f"--setenv=JELLYFIN_URL=http://127.0.0.1:{JELLYFIN_PORT} "
+            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
+            f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
+            f"--setenv=STATE_FILE={STATE_FILE} "
+            f"--setenv=POLL_INTERVAL=3 "
+            f"{PYTHON} {SCRIPT}"
+        )
+        time.sleep(6)
+        annots = read_annotations()
+        assert len(annots) == 2, f"Restart should not create duplicates, got: {annots}"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index 44b1db0..59906f9 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -22,6 +22,9 @@ in
   fail2banImmichTest = handleTest ./fail2ban-immich.nix;
   fail2banJellyfinTest = handleTest ./fail2ban-jellyfin.nix;
 
+  # jellyfin annotation service test
+  jellyfinAnnotationsTest = handleTest ./jellyfin-annotations.nix;
+
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 

From a288e18e6dce551fceed24ad8f72e8b4c9d08667 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 17:47:53 -0400
Subject: [PATCH 727/847] grafana: qbt stats

---
 services/monitoring.nix | 96 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 94 insertions(+), 2 deletions(-)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index b80be0b..3031018 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -49,6 +49,36 @@ let
     '';
   };
 
+  qbittorrentCollector = pkgs.writeShellApplication {
+    name = "qbittorrent-collector";
+    runtimeInputs = with pkgs; [
+      curl
+      jq
+    ];
+    text = ''
+      QBIT="http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}"
+      OUT="${textfileDir}/qbittorrent.prom"
+
+      if info=$(curl -sf --max-time 5 "''${QBIT}/api/v2/transfer/info"); then
+        dl=$(echo "$info" | jq '.dl_info_speed')
+        ul=$(echo "$info" | jq '.up_info_speed')
+      else
+        dl=0
+        ul=0
+      fi
+
+      {
+        echo '# HELP qbittorrent_download_bytes_per_second Current download speed in bytes/s'
+        echo '# TYPE qbittorrent_download_bytes_per_second gauge'
+        echo "qbittorrent_download_bytes_per_second $dl"
+        echo '# HELP qbittorrent_upload_bytes_per_second Current upload speed in bytes/s'
+        echo '# TYPE qbittorrent_upload_bytes_per_second gauge'
+        echo "qbittorrent_upload_bytes_per_second $ul"
+      } > "''${OUT}.tmp"
+      mv "''${OUT}.tmp" "$OUT"
+    '';
+  };
+
   dashboard = {
     editable = true;
     graphTooltip = 1;
@@ -442,7 +472,48 @@ let
         };
       }
 
-      # -- Row 3: Intel GPU --
+      # -- Row 3: qBittorrent --
+      {
+        id = 11;
+        type = "timeseries";
+        title = "qBittorrent Speed";
+        gridPos = {
+          h = 8;
+          w = 24;
+          x = 0;
+          y = 16;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "qbittorrent_download_bytes_per_second";
+            legendFormat = "Download";
+            refId = "A";
+          }
+          {
+            datasource = promDs;
+            expr = "qbittorrent_upload_bytes_per_second";
+            legendFormat = "Upload";
+            refId = "B";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "binBps";
+            min = 0;
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 15;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
+
+      # -- Row 4: Intel GPU --
       {
         id = 8;
         type = "timeseries";
@@ -451,7 +522,7 @@ let
           h = 8;
           w = 24;
           x = 0;
-          y = 16;
+          y = 24;
         };
         datasource = promDs;
         targets = [
@@ -647,6 +718,27 @@ in
     };
   };
 
+  # -- qBittorrent speed textfile collector --
+  systemd.services.qbittorrent-collector = {
+    description = "Collect qBittorrent transfer metrics for Prometheus";
+    after = [
+      "network.target"
+      "qbittorrent.service"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe qbittorrentCollector;
+    };
+  };
+
+  systemd.timers.qbittorrent-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/15";
+      RandomizedDelaySec = "3s";
+    };
+  };
+
   systemd.tmpfiles.rules = [
     "d ${textfileDir} 0755 root root -"
   ];

From 5856d835bab4d6505d63aa4e8a1dd2daa8a4a58d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 18:54:57 -0400
Subject: [PATCH 728/847] grafana: qbt smoothing

---
 services/monitoring.nix | 103 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 100 insertions(+), 3 deletions(-)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index 3031018..f63549e 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -497,6 +497,18 @@ let
             legendFormat = "Upload";
             refId = "B";
           }
+          {
+            datasource = promDs;
+            expr = "avg_over_time(qbittorrent_download_bytes_per_second[10m:])";
+            legendFormat = "Download (10m avg)";
+            refId = "C";
+          }
+          {
+            datasource = promDs;
+            expr = "avg_over_time(qbittorrent_upload_bytes_per_second[10m:])";
+            legendFormat = "Upload (10m avg)";
+            refId = "D";
+          }
         ];
         fieldConfig = {
           defaults = {
@@ -504,12 +516,97 @@ let
             min = 0;
             color.mode = "palette-classic";
             custom = {
-              lineWidth = 2;
-              fillOpacity = 15;
+              lineWidth = 1;
+              fillOpacity = 10;
               spanNulls = true;
             };
           };
-          overrides = [ ];
+          overrides = [
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "A";
+              };
+              properties = [
+                {
+                  id = "color";
+                  value = {
+                    fixedColor = "green";
+                    mode = "fixed";
+                  };
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 5;
+                }
+              ];
+            }
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "B";
+              };
+              properties = [
+                {
+                  id = "color";
+                  value = {
+                    fixedColor = "blue";
+                    mode = "fixed";
+                  };
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 5;
+                }
+              ];
+            }
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "C";
+              };
+              properties = [
+                {
+                  id = "color";
+                  value = {
+                    fixedColor = "green";
+                    mode = "fixed";
+                  };
+                }
+                {
+                  id = "custom.lineWidth";
+                  value = 3;
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 0;
+                }
+              ];
+            }
+            {
+              matcher = {
+                id = "byFrameRefID";
+                options = "D";
+              };
+              properties = [
+                {
+                  id = "color";
+                  value = {
+                    fixedColor = "blue";
+                    mode = "fixed";
+                  };
+                }
+                {
+                  id = "custom.lineWidth";
+                  value = 3;
+                }
+                {
+                  id = "custom.fillOpacity";
+                  value = 0;
+                }
+              ];
+            }
+          ];
         };
       }
 

From f1b767919657d3a82bfa07f4cfcabcab05bb3385 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 18:55:07 -0400
Subject: [PATCH 729/847] grafana: remove unused stuff

---
 services/monitoring.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index f63549e..4536612 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -738,6 +738,21 @@ in
       "auth".disable_login_form = true;
 
       analytics.reporting_enabled = false;
+
+      feature_toggles.enable = "dataConnectionsConsole=false";
+
+      users.default_theme = "dark";
+
+      # Disable unused built-in integrations
+      alerting.enabled = false;
+      "unified_alerting".enabled = false;
+      explore.enabled = false;
+      news.news_feed_enabled = false;
+
+      plugins = {
+        enable_alpha = false;
+        plugin_admin_enabled = false;
+      };
     };
 
     provision = {

From fdf57873d7968a38539c12831d1a6e679ebe8a02 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 23:31:31 -0400
Subject: [PATCH 730/847] prowlarr: fix perms

---
 services/arr/prowlarr.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index fc2001f..543eb1b 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -32,6 +32,17 @@
   };
   users.groups.prowlarr = { };
 
+  # The upstream prowlarr module hardcodes root:root in tmpfiles for custom dataDirs
+  # (systemd.tmpfiles.settings."10-prowlarr"), which gets applied by
+  # systemd-tmpfiles-setup.service on every boot/deploy, resetting the directory
+  # ownership and making Prowlarr unable to access its SQLite databases.
+  # Override to use the correct user as we disable DynamicUser
+  systemd.tmpfiles.settings."10-prowlarr".${service_configs.prowlarr.dataDir}.d = lib.mkForce {
+    user = "prowlarr";
+    group = "prowlarr";
+    mode = "0700";
+  };
+
   systemd.services.prowlarr.serviceConfig = {
     DynamicUser = lib.mkForce false;
     User = "prowlarr";

From 59d33cea3d78e0fd11ae6794842f82e5d03c8865 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 31 Mar 2026 23:37:57 -0400
Subject: [PATCH 731/847] grafana: power improvement

---
 services/monitoring.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index 4536612..adb6c94 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -132,8 +132,8 @@ let
           }
           {
             datasource = promDs;
-            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts)[1h:])";
-            legendFormat = "1h average (W)";
+            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts + 4.5)[5m:])";
+            legendFormat = "5m average (W)";
             refId = "B";
           }
         ];
@@ -207,7 +207,7 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts)[24h:]) * 24 / 1000";
+            expr = "avg_over_time((apcupsd_ups_load_percent / 100 * apcupsd_nominal_power_watts + 4.5)[24h:]) * 24 / 1000";
             legendFormat = "";
             refId = "A";
           }

From 3196b38db7be7efe0132288d2cfa5018f7874952 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 01:49:33 -0400
Subject: [PATCH 732/847] tests: extract shared mock grafana server from
 jellyfin test

---
 tests/jellyfin-annotations.nix | 62 ++++++----------------------------
 tests/mock-grafana-server.py   | 58 +++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 51 deletions(-)
 create mode 100644 tests/mock-grafana-server.py

diff --git a/tests/jellyfin-annotations.nix b/tests/jellyfin-annotations.nix
index 36b6252..1d3194b 100644
--- a/tests/jellyfin-annotations.nix
+++ b/tests/jellyfin-annotations.nix
@@ -4,22 +4,18 @@
   ...
 }:
 let
-  mockServer = pkgs.writeText "mock-server.py" ''
-    import http.server, json, os, sys
-    from urllib.parse import urlparse
+  mockGrafana = ./mock-grafana-server.py;
 
-    MODE = sys.argv[1]
-    PORT = int(sys.argv[2])
-    DATA_FILE = sys.argv[3]
+  mockJellyfin = pkgs.writeText "mock-jellyfin-server.py" ''
+    import http.server, json, sys
+
+    PORT = int(sys.argv[1])
+    DATA_FILE = sys.argv[2]
 
     class Handler(http.server.BaseHTTPRequestHandler):
         def log_message(self, fmt, *args):
             pass
 
-        def _read_body(self):
-            length = int(self.headers.get("Content-Length", 0))
-            return json.loads(self.rfile.read(length)) if length else {}
-
         def _json(self, code, body):
             data = json.dumps(body).encode()
             self.send_response(code)
@@ -28,7 +24,7 @@ let
             self.wfile.write(data)
 
         def do_GET(self):
-            if MODE == "jellyfin" and self.path.startswith("/Sessions"):
+            if self.path.startswith("/Sessions"):
                 try:
                     with open(DATA_FILE) as f:
                         sessions = json.load(f)
@@ -39,43 +35,6 @@ let
                 self.send_response(404)
                 self.end_headers()
 
-        def do_POST(self):
-            if MODE == "grafana" and self.path == "/api/annotations":
-                body = self._read_body()
-                try:
-                    with open(DATA_FILE) as f:
-                        annotations = json.load(f)
-                except Exception:
-                    annotations = []
-                aid = len(annotations) + 1
-                body["id"] = aid
-                annotations.append(body)
-                with open(DATA_FILE, "w") as f:
-                    json.dump(annotations, f)
-                self._json(200, {"id": aid, "message": "Annotation added"})
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-        def do_PATCH(self):
-            if MODE == "grafana" and self.path.startswith("/api/annotations/"):
-                aid = int(self.path.rsplit("/", 1)[-1])
-                body = self._read_body()
-                try:
-                    with open(DATA_FILE) as f:
-                        annotations = json.load(f)
-                except Exception:
-                    annotations = []
-                for a in annotations:
-                    if a["id"] == aid:
-                        a.update(body)
-                with open(DATA_FILE, "w") as f:
-                    json.dump(annotations, f)
-                self._json(200, {"message": "Annotation patched"})
-            else:
-                self.send_response(404)
-                self.end_headers()
-
     http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
   '';
 
@@ -102,7 +61,8 @@ pkgs.testers.runNixOSTest {
     STATE_FILE    = "/tmp/annotations-state.json"
     CREDS_DIR     = "/tmp/test-creds"
     PYTHON        = "${python}/bin/python3"
-    MOCK          = "${mockServer}"
+    MOCK_GRAFANA  = "${mockGrafana}"
+    MOCK_JELLYFIN = "${mockJellyfin}"
     SCRIPT        = "${script}"
 
     def read_annotations():
@@ -119,10 +79,10 @@ pkgs.testers.runNixOSTest {
 
     with subtest("Start mock Jellyfin and Grafana servers"):
         machine.succeed(
-            f"systemd-run --unit=mock-jellyfin {PYTHON} {MOCK} jellyfin {JELLYFIN_PORT} {SESSIONS_FILE}"
+            f"systemd-run --unit=mock-jellyfin {PYTHON} {MOCK_JELLYFIN} {JELLYFIN_PORT} {SESSIONS_FILE}"
         )
         machine.succeed(
-            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK} grafana {GRAFANA_PORT} {ANNOTS_FILE}"
+            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
         )
         machine.wait_until_succeeds(
             f"curl -sf http://127.0.0.1:{JELLYFIN_PORT}/Sessions", timeout=10
diff --git a/tests/mock-grafana-server.py b/tests/mock-grafana-server.py
new file mode 100644
index 0000000..437bf7c
--- /dev/null
+++ b/tests/mock-grafana-server.py
@@ -0,0 +1,58 @@
+import http.server, json, sys
+
+PORT = int(sys.argv[1])
+DATA_FILE = sys.argv[2]
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    def log_message(self, fmt, *args):
+        pass
+
+    def _read_body(self):
+        length = int(self.headers.get("Content-Length", 0))
+        return json.loads(self.rfile.read(length)) if length else {}
+
+    def _json(self, code, body):
+        data = json.dumps(body).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_POST(self):
+        if self.path == "/api/annotations":
+            body = self._read_body()
+            try:
+                with open(DATA_FILE) as f:
+                    annotations = json.load(f)
+            except Exception:
+                annotations = []
+            aid = len(annotations) + 1
+            body["id"] = aid
+            annotations.append(body)
+            with open(DATA_FILE, "w") as f:
+                json.dump(annotations, f)
+            self._json(200, {"id": aid, "message": "Annotation added"})
+        else:
+            self.send_response(404)
+            self.end_headers()
+
+    def do_PATCH(self):
+        if self.path.startswith("/api/annotations/"):
+            aid = int(self.path.rsplit("/", 1)[-1])
+            body = self._read_body()
+            try:
+                with open(DATA_FILE) as f:
+                    annotations = json.load(f)
+            except Exception:
+                annotations = []
+            for a in annotations:
+                if a["id"] == aid:
+                    a.update(body)
+            with open(DATA_FILE, "w") as f:
+                json.dump(annotations, f)
+            self._json(200, {"message": "Annotation patched"})
+        else:
+            self.send_response(404)
+            self.end_headers()
+
+http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()

From a5206b9ec6128afa33caef5c5eb42590e1a97e69 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 01:49:53 -0400
Subject: [PATCH 733/847] monitoring: add grafana annotations for zfs scrub
 events

---
 configuration.nix                  |   1 +
 services/monitoring.nix            |  12 +++
 services/zfs-scrub-annotations.nix |  36 +++++++++
 services/zfs-scrub-annotations.sh  |  55 +++++++++++++
 tests/tests.nix                    |   3 +
 tests/zfs-scrub-annotations.nix    | 123 +++++++++++++++++++++++++++++
 6 files changed, 230 insertions(+)
 create mode 100644 services/zfs-scrub-annotations.nix
 create mode 100644 services/zfs-scrub-annotations.sh
 create mode 100644 tests/zfs-scrub-annotations.nix

diff --git a/configuration.nix b/configuration.nix
index adbd64e..13a1582 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -49,6 +49,7 @@
     ./services/ups.nix
     ./services/monitoring.nix
     ./services/jellyfin-annotations.nix
+    ./services/zfs-scrub-annotations.nix
 
     ./services/bitwarden.nix
     ./services/firefox-syncserver.nix
diff --git a/services/monitoring.nix b/services/monitoring.nix
index adb6c94..f23f7c7 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -108,6 +108,18 @@ let
         type = "tags";
         tags = [ "jellyfin" ];
       }
+      {
+        name = "ZFS Scrubs";
+        datasource = {
+          type = "grafana";
+          uid = "-- Grafana --";
+        };
+        enable = true;
+        iconColor = "orange";
+        showIn = 0;
+        type = "tags";
+        tags = [ "zfs-scrub" ];
+      }
     ];
 
     panels = [
diff --git a/services/zfs-scrub-annotations.nix b/services/zfs-scrub-annotations.nix
new file mode 100644
index 0000000..e502178
--- /dev/null
+++ b/services/zfs-scrub-annotations.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  grafanaUrl = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
+
+  script = pkgs.writeShellApplication {
+    name = "zfs-scrub-annotations";
+    runtimeInputs = with pkgs; [
+      curl
+      jq
+      coreutils
+      gnugrep
+      gnused
+      config.boot.zfs.package
+    ];
+    text = builtins.readFile ./zfs-scrub-annotations.sh;
+  };
+in
+{
+  systemd.services.zfs-scrub = {
+    environment = {
+      GRAFANA_URL = grafanaUrl;
+      STATE_DIR = "/run/zfs-scrub-annotations";
+    };
+    serviceConfig = {
+      RuntimeDirectory = "zfs-scrub-annotations";
+      ExecStartPre = [ "-${lib.getExe script} start" ];
+      ExecStopPost = [ "${lib.getExe script} stop" ];
+    };
+  };
+}
diff --git a/services/zfs-scrub-annotations.sh b/services/zfs-scrub-annotations.sh
new file mode 100644
index 0000000..237ab3d
--- /dev/null
+++ b/services/zfs-scrub-annotations.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# ZFS scrub annotation script for Grafana
+# Usage: zfs-scrub-annotations.sh {start|stop}
+# Required env: GRAFANA_URL, STATE_DIR
+# Required on PATH: zpool, curl, jq, paste, date, grep, sed
+
+set -euo pipefail
+
+ACTION="${1:-}"
+GRAFANA_URL="${GRAFANA_URL:?GRAFANA_URL required}"
+STATE_DIR="${STATE_DIR:?STATE_DIR required}"
+
+case "$ACTION" in
+  start)
+    POOLS=$(zpool list -H -o name | paste -sd ', ')
+    NOW_MS=$(date +%s%3N)
+
+    RESPONSE=$(curl -sf --max-time 5 \
+      -X POST "$GRAFANA_URL/api/annotations" \
+      -H "Content-Type: application/json" \
+      -d "$(jq -n --arg text "ZFS scrub: $POOLS" --argjson time "$NOW_MS" \
+        '{time: $time, text: $text, tags: ["zfs-scrub"]}')" \
+    ) || exit 0
+
+    echo "$RESPONSE" | jq -r '.id' > "$STATE_DIR/annotation-id"
+    ;;
+
+  stop)
+    ANN_ID=$(cat "$STATE_DIR/annotation-id" 2>/dev/null) || exit 0
+    [ -z "$ANN_ID" ] && exit 0
+
+    NOW_MS=$(date +%s%3N)
+
+    RESULTS=""
+    while IFS= read -r pool; do
+      scan_line=$(zpool status "$pool" | grep "scan:" | sed 's/^[[:space:]]*//')
+      RESULTS="${RESULTS}${pool}: ${scan_line}"$'\n'
+    done < <(zpool list -H -o name)
+
+    TEXT=$(printf "ZFS scrub completed\n%s" "$RESULTS")
+
+    curl -sf --max-time 5 \
+      -X PATCH "$GRAFANA_URL/api/annotations/$ANN_ID" \
+      -H "Content-Type: application/json" \
+      -d "$(jq -n --arg text "$TEXT" --argjson timeEnd "$NOW_MS" \
+        '{timeEnd: $timeEnd, text: $text}')" || true
+
+    rm -f "$STATE_DIR/annotation-id"
+    ;;
+
+  *)
+    echo "Usage: $0 {start|stop}" >&2
+    exit 1
+    ;;
+esac
diff --git a/tests/tests.nix b/tests/tests.nix
index 59906f9..9762b9c 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -25,6 +25,9 @@ in
   # jellyfin annotation service test
   jellyfinAnnotationsTest = handleTest ./jellyfin-annotations.nix;
 
+  # zfs scrub annotations test
+  zfsScrubAnnotationsTest = handleTest ./zfs-scrub-annotations.nix;
+
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 
diff --git a/tests/zfs-scrub-annotations.nix b/tests/zfs-scrub-annotations.nix
new file mode 100644
index 0000000..4bed3a7
--- /dev/null
+++ b/tests/zfs-scrub-annotations.nix
@@ -0,0 +1,123 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  mockServer = ./mock-grafana-server.py;
+
+  mockZpool = pkgs.writeShellScript "zpool" ''
+    case "$1" in
+      list)
+        echo "tank"
+        echo "hdds"
+        ;;
+      status)
+        pool="$2"
+        if [ "$pool" = "tank" ]; then
+          echo "  scan: scrub repaired 0B in 00:24:39 with 0 errors on Mon Jan  1 02:24:39 2024"
+        elif [ "$pool" = "hdds" ]; then
+          echo "  scan: scrub repaired 0B in 04:12:33 with 0 errors on Mon Jan  1 06:12:33 2024"
+        fi
+        ;;
+    esac
+  '';
+
+  script = ../services/zfs-scrub-annotations.sh;
+  python = pkgs.python3;
+in
+pkgs.testers.runNixOSTest {
+  name = "zfs-scrub-annotations";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        python3
+        curl
+        jq
+      ];
+    };
+
+  testScript = ''
+    import json
+
+    GRAFANA_PORT = 13000
+    ANNOTS_FILE  = "/tmp/annotations.json"
+    STATE_DIR    = "/tmp/scrub-state"
+    PYTHON       = "${python}/bin/python3"
+    MOCK         = "${mockServer}"
+    SCRIPT       = "${script}"
+    MOCK_ZPOOL   = "${mockZpool}"
+
+    MOCK_BIN = "/tmp/mock-bin"
+    ENV_PREFIX = (
+        f"GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
+        f"STATE_DIR={STATE_DIR} "
+        f"PATH={MOCK_BIN}:$PATH "
+    )
+
+    def read_annotations():
+        out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
+        return json.loads(out.strip())
+
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Setup state directory and mock zpool"):
+        machine.succeed(f"mkdir -p {STATE_DIR}")
+        machine.succeed(f"mkdir -p {MOCK_BIN} && cp {MOCK_ZPOOL} {MOCK_BIN}/zpool && chmod +x {MOCK_BIN}/zpool")
+
+    with subtest("Start mock Grafana server"):
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+        machine.succeed(
+            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK} {GRAFANA_PORT} {ANNOTS_FILE}"
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf -X POST http://127.0.0.1:{GRAFANA_PORT}/api/annotations "
+            f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
+            timeout=10,
+        )
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+
+    with subtest("Start action creates annotation with pool names and zfs-scrub tag"):
+        machine.succeed(f"{ENV_PREFIX} bash {SCRIPT} start")
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
+        assert "zfs-scrub" in annots[0].get("tags", []), f"Missing zfs-scrub tag: {annots[0]}"
+        assert "tank" in annots[0]["text"], f"Missing tank in text: {annots[0]['text']}"
+        assert "hdds" in annots[0]["text"], f"Missing hdds in text: {annots[0]['text']}"
+        assert "time" in annots[0], f"Missing time field: {annots[0]}"
+        assert "timeEnd" not in annots[0], f"timeEnd should not be set yet: {annots[0]}"
+
+    with subtest("State file contains annotation ID"):
+        ann_id = machine.succeed(f"cat {STATE_DIR}/annotation-id").strip()
+        assert ann_id == "1", f"Expected annotation ID 1, got: {ann_id}"
+
+    with subtest("Stop action closes annotation with per-pool scrub results"):
+        machine.succeed(f"{ENV_PREFIX} bash {SCRIPT} stop")
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
+        assert "timeEnd" in annots[0], f"timeEnd should be set: {annots[0]}"
+        assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"
+        text = annots[0]["text"]
+        assert "ZFS scrub completed" in text, f"Missing completed text: {text}"
+        assert "tank:" in text, f"Missing tank results: {text}"
+        assert "hdds:" in text, f"Missing hdds results: {text}"
+        assert "00:24:39" in text, f"Missing tank scrub duration: {text}"
+        assert "04:12:33" in text, f"Missing hdds scrub duration: {text}"
+
+    with subtest("State file cleaned up after stop"):
+        machine.fail(f"test -f {STATE_DIR}/annotation-id")
+
+    with subtest("Stop action handles missing state file gracefully"):
+        machine.succeed(f"{ENV_PREFIX} bash {SCRIPT} stop")
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected no new annotations, got: {annots}"
+
+    with subtest("Start action handles Grafana being down gracefully"):
+        machine.succeed("systemctl stop mock-grafana")
+        machine.succeed(f"{ENV_PREFIX} bash {SCRIPT} start")
+        machine.fail(f"test -f {STATE_DIR}/annotation-id")
+  '';
+}

From 297264a34aafe7b0cfda2cac19e83fa0969c10cd Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 02:18:23 -0400
Subject: [PATCH 734/847] tests: extract shared jellyfin test helpers and use
 real jellyfin in annotations test

---
 tests/jellyfin-annotations.nix         | 177 ++++++++++++-------------
 tests/jellyfin-qbittorrent-monitor.nix |  96 +++-----------
 tests/jellyfin-test-lib.nix            |  20 +++
 tests/jellyfin-test-lib.py             |  90 +++++++++++++
 4 files changed, 213 insertions(+), 170 deletions(-)
 create mode 100644 tests/jellyfin-test-lib.nix
 create mode 100644 tests/jellyfin-test-lib.py

diff --git a/tests/jellyfin-annotations.nix b/tests/jellyfin-annotations.nix
index 1d3194b..3c5a4b9 100644
--- a/tests/jellyfin-annotations.nix
+++ b/tests/jellyfin-annotations.nix
@@ -4,40 +4,8 @@
   ...
 }:
 let
+  jfLib = import ./jellyfin-test-lib.nix { inherit pkgs lib; };
   mockGrafana = ./mock-grafana-server.py;
-
-  mockJellyfin = pkgs.writeText "mock-jellyfin-server.py" ''
-    import http.server, json, sys
-
-    PORT = int(sys.argv[1])
-    DATA_FILE = sys.argv[2]
-
-    class Handler(http.server.BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            pass
-
-        def _json(self, code, body):
-            data = json.dumps(body).encode()
-            self.send_response(code)
-            self.send_header("Content-Type", "application/json")
-            self.end_headers()
-            self.wfile.write(data)
-
-        def do_GET(self):
-            if self.path.startswith("/Sessions"):
-                try:
-                    with open(DATA_FILE) as f:
-                        sessions = json.load(f)
-                except Exception:
-                    sessions = []
-                self._json(200, sessions)
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-    http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
-  '';
-
   script = ../services/jellyfin-annotations.py;
   python = pkgs.python3;
 in
@@ -47,6 +15,7 @@ pkgs.testers.runNixOSTest {
   nodes.machine =
     { pkgs, ... }:
     {
+      imports = [ jfLib.jellyfinTestConfig ];
       environment.systemPackages = [ pkgs.python3 ];
     };
 
@@ -54,39 +23,42 @@ pkgs.testers.runNixOSTest {
     import json
     import time
 
-    JELLYFIN_PORT = 18096
+    import importlib.util
+    _spec = importlib.util.spec_from_file_location("jf_helpers", "${jfLib.helpers}")
+    assert _spec and _spec.loader
+    _jf = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(_jf)
+    setup_jellyfin = _jf.setup_jellyfin
+    jellyfin_api = _jf.jellyfin_api
+
     GRAFANA_PORT  = 13000
-    SESSIONS_FILE = "/tmp/sessions.json"
     ANNOTS_FILE   = "/tmp/annotations.json"
     STATE_FILE    = "/tmp/annotations-state.json"
     CREDS_DIR     = "/tmp/test-creds"
     PYTHON        = "${python}/bin/python3"
     MOCK_GRAFANA  = "${mockGrafana}"
-    MOCK_JELLYFIN = "${mockJellyfin}"
     SCRIPT        = "${script}"
 
+    auth_header  = 'MediaBrowser Client="Infuse", DeviceId="test-dev-1", Device="iPhone", Version="1.0"'
+    auth_header2 = 'MediaBrowser Client="Jellyfin Web", DeviceId="test-dev-2", Device="Chrome", Version="1.0"'
+
     def read_annotations():
         out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
         return json.loads(out.strip())
 
     start_all()
-    machine.wait_for_unit("multi-user.target")
+    token, user_id, movie_id, media_source_id = setup_jellyfin(
+        machine, retry, auth_header,
+        "${jfLib.payloads.auth}", "${jfLib.payloads.empty}",
+    )
 
-    with subtest("Setup mock credentials and data files"):
-        machine.succeed(f"mkdir -p {CREDS_DIR} && echo 'fake-api-key' > {CREDS_DIR}/jellyfin-api-key")
-        machine.succeed(f"echo '[]' > {SESSIONS_FILE}")
+    with subtest("Setup mock Grafana and credentials"):
+        machine.succeed(f"mkdir -p {CREDS_DIR}")
+        machine.succeed(f"echo '{token}' > {CREDS_DIR}/jellyfin-api-key")
         machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
-
-    with subtest("Start mock Jellyfin and Grafana servers"):
-        machine.succeed(
-            f"systemd-run --unit=mock-jellyfin {PYTHON} {MOCK_JELLYFIN} {JELLYFIN_PORT} {SESSIONS_FILE}"
-        )
         machine.succeed(
             f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
         )
-        machine.wait_until_succeeds(
-            f"curl -sf http://127.0.0.1:{JELLYFIN_PORT}/Sessions", timeout=10
-        )
         machine.wait_until_succeeds(
             f"curl -sf -X POST http://127.0.0.1:{GRAFANA_PORT}/api/annotations "
             f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
@@ -94,10 +66,10 @@ pkgs.testers.runNixOSTest {
         )
         machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
 
-    with subtest("Start annotation service pointing at mock servers"):
+    with subtest("Start annotation service"):
         machine.succeed(
             f"systemd-run --unit=annotations-svc "
-            f"--setenv=JELLYFIN_URL=http://127.0.0.1:{JELLYFIN_PORT} "
+            f"--setenv=JELLYFIN_URL=http://127.0.0.1:8096 "
             f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
             f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
             f"--setenv=STATE_FILE={STATE_FILE} "
@@ -106,38 +78,24 @@ pkgs.testers.runNixOSTest {
         )
         time.sleep(2)
 
-    with subtest("No annotations pushed when no streams active"):
+    with subtest("No annotations when no streams active"):
         time.sleep(4)
         annots = read_annotations()
         assert annots == [], f"Expected no annotations, got: {annots}"
 
-    with subtest("Annotation created when stream starts"):
-        rich_session = json.dumps([{
-            "Id": "sess-1",
-            "UserName": "alice",
-            "Client": "Infuse",
-            "DeviceName": "iPhone",
-            "PlayState": {"PlayMethod": "Transcode"},
-            "NowPlayingItem": {
-                "Name": "Inception",
-                "Type": "Movie",
-                "Bitrate": 20000000,
-                "MediaStreams": [
-                    {"Type": "Video", "Codec": "h264", "Width": 1920, "Height": 1080},
-                    {"Type": "Audio", "Codec": "dts", "Channels": 6, "IsDefault": True},
-                ],
-            },
-            "TranscodingInfo": {
-                "IsVideoDirect": True,
-                "IsAudioDirect": False,
-                "VideoCodec": "h264",
-                "AudioCodec": "aac",
-                "AudioChannels": 2,
-                "Bitrate": 8000000,
-                "TranscodeReasons": ["AudioCodecNotSupported"],
-            },
-        }])
-        machine.succeed(f"echo {repr(rich_session)} > {SESSIONS_FILE}")
+    with subtest("Annotation created when playback starts"):
+        playback_start = json.dumps({
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-1",
+            "CanSeek": True,
+            "IsPaused": False,
+        })
+        machine.succeed(
+            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
+            f"-d '{playback_start}' -H 'Content-Type:application/json' "
+            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
+        )
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
             timeout=15,
@@ -145,18 +103,24 @@ pkgs.testers.runNixOSTest {
         annots = read_annotations()
         assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
         text = annots[0]["text"]
-        assert "alice: Inception (movie)" in text, f"Missing title in: {text}"
-        assert "Transcode" in text, f"Missing method in: {text}"
-        assert "H.264" in text, f"Missing video codec in: {text}"
-        assert "DTS" in text and "AAC" in text, f"Missing audio codec in: {text}"
-        assert "8.0 Mbps" in text, f"Missing bitrate in: {text}"
-        assert "AudioCodecNotSupported" in text, f"Missing transcode reason in: {text}"
-        assert "Infuse" in text and "iPhone" in text, f"Missing client in: {text}"
         assert "jellyfin" in annots[0].get("tags", []), f"Missing jellyfin tag: {annots[0]}"
+        assert "Test Movie" in text, f"Missing title in: {text}"
+        assert "Infuse" in text, f"Missing client in: {text}"
+        assert "iPhone" in text, f"Missing device in: {text}"
         assert "timeEnd" not in annots[0], f"timeEnd should not be set yet: {annots[0]}"
 
-    with subtest("Annotation closed when stream ends"):
-        machine.succeed(f"echo '[]' > {SESSIONS_FILE}")
+    with subtest("Annotation closed when playback stops"):
+        playback_stop = json.dumps({
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-1",
+            "PositionTicks": 50000000,
+        })
+        machine.succeed(
+            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing/Stopped' "
+            f"-d '{playback_stop}' -H 'Content-Type:application/json' "
+            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
+        )
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
             timeout=15,
@@ -168,11 +132,37 @@ pkgs.testers.runNixOSTest {
 
     with subtest("Multiple concurrent streams each get their own annotation"):
         machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+
+        auth_result2 = json.loads(machine.succeed(
+            f"curl -sf -X POST 'http://localhost:8096/Users/AuthenticateByName' "
+            f"-d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' "
+            f"-H 'X-Emby-Authorization:{auth_header2}'"
+        ))
+        token2 = auth_result2["AccessToken"]
+
+        playback1 = json.dumps({
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-multi-1",
+            "CanSeek": True,
+            "IsPaused": False,
+        })
         machine.succeed(
-            f"""echo '[
-              {{"Id":"sess-2","UserName":"bob","NowPlayingItem":{{"Name":"Breaking Bad","SeriesName":"Breaking Bad","ParentIndexNumber":1,"IndexNumber":1}}}},
-              {{"Id":"sess-3","UserName":"carol","NowPlayingItem":{{"Name":"Inception","Type":"Movie"}}}}
-            ]' > {SESSIONS_FILE}"""
+            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
+            f"-d '{playback1}' -H 'Content-Type:application/json' "
+            f"-H 'X-Emby-Authorization:{auth_header}, Token={token}'"
+        )
+        playback2 = json.dumps({
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-play-multi-2",
+            "CanSeek": True,
+            "IsPaused": False,
+        })
+        machine.succeed(
+            f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing' "
+            f"-d '{playback2}' -H 'Content-Type:application/json' "
+            f"-H 'X-Emby-Authorization:{auth_header2}, Token={token2}'"
         )
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | python3 -c \"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
@@ -180,16 +170,13 @@ pkgs.testers.runNixOSTest {
         )
         annots = read_annotations()
         assert len(annots) == 2, f"Expected 2 annotations, got: {annots}"
-        texts = sorted(a["text"] for a in annots)
-        assert any("Breaking Bad" in t and "S01E01" in t for t in texts), f"Missing Bob's annotation: {texts}"
-        assert any("carol" in t and "Inception" in t for t in texts), f"Missing Carol's annotation: {texts}"
 
     with subtest("State survives service restart (no duplicate annotations)"):
         machine.succeed("systemctl stop annotations-svc || true")
         time.sleep(1)
         machine.succeed(
             f"systemd-run --unit=annotations-svc-2 "
-            f"--setenv=JELLYFIN_URL=http://127.0.0.1:{JELLYFIN_PORT} "
+            f"--setenv=JELLYFIN_URL=http://127.0.0.1:8096 "
             f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
             f"--setenv=CREDENTIALS_DIRECTORY={CREDS_DIR} "
             f"--setenv=STATE_FILE={STATE_FILE} "
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index 3cb8b64..aec5a98 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -5,10 +5,7 @@
   ...
 }:
 let
-  payloads = {
-    auth = pkgs.writeText "auth.json" (builtins.toJSON { Username = "jellyfin"; });
-    empty = pkgs.writeText "empty.json" (builtins.toJSON { });
-  };
+  jfLib = import ./jellyfin-test-lib.nix { inherit pkgs lib; };
 in
 pkgs.testers.runNixOSTest {
   name = "jellyfin-qbittorrent-monitor";
@@ -18,11 +15,10 @@ pkgs.testers.runNixOSTest {
       { ... }:
       {
         imports = [
+          jfLib.jellyfinTestConfig
           inputs.vpn-confinement.nixosModules.default
         ];
 
-        services.jellyfin.enable = true;
-
         # Real qBittorrent service
         services.qbittorrent = {
           enable = true;
@@ -56,11 +52,6 @@ pkgs.testers.runNixOSTest {
           };
         };
 
-        environment.systemPackages = with pkgs; [
-          curl
-          ffmpeg
-        ];
-        virtualisation.diskSize = 3 * 1024;
         networking.firewall.allowedTCPPorts = [
           8096
           8080
@@ -106,20 +97,17 @@ pkgs.testers.runNixOSTest {
   testScript = ''
     import json
     import time
-    from urllib.parse import urlencode
+
+    import importlib.util
+    _spec = importlib.util.spec_from_file_location("jf_helpers", "${jfLib.helpers}")
+    assert _spec and _spec.loader
+    _jf = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(_jf)
+    setup_jellyfin = _jf.setup_jellyfin
+    jellyfin_api = _jf.jellyfin_api
 
     auth_header = 'MediaBrowser Client="NixOS Test", DeviceId="test-1337", Device="TestDevice", Version="1.0"'
 
-    def api_get(path, token=None):
-        header = auth_header + (f", Token={token}" if token else "")
-        return f"curl -sf 'http://server:8096{path}' -H 'X-Emby-Authorization:{header}'"
-
-    def api_post(path, json_file=None, token=None):
-        header = auth_header + (f", Token={token}" if token else "")
-        if json_file:
-            return f"curl -sf -X POST 'http://server:8096{path}' -d '@{json_file}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{header}'"
-        return f"curl -sf -X POST 'http://server:8096{path}' -H 'X-Emby-Authorization:{header}'"
-
     def is_throttled():
         return server.succeed("curl -s http://localhost:8080/api/v2/transfer/speedLimitsMode").strip() == "1"
 
@@ -137,57 +125,15 @@ pkgs.testers.runNixOSTest {
             return False
         return all(t["state"].startswith("stopped") for t in torrents)
 
-    movie_id: str = ""
-    media_source_id: str = ""
-
     start_all()
-    server.wait_for_unit("jellyfin.service")
-    server.wait_for_open_port(8096)
-    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
     server.wait_for_unit("qbittorrent.service")
     server.wait_for_open_port(8080)
-
-    # Wait for qBittorrent WebUI to be responsive
     server.wait_until_succeeds("curl -sf http://localhost:8080/api/v2/app/version", timeout=30)
 
-    with subtest("Complete Jellyfin setup wizard"):
-        server.wait_until_succeeds(api_get("/Startup/Configuration"))
-        server.succeed(api_get("/Startup/FirstUser"))
-        server.succeed(api_post("/Startup/Complete"))
-
-    with subtest("Authenticate and get token"):
-        auth_result = json.loads(server.succeed(api_post("/Users/AuthenticateByName", "${payloads.auth}")))
-        token = auth_result["AccessToken"]
-        user_id = auth_result["User"]["Id"]
-
-    with subtest("Create test video library"):
-        tempdir = server.succeed("mktemp -d -p /var/lib/jellyfin").strip()
-        server.succeed(f"chmod 755 '{tempdir}'")
-        server.succeed(f"ffmpeg -f lavfi -i testsrc2=duration=5 '{tempdir}/Test Movie (2024) [1080p].mkv'")
-
-        add_folder_query = urlencode({
-            "name": "Test Library",
-            "collectionType": "Movies",
-            "paths": tempdir,
-            "refreshLibrary": "true",
-        })
-        server.succeed(api_post(f"/Library/VirtualFolders?{add_folder_query}", "${payloads.empty}", token))
-
-        def is_library_ready(_):
-            folders = json.loads(server.succeed(api_get("/Library/VirtualFolders", token)))
-            return all(f.get("RefreshStatus") == "Idle" for f in folders)
-        retry(is_library_ready, timeout=60)
-
-        def get_movie(_):
-            global movie_id, media_source_id
-            items = json.loads(server.succeed(api_get(f"/Users/{user_id}/Items?IncludeItemTypes=Movie&Recursive=true", token)))
-            if items["TotalRecordCount"] > 0:
-                movie_id = items["Items"][0]["Id"]
-                item_info = json.loads(server.succeed(api_get(f"/Users/{user_id}/Items/{movie_id}", token)))
-                media_source_id = item_info["MediaSources"][0]["Id"]
-                return True
-            return False
-        retry(get_movie, timeout=60)
+    token, user_id, movie_id, media_source_id = setup_jellyfin(
+        server, retry, auth_header,
+        "${jfLib.payloads.auth}", "${jfLib.payloads.empty}",
+    )
 
     with subtest("Start monitor service"):
         python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
@@ -214,12 +160,12 @@ pkgs.testers.runNixOSTest {
     server_ip = "192.168.1.1"
 
     with subtest("Client authenticates from external network"):
-        auth_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+        auth_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
         client_auth_result = json.loads(client.succeed(auth_cmd))
         client_token = client_auth_result["AccessToken"]
 
     with subtest("Second client authenticates from external network"):
-        auth_cmd2 = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+        auth_cmd2 = f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
         client_auth_result2 = json.loads(client.succeed(auth_cmd2))
         client_token2 = client_auth_result2["AccessToken"]
 
@@ -430,7 +376,7 @@ pkgs.testers.runNixOSTest {
     with subtest("Local playback does NOT trigger throttling"):
         local_auth = 'MediaBrowser Client="Local Client", DeviceId="local-1111", Device="LocalDevice", Version="1.0"'
         local_auth_result = json.loads(server.succeed(
-            f"curl -sf -X POST 'http://localhost:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}'"
+            f"curl -sf -X POST 'http://localhost:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}'"
         ))
         local_token = local_auth_result["AccessToken"]
 
@@ -527,11 +473,11 @@ pkgs.testers.runNixOSTest {
 
         # Re-authenticate (old token invalid after restart)
         client_auth_result = json.loads(client.succeed(
-            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
         ))
         client_token = client_auth_result["AccessToken"]
         client_auth_result2 = json.loads(client.succeed(
-            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
         ))
         client_token2 = client_auth_result2["AccessToken"]
 
@@ -542,11 +488,11 @@ pkgs.testers.runNixOSTest {
     with subtest("Monitor recovers after Jellyfin temporary unavailability"):
         # Re-authenticate with fresh token
         client_auth_result = json.loads(client.succeed(
-            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}'"
         ))
         client_token = client_auth_result["AccessToken"]
         client_auth_result2 = json.loads(client.succeed(
-            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
+            f"curl -sf -X POST 'http://{server_ip}:8096/Users/AuthenticateByName' -d '@${jfLib.payloads.auth}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth2}'"
         ))
         client_token2 = client_auth_result2["AccessToken"]
 
diff --git a/tests/jellyfin-test-lib.nix b/tests/jellyfin-test-lib.nix
new file mode 100644
index 0000000..24fa07f
--- /dev/null
+++ b/tests/jellyfin-test-lib.nix
@@ -0,0 +1,20 @@
+{ pkgs, lib }:
+{
+  payloads = {
+    auth = pkgs.writeText "auth.json" (builtins.toJSON { Username = "jellyfin"; });
+    empty = pkgs.writeText "empty.json" (builtins.toJSON { });
+  };
+
+  helpers = ./jellyfin-test-lib.py;
+
+  jellyfinTestConfig =
+    { pkgs, ... }:
+    {
+      services.jellyfin.enable = true;
+      environment.systemPackages = with pkgs; [
+        curl
+        ffmpeg
+      ];
+      virtualisation.diskSize = lib.mkDefault (3 * 1024);
+    };
+}
diff --git a/tests/jellyfin-test-lib.py b/tests/jellyfin-test-lib.py
new file mode 100644
index 0000000..81c164b
--- /dev/null
+++ b/tests/jellyfin-test-lib.py
@@ -0,0 +1,90 @@
+import json
+from urllib.parse import urlencode
+
+
+def jellyfin_api(machine, method, path, auth_header, token=None, data_file=None, data=None):
+    hdr = auth_header + (f", Token={token}" if token else "")
+    cmd = f"curl -sf -X {method} 'http://localhost:8096{path}'"
+    if data_file:
+        cmd += f" -d '@{data_file}' -H 'Content-Type:application/json'"
+    elif data:
+        payload = json.dumps(data) if isinstance(data, dict) else data
+        cmd += f" -d '{payload}' -H 'Content-Type:application/json'"
+    cmd += f" -H 'X-Emby-Authorization:{hdr}'"
+    return machine.succeed(cmd)
+
+
+def setup_jellyfin(machine, retry, auth_header, auth_payload, empty_payload):
+    machine.wait_for_unit("jellyfin.service")
+    machine.wait_for_open_port(8096)
+    machine.wait_until_succeeds(
+        "curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60
+    )
+
+    machine.wait_until_succeeds(
+        f"curl -sf 'http://localhost:8096/Startup/Configuration' "
+        f"-H 'X-Emby-Authorization:{auth_header}'"
+    )
+    jellyfin_api(machine, "GET", "/Startup/FirstUser", auth_header)
+    jellyfin_api(machine, "POST", "/Startup/Complete", auth_header)
+
+    result = json.loads(
+        jellyfin_api(
+            machine, "POST", "/Users/AuthenticateByName",
+            auth_header, data_file=auth_payload,
+        )
+    )
+    token = result["AccessToken"]
+    user_id = result["User"]["Id"]
+
+    tempdir = machine.succeed("mktemp -d -p /var/lib/jellyfin").strip()
+    machine.succeed(f"chmod 755 '{tempdir}'")
+    machine.succeed(
+        f"ffmpeg -f lavfi -i testsrc2=duration=5 -f lavfi -i sine=frequency=440:duration=5 "
+        f"-c:v libx264 -c:a aac '{tempdir}/Test Movie (2024).mkv'"
+    )
+
+    query = urlencode({
+        "name": "Test Library",
+        "collectionType": "Movies",
+        "paths": tempdir,
+        "refreshLibrary": "true",
+    })
+    jellyfin_api(
+        machine, "POST", f"/Library/VirtualFolders?{query}",
+        auth_header, token=token, data_file=empty_payload,
+    )
+
+    def is_ready(_):
+        folders = json.loads(
+            jellyfin_api(machine, "GET", "/Library/VirtualFolders", auth_header, token=token)
+        )
+        return all(f.get("RefreshStatus") == "Idle" for f in folders)
+    retry(is_ready, timeout=60)
+
+    movie_id = None
+    media_source_id = None
+
+    def get_movie(_):
+        nonlocal movie_id, media_source_id
+        items = json.loads(
+            jellyfin_api(
+                machine, "GET",
+                f"/Users/{user_id}/Items?IncludeItemTypes=Movie&Recursive=true",
+                auth_header, token=token,
+            )
+        )
+        if items["TotalRecordCount"] > 0:
+            movie_id = items["Items"][0]["Id"]
+            info = json.loads(
+                jellyfin_api(
+                    machine, "GET", f"/Users/{user_id}/Items/{movie_id}",
+                    auth_header, token=token,
+                )
+            )
+            media_source_id = info["MediaSources"][0]["Id"]
+            return True
+        return False
+    retry(get_movie, timeout=60)
+
+    return token, user_id, movie_id, media_source_id

From 1bb0844649220a698b87b899dec788d66fb5c98f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 13:12:14 -0400
Subject: [PATCH 735/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index dfc132f..2a02e08 100644
--- a/flake.lock
+++ b/flake.lock
@@ -285,11 +285,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1774899286,
-        "narHash": "sha256-fuHDpWYjyc0Dxq0iH310vmdyfdTTj3ufSIZ6vbwuQzU=",
+        "lastModified": 1775014230,
+        "narHash": "sha256-oqRN8daUQrUPIjdoc8+bXgy+MVLXt3pa02UeFE/0Eus=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "676dec3b72efdae4a27b46e6059aa094f5069eca",
+        "rev": "253331438df9aaa637c4b13fbac7cce5f6d04775",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1774799055,
-        "narHash": "sha256-Tsq9BCz0q47ej1uFF39m4tuhcwru/ls6vCCJzutEpaw=",
+        "lastModified": 1775002709,
+        "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "107cba9eb4a8d8c9f8e9e61266d78d340867913a",
+        "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e",
         "type": "github"
       },
       "original": {
@@ -452,11 +452,11 @@
     "senior_project-website": {
       "flake": false,
       "locked": {
-        "lastModified": 1771869552,
-        "narHash": "sha256-veaVrRWCSy7HYAAjUFLw8HASKcj+3f0W+sCwS3QiaM4=",
+        "lastModified": 1775019649,
+        "narHash": "sha256-zVQy5ydiWKnIixf79pmd2LJTPkwyiv4V5piKZETDdwI=",
         "owner": "Titaniumtown",
         "repo": "senior-project-website",
-        "rev": "28a2b93492dac877dce0b38f078eacf74fce26e7",
+        "rev": "bfd504c77c90524b167158652e1d87a260680120",
         "type": "github"
       },
       "original": {
@@ -548,11 +548,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774908585,
-        "narHash": "sha256-Jf3dbkZOwe0/7l4CNg2UDkOYEH+Z/yoYBTrx5RrN2Ss=",
+        "lastModified": 1774994979,
+        "narHash": "sha256-fYUw6SA2qvG2K5O1NN087EaP3fAPhFZM/9YHINyjaxc=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "29d08b113aa65020968dd5cd9207c7479c8c28ff",
+        "rev": "37bdb0abc56c990797b1bf8387c9691778ee2a74",
         "type": "github"
       },
       "original": {

From f775f22dbf4f42b16ae4a16c7d2ca0965185282d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 15:25:31 -0400
Subject: [PATCH 736/847] recylcarr: restart service after config change

---
 services/arr/recyclarr.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 6fd6697..4d4a460 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -202,8 +202,9 @@ in
     };
   };
 
-  # Add secrets generation before recyclarr runs
+  # Re-sync immediately on deploy when the recyclarr config changes
   systemd.services.recyclarr = {
+    restartTriggers = [ (builtins.toJSON config.services.recyclarr.configuration) ];
     after = [
       "network-online.target"
       "radarr.service"

From f9694ae033bb7dea85e043c14844d662955efd68 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 15:25:40 -0400
Subject: [PATCH 737/847] qbt: fix categories

---
 service-configs.nix            | 11 +++++++++++
 services/arr/torrent-audit.nix |  3 ++-
 services/qbittorrent.nix       | 21 +++++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/service-configs.nix b/service-configs.nix
index e48a910..a3294bc 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -205,6 +205,17 @@ rec {
   torrent = {
     SavePath = torrents_path;
     TempPath = torrents_path + "/incomplete";
+    categories = {
+      anime = torrents_path + "/anime";
+      archive = torrents_path + "/archive";
+      audiobooks = torrents_path + "/audiobooks";
+      books = torrents_path + "/books";
+      games = torrents_path + "/games";
+      movies = torrents_path + "/movies";
+      music = torrents_path + "/music";
+      musicals = torrents_path + "/musicals";
+      tvshows = torrents_path + "/tvshows";
+    };
   };
 
   jellyfin = {
diff --git a/services/arr/torrent-audit.nix b/services/arr/torrent-audit.nix
index e59e211..95e8b1a 100644
--- a/services/arr/torrent-audit.nix
+++ b/services/arr/torrent-audit.nix
@@ -2,6 +2,7 @@
   pkgs,
   config,
   service_configs,
+  lib,
   ...
 }:
 {
@@ -34,7 +35,7 @@
       RADARR_CONFIG = "${service_configs.radarr.dataDir}/config.xml";
       SONARR_URL = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
       SONARR_CONFIG = "${service_configs.sonarr.dataDir}/config.xml";
-      CATEGORIES = "tvshows,movies,anime";
+      CATEGORIES = lib.concatStringsSep "," (builtins.attrNames service_configs.torrent.categories);
       TAG_TORRENTS = "true";
     };
   };
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index c69f64b..0b12874 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -6,6 +6,11 @@
   inputs,
   ...
 }:
+let
+  categoriesFile = pkgs.writeText "categories.json" (
+    builtins.toJSON (lib.mapAttrs (_: path: { save_path = path; }) service_configs.torrent.categories)
+  );
+in
 {
   imports = [
     (lib.serviceMountWithZpool "qbittorrent" service_configs.zpool_hdds [
@@ -135,6 +140,22 @@
     UMask = lib.mkForce "0007";
   };
 
+  # Pre-define qBittorrent categories with explicit save paths so every
+  # torrent routes to its category directory instead of the SavePath root.
+  systemd.tmpfiles.settings.qbittorrent-categories = {
+    "${config.services.qbittorrent.profileDir}/qBittorrent/config/categories.json"."L+" = {
+      argument = "${categoriesFile}";
+      user = config.services.qbittorrent.user;
+      group = config.services.qbittorrent.group;
+      mode = "1400";
+    };
+  };
+
+  # Ensure category directories exist with correct ownership before first use.
+  systemd.tmpfiles.rules = lib.mapAttrsToList (
+    _: path: "d ${path} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group} -"
+  ) service_configs.torrent.categories;
+
   services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString config.services.qbittorrent.webuiPort}

From 06b2016bd603a4da997933d7180956af20107ec1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 1 Apr 2026 20:37:18 -0400
Subject: [PATCH 738/847] recyclarr: things

---
 services/arr/recyclarr.nix | 52 +++++++++++++++++++++++++++++++++++---
 1 file changed, 48 insertions(+), 4 deletions(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 4d4a460..aba8644 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -99,7 +99,7 @@ in
               }
             ];
           }
-          # x265 (HD) - override template -10000 penalty
+          # x265 (HD) - override template -10000 penalty for non-2160p HEVC
           {
             trash_ids = [ "dc98083864ea246d05a42df0d05f81cc" ];
             assign_scores_to = [
@@ -109,7 +109,7 @@ in
               }
             ];
           }
-          # x265 (no HDR/DV) - override template -10000 penalty
+          # x265 (no HDR/DV) - override template -10000 penalty for non-2160p HEVC
           {
             trash_ids = [ "839bea857ed2c0a8e084f3cbdbd65ecb" ];
             assign_scores_to = [
@@ -119,6 +119,28 @@ in
               }
             ];
           }
+          # Codec ranking: AV1 (20) > HEVC (10) > AVC (0)
+          #
+          # Positive scores only -- nothing drops below min_format_score.
+          # AVC stays at 0 implicitly (no custom format adds or removes score).
+          {
+            trash_ids = [ "cae4ca30163749b891686f95532519bd" ]; # AV1
+            assign_scores_to = [
+              {
+                name = "Remux + WEB 2160p";
+                score = 20;
+              }
+            ];
+          }
+          {
+            trash_ids = [ "9170d55c319f4fe40da8711ba9d8050d" ]; # x265
+            assign_scores_to = [
+              {
+                name = "Remux + WEB 2160p";
+                score = 10;
+              }
+            ];
+          }
         ];
       };
 
@@ -177,7 +199,7 @@ in
               }
             ];
           }
-          # x265 (HD) - override template -10000 penalty
+          # x265 (HD) - override template -10000 penalty for non-2160p HEVC
           {
             trash_ids = [ "47435ece6b99a0b477caf360e79ba0bb" ];
             assign_scores_to = [
@@ -187,7 +209,7 @@ in
               }
             ];
           }
-          # x265 (no HDR/DV) - override template -10000 penalty
+          # x265 (no HDR/DV) - override template -10000 penalty for non-2160p HEVC
           {
             trash_ids = [ "9b64dff695c2115facf1b6ea59c9bd07" ];
             assign_scores_to = [
@@ -197,6 +219,28 @@ in
               }
             ];
           }
+          # Codec ranking: AV1 (20) > HEVC (10) > AVC (0)
+          #
+          # Positive scores only -- nothing drops below min_format_score.
+          # AVC stays at 0 implicitly (no custom format adds or removes score).
+          {
+            trash_ids = [ "15a05bc7c1a36e2b57fd628f8977e2fc" ]; # AV1
+            assign_scores_to = [
+              {
+                name = "WEB-2160p";
+                score = 20;
+              }
+            ];
+          }
+          {
+            trash_ids = [ "c9eafd50846d299b862ca9bb6ea91950" ]; # x265
+            assign_scores_to = [
+              {
+                name = "WEB-2160p";
+                score = 10;
+              }
+            ];
+          }
         ];
       };
     };

From 7e779ca0f7be25482a73e073e83e5107507e5cb5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 13:13:38 -0400
Subject: [PATCH 739/847] power optimizations

---
 configuration.nix | 14 +------
 modules/power.nix | 93 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 94 insertions(+), 13 deletions(-)
 create mode 100644 modules/power.nix

diff --git a/configuration.nix b/configuration.nix
index 13a1582..b96ea97 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -20,6 +20,7 @@
     ./modules/no-rgb.nix
     ./modules/security.nix
     ./modules/ntfy-alerts.nix
+    ./modules/power.nix
 
     ./services/postgresql.nix
     ./services/jellyfin.nix
@@ -91,13 +92,6 @@
 
   services.kmscon.enable = true;
 
-  systemd.targets = {
-    sleep.enable = false;
-    suspend.enable = false;
-    hibernate.enable = false;
-    hybrid-sleep.enable = false;
-  };
-
   # Disable serial getty on ttyS0 to prevent dmesg warnings
   systemd.services."serial-getty@ttyS0".enable = false;
 
@@ -109,12 +103,6 @@
     enable = false;
   };
 
-  powerManagement = {
-    powertop.enable = true;
-    enable = true;
-    cpuFreqGovernor = "powersave";
-  };
-
   # https://github.com/NixOS/nixpkgs/issues/101459#issuecomment-758306434
   security.pam.loginLimits = [
     {
diff --git a/modules/power.nix b/modules/power.nix
new file mode 100644
index 0000000..98e6cda
--- /dev/null
+++ b/modules/power.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  powerManagement = {
+    enable = true;
+    powertop.enable = true;
+    cpuFreqGovernor = "powersave";
+  };
+
+  # Always-on server: disable all sleep targets.
+  systemd.targets = {
+    sleep.enable = false;
+    suspend.enable = false;
+    hibernate.enable = false;
+    hybrid-sleep.enable = false;
+  };
+
+  boot.kernelParams = [
+    # Disable NMI watchdog at boot. Eliminates periodic perf-counter interrupts
+    # across all cores (~1 W). Safe: apcupsd provides hardware hang detection
+    # via UPS, and softlockup watchdog remains active.
+    "nmi_watchdog=0"
+
+    # Route kernel work items to already-busy CPUs rather than waking idle ones.
+    # Reduces C-state exit frequency at the cost of slightly higher latency on
+    # work items -- irrelevant for a server whose latency-sensitive paths are
+    # all in userspace (caddy, jellyfin).
+    "workqueue.power_efficient=1"
+
+    # Force PCIe ASPM on even if the BIOS doesn't advertise support. ASRock
+    # B550M Pro4 BIOS defaults are conservative; the Zen 3 root complex and
+    # all downstream devices (NVMe, AHCI, Intel NIC) support L1 substates.
+    # powertop auto-tune sets the policy to powersupersave at runtime, but
+    # without `force` the kernel may refuse to enable ASPM at all if the BIOS
+    # opted out, making the policy write a no-op.
+    "pcie_aspm=force"
+  ];
+
+  boot.kernel.sysctl = {
+    # Belt-and-suspenders: also set via boot param, but sysctl ensures it
+    # stays off if anything re-enables it at runtime.
+    "kernel.nmi_watchdog" = 0;
+  };
+
+  # Server has no audio consumers. Power-gate the HDA codec at module load
+  # rather than waiting for powertop auto-tune to do it after boot.
+  boot.extraModprobeConfig = ''
+    options snd_hda_intel power_save=1 power_save_controller=Y
+  '';
+
+  # Apply sysfs power knobs that powertop --auto-tune cannot reach (hardened
+  # kernel blocks debugfs mount, so powertop silently skips ASPM policy and
+  # may only lower EPP to balance_power instead of power).
+  #
+  # AMD pstate EPP "power": deepest P-states, fastest core parking. Safe because:
+  # - xmrig runs at Nice=19 / CPUSchedulingPolicy=idle and tolerates latency
+  # - web services (caddy, jellyfin) are I/O-bound; the ~50 us extra C-state
+  #   exit latency is invisible behind network RTT
+  # - Minecraft server benefits from single-thread boost, which pstate still
+  #   provides on demand even in "power" mode (just with slightly slower ramp)
+  #
+  # ASPM powersupersave: deepest PCIe link power states (L1.1/L1.2). The
+  # pcie_aspm=force boot param enables ASPM, but the runtime policy defaults
+  # to "default" which only uses L0s. powersupersave adds L1 substates for
+  # all downstream devices (NVMe, AHCI, NIC).
+  systemd.services.power-tune = {
+    description = "Apply power-saving sysfs knobs (EPP, ASPM policy)";
+    after = [ "multi-user.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = lib.getExe (
+        pkgs.writeShellApplication {
+          name = "power-tune";
+          text = ''
+            # AMD pstate energy performance preference
+            for epp in /sys/devices/system/cpu/cpu*/cpufreq/energy_performance_preference; do
+              [ -f "$epp" ] && echo power > "$epp"
+            done
+
+            # PCIe ASPM policy
+            aspm=/sys/module/pcie_aspm/parameters/policy
+            [ -f "$aspm" ] && echo powersupersave > "$aspm"
+          '';
+        }
+      );
+    };
+  };
+}

From f342521d469015a1353fada577426b2b98705c65 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 13:42:39 -0400
Subject: [PATCH 740/847] llama-cpp: re-add w/ turboquant

---
 configuration.nix      |  2 ++
 flake.lock             | 53 ++++++++++++++++++++++++++++++++++++++++++
 flake.nix              |  5 ++++
 service-configs.nix    |  4 ++++
 services/llama-cpp.nix | 40 +++++++++++++++++++++++++++++++
 5 files changed, 104 insertions(+)
 create mode 100644 services/llama-cpp.nix

diff --git a/configuration.nix b/configuration.nix
index b96ea97..a49e9a7 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -47,6 +47,8 @@
 
     ./services/soulseek.nix
 
+    ./services/llama-cpp.nix
+
     ./services/ups.nix
     ./services/monitoring.nix
     ./services/jellyfin-annotations.nix
diff --git a/flake.lock b/flake.lock
index 2a02e08..7967502 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,6 +150,24 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_4"
@@ -276,6 +294,28 @@
         "type": "github"
       }
     },
+    "llamacpp": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775101360,
+        "narHash": "sha256-X1cyWED8lmsGKFc7Pb6nGJ8EVzpPqi5iKcyL8NVVIe8=",
+        "owner": "TheTom",
+        "repo": "llama-cpp-turboquant",
+        "rev": "04eeabb0d344b54ca12d4140b8af8c236ffe7beb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "TheTom",
+        "ref": "feature/turboquant-kv-cache",
+        "repo": "llama-cpp-turboquant",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
@@ -330,6 +370,18 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
+      }
+    },
     "nixpkgs-p2pool-module": {
       "flake": false,
       "locked": {
@@ -395,6 +447,7 @@
         "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
+        "llamacpp": "llamacpp",
         "nix-minecraft": "nix-minecraft",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index e8c4ba9..487628a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,6 +28,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    llamacpp = {
+      url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     srvos = {
       url = "github:nix-community/srvos";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/service-configs.nix b/service-configs.nix
index a3294bc..8f68293 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -169,6 +169,10 @@ rec {
         port = 9162;
         proto = "tcp";
       };
+      llama_cpp = {
+        port = 6688;
+        proto = "tcp";
+      };
     };
   };
 
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
new file mode 100644
index 0000000..1ed5fee
--- /dev/null
+++ b/services/llama-cpp.nix
@@ -0,0 +1,40 @@
+{
+  pkgs,
+  service_configs,
+  config,
+  inputs,
+  lib,
+  ...
+}:
+{
+  services.llama-cpp = {
+    enable = true;
+    model = toString (
+      pkgs.fetchurl {
+        url = "https://huggingface.co/Jackrong/Qwen3.5-9B-Claude-4.6-Opus-Reasoning-Distilled-v2-GGUF/resolve/main/Qwen3.5-9B.Q4_K_M.gguf";
+        sha256 = "8fbbc7b04a7d4b052d14b7aa97c8bf2014d39ceca8c2baaa043711712ba71ccc";
+      }
+    );
+    port = service_configs.ports.private.llama_cpp.port;
+    host = "0.0.0.0";
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    extraFlags = [
+      "-ngl"
+      "12"
+      "-c"
+      "16384"
+      "-ctk"
+      "q8_0"
+      "-ctv"
+      "turbo3"
+    ];
+  };
+
+  # have to do this in order to get vulkan to work
+  systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
+
+  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${toString config.services.llama-cpp.port}
+  '';
+}

From bb6ea2f1d51d2a0ddaf3e229a236319a298e9d3f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 15:32:39 -0400
Subject: [PATCH 741/847] llama-cpp: cpu only

---
 services/llama-cpp.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 1ed5fee..c3b782a 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -17,10 +17,10 @@
     );
     port = service_configs.ports.private.llama_cpp.port;
     host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
     extraFlags = [
-      "-ngl"
-      "12"
+      # "-ngl"
+      # "12"
       "-c"
       "16384"
       "-ctk"

From 50453cf0b5ac7cb4ccb89bb8c9ed047cc01b7abb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 16:09:17 -0400
Subject: [PATCH 742/847] llama-cpp: adjust args

---
 services/llama-cpp.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index c3b782a..22a766e 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -22,11 +22,13 @@
       # "-ngl"
       # "12"
       "-c"
-      "16384"
+      "32768"
       "-ctk"
       "q8_0"
       "-ctv"
-      "turbo3"
+      "turbo4"
+      "-fa"
+      "on"
     ];
   };
 

From df15be01eac8b411b24226ad86ecad6f5d09e35b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 17:43:07 -0400
Subject: [PATCH 743/847] llama-cpp: pause xmrig during active inference
 requests

Add sidecar service that polls llama-cpp /slots endpoint every 3s.
When any slot is processing, stops xmrig. Restarts xmrig after 10s
grace period when all slots are idle. Handles unreachable llama-cpp
gracefully (leaves xmrig untouched).
---
 configuration.nix                  |  2 +
 services/llama-cpp-xmrig-pause.nix | 35 ++++++++++++
 services/llama-cpp-xmrig-pause.py  | 91 ++++++++++++++++++++++++++++++
 3 files changed, 128 insertions(+)
 create mode 100644 services/llama-cpp-xmrig-pause.nix
 create mode 100644 services/llama-cpp-xmrig-pause.py

diff --git a/configuration.nix b/configuration.nix
index a49e9a7..676c9ef 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -65,6 +65,8 @@
     ./services/p2pool.nix
     ./services/xmrig.nix
 
+    ./services/llama-cpp-xmrig-pause.nix
+
     # KEEP UNTIL 2028
     ./services/caddy_senior_project.nix
 
diff --git a/services/llama-cpp-xmrig-pause.nix b/services/llama-cpp-xmrig-pause.nix
new file mode 100644
index 0000000..c5ee1e2
--- /dev/null
+++ b/services/llama-cpp-xmrig-pause.nix
@@ -0,0 +1,35 @@
+{
+  pkgs,
+  service_configs,
+  ...
+}:
+{
+  systemd.services.llama-cpp-xmrig-pause = {
+    description = "Pause xmrig while llama-cpp is processing requests";
+    after = [
+      "network.target"
+      "llama-cpp.service"
+      "xmrig.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.python3}/bin/python3 ${./llama-cpp-xmrig-pause.py}";
+      Restart = "always";
+      RestartSec = "10s";
+      NoNewPrivileges = true;
+      ProtectHome = true;
+      ProtectSystem = "strict";
+      PrivateTmp = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      MemoryDenyWriteExecute = true;
+    };
+    environment = {
+      LLAMA_CPP_URL = "http://127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}";
+      POLL_INTERVAL = "3";
+      GRACE_PERIOD = "10";
+    };
+  };
+}
diff --git a/services/llama-cpp-xmrig-pause.py b/services/llama-cpp-xmrig-pause.py
new file mode 100644
index 0000000..7f816f2
--- /dev/null
+++ b/services/llama-cpp-xmrig-pause.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""
+Pause xmrig while llama-cpp is processing inference requests.
+
+Polls llama-cpp /slots endpoint. When any slot is busy, stops xmrig.
+When all slots are idle for GRACE_PERIOD seconds, restarts xmrig.
+If llama-cpp is unreachable, does nothing (leaves xmrig in its current state).
+"""
+
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.request
+
+LLAMA_CPP_URL = os.environ["LLAMA_CPP_URL"].rstrip("/")
+POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "3"))
+GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "10"))
+
+
+def log(msg):
+    print(f"[llama-cpp-xmrig-pause] {msg}", file=sys.stderr, flush=True)
+
+
+def get_slots():
+    """Fetch /slots from llama-cpp. Returns list of slot dicts, or None on error."""
+    req = urllib.request.Request(f"{LLAMA_CPP_URL}/slots")
+    try:
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, OSError, json.JSONDecodeError, ValueError) as exc:
+        log(f"Cannot reach llama-cpp: {exc}")
+        return None
+
+
+def any_slot_busy(slots):
+    return any(s.get("is_processing", False) for s in slots)
+
+
+def systemctl(action, unit):
+    result = subprocess.run(
+        ["systemctl", action, unit],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        log(f"systemctl {action} {unit} failed (rc={result.returncode}): {result.stderr.strip()}")
+    return result.returncode == 0
+
+
+def main():
+    xmrig_paused = False
+    idle_since = None  # monotonic timestamp when slots first went idle
+
+    log(f"Starting: url={LLAMA_CPP_URL} poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s")
+
+    while True:
+        slots = get_slots()
+
+        if slots is None:
+            # llama-cpp unreachable — leave xmrig alone, reset idle timer
+            idle_since = None
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        busy = any_slot_busy(slots)
+
+        if busy:
+            idle_since = None
+            if not xmrig_paused:
+                log("Slot busy — stopping xmrig")
+                if systemctl("stop", "xmrig"):
+                    xmrig_paused = True
+        else:
+            # All slots idle
+            if xmrig_paused:
+                now = time.monotonic()
+                if idle_since is None:
+                    idle_since = now
+                elif now - idle_since >= GRACE_PERIOD:
+                    log("Slots idle past grace period — starting xmrig")
+                    if systemctl("start", "xmrig"):
+                        xmrig_paused = False
+                    idle_since = None
+
+        time.sleep(POLL_INTERVAL)
+
+
+if __name__ == "__main__":
+    main()

From 0235617627a7860ad713ffb0196ed9aeeb796b89 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 17:43:13 -0400
Subject: [PATCH 744/847] monitoring: fix intel-gpu-collector crash resilience

Wrap entire read_one_sample() in try/except to handle all failures
(missing binary, permission errors, malformed JSON, timeouts).
Write zero-valued metrics on failure instead of exiting non-zero.
Increase timeout from 5s to 8s for slower GPU initialization.
---
 services/intel-gpu-collector.py | 81 ++++++++++++++++++++++-----------
 1 file changed, 55 insertions(+), 26 deletions(-)

diff --git a/services/intel-gpu-collector.py b/services/intel-gpu-collector.py
index 97aacec..70a5560 100644
--- a/services/intel-gpu-collector.py
+++ b/services/intel-gpu-collector.py
@@ -12,33 +12,61 @@ TEXTFILE = os.environ.get(
 
 
 def read_one_sample():
-    proc = subprocess.Popen(
-        ["intel_gpu_top", "-J", "-s", "1000"],
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-    )
-    buf = b""
-    depth = 0
-    in_obj = False
-    deadline = time.monotonic() + 5.0
     try:
-        while time.monotonic() < deadline:
-            byte = proc.stdout.read(1)
-            if not byte:
-                break
-            if byte == b"{":
-                in_obj = True
-                depth += 1
-            if in_obj:
-                buf += byte
-            if in_obj and byte == b"}":
-                depth -= 1
-                if depth == 0:
+        proc = subprocess.Popen(
+            ["intel_gpu_top", "-J", "-s", "1000"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+        )
+        buf = b""
+        depth = 0
+        in_obj = False
+        deadline = time.monotonic() + 8.0
+        try:
+            while time.monotonic() < deadline:
+                byte = proc.stdout.read(1)
+                if not byte:
                     break
-    finally:
-        proc.terminate()
-        proc.wait()
-    return json.loads(buf) if buf else None
+                if byte == b"{":
+                    in_obj = True
+                    depth += 1
+                if in_obj:
+                    buf += byte
+                if in_obj and byte == b"}":
+                    depth -= 1
+                    if depth == 0:
+                        break
+        finally:
+            proc.terminate()
+            proc.wait()
+        if not buf:
+            return None
+        try:
+            return json.loads(buf)
+        except json.JSONDecodeError:
+            print("Malformed JSON from intel_gpu_top", file=sys.stderr)
+            return None
+    except Exception as e:
+        print(f"intel_gpu_top unavailable: {e}", file=sys.stderr)
+        return None
+
+
+def write_empty_metrics():
+    """Write zero-valued metrics so Prometheus doesn't see stale data."""
+    lines = [
+        "# HELP intel_gpu_engine_busy_percent Intel GPU engine busy percentage",
+        "# TYPE intel_gpu_engine_busy_percent gauge",
+        "# HELP intel_gpu_frequency_mhz Intel GPU actual frequency in MHz",
+        "# TYPE intel_gpu_frequency_mhz gauge",
+        "intel_gpu_frequency_mhz 0",
+        "# HELP intel_gpu_rc6_percent Intel GPU RC6 power-saving state percentage",
+        "# TYPE intel_gpu_rc6_percent gauge",
+        "intel_gpu_rc6_percent 0",
+    ]
+    tmp = TEXTFILE + ".tmp"
+    with open(tmp, "w") as f:
+        f.write("\n".join(lines) + "\n")
+    os.replace(tmp, TEXTFILE)
 
 
 def write_metrics(sample):
@@ -70,7 +98,8 @@ def main():
     sample = read_one_sample()
     if sample is None:
         print("Failed to read intel_gpu_top sample", file=sys.stderr)
-        sys.exit(1)
+        write_empty_metrics()
+        sys.exit(0)
     write_metrics(sample)
 
 

From 9baeaa5c23bd1e4fa3c1cff038e87a92716d666c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 17:43:49 -0400
Subject: [PATCH 745/847] llama-cpp: add grafana annotations for inference
 requests

Poll /slots endpoint, create annotations when slots start processing,
close with token count when complete. Includes NixOS VM test with
mock llama-cpp and grafana servers. Dashboard annotation entry added.
---
 configuration.nix                  |   1 +
 services/llama-cpp-annotations.nix |  40 +++++++
 services/llama-cpp-annotations.py  | 127 ++++++++++++++++++++
 services/monitoring.nix            |  12 ++
 tests/llama-cpp-annotations.nix    | 179 +++++++++++++++++++++++++++++
 tests/tests.nix                    |   3 +
 6 files changed, 362 insertions(+)
 create mode 100644 services/llama-cpp-annotations.nix
 create mode 100644 services/llama-cpp-annotations.py
 create mode 100644 tests/llama-cpp-annotations.nix

diff --git a/configuration.nix b/configuration.nix
index 676c9ef..de8f0b3 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -48,6 +48,7 @@
     ./services/soulseek.nix
 
     ./services/llama-cpp.nix
+    ./services/llama-cpp-annotations.nix
 
     ./services/ups.nix
     ./services/monitoring.nix
diff --git a/services/llama-cpp-annotations.nix b/services/llama-cpp-annotations.nix
new file mode 100644
index 0000000..94f5221
--- /dev/null
+++ b/services/llama-cpp-annotations.nix
@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  systemd.services.llama-cpp-annotations = {
+    description = "LLM request annotation service for Grafana";
+    after = [
+      "network.target"
+      "grafana.service"
+      "llama-cpp.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.python3}/bin/python3 ${./llama-cpp-annotations.py}";
+      Restart = "always";
+      RestartSec = "10s";
+      DynamicUser = true;
+      StateDirectory = "llama-cpp-annotations";
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      MemoryDenyWriteExecute = true;
+    };
+    environment = {
+      LLAMA_CPP_URL = "http://127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}";
+      GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
+      STATE_FILE = "/var/lib/llama-cpp-annotations/state.json";
+      POLL_INTERVAL = "5";
+    };
+  };
+}
diff --git a/services/llama-cpp-annotations.py b/services/llama-cpp-annotations.py
new file mode 100644
index 0000000..d8fac69
--- /dev/null
+++ b/services/llama-cpp-annotations.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+import json
+import os
+import sys
+import time
+import urllib.request
+
+LLAMA_CPP_URL = os.environ.get("LLAMA_CPP_URL", "http://127.0.0.1:6688")
+GRAFANA_URL = os.environ.get("GRAFANA_URL", "http://127.0.0.1:3000")
+STATE_FILE = os.environ.get("STATE_FILE", "/var/lib/llama-cpp-annotations/state.json")
+POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "5"))
+
+
+def http_json(method, url, body=None):
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(
+        url,
+        data=data,
+        headers={"Content-Type": "application/json", "Accept": "application/json"},
+        method=method,
+    )
+    with urllib.request.urlopen(req, timeout=5) as resp:
+        return json.loads(resp.read())
+
+
+def get_slots():
+    try:
+        req = urllib.request.Request(
+            f"{LLAMA_CPP_URL}/slots",
+            headers={"Accept": "application/json"},
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            return json.loads(resp.read())
+    except Exception as e:
+        print(f"Error fetching slots: {e}", file=sys.stderr)
+        return None
+
+
+def load_state():
+    try:
+        with open(STATE_FILE) as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError):
+        return {}
+
+
+def save_state(state):
+    os.makedirs(os.path.dirname(STATE_FILE), exist_ok=True)
+    tmp = STATE_FILE + ".tmp"
+    with open(tmp, "w") as f:
+        json.dump(state, f)
+    os.replace(tmp, STATE_FILE)
+
+
+def grafana_post(text, start_ms):
+    try:
+        result = http_json(
+            "POST",
+            f"{GRAFANA_URL}/api/annotations",
+            {"time": start_ms, "text": text, "tags": ["llama-cpp"]},
+        )
+        return result.get("id")
+    except Exception as e:
+        print(f"Error posting annotation: {e}", file=sys.stderr)
+        return None
+
+
+def grafana_close(grafana_id, end_ms, text=None):
+    try:
+        body = {"timeEnd": end_ms}
+        if text is not None:
+            body["text"] = text
+        http_json(
+            "PATCH",
+            f"{GRAFANA_URL}/api/annotations/{grafana_id}",
+            body,
+        )
+    except Exception as e:
+        print(f"Error closing annotation {grafana_id}: {e}", file=sys.stderr)
+
+
+def main():
+    state = load_state()
+
+    while True:
+        now_ms = int(time.time() * 1000)
+        slots = get_slots()
+
+        if slots is not None:
+            # Track which slots are currently processing
+            processing_ids = set()
+            for slot in slots:
+                slot_id = str(slot["id"])
+                is_processing = slot.get("is_processing", False)
+
+                if is_processing:
+                    processing_ids.add(slot_id)
+                    if slot_id not in state:
+                        text = f"LLM request (slot {slot['id']})"
+                        grafana_id = grafana_post(text, now_ms)
+                        if grafana_id is not None:
+                            state[slot_id] = {
+                                "grafana_id": grafana_id,
+                                "start_ms": now_ms,
+                            }
+                            save_state(state)
+
+            # Close annotations for slots that stopped processing
+            for slot_id in [k for k in state if k not in processing_ids]:
+                info = state.pop(slot_id)
+                # Try to get token count from the slot data
+                n_decoded = None
+                for slot in slots:
+                    if str(slot["id"]) == slot_id:
+                        n_decoded = slot.get("next_token", {}).get("n_decoded")
+                        break
+                text = f"LLM request (slot {slot_id})"
+                if n_decoded is not None and n_decoded > 0:
+                    text += f" — {n_decoded} tokens"
+                grafana_close(info["grafana_id"], now_ms, text)
+                save_state(state)
+
+        time.sleep(POLL_INTERVAL)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/services/monitoring.nix b/services/monitoring.nix
index f23f7c7..5c4c6ab 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -120,6 +120,18 @@ let
         type = "tags";
         tags = [ "zfs-scrub" ];
       }
+      {
+        name = "LLM Requests";
+        datasource = {
+          type = "grafana";
+          uid = "-- Grafana --";
+        };
+        enable = true;
+        iconColor = "purple";
+        showIn = 0;
+        type = "tags";
+        tags = [ "llama-cpp" ];
+      }
     ];
 
     panels = [
diff --git a/tests/llama-cpp-annotations.nix b/tests/llama-cpp-annotations.nix
new file mode 100644
index 0000000..4d7eb2d
--- /dev/null
+++ b/tests/llama-cpp-annotations.nix
@@ -0,0 +1,179 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  mockGrafana = ./mock-grafana-server.py;
+  script = ../services/llama-cpp-annotations.py;
+  python = pkgs.python3;
+
+  mockLlamaCpp = pkgs.writeText "mock-llama-cpp-server.py" ''
+    import http.server, json, sys, os
+
+    PORT = int(sys.argv[1])
+    STATE_FILE = sys.argv[2]
+
+    if not os.path.exists(STATE_FILE):
+        with open(STATE_FILE, "w") as f:
+            json.dump([{"id": 0, "is_processing": False, "next_token": {"n_decoded": 0}}], f)
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, fmt, *args):
+            pass
+
+        def _json(self, code, body):
+            data = json.dumps(body).encode()
+            self.send_response(code)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(data)
+
+        def do_GET(self):
+            if self.path == "/slots":
+                with open(STATE_FILE) as f:
+                    slots = json.load(f)
+                self._json(200, slots)
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self):
+            if self.path == "/test/set-slots":
+                length = int(self.headers.get("Content-Length", 0))
+                body = json.loads(self.rfile.read(length)) if length else []
+                with open(STATE_FILE, "w") as f:
+                    json.dump(body, f)
+                self._json(200, {"ok": True})
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+    http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
+  '';
+in
+pkgs.testers.runNixOSTest {
+  name = "llama-cpp-annotations";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.python3
+        pkgs.curl
+      ];
+    };
+
+  testScript = ''
+    import json
+    import time
+
+    GRAFANA_PORT = 13000
+    LLAMA_PORT = 16688
+    ANNOTS_FILE = "/tmp/annotations.json"
+    SLOTS_FILE = "/tmp/llama-slots.json"
+    STATE_FILE = "/tmp/llama-annot-state.json"
+    PYTHON = "${python}/bin/python3"
+    MOCK_GRAFANA = "${mockGrafana}"
+    MOCK_LLAMA = "${mockLlamaCpp}"
+    SCRIPT = "${script}"
+
+    def read_annotations():
+        out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
+        return json.loads(out.strip())
+
+    def set_slots(slots):
+        machine.succeed(
+            f"curl -sf -X POST http://127.0.0.1:{LLAMA_PORT}/test/set-slots "
+            f"-H 'Content-Type: application/json' "
+            f"-d '{json.dumps(slots)}'"
+        )
+
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Start mock services"):
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+        machine.succeed(
+            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
+        )
+        machine.succeed(
+            f"echo '[{{\"id\": 0, \"is_processing\": false, \"next_token\": {{\"n_decoded\": 0}}}}]' > {SLOTS_FILE}"
+        )
+        machine.succeed(
+            f"systemd-run --unit=mock-llama {PYTHON} {MOCK_LLAMA} {LLAMA_PORT} {SLOTS_FILE}"
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf http://127.0.0.1:{GRAFANA_PORT}/api/annotations -X POST "
+            f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
+            timeout=10,
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf http://127.0.0.1:{LLAMA_PORT}/slots | grep -q is_processing",
+            timeout=10,
+        )
+        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
+
+    with subtest("Start annotation service"):
+        machine.succeed(
+            f"systemd-run --unit=llama-annot "
+            f"--setenv=LLAMA_CPP_URL=http://127.0.0.1:{LLAMA_PORT} "
+            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
+            f"--setenv=STATE_FILE={STATE_FILE} "
+            f"--setenv=POLL_INTERVAL=2 "
+            f"{PYTHON} {SCRIPT}"
+        )
+        time.sleep(3)
+
+    with subtest("No annotations when slots are idle"):
+        annots = read_annotations()
+        assert annots == [], f"Expected no annotations, got: {annots}"
+
+    with subtest("Annotation created when slot starts processing"):
+        set_slots([{"id": 0, "is_processing": True, "next_token": {"n_decoded": 0}}])
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | {PYTHON} -c "
+            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
+            timeout=15,
+        )
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
+        assert "llama-cpp" in annots[0].get("tags", []), f"Missing tag: {annots[0]}"
+        assert "slot 0" in annots[0]["text"], f"Missing slot info: {annots[0]['text']}"
+        assert "timeEnd" not in annots[0], f"timeEnd should not be set: {annots[0]}"
+
+    with subtest("Annotation closed when slot stops processing"):
+        set_slots([{"id": 0, "is_processing": False, "next_token": {"n_decoded": 42}}])
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | {PYTHON} -c "
+            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
+            timeout=15,
+        )
+        annots = read_annotations()
+        assert len(annots) == 1, f"Expected 1, got: {annots}"
+        assert "timeEnd" in annots[0], f"timeEnd missing: {annots[0]}"
+        assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"
+        assert "42 tokens" in annots[0].get("text", ""), f"Token count missing: {annots[0]}"
+
+    with subtest("State survives restart"):
+        set_slots([{"id": 0, "is_processing": True, "next_token": {"n_decoded": 0}}])
+        machine.wait_until_succeeds(
+            f"cat {ANNOTS_FILE} | {PYTHON} -c "
+            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
+            timeout=15,
+        )
+        machine.succeed("systemctl stop llama-annot || true")
+        time.sleep(1)
+        machine.succeed(
+            f"systemd-run --unit=llama-annot-2 "
+            f"--setenv=LLAMA_CPP_URL=http://127.0.0.1:{LLAMA_PORT} "
+            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
+            f"--setenv=STATE_FILE={STATE_FILE} "
+            f"--setenv=POLL_INTERVAL=2 "
+            f"{PYTHON} {SCRIPT}"
+        )
+        time.sleep(4)
+        annots = read_annotations()
+        assert len(annots) == 2, f"Restart should not duplicate, got: {annots}"
+  '';
+}
diff --git a/tests/tests.nix b/tests/tests.nix
index 9762b9c..21e5b08 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -28,6 +28,9 @@ in
   # zfs scrub annotations test
   zfsScrubAnnotationsTest = handleTest ./zfs-scrub-annotations.nix;
 
+  # llama-cpp annotation service test
+  llamaCppAnnotationsTest = handleTest ./llama-cpp-annotations.nix;
+
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 

From e41f869843f3234b7870b30d2a56b30cb8337ac0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 17:44:04 -0400
Subject: [PATCH 746/847] trilium: add self-hosted note-taking service

Add trilium-server on port 8787 behind Caddy reverse proxy at
notes.sigkill.computer. Data stored on ZFS tank pool with
serviceMountWithZpool for mount ordering.
---
 configuration.nix    |  1 +
 service-configs.nix  |  8 ++++++++
 services/trilium.nix | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 services/trilium.nix

diff --git a/configuration.nix b/configuration.nix
index de8f0b3..2099a6b 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -49,6 +49,7 @@
 
     ./services/llama-cpp.nix
     ./services/llama-cpp-annotations.nix
+    ./services/trilium.nix
 
     ./services/ups.nix
     ./services/monitoring.nix
diff --git a/service-configs.nix b/service-configs.nix
index 8f68293..78cd711 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -173,6 +173,10 @@ rec {
         port = 6688;
         proto = "tcp";
       };
+      trilium = {
+        port = 8787;
+        proto = "tcp";
+      };
     };
   };
 
@@ -302,6 +306,10 @@ rec {
     domain = "grafana.${https.domain}";
   };
 
+  trilium = {
+    dataDir = services_dir + "/trilium";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/trilium.nix b/services/trilium.nix
new file mode 100644
index 0000000..758154a
--- /dev/null
+++ b/services/trilium.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "trilium-server" service_configs.zpool_ssds [
+      (service_configs.services_dir + "/trilium")
+    ])
+  ];
+
+  services.trilium-server = {
+    enable = true;
+    port = service_configs.ports.private.trilium.port;
+    host = "127.0.0.1";
+    dataDir = service_configs.trilium.dataDir;
+  };
+
+  services.caddy.virtualHosts."notes.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${toString service_configs.ports.private.trilium.port}
+  '';
+}

From bfe7a65db2008c2eef17a5d2ed8a3ac5d9e08553 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 18:02:23 -0400
Subject: [PATCH 747/847] monitoring: add zpool and boot partition usage
 metrics

Add textfile collector for ZFS pool utilization (tank, hdds) and
boot drive partitions (/boot, /persistent, /nix). Runs every 60s.
Add two Grafana dashboard panels: ZFS Pool Utilization and Boot
Drive Partitions as Row 5.
---
 services/disk-usage-collector.sh |  44 ++++++++++++
 services/monitoring.nix          | 117 +++++++++++++++++++++++++++++++
 2 files changed, 161 insertions(+)
 create mode 100644 services/disk-usage-collector.sh

diff --git a/services/disk-usage-collector.sh b/services/disk-usage-collector.sh
new file mode 100644
index 0000000..3874b53
--- /dev/null
+++ b/services/disk-usage-collector.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Collects ZFS pool utilization and boot partition usage for Prometheus textfile collector
+set -euo pipefail
+
+TEXTFILE="${TEXTFILE:?TEXTFILE env required}"
+TMP="${TEXTFILE}.$$"
+
+{
+  echo '# HELP zpool_size_bytes Total size of ZFS pool in bytes'
+  echo '# TYPE zpool_size_bytes gauge'
+  echo '# HELP zpool_used_bytes Used space in ZFS pool in bytes'
+  echo '# TYPE zpool_used_bytes gauge'
+  echo '# HELP zpool_free_bytes Free space in ZFS pool in bytes'
+  echo '# TYPE zpool_free_bytes gauge'
+
+  # -Hp: scripting mode, parseable, bytes
+  zpool list -Hp -o name,size,alloc,free | while IFS=$'\t' read -r name size alloc free; do
+    echo "zpool_size_bytes{pool=\"${name}\"} ${size}"
+    echo "zpool_used_bytes{pool=\"${name}\"} ${alloc}"
+    echo "zpool_free_bytes{pool=\"${name}\"} ${free}"
+  done
+
+  echo '# HELP partition_size_bytes Total size of partition in bytes'
+  echo '# TYPE partition_size_bytes gauge'
+  echo '# HELP partition_used_bytes Used space on partition in bytes'
+  echo '# TYPE partition_used_bytes gauge'
+  echo '# HELP partition_free_bytes Free space on partition in bytes'
+  echo '# TYPE partition_free_bytes gauge'
+
+  # Boot drive partitions: /boot (ESP), /persistent, /nix
+  # Use df with 1K blocks and convert to bytes
+  for mount in /boot /persistent /nix; do
+    if mountpoint -q "$mount" 2>/dev/null; then
+      read -r size used avail _ <<< "$(df -k --output=size,used,avail "$mount" | tail -1)"
+      size_b=$((size * 1024))
+      used_b=$((used * 1024))
+      avail_b=$((avail * 1024))
+      echo "partition_size_bytes{mount=\"${mount}\"} ${size_b}"
+      echo "partition_used_bytes{mount=\"${mount}\"} ${used_b}"
+      echo "partition_free_bytes{mount=\"${mount}\"} ${avail_b}"
+    fi
+  done
+} > "$TMP"
+mv "$TMP" "$TEXTFILE"
diff --git a/services/monitoring.nix b/services/monitoring.nix
index 5c4c6ab..c274257 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -79,6 +79,17 @@ let
     '';
   };
 
+  diskUsageCollector = pkgs.writeShellApplication {
+    name = "disk-usage-collector";
+    runtimeInputs = with pkgs; [
+      coreutils
+      gawk
+      config.boot.zfs.package
+      util-linux # for mountpoint
+    ];
+    text = builtins.readFile ./disk-usage-collector.sh;
+  };
+
   dashboard = {
     editable = true;
     graphTooltip = 1;
@@ -669,6 +680,94 @@ let
           overrides = [ ];
         };
       }
+
+      # -- Row 5: Storage --
+      {
+        id = 12;
+        type = "timeseries";
+        title = "ZFS Pool Utilization";
+        gridPos = {
+          h = 8;
+          w = 12;
+          x = 0;
+          y = 32;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "zpool_used_bytes{pool=\"tank\"} / zpool_size_bytes{pool=\"tank\"} * 100";
+            legendFormat = "tank";
+            refId = "A";
+          }
+          {
+            datasource = promDs;
+            expr = "zpool_used_bytes{pool=\"hdds\"} / zpool_size_bytes{pool=\"hdds\"} * 100";
+            legendFormat = "hdds";
+            refId = "B";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "percent";
+            min = 0;
+            max = 100;
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 20;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
+      {
+        id = 13;
+        type = "timeseries";
+        title = "Boot Drive Partitions";
+        gridPos = {
+          h = 8;
+          w = 12;
+          x = 12;
+          y = 32;
+        };
+        datasource = promDs;
+        targets = [
+          {
+            datasource = promDs;
+            expr = "partition_used_bytes{mount=\"/boot\"} / partition_size_bytes{mount=\"/boot\"} * 100";
+            legendFormat = "/boot";
+            refId = "A";
+          }
+          {
+            datasource = promDs;
+            expr = "partition_used_bytes{mount=\"/persistent\"} / partition_size_bytes{mount=\"/persistent\"} * 100";
+            legendFormat = "/persistent";
+            refId = "B";
+          }
+          {
+            datasource = promDs;
+            expr = "partition_used_bytes{mount=\"/nix\"} / partition_size_bytes{mount=\"/nix\"} * 100";
+            legendFormat = "/nix";
+            refId = "C";
+          }
+        ];
+        fieldConfig = {
+          defaults = {
+            unit = "percent";
+            min = 0;
+            max = 100;
+            color.mode = "palette-classic";
+            custom = {
+              lineWidth = 2;
+              fillOpacity = 20;
+              spanNulls = true;
+            };
+          };
+          overrides = [ ];
+        };
+      }
     ];
   };
 in
@@ -875,6 +974,24 @@ in
     };
   };
 
+  # -- Disk/pool usage textfile collector --
+  systemd.services.disk-usage-collector = {
+    description = "Collect ZFS pool and partition usage metrics for Prometheus";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe diskUsageCollector;
+    };
+    environment.TEXTFILE = "${textfileDir}/disk-usage.prom";
+  };
+
+  systemd.timers.disk-usage-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/60"; # every 60 seconds
+      RandomizedDelaySec = "10s";
+    };
+  };
+
   systemd.tmpfiles.rules = [
     "d ${textfileDir} 0755 root root -"
   ];

From 0aeb6c5523e0c047487a069f0a15b8a37c1ee04f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 18:02:23 -0400
Subject: [PATCH 748/847] llama-cpp: add API key auth via --api-key-file

Generate and encrypt a Bearer token for llama-cpp's built-in auth.
Remove caddy_auth from the vhost since basic auth blocks Bearer-only
clients. Internal sidecars (xmrig-pause, annotations) connect
directly to localhost and are unaffected (/slots is public).
---
 modules/age-secrets.nix       |   8 ++++++++
 secrets/llama-cpp-api-key.age | Bin 0 -> 299 bytes
 services/llama-cpp.nix        |   6 +++++-
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 secrets/llama-cpp-api-key.age

diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index 2effde8..63c612d 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -159,5 +159,13 @@
       owner = "gitea-runner";
       group = "gitea-runner";
     };
+
+    # llama-cpp API key for bearer token auth
+    llama-cpp-api-key = {
+      file = ../secrets/llama-cpp-api-key.age;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
   };
 }
diff --git a/secrets/llama-cpp-api-key.age b/secrets/llama-cpp-api-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..354f21164f62f605d8f974a44128dbddb79c69c8
GIT binary patch
literal 299
zcmZQ@_Y83kiVO&0(7yTi+Q%)wS6TLSC(N1IbxUB=OLM^^X)euIerG>AJK0~emgluH
z`$@gMr^C#*r*E5WfA_L%j_<*&q_7MQ`;*a`Y0?^pEyFsiE3!(&ezAVzldy^0d2fDr
zMwXP`C;8~Br2#KiZ+zo(`L>Dg{glA;-WJ}QQ-1Aupkb(>TOP3Lvd7Zjkp{j`cFkJ&
zY-`}>^S-_(+szB*Zr(ZQsIdGhN95c2rCFRxS!z*1EAnowQegdev1oPHjSp&DX1!Pb
z%o+J_zlGN))hBm9`C5fkomV`-S{cCMB!5la@^DLt@h2N)_FD_uYgUv?NcDJ`J-)i?
zKr^qa!1JuWmX2AQFX)|>jw(7_F12TFadT_d;bm#Ziw(U`>@9V))|1N6tospvs5x48
IVkxT+02t|z82|tP

literal 0
HcmV?d00001

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 22a766e..e1e6337 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -29,14 +29,18 @@
       "turbo4"
       "-fa"
       "on"
+      "--api-key-file"
+      config.age.secrets.llama-cpp-api-key.path
     ];
   };
 
   # have to do this in order to get vulkan to work
   systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
 
+  # Auth handled by llama-cpp --api-key-file (Bearer token).
+  # No caddy_auth — the API key is the auth layer, and caddy_auth's basic
+  # auth would block Bearer-only clients like oh-my-pi.
   services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
     reverse_proxy :${toString config.services.llama-cpp.port}
   '';
 }

From ab9c12cb978d6ff09361368ba4afc54db7b28abb Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 22:47:49 -0400
Subject: [PATCH 749/847] llama-cpp: general changes

---
 services/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index e1e6337..b6eeb4e 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -11,8 +11,8 @@
     enable = true;
     model = toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/Jackrong/Qwen3.5-9B-Claude-4.6-Opus-Reasoning-Distilled-v2-GGUF/resolve/main/Qwen3.5-9B.Q4_K_M.gguf";
-        sha256 = "8fbbc7b04a7d4b052d14b7aa97c8bf2014d39ceca8c2baaa043711712ba71ccc";
+        url = "https://huggingface.co/unsloth/Qwen3.5-9B-GGUF/resolve/main/Qwen3.5-9B-Q4_K_M.gguf";
+        sha256 = "03b74727a860a56338e042c4420bb3f04b2fec5734175f4cb9fa853daf52b7e8";
       }
     );
     port = service_configs.ports.private.llama_cpp.port;

From 096ffeb943dcdb86c1b4b9d7ab3a58e3be16b245 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 22:47:53 -0400
Subject: [PATCH 750/847] llama-cpp: xmrig + grafana hooks

---
 services/llama-cpp-annotations.nix |   5 +-
 services/llama-cpp-annotations.py  | 118 +++++++++++++--------
 services/llama-cpp-xmrig-pause.nix |   8 +-
 services/llama-cpp-xmrig-pause.py  |  88 +++++++++++-----
 tests/llama-cpp-annotations.nix    |  99 +++++-------------
 tests/llama-cpp-xmrig-pause.nix    | 162 +++++++++++++++++++++++++++++
 tests/mock-llama-server-proc.py    |  42 ++++++++
 tests/tests.nix                    |   4 +-
 8 files changed, 369 insertions(+), 157 deletions(-)
 create mode 100644 tests/llama-cpp-xmrig-pause.nix
 create mode 100644 tests/mock-llama-server-proc.py

diff --git a/services/llama-cpp-annotations.nix b/services/llama-cpp-annotations.nix
index 94f5221..163dfe4 100644
--- a/services/llama-cpp-annotations.nix
+++ b/services/llama-cpp-annotations.nix
@@ -1,15 +1,12 @@
 {
-  config,
   pkgs,
   service_configs,
-  lib,
   ...
 }:
 {
   systemd.services.llama-cpp-annotations = {
     description = "LLM request annotation service for Grafana";
     after = [
-      "network.target"
       "grafana.service"
       "llama-cpp.service"
     ];
@@ -31,10 +28,10 @@
       MemoryDenyWriteExecute = true;
     };
     environment = {
-      LLAMA_CPP_URL = "http://127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}";
       GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
       STATE_FILE = "/var/lib/llama-cpp-annotations/state.json";
       POLL_INTERVAL = "5";
+      CPU_THRESHOLD = "50";
     };
   };
 }
diff --git a/services/llama-cpp-annotations.py b/services/llama-cpp-annotations.py
index d8fac69..6da2c6c 100644
--- a/services/llama-cpp-annotations.py
+++ b/services/llama-cpp-annotations.py
@@ -1,14 +1,42 @@
 #!/usr/bin/env python3
+"""
+Grafana annotation service for llama-cpp inference requests.
+
+Monitors llama-server CPU usage via /proc. Creates a Grafana annotation
+when inference starts (CPU spikes), closes it when inference ends.
+"""
+
+import glob
 import json
 import os
 import sys
 import time
 import urllib.request
 
-LLAMA_CPP_URL = os.environ.get("LLAMA_CPP_URL", "http://127.0.0.1:6688")
 GRAFANA_URL = os.environ.get("GRAFANA_URL", "http://127.0.0.1:3000")
 STATE_FILE = os.environ.get("STATE_FILE", "/var/lib/llama-cpp-annotations/state.json")
 POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "5"))
+CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "50"))
+
+
+def find_llama_pid():
+    for path in glob.glob("/proc/[0-9]*/comm"):
+        try:
+            with open(path) as f:
+                if f.read().strip() == "llama-server":
+                    return int(path.split("/")[2])
+        except (OSError, ValueError):
+            continue
+    return None
+
+
+def get_cpu_times(pid):
+    try:
+        with open(f"/proc/{pid}/stat") as f:
+            fields = f.read().split(")")[-1].split()
+            return int(fields[11]) + int(fields[12])
+    except (OSError, IndexError, ValueError):
+        return None
 
 
 def http_json(method, url, body=None):
@@ -23,19 +51,6 @@ def http_json(method, url, body=None):
         return json.loads(resp.read())
 
 
-def get_slots():
-    try:
-        req = urllib.request.Request(
-            f"{LLAMA_CPP_URL}/slots",
-            headers={"Accept": "application/json"},
-        )
-        with urllib.request.urlopen(req, timeout=5) as resp:
-            return json.loads(resp.read())
-    except Exception as e:
-        print(f"Error fetching slots: {e}", file=sys.stderr)
-        return None
-
-
 def load_state():
     try:
         with open(STATE_FILE) as f:
@@ -81,45 +96,58 @@ def grafana_close(grafana_id, end_ms, text=None):
 
 def main():
     state = load_state()
+    prev_ticks = None
+    prev_time = None
+    hz = os.sysconf("SC_CLK_TCK")
 
     while True:
         now_ms = int(time.time() * 1000)
-        slots = get_slots()
+        pid = find_llama_pid()
 
-        if slots is not None:
-            # Track which slots are currently processing
-            processing_ids = set()
-            for slot in slots:
-                slot_id = str(slot["id"])
-                is_processing = slot.get("is_processing", False)
+        if pid is None:
+            prev_ticks = None
+            prev_time = None
+            time.sleep(POLL_INTERVAL)
+            continue
 
-                if is_processing:
-                    processing_ids.add(slot_id)
-                    if slot_id not in state:
-                        text = f"LLM request (slot {slot['id']})"
-                        grafana_id = grafana_post(text, now_ms)
-                        if grafana_id is not None:
-                            state[slot_id] = {
-                                "grafana_id": grafana_id,
-                                "start_ms": now_ms,
-                            }
-                            save_state(state)
+        ticks = get_cpu_times(pid)
+        now = time.monotonic()
 
-            # Close annotations for slots that stopped processing
-            for slot_id in [k for k in state if k not in processing_ids]:
-                info = state.pop(slot_id)
-                # Try to get token count from the slot data
-                n_decoded = None
-                for slot in slots:
-                    if str(slot["id"]) == slot_id:
-                        n_decoded = slot.get("next_token", {}).get("n_decoded")
-                        break
-                text = f"LLM request (slot {slot_id})"
-                if n_decoded is not None and n_decoded > 0:
-                    text += f" — {n_decoded} tokens"
-                grafana_close(info["grafana_id"], now_ms, text)
+        if ticks is None or prev_ticks is None or prev_time is None:
+            prev_ticks = ticks
+            prev_time = now
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        dt = now - prev_time
+        if dt <= 0:
+            prev_ticks = ticks
+            prev_time = now
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        cpu_pct = ((ticks - prev_ticks) / hz) / dt * 100
+        prev_ticks = ticks
+        prev_time = now
+
+        busy = cpu_pct > CPU_THRESHOLD
+
+        if busy and "active" not in state:
+            grafana_id = grafana_post("LLM request", now_ms)
+            if grafana_id is not None:
+                state["active"] = {
+                    "grafana_id": grafana_id,
+                    "start_ms": now_ms,
+                }
                 save_state(state)
 
+        elif not busy and "active" in state:
+            info = state.pop("active")
+            duration_s = (now_ms - info["start_ms"]) / 1000
+            text = f"LLM request ({duration_s:.1f}s)"
+            grafana_close(info["grafana_id"], now_ms, text)
+            save_state(state)
+
         time.sleep(POLL_INTERVAL)
 
 
diff --git a/services/llama-cpp-xmrig-pause.nix b/services/llama-cpp-xmrig-pause.nix
index c5ee1e2..f797de9 100644
--- a/services/llama-cpp-xmrig-pause.nix
+++ b/services/llama-cpp-xmrig-pause.nix
@@ -1,13 +1,11 @@
 {
   pkgs,
-  service_configs,
   ...
 }:
 {
   systemd.services.llama-cpp-xmrig-pause = {
     description = "Pause xmrig while llama-cpp is processing requests";
     after = [
-      "network.target"
       "llama-cpp.service"
       "xmrig.service"
     ];
@@ -16,20 +14,20 @@
       ExecStart = "${pkgs.python3}/bin/python3 ${./llama-cpp-xmrig-pause.py}";
       Restart = "always";
       RestartSec = "10s";
+      # Needs /proc access (default) and AF_UNIX for systemctl
       NoNewPrivileges = true;
       ProtectHome = true;
       ProtectSystem = "strict";
       PrivateTmp = true;
       RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
+        "AF_UNIX" # systemctl talks to systemd over D-Bus unix socket
       ];
       MemoryDenyWriteExecute = true;
     };
     environment = {
-      LLAMA_CPP_URL = "http://127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}";
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "10";
+      CPU_THRESHOLD = "50";
     };
   };
 }
diff --git a/services/llama-cpp-xmrig-pause.py b/services/llama-cpp-xmrig-pause.py
index 7f816f2..9426be2 100644
--- a/services/llama-cpp-xmrig-pause.py
+++ b/services/llama-cpp-xmrig-pause.py
@@ -2,42 +2,51 @@
 """
 Pause xmrig while llama-cpp is processing inference requests.
 
-Polls llama-cpp /slots endpoint. When any slot is busy, stops xmrig.
-When all slots are idle for GRACE_PERIOD seconds, restarts xmrig.
-If llama-cpp is unreachable, does nothing (leaves xmrig in its current state).
+Checks if the llama-server process is actively using CPU by reading
+/proc/<pid>/stat. When CPU usage exceeds the threshold, stops xmrig.
+When CPU drops below threshold for GRACE_PERIOD seconds, restarts xmrig.
 """
 
-import json
+import glob
 import os
 import subprocess
 import sys
 import time
-import urllib.request
 
-LLAMA_CPP_URL = os.environ["LLAMA_CPP_URL"].rstrip("/")
 POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "3"))
 GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "10"))
+# CPU percentage (per-core) above which llama-server is considered busy.
+# Idle llama-server uses ~0% CPU; active inference saturates multiple cores.
+CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "50"))
 
 
 def log(msg):
     print(f"[llama-cpp-xmrig-pause] {msg}", file=sys.stderr, flush=True)
 
 
-def get_slots():
-    """Fetch /slots from llama-cpp. Returns list of slot dicts, or None on error."""
-    req = urllib.request.Request(f"{LLAMA_CPP_URL}/slots")
+def find_llama_pid():
+    """Find the PID of the llama-server process."""
+    for path in glob.glob("/proc/[0-9]*/comm"):
+        try:
+            with open(path) as f:
+                if f.read().strip() == "llama-server":
+                    return int(path.split("/")[2])
+        except (OSError, ValueError):
+            continue
+    return None
+
+
+def get_cpu_times(pid):
+    """Read utime + stime from /proc/<pid>/stat. Returns total ticks or None."""
     try:
-        with urllib.request.urlopen(req, timeout=5) as resp:
-            return json.loads(resp.read())
-    except (urllib.error.URLError, OSError, json.JSONDecodeError, ValueError) as exc:
-        log(f"Cannot reach llama-cpp: {exc}")
+        with open(f"/proc/{pid}/stat") as f:
+            fields = f.read().split(")")[-1].split()
+            # fields[11] = utime, fields[12] = stime (0-indexed after ')')
+            return int(fields[11]) + int(fields[12])
+    except (OSError, IndexError, ValueError):
         return None
 
 
-def any_slot_busy(slots):
-    return any(s.get("is_processing", False) for s in slots)
-
-
 def systemctl(action, unit):
     result = subprocess.run(
         ["systemctl", action, unit],
@@ -51,35 +60,58 @@ def systemctl(action, unit):
 
 def main():
     xmrig_paused = False
-    idle_since = None  # monotonic timestamp when slots first went idle
+    idle_since = None
+    prev_ticks = None
+    prev_time = None
+    hz = os.sysconf("SC_CLK_TCK")
 
-    log(f"Starting: url={LLAMA_CPP_URL} poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s")
+    log(f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s threshold={CPU_THRESHOLD}%")
 
     while True:
-        slots = get_slots()
-
-        if slots is None:
-            # llama-cpp unreachable — leave xmrig alone, reset idle timer
+        pid = find_llama_pid()
+        if pid is None:
+            # llama-server not running
             idle_since = None
+            prev_ticks = None
+            prev_time = None
             time.sleep(POLL_INTERVAL)
             continue
 
-        busy = any_slot_busy(slots)
+        ticks = get_cpu_times(pid)
+        now = time.monotonic()
+
+        if ticks is None or prev_ticks is None or prev_time is None:
+            prev_ticks = ticks
+            prev_time = now
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        dt = now - prev_time
+        if dt <= 0:
+            prev_ticks = ticks
+            prev_time = now
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        # CPU% = (delta_ticks / hz) / delta_seconds * 100
+        cpu_pct = ((ticks - prev_ticks) / hz) / dt * 100
+        prev_ticks = ticks
+        prev_time = now
+
+        busy = cpu_pct > CPU_THRESHOLD
 
         if busy:
             idle_since = None
             if not xmrig_paused:
-                log("Slot busy — stopping xmrig")
+                log(f"llama-server busy ({cpu_pct:.0f}% CPU) — stopping xmrig")
                 if systemctl("stop", "xmrig"):
                     xmrig_paused = True
         else:
-            # All slots idle
             if xmrig_paused:
-                now = time.monotonic()
                 if idle_since is None:
                     idle_since = now
                 elif now - idle_since >= GRACE_PERIOD:
-                    log("Slots idle past grace period — starting xmrig")
+                    log(f"llama-server idle ({cpu_pct:.0f}% CPU) past grace period — starting xmrig")
                     if systemctl("start", "xmrig"):
                         xmrig_paused = False
                     idle_since = None
diff --git a/tests/llama-cpp-annotations.nix b/tests/llama-cpp-annotations.nix
index 4d7eb2d..649de47 100644
--- a/tests/llama-cpp-annotations.nix
+++ b/tests/llama-cpp-annotations.nix
@@ -1,5 +1,4 @@
 {
-  lib,
   pkgs,
   ...
 }:
@@ -8,49 +7,7 @@ let
   script = ../services/llama-cpp-annotations.py;
   python = pkgs.python3;
 
-  mockLlamaCpp = pkgs.writeText "mock-llama-cpp-server.py" ''
-    import http.server, json, sys, os
-
-    PORT = int(sys.argv[1])
-    STATE_FILE = sys.argv[2]
-
-    if not os.path.exists(STATE_FILE):
-        with open(STATE_FILE, "w") as f:
-            json.dump([{"id": 0, "is_processing": False, "next_token": {"n_decoded": 0}}], f)
-
-    class Handler(http.server.BaseHTTPRequestHandler):
-        def log_message(self, fmt, *args):
-            pass
-
-        def _json(self, code, body):
-            data = json.dumps(body).encode()
-            self.send_response(code)
-            self.send_header("Content-Type", "application/json")
-            self.end_headers()
-            self.wfile.write(data)
-
-        def do_GET(self):
-            if self.path == "/slots":
-                with open(STATE_FILE) as f:
-                    slots = json.load(f)
-                self._json(200, slots)
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-        def do_POST(self):
-            if self.path == "/test/set-slots":
-                length = int(self.headers.get("Content-Length", 0))
-                body = json.loads(self.rfile.read(length)) if length else []
-                with open(STATE_FILE, "w") as f:
-                    json.dump(body, f)
-                self._json(200, {"ok": True})
-            else:
-                self.send_response(404)
-                self.end_headers()
-
-    http.server.HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
-  '';
+  mockLlamaProcess = ./mock-llama-server-proc.py;
 in
 pkgs.testers.runNixOSTest {
   name = "llama-cpp-annotations";
@@ -61,6 +18,7 @@ pkgs.testers.runNixOSTest {
       environment.systemPackages = [
         pkgs.python3
         pkgs.curl
+        pkgs.procps
       ];
     };
 
@@ -69,25 +27,23 @@ pkgs.testers.runNixOSTest {
     import time
 
     GRAFANA_PORT = 13000
-    LLAMA_PORT = 16688
     ANNOTS_FILE = "/tmp/annotations.json"
-    SLOTS_FILE = "/tmp/llama-slots.json"
+    LLAMA_STATE = "/tmp/llama-state.txt"
     STATE_FILE = "/tmp/llama-annot-state.json"
     PYTHON = "${python}/bin/python3"
     MOCK_GRAFANA = "${mockGrafana}"
-    MOCK_LLAMA = "${mockLlamaCpp}"
+    MOCK_LLAMA = "${mockLlamaProcess}"
     SCRIPT = "${script}"
 
     def read_annotations():
         out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
         return json.loads(out.strip())
 
-    def set_slots(slots):
-        machine.succeed(
-            f"curl -sf -X POST http://127.0.0.1:{LLAMA_PORT}/test/set-slots "
-            f"-H 'Content-Type: application/json' "
-            f"-d '{json.dumps(slots)}'"
-        )
+    def set_busy():
+        machine.succeed(f"echo busy > {LLAMA_STATE}")
+
+    def set_idle():
+        machine.succeed(f"echo idle > {LLAMA_STATE}")
 
     start_all()
     machine.wait_for_unit("multi-user.target")
@@ -98,10 +54,7 @@ pkgs.testers.runNixOSTest {
             f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
         )
         machine.succeed(
-            f"echo '[{{\"id\": 0, \"is_processing\": false, \"next_token\": {{\"n_decoded\": 0}}}}]' > {SLOTS_FILE}"
-        )
-        machine.succeed(
-            f"systemd-run --unit=mock-llama {PYTHON} {MOCK_LLAMA} {LLAMA_PORT} {SLOTS_FILE}"
+            f"systemd-run --unit=mock-llama {PYTHON} {MOCK_LLAMA} {LLAMA_STATE}"
         )
         machine.wait_until_succeeds(
             f"curl -sf http://127.0.0.1:{GRAFANA_PORT}/api/annotations -X POST "
@@ -109,7 +62,7 @@ pkgs.testers.runNixOSTest {
             timeout=10,
         )
         machine.wait_until_succeeds(
-            f"curl -sf http://127.0.0.1:{LLAMA_PORT}/slots | grep -q is_processing",
+            "pgrep -x llama-server",
             timeout=10,
         )
         machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
@@ -117,62 +70,62 @@ pkgs.testers.runNixOSTest {
     with subtest("Start annotation service"):
         machine.succeed(
             f"systemd-run --unit=llama-annot "
-            f"--setenv=LLAMA_CPP_URL=http://127.0.0.1:{LLAMA_PORT} "
             f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
             f"--setenv=STATE_FILE={STATE_FILE} "
             f"--setenv=POLL_INTERVAL=2 "
+            f"--setenv=CPU_THRESHOLD=10 "
             f"{PYTHON} {SCRIPT}"
         )
-        time.sleep(3)
+        time.sleep(5)
 
-    with subtest("No annotations when slots are idle"):
+    with subtest("No annotations when idle"):
         annots = read_annotations()
         assert annots == [], f"Expected no annotations, got: {annots}"
 
-    with subtest("Annotation created when slot starts processing"):
-        set_slots([{"id": 0, "is_processing": True, "next_token": {"n_decoded": 0}}])
+    with subtest("Annotation created when llama-server becomes busy"):
+        set_busy()
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | {PYTHON} -c "
             f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
-            timeout=15,
+            timeout=20,
         )
         annots = read_annotations()
         assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
         assert "llama-cpp" in annots[0].get("tags", []), f"Missing tag: {annots[0]}"
-        assert "slot 0" in annots[0]["text"], f"Missing slot info: {annots[0]['text']}"
+        assert "LLM request" in annots[0]["text"], f"Missing text: {annots[0]['text']}"
         assert "timeEnd" not in annots[0], f"timeEnd should not be set: {annots[0]}"
 
-    with subtest("Annotation closed when slot stops processing"):
-        set_slots([{"id": 0, "is_processing": False, "next_token": {"n_decoded": 42}}])
+    with subtest("Annotation closed when llama-server becomes idle"):
+        set_idle()
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | {PYTHON} -c "
             f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
-            timeout=15,
+            timeout=20,
         )
         annots = read_annotations()
         assert len(annots) == 1, f"Expected 1, got: {annots}"
         assert "timeEnd" in annots[0], f"timeEnd missing: {annots[0]}"
         assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"
-        assert "42 tokens" in annots[0].get("text", ""), f"Token count missing: {annots[0]}"
+        assert "s)" in annots[0].get("text", ""), f"Duration missing: {annots[0]}"
 
     with subtest("State survives restart"):
-        set_slots([{"id": 0, "is_processing": True, "next_token": {"n_decoded": 0}}])
+        set_busy()
         machine.wait_until_succeeds(
             f"cat {ANNOTS_FILE} | {PYTHON} -c "
             f"\"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
-            timeout=15,
+            timeout=20,
         )
         machine.succeed("systemctl stop llama-annot || true")
         time.sleep(1)
         machine.succeed(
             f"systemd-run --unit=llama-annot-2 "
-            f"--setenv=LLAMA_CPP_URL=http://127.0.0.1:{LLAMA_PORT} "
             f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
             f"--setenv=STATE_FILE={STATE_FILE} "
             f"--setenv=POLL_INTERVAL=2 "
+            f"--setenv=CPU_THRESHOLD=10 "
             f"{PYTHON} {SCRIPT}"
         )
-        time.sleep(4)
+        time.sleep(6)
         annots = read_annotations()
         assert len(annots) == 2, f"Restart should not duplicate, got: {annots}"
   '';
diff --git a/tests/llama-cpp-xmrig-pause.nix b/tests/llama-cpp-xmrig-pause.nix
new file mode 100644
index 0000000..44eca77
--- /dev/null
+++ b/tests/llama-cpp-xmrig-pause.nix
@@ -0,0 +1,162 @@
+{
+  pkgs,
+  ...
+}:
+let
+  script = ../services/llama-cpp-xmrig-pause.py;
+  python = pkgs.python3;
+
+  # SmolLM-135M Q2_K: 85MB, modern GGUFv3, generates ~30 tok/s on one CPU
+  # thread — slow enough that a 200-token request keeps the process busy for
+  # several seconds, fast enough that tests don't crawl.
+  tinyModel = pkgs.fetchurl {
+    url = "https://huggingface.co/QuantFactory/SmolLM-135M-GGUF/resolve/main/SmolLM-135M.Q2_K.gguf";
+    hash = "sha256-DX46drPNJILNba21xfY2tyE0/yPWgOhz43gJdeSYKh4=";
+  };
+in
+pkgs.testers.runNixOSTest {
+  name = "llama-cpp-xmrig-pause";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.python3
+        pkgs.procps
+        pkgs.curl
+        pkgs.llama-cpp
+      ];
+
+      # Mock xmrig as a simple sleep process that can be stopped/started.
+      systemd.services.xmrig = {
+        description = "Mock xmrig miner";
+        serviceConfig = {
+          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+          Type = "simple";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+
+  testScript = ''
+    import time
+
+    PORT = 18088
+    MODEL = "${tinyModel}"
+    PYTHON = "${python}/bin/python3"
+    SCRIPT = "${script}"
+
+    # Tuned for test speed while remaining realistic.
+    # POLL_INTERVAL=1 keeps detection latency low.
+    # GRACE_PERIOD=5 is long enough to verify "stays stopped" but short enough
+    # that the full test completes in ~2 minutes.
+    # CPU_THRESHOLD=10 is low because the VM has limited cores and the model
+    # is small — but any active inference still saturates a core.
+    POLL_INTERVAL = "1"
+    GRACE_PERIOD = "5"
+    CPU_THRESHOLD = "10"
+
+    infer_counter = 0
+
+    def send_completion(n_predict=200):
+        """Fire a completion request in the background via a transient systemd unit."""
+        global infer_counter
+        infer_counter += 1
+        name = f"infer-{infer_counter}"
+        machine.succeed(
+            f"systemd-run --unit={name} --property=Type=exec "
+            f"curl -sf -X POST http://127.0.0.1:{PORT}/completion "
+            f"-H 'Content-Type: application/json' "
+            f"-d '{{\"prompt\": \"Once upon a time in a land far away there lived\", \"n_predict\": {n_predict}}}'"
+        )
+        return name
+
+    def wait_inference_done(unit_name, timeout=60):
+        """Wait for a background inference request to finish."""
+        machine.wait_until_fails(
+            f"systemctl is-active {unit_name}",
+            timeout=timeout,
+        )
+
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("xmrig.service")
+
+    with subtest("Start llama-server"):
+        machine.succeed(
+            f"systemd-run --unit=llama-server "
+            # Single inference thread to maximise per-core CPU%, which is
+            # what the monitor measures.  Keeps token generation slow enough
+            # (~30 tok/s) that a 200-token request sustains load for seconds.
+            f"llama-server --model {MODEL} --port {PORT} --ctx-size 512 -t 1 -np 1"
+        )
+        machine.wait_until_succeeds(
+            f"curl -sf http://127.0.0.1:{PORT}/health",
+            timeout=30,
+        )
+        machine.succeed("pgrep -x llama-server")
+
+    with subtest("Start pause monitor"):
+        machine.succeed(
+            f"systemd-run --unit=llama-xmrig-pause "
+            f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
+            f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
+            f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
+            f"{PYTHON} {SCRIPT}"
+        )
+        # The monitor needs two consecutive polls to compute a CPU delta.
+        # Wait for baseline to stabilise.
+        time.sleep(3)
+
+    with subtest("xmrig stays running while llama-server is idle"):
+        machine.succeed("systemctl is-active xmrig")
+
+    with subtest("xmrig stopped during prompt processing"):
+        unit = send_completion(n_predict=200)
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+    with subtest("xmrig remains stopped during grace period after inference ends"):
+        wait_inference_done(unit)
+        # Inference just finished.  The monitor will need 1-2 polls to detect
+        # idle, then the grace period starts.  Checking 2s after completion
+        # is well within the 5s grace window.
+        time.sleep(2)
+        machine.fail("systemctl is-active xmrig")
+
+    with subtest("xmrig resumes after grace period expires"):
+        # Already idle since previous subtest.  Grace period (5s) plus
+        # detection delay (~2 polls) means xmrig should restart within ~8s.
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+
+    with subtest("Sequential prompts do not cause xmrig flapping"):
+        # First prompt — stop xmrig
+        unit1 = send_completion(n_predict=200)
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+        wait_inference_done(unit1)
+
+        # Brief idle gap — shorter than grace period
+        time.sleep(2)
+
+        # Second prompt arrives before grace period expires, resetting it
+        unit2 = send_completion(n_predict=200)
+        time.sleep(3)
+
+        # xmrig must still be stopped
+        machine.fail("systemctl is-active xmrig")
+
+        wait_inference_done(unit2)
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+
+    with subtest("xmrig stays stopped during sustained inference"):
+        unit = send_completion(n_predict=500)
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        # Stay busy longer than the grace period to prove continuous
+        # activity keeps xmrig stopped indefinitely.
+        time.sleep(8)
+        machine.fail("systemctl is-active xmrig")
+
+        wait_inference_done(unit)
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+  '';
+}
diff --git a/tests/mock-llama-server-proc.py b/tests/mock-llama-server-proc.py
new file mode 100644
index 0000000..6119372
--- /dev/null
+++ b/tests/mock-llama-server-proc.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""
+Mock llama-server process for NixOS VM tests.
+
+Sets /proc/self/comm to "llama-server" via prctl so that monitoring scripts
+(llama-cpp-annotations, llama-cpp-xmrig-pause) can discover this process
+the same way they discover the real one.
+
+Usage: python3 mock-llama-server-proc.py <state-file>
+
+The state file controls behavior:
+  "busy"  -> burn CPU in a tight loop (simulates prompt processing / inference)
+  "idle"  -> sleep (simulates waiting for requests)
+"""
+
+import ctypes
+import ctypes.util
+import sys
+import time
+
+STATE_FILE = sys.argv[1]
+
+# PR_SET_NAME = 15, sets /proc/self/comm
+libc = ctypes.CDLL(ctypes.util.find_library("c"), use_errno=True)
+libc.prctl(15, b"llama-server", 0, 0, 0)
+
+with open(STATE_FILE, "w") as f:
+    f.write("idle")
+
+while True:
+    try:
+        with open(STATE_FILE) as f:
+            state = f.read().strip()
+    except Exception:
+        state = "idle"
+
+    if state == "busy":
+        end = time.monotonic() + 0.1
+        while time.monotonic() < end:
+            _ = sum(range(10000))
+    else:
+        time.sleep(0.5)
diff --git a/tests/tests.nix b/tests/tests.nix
index 21e5b08..2dcec9a 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -28,9 +28,9 @@ in
   # zfs scrub annotations test
   zfsScrubAnnotationsTest = handleTest ./zfs-scrub-annotations.nix;
 
-  # llama-cpp annotation service test
+  # llama-cpp tests
   llamaCppAnnotationsTest = handleTest ./llama-cpp-annotations.nix;
-
+  llamaCppXmrigPauseTest = handleTest ./llama-cpp-xmrig-pause.nix;
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 

From 9e235abf4819ba3e7fbc4ad4f9690c9d0375e91a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 2 Apr 2026 22:49:07 -0400
Subject: [PATCH 751/847] monitoring: fix disk-usage-collector timer calendar
 spec

---
 services/monitoring.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/monitoring.nix b/services/monitoring.nix
index c274257..1596596 100644
--- a/services/monitoring.nix
+++ b/services/monitoring.nix
@@ -987,7 +987,7 @@ in
   systemd.timers.disk-usage-collector = {
     wantedBy = [ "timers.target" ];
     timerConfig = {
-      OnCalendar = "*:*:0/60"; # every 60 seconds
+      OnCalendar = "minutely";
       RandomizedDelaySec = "10s";
     };
   };

From c2ff07b32911d8086715b1807a8d1c4873ab5224 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 00:17:38 -0400
Subject: [PATCH 752/847] llama-cpp: disable

---
 services/llama-cpp.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index b6eeb4e..23dee04 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -8,7 +8,7 @@
 }:
 {
   services.llama-cpp = {
-    enable = true;
+    enable = false;
     model = toString (
       pkgs.fetchurl {
         url = "https://huggingface.co/unsloth/Qwen3.5-9B-GGUF/resolve/main/Qwen3.5-9B-Q4_K_M.gguf";

From 8e6619097d8dcafa77c221c62291ab3e28c8a776 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 00:20:13 -0400
Subject: [PATCH 753/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7967502..5e712a4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -215,11 +215,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774875830,
-        "narHash": "sha256-WPYlTmZvVa9dWlAziFkVjBdv1Z6giNIq40O1DxsBmiI=",
+        "lastModified": 1775077333,
+        "narHash": "sha256-OXcxobt7lBkh1B8AjwreU+24myhtKpqeLfAeIyNLFY8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7afd8cebb99e25a64a745765920e663478eb8830",
+        "rev": "49ca96b2714c5931e17401eff87f3edd42d2b0f2",
         "type": "github"
       },
       "original": {
@@ -302,11 +302,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775101360,
-        "narHash": "sha256-X1cyWED8lmsGKFc7Pb6nGJ8EVzpPqi5iKcyL8NVVIe8=",
+        "lastModified": 1775161985,
+        "narHash": "sha256-CahR+F3hF7C5IYWooVblvlzHf2eDST0Eagu59xdY37g=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "04eeabb0d344b54ca12d4140b8af8c236ffe7beb",
+        "rev": "63b832bc0799ba7270e695e0987d0bd2272bdc7e",
         "type": "github"
       },
       "original": {
@@ -325,11 +325,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775014230,
-        "narHash": "sha256-oqRN8daUQrUPIjdoc8+bXgy+MVLXt3pa02UeFE/0Eus=",
+        "lastModified": 1775185059,
+        "narHash": "sha256-3d9gBmLMfI9d5xwfbd9Zr5JwpQzZ27qw9NiRjJ2aB28=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "253331438df9aaa637c4b13fbac7cce5f6d04775",
+        "rev": "f5d7077eb578b9e321b74329bd0625d5569dc90e",
         "type": "github"
       },
       "original": {
@@ -525,11 +525,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774909327,
-        "narHash": "sha256-P0L3fYEiQHp2bKrBF+H9GCPYKhLohE32Bu5OgnGYh7o=",
+        "lastModified": 1775095870,
+        "narHash": "sha256-C15ZVObWmLOKOme4VkJru8+1an5xRZE0R0/t3AuIEKM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "154666bca66525a3f6cc206df1cc5ae84e1450b6",
+        "rev": "8677ae9b6569964e5a27e27abfb707a49a6b827f",
         "type": "github"
       },
       "original": {
@@ -601,11 +601,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1774994979,
-        "narHash": "sha256-fYUw6SA2qvG2K5O1NN087EaP3fAPhFZM/9YHINyjaxc=",
+        "lastModified": 1775167783,
+        "narHash": "sha256-Tus994D/cxp3HDFRJ2057eBw5wHJ7EncOXyodiwUCwU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "37bdb0abc56c990797b1bf8387c9691778ee2a74",
+        "rev": "74023c1466f7ad7b777a3047d10cca83e005c111",
         "type": "github"
       },
       "original": {

From 1451f902ad1a246a8ac93a4d64b480cc7ff52d07 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 00:36:44 -0400
Subject: [PATCH 754/847] grafana: re-organize

---
 configuration.nix                             |   6 +-
 .../{monitoring.nix => grafana/dashboard.nix} | 302 ------------------
 services/grafana/default.nix                  |  14 +
 services/grafana/disk-usage-collector.nix     |  38 +++
 .../{ => grafana}/disk-usage-collector.sh     |   0
 services/grafana/grafana.nix                  |  86 +++++
 services/grafana/intel-gpu-collector.nix      |  38 +++
 services/{ => grafana}/intel-gpu-collector.py |   0
 .../{ => grafana}/jellyfin-annotations.nix    |   2 +-
 .../{ => grafana}/jellyfin-annotations.py     |   0
 services/grafana/jellyfin-collector.nix       |  54 ++++
 .../{ => grafana}/llama-cpp-annotations.nix   |   4 +-
 .../{ => grafana}/llama-cpp-annotations.py    |   0
 services/grafana/prometheus.nix               |  74 +++++
 services/grafana/qbittorrent-collector.nix    |  60 ++++
 .../{ => grafana}/zfs-scrub-annotations.nix   |   2 +-
 .../{ => grafana}/zfs-scrub-annotations.sh    |   0
 tests/jellyfin-annotations.nix                |   2 +-
 tests/llama-cpp-annotations.nix               |   2 +-
 tests/zfs-scrub-annotations.nix               |   2 +-
 20 files changed, 374 insertions(+), 312 deletions(-)
 rename services/{monitoring.nix => grafana/dashboard.nix} (66%)
 create mode 100644 services/grafana/default.nix
 create mode 100644 services/grafana/disk-usage-collector.nix
 rename services/{ => grafana}/disk-usage-collector.sh (100%)
 create mode 100644 services/grafana/grafana.nix
 create mode 100644 services/grafana/intel-gpu-collector.nix
 rename services/{ => grafana}/intel-gpu-collector.py (100%)
 rename services/{ => grafana}/jellyfin-annotations.nix (93%)
 rename services/{ => grafana}/jellyfin-annotations.py (100%)
 create mode 100644 services/grafana/jellyfin-collector.nix
 rename services/{ => grafana}/llama-cpp-annotations.nix (90%)
 rename services/{ => grafana}/llama-cpp-annotations.py (100%)
 create mode 100644 services/grafana/prometheus.nix
 create mode 100644 services/grafana/qbittorrent-collector.nix
 rename services/{ => grafana}/zfs-scrub-annotations.nix (90%)
 rename services/{ => grafana}/zfs-scrub-annotations.sh (100%)

diff --git a/configuration.nix b/configuration.nix
index 2099a6b..a40e2c3 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -48,13 +48,11 @@
     ./services/soulseek.nix
 
     ./services/llama-cpp.nix
-    ./services/llama-cpp-annotations.nix
     ./services/trilium.nix
 
     ./services/ups.nix
-    ./services/monitoring.nix
-    ./services/jellyfin-annotations.nix
-    ./services/zfs-scrub-annotations.nix
+
+    ./services/grafana
 
     ./services/bitwarden.nix
     ./services/firefox-syncserver.nix
diff --git a/services/monitoring.nix b/services/grafana/dashboard.nix
similarity index 66%
rename from services/monitoring.nix
rename to services/grafana/dashboard.nix
index 1596596..97afe2a 100644
--- a/services/monitoring.nix
+++ b/services/grafana/dashboard.nix
@@ -1,95 +1,12 @@
 {
-  config,
-  pkgs,
-  service_configs,
-  lib,
   ...
 }:
 let
-  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
-
   promDs = {
     type = "prometheus";
     uid = "prometheus";
   };
 
-  jellyfinCollector = pkgs.writeShellApplication {
-    name = "jellyfin-metrics-collector";
-    runtimeInputs = with pkgs; [
-      curl
-      jq
-    ];
-    text = ''
-      API_KEY=$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")
-      JELLYFIN="http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}"
-
-      if response=$(curl -sf --max-time 5 "''${JELLYFIN}/Sessions?api_key=''${API_KEY}"); then
-        active_streams=$(echo "$response" | jq '[.[] | select(.NowPlayingItem != null)] | length')
-      else
-        active_streams=0
-      fi
-
-      {
-        echo '# HELP jellyfin_active_streams Number of currently active Jellyfin streams'
-        echo '# TYPE jellyfin_active_streams gauge'
-        echo "jellyfin_active_streams $active_streams"
-      } > "${textfileDir}/jellyfin.prom.$$.tmp"
-      mv "${textfileDir}/jellyfin.prom.$$.tmp" "${textfileDir}/jellyfin.prom"
-    '';
-  };
-
-  intelGpuCollector = pkgs.writeShellApplication {
-    name = "intel-gpu-collector";
-    runtimeInputs = with pkgs; [
-      python3
-      intel-gpu-tools
-    ];
-    text = ''
-      exec python3 ${./intel-gpu-collector.py}
-    '';
-  };
-
-  qbittorrentCollector = pkgs.writeShellApplication {
-    name = "qbittorrent-collector";
-    runtimeInputs = with pkgs; [
-      curl
-      jq
-    ];
-    text = ''
-      QBIT="http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}"
-      OUT="${textfileDir}/qbittorrent.prom"
-
-      if info=$(curl -sf --max-time 5 "''${QBIT}/api/v2/transfer/info"); then
-        dl=$(echo "$info" | jq '.dl_info_speed')
-        ul=$(echo "$info" | jq '.up_info_speed')
-      else
-        dl=0
-        ul=0
-      fi
-
-      {
-        echo '# HELP qbittorrent_download_bytes_per_second Current download speed in bytes/s'
-        echo '# TYPE qbittorrent_download_bytes_per_second gauge'
-        echo "qbittorrent_download_bytes_per_second $dl"
-        echo '# HELP qbittorrent_upload_bytes_per_second Current upload speed in bytes/s'
-        echo '# TYPE qbittorrent_upload_bytes_per_second gauge'
-        echo "qbittorrent_upload_bytes_per_second $ul"
-      } > "''${OUT}.tmp"
-      mv "''${OUT}.tmp" "$OUT"
-    '';
-  };
-
-  diskUsageCollector = pkgs.writeShellApplication {
-    name = "disk-usage-collector";
-    runtimeInputs = with pkgs; [
-      coreutils
-      gawk
-      config.boot.zfs.package
-      util-linux # for mountpoint
-    ];
-    text = builtins.readFile ./disk-usage-collector.sh;
-  };
-
   dashboard = {
     editable = true;
     graphTooltip = 1;
@@ -772,227 +689,8 @@ let
   };
 in
 {
-  imports = [
-    (lib.serviceMountWithZpool "grafana" service_configs.zpool_ssds [
-      service_configs.grafana.dir
-    ])
-    (lib.serviceFilePerms "grafana" [
-      "Z ${service_configs.grafana.dir} 0700 grafana grafana"
-    ])
-    (lib.serviceMountWithZpool "prometheus" service_configs.zpool_ssds [
-      "/var/lib/prometheus"
-    ])
-    (lib.serviceFilePerms "prometheus" [
-      "Z /var/lib/prometheus 0700 prometheus prometheus"
-    ])
-  ];
-
-  # -- Prometheus --
-  services.prometheus = {
-    enable = true;
-    port = service_configs.ports.private.prometheus.port;
-    listenAddress = "127.0.0.1";
-    stateDir = "prometheus";
-    retentionTime = "90d";
-
-    exporters = {
-      node = {
-        enable = true;
-        port = service_configs.ports.private.prometheus_node.port;
-        listenAddress = "127.0.0.1";
-        enabledCollectors = [
-          "hwmon"
-          "systemd"
-          "textfile"
-        ];
-        extraFlags = [
-          "--collector.textfile.directory=${textfileDir}"
-        ];
-      };
-
-      apcupsd = {
-        enable = true;
-        port = service_configs.ports.private.prometheus_apcupsd.port;
-        listenAddress = "127.0.0.1";
-        apcupsdAddress = "127.0.0.1:3551";
-      };
-    };
-
-    scrapeConfigs = [
-      {
-        job_name = "prometheus";
-        static_configs = [
-          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus.port}" ]; }
-        ];
-      }
-      {
-        job_name = "node";
-        static_configs = [
-          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_node.port}" ]; }
-        ];
-      }
-      {
-        job_name = "apcupsd";
-        static_configs = [
-          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_apcupsd.port}" ]; }
-        ];
-      }
-    ];
-  };
-
-  # -- Grafana --
-  services.grafana = {
-    enable = true;
-    dataDir = service_configs.grafana.dir;
-
-    settings = {
-      server = {
-        http_addr = "127.0.0.1";
-        http_port = service_configs.ports.private.grafana.port;
-        domain = service_configs.grafana.domain;
-        root_url = "https://${service_configs.grafana.domain}";
-      };
-
-      "auth.anonymous" = {
-        enabled = true;
-        org_role = "Admin";
-      };
-      "auth.basic".enabled = false;
-      "auth".disable_login_form = true;
-
-      analytics.reporting_enabled = false;
-
-      feature_toggles.enable = "dataConnectionsConsole=false";
-
-      users.default_theme = "dark";
-
-      # Disable unused built-in integrations
-      alerting.enabled = false;
-      "unified_alerting".enabled = false;
-      explore.enabled = false;
-      news.news_feed_enabled = false;
-
-      plugins = {
-        enable_alpha = false;
-        plugin_admin_enabled = false;
-      };
-    };
-
-    provision = {
-      datasources.settings = {
-        apiVersion = 1;
-        datasources = [
-          {
-            name = "Prometheus";
-            type = "prometheus";
-            url = "http://127.0.0.1:${toString service_configs.ports.private.prometheus.port}";
-            access = "proxy";
-            isDefault = true;
-            editable = false;
-            uid = "prometheus";
-          }
-        ];
-      };
-
-      dashboards.settings.providers = [
-        {
-          name = "system";
-          type = "file";
-          options.path = "/etc/grafana-dashboards";
-          disableDeletion = true;
-          updateIntervalSeconds = 60;
-        }
-      ];
-    };
-  };
-
   environment.etc."grafana-dashboards/system-overview.json" = {
     text = builtins.toJSON dashboard;
     mode = "0444";
   };
-
-  services.caddy.virtualHosts."${service_configs.grafana.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.private.grafana.port}
-  '';
-
-  # -- Jellyfin active-stream prometheus textfile collector --
-  systemd.services.jellyfin-metrics-collector = {
-    description = "Collect Jellyfin metrics for Prometheus";
-    after = [ "network.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe jellyfinCollector;
-      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
-    };
-  };
-
-  systemd.timers.jellyfin-metrics-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/30";
-      RandomizedDelaySec = "5s";
-    };
-  };
-
-  # -- Intel GPU textfile collector --
-  systemd.services.intel-gpu-collector = {
-    description = "Collect Intel GPU metrics for Prometheus";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe intelGpuCollector;
-    };
-    environment.TEXTFILE = "${textfileDir}/intel-gpu.prom";
-  };
-
-  systemd.timers.intel-gpu-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/30";
-      RandomizedDelaySec = "10s";
-    };
-  };
-
-  # -- qBittorrent speed textfile collector --
-  systemd.services.qbittorrent-collector = {
-    description = "Collect qBittorrent transfer metrics for Prometheus";
-    after = [
-      "network.target"
-      "qbittorrent.service"
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe qbittorrentCollector;
-    };
-  };
-
-  systemd.timers.qbittorrent-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/15";
-      RandomizedDelaySec = "3s";
-    };
-  };
-
-  # -- Disk/pool usage textfile collector --
-  systemd.services.disk-usage-collector = {
-    description = "Collect ZFS pool and partition usage metrics for Prometheus";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe diskUsageCollector;
-    };
-    environment.TEXTFILE = "${textfileDir}/disk-usage.prom";
-  };
-
-  systemd.timers.disk-usage-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "minutely";
-      RandomizedDelaySec = "10s";
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${textfileDir} 0755 root root -"
-  ];
 }
diff --git a/services/grafana/default.nix b/services/grafana/default.nix
new file mode 100644
index 0000000..fccd7e6
--- /dev/null
+++ b/services/grafana/default.nix
@@ -0,0 +1,14 @@
+{
+  imports = [
+    ./grafana.nix
+    ./prometheus.nix
+    ./dashboard.nix
+    ./jellyfin-collector.nix
+    ./jellyfin-annotations.nix
+    ./qbittorrent-collector.nix
+    ./intel-gpu-collector.nix
+    ./disk-usage-collector.nix
+    ./llama-cpp-annotations.nix
+    ./zfs-scrub-annotations.nix
+  ];
+}
diff --git a/services/grafana/disk-usage-collector.nix b/services/grafana/disk-usage-collector.nix
new file mode 100644
index 0000000..9170b36
--- /dev/null
+++ b/services/grafana/disk-usage-collector.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+
+  diskUsageCollector = pkgs.writeShellApplication {
+    name = "disk-usage-collector";
+    runtimeInputs = with pkgs; [
+      coreutils
+      gawk
+      config.boot.zfs.package
+      util-linux # for mountpoint
+    ];
+    text = builtins.readFile ./disk-usage-collector.sh;
+  };
+in
+lib.mkIf config.services.grafana.enable {
+  systemd.services.disk-usage-collector = {
+    description = "Collect ZFS pool and partition usage metrics for Prometheus";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe diskUsageCollector;
+    };
+    environment.TEXTFILE = "${textfileDir}/disk-usage.prom";
+  };
+
+  systemd.timers.disk-usage-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "minutely";
+      RandomizedDelaySec = "10s";
+    };
+  };
+}
diff --git a/services/disk-usage-collector.sh b/services/grafana/disk-usage-collector.sh
similarity index 100%
rename from services/disk-usage-collector.sh
rename to services/grafana/disk-usage-collector.sh
diff --git a/services/grafana/grafana.nix b/services/grafana/grafana.nix
new file mode 100644
index 0000000..6d10923
--- /dev/null
+++ b/services/grafana/grafana.nix
@@ -0,0 +1,86 @@
+{
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "grafana" service_configs.zpool_ssds [
+      service_configs.grafana.dir
+    ])
+    (lib.serviceFilePerms "grafana" [
+      "Z ${service_configs.grafana.dir} 0700 grafana grafana"
+    ])
+  ];
+
+  services.grafana = {
+    enable = true;
+    dataDir = service_configs.grafana.dir;
+
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = service_configs.ports.private.grafana.port;
+        domain = service_configs.grafana.domain;
+        root_url = "https://${service_configs.grafana.domain}";
+      };
+
+      "auth.anonymous" = {
+        enabled = true;
+        org_role = "Admin";
+      };
+      "auth.basic".enabled = false;
+      "auth".disable_login_form = true;
+
+      analytics.reporting_enabled = false;
+
+      feature_toggles.enable = "dataConnectionsConsole=false";
+
+      users.default_theme = "dark";
+
+      # Disable unused built-in integrations
+      alerting.enabled = false;
+      "unified_alerting".enabled = false;
+      explore.enabled = false;
+      news.news_feed_enabled = false;
+
+      plugins = {
+        enable_alpha = false;
+        plugin_admin_enabled = false;
+      };
+    };
+
+    provision = {
+      datasources.settings = {
+        apiVersion = 1;
+        datasources = [
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://127.0.0.1:${toString service_configs.ports.private.prometheus.port}";
+            access = "proxy";
+            isDefault = true;
+            editable = false;
+            uid = "prometheus";
+          }
+        ];
+      };
+
+      dashboards.settings.providers = [
+        {
+          name = "system";
+          type = "file";
+          options.path = "/etc/grafana-dashboards";
+          disableDeletion = true;
+          updateIntervalSeconds = 60;
+        }
+      ];
+    };
+  };
+
+  services.caddy.virtualHosts."${service_configs.grafana.domain}".extraConfig = ''
+    import ${config.age.secrets.caddy_auth.path}
+    reverse_proxy :${toString service_configs.ports.private.grafana.port}
+  '';
+}
diff --git a/services/grafana/intel-gpu-collector.nix b/services/grafana/intel-gpu-collector.nix
new file mode 100644
index 0000000..25612d4
--- /dev/null
+++ b/services/grafana/intel-gpu-collector.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+
+  intelGpuCollector = pkgs.writeShellApplication {
+    name = "intel-gpu-collector";
+    runtimeInputs = with pkgs; [
+      python3
+      intel-gpu-tools
+    ];
+    text = ''
+      exec python3 ${./intel-gpu-collector.py}
+    '';
+  };
+in
+lib.mkIf config.services.grafana.enable {
+  systemd.services.intel-gpu-collector = {
+    description = "Collect Intel GPU metrics for Prometheus";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe intelGpuCollector;
+    };
+    environment.TEXTFILE = "${textfileDir}/intel-gpu.prom";
+  };
+
+  systemd.timers.intel-gpu-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/30";
+      RandomizedDelaySec = "10s";
+    };
+  };
+}
diff --git a/services/intel-gpu-collector.py b/services/grafana/intel-gpu-collector.py
similarity index 100%
rename from services/intel-gpu-collector.py
rename to services/grafana/intel-gpu-collector.py
diff --git a/services/jellyfin-annotations.nix b/services/grafana/jellyfin-annotations.nix
similarity index 93%
rename from services/jellyfin-annotations.nix
rename to services/grafana/jellyfin-annotations.nix
index 93abea2..0122b48 100644
--- a/services/jellyfin-annotations.nix
+++ b/services/grafana/jellyfin-annotations.nix
@@ -5,7 +5,7 @@
   lib,
   ...
 }:
-{
+lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable) {
   systemd.services.jellyfin-annotations = {
     description = "Jellyfin stream annotation service for Grafana";
     after = [
diff --git a/services/jellyfin-annotations.py b/services/grafana/jellyfin-annotations.py
similarity index 100%
rename from services/jellyfin-annotations.py
rename to services/grafana/jellyfin-annotations.py
diff --git a/services/grafana/jellyfin-collector.nix b/services/grafana/jellyfin-collector.nix
new file mode 100644
index 0000000..fe05371
--- /dev/null
+++ b/services/grafana/jellyfin-collector.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+
+  jellyfinCollector = pkgs.writeShellApplication {
+    name = "jellyfin-metrics-collector";
+    runtimeInputs = with pkgs; [
+      curl
+      jq
+    ];
+    text = ''
+      API_KEY=$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")
+      JELLYFIN="http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}"
+
+      if response=$(curl -sf --max-time 5 "''${JELLYFIN}/Sessions?api_key=''${API_KEY}"); then
+        active_streams=$(echo "$response" | jq '[.[] | select(.NowPlayingItem != null)] | length')
+      else
+        active_streams=0
+      fi
+
+      {
+        echo '# HELP jellyfin_active_streams Number of currently active Jellyfin streams'
+        echo '# TYPE jellyfin_active_streams gauge'
+        echo "jellyfin_active_streams $active_streams"
+      } > "${textfileDir}/jellyfin.prom.$$.tmp"
+      mv "${textfileDir}/jellyfin.prom.$$.tmp" "${textfileDir}/jellyfin.prom"
+    '';
+  };
+in
+lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable) {
+  systemd.services.jellyfin-metrics-collector = {
+    description = "Collect Jellyfin metrics for Prometheus";
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe jellyfinCollector;
+      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+    };
+  };
+
+  systemd.timers.jellyfin-metrics-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/30";
+      RandomizedDelaySec = "5s";
+    };
+  };
+}
diff --git a/services/llama-cpp-annotations.nix b/services/grafana/llama-cpp-annotations.nix
similarity index 90%
rename from services/llama-cpp-annotations.nix
rename to services/grafana/llama-cpp-annotations.nix
index 163dfe4..3e60fe7 100644
--- a/services/llama-cpp-annotations.nix
+++ b/services/grafana/llama-cpp-annotations.nix
@@ -1,9 +1,11 @@
 {
+  config,
   pkgs,
   service_configs,
+  lib,
   ...
 }:
-{
+lib.mkIf (config.services.grafana.enable && config.services.llama-cpp.enable) {
   systemd.services.llama-cpp-annotations = {
     description = "LLM request annotation service for Grafana";
     after = [
diff --git a/services/llama-cpp-annotations.py b/services/grafana/llama-cpp-annotations.py
similarity index 100%
rename from services/llama-cpp-annotations.py
rename to services/grafana/llama-cpp-annotations.py
diff --git a/services/grafana/prometheus.nix b/services/grafana/prometheus.nix
new file mode 100644
index 0000000..e9835d5
--- /dev/null
+++ b/services/grafana/prometheus.nix
@@ -0,0 +1,74 @@
+{
+  service_configs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+in
+{
+  imports = [
+    (lib.serviceMountWithZpool "prometheus" service_configs.zpool_ssds [
+      "/var/lib/prometheus"
+    ])
+    (lib.serviceFilePerms "prometheus" [
+      "Z /var/lib/prometheus 0700 prometheus prometheus"
+    ])
+  ];
+
+  services.prometheus = {
+    enable = true;
+    port = service_configs.ports.private.prometheus.port;
+    listenAddress = "127.0.0.1";
+    stateDir = "prometheus";
+    retentionTime = "90d";
+
+    exporters = {
+      node = {
+        enable = true;
+        port = service_configs.ports.private.prometheus_node.port;
+        listenAddress = "127.0.0.1";
+        enabledCollectors = [
+          "hwmon"
+          "systemd"
+          "textfile"
+        ];
+        extraFlags = [
+          "--collector.textfile.directory=${textfileDir}"
+        ];
+      };
+
+      apcupsd = {
+        enable = true;
+        port = service_configs.ports.private.prometheus_apcupsd.port;
+        listenAddress = "127.0.0.1";
+        apcupsdAddress = "127.0.0.1:3551";
+      };
+    };
+
+    scrapeConfigs = [
+      {
+        job_name = "prometheus";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus.port}" ]; }
+        ];
+      }
+      {
+        job_name = "node";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_node.port}" ]; }
+        ];
+      }
+      {
+        job_name = "apcupsd";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_apcupsd.port}" ]; }
+        ];
+      }
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${textfileDir} 0755 root root -"
+  ];
+}
diff --git a/services/grafana/qbittorrent-collector.nix b/services/grafana/qbittorrent-collector.nix
new file mode 100644
index 0000000..25112af
--- /dev/null
+++ b/services/grafana/qbittorrent-collector.nix
@@ -0,0 +1,60 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
+
+  qbittorrentCollector = pkgs.writeShellApplication {
+    name = "qbittorrent-collector";
+    runtimeInputs = with pkgs; [
+      curl
+      jq
+    ];
+    text = ''
+      QBIT="http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}"
+      OUT="${textfileDir}/qbittorrent.prom"
+
+      if info=$(curl -sf --max-time 5 "''${QBIT}/api/v2/transfer/info"); then
+        dl=$(echo "$info" | jq '.dl_info_speed')
+        ul=$(echo "$info" | jq '.up_info_speed')
+      else
+        dl=0
+        ul=0
+      fi
+
+      {
+        echo '# HELP qbittorrent_download_bytes_per_second Current download speed in bytes/s'
+        echo '# TYPE qbittorrent_download_bytes_per_second gauge'
+        echo "qbittorrent_download_bytes_per_second $dl"
+        echo '# HELP qbittorrent_upload_bytes_per_second Current upload speed in bytes/s'
+        echo '# TYPE qbittorrent_upload_bytes_per_second gauge'
+        echo "qbittorrent_upload_bytes_per_second $ul"
+      } > "''${OUT}.tmp"
+      mv "''${OUT}.tmp" "$OUT"
+    '';
+  };
+in
+lib.mkIf (config.services.grafana.enable && config.services.qbittorrent.enable) {
+  systemd.services.qbittorrent-collector = {
+    description = "Collect qBittorrent transfer metrics for Prometheus";
+    after = [
+      "network.target"
+      "qbittorrent.service"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = lib.getExe qbittorrentCollector;
+    };
+  };
+
+  systemd.timers.qbittorrent-collector = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:*:0/15";
+      RandomizedDelaySec = "3s";
+    };
+  };
+}
diff --git a/services/zfs-scrub-annotations.nix b/services/grafana/zfs-scrub-annotations.nix
similarity index 90%
rename from services/zfs-scrub-annotations.nix
rename to services/grafana/zfs-scrub-annotations.nix
index e502178..2149c5c 100644
--- a/services/zfs-scrub-annotations.nix
+++ b/services/grafana/zfs-scrub-annotations.nix
@@ -21,7 +21,7 @@ let
     text = builtins.readFile ./zfs-scrub-annotations.sh;
   };
 in
-{
+lib.mkIf (config.services.grafana.enable && config.services.zfs.autoScrub.enable) {
   systemd.services.zfs-scrub = {
     environment = {
       GRAFANA_URL = grafanaUrl;
diff --git a/services/zfs-scrub-annotations.sh b/services/grafana/zfs-scrub-annotations.sh
similarity index 100%
rename from services/zfs-scrub-annotations.sh
rename to services/grafana/zfs-scrub-annotations.sh
diff --git a/tests/jellyfin-annotations.nix b/tests/jellyfin-annotations.nix
index 3c5a4b9..d6c4cea 100644
--- a/tests/jellyfin-annotations.nix
+++ b/tests/jellyfin-annotations.nix
@@ -6,7 +6,7 @@
 let
   jfLib = import ./jellyfin-test-lib.nix { inherit pkgs lib; };
   mockGrafana = ./mock-grafana-server.py;
-  script = ../services/jellyfin-annotations.py;
+  script = ../services/grafana/jellyfin-annotations.py;
   python = pkgs.python3;
 in
 pkgs.testers.runNixOSTest {
diff --git a/tests/llama-cpp-annotations.nix b/tests/llama-cpp-annotations.nix
index 649de47..4dbc077 100644
--- a/tests/llama-cpp-annotations.nix
+++ b/tests/llama-cpp-annotations.nix
@@ -4,7 +4,7 @@
 }:
 let
   mockGrafana = ./mock-grafana-server.py;
-  script = ../services/llama-cpp-annotations.py;
+  script = ../services/grafana/llama-cpp-annotations.py;
   python = pkgs.python3;
 
   mockLlamaProcess = ./mock-llama-server-proc.py;
diff --git a/tests/zfs-scrub-annotations.nix b/tests/zfs-scrub-annotations.nix
index 4bed3a7..437e5a3 100644
--- a/tests/zfs-scrub-annotations.nix
+++ b/tests/zfs-scrub-annotations.nix
@@ -23,7 +23,7 @@ let
     esac
   '';
 
-  script = ../services/zfs-scrub-annotations.sh;
+  script = ../services/grafana/zfs-scrub-annotations.sh;
   python = pkgs.python3;
 in
 pkgs.testers.runNixOSTest {

From 124d33963e5edcab966d146d18f97a8ca7b6eea4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 00:47:12 -0400
Subject: [PATCH 755/847] organize

---
 configuration.nix                                 | 15 ++++-----------
 services/{ => caddy}/caddy.nix                    |  0
 services/{ => caddy}/caddy_senior_project.nix     |  0
 services/caddy/default.nix                        |  7 +++++++
 services/jellyfin/default.nix                     |  6 ++++++
 .../jellyfin-qbittorrent-monitor.nix              |  3 ++-
 .../jellyfin-qbittorrent-monitor.py               |  0
 services/{ => jellyfin}/jellyfin.nix              |  0
 services/llama-cpp/default.nix                    |  6 ++++++
 .../{ => llama-cpp}/llama-cpp-xmrig-pause.nix     |  4 +++-
 services/{ => llama-cpp}/llama-cpp-xmrig-pause.py |  0
 services/{ => llama-cpp}/llama-cpp.nix            |  0
 services/ntfy/default.nix                         |  6 ++++++
 services/{ => ntfy}/ntfy-alerts.nix               |  7 ++++++-
 services/{ => ntfy}/ntfy.nix                      |  0
 tests/fail2ban-jellyfin.nix                       |  2 +-
 tests/jellyfin-qbittorrent-monitor.nix            |  2 +-
 tests/llama-cpp-xmrig-pause.nix                   |  2 +-
 18 files changed, 43 insertions(+), 17 deletions(-)
 rename services/{ => caddy}/caddy.nix (100%)
 rename services/{ => caddy}/caddy_senior_project.nix (100%)
 create mode 100644 services/caddy/default.nix
 create mode 100644 services/jellyfin/default.nix
 rename services/{ => jellyfin}/jellyfin-qbittorrent-monitor.nix (97%)
 rename services/{ => jellyfin}/jellyfin-qbittorrent-monitor.py (100%)
 rename services/{ => jellyfin}/jellyfin.nix (100%)
 create mode 100644 services/llama-cpp/default.nix
 rename services/{ => llama-cpp}/llama-cpp-xmrig-pause.nix (93%)
 rename services/{ => llama-cpp}/llama-cpp-xmrig-pause.py (100%)
 rename services/{ => llama-cpp}/llama-cpp.nix (100%)
 create mode 100644 services/ntfy/default.nix
 rename services/{ => ntfy}/ntfy-alerts.nix (72%)
 rename services/{ => ntfy}/ntfy.nix (100%)

diff --git a/configuration.nix b/configuration.nix
index a40e2c3..b14678c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -23,8 +23,8 @@
     ./modules/power.nix
 
     ./services/postgresql.nix
-    ./services/jellyfin.nix
-    ./services/caddy.nix
+    ./services/jellyfin
+    ./services/caddy
     ./services/immich.nix
     ./services/gitea.nix
     ./services/gitea-actions-runner.nix
@@ -32,7 +32,6 @@
 
     ./services/wg.nix
     ./services/qbittorrent.nix
-    ./services/jellyfin-qbittorrent-monitor.nix
     ./services/bitmagnet.nix
 
     ./services/arr/prowlarr.nix
@@ -47,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    ./services/llama-cpp
     ./services/trilium.nix
 
     ./services/ups.nix
@@ -65,19 +64,13 @@
     ./services/p2pool.nix
     ./services/xmrig.nix
 
-    ./services/llama-cpp-xmrig-pause.nix
-
-    # KEEP UNTIL 2028
-    ./services/caddy_senior_project.nix
-
     ./services/graphing-calculator.nix
 
     ./services/ssh.nix
 
     ./services/syncthing.nix
 
-    ./services/ntfy.nix
-    ./services/ntfy-alerts.nix
+    ./services/ntfy
 
     ./services/mollysocket.nix
   ];
diff --git a/services/caddy.nix b/services/caddy/caddy.nix
similarity index 100%
rename from services/caddy.nix
rename to services/caddy/caddy.nix
diff --git a/services/caddy_senior_project.nix b/services/caddy/caddy_senior_project.nix
similarity index 100%
rename from services/caddy_senior_project.nix
rename to services/caddy/caddy_senior_project.nix
diff --git a/services/caddy/default.nix b/services/caddy/default.nix
new file mode 100644
index 0000000..d22611d
--- /dev/null
+++ b/services/caddy/default.nix
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./caddy.nix
+    # KEEP UNTIL 2028
+    ./caddy_senior_project.nix
+  ];
+}
diff --git a/services/jellyfin/default.nix b/services/jellyfin/default.nix
new file mode 100644
index 0000000..a396984
--- /dev/null
+++ b/services/jellyfin/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./jellyfin.nix
+    ./jellyfin-qbittorrent-monitor.nix
+  ];
+}
diff --git a/services/jellyfin-qbittorrent-monitor.nix b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
similarity index 97%
rename from services/jellyfin-qbittorrent-monitor.nix
rename to services/jellyfin/jellyfin-qbittorrent-monitor.nix
index 9d73adc..4bf57d7 100644
--- a/services/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
@@ -2,9 +2,10 @@
   pkgs,
   service_configs,
   config,
+  lib,
   ...
 }:
-{
+lib.mkIf config.services.jellyfin.enable {
   systemd.services."jellyfin-qbittorrent-monitor" = {
     description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
     after = [
diff --git a/services/jellyfin-qbittorrent-monitor.py b/services/jellyfin/jellyfin-qbittorrent-monitor.py
similarity index 100%
rename from services/jellyfin-qbittorrent-monitor.py
rename to services/jellyfin/jellyfin-qbittorrent-monitor.py
diff --git a/services/jellyfin.nix b/services/jellyfin/jellyfin.nix
similarity index 100%
rename from services/jellyfin.nix
rename to services/jellyfin/jellyfin.nix
diff --git a/services/llama-cpp/default.nix b/services/llama-cpp/default.nix
new file mode 100644
index 0000000..cce8a0a
--- /dev/null
+++ b/services/llama-cpp/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./llama-cpp.nix
+    ./llama-cpp-xmrig-pause.nix
+  ];
+}
diff --git a/services/llama-cpp-xmrig-pause.nix b/services/llama-cpp/llama-cpp-xmrig-pause.nix
similarity index 93%
rename from services/llama-cpp-xmrig-pause.nix
rename to services/llama-cpp/llama-cpp-xmrig-pause.nix
index f797de9..c694bad 100644
--- a/services/llama-cpp-xmrig-pause.nix
+++ b/services/llama-cpp/llama-cpp-xmrig-pause.nix
@@ -1,8 +1,10 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
-{
+lib.mkIf config.services.llama-cpp.enable {
   systemd.services.llama-cpp-xmrig-pause = {
     description = "Pause xmrig while llama-cpp is processing requests";
     after = [
diff --git a/services/llama-cpp-xmrig-pause.py b/services/llama-cpp/llama-cpp-xmrig-pause.py
similarity index 100%
rename from services/llama-cpp-xmrig-pause.py
rename to services/llama-cpp/llama-cpp-xmrig-pause.py
diff --git a/services/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
similarity index 100%
rename from services/llama-cpp.nix
rename to services/llama-cpp/llama-cpp.nix
diff --git a/services/ntfy/default.nix b/services/ntfy/default.nix
new file mode 100644
index 0000000..7757bd4
--- /dev/null
+++ b/services/ntfy/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./ntfy.nix
+    ./ntfy-alerts.nix
+  ];
+}
diff --git a/services/ntfy-alerts.nix b/services/ntfy/ntfy-alerts.nix
similarity index 72%
rename from services/ntfy-alerts.nix
rename to services/ntfy/ntfy-alerts.nix
index 089b270..e1dbb63 100644
--- a/services/ntfy-alerts.nix
+++ b/services/ntfy/ntfy-alerts.nix
@@ -1,5 +1,10 @@
-{ config, service_configs, ... }:
 {
+  config,
+  lib,
+  service_configs,
+  ...
+}:
+lib.mkIf config.services.ntfy-sh.enable {
   services.ntfyAlerts = {
     enable = true;
     serverUrl = "https://${service_configs.ntfy.domain}";
diff --git a/services/ntfy.nix b/services/ntfy/ntfy.nix
similarity index 100%
rename from services/ntfy.nix
rename to services/ntfy/ntfy.nix
diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index 195c5f7..bd7971d 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -30,7 +30,7 @@ let
     { config, pkgs, ... }:
     {
       imports = [
-        (import ../services/jellyfin.nix {
+        (import ../services/jellyfin/jellyfin.nix {
           inherit config pkgs;
           lib = testLib;
           service_configs = testServiceConfigs;
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index aec5a98..dd6508e 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -137,7 +137,7 @@ pkgs.testers.runNixOSTest {
 
     with subtest("Start monitor service"):
         python = "${pkgs.python3.withPackages (ps: [ ps.requests ])}/bin/python"
-        monitor = "${../services/jellyfin-qbittorrent-monitor.py}"
+        monitor = "${../services/jellyfin/jellyfin-qbittorrent-monitor.py}"
         server.succeed(f"""
           systemd-run --unit=monitor-test \
             --setenv=JELLYFIN_URL=http://localhost:8096 \
diff --git a/tests/llama-cpp-xmrig-pause.nix b/tests/llama-cpp-xmrig-pause.nix
index 44eca77..78a272c 100644
--- a/tests/llama-cpp-xmrig-pause.nix
+++ b/tests/llama-cpp-xmrig-pause.nix
@@ -3,7 +3,7 @@
   ...
 }:
 let
-  script = ../services/llama-cpp-xmrig-pause.py;
+  script = ../services/llama-cpp/llama-cpp-xmrig-pause.py;
   python = pkgs.python3;
 
   # SmolLM-135M Q2_K: 85MB, modern GGUFv3, generates ~30 tok/s on one CPU

From e765a9848720425934deeb292b2165d8e6ed236c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 13:45:26 -0400
Subject: [PATCH 756/847] recyclarr: reset back to default basically

---
 services/arr/recyclarr.nix | 142 +++++++------------------------------
 1 file changed, 26 insertions(+), 116 deletions(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index aba8644..2e96bcc 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -52,19 +52,10 @@ in
           { template = "radarr-custom-formats-remux-web-2160p"; }
         ];
 
+        # Extend the template's quality profile with lower-resolution fallbacks
         quality_profiles = [
           {
             name = "Remux + WEB 2160p";
-            min_format_score = 0;
-            reset_unmatched_scores = {
-              enabled = true;
-            };
-            upgrade = {
-              allowed = true;
-              until_quality = "Remux-2160p";
-              until_score = 10000;
-            };
-            quality_sort = "top";
             qualities = [
               { name = "Remux-2160p"; }
               {
@@ -84,61 +75,25 @@ in
                 ];
               }
               { name = "HDTV-1080p"; }
+              { name = "Bluray-720p"; }
+              {
+                name = "WEB 720p";
+                qualities = [
+                  "WEBDL-720p"
+                  "WEBRip-720p"
+                ];
+              }
+              { name = "HDTV-720p"; }
             ];
           }
         ];
 
         custom_formats = [
-          # Upscaled
+          # DV (w/o HDR fallback) - block releases with DV that lack HDR10 fallback
           {
-            trash_ids = [ "bfd8eb01832d646a0a89c4deb46f8564" ];
+            trash_ids = [ "923b6abef9b17f937fab56cfcf89e1f1" ];
             assign_scores_to = [
-              {
-                name = "Remux + WEB 2160p";
-                score = -10000;
-              }
-            ];
-          }
-          # x265 (HD) - override template -10000 penalty for non-2160p HEVC
-          {
-            trash_ids = [ "dc98083864ea246d05a42df0d05f81cc" ];
-            assign_scores_to = [
-              {
-                name = "Remux + WEB 2160p";
-                score = 0;
-              }
-            ];
-          }
-          # x265 (no HDR/DV) - override template -10000 penalty for non-2160p HEVC
-          {
-            trash_ids = [ "839bea857ed2c0a8e084f3cbdbd65ecb" ];
-            assign_scores_to = [
-              {
-                name = "Remux + WEB 2160p";
-                score = 0;
-              }
-            ];
-          }
-          # Codec ranking: AV1 (20) > HEVC (10) > AVC (0)
-          #
-          # Positive scores only -- nothing drops below min_format_score.
-          # AVC stays at 0 implicitly (no custom format adds or removes score).
-          {
-            trash_ids = [ "cae4ca30163749b891686f95532519bd" ]; # AV1
-            assign_scores_to = [
-              {
-                name = "Remux + WEB 2160p";
-                score = 20;
-              }
-            ];
-          }
-          {
-            trash_ids = [ "9170d55c319f4fe40da8711ba9d8050d" ]; # x265
-            assign_scores_to = [
-              {
-                name = "Remux + WEB 2160p";
-                score = 10;
-              }
+              { name = "Remux + WEB 2160p"; }
             ];
           }
         ];
@@ -153,19 +108,10 @@ in
           { template = "sonarr-v4-custom-formats-web-2160p"; }
         ];
 
+        # Extend the template's quality profile with lower-resolution fallbacks
         quality_profiles = [
           {
             name = "WEB-2160p";
-            min_format_score = 0;
-            reset_unmatched_scores = {
-              enabled = true;
-            };
-            upgrade = {
-              allowed = true;
-              until_quality = "WEB 2160p";
-              until_score = 10000;
-            };
-            quality_sort = "top";
             qualities = [
               {
                 name = "WEB 2160p";
@@ -184,61 +130,25 @@ in
                 ];
               }
               { name = "HDTV-1080p"; }
+              { name = "Bluray-720p"; }
+              {
+                name = "WEB 720p";
+                qualities = [
+                  "WEBDL-720p"
+                  "WEBRip-720p"
+                ];
+              }
+              { name = "HDTV-720p"; }
             ];
           }
         ];
 
         custom_formats = [
-          # Upscaled
+          # DV (w/o HDR fallback) - block releases with DV that lack HDR10 fallback
           {
-            trash_ids = [ "23297a736ca77c0fc8e70f8edd7ee56c" ];
+            trash_ids = [ "9b27ab6498ec0f31a3353992e19434ca" ];
             assign_scores_to = [
-              {
-                name = "WEB-2160p";
-                score = -10000;
-              }
-            ];
-          }
-          # x265 (HD) - override template -10000 penalty for non-2160p HEVC
-          {
-            trash_ids = [ "47435ece6b99a0b477caf360e79ba0bb" ];
-            assign_scores_to = [
-              {
-                name = "WEB-2160p";
-                score = 0;
-              }
-            ];
-          }
-          # x265 (no HDR/DV) - override template -10000 penalty for non-2160p HEVC
-          {
-            trash_ids = [ "9b64dff695c2115facf1b6ea59c9bd07" ];
-            assign_scores_to = [
-              {
-                name = "WEB-2160p";
-                score = 0;
-              }
-            ];
-          }
-          # Codec ranking: AV1 (20) > HEVC (10) > AVC (0)
-          #
-          # Positive scores only -- nothing drops below min_format_score.
-          # AVC stays at 0 implicitly (no custom format adds or removes score).
-          {
-            trash_ids = [ "15a05bc7c1a36e2b57fd628f8977e2fc" ]; # AV1
-            assign_scores_to = [
-              {
-                name = "WEB-2160p";
-                score = 20;
-              }
-            ];
-          }
-          {
-            trash_ids = [ "c9eafd50846d299b862ca9bb6ea91950" ]; # x265
-            assign_scores_to = [
-              {
-                name = "WEB-2160p";
-                score = 10;
-              }
+              { name = "WEB-2160p"; }
             ];
           }
         ];

From d4d01d63f15e96a4fe15f637e91e6c6d4b57a8ab Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 14:06:35 -0400
Subject: [PATCH 757/847] llama-cpp: update + re-enable + gemma 4 E4B

---
 flake.lock                       | 6 +++---
 services/llama-cpp/llama-cpp.nix | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5e712a4..81bc859 100644
--- a/flake.lock
+++ b/flake.lock
@@ -302,11 +302,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775161985,
-        "narHash": "sha256-CahR+F3hF7C5IYWooVblvlzHf2eDST0Eagu59xdY37g=",
+        "lastModified": 1775236905,
+        "narHash": "sha256-tHshzR/k6D/r5UhJCfJ9b/mJgsbn7ODtnZrDlimhOOI=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "63b832bc0799ba7270e695e0987d0bd2272bdc7e",
+        "rev": "bc05a6803e48f17e0f2c7a99fce9b50d03882de7",
         "type": "github"
       },
       "original": {
diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 23dee04..7cd002b 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -8,11 +8,11 @@
 }:
 {
   services.llama-cpp = {
-    enable = false;
+    enable = true;
     model = toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/unsloth/Qwen3.5-9B-GGUF/resolve/main/Qwen3.5-9B-Q4_K_M.gguf";
-        sha256 = "03b74727a860a56338e042c4420bb3f04b2fec5734175f4cb9fa853daf52b7e8";
+        url = "https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/gemma-4-E4B-it-Q4_K_M.gguf";
+        sha256 = "ced37f54b80068fe65e95c6dd79ac88cddc227e179fd1040b8f751b1e5bdf849";
       }
     );
     port = service_configs.ports.private.llama_cpp.port;

From daf82c16bacb8805eed3c0f8f53e58e4cddc9fc0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 14:39:20 -0400
Subject: [PATCH 758/847] fix xmrig pause

---
 configuration.nix                             |   1 +
 services/llama-cpp/default.nix                |   1 -
 services/llama-cpp/llama-cpp-xmrig-pause.py   | 123 -------------
 ...p-xmrig-pause.nix => xmrig-auto-pause.nix} |  18 +-
 services/xmrig-auto-pause.py                  | 131 ++++++++++++++
 tests/llama-cpp-xmrig-pause.nix               | 162 ------------------
 tests/tests.nix                               |   4 +-
 tests/xmrig-auto-pause.nix                    | 121 +++++++++++++
 8 files changed, 263 insertions(+), 298 deletions(-)
 delete mode 100644 services/llama-cpp/llama-cpp-xmrig-pause.py
 rename services/{llama-cpp/llama-cpp-xmrig-pause.nix => xmrig-auto-pause.nix} (52%)
 create mode 100644 services/xmrig-auto-pause.py
 delete mode 100644 tests/llama-cpp-xmrig-pause.nix
 create mode 100644 tests/xmrig-auto-pause.nix

diff --git a/configuration.nix b/configuration.nix
index b14678c..c2b99c3 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -63,6 +63,7 @@
     ./services/monero.nix
     ./services/p2pool.nix
     ./services/xmrig.nix
+    ./services/xmrig-auto-pause.nix
 
     ./services/graphing-calculator.nix
 
diff --git a/services/llama-cpp/default.nix b/services/llama-cpp/default.nix
index cce8a0a..0cd110d 100644
--- a/services/llama-cpp/default.nix
+++ b/services/llama-cpp/default.nix
@@ -1,6 +1,5 @@
 {
   imports = [
     ./llama-cpp.nix
-    ./llama-cpp-xmrig-pause.nix
   ];
 }
diff --git a/services/llama-cpp/llama-cpp-xmrig-pause.py b/services/llama-cpp/llama-cpp-xmrig-pause.py
deleted file mode 100644
index 9426be2..0000000
--- a/services/llama-cpp/llama-cpp-xmrig-pause.py
+++ /dev/null
@@ -1,123 +0,0 @@
-#!/usr/bin/env python3
-"""
-Pause xmrig while llama-cpp is processing inference requests.
-
-Checks if the llama-server process is actively using CPU by reading
-/proc/<pid>/stat. When CPU usage exceeds the threshold, stops xmrig.
-When CPU drops below threshold for GRACE_PERIOD seconds, restarts xmrig.
-"""
-
-import glob
-import os
-import subprocess
-import sys
-import time
-
-POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "3"))
-GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "10"))
-# CPU percentage (per-core) above which llama-server is considered busy.
-# Idle llama-server uses ~0% CPU; active inference saturates multiple cores.
-CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "50"))
-
-
-def log(msg):
-    print(f"[llama-cpp-xmrig-pause] {msg}", file=sys.stderr, flush=True)
-
-
-def find_llama_pid():
-    """Find the PID of the llama-server process."""
-    for path in glob.glob("/proc/[0-9]*/comm"):
-        try:
-            with open(path) as f:
-                if f.read().strip() == "llama-server":
-                    return int(path.split("/")[2])
-        except (OSError, ValueError):
-            continue
-    return None
-
-
-def get_cpu_times(pid):
-    """Read utime + stime from /proc/<pid>/stat. Returns total ticks or None."""
-    try:
-        with open(f"/proc/{pid}/stat") as f:
-            fields = f.read().split(")")[-1].split()
-            # fields[11] = utime, fields[12] = stime (0-indexed after ')')
-            return int(fields[11]) + int(fields[12])
-    except (OSError, IndexError, ValueError):
-        return None
-
-
-def systemctl(action, unit):
-    result = subprocess.run(
-        ["systemctl", action, unit],
-        capture_output=True,
-        text=True,
-    )
-    if result.returncode != 0:
-        log(f"systemctl {action} {unit} failed (rc={result.returncode}): {result.stderr.strip()}")
-    return result.returncode == 0
-
-
-def main():
-    xmrig_paused = False
-    idle_since = None
-    prev_ticks = None
-    prev_time = None
-    hz = os.sysconf("SC_CLK_TCK")
-
-    log(f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s threshold={CPU_THRESHOLD}%")
-
-    while True:
-        pid = find_llama_pid()
-        if pid is None:
-            # llama-server not running
-            idle_since = None
-            prev_ticks = None
-            prev_time = None
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        ticks = get_cpu_times(pid)
-        now = time.monotonic()
-
-        if ticks is None or prev_ticks is None or prev_time is None:
-            prev_ticks = ticks
-            prev_time = now
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        dt = now - prev_time
-        if dt <= 0:
-            prev_ticks = ticks
-            prev_time = now
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        # CPU% = (delta_ticks / hz) / delta_seconds * 100
-        cpu_pct = ((ticks - prev_ticks) / hz) / dt * 100
-        prev_ticks = ticks
-        prev_time = now
-
-        busy = cpu_pct > CPU_THRESHOLD
-
-        if busy:
-            idle_since = None
-            if not xmrig_paused:
-                log(f"llama-server busy ({cpu_pct:.0f}% CPU) — stopping xmrig")
-                if systemctl("stop", "xmrig"):
-                    xmrig_paused = True
-        else:
-            if xmrig_paused:
-                if idle_since is None:
-                    idle_since = now
-                elif now - idle_since >= GRACE_PERIOD:
-                    log(f"llama-server idle ({cpu_pct:.0f}% CPU) past grace period — starting xmrig")
-                    if systemctl("start", "xmrig"):
-                        xmrig_paused = False
-                    idle_since = None
-
-        time.sleep(POLL_INTERVAL)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/services/llama-cpp/llama-cpp-xmrig-pause.nix b/services/xmrig-auto-pause.nix
similarity index 52%
rename from services/llama-cpp/llama-cpp-xmrig-pause.nix
rename to services/xmrig-auto-pause.nix
index c694bad..12dc475 100644
--- a/services/llama-cpp/llama-cpp-xmrig-pause.nix
+++ b/services/xmrig-auto-pause.nix
@@ -4,19 +4,15 @@
   pkgs,
   ...
 }:
-lib.mkIf config.services.llama-cpp.enable {
-  systemd.services.llama-cpp-xmrig-pause = {
-    description = "Pause xmrig while llama-cpp is processing requests";
-    after = [
-      "llama-cpp.service"
-      "xmrig.service"
-    ];
+lib.mkIf config.services.xmrig.enable {
+  systemd.services.xmrig-auto-pause = {
+    description = "Auto-pause xmrig when other services need CPU";
+    after = [ "xmrig.service" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      ExecStart = "${pkgs.python3}/bin/python3 ${./llama-cpp-xmrig-pause.py}";
+      ExecStart = "${pkgs.python3}/bin/python3 ${./xmrig-auto-pause.py}";
       Restart = "always";
       RestartSec = "10s";
-      # Needs /proc access (default) and AF_UNIX for systemctl
       NoNewPrivileges = true;
       ProtectHome = true;
       ProtectSystem = "strict";
@@ -28,8 +24,8 @@ lib.mkIf config.services.llama-cpp.enable {
     };
     environment = {
       POLL_INTERVAL = "3";
-      GRACE_PERIOD = "10";
-      CPU_THRESHOLD = "50";
+      GRACE_PERIOD = "15";
+      CPU_THRESHOLD = "5";
     };
   };
 }
diff --git a/services/xmrig-auto-pause.py b/services/xmrig-auto-pause.py
new file mode 100644
index 0000000..2aafd7e
--- /dev/null
+++ b/services/xmrig-auto-pause.py
@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""
+Auto-pause xmrig when other services need CPU.
+
+Monitors non-nice CPU usage from /proc/stat. Since xmrig runs at Nice=19,
+its CPU time lands in the 'nice' column and is excluded from the metric.
+When real workload (user + system + irq + softirq) exceeds the threshold,
+stops xmrig. When it drops below threshold for GRACE_PERIOD seconds,
+restarts xmrig.
+
+This replaces per-service pause scripts with a single general-purpose
+monitor that handles any CPU-intensive workload (gitea workers, llama-cpp
+inference, etc.) without needing to know about specific processes.
+
+Why scheduler priority alone isn't enough:
+  Nice=19 / SCHED_IDLE only affects which thread gets the next time slice.
+  RandomX's 2MB-per-thread scratchpad (24MB across 12 threads) pollutes
+  the shared 32MB L3 cache, and its memory access pattern saturates DRAM
+  bandwidth. Other services run slower even though they aren't denied CPU
+  time. The only fix is to stop xmrig entirely when real work is happening.
+"""
+
+import os
+import subprocess
+import sys
+import time
+
+POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "3"))
+GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "15"))
+# Percentage of total CPU ticks that non-nice processes must use to trigger
+# a pause. On a 12-thread system, one fully loaded core ≈ 8.3% of total.
+# Default 5% catches anything using more than ~60% of a single core.
+CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "5"))
+
+
+def log(msg):
+    print(f"[xmrig-auto-pause] {msg}", file=sys.stderr, flush=True)
+
+
+def read_cpu_ticks():
+    """Read CPU tick counters from /proc/stat.
+
+    Returns (total_ticks, real_work_ticks) where real_work excludes the
+    'nice' column (xmrig) and idle/iowait.
+    """
+    with open("/proc/stat") as f:
+        parts = f.readline().split()
+    # cpu  user nice system idle iowait irq softirq steal
+    user, nice, system, idle, iowait, irq, softirq, steal = (
+        int(x) for x in parts[1:9]
+    )
+    total = user + nice + system + idle + iowait + irq + softirq + steal
+    real_work = user + system + irq + softirq
+    return total, real_work
+
+
+def is_active(unit):
+    """Check if a systemd unit is currently active."""
+    result = subprocess.run(
+        ["systemctl", "is-active", "--quiet", unit],
+        capture_output=True,
+    )
+    return result.returncode == 0
+
+
+def systemctl(action, unit):
+    result = subprocess.run(
+        ["systemctl", action, unit],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        log(f"systemctl {action} {unit} failed (rc={result.returncode}): {result.stderr.strip()}")
+    return result.returncode == 0
+
+
+def main():
+    paused_by_us = False
+    idle_since = None
+    prev_total = None
+    prev_work = None
+
+    log(f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s threshold={CPU_THRESHOLD}%")
+
+    while True:
+        total, work = read_cpu_ticks()
+
+        if prev_total is None:
+            prev_total = total
+            prev_work = work
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        dt = total - prev_total
+        if dt <= 0:
+            prev_total = total
+            prev_work = work
+            time.sleep(POLL_INTERVAL)
+            continue
+
+        real_work_pct = ((work - prev_work) / dt) * 100
+        prev_total = total
+        prev_work = work
+
+        busy = real_work_pct > CPU_THRESHOLD
+
+        if busy:
+            idle_since = None
+            if not paused_by_us:
+                # Only claim ownership if xmrig is actually running.
+                # If something else stopped it (e.g. UPS battery hook),
+                # don't interfere — we'd wrongly restart it later.
+                if is_active("xmrig.service"):
+                    log(f"Real workload detected ({real_work_pct:.1f}% CPU) — stopping xmrig")
+                    if systemctl("stop", "xmrig.service"):
+                        paused_by_us = True
+        else:
+            if paused_by_us:
+                if idle_since is None:
+                    idle_since = time.monotonic()
+                elif time.monotonic() - idle_since >= GRACE_PERIOD:
+                    log(f"Workload ended ({real_work_pct:.1f}% CPU) past grace period — starting xmrig")
+                    if systemctl("start", "xmrig.service"):
+                        paused_by_us = False
+                    idle_since = None
+
+        time.sleep(POLL_INTERVAL)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/llama-cpp-xmrig-pause.nix b/tests/llama-cpp-xmrig-pause.nix
deleted file mode 100644
index 78a272c..0000000
--- a/tests/llama-cpp-xmrig-pause.nix
+++ /dev/null
@@ -1,162 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-let
-  script = ../services/llama-cpp/llama-cpp-xmrig-pause.py;
-  python = pkgs.python3;
-
-  # SmolLM-135M Q2_K: 85MB, modern GGUFv3, generates ~30 tok/s on one CPU
-  # thread — slow enough that a 200-token request keeps the process busy for
-  # several seconds, fast enough that tests don't crawl.
-  tinyModel = pkgs.fetchurl {
-    url = "https://huggingface.co/QuantFactory/SmolLM-135M-GGUF/resolve/main/SmolLM-135M.Q2_K.gguf";
-    hash = "sha256-DX46drPNJILNba21xfY2tyE0/yPWgOhz43gJdeSYKh4=";
-  };
-in
-pkgs.testers.runNixOSTest {
-  name = "llama-cpp-xmrig-pause";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [
-        pkgs.python3
-        pkgs.procps
-        pkgs.curl
-        pkgs.llama-cpp
-      ];
-
-      # Mock xmrig as a simple sleep process that can be stopped/started.
-      systemd.services.xmrig = {
-        description = "Mock xmrig miner";
-        serviceConfig = {
-          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
-          Type = "simple";
-        };
-        wantedBy = [ "multi-user.target" ];
-      };
-    };
-
-  testScript = ''
-    import time
-
-    PORT = 18088
-    MODEL = "${tinyModel}"
-    PYTHON = "${python}/bin/python3"
-    SCRIPT = "${script}"
-
-    # Tuned for test speed while remaining realistic.
-    # POLL_INTERVAL=1 keeps detection latency low.
-    # GRACE_PERIOD=5 is long enough to verify "stays stopped" but short enough
-    # that the full test completes in ~2 minutes.
-    # CPU_THRESHOLD=10 is low because the VM has limited cores and the model
-    # is small — but any active inference still saturates a core.
-    POLL_INTERVAL = "1"
-    GRACE_PERIOD = "5"
-    CPU_THRESHOLD = "10"
-
-    infer_counter = 0
-
-    def send_completion(n_predict=200):
-        """Fire a completion request in the background via a transient systemd unit."""
-        global infer_counter
-        infer_counter += 1
-        name = f"infer-{infer_counter}"
-        machine.succeed(
-            f"systemd-run --unit={name} --property=Type=exec "
-            f"curl -sf -X POST http://127.0.0.1:{PORT}/completion "
-            f"-H 'Content-Type: application/json' "
-            f"-d '{{\"prompt\": \"Once upon a time in a land far away there lived\", \"n_predict\": {n_predict}}}'"
-        )
-        return name
-
-    def wait_inference_done(unit_name, timeout=60):
-        """Wait for a background inference request to finish."""
-        machine.wait_until_fails(
-            f"systemctl is-active {unit_name}",
-            timeout=timeout,
-        )
-
-    start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.wait_for_unit("xmrig.service")
-
-    with subtest("Start llama-server"):
-        machine.succeed(
-            f"systemd-run --unit=llama-server "
-            # Single inference thread to maximise per-core CPU%, which is
-            # what the monitor measures.  Keeps token generation slow enough
-            # (~30 tok/s) that a 200-token request sustains load for seconds.
-            f"llama-server --model {MODEL} --port {PORT} --ctx-size 512 -t 1 -np 1"
-        )
-        machine.wait_until_succeeds(
-            f"curl -sf http://127.0.0.1:{PORT}/health",
-            timeout=30,
-        )
-        machine.succeed("pgrep -x llama-server")
-
-    with subtest("Start pause monitor"):
-        machine.succeed(
-            f"systemd-run --unit=llama-xmrig-pause "
-            f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
-            f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
-            f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
-            f"{PYTHON} {SCRIPT}"
-        )
-        # The monitor needs two consecutive polls to compute a CPU delta.
-        # Wait for baseline to stabilise.
-        time.sleep(3)
-
-    with subtest("xmrig stays running while llama-server is idle"):
-        machine.succeed("systemctl is-active xmrig")
-
-    with subtest("xmrig stopped during prompt processing"):
-        unit = send_completion(n_predict=200)
-        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
-
-    with subtest("xmrig remains stopped during grace period after inference ends"):
-        wait_inference_done(unit)
-        # Inference just finished.  The monitor will need 1-2 polls to detect
-        # idle, then the grace period starts.  Checking 2s after completion
-        # is well within the 5s grace window.
-        time.sleep(2)
-        machine.fail("systemctl is-active xmrig")
-
-    with subtest("xmrig resumes after grace period expires"):
-        # Already idle since previous subtest.  Grace period (5s) plus
-        # detection delay (~2 polls) means xmrig should restart within ~8s.
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
-
-    with subtest("Sequential prompts do not cause xmrig flapping"):
-        # First prompt — stop xmrig
-        unit1 = send_completion(n_predict=200)
-        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
-        wait_inference_done(unit1)
-
-        # Brief idle gap — shorter than grace period
-        time.sleep(2)
-
-        # Second prompt arrives before grace period expires, resetting it
-        unit2 = send_completion(n_predict=200)
-        time.sleep(3)
-
-        # xmrig must still be stopped
-        machine.fail("systemctl is-active xmrig")
-
-        wait_inference_done(unit2)
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
-
-    with subtest("xmrig stays stopped during sustained inference"):
-        unit = send_completion(n_predict=500)
-        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
-
-        # Stay busy longer than the grace period to prove continuous
-        # activity keeps xmrig stopped indefinitely.
-        time.sleep(8)
-        machine.fail("systemctl is-active xmrig")
-
-        wait_inference_done(unit)
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
-  '';
-}
diff --git a/tests/tests.nix b/tests/tests.nix
index 2dcec9a..c5e6cd4 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -30,7 +30,9 @@ in
 
   # llama-cpp tests
   llamaCppAnnotationsTest = handleTest ./llama-cpp-annotations.nix;
-  llamaCppXmrigPauseTest = handleTest ./llama-cpp-xmrig-pause.nix;
+
+  # xmrig auto-pause test
+  xmrigAutoPauseTest = handleTest ./xmrig-auto-pause.nix;
   # ntfy alerts test
   ntfyAlertsTest = handleTest ./ntfy-alerts.nix;
 
diff --git a/tests/xmrig-auto-pause.nix b/tests/xmrig-auto-pause.nix
new file mode 100644
index 0000000..6f5daa6
--- /dev/null
+++ b/tests/xmrig-auto-pause.nix
@@ -0,0 +1,121 @@
+{
+  pkgs,
+  ...
+}:
+let
+  script = ../services/xmrig-auto-pause.py;
+  python = pkgs.python3;
+in
+pkgs.testers.runNixOSTest {
+  name = "xmrig-auto-pause";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.python3
+        pkgs.procps
+      ];
+
+      # Mock xmrig as a nice'd sleep process that can be stopped/started.
+      systemd.services.xmrig = {
+        description = "Mock xmrig miner";
+        serviceConfig = {
+          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+          Type = "simple";
+          Nice = 19;
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+    };
+
+  testScript = ''
+    import time
+
+    PYTHON = "${python}/bin/python3"
+    SCRIPT = "${script}"
+
+    # Tuned for test VMs (1-2 cores).
+    # POLL_INTERVAL=1 keeps detection latency low.
+    # GRACE_PERIOD=5 is long enough to verify "stays stopped" but short
+    # enough that the full test completes in reasonable time.
+    # CPU_THRESHOLD=10 catches a single busy-loop on a 1-2 core VM.
+    POLL_INTERVAL = "1"
+    GRACE_PERIOD = "5"
+    CPU_THRESHOLD = "10"
+
+    def start_cpu_load(name):
+        """Start a non-nice CPU burn as a transient systemd unit."""
+        machine.succeed(
+            f"systemd-run --unit={name} --property=Type=exec "
+            f"bash -c 'while true; do :; done'"
+        )
+
+    def stop_cpu_load(name):
+        machine.succeed(f"systemctl stop {name}")
+
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("xmrig.service")
+
+    with subtest("Start auto-pause monitor"):
+        machine.succeed(
+            f"systemd-run --unit=xmrig-auto-pause "
+            f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
+            f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
+            f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
+            f"{PYTHON} {SCRIPT}"
+        )
+        # Monitor needs two consecutive polls to compute a CPU delta.
+        time.sleep(3)
+
+    with subtest("xmrig stays running while system is idle"):
+        machine.succeed("systemctl is-active xmrig")
+
+    with subtest("xmrig stopped when CPU load appears"):
+        start_cpu_load("cpu-load")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+    with subtest("xmrig remains stopped during grace period after load ends"):
+        stop_cpu_load("cpu-load")
+        # Load just stopped. Grace period is 5s. Check at 2s — well within.
+        time.sleep(2)
+        machine.fail("systemctl is-active xmrig")
+
+    with subtest("xmrig resumes after grace period expires"):
+        # Already idle since previous subtest. Grace period (5s) plus
+        # detection delay (~2 polls) means xmrig should restart within ~8s.
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+
+    with subtest("Intermittent load does not cause flapping"):
+        # First load — stop xmrig
+        start_cpu_load("cpu-load-1")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+        stop_cpu_load("cpu-load-1")
+
+        # Brief idle gap — shorter than grace period
+        time.sleep(2)
+
+        # Second load arrives before grace period expires
+        start_cpu_load("cpu-load-2")
+        time.sleep(3)
+
+        # xmrig must still be stopped
+        machine.fail("systemctl is-active xmrig")
+
+        stop_cpu_load("cpu-load-2")
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+
+    with subtest("Sustained load keeps xmrig stopped"):
+        start_cpu_load("cpu-load-3")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        # Stay busy longer than the grace period to prove continuous
+        # activity keeps xmrig stopped indefinitely.
+        time.sleep(8)
+        machine.fail("systemctl is-active xmrig")
+
+        stop_cpu_load("cpu-load-3")
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+  '';
+}

From 47aeb58f7ad5ac8cb1af542f105dd083904af515 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 14:39:46 -0400
Subject: [PATCH 759/847] llama-cpp: do logging

---
 services/llama-cpp/llama-cpp.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 7cd002b..b126198 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -4,8 +4,12 @@
   config,
   inputs,
   lib,
+  utils,
   ...
 }:
+let
+  cfg = config.services.llama-cpp;
+in
 {
   services.llama-cpp = {
     enable = true;
@@ -37,6 +41,16 @@
   # have to do this in order to get vulkan to work
   systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
 
+  # upstream module hardcodes --log-disable; override ExecStart to keep logs
+  # so we can see prompt processing progress via journalctl
+  systemd.services.llama-cpp.serviceConfig.ExecStart = lib.mkForce (
+    "${cfg.package}/bin/llama-server"
+    + " --host ${cfg.host}"
+    + " --port ${toString cfg.port}"
+    + " -m ${cfg.model}"
+    + " ${utils.escapeSystemdExecArgs cfg.extraFlags}"
+  );
+
   # Auth handled by llama-cpp --api-key-file (Bearer token).
   # No caddy_auth — the API key is the auth layer, and caddy_auth's basic
   # auth would block Bearer-only clients like oh-my-pi.

From 37ac88fc0fc9c2b1c666dc90f322356afd618e62 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 15:18:22 -0400
Subject: [PATCH 760/847] lib: replace deprecated overrideDerivation with
 overrideAttrs

overrideDerivation has been deprecated since 2019. The new
overrideAttrs properly handles the env attribute set used by
modern derivations to avoid the NIX_CFLAGS_COMPILE overlap
error between env and top-level derivation arguments.
---
 modules/lib.nix | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/modules/lib.nix b/modules/lib.nix
index 8f36a9d..7e3160c 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -10,20 +10,16 @@ inputs.nixpkgs.lib.extend (
     lib = prev;
   in
   {
-    # stolen from: https://stackoverflow.com/a/42398526
     optimizeWithFlags =
       pkg: flags:
-      lib.overrideDerivation pkg (
-        old:
-        let
-          newflags = lib.foldl' (acc: x: "${acc} ${x}") "" flags;
-          oldflags = if (lib.hasAttr "NIX_CFLAGS_COMPILE" old) then "${old.NIX_CFLAGS_COMPILE}" else "";
-        in
-        {
-          NIX_CFLAGS_COMPILE = "${oldflags} ${newflags}";
-          # stdenv = pkgs.clang19Stdenv;
-        }
-      );
+      pkg.overrideAttrs (old: {
+        env = (old.env or { }) // {
+          NIX_CFLAGS_COMPILE =
+            (old.env.NIX_CFLAGS_COMPILE or old.NIX_CFLAGS_COMPILE or "")
+            + " "
+            + (lib.concatStringsSep " " flags);
+        };
+      });
 
     optimizePackage =
       pkg:

From 479ec43b8fe7a2d2f73d14a241ffc098d67d9528 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 15:19:11 -0400
Subject: [PATCH 761/847] llama-cpp: integrate native prometheus /metrics
 endpoint

llama.cpp server has a built-in /metrics endpoint exposing
prompt_tokens_seconds, predicted_tokens_seconds, tokens_predicted_total,
n_decode_total, and n_busy_slots_per_decode. Enable it with --metrics
and add a Prometheus scrape target, replacing the need for any external
metric collection for LLM inference monitoring.
---
 services/grafana/prometheus.nix  | 6 ++++++
 services/llama-cpp/llama-cpp.nix | 1 +
 2 files changed, 7 insertions(+)

diff --git a/services/grafana/prometheus.nix b/services/grafana/prometheus.nix
index e9835d5..2939ec9 100644
--- a/services/grafana/prometheus.nix
+++ b/services/grafana/prometheus.nix
@@ -65,6 +65,12 @@ in
           { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_apcupsd.port}" ]; }
         ];
       }
+      {
+        job_name = "llama-cpp";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}" ]; }
+        ];
+      }
     ];
   };
 
diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index b126198..4f3800b 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -35,6 +35,7 @@ in
       "on"
       "--api-key-file"
       config.age.secrets.llama-cpp-api-key.path
+      "--metrics"
     ];
   };
 

From 3f62b9c88ed5ca0ab6614a43bb1bb08a940d005f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 3 Apr 2026 15:23:47 -0400
Subject: [PATCH 762/847] grafana: replace custom metric collectors with
 community exporters

Replace three custom Prometheus textfile collector scripts with
dedicated community-maintained exporters:

- jellyfin-collector.nix (25 LoC shell) -> rebelcore/jellyfin_exporter
  Metric: jellyfin_active_streams -> count(jellyfin_now_playing_state)
  Bonus: per-session labels (user, title, device, codec info)

- qbittorrent-collector.nix (40 LoC shell) -> anriha/qbittorrent-metrics-exporter
  Metric: qbittorrent_{download,upload}_bytes_per_second -> qbit_{dl,up}speed
  Bonus: per-torrent metrics with category/tag aggregation

- intel-gpu-collector.nix + .py (130 LoC Python) -> mike1808/igpu-exporter
  Metric: intel_gpu_engine_busy_percent -> igpu_engines_busy_percent
  Bonus: persistent daemon vs oneshot timer, no streaming JSON parser

All three run as persistent daemons scraped by Prometheus, replacing
the textfile-collector pattern of systemd timers writing .prom files.
Dashboard PromQL queries updated to match new metric names.
---
 flake.lock                                 | 118 ++++++++++++++++++++-
 flake.nix                                  |   5 +
 modules/overlays.nix                       |  32 ++++++
 service-configs.nix                        |  12 +++
 services/grafana/dashboard.nix             |  12 +--
 services/grafana/default.nix               |   4 +-
 services/grafana/exporters.nix             | 112 +++++++++++++++++++
 services/grafana/intel-gpu-collector.nix   |  38 -------
 services/grafana/intel-gpu-collector.py    | 107 -------------------
 services/grafana/jellyfin-collector.nix    |  54 ----------
 services/grafana/prometheus.nix            |  18 ++++
 services/grafana/qbittorrent-collector.nix |  60 -----------
 12 files changed, 302 insertions(+), 270 deletions(-)
 create mode 100644 services/grafana/exporters.nix
 delete mode 100644 services/grafana/intel-gpu-collector.nix
 delete mode 100644 services/grafana/intel-gpu-collector.py
 delete mode 100644 services/grafana/jellyfin-collector.nix
 delete mode 100644 services/grafana/qbittorrent-collector.nix

diff --git a/flake.lock b/flake.lock
index 81bc859..f081ed1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -102,6 +102,29 @@
         "type": "github"
       }
     },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "qbittorrent-metrics-exporter",
+          "naersk",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1752475459,
+        "narHash": "sha256-z6QEu4ZFuHiqdOPbYss4/Q8B0BFhacR8ts6jO/F/aOU=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "bf0d6f70f4c9a9cf8845f992105652173f4b617f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -170,7 +193,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -316,6 +339,26 @@
         "type": "github"
       }
     },
+    "naersk": {
+      "inputs": {
+        "fenix": "fenix",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1763384566,
+        "narHash": "sha256-r+wgI+WvNaSdxQmqaM58lVNvJYJ16zoq+tKN20cLst4=",
+        "owner": "nix-community",
+        "repo": "naersk",
+        "rev": "d4155d6ebb70fbe2314959842f744aa7cabbbf6a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_3",
@@ -400,6 +443,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1752077645,
+        "narHash": "sha256-HM791ZQtXV93xtCY+ZxG1REzhQenSQO020cu6rHtAPk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "be9e214982e20b8310878ac2baa063a961c1bdf6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1764517877,
         "narHash": "sha256-pp3uT4hHijIC8JUK5MEqeAWmParJrgBVzHLNfJDZxg4=",
@@ -438,6 +497,28 @@
         "type": "github"
       }
     },
+    "qbittorrent-metrics-exporter": {
+      "inputs": {
+        "naersk": "naersk",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1771989937,
+        "narHash": "sha256-bPUV4gVvSbF4VMkbLKYrfwVwzTeS+Sr41wucDj1///g=",
+        "ref": "refs/heads/main",
+        "rev": "cb94f866b7a2738532b1cae31d0b9f89adecbd54",
+        "revCount": 112,
+        "type": "git",
+        "url": "https://codeberg.org/anriha/qbittorrent-metrics-exporter"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://codeberg.org/anriha/qbittorrent-metrics-exporter"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -452,6 +533,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixpkgs-p2pool-module": "nixpkgs-p2pool-module",
+        "qbittorrent-metrics-exporter": "qbittorrent-metrics-exporter",
         "senior_project-website": "senior_project-website",
         "srvos": "srvos",
         "trackerlist": "trackerlist",
@@ -460,6 +542,23 @@
         "ytbn-graphing-software": "ytbn-graphing-software"
       }
     },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1752428706,
+        "narHash": "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "591e3b7624be97e4443ea7b5542c191311aa141d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
@@ -598,6 +697,21 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "trackerlist": {
       "flake": false,
       "locked": {
@@ -666,7 +780,7 @@
     "ytbn-graphing-software": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
diff --git a/flake.nix b/flake.nix
index 487628a..56319ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,6 +83,11 @@
       url = "github:JacoMalan1/nixpkgs/create-p2pool-service";
       flake = false;
     };
+
+    qbittorrent-metrics-exporter = {
+      url = "git+https://codeberg.org/anriha/qbittorrent-metrics-exporter";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
diff --git a/modules/overlays.nix b/modules/overlays.nix
index 4b705b2..5f8ee0e 100644
--- a/modules/overlays.nix
+++ b/modules/overlays.nix
@@ -43,4 +43,36 @@ final: prev: {
       }
     );
   };
+
+  jellyfin-exporter = prev.buildGoModule rec {
+    pname = "jellyfin-exporter";
+    version = "unstable-2025-03-27";
+    src = prev.fetchFromGitHub {
+      owner = "rebelcore";
+      repo = "jellyfin_exporter";
+      rev = "8e3970cb1bdf3cb21fac099c13072bb7c1b20cf9";
+      hash = "sha256-wDnhepYj1MyLRZlwKfmwf4xiEEL3mgQY6V+7TnBd0MY=";
+    };
+    vendorHash = "sha256-e08u10e/wNapNZSsD/fGVN9ybMHe3sW0yDIOqI8ZcYs=";
+    # upstream tests require a running Jellyfin instance
+    doCheck = false;
+    meta.mainProgram = "jellyfin_exporter";
+  };
+
+  igpu-exporter = prev.buildGoModule rec {
+    pname = "igpu-exporter";
+    version = "unstable-2025-03-27";
+    src = prev.fetchFromGitHub {
+      owner = "mike1808";
+      repo = "igpu-exporter";
+      rev = "db2dace1a895c2b950f6d3ba1a2e46729251d124";
+      hash = "sha256-xWTiu26UzTZIK/6jeda+x6VePUgoWTS0AekejFdgFWs=";
+    };
+    vendorHash = "sha256-oeCSKwDKVwvYQ1fjXXTwQSXNl/upDE3WAAk680vqh3U=";
+    subPackages = [ "cmd" ];
+    postInstall = ''
+      mv $out/bin/cmd $out/bin/igpu-exporter
+    '';
+    meta.mainProgram = "igpu-exporter";
+  };
 }
diff --git a/service-configs.nix b/service-configs.nix
index 78cd711..1a98996 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -177,6 +177,18 @@ rec {
         port = 8787;
         proto = "tcp";
       };
+      jellyfin_exporter = {
+        port = 9594;
+        proto = "tcp";
+      };
+      qbittorrent_exporter = {
+        port = 9561;
+        proto = "tcp";
+      };
+      igpu_exporter = {
+        port = 9563;
+        proto = "tcp";
+      };
     };
   };
 
diff --git a/services/grafana/dashboard.nix b/services/grafana/dashboard.nix
index 97afe2a..94d84c1 100644
--- a/services/grafana/dashboard.nix
+++ b/services/grafana/dashboard.nix
@@ -387,7 +387,7 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "jellyfin_active_streams";
+            expr = "count(jellyfin_now_playing_state) or vector(0)";
             refId = "A";
           }
         ];
@@ -439,25 +439,25 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "qbittorrent_download_bytes_per_second";
+            expr = "sum(qbit_dlspeed) or vector(0)";
             legendFormat = "Download";
             refId = "A";
           }
           {
             datasource = promDs;
-            expr = "qbittorrent_upload_bytes_per_second";
+            expr = "sum(qbit_upspeed) or vector(0)";
             legendFormat = "Upload";
             refId = "B";
           }
           {
             datasource = promDs;
-            expr = "avg_over_time(qbittorrent_download_bytes_per_second[10m:])";
+            expr = "avg_over_time((sum(qbit_dlspeed) or vector(0))[10m:])";
             legendFormat = "Download (10m avg)";
             refId = "C";
           }
           {
             datasource = promDs;
-            expr = "avg_over_time(qbittorrent_upload_bytes_per_second[10m:])";
+            expr = "avg_over_time((sum(qbit_upspeed) or vector(0))[10m:])";
             legendFormat = "Upload (10m avg)";
             refId = "D";
           }
@@ -577,7 +577,7 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "intel_gpu_engine_busy_percent";
+            expr = "igpu_engines_busy_percent";
             legendFormat = "{{engine}}";
             refId = "A";
           }
diff --git a/services/grafana/default.nix b/services/grafana/default.nix
index fccd7e6..ec4fb98 100644
--- a/services/grafana/default.nix
+++ b/services/grafana/default.nix
@@ -3,10 +3,8 @@
     ./grafana.nix
     ./prometheus.nix
     ./dashboard.nix
-    ./jellyfin-collector.nix
+    ./exporters.nix
     ./jellyfin-annotations.nix
-    ./qbittorrent-collector.nix
-    ./intel-gpu-collector.nix
     ./disk-usage-collector.nix
     ./llama-cpp-annotations.nix
     ./zfs-scrub-annotations.nix
diff --git a/services/grafana/exporters.nix b/services/grafana/exporters.nix
new file mode 100644
index 0000000..96e4224
--- /dev/null
+++ b/services/grafana/exporters.nix
@@ -0,0 +1,112 @@
+{
+  config,
+  pkgs,
+  inputs,
+  service_configs,
+  lib,
+  ...
+}:
+let
+  jellyfinExporterPort = service_configs.ports.private.jellyfin_exporter.port;
+  qbitExporterPort = service_configs.ports.private.qbittorrent_exporter.port;
+  igpuExporterPort = service_configs.ports.private.igpu_exporter.port;
+in
+{
+  # -- Jellyfin Prometheus Exporter --
+  # Replaces custom jellyfin-collector.nix textfile timer.
+  # Exposes per-session metrics (jellyfin_now_playing_state) and library stats.
+  systemd.services.jellyfin-exporter =
+    lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable)
+      {
+        description = "Prometheus exporter for Jellyfin";
+        after = [
+          "network.target"
+          "jellyfin.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = lib.getExe (
+            pkgs.writeShellApplication {
+              name = "jellyfin-exporter-wrapper";
+              runtimeInputs = [ pkgs.jellyfin-exporter ];
+              text = ''
+                exec jellyfin_exporter \
+                  --jellyfin.address=http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port} \
+                  --jellyfin.token="$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")" \
+                  --web.listen-address=127.0.0.1:${toString jellyfinExporterPort}
+              '';
+            }
+          );
+          Restart = "on-failure";
+          RestartSec = "10s";
+          DynamicUser = true;
+          NoNewPrivileges = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          MemoryDenyWriteExecute = true;
+          LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+        };
+      };
+
+  # -- qBittorrent Prometheus Exporter --
+  # Replaces custom qbittorrent-collector.nix textfile timer.
+  # Exposes per-torrent metrics (qbit_dlspeed, qbit_upspeed) and aggregate stats.
+  # qBittorrent runs in a VPN namespace; the exporter reaches it via namespace address.
+  systemd.services.qbittorrent-exporter =
+    lib.mkIf (config.services.grafana.enable && config.services.qbittorrent.enable)
+      {
+        description = "Prometheus exporter for qBittorrent";
+        after = [
+          "network.target"
+          "qbittorrent.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart =
+            lib.getExe' inputs.qbittorrent-metrics-exporter.packages.${pkgs.system}.default
+              "qbittorrent-metrics-exporter";
+          Restart = "on-failure";
+          RestartSec = "10s";
+          DynamicUser = true;
+          NoNewPrivileges = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+        };
+        environment = {
+          HOST = "127.0.0.1";
+          PORT = toString qbitExporterPort;
+          SCRAPE_INTERVAL = "15";
+          BACKEND = "in-memory";
+          # qBittorrent has AuthSubnetWhitelist=0.0.0.0/0, so no real password needed.
+          # The exporter still expects the env var to be set.
+          QBITTORRENT_PASSWORD = "unused";
+          QBITTORRENT_USERNAME = "admin";
+          TORRENT_HOSTS = "qbit:main=http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}|http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}";
+          RUST_LOG = "warn";
+        };
+      };
+
+  # -- Intel GPU Prometheus Exporter --
+  # Replaces custom intel-gpu-collector.nix + intel-gpu-collector.py textfile timer.
+  # Exposes engine busy%, frequency, and RC6 metrics via /metrics.
+  # Requires privileged access to GPU debug interfaces (intel_gpu_top).
+  systemd.services.igpu-exporter = lib.mkIf config.services.grafana.enable {
+    description = "Prometheus exporter for Intel integrated GPU";
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.intel-gpu-tools ];
+    serviceConfig = {
+      ExecStart = lib.getExe pkgs.igpu-exporter;
+      Restart = "on-failure";
+      RestartSec = "10s";
+      # intel_gpu_top requires root-level access to GPU debug interfaces
+      ProtectHome = true;
+      PrivateTmp = true;
+    };
+    environment = {
+      PORT = toString igpuExporterPort;
+      REFRESH_PERIOD_MS = "30000";
+    };
+  };
+}
diff --git a/services/grafana/intel-gpu-collector.nix b/services/grafana/intel-gpu-collector.nix
deleted file mode 100644
index 25612d4..0000000
--- a/services/grafana/intel-gpu-collector.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
-
-  intelGpuCollector = pkgs.writeShellApplication {
-    name = "intel-gpu-collector";
-    runtimeInputs = with pkgs; [
-      python3
-      intel-gpu-tools
-    ];
-    text = ''
-      exec python3 ${./intel-gpu-collector.py}
-    '';
-  };
-in
-lib.mkIf config.services.grafana.enable {
-  systemd.services.intel-gpu-collector = {
-    description = "Collect Intel GPU metrics for Prometheus";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe intelGpuCollector;
-    };
-    environment.TEXTFILE = "${textfileDir}/intel-gpu.prom";
-  };
-
-  systemd.timers.intel-gpu-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/30";
-      RandomizedDelaySec = "10s";
-    };
-  };
-}
diff --git a/services/grafana/intel-gpu-collector.py b/services/grafana/intel-gpu-collector.py
deleted file mode 100644
index 70a5560..0000000
--- a/services/grafana/intel-gpu-collector.py
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/usr/bin/env python3
-import json
-import os
-import subprocess
-import sys
-import time
-
-TEXTFILE = os.environ.get(
-    "TEXTFILE",
-    "/var/lib/prometheus-node-exporter-textfiles/intel-gpu.prom",
-)
-
-
-def read_one_sample():
-    try:
-        proc = subprocess.Popen(
-            ["intel_gpu_top", "-J", "-s", "1000"],
-            stdout=subprocess.PIPE,
-            stderr=subprocess.DEVNULL,
-        )
-        buf = b""
-        depth = 0
-        in_obj = False
-        deadline = time.monotonic() + 8.0
-        try:
-            while time.monotonic() < deadline:
-                byte = proc.stdout.read(1)
-                if not byte:
-                    break
-                if byte == b"{":
-                    in_obj = True
-                    depth += 1
-                if in_obj:
-                    buf += byte
-                if in_obj and byte == b"}":
-                    depth -= 1
-                    if depth == 0:
-                        break
-        finally:
-            proc.terminate()
-            proc.wait()
-        if not buf:
-            return None
-        try:
-            return json.loads(buf)
-        except json.JSONDecodeError:
-            print("Malformed JSON from intel_gpu_top", file=sys.stderr)
-            return None
-    except Exception as e:
-        print(f"intel_gpu_top unavailable: {e}", file=sys.stderr)
-        return None
-
-
-def write_empty_metrics():
-    """Write zero-valued metrics so Prometheus doesn't see stale data."""
-    lines = [
-        "# HELP intel_gpu_engine_busy_percent Intel GPU engine busy percentage",
-        "# TYPE intel_gpu_engine_busy_percent gauge",
-        "# HELP intel_gpu_frequency_mhz Intel GPU actual frequency in MHz",
-        "# TYPE intel_gpu_frequency_mhz gauge",
-        "intel_gpu_frequency_mhz 0",
-        "# HELP intel_gpu_rc6_percent Intel GPU RC6 power-saving state percentage",
-        "# TYPE intel_gpu_rc6_percent gauge",
-        "intel_gpu_rc6_percent 0",
-    ]
-    tmp = TEXTFILE + ".tmp"
-    with open(tmp, "w") as f:
-        f.write("\n".join(lines) + "\n")
-    os.replace(tmp, TEXTFILE)
-
-
-def write_metrics(sample):
-    lines = [
-        "# HELP intel_gpu_engine_busy_percent Intel GPU engine busy percentage",
-        "# TYPE intel_gpu_engine_busy_percent gauge",
-    ]
-    for engine, data in sample.get("engines", {}).items():
-        lines.append(
-            f'intel_gpu_engine_busy_percent{{engine="{engine}"}} {data.get("busy", 0)}'
-        )
-    freq = sample.get("frequency", {})
-    lines += [
-        "# HELP intel_gpu_frequency_mhz Intel GPU actual frequency in MHz",
-        "# TYPE intel_gpu_frequency_mhz gauge",
-        f'intel_gpu_frequency_mhz {freq.get("actual", 0)}',
-        "# HELP intel_gpu_rc6_percent Intel GPU RC6 power-saving state percentage",
-        "# TYPE intel_gpu_rc6_percent gauge",
-        f'intel_gpu_rc6_percent {sample.get("rc6", {}).get("value", 0)}',
-    ]
-
-    tmp = TEXTFILE + ".tmp"
-    with open(tmp, "w") as f:
-        f.write("\n".join(lines) + "\n")
-    os.replace(tmp, TEXTFILE)
-
-
-def main():
-    sample = read_one_sample()
-    if sample is None:
-        print("Failed to read intel_gpu_top sample", file=sys.stderr)
-        write_empty_metrics()
-        sys.exit(0)
-    write_metrics(sample)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/services/grafana/jellyfin-collector.nix b/services/grafana/jellyfin-collector.nix
deleted file mode 100644
index fe05371..0000000
--- a/services/grafana/jellyfin-collector.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  config,
-  pkgs,
-  service_configs,
-  lib,
-  ...
-}:
-let
-  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
-
-  jellyfinCollector = pkgs.writeShellApplication {
-    name = "jellyfin-metrics-collector";
-    runtimeInputs = with pkgs; [
-      curl
-      jq
-    ];
-    text = ''
-      API_KEY=$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")
-      JELLYFIN="http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}"
-
-      if response=$(curl -sf --max-time 5 "''${JELLYFIN}/Sessions?api_key=''${API_KEY}"); then
-        active_streams=$(echo "$response" | jq '[.[] | select(.NowPlayingItem != null)] | length')
-      else
-        active_streams=0
-      fi
-
-      {
-        echo '# HELP jellyfin_active_streams Number of currently active Jellyfin streams'
-        echo '# TYPE jellyfin_active_streams gauge'
-        echo "jellyfin_active_streams $active_streams"
-      } > "${textfileDir}/jellyfin.prom.$$.tmp"
-      mv "${textfileDir}/jellyfin.prom.$$.tmp" "${textfileDir}/jellyfin.prom"
-    '';
-  };
-in
-lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable) {
-  systemd.services.jellyfin-metrics-collector = {
-    description = "Collect Jellyfin metrics for Prometheus";
-    after = [ "network.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe jellyfinCollector;
-      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
-    };
-  };
-
-  systemd.timers.jellyfin-metrics-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/30";
-      RandomizedDelaySec = "5s";
-    };
-  };
-}
diff --git a/services/grafana/prometheus.nix b/services/grafana/prometheus.nix
index 2939ec9..4ac8bd5 100644
--- a/services/grafana/prometheus.nix
+++ b/services/grafana/prometheus.nix
@@ -71,6 +71,24 @@ in
           { targets = [ "127.0.0.1:${toString service_configs.ports.private.llama_cpp.port}" ]; }
         ];
       }
+      {
+        job_name = "jellyfin";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.jellyfin_exporter.port}" ]; }
+        ];
+      }
+      {
+        job_name = "qbittorrent";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.qbittorrent_exporter.port}" ]; }
+        ];
+      }
+      {
+        job_name = "igpu";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.igpu_exporter.port}" ]; }
+        ];
+      }
     ];
   };
 
diff --git a/services/grafana/qbittorrent-collector.nix b/services/grafana/qbittorrent-collector.nix
deleted file mode 100644
index 25112af..0000000
--- a/services/grafana/qbittorrent-collector.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
-
-  qbittorrentCollector = pkgs.writeShellApplication {
-    name = "qbittorrent-collector";
-    runtimeInputs = with pkgs; [
-      curl
-      jq
-    ];
-    text = ''
-      QBIT="http://${config.vpnNamespaces.wg.namespaceAddress}:${toString config.services.qbittorrent.webuiPort}"
-      OUT="${textfileDir}/qbittorrent.prom"
-
-      if info=$(curl -sf --max-time 5 "''${QBIT}/api/v2/transfer/info"); then
-        dl=$(echo "$info" | jq '.dl_info_speed')
-        ul=$(echo "$info" | jq '.up_info_speed')
-      else
-        dl=0
-        ul=0
-      fi
-
-      {
-        echo '# HELP qbittorrent_download_bytes_per_second Current download speed in bytes/s'
-        echo '# TYPE qbittorrent_download_bytes_per_second gauge'
-        echo "qbittorrent_download_bytes_per_second $dl"
-        echo '# HELP qbittorrent_upload_bytes_per_second Current upload speed in bytes/s'
-        echo '# TYPE qbittorrent_upload_bytes_per_second gauge'
-        echo "qbittorrent_upload_bytes_per_second $ul"
-      } > "''${OUT}.tmp"
-      mv "''${OUT}.tmp" "$OUT"
-    '';
-  };
-in
-lib.mkIf (config.services.grafana.enable && config.services.qbittorrent.enable) {
-  systemd.services.qbittorrent-collector = {
-    description = "Collect qBittorrent transfer metrics for Prometheus";
-    after = [
-      "network.target"
-      "qbittorrent.service"
-    ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe qbittorrentCollector;
-    };
-  };
-
-  systemd.timers.qbittorrent-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:*:0/15";
-      RandomizedDelaySec = "3s";
-    };
-  };
-}

From 8ea96c8b8edf5a9c8d9e494db5e8aa6104d199d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 4 Apr 2026 00:28:07 -0400
Subject: [PATCH 763/847] llama-cpp: fix model hash

---
 services/llama-cpp/llama-cpp.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 4f3800b..759dbfc 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -16,7 +16,7 @@ in
     model = toString (
       pkgs.fetchurl {
         url = "https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/gemma-4-E4B-it-Q4_K_M.gguf";
-        sha256 = "ced37f54b80068fe65e95c6dd79ac88cddc227e179fd1040b8f751b1e5bdf849";
+        sha256 = "sha256-4bxEJwn+eAqksuybIsFqf83/VC8X8B7Q4yAxFNKPnzQ=";
       }
     );
     port = service_configs.ports.private.llama_cpp.port;

From 324a9123db4c479a43027a654c89c5e5ac070c5b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 4 Apr 2026 14:32:26 -0400
Subject: [PATCH 764/847] better organize related monero and matrix services

---
 configuration.nix                          | 9 ++-------
 services/{ => matrix}/coturn.nix           | 0
 services/matrix/default.nix                | 7 +++++++
 services/{ => matrix}/livekit.nix          | 2 +-
 services/{ => matrix}/matrix.nix           | 0
 services/monero/default.nix                | 8 ++++++++
 services/{ => monero}/monero.nix           | 0
 services/{ => monero}/p2pool.nix           | 0
 services/{ => monero}/xmrig-auto-pause.nix | 0
 services/{ => monero}/xmrig-auto-pause.py  | 0
 services/{ => monero}/xmrig.nix            | 0
 tests/xmrig-auto-pause.nix                 | 2 +-
 12 files changed, 19 insertions(+), 9 deletions(-)
 rename services/{ => matrix}/coturn.nix (100%)
 create mode 100644 services/matrix/default.nix
 rename services/{ => matrix}/livekit.nix (96%)
 rename services/{ => matrix}/matrix.nix (100%)
 create mode 100644 services/monero/default.nix
 rename services/{ => monero}/monero.nix (100%)
 rename services/{ => monero}/p2pool.nix (100%)
 rename services/{ => monero}/xmrig-auto-pause.nix (100%)
 rename services/{ => monero}/xmrig-auto-pause.py (100%)
 rename services/{ => monero}/xmrig.nix (100%)

diff --git a/configuration.nix b/configuration.nix
index c2b99c3..38d1eaf 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -56,14 +56,9 @@
     ./services/bitwarden.nix
     ./services/firefox-syncserver.nix
 
-    ./services/matrix.nix
-    ./services/coturn.nix
-    ./services/livekit.nix
+    ./services/matrix
 
-    ./services/monero.nix
-    ./services/p2pool.nix
-    ./services/xmrig.nix
-    ./services/xmrig-auto-pause.nix
+    ./services/monero
 
     ./services/graphing-calculator.nix
 
diff --git a/services/coturn.nix b/services/matrix/coturn.nix
similarity index 100%
rename from services/coturn.nix
rename to services/matrix/coturn.nix
diff --git a/services/matrix/default.nix b/services/matrix/default.nix
new file mode 100644
index 0000000..8bce986
--- /dev/null
+++ b/services/matrix/default.nix
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./matrix.nix
+    ./coturn.nix
+    ./livekit.nix
+  ];
+}
diff --git a/services/livekit.nix b/services/matrix/livekit.nix
similarity index 96%
rename from services/livekit.nix
rename to services/matrix/livekit.nix
index 4573780..99addec 100644
--- a/services/livekit.nix
+++ b/services/matrix/livekit.nix
@@ -3,7 +3,7 @@
   ...
 }:
 let
-  keyFile = ../secrets/livekit_keys;
+  keyFile = ../../secrets/livekit_keys;
 in
 {
   services.livekit = {
diff --git a/services/matrix.nix b/services/matrix/matrix.nix
similarity index 100%
rename from services/matrix.nix
rename to services/matrix/matrix.nix
diff --git a/services/monero/default.nix b/services/monero/default.nix
new file mode 100644
index 0000000..8cb3687
--- /dev/null
+++ b/services/monero/default.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./monero.nix
+    ./p2pool.nix
+    ./xmrig.nix
+    ./xmrig-auto-pause.nix
+  ];
+}
diff --git a/services/monero.nix b/services/monero/monero.nix
similarity index 100%
rename from services/monero.nix
rename to services/monero/monero.nix
diff --git a/services/p2pool.nix b/services/monero/p2pool.nix
similarity index 100%
rename from services/p2pool.nix
rename to services/monero/p2pool.nix
diff --git a/services/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
similarity index 100%
rename from services/xmrig-auto-pause.nix
rename to services/monero/xmrig-auto-pause.nix
diff --git a/services/xmrig-auto-pause.py b/services/monero/xmrig-auto-pause.py
similarity index 100%
rename from services/xmrig-auto-pause.py
rename to services/monero/xmrig-auto-pause.py
diff --git a/services/xmrig.nix b/services/monero/xmrig.nix
similarity index 100%
rename from services/xmrig.nix
rename to services/monero/xmrig.nix
diff --git a/tests/xmrig-auto-pause.nix b/tests/xmrig-auto-pause.nix
index 6f5daa6..ba8d225 100644
--- a/tests/xmrig-auto-pause.nix
+++ b/tests/xmrig-auto-pause.nix
@@ -3,7 +3,7 @@
   ...
 }:
 let
-  script = ../services/xmrig-auto-pause.py;
+  script = ../services/monero/xmrig-auto-pause.py;
   python = pkgs.python3;
 in
 pkgs.testers.runNixOSTest {

From bbcd662c28b56f150354bb7c923e6b5dd5351061 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 5 Apr 2026 23:20:47 -0400
Subject: [PATCH 765/847] xmrig-auto-pause: fix stuck state after external
 restart, add startup cooldown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs found during live verification on the server:

1. Stuck state after external restart: if something else restarted xmrig
   (e.g. deploy-rs activation) while paused_by_us=True, the script never
   detected this and became permanently stuck — unable to stop xmrig on
   future load because it thought xmrig was already stopped.

   Fix: when paused_by_us=True and busy, check if xmrig is actually
   running. If so, reset paused_by_us=False and re-stop it.

2. Flapping on xmrig restart: RandomX dataset init takes ~3.7s of intense
   non-nice CPU, which the script detected as real workload and immediately
   re-stopped xmrig after every restart, creating a start-stop loop.

   Fix: add STARTUP_COOLDOWN (default 10s) — after starting xmrig, skip
   CPU checks until the cooldown expires.

Both bugs were present in production: the script had been stuck since
Apr 3 (2+ days) with xmrig running unmanaged alongside llama-server.
---
 services/monero/xmrig-auto-pause.nix |  1 +
 services/monero/xmrig-auto-pause.py  | 25 ++++++++++++++++++++++++-
 tests/xmrig-auto-pause.nix           | 25 +++++++++++++++++++++----
 3 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/services/monero/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
index 12dc475..1d1e79c 100644
--- a/services/monero/xmrig-auto-pause.nix
+++ b/services/monero/xmrig-auto-pause.nix
@@ -26,6 +26,7 @@ lib.mkIf config.services.xmrig.enable {
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "15";
       CPU_THRESHOLD = "5";
+      STARTUP_COOLDOWN = "10";
     };
   };
 }
diff --git a/services/monero/xmrig-auto-pause.py b/services/monero/xmrig-auto-pause.py
index 2aafd7e..85c7ba0 100644
--- a/services/monero/xmrig-auto-pause.py
+++ b/services/monero/xmrig-auto-pause.py
@@ -31,6 +31,10 @@ GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "15"))
 # a pause. On a 12-thread system, one fully loaded core ≈ 8.3% of total.
 # Default 5% catches anything using more than ~60% of a single core.
 CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "5"))
+# After starting xmrig, ignore CPU spikes for this many seconds to let
+# RandomX dataset initialization complete (~4s on the target hardware)
+# without retriggering a stop.
+STARTUP_COOLDOWN = float(os.environ.get("STARTUP_COOLDOWN", "10"))
 
 
 def log(msg):
@@ -77,10 +81,14 @@ def systemctl(action, unit):
 def main():
     paused_by_us = False
     idle_since = None
+    started_at = None  # monotonic time when we last started xmrig
     prev_total = None
     prev_work = None
 
-    log(f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s threshold={CPU_THRESHOLD}%")
+    log(
+        f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s "
+        f"threshold={CPU_THRESHOLD}% cooldown={STARTUP_COOLDOWN}s"
+    )
 
     while True:
         total, work = read_cpu_ticks()
@@ -102,10 +110,24 @@ def main():
         prev_total = total
         prev_work = work
 
+        # Don't act during startup cooldown — RandomX dataset init causes
+        # a transient CPU spike that would immediately retrigger a stop.
+        if started_at is not None:
+            if time.monotonic() - started_at < STARTUP_COOLDOWN:
+                time.sleep(POLL_INTERVAL)
+                continue
+            started_at = None
+
         busy = real_work_pct > CPU_THRESHOLD
 
         if busy:
             idle_since = None
+            if paused_by_us and is_active("xmrig.service"):
+                # Something else restarted xmrig (deploy, manual start, etc.)
+                # while we thought it was stopped. Reset ownership so we can
+                # manage it again.
+                log("xmrig was restarted externally while paused — reclaiming")
+                paused_by_us = False
             if not paused_by_us:
                 # Only claim ownership if xmrig is actually running.
                 # If something else stopped it (e.g. UPS battery hook),
@@ -122,6 +144,7 @@ def main():
                     log(f"Workload ended ({real_work_pct:.1f}% CPU) past grace period — starting xmrig")
                     if systemctl("start", "xmrig.service"):
                         paused_by_us = False
+                        started_at = time.monotonic()
                     idle_since = None
 
         time.sleep(POLL_INTERVAL)
diff --git a/tests/xmrig-auto-pause.nix b/tests/xmrig-auto-pause.nix
index ba8d225..20dc7d8 100644
--- a/tests/xmrig-auto-pause.nix
+++ b/tests/xmrig-auto-pause.nix
@@ -43,6 +43,7 @@ pkgs.testers.runNixOSTest {
     POLL_INTERVAL = "1"
     GRACE_PERIOD = "5"
     CPU_THRESHOLD = "10"
+    STARTUP_COOLDOWN = "4"
 
     def start_cpu_load(name):
         """Start a non-nice CPU burn as a transient systemd unit."""
@@ -64,6 +65,7 @@ pkgs.testers.runNixOSTest {
             f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
             f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
             f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
+            f"--setenv=STARTUP_COOLDOWN={STARTUP_COOLDOWN} "
             f"{PYTHON} {SCRIPT}"
         )
         # Monitor needs two consecutive polls to compute a CPU delta.
@@ -84,8 +86,9 @@ pkgs.testers.runNixOSTest {
 
     with subtest("xmrig resumes after grace period expires"):
         # Already idle since previous subtest. Grace period (5s) plus
-        # detection delay (~2 polls) means xmrig should restart within ~8s.
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+        # detection delay (~2 polls) plus startup cooldown (4s) means
+        # xmrig should restart within ~12s.
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=20)
 
     with subtest("Intermittent load does not cause flapping"):
         # First load — stop xmrig
@@ -104,7 +107,7 @@ pkgs.testers.runNixOSTest {
         machine.fail("systemctl is-active xmrig")
 
         stop_cpu_load("cpu-load-2")
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=20)
 
     with subtest("Sustained load keeps xmrig stopped"):
         start_cpu_load("cpu-load-3")
@@ -116,6 +119,20 @@ pkgs.testers.runNixOSTest {
         machine.fail("systemctl is-active xmrig")
 
         stop_cpu_load("cpu-load-3")
-        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=15)
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=20)
+
+    with subtest("External restart detected and re-stopped under load"):
+        # Put system under load so auto-pause stops xmrig.
+        start_cpu_load("cpu-load-4")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        # Something external starts xmrig while load is active.
+        # The script should detect this and re-stop it.
+        machine.succeed("systemctl start xmrig")
+        machine.succeed("systemctl is-active xmrig")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        stop_cpu_load("cpu-load-4")
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=20)
   '';
 }

From 0e4f0d3176c561e1e8f3d65bcd0ac27f2fc91016 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 00:59:20 -0400
Subject: [PATCH 766/847] llama-cpp: fix model name

---
 services/llama-cpp/llama-cpp.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 759dbfc..4a27929 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -9,13 +9,15 @@
 }:
 let
   cfg = config.services.llama-cpp;
+  modelUrl = "https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/gemma-4-E4B-it-Q4_K_M.gguf";
+  modelAlias = lib.removeSuffix ".gguf" (builtins.baseNameOf modelUrl);
 in
 {
   services.llama-cpp = {
     enable = true;
     model = toString (
       pkgs.fetchurl {
-        url = "https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/gemma-4-E4B-it-Q4_K_M.gguf";
+        url = modelUrl;
         sha256 = "sha256-4bxEJwn+eAqksuybIsFqf83/VC8X8B7Q4yAxFNKPnzQ=";
       }
     );
@@ -36,6 +38,8 @@ in
       "--api-key-file"
       config.age.secrets.llama-cpp-api-key.path
       "--metrics"
+      "--alias"
+      modelAlias
     ];
   };
 

From 8fddd3a9549348a580fee71f025aef8a943e6bd6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 01:04:23 -0400
Subject: [PATCH 767/847] llama-cpp: context: 32768 -> 65536

---
 services/llama-cpp/llama-cpp.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 4a27929..8d66ec0 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -28,7 +28,7 @@ in
       # "-ngl"
       # "12"
       "-c"
-      "32768"
+      "65536"
       "-ctk"
       "q8_0"
       "-ctv"

From 06aee5af777c74b712d03045f662294fdb92ea71 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 01:24:25 -0400
Subject: [PATCH 768/847] llama-cpp: gemma 4 E4B -> gemma 4 E2B

---
 services/llama-cpp/llama-cpp.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 8d66ec0..df27025 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -9,8 +9,8 @@
 }:
 let
   cfg = config.services.llama-cpp;
-  modelUrl = "https://huggingface.co/unsloth/gemma-4-E4B-it-GGUF/resolve/main/gemma-4-E4B-it-Q4_K_M.gguf";
-  modelAlias = lib.removeSuffix ".gguf" (builtins.baseNameOf modelUrl);
+  modelUrl = "https://huggingface.co/bartowski/google_gemma-4-E2B-it-GGUF/resolve/main/google_gemma-4-E2B-it-Q4_K_M.gguf";
+  modelAlias = lib.removeSuffix ".gguf" (baseNameOf modelUrl);
 in
 {
   services.llama-cpp = {
@@ -18,7 +18,7 @@ in
     model = toString (
       pkgs.fetchurl {
         url = modelUrl;
-        sha256 = "sha256-4bxEJwn+eAqksuybIsFqf83/VC8X8B7Q4yAxFNKPnzQ=";
+        sha256 = "5efe645db4e1909c7a1f4a9608df18e6c14383f5e86777fc49f769f9ba7d5fdf";
       }
     );
     port = service_configs.ports.private.llama_cpp.port;

From 3e46c5bfa54507f11d222b8cae1e954f0155a8c3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 01:53:11 -0400
Subject: [PATCH 769/847] llama-cpp: use turbo3 for everything

---
 services/llama-cpp/llama-cpp.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index df27025..1691d35 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -30,9 +30,9 @@ in
       "-c"
       "65536"
       "-ctk"
-      "q8_0"
+      "turbo3"
       "-ctv"
-      "turbo4"
+      "turbo3"
       "-fa"
       "on"
       "--api-key-file"

From 0a927ea893366de32aab1b2ec75e2c0b78911c7c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 02:12:46 -0400
Subject: [PATCH 770/847] llama-cpp: maybe use vulkan?

---
 flake.lock                       | 12 ++++++------
 flake.nix                        |  3 ++-
 services/llama-cpp/llama-cpp.nix |  6 +++---
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index f081ed1..f0331e1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,16 +325,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1775236905,
-        "narHash": "sha256-tHshzR/k6D/r5UhJCfJ9b/mJgsbn7ODtnZrDlimhOOI=",
-        "owner": "TheTom",
+        "lastModified": 1774922513,
+        "narHash": "sha256-TKk1i8AZzxy4/z0MkqKxoGf/CQDvoL+jo8JDtZeCRy8=",
+        "owner": "apollosenvy",
         "repo": "llama-cpp-turboquant",
-        "rev": "bc05a6803e48f17e0f2c7a99fce9b50d03882de7",
+        "rev": "9e80e93ceb115bc5055997c373d8c09bfa47a565",
         "type": "github"
       },
       "original": {
-        "owner": "TheTom",
-        "ref": "feature/turboquant-kv-cache",
+        "owner": "apollosenvy",
+        "ref": "pr/vulkan-turbo3",
         "repo": "llama-cpp-turboquant",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 56319ee..728fa02 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,7 +29,8 @@
     };
 
     llamacpp = {
-      url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
+      # url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
+      url = "github:apollosenvy/llama-cpp-turboquant/pr/vulkan-turbo3";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 1691d35..72d8725 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -23,10 +23,10 @@ in
     );
     port = service_configs.ports.private.llama_cpp.port;
     host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
     extraFlags = [
-      # "-ngl"
-      # "12"
+      "-ngl"
+      "999"
       "-c"
       "65536"
       "-ctk"

From df04e36b41be5108400f5729a6d15a6a70cf6714 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 02:23:29 -0400
Subject: [PATCH 771/847] llama-cpp: fix vulkan cache

---
 services/llama-cpp/llama-cpp.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 72d8725..f5e64cd 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -46,6 +46,11 @@ in
   # have to do this in order to get vulkan to work
   systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
 
+  # llama-server tries to create ~/.cache; ProtectSystem=strict + impermanent
+  # root make /root read-only. Give it a writable cache dir and point HOME there.
+  systemd.services.llama-cpp.serviceConfig.CacheDirectory = "llama-cpp";
+  systemd.services.llama-cpp.environment.HOME = "/var/cache/llama-cpp";
+
   # upstream module hardcodes --log-disable; override ExecStart to keep logs
   # so we can see prompt processing progress via journalctl
   systemd.services.llama-cpp.serviceConfig.ExecStart = lib.mkForce (

From 9addb1569a59cbd207db19a0f936bd6a6ed70b36 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 02:28:26 -0400
Subject: [PATCH 772/847] Revert "llama-cpp: maybe use vulkan?"

This reverts commit 0a927ea893366de32aab1b2ec75e2c0b78911c7c.
---
 flake.lock                       | 12 ++++++------
 flake.nix                        |  3 +--
 services/llama-cpp/llama-cpp.nix |  6 +++---
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/flake.lock b/flake.lock
index f0331e1..f081ed1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,16 +325,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774922513,
-        "narHash": "sha256-TKk1i8AZzxy4/z0MkqKxoGf/CQDvoL+jo8JDtZeCRy8=",
-        "owner": "apollosenvy",
+        "lastModified": 1775236905,
+        "narHash": "sha256-tHshzR/k6D/r5UhJCfJ9b/mJgsbn7ODtnZrDlimhOOI=",
+        "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "9e80e93ceb115bc5055997c373d8c09bfa47a565",
+        "rev": "bc05a6803e48f17e0f2c7a99fce9b50d03882de7",
         "type": "github"
       },
       "original": {
-        "owner": "apollosenvy",
-        "ref": "pr/vulkan-turbo3",
+        "owner": "TheTom",
+        "ref": "feature/turboquant-kv-cache",
         "repo": "llama-cpp-turboquant",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 728fa02..56319ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,8 +29,7 @@
     };
 
     llamacpp = {
-      # url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
-      url = "github:apollosenvy/llama-cpp-turboquant/pr/vulkan-turbo3";
+      url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index f5e64cd..8e77a3d 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -23,10 +23,10 @@ in
     );
     port = service_configs.ports.private.llama_cpp.port;
     host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
     extraFlags = [
-      "-ngl"
-      "999"
+      # "-ngl"
+      # "12"
       "-c"
       "65536"
       "-ctk"

From 6d47f02a0fc2559ffb2de4e5eac9e519d0d97def Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 02:29:37 -0400
Subject: [PATCH 773/847] llama-cpp: set batch size to 4096

---
 services/llama-cpp/llama-cpp.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp/llama-cpp.nix
index 8e77a3d..86d6557 100644
--- a/services/llama-cpp/llama-cpp.nix
+++ b/services/llama-cpp/llama-cpp.nix
@@ -40,6 +40,10 @@ in
       "--metrics"
       "--alias"
       modelAlias
+      "-b"
+      "4096"
+      "-ub"
+      "4096"
     ];
   };
 

From a12dcb01ecd8f719740f39aa6b7bb0217214edea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 12:48:28 -0400
Subject: [PATCH 774/847] llama-cpp: remove folder

---
 configuration.nix                      | 2 +-
 services/{llama-cpp => }/llama-cpp.nix | 0
 services/llama-cpp/default.nix         | 5 -----
 3 files changed, 1 insertion(+), 6 deletions(-)
 rename services/{llama-cpp => }/llama-cpp.nix (100%)
 delete mode 100644 services/llama-cpp/default.nix

diff --git a/configuration.nix b/configuration.nix
index 38d1eaf..90ab278 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp
+    ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix
diff --git a/services/llama-cpp/llama-cpp.nix b/services/llama-cpp.nix
similarity index 100%
rename from services/llama-cpp/llama-cpp.nix
rename to services/llama-cpp.nix
diff --git a/services/llama-cpp/default.nix b/services/llama-cpp/default.nix
deleted file mode 100644
index 0cd110d..0000000
--- a/services/llama-cpp/default.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./llama-cpp.nix
-  ];
-}

From 7afd1f35d290bb92548ab984a770afc72973ab48 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:11:54 -0400
Subject: [PATCH 775/847] xmrig-auto-pause: fix

---
 services/monero/xmrig-auto-pause.nix |  2 +
 services/monero/xmrig-auto-pause.py  | 41 ++++++++++++++-
 tests/xmrig-auto-pause.nix           | 75 +++++++++++++++++++++++++---
 3 files changed, 111 insertions(+), 7 deletions(-)

diff --git a/services/monero/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
index 1d1e79c..4161e34 100644
--- a/services/monero/xmrig-auto-pause.nix
+++ b/services/monero/xmrig-auto-pause.nix
@@ -21,12 +21,14 @@ lib.mkIf config.services.xmrig.enable {
         "AF_UNIX" # systemctl talks to systemd over D-Bus unix socket
       ];
       MemoryDenyWriteExecute = true;
+      StateDirectory = "xmrig-auto-pause";
     };
     environment = {
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "15";
       CPU_THRESHOLD = "5";
       STARTUP_COOLDOWN = "10";
+      STATE_DIR = "/var/lib/xmrig-auto-pause";
     };
   };
 }
diff --git a/services/monero/xmrig-auto-pause.py b/services/monero/xmrig-auto-pause.py
index 85c7ba0..2abd4ac 100644
--- a/services/monero/xmrig-auto-pause.py
+++ b/services/monero/xmrig-auto-pause.py
@@ -35,6 +35,11 @@ CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "5"))
 # RandomX dataset initialization complete (~4s on the target hardware)
 # without retriggering a stop.
 STARTUP_COOLDOWN = float(os.environ.get("STARTUP_COOLDOWN", "10"))
+# Directory for persisting pause state across script restarts.  Without
+# this, a restart while xmrig is paused loses the paused_by_us flag and
+# xmrig stays stopped permanently.
+STATE_DIR = os.environ.get("STATE_DIR", "")
+_PAUSE_FILE = os.path.join(STATE_DIR, "paused") if STATE_DIR else ""
 
 
 def log(msg):
@@ -78,13 +83,36 @@ def systemctl(action, unit):
     return result.returncode == 0
 
 
+def _save_paused(paused):
+    """Persist pause flag so a script restart can resume where we left off."""
+    if not _PAUSE_FILE:
+        return
+    try:
+        if paused:
+            open(_PAUSE_FILE, "w").close()
+        else:
+            os.remove(_PAUSE_FILE)
+    except OSError:
+        pass
+
+
+def _load_paused():
+    """Check if a previous instance left xmrig paused."""
+    if not _PAUSE_FILE:
+        return False
+    return os.path.isfile(_PAUSE_FILE)
+
+
 def main():
-    paused_by_us = False
+    paused_by_us = _load_paused()
     idle_since = None
     started_at = None  # monotonic time when we last started xmrig
     prev_total = None
     prev_work = None
 
+    if paused_by_us:
+        log("Recovered pause state from previous instance")
+
     log(
         f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s "
         f"threshold={CPU_THRESHOLD}% cooldown={STARTUP_COOLDOWN}s"
@@ -116,6 +144,14 @@ def main():
             if time.monotonic() - started_at < STARTUP_COOLDOWN:
                 time.sleep(POLL_INTERVAL)
                 continue
+            # Cooldown expired — verify xmrig survived startup.  If it
+            # crashed during init (hugepage failure, pool unreachable, etc.),
+            # re-enter the pause/retry cycle rather than silently leaving
+            # xmrig dead.
+            if not is_active("xmrig.service"):
+                log("xmrig died during startup cooldown — will retry")
+                paused_by_us = True
+                _save_paused(True)
             started_at = None
 
         busy = real_work_pct > CPU_THRESHOLD
@@ -128,6 +164,7 @@ def main():
                 # manage it again.
                 log("xmrig was restarted externally while paused — reclaiming")
                 paused_by_us = False
+                _save_paused(False)
             if not paused_by_us:
                 # Only claim ownership if xmrig is actually running.
                 # If something else stopped it (e.g. UPS battery hook),
@@ -136,6 +173,7 @@ def main():
                     log(f"Real workload detected ({real_work_pct:.1f}% CPU) — stopping xmrig")
                     if systemctl("stop", "xmrig.service"):
                         paused_by_us = True
+                        _save_paused(True)
         else:
             if paused_by_us:
                 if idle_since is None:
@@ -144,6 +182,7 @@ def main():
                     log(f"Workload ended ({real_work_pct:.1f}% CPU) past grace period — starting xmrig")
                     if systemctl("start", "xmrig.service"):
                         paused_by_us = False
+                        _save_paused(False)
                         started_at = time.monotonic()
                     idle_since = None
 
diff --git a/tests/xmrig-auto-pause.nix b/tests/xmrig-auto-pause.nix
index 20dc7d8..33796e6 100644
--- a/tests/xmrig-auto-pause.nix
+++ b/tests/xmrig-auto-pause.nix
@@ -44,6 +44,7 @@ pkgs.testers.runNixOSTest {
     GRACE_PERIOD = "5"
     CPU_THRESHOLD = "10"
     STARTUP_COOLDOWN = "4"
+    STATE_DIR = "/tmp/xap-state"
 
     def start_cpu_load(name):
         """Start a non-nice CPU burn as a transient systemd unit."""
@@ -55,22 +56,28 @@ pkgs.testers.runNixOSTest {
     def stop_cpu_load(name):
         machine.succeed(f"systemctl stop {name}")
 
-    start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.wait_for_unit("xmrig.service")
-
-    with subtest("Start auto-pause monitor"):
+    def start_monitor(unit_name):
+        """Start the auto-pause monitor as a transient unit."""
         machine.succeed(
-            f"systemd-run --unit=xmrig-auto-pause "
+            f"systemd-run --unit={unit_name} "
             f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
             f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
             f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
             f"--setenv=STARTUP_COOLDOWN={STARTUP_COOLDOWN} "
+            f"--setenv=STATE_DIR={STATE_DIR} "
             f"{PYTHON} {SCRIPT}"
         )
         # Monitor needs two consecutive polls to compute a CPU delta.
         time.sleep(3)
 
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("xmrig.service")
+    machine.succeed(f"mkdir -p {STATE_DIR}")
+
+    with subtest("Start auto-pause monitor"):
+        start_monitor("xmrig-auto-pause")
+
     with subtest("xmrig stays running while system is idle"):
         machine.succeed("systemctl is-active xmrig")
 
@@ -134,5 +141,61 @@ pkgs.testers.runNixOSTest {
 
         stop_cpu_load("cpu-load-4")
         machine.wait_until_succeeds("systemctl is-active xmrig", timeout=20)
+
+    # --- State persistence and crash recovery ---
+    machine.succeed("systemctl stop xmrig-auto-pause")
+
+    with subtest("xmrig recovers after crash during startup cooldown"):
+        machine.succeed(f"rm -rf {STATE_DIR} && mkdir -p {STATE_DIR}")
+        start_monitor("xmrig-auto-pause-crash")
+
+        # Load -> xmrig stops
+        start_cpu_load("cpu-crash")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        # End load -> xmrig restarts after grace period
+        stop_cpu_load("cpu-crash")
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=30)
+
+        # Kill xmrig immediately — simulates crash during startup cooldown.
+        # The script should detect the failure when cooldown expires and
+        # re-enter the retry cycle.
+        machine.succeed("systemctl kill --signal=KILL xmrig")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=5)
+
+        # After cooldown + grace period + restart, xmrig should be back.
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=30)
+
+        machine.succeed("systemctl stop xmrig-auto-pause-crash")
+        machine.succeed("systemctl reset-failed xmrig.service || true")
+        machine.succeed("systemctl start xmrig")
+        machine.wait_for_unit("xmrig.service")
+
+    with subtest("Script restart preserves pause state"):
+        machine.succeed(f"rm -rf {STATE_DIR} && mkdir -p {STATE_DIR}")
+        start_monitor("xmrig-auto-pause-persist")
+
+        # Load -> xmrig stops
+        start_cpu_load("cpu-persist")
+        machine.wait_until_fails("systemctl is-active xmrig", timeout=20)
+
+        # Kill the monitor while xmrig is paused (simulates script crash)
+        machine.succeed("systemctl stop xmrig-auto-pause-persist")
+
+        # State file must exist — the monitor persisted the pause flag
+        machine.succeed(f"test -f {STATE_DIR}/paused")
+
+        # Start a fresh monitor instance (reads state file on startup)
+        start_monitor("xmrig-auto-pause-persist2")
+
+        # End load — the new monitor should pick up the paused state
+        # and restart xmrig after the grace period
+        stop_cpu_load("cpu-persist")
+        machine.wait_until_succeeds("systemctl is-active xmrig", timeout=30)
+
+        # State file should be cleaned up after successful restart
+        machine.fail(f"test -f {STATE_DIR}/paused")
+
+        machine.succeed("systemctl stop xmrig-auto-pause-persist2")
   '';
 }

From 5fa6f37b280610e3ed0f2a636f0ef59b1c6a0b68 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:12:06 -0400
Subject: [PATCH 776/847] llama-cpp: disable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 90ab278..b3a0346 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix

From 960259b0d0b86c32888b604a9f764699edce859c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:12:50 -0400
Subject: [PATCH 777/847] update

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index f081ed1..906bf46 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775077333,
-        "narHash": "sha256-OXcxobt7lBkh1B8AjwreU+24myhtKpqeLfAeIyNLFY8=",
+        "lastModified": 1775425411,
+        "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "49ca96b2714c5931e17401eff87f3edd42d2b0f2",
+        "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
         "type": "github"
       },
       "original": {
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1774858933,
-        "narHash": "sha256-rgHUoE4QhOvK3Rcl9cbuIVdjPjFjfhcTm/uPs8Y7+2w=",
+        "lastModified": 1775494882,
+        "narHash": "sha256-bOUFAWjD95Au+K1LkEhV4u3ulsiVfIXbbOFPxnEgSv8=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "45338aab3013924c75305f5cb3543b9cda993183",
+        "rev": "40970afc8d8f1c122f3d282d3e7329d9faf65bec",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775185059,
-        "narHash": "sha256-3d9gBmLMfI9d5xwfbd9Zr5JwpQzZ27qw9NiRjJ2aB28=",
+        "lastModified": 1775446111,
+        "narHash": "sha256-3W1RFYoJgpC9N7Oezj3r4ILOzBP4LSob8QZV0/vuxhc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f5d7077eb578b9e321b74329bd0625d5569dc90e",
+        "rev": "059dc0e19a275112ba0a396f0d7d2c4cda062d10",
         "type": "github"
       },
       "original": {
@@ -383,11 +383,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774933469,
-        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775002709,
-        "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=",
+        "lastModified": 1775305101,
+        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e",
+        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775095870,
-        "narHash": "sha256-C15ZVObWmLOKOme4VkJru8+1an5xRZE0R0/t3AuIEKM=",
+        "lastModified": 1775444042,
+        "narHash": "sha256-cg19ipIlZaLYgs/5ZPFcDDuOcZlGzfprB5xS4x7bVM4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "8677ae9b6569964e5a27e27abfb707a49a6b827f",
+        "rev": "64c9cc6a274dac7d08c4d53494ffa4acf906e287",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775167783,
-        "narHash": "sha256-Tus994D/cxp3HDFRJ2057eBw5wHJ7EncOXyodiwUCwU=",
+        "lastModified": 1775426970,
+        "narHash": "sha256-MXs6xRTFxCvXnhShHMTCSw70nFeIkY1L20YWXso0xyo=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "74023c1466f7ad7b777a3047d10cca83e005c111",
+        "rev": "00634b20e7c805cffcde71f280324ef6ab45607f",
         "type": "github"
       },
       "original": {

From 3b8aedd5021b4e4c06bff847c6f7aaa6871c17b2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:36:38 -0400
Subject: [PATCH 778/847] fix hardened kernel with nix sandbox

---
 modules/security.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/security.nix b/modules/security.nix
index f1bebcd..52d0a28 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -13,6 +13,12 @@
   # disable coredumps
   systemd.coredump.enable = false;
 
+  # The hardened kernel defaults kernel.unprivileged_userns_clone to 0, which
+  # prevents the Nix sandbox from mapping UIDs/GIDs. Without this, any derivation
+  # that calls `id` in its build phase (e.g. logrotate checkPhase) fails when not
+  # served from the binary cache. See https://github.com/NixOS/nixpkgs/issues/287194
+  security.unprivilegedUsernsClone = true;
+
   services = {
     dbus.implementation = "broker";
     /*

From 655bbda26f0838bbbb5fbfe986a84fbc11bdef94 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:39:32 -0400
Subject: [PATCH 779/847] Revert "update"

This reverts commit 960259b0d0b86c32888b604a9f764699edce859c.
---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 906bf46..f081ed1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775425411,
-        "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
+        "lastModified": 1775077333,
+        "narHash": "sha256-OXcxobt7lBkh1B8AjwreU+24myhtKpqeLfAeIyNLFY8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
+        "rev": "49ca96b2714c5931e17401eff87f3edd42d2b0f2",
         "type": "github"
       },
       "original": {
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775494882,
-        "narHash": "sha256-bOUFAWjD95Au+K1LkEhV4u3ulsiVfIXbbOFPxnEgSv8=",
+        "lastModified": 1774858933,
+        "narHash": "sha256-rgHUoE4QhOvK3Rcl9cbuIVdjPjFjfhcTm/uPs8Y7+2w=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "40970afc8d8f1c122f3d282d3e7329d9faf65bec",
+        "rev": "45338aab3013924c75305f5cb3543b9cda993183",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775446111,
-        "narHash": "sha256-3W1RFYoJgpC9N7Oezj3r4ILOzBP4LSob8QZV0/vuxhc=",
+        "lastModified": 1775185059,
+        "narHash": "sha256-3d9gBmLMfI9d5xwfbd9Zr5JwpQzZ27qw9NiRjJ2aB28=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "059dc0e19a275112ba0a396f0d7d2c4cda062d10",
+        "rev": "f5d7077eb578b9e321b74329bd0625d5569dc90e",
         "type": "github"
       },
       "original": {
@@ -383,11 +383,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1774933469,
+        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775305101,
-        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
+        "lastModified": 1775002709,
+        "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
+        "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775444042,
-        "narHash": "sha256-cg19ipIlZaLYgs/5ZPFcDDuOcZlGzfprB5xS4x7bVM4=",
+        "lastModified": 1775095870,
+        "narHash": "sha256-C15ZVObWmLOKOme4VkJru8+1an5xRZE0R0/t3AuIEKM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "64c9cc6a274dac7d08c4d53494ffa4acf906e287",
+        "rev": "8677ae9b6569964e5a27e27abfb707a49a6b827f",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775426970,
-        "narHash": "sha256-MXs6xRTFxCvXnhShHMTCSw70nFeIkY1L20YWXso0xyo=",
+        "lastModified": 1775167783,
+        "narHash": "sha256-Tus994D/cxp3HDFRJ2057eBw5wHJ7EncOXyodiwUCwU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "00634b20e7c805cffcde71f280324ef6ab45607f",
+        "rev": "74023c1466f7ad7b777a3047d10cca83e005c111",
         "type": "github"
       },
       "original": {

From 4be2eaed353a79501e0c31cbf5d59822ce8d8dc2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 13:40:52 -0400
Subject: [PATCH 780/847] Reapply "update"

This reverts commit 655bbda26f0838bbbb5fbfe986a84fbc11bdef94.
---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index f081ed1..906bf46 100644
--- a/flake.lock
+++ b/flake.lock
@@ -238,11 +238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775077333,
-        "narHash": "sha256-OXcxobt7lBkh1B8AjwreU+24myhtKpqeLfAeIyNLFY8=",
+        "lastModified": 1775425411,
+        "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "49ca96b2714c5931e17401eff87f3edd42d2b0f2",
+        "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
         "type": "github"
       },
       "original": {
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1774858933,
-        "narHash": "sha256-rgHUoE4QhOvK3Rcl9cbuIVdjPjFjfhcTm/uPs8Y7+2w=",
+        "lastModified": 1775494882,
+        "narHash": "sha256-bOUFAWjD95Au+K1LkEhV4u3ulsiVfIXbbOFPxnEgSv8=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "45338aab3013924c75305f5cb3543b9cda993183",
+        "rev": "40970afc8d8f1c122f3d282d3e7329d9faf65bec",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775185059,
-        "narHash": "sha256-3d9gBmLMfI9d5xwfbd9Zr5JwpQzZ27qw9NiRjJ2aB28=",
+        "lastModified": 1775446111,
+        "narHash": "sha256-3W1RFYoJgpC9N7Oezj3r4ILOzBP4LSob8QZV0/vuxhc=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "f5d7077eb578b9e321b74329bd0625d5569dc90e",
+        "rev": "059dc0e19a275112ba0a396f0d7d2c4cda062d10",
         "type": "github"
       },
       "original": {
@@ -383,11 +383,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774933469,
-        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775002709,
-        "narHash": "sha256-d3Yx83vSrN+2z/loBh4mJpyRqr9aAJqlke4TkpFmRJA=",
+        "lastModified": 1775305101,
+        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bcd464ccd2a1a7cd09aa2f8d4ffba83b761b1d0e",
+        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775095870,
-        "narHash": "sha256-C15ZVObWmLOKOme4VkJru8+1an5xRZE0R0/t3AuIEKM=",
+        "lastModified": 1775444042,
+        "narHash": "sha256-cg19ipIlZaLYgs/5ZPFcDDuOcZlGzfprB5xS4x7bVM4=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "8677ae9b6569964e5a27e27abfb707a49a6b827f",
+        "rev": "64c9cc6a274dac7d08c4d53494ffa4acf906e287",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775167783,
-        "narHash": "sha256-Tus994D/cxp3HDFRJ2057eBw5wHJ7EncOXyodiwUCwU=",
+        "lastModified": 1775426970,
+        "narHash": "sha256-MXs6xRTFxCvXnhShHMTCSw70nFeIkY1L20YWXso0xyo=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "74023c1466f7ad7b777a3047d10cca83e005c111",
+        "rev": "00634b20e7c805cffcde71f280324ef6ab45607f",
         "type": "github"
       },
       "original": {

From a76a7969d9c8751c85a0ba0475bcb0ba990e978a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 14:21:31 -0400
Subject: [PATCH 781/847] nix-cache

---
 configuration.nix             |   2 ++
 modules/age-secrets.nix       |  16 ++++++++++++++++
 secrets/harmonia-sign-key.age | Bin 0 -> 351 bytes
 secrets/nix-cache-auth.age    | Bin 0 -> 324 bytes
 service-configs.nix           |   4 ++++
 services/harmonia.nix         |  24 ++++++++++++++++++++++++
 6 files changed, 46 insertions(+)
 create mode 100644 secrets/harmonia-sign-key.age
 create mode 100644 secrets/nix-cache-auth.age
 create mode 100644 services/harmonia.nix

diff --git a/configuration.nix b/configuration.nix
index b3a0346..d2bbb2c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -69,6 +69,8 @@
     ./services/ntfy
 
     ./services/mollysocket.nix
+
+    ./services/harmonia.nix
   ];
 
   # Hosts entries for CI/CD deploy targets
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index 63c612d..26d0ee4 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -167,5 +167,21 @@
       owner = "root";
       group = "root";
     };
+
+    # Harmonia binary cache signing key
+    harmonia-sign-key = {
+      file = ../secrets/harmonia-sign-key.age;
+      mode = "0400";
+      owner = "harmonia";
+      group = "harmonia";
+    };
+
+    # Caddy basic auth for nix binary cache (separate from main caddy_auth)
+    nix-cache-auth = {
+      file = ../secrets/nix-cache-auth.age;
+      mode = "0400";
+      owner = "caddy";
+      group = "caddy";
+    };
   };
 }
diff --git a/secrets/harmonia-sign-key.age b/secrets/harmonia-sign-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..07ea34b29e4897618b7049fbdc8dd2810a2f22e1
GIT binary patch
literal 351
zcmZQ@_Y83kiVO&0sFb-m<=ds!lR+HC9#YL-%exF`oP01T;_s&SyHt}}(-kNCxPAH)
zxI8*kX+E#Xw1{;@^+NA28=PUPv)FdxdJx}6d7Y1<CQWaqE>&8>Fq4nr-?6*L!fr90
z$nRM%cacl##)OV!gR{&f;ri_blA+mCpI+`XwY#zP)QiPDO#5G^|Gm5a`i&f07K^72
z9vq*JUvQ8pR$bh)>9D2YJC;jI=l{5O?cKiO-h>qnPE0fHE*uCsy0$|~Zc@v|i%O5S
zPPwwtvgErz$E<&j%`%R&KX@ecUgTr3wpgo^UZ7uj)+mcDWUadDTtUVdhuYwMN9Gm9
zMKMO5cl~p=@|ORUsmIPu4$iE2zVn*b;?yg<ey>wyW-r!0zS{bR*7IHKcNn!D+B@M;
z?yjGoF00&gcNXwdcAvZLZqADZQ~SMKk5p7&O*&hVsO7L->TIWIR`7w(sng}l{<I~r
NEle_d=y;*@DFE;Ete5}*

literal 0
HcmV?d00001

diff --git a/secrets/nix-cache-auth.age b/secrets/nix-cache-auth.age
new file mode 100644
index 0000000000000000000000000000000000000000..10b7a7ace142b0a5ca57ed174d0dbaff6b5f8f14
GIT binary patch
literal 324
zcmZQ@_Y83kiVO&0=n`IjeZ{rotFPM6Zfo9rS9yEaE&DSwyMAt|c<#D2EWXRha=Y>Q
zJ8d%6@|m;WG;8LFY}UOmX}BpW&9msz27c9BTy~W&TC{qkS(EZVR_MrggqA<BT<rTY
z({#>_Z@WSY?(>yZ<~*)_m+brK%!LP6u0ERcvcxjm%=#v)k%gq7H;cpD^ji_9ja&Z8
zA7I&*-XeSPy^A*cEafiog6J8n1?TQ1UuUuneDh(!Bd15a<>xjTgsaU<x34aGXY<93
z_1c5z1P-h7!i`6F2&Qvi-e#y*CK~A?TvGH+VqW*su!H=W)1!TT+<tf|&(d%>&KG@S
zQf$n-b+@%*oBd<MqXlFw(o{Xqh3au`eDbJZ@9mobDTbE+ZO$#0RNoddS2|UAs$t5{
iQ-%Mzmn}~X+$N`TU(L~<Me+NhKU-Tq{@&4YAsPUAznI|w

literal 0
HcmV?d00001

diff --git a/service-configs.nix b/service-configs.nix
index 1a98996..24d8429 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -189,6 +189,10 @@ rec {
         port = 9563;
         proto = "tcp";
       };
+      harmonia = {
+        port = 5500;
+        proto = "tcp";
+      };
     };
   };
 
diff --git a/services/harmonia.nix b/services/harmonia.nix
new file mode 100644
index 0000000..002735e
--- /dev/null
+++ b/services/harmonia.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceFilePerms "harmonia" [
+      "Z /run/agenix/harmonia-sign-key 0400 harmonia harmonia"
+    ])
+  ];
+
+  services.harmonia = {
+    enable = true;
+    signKeyPaths = [ config.age.secrets.harmonia-sign-key.path ];
+    settings.bind = "127.0.0.1:${toString service_configs.ports.private.harmonia.port}";
+  };
+
+  services.caddy.virtualHosts."nix-cache.${service_configs.https.domain}".extraConfig = ''
+    import ${config.age.secrets.nix-cache-auth.path}
+    reverse_proxy :${toString service_configs.ports.private.harmonia.port}
+  '';
+}

From 274ef40ccc9eadbb29e7c0f57fc3bc9d658b5e9a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 16:02:30 -0400
Subject: [PATCH 782/847] lanzaboote: pin to fork with pcrlock reinstall fix

Upstream PR: https://github.com/nix-community/lanzaboote/pull/566
---
 flake.lock | 11 ++++++-----
 flake.nix  |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 906bf46..b4c21ce 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,15 +304,16 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775494882,
-        "narHash": "sha256-bOUFAWjD95Au+K1LkEhV4u3ulsiVfIXbbOFPxnEgSv8=",
-        "owner": "nix-community",
+        "lastModified": 1775504408,
+        "narHash": "sha256-0OueSEJk/BZlanFXEexVQg2Jy1pGXA2DCO9ZgBkWCTM=",
+        "owner": "Titaniumtown",
         "repo": "lanzaboote",
-        "rev": "40970afc8d8f1c122f3d282d3e7329d9faf65bec",
+        "rev": "ba00703759608f49a094c40d09ed39ed98c2b8bb",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "Titaniumtown",
+        "ref": "pr/fix-pcrlock-reinstall-systemd-boot",
         "repo": "lanzaboote",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 56319ee..74906d6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,7 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
     lanzaboote = {
-      url = "github:nix-community/lanzaboote";
+      url = "github:Titaniumtown/lanzaboote/pr/fix-pcrlock-reinstall-systemd-boot";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

From 738861fd53a2a4cd672368e8fc806da6cd9f79e6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 19:21:20 -0400
Subject: [PATCH 783/847] lanzaboote: fix was upstreamed

---
 flake.lock | 11 +++++------
 flake.nix  |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/flake.lock b/flake.lock
index b4c21ce..940fc46 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,16 +304,15 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775504408,
-        "narHash": "sha256-0OueSEJk/BZlanFXEexVQg2Jy1pGXA2DCO9ZgBkWCTM=",
-        "owner": "Titaniumtown",
+        "lastModified": 1775510693,
+        "narHash": "sha256-gZfJ07j/oOciDi8mF/V8QTm7YCeDcusNSMZzBFi8OUM=",
+        "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "ba00703759608f49a094c40d09ed39ed98c2b8bb",
+        "rev": "3fe0ae8cb285e0ad101a9675f4190d455fb05e85",
         "type": "github"
       },
       "original": {
-        "owner": "Titaniumtown",
-        "ref": "pr/fix-pcrlock-reinstall-systemd-boot",
+        "owner": "nix-community",
         "repo": "lanzaboote",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 74906d6..56319ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,7 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
     lanzaboote = {
-      url = "github:Titaniumtown/lanzaboote/pr/fix-pcrlock-reinstall-systemd-boot";
+      url = "github:nix-community/lanzaboote";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

From d48f27701f7d46f5f66dc8ba6e2a67f7d9fddb51 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 20:33:58 -0400
Subject: [PATCH 784/847] xmrig-auto-pause: add hysteresis to prevent
 stop/start thrashing

xmrig's RandomX pollutes the L3 cache, making other processes appear
~3-8% busier. With a single 5% threshold for both stopping and
resuming, the script oscillates: start xmrig -> cache pressure
inflates CPU -> stop xmrig -> CPU drops -> restart -> repeat.

Split into CPU_STOP_THRESHOLD (15%) and CPU_RESUME_THRESHOLD (5%).
The stop threshold sits above xmrig's indirect pressure, so only
genuine workloads trigger a pause. The resume threshold confirms the
system is truly idle before restarting.
---
 services/monero/xmrig-auto-pause.nix |  3 ++-
 services/monero/xmrig-auto-pause.py  | 37 ++++++++++++++++++++--------
 tests/xmrig-auto-pause.nix           | 13 +++++++---
 3 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/services/monero/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
index 4161e34..758353b 100644
--- a/services/monero/xmrig-auto-pause.nix
+++ b/services/monero/xmrig-auto-pause.nix
@@ -26,7 +26,8 @@ lib.mkIf config.services.xmrig.enable {
     environment = {
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "15";
-      CPU_THRESHOLD = "5";
+      CPU_STOP_THRESHOLD = "15";
+      CPU_RESUME_THRESHOLD = "5";
       STARTUP_COOLDOWN = "10";
       STATE_DIR = "/var/lib/xmrig-auto-pause";
     };
diff --git a/services/monero/xmrig-auto-pause.py b/services/monero/xmrig-auto-pause.py
index 2abd4ac..4e11f84 100644
--- a/services/monero/xmrig-auto-pause.py
+++ b/services/monero/xmrig-auto-pause.py
@@ -4,9 +4,9 @@ Auto-pause xmrig when other services need CPU.
 
 Monitors non-nice CPU usage from /proc/stat. Since xmrig runs at Nice=19,
 its CPU time lands in the 'nice' column and is excluded from the metric.
-When real workload (user + system + irq + softirq) exceeds the threshold,
-stops xmrig. When it drops below threshold for GRACE_PERIOD seconds,
-restarts xmrig.
+When real workload (user + system + irq + softirq) exceeds the stop
+threshold, stops xmrig. When it drops below the resume threshold for
+GRACE_PERIOD seconds, restarts xmrig.
 
 This replaces per-service pause scripts with a single general-purpose
 monitor that handles any CPU-intensive workload (gitea workers, llama-cpp
@@ -18,6 +18,14 @@ Why scheduler priority alone isn't enough:
   the shared 32MB L3 cache, and its memory access pattern saturates DRAM
   bandwidth. Other services run slower even though they aren't denied CPU
   time. The only fix is to stop xmrig entirely when real work is happening.
+
+Hysteresis:
+  The stop threshold is set higher than the resume threshold to prevent
+  oscillation. When xmrig runs, its L3 cache pressure makes other processes
+  appear ~3-8% busier. A single threshold trips on this indirect effect,
+  causing stop/start thrashing. Separate thresholds break the cycle: the
+  resume threshold confirms the system is truly idle, while the stop
+  threshold requires genuine workload above xmrig's indirect pressure.
 """
 
 import os
@@ -29,8 +37,12 @@ POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "3"))
 GRACE_PERIOD = float(os.environ.get("GRACE_PERIOD", "15"))
 # Percentage of total CPU ticks that non-nice processes must use to trigger
 # a pause. On a 12-thread system, one fully loaded core ≈ 8.3% of total.
-# Default 5% catches anything using more than ~60% of a single core.
-CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "5"))
+# Default 15% requires roughly two busy cores, which avoids false positives
+# from xmrig's L3 cache pressure inflating other processes' apparent CPU.
+CPU_STOP_THRESHOLD = float(os.environ.get("CPU_STOP_THRESHOLD", "15"))
+# Percentage below which the system is considered idle enough to resume
+# mining. Lower than the stop threshold to provide hysteresis.
+CPU_RESUME_THRESHOLD = float(os.environ.get("CPU_RESUME_THRESHOLD", "5"))
 # After starting xmrig, ignore CPU spikes for this many seconds to let
 # RandomX dataset initialization complete (~4s on the target hardware)
 # without retriggering a stop.
@@ -115,7 +127,8 @@ def main():
 
     log(
         f"Starting: poll={POLL_INTERVAL}s grace={GRACE_PERIOD}s "
-        f"threshold={CPU_THRESHOLD}% cooldown={STARTUP_COOLDOWN}s"
+        f"stop={CPU_STOP_THRESHOLD}% resume={CPU_RESUME_THRESHOLD}% "
+        f"cooldown={STARTUP_COOLDOWN}s"
     )
 
     while True:
@@ -154,9 +167,10 @@ def main():
                 _save_paused(True)
             started_at = None
 
-        busy = real_work_pct > CPU_THRESHOLD
+        above_stop = real_work_pct > CPU_STOP_THRESHOLD
+        below_resume = real_work_pct <= CPU_RESUME_THRESHOLD
 
-        if busy:
+        if above_stop:
             idle_since = None
             if paused_by_us and is_active("xmrig.service"):
                 # Something else restarted xmrig (deploy, manual start, etc.)
@@ -174,8 +188,8 @@ def main():
                     if systemctl("stop", "xmrig.service"):
                         paused_by_us = True
                         _save_paused(True)
-        else:
-            if paused_by_us:
+        elif paused_by_us:
+            if below_resume:
                 if idle_since is None:
                     idle_since = time.monotonic()
                 elif time.monotonic() - idle_since >= GRACE_PERIOD:
@@ -185,6 +199,9 @@ def main():
                         _save_paused(False)
                         started_at = time.monotonic()
                     idle_since = None
+            else:
+                # Between thresholds — not idle enough to resume.
+                idle_since = None
 
         time.sleep(POLL_INTERVAL)
 
diff --git a/tests/xmrig-auto-pause.nix b/tests/xmrig-auto-pause.nix
index 33796e6..ca52d77 100644
--- a/tests/xmrig-auto-pause.nix
+++ b/tests/xmrig-auto-pause.nix
@@ -39,13 +39,15 @@ pkgs.testers.runNixOSTest {
     # POLL_INTERVAL=1 keeps detection latency low.
     # GRACE_PERIOD=5 is long enough to verify "stays stopped" but short
     # enough that the full test completes in reasonable time.
-    # CPU_THRESHOLD=10 catches a single busy-loop on a 1-2 core VM.
+    # CPU_STOP_THRESHOLD=20 catches a busy-loop on a 1-2 core VM (50-100%)
+    # without triggering from normal VM noise.
+    # CPU_RESUME_THRESHOLD=10 is the idle cutoff for a 1-2 core VM.
     POLL_INTERVAL = "1"
     GRACE_PERIOD = "5"
-    CPU_THRESHOLD = "10"
+    CPU_STOP_THRESHOLD = "20"
+    CPU_RESUME_THRESHOLD = "10"
     STARTUP_COOLDOWN = "4"
     STATE_DIR = "/tmp/xap-state"
-
     def start_cpu_load(name):
         """Start a non-nice CPU burn as a transient systemd unit."""
         machine.succeed(
@@ -62,13 +64,16 @@ pkgs.testers.runNixOSTest {
             f"systemd-run --unit={unit_name} "
             f"--setenv=POLL_INTERVAL={POLL_INTERVAL} "
             f"--setenv=GRACE_PERIOD={GRACE_PERIOD} "
-            f"--setenv=CPU_THRESHOLD={CPU_THRESHOLD} "
+            f"--setenv=CPU_STOP_THRESHOLD={CPU_STOP_THRESHOLD} "
+            f"--setenv=CPU_RESUME_THRESHOLD={CPU_RESUME_THRESHOLD} "
             f"--setenv=STARTUP_COOLDOWN={STARTUP_COOLDOWN} "
             f"--setenv=STATE_DIR={STATE_DIR} "
             f"{PYTHON} {SCRIPT}"
         )
         # Monitor needs two consecutive polls to compute a CPU delta.
         time.sleep(3)
+        # Monitor needs two consecutive polls to compute a CPU delta.
+        time.sleep(3)
 
     start_all()
     machine.wait_for_unit("multi-user.target")

From e57c9cb83b3ff6bda50d55aec997d7afdb5db2b1 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 6 Apr 2026 20:57:08 -0400
Subject: [PATCH 785/847] xmrig-auto-pause: raise thresholds for server
 background load

---
 services/monero/xmrig-auto-pause.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/services/monero/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
index 758353b..3c0190c 100644
--- a/services/monero/xmrig-auto-pause.nix
+++ b/services/monero/xmrig-auto-pause.nix
@@ -26,8 +26,11 @@ lib.mkIf config.services.xmrig.enable {
     environment = {
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "15";
-      CPU_STOP_THRESHOLD = "15";
-      CPU_RESUME_THRESHOLD = "5";
+      # This server's background services (qbittorrent, monero, bazarr, etc.)
+      # produce 5-14% non-nice CPU during normal operation. Thresholds must
+      # sit above that noise floor.
+      CPU_STOP_THRESHOLD = "40";
+      CPU_RESUME_THRESHOLD = "30";
       STARTUP_COOLDOWN = "10";
       STATE_DIR = "/var/lib/xmrig-auto-pause";
     };

From 2848c7e897f32433bd240f965f33f60d473a9a15 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 12:44:46 -0400
Subject: [PATCH 786/847] grafana: keep data forever

---
 services/grafana/prometheus.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/grafana/prometheus.nix b/services/grafana/prometheus.nix
index 4ac8bd5..680ca3d 100644
--- a/services/grafana/prometheus.nix
+++ b/services/grafana/prometheus.nix
@@ -21,7 +21,7 @@ in
     port = service_configs.ports.private.prometheus.port;
     listenAddress = "127.0.0.1";
     stateDir = "prometheus";
-    retentionTime = "90d";
+    retentionTime = "0d"; # 0 disables time-based retention (keep forever)
 
     exporters = {
       node = {

From 0df5d98770ed31fcddbdd170fc89b87552cb981d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 12:44:59 -0400
Subject: [PATCH 787/847] grafana: use postgresql

Doesn't use for data, only annotation and other stuff
---
 services/grafana/grafana.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/services/grafana/grafana.nix b/services/grafana/grafana.nix
index 6d10923..3fd0e13 100644
--- a/services/grafana/grafana.nix
+++ b/services/grafana/grafana.nix
@@ -26,6 +26,12 @@
         root_url = "https://${service_configs.grafana.domain}";
       };
 
+      database = {
+        type = "postgres";
+        host = service_configs.postgres.socket;
+        user = "grafana";
+      };
+
       "auth.anonymous" = {
         enabled = true;
         org_role = "Admin";
@@ -83,4 +89,15 @@
     import ${config.age.secrets.caddy_auth.path}
     reverse_proxy :${toString service_configs.ports.private.grafana.port}
   '';
+
+  services.postgresql = {
+    ensureDatabases = [ "grafana" ];
+    ensureUsers = [
+      {
+        name = "grafana";
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }
+    ];
+  };
 }

From 628c16fe64155ab9fce84595c20bff30938b9d8e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 13:51:19 -0400
Subject: [PATCH 788/847] fix git-crypt key for dotfiles workflow

---
 modules/age-secrets.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index 26d0ee4..d3d8912 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -140,8 +140,8 @@
     git-crypt-key-dotfiles = {
       file = ../secrets/git-crypt-key-dotfiles.age;
       mode = "0400";
-      owner = "root";
-      group = "root";
+      owner = "gitea-runner";
+      group = "gitea-runner";
     };
 
     # Git-crypt symmetric key for server-config repo

From a5c7c91e38ba853f365aea744d0983e27d1885d6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 19:08:08 -0400
Subject: [PATCH 789/847] Power: disable a bunch of things

BROKE intel arc A380 completely because it was forced into L1.1/L1.2
pcie substates. Forcewaking the device would fail and it would never come up.

So I will be more conservative on power saving tuning.
---
 configuration.nix |  7 +++++-
 modules/power.nix | 54 +----------------------------------------------
 2 files changed, 7 insertions(+), 54 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index d2bbb2c..9c83e88 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -120,7 +120,12 @@
     };
   };
 
-  hardware.intelgpu.driver = "xe";
+  # Intel Arc A380 (DG2, 56a5) uses the i915 driver on kernel 6.12.
+  # The xe driver's iHD media driver integration has buffer mapping
+  # failures on this GPU/kernel combination. i915 works correctly for
+  # VAAPI transcode as long as ASPM deep states are disabled for the
+  # GPU (see modules/power.nix).
+  hardware.intelgpu.driver = "i915";
 
   # Per-service 2MB hugepage budget calculated in service-configs.nix.
   boot.kernel.sysctl."vm.nr_hugepages" = service_configs.hugepages_2m.total_pages;
diff --git a/modules/power.nix b/modules/power.nix
index 98e6cda..4cb9469 100644
--- a/modules/power.nix
+++ b/modules/power.nix
@@ -1,12 +1,9 @@
 {
-  lib,
-  pkgs,
   ...
 }:
 {
   powerManagement = {
     enable = true;
-    powertop.enable = true;
     cpuFreqGovernor = "powersave";
   };
 
@@ -29,14 +26,6 @@
     # work items -- irrelevant for a server whose latency-sensitive paths are
     # all in userspace (caddy, jellyfin).
     "workqueue.power_efficient=1"
-
-    # Force PCIe ASPM on even if the BIOS doesn't advertise support. ASRock
-    # B550M Pro4 BIOS defaults are conservative; the Zen 3 root complex and
-    # all downstream devices (NVMe, AHCI, Intel NIC) support L1 substates.
-    # powertop auto-tune sets the policy to powersupersave at runtime, but
-    # without `force` the kernel may refuse to enable ASPM at all if the BIOS
-    # opted out, making the policy write a no-op.
-    "pcie_aspm=force"
   ];
 
   boot.kernel.sysctl = {
@@ -45,49 +34,8 @@
     "kernel.nmi_watchdog" = 0;
   };
 
-  # Server has no audio consumers. Power-gate the HDA codec at module load
-  # rather than waiting for powertop auto-tune to do it after boot.
+  # Server has no audio consumers. Power-gate the HDA codec at module load.
   boot.extraModprobeConfig = ''
     options snd_hda_intel power_save=1 power_save_controller=Y
   '';
-
-  # Apply sysfs power knobs that powertop --auto-tune cannot reach (hardened
-  # kernel blocks debugfs mount, so powertop silently skips ASPM policy and
-  # may only lower EPP to balance_power instead of power).
-  #
-  # AMD pstate EPP "power": deepest P-states, fastest core parking. Safe because:
-  # - xmrig runs at Nice=19 / CPUSchedulingPolicy=idle and tolerates latency
-  # - web services (caddy, jellyfin) are I/O-bound; the ~50 us extra C-state
-  #   exit latency is invisible behind network RTT
-  # - Minecraft server benefits from single-thread boost, which pstate still
-  #   provides on demand even in "power" mode (just with slightly slower ramp)
-  #
-  # ASPM powersupersave: deepest PCIe link power states (L1.1/L1.2). The
-  # pcie_aspm=force boot param enables ASPM, but the runtime policy defaults
-  # to "default" which only uses L0s. powersupersave adds L1 substates for
-  # all downstream devices (NVMe, AHCI, NIC).
-  systemd.services.power-tune = {
-    description = "Apply power-saving sysfs knobs (EPP, ASPM policy)";
-    after = [ "multi-user.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = lib.getExe (
-        pkgs.writeShellApplication {
-          name = "power-tune";
-          text = ''
-            # AMD pstate energy performance preference
-            for epp in /sys/devices/system/cpu/cpu*/cpufreq/energy_performance_preference; do
-              [ -f "$epp" ] && echo power > "$epp"
-            done
-
-            # PCIe ASPM policy
-            aspm=/sys/module/pcie_aspm/parameters/policy
-            [ -f "$aspm" ] && echo powersupersave > "$aspm"
-          '';
-        }
-      );
-    };
-  };
 }

From 88fc219f2d1973601065a5f663bac59216ce8060 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 19:11:50 -0400
Subject: [PATCH 790/847] update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 940fc46..931a4bd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,11 +325,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775236905,
-        "narHash": "sha256-tHshzR/k6D/r5UhJCfJ9b/mJgsbn7ODtnZrDlimhOOI=",
+        "lastModified": 1775603401,
+        "narHash": "sha256-kp+cnqLX+K4M6gBc5Iy4S+G0xkz78qVEcO1xmNTrtgM=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "bc05a6803e48f17e0f2c7a99fce9b50d03882de7",
+        "rev": "a4e8af4455d34d4872f967e615c8212643c2123e",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775446111,
-        "narHash": "sha256-3W1RFYoJgpC9N7Oezj3r4ILOzBP4LSob8QZV0/vuxhc=",
+        "lastModified": 1775531897,
+        "narHash": "sha256-3NIpnV1HxBCwi00iMvj9KcqXkM0VNA72KABj8g0cFFs=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "059dc0e19a275112ba0a396f0d7d2c4cda062d10",
+        "rev": "8c7693880cb861e60adeab5480f02dc3e7a390f6",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775426970,
-        "narHash": "sha256-MXs6xRTFxCvXnhShHMTCSw70nFeIkY1L20YWXso0xyo=",
+        "lastModified": 1775599784,
+        "narHash": "sha256-ZapxbiFEYjJV2nhdowHQ/8+c8Jd5fpBIEKDiPEmyNgI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "00634b20e7c805cffcde71f280324ef6ab45607f",
+        "rev": "6cc71b5b65349081bb713719f5142c200438a327",
         "type": "github"
       },
       "original": {

From 778b04a80f38906c9b103a5ee152e43533d03eda Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 19:12:57 -0400
Subject: [PATCH 791/847] Reapply "llama-cpp: maybe use vulkan?"

This reverts commit 9addb1569a59cbd207db19a0f936bd6a6ed70b36.
---
 flake.lock             | 12 ++++++------
 flake.nix              |  3 ++-
 services/llama-cpp.nix |  6 +++---
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index 931a4bd..f6cc9e2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,16 +325,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1775603401,
-        "narHash": "sha256-kp+cnqLX+K4M6gBc5Iy4S+G0xkz78qVEcO1xmNTrtgM=",
-        "owner": "TheTom",
+        "lastModified": 1774922513,
+        "narHash": "sha256-TKk1i8AZzxy4/z0MkqKxoGf/CQDvoL+jo8JDtZeCRy8=",
+        "owner": "apollosenvy",
         "repo": "llama-cpp-turboquant",
-        "rev": "a4e8af4455d34d4872f967e615c8212643c2123e",
+        "rev": "9e80e93ceb115bc5055997c373d8c09bfa47a565",
         "type": "github"
       },
       "original": {
-        "owner": "TheTom",
-        "ref": "feature/turboquant-kv-cache",
+        "owner": "apollosenvy",
+        "ref": "pr/vulkan-turbo3",
         "repo": "llama-cpp-turboquant",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 56319ee..728fa02 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,7 +29,8 @@
     };
 
     llamacpp = {
-      url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
+      # url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
+      url = "github:apollosenvy/llama-cpp-turboquant/pr/vulkan-turbo3";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 86d6557..1f1d834 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -23,10 +23,10 @@ in
     );
     port = service_configs.ports.private.llama_cpp.port;
     host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.default);
+    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
     extraFlags = [
-      # "-ngl"
-      # "12"
+      "-ngl"
+      "999"
       "-c"
       "65536"
       "-ctk"

From fdc1596bce37fde4ef172206bc62dba704fb224e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 19:15:56 -0400
Subject: [PATCH 792/847] llama-cpp: enable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 9c83e88..6bcd45e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix

From 2884a39eb1a0fbe6f048ceac41642d2c7afd68f5 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 20:04:06 -0400
Subject: [PATCH 793/847] llama-cpp: patch for vulkan support instead

---
 flake.lock                                |  12 +-
 flake.nix                                 |   3 +-
 patches/0002-llamacpp-vulkan-turbo3.patch | 392 ++++++++++++++++++++++
 services/llama-cpp.nix                    |   6 +-
 4 files changed, 404 insertions(+), 9 deletions(-)
 create mode 100644 patches/0002-llamacpp-vulkan-turbo3.patch

diff --git a/flake.lock b/flake.lock
index f6cc9e2..931a4bd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,16 +325,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774922513,
-        "narHash": "sha256-TKk1i8AZzxy4/z0MkqKxoGf/CQDvoL+jo8JDtZeCRy8=",
-        "owner": "apollosenvy",
+        "lastModified": 1775603401,
+        "narHash": "sha256-kp+cnqLX+K4M6gBc5Iy4S+G0xkz78qVEcO1xmNTrtgM=",
+        "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "9e80e93ceb115bc5055997c373d8c09bfa47a565",
+        "rev": "a4e8af4455d34d4872f967e615c8212643c2123e",
         "type": "github"
       },
       "original": {
-        "owner": "apollosenvy",
-        "ref": "pr/vulkan-turbo3",
+        "owner": "TheTom",
+        "ref": "feature/turboquant-kv-cache",
         "repo": "llama-cpp-turboquant",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 728fa02..56319ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,8 +29,7 @@
     };
 
     llamacpp = {
-      # url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
-      url = "github:apollosenvy/llama-cpp-turboquant/pr/vulkan-turbo3";
+      url = "github:TheTom/llama-cpp-turboquant/feature/turboquant-kv-cache";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
diff --git a/patches/0002-llamacpp-vulkan-turbo3.patch b/patches/0002-llamacpp-vulkan-turbo3.patch
new file mode 100644
index 0000000..a8e0f7b
--- /dev/null
+++ b/patches/0002-llamacpp-vulkan-turbo3.patch
@@ -0,0 +1,392 @@
+From 9e80e93ceb115bc5055997c373d8c09bfa47a565 Mon Sep 17 00:00:00 2001
+From: Tuklus-Labs <tuklus@users.noreply.github.com>
+Date: Mon, 30 Mar 2026 07:48:27 -0700
+Subject: [PATCH] feat: Vulkan compute shader support for turbo3 KV cache
+
+Full turbo3 quantize/dequant pipeline for Vulkan backend:
+
+- types.glsl: block_turbo3_0 struct (norm + qs[8] + signs[4])
+- dequant_turbo3_0.comp: standalone dequant shader (3-bit index
+  reconstruction from 2-bit qs + 1-bit signs, centroid lookup)
+- dequant_funcs.glsl: inline dequant for get_rows/mul_mat paths
+- dequant_funcs_cm2.glsl: cooperative matrix 2 FA path support
+- copy_to_quant.comp: quantize function with norm correction
+- vulkan-shaders-gen.cpp: turbo3_0 type registration
+- ggml-vulkan.cpp: pipeline creation and supports_op dispatch
+
+Tested on AMD 7900 XTX (RADV): 243 pp / 25.8 tg t/s with turbo3 KV.
+
+Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
+---
+ ggml/src/ggml-vulkan/ggml-vulkan.cpp          | 13 ++++-
+ .../vulkan-shaders/copy_to_quant.comp         | 58 +++++++++++++++++++
+ .../vulkan-shaders/dequant_funcs.glsl         | 36 ++++++++++++
+ .../vulkan-shaders/dequant_funcs_cm2.glsl     | 29 ++++++++++
+ .../vulkan-shaders/dequant_turbo3_0.comp      | 46 +++++++++++++++
+ .../src/ggml-vulkan/vulkan-shaders/types.glsl | 17 ++++++
+ .../vulkan-shaders/vulkan-shaders-gen.cpp     |  5 +-
+ 7 files changed, 201 insertions(+), 3 deletions(-)
+ create mode 100644 ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
+
+diff --git a/ggml/src/ggml-vulkan/ggml-vulkan.cpp b/ggml/src/ggml-vulkan/ggml-vulkan.cpp
+index 221e6fa04e9..bf826075c11 100644
+--- a/ggml/src/ggml-vulkan/ggml-vulkan.cpp
++++ b/ggml/src/ggml-vulkan/ggml-vulkan.cpp
+@@ -4177,6 +4177,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_IQ4_XS],  "dequant_iq4_xs",  dequant_iq4_xs_len,  dequant_iq4_xs_data,  "main", 2, 5 * sizeof(uint32_t), {256 * 32, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_IQ4_NL],  "dequant_iq4_nl",  dequant_iq4_nl_len,  dequant_iq4_nl_data,  "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_MXFP4],   "dequant_mxfp4",   dequant_mxfp4_len,   dequant_mxfp4_data,   "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
++    ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_TURBO3_0], "dequant_turbo3_0", dequant_turbo3_0_len, dequant_turbo3_0_data, "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
+ 
+     // get_rows
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_F32 ], "get_rows_f32",  get_rows_f32_len,  get_rows_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), { 512, 1, 1}, {}, 1);
+@@ -4202,6 +4203,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_IQ4_XS],  "get_rows_iq4_xs",  get_rows_iq4_xs_len,  get_rows_iq4_xs_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_IQ4_NL],  "get_rows_iq4_nl",  get_rows_iq4_nl_len,  get_rows_iq4_nl_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_MXFP4],   "get_rows_mxfp4",   get_rows_mxfp4_len,   get_rows_mxfp4_data,   "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
++    ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_TURBO3_0], "get_rows_turbo3_0", get_rows_turbo3_0_len, get_rows_turbo3_0_data, "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_I32],     "get_rows_i32",     get_rows_i32_len,     get_rows_i32_data,     "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+ 
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_F32 ], "get_rows_f32_f32",  get_rows_f32_f32_len,  get_rows_f32_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), { 512, 1, 1}, {}, 1);
+@@ -4227,6 +4229,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_IQ4_XS],  "get_rows_iq4_xs_f32",  get_rows_iq4_xs_f32_len,  get_rows_iq4_xs_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_IQ4_NL],  "get_rows_iq4_nl_f32",  get_rows_iq4_nl_f32_len,  get_rows_iq4_nl_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_MXFP4],   "get_rows_mxfp4_f32",   get_rows_mxfp4_f32_len,   get_rows_mxfp4_f32_data,   "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
++    ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_TURBO3_0], "get_rows_turbo3_0_f32", get_rows_turbo3_0_f32_len, get_rows_turbo3_0_f32_data, "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
+ 
+     ggml_vk_create_pipeline(device, device->pipeline_matmul_split_k_reduce, "split_k_reduce", split_k_reduce_len, split_k_reduce_data, "main", 2, 2 * sizeof(uint32_t), {256 * 4, 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_flash_attn_split_k_reduce, "fa_split_k_reduce", fa_split_k_reduce_len, fa_split_k_reduce_data, "main", 3, sizeof(vk_op_flash_attn_split_k_reduce_push_constants), {1, device->subgroup_size, 1}, {device->subgroup_size}, 1, true);
+@@ -4294,6 +4297,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q5_1], "cpy_f32_q5_1", cpy_f32_q5_1_rte_len, cpy_f32_q5_1_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q8_0], "cpy_f32_q8_0", cpy_f32_q8_0_rte_len, cpy_f32_q8_0_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_IQ4_NL], "cpy_f32_iq4_nl", cpy_f32_iq4_nl_rte_len, cpy_f32_iq4_nl_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
++        ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_TURBO3_0], "cpy_f32_turbo3_0", cpy_f32_turbo3_0_rte_len, cpy_f32_turbo3_0_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+     } else {
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q4_0], "cpy_f32_q4_0", cpy_f32_q4_0_len, cpy_f32_q4_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q4_1], "cpy_f32_q4_1", cpy_f32_q4_1_len, cpy_f32_q4_1_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+@@ -4301,6 +4305,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q5_1], "cpy_f32_q5_1", cpy_f32_q5_1_len, cpy_f32_q5_1_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q8_0], "cpy_f32_q8_0", cpy_f32_q8_0_len, cpy_f32_q8_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_IQ4_NL], "cpy_f32_iq4_nl", cpy_f32_iq4_nl_len, cpy_f32_iq4_nl_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
++        ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_TURBO3_0], "cpy_f32_turbo3_0", cpy_f32_turbo3_0_len, cpy_f32_turbo3_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
+     }
+ 
+ #define SET_ROWS(itype, rte) \
+@@ -4312,7 +4317,8 @@ static void ggml_vk_load_shaders(vk_device& device) {
+         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q5_0], "set_rows_q5_0" #itype, set_rows_q5_0 ## itype ## rte ## _len, set_rows_q5_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
+         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q5_1], "set_rows_q5_1" #itype, set_rows_q5_1 ## itype ## rte ## _len, set_rows_q5_1 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
+         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q8_0], "set_rows_q8_0" #itype, set_rows_q8_0 ## itype ## rte ## _len, set_rows_q8_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
+-        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_IQ4_NL], "set_rows_iq4_nl" #itype, set_rows_iq4_nl ## itype ## rte ## _len, set_rows_iq4_nl ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true);
++        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_IQ4_NL], "set_rows_iq4_nl" #itype, set_rows_iq4_nl ## itype ## rte ## _len, set_rows_iq4_nl ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
++        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_TURBO3_0], "set_rows_turbo3_0" #itype, set_rows_turbo3_0 ## itype ## rte ## _len, set_rows_turbo3_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true);
+ 
+     if (device->float_controls_rte_fp16) {
+         SET_ROWS(_i32, _rte)
+@@ -4330,6 +4336,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
+     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_Q5_1], "cpy_q5_1_f32", cpy_q5_1_f32_len, cpy_q5_1_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_Q5_1), 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_Q8_0], "cpy_q8_0_f32", cpy_q8_0_f32_len, cpy_q8_0_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_Q8_0), 1, 1}, {}, 1);
+     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_IQ4_NL], "cpy_iq4_nl_f32", cpy_iq4_nl_f32_len, cpy_iq4_nl_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_IQ4_NL), 1, 1}, {}, 1);
++    ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_TURBO3_0], "cpy_turbo3_0_f32", cpy_turbo3_0_f32_len, cpy_turbo3_0_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_TURBO3_0), 1, 1}, {}, 1);
+ 
+     auto get_suffix = [](bool src0_f16, bool src1_f16, bool dst_f16) {
+         std::string s;
+@@ -15376,6 +15383,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
+                     case GGML_TYPE_IQ4_XS:
+                     case GGML_TYPE_IQ4_NL:
+                     case GGML_TYPE_MXFP4:
++                    case GGML_TYPE_TURBO3_0:
+                     case GGML_TYPE_I32:
+                         return true;
+                     default:
+@@ -15394,6 +15402,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
+                     case GGML_TYPE_Q5_1:
+                     case GGML_TYPE_Q8_0:
+                     case GGML_TYPE_IQ4_NL:
++                    case GGML_TYPE_TURBO3_0:
+                         return true;
+                     default:
+                         return false;
+@@ -15417,6 +15426,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
+                     case GGML_TYPE_Q5_1:
+                     case GGML_TYPE_Q8_0:
+                     case GGML_TYPE_IQ4_NL:
++                    case GGML_TYPE_TURBO3_0:
+                         return true;
+                     default:
+                         break;
+@@ -15431,6 +15441,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
+                     case GGML_TYPE_Q5_1:
+                     case GGML_TYPE_Q8_0:
+                     case GGML_TYPE_IQ4_NL:
++                    case GGML_TYPE_TURBO3_0:
+                         return true;
+                     default:
+                         break;
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp b/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
+index b8c40eec102..54331e28c82 100644
+--- a/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
+@@ -184,6 +184,64 @@ void quantize(uint dst_idx, uint src_idx)
+ }
+ #endif
+ 
++#if defined(DATA_A_TURBO3_0)
++void quantize(uint dst_idx, uint src_idx)
++{
++    const float centroids[8] = float[8](
++        -0.190685, -0.117832, -0.065717, -0.021460,
++         0.021460,  0.065717,  0.117832,  0.190685
++    );
++    const float midpoints[7] = float[7](
++        -0.154259, -0.091775, -0.043589, 0.0, 0.043589, 0.091775, 0.154259
++    );
++
++    // Compute L2 norm
++    float norm_sq = 0.0;
++    [[unroll]] for (int j = 0; j < 32; ++j) {
++        float v = data_s[src_idx + j];
++        norm_sq += v * v;
++    }
++    float norm = sqrt(norm_sq);
++    float inv_norm = (norm > 1e-10) ? (1.0 / norm) : 0.0;
++
++    // Clear output
++    [[unroll]] for (int j = 0; j < 8; ++j) data_q[dst_idx].qs[j] = uint8_t(0);
++    [[unroll]] for (int j = 0; j < 4; ++j) data_q[dst_idx].signs[j] = uint8_t(0);
++
++    // Accumulate centroid reconstruction norm for correction
++    float recon_norm_sq = 0.0;
++
++    // Quantize each element
++    [[unroll]] for (int j = 0; j < 32; ++j) {
++        float val = data_s[src_idx + j] * inv_norm;
++
++        // Find nearest centroid via midpoint comparison
++        uint idx = 0;
++        if      (val < midpoints[0]) idx = 0;
++        else if (val < midpoints[1]) idx = 1;
++        else if (val < midpoints[2]) idx = 2;
++        else if (val < midpoints[3]) idx = 3;
++        else if (val < midpoints[4]) idx = 4;
++        else if (val < midpoints[5]) idx = 5;
++        else if (val < midpoints[6]) idx = 6;
++        else                         idx = 7;
++
++        recon_norm_sq += centroids[idx] * centroids[idx];
++
++        // Pack: low 2 bits to qs, high 1 bit to signs
++        uint low2 = idx & 0x3;
++        uint hi1 = (idx >> 2) & 0x1;
++        data_q[dst_idx].qs[j / 4] |= uint8_t(low2 << ((j % 4) * 2));
++        data_q[dst_idx].signs[j / 8] |= uint8_t(hi1 << (j % 8));
++    }
++
++    // Norm correction: scale so reconstruction matches original norm
++    float recon_norm = sqrt(recon_norm_sq);
++    float corrected_norm = (recon_norm > 1e-10) ? (norm / recon_norm) : norm;
++    data_q[dst_idx].norm = float16_t(corrected_norm);
++}
++#endif
++
+ #if defined(DATA_A_IQ4_NL)
+ uint best_index(float x) {
+     if (x <= kvalues_iq4nl[0]) return 0;
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
+index 7865a6bda79..eefffe9d502 100644
+--- a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
+@@ -602,3 +602,39 @@ vec2 get_dm(uint ib, uint a_offset) {
+     return vec2(1, 0);
+ }
+ #endif
++
++#if defined(DATA_A_TURBO3_0)
++vec2 dequantize(uint ib, uint iqs, uint a_offset) {
++    // PolarQuant 3-bit centroids (Lloyd-Max for Gaussian)
++    const float centroids[8] = float[8](
++        -0.190685, -0.117832, -0.065717, -0.021460,
++         0.021460,  0.065717,  0.117832,  0.190685
++    );
++
++    // iqs is the element index within the block (0..31), we decode 2 consecutive elements
++    const uint j0 = iqs;
++    const uint j1 = iqs + 1;
++
++    // Extract 2-bit low indices from qs (4 per byte)
++    const uint low2_0 = (uint(data_a[a_offset + ib].qs[j0 / 4]) >> ((j0 % 4) * 2)) & 0x3;
++    const uint low2_1 = (uint(data_a[a_offset + ib].qs[j1 / 4]) >> ((j1 % 4) * 2)) & 0x3;
++
++    // Extract 1-bit high from signs (8 per byte)
++    const uint hi1_0 = (uint(data_a[a_offset + ib].signs[j0 / 8]) >> (j0 % 8)) & 0x1;
++    const uint hi1_1 = (uint(data_a[a_offset + ib].signs[j1 / 8]) >> (j1 % 8)) & 0x1;
++
++    // Combine to 3-bit index
++    const uint idx0 = low2_0 | (hi1_0 << 2);
++    const uint idx1 = low2_1 | (hi1_1 << 2);
++
++    return vec2(centroids[idx0], centroids[idx1]);
++}
++vec4 dequantize4(uint ib, uint iqs, uint a_offset) {
++    vec2 v0 = dequantize(ib, iqs, a_offset);
++    vec2 v1 = dequantize(ib, iqs + 2, a_offset);
++    return vec4(v0.x, v0.y, v1.x, v1.y);
++}
++vec2 get_dm(uint ib, uint a_offset) {
++    return vec2(float(data_a[a_offset + ib].norm), 0);
++}
++#endif
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
+index 8ac6482dc94..03d200bd964 100644
+--- a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
+@@ -685,6 +685,33 @@ float16_t dequantFuncMXFP4(const in decodeBufMXFP4 bl, const in uint blockCoords
+ }
+ #endif
+ 
++#if defined(DATA_A_TURBO3_0)
++layout(buffer_reference, std430, buffer_reference_align = 2) buffer decodeBufTURBO3_0 {
++   block_turbo3_0 block;
++};
++
++float16_t dequantFuncTURBO3_0(const in decodeBufTURBO3_0 bl, const in uint blockCoords[2], const in uint coordInBlock[2])
++{
++    const float centroids[8] = float[8](
++        -0.190685, -0.117832, -0.065717, -0.021460,
++         0.021460,  0.065717,  0.117832,  0.190685
++    );
++    const float norm = float(bl.block.norm);
++    const uint j = coordInBlock[1];
++
++    // Extract 2-bit low index from qs (4 per byte)
++    const uint low2 = (uint(bl.block.qs[j / 4]) >> ((j % 4) * 2)) & 0x3;
++
++    // Extract 1-bit high from signs (8 per byte)
++    const uint hi1 = (uint(bl.block.signs[j / 8]) >> (j % 8)) & 0x1;
++
++    // Combine to 3-bit index
++    const uint idx = low2 | (hi1 << 2);
++
++    return float16_t(centroids[idx] * norm);
++}
++#endif
++
+ #if defined(DATA_A_Q4_0)
+ #define dequantFuncA dequantFuncQ4_0
+ #elif defined(DATA_A_Q4_1)
+@@ -729,6 +756,8 @@ float16_t dequantFuncMXFP4(const in decodeBufMXFP4 bl, const in uint blockCoords
+ #define dequantFuncA dequantFuncIQ4_NL
+ #elif defined(DATA_A_MXFP4)
+ #define dequantFuncA dequantFuncMXFP4
++#elif defined(DATA_A_TURBO3_0)
++#define dequantFuncA dequantFuncTURBO3_0
+ #elif defined(DATA_A_F32)
+ #define dequantFuncA dequantFuncF32
+ #endif
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
+new file mode 100644
+index 00000000000..17b9bd9eb4b
+--- /dev/null
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
+@@ -0,0 +1,46 @@
++#version 450
++
++#include "dequant_head.glsl"
++
++layout(local_size_x = 256, local_size_y = 1, local_size_z = 1) in;
++
++layout (binding = 0) readonly buffer A {block_turbo3_0 data_a[];};
++layout (binding = 1) writeonly buffer D {D_TYPE data_b[];};
++
++void main() {
++    const float centroids[8] = float[8](
++        -0.190685, -0.117832, -0.065717, -0.021460,
++         0.021460,  0.065717,  0.117832,  0.190685
++    );
++
++    const uint i = gl_WorkGroupID.x * 4 + gl_LocalInvocationID.x / 64;
++
++    const uint tid = gl_LocalInvocationID.x % 64;
++    const uint il  = tid/32;
++    const uint ir  = tid%32;
++    const uint ib = 32*i + ir;
++    if (ib >= p.nel / 32) {
++        return;
++    }
++
++    const uint b_idx = 1024*i + 32*ir + 16*il;
++
++    const float norm = float(data_a[ib].norm);
++
++    const uint q_start = 16*il;
++
++    [[unroll]] for (uint l = 0; l < 16; ++l) {
++        const uint j = q_start + l;
++
++        // Extract 2-bit low index from qs (4 per byte)
++        const uint low2 = (uint(data_a[ib].qs[j / 4]) >> ((j % 4) * 2)) & 0x3;
++
++        // Extract 1-bit high from signs (8 per byte)
++        const uint hi1 = (uint(data_a[ib].signs[j / 8]) >> (j % 8)) & 0x1;
++
++        // Combine to 3-bit index
++        const uint idx = low2 | (hi1 << 2);
++
++        data_b[b_idx + l] = D_TYPE(centroids[idx] * norm);
++    }
++}
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
+index bdb2c09259b..e3635fa01b7 100644
+--- a/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
+@@ -1696,6 +1696,23 @@ struct block_mxfp4
+ #define A_TYPE block_mxfp4
+ #endif
+ 
++#define QUANT_K_TURBO3_0 32
++#define QUANT_R_TURBO3_0 1
++
++struct block_turbo3_0
++{
++    float16_t norm;
++    uint8_t qs[8];      // 2-bit centroid indices (4 per byte)
++    uint8_t signs[4];   // 1-bit high bit of 3-bit index (8 per byte)
++};
++
++#if defined(DATA_A_TURBO3_0)
++#define QUANT_K QUANT_K_TURBO3_0
++#define QUANT_R QUANT_R_TURBO3_0
++#define QUANT_AUXF 1
++#define A_TYPE block_turbo3_0
++#endif
++
+ #if defined(DATA_A_IQ4_NL) || defined(DATA_A_IQ4_XS)
+ const int8_t kvalues_iq4nl_const[16] = {
+     int8_t(-127), int8_t(-104), int8_t(-83), int8_t(-65), int8_t(-49), int8_t(-35), int8_t(-22), int8_t(-10),
+diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp b/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
+index 8186dba36f6..90253243ab8 100644
+--- a/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
++++ b/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
+@@ -66,6 +66,7 @@ const std::vector<std::string> type_names = {
+     "iq4_nl",
+     "mxfp4",
+     "bf16",
++    "turbo3_0",
+ };
+ 
+ enum MatMulIdType {
+@@ -757,13 +758,13 @@ void process_shaders() {
+     string_to_spv("cpy_transpose_16", "copy_transpose.comp", {{"A_TYPE", "uint16_t"}, {"D_TYPE", "uint16_t"}});
+     string_to_spv("cpy_transpose_32", "copy_transpose.comp", {{"A_TYPE", "uint"}, {"D_TYPE", "uint"}});
+ 
+-    for (std::string t : {"q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl"}) {
++    for (std::string t : {"q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl", "turbo3_0"}) {
+         string_to_spv("cpy_f32_" + t, "copy_to_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
+         string_to_spv("cpy_f32_" + t + "_rte", "copy_to_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}, {"RTE16", "1"}});
+         string_to_spv("cpy_" + t + "_f32", "copy_from_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
+     }
+ 
+-    for (std::string t : {"f32", "f16", "bf16", "q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl"}) {
++    for (std::string t : {"f32", "f16", "bf16", "q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl", "turbo3_0"}) {
+         string_to_spv("set_rows_" + t + "_i32",     "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uint"}, {"B_SIZE", "32"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
+         string_to_spv("set_rows_" + t + "_i32_rte", "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uint"}, {"B_SIZE", "32"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}, {"RTE16", "1"}});
+         string_to_spv("set_rows_" + t + "_i64",     "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uvec2"}, {"B_SIZE", "64"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 1f1d834..cdf9955 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -23,7 +23,11 @@ in
     );
     port = service_configs.ports.private.llama_cpp.port;
     host = "0.0.0.0";
-    package = (lib.optimizePackage inputs.llamacpp.packages.${pkgs.system}.vulkan);
+    package = lib.optimizePackage (
+      inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
+        patches = (old.patches or [ ]) ++ [ ../patches/0002-llamacpp-vulkan-turbo3.patch ];
+      })
+    );
     extraFlags = [
       "-ngl"
       "999"

From 645a532ed70abb5115d5d36416dc3954aef66f23 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 20:23:48 -0400
Subject: [PATCH 794/847] Revert "llama-cpp: enable"

This reverts commit fdc1596bce37fde4ef172206bc62dba704fb224e.
---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 6bcd45e..9c83e88 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix

From 98310f25827b06c6cc8c7ef626ca4f9a4309e096 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 20:57:54 -0400
Subject: [PATCH 795/847] organize patches + add gemma4 patch

---
 flake.nix                                     |  2 +-
 .../0002-llamacpp-vulkan-turbo3.patch         |  0
 .../llamacpp/0003-gemma4-tokenizer-fix.patch  | 88 +++++++++++++++++++
 ...erver-add-postgresql-backend-support.patch |  0
 services/llama-cpp.nix                        |  5 +-
 5 files changed, 93 insertions(+), 2 deletions(-)
 rename patches/{ => llamacpp}/0002-llamacpp-vulkan-turbo3.patch (100%)
 create mode 100644 patches/llamacpp/0003-gemma4-tokenizer-fix.patch
 rename patches/{ => nixpkgs}/0001-firefox-syncserver-add-postgresql-backend-support.patch (100%)

diff --git a/flake.nix b/flake.nix
index 56319ee..38833e4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -123,7 +123,7 @@
         name = "nixpkgs-patched";
         src = nixpkgs;
         patches = [
-          ./patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
+          ./patches/nixpkgs/0001-firefox-syncserver-add-postgresql-backend-support.patch
         ];
       };
 
diff --git a/patches/0002-llamacpp-vulkan-turbo3.patch b/patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
similarity index 100%
rename from patches/0002-llamacpp-vulkan-turbo3.patch
rename to patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
diff --git a/patches/llamacpp/0003-gemma4-tokenizer-fix.patch b/patches/llamacpp/0003-gemma4-tokenizer-fix.patch
new file mode 100644
index 0000000..e01692a
--- /dev/null
+++ b/patches/llamacpp/0003-gemma4-tokenizer-fix.patch
@@ -0,0 +1,88 @@
+From 320c29c2dbe3c8df56374a9ec19a7fe5c124d4f8 Mon Sep 17 00:00:00 2001
+From: Piotr Wilkin <piotr.wilkin@syndatis.com>
+Date: Tue, 7 Apr 2026 00:54:00 +0200
+Subject: [PATCH 1/2] YATF (Yet Another Tokenizer Fix) for Gemma 4. With tests!
+
+---
+ convert_hf_to_gguf_update.py       |   1 +
+ models/ggml-vocab-gemma-4.gguf     | Bin 0 -> 15776467 bytes
+ models/ggml-vocab-gemma-4.gguf.inp | 111 +++++++++++++++++++++++++++++
+ models/ggml-vocab-gemma-4.gguf.out |  46 ++++++++++++
+ src/llama-vocab.cpp                |  13 +++-
+ tests/CMakeLists.txt               |   1 +
+ 6 files changed, 170 insertions(+), 2 deletions(-)
+ create mode 100644 models/ggml-vocab-gemma-4.gguf
+ create mode 100644 models/ggml-vocab-gemma-4.gguf.inp
+ create mode 100644 models/ggml-vocab-gemma-4.gguf.out
+
+diff --git a/convert_hf_to_gguf_update.py b/convert_hf_to_gguf_update.py
+index 086f1c22863..f1d70d62e73 100755
+--- a/convert_hf_to_gguf_update.py
++++ b/convert_hf_to_gguf_update.py
+@@ -114,6 +114,7 @@ class TOKENIZER_TYPE(IntEnum):
+     {"name": "viking",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/LumiOpen/Viking-7B", }, # Also used for Viking 13B and 33B
+     {"name": "gemma",            "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2b", },
+     {"name": "gemma-2",          "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2-9b", },
++    {"name": "gemma-4",          "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/google/gemma-4-E2B-it", },
+     {"name": "jais",             "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/core42/jais-13b", },
+     {"name": "jais-2",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/inceptionai/Jais-2-8B-Chat", },
+     {"name": "t5",               "tokt": TOKENIZER_TYPE.UGM, "repo": "https://huggingface.co/google-t5/t5-small", },
+diff --git a/src/llama-vocab.cpp b/src/llama-vocab.cpp
+index de9a9466bc7..e9e276ab999 100644
+--- a/src/llama-vocab.cpp
++++ b/src/llama-vocab.cpp
+@@ -658,9 +658,18 @@ struct llm_tokenizer_bpe_session {
+                 const auto token = vocab.text_to_token(str);
+ 
+                 if (token == LLAMA_TOKEN_NULL) {
++                    static const char * hex = "0123456789ABCDEF";
+                     for (auto j = str.begin(); j != str.end(); ++j) {
+-                        std::string byte_str(1, *j);
+-                        auto token_multibyte = vocab.text_to_token(byte_str);
++                        llama_token token_multibyte = LLAMA_TOKEN_NULL;
++                        if (tokenizer.byte_encode) {
++                            std::string byte_str(1, *j);
++                            token_multibyte = vocab.text_to_token(byte_str);
++                        } else {
++                            // For non-byte-encoded BPE (e.g. gemma-4), byte tokens use <0xXX> format
++                            const uint8_t ch = (uint8_t)*j;
++                            const char buf[7] = { '<', '0', 'x', hex[ch >> 4], hex[ch & 15], '>', 0 };
++                            token_multibyte = vocab.text_to_token(buf);
++                        }
+                         if (token_multibyte != LLAMA_TOKEN_NULL) {
+                             output.push_back(token_multibyte);
+                         }
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 5e87c8b34e1..cd4bc5ef1d3 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -124,6 +124,7 @@ llama_test(test-tokenizer-0 NAME test-tokenizer-0-command-r         ARGS ${PROJE
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-deepseek-coder    ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-deepseek-coder.gguf)
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-deepseek-llm      ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-deepseek-llm.gguf)
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-falcon            ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-falcon.gguf)
++llama_test(test-tokenizer-0 NAME test-tokenizer-0-gemma-4           ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-gemma-4.gguf)
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-gpt-2             ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-gpt-2.gguf)
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-llama-bpe         ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-llama-bpe.gguf)
+ llama_test(test-tokenizer-0 NAME test-tokenizer-0-llama-spm         ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-llama-spm.gguf)
+
+From 0e98596dec124c6968132ef042c21ccdb20d1304 Mon Sep 17 00:00:00 2001
+From: Piotr Wilkin <piotr.wilkin@syndatis.com>
+Date: Tue, 7 Apr 2026 00:58:08 +0200
+Subject: [PATCH 2/2] Remove unnecessary hash  from update script.
+
+---
+ convert_hf_to_gguf_update.py | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/convert_hf_to_gguf_update.py b/convert_hf_to_gguf_update.py
+index f1d70d62e73..086f1c22863 100755
+--- a/convert_hf_to_gguf_update.py
++++ b/convert_hf_to_gguf_update.py
+@@ -114,7 +114,6 @@ class TOKENIZER_TYPE(IntEnum):
+     {"name": "viking",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/LumiOpen/Viking-7B", }, # Also used for Viking 13B and 33B
+     {"name": "gemma",            "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2b", },
+     {"name": "gemma-2",          "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2-9b", },
+-    {"name": "gemma-4",          "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/google/gemma-4-E2B-it", },
+     {"name": "jais",             "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/core42/jais-13b", },
+     {"name": "jais-2",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/inceptionai/Jais-2-8B-Chat", },
+     {"name": "t5",               "tokt": TOKENIZER_TYPE.UGM, "repo": "https://huggingface.co/google-t5/t5-small", },
diff --git a/patches/0001-firefox-syncserver-add-postgresql-backend-support.patch b/patches/nixpkgs/0001-firefox-syncserver-add-postgresql-backend-support.patch
similarity index 100%
rename from patches/0001-firefox-syncserver-add-postgresql-backend-support.patch
rename to patches/nixpkgs/0001-firefox-syncserver-add-postgresql-backend-support.patch
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index cdf9955..c6056d2 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -25,7 +25,10 @@ in
     host = "0.0.0.0";
     package = lib.optimizePackage (
       inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
-        patches = (old.patches or [ ]) ++ [ ../patches/0002-llamacpp-vulkan-turbo3.patch ];
+        patches = (old.patches or [ ]) ++ [
+          ../patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
+          ../patches/llamacpp/0003-gemma4-tokenizer-fix.patch
+        ];
       })
     );
     extraFlags = [

From c0390af1a4ef5ac5164d2221f0cce2c9a6c7ffd8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 22:29:02 -0400
Subject: [PATCH 796/847] llama-cpp: update

---
 flake.lock                                    |   6 +-
 .../0002-llamacpp-vulkan-turbo3.patch         | 392 ------------------
 services/llama-cpp.nix                        |   1 -
 3 files changed, 3 insertions(+), 396 deletions(-)
 delete mode 100644 patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch

diff --git a/flake.lock b/flake.lock
index 931a4bd..4b64d4f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,11 +325,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775603401,
-        "narHash": "sha256-kp+cnqLX+K4M6gBc5Iy4S+G0xkz78qVEcO1xmNTrtgM=",
+        "lastModified": 1775614184,
+        "narHash": "sha256-OYwr36LLVIeEqccN1mJ2k6vCsFocboCQJnbtne415Ig=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "a4e8af4455d34d4872f967e615c8212643c2123e",
+        "rev": "eea498c42716519e58baf2d9600d2e2b41839255",
         "type": "github"
       },
       "original": {
diff --git a/patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch b/patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
deleted file mode 100644
index a8e0f7b..0000000
--- a/patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
+++ /dev/null
@@ -1,392 +0,0 @@
-From 9e80e93ceb115bc5055997c373d8c09bfa47a565 Mon Sep 17 00:00:00 2001
-From: Tuklus-Labs <tuklus@users.noreply.github.com>
-Date: Mon, 30 Mar 2026 07:48:27 -0700
-Subject: [PATCH] feat: Vulkan compute shader support for turbo3 KV cache
-
-Full turbo3 quantize/dequant pipeline for Vulkan backend:
-
-- types.glsl: block_turbo3_0 struct (norm + qs[8] + signs[4])
-- dequant_turbo3_0.comp: standalone dequant shader (3-bit index
-  reconstruction from 2-bit qs + 1-bit signs, centroid lookup)
-- dequant_funcs.glsl: inline dequant for get_rows/mul_mat paths
-- dequant_funcs_cm2.glsl: cooperative matrix 2 FA path support
-- copy_to_quant.comp: quantize function with norm correction
-- vulkan-shaders-gen.cpp: turbo3_0 type registration
-- ggml-vulkan.cpp: pipeline creation and supports_op dispatch
-
-Tested on AMD 7900 XTX (RADV): 243 pp / 25.8 tg t/s with turbo3 KV.
-
-Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
----
- ggml/src/ggml-vulkan/ggml-vulkan.cpp          | 13 ++++-
- .../vulkan-shaders/copy_to_quant.comp         | 58 +++++++++++++++++++
- .../vulkan-shaders/dequant_funcs.glsl         | 36 ++++++++++++
- .../vulkan-shaders/dequant_funcs_cm2.glsl     | 29 ++++++++++
- .../vulkan-shaders/dequant_turbo3_0.comp      | 46 +++++++++++++++
- .../src/ggml-vulkan/vulkan-shaders/types.glsl | 17 ++++++
- .../vulkan-shaders/vulkan-shaders-gen.cpp     |  5 +-
- 7 files changed, 201 insertions(+), 3 deletions(-)
- create mode 100644 ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
-
-diff --git a/ggml/src/ggml-vulkan/ggml-vulkan.cpp b/ggml/src/ggml-vulkan/ggml-vulkan.cpp
-index 221e6fa04e9..bf826075c11 100644
---- a/ggml/src/ggml-vulkan/ggml-vulkan.cpp
-+++ b/ggml/src/ggml-vulkan/ggml-vulkan.cpp
-@@ -4177,6 +4177,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_IQ4_XS],  "dequant_iq4_xs",  dequant_iq4_xs_len,  dequant_iq4_xs_data,  "main", 2, 5 * sizeof(uint32_t), {256 * 32, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_IQ4_NL],  "dequant_iq4_nl",  dequant_iq4_nl_len,  dequant_iq4_nl_data,  "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_MXFP4],   "dequant_mxfp4",   dequant_mxfp4_len,   dequant_mxfp4_data,   "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
-+    ggml_vk_create_pipeline(device, device->pipeline_dequant[GGML_TYPE_TURBO3_0], "dequant_turbo3_0", dequant_turbo3_0_len, dequant_turbo3_0_data, "main", 2, 5 * sizeof(uint32_t), {256 * 16, 1, 1}, {}, 1);
- 
-     // get_rows
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_F32 ], "get_rows_f32",  get_rows_f32_len,  get_rows_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), { 512, 1, 1}, {}, 1);
-@@ -4202,6 +4203,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_IQ4_XS],  "get_rows_iq4_xs",  get_rows_iq4_xs_len,  get_rows_iq4_xs_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_IQ4_NL],  "get_rows_iq4_nl",  get_rows_iq4_nl_len,  get_rows_iq4_nl_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_MXFP4],   "get_rows_mxfp4",   get_rows_mxfp4_len,   get_rows_mxfp4_data,   "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-+    ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_TURBO3_0], "get_rows_turbo3_0", get_rows_turbo3_0_len, get_rows_turbo3_0_data, "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows[GGML_TYPE_I32],     "get_rows_i32",     get_rows_i32_len,     get_rows_i32_data,     "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
- 
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_F32 ], "get_rows_f32_f32",  get_rows_f32_f32_len,  get_rows_f32_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), { 512, 1, 1}, {}, 1);
-@@ -4227,6 +4229,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_IQ4_XS],  "get_rows_iq4_xs_f32",  get_rows_iq4_xs_f32_len,  get_rows_iq4_xs_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_IQ4_NL],  "get_rows_iq4_nl_f32",  get_rows_iq4_nl_f32_len,  get_rows_iq4_nl_f32_data,  "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_MXFP4],   "get_rows_mxfp4_f32",   get_rows_mxfp4_f32_len,   get_rows_mxfp4_f32_data,   "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
-+    ggml_vk_create_pipeline(device, device->pipeline_get_rows_f32[GGML_TYPE_TURBO3_0], "get_rows_turbo3_0_f32", get_rows_turbo3_0_f32_len, get_rows_turbo3_0_f32_data, "main", 3, sizeof(vk_op_binary_push_constants), {1024, 1, 1}, {}, 1);
- 
-     ggml_vk_create_pipeline(device, device->pipeline_matmul_split_k_reduce, "split_k_reduce", split_k_reduce_len, split_k_reduce_data, "main", 2, 2 * sizeof(uint32_t), {256 * 4, 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_flash_attn_split_k_reduce, "fa_split_k_reduce", fa_split_k_reduce_len, fa_split_k_reduce_data, "main", 3, sizeof(vk_op_flash_attn_split_k_reduce_push_constants), {1, device->subgroup_size, 1}, {device->subgroup_size}, 1, true);
-@@ -4294,6 +4297,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q5_1], "cpy_f32_q5_1", cpy_f32_q5_1_rte_len, cpy_f32_q5_1_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q8_0], "cpy_f32_q8_0", cpy_f32_q8_0_rte_len, cpy_f32_q8_0_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_IQ4_NL], "cpy_f32_iq4_nl", cpy_f32_iq4_nl_rte_len, cpy_f32_iq4_nl_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-+        ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_TURBO3_0], "cpy_f32_turbo3_0", cpy_f32_turbo3_0_rte_len, cpy_f32_turbo3_0_rte_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-     } else {
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q4_0], "cpy_f32_q4_0", cpy_f32_q4_0_len, cpy_f32_q4_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q4_1], "cpy_f32_q4_1", cpy_f32_q4_1_len, cpy_f32_q4_1_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-@@ -4301,6 +4305,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q5_1], "cpy_f32_q5_1", cpy_f32_q5_1_len, cpy_f32_q5_1_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_Q8_0], "cpy_f32_q8_0", cpy_f32_q8_0_len, cpy_f32_q8_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-         ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_IQ4_NL], "cpy_f32_iq4_nl", cpy_f32_iq4_nl_len, cpy_f32_iq4_nl_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-+        ggml_vk_create_pipeline(device, device->pipeline_cpy_f32_quant[GGML_TYPE_TURBO3_0], "cpy_f32_turbo3_0", cpy_f32_turbo3_0_len, cpy_f32_turbo3_0_data, "main", 2, sizeof(vk_op_unary_push_constants), {32, 1, 1}, {}, 1);
-     }
- 
- #define SET_ROWS(itype, rte) \
-@@ -4312,7 +4317,8 @@ static void ggml_vk_load_shaders(vk_device& device) {
-         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q5_0], "set_rows_q5_0" #itype, set_rows_q5_0 ## itype ## rte ## _len, set_rows_q5_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
-         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q5_1], "set_rows_q5_1" #itype, set_rows_q5_1 ## itype ## rte ## _len, set_rows_q5_1 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
-         ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_Q8_0], "set_rows_q8_0" #itype, set_rows_q8_0 ## itype ## rte ## _len, set_rows_q8_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
--        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_IQ4_NL], "set_rows_iq4_nl" #itype, set_rows_iq4_nl ## itype ## rte ## _len, set_rows_iq4_nl ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true);
-+        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_IQ4_NL], "set_rows_iq4_nl" #itype, set_rows_iq4_nl ## itype ## rte ## _len, set_rows_iq4_nl ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true); \
-+        ggml_vk_create_pipeline(device, device->pipeline_set_rows ## itype [GGML_TYPE_TURBO3_0], "set_rows_turbo3_0" #itype, set_rows_turbo3_0 ## itype ## rte ## _len, set_rows_turbo3_0 ## itype ## rte ## _data, "main", 3, sizeof(vk_op_binary_push_constants), {1, 1, 1}, {1}, 1, true);
- 
-     if (device->float_controls_rte_fp16) {
-         SET_ROWS(_i32, _rte)
-@@ -4330,6 +4336,7 @@ static void ggml_vk_load_shaders(vk_device& device) {
-     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_Q5_1], "cpy_q5_1_f32", cpy_q5_1_f32_len, cpy_q5_1_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_Q5_1), 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_Q8_0], "cpy_q8_0_f32", cpy_q8_0_f32_len, cpy_q8_0_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_Q8_0), 1, 1}, {}, 1);
-     ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_IQ4_NL], "cpy_iq4_nl_f32", cpy_iq4_nl_f32_len, cpy_iq4_nl_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_IQ4_NL), 1, 1}, {}, 1);
-+    ggml_vk_create_pipeline(device, device->pipeline_cpy_quant_f32[GGML_TYPE_TURBO3_0], "cpy_turbo3_0_f32", cpy_turbo3_0_f32_len, cpy_turbo3_0_f32_data, "main", 2, sizeof(vk_op_unary_push_constants), {(uint32_t)ggml_blck_size(GGML_TYPE_TURBO3_0), 1, 1}, {}, 1);
- 
-     auto get_suffix = [](bool src0_f16, bool src1_f16, bool dst_f16) {
-         std::string s;
-@@ -15376,6 +15383,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
-                     case GGML_TYPE_IQ4_XS:
-                     case GGML_TYPE_IQ4_NL:
-                     case GGML_TYPE_MXFP4:
-+                    case GGML_TYPE_TURBO3_0:
-                     case GGML_TYPE_I32:
-                         return true;
-                     default:
-@@ -15394,6 +15402,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
-                     case GGML_TYPE_Q5_1:
-                     case GGML_TYPE_Q8_0:
-                     case GGML_TYPE_IQ4_NL:
-+                    case GGML_TYPE_TURBO3_0:
-                         return true;
-                     default:
-                         return false;
-@@ -15417,6 +15426,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
-                     case GGML_TYPE_Q5_1:
-                     case GGML_TYPE_Q8_0:
-                     case GGML_TYPE_IQ4_NL:
-+                    case GGML_TYPE_TURBO3_0:
-                         return true;
-                     default:
-                         break;
-@@ -15431,6 +15441,7 @@ static bool ggml_backend_vk_device_supports_op(ggml_backend_dev_t dev, const ggm
-                     case GGML_TYPE_Q5_1:
-                     case GGML_TYPE_Q8_0:
-                     case GGML_TYPE_IQ4_NL:
-+                    case GGML_TYPE_TURBO3_0:
-                         return true;
-                     default:
-                         break;
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp b/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
-index b8c40eec102..54331e28c82 100644
---- a/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/copy_to_quant.comp
-@@ -184,6 +184,64 @@ void quantize(uint dst_idx, uint src_idx)
- }
- #endif
- 
-+#if defined(DATA_A_TURBO3_0)
-+void quantize(uint dst_idx, uint src_idx)
-+{
-+    const float centroids[8] = float[8](
-+        -0.190685, -0.117832, -0.065717, -0.021460,
-+         0.021460,  0.065717,  0.117832,  0.190685
-+    );
-+    const float midpoints[7] = float[7](
-+        -0.154259, -0.091775, -0.043589, 0.0, 0.043589, 0.091775, 0.154259
-+    );
-+
-+    // Compute L2 norm
-+    float norm_sq = 0.0;
-+    [[unroll]] for (int j = 0; j < 32; ++j) {
-+        float v = data_s[src_idx + j];
-+        norm_sq += v * v;
-+    }
-+    float norm = sqrt(norm_sq);
-+    float inv_norm = (norm > 1e-10) ? (1.0 / norm) : 0.0;
-+
-+    // Clear output
-+    [[unroll]] for (int j = 0; j < 8; ++j) data_q[dst_idx].qs[j] = uint8_t(0);
-+    [[unroll]] for (int j = 0; j < 4; ++j) data_q[dst_idx].signs[j] = uint8_t(0);
-+
-+    // Accumulate centroid reconstruction norm for correction
-+    float recon_norm_sq = 0.0;
-+
-+    // Quantize each element
-+    [[unroll]] for (int j = 0; j < 32; ++j) {
-+        float val = data_s[src_idx + j] * inv_norm;
-+
-+        // Find nearest centroid via midpoint comparison
-+        uint idx = 0;
-+        if      (val < midpoints[0]) idx = 0;
-+        else if (val < midpoints[1]) idx = 1;
-+        else if (val < midpoints[2]) idx = 2;
-+        else if (val < midpoints[3]) idx = 3;
-+        else if (val < midpoints[4]) idx = 4;
-+        else if (val < midpoints[5]) idx = 5;
-+        else if (val < midpoints[6]) idx = 6;
-+        else                         idx = 7;
-+
-+        recon_norm_sq += centroids[idx] * centroids[idx];
-+
-+        // Pack: low 2 bits to qs, high 1 bit to signs
-+        uint low2 = idx & 0x3;
-+        uint hi1 = (idx >> 2) & 0x1;
-+        data_q[dst_idx].qs[j / 4] |= uint8_t(low2 << ((j % 4) * 2));
-+        data_q[dst_idx].signs[j / 8] |= uint8_t(hi1 << (j % 8));
-+    }
-+
-+    // Norm correction: scale so reconstruction matches original norm
-+    float recon_norm = sqrt(recon_norm_sq);
-+    float corrected_norm = (recon_norm > 1e-10) ? (norm / recon_norm) : norm;
-+    data_q[dst_idx].norm = float16_t(corrected_norm);
-+}
-+#endif
-+
- #if defined(DATA_A_IQ4_NL)
- uint best_index(float x) {
-     if (x <= kvalues_iq4nl[0]) return 0;
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
-index 7865a6bda79..eefffe9d502 100644
---- a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs.glsl
-@@ -602,3 +602,39 @@ vec2 get_dm(uint ib, uint a_offset) {
-     return vec2(1, 0);
- }
- #endif
-+
-+#if defined(DATA_A_TURBO3_0)
-+vec2 dequantize(uint ib, uint iqs, uint a_offset) {
-+    // PolarQuant 3-bit centroids (Lloyd-Max for Gaussian)
-+    const float centroids[8] = float[8](
-+        -0.190685, -0.117832, -0.065717, -0.021460,
-+         0.021460,  0.065717,  0.117832,  0.190685
-+    );
-+
-+    // iqs is the element index within the block (0..31), we decode 2 consecutive elements
-+    const uint j0 = iqs;
-+    const uint j1 = iqs + 1;
-+
-+    // Extract 2-bit low indices from qs (4 per byte)
-+    const uint low2_0 = (uint(data_a[a_offset + ib].qs[j0 / 4]) >> ((j0 % 4) * 2)) & 0x3;
-+    const uint low2_1 = (uint(data_a[a_offset + ib].qs[j1 / 4]) >> ((j1 % 4) * 2)) & 0x3;
-+
-+    // Extract 1-bit high from signs (8 per byte)
-+    const uint hi1_0 = (uint(data_a[a_offset + ib].signs[j0 / 8]) >> (j0 % 8)) & 0x1;
-+    const uint hi1_1 = (uint(data_a[a_offset + ib].signs[j1 / 8]) >> (j1 % 8)) & 0x1;
-+
-+    // Combine to 3-bit index
-+    const uint idx0 = low2_0 | (hi1_0 << 2);
-+    const uint idx1 = low2_1 | (hi1_1 << 2);
-+
-+    return vec2(centroids[idx0], centroids[idx1]);
-+}
-+vec4 dequantize4(uint ib, uint iqs, uint a_offset) {
-+    vec2 v0 = dequantize(ib, iqs, a_offset);
-+    vec2 v1 = dequantize(ib, iqs + 2, a_offset);
-+    return vec4(v0.x, v0.y, v1.x, v1.y);
-+}
-+vec2 get_dm(uint ib, uint a_offset) {
-+    return vec2(float(data_a[a_offset + ib].norm), 0);
-+}
-+#endif
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
-index 8ac6482dc94..03d200bd964 100644
---- a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_funcs_cm2.glsl
-@@ -685,6 +685,33 @@ float16_t dequantFuncMXFP4(const in decodeBufMXFP4 bl, const in uint blockCoords
- }
- #endif
- 
-+#if defined(DATA_A_TURBO3_0)
-+layout(buffer_reference, std430, buffer_reference_align = 2) buffer decodeBufTURBO3_0 {
-+   block_turbo3_0 block;
-+};
-+
-+float16_t dequantFuncTURBO3_0(const in decodeBufTURBO3_0 bl, const in uint blockCoords[2], const in uint coordInBlock[2])
-+{
-+    const float centroids[8] = float[8](
-+        -0.190685, -0.117832, -0.065717, -0.021460,
-+         0.021460,  0.065717,  0.117832,  0.190685
-+    );
-+    const float norm = float(bl.block.norm);
-+    const uint j = coordInBlock[1];
-+
-+    // Extract 2-bit low index from qs (4 per byte)
-+    const uint low2 = (uint(bl.block.qs[j / 4]) >> ((j % 4) * 2)) & 0x3;
-+
-+    // Extract 1-bit high from signs (8 per byte)
-+    const uint hi1 = (uint(bl.block.signs[j / 8]) >> (j % 8)) & 0x1;
-+
-+    // Combine to 3-bit index
-+    const uint idx = low2 | (hi1 << 2);
-+
-+    return float16_t(centroids[idx] * norm);
-+}
-+#endif
-+
- #if defined(DATA_A_Q4_0)
- #define dequantFuncA dequantFuncQ4_0
- #elif defined(DATA_A_Q4_1)
-@@ -729,6 +756,8 @@ float16_t dequantFuncMXFP4(const in decodeBufMXFP4 bl, const in uint blockCoords
- #define dequantFuncA dequantFuncIQ4_NL
- #elif defined(DATA_A_MXFP4)
- #define dequantFuncA dequantFuncMXFP4
-+#elif defined(DATA_A_TURBO3_0)
-+#define dequantFuncA dequantFuncTURBO3_0
- #elif defined(DATA_A_F32)
- #define dequantFuncA dequantFuncF32
- #endif
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
-new file mode 100644
-index 00000000000..17b9bd9eb4b
---- /dev/null
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/dequant_turbo3_0.comp
-@@ -0,0 +1,46 @@
-+#version 450
-+
-+#include "dequant_head.glsl"
-+
-+layout(local_size_x = 256, local_size_y = 1, local_size_z = 1) in;
-+
-+layout (binding = 0) readonly buffer A {block_turbo3_0 data_a[];};
-+layout (binding = 1) writeonly buffer D {D_TYPE data_b[];};
-+
-+void main() {
-+    const float centroids[8] = float[8](
-+        -0.190685, -0.117832, -0.065717, -0.021460,
-+         0.021460,  0.065717,  0.117832,  0.190685
-+    );
-+
-+    const uint i = gl_WorkGroupID.x * 4 + gl_LocalInvocationID.x / 64;
-+
-+    const uint tid = gl_LocalInvocationID.x % 64;
-+    const uint il  = tid/32;
-+    const uint ir  = tid%32;
-+    const uint ib = 32*i + ir;
-+    if (ib >= p.nel / 32) {
-+        return;
-+    }
-+
-+    const uint b_idx = 1024*i + 32*ir + 16*il;
-+
-+    const float norm = float(data_a[ib].norm);
-+
-+    const uint q_start = 16*il;
-+
-+    [[unroll]] for (uint l = 0; l < 16; ++l) {
-+        const uint j = q_start + l;
-+
-+        // Extract 2-bit low index from qs (4 per byte)
-+        const uint low2 = (uint(data_a[ib].qs[j / 4]) >> ((j % 4) * 2)) & 0x3;
-+
-+        // Extract 1-bit high from signs (8 per byte)
-+        const uint hi1 = (uint(data_a[ib].signs[j / 8]) >> (j % 8)) & 0x1;
-+
-+        // Combine to 3-bit index
-+        const uint idx = low2 | (hi1 << 2);
-+
-+        data_b[b_idx + l] = D_TYPE(centroids[idx] * norm);
-+    }
-+}
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl b/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
-index bdb2c09259b..e3635fa01b7 100644
---- a/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/types.glsl
-@@ -1696,6 +1696,23 @@ struct block_mxfp4
- #define A_TYPE block_mxfp4
- #endif
- 
-+#define QUANT_K_TURBO3_0 32
-+#define QUANT_R_TURBO3_0 1
-+
-+struct block_turbo3_0
-+{
-+    float16_t norm;
-+    uint8_t qs[8];      // 2-bit centroid indices (4 per byte)
-+    uint8_t signs[4];   // 1-bit high bit of 3-bit index (8 per byte)
-+};
-+
-+#if defined(DATA_A_TURBO3_0)
-+#define QUANT_K QUANT_K_TURBO3_0
-+#define QUANT_R QUANT_R_TURBO3_0
-+#define QUANT_AUXF 1
-+#define A_TYPE block_turbo3_0
-+#endif
-+
- #if defined(DATA_A_IQ4_NL) || defined(DATA_A_IQ4_XS)
- const int8_t kvalues_iq4nl_const[16] = {
-     int8_t(-127), int8_t(-104), int8_t(-83), int8_t(-65), int8_t(-49), int8_t(-35), int8_t(-22), int8_t(-10),
-diff --git a/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp b/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
-index 8186dba36f6..90253243ab8 100644
---- a/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
-+++ b/ggml/src/ggml-vulkan/vulkan-shaders/vulkan-shaders-gen.cpp
-@@ -66,6 +66,7 @@ const std::vector<std::string> type_names = {
-     "iq4_nl",
-     "mxfp4",
-     "bf16",
-+    "turbo3_0",
- };
- 
- enum MatMulIdType {
-@@ -757,13 +758,13 @@ void process_shaders() {
-     string_to_spv("cpy_transpose_16", "copy_transpose.comp", {{"A_TYPE", "uint16_t"}, {"D_TYPE", "uint16_t"}});
-     string_to_spv("cpy_transpose_32", "copy_transpose.comp", {{"A_TYPE", "uint"}, {"D_TYPE", "uint"}});
- 
--    for (std::string t : {"q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl"}) {
-+    for (std::string t : {"q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl", "turbo3_0"}) {
-         string_to_spv("cpy_f32_" + t, "copy_to_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
-         string_to_spv("cpy_f32_" + t + "_rte", "copy_to_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}, {"RTE16", "1"}});
-         string_to_spv("cpy_" + t + "_f32", "copy_from_quant.comp", {{"DATA_A_" + to_uppercase(t), "1"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
-     }
- 
--    for (std::string t : {"f32", "f16", "bf16", "q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl"}) {
-+    for (std::string t : {"f32", "f16", "bf16", "q4_0", "q4_1", "q5_0", "q5_1", "q8_0", "iq4_nl", "turbo3_0"}) {
-         string_to_spv("set_rows_" + t + "_i32",     "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uint"}, {"B_SIZE", "32"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
-         string_to_spv("set_rows_" + t + "_i32_rte", "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uint"}, {"B_SIZE", "32"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}, {"RTE16", "1"}});
-         string_to_spv("set_rows_" + t + "_i64",     "copy_to_quant.comp", {{"SET_ROWS", "1"}, {"DATA_A_" + to_uppercase(t), "1"}, {"B_TYPE", "uvec2"}, {"B_SIZE", "64"}, {"D_TYPE", "float"}, {"FLOAT_TYPE", "float"}});
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index c6056d2..25015c8 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -26,7 +26,6 @@ in
     package = lib.optimizePackage (
       inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
         patches = (old.patches or [ ]) ++ [
-          ../patches/llamacpp/0002-llamacpp-vulkan-turbo3.patch
           ../patches/llamacpp/0003-gemma4-tokenizer-fix.patch
         ];
       })

From 4f41789995ce8c7886c1ccb36f9c42045dca7979 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 7 Apr 2026 22:49:53 -0400
Subject: [PATCH 797/847] Reapply "llama-cpp: enable"

This reverts commit 645a532ed70abb5115d5d36416dc3954aef66f23.
---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 9c83e88..6bcd45e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    # ./services/llama-cpp.nix
+    ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix

From 4f33b16411ff9810ad3b4af0de2605a35ca19b1a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 14:02:53 -0400
Subject: [PATCH 798/847] llama.cpp: thing

---
 flake.lock             |  6 +++---
 services/llama-cpp.nix | 23 +++++++++++++++++++++++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4b64d4f..429d531 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,11 +325,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775614184,
-        "narHash": "sha256-OYwr36LLVIeEqccN1mJ2k6vCsFocboCQJnbtne415Ig=",
+        "lastModified": 1775754125,
+        "narHash": "sha256-4udYhEvii0xPmRiKXYWLhPakPDd1mJppnEFY6uWdv8s=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "eea498c42716519e58baf2d9600d2e2b41839255",
+        "rev": "8590cbff961dbaf1d3a9793fd11d402e248869b9",
         "type": "github"
       },
       "original": {
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 25015c8..b7470f9 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -50,17 +50,40 @@ in
       "4096"
       "-ub"
       "4096"
+      "--parallel"
+      "2"
     ];
   };
 
   # have to do this in order to get vulkan to work
   systemd.services.llama-cpp.serviceConfig.DynamicUser = lib.mkForce false;
 
+  # ANV driver's turbo3 shader compilation exceeds the default 8 MB thread stack.
+  systemd.services.llama-cpp.serviceConfig.LimitSTACK = lib.mkForce "67108864"; # 64 MB soft+hard
+
   # llama-server tries to create ~/.cache; ProtectSystem=strict + impermanent
   # root make /root read-only. Give it a writable cache dir and point HOME there.
   systemd.services.llama-cpp.serviceConfig.CacheDirectory = "llama-cpp";
   systemd.services.llama-cpp.environment.HOME = "/var/cache/llama-cpp";
 
+  # turbo3 KV cache quantization runs a 14-barrier WHT butterfly per 128-element
+  # workgroup in SET_ROWS. With 4 concurrent slots and batch=4096, the combined
+  # GPU dispatch can exceed the default i915 CCS engine preempt timeout (7.5s),
+  # causing GPU HANG -> ErrorDeviceLost. Increase compute engine timeouts.
+  # Note: batch<4096 is not viable -- GDN chunked mode needs a larger compute
+  # buffer at smaller batch sizes, exceeding the A380's 6 GB VRAM.
+  # '+' prefix runs as root regardless of service User=.
+  systemd.services.llama-cpp.serviceConfig.ExecStartPre = [
+    "+${pkgs.writeShellScript "set-gpu-compute-timeout" ''
+      for f in /sys/class/drm/card*/engine/ccs*/preempt_timeout_ms; do
+        [ -w "$f" ] && echo 30000 > "$f"
+      done
+      for f in /sys/class/drm/card*/engine/ccs*/heartbeat_interval_ms; do
+        [ -w "$f" ] && echo 10000 > "$f"
+      done
+    ''}"
+  ];
+
   # upstream module hardcodes --log-disable; override ExecStart to keep logs
   # so we can see prompt processing progress via journalctl
   systemd.services.llama-cpp.serviceConfig.ExecStart = lib.mkForce (

From d1e9c924239044729f386a64a66bc24823ab905c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 14:03:34 -0400
Subject: [PATCH 799/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 429d531..6a0797b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775510693,
-        "narHash": "sha256-gZfJ07j/oOciDi8mF/V8QTm7YCeDcusNSMZzBFi8OUM=",
+        "lastModified": 1775754862,
+        "narHash": "sha256-8y9cz8+cyeA7KtA7+Q3bXjyFJV5nM38Fc0E4qPw7WDk=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "3fe0ae8cb285e0ad101a9675f4190d455fb05e85",
+        "rev": "bea51aaee00688794a877f308007590a6cc8e378",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775531897,
-        "narHash": "sha256-3NIpnV1HxBCwi00iMvj9KcqXkM0VNA72KABj8g0cFFs=",
+        "lastModified": 1775752089,
+        "narHash": "sha256-+psXqZ1SvQw7L8HgCQINmob9zLnvK433b2k080lBPH0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8c7693880cb861e60adeab5480f02dc3e7a390f6",
+        "rev": "1beacd3bdadabfac884dedd56176966c141214d8",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775305101,
-        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
+        "lastModified": 1775595990,
+        "narHash": "sha256-OEf7YqhF9IjJFYZJyuhAypgU+VsRB5lD4DuiMws5Ltc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
+        "rev": "4e92bbcdb030f3b4782be4751dc08e6b6cb6ccf2",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775444042,
-        "narHash": "sha256-cg19ipIlZaLYgs/5ZPFcDDuOcZlGzfprB5xS4x7bVM4=",
+        "lastModified": 1775701952,
+        "narHash": "sha256-xj9u8fz2hTTTELMorqox0hPWrmAvGRnQUEnlj+vCjFo=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "64c9cc6a274dac7d08c4d53494ffa4acf906e287",
+        "rev": "f56f1053ae9f878501d3a8ae1961c73d1d7abce3",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775599784,
-        "narHash": "sha256-ZapxbiFEYjJV2nhdowHQ/8+c8Jd5fpBIEKDiPEmyNgI=",
+        "lastModified": 1775686189,
+        "narHash": "sha256-kzEDJKptaVToSg/wpub0bLjAVRmkYOorjPsNqlpxWdU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "6cc71b5b65349081bb713719f5142c200438a327",
+        "rev": "ce9c0afc3885d0592caa91f0d4359f315ef7428c",
         "type": "github"
       },
       "original": {

From 0d87f9065717b9eadacf4a6df12b7b315cc08f3e Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 14:16:05 -0400
Subject: [PATCH 800/847] gitea: make gitea-runner wait for gitea.service

prevents spam on ntfy
---
 services/gitea-actions-runner.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/services/gitea-actions-runner.nix b/services/gitea-actions-runner.nix
index 748d47b..d47e6ae 100644
--- a/services/gitea-actions-runner.nix
+++ b/services/gitea-actions-runner.nix
@@ -34,8 +34,12 @@
     };
   };
 
-  # Override DynamicUser to use our static gitea-runner user
+  # Override DynamicUser to use our static gitea-runner user, and ensure
+  # the runner doesn't start before the co-located gitea instance is ready
+  # (upstream can't assume locality, so this dependency is ours to add).
   systemd.services."gitea-runner-muffin" = {
+    requires = [ "gitea.service" ];
+    after = [ "gitea.service" ];
     serviceConfig = {
       DynamicUser = lib.mkForce false;
       User = "gitea-runner";

From ae03c2f2882db25f73454c6658be73c860ae81c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 14:44:13 -0400
Subject: [PATCH 801/847] p2pool: don't disable on power loss

p2pool is very light on resources, it's xmrig that should be disabled
---
 services/monero/p2pool.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/services/monero/p2pool.nix b/services/monero/p2pool.nix
index 4550451..2555b1d 100644
--- a/services/monero/p2pool.nix
+++ b/services/monero/p2pool.nix
@@ -33,12 +33,6 @@
     wants = [ "monero.service" ];
   };
 
-  # Stop p2pool on UPS battery to conserve power
-  services.apcupsd.hooks = lib.mkIf config.services.apcupsd.enable {
-    onbattery = "systemctl stop p2pool";
-    offbattery = "systemctl start p2pool";
-  };
-
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.public.p2pool_p2p.port
   ];

From c74d35659541c069fb372e0254841ef867ac6f89 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 14:46:04 -0400
Subject: [PATCH 802/847] xmrig: compile with compiler optimizations

---
 services/monero/xmrig.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/monero/xmrig.nix b/services/monero/xmrig.nix
index 6793f1d..ab3cfbe 100644
--- a/services/monero/xmrig.nix
+++ b/services/monero/xmrig.nix
@@ -11,7 +11,7 @@ in
 {
   services.xmrig = {
     enable = true;
-    package = pkgs.xmrig;
+    package = lib.optimizePackage pkgs.xmrig;
 
     settings = {
       autosave = true;

From 75319256f3b8809e6db7abae41ff8f4b032fcf56 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 19:00:47 -0400
Subject: [PATCH 803/847] lib: add mkCaddyReverseProxy, mkFail2banJail,
 mkGrafanaAnnotationService, extractArrApiKey

---
 modules/lib.nix                            | 103 +++++++++++++++++++++
 services/arr/arr-search.nix                |   6 +-
 services/arr/bazarr.nix                    |  10 +-
 services/arr/jellyseerr.nix                |   8 +-
 services/arr/prowlarr.nix                  |  10 +-
 services/arr/radarr.nix                    |  10 +-
 services/arr/recyclarr.nix                 |   4 +-
 services/arr/sonarr.nix                    |  10 +-
 services/bitmagnet.nix                     |  10 +-
 services/bitwarden.nix                     |  18 +---
 services/firefox-syncserver.nix            |  10 +-
 services/gitea.nix                         |  26 ++----
 services/grafana/grafana.nix               |  10 +-
 services/grafana/jellyfin-annotations.nix  |  36 ++-----
 services/grafana/llama-cpp-annotations.nix |  35 ++-----
 services/immich.nix                        |  27 ++----
 services/llama-cpp.nix                     |  13 +--
 services/matrix/matrix.nix                 |   8 +-
 services/ntfy/ntfy.nix                     |   8 +-
 services/qbittorrent.nix                   |  11 ++-
 services/soulseek.nix                      |   9 +-
 services/syncthing.nix                     |  10 +-
 services/trilium.nix                       |   9 +-
 23 files changed, 221 insertions(+), 180 deletions(-)

diff --git a/modules/lib.nix b/modules/lib.nix
index 7e3160c..85d6b92 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -176,5 +176,108 @@ inputs.nixpkgs.lib.extend (
           after = [ "${serviceName}-file-perms.service" ];
         };
       };
+    # Creates a Caddy virtualHost with reverse_proxy to a local or VPN-namespaced port.
+    # Use `subdomain` for "<name>.${domain}" or `domain` for a full custom domain.
+    # Exactly one of `subdomain` or `domain` must be provided.
+    mkCaddyReverseProxy =
+      {
+        subdomain ? null,
+        domain ? null,
+        port,
+        auth ? false,
+        vpn ? false,
+      }:
+      assert (subdomain != null) != (domain != null);
+      { config, ... }:
+      let
+        vhostDomain = if domain != null then domain else "${subdomain}.${service_configs.https.domain}";
+        upstream =
+          if vpn then
+            "${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString port}"
+          else
+            ":${builtins.toString port}";
+      in
+      {
+        services.caddy.virtualHosts."${vhostDomain}".extraConfig = lib.concatStringsSep "\n" (
+          lib.optional auth "import ${config.age.secrets.caddy_auth.path}" ++ [ "reverse_proxy ${upstream}" ]
+        );
+      };
+
+    # Creates a fail2ban jail with systemd journal backend.
+    # Covers the common pattern: journal-based detection, http/https ports, default thresholds.
+    mkFail2banJail =
+      {
+        name,
+        unitName ? "${name}.service",
+        failregex,
+      }:
+      { ... }:
+      {
+        services.fail2ban.jails.${name} = {
+          enabled = true;
+          settings = {
+            backend = "systemd";
+            port = "http,https";
+            # defaults: maxretry=5, findtime=10m, bantime=10m
+          };
+          filter.Definition = {
+            inherit failregex;
+            ignoreregex = "";
+            journalmatch = "_SYSTEMD_UNIT=${unitName}";
+          };
+        };
+      };
+
+    # Creates a hardened Grafana annotation daemon service.
+    # Provides DynamicUser, sandboxing, state directory, and GRAFANA_URL/STATE_FILE automatically.
+    mkGrafanaAnnotationService =
+      {
+        name,
+        description,
+        script,
+        after ? [ ],
+        environment ? { },
+        loadCredential ? null,
+      }:
+      {
+        systemd.services."${name}-annotations" = {
+          inherit description;
+          after = [
+            "network.target"
+            "grafana.service"
+          ]
+          ++ after;
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            ExecStart = "${pkgs.python3}/bin/python3 ${script}";
+            Restart = "always";
+            RestartSec = "10s";
+            DynamicUser = true;
+            StateDirectory = "${name}-annotations";
+            NoNewPrivileges = true;
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            PrivateTmp = true;
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+            ];
+            MemoryDenyWriteExecute = true;
+          }
+          // lib.optionalAttrs (loadCredential != null) {
+            LoadCredential = loadCredential;
+          };
+          environment = {
+            GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
+            STATE_FILE = "/var/lib/${name}-annotations/state.json";
+          }
+          // environment;
+        };
+      };
+
+    # Shell command to extract an API key from an *arr config.xml file.
+    # Returns a string suitable for $() command substitution in shell scripts.
+    extractArrApiKey =
+      configXmlPath: "${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${configXmlPath}";
   }
 )
diff --git a/services/arr/arr-search.nix b/services/arr/arr-search.nix
index e9af616..81e5867 100644
--- a/services/arr/arr-search.nix
+++ b/services/arr/arr-search.nix
@@ -1,5 +1,6 @@
 {
   pkgs,
+  lib,
   service_configs,
   ...
 }:
@@ -12,7 +13,6 @@ let
 
   curl = "${pkgs.curl}/bin/curl";
   jq = "${pkgs.jq}/bin/jq";
-  grep = "${pkgs.gnugrep}/bin/grep";
 
   # Max items to search per cycle per category (missing + cutoff) per app
   maxPerCycle = 5;
@@ -20,8 +20,8 @@ let
   searchScript = pkgs.writeShellScript "arr-search" ''
     set -euo pipefail
 
-    RADARR_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
-    SONARR_KEY=$(${grep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    RADARR_KEY=$(${lib.extractArrApiKey radarrConfig})
+    SONARR_KEY=$(${lib.extractArrApiKey sonarrConfig})
 
     search_radarr() {
       local endpoint="$1"
diff --git a/services/arr/bazarr.nix b/services/arr/bazarr.nix
index 1c7e0ad..d31b196 100644
--- a/services/arr/bazarr.nix
+++ b/services/arr/bazarr.nix
@@ -16,6 +16,11 @@
     (lib.serviceFilePerms "bazarr" [
       "Z ${service_configs.bazarr.dataDir} 0700 ${config.services.bazarr.user} ${config.services.bazarr.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "bazarr";
+      port = service_configs.ports.private.bazarr.port;
+      auth = true;
+    })
   ];
 
   services.bazarr = {
@@ -23,11 +28,6 @@
     listenPort = service_configs.ports.private.bazarr.port;
   };
 
-  services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.private.bazarr.port}
-  '';
-
   users.users.${config.services.bazarr.user}.extraGroups = [
     service_configs.media_group
   ];
diff --git a/services/arr/jellyseerr.nix b/services/arr/jellyseerr.nix
index ea0223b..70d44c5 100644
--- a/services/arr/jellyseerr.nix
+++ b/services/arr/jellyseerr.nix
@@ -13,6 +13,10 @@
     (lib.serviceFilePerms "jellyseerr" [
       "Z ${service_configs.jellyseerr.configDir} 0700 jellyseerr jellyseerr"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "jellyseerr";
+      port = service_configs.ports.private.jellyseerr.port;
+    })
   ];
 
   services.jellyseerr = {
@@ -36,8 +40,4 @@
 
   users.groups.jellyseerr = { };
 
-  services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = ''
-    # import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.private.jellyseerr.port}
-  '';
 }
diff --git a/services/arr/prowlarr.nix b/services/arr/prowlarr.nix
index 543eb1b..45316ab 100644
--- a/services/arr/prowlarr.nix
+++ b/services/arr/prowlarr.nix
@@ -14,6 +14,12 @@
     (lib.serviceFilePerms "prowlarr" [
       "Z ${service_configs.prowlarr.dataDir} 0700 prowlarr prowlarr"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "prowlarr";
+      port = service_configs.ports.private.prowlarr.port;
+      auth = true;
+      vpn = true;
+    })
   ];
 
   services.prowlarr = {
@@ -51,8 +57,4 @@
     ExecStart = lib.mkForce "${lib.getExe pkgs.prowlarr} -nobrowser -data=${service_configs.prowlarr.dataDir}";
   };
 
-  services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}
-  '';
 }
diff --git a/services/arr/radarr.nix b/services/arr/radarr.nix
index 7a62e52..7a523c3 100644
--- a/services/arr/radarr.nix
+++ b/services/arr/radarr.nix
@@ -16,6 +16,11 @@
     (lib.serviceFilePerms "radarr" [
       "Z ${service_configs.radarr.dataDir} 0700 ${config.services.radarr.user} ${config.services.radarr.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "radarr";
+      port = service_configs.ports.private.radarr.port;
+      auth = true;
+    })
   ];
 
   services.radarr = {
@@ -25,11 +30,6 @@
     settings.update.mechanism = "external";
   };
 
-  services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.private.radarr.port}
-  '';
-
   users.users.${config.services.radarr.user}.extraGroups = [
     service_configs.media_group
   ];
diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 2e96bcc..7b19cbc 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -13,8 +13,8 @@ let
   # Runs as root (via + prefix) after the NixOS module writes config.json.
   # Extracts API keys from radarr/sonarr config.xml and injects them via jq.
   injectApiKeys = pkgs.writeShellScript "recyclarr-inject-api-keys" ''
-    RADARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
-    SONARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    RADARR_KEY=$(${lib.extractArrApiKey radarrConfig})
+    SONARR_KEY=$(${lib.extractArrApiKey sonarrConfig})
     ${pkgs.jq}/bin/jq \
       --arg rk "$RADARR_KEY" \
       --arg sk "$SONARR_KEY" \
diff --git a/services/arr/sonarr.nix b/services/arr/sonarr.nix
index 44dc196..6200dc3 100644
--- a/services/arr/sonarr.nix
+++ b/services/arr/sonarr.nix
@@ -16,6 +16,11 @@
     (lib.serviceFilePerms "sonarr" [
       "Z ${service_configs.sonarr.dataDir} 0700 ${config.services.sonarr.user} ${config.services.sonarr.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "sonarr";
+      port = service_configs.ports.private.sonarr.port;
+      auth = true;
+    })
   ];
 
   systemd.tmpfiles.rules = [
@@ -31,11 +36,6 @@
     settings.update.mechanism = "external";
   };
 
-  services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${builtins.toString service_configs.ports.private.sonarr.port}
-  '';
-
   users.users.${config.services.sonarr.user}.extraGroups = [
     service_configs.media_group
   ];
diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index 9d27503..f59e97a 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -8,6 +8,12 @@
 {
   imports = [
     (lib.vpnNamespaceOpenPort service_configs.ports.private.bitmagnet.port "bitmagnet")
+    (lib.mkCaddyReverseProxy {
+      subdomain = "bitmagnet";
+      port = service_configs.ports.private.bitmagnet.port;
+      auth = true;
+      vpn = true;
+    })
   ];
 
   services.bitmagnet = {
@@ -24,8 +30,4 @@
     };
   };
 
-  services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.bitmagnet.port}
-  '';
 }
diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 18d3f0b..87547a8 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -13,6 +13,10 @@
     (lib.serviceFilePerms "vaultwarden" [
       "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
     ])
+    (lib.mkFail2banJail {
+      name = "vaultwarden";
+      failregex = ''^.*Username or password is incorrect\. Try again\. IP: <HOST>\..*$'';
+    })
   ];
 
   services.vaultwarden = {
@@ -38,18 +42,4 @@
     }
   '';
 
-  # Protect Vaultwarden login from brute force attacks
-  services.fail2ban.jails.vaultwarden = {
-    enabled = true;
-    settings = {
-      backend = "systemd";
-      port = "http,https";
-      # defaults: maxretry=5, findtime=10m, bantime=10m
-    };
-    filter.Definition = {
-      failregex = ''^.*Username or password is incorrect\. Try again\. IP: <HOST>\..*$'';
-      ignoreregex = "";
-      journalmatch = "_SYSTEMD_UNIT=vaultwarden.service";
-    };
-  };
 }
diff --git a/services/firefox-syncserver.nix b/services/firefox-syncserver.nix
index d7f31a6..bc0f656 100644
--- a/services/firefox-syncserver.nix
+++ b/services/firefox-syncserver.nix
@@ -6,6 +6,13 @@
   ...
 }:
 {
+  imports = [
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.firefox_syncserver.domain;
+      port = service_configs.ports.private.firefox_syncserver.port;
+    })
+  ];
+
   services.firefox-syncserver = {
     enable = true;
     database = {
@@ -33,7 +40,4 @@
     ];
   };
 
-  services.caddy.virtualHosts."${service_configs.firefox_syncserver.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.private.firefox_syncserver.port}
-  '';
 }
diff --git a/services/gitea.nix b/services/gitea.nix
index 907abe5..c82fe19 100644
--- a/services/gitea.nix
+++ b/services/gitea.nix
@@ -11,6 +11,14 @@
     (lib.serviceFilePerms "gitea" [
       "Z ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.gitea.domain;
+      port = service_configs.ports.private.gitea.port;
+    })
+    (lib.mkFail2banJail {
+      name = "gitea";
+      failregex = "^.*Failed authentication attempt for .* from <HOST>:.*$";
+    })
   ];
 
   services.gitea = {
@@ -41,10 +49,6 @@
     };
   };
 
-  services.caddy.virtualHosts."${service_configs.gitea.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
-  '';
-
   services.postgresql = {
     ensureDatabases = [ config.services.gitea.user ];
     ensureUsers = [
@@ -58,18 +62,4 @@
 
   services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
 
-  # Protect Gitea login from brute force attacks
-  services.fail2ban.jails.gitea = {
-    enabled = true;
-    settings = {
-      backend = "systemd";
-      port = "http,https";
-      # defaults: maxretry=5, findtime=10m, bantime=10m
-    };
-    filter.Definition = {
-      failregex = "^.*Failed authentication attempt for .* from <HOST>:.*$";
-      ignoreregex = "";
-      journalmatch = "_SYSTEMD_UNIT=gitea.service";
-    };
-  };
 }
diff --git a/services/grafana/grafana.nix b/services/grafana/grafana.nix
index 3fd0e13..a66b772 100644
--- a/services/grafana/grafana.nix
+++ b/services/grafana/grafana.nix
@@ -12,6 +12,11 @@
     (lib.serviceFilePerms "grafana" [
       "Z ${service_configs.grafana.dir} 0700 grafana grafana"
     ])
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.grafana.domain;
+      port = service_configs.ports.private.grafana.port;
+      auth = true;
+    })
   ];
 
   services.grafana = {
@@ -85,11 +90,6 @@
     };
   };
 
-  services.caddy.virtualHosts."${service_configs.grafana.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${toString service_configs.ports.private.grafana.port}
-  '';
-
   services.postgresql = {
     ensureDatabases = [ "grafana" ];
     ensureUsers = [
diff --git a/services/grafana/jellyfin-annotations.nix b/services/grafana/jellyfin-annotations.nix
index 0122b48..f04ac50 100644
--- a/services/grafana/jellyfin-annotations.nix
+++ b/services/grafana/jellyfin-annotations.nix
@@ -1,40 +1,18 @@
 {
   config,
-  pkgs,
   service_configs,
   lib,
   ...
 }:
-lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable) {
-  systemd.services.jellyfin-annotations = {
+lib.mkIf (config.services.grafana.enable && config.services.jellyfin.enable) (
+  lib.mkGrafanaAnnotationService {
+    name = "jellyfin";
     description = "Jellyfin stream annotation service for Grafana";
-    after = [
-      "network.target"
-      "grafana.service"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${pkgs.python3}/bin/python3 ${./jellyfin-annotations.py}";
-      Restart = "always";
-      RestartSec = "10s";
-      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
-      DynamicUser = true;
-      StateDirectory = "jellyfin-annotations";
-      NoNewPrivileges = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      PrivateTmp = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-      ];
-      MemoryDenyWriteExecute = true;
-    };
+    script = ./jellyfin-annotations.py;
     environment = {
       JELLYFIN_URL = "http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}";
-      GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
-      STATE_FILE = "/var/lib/jellyfin-annotations/state.json";
       POLL_INTERVAL = "30";
     };
-  };
-}
+    loadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+  }
+)
diff --git a/services/grafana/llama-cpp-annotations.nix b/services/grafana/llama-cpp-annotations.nix
index 3e60fe7..f4f6440 100644
--- a/services/grafana/llama-cpp-annotations.nix
+++ b/services/grafana/llama-cpp-annotations.nix
@@ -1,39 +1,18 @@
 {
   config,
-  pkgs,
   service_configs,
   lib,
   ...
 }:
-lib.mkIf (config.services.grafana.enable && config.services.llama-cpp.enable) {
-  systemd.services.llama-cpp-annotations = {
+lib.mkIf (config.services.grafana.enable && config.services.llama-cpp.enable) (
+  lib.mkGrafanaAnnotationService {
+    name = "llama-cpp";
     description = "LLM request annotation service for Grafana";
-    after = [
-      "grafana.service"
-      "llama-cpp.service"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${pkgs.python3}/bin/python3 ${./llama-cpp-annotations.py}";
-      Restart = "always";
-      RestartSec = "10s";
-      DynamicUser = true;
-      StateDirectory = "llama-cpp-annotations";
-      NoNewPrivileges = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      PrivateTmp = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-      ];
-      MemoryDenyWriteExecute = true;
-    };
+    script = ./llama-cpp-annotations.py;
+    after = [ "llama-cpp.service" ];
     environment = {
-      GRAFANA_URL = "http://127.0.0.1:${toString service_configs.ports.private.grafana.port}";
-      STATE_FILE = "/var/lib/llama-cpp-annotations/state.json";
       POLL_INTERVAL = "5";
       CPU_THRESHOLD = "50";
     };
-  };
-}
+  }
+)
diff --git a/services/immich.nix b/services/immich.nix
index c01dafe..d522c58 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -16,6 +16,15 @@
     (lib.serviceFilePerms "immich-server" [
       "Z ${config.services.immich.mediaLocation} 0770 ${config.services.immich.user} ${config.services.immich.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "immich";
+      port = service_configs.ports.private.immich.port;
+    })
+    (lib.mkFail2banJail {
+      name = "immich";
+      unitName = "immich-server.service";
+      failregex = "^.*Failed login attempt for user .* from ip address <HOST>.*$";
+    })
   ];
 
   services.immich = {
@@ -29,10 +38,6 @@
     };
   };
 
-  services.caddy.virtualHosts."immich.${service_configs.https.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString config.services.immich.port}
-  '';
-
   environment.systemPackages = with pkgs; [
     immich-go
   ];
@@ -42,18 +47,4 @@
     "render"
   ];
 
-  # Protect Immich login from brute force attacks
-  services.fail2ban.jails.immich = {
-    enabled = true;
-    settings = {
-      backend = "systemd";
-      port = "http,https";
-      # defaults: maxretry=5, findtime=10m, bantime=10m
-    };
-    filter.Definition = {
-      failregex = "^.*Failed login attempt for user .* from ip address <HOST>.*$";
-      ignoreregex = "";
-      journalmatch = "_SYSTEMD_UNIT=immich-server.service";
-    };
-  };
 }
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index b7470f9..78f931f 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -13,6 +13,13 @@ let
   modelAlias = lib.removeSuffix ".gguf" (baseNameOf modelUrl);
 in
 {
+  imports = [
+    (lib.mkCaddyReverseProxy {
+      subdomain = "llm";
+      port = service_configs.ports.private.llama_cpp.port;
+    })
+  ];
+
   services.llama-cpp = {
     enable = true;
     model = toString (
@@ -94,10 +101,4 @@ in
     + " ${utils.escapeSystemdExecArgs cfg.extraFlags}"
   );
 
-  # Auth handled by llama-cpp --api-key-file (Bearer token).
-  # No caddy_auth — the API key is the auth layer, and caddy_auth's basic
-  # auth would block Bearer-only clients like oh-my-pi.
-  services.caddy.virtualHosts."llm.${service_configs.https.domain}".extraConfig = ''
-    reverse_proxy :${toString config.services.llama-cpp.port}
-  '';
 }
diff --git a/services/matrix/matrix.nix b/services/matrix/matrix.nix
index c8952d8..fea48c3 100644
--- a/services/matrix/matrix.nix
+++ b/services/matrix/matrix.nix
@@ -12,6 +12,10 @@
     (lib.serviceFilePerms "continuwuity" [
       "Z /var/lib/private/continuwuity 0770 ${config.services.matrix-continuwuity.user} ${config.services.matrix-continuwuity.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.matrix.domain;
+      port = service_configs.ports.private.matrix.port;
+    })
   ];
 
   services.matrix-continuwuity = {
@@ -53,10 +57,6 @@
     respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}`
   '';
 
-  services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.private.matrix.port}
-  '';
-
   # Exact duplicate for federation port
   services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.matrix_federation.port}".extraConfig =
     config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
diff --git a/services/ntfy/ntfy.nix b/services/ntfy/ntfy.nix
index ef26330..a9a8a88 100644
--- a/services/ntfy/ntfy.nix
+++ b/services/ntfy/ntfy.nix
@@ -12,6 +12,10 @@
     (lib.serviceFilePerms "ntfy-sh" [
       "Z /var/lib/private/ntfy-sh 0700 ${config.services.ntfy-sh.user} ${config.services.ntfy-sh.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.ntfy.domain;
+      port = service_configs.ports.private.ntfy.port;
+    })
   ];
 
   services.ntfy-sh = {
@@ -27,8 +31,4 @@
     };
   };
 
-  services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString service_configs.ports.private.ntfy.port}
-  '';
-
 }
diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 0b12874..666385d 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -27,6 +27,12 @@ in
       "z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
       "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "torrent";
+      port = service_configs.ports.private.torrent.port;
+      auth = true;
+      vpn = true;
+    })
   ];
 
   services.qbittorrent = {
@@ -156,11 +162,6 @@ in
     _: path: "d ${path} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group} -"
   ) service_configs.torrent.categories;
 
-  services.caddy.virtualHosts."torrent.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString config.services.qbittorrent.webuiPort}
-  '';
-
   users.users.${config.services.qbittorrent.user}.extraGroups = [
     service_configs.media_group
   ];
diff --git a/services/soulseek.nix b/services/soulseek.nix
index f8c4f62..5f93360 100644
--- a/services/soulseek.nix
+++ b/services/soulseek.nix
@@ -19,6 +19,10 @@
       "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
       "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "soulseek";
+      port = service_configs.ports.private.soulseek_web.port;
+    })
   ];
 
   users.groups."music" = { };
@@ -58,11 +62,6 @@
   users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
   users.users.${username}.extraGroups = [ "music" ];
 
-  # doesn't work with auth????
-  services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
-    reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
-  '';
-
   networking.firewall.allowedTCPPorts = [
     service_configs.ports.public.soulseek_listen.port
   ];
diff --git a/services/syncthing.nix b/services/syncthing.nix
index 6200737..0166579 100644
--- a/services/syncthing.nix
+++ b/services/syncthing.nix
@@ -17,6 +17,11 @@
       "Z ${service_configs.syncthing.signalBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
       "Z ${service_configs.syncthing.grayjayBackupDir} 0750 ${config.services.syncthing.user} ${config.services.syncthing.group}"
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "syncthing";
+      port = service_configs.ports.private.syncthing_gui.port;
+      auth = true;
+    })
   ];
 
   services.syncthing = {
@@ -49,9 +54,4 @@
     ];
   };
 
-  services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${toString service_configs.ports.private.syncthing_gui.port}
-  '';
-
 }
diff --git a/services/trilium.nix b/services/trilium.nix
index 758154a..8959e32 100644
--- a/services/trilium.nix
+++ b/services/trilium.nix
@@ -10,6 +10,11 @@
     (lib.serviceMountWithZpool "trilium-server" service_configs.zpool_ssds [
       (service_configs.services_dir + "/trilium")
     ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "notes";
+      port = service_configs.ports.private.trilium.port;
+      auth = true;
+    })
   ];
 
   services.trilium-server = {
@@ -19,8 +24,4 @@
     dataDir = service_configs.trilium.dataDir;
   };
 
-  services.caddy.virtualHosts."notes.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.caddy_auth.path}
-    reverse_proxy :${toString service_configs.ports.private.trilium.port}
-  '';
 }

From a3a670010621bd4d63d477df016c199a7bafd2c8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 19:15:54 -0400
Subject: [PATCH 804/847] grafana: replace disk-usage-collector with
 prometheus-zfs-exporter

The custom disk-usage-collector shell script + minutely timer is replaced
by prometheus-zfs-exporter (pdf/zfs_exporter, packaged in nixpkgs as
services.prometheus.exporters.zfs). The exporter provides pool capacity
metrics (allocated/free/size) natively.

Partition metrics (/boot, /persistent, /nix) now use node_exporter's
built-in filesystem collector (node_filesystem_*_bytes) which already
runs and collects these metrics.

Also fixes a latent race condition in serviceMountWithZpool: the -mounts
service now orders after zfs-mount.service (which runs 'zfs mount -a'),
not just after pool import. Without this, the mount check could run
before datasets are actually mounted.
---
 modules/lib.nix                           |  8 +++--
 service-configs.nix                       |  4 +++
 services/grafana/dashboard.nix            | 10 +++---
 services/grafana/default.nix              |  1 -
 services/grafana/disk-usage-collector.nix | 38 --------------------
 services/grafana/disk-usage-collector.sh  | 44 -----------------------
 services/grafana/prometheus.nix           | 12 +++++++
 7 files changed, 27 insertions(+), 90 deletions(-)
 delete mode 100644 services/grafana/disk-usage-collector.nix
 delete mode 100644 services/grafana/disk-usage-collector.sh

diff --git a/modules/lib.nix b/modules/lib.nix
index 85d6b92..2d85360 100644
--- a/modules/lib.nix
+++ b/modules/lib.nix
@@ -59,8 +59,12 @@ inputs.nixpkgs.lib.extend (
       { pkgs, config, ... }:
       {
         systemd.services."${serviceName}-mounts" = {
-          wants = [ "zfs.target" ] ++ lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
-          after = lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
+          wants = [
+            "zfs.target"
+            "zfs-mount.service"
+          ]
+          ++ lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
+          after = [ "zfs-mount.service" ] ++ lib.optionals (zpool != "") [ "zfs-import-${zpool}.service" ];
           before = [ "${serviceName}.service" ];
 
           serviceConfig = {
diff --git a/service-configs.nix b/service-configs.nix
index 24d8429..4cb200d 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -189,6 +189,10 @@ rec {
         port = 9563;
         proto = "tcp";
       };
+      prometheus_zfs = {
+        port = 9134;
+        proto = "tcp";
+      };
       harmonia = {
         port = 5500;
         proto = "tcp";
diff --git a/services/grafana/dashboard.nix b/services/grafana/dashboard.nix
index 94d84c1..89ea472 100644
--- a/services/grafana/dashboard.nix
+++ b/services/grafana/dashboard.nix
@@ -613,13 +613,13 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "zpool_used_bytes{pool=\"tank\"} / zpool_size_bytes{pool=\"tank\"} * 100";
+            expr = "zfs_pool_allocated_bytes{pool=\"tank\"} / zfs_pool_size_bytes{pool=\"tank\"} * 100";
             legendFormat = "tank";
             refId = "A";
           }
           {
             datasource = promDs;
-            expr = "zpool_used_bytes{pool=\"hdds\"} / zpool_size_bytes{pool=\"hdds\"} * 100";
+            expr = "zfs_pool_allocated_bytes{pool=\"hdds\"} / zfs_pool_size_bytes{pool=\"hdds\"} * 100";
             legendFormat = "hdds";
             refId = "B";
           }
@@ -653,19 +653,19 @@ let
         targets = [
           {
             datasource = promDs;
-            expr = "partition_used_bytes{mount=\"/boot\"} / partition_size_bytes{mount=\"/boot\"} * 100";
+            expr = "(node_filesystem_size_bytes{mountpoint=\"/boot\"} - node_filesystem_avail_bytes{mountpoint=\"/boot\"}) / node_filesystem_size_bytes{mountpoint=\"/boot\"} * 100";
             legendFormat = "/boot";
             refId = "A";
           }
           {
             datasource = promDs;
-            expr = "partition_used_bytes{mount=\"/persistent\"} / partition_size_bytes{mount=\"/persistent\"} * 100";
+            expr = "(node_filesystem_size_bytes{mountpoint=\"/persistent\"} - node_filesystem_avail_bytes{mountpoint=\"/persistent\"}) / node_filesystem_size_bytes{mountpoint=\"/persistent\"} * 100";
             legendFormat = "/persistent";
             refId = "B";
           }
           {
             datasource = promDs;
-            expr = "partition_used_bytes{mount=\"/nix\"} / partition_size_bytes{mount=\"/nix\"} * 100";
+            expr = "(node_filesystem_size_bytes{mountpoint=\"/nix\"} - node_filesystem_avail_bytes{mountpoint=\"/nix\"}) / node_filesystem_size_bytes{mountpoint=\"/nix\"} * 100";
             legendFormat = "/nix";
             refId = "C";
           }
diff --git a/services/grafana/default.nix b/services/grafana/default.nix
index ec4fb98..9985459 100644
--- a/services/grafana/default.nix
+++ b/services/grafana/default.nix
@@ -5,7 +5,6 @@
     ./dashboard.nix
     ./exporters.nix
     ./jellyfin-annotations.nix
-    ./disk-usage-collector.nix
     ./llama-cpp-annotations.nix
     ./zfs-scrub-annotations.nix
   ];
diff --git a/services/grafana/disk-usage-collector.nix b/services/grafana/disk-usage-collector.nix
deleted file mode 100644
index 9170b36..0000000
--- a/services/grafana/disk-usage-collector.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  textfileDir = "/var/lib/prometheus-node-exporter-textfiles";
-
-  diskUsageCollector = pkgs.writeShellApplication {
-    name = "disk-usage-collector";
-    runtimeInputs = with pkgs; [
-      coreutils
-      gawk
-      config.boot.zfs.package
-      util-linux # for mountpoint
-    ];
-    text = builtins.readFile ./disk-usage-collector.sh;
-  };
-in
-lib.mkIf config.services.grafana.enable {
-  systemd.services.disk-usage-collector = {
-    description = "Collect ZFS pool and partition usage metrics for Prometheus";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe diskUsageCollector;
-    };
-    environment.TEXTFILE = "${textfileDir}/disk-usage.prom";
-  };
-
-  systemd.timers.disk-usage-collector = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "minutely";
-      RandomizedDelaySec = "10s";
-    };
-  };
-}
diff --git a/services/grafana/disk-usage-collector.sh b/services/grafana/disk-usage-collector.sh
deleted file mode 100644
index 3874b53..0000000
--- a/services/grafana/disk-usage-collector.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# Collects ZFS pool utilization and boot partition usage for Prometheus textfile collector
-set -euo pipefail
-
-TEXTFILE="${TEXTFILE:?TEXTFILE env required}"
-TMP="${TEXTFILE}.$$"
-
-{
-  echo '# HELP zpool_size_bytes Total size of ZFS pool in bytes'
-  echo '# TYPE zpool_size_bytes gauge'
-  echo '# HELP zpool_used_bytes Used space in ZFS pool in bytes'
-  echo '# TYPE zpool_used_bytes gauge'
-  echo '# HELP zpool_free_bytes Free space in ZFS pool in bytes'
-  echo '# TYPE zpool_free_bytes gauge'
-
-  # -Hp: scripting mode, parseable, bytes
-  zpool list -Hp -o name,size,alloc,free | while IFS=$'\t' read -r name size alloc free; do
-    echo "zpool_size_bytes{pool=\"${name}\"} ${size}"
-    echo "zpool_used_bytes{pool=\"${name}\"} ${alloc}"
-    echo "zpool_free_bytes{pool=\"${name}\"} ${free}"
-  done
-
-  echo '# HELP partition_size_bytes Total size of partition in bytes'
-  echo '# TYPE partition_size_bytes gauge'
-  echo '# HELP partition_used_bytes Used space on partition in bytes'
-  echo '# TYPE partition_used_bytes gauge'
-  echo '# HELP partition_free_bytes Free space on partition in bytes'
-  echo '# TYPE partition_free_bytes gauge'
-
-  # Boot drive partitions: /boot (ESP), /persistent, /nix
-  # Use df with 1K blocks and convert to bytes
-  for mount in /boot /persistent /nix; do
-    if mountpoint -q "$mount" 2>/dev/null; then
-      read -r size used avail _ <<< "$(df -k --output=size,used,avail "$mount" | tail -1)"
-      size_b=$((size * 1024))
-      used_b=$((used * 1024))
-      avail_b=$((avail * 1024))
-      echo "partition_size_bytes{mount=\"${mount}\"} ${size_b}"
-      echo "partition_used_bytes{mount=\"${mount}\"} ${used_b}"
-      echo "partition_free_bytes{mount=\"${mount}\"} ${avail_b}"
-    fi
-  done
-} > "$TMP"
-mv "$TMP" "$TEXTFILE"
diff --git a/services/grafana/prometheus.nix b/services/grafana/prometheus.nix
index 680ca3d..634de9b 100644
--- a/services/grafana/prometheus.nix
+++ b/services/grafana/prometheus.nix
@@ -44,6 +44,12 @@ in
         listenAddress = "127.0.0.1";
         apcupsdAddress = "127.0.0.1:3551";
       };
+
+      zfs = {
+        enable = true;
+        port = service_configs.ports.private.prometheus_zfs.port;
+        listenAddress = "127.0.0.1";
+      };
     };
 
     scrapeConfigs = [
@@ -89,6 +95,12 @@ in
           { targets = [ "127.0.0.1:${toString service_configs.ports.private.igpu_exporter.port}" ]; }
         ];
       }
+      {
+        job_name = "zfs";
+        static_configs = [
+          { targets = [ "127.0.0.1:${toString service_configs.ports.private.prometheus_zfs.port}" ]; }
+        ];
+      }
     ];
   };
 

From e9ce1ce0a24cbc72b3ace3508023cee74c91a271 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 19:19:58 -0400
Subject: [PATCH 805/847] grafana: replace llama-cpp-annotations daemon with
 prometheus query

---
 services/grafana/dashboard.nix             |  11 +-
 services/grafana/default.nix               |   1 -
 services/grafana/llama-cpp-annotations.nix |  18 ---
 services/grafana/llama-cpp-annotations.py  | 155 ---------------------
 tests/llama-cpp-annotations.nix            | 132 ------------------
 tests/mock-llama-server-proc.py            |  42 ------
 tests/tests.nix                            |   3 -
 7 files changed, 4 insertions(+), 358 deletions(-)
 delete mode 100644 services/grafana/llama-cpp-annotations.nix
 delete mode 100644 services/grafana/llama-cpp-annotations.py
 delete mode 100644 tests/llama-cpp-annotations.nix
 delete mode 100644 tests/mock-llama-server-proc.py

diff --git a/services/grafana/dashboard.nix b/services/grafana/dashboard.nix
index 89ea472..7f2ff07 100644
--- a/services/grafana/dashboard.nix
+++ b/services/grafana/dashboard.nix
@@ -50,15 +50,12 @@ let
       }
       {
         name = "LLM Requests";
-        datasource = {
-          type = "grafana";
-          uid = "-- Grafana --";
-        };
+        datasource = promDs;
         enable = true;
         iconColor = "purple";
-        showIn = 0;
-        type = "tags";
-        tags = [ "llama-cpp" ];
+        expr = "llamacpp:requests_processing > 0";
+        step = "10s";
+        titleFormat = "LLM inference";
       }
     ];
 
diff --git a/services/grafana/default.nix b/services/grafana/default.nix
index 9985459..b6a4bd7 100644
--- a/services/grafana/default.nix
+++ b/services/grafana/default.nix
@@ -5,7 +5,6 @@
     ./dashboard.nix
     ./exporters.nix
     ./jellyfin-annotations.nix
-    ./llama-cpp-annotations.nix
     ./zfs-scrub-annotations.nix
   ];
 }
diff --git a/services/grafana/llama-cpp-annotations.nix b/services/grafana/llama-cpp-annotations.nix
deleted file mode 100644
index f4f6440..0000000
--- a/services/grafana/llama-cpp-annotations.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  config,
-  service_configs,
-  lib,
-  ...
-}:
-lib.mkIf (config.services.grafana.enable && config.services.llama-cpp.enable) (
-  lib.mkGrafanaAnnotationService {
-    name = "llama-cpp";
-    description = "LLM request annotation service for Grafana";
-    script = ./llama-cpp-annotations.py;
-    after = [ "llama-cpp.service" ];
-    environment = {
-      POLL_INTERVAL = "5";
-      CPU_THRESHOLD = "50";
-    };
-  }
-)
diff --git a/services/grafana/llama-cpp-annotations.py b/services/grafana/llama-cpp-annotations.py
deleted file mode 100644
index 6da2c6c..0000000
--- a/services/grafana/llama-cpp-annotations.py
+++ /dev/null
@@ -1,155 +0,0 @@
-#!/usr/bin/env python3
-"""
-Grafana annotation service for llama-cpp inference requests.
-
-Monitors llama-server CPU usage via /proc. Creates a Grafana annotation
-when inference starts (CPU spikes), closes it when inference ends.
-"""
-
-import glob
-import json
-import os
-import sys
-import time
-import urllib.request
-
-GRAFANA_URL = os.environ.get("GRAFANA_URL", "http://127.0.0.1:3000")
-STATE_FILE = os.environ.get("STATE_FILE", "/var/lib/llama-cpp-annotations/state.json")
-POLL_INTERVAL = int(os.environ.get("POLL_INTERVAL", "5"))
-CPU_THRESHOLD = float(os.environ.get("CPU_THRESHOLD", "50"))
-
-
-def find_llama_pid():
-    for path in glob.glob("/proc/[0-9]*/comm"):
-        try:
-            with open(path) as f:
-                if f.read().strip() == "llama-server":
-                    return int(path.split("/")[2])
-        except (OSError, ValueError):
-            continue
-    return None
-
-
-def get_cpu_times(pid):
-    try:
-        with open(f"/proc/{pid}/stat") as f:
-            fields = f.read().split(")")[-1].split()
-            return int(fields[11]) + int(fields[12])
-    except (OSError, IndexError, ValueError):
-        return None
-
-
-def http_json(method, url, body=None):
-    data = json.dumps(body).encode() if body is not None else None
-    req = urllib.request.Request(
-        url,
-        data=data,
-        headers={"Content-Type": "application/json", "Accept": "application/json"},
-        method=method,
-    )
-    with urllib.request.urlopen(req, timeout=5) as resp:
-        return json.loads(resp.read())
-
-
-def load_state():
-    try:
-        with open(STATE_FILE) as f:
-            return json.load(f)
-    except (FileNotFoundError, json.JSONDecodeError):
-        return {}
-
-
-def save_state(state):
-    os.makedirs(os.path.dirname(STATE_FILE), exist_ok=True)
-    tmp = STATE_FILE + ".tmp"
-    with open(tmp, "w") as f:
-        json.dump(state, f)
-    os.replace(tmp, STATE_FILE)
-
-
-def grafana_post(text, start_ms):
-    try:
-        result = http_json(
-            "POST",
-            f"{GRAFANA_URL}/api/annotations",
-            {"time": start_ms, "text": text, "tags": ["llama-cpp"]},
-        )
-        return result.get("id")
-    except Exception as e:
-        print(f"Error posting annotation: {e}", file=sys.stderr)
-        return None
-
-
-def grafana_close(grafana_id, end_ms, text=None):
-    try:
-        body = {"timeEnd": end_ms}
-        if text is not None:
-            body["text"] = text
-        http_json(
-            "PATCH",
-            f"{GRAFANA_URL}/api/annotations/{grafana_id}",
-            body,
-        )
-    except Exception as e:
-        print(f"Error closing annotation {grafana_id}: {e}", file=sys.stderr)
-
-
-def main():
-    state = load_state()
-    prev_ticks = None
-    prev_time = None
-    hz = os.sysconf("SC_CLK_TCK")
-
-    while True:
-        now_ms = int(time.time() * 1000)
-        pid = find_llama_pid()
-
-        if pid is None:
-            prev_ticks = None
-            prev_time = None
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        ticks = get_cpu_times(pid)
-        now = time.monotonic()
-
-        if ticks is None or prev_ticks is None or prev_time is None:
-            prev_ticks = ticks
-            prev_time = now
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        dt = now - prev_time
-        if dt <= 0:
-            prev_ticks = ticks
-            prev_time = now
-            time.sleep(POLL_INTERVAL)
-            continue
-
-        cpu_pct = ((ticks - prev_ticks) / hz) / dt * 100
-        prev_ticks = ticks
-        prev_time = now
-
-        busy = cpu_pct > CPU_THRESHOLD
-
-        if busy and "active" not in state:
-            grafana_id = grafana_post("LLM request", now_ms)
-            if grafana_id is not None:
-                state["active"] = {
-                    "grafana_id": grafana_id,
-                    "start_ms": now_ms,
-                }
-                save_state(state)
-
-        elif not busy and "active" in state:
-            info = state.pop("active")
-            duration_s = (now_ms - info["start_ms"]) / 1000
-            text = f"LLM request ({duration_s:.1f}s)"
-            grafana_close(info["grafana_id"], now_ms, text)
-            save_state(state)
-
-        time.sleep(POLL_INTERVAL)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/tests/llama-cpp-annotations.nix b/tests/llama-cpp-annotations.nix
deleted file mode 100644
index 4dbc077..0000000
--- a/tests/llama-cpp-annotations.nix
+++ /dev/null
@@ -1,132 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-let
-  mockGrafana = ./mock-grafana-server.py;
-  script = ../services/grafana/llama-cpp-annotations.py;
-  python = pkgs.python3;
-
-  mockLlamaProcess = ./mock-llama-server-proc.py;
-in
-pkgs.testers.runNixOSTest {
-  name = "llama-cpp-annotations";
-
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [
-        pkgs.python3
-        pkgs.curl
-        pkgs.procps
-      ];
-    };
-
-  testScript = ''
-    import json
-    import time
-
-    GRAFANA_PORT = 13000
-    ANNOTS_FILE = "/tmp/annotations.json"
-    LLAMA_STATE = "/tmp/llama-state.txt"
-    STATE_FILE = "/tmp/llama-annot-state.json"
-    PYTHON = "${python}/bin/python3"
-    MOCK_GRAFANA = "${mockGrafana}"
-    MOCK_LLAMA = "${mockLlamaProcess}"
-    SCRIPT = "${script}"
-
-    def read_annotations():
-        out = machine.succeed(f"cat {ANNOTS_FILE} 2>/dev/null || echo '[]'")
-        return json.loads(out.strip())
-
-    def set_busy():
-        machine.succeed(f"echo busy > {LLAMA_STATE}")
-
-    def set_idle():
-        machine.succeed(f"echo idle > {LLAMA_STATE}")
-
-    start_all()
-    machine.wait_for_unit("multi-user.target")
-
-    with subtest("Start mock services"):
-        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
-        machine.succeed(
-            f"systemd-run --unit=mock-grafana {PYTHON} {MOCK_GRAFANA} {GRAFANA_PORT} {ANNOTS_FILE}"
-        )
-        machine.succeed(
-            f"systemd-run --unit=mock-llama {PYTHON} {MOCK_LLAMA} {LLAMA_STATE}"
-        )
-        machine.wait_until_succeeds(
-            f"curl -sf http://127.0.0.1:{GRAFANA_PORT}/api/annotations -X POST "
-            f"-H 'Content-Type: application/json' -d '{{\"text\":\"ping\",\"tags\":[]}}' | grep -q id",
-            timeout=10,
-        )
-        machine.wait_until_succeeds(
-            "pgrep -x llama-server",
-            timeout=10,
-        )
-        machine.succeed(f"echo '[]' > {ANNOTS_FILE}")
-
-    with subtest("Start annotation service"):
-        machine.succeed(
-            f"systemd-run --unit=llama-annot "
-            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
-            f"--setenv=STATE_FILE={STATE_FILE} "
-            f"--setenv=POLL_INTERVAL=2 "
-            f"--setenv=CPU_THRESHOLD=10 "
-            f"{PYTHON} {SCRIPT}"
-        )
-        time.sleep(5)
-
-    with subtest("No annotations when idle"):
-        annots = read_annotations()
-        assert annots == [], f"Expected no annotations, got: {annots}"
-
-    with subtest("Annotation created when llama-server becomes busy"):
-        set_busy()
-        machine.wait_until_succeeds(
-            f"cat {ANNOTS_FILE} | {PYTHON} -c "
-            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a else 1)\"",
-            timeout=20,
-        )
-        annots = read_annotations()
-        assert len(annots) == 1, f"Expected 1 annotation, got: {annots}"
-        assert "llama-cpp" in annots[0].get("tags", []), f"Missing tag: {annots[0]}"
-        assert "LLM request" in annots[0]["text"], f"Missing text: {annots[0]['text']}"
-        assert "timeEnd" not in annots[0], f"timeEnd should not be set: {annots[0]}"
-
-    with subtest("Annotation closed when llama-server becomes idle"):
-        set_idle()
-        machine.wait_until_succeeds(
-            f"cat {ANNOTS_FILE} | {PYTHON} -c "
-            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if a and 'timeEnd' in a[0] else 1)\"",
-            timeout=20,
-        )
-        annots = read_annotations()
-        assert len(annots) == 1, f"Expected 1, got: {annots}"
-        assert "timeEnd" in annots[0], f"timeEnd missing: {annots[0]}"
-        assert annots[0]["timeEnd"] > annots[0]["time"], "timeEnd should be after time"
-        assert "s)" in annots[0].get("text", ""), f"Duration missing: {annots[0]}"
-
-    with subtest("State survives restart"):
-        set_busy()
-        machine.wait_until_succeeds(
-            f"cat {ANNOTS_FILE} | {PYTHON} -c "
-            f"\"import sys,json; a=json.load(sys.stdin); exit(0 if len(a)==2 else 1)\"",
-            timeout=20,
-        )
-        machine.succeed("systemctl stop llama-annot || true")
-        time.sleep(1)
-        machine.succeed(
-            f"systemd-run --unit=llama-annot-2 "
-            f"--setenv=GRAFANA_URL=http://127.0.0.1:{GRAFANA_PORT} "
-            f"--setenv=STATE_FILE={STATE_FILE} "
-            f"--setenv=POLL_INTERVAL=2 "
-            f"--setenv=CPU_THRESHOLD=10 "
-            f"{PYTHON} {SCRIPT}"
-        )
-        time.sleep(6)
-        annots = read_annotations()
-        assert len(annots) == 2, f"Restart should not duplicate, got: {annots}"
-  '';
-}
diff --git a/tests/mock-llama-server-proc.py b/tests/mock-llama-server-proc.py
deleted file mode 100644
index 6119372..0000000
--- a/tests/mock-llama-server-proc.py
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env python3
-"""
-Mock llama-server process for NixOS VM tests.
-
-Sets /proc/self/comm to "llama-server" via prctl so that monitoring scripts
-(llama-cpp-annotations, llama-cpp-xmrig-pause) can discover this process
-the same way they discover the real one.
-
-Usage: python3 mock-llama-server-proc.py <state-file>
-
-The state file controls behavior:
-  "busy"  -> burn CPU in a tight loop (simulates prompt processing / inference)
-  "idle"  -> sleep (simulates waiting for requests)
-"""
-
-import ctypes
-import ctypes.util
-import sys
-import time
-
-STATE_FILE = sys.argv[1]
-
-# PR_SET_NAME = 15, sets /proc/self/comm
-libc = ctypes.CDLL(ctypes.util.find_library("c"), use_errno=True)
-libc.prctl(15, b"llama-server", 0, 0, 0)
-
-with open(STATE_FILE, "w") as f:
-    f.write("idle")
-
-while True:
-    try:
-        with open(STATE_FILE) as f:
-            state = f.read().strip()
-    except Exception:
-        state = "idle"
-
-    if state == "busy":
-        end = time.monotonic() + 0.1
-        while time.monotonic() < end:
-            _ = sum(range(10000))
-    else:
-        time.sleep(0.5)
diff --git a/tests/tests.nix b/tests/tests.nix
index c5e6cd4..8493569 100644
--- a/tests/tests.nix
+++ b/tests/tests.nix
@@ -28,9 +28,6 @@ in
   # zfs scrub annotations test
   zfsScrubAnnotationsTest = handleTest ./zfs-scrub-annotations.nix;
 
-  # llama-cpp tests
-  llamaCppAnnotationsTest = handleTest ./llama-cpp-annotations.nix;
-
   # xmrig auto-pause test
   xmrigAutoPauseTest = handleTest ./xmrig-auto-pause.nix;
   # ntfy alerts test

From ce1c3352301a439f2b7c09842eee49308da0e1ea Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 19:46:40 -0400
Subject: [PATCH 806/847] caddy: wildcard TLS via DNS-01 challenge +
 ddns-updater for Njalla

Build Caddy with the caddy-dns/njalla plugin to enable DNS-01 ACME
challenges. This issues a single wildcard certificate for
*.sigkill.computer instead of per-subdomain certificates, reducing
Let's Encrypt API calls and certificate management overhead.

Add ddns-updater service (nixpkgs services.ddns-updater) configured
with Njalla provider to automatically update DNS records when the
server's public IP changes.
---
 configuration.nix                |   2 ++
 modules/age-secrets.nix          |  14 ++++++++++++++
 secrets/ddns-updater-config.age  | Bin 0 -> 417 bytes
 secrets/njalla-api-token-env.age | Bin 0 -> 292 bytes
 services/caddy/caddy.nix         |  17 +++++++++++++++--
 services/ddns-updater.nix        |  14 ++++++++++++++
 6 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 secrets/ddns-updater-config.age
 create mode 100644 secrets/njalla-api-token-env.age
 create mode 100644 services/ddns-updater.nix

diff --git a/configuration.nix b/configuration.nix
index 6bcd45e..79f0159 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -71,6 +71,8 @@
     ./services/mollysocket.nix
 
     ./services/harmonia.nix
+
+    ./services/ddns-updater.nix
   ];
 
   # Hosts entries for CI/CD deploy targets
diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index d3d8912..cd43825 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -46,6 +46,20 @@
       group = "caddy";
     };
 
+    # Njalla API token (NJALLA_API_TOKEN=...) for Caddy DNS-01 challenge
+    njalla-api-token-env = {
+      file = ../secrets/njalla-api-token-env.age;
+      mode = "0400";
+      owner = "caddy";
+      group = "caddy";
+    };
+
+    # ddns-updater config.json with Njalla provider credentials
+    ddns-updater-config = {
+      file = ../secrets/ddns-updater-config.age;
+      mode = "0400";
+    };
+
     jellyfin-api-key = {
       file = ../secrets/jellyfin-api-key.age;
       mode = "0400";
diff --git a/secrets/ddns-updater-config.age b/secrets/ddns-updater-config.age
new file mode 100644
index 0000000000000000000000000000000000000000..1fe9a46fac88ac96ac13ef29a8300fa3b85367bf
GIT binary patch
literal 417
zcmZQ@_Y83kiVO&0_^@J;nHxis;DsFLfA{CPJ~0sW*H!DeQMyjzhS8pj8=7yqsOar>
z3|y`vUu*H}VQpDaK=zNj`_6@LHaUCtko&6%c2SEY6ZiX-sf*wFZt{<F&&<6Cy56pt
znJzD&{#kFrUB3LZWsC|b+A^$1I?8A4Y<A2uwoCafl=OUhM#{D)YtxM;lq+%eSgUQV
zJSEoOFEu09XZxPi#-)Fz3f6mF31Us@?-#Vve!HyT=*E|`F5c%nwajPMn`H++%~tO%
z4r+gw$!RKbv~1O%kh|A*d?-wO*tDmBZ|$*w(&PJD4!ONB*gwys&e}BI^(0Ttf&%m1
zvb9gUr!1~ma@(U}Ztc?cQ{J)1bL@WVR?IJ*71((5`xC*E7nh9o2xV{Ea{Iu>sj{WK
zen%%|d^xjf=Q;h(YnjRX?7s6poeSx-USrVjF+alLUs9v1X&9&Cgq`Ahx=Q+8?&iOk
zkazLe_0@|PJXn<UNI1j)&AhB<p5O0yiOWjXhwxZf1?}0JXIDAJI@G&qrYfUT@Q1`d
eU&ET7_b<y1y}YFBVf4MAec9<o&bOj1R{;PM4bOrA

literal 0
HcmV?d00001

diff --git a/secrets/njalla-api-token-env.age b/secrets/njalla-api-token-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..d491b1cf442ead8c256822c2142ee6ac47e53842
GIT binary patch
literal 292
zcmZQ@_Y83kiVO&0=+!oTcDK7W@KspZ#PA8<IbU5mpyt_e+VzcCc4~Kq7EjQ&gx5>`
zC&}@+{}xaAp|WA8?GKmoHM5>Z&AF8xCn&>R;$_l*e`=QZqP|Z|f0uc`W1aZ4#IQc8
zXA+ZBo=2tY>g<;mJAVAK&gk4L<i2D#hm5RF?`OH&3pZ%j@tk8;nc<=8C>&cF+5UXp
zGZxw1zm0e7SNf#BPbJ56_l;KjmX~IJm5OK0S24Y|IKE3@$5fBczm7gRX?&^unj9-f
z%`<`0_v>!WJ$dR-%fZc(@dBz#J1);P+{Sy_(|ui;_L(In-vzGwb!xxjzw6|5eC~?p
zz5hA1rhkk7`1+~#<D4s2fzS4wzwj#H!8-4C$7Y4@+PQgqEX&Gs37rNDPRluPo^}QR
D{Vb4k

literal 0
HcmV?d00001

diff --git a/services/caddy/caddy.nix b/services/caddy/caddy.nix
index f77644f..6481c8d 100644
--- a/services/caddy/caddy.nix
+++ b/services/caddy/caddy.nix
@@ -56,9 +56,19 @@ in
     enable = true;
     email = "titaniumtown@proton.me";
 
-    # Enable on-demand TLS for old domain redirects
-    # Certs are issued dynamically when subdomains are accessed
+    # Build with Njalla DNS provider for DNS-01 ACME challenges (wildcard certs)
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "github.com/caddy-dns/njalla@v0.0.0-20250823094507-f709141f1fe6" ];
+      hash = "sha256-rrOAR6noTDpV/I/hZXxhz0OXVJKu0mFQRq87RUrpmzw=";
+    };
+
     globalConfig = ''
+      # Wildcard cert for *.${newDomain} via DNS-01 challenge
+      acme_dns njalla {
+        api_token {env.NJALLA_API_TOKEN}
+      }
+
+      # On-demand TLS for old domain redirects
       on_demand_tls {
         ask http://localhost:9123/check
       }
@@ -106,6 +116,9 @@ in
     };
   };
 
+  # Inject Njalla API token for DNS-01 challenge
+  systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.njalla-api-token-env.path;
+
   systemd.tmpfiles.rules = [
     "d ${config.services.caddy.dataDir} 700 ${config.services.caddy.user} ${config.services.caddy.group}"
   ];
diff --git a/services/ddns-updater.nix b/services/ddns-updater.nix
new file mode 100644
index 0000000..9b145c9
--- /dev/null
+++ b/services/ddns-updater.nix
@@ -0,0 +1,14 @@
+{
+  config,
+  ...
+}:
+{
+  services.ddns-updater = {
+    enable = true;
+    environment = {
+      PERIOD = "5m";
+      # ddns-updater reads config from this path at runtime
+      CONFIG_FILEPATH = config.age.secrets.ddns-updater-config.path;
+    };
+  };
+}

From 100999734ba16f3b4cc0f3b4e84a331e9fabae18 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 20:47:04 -0400
Subject: [PATCH 807/847] ddns-updater: disable DynamicUser to fix secret perms

---
 modules/age-secrets.nix   |  2 ++
 services/ddns-updater.nix | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/modules/age-secrets.nix b/modules/age-secrets.nix
index cd43825..b38ba82 100644
--- a/modules/age-secrets.nix
+++ b/modules/age-secrets.nix
@@ -58,6 +58,8 @@
     ddns-updater-config = {
       file = ../secrets/ddns-updater-config.age;
       mode = "0400";
+      owner = "ddns-updater";
+      group = "ddns-updater";
     };
 
     jellyfin-api-key = {
diff --git a/services/ddns-updater.nix b/services/ddns-updater.nix
index 9b145c9..aba9402 100644
--- a/services/ddns-updater.nix
+++ b/services/ddns-updater.nix
@@ -1,5 +1,6 @@
 {
   config,
+  lib,
   ...
 }:
 {
@@ -11,4 +12,16 @@
       CONFIG_FILEPATH = config.age.secrets.ddns-updater-config.path;
     };
   };
+
+  users.users.ddns-updater = {
+    isSystemUser = true;
+    group = "ddns-updater";
+  };
+  users.groups.ddns-updater = { };
+
+  systemd.service.ddns-updater.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "ddns-updater";
+    Group = "ddns-updater";
+  };
 }

From 7ee55eca6bc506794edfcb476c924b21888eedaa Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 20:48:06 -0400
Subject: [PATCH 808/847] typo: systemd.service -> systemd.services

---
 services/ddns-updater.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/ddns-updater.nix b/services/ddns-updater.nix
index aba9402..6d8cbbc 100644
--- a/services/ddns-updater.nix
+++ b/services/ddns-updater.nix
@@ -19,7 +19,7 @@
   };
   users.groups.ddns-updater = { };
 
-  systemd.service.ddns-updater.serviceConfig = {
+  systemd.services.ddns-updater.serviceConfig = {
     DynamicUser = lib.mkForce false;
     User = "ddns-updater";
     Group = "ddns-updater";

From dad3867144bc108f3bb8054c00f0d75f935788d2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 9 Apr 2026 22:19:21 -0400
Subject: [PATCH 809/847] grafana: fix llama-cpp annotation query format for
 Grafana 12

Grafana 12 expects Prometheus annotation queries wrapped in a 'target'
object with datasource, expr, refId, and range fields. The previous
format had expr/step as top-level fields which Grafana silently ignored.
---
 services/grafana/dashboard.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/services/grafana/dashboard.nix b/services/grafana/dashboard.nix
index 7f2ff07..60f68dd 100644
--- a/services/grafana/dashboard.nix
+++ b/services/grafana/dashboard.nix
@@ -53,8 +53,13 @@ let
         datasource = promDs;
         enable = true;
         iconColor = "purple";
-        expr = "llamacpp:requests_processing > 0";
-        step = "10s";
+        target = {
+          datasource = promDs;
+          expr = "llamacpp:requests_processing > 0";
+          instant = false;
+          range = true;
+          refId = "A";
+        };
         titleFormat = "LLM inference";
       }
     ];

From 12469de58019ba06a6d8fdf84e8c6ab8e3774443 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 11 Apr 2026 10:27:38 -0400
Subject: [PATCH 810/847] llama.cpp: things

---
 .../llamacpp/0003-gemma4-tokenizer-fix.patch  | 88 -------------------
 services/llama-cpp.nix                        |  5 +-
 2 files changed, 2 insertions(+), 91 deletions(-)
 delete mode 100644 patches/llamacpp/0003-gemma4-tokenizer-fix.patch

diff --git a/patches/llamacpp/0003-gemma4-tokenizer-fix.patch b/patches/llamacpp/0003-gemma4-tokenizer-fix.patch
deleted file mode 100644
index e01692a..0000000
--- a/patches/llamacpp/0003-gemma4-tokenizer-fix.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 320c29c2dbe3c8df56374a9ec19a7fe5c124d4f8 Mon Sep 17 00:00:00 2001
-From: Piotr Wilkin <piotr.wilkin@syndatis.com>
-Date: Tue, 7 Apr 2026 00:54:00 +0200
-Subject: [PATCH 1/2] YATF (Yet Another Tokenizer Fix) for Gemma 4. With tests!
-
----
- convert_hf_to_gguf_update.py       |   1 +
- models/ggml-vocab-gemma-4.gguf     | Bin 0 -> 15776467 bytes
- models/ggml-vocab-gemma-4.gguf.inp | 111 +++++++++++++++++++++++++++++
- models/ggml-vocab-gemma-4.gguf.out |  46 ++++++++++++
- src/llama-vocab.cpp                |  13 +++-
- tests/CMakeLists.txt               |   1 +
- 6 files changed, 170 insertions(+), 2 deletions(-)
- create mode 100644 models/ggml-vocab-gemma-4.gguf
- create mode 100644 models/ggml-vocab-gemma-4.gguf.inp
- create mode 100644 models/ggml-vocab-gemma-4.gguf.out
-
-diff --git a/convert_hf_to_gguf_update.py b/convert_hf_to_gguf_update.py
-index 086f1c22863..f1d70d62e73 100755
---- a/convert_hf_to_gguf_update.py
-+++ b/convert_hf_to_gguf_update.py
-@@ -114,6 +114,7 @@ class TOKENIZER_TYPE(IntEnum):
-     {"name": "viking",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/LumiOpen/Viking-7B", }, # Also used for Viking 13B and 33B
-     {"name": "gemma",            "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2b", },
-     {"name": "gemma-2",          "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2-9b", },
-+    {"name": "gemma-4",          "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/google/gemma-4-E2B-it", },
-     {"name": "jais",             "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/core42/jais-13b", },
-     {"name": "jais-2",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/inceptionai/Jais-2-8B-Chat", },
-     {"name": "t5",               "tokt": TOKENIZER_TYPE.UGM, "repo": "https://huggingface.co/google-t5/t5-small", },
-diff --git a/src/llama-vocab.cpp b/src/llama-vocab.cpp
-index de9a9466bc7..e9e276ab999 100644
---- a/src/llama-vocab.cpp
-+++ b/src/llama-vocab.cpp
-@@ -658,9 +658,18 @@ struct llm_tokenizer_bpe_session {
-                 const auto token = vocab.text_to_token(str);
- 
-                 if (token == LLAMA_TOKEN_NULL) {
-+                    static const char * hex = "0123456789ABCDEF";
-                     for (auto j = str.begin(); j != str.end(); ++j) {
--                        std::string byte_str(1, *j);
--                        auto token_multibyte = vocab.text_to_token(byte_str);
-+                        llama_token token_multibyte = LLAMA_TOKEN_NULL;
-+                        if (tokenizer.byte_encode) {
-+                            std::string byte_str(1, *j);
-+                            token_multibyte = vocab.text_to_token(byte_str);
-+                        } else {
-+                            // For non-byte-encoded BPE (e.g. gemma-4), byte tokens use <0xXX> format
-+                            const uint8_t ch = (uint8_t)*j;
-+                            const char buf[7] = { '<', '0', 'x', hex[ch >> 4], hex[ch & 15], '>', 0 };
-+                            token_multibyte = vocab.text_to_token(buf);
-+                        }
-                         if (token_multibyte != LLAMA_TOKEN_NULL) {
-                             output.push_back(token_multibyte);
-                         }
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 5e87c8b34e1..cd4bc5ef1d3 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -124,6 +124,7 @@ llama_test(test-tokenizer-0 NAME test-tokenizer-0-command-r         ARGS ${PROJE
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-deepseek-coder    ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-deepseek-coder.gguf)
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-deepseek-llm      ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-deepseek-llm.gguf)
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-falcon            ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-falcon.gguf)
-+llama_test(test-tokenizer-0 NAME test-tokenizer-0-gemma-4           ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-gemma-4.gguf)
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-gpt-2             ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-gpt-2.gguf)
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-llama-bpe         ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-llama-bpe.gguf)
- llama_test(test-tokenizer-0 NAME test-tokenizer-0-llama-spm         ARGS ${PROJECT_SOURCE_DIR}/models/ggml-vocab-llama-spm.gguf)
-
-From 0e98596dec124c6968132ef042c21ccdb20d1304 Mon Sep 17 00:00:00 2001
-From: Piotr Wilkin <piotr.wilkin@syndatis.com>
-Date: Tue, 7 Apr 2026 00:58:08 +0200
-Subject: [PATCH 2/2] Remove unnecessary hash  from update script.
-
----
- convert_hf_to_gguf_update.py | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/convert_hf_to_gguf_update.py b/convert_hf_to_gguf_update.py
-index f1d70d62e73..086f1c22863 100755
---- a/convert_hf_to_gguf_update.py
-+++ b/convert_hf_to_gguf_update.py
-@@ -114,7 +114,6 @@ class TOKENIZER_TYPE(IntEnum):
-     {"name": "viking",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/LumiOpen/Viking-7B", }, # Also used for Viking 13B and 33B
-     {"name": "gemma",            "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2b", },
-     {"name": "gemma-2",          "tokt": TOKENIZER_TYPE.SPM, "repo": "https://huggingface.co/google/gemma-2-9b", },
--    {"name": "gemma-4",          "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/google/gemma-4-E2B-it", },
-     {"name": "jais",             "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/core42/jais-13b", },
-     {"name": "jais-2",           "tokt": TOKENIZER_TYPE.BPE, "repo": "https://huggingface.co/inceptionai/Jais-2-8B-Chat", },
-     {"name": "t5",               "tokt": TOKENIZER_TYPE.UGM, "repo": "https://huggingface.co/google-t5/t5-small", },
diff --git a/services/llama-cpp.nix b/services/llama-cpp.nix
index 78f931f..d9f7f76 100644
--- a/services/llama-cpp.nix
+++ b/services/llama-cpp.nix
@@ -9,7 +9,7 @@
 }:
 let
   cfg = config.services.llama-cpp;
-  modelUrl = "https://huggingface.co/bartowski/google_gemma-4-E2B-it-GGUF/resolve/main/google_gemma-4-E2B-it-Q4_K_M.gguf";
+  modelUrl = "https://huggingface.co/bartowski/google_gemma-4-E2B-it-GGUF/resolve/main/google_gemma-4-E2B-it-IQ2_M.gguf";
   modelAlias = lib.removeSuffix ".gguf" (baseNameOf modelUrl);
 in
 {
@@ -25,7 +25,7 @@ in
     model = toString (
       pkgs.fetchurl {
         url = modelUrl;
-        sha256 = "5efe645db4e1909c7a1f4a9608df18e6c14383f5e86777fc49f769f9ba7d5fdf";
+        sha256 = "17e869ac54d0e59faa884d5319fc55ad84cd866f50f0b3073fbb25accc875a23";
       }
     );
     port = service_configs.ports.private.llama_cpp.port;
@@ -33,7 +33,6 @@ in
     package = lib.optimizePackage (
       inputs.llamacpp.packages.${pkgs.system}.vulkan.overrideAttrs (old: {
         patches = (old.patches or [ ]) ++ [
-          ../patches/llamacpp/0003-gemma4-tokenizer-fix.patch
         ];
       })
     );

From bef4ac7ddc1d931727f9d61cfa5478e0092cd934 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sat, 11 Apr 2026 10:28:01 -0400
Subject: [PATCH 811/847] update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6a0797b..dc717cd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775754862,
-        "narHash": "sha256-8y9cz8+cyeA7KtA7+Q3bXjyFJV5nM38Fc0E4qPw7WDk=",
+        "lastModified": 1775866084,
+        "narHash": "sha256-mWn8D/oXXAaqeFFFRorKHvTLw5V9M8eYzAWRr4iffag=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "bea51aaee00688794a877f308007590a6cc8e378",
+        "rev": "29d2cca7fc3841708c1d48e2d1272f79db1538b6",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775752089,
-        "narHash": "sha256-+psXqZ1SvQw7L8HgCQINmob9zLnvK433b2k080lBPH0=",
+        "lastModified": 1775791757,
+        "narHash": "sha256-3BS1Hw+3A3uf4G/8zwts3ZgxSnYq0y+QntbwO+b6KEw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "1beacd3bdadabfac884dedd56176966c141214d8",
+        "rev": "c4c6a33affcc15cde3df06083e96cda87f9a7627",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775595990,
-        "narHash": "sha256-OEf7YqhF9IjJFYZJyuhAypgU+VsRB5lD4DuiMws5Ltc=",
+        "lastModified": 1775811116,
+        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4e92bbcdb030f3b4782be4751dc08e6b6cb6ccf2",
+        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775701952,
-        "narHash": "sha256-xj9u8fz2hTTTELMorqox0hPWrmAvGRnQUEnlj+vCjFo=",
+        "lastModified": 1775896579,
+        "narHash": "sha256-uU9t4oqG7MbJHYjYnEPfnOcSMBPxK4wACeaOXvE0Ezg=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "f56f1053ae9f878501d3a8ae1961c73d1d7abce3",
+        "rev": "7983ea7a44f40fcc1c35b0ca8e54e794a26b09e2",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775686189,
-        "narHash": "sha256-kzEDJKptaVToSg/wpub0bLjAVRmkYOorjPsNqlpxWdU=",
+        "lastModified": 1775858976,
+        "narHash": "sha256-LJ+A/x7g3jhS7R9Jkyt3E4Be2jo/bJVStDDJLG5AL7c=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "ce9c0afc3885d0592caa91f0d4359f315ef7428c",
+        "rev": "b4dac394ef1eff0ab51c0cb7004c05826988d846",
         "type": "github"
       },
       "original": {

From 674d3cf53961ade1b74eac3b940d96ce6606464a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 15:36:04 -0400
Subject: [PATCH 812/847] fix tests

---
 tests/fail2ban-jellyfin.nix | 2 +-
 tests/jellyfin-test-lib.py  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/fail2ban-jellyfin.nix b/tests/fail2ban-jellyfin.nix
index bd7971d..69e06e2 100644
--- a/tests/fail2ban-jellyfin.nix
+++ b/tests/fail2ban-jellyfin.nix
@@ -107,7 +107,7 @@ pkgs.testers.runNixOSTest {
     server.wait_for_unit("jellyfin.service")
     server.wait_for_unit("fail2ban.service")
     server.wait_for_open_port(8096)
-    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=120)
     time.sleep(2)
 
     # Wait for Jellyfin to create real log files and reload fail2ban
diff --git a/tests/jellyfin-test-lib.py b/tests/jellyfin-test-lib.py
index 81c164b..30f0717 100644
--- a/tests/jellyfin-test-lib.py
+++ b/tests/jellyfin-test-lib.py
@@ -18,7 +18,7 @@ def setup_jellyfin(machine, retry, auth_header, auth_payload, empty_payload):
     machine.wait_for_unit("jellyfin.service")
     machine.wait_for_open_port(8096)
     machine.wait_until_succeeds(
-        "curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60
+        "curl -sf http://localhost:8096/health | grep -q Healthy", timeout=120
     )
 
     machine.wait_until_succeeds(

From 1f2886d35c74b5e7d405e730d64d82fb2e6f622d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 16:33:53 -0400
Subject: [PATCH 813/847] AGENTS.md: document postgresql-first policy

---
 AGENTS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/AGENTS.md b/AGENTS.md
index 356feab..7172418 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -112,6 +112,7 @@ Each service file in `services/` follows this structure:
 - **Hugepages**: Services needing large pages declare their budget in `service-configs.nix` under `hugepages_2m.services`. The kernel sysctl is set automatically from the total.
 - **Domain**: Primary domain is `sigkill.computer`. Old domain `gardling.com` redirects automatically.
 - **Hardened kernel**: Uses `_hardened` kernel. Security-sensitive defaults apply.
+- **PostgreSQL as central database**: All services that support PostgreSQL MUST use it instead of embedded databases (H2, SQLite, etc.). Connect via Unix socket with peer auth when possible (JDBC services can use junixsocket). The PostgreSQL instance is declared in `services/postgresql.nix` with ZFS-backed storage. Use `ensureDatabases`/`ensureUsers` to auto-create databases and roles.
 
 ### Test Pattern
 Tests use `pkgs.testers.runNixOSTest` (NixOS VM tests):

From acfa08fc2ef54dfcee7655202b03f19ac1e52516 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 16:15:52 -0400
Subject: [PATCH 814/847] traccar: init

---
 configuration.nix    |  2 ++
 service-configs.nix  | 12 +++++++
 services/traccar.nix | 84 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+)
 create mode 100644 services/traccar.nix

diff --git a/configuration.nix b/configuration.nix
index 79f0159..3c0fdf6 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -73,6 +73,8 @@
     ./services/harmonia.nix
 
     ./services/ddns-updater.nix
+
+    ./services/traccar.nix
   ];
 
   # Hosts entries for CI/CD deploy targets
diff --git a/service-configs.nix b/service-configs.nix
index 4cb200d..6623924 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -197,6 +197,14 @@ rec {
         port = 5500;
         proto = "tcp";
       };
+      traccar_web = {
+        port = 8082;
+        proto = "tcp";
+      };
+      traccar_tracking = {
+        port = 5056;
+        proto = "tcp";
+      };
     };
   };
 
@@ -330,6 +338,10 @@ rec {
     dataDir = services_dir + "/trilium";
   };
 
+  traccar = {
+    domain = "traccar.${https.domain}";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/traccar.nix b/services/traccar.nix
new file mode 100644
index 0000000..36f7b71
--- /dev/null
+++ b/services/traccar.nix
@@ -0,0 +1,84 @@
+{
+  pkgs,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "traccar" service_configs.zpool_ssds [
+      "/var/lib/traccar"
+    ])
+    (lib.serviceFilePerms "traccar" [
+      "Z /var/lib/traccar 0700 traccar traccar"
+    ])
+  ];
+
+  users.users.traccar = {
+    isSystemUser = true;
+    group = "traccar";
+    home = "/var/lib/traccar";
+    description = "Traccar GPS Tracking";
+  };
+  users.groups.traccar = { };
+
+  # PostgreSQL database (auto-created, peer auth via Unix socket)
+  services.postgresql = {
+    ensureDatabases = [ "traccar" ];
+    ensureUsers = [
+      {
+        name = "traccar";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+
+  services.traccar = {
+    enable = true;
+
+    # The JDBC URL contains '$' (Java inner class) and '&' (query param
+    # separator) which break the NixOS module's XML generator + envsubst.
+    # Route it through environmentFile so envsubst replaces $TRACCAR_DB_URL
+    # with the literal value, and use &amp; for valid XML (the XML parser
+    # decodes it back to & for JDBC).
+    environmentFile = pkgs.writeText "traccar-db-env" ''
+      TRACCAR_DB_URL=jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&amp;socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432
+    '';
+
+    settings = {
+      web.port = toString service_configs.ports.private.traccar_web.port;
+
+      # PostgreSQL via Unix socket (peer auth, junixsocket is bundled)
+      database = {
+        driver = "org.postgresql.Driver";
+        url = "$TRACCAR_DB_URL";
+        user = "traccar";
+        password = "";
+      };
+
+      # Only enable OsmAnd protocol (phone app). Prevents Traccar from
+      # opening 200+ default protocol ports that conflict with other services.
+      protocols.enable = "osmand";
+      osmand.port = toString service_configs.ports.private.traccar_tracking.port;
+    };
+  };
+
+  # Disable DynamicUser so we can use peer auth with PostgreSQL
+  systemd.services.traccar = {
+    after = [ "postgresql.service" ];
+    requires = [ "postgresql.service" ];
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "traccar";
+      Group = "traccar";
+    };
+  };
+
+  # Route tracking requests (OsmAnd protocol) through Caddy for TLS.
+  # The phone app connects via HTTPS instead of a separate plain port.
+  services.caddy.virtualHosts."${service_configs.traccar.domain}".extraConfig = ''
+    @tracking query id=*
+    reverse_proxy @tracking :${toString service_configs.ports.private.traccar_tracking.port}
+    reverse_proxy :${toString service_configs.ports.private.traccar_web.port}
+  '';
+}

From dbf6d2f8322ef96da0ed44b224f02d942e348629 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 21:04:28 -0400
Subject: [PATCH 815/847] Revert "traccar: init"

This reverts commit acfa08fc2ef54dfcee7655202b03f19ac1e52516.
---
 configuration.nix    |  2 --
 service-configs.nix  | 12 -------
 services/traccar.nix | 84 --------------------------------------------
 3 files changed, 98 deletions(-)
 delete mode 100644 services/traccar.nix

diff --git a/configuration.nix b/configuration.nix
index 3c0fdf6..79f0159 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -73,8 +73,6 @@
     ./services/harmonia.nix
 
     ./services/ddns-updater.nix
-
-    ./services/traccar.nix
   ];
 
   # Hosts entries for CI/CD deploy targets
diff --git a/service-configs.nix b/service-configs.nix
index 6623924..4cb200d 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -197,14 +197,6 @@ rec {
         port = 5500;
         proto = "tcp";
       };
-      traccar_web = {
-        port = 8082;
-        proto = "tcp";
-      };
-      traccar_tracking = {
-        port = 5056;
-        proto = "tcp";
-      };
     };
   };
 
@@ -338,10 +330,6 @@ rec {
     dataDir = services_dir + "/trilium";
   };
 
-  traccar = {
-    domain = "traccar.${https.domain}";
-  };
-
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";
diff --git a/services/traccar.nix b/services/traccar.nix
deleted file mode 100644
index 36f7b71..0000000
--- a/services/traccar.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  pkgs,
-  service_configs,
-  lib,
-  ...
-}:
-{
-  imports = [
-    (lib.serviceMountWithZpool "traccar" service_configs.zpool_ssds [
-      "/var/lib/traccar"
-    ])
-    (lib.serviceFilePerms "traccar" [
-      "Z /var/lib/traccar 0700 traccar traccar"
-    ])
-  ];
-
-  users.users.traccar = {
-    isSystemUser = true;
-    group = "traccar";
-    home = "/var/lib/traccar";
-    description = "Traccar GPS Tracking";
-  };
-  users.groups.traccar = { };
-
-  # PostgreSQL database (auto-created, peer auth via Unix socket)
-  services.postgresql = {
-    ensureDatabases = [ "traccar" ];
-    ensureUsers = [
-      {
-        name = "traccar";
-        ensureDBOwnership = true;
-      }
-    ];
-  };
-
-  services.traccar = {
-    enable = true;
-
-    # The JDBC URL contains '$' (Java inner class) and '&' (query param
-    # separator) which break the NixOS module's XML generator + envsubst.
-    # Route it through environmentFile so envsubst replaces $TRACCAR_DB_URL
-    # with the literal value, and use &amp; for valid XML (the XML parser
-    # decodes it back to & for JDBC).
-    environmentFile = pkgs.writeText "traccar-db-env" ''
-      TRACCAR_DB_URL=jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&amp;socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432
-    '';
-
-    settings = {
-      web.port = toString service_configs.ports.private.traccar_web.port;
-
-      # PostgreSQL via Unix socket (peer auth, junixsocket is bundled)
-      database = {
-        driver = "org.postgresql.Driver";
-        url = "$TRACCAR_DB_URL";
-        user = "traccar";
-        password = "";
-      };
-
-      # Only enable OsmAnd protocol (phone app). Prevents Traccar from
-      # opening 200+ default protocol ports that conflict with other services.
-      protocols.enable = "osmand";
-      osmand.port = toString service_configs.ports.private.traccar_tracking.port;
-    };
-  };
-
-  # Disable DynamicUser so we can use peer auth with PostgreSQL
-  systemd.services.traccar = {
-    after = [ "postgresql.service" ];
-    requires = [ "postgresql.service" ];
-    serviceConfig = {
-      DynamicUser = lib.mkForce false;
-      User = "traccar";
-      Group = "traccar";
-    };
-  };
-
-  # Route tracking requests (OsmAnd protocol) through Caddy for TLS.
-  # The phone app connects via HTTPS instead of a separate plain port.
-  services.caddy.virtualHosts."${service_configs.traccar.domain}".extraConfig = ''
-    @tracking query id=*
-    reverse_proxy @tracking :${toString service_configs.ports.private.traccar_tracking.port}
-    reverse_proxy :${toString service_configs.ports.private.traccar_web.port}
-  '';
-}

From 19ea2dc02bf4476e77b00b1f695cc3768be4c4f0 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 21:29:37 -0400
Subject: [PATCH 816/847] prowlarr: handle bitmagnet restart

---
 services/bitmagnet.nix | 82 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 81 insertions(+), 1 deletion(-)

diff --git a/services/bitmagnet.nix b/services/bitmagnet.nix
index f59e97a..a01c7ce 100644
--- a/services/bitmagnet.nix
+++ b/services/bitmagnet.nix
@@ -5,6 +5,57 @@
   lib,
   ...
 }:
+let
+  prowlarrPort = toString service_configs.ports.private.prowlarr.port;
+  sonarrPort = toString service_configs.ports.private.sonarr.port;
+  radarrPort = toString service_configs.ports.private.radarr.port;
+  bitmagnetPort = toString service_configs.ports.private.bitmagnet.port;
+  bridgeAddr = config.vpnNamespaces.wg.bridgeAddress;
+
+  prowlarrConfigXml = "${service_configs.prowlarr.dataDir}/config.xml";
+  sonarrConfigXml = "${service_configs.sonarr.dataDir}/config.xml";
+  radarrConfigXml = "${service_configs.radarr.dataDir}/config.xml";
+
+  curl = "${pkgs.curl}/bin/curl";
+  jq = "${pkgs.jq}/bin/jq";
+
+  # Clears the escalating failure backoff for the Bitmagnet indexer across
+  # Prowlarr, Sonarr, and Radarr so searches resume immediately after
+  # Bitmagnet restarts instead of waiting hours for disable timers to expire.
+  recoveryScript = pkgs.writeShellScript "prowlarr-bitmagnet-recovery" ''
+    set -euo pipefail
+
+    wait_for() {
+      for _ in $(seq 1 "$2"); do
+        ${curl} -sf --max-time 5 "$1" > /dev/null && return 0
+        sleep 5
+      done
+      echo "$1 not reachable, aborting" >&2; exit 1
+    }
+
+    # Test a Bitmagnet-named indexer to clear its failure status.
+    # A successful test triggers RecordSuccess() which resets the backoff.
+    clear_status() {
+      local key indexer
+      key=$(${lib.extractArrApiKey ''"$3"''}) || return 0
+      indexer=$(${curl} -sf --max-time 10 \
+        -H "X-Api-Key: $key" "$2/api/$1/indexer" | \
+        ${jq} 'first(.[] | select(.name | test("Bitmagnet"; "i")))') || return 0
+      [ -n "$indexer" ] && [ "$indexer" != "null" ] || return 0
+      ${curl} -sf --max-time 30 \
+        -H "X-Api-Key: $key" -H "Content-Type: application/json" \
+        -X POST "$2/api/$1/indexer/test" -d "$indexer" > /dev/null
+    }
+
+    wait_for "http://localhost:${bitmagnetPort}" 12
+    wait_for "http://localhost:${prowlarrPort}/ping" 6
+
+    # Prowlarr first — downstream apps route searches through it.
+    clear_status v1 "http://localhost:${prowlarrPort}" "${prowlarrConfigXml}" || true
+    clear_status v3 "http://${bridgeAddr}:${sonarrPort}" "${sonarrConfigXml}" || true
+    clear_status v3 "http://${bridgeAddr}:${radarrPort}" "${radarrConfigXml}" || true
+  '';
+in
 {
   imports = [
     (lib.vpnNamespaceOpenPort service_configs.ports.private.bitmagnet.port "bitmagnet")
@@ -25,9 +76,38 @@
       };
       http_server = {
         # TODO! make issue about this being a string and not a `port` type
-        port = ":" + (builtins.toString service_configs.ports.private.bitmagnet.port);
+        port = ":" + (toString service_configs.ports.private.bitmagnet.port);
       };
     };
   };
 
+  # The upstream default (Restart=on-failure) leaves Bitmagnet dead after
+  # clean exits (e.g. systemd stop during deploy). Always restart it.
+  systemd.services.bitmagnet.serviceConfig = {
+    Restart = lib.mkForce "always";
+    RestartSec = 10;
+  };
+
+  # After Bitmagnet restarts, clear the escalating failure backoff across
+  # Prowlarr, Sonarr, and Radarr so searches resume immediately instead of
+  # waiting hours for the disable timers to expire.
+  systemd.services.prowlarr-bitmagnet-recovery = {
+    description = "Clear Prowlarr/Sonarr/Radarr failure status for Bitmagnet indexer";
+    after = [
+      "bitmagnet.service"
+      "prowlarr.service"
+      "sonarr.service"
+      "radarr.service"
+    ];
+    bindsTo = [ "bitmagnet.service" ];
+    wantedBy = [ "bitmagnet.service" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = recoveryScript;
+      # Same VPN namespace as Bitmagnet and Prowlarr.
+      NetworkNamespacePath = "/run/netns/wg";
+    };
+  };
 }

From 053160fb36a6a02ca1d8676f7587832e126bc26c Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 21:38:11 -0400
Subject: [PATCH 817/847] recyclarr: add upscaled custom format to block fake
 2160p

---
 services/arr/recyclarr.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 7b19cbc..93312d3 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -96,6 +96,13 @@ in
               { name = "Remux + WEB 2160p"; }
             ];
           }
+          # Upscaled - block releases upscaled to 2160p from lower resolution sources
+          {
+            trash_ids = [ "bfd8eb01832d646a0a89c4deb46f8564" ];
+            assign_scores_to = [
+              { name = "Remux + WEB 2160p"; }
+            ];
+          }
         ];
       };
 
@@ -151,6 +158,13 @@ in
               { name = "WEB-2160p"; }
             ];
           }
+          # Upscaled - block releases upscaled to 2160p from lower resolution sources
+          {
+            trash_ids = [ "23297a736ca77c0fc8e70f8edd7ee56c" ];
+            assign_scores_to = [
+              { name = "WEB-2160p"; }
+            ];
+          }
         ];
       };
     };

From 55001bbe759aaa9e65ab57e83c20e9eea614a68a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 22:17:51 -0400
Subject: [PATCH 818/847] recylcarr: hopefully prevent ai upscale torrents

---
 services/arr/recyclarr.nix | 64 +++++++++++++++++++++++++-------------
 1 file changed, 42 insertions(+), 22 deletions(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 93312d3..62b3359 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -52,24 +52,31 @@ in
           { template = "radarr-custom-formats-remux-web-2160p"; }
         ];
 
-        # Extend the template's quality profile with lower-resolution fallbacks
+        # Group WEB 2160p with 1080p in the same quality tier so custom
+        # format scores -- not quality ranking -- decide the winner.
+        # Native 4K with HDR/DV from good release groups scores high and
+        # wins; AI upscales get -10000 from the Upscaled CF and are
+        # blocked by min_format_score. Untagged upscales from unknown
+        # groups (score ~0) lose to well-scored 1080p (Tier 01 = +1750).
         quality_profiles = [
           {
             name = "Remux + WEB 2160p";
+            min_format_score = 0;
+            reset_unmatched_scores.enabled = true;
+            upgrade = {
+              allowed = true;
+              until_quality = "Remux-2160p";
+              until_score = 10000;
+            };
             qualities = [
               { name = "Remux-2160p"; }
               {
-                name = "WEB 2160p";
+                name = "WEB/Bluray";
                 qualities = [
                   "WEBDL-2160p"
                   "WEBRip-2160p"
-                ];
-              }
-              { name = "Remux-1080p"; }
-              { name = "Bluray-1080p"; }
-              {
-                name = "WEB 1080p";
-                qualities = [
+                  "Remux-1080p"
+                  "Bluray-1080p"
                   "WEBDL-1080p"
                   "WEBRip-1080p"
                 ];
@@ -96,11 +103,14 @@ in
               { name = "Remux + WEB 2160p"; }
             ];
           }
-          # Upscaled - block releases upscaled to 2160p from lower resolution sources
+          # Upscaled - block AI upscales and other upscaled-to-2160p releases
           {
             trash_ids = [ "bfd8eb01832d646a0a89c4deb46f8564" ];
             assign_scores_to = [
-              { name = "Remux + WEB 2160p"; }
+              {
+                name = "Remux + WEB 2160p";
+                score = -10000;
+              }
             ];
           }
         ];
@@ -115,23 +125,30 @@ in
           { template = "sonarr-v4-custom-formats-web-2160p"; }
         ];
 
-        # Extend the template's quality profile with lower-resolution fallbacks
+        # Group WEB 2160p with 1080p in the same quality tier so custom
+        # format scores -- not quality ranking -- decide the winner.
+        # Native 4K with HDR/DV from good release groups scores high and
+        # wins; AI upscales get -10000 from the Upscaled CF and are
+        # blocked by min_format_score. Untagged upscales from unknown
+        # groups (score ~0) lose to well-scored 1080p (Tier 01 = +1750).
         quality_profiles = [
           {
             name = "WEB-2160p";
+            min_format_score = 0;
+            reset_unmatched_scores.enabled = true;
+            upgrade = {
+              allowed = true;
+              until_quality = "WEB/Bluray";
+              until_score = 10000;
+            };
             qualities = [
               {
-                name = "WEB 2160p";
+                name = "WEB/Bluray";
                 qualities = [
                   "WEBDL-2160p"
                   "WEBRip-2160p"
-                ];
-              }
-              { name = "Bluray-1080p Remux"; }
-              { name = "Bluray-1080p"; }
-              {
-                name = "WEB 1080p";
-                qualities = [
+                  "Bluray-1080p Remux"
+                  "Bluray-1080p"
                   "WEBDL-1080p"
                   "WEBRip-1080p"
                 ];
@@ -158,11 +175,14 @@ in
               { name = "WEB-2160p"; }
             ];
           }
-          # Upscaled - block releases upscaled to 2160p from lower resolution sources
+          # Upscaled - block AI upscales and other upscaled-to-2160p releases
           {
             trash_ids = [ "23297a736ca77c0fc8e70f8edd7ee56c" ];
             assign_scores_to = [
-              { name = "WEB-2160p"; }
+              {
+                name = "WEB-2160p";
+                score = -10000;
+              }
             ];
           }
         ];

From e904e249ed5cb0f5d52f2bfd452da60e2fcf5740 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 22:26:07 -0400
Subject: [PATCH 819/847] recyclarr: ensure restart on config change

---
 services/arr/recyclarr.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 62b3359..ebddbce 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -190,9 +190,19 @@ in
     };
   };
 
-  # Re-sync immediately on deploy when the recyclarr config changes
+  # Trigger immediate sync on deploy when recyclarr config changes.
+  # restartTriggers on the oneshot service are unreliable (systemd may
+  # no-op a restart of an inactive oneshot). Instead, embed a config
+  # hash in the timer unit -- NixOS restarts changed timers reliably,
+  # and OnActiveSec fires the sync within seconds.
+  systemd.timers.recyclarr = {
+    timerConfig.OnActiveSec = "5s";
+    unitConfig.X-ConfigHash = builtins.hashString "sha256" (
+      builtins.toJSON config.services.recyclarr.configuration
+    );
+  };
+
   systemd.services.recyclarr = {
-    restartTriggers = [ (builtins.toJSON config.services.recyclarr.configuration) ];
     after = [
       "network-online.target"
       "radarr.service"

From e0c86a956ec701968563bf491585d70d2dc3c2e3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 22:37:05 -0400
Subject: [PATCH 820/847] llama.cpp: disable

---
 configuration.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 79f0159..59a0c4e 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -46,7 +46,7 @@
 
     ./services/soulseek.nix
 
-    ./services/llama-cpp.nix
+    # ./services/llama-cpp.nix
     ./services/trilium.nix
 
     ./services/ups.nix

From 4aa7c2a44b64f446fbcb5d3c2c0ddc361e0338a7 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 13 Apr 2026 03:17:03 -0400
Subject: [PATCH 821/847] recyclarr: enforce as sole authority over custom
 formats

---
 services/arr/recyclarr.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index ebddbce..088388b 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -46,6 +46,11 @@ in
       radarr.movies = {
         base_url = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
 
+        # Recyclarr is the sole authority for custom formats and scores.
+        # Overwrite any manually-created CFs and delete stale ones.
+        replace_existing_custom_formats = true;
+        delete_old_custom_formats = true;
+
         include = [
           { template = "radarr-quality-definition-movie"; }
           { template = "radarr-quality-profile-remux-web-2160p"; }
@@ -119,6 +124,11 @@ in
       sonarr.series = {
         base_url = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
 
+        # Recyclarr is the sole authority for custom formats and scores.
+        # Overwrite any manually-created CFs and delete stale ones.
+        replace_existing_custom_formats = true;
+        delete_old_custom_formats = true;
+
         include = [
           { template = "sonarr-quality-definition-series"; }
           { template = "sonarr-v4-quality-profile-web-2160p"; }

From 28df0a7f06071cc5a5eedbe447519b4f139d0ed6 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 13 Apr 2026 19:59:47 -0400
Subject: [PATCH 822/847] jellyseerr: declarative quality profile defaults via
 arr-init

---
 flake.lock            |  8 ++++----
 services/arr/init.nix | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index dc717cd..19b5bbf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -32,11 +32,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774681523,
-        "narHash": "sha256-K49RohIwbgzVeOdStfVDO83qy5K5ZLKWk4EsHJKj/k4=",
+        "lastModified": 1776124758,
+        "narHash": "sha256-bWLlqMPM5bh6KzENwWN8gIVXm41ptR6/1/k472yzjQo=",
         "ref": "refs/heads/main",
-        "rev": "f8475f6cb4d4d4df99002d07cf9583fb33b87876",
-        "revCount": 11,
+        "rev": "60fcce47df643c02d5a41d47719c2cdb2c0f327e",
+        "revCount": 13,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
diff --git a/services/arr/init.nix b/services/arr/init.nix
index d54699b..63f8dd3 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -110,4 +110,21 @@
       serviceName = "radarr";
     };
   };
+
+  services.jellyseerrInit = {
+    enable = true;
+    configDir = service_configs.jellyseerr.configDir;
+    radarr = {
+      profileName = "Remux + WEB 2160p";
+      dataDir = service_configs.radarr.dataDir;
+      port = service_configs.ports.private.radarr.port;
+      serviceName = "radarr";
+    };
+    sonarr = {
+      profileName = "WEB-2160p";
+      dataDir = service_configs.sonarr.dataDir;
+      port = service_configs.ports.private.sonarr.port;
+      serviceName = "sonarr";
+    };
+  };
 }

From 140330e98d2b412a961dda2cd90307c1f41e7862 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Mon, 13 Apr 2026 20:01:36 -0400
Subject: [PATCH 823/847] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 19b5bbf..4b6f5b3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1775791757,
-        "narHash": "sha256-3BS1Hw+3A3uf4G/8zwts3ZgxSnYq0y+QntbwO+b6KEw=",
+        "lastModified": 1776051551,
+        "narHash": "sha256-zqDhVyUtctq7HlpMC9cdR277ner0L/f7SkC3oKbZwy0=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c4c6a33affcc15cde3df06083e96cda87f9a7627",
+        "rev": "c5eb01b60873e331265779028a839cd2b5237874",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775811116,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
+        "lastModified": 1776067740,
+        "narHash": "sha256-B35lpsqnSZwn1Lmz06BpwF7atPgFmUgw1l8KAV3zpVQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
+        "rev": "7e495b747b51f95ae15e74377c5ce1fe69c1765f",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775896579,
-        "narHash": "sha256-uU9t4oqG7MbJHYjYnEPfnOcSMBPxK4wACeaOXvE0Ezg=",
+        "lastModified": 1776047941,
+        "narHash": "sha256-XjIqkHJjn5e5UbwS2Nl63uBOF1AaC5coRiO+ukENAmM=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "7983ea7a44f40fcc1c35b0ca8e54e794a26b09e2",
+        "rev": "df399d4ba5d7f4ddd8dae16e5ace5a70e958153d",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1775858976,
-        "narHash": "sha256-LJ+A/x7g3jhS7R9Jkyt3E4Be2jo/bJVStDDJLG5AL7c=",
+        "lastModified": 1776118185,
+        "narHash": "sha256-7gh0sONRGuZIU0ziZeVRZITFXcbcNJfcvE//OBZxiiU=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "b4dac394ef1eff0ab51c0cb7004c05826988d846",
+        "rev": "68e3e822f392fa52b0af6ebf132af51c2b9b4e0c",
         "type": "github"
       },
       "original": {

From a01452bd591a4d6944b94a1dc277c1890e4917e2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Apr 2026 18:09:57 -0400
Subject: [PATCH 824/847] gitea-actions-runner: increase timeout to 6h

---
 services/gitea-actions-runner.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/gitea-actions-runner.nix b/services/gitea-actions-runner.nix
index d47e6ae..e650d23 100644
--- a/services/gitea-actions-runner.nix
+++ b/services/gitea-actions-runner.nix
@@ -29,7 +29,7 @@
     settings = {
       runner = {
         capacity = 1;
-        timeout = "3h";
+        timeout = "6h";
       };
     };
   };

From f28dd190bf2876eaf617d4807593822d91874689 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Apr 2026 20:04:26 -0400
Subject: [PATCH 825/847] move off of hardened kernel to latest LTS

---
 configuration.nix    |  4 +--
 modules/security.nix | 74 +++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 72 insertions(+), 6 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 59a0c4e..6b12195 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -133,8 +133,8 @@
   boot.kernel.sysctl."vm.nr_hugepages" = service_configs.hugepages_2m.total_pages;
 
   boot = {
-    # 6.12 LTS until 2026
-    kernelPackages = pkgs.linuxPackages_6_12_hardened;
+    # 6.18 LTS until 2027
+    kernelPackages = pkgs.linuxPackages_6_18;
 
     loader = {
       # Use the systemd-boot EFI boot loader.
diff --git a/modules/security.nix b/modules/security.nix
index 52d0a28..947bd7c 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -13,12 +13,78 @@
   # disable coredumps
   systemd.coredump.enable = false;
 
-  # The hardened kernel defaults kernel.unprivileged_userns_clone to 0, which
-  # prevents the Nix sandbox from mapping UIDs/GIDs. Without this, any derivation
-  # that calls `id` in its build phase (e.g. logrotate checkPhase) fails when not
-  # served from the binary cache. See https://github.com/NixOS/nixpkgs/issues/287194
+  # Needed for Nix sandbox UID/GID mapping inside derivation builds.
+  # See https://github.com/NixOS/nixpkgs/issues/287194
   security.unprivilegedUsernsClone = true;
 
+  # Disable kexec to prevent replacing the running kernel at runtime.
+  security.protectKernelImage = true;
+
+  # Kernel hardening boot parameters. These recover most of the runtime-
+  # configurable protections that the linux-hardened patchset provided.
+  boot.kernelParams = [
+    # Zero all page allocator pages on free / alloc. Prevents info leaks
+    # and use-after-free from seeing stale data. Modest CPU overhead.
+    "init_on_alloc=1"
+    "init_on_free=1"
+
+    # Prevent SLUB allocator from merging caches with similar size/flags.
+    # Keeps different kernel object types in separate slabs, making heap
+    # exploitation (type confusion, spray, use-after-free) significantly harder.
+    "slab_nomerge"
+
+    # Randomize order of pages returned by the buddy allocator.
+    "page_alloc.shuffle=1"
+
+    # Disable debugfs entirely (exposes kernel internals).
+    "debugfs=off"
+
+    # Disable legacy vsyscall emulation (unused by any modern glibc).
+    "vsyscall=none"
+
+    # Strict IOMMU TLB invalidation (no batching). Prevents DMA-capable
+    # devices from accessing stale mappings after unmap.
+    "iommu.strict=1"
+  ];
+
+  boot.kernel.sysctl = {
+    # Immediately reboot on kernel oops (don't leave a compromised
+    # kernel running). Negative value = reboot without delay.
+    "kernel.panic" = -1;
+
+    # Hide kernel pointers from all processes, including CAP_SYSLOG.
+    # Prevents info leaks used to defeat KASLR.
+    "kernel.kptr_restrict" = 2;
+
+    # Disable bpf() JIT compiler (eliminates JIT spray attack vector).
+    "net.core.bpf_jit_enable" = false;
+
+    # Disable ftrace (kernel function tracer) at runtime.
+    "kernel.ftrace_enabled" = false;
+
+    # Strict reverse-path filtering: drop packets arriving on an interface
+    # where the source address isn't routable back via that interface.
+    "net.ipv4.conf.all.rp_filter" = 1;
+    "net.ipv4.conf.default.rp_filter" = 1;
+    "net.ipv4.conf.all.log_martians" = true;
+    "net.ipv4.conf.default.log_martians" = true;
+
+    # Ignore ICMP redirects (prevents route table poisoning).
+    "net.ipv4.conf.all.accept_redirects" = false;
+    "net.ipv4.conf.all.secure_redirects" = false;
+    "net.ipv4.conf.default.accept_redirects" = false;
+    "net.ipv4.conf.default.secure_redirects" = false;
+    "net.ipv6.conf.all.accept_redirects" = false;
+    "net.ipv6.conf.default.accept_redirects" = false;
+
+    # Don't send ICMP redirects (we are not a router).
+    "net.ipv4.conf.all.send_redirects" = false;
+    "net.ipv4.conf.default.send_redirects" = false;
+
+    # Ignore broadcast ICMP (SMURF amplification mitigation).
+    "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+  };
+
   services = {
     dbus.implementation = "broker";
     /*

From 0c70c2b2b4222c3b224b2b0742946f565350b3a2 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Apr 2026 20:55:39 -0400
Subject: [PATCH 826/847] add infra for providing updates to yarn

---
 services/harmonia.nix | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/services/harmonia.nix b/services/harmonia.nix
index 002735e..f4b6b73 100644
--- a/services/harmonia.nix
+++ b/services/harmonia.nix
@@ -17,8 +17,22 @@
     settings.bind = "127.0.0.1:${toString service_configs.ports.private.harmonia.port}";
   };
 
+  # serve latest deploy store paths (unauthenticated — just a path string)
+  # CI writes to /var/lib/dotfiles-deploy/<hostname> after building
   services.caddy.virtualHosts."nix-cache.${service_configs.https.domain}".extraConfig = ''
-    import ${config.age.secrets.nix-cache-auth.path}
-    reverse_proxy :${toString service_configs.ports.private.harmonia.port}
+    handle_path /deploy/* {
+        root * /var/lib/dotfiles-deploy
+        file_server
+    }
+
+    handle {
+        import ${config.age.secrets.nix-cache-auth.path}
+        reverse_proxy :${toString service_configs.ports.private.harmonia.port}
+    }
   '';
+
+  # directory for CI to record latest deploy store paths
+  systemd.tmpfiles.rules = [
+    "d /var/lib/dotfiles-deploy 0755 gitea-runner gitea-runner"
+  ];
 }

From a0085187a9ddf1dbb998ed359d2cfb800e298bec Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 14 Apr 2026 21:59:08 -0400
Subject: [PATCH 827/847] fix systemd-tmpfiles

---
 modules/security.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/modules/security.nix b/modules/security.nix
index 947bd7c..a0961c6 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -83,6 +83,17 @@
 
     # Ignore broadcast ICMP (SMURF amplification mitigation).
     "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+
+    # Filesystem hardening: prevent hardlink/symlink-based attacks.
+    # protected_hardlinks/symlinks: block unprivileged creation of hard/symlinks
+    # to files the user doesn't own (prevents TOCTOU privilege escalation).
+    # protected_fifos/regular (level 2): restrict opening FIFOs and regular files
+    # in world-writable sticky directories to owner/group match only.
+    # Also required for systemd-tmpfiles to chmod hardlinked files.
+    "fs.protected_hardlinks" = true;
+    "fs.protected_symlinks" = true;
+    "fs.protected_fifos" = 2;
+    "fs.protected_regular" = 2;
   };
 
   services = {

From 5b98e6197e75a4e708c3fbc654ca9c68788bfa45 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 18:07:44 -0400
Subject: [PATCH 828/847] kernel: rollback to 6.12

Major ZFS issue causing deadlocks on my system:
https://github.com/openzfs/zfs/issues/18426
---
 configuration.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 6b12195..0be5282 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -133,8 +133,10 @@
   boot.kernel.sysctl."vm.nr_hugepages" = service_configs.hugepages_2m.total_pages;
 
   boot = {
-    # 6.18 LTS until 2027
-    kernelPackages = pkgs.linuxPackages_6_18;
+    # 6.12 LTS until 2027-03. Kernel 6.18 causes a reproducible ZFS deadlock
+    # in dbuf_evict due to page allocator changes (__free_frozen_pages).
+    # https://github.com/openzfs/zfs/issues/18426
+    kernelPackages = pkgs.linuxPackages_6_12;
 
     loader = {
       # Use the systemd-boot EFI boot loader.

From 0289ce0856422241317404145d5d9ac4ea28fe30 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 18:08:15 -0400
Subject: [PATCH 829/847] xmrig-auto-pause: tweak resume_threshold

---
 services/monero/xmrig-auto-pause.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/services/monero/xmrig-auto-pause.nix b/services/monero/xmrig-auto-pause.nix
index 3c0190c..80107a5 100644
--- a/services/monero/xmrig-auto-pause.nix
+++ b/services/monero/xmrig-auto-pause.nix
@@ -26,11 +26,12 @@ lib.mkIf config.services.xmrig.enable {
     environment = {
       POLL_INTERVAL = "3";
       GRACE_PERIOD = "15";
-      # This server's background services (qbittorrent, monero, bazarr, etc.)
-      # produce 5-14% non-nice CPU during normal operation. Thresholds must
-      # sit above that noise floor.
+      # Background services (qbittorrent, bitmagnet, postgresql, etc.) produce
+      # 15-25% non-nice CPU during normal operation. The stop threshold must
+      # sit above transient spikes; the resume threshold must be below the
+      # steady-state floor to avoid restarting xmrig while services are active.
       CPU_STOP_THRESHOLD = "40";
-      CPU_RESUME_THRESHOLD = "30";
+      CPU_RESUME_THRESHOLD = "10";
       STARTUP_COOLDOWN = "10";
       STATE_DIR = "/var/lib/xmrig-auto-pause";
     };

From 48efd7fcf72ad103171d2c42cdaeb2fee335b5d3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 18:08:22 -0400
Subject: [PATCH 830/847] qbittorent: fix (?) perms

---
 services/qbittorrent.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 666385d..0591e18 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -23,7 +23,9 @@ in
     (lib.serviceFilePerms "qbittorrent" [
       # 0770: group (media) needs write to delete files during upgrades —
       # Radarr/Sonarr must unlink the old file before placing the new one.
-      "Z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group}"
+      # Non-recursive (z not Z): UMask=0007 ensures new files get correct perms.
+      # A recursive Z rule would walk millions of files on the HDD pool at every boot.
+      "z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.SavePath} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group}"
       "z ${config.services.qbittorrent.serverConfig.Preferences.Downloads.TempPath} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
       "Z ${config.services.qbittorrent.profileDir} 0700 ${config.services.qbittorrent.user} ${config.services.qbittorrent.group}"
     ])

From aecd9002b072f8ce13d793b7d0951f3546ba7897 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 13:25:38 -0400
Subject: [PATCH 831/847] zfs tuning

---
 modules/zfs.nix | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/modules/zfs.nix b/modules/zfs.nix
index c447c34..4e5da01 100644
--- a/modules/zfs.nix
+++ b/modules/zfs.nix
@@ -1,15 +1,39 @@
 {
   config,
+  lib,
   service_configs,
   pkgs,
   ...
 }:
+let
+  # Total RAM in bytes (from /proc/meminfo: 65775836 KiB).
+  totalRamBytes = 65775836 * 1024;
+
+  # Hugepage reservations that the kernel carves out before ZFS can use them.
+  hugepages2mBytes = service_configs.hugepages_2m.total_pages * 2 * 1024 * 1024;
+  hugepages1gBytes = 3 * 1024 * 1024 * 1024; # 3x 1G pages for RandomX (xmrig.nix)
+  totalHugepageBytes = hugepages2mBytes + hugepages1gBytes;
+
+  # ARC max: 60% of RAM remaining after hugepages. Leaves headroom for
+  # application RSS (PostgreSQL, qBittorrent, Jellyfin, Grafana, etc.),
+  # kernel slabs, and page cache.
+  arcMaxBytes = (totalRamBytes - totalHugepageBytes) * 60 / 100;
+in
 {
-  boot.zfs.package = pkgs.zfs;
+  boot.zfs.package = pkgs.zfs_2_4;
   boot.initrd.kernelModules = [ "zfs" ];
 
   boot.kernelParams = [
-    "zfs.zfs_txg_timeout=120" # longer TXG open time = larger sequential writes
+    # 120s TXG timeout: batch more dirty data per transaction group so the
+    # HDD pool (hdds) writes larger, sequential I/Os instead of many small syncs.
+    # This is a global setting (no per-pool control); the SSD pool (tank) syncs
+    # infrequently but handles it fine since SSDs don't suffer from seek overhead.
+    "zfs.zfs_txg_timeout=120"
+
+    # Cap ARC to prevent it from claiming memory reserved for hugepages.
+    # Without this, ZFS auto-sizes c_max to ~62 GiB on a 64 GiB system,
+    # ignoring the 11.5 GiB of hugepage reservations.
+    "zfs.zfs_arc_max=${toString arcMaxBytes}"
 
     # vdev I/O scheduler: feed more concurrent reads to the block scheduler so
     # mq-deadline has a larger pool of requests to sort and merge into elevator sweeps.

From 20ca9454362ef3c7a524cc7111fd2360d0570625 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 18:46:26 -0400
Subject: [PATCH 832/847] qbt: create timer to flush WAL

---
 services/qbittorrent.nix | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/services/qbittorrent.nix b/services/qbittorrent.nix
index 0591e18..a4274a5 100644
--- a/services/qbittorrent.nix
+++ b/services/qbittorrent.nix
@@ -164,6 +164,35 @@ in
     _: path: "d ${path} 0770 ${config.services.qbittorrent.user} ${service_configs.media_group} -"
   ) service_configs.torrent.categories;
 
+  # Periodically checkpoint qBittorrent's SQLite WAL (Write-Ahead Log).
+  # qBittorrent holds a read transaction open for its entire lifetime,
+  # preventing SQLite's auto-checkpoint from running. The WAL grows
+  # unbounded (observed: 405 MB) and must be replayed on next startup,
+  # causing 10+ minute "internal preparations" hangs.
+  # A second sqlite3 connection can checkpoint concurrently and safely.
+  # See: https://github.com/qbittorrent/qBittorrent/issues/20433
+  systemd.services.qbittorrent-wal-checkpoint = {
+    description = "Checkpoint qBittorrent SQLite WAL";
+    after = [ "qbittorrent.service" ];
+    requires = [ "qbittorrent.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.sqlite}/bin/sqlite3 ${config.services.qbittorrent.profileDir}/qBittorrent/data/torrents.db 'PRAGMA wal_checkpoint(TRUNCATE);'";
+      User = config.services.qbittorrent.user;
+      Group = config.services.qbittorrent.group;
+    };
+  };
+
+  systemd.timers.qbittorrent-wal-checkpoint = {
+    description = "Periodically checkpoint qBittorrent SQLite WAL";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnUnitActiveSec = "4h";
+      OnBootSec = "30min";
+      RandomizedDelaySec = "10min";
+    };
+  };
+
   users.users.${config.services.qbittorrent.user}.extraGroups = [
     service_configs.media_group
   ];

From 55fda4b5ee99f278fbfcef8e0024c0a1c562535b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Wed, 15 Apr 2026 21:30:06 -0400
Subject: [PATCH 833/847] update (including llamacpp)

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4b6f5b3..0566f79 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,11 +304,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1775866084,
-        "narHash": "sha256-mWn8D/oXXAaqeFFFRorKHvTLw5V9M8eYzAWRr4iffag=",
+        "lastModified": 1776248416,
+        "narHash": "sha256-TC6yzbCAex1pDfqUZv9u8fVm8e17ft5fNrcZ0JRDOIQ=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "29d2cca7fc3841708c1d48e2d1272f79db1538b6",
+        "rev": "18e9e64bae15b828c092658335599122a6db939b",
         "type": "github"
       },
       "original": {
@@ -325,11 +325,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775754125,
-        "narHash": "sha256-4udYhEvii0xPmRiKXYWLhPakPDd1mJppnEFY6uWdv8s=",
+        "lastModified": 1776301820,
+        "narHash": "sha256-Yr3JRZ05PNmX4sR2Ak7e0jT+oCQgTAAML7FUoyTmitk=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "8590cbff961dbaf1d3a9793fd11d402e248869b9",
+        "rev": "1073622985bb68075472474b4b0fdfcdabcfc9d0",
         "type": "github"
       },
       "original": {
@@ -368,11 +368,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1776051551,
-        "narHash": "sha256-zqDhVyUtctq7HlpMC9cdR277ner0L/f7SkC3oKbZwy0=",
+        "lastModified": 1776223637,
+        "narHash": "sha256-xi+0w4fJ3IlR2YwGrTphCopNvtGotEk0TF1ghg2fy0A=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c5eb01b60873e331265779028a839cd2b5237874",
+        "rev": "3328b386618e89f2a885805b94b610ec4d379df1",
         "type": "github"
       },
       "original": {
@@ -715,11 +715,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1776118185,
-        "narHash": "sha256-7gh0sONRGuZIU0ziZeVRZITFXcbcNJfcvE//OBZxiiU=",
+        "lastModified": 1776290985,
+        "narHash": "sha256-eNWDOLBA0vk1TiKqse71siIAgLycjvBFDw35eAtnUPs=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "68e3e822f392fa52b0af6ebf132af51c2b9b4e0c",
+        "rev": "9bb380b3c2a641a3289f92dedef97016f2e47f36",
         "type": "github"
       },
       "original": {

From 599031944514daeba6bc8adbdd79e4a44d78af8b Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 01:30:10 -0400
Subject: [PATCH 834/847] jellyfin: fix caddy reverse proxy

---
 services/jellyfin/jellyfin.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/services/jellyfin/jellyfin.nix b/services/jellyfin/jellyfin.nix
index b80e842..d37df91 100644
--- a/services/jellyfin/jellyfin.nix
+++ b/services/jellyfin/jellyfin.nix
@@ -26,6 +26,14 @@
 
   services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
     reverse_proxy :${builtins.toString service_configs.ports.private.jellyfin.port} {
+      # Disable response buffering for streaming. Caddy's default partial
+      # buffering delays fMP4-HLS segments and direct-play responses where
+      # Content-Length is known (so auto-flush doesn't trigger).
+      flush_interval -1
+      transport http {
+        # Localhost: compression wastes CPU re-encoding already-compressed media.
+        compression off
+      }
       header_up X-Real-IP {remote_host}
       header_up X-Forwarded-For {remote_host}
       header_up X-Forwarded-Proto {scheme}

From daae941d361dbe73b556e0cb1bcea0c2b5bfff1d Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 14:35:23 -0400
Subject: [PATCH 835/847] minecraft: 1.21.1 -> 26.1.2

---
 services/minecraft.nix | 73 ++++++++++++++++++++----------------------
 1 file changed, 35 insertions(+), 38 deletions(-)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index adfd500..d002d4d 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -37,7 +37,7 @@
 
     servers.${service_configs.minecraft.server_name} = {
       enable = true;
-      package = pkgs.fabricServers.fabric-1_21_11;
+      package = pkgs.fabricServers.fabric-26_1_2.override { jre_headless = pkgs.openjdk25_headless; };
 
       jvmOpts = lib.concatStringsSep " " [
         # Memory
@@ -92,71 +92,68 @@
           with pkgs;
           builtins.attrValues {
             FabricApi = fetchurl {
-              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/i5tSkVBH/fabric-api-0.141.3%2B1.21.11.jar";
-              sha512 = "c20c017e23d6d2774690d0dd774cec84c16bfac5461da2d9345a1cd95eee495b1954333c421e3d1c66186284d24a433f6b0cced8021f62e0bfa617d2384d0471";
+              url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/fm7UYECV/fabric-api-0.145.4%2B26.1.2.jar";
+              sha512 = "ffd5ef62a745f76cd2e5481252cb7bc67006c809b4f436827d05ea22c01d19279e94a3b24df3d57e127af1cd08440b5de6a92a4ea8f39b2dcbbe1681275564c3";
             };
 
-            FerriteCore = fetchurl {
-              url = "https://cdn.modrinth.com/data/uXXizFIs/versions/Ii0gP3D8/ferritecore-8.2.0-fabric.jar";
-              sha512 = "3210926a82eb32efd9bcebabe2f6c053daf5c4337eebc6d5bacba96d283510afbde646e7e195751de795ec70a2ea44fef77cb54bf22c8e57bb832d6217418869";
-            };
+            # No 26.1.2 version available
+            # FerriteCore = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/uXXizFIs/versions/d5ddUdiB/ferritecore-9.0.0-fabric.jar";
+            #   sha512 = "d81fa97e11784c19d42f89c2f433831d007603dd7193cee45fa177e4a6a9c52b384b198586e04a0f7f63cd996fed713322578bde9a8db57e1188854ae5cbe584";
+            # };
 
             Lithium = fetchurl {
-              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/Ow7wA0kG/lithium-fabric-0.21.4%2Bmc1.21.11.jar";
-              sha512 = "f14a5c3d2fad786347ca25083f902139694f618b7c103947f2fd067a7c5ee88a63e1ef8926f7d693ea79ed7d00f57317bae77ef9c2d630bf5ed01ac97a752b94";
+              url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/v2xoRvRP/lithium-fabric-0.24.1%2Bmc26.1.2.jar";
+              sha512 = "8711bc8c6f39be4c8511becb7a68e573ced56777bd691639f2fc62299b35bb4ccd2efe4a39bd9c308084b523be86a5f5c4bf921ab85f7a22bf075d8ea2359621";
             };
 
             NoChatReports = fetchurl {
-              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/rhykGstm/NoChatReports-FABRIC-1.21.11-v2.18.0.jar";
-              sha512 = "d2c35cc8d624616f441665aff67c0e366e4101dba243bad25ed3518170942c1a3c1a477b28805cd1a36c44513693b1c55e76bea627d3fced13927a3d67022ccc";
+              url = "https://cdn.modrinth.com/data/qQyHxfxd/versions/2yrLNE3S/NoChatReports-FABRIC-26.1-v2.19.0.jar";
+              sha512 = "94d58a1a4cde4e3b1750bdf724e65c5f4ff3436c2532f36a465d497d26bf59f5ac996cddbff8ecdfed770c319aa2f2dcc9c7b2d19a35651c2a7735c5b2124dad";
             };
 
             squaremap = fetchurl {
-              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/BW8lMXBi/squaremap-fabric-mc1.21.11-1.3.12.jar";
-              sha512 = "f62eb791a3f5812eb174565d318f2e6925353f846ef8ac56b4e595f481494e0c281f26b9e9fcfdefa855093c96b735b12f67ee17c07c2477aa7a3439238670d9";
+              url = "https://cdn.modrinth.com/data/PFb7ZqK6/versions/UBN6MFvH/squaremap-fabric-mc26.1.2-1.3.13.jar";
+              sha512 = "97bc130184b5d0ddc4ff98a15acef6203459d982e0e2afbd49a2976d546c55a86ef22b841378b51dd782be9b2cfbe4cfa197717f2b7f6800fd8b4ff4df6e564f";
             };
 
             scalablelux = fetchurl {
-              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/PV9KcrYQ/ScalableLux-0.1.6%2Bfabric.c25518a-all.jar";
-              sha512 = "729515c1e75cf8d9cd704f12b3487ddb9664cf9928e7b85b12289c8fbbc7ed82d0211e1851375cbd5b385820b4fedbc3f617038fff5e30b302047b0937042ae7";
+              url = "https://cdn.modrinth.com/data/Ps1zyz6x/versions/gYbHVCz8/ScalableLux-0.2.0%2Bfabric.2b63825-all.jar";
+              sha512 = "48565a4d8a1cbd623f0044086d971f2c0cf1c40e1d0b6636a61d41512f4c1c1ddff35879d9dba24b088a670ee254e2d5842d13a30b6d76df23706fa94ea4a58b";
             };
 
             c2me = fetchurl {
-              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/QdLiMUjx/c2me-fabric-mc1.21.11-0.3.7%2Balpha.0.7.jar";
-              sha512 = "f9543febe2d649a82acd6d5b66189b6a3d820cf24aa503ba493fdb3bbd4e52e30912c4c763fe50006f9a46947ae8cd737d420838c61b93429542573ed67f958e";
+              url = "https://cdn.modrinth.com/data/VSNURh3q/versions/yrNQQ1AQ/c2me-fabric-mc26.1.2-0.3.7%2Balpha.0.65.jar";
+              sha512 = "6666ebaa3bfa403e386776590fc845b7c306107d37ebc7b1be3b057893fbf9f933abb2314c171d7fe19c177cf8823cb47fdc32040d34a9704f5ab656dd5d93f8";
             };
 
-            krypton = fetchurl {
-              url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/O9LmWYR7/krypton-0.2.10.jar";
-              sha512 = "4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab";
-            };
+            # No 26.1 version available
+            # krypton = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/O9LmWYR7/krypton-0.2.10.jar";
+            #   sha512 = "4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab";
+            # };
 
-            better-fabric-console = fetchurl {
-              url = "https://cdn.modrinth.com/data/Y8o1j1Sf/versions/6aIKl5wy/better-fabric-console-mc1.21.11-1.2.9.jar";
-              sha512 = "427247dafd99df202ee10b4bf60ffcbbecbabfadb01c167097ffb5b85670edb811f4d061c2551be816295cbbc6b8ec5ec464c14a6ff41912ef1f6c57b038d320";
-            };
-
-            disconnect-packet-fix = fetchurl {
-              url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/Gv74xveQ/disconnect-packet-fix-fabric-2.0.0.jar";
-              sha512 = "1fd6f09a41ce36284e1a8e9def53f3f6834d7201e69e54e24933be56445ba569fbc26278f28300d36926ba92db6f4f9c0ae245d23576aaa790530345587316db";
-            };
+            # No 26.1.2 version available
+            # disconnect-packet-fix = fetchurl {
+            #   url = "https://cdn.modrinth.com/data/rd9rKuJT/versions/x9gVeaTU/disconnect-packet-fix-fabric-2.1.0.jar";
+            #   sha512 = "bf84d02bdcd737706df123e452dd31ef535580fa4ced6af1e4ceea022fef94e4764775253e970b8caa1292e2fa00eb470557f70b290fafdb444479fa801b07a1";
+            # };
 
             packet-fixer = fetchurl {
-              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/CUh1DWeO/packetfixer-fabric-3.3.4-1.21.11.jar";
-              sha512 = "33331b16cb40c5e6fbaade3cacc26f3a0e8fa5805a7186f94d7366a0e14dbeee9de2d2e8c76fa71f5e9dd24eb1c261667c35447e32570ea965ca0f154fdfba0a";
+              url = "https://cdn.modrinth.com/data/c7m1mi73/versions/M8PqPQr4/packetfixer-fabric-3.3.4-26.1.2.jar";
+              sha512 = "698020edba2a1fd80bb282bfd4832a00d6447b08eaafbc2e16a8f3bf89e187fc9a622c92dfe94ae140dd485fc0220a86890f12158ec08054e473fef8337829bc";
             };
 
-            # fork of Modernfix for 1.21.11 (upstream will support 26.1)
+            # mVUS fork: upstream ModernFix no longer ships Fabric builds
             modernfix = fetchurl {
-              url = "https://cdn.modrinth.com/data/TjSm1wrD/versions/JwSO8JCN/modernfix-5.25.2-build.4.jar";
-              sha512 = "0d65c05ac0475408c58ef54215714e6301113101bf98bfe4bb2ba949fbfddd98225ac4e2093a5f9206a9e01ba80a931424b237bdfa3b6e178c741ca6f7f8c6a3";
+              url = "https://cdn.modrinth.com/data/TjSm1wrD/versions/dqQ7mabN/modernfix-5.26.2-build.1.jar";
+              sha512 = "fbef93c2dabf7bcd0ccd670226dfc4958f7ebe5d8c2b1158e88a65e6954a40f595efd58401d2a3dbb224660dca5952199cf64df29100e7bd39b1b1941290b57b";
             };
 
             debugify = fetchurl {
-              url = "https://cdn.modrinth.com/data/QwxR6Gcd/versions/8Q49lnaU/debugify-1.21.11%2B1.0.jar";
-              sha512 = "04d82dd33f44ced37045f1f9a54ad4eacd70861ff74a8800f2d2df358579e6cb0ea86a34b0086b3e87026b1a0691dd6594b4fdc49f89106466eea840518beb03";
+              url = "https://cdn.modrinth.com/data/QwxR6Gcd/versions/mfTTfiKn/debugify-26.1.2%2B1.0.jar";
+              sha512 = "63db82f2163b9f7fc27ebea999ffcd7a961054435b3ed7d8bf32d905b5f60ce81715916b7fd4e9509dd23703d5492059f3ce7e5f176402f8ed4f985a415553f4";
             };
-
           }
         );
       };

From 92f44d6c71b52e0f5b587f0f175470d325918b18 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 14:35:28 -0400
Subject: [PATCH 836/847] Reapply "minecraft: tweak jvm args"

This reverts commit 82a383482e1c534d1793c021a6d85a5e441f4870.
---
 services/minecraft.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/minecraft.nix b/services/minecraft.nix
index d002d4d..ea201cf 100644
--- a/services/minecraft.nix
+++ b/services/minecraft.nix
@@ -43,9 +43,15 @@
         # Memory
         "-Xmx${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
         "-Xms${builtins.toString service_configs.minecraft.memory.heap_size_m}M"
+
         # GC
         "-XX:+UseZGC"
         "-XX:+ZGenerational"
+
+        # added in new minecraft version
+        "-XX:+UseCompactObjectHeaders"
+        "-XX:+UseStringDeduplication"
+
         # Base JVM optimizations (brucethemoose/Minecraft-Performance-Flags-Benchmarks)
         "-XX:+UnlockExperimentalVMOptions"
         "-XX:+UnlockDiagnosticVMOptions"
@@ -67,6 +73,7 @@
         "-XX:NonProfiledCodeHeapSize=194M"
         "-XX:NmethodSweepActivity=1"
         "-XX:+UseVectorCmov"
+
         # Large pages (requires vm.nr_hugepages sysctl)
         "-XX:+UseLargePages"
         "-XX:LargePageSizeInBytes=${builtins.toString service_configs.minecraft.memory.large_page_size_m}M"

From 2aa401a9efbb6c7ca8bbc44ff50322d7bf3125c3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 16:47:27 -0400
Subject: [PATCH 837/847] update

---
 flake.lock | 70 ++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 52 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0566f79..085f822 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27,16 +27,17 @@
     },
     "arr-init": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1776124758,
-        "narHash": "sha256-bWLlqMPM5bh6KzENwWN8gIVXm41ptR6/1/k472yzjQo=",
+        "lastModified": 1776371728,
+        "narHash": "sha256-Xap/Om+nYRjOHU8zcyMQzFoBMi57X90TTHy03/UFadA=",
         "ref": "refs/heads/main",
-        "rev": "60fcce47df643c02d5a41d47719c2cdb2c0f327e",
-        "revCount": 13,
+        "rev": "9635aecb810a2d7d8db4f066b75a421d0a45bdf3",
+        "revCount": 19,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },
@@ -193,7 +194,25 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -365,14 +384,14 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1776223637,
-        "narHash": "sha256-xi+0w4fJ3IlR2YwGrTphCopNvtGotEk0TF1ghg2fy0A=",
+        "lastModified": 1776310483,
+        "narHash": "sha256-xMFl+umxGmo5VEgcZcXT5Dk9sXU5WyTRz1Olpywr/60=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "3328b386618e89f2a885805b94b610ec4d379df1",
+        "rev": "74abd91054e2655d6c392428a27e5d27edd5e6bf",
         "type": "github"
       },
       "original": {
@@ -399,11 +418,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776067740,
-        "narHash": "sha256-B35lpsqnSZwn1Lmz06BpwF7atPgFmUgw1l8KAV3zpVQ=",
+        "lastModified": 1776221942,
+        "narHash": "sha256-FbQAeVNi7G4v3QCSThrSAAvzQTmrmyDLiHNPvTF2qFM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7e495b747b51f95ae15e74377c5ce1fe69c1765f",
+        "rev": "1766437c5509f444c1b15331e82b8b6a9b967000",
         "type": "github"
       },
       "original": {
@@ -503,7 +522,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1771989937,
@@ -624,11 +643,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776047941,
-        "narHash": "sha256-XjIqkHJjn5e5UbwS2Nl63uBOF1AaC5coRiO+ukENAmM=",
+        "lastModified": 1776306894,
+        "narHash": "sha256-l4N3O1cfXiQCHJGspAkg6WlZyOFBTbLXhi8Anf8jB0g=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "df399d4ba5d7f4ddd8dae16e5ace5a70e958153d",
+        "rev": "01d98209264c78cb323b636d7ab3fe8e7a8b60c7",
         "type": "github"
       },
       "original": {
@@ -712,6 +731,21 @@
         "type": "github"
       }
     },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "trackerlist": {
       "flake": false,
       "locked": {
@@ -730,7 +764,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -779,7 +813,7 @@
     },
     "ytbn-graphing-software": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_3",
         "rust-overlay": "rust-overlay_2"
       },

From 7d77926f8a192827a5c480be92f6a02e4ac4f79a Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 17:33:54 -0400
Subject: [PATCH 838/847] update arr-init

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 085f822..15d773a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -33,11 +33,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776371728,
-        "narHash": "sha256-Xap/Om+nYRjOHU8zcyMQzFoBMi57X90TTHy03/UFadA=",
+        "lastModified": 1776375011,
+        "narHash": "sha256-zhR4n3JINny+jDh5oZncOA1KgpYEeWdCRYNqSH2iZ/w=",
         "ref": "refs/heads/main",
-        "rev": "9635aecb810a2d7d8db4f066b75a421d0a45bdf3",
-        "revCount": 19,
+        "rev": "a1ae022dc37a19d5432bce7f9a0e5c0b084bc20d",
+        "revCount": 18,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },

From 2c67b9729b58374a74f6d1f0d7a60a06407f8df8 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Thu, 16 Apr 2026 17:45:19 -0400
Subject: [PATCH 839/847] arr-init: fix prowlarr health check failure

Disable health checks on Prowlarr -- the synced-app testall endpoint
requires Sonarr/Radarr to reverse-connect to prowlarrUrl, which is
unreachable across the wg namespace boundary.

Also add networkNamespaceService = "wg" for the new configurable
namespace service dependency (replaces old hardcoded wg.service).
---
 services/arr/init.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/services/arr/init.nix b/services/arr/init.nix
index 63f8dd3..5f72c0d 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -8,7 +8,10 @@
       dataDir = service_configs.prowlarr.dataDir;
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
-      healthChecks = true;
+      networkNamespaceService = "wg";
+      # Synced-app health checks require Sonarr/Radarr to reverse-connect to
+      # prowlarrUrl, which is unreachable across the wg namespace boundary.
+      healthChecks = false;
       syncedApps = [
         {
           name = "Sonarr";

From 2f09c800e0ded4839be4dde1dd88cddd4e1c95b3 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 00:38:44 -0400
Subject: [PATCH 840/847] update arr-init

---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 15d773a..6bf2e7e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -33,11 +33,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776375011,
-        "narHash": "sha256-zhR4n3JINny+jDh5oZncOA1KgpYEeWdCRYNqSH2iZ/w=",
+        "lastModified": 1776400712,
+        "narHash": "sha256-BELV1YMBuLL0aQNQ3SLvSLq8YN5h2o1jcrwz1+Zt32Q=",
         "ref": "refs/heads/main",
-        "rev": "a1ae022dc37a19d5432bce7f9a0e5c0b084bc20d",
-        "revCount": 18,
+        "rev": "fdb9433344645802ba2c43e9381700aa2ef59017",
+        "revCount": 19,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
       },

From df57d636f55c276b4d40acd570ccce0b3cbc15f4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 00:47:08 -0400
Subject: [PATCH 841/847] arr: declare critical config.xml elements via
 configXml

Pin <Port>, <BindAddress>, and <EnableSsl> in each arr service's
config.xml through arr-init's new configXml option. A preStart hook
ensures these elements exist before the service reads its config,
fixing the recurring Prowlarr bug where <Port> was absent from
config.xml and the service would run without binding any socket.

Updates arr-init lock to 6dde2a3.
---
 flake.lock            |  4 ++--
 services/arr/init.nix | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/flake.lock b/flake.lock
index 6bf2e7e..39560d9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -33,10 +33,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1776400712,
+        "lastModified": 1776401121,
         "narHash": "sha256-BELV1YMBuLL0aQNQ3SLvSLq8YN5h2o1jcrwz1+Zt32Q=",
         "ref": "refs/heads/main",
-        "rev": "fdb9433344645802ba2c43e9381700aa2ef59017",
+        "rev": "6dde2a3e0d087208b8084b61113707c5533c4c2d",
         "revCount": 19,
         "type": "git",
         "url": "ssh://gitea@git.gardling.com/titaniumtown/arr-init"
diff --git a/services/arr/init.nix b/services/arr/init.nix
index 5f72c0d..7f3cf90 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -9,6 +9,14 @@
       apiVersion = "v1";
       networkNamespacePath = "/run/netns/wg";
       networkNamespaceService = "wg";
+      # Guarantee critical config.xml elements before startup. Prowlarr has a
+      # history of losing <Port> from config.xml, causing the service to run
+      # without binding any socket. See arr-init's configXml for details.
+      configXml = {
+        Port = service_configs.ports.private.prowlarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       # Synced-app health checks require Sonarr/Radarr to reverse-connect to
       # prowlarrUrl, which is unreachable across the wg namespace boundary.
       healthChecks = false;
@@ -40,6 +48,11 @@
       port = service_configs.ports.private.sonarr.port;
       dataDir = service_configs.sonarr.dataDir;
       healthChecks = true;
+      configXml = {
+        Port = service_configs.ports.private.sonarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       rootFolders = [ service_configs.media.tvDir ];
       naming = {
         renameEpisodes = true;
@@ -72,6 +85,11 @@
       port = service_configs.ports.private.radarr.port;
       dataDir = service_configs.radarr.dataDir;
       healthChecks = true;
+      configXml = {
+        Port = service_configs.ports.private.radarr.port;
+        BindAddress = "*";
+        EnableSsl = false;
+      };
       rootFolders = [ service_configs.media.moviesDir ];
       naming = {
         renameMovies = true;

From cebdd3ea96e36e0cbef560471d6e3b644e8c219f Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 00:53:24 -0400
Subject: [PATCH 842/847] arr: fix prowlarrUrl for cross-netns reachability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prowlarr runs in the wg VPN namespace; Sonarr/Radarr run in the host
namespace. Configuring the Prowlarr sync with prowlarrUrl=localhost:9696
made Sonarr/Radarr try to connect to their own localhost, where
Prowlarr does not exist — the host netns. Every indexer sync emitted
'Prowlarr URL is invalid' with Connection refused (localhost:9696).

Use vpnNamespaces.wg.namespaceAddress (192.168.15.1) so host-netns
clients hit the wg-side veth where Prowlarr is listening.

Also re-enables healthChecks on prowlarr-init: the /applications/testall
endpoint now validates clean (manually verified via API).
---
 services/arr/init.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/services/arr/init.nix b/services/arr/init.nix
index 7f3cf90..0ac1ac4 100644
--- a/services/arr/init.nix
+++ b/services/arr/init.nix
@@ -17,15 +17,17 @@
         BindAddress = "*";
         EnableSsl = false;
       };
-      # Synced-app health checks require Sonarr/Radarr to reverse-connect to
-      # prowlarrUrl, which is unreachable across the wg namespace boundary.
-      healthChecks = false;
+      # Prowlarr runs in the wg netns; Sonarr/Radarr in the host netns.
+      # From host netns, Prowlarr is reachable at the wg namespace address,
+      # not at localhost (which resolves to the host's own netns).
+      # Health checks can now run — the reverse-connect is reachable.
+      healthChecks = true;
       syncedApps = [
         {
           name = "Sonarr";
           implementation = "Sonarr";
           configContract = "SonarrSettings";
-          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
+          prowlarrUrl = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}";
           baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.sonarr.port}";
           apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml";
           serviceName = "sonarr";
@@ -34,7 +36,7 @@
           name = "Radarr";
           implementation = "Radarr";
           configContract = "RadarrSettings";
-          prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
+          prowlarrUrl = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}";
           baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.radarr.port}";
           apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml";
           serviceName = "radarr";

From 9ea45d4558f5cca3dd46b2a8f1a262cfef8cd578 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 19:47:20 -0400
Subject: [PATCH 843/847] hardware: tighten mq-deadline read_expire for
 jellyfin coexistence

---
 modules/hardware.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/modules/hardware.nix b/modules/hardware.nix
index 32ac735..81306e9 100644
--- a/modules/hardware.nix
+++ b/modules/hardware.nix
@@ -12,7 +12,7 @@ let
     parent=''${1%%[0-9]*}
     dev="/sys/block/$parent"
     [ -d "$dev/queue/iosched" ] || exit 0
-    echo 15000 > "$dev/queue/iosched/read_expire"
+    echo 500 > "$dev/queue/iosched/read_expire"
     echo 15000 > "$dev/queue/iosched/write_expire"
     echo 128 > "$dev/queue/iosched/fifo_batch"
     echo 16 > "$dev/queue/iosched/writes_starved"
@@ -36,11 +36,17 @@ in
   hardware.cpu.amd.updateMicrocode = true;
   hardware.enableRedistributableFirmware = true;
 
-  # HDD I/O tuning for torrent seeding workload (high-concurrency random reads).
+  # HDD I/O tuning for torrent seeding workload (high-concurrency random reads)
+  # sharing the pool with latency-sensitive sequential reads (Jellyfin playback).
   #
   # mq-deadline sorts requests into elevator sweeps, reducing seek distance.
-  # Aggressive deadlines (15s) let the scheduler accumulate more ops before dispatching,
-  # maximizing coalescence — latency is irrelevant since torrent peers tolerate 30-60s.
+  # read_expire=500ms keeps reads bounded so a Jellyfin segment can't queue for
+  # seconds behind a torrent burst; write_expire=15s lets the scheduler batch
+  # writes for coalescence (torrent writes are async and tolerate delay).
+  # The bulk of read coalescence already happens above the scheduler via ZFS
+  # aggregation (zfs_vdev_aggregation_limit=4M, read_gap_limit=128K,
+  # async_read_max=32), so the scheduler deadline only needs to be large enough
+  # to keep the elevator sweep coherent -- 500ms is plenty on rotational disks.
   # fifo_batch=128 keeps sweeps long; writes_starved=16 heavily favors reads.
   # 4 MiB readahead matches libtorrent piece extent affinity for sequential prefetch.
   #

From fc548a137f526d58d5b28ddef35667dd70719fbf Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 19:47:23 -0400
Subject: [PATCH 844/847] patches/nixpkgs: add jellyfin declarative network.xml
 options

---
 ...-add-declarative-network-xml-options.patch | 443 ++++++++++++++++++
 1 file changed, 443 insertions(+)
 create mode 100644 patches/nixpkgs/0002-jellyfin-add-declarative-network-xml-options.patch

diff --git a/patches/nixpkgs/0002-jellyfin-add-declarative-network-xml-options.patch b/patches/nixpkgs/0002-jellyfin-add-declarative-network-xml-options.patch
new file mode 100644
index 0000000..2bcfd11
--- /dev/null
+++ b/patches/nixpkgs/0002-jellyfin-add-declarative-network-xml-options.patch
@@ -0,0 +1,443 @@
+From f0582558f0a8b0ef543b3251c4a07afab89fde63 Mon Sep 17 00:00:00 2001
+From: Simon Gardling <titaniumtown@proton.me>
+Date: Fri, 17 Apr 2026 19:37:11 -0400
+Subject: [PATCH] nixos/jellyfin: add declarative network.xml options
+
+Adds services.jellyfin.network.* (baseUrl, ports, IPv4/6, LAN subnets,
+known proxies, remote IP filter, etc.) and services.jellyfin.forceNetworkConfig,
+mirroring the existing hardwareAcceleration / forceEncodingConfig pattern.
+
+Motivation: running Jellyfin behind a reverse proxy requires configuring
+KnownProxies (so the real client IP is extracted from X-Forwarded-For)
+and LocalNetworkSubnets (so LAN clients are correctly classified and not
+subject to RemoteClientBitrateLimit). These settings previously had no
+declarative option -- they could only be set via the web dashboard or
+by hand-editing network.xml, with no guarantee they would survive a
+reinstall or be consistent across deployments.
+
+Implementation:
+- Adds a networkXmlText template alongside the existing encodingXmlText.
+- Factors the force-vs-soft install logic out of preStart into a
+  small 'manage_config_xml' shell helper; encoding.xml and network.xml
+  now share the same install/backup semantics.
+- Extends the VM test with a machineWithNetworkConfig node and a
+  subtest that verifies the declared values land in network.xml,
+  Jellyfin parses them at startup, and the backup-on-overwrite path
+  works (same shape as the existing 'Force encoding config' subtest).
+---
+ nixos/modules/services/misc/jellyfin.nix | 303 ++++++++++++++++++++---
+ nixos/tests/jellyfin.nix                 |  50 ++++
+ 2 files changed, 317 insertions(+), 36 deletions(-)
+
+diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
+index 5c08fc478e45..387da907c652 100644
+--- a/nixos/modules/services/misc/jellyfin.nix
++++ b/nixos/modules/services/misc/jellyfin.nix
+@@ -26,8 +26,10 @@ let
+     bool
+     enum
+     ints
++    listOf
+     nullOr
+     path
++    port
+     str
+     submodule
+     ;
+@@ -68,6 +70,41 @@ let
+     </EncodingOptions>
+   '';
+   encodingXmlFile = pkgs.writeText "encoding.xml" encodingXmlText;
++  stringListToXml =
++    tag: items:
++    if items == [ ] then
++      "<${tag} />"
++    else
++      "<${tag}>\n    ${
++        concatMapStringsSep "\n    " (item: "<string>${escapeXML item}</string>") items
++      }\n  </${tag}>";
++  networkXmlText = ''
++    <?xml version="1.0" encoding="utf-8"?>
++    <NetworkConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
++      <BaseUrl>${escapeXML cfg.network.baseUrl}</BaseUrl>
++      <EnableHttps>${boolToString cfg.network.enableHttps}</EnableHttps>
++      <RequireHttps>${boolToString cfg.network.requireHttps}</RequireHttps>
++      <InternalHttpPort>${toString cfg.network.internalHttpPort}</InternalHttpPort>
++      <InternalHttpsPort>${toString cfg.network.internalHttpsPort}</InternalHttpsPort>
++      <PublicHttpPort>${toString cfg.network.publicHttpPort}</PublicHttpPort>
++      <PublicHttpsPort>${toString cfg.network.publicHttpsPort}</PublicHttpsPort>
++      <AutoDiscovery>${boolToString cfg.network.autoDiscovery}</AutoDiscovery>
++      <EnableUPnP>${boolToString cfg.network.enableUPnP}</EnableUPnP>
++      <EnableIPv4>${boolToString cfg.network.enableIPv4}</EnableIPv4>
++      <EnableIPv6>${boolToString cfg.network.enableIPv6}</EnableIPv6>
++      <EnableRemoteAccess>${boolToString cfg.network.enableRemoteAccess}</EnableRemoteAccess>
++      ${stringListToXml "LocalNetworkSubnets" cfg.network.localNetworkSubnets}
++      ${stringListToXml "LocalNetworkAddresses" cfg.network.localNetworkAddresses}
++      ${stringListToXml "KnownProxies" cfg.network.knownProxies}
++      <IgnoreVirtualInterfaces>${boolToString cfg.network.ignoreVirtualInterfaces}</IgnoreVirtualInterfaces>
++      ${stringListToXml "VirtualInterfaceNames" cfg.network.virtualInterfaceNames}
++      <EnablePublishedServerUriByRequest>${boolToString cfg.network.enablePublishedServerUriByRequest}</EnablePublishedServerUriByRequest>
++      ${stringListToXml "PublishedServerUriBySubnet" cfg.network.publishedServerUriBySubnet}
++      ${stringListToXml "RemoteIPFilter" cfg.network.remoteIPFilter}
++      <IsRemoteIPFilterBlacklist>${boolToString cfg.network.isRemoteIPFilterBlacklist}</IsRemoteIPFilterBlacklist>
++    </NetworkConfiguration>
++  '';
++  networkXmlFile = pkgs.writeText "network.xml" networkXmlText;
+   codecListToType =
+     desc: list:
+     submodule {
+@@ -205,6 +242,196 @@ in
+         '';
+       };
+ 
++      network = {
++        baseUrl = mkOption {
++          type = str;
++          default = "";
++          example = "/jellyfin";
++          description = ''
++            Prefix added to Jellyfin's internal URLs when it sits behind a reverse proxy at a sub-path.
++            Leave empty when Jellyfin is served at the root of its host.
++          '';
++        };
++
++        enableHttps = mkOption {
++          type = bool;
++          default = false;
++          description = ''
++            Serve HTTPS directly from Jellyfin. Usually unnecessary when terminating TLS in a reverse proxy.
++          '';
++        };
++
++        requireHttps = mkOption {
++          type = bool;
++          default = false;
++          description = ''
++            Redirect plaintext HTTP requests to HTTPS. Only meaningful when {option}`enableHttps` is true.
++          '';
++        };
++
++        internalHttpPort = mkOption {
++          type = port;
++          default = 8096;
++          description = "TCP port Jellyfin binds for HTTP.";
++        };
++
++        internalHttpsPort = mkOption {
++          type = port;
++          default = 8920;
++          description = "TCP port Jellyfin binds for HTTPS. Only used when {option}`enableHttps` is true.";
++        };
++
++        publicHttpPort = mkOption {
++          type = port;
++          default = 8096;
++          description = "HTTP port Jellyfin advertises in server discovery responses and published URIs.";
++        };
++
++        publicHttpsPort = mkOption {
++          type = port;
++          default = 8920;
++          description = "HTTPS port Jellyfin advertises in server discovery responses and published URIs.";
++        };
++
++        autoDiscovery = mkOption {
++          type = bool;
++          default = true;
++          description = "Respond to LAN client auto-discovery broadcasts (UDP 7359).";
++        };
++
++        enableUPnP = mkOption {
++          type = bool;
++          default = false;
++          description = "Attempt to open the public ports on the router via UPnP.";
++        };
++
++        enableIPv4 = mkOption {
++          type = bool;
++          default = true;
++          description = "Listen on IPv4.";
++        };
++
++        enableIPv6 = mkOption {
++          type = bool;
++          default = true;
++          description = "Listen on IPv6.";
++        };
++
++        enableRemoteAccess = mkOption {
++          type = bool;
++          default = true;
++          description = ''
++            Allow connections from clients outside the subnets listed in {option}`localNetworkSubnets`.
++            When false, Jellyfin rejects non-local requests regardless of reverse proxy configuration.
++          '';
++        };
++
++        localNetworkSubnets = mkOption {
++          type = listOf str;
++          default = [ ];
++          example = [
++            "192.168.1.0/24"
++            "10.0.0.0/8"
++          ];
++          description = ''
++            CIDR ranges (or bare IPs) that Jellyfin classifies as the local network.
++            Clients originating from these ranges -- as seen after {option}`knownProxies` X-Forwarded-For
++            unwrapping -- are not subject to {option}`services.jellyfin` remote-client bitrate limits.
++          '';
++        };
++
++        localNetworkAddresses = mkOption {
++          type = listOf str;
++          default = [ ];
++          example = [ "192.168.1.50" ];
++          description = ''
++            Specific interface addresses Jellyfin binds to. Leave empty to bind all interfaces.
++          '';
++        };
++
++        knownProxies = mkOption {
++          type = listOf str;
++          default = [ ];
++          example = [ "127.0.0.1" ];
++          description = ''
++            Addresses of reverse proxies trusted to forward the real client IP via `X-Forwarded-For`.
++            Without this, Jellyfin sees the proxy's address for every request and cannot apply
++            {option}`localNetworkSubnets` classification to the true client.
++          '';
++        };
++
++        ignoreVirtualInterfaces = mkOption {
++          type = bool;
++          default = true;
++          description = "Skip virtual network interfaces (matching {option}`virtualInterfaceNames`) during auto-bind.";
++        };
++
++        virtualInterfaceNames = mkOption {
++          type = listOf str;
++          default = [ "veth" ];
++          description = "Interface name prefixes treated as virtual when {option}`ignoreVirtualInterfaces` is true.";
++        };
++
++        enablePublishedServerUriByRequest = mkOption {
++          type = bool;
++          default = false;
++          description = ''
++            Derive the server's public URI from the incoming request's Host header instead of any
++            configured {option}`publishedServerUriBySubnet` entry.
++          '';
++        };
++
++        publishedServerUriBySubnet = mkOption {
++          type = listOf str;
++          default = [ ];
++          example = [ "192.168.1.0/24=http://jellyfin.lan:8096" ];
++          description = ''
++            Per-subnet overrides for the URI Jellyfin advertises to clients, in `subnet=uri` form.
++          '';
++        };
++
++        remoteIPFilter = mkOption {
++          type = listOf str;
++          default = [ ];
++          example = [ "203.0.113.0/24" ];
++          description = ''
++            IPs or CIDRs used as the allow- or denylist for remote access.
++            Behaviour is controlled by {option}`isRemoteIPFilterBlacklist`.
++          '';
++        };
++
++        isRemoteIPFilterBlacklist = mkOption {
++          type = bool;
++          default = false;
++          description = ''
++            When true, {option}`remoteIPFilter` is a denylist; when false, it is an allowlist
++            (and an empty list allows all remote addresses).
++          '';
++        };
++      };
++
++      forceNetworkConfig = mkOption {
++        type = bool;
++        default = false;
++        description = ''
++          Whether to overwrite Jellyfin's `network.xml` configuration file on each service start.
++
++          When enabled, the network configuration specified in {option}`services.jellyfin.network`
++          is applied on every service restart. A backup of the existing `network.xml` will be
++          created at `network.xml.backup-$timestamp`.
++
++          ::: {.warning}
++          Enabling this option means that any changes made to networking settings through
++          Jellyfin's web dashboard will be lost on the next service restart. The NixOS configuration
++          becomes the single source of truth for network settings.
++          :::
++
++          When disabled (the default), the network configuration is only written if no `network.xml`
++          exists yet. This allows settings to be changed through Jellyfin's web dashboard and persist
++          across restarts, but means the NixOS configuration options will be ignored after the initial setup.
++        '';
++      };
++
+       transcoding = {
+         maxConcurrentStreams = mkOption {
+           type = nullOr ints.positive;
+@@ -384,46 +611,50 @@ in
+         wants = [ "network-online.target" ];
+         wantedBy = [ "multi-user.target" ];
+ 
+-        preStart = mkIf cfg.hardwareAcceleration.enable (
+-          ''
+-            configDir=${escapeShellArg cfg.configDir}
+-            encodingXml="$configDir/encoding.xml"
+-          ''
+-          + (
+-            if cfg.forceEncodingConfig then
+-              ''
+-                if [[ -e $encodingXml ]]; then
++        preStart =
++          let
++            # manage_config_xml <source> <destination> <force> <description>
++            #
++            # Installs a NixOS-declared XML config at <destination>, preserving
++            # any existing file as a timestamped backup when <force> is true.
++            # With <force>=false, leaves existing files untouched and warns if
++            # the on-disk content differs from the declared content.
++            helper = ''
++              manage_config_xml() {
++                local src="$1" dest="$2" force="$3" desc="$4"
++                if [[ -e "$dest" ]]; then
+                   # this intentionally removes trailing newlines
+-                  currentText="$(<"$encodingXml")"
+-                  configuredText="$(<${encodingXmlFile})"
+-                  if [[ $currentText == "$configuredText" ]]; then
+-                    # don't need to do anything
+-                    exit 0
+-                  else
+-                    encodingXmlBackup="$configDir/encoding.xml.backup-$(date -u +"%FT%H_%M_%SZ")"
+-                    mv --update=none-fail -T "$encodingXml" "$encodingXmlBackup"
++                  local currentText configuredText
++                  currentText="$(<"$dest")"
++                  configuredText="$(<"$src")"
++                  if [[ "$currentText" == "$configuredText" ]]; then
++                    return 0
+                   fi
+-                fi
+-                cp --update=none-fail -T ${encodingXmlFile} "$encodingXml"
+-                chmod u+w "$encodingXml"
+-              ''
+-            else
+-              ''
+-                if [[ -e $encodingXml ]]; then
+-                  # this intentionally removes trailing newlines
+-                  currentText="$(<"$encodingXml")"
+-                  configuredText="$(<${encodingXmlFile})"
+-                  if [[ $currentText != "$configuredText" ]]; then
+-                    echo "WARN: $encodingXml already exists and is different from the configured settings. transcoding options NOT applied." >&2
+-                    echo "WARN: Set config.services.jellyfin.forceEncodingConfig = true to override." >&2
++                  if [[ "$force" == true ]]; then
++                    local backup
++                    backup="$dest.backup-$(date -u +"%FT%H_%M_%SZ")"
++                    mv --update=none-fail -T "$dest" "$backup"
++                  else
++                    echo "WARN: $dest already exists and is different from the configured settings. $desc options NOT applied." >&2
++                    echo "WARN: Set the corresponding force*Config option to override." >&2
++                    return 0
+                   fi
+-                else
+-                  cp --update=none-fail -T ${encodingXmlFile} "$encodingXml"
+-                  chmod u+w "$encodingXml"
+                 fi
+-              ''
+-          )
+-        );
++                cp --update=none-fail -T "$src" "$dest"
++                chmod u+w "$dest"
++              }
++              configDir=${escapeShellArg cfg.configDir}
++            '';
++          in
++          (
++            helper
++            + optionalString cfg.hardwareAcceleration.enable ''
++              manage_config_xml ${encodingXmlFile} "$configDir/encoding.xml" ${boolToString cfg.forceEncodingConfig} transcoding
++            ''
++            + ''
++              manage_config_xml ${networkXmlFile} "$configDir/network.xml" ${boolToString cfg.forceNetworkConfig} network
++            ''
++          );
+ 
+         # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service
+         # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
+diff --git a/nixos/tests/jellyfin.nix b/nixos/tests/jellyfin.nix
+index 4896c13d4eca..0c9191960f78 100644
+--- a/nixos/tests/jellyfin.nix
++++ b/nixos/tests/jellyfin.nix
+@@ -63,6 +63,26 @@
+       environment.systemPackages = with pkgs; [ ffmpeg ];
+       virtualisation.diskSize = 3 * 1024;
+     };
++
++    machineWithNetworkConfig = {
++      services.jellyfin = {
++        enable = true;
++        forceNetworkConfig = true;
++        network = {
++          localNetworkSubnets = [
++            "192.168.1.0/24"
++            "10.0.0.0/8"
++          ];
++          knownProxies = [ "127.0.0.1" ];
++          enableUPnP = false;
++          enableIPv6 = false;
++          remoteIPFilter = [ "203.0.113.5" ];
++          isRemoteIPFilterBlacklist = true;
++        };
++      };
++      environment.systemPackages = with pkgs; [ ffmpeg ];
++      virtualisation.diskSize = 3 * 1024;
++    };
+   };
+ 
+   # Documentation of the Jellyfin API: https://api.jellyfin.org/
+@@ -122,6 +142,36 @@
+           # Verify the new encoding.xml does not have the marker (was overwritten)
+           machineWithForceConfig.fail("grep -q 'MARKER' /var/lib/jellyfin/config/encoding.xml")
+ 
++      # Test forceNetworkConfig and network.xml generation
++      with subtest("Force network config writes declared values and backs up on overwrite"):
++          wait_for_jellyfin(machineWithNetworkConfig)
++
++          # Verify network.xml exists and contains the declared values
++          machineWithNetworkConfig.succeed("test -f /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<string>192.168.1.0/24</string>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<string>10.0.0.0/8</string>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<string>127.0.0.1</string>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<string>203.0.113.5</string>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<IsRemoteIPFilterBlacklist>true</IsRemoteIPFilterBlacklist>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<EnableIPv6>false</EnableIPv6>' /var/lib/jellyfin/config/network.xml")
++          machineWithNetworkConfig.succeed("grep -F '<EnableUPnP>false</EnableUPnP>' /var/lib/jellyfin/config/network.xml")
++
++          # Stop service before modifying config
++          machineWithNetworkConfig.succeed("systemctl stop jellyfin.service")
++
++          # Plant a marker so we can prove the backup-and-overwrite path runs
++          machineWithNetworkConfig.succeed("echo '<!-- NETMARKER -->' > /var/lib/jellyfin/config/network.xml")
++
++          # Restart the service to trigger the backup
++          machineWithNetworkConfig.succeed("systemctl restart jellyfin.service")
++          wait_for_jellyfin(machineWithNetworkConfig)
++
++          # Verify the marked content was preserved as a timestamped backup
++          machineWithNetworkConfig.succeed("grep -q 'NETMARKER' /var/lib/jellyfin/config/network.xml.backup-*")
++
++          # Verify the new network.xml does not have the marker (was overwritten)
++          machineWithNetworkConfig.fail("grep -q 'NETMARKER' /var/lib/jellyfin/config/network.xml")
++
+       auth_header = 'MediaBrowser Client="NixOS Integration Tests", DeviceId="1337", Device="Apple II", Version="20.09"'
+ 
+ 
+-- 
+2.53.0
+

From 48ac68c2973742155b824767ae5fc0d1fcb767ed Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 19:47:26 -0400
Subject: [PATCH 845/847] jellyfin: add webhook plugin helper

---
 services/jellyfin/jellyfin-webhook-plugin.nix | 105 ++++++++++++++++++
 1 file changed, 105 insertions(+)
 create mode 100644 services/jellyfin/jellyfin-webhook-plugin.nix

diff --git a/services/jellyfin/jellyfin-webhook-plugin.nix b/services/jellyfin/jellyfin-webhook-plugin.nix
new file mode 100644
index 0000000..371f818
--- /dev/null
+++ b/services/jellyfin/jellyfin-webhook-plugin.nix
@@ -0,0 +1,105 @@
+{ pkgs, lib }:
+let
+  pluginVersion = "18.0.0.0";
+  # GUID from the plugin's meta.json; addresses it on /Plugins/<guid>/Configuration.
+  pluginGuid = "71552a5a-5c5c-4350-a2ae-ebe451a30173";
+
+  package = pkgs.stdenvNoCC.mkDerivation {
+    pname = "jellyfin-plugin-webhook";
+    version = pluginVersion;
+    src = pkgs.fetchurl {
+      url = "https://repo.jellyfin.org/files/plugin/webhook/webhook_${pluginVersion}.zip";
+      hash = "sha256-LFFojiPnBGl9KJ0xVyPBnCmatcaeVbllRwRkz5Z3dqI=";
+    };
+    nativeBuildInputs = [ pkgs.unzip ];
+    unpackPhase = ''unzip "$src"'';
+    installPhase = ''
+      mkdir -p "$out"
+      cp *.dll meta.json "$out/"
+    '';
+    dontFixup = true; # managed .NET assemblies must not be patched
+  };
+
+  # Minimal Handlebars template, base64 encoded. The monitor only needs the POST;
+  # NotificationType is parsed for the debug log line.
+  # Decoded: {"NotificationType":"{{NotificationType}}"}
+  templateB64 = "eyJOb3RpZmljYXRpb25UeXBlIjoie3tOb3RpZmljYXRpb25UeXBlfX0ifQ==";
+
+  # Build a PluginConfiguration payload accepted by Jellyfin's JSON deserializer.
+  # Each webhook is `{ name, uri, notificationTypes }`.
+  mkConfigJson =
+    webhooks:
+    builtins.toJSON {
+      ServerUrl = "";
+      GenericOptions = map (w: {
+        NotificationTypes = w.notificationTypes;
+        WebhookName = w.name;
+        WebhookUri = w.uri;
+        EnableMovies = true;
+        EnableEpisodes = true;
+        EnableVideos = true;
+        EnableWebhook = true;
+        Template = templateB64;
+        Headers = [
+          {
+            Key = "Content-Type";
+            Value = "application/json";
+          }
+        ];
+      }) webhooks;
+    };
+
+  # Oneshot that POSTs the plugin configuration. Retries past the window
+  # between Jellyfin API health and plugin registration.
+  mkConfigureScript =
+    { jellyfinUrl, webhooks }:
+    pkgs.writeShellScript "jellyfin-webhook-configure" ''
+      set -euo pipefail
+      export PATH=${
+        lib.makeBinPath [
+          pkgs.coreutils
+          pkgs.curl
+        ]
+      }
+
+      URL=${lib.escapeShellArg jellyfinUrl}
+      AUTH="Authorization: MediaBrowser Token=\"$(cat "$CREDENTIALS_DIRECTORY/jellyfin-api-key")\""
+      CONFIG=${lib.escapeShellArg (mkConfigJson webhooks)}
+
+      for _ in $(seq 1 120); do curl -sf -o /dev/null "$URL/health" && break; sleep 1; done
+      curl -sf -o /dev/null "$URL/health"
+
+      for _ in $(seq 1 60); do
+        if printf '%s' "$CONFIG" | curl -sf -X POST \
+          -H "$AUTH" -H "Content-Type: application/json" --data-binary @- \
+          "$URL/Plugins/${pluginGuid}/Configuration"; then
+          echo "Jellyfin webhook plugin configured"; exit 0
+        fi
+        sleep 1
+      done
+      echo "Failed to configure webhook plugin" >&2; exit 1
+    '';
+
+  # Materialise a writable copy of the plugin. Jellyfin rewrites meta.json at
+  # runtime, so a read-only nix-store symlink would EACCES.
+  mkInstallScript =
+    { pluginsDir }:
+    pkgs.writeShellScript "jellyfin-webhook-install" ''
+      set -euo pipefail
+      export PATH=${lib.makeBinPath [ pkgs.coreutils ]}
+      dst=${lib.escapeShellArg "${pluginsDir}/Webhook_${pluginVersion}"}
+      mkdir -p ${lib.escapeShellArg pluginsDir}
+      rm -rf "$dst" && mkdir -p "$dst"
+      cp ${package}/*.dll ${package}/meta.json "$dst/"
+      chmod u+rw "$dst"/*
+    '';
+in
+{
+  inherit
+    package
+    pluginVersion
+    pluginGuid
+    mkConfigureScript
+    mkInstallScript
+    ;
+}

From 1403c9d3bc6b15aa90df0a91ce83cb7cd0663312 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 19:47:29 -0400
Subject: [PATCH 846/847] jellyfin-qbittorrent-monitor: add webhook receiver
 for instant throttling

---
 service-configs.nix                           |   6 +
 .../jellyfin/jellyfin-qbittorrent-monitor.nix |  58 +++++++-
 .../jellyfin/jellyfin-qbittorrent-monitor.py  |  71 +++++++++-
 tests/jellyfin-qbittorrent-monitor.nix        | 127 +++++++++++++++++-
 4 files changed, 257 insertions(+), 5 deletions(-)

diff --git a/service-configs.nix b/service-configs.nix
index 4cb200d..3f20d4a 100644
--- a/service-configs.nix
+++ b/service-configs.nix
@@ -81,6 +81,12 @@ rec {
         port = 6011;
         proto = "tcp";
       };
+      # Webhook receiver for the Jellyfin-qBittorrent monitor — Jellyfin pushes
+      # playback events here so throttling reacts without waiting for the poll.
+      jellyfin_qbittorrent_monitor_webhook = {
+        port = 9898;
+        proto = "tcp";
+      };
       bitmagnet = {
         port = 3333;
         proto = "tcp";
diff --git a/services/jellyfin/jellyfin-qbittorrent-monitor.nix b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
index 4bf57d7..9b800d1 100644
--- a/services/jellyfin/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
@@ -5,14 +5,67 @@
   lib,
   ...
 }:
+let
+  webhookPlugin = import ./jellyfin-webhook-plugin.nix { inherit pkgs lib; };
+  jellyfinPort = service_configs.ports.private.jellyfin.port;
+  webhookPort = service_configs.ports.private.jellyfin_qbittorrent_monitor_webhook.port;
+in
 lib.mkIf config.services.jellyfin.enable {
+  # Materialise the Jellyfin Webhook plugin into Jellyfin's plugins dir before
+  # Jellyfin starts. Jellyfin rewrites meta.json at runtime, so a read-only
+  # nix-store symlink would EACCES — we copy instead.
+  systemd.services.jellyfin-webhook-install = {
+    before = [ "jellyfin.service" ];
+    wantedBy = [ "jellyfin.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = config.services.jellyfin.user;
+      Group = config.services.jellyfin.group;
+      ExecStart = webhookPlugin.mkInstallScript {
+        pluginsDir = "${config.services.jellyfin.dataDir}/plugins";
+      };
+    };
+  };
+
+  # After Jellyfin starts, POST the plugin configuration so the webhook
+  # targets the monitor's receiver. Idempotent; runs on every boot.
+  systemd.services.jellyfin-webhook-configure = {
+    after = [ "jellyfin.service" ];
+    wants = [ "jellyfin.service" ];
+    before = [ "jellyfin-qbittorrent-monitor.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      DynamicUser = true;
+      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
+      ExecStart = webhookPlugin.mkConfigureScript {
+        jellyfinUrl = "http://127.0.0.1:${toString jellyfinPort}";
+        webhooks = [
+          {
+            name = "qBittorrent Monitor";
+            uri = "http://127.0.0.1:${toString webhookPort}/";
+            notificationTypes = [
+              "PlaybackStart"
+              "PlaybackProgress"
+              "PlaybackStop"
+            ];
+          }
+        ];
+      };
+    };
+  };
+
   systemd.services."jellyfin-qbittorrent-monitor" = {
     description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
     after = [
       "network.target"
       "jellyfin.service"
       "qbittorrent.service"
+      "jellyfin-webhook-configure.service"
     ];
+    wants = [ "jellyfin-webhook-configure.service" ];
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
@@ -44,7 +97,7 @@ lib.mkIf config.services.jellyfin.enable {
     };
 
     environment = {
-      JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.private.jellyfin.port}";
+      JELLYFIN_URL = "http://localhost:${builtins.toString jellyfinPort}";
       QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.torrent.port}";
       CHECK_INTERVAL = "30";
       # Bandwidth budget configuration
@@ -53,6 +106,9 @@ lib.mkIf config.services.jellyfin.enable {
       DEFAULT_STREAM_BITRATE = "10000000"; # 10 Mbps fallback when bitrate unknown (bps)
       MIN_TORRENT_SPEED = "100"; # KB/s - below this, pause torrents instead
       STREAM_BITRATE_HEADROOM = "1.1"; # multiplier per stream for bitrate fluctuations
+      # Webhook receiver: Jellyfin Webhook plugin POSTs events here to throttle immediately.
+      WEBHOOK_BIND = "127.0.0.1";
+      WEBHOOK_PORT = toString webhookPort;
     };
   };
 }
diff --git a/services/jellyfin/jellyfin-qbittorrent-monitor.py b/services/jellyfin/jellyfin-qbittorrent-monitor.py
index 3c01cee..5c9326b 100644
--- a/services/jellyfin/jellyfin-qbittorrent-monitor.py
+++ b/services/jellyfin/jellyfin-qbittorrent-monitor.py
@@ -7,6 +7,8 @@ import sys
 import signal
 import json
 import ipaddress
+import threading
+from http.server import HTTPServer, BaseHTTPRequestHandler
 
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
@@ -34,6 +36,8 @@ class JellyfinQBittorrentMonitor:
         default_stream_bitrate=10000000,
         min_torrent_speed=100,
         stream_bitrate_headroom=1.1,
+        webhook_port=0,
+        webhook_bind="127.0.0.1",
     ):
         self.jellyfin_url = jellyfin_url
         self.qbittorrent_url = qbittorrent_url
@@ -57,6 +61,12 @@ class JellyfinQBittorrentMonitor:
         self.streaming_stop_delay = streaming_stop_delay
         self.last_state_change = 0
 
+        # Webhook receiver: allows Jellyfin to push events instead of waiting for the poll
+        self.webhook_port = webhook_port
+        self.webhook_bind = webhook_bind
+        self.wake_event = threading.Event()
+        self.webhook_server = None
+
         # Local network ranges (RFC 1918 private networks + localhost)
         self.local_networks = [
             ipaddress.ip_network("10.0.0.0/8"),
@@ -79,9 +89,56 @@ class JellyfinQBittorrentMonitor:
     def signal_handler(self, signum, frame):
         logger.info("Received shutdown signal, cleaning up...")
         self.running = False
+        if self.webhook_server is not None:
+            # shutdown() blocks until serve_forever returns; run from a thread so we don't deadlock
+            threading.Thread(target=self.webhook_server.shutdown, daemon=True).start()
         self.restore_normal_limits()
         sys.exit(0)
 
+    def wake(self) -> None:
+        """Signal the main loop to re-evaluate state immediately."""
+        self.wake_event.set()
+
+    def sleep_or_wake(self, seconds: float) -> None:
+        """Wait up to `seconds`, returning early if a webhook wakes the loop."""
+        self.wake_event.wait(seconds)
+        self.wake_event.clear()
+
+    def start_webhook_server(self) -> None:
+        """Start a background HTTP server that wakes the monitor on any POST."""
+        if not self.webhook_port:
+            return
+
+        monitor = self
+
+        class WebhookHandler(BaseHTTPRequestHandler):
+            def do_POST(self):  # noqa: N802
+                length = int(self.headers.get("Content-Length", "0") or "0")
+                body = self.rfile.read(min(length, 65536)) if length else b""
+                event = "unknown"
+                try:
+                    if body:
+                        event = json.loads(body).get("NotificationType", "unknown")
+                except (json.JSONDecodeError, ValueError):
+                    pass
+                logger.info(f"Webhook received: {event}")
+                self.send_response(204)
+                self.end_headers()
+                monitor.wake()
+
+            def log_message(self, format, *args):
+                return  # suppress default access log
+
+        self.webhook_server = HTTPServer(
+            (self.webhook_bind, self.webhook_port), WebhookHandler
+        )
+        threading.Thread(
+            target=self.webhook_server.serve_forever, daemon=True, name="webhook-server"
+        ).start()
+        logger.info(
+            f"Webhook receiver listening on http://{self.webhook_bind}:{self.webhook_port}"
+        )
+
     def check_jellyfin_sessions(self) -> list[dict]:
         headers = (
             {"X-Emby-Token": self.jellyfin_api_key} if self.jellyfin_api_key else {}
@@ -297,10 +354,14 @@ class JellyfinQBittorrentMonitor:
         logger.info(f"Default stream bitrate: {self.default_stream_bitrate} bps")
         logger.info(f"Minimum torrent speed: {self.min_torrent_speed} KB/s")
         logger.info(f"Stream bitrate headroom: {self.stream_bitrate_headroom}x")
+        if self.webhook_port:
+            logger.info(f"Webhook receiver: {self.webhook_bind}:{self.webhook_port}")
 
         signal.signal(signal.SIGINT, self.signal_handler)
         signal.signal(signal.SIGTERM, self.signal_handler)
 
+        self.start_webhook_server()
+
         while self.running:
             try:
                 self.sync_qbittorrent_state()
@@ -309,7 +370,7 @@ class JellyfinQBittorrentMonitor:
                     active_streams = self.check_jellyfin_sessions()
                 except ServiceUnavailable:
                     logger.warning("Jellyfin unavailable, maintaining current state")
-                    time.sleep(self.check_interval)
+                    self.sleep_or_wake(self.check_interval)
                     continue
 
                 streaming_active = len(active_streams) > 0
@@ -394,13 +455,13 @@ class JellyfinQBittorrentMonitor:
 
                 self.current_state = desired_state
                 self.last_active_streams = active_streams
-                time.sleep(self.check_interval)
+                self.sleep_or_wake(self.check_interval)
 
             except KeyboardInterrupt:
                 break
             except Exception as e:
                 logger.error(f"Unexpected error in monitoring loop: {e}")
-                time.sleep(self.check_interval)
+                self.sleep_or_wake(self.check_interval)
 
         self.restore_normal_limits()
         logger.info("Monitor stopped")
@@ -421,6 +482,8 @@ if __name__ == "__main__":
     default_stream_bitrate = int(os.getenv("DEFAULT_STREAM_BITRATE", "10000000"))
     min_torrent_speed = int(os.getenv("MIN_TORRENT_SPEED", "100"))
     stream_bitrate_headroom = float(os.getenv("STREAM_BITRATE_HEADROOM", "1.1"))
+    webhook_port = int(os.getenv("WEBHOOK_PORT", "0"))
+    webhook_bind = os.getenv("WEBHOOK_BIND", "127.0.0.1")
 
     monitor = JellyfinQBittorrentMonitor(
         jellyfin_url=jellyfin_url,
@@ -434,6 +497,8 @@ if __name__ == "__main__":
         default_stream_bitrate=default_stream_bitrate,
         min_torrent_speed=min_torrent_speed,
         stream_bitrate_headroom=stream_bitrate_headroom,
+        webhook_port=webhook_port,
+        webhook_bind=webhook_bind,
     )
 
     monitor.run()
diff --git a/tests/jellyfin-qbittorrent-monitor.nix b/tests/jellyfin-qbittorrent-monitor.nix
index dd6508e..e3c248a 100644
--- a/tests/jellyfin-qbittorrent-monitor.nix
+++ b/tests/jellyfin-qbittorrent-monitor.nix
@@ -6,6 +6,21 @@
 }:
 let
   jfLib = import ./jellyfin-test-lib.nix { inherit pkgs lib; };
+  webhookPlugin = import ../services/jellyfin/jellyfin-webhook-plugin.nix { inherit pkgs lib; };
+  configureWebhook = webhookPlugin.mkConfigureScript {
+    jellyfinUrl = "http://localhost:8096";
+    webhooks = [
+      {
+        name = "qBittorrent Monitor";
+        uri = "http://127.0.0.1:9898/";
+        notificationTypes = [
+          "PlaybackStart"
+          "PlaybackProgress"
+          "PlaybackStop"
+        ];
+      }
+    ];
+  };
 in
 pkgs.testers.runNixOSTest {
   name = "jellyfin-qbittorrent-monitor";
@@ -69,11 +84,30 @@ pkgs.testers.runNixOSTest {
           }
         ];
 
-        # Create directories for qBittorrent
+        # Create directories for qBittorrent.
         systemd.tmpfiles.rules = [
           "d /var/lib/qbittorrent/downloads 0755 qbittorrent qbittorrent"
           "d /var/lib/qbittorrent/incomplete 0755 qbittorrent qbittorrent"
         ];
+
+        # Install the Jellyfin Webhook plugin before Jellyfin starts, mirroring
+        # the production module. Jellyfin rewrites meta.json at runtime so a
+        # read-only nix-store symlink would fail — we materialise a writable copy.
+        systemd.services."jellyfin-webhook-install" = {
+          description = "Install Jellyfin Webhook plugin files";
+          before = [ "jellyfin.service" ];
+          wantedBy = [ "jellyfin.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            User = "jellyfin";
+            Group = "jellyfin";
+            UMask = "0077";
+            ExecStart = webhookPlugin.mkInstallScript {
+              pluginsDir = "/var/lib/jellyfin/plugins";
+            };
+          };
+        };
       };
 
     # Public test IP (RFC 5737 TEST-NET-3) so Jellyfin sees it as external
@@ -394,6 +428,97 @@ pkgs.testers.runNixOSTest {
         local_playback["PositionTicks"] = 50000000
         server.succeed(f"curl -sf -X POST 'http://localhost:8096/Sessions/Playing/Stopped' -d '{json.dumps(local_playback)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{local_auth}, Token={local_token}'")
 
+    # === WEBHOOK TESTS ===
+    #
+    # Configure the Jellyfin Webhook plugin to target the monitor, then verify
+    # the real Jellyfin → plugin → monitor path reacts faster than any possible
+    # poll. CHECK_INTERVAL=30 rules out polling as the cause.
+
+    WEBHOOK_PORT = 9898
+    WEBHOOK_CREDS = "/tmp/webhook-creds"
+
+    # Start a webhook-enabled monitor with long poll interval.
+    server.succeed("systemctl stop monitor-test || true")
+    time.sleep(1)
+    server.succeed(f"""
+      systemd-run --unit=monitor-webhook \
+        --setenv=JELLYFIN_URL=http://localhost:8096 \
+        --setenv=JELLYFIN_API_KEY={token} \
+        --setenv=QBITTORRENT_URL=http://localhost:8080 \
+        --setenv=CHECK_INTERVAL=30 \
+        --setenv=STREAMING_START_DELAY=1 \
+        --setenv=STREAMING_STOP_DELAY=1 \
+        --setenv=TOTAL_BANDWIDTH_BUDGET=50000000 \
+        --setenv=SERVICE_BUFFER=2000000 \
+        --setenv=DEFAULT_STREAM_BITRATE=10000000 \
+        --setenv=MIN_TORRENT_SPEED=100 \
+        --setenv=WEBHOOK_PORT={WEBHOOK_PORT} \
+        --setenv=WEBHOOK_BIND=127.0.0.1 \
+        {python} {monitor}
+    """)
+    server.wait_until_succeeds(f"ss -ltn | grep -q ':{WEBHOOK_PORT}'", timeout=15)
+    time.sleep(2)
+    assert not is_throttled(), "Should start unthrottled"
+
+    # Drop the admin token where the configure script expects it (production uses agenix).
+    server.succeed(f"mkdir -p {WEBHOOK_CREDS} && echo '{token}' > {WEBHOOK_CREDS}/jellyfin-api-key")
+    server.succeed(
+        f"systemd-run --wait --unit=webhook-configure-test "
+        f"--setenv=CREDENTIALS_DIRECTORY={WEBHOOK_CREDS} "
+        f"${configureWebhook}"
+    )
+
+    with subtest("Real PlaybackStart event throttles via the plugin"):
+        playback_start = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-plugin-start",
+            "CanSeek": True,
+            "IsPaused": False,
+        }
+        start_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing' -d '{json.dumps(playback_start)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(start_cmd)
+        server.wait_until_succeeds(
+            "curl -sf http://localhost:8080/api/v2/transfer/speedLimitsMode | grep -q '^1$'",
+            timeout=5,
+        )
+        # Let STREAMING_STOP_DELAY (1s) elapse so the upcoming stop is not swallowed by hysteresis.
+        time.sleep(2)
+
+    with subtest("Real PlaybackStop event unthrottles via the plugin"):
+        playback_stop = {
+            "ItemId": movie_id,
+            "MediaSourceId": media_source_id,
+            "PlaySessionId": "test-plugin-start",
+            "PositionTicks": 50000000,
+        }
+        stop_cmd = f"curl -sf -X POST 'http://{server_ip}:8096/Sessions/Playing/Stopped' -d '{json.dumps(playback_stop)}' -H 'Content-Type:application/json' -H 'X-Emby-Authorization:{client_auth}, Token={client_token}'"
+        client.succeed(stop_cmd)
+        server.wait_until_succeeds(
+            "curl -sf http://localhost:8080/api/v2/transfer/speedLimitsMode | grep -q '^0$'",
+            timeout=10,
+        )
+
+    # Restore fast-polling monitor for the service-restart tests below.
+    server.succeed("systemctl stop monitor-webhook || true")
+    time.sleep(1)
+    server.succeed(f"""
+      systemd-run --unit=monitor-test \
+        --setenv=JELLYFIN_URL=http://localhost:8096 \
+        --setenv=JELLYFIN_API_KEY={token} \
+        --setenv=QBITTORRENT_URL=http://localhost:8080 \
+        --setenv=CHECK_INTERVAL=1 \
+        --setenv=STREAMING_START_DELAY=1 \
+        --setenv=STREAMING_STOP_DELAY=1 \
+        --setenv=TOTAL_BANDWIDTH_BUDGET=50000000 \
+        --setenv=SERVICE_BUFFER=2000000 \
+        --setenv=DEFAULT_STREAM_BITRATE=10000000 \
+        --setenv=MIN_TORRENT_SPEED=100 \
+        {python} {monitor}
+    """)
+    time.sleep(2)
+
+
     # === SERVICE RESTART TESTS ===
 
     with subtest("qBittorrent restart during throttled state re-applies throttling"):

From 4bc5d57fa69a393877e7019d7673ceb33c3ab4b4 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Fri, 17 Apr 2026 22:08:29 -0400
Subject: [PATCH 847/847] jellyfin: restartTriggers on webhook plugin so
 install runs at activation

The jellyfin-webhook-install oneshot has 'wantedBy = jellyfin.service',
which only runs it when jellyfin (re)starts. On first rollout to a host
where jellyfin is already running, the unit gets added but never fires,
leaving the Webhook plugin files absent -- jellyfin-webhook-configure
then gets 404 from /Plugins/$GUID/Configuration and deploy-rs rolls back.

Pinning jellyfin.restartTriggers to the plugin package + install script
forces a restart whenever either derivation changes, which pulls install
in via the existing before/wantedBy chain.
---
 .../jellyfin/jellyfin-qbittorrent-monitor.nix     | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/services/jellyfin/jellyfin-qbittorrent-monitor.nix b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
index 9b800d1..92e3341 100644
--- a/services/jellyfin/jellyfin-qbittorrent-monitor.nix
+++ b/services/jellyfin/jellyfin-qbittorrent-monitor.nix
@@ -13,7 +13,13 @@ in
 lib.mkIf config.services.jellyfin.enable {
   # Materialise the Jellyfin Webhook plugin into Jellyfin's plugins dir before
   # Jellyfin starts. Jellyfin rewrites meta.json at runtime, so a read-only
-  # nix-store symlink would EACCES — we copy instead.
+  # nix-store symlink would EACCES -- we copy instead.
+  #
+  # `wantedBy = [ "jellyfin.service" ]` alone is insufficient on initial rollout:
+  # if jellyfin is already running at activation time, systemd won't start the
+  # oneshot until the next jellyfin restart. `restartTriggers` on jellyfin pinned
+  # to the plugin package + install script forces that restart whenever either
+  # changes, which invokes this unit via the `before`/`wantedBy` chain.
   systemd.services.jellyfin-webhook-install = {
     before = [ "jellyfin.service" ];
     wantedBy = [ "jellyfin.service" ];
@@ -28,6 +34,13 @@ lib.mkIf config.services.jellyfin.enable {
     };
   };
 
+  systemd.services.jellyfin.restartTriggers = [
+    webhookPlugin.package
+    (webhookPlugin.mkInstallScript {
+      pluginsDir = "${config.services.jellyfin.dataDir}/plugins";
+    })
+  ];
+
   # After Jellyfin starts, POST the plugin configuration so the webhook
   # targets the monitor's receiver. Idempotent; runs on every boot.
   systemd.services.jellyfin-webhook-configure = {