Services/Nextcloud: Update to v33.0.5

README.md

@@ -1,43 +1,159 @@
-# NixOS Configuration
+# NixFlake
 
-Modular NixOS configuration, using [Niri](https://github.com/niri-wm/niri) and [Waybar](https://github.com/Alexays/Waybar) for a light desktop.
+NixOS flake with [Niri](https://github.com/niri-wm/niri), [Waybar](https://github.com/Alexays/Waybar) for a lightweight desktop and [home-manager](https://github.com/nix-community/home-manager) for declarative `~/` configuration.
 
-![](FastFetch.png)
-![](Darwin.png)
+## Screenshots
 
-To install, run `nixos-rebuild` with the `--flake` parameter from the `NixFlake` directory: `nixos-rebuild switch --flake .#nixinator`.
-Alternatively, use `nh os switch` or `nh os boot`.
+![Fastfetch](FastFetch.png)
 
-## NixFlake/system
+![Neovim](NeoVim.png)
 
-Contains all the system configurations.
+![Darwin](Darwin.png)
 
-- There is a common configuration used for all systems: `NixFlake/system/default.nix`
-- Every system has its own special configuration: `NixFlake/system/<hostname>/default.nix`
-- System modules are located in `NixFlake/system/systemmodules`
-- Hosted services are located in `NixFlake/system/services`
+## Hosts
 
-When creating a NixOS configuration inside the `NixFlake/flake.nix` the common configuration is imported.
-Because the hostname is propagated to the common configuration, it can import the host-specific config by itself.
+| Host | Type | GPU | Features |
+|-|-|-|-|
+| `nixinator` | Desktop (x86_64) | NVIDIA | [disko](https://github.com/nix-community/disko) partitioning, [lanzaboote](https://github.com/nix-community/lanzaboote) Secure Boot, [impermanence](https://github.com/nix-community/impermanence) opt-in state, [sops-nix](https://github.com/Mic92/sops-nix) secrets |
+| `nixtop` | Laptop (x86_64) | Intel | Obsolete trash computer |
+| `servenix` | Headless (x86_64) | NVIDIA | Jellyfin, Nextcloud, Gitea, ... |
+| `thinknix` | Headless (x86_64) | - | AdGuard DNS, Nginx, ... |
+| `darwinix` | macOS (aarch64) | - | nix-darwin with home-manager |
 
-## NixFlake/home
+## Usage
 
-Contains all the home-manager configurations.
+```bash
+# Enter dev shell (provides helper utilities)
+nix develop
 
-- There is a common configuration for each user: `NixFlake/home/<username>/default.nix`
-- There is a configuration for a single system of this user: `NixFlake/home/<username>/<hostname>/default.nix`
-- Home-Manager modules are located in `NixFlake/home/homemodules`
+# Rebuild system + user config together
+nh os switch
+nh os boot
 
-When creating a NixOS configuration inside the `NixFlake/flake.nix` the common configuration is imported.
-Because the hostname is propagated to the common configuration, it can import the host-specific config by itself.
+# Or with nixos-rebuild
+sudo nixos-rebuild switch --flake .#nixinator
+```
 
-## NixFlake/derivations
+## Info
 
-Contains all the stuff I packaged.
-Each derivation is loaded into `NixFlake/derivations/default.nix`.
+Home-manager runs as a NixOS module (not standalone). A single `nixos-rebuild switch` rebuilds both system and user configuration together.
 
-## NixFlake/overlays
+### Components
 
-Contains all overlays, e.g. package version overrides.
-The `NixFlake/overlays/default.nix` imports all overlays and all derivations.
-It is then imported by the top-level `NixFlake/flake.nix`, to make everything available to the system/home configurations.
+Per-host config consists of three layers:
+
+1. **Common Config**: `system/default.nix` (NixOS) / `home/christoph/default.nix` (home-manager)
+2. **Host Config**: `system/<hostname>/default.nix` (NixOS) / `home/christoph/<hostname>/default.nix` (home-manager)
+3. **Hardware**: `system/<hostname>/hardware-configuration.nix`
+
+### Modules
+
+There are two module hierarchies (NixOS and home-manager modules):
+
+```
+system/systemmodules/<name>/        home/homemodules/<name>/
+- options.nix # declares options    - options.nix # declares options
+- default.nix # implementation      - default.nix # implementation
+```
+
+## Files
+
+```
+NixFlake/
+├── flake.nix              # flake entrypoint: inputs, outputs, host definitions
+├── flake.lock             # flake lockfile
+├── shell.nix              # dev shell (nix develop)
+├── system/                # NixOS system configurations
+│   ├── default.nix        # global system defaults (all hosts)
+│   ├── <hostname>/        # per-host overrides + hardware-config
+│   ├── systemmodules/     # reusable system modules
+│   └── services/          # OCI container services
+├── home/                  # home-manager user configuration
+│   └── christoph/
+│       ├── default.nix    # global user defaults
+│       ├── <hostname>/    # per-host user overrides
+│       └── homemodules/   # reusable home-manager modules
+├── lib/                   # shared helpers
+├── derivations/           # custom packages
+├── overlays/              # package overrides
+├── config/                # linked dotfiles
+└── wallpapers/            # backgrounds
+```
+
+## System Modules
+
+| Module | Description |
+|--------|-------------|
+| `bootloader` | systemd-boot, lanzaboote Secure Boot signing |
+| `desktopportal` | xdg-desktop-portal backends (Niri, GTK) |
+| `docker` | Docker / podman daemon config |
+| `fonts` | System fonts and fontconfig |
+| `impermanence` | Opt-in state persistence (wipes `/` on boot) |
+| `mime` | MIME type associations |
+| `network` | systemd-networkd wired/wireless config |
+| `polkit` | Polkit rules for desktop users |
+| `sops-nix` | Secrets decryption at boot |
+
+## Home-Manager Modules
+
+### Shell & Terminal
+`fish` `terminal` `kitty` `tmux` `paths`
+
+### Editors
+`neovim` `vscode` `zed`
+
+### Desktop / WM
+`niri` `waybar` `rofi` `color` `fcitx`
+
+### Media
+`mpd` `rmpc` `cava` `beets` `jellyfin-tui`
+
+### Browsers
+`firefox` `qutebrowser`
+
+### Tools
+`git` `ssh` `bat` `btop` `fastfetch` `lazygit` `yazi` `zathura`
+
+## Services
+
+All server services run as OCI containers (podman). Each service is defined in `system/services/<name>.nix`.
+
+| Service | Purpose |
+|---------|---------|
+| `adguard` | DNS ad blocking |
+| `authelia` | SSO |
+| `fileflows` | Media processing |
+| `gitea` | Git server |
+| `immich` | Photo cloud |
+| `jellyfin` | Streaming server |
+| `kiwix` | Offline mirrors |
+| `kopia` | Docker volume backup |
+| `nextcloud` | File sync |
+| `nginx-proxy-manager` | Reverse proxy with Let's Encrypt |
+| `ntfy` | Push notification server |
+| `paperless` | Document management |
+| `portainer` | Container status monitor |
+| `teamspeak` | Voice chat server |
+| `tinymediamanager` | Media metadata management |
+
+## Overlays
+
+Package modifications live in `overlays/default.nix`.
+
+## Secrets
+
+Secrets are managed with sops-nix. Public age keys are stored in `flake.nix` under `publicKeys`. Encrypted `.yaml`/`.json` files are referenced via `sops.secrets.<name>`. Decryption happens at activation time.
+
+## Shared Helpers (`lib/`)
+
+| File | Purpose |
+|------|---------|
+| `nixos.nix` | Host config builders (NixOS + darwin) |
+| `modules.nix` | Option helpers |
+| `networking.nix` | systemd-networkd config generators |
+| `generators.nix` | Lua code generation |
+| `containers.nix` | OCI container helpers for services |
+| `color.nix` | Color utilities |
+| `rofi.nix` | Rofi menu helpers |
+
+Available to all modules as `mylib` (injected via special args).

flake.lock

@@ -60,11 +60,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1775706155,
-        "narHash": "sha256-h7Rw0vlb0n0Jsk21WJPm7H+1T1bG+PEuxE5cJ2TZl8A=",
+        "lastModified": 1781164160,
+        "narHash": "sha256-dxo3aPnfaQJt9K/3NhgKfu2Q9B42z4d4Or9Izoug+68=",
         "owner": "abenz1267",
         "repo": "elephant",
-        "rev": "376ee71c66db38683daabd57350bf3f6f086eaf8",
+        "rev": "3296842820d04d5ec774afc7528492fcbb3c01f2",
         "type": "github"
       },
       "original": {
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1780065812,
-        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "lastModified": 1781168557,
+        "narHash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
+        "rev": "6358ff76821101c178e3ab4919a62799bfe3652e",
         "type": "github"
       },
       "original": {
@@ -287,11 +287,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779969295,
-        "narHash": "sha256-HwIJ3tOcwSMiV75L7KqJXciXR9UfT+d7rwOZMX7cTnA=",
+        "lastModified": 1781305496,
+        "narHash": "sha256-g8Vv4Qfc7n+lgov97REu3X6BeJtvYY0hlSUZR1GrGQQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "61e2c9659324181e0f0ed911958c536333b1d4f6",
+        "rev": "c87a39aa979acc4848016d2220c6238390d84779",
         "type": "github"
       },
       "original": {
@@ -326,11 +326,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1779815066,
-        "narHash": "sha256-QVxEQivn5kA2H4Zf++wiwNR6yfJZJnvAWADUDqgtW0I=",
+        "lastModified": 1781228795,
+        "narHash": "sha256-OSofuO5j7FLg2R7c9YQdK5epMqkQLucExcDNF7dqCMo=",
         "owner": "JPyke3",
         "repo": "hytale-launcher-nix",
-        "rev": "7b527a3eeff0ee9a95106a056638a407aef1eb43",
+        "rev": "efe21e31eb63d6db1a104c14bbb437ae5d03f73b",
         "type": "github"
       },
       "original": {
@@ -436,11 +436,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1780062130,
-        "narHash": "sha256-3XF+oy0PX4aajJw2RNB8rlMpyu0eXCG4pGH7fe94yBg=",
+        "lastModified": 1781234038,
+        "narHash": "sha256-jo4a47qDgsx1F1i0MtHZl12FfzqKJOES25vbm0ZUxeI=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "3cb351d73c357a4e413f59c4551d219118791c14",
+        "rev": "eb5789cba8d37802d330df5a13c691622c83121f",
         "type": "github"
       },
       "original": {
@@ -469,11 +469,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1780056110,
-        "narHash": "sha256-t7lKVshV/srD0G06j4r5P5qj9zaDeZ9JYFCxHDGROZU=",
+        "lastModified": 1780938415,
+        "narHash": "sha256-QHyIMGSbCQW8d5qbOrMsm6gem10bO3Au2YLa3alJfHo=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "f9f43d826ab4014a7c302be28d7da33e12f5be37",
+        "rev": "6f1a2c5f0e8274223d4204b1f8d6f7f91538967e",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779036909,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "lastModified": 1781242433,
+        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
         "type": "github"
       },
       "original": {
@@ -578,11 +578,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1779796641,
-        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
+        "lastModified": 1780952837,
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "25f538306313eae3927264466c70d7001dcea1df",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
         "type": "github"
       },
       "original": {
@@ -594,11 +594,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1779796641,
-        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
+        "lastModified": 1780952837,
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "25f538306313eae3927264466c70d7001dcea1df",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
         "type": "github"
       },
       "original": {
@@ -655,11 +655,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
       "original": {
@@ -703,11 +703,11 @@
     },
     "nixpkgs_7": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
       "original": {
@@ -719,11 +719,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1779877693,
-        "narHash": "sha256-NOF9NAREhxr50bbBfVcVOq+ArCMSoe8dP79Pk2uyARk=",
+        "lastModified": 1780336545,
+        "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4100e830e085863741bc69b156ec4ccd53ab5be0",
+        "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
         "type": "github"
       },
       "original": {
@@ -756,11 +756,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1780056171,
-        "narHash": "sha256-CXpH7axUH7AzI5izVHfOYawY350beplaAKFLDaQY128=",
+        "lastModified": 1781287460,
+        "narHash": "sha256-9hXtN4my7eBqHRVQ/t6FQZ4YqZ1KG6SsKSG4Hdtr+i0=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "d7800d4b1c420e0c2dcaaddd58038c8b662e72a8",
+        "rev": "f2029d9a26266eb67f46b0c79bd0a3713839a57a",
         "type": "github"
       },
       "original": {
@@ -800,11 +800,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780066277,
-        "narHash": "sha256-VfvIrI792pYYywcEfvMy5FC5hIIq4lFeUK2dcoSq1BQ=",
+        "lastModified": 1781349989,
+        "narHash": "sha256-PTgbtYdDqSzfANBCI8g0iA5DdMGr5imJuWUH1w0RmWY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "58bb8dda9943cc5c0827ece3b1a367d76b64af21",
+        "rev": "6b2f93e70e526d09559f73dfc3760d489a5504bf",
         "type": "github"
       },
       "original": {
@@ -909,11 +909,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
         "type": "github"
       },
       "original": {
@@ -954,15 +954,16 @@
     },
     "systems_3": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }
@@ -1004,11 +1005,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779792099,
-        "narHash": "sha256-HF5M0dr96kDPLS8ebRCG/YZglsKZZdvAhGIAf+lGUiU=",
+        "lastModified": 1780405768,
+        "narHash": "sha256-WhPHaupeq5yWP53anFH6vr/ZMQQtAYGtpgUhzqWx9Ws=",
         "owner": "adriankarlen",
         "repo": "textfox",
-        "rev": "2c35f1f04e6283d37b199f318874c57f7d37ef6a",
+        "rev": "d6895da75f10fa17f1b637759aec3d84818b20e2",
         "type": "github"
       },
       "original": {
@@ -1026,11 +1027,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1777789924,
-        "narHash": "sha256-fX3ErzTmHRO9z1SzHC2VZUgKOgRfO13X/joC5a3QN7Q=",
+        "lastModified": 1781164128,
+        "narHash": "sha256-xPcYrHdDXWykIi5/XXkLvliBArRnfzvs+atB9El1qhI=",
         "owner": "abenz1267",
         "repo": "walker",
-        "rev": "93d44d1cb41732e1370e4b949429ae8e34ea05a4",
+        "rev": "aa1e4b7d59237e8c43dde58636bae476f23d9bfb",
         "type": "github"
       },
       "original": {
@@ -1059,11 +1060,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1779745227,
-        "narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=",
+        "lastModified": 1781226823,
+        "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2",
+        "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e",
         "type": "github"
       },
       "original": {

home/christoph/nixinator/default.nix

@@ -3,6 +3,7 @@
   pkgs,
   nixosConfig,
   config,
+  hostname,
   lib,
   mylib,
   username,
@@ -52,20 +53,171 @@
       opencode = {
         enable = true;
         enableMcpIntegration = true;
-        extraPackages = [
-          # pkgs.opencode-claude-auth # Installed using npm
+        extraPackages = with pkgs; [
+          # opencode-claude-auth # Installed using npm
         ];
 
         # Writes opencode.json
         settings = {
-          plugin = [
-            # https://github.com/griffinmartin/opencode-claude-auth
-            "opencode-claude-auth@latest"
+          attachment = {
+            image = {
+              auto_resize = true;
+              max_width = 2000;
+              max_height = 2000;
+              max_base64_bytes = 5242880;
+            };
+          };
+          autoupdate = false;
+          compaction = {
+            auto = true;
+            prune = true;
+            reserved = 10000;
+          };
+          default_agent = "plan";
+          enabled_providers = [
+            "opencode"
+            "opencode-go"
+            "anthropic"
           ];
+          formatter = {
+            nixfmt = {
+              disabled = true;
+            };
+            alejandra = {
+              command = ["alejandra" "$FILE"];
+              extensions = [".nix"];
+            };
+            perltidy = {
+              command = ["perltidy" "$FILE"];
+              extensions = [".pl"];
+            };
+          };
+          lsp = {
+            nixd = {
+              command = ["nixd"];
+              extensions = [".nix"];
+              initialization = {
+                preferences = {
+                  nixd = {
+                    nixpkgs = {expr = "import <nixpkgs> {}";};
+                    options = {
+                      nixos = {expr = "(builtins.getFlake \"/home/${username}/NixFlake\").nixosConfigurations.${hostname}.options";};
+                      home-manager = {expr = "(builtins.getFlake \"/home/${username}/NixFlake\").nixosConfigurations.\"${hostname}\".options.home-manager.users.type.getSubOptions []";};
+                    };
+                    diagnostic = {
+                      suppress = ["sema-escaping-with" "var-bind-to-this" "escaping-this-with"];
+                    };
+                  };
+                };
+              };
+            };
+            perlnavigator = {
+              command = ["perlnavigator"];
+              extensions = [".pl"];
+              initialization = {
+                preferences = {};
+              };
+            };
+            # perlpls = {
+            #   command = ["pls"];
+            #   extensions = [".pl"];
+            #   initialization = {
+            #     preferences = {
+            #       perl = {
+            #         perlcritic = {enabled = false;};
+            #         syntax = {enabled = true;};
+            #       };
+            #     };
+            #   };
+            # };
+            r-language-server = {
+              command = ["R" "--no-echo" "-e" "languageserver::run()"];
+              extensions = [".r" ".rmd" ".quarto"];
+            };
+          };
+          permission = {
+            "*" = "ask";
+            "bash" = {
+              "*" = "ask";
+              "ls *" = "allow";
+              "find *" = "ask"; # Don't want find -exec
+              "file *" = "allow";
+              "wc *" = "allow";
+              "grep *" = "allow";
+              "rg *" = "allow";
+              "test *" = "allow";
+              "echo *" = "allow";
+              "which *" = "allow";
+              "pwd *" = "allow";
+              "dirname *" = "allow";
+              "basename *" = "allow";
+              "readlink *" = "allow";
+
+              "cat *.env" = "deny";
+              "cat *.env.*" = "deny";
+              "cat *.env.example" = "allow";
+              "printenv *" = "deny";
+              "env *" = "deny";
+
+              "nix eval *" = "allow";
+              "nix flake metadata *" = "allow";
+              "nix flake show *" = "allow";
+              "nix path-info *" = "allow";
+              "nix why-depends *" = "allow";
+              "nix derivation show *" = "allow";
+              "nix store ping *" = "allow";
+              "nix stire diff-closures *" = "allow";
+
+              "git status *" = "allow";
+              "git log *" = "allow";
+              "git diff *" = "allow";
+            };
+            "external_directory" = {
+              "/nix/store/**" = "allow";
+              "/tmp" = "allow";
+              "/tmp/*" = "allow";
+            };
+            "read" = {
+              "*" = "allow";
+              "*.env" = "deny";
+              "*.env.*" = "deny";
+              "*.env.example" = "allow";
+            };
+            "grep" = "allow";
+            "glob" = "allow";
+            "lsp" = "allow";
+            "skill" = "allow";
+            "task" = "ask";
+            "todowrite" = "allow";
+            "webfetch" = "allow";
+            "websearch" = "allow";
+            "question" = "allow";
+          };
+          plugin = [
+            "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
+            "@tarquinen/opencode-dcp@latest" # better compacting
+            # "@slkiser/opencode-quota"
+          ];
+          share = "disabled";
+          shell = "fish";
+          snapshot = false;
+          watcher = {
+            ignore = ["node_modules/**" "dist/**" ".git/**"];
+          };
         };
 
         # Writes tui.json
-        tui = {};
+        tui = {
+          theme = "system";
+          diff_style = "auto";
+          mouse = true;
+          attention = {
+            enabled = true;
+            notifications = true;
+            sound = true;
+            volume = "0.3";
+          };
+        };
 
         agents = {};
         commands = {};

home/homemodules/neovim/default.nix

@@ -308,6 +308,15 @@ in {
             require("${name}").setup(opts)
           end
         '';
+
+        # Like mkDefaultConfig but takes the Lua module name explicitly.
+        # Use when the Lua module name (e.g. "noice") differs from what
+        # lazy.nvim expects as the plugin name (e.g. "noice.nvim").
+        mkDefaultConfigFor = moduleName: ''
+          function(_, opts)
+            require("${moduleName}").setup(opts)
+          end
+        '';
       in {
         enable = true;
 
@@ -1378,19 +1387,19 @@ in {
           };
 
           _nui = {
-            name = "nui"; # For noice
+            name = "nui.nvim";
             pkg = pkgs.vimPlugins.nui-nvim;
             lazy = true;
           };
 
           noice = rec {
-            name = "noice";
+            name = "noice.nvim";
             pkg = pkgs.vimPlugins.noice-nvim;
             lazy = false;
             dependencies = [
               _nui
             ];
-            config = mkDefaultConfig name;
+            config = mkDefaultConfigFor "noice";
             opts = {
               presets = {
                 bottom_search = false;
@@ -1452,21 +1461,31 @@ in {
             };
           };
 
-          # opencode = {
-          #   name = "opencode";
-          #   pkg = pkgs.vimPlugins.opencode-nvim;
-          #   lazy = false;
-          #   config = ''
-          #     function()
-          #       ---@type opencode.Opts
-          #       vim.g.opencode_opts = {
-          #         -- Your configuration, if any; goto definition on the type or field for details
-          #       }
-          #
-          #       vim.o.autoread = true -- Required for `vim.g.opencode_opts.events.reload`
-          #     end
-          #   '';
-          # };
+          opencode = {
+            name = "opencode";
+            pkg = pkgs.vimPlugins.opencode-nvim;
+            lazy = false;
+            config = ''
+              function()
+                vim.g.opencode_opts = {
+                  server = {
+                    url = "http://localhost:12345",
+                    start = false,
+                  },
+                  events = {
+                    permissions = {
+                      edits = {
+                        -- Disable neovim diff popup tab
+                        enabled = false,
+                      },
+                    },
+                  },
+                }
+
+                vim.o.autoread = true -- Required for `vim.g.opencode_opts.events.reload`
+              end
+            '';
+          };
 
           # obsidian = rec {
           #   name = "obsidian";
@@ -1812,7 +1831,7 @@ in {
           };
 
           _plenary = {
-            name = "plenary";
+            name = "plenary.nvim";
             pkg = pkgs.vimPlugins.plenary-nvim;
             lazy = true;
           };
@@ -2231,12 +2250,12 @@ in {
           };
 
           yazi = rec {
-            name = "yazi";
+            name = "yazi.nvim";
             pkg = pkgs.vimPlugins.yazi-nvim;
             lazy = true;
             event = ["VeryLazy"];
             dependencies = [_plenary];
-            config = mkDefaultConfig name;
+            config = mkDefaultConfigFor "yazi";
             opts = {
               open_for_directories = true;
               highlight_hovered_buffers_in_same_directory = false;
@@ -2298,7 +2317,7 @@ in {
           noice # Modern UI overhaul, e.g. floating cmdline
           # obsidian # Integration with Obsidian.md
 
-          # opencode # TODO: Doesn't work, can't find "opencode --port" process
+          opencode # TODO: Doesn't work, can't find "opencode --port" process
           # overseer # Run tasks from within neovim (e.g. cargo) # TODO:
 
           persisted # Session management

home/homemodules/neovim/mappings.nix

@@ -415,51 +415,57 @@ _: let
     }
   ];
 
-  # leader-opencode = [
-  #   {
-  #     mode = "n";
-  #     key = "<leader>o";
-  #     action = "+opencode";
-  #   }
-  #   {
-  #     mode = ["n" "v"];
-  #     key = "<leader>oa";
-  #     action.__raw = ''function() require("opencode").ask("@this: ") end'';
-  #     options.desc = "Ask";
-  #   }
-  #   {
-  #     mode = ["n" "v"];
-  #     key = "<leader>os";
-  #     action.__raw = ''function() require("opencode").select() end'';
-  #     options.desc = "Select";
-  #   }
-  #   {
-  #     mode = "n";
-  #     key = "<leader>ol";
-  #     action.__raw = ''function() return require("opencode").operator("@this ") .. "_" end'';
-  #     options.desc = "Append Line";
-  #     options.expr = true;
-  #   }
-  #   {
-  #     mode = ["n" "v"];
-  #     key = "<leader>or";
-  #     action.__raw = ''function() return require("opencode").operator("@this ") end'';
-  #     options.desc = "Append Range";
-  #     options.expr = true;
-  #   }
-  #   {
-  #     mode = "n";
-  #     key = "<S-C-u>";
-  #     action.__raw = ''function() require("opencode").command("session.half.page.up") end'';
-  #     options.desc = "Scroll OpenCode Up";
-  #   }
-  #   {
-  #     mode = "n";
-  #     key = "<S-C-d>";
-  #     action.__raw = ''function() require("opencode").command("session.half.page.down") end'';
-  #     options.desc = "Scroll OpenCode Down";
-  #   }
-  # ];
+  leader-opencode = [
+    {
+      mode = ["n" "v"];
+      key = "<leader>o";
+      action = "+opencode";
+    }
+    {
+      mode = ["n" "v"];
+      key = "<leader>oo";
+      action.__raw = ''function() require("opencode").ask("@this: ") end'';
+      options.desc = "Ask about @this";
+    }
+    {
+      mode = ["n" "v"];
+      key = "<leader>od";
+      action.__raw = ''function() require("opencode").prompt("Explain @diagnostics") end'';
+      options.desc = "Explain @diagnostics";
+    }
+    {
+      mode = ["n" "v"];
+      key = "<leader>oe";
+      action.__raw = ''function() require("opencode").prompt("Explain @this and its context") end'';
+      options.desc = "Explain @this";
+    }
+    {
+      mode = ["n" "v"];
+      key = "<leader>or";
+      action.__raw = ''function() require("opencode").prompt("Review @this for correctness and readability") end'';
+      options.desc = "Review @this";
+    }
+    {
+      mode = ["n" "v"];
+      key = "<leader>os";
+      action.__raw = ''function() require("opencode").select() end'';
+      options.desc = "Select Action";
+    }
+    {
+      mode = "n";
+      key = "<leader>oa";
+      action.__raw = ''function() return require("opencode").operator("@this ") .. "_" end'';
+      options.desc = "Append Line to Prompt";
+      options.expr = true;
+    }
+    {
+      mode = "v";
+      key = "<leader>oa";
+      action.__raw = ''function() return require("opencode").operator("@this ") end'';
+      options.desc = "Append Range to Prompt";
+      options.expr = true;
+    }
+  ];
 
   leader-file = [
     {
@@ -1051,7 +1057,7 @@ in
     no-leader
 
     leader
-    # leader-opencode
+    leader-opencode
     leader-file
     leader-help
     leader-quit

home/homemodules/packages/default.nix

@@ -160,6 +160,8 @@ in {
           czkawka-full # file deduplicator
           binaryninja-free # reverse engineering
           tableplus # database explorer
+          # opencode-desktop
+          lmstudio # TODO: Ollama
 
           # Office
           kdePackages.wacomtablet # For xournalpp/krita

lib/nixos.nix

@@ -23,15 +23,11 @@
       substituters = [
         "https://cache.nixos.org"
         "https://nix-community.cachix.org"
-        # "https://comfyui.cachix.org"
-        # "https://ai.cachix.org"
         # "https://app.cachix.org/cache/nixos-rocm"
       ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        # "comfyui.cachix.org-1:33mf9VzoIjzVbp0zwj+fT51HG0y31ZTK3nzYZAX0rec="
-        # "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
         # "nixos-rocm.cachix.org-1:VEpsf7pRIijjd8csKjFNBGzkBqOmw8H9PRmgAq14LnE="
       ];
     };

system/nixinator/default.nix

@@ -12,7 +12,6 @@
     ./disks.nix
 
     # General services
-    ../services/comfyui.nix
     ../services/fileflows-node.nix
   ];
 
@@ -234,53 +233,50 @@
 
     kmscon = {
       enable = false;
-      hwRender = true;
       useXkbConfig = true;
       # autologinUser = username;
 
-      fonts = [
-        {
-          name = "MonoLisa Alt Script";
-          package = pkgs.monolisa;
-        }
-      ];
+      config = let
+        color = config.home-manager.users.${username}.homemodules.color;
+      in {
+        # term=xterm-256color
+
+        hwaccel = true;
+
+        font-name = color.font;
+        font-size = 14;
+
+        mode = "3440x1440";
+        palette = "custom";
+
+        palette-black = "0,0,0";
+        pallette-white = "255,255,255";
+
+        palette-red = color.rgbS.red;
+        palette-light-red = color.rgbS.red;
+
+        palette-green = color.rgbS.green;
+        palette-light-green = color.rgbS.green;
+
+        palette-yellow = color.rgbS.yellow;
+        palette-light-yellow = color.rgbS.yellow;
+
+        palette-blue = color.rgbS.blue;
+        palette-light-blue = color.rgbS.blue;
+
+        palette-magenta = color.rgbS.pink;
+        palette-light-magenta = color.rgbS.pink;
+
+        palette-cyan = color.rgbS.teal;
+        palette-light-cyan = color.rgbS.teal;
+
+        palette-foreground = color.rgbS.text;
+        palette-background = "0,0,0";
+      };
 
       # NOTE: Do NOT use multline strings here!
       #       This will create a linebreak in the systemd service and break login!
       extraOptions = "";
-
-      extraConfig = let
-        color = config.home-manager.users.${username}.homemodules.color;
-      in ''
-        # term=xterm-256color
-        font-size=14
-        mode=3440x1440
-        palette=custom
-
-        palette-black=0,0,0
-        pallette-white=255,255,255
-
-        palette-red=${color.rgbS.red}
-        palette-light-red=${color.rgbS.red}
-
-        palette-green=${color.rgbS.green}
-        palette-light-green=${color.rgbS.green}
-
-        palette-yellow=${color.rgbS.yellow}
-        palette-light-yellow=${color.rgbS.yellow}
-
-        palette-blue=${color.rgbS.blue}
-        palette-light-blue=${color.rgbS.blue}
-
-        palette-magenta=${color.rgbS.pink}
-        palette-light-magenta=${color.rgbS.pink}
-
-        palette-cyan=${color.rgbS.teal}
-        palette-light-cyan=${color.rgbS.teal}
-
-        palette-foreground=${color.rgbS.text}
-        palette-background=0,0,0
-      '';
     };
 
     openssh = {

system/nixinator/hardware-configuration.nix

@@ -121,12 +121,6 @@
       fsType = "nfs";
       options = ["defaults" "rw" "noatime" "_netdev" "bg" "hard"];
     };
-
-    "/media/Box" = {
-      device = "192.168.86.20:/mnt/Seagate4TB/Box";
-      fsType = "nfs";
-      options = ["defaults" "rw" "relatime" "_netdev" "bg" "hard"];
-    };
   };
 
   swapDevices = [

system/servenix/default.nix

@@ -24,7 +24,6 @@
     # General services
     ../services/authelia.nix
     ../services/bazarr.nix
-    ../services/box.nix
     ../services/fileflows.nix
     ../services/gitea.nix
     ../services/immich.nix

system/servenix/hardware-configuration.nix

@@ -69,12 +69,6 @@
       fsType = "nfs";
       options = ["defaults" "rw" "relatime" "_netdev" "bg" "hard"];
     };
-
-    "/media/Box" = {
-      device = "192.168.86.20:/mnt/Seagate4TB/Box";
-      fsType = "nfs";
-      options = ["defaults" "rw" "relatime" "_netdev" "bg" "hard"];
-    };
   };
 
   swapDevices = [

system/services/box.nix

@@ -1,53 +0,0 @@
-{
-  mylib,
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  boxVersion = "v0.31.0";
-in {
-  virtualisation.oci-containers.containers = {
-    box = {
-      image = "stashapp/stash:${boxVersion}";
-      autoStart = true;
-
-      login = mylib.containers.mkDockerLogin config;
-
-      dependsOn = [];
-
-      ports = [
-        # "9999:9999"
-      ];
-
-      volumes = [
-        "/etc/localtime:/etc/localtime:ro"
-
-        "/media/Box:/data"
-
-        "box_config:/root/.stash"
-        "box_metadata:/metadata"
-        "box_cache:/cache"
-        "box_blobs:/blobs"
-        "box_generated:/generated"
-      ];
-
-      environment = {
-        PUID = "3000";
-        PGID = "3000";
-        TZ = "Europe/Berlin";
-
-        STASH_STASH = "/data/";
-        STASH_GENERATED = "/generated/";
-        STASH_METADATA = "/metadata/";
-        STASH_CACHE = "/cache/";
-      };
-
-      extraOptions = [
-        "--privileged"
-        "--device=nvidia.com/gpu=all"
-        "--net=behind-nginx"
-      ];
-    };
-  };
-}

system/services/comfyui.nix

@@ -1,79 +0,0 @@
-{
-  mylib,
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  # comfyuiVersion = "cu128-slim-20260316";
-  # comfyuiVersion = "cu128-megapak-20260413";
-  # comfyuiVersion = "cu130-megapak-pt211-20260413";
-  # comfyuiVersion = "cu130-megapak-pt211-20260508";
-  comfyuiVersion = "cu130-megapak-pt211-20260604";
-in {
-  virtualisation.oci-containers.containers = {
-    comfyui = {
-      image = "yanwk/comfyui-boot:${comfyuiVersion}";
-      autoStart = false;
-
-      login = mylib.containers.mkDockerLogin config;
-
-      dependsOn = [];
-
-      ports = [
-        "8188:8188"
-      ];
-
-      volumes = let
-        rootDir = "/home/christoph/Games/ComfyUI";
-      in [
-        # cu128-slim / cu128-megapak
-        # "${rootDir}/storage:/root"
-        # "${rootDir}/storage-models/models:/root/ComfyUI/models"
-        # "${rootDir}/storage-models/hf-hub:/root/.cache/huggingface/hub"
-        # "${rootDir}/storage-models/torch-hub:/root/.cache/torch/hub"
-        # "${rootDir}/storage-user/input:/root/ComfyUI/input"
-        # "${rootDir}/storage-user/output:/root/ComfyUI/output"
-        # "${rootDir}/storage-user/workflows:/root/ComfyUI/user/default/workflows"
-
-        # cu130-megapak
-        "${rootDir}/storage-cache/dot-cache:/root/.cache"
-        "${rootDir}/storage-cache/dot-config:/root/.config"
-        "${rootDir}/storage-nodes/dot-local:/root/.local"
-        "${rootDir}/storage-nodes/comfy-extras:/root/ComfyUI/comfy_extras"
-        "${rootDir}/storage-nodes/custom_nodes:/root/ComfyUI/custom_nodes"
-        "${rootDir}/storage-models/models:/root/ComfyUI/models"
-        "${rootDir}/storage-models/hf-hub:/root/.cache/huggingface/hub"
-        "${rootDir}/storage-models/torch-hub:/root/.cache/torch/hub"
-        "${rootDir}/storage-user/input:/root/ComfyUI/input"
-        "${rootDir}/storage-user/output:/root/ComfyUI/output"
-        "${rootDir}/storage-user/user-profile:/root/ComfyUI/user"
-        "${rootDir}/storage-user/user-scripts:/root/user-scripts"
-      ];
-
-      environment = {
-        PUID = "1000";
-        PGID = "1000";
-        TZ = "Europe/Berlin";
-
-        # https://github.com/Comfy-Org/ComfyUI/blob/master/comfy/cli_args.py
-        CLI_ARGS = lib.concatStringsSep " " [
-          # "--cache-none" # Leads to single nodes being executed multiple times for each output connection :/
-          # "--lowvram"
-          # "--disable-smart-memory"
-          # "--disable-pinned-memory"
-          # "--disable-dynamic-vram"
-          # "--disable-xformers"
-          # "--use-sage-attention" # Crashes
-          # "--reserve-vram 1" # (1 or 2) => Assume less vram is available to mitigate OOM due to wrong vram estimation
-        ];
-      };
-
-      extraOptions = [
-        "--privileged"
-        "--device=nvidia.com/gpu=all"
-        # "--net=behind-nginx"
-      ];
-    };
-  };
-}

system/services/nextcloud.nix

@@ -5,7 +5,7 @@
   pkgs,
   ...
 }: let
-  nextcloudVersion = "31.0.6-apache";
+  nextcloudVersion = "33.0.5-apache";
 in {
   systemd.services.nextcloud-cron = {
     enable = true;

system/systemmodules/impermanence/default.nix

@@ -70,7 +70,6 @@ in {
           (mkRDir "/usr/systemd-placeholder" m755)
 
           # TODO: Why does this use the mandb user?
-          # TODO: Why does this apparently conflict with comfyui-nix?
           # (mkDir "mandb" "/var/cache/man" m755)
 
           # (mkRDir "/var/cache/restic-backups-synology" m755)
@@ -126,10 +125,12 @@ in {
             (mkUDir ".docker" m755)
             # (mkUDir ".gradle" m755) # Unity
             (mkUDir ".java" m755) # JetBrains
+            (mkUDir ".lmstudio" m755)
             (mkUDir ".MakeMKV" m755)
             (mkUDir ".mozilla/firefox" m755) # TODO: Remove this someday
             (mkUDir ".mozilla/native-messaging-hosts" m755)
             (mkUDir ".nix-package-search" m755)
+            (mkUDir ".npm" m755) # Contains mcp servers :/
             # (mkUDir ".nv" m755) # Unity
             # (mkUDir ".ollama" m755)
             # (mkUDir ".plastic4" m755) # Unity
@@ -142,12 +143,16 @@ in {
 
             # Cache that's actually useful
             (mkUDir ".cache/claude-cli-nodejs" m755)
+            (mkUDir ".cache/elephant" m755)
             (mkUDir ".cache/fish/generated_completions" m755)
+            (mkUDir ".cache/nix" m755)
             (mkUDir ".cache/nix-index" m755)
             (mkUDir ".cache/nix-search-tv" m755)
             (mkUDir ".cache/nvim" m755)
             (mkUDir ".cache/JetBrains" m755)
             (mkUDir ".cache/keepassxc" m755)
+            (mkUDir ".cache/opencode" m755)
+            (mkUDir ".cache/uv" m755)
 
             # Config
             # (mkUDir ".config/.android" m755) # Unity
@@ -166,6 +171,7 @@ in {
             (mkUDir ".config/JetBrains" m755)
             (mkUDir ".config/kdeconnect" m755)
             (mkUDir ".config/keepassxc" m755)
+            (mkUDir ".config/LM Studio" m755)
             (mkUDir ".config/Msty" m755)
             (mkUDir ".config/Nextcloud" m755)
             # (mkUDir ".config/niri/dms" m755)