some changes

modules/nixos/hardware/audio/default.nix

@@ -43,18 +43,17 @@ in {
         # Command to execute. Use full paths for robustness.
         # We use sh -c to run multiple commands sequentially.
         # pactl is provided by the pulseaudio package.
-        ExecStart = ''
-          ${pkgs.runtimeShell} -c '
-            echo "Attempting to load Cava combine modules..."
-            # Load null sink (returns non-zero if it fails AND module doesn't exist)
-            ${pkgs.pulseaudio}/bin/pactl load-module module-null-sink sink_name=cava-line-in sink_properties=device.description="Cava_Combined_LineIn"
-            # Load loopbacks (returns non-zero on failure)
-            ${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line3__source" sink=cava-line-in latency_msec=10
-            ${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line4__source" sink=cava-line-in latency_msec=10
-            echo "Finished loading Cava combine modules (ignore errors if already loaded)."
-            # Exit successfully even if modules were already loaded (pactl might return 0)
-            exit 0
-        '';
+        ExecStart = "${pkgs.writeShellScriptBin "cava-start" ''
+          echo "Attempting to load Cava combine modules..."
+          # Load null sink (returns non-zero if it fails AND module doesn't exist)
+          ${pkgs.pulseaudio}/bin/pactl load-module module-null-sink sink_name=cava-line-in sink_properties=device.description="Cava_Combined_LineIn"
+          # Load loopbacks (returns non-zero on failure)
+          ${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line3__source" sink=cava-line-in latency_msec=10
+          ${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line4__source" sink=cava-line-in latency_msec=10
+          echo "Finished loading Cava combine modules (ignore errors if already loaded)."
+          # Exit successfully even if modules were already loaded (pactl might return 0)
+          exit 0
+        ''}/bin/cava-start";
 
         # Prevent service from restarting automatically
         Restart = "no";

modules/nixos/hardware/gpu-passthru/default.nix

@@ -8,6 +8,104 @@
 with lib;
 with lib.custom; let
   cfg = config.hardware.gpu-passthru;
+
+  startScript = ''
+    #!/run/current-system/sw/bin/bash
+
+    # Debugging
+    exec 19>/home/zoey/Desktop/startlogfile
+    BASH_XTRACEFD=19
+    set -x
+
+    # Load variables we defined
+    source "/etc/libvirt/hooks/kvm.conf"
+
+    # Change to performance governor
+    echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
+
+    # Isolate host to core 0
+    systemctl set-property --runtime -- user.slice AllowedCPUs=0-8
+    systemctl set-property --runtime -- system.slice AllowedCPUs=0-8
+    systemctl set-property --runtime -- init.scope AllowedCPUs=0-8
+
+    # disable vpn
+    mullvad disconnect -w
+
+    # Logout
+    # source "/home/owner/Desktop/Sync/Files/Tools/logout.sh"
+
+    # Stop display manager
+    systemctl stop display-manager.service
+    killall gdm-wayland-session
+    killall niri
+    killall niri-session
+
+    # Unbind VTconsoles
+    echo 0 > /sys/class/vtconsole/vtcon0/bind
+    echo 0 > /sys/class/vtconsole/vtcon1/bind
+
+    # Unbind EFI Framebuffer
+    echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind
+
+    # Avoid race condition
+    sleep 5
+
+    # Unload NVIDIA kernel modules
+    modprobe -r nvidia_drm nvidia_modeset nvidia_uvm nvidia
+
+    # Detach GPU devices from host
+    virsh nodedev-detach $VIRSH_GPU_VIDEO
+    virsh nodedev-detach $VIRSH_GPU_AUDIO
+
+    # Load vfio module
+    modprobe vfio-pci
+  '';
+
+  stopScript = ''
+    #!/run/current-system/sw/bin/bash
+
+    # Debugging
+    exec 19>/home/zoey/Desktop/stoplogfile
+    BASH_XTRACEFD=19
+    set -x
+
+    # Load variables we defined
+    source "/etc/libvirt/hooks/kvm.conf"
+
+    # Unload vfio module
+    modprobe -r vfio-pci
+
+    # Attach GPU devices from host
+    virsh nodedev-reattach $VIRSH_GPU_VIDEO
+    virsh nodedev-reattach $VIRSH_GPU_AUDIO
+
+    # Read nvidia x config
+    nvidia-xconfig --query-gpu-info > /dev/null 2>&1
+
+    # Load NVIDIA kernel modules
+    modprobe nvidia_drm nvidia_modeset nvidia_uvm nvidia
+
+    # Avoid race condition
+    sleep 5
+
+    # Bind EFI Framebuffer
+    echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/bind
+
+    # Bind VTconsoles
+    echo 1 > /sys/class/vtconsole/vtcon0/bind
+    echo 1 > /sys/class/vtconsole/vtcon1/bind
+
+    # Start display manager
+    systemctl start display-manager.service
+
+    # Return host to all cores
+    systemctl set-property --runtime -- user.slice AllowedCPUs=0-31
+    systemctl set-property --runtime -- system.slice AllowedCPUs=0-31
+    systemctl set-property --runtime -- init.scope AllowedCPUs=0-31
+
+    # Change to powersave governor
+    echo powersave | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
+  '';
 in {
   options.hardware.gpu-passthru = with types; {
     enable = mkBoolOpt false "Enable support for single gpu-passthru";
@@ -113,106 +211,22 @@ in {
       };
 
       "libvirt/hooks/qemu.d/win10/prepare/begin/start.sh" = {
-        text = ''
-          #!/run/current-system/sw/bin/bash
-
-          # Debugging
-          exec 19>/home/zoey/Desktop/startlogfile
-          BASH_XTRACEFD=19
-          set -x
-
-          # Load variables we defined
-          source "/etc/libvirt/hooks/kvm.conf"
-
-          # Change to performance governor
-          echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-
-          # Isolate host to core 0
-          systemctl set-property --runtime -- user.slice AllowedCPUs=0-8
-          systemctl set-property --runtime -- system.slice AllowedCPUs=0-8
-          systemctl set-property --runtime -- init.scope AllowedCPUs=0-8
-
-          # disable vpn
-          mullvad disconnect -w
-
-          # Logout
-          # source "/home/owner/Desktop/Sync/Files/Tools/logout.sh"
-
-          # Stop display manager
-          systemctl stop display-manager.service
-          killall gdm-wayland-session
-          killall niri
-          killall niri-session
-
-          # Unbind VTconsoles
-          echo 0 > /sys/class/vtconsole/vtcon0/bind
-          echo 0 > /sys/class/vtconsole/vtcon1/bind
-
-          # Unbind EFI Framebuffer
-          echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind
-
-          # Avoid race condition
-          sleep 5
-
-          # Unload NVIDIA kernel modules
-          modprobe -r nvidia_drm nvidia_modeset nvidia_uvm nvidia
-
-          # Detach GPU devices from host
-          virsh nodedev-detach $VIRSH_GPU_VIDEO
-          virsh nodedev-detach $VIRSH_GPU_AUDIO
-
-          # Load vfio module
-          modprobe vfio-pci
-        '';
+        text = startScript;
         mode = "0755";
       };
 
       "libvirt/hooks/qemu.d/win10/release/end/stop.sh" = {
-        text = ''
-          #!/run/current-system/sw/bin/bash
+        text = stopScript;
+        mode = "0755";
+      };
 
-          # Debugging
-          exec 19>/home/zoey/Desktop/stoplogfile
-          BASH_XTRACEFD=19
-          set -x
+      "libvirt/hooks/qemu.d/bazzite/prepare/begin/start.sh" = {
+        text = startScript;
+        mode = "0755";
+      };
 
-          # Load variables we defined
-          source "/etc/libvirt/hooks/kvm.conf"
-
-          # Unload vfio module
-          modprobe -r vfio-pci
-
-          # Attach GPU devices from host
-          virsh nodedev-reattach $VIRSH_GPU_VIDEO
-          virsh nodedev-reattach $VIRSH_GPU_AUDIO
-
-          # Read nvidia x config
-          nvidia-xconfig --query-gpu-info > /dev/null 2>&1
-
-          # Load NVIDIA kernel modules
-          modprobe nvidia_drm nvidia_modeset nvidia_uvm nvidia
-
-          # Avoid race condition
-          sleep 5
-
-          # Bind EFI Framebuffer
-          echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/bind
-
-          # Bind VTconsoles
-          echo 1 > /sys/class/vtconsole/vtcon0/bind
-          echo 1 > /sys/class/vtconsole/vtcon1/bind
-
-          # Start display manager
-          systemctl start display-manager.service
-
-          # Return host to all cores
-          systemctl set-property --runtime -- user.slice AllowedCPUs=0-31
-          systemctl set-property --runtime -- system.slice AllowedCPUs=0-31
-          systemctl set-property --runtime -- init.scope AllowedCPUs=0-31
-
-          # Change to powersave governor
-          echo powersave | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-        '';
+      "libvirt/hooks/qemu.d/bazzite/release/end/stop.sh" = {
+        text = stopScript;
         mode = "0755";
       };
     };

modules/nixos/services/mail/default.nix

@@ -28,6 +28,8 @@ in {
       zach-pw.file = ./sec/zach-pw.age;
       emily-pw.file = ./sec/emily-piccat.age;
 
+      smtp-password.file = ./sec/smtpPassword.age;
+
       gitlab-email-pw-hashed.file = ./sec/gitlab-email-pw-hashed.age;
     };
 
@@ -39,7 +41,7 @@ in {
       loginAccounts = {
         "zoey@zoeys.email" = {
           hashedPasswordFile = sec.webmaster-pw.path;
-          aliases = ["zoey@zoeys.cloud" "postmaster@zoeys.email" "abuse@zoeys.email"];
+          aliases = ["zoey@zoeys.cloud" "errors@zoeys.cloud" "admin@zoeys.cloud" "postmaster@zoeys.email" "abuse@zoeys.email"];
         };
         "hi@zoeys.computer" = {
           hashedPasswordFile = sec.zoeycomputer-pw.path;
@@ -57,6 +59,9 @@ in {
           hashedPasswordFile = sec.gitlab-email-pw-hashed.path;
           aliases = ["noreply@zoeys.cloud"];
         };
+        "no-reply@code.zoeys.cloud" = {
+          hashedPasswordFile = sec.smtp-password.path;
+        };
       };
 
       certificateScheme = "acme-nginx";

modules/nixos/services/mail/sec/smtpPassword.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CtmR6w 5VDFuttJ1VBYa4fBxMv/Ws96h3lQMtDtt4kift5TggY
+iHhoBRnhFOG7AYWAWcgEbX0ABUNgIWHHUpterkkMunc
+-> ssh-ed25519 +be3hg zpo9T3n1X5PipJjEgOqgSJSwhIZu19rLcQP3zPILWRM
+SJp+lVPB997tCMucqfGgqXOougiSoMoGMd/tozTTT0Q
+--- /uEWB/Q4G4hy0t+hEIeID0Ymqy+qGrnrK5AgwPhs82Y
+ýýI?è¢<C3A8>.þ_Q}lïÐ3/˳¨Û3æ<33>9› 8J	®KÔÅ™aJ:ký*–-‹Š;5Ê%Ô7£y

modules/nixos/services/vpn/default.nix

@@ -19,24 +19,6 @@ in {
       enable = cfg.mullvad;
       package = nixos-stable.mullvad;
     };
-    #
-    # # Create a specific network namespace for VPN traffic
-    # systemd.services.mullvad-daemon = {
-    #   serviceConfig = {
-    #     NetworkNamespacePath = "/run/netns/mullvad";
-    #   };
-    # };
-    #
-    # # Configure transmission to use Mullvad's SOCKS5 proxy
-    # # Configure transmission to use the Mullvad network namespace
-    # systemd.services.transmission = mkIf config.services.transmission.enable {
-    #   serviceConfig = {
-    #     NetworkNamespacePath = "/run/netns/mullvad";
-    #   };
-    #   # Make sure Mullvad is running before transmission starts
-    #   requires = ["mullvad-daemon.service"];
-    #   after = ["mullvad-daemon.service"];
-    # };
 
     services.openvpn = {
       servers = {
@@ -48,22 +30,5 @@ in {
     };
 
     systemd.services.openvpn-work.wantedBy = lib.mkForce [];
-
-    #   # Add necessary networking tools
-    #   environment.systemPackages = with pkgs; [
-    #     iproute2 # for ip netns commands
-    #   ];
-    #
-    #   # Setup network namespace
-    #   systemd.services.setup-mullvad-netns = {
-    #     description = "Setup Mullvad Network Namespace";
-    #     before = ["mullvad-daemon.service"];
-    #     serviceConfig = {
-    #       Type = "oneshot";
-    #       RemainAfterExit = true;
-    #       ExecStart = "${pkgs.iproute2}/bin/ip netns add mullvad";
-    #       ExecStop = "${pkgs.iproute2}/bin/ip netns delete mullvad";
-    #     };
-    #   };
   };
 }

modules/nixos/sites/cache/default.nix

@@ -24,6 +24,7 @@ in {
     services.nix-serve = {
       enable = true;
       secretKeyFile = sec.cache_key.path;
+      port = 12024;
     };
 
     services.nginx.virtualHosts."cache.zoeys.computer" = {

modules/nixos/sites/code/default.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.forgejo;
+  frg = config.services.forgejo;
+  srv = frg.settings.server;
+in {
+  options.sites.forgejo = with types; {
+    enable = mkBoolOpt false "Enable Forgejo site";
+
+    domain = mkStringOpt "code.zoeys.cloud" "The domain for the site";
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx.virtualHosts.${frg.settings.server.DOMAIN} = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+    };
+
+    catppuccin.forgejo.enable = true;
+
+    services.gitea-actions-runner = {
+      package = pkgs.forgejo-actions-runner;
+      instances.default = {
+        enable = true;
+        name = "monolith";
+        url = "https://code.zoeys.cloud";
+        # Obtaining the path to the runner token file may differ
+        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+        tokenFile = config.age.secrets.forgejo-runner-token.path;
+        labels = [
+          "ubuntu-latest:docker://node:16-bullseye"
+          "ubuntu-22.04:docker://node:16-bullseye"
+          "ubuntu-20.04:docker://node:16-bullseye"
+          "ubuntu-18.04:docker://node:16-buster"
+          ## optionally provide native execution on the host:
+          # "native:host"
+        ];
+      };
+    };
+
+    services.forgejo = {
+      enable = true;
+      database.type = "postgres";
+
+      lfs.enable = true;
+      settings = {
+        server = {
+          DOMAIN = cfg.domain;
+          ROOT_URL = "https://${srv.DOMAIN}";
+          HTTP_PORT = 7201;
+        };
+        service.DISABLE_REGISTRATION = true;
+        actions = {
+          ENABLED = true;
+          DEFAULT_ACTIONS_URL = "github";
+        };
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = "mail.zoeys.cloud";
+          FROM = "no-reply@${srv.DOMAIN}";
+          USER = "no-reply@${srv.DOMAIN}";
+        };
+      };
+      secrets = {
+        mailer = {
+          PASSWD = config.age.secrets.forgejo-mailer-password.path;
+        };
+      };
+    };
+
+    systemd.services.forgejo.preStart = let
+      adminCmd = "${lib.getExe frg.package} admin user";
+      pwd = config.age.secrets.forgejo-pw;
+      user = "zoey";
+    in ''
+      ${adminCmd} create --admin --email "hi@zoeys.computer" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true'';
+
+    age.secrets = {
+      forgejo-mailer-password = {
+        file = ../sourcehut/sec/smtpPassword.age;
+        mode = "400";
+        owner = "forgejo";
+      };
+      forgejo-pw = {
+        file = ./forgejoPw.age;
+        mode = "400";
+        owner = "forgejo";
+      };
+      forgejo-runner-token = {
+        file = ./forgejoRunner.age;
+        mode = "400";
+        owner = "forgejo";
+      };
+    };
+  };
+}

modules/nixos/sites/code/forgejoRunner.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CtmR6w oShhq0zXjjMoDW0+AZx/ro5x3XZ/Smf//Han2rZdA0o
+ucJn5M9x66gxKPmkVg1E4F/PsZ7rBTA8MlUAbmIC+2s
+-> ssh-ed25519 RMNffg GBNcFhRuZyme2t/yrWDS/lrQzpm1wHUkAhjLz86ZG3I
+bpsZdqqP205zT9F7Ca5jtCn/qfKcI/gTxANQOPLWnnA
+--- JbJQpU8FaE6TPHMyX4SmDQLEI8b67SaFG73nUc+Ud3s
+"'Åx<C385>táop‹h°ðhç5]Ž|Új1‰_e#mDö~mv
ŒÈ¢osõ˜ÊRfúù’‚€’ðfëoÕ<>óÅ"RžÜêf8uuU?¯

modules/nixos/sites/gitlab/default.nix

@@ -57,44 +57,6 @@ in {
 
     boot.kernel.sysctl."net.ipv4.ip_forward" = true; # 1
 
-    services.gitlab-runner = {
-      enable = true;
-      services = {
-        nix = with lib; {
-          authenticationTokenConfigFile = sec.gitlab_runner.path;
-          dockerImage = "alpine";
-          dockerVolumes = [
-            "/nix/store:/nix/store:ro"
-            "/nix/var/nix/db:/nix/var/nix/db:ro"
-            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          ];
-          dockerDisableCache = true;
-          preBuildScript = pkgs.writeScript "setup-container" ''
-            mkdir -p -m 0755 /nix/var/log/nix/drvs
-            mkdir -p -m 0755 /nix/var/nix/gcroots
-            mkdir -p -m 0755 /nix/var/nix/profiles
-            mkdir -p -m 0755 /nix/var/nix/temproots
-            mkdir -p -m 0755 /nix/var/nix/userpool
-            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
-            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
-            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
-            mkdir -p -m 0700 "$HOME/.nix-defexpr"
-            . ${pkgs.nix}/etc/profile.d/nix-daemon.sh
-            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixos-24.11 nixpkgs # 3
-            ${pkgs.nix}/bin/nix-channel --update nixpkgs
-            ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [nix cacert git openssh])}
-          '';
-          environmentVariables = {
-            ENV = "/etc/profile";
-            USER = "root";
-            NIX_REMOTE = "daemon";
-            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
-            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
-          };
-        };
-      };
-    };
-
     services.gitlab = {
       enable = true;
       databasePasswordFile = sec.gitlab_db.path;

modules/nixos/sites/sourcehut/default.nix

@@ -0,0 +1,204 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.sourcehut;
+
+  srhtCfg = config.services.sourcehut;
+
+  fqdn = "zoeys.cloud";
+
+  sec = config.age.secrets;
+
+  sourcehutGroup = "sourcehut-secrets";
+
+  mkSrhtBindOverrides = serviceNames:
+    lib.listToAttrs (map (name: {
+        name = name;
+
+        value = {
+          serviceConfig.BindReadOnlyPaths = lib.mkMerge ["/run/agenix"];
+        };
+      })
+      serviceNames);
+
+  metaServices = lib.mkIf srhtCfg.meta.enable (mkSrhtBindOverrides [
+    "metasrht" # Main web service
+    "metashrt-daily"
+    "metasrht-api" # API service
+    "metasrht-webhooks" # Webhook worker
+  ]);
+
+  gitServices = lib.mkIf srhtCfg.git.enable (mkSrhtBindOverrides [
+    "gitsrht" # Main web service
+    "gitsrht-api" # API service
+    "gitsrht-periodic" # Timer service
+    "gitsrht-webhooks" # Webhook worker
+    "gitsrht-fcgiwrap" # FCGIWrap for git http backend (might need access if hooks use secrets)
+  ]);
+
+  manServices = lib.mkIf srhtCfg.man.enable (mkSrhtBindOverrides [
+    "mansrht" # Main web service
+    # Add others if man gains sub-services
+  ]);
+in {
+  options.sites.sourcehut = with types; {
+    enable = mkBoolOpt false "Enable SRHT";
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.sourcehut-secrets = {};
+
+    users.users.metasrht.extraGroups = ["sourcehut-secrets"];
+    users.users.gitsrht.extraGroups = ["sourcehut-secrets"];
+
+    systemd.services = lib.mkMerge [
+      metaServices
+      gitServices
+    ];
+
+    age.secrets = {
+      network-key = {
+        file = ./sec/networkKey.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+      service-key = {
+        file = ./sec/serviceKey.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+      webhook-key = {
+        file = ./sec/webhookKey.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+      smtp-password = {
+        file = ./sec/smtpPassword.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+
+      pgp-pub-key = {
+        file = ./sec/pgpPubKey.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440"; # Or 0444 if it needs to be world-readable, but 0440 is safer
+      };
+      pgp-priv-key = {
+        file = ./sec/pgpPrivKey.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440"; # Private key needs strict permissions
+      };
+
+      git-client-secret = {
+        file = ./sec/gitClientSecret.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+      man-client-secret = {
+        file = ./sec/gitClientSecret.age;
+        owner = "root";
+        group = sourcehutGroup;
+        mode = "0440";
+      };
+    };
+
+    services.sourcehut = {
+      enable = true;
+
+      git.enable = true;
+      git.redis.host = "redis://localhost:6379?db=0";
+      man.enable = true;
+      man.redis.host = "redis://localhost:6379?db=0";
+      meta.enable = true;
+      meta.redis.host = "redis://localhost:6379?db=0";
+      # todo.enable = true;
+      # paste.enable = true;
+      # lists.enable = true;
+
+      nginx.enable = true;
+      postgresql.enable = true;
+      redis.enable = true;
+
+      postfix.enable = false;
+
+      settings = {
+        "sr.ht" = {
+          environment = "production";
+          global-domain = fqdn;
+
+          origin = "https://${fqdn}";
+
+          owner-email = "admin@${fqdn}";
+          owner-name = "zoey";
+          site-name = "zoey's cloud";
+
+          network-key = sec.network-key.path;
+          service-key = sec.service-key.path;
+        };
+
+        webhooks = {
+          private-key = sec.webhook-key.path;
+        };
+
+        "git.sr.ht" = {
+          oauth-client-id = "bdd69307-d8b9-4f02-b079-2a1055c3e865";
+          oauth-client-secret = sec.git-client-secret.path;
+        };
+
+        "man.sr.ht" = {
+          oauth-client-id = "9c64aac1-51cb-48f0-9ff8-a2af377dd38e";
+          oauth-client-secret = sec.man-client-secret.path;
+        };
+
+        mail = {
+          smtp-host = "mail.zoeys.email";
+          smtp-port = 465;
+          smtp-user = "srht@${fqdn}";
+          smtp-password = sec.smtp-password.path;
+          smtp-from = "no-reply@${fqdn}";
+
+          smtp-ssl = true;
+
+          pgp-pubkey = sec.pgp-pub-key.path;
+          pgp-privkey = sec.pgp-priv-key.path;
+
+          pgp-key-id = "0xD82899ACCD75CC48";
+
+          error-to = "errors@${fqdn}";
+          error-from = "sourcehut-errors@${fqdn}";
+        };
+
+        "meta.sr.ht::settings" = {
+          registration = true;
+        };
+      };
+    };
+
+    security.acme.certs."${fqdn}".extraDomainNames = [
+      "meta.${fqdn}"
+      "man.${fqdn}"
+      "git.${fqdn}"
+    ];
+
+    services.nginx = {
+      virtualHosts = {
+        "${fqdn}".enableACME = true;
+        "meta.${fqdn}".enableACME = true;
+        "man.${fqdn}".enableACME = true;
+        "git.${fqdn}".enableACME = true;
+      };
+    };
+  };
+}

modules/nixos/sites/sourcehut/sec/networkKey.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CtmR6w sWwNYqQ3g9UMu35p8kvAXj4uEy35g0///7gpHFO69zs
+1lQ0r74sGR+K/ynikwClNB5UZ3ZD1fTpxSdJE5Dk0nM
+-> ssh-ed25519 RMNffg vqaQVHXN7yjv10wz2xZCpJ6O7fqXaNYCPqKEdufkdCc
+FLFvodvpQGPYbjv8yoyjHE2+a+YyZkBGZZbOx33GpRo
+--- H3zEDss69sqnW3LM5GlWR11xx9E8u04/id6jlZqNgfg
+J^s=†ÕYЭ_ÂŒü¤/À ÉȤ¸Ziýþ#‹?Lu—œ”Ú3Ñ~vH¢c9^î™Cù‡²…²üuŸ»ßÚp[ÉcúCS<43>Sv¹S

modules/nixos/sites/sourcehut/sec/smtpPassword.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CtmR6w ExpktzFWkofB1qmGIexwu0UAnUeGzQIeeEMHiZNXQkY
+YDNPPLtB8N7A0NB0VwVkQAN3DNeknLo3rv+WdcUdLD0
+-> ssh-ed25519 RMNffg GFHzl2/nPuIVH4RzUnbUl/LHFmkXQ+pPUGuQzcEZi3o
+Z6iMUjgD0K7LCYWV0qZMbyzWmUsbhp0anr3niecdyPs
+--- wjP9Fn9/VIrsgwbTVZv/vzbEskwMKmQbHohtNyfF02w
+Ýžsý§‘zš‡<EFBFBD>ÍKQŽÐä‘b	#&™ÖTÆ3v/<2F>ÂÐg‘¨Õ¨%ë½fõî›\^œj²QÜqh

modules/nixos/ui/fonts/default.nix

@@ -29,46 +29,85 @@ in {
         lexend
         jost
         dejavu_fonts
-        iosevka
+        # iosevka
         cantarell-fonts
-        # (iosevka.override
-        #   {
-        #     set = "Custom";
-        #     privateBuildPlan = ''
-        #       [buildPlans.IosevkaCustom]
-        #       family = "Iosevka"
-        #       spacing = "normal"
-        #       serifs = "sans"
-        #       noCvSs = true
-        #       exportGlyphNames = true
-        #
-        #         [buildPlans.IosevkaCustom.variants]
-        #         inherits = "ss05"
-        #
-        #           [buildPlans.IosevkaCustom.variants.design]
-        #           l = "hooky"
-        #
-        #       [buildPlans.IosevkaCustom.widths.Normal]
-        #       shape = 500
-        #       menu = 5
-        #       css = "normal"
-        #
-        #       [buildPlans.IosevkaCustom.widths.Extended]
-        #       shape = 600
-        #       menu = 7
-        #       css = "expanded"
-        #
-        #       [buildPlans.IosevkaCustom.widths.SemiCondensed]
-        #       shape = 456
-        #       menu = 4
-        #       css = "semi-condensed"
-        #
-        #       [buildPlans.IosevkaCustom.widths.SemiExtended]
-        #       shape = 548
-        #       menu = 6
-        #       css = "semi-expanded"
-        #     '';
-        #   })
+        (iosevka.override
+          {
+            set = "Custom";
+            privateBuildPlan = ''
+              # [buildPlans.IosevkaCustom]
+              # family = "Iosevka"
+              # spacing = "fontconfig-mono"
+              # serifs = "sans"
+              # noCvSs = true
+              # exportGlyphNames = true
+              #
+              #   [buildPlans.IosevkaCustom.variants]
+              #   inherits = "ss08"
+              #
+              # [buildPlans.IosevkaCustom.widths.Normal]
+              # shape = 500
+              # menu = 5
+              # css = "normal"
+              #
+              # [buildPlans.IosevkaCustom.widths.Extended]
+              # shape = 600
+              # menu = 7
+              # css = "expanded"
+
+              [buildPlans.IosevkaCustom]
+              family = "Iosevka"
+              spacing = "normal"
+              serifs = "sans"
+              noCvSs = true
+              exportGlyphNames = true
+
+                [buildPlans.IosevkaCustom.variants]
+                inherits = "ss17"
+
+                  [buildPlans.IosevkaCustom.variants.design]
+                  capital-e = "top-left-serifed"
+                  capital-u = "toothed-bottom-right-serifed"
+                  f = "tailed"
+                  m = "short-leg-top-left-and-bottom-right-serifed"
+                  paren = "flat-arc"
+
+                [buildPlans.IosevkaCustom.ligations]
+                inherits = "dlig"
+
+                [buildPlans.IosevkaCustom.weights.Regular]
+                shape = 400
+                menu = 400
+                css = 400
+
+                [buildPlans.IosevkaCustom.weights.Medium]
+                shape = 500
+                menu = 500
+                css = 500
+
+                [buildPlans.IosevkaCustom.weights.SemiBold]
+                shape = 600
+                menu = 600
+                css = 600
+
+                [buildPlans.IosevkaCustom.weights.Bold]
+                shape = 700
+                menu = 700
+                css = 700
+
+                [buildPlans.IosevkaCustom.slopes.Upright]
+                angle = 0
+                shape = "upright"
+                menu = "upright"
+                css = "normal"
+
+                [buildPlans.IosevkaCustom.slopes.Italic]
+                angle = 9.4
+                shape = "italic"
+                menu = "italic"
+                css = "italic"
+            '';
+          })
         noto-fonts
         noto-fonts-cjk-sans
         noto-fonts-emoji