chore: Update

fix: Add Downloads folder fix preference for workspaces
chore: Update impermanence
2026-02-07 17:12:07 +01:00 · 2026-02-07 17:02:56 +01:00 · 2026-02-07 17:02:17 +01:00 · 2026-01-28 15:28:47 +01:00 · 2025-12-31 02:00:35 +01:00 · 2025-12-23 12:17:38 +01:00
50 changed files with 2212 additions and 241 deletions
@@ -4,8 +4,39 @@ My NixOS configuration.

 ## Installation

-For disk configuration we use disko, this means that installing the system from the configuration is just a single command:
+For disk configuration we use disko, but for secrets management we use sops-nix and the particular setup makes the installation process a bit more involved. It is required that the computer from which the installation is being run has access to the `nixos-secrets` repository, otherwise you will need to manually add the required ssh keys to the installation image. 
+```bash
+# Load into the installer
+sudo passwd # Set a root password

+# From a machine with network access to the installer
+# and access to the nixos-secrets repo
+ssh -A root@(installer-ip)
+
+# Set up disks
+nix-shell -p disko
+disko --mode disko --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+exit
+
+# Install NixOS
+nixos-install --no-channel-copy --no-root-password --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+
+# Set up host credentials for access to the secrets
+cd /mnt/persist/system/etc/sops
+touch sops_ed25519_key 
+chmod 600 sops_ed25519_key
+nano sops_ed25519_key
 ```
-sudo nix --experimental-features "nix-command flakes" run "github:nix-community/disko/latest#disko-install" -- --flake git+https://git.bulthuis.dev/Jan/dotfiles#<hostname> --disk main /dev/sda
+If `nixos-install` is being stopped by the OOM-killer, you can try adding `-j 1` to limit the amount of jobs that will be executed at the same time to 1. It might require running nixos-install multiple times untill it has managed to download all requirements and slowly start building the rest of the system.
+
+## Updating
+
+To update the system configuration, it is a single command:
+```bash
+sudo system-update
 ```
+Or if this shell script has not been installed for some reason:
+```bash
+sudo nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config
+```
+Sometimes it may be necessary to reboot of course.
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1748225455,
-        "narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
        "type": "github"
      },
      "original": {
@@ -23,11 +23,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
@@ -54,6 +54,24 @@
        "type": "github"
      }
    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -61,11 +79,32 @@
        ]
      },
      "locked": {
-        "lastModified": 1748134483,
-        "narHash": "sha256-5PBK1nV8X39K3qUj8B477Aa2RdbLq3m7wRxUKRtggX4=",
+        "lastModified": 1770476834,
+        "narHash": "sha256-cyxgVsNfHnJ4Zn6G1EOzfTXbjTy7Ds9zMOsZaX7VZWs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c1e671036224089937e111e32ea899f59181c383",
+        "rev": "6cee0821577643e0b34e2c5d9a90d0b1b5cdca70",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768598210,
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
        "type": "github"
      },
      "original": {
@@ -75,12 +114,16 @@
      }
    },
    "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs"
+      },
      "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "lastModified": 1769548169,
+        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
        "type": "github"
      },
      "original": {
@@ -89,20 +132,41 @@
        "type": "github"
      }
    },
-    "nix-minecraft": {
+    "madd": {
      "inputs": {
-        "flake-compat": "flake-compat",
        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1747581338,
-        "narHash": "sha256-/+H9qce+NPsEcAC31s3pbD64nB6GKC3+3ZNLV1+tffk=",
+        "lastModified": 1754781336,
+        "narHash": "sha256-EUavinU3psYqVDx7Cjdypsf4dUymdu1yawbwRYv6wbM=",
+        "ref": "refs/heads/master",
+        "rev": "d490b648ac5acb65aa24c8e8314c1a6fa9e2c0c1",
+        "revCount": 8,
+        "type": "git",
+        "url": "https://git.bulthuis.dev/Jan/madd"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.bulthuis.dev/Jan/madd"
+      }
+    },
+    "nix-minecraft": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751650156,
+        "narHash": "sha256-1gIPVDf159TQlcVg3WQBHMZVn8RllHOa8eT7AJPj2IE=",
        "owner": "Jan-Bulthuis",
        "repo": "nix-minecraft",
-        "rev": "44b6b40d7a3e0a114567b38a203029a5bc67e838",
+        "rev": "d3b3779fd78bd55db24d25e896438b2b51cbb6cb",
        "type": "github"
      },
      "original": {
@@ -133,16 +197,48 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1747958103,
-        "narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
+        "lastModified": 1768564909,
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1770197578,
+        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -152,9 +248,48 @@
        "disko": "disko",
        "home-manager": "home-manager",
        "impermanence": "impermanence",
+        "madd": "madd",
        "nix-minecraft": "nix-minecraft",
        "nix-modpack": "nix-modpack",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "secrets": "secrets",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1766822527,
+        "narHash": "sha256-0qNxAxr7LQ8C6MjSxV2FkMSfdVmOVRq7Yz/wCea8plo=",
+        "ref": "refs/heads/main",
+        "rev": "695e36891b5de248993845e1435df5e4116a26f2",
+        "revCount": 21,
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770145881,
+        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
      }
    },
    "systems": {
@@ -171,6 +306,21 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -3,13 +3,25 @@

  inputs = {
    # General inputs
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    home-manager.url = "github:nix-community/home-manager";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Secrets
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+    secrets.url = "git+ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets";
+
+    # Disk setup
    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";
    impermanence.url = "github:nix-community/impermanence";

+    # MADD
+    madd.url = "git+https://git.bulthuis.dev/Jan/madd";
+    madd.inputs.nixpkgs.follows = "nixpkgs";
+
    # For Minecraft VM
    nix-minecraft.url = "github:Jan-Bulthuis/nix-minecraft";
    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
@@ -17,5 +29,10 @@
    nix-modpack.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs = inputs: import ./glue inputs;
+  outputs =
+    inputs:
+    import ./glue {
+      inherit inputs;
+      excludeHomeManagerModules = [ "impermanence" ];
+    };
 }
@@ -1,9 +1,16 @@
-inputs:
+{
+  inputs,
+  excludeHomeManagerModules ? [ ],
+}:
 let
  flake = inputs.self;
  nixpkgs = inputs.nixpkgs;
  lib = nixpkgs.lib;

+  nixpkgs-config = {
+    allowUnfree = true;
+  };
+
  importDir =
    path: fn:
    let
@@ -49,6 +56,13 @@ let
    pkgs = (
      import inputs.nixpkgs {
        inherit system;
+        config = nixpkgs-config;
+      }
+    );
+    stable-pkgs = (
+      import inputs.nixpkgs-stable {
+        inherit system;
+        config = nixpkgs-config;
      }
    );
  });
@@ -102,7 +116,9 @@ let
  homeProfiles = collectModules "${flake}/profiles/home";
  inputHomeModules = lib.map (flake: flake.outputs.homeManagerModules.default) (
    lib.filter (flake: lib.hasAttrByPath [ "outputs" "homeManagerModules" "default" ] flake) (
-      lib.attrValues inputs
+      lib.attrValues (
+        lib.attrsets.filterAttrs (name: entry: !(lib.elem name excludeHomeManagerModules)) inputs
+      )
    )
  );

@@ -118,13 +134,22 @@ let
      nixpkgs.overlays = [ overlay ] ++ inputOverlays;
    };

+  nixpkgsModule =
+    { ... }:
+    {
+      nixpkgs.config = nixpkgs-config;
+    };
+
  nixosConfigurations = importDir "${flake}/hosts" (
    attrs:
    lib.mapAttrs (
      name: entry:
+      let
+        pkgs-stable = systemArgs."x86_64-linux".stable-pkgs;
+      in
      lib.nixosSystem {
        specialArgs = {
-          inherit inputs;
+          inherit inputs pkgs-stable;
        };
        modules =
          let
@@ -143,8 +168,11 @@ let
            usersModule =
              { ... }:
              {
+                home-manager.extraSpecialArgs = {
+                  inherit inputs pkgs-stable;
+                };
                home-manager.sharedModules = homeModules ++ homeProfiles ++ inputHomeModules;
-                home-manager.useUserPackages = false; # TODO: See if this should be changed to true?
+                home-manager.useUserPackages = true;
                home-manager.useGlobalPkgs = true;
                home-manager.users = homesConfiguration;
                users.users = usersConfiguration;
@@ -155,6 +183,7 @@ let
            systemPath
            overlayModule
            usersModule
+            nixpkgsModule
          ]
          ++ nixosModules
          ++ nixosProfiles
@@ -1,45 +0,0 @@
-{ flake, ... }:
-
-{
-  # State version
-  system.stateVersion = "24.05";
-
-  # Machine hostname
-  networking.hostName = "20212060";
-
-  # Admin users
-  users.users.jan.extraGroups = [
-    "wheel"
-    "wireshark"
-  ];
-
-  # Enable virtualisation for VMs
-  virtualisation.libvirtd.enable = true;
-
-  # Enable wireshark
-  programs.wireshark = {
-    enable = true;
-    dumpcap.enable = true;
-    usbmon.enable = true;
-  };
-
-  # Set up wstunnel client
-  services.wstunnel = {
-    enable = true;
-    clients.wg-tunnel = {
-      connectTo = "wss://tunnel.bulthuis.dev:443";
-      localToRemote = [
-        "udp://51820:10.10.40.100:51820"
-      ];
-    };
-  };
-
-  # Module setup
-  modules = {
-    profiles.laptop.enable = true;
-  };
-
-  imports = [
-    ./hardware-configuration.nix
-  ];
-}
@@ -1,43 +0,0 @@
-{ ... }:
-
-{
-  # Machine platform
-  nixpkgs.hostPlatform = "x86_64-linux";
-
-  # Hardware configuration
-  hardware.enableRedistributableFirmware = true;
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "nvme"
-    "usb_storage"
-    "sd_mod"
-    "rtsx_pci_sdmmc"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-  hardware.cpu.intel.updateMicrocode = true;
-
-  # Filesystems
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/3b91eaeb-ea95-4bea-8dc1-f55af7502d23";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/46BF-DE2C";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  # Swapfile
-  swapDevices = [
-    {
-      device = "/var/lib/swapfile";
-      size = 16 * 1024;
-    }
-  ];
-}
@@ -1,9 +0,0 @@
-{
-  ...
-}:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.jan.enable = true;
-}
@@ -77,7 +77,7 @@
    group = "mixer";
    extraGroups = [ "systemd-journal" ];
    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq jan@bulthuis.dev"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Personal"
    ];
  };
  users.groups.mixer = { };
@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}
@@ -0,0 +1,39 @@
+{
+  inputs,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "25.05";
+
+  # Machine hostname
+  networking.hostName = "vm-infra";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Setup JOOL NAT64
+  networking.jool = {
+    enable = true;
+    nat64.default = {
+      global.pool6 = "64:ff9b::/96";
+      pool4 = [
+        {
+          protocol = "TCP";
+          prefix = "10.64.0.1/32";
+        }
+        {
+          protocol = "UDP";
+          prefix = "10.64.0.1/32";
+        }
+        {
+          protocol = "ICMP";
+          prefix = "10.64.0.1/32";
+        }
+      ];
+    };
+  };
+}
@@ -0,0 +1,304 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "25.05";
+
+  # Machine hostname
+  networking.hostName = "vm-k1s";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Read in secrets
+  sops.secrets."flux/git-ssh-key" = {
+    sopsFile = "${inputs.secrets}/secrets/k3s-cluster.enc.yaml";
+  };
+  sops.secrets."flux/sops-decrypt-key" = {
+    sopsFile = "${inputs.secrets}/secrets/k3s-cluster.enc.yaml";
+  };
+
+  # Include NFS client module
+  boot.supportedFilesystems = [ "nfs" ];
+
+  # Set up K3S cluster with CoreDNS and FluxCD
+  services.k3s = {
+    enable = true;
+    extraFlags = [
+      "--cluster-domain ${inputs.secrets.lab.k3s.clusterDomain}"
+      "--flannel-backend=none"
+      "--disable-network-policy"
+      "--disable-kube-proxy"
+    ];
+    disable = [
+      # "coredns" # CoreDNS is required for Flux to be able to bootstrap the cluster (Flux needs to resolve the git repo)
+      "servicelb"
+      "traefik"
+      "local-storage"
+      "metrics-server"
+      "runtimes"
+    ];
+    manifests = {
+      git-ssh-key = {
+        source = config.sops.secrets."flux/git-ssh-key".path;
+      };
+      sops-decrypt-key = {
+        source = config.sops.secrets."flux/sops-decrypt-key".path;
+      };
+      # "0-secrets-backup-namespaces" = {
+      #   source = "/opt/k3s-secrets-backup/namespaces.yaml";
+      # };
+      # "1-secrets-backup" = {
+      #   source = "/opt/k3s-secrets-backup/secrets.yaml";
+      # };
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      cilium-secrets-namespace = {
+        content = {
+          apiVersion = "v1";
+          kind = "Namespace";
+          metadata.name = "cilium-secrets";
+        };
+      };
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      gateway-api =
+        let
+          manifest = pkgs.fetchurl {
+            url = "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/experimental-install.yaml";
+            hash = "sha256-08IN1MBDGTZWemkXypMfbc7RMQJCvmK57KB72YkuICU=";
+          };
+        in
+        {
+          source = manifest;
+        };
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      netpol-system-allow-egress.content = {
+        apiVersion = "cilium.io/v2";
+        kind = "CiliumClusterwideNetworkPolicy";
+        metadata.name = "allow-system-egress";
+        spec = {
+          description = "Allow all egress to system services.";
+          endpointSelector = {
+            matchExpressions = [
+              {
+                key = "io.kubernetes.pod.namespace";
+                operator = "NotIn";
+                values = [
+                  "bogus-namespace"
+                  # "kube-system"
+                  # "cilium-system"
+                  # "flux-system"
+                ];
+              }
+            ];
+          };
+          egress = [
+            {
+              toEntities = [
+                "all"
+              ];
+            }
+          ];
+          ingress = [
+            {
+              fromEntities = [
+                "all"
+              ];
+            }
+          ];
+        };
+      };
+      netpol-cluster-allow-dns.content = {
+        apiVersion = "cilium.io/v2";
+        kind = "CiliumClusterwideNetworkPolicy";
+        metadata.name = "allow-dns";
+        spec = {
+          description = "Allow DNS";
+          endpointSelector = { };
+          egress = [
+            {
+              toEndpoints = [
+                {
+                  matchLabels = {
+                    "io.kubernetes.pod.namespace" = "kube-system";
+                    "k8s-app" = "kube-dns";
+                  };
+                }
+              ];
+              toPorts = [
+                {
+                  ports = [
+                    {
+                      port = 53;
+                      protocol = "ANY";
+                    }
+                  ];
+                  rules.dns = [
+                    {
+                      matchPattern = "*";
+                    }
+                  ];
+                }
+              ];
+            }
+          ];
+        };
+      };
+      netpol-flux-allow-egress.content = { };
+    };
+    autoDeployCharts = {
+      # TODO: Move to flux config, once it is possible to easily install flux without CNI
+      cilium = {
+        name = "cilium";
+        repo = "oci://quay.io/cilium/charts/cilium";
+        version = "1.18.6";
+        hash = "sha256-+yr38lc5X1+eXCFE/rq/K0m4g/IiNFJHuhB+Nu24eUs=";
+        createNamespace = true;
+        targetNamespace = "cilium-system";
+        values = {
+          operator.replicas = 1;
+          kubeProxyReplacement = true;
+          ipam.operator.clusterPoolIPv4PodCIDRList = [ "10.42.0.0/16" ];
+          cluster = {
+            id = 1;
+            name = "vm-k1s";
+          };
+          k8sServiceHost = "10.10.50.60";
+          k8sServicePort = 6443;
+          policyEnforcementMode = "always";
+          gatewayAPI = {
+            enabled = true;
+            gatewayClass.create = "true";
+            secretsNamespace.create = false;
+            enableAlpn = true;
+          };
+          bgpControlPlane.enabled = true;
+          tls.secretsNamespace.create = false;
+          hubble = {
+            relay.enabled = true;
+            ui.enabled = true;
+            peerService.clusterDomain = inputs.secrets.lab.k3s.clusterDomain;
+          };
+        };
+        extraFieldDefinitions = {
+          spec.bootstrap = true;
+        };
+      };
+      flux-operator = {
+        name = "flux-operator";
+        repo = "oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator";
+        version = "0.38.1";
+        hash = "sha256-nb0mzEWC3IwjPenQ4LSWBN0NNJc2cc68RB+G60xBOEM=";
+        createNamespace = true;
+        targetNamespace = "flux-system";
+        extraDeploy = [
+          {
+            apiVersion = "fluxcd.controlplane.io/v1";
+            kind = "FluxInstance";
+            metadata = {
+              name = "flux";
+              namespace = "flux-system";
+              annotations = {
+                "fluxcd.controlplane.io/reconcile" = "enabled";
+                "fluxcd.controlplane.io/reconcileEvery" = "1h";
+                "fluxcd.controlplane.io/reconcileTimeout" = "5m";
+              };
+            };
+            spec = {
+              distribution = {
+                version = "2.x";
+                registry = "ghcr.io/fluxcd";
+              };
+              components = [
+                "source-controller"
+                "kustomize-controller"
+                "helm-controller"
+                "notification-controller"
+              ];
+              cluster = {
+                type = "kubernetes";
+                size = "small";
+                multitenant = false;
+                networkPolicy = true;
+                domain = inputs.secrets.lab.k3s.clusterDomain;
+              };
+              commonMetadata.labels = {
+                "app.kubernetes.io/name" = "flux";
+              };
+              sync = (
+                {
+                  pullSecret = "git-ssh-key";
+                }
+                // inputs.secrets.lab.k3s.fluxRepo
+              );
+            };
+          }
+        ];
+      };
+    };
+  };
+
+  # Backup secrets to avoid reissueing them
+  modules.impermanence.directories = [
+    "/opt/k3s-secrets-backup"
+  ];
+  systemd.timers.k3s-secrets-backup-timer = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "15m";
+      OnUnitActiveSec = "1h";
+      Unit = "k3s-secrets-backup.service";
+    };
+  };
+  systemd.services.k3s-secrets-backup = {
+    script = ''
+      mkdir -p /opt/k3s-secrets-backup
+      touch /opt/k3s-secrets-backup/secrets.yaml
+      touch /opt/k3s-secrets-backup/namespaces.yaml
+      chmod 600 /opt/k3s-secrets-backup/secrets.yaml
+      chmod 600 /opt/k3s-secrets-backup/namespaces.yaml
+
+      ${pkgs.k3s}/bin/kubectl get secrets -A -l controller.cert-manager\.io/fao=="true" -oyaml | ${pkgs.kubectl-neat}/bin/kubectl-neat > /opt/k3s-secrets-backup/secrets.yaml
+
+      echo "apiVersion: v1
+      kind: List
+      items:" > /opt/k3s-secrets-backup/namespaces.yaml
+
+      ${pkgs.gnugrep}/bin/grep -oP '\snamespace: \K.*' /opt/k3s-secrets-backup/secrets.yaml | sort -u | while read -r ns; do
+        echo "- apiVersion: v1
+        kind: Namespace
+        metadata:
+          name: $ns"
+      done >> /opt/k3s-secrets-backup/namespaces.yaml
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+  };
+
+  environment.variables = {
+    KUBECONFIG = "/etc/rancher/k3s/k3s.yaml";
+    CILIUM_NAMESPACE = "cilium-system";
+  };
+
+  environment.systemPackages = with pkgs; [
+    fluxcd
+    k9s
+    cilium-cli
+    hubble
+  ];
+
+  # Use correct disko profile
+  modules.disko.profile = "k3s";
+
+  # TEMP: Disable firewall for now
+  networking.firewall.enable = false;
+  security.sudo.wheelNeedsPassword = false;
+}
@@ -25,14 +25,27 @@

  # Set up minecraft servers
  users.users.local.extraGroups = [ "minecraft" ];
+  modules.impermanence.directories = [
+    "/srv/minecraft"
+  ];
  services.minecraft-servers = {
    enable = true;
    eula = true;
    openFirewall = true;
    servers = {
-      modpack = {
+      vanilla = {
        enable = true;
        autoStart = true;
+        serverProperties = {
+          white-list = true;
+          difficulty = "normal";
+          max-players = 5;
+        };
+        package = inputs.nix-minecraft.legacyPackages.${pkgs.system}.fabricServers.fabric-1_21_7;
+      };
+      modpack = {
+        enable = false;
+        autoStart = true;
        serverProperties = { };
        package = inputs.nix-modpack.packages.${pkgs.system}.mkModpackServer {
          packUrl = "https://raw.githubusercontent.com/Jan-Bulthuis/Modpack/refs/heads/master/pack.toml";
@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}
@@ -0,0 +1,143 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-oddjob";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Omada Software Controller
+  users.users.omada = {
+    isSystemUser = true;
+    group = "omada";
+  };
+  users.groups.omada = { };
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      omada-controller = {
+        volumes = [
+          "/var/lib/omada:/opt/tplink/EAPController/data"
+        ];
+        environment = {
+          TZ = "Europe/Amsterdam";
+        };
+        extraOptions = [
+          "--network=host"
+          "--ulimit"
+          "nofile=4096:8192"
+        ];
+        image = "mbentley/omada-controller:5.15";
+      };
+    };
+  };
+  modules.impermanence.directories = [
+    "/var/lib/omada"
+  ];
+  networking.firewall = {
+    allowedTCPPorts = [
+      8088
+      8043
+      8843
+    ];
+    allowedTCPPortRanges = [
+      {
+        from = 29811;
+        to = 29816;
+      }
+    ];
+    allowedUDPPorts = [
+      19810
+      27001
+      29810
+    ];
+  };
+
+  # Setup NAS backups
+  environment.systemPackages = with pkgs; [
+    keyutils
+  ];
+  environment.etc."request-key.d/cifs.spnego.conf".text = ''
+    create cifs.spnego * * ${pkgs.cifs-utils}/bin/cifs.upcall -t %k
+  '';
+  environment.etc."request-key.d/cifs.idmap.conf".text = ''
+    create cifs.idmap * * ${pkgs.cifs-utils}/bin/cifs.idmap %k
+  '';
+  sops.secrets."smb-credentials" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  sops.secrets."backup-script-env" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  services.cron = {
+    enable = true;
+    systemCronJobs =
+      let
+        script = pkgs.writeShellScript "backup-script" (
+          lib.concatStrings (
+            [
+              ''
+                . ${config.sops.secrets."backup-script-env".path}
+                export PBS_REPOSITORY=$PBS_REPOSITORY
+                export PBS_NAMESPACE=$PBS_NAMESPACE
+                export PBS_PASSWORD=$PBS_PASSWORD
+                export PBS_FINGERPRINT=$PBS_FINGERPRINT
+              ''
+            ]
+            ++ lib.map (share: ''
+              systemctl start mnt-${share}.mount
+              ${pkgs.util-linux}/bin/prlimit --nofile=1024:1024 ${pkgs.proxmox-backup-client}/bin/proxmox-backup-client backup nfs.pxar:/mnt/${share} --ns $PBS_NAMESPACE --backup-id share-${share} --change-detection-mode=metadata --exclude "#recycle"
+              systemctl stop mnt-${share}.mount
+            '') inputs.secrets.lab.nas.backupShares
+          )
+        );
+      in
+      [
+        "0 0 * * * root ${script}"
+      ];
+  };
+
+  # Mount filesystems
+  systemd.services.krb5-mnt-credentials = {
+    description = "Set up Kerberos credentials for mounting shares";
+    before = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    requiredBy = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      . ${config.sops.secrets."smb-credentials".path}
+      echo $password | ${pkgs.krb5}/bin/kinit $username
+    '';
+  };
+  fileSystems = lib.listToAttrs (
+    lib.map (share: {
+      name = "/mnt/${share}";
+      value = {
+        device = "//${inputs.secrets.lab.nas.host}/${share}";
+        fsType = "cifs";
+        options = [
+          "noauto"
+          "sec=krb5,credentials=${config.sops.secrets."smb-credentials".path}"
+        ];
+      };
+    }) inputs.secrets.lab.nas.backupShares
+  );
+}
@@ -0,0 +1,19 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-test";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+}
@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}
@@ -0,0 +1,176 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.05";
+
+  # Machine hostname
+  networking.hostName = "ws-think";
+
+  # Set up users
+  sops.secrets."passwords/jan-hashed" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    neededForUsers = true;
+  };
+  users.mutableUsers = false;
+  users.users.Jan = {
+    hashedPasswordFile = config.sops.secrets."passwords/jan-hashed".path;
+    # Extra admin groups
+    # TODO: Streamline setup of this
+    extraGroups = [
+      "wheel"
+      "wireshark"
+      "podman"
+      "libvirtd"
+    ];
+  };
+
+  # Set up impermanence
+  modules.impermanence = {
+    enable = true;
+    resetScript = ''
+      # Revert to the blank state for the root directory
+      zfs rollback -r tank/root@blank
+    '';
+  };
+
+  # Set up kerberos
+  security.krb5 = {
+    enable = true;
+    settings = {
+      libdefaults = {
+        rdns = false;
+      };
+      realms = (inputs.secrets.gewis.krb5Realm);
+    };
+  };
+
+  services.netbird = {
+    enable = true;
+  };
+
+  # SSH X11 forwarding
+  programs.ssh.forwardX11 = true;
+
+  # Enable older samba versions
+  services.samba = {
+    enable = true;
+    settings = {
+      global = {
+        "invalid users" = [ "root" ];
+        "passwd program" = "/run/wrappers/bin/passwd %u";
+        "security" = "user";
+        "client min protocol" = "NT1";
+      };
+    };
+  };
+
+  # TODO: Remove once laptop is properly integrated into domain
+  programs.ssh = {
+    package = pkgs.openssh_gssapi;
+    extraConfig = ''
+      GSSAPIAuthentication yes
+    '';
+  };
+
+  # Enable virtualisation for VMs
+  virtualisation.libvirtd.enable = true;
+  programs.virt-manager.enable = true;
+
+  # Enable wireshark
+  programs.wireshark = {
+    enable = true;
+    dumpcap.enable = true;
+    usbmon.enable = true;
+  };
+
+  # Enable Nix-LD
+  programs.nix-ld = {
+    enable = true;
+  };
+
+  # Set up wstunnel client
+  services.wstunnel = {
+    enable = true;
+    clients.wg-tunnel = {
+      connectTo = "wss://tunnel.bulthuis.dev:443";
+      settings.local-to-remote = [
+        "udp://51819:10.10.40.100:51820"
+      ];
+    };
+  };
+
+  # Enable flatpak
+  services.flatpak.enable = true;
+
+  # Module setup
+  modules = {
+    profiles.laptop.enable = true;
+  };
+
+  # Set up podman
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    autoPrune.enable = true;
+  };
+
+  # Enable Gnome Remote Desktop
+  services.gnome.gnome-remote-desktop.enable = true;
+  systemd.services."gnome-remote-desktop".wantedBy = [ "graphical.target" ];
+  systemd.services."gnome-remote-desktop".preStart =
+    let
+      credDir = "/var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop";
+      credPath = "${credDir}/credentials.ini";
+      credFile = pkgs.writeText "gnome-remote-desktop-credentials" ''
+        [RDP]
+        credentials={'username': <'remote'>, 'password': <'remote'>}
+      '';
+      script = pkgs.writeScript "gnome-remote-desktop-setup" ''
+        mkdir -p ${credDir}
+        touch ${credPath}
+        chown gnome-remote-desktop:gnome-remote-desktop ${credPath}
+        chmod 600 ${credPath}
+        cat ${credFile} > ${credPath}
+      '';
+    in
+    "${script}";
+  environment.etc."gnome-remote-desktop/grd.conf" = {
+    text = ''
+      [RDP]
+      port=3389
+      tls-key=/run/secrets/gnome-remote-desktop/tls-key
+      tls-cert=/run/secrets/gnome-remote-desktop/tls-crt
+      enabled=true
+    '';
+  };
+  networking.firewall = {
+    allowedTCPPorts = [
+      3389
+      3390
+    ];
+    allowedUDPPorts = [
+      3389
+      3390
+    ];
+  };
+  sops.secrets."gnome-remote-desktop/tls-key" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    owner = config.users.users.gnome-remote-desktop.name;
+    group = config.users.users.gnome-remote-desktop.group;
+  };
+  sops.secrets."gnome-remote-desktop/tls-crt" = {
+    sopsFile = "${inputs.secrets}/secrets/ws-think.enc.yaml";
+    owner = config.users.users.gnome-remote-desktop.name;
+    group = config.users.users.gnome-remote-desktop.group;
+  };
+
+  # Set up hardware
+  imports = [ ./hardware-configuration.nix ];
+}
@@ -0,0 +1,61 @@
+{ ... }:
+
+{
+  # Machine platform
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  # Set hostid (required for ZFS)
+  networking.hostId = "deadbeef";
+
+  # Hardware configuration
+  hardware.enableRedistributableFirmware = true;
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  hardware.cpu.intel.updateMicrocode = true;
+
+  # Filesystems
+  fileSystems = {
+    "/" = {
+      device = "tank/root";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/nix" = {
+      device = "tank/nix";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/persist" = {
+      device = "tank/persist";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/46BF-DE2C";
+      fsType = "vfat";
+      options = [
+        "fmask=0077"
+        "dmask=0077"
+      ];
+    };
+  };
+
+  # Swap setup
+  swapDevices = [
+    {
+      device = "/dev/disk/by-uuid/9f6f2a47-e53a-45a0-8cb2-8c1082f54ccb";
+      discardPolicy = "both";
+    }
+  ];
+}
@@ -0,0 +1,52 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  home.stateVersion = "25.11";
+
+  modules.profiles.jan.enable = true;
+
+  # home.packages = with pkgs; [
+  #   opencloud-desktop
+  #   code-nautilus
+  #   nautilus-open-in-blackbox
+  # ];
+
+  xdg.desktopEntries = {
+    canvas = {
+      name = "Canvas";
+      type = "Application";
+      exec = "${pkgs.chromium}/bin/chromium --app=\"https://canvas.tue.nl\" --user-data-dir=/home/jan/.local/state/Canvas";
+      settings.StartupWMClass = "chrome-canvas.tue.nl__-Default";
+    };
+    overleaf = {
+      name = "Overleaf";
+      type = "Application";
+      exec = "${pkgs.chromium}/bin/chromium --app=\"https://www.overleaf.com\" --user-data-dir=/home/jan/.local/state/Overleaf";
+      settings.StartupWMClass = "chrome-www.overleaf.com__-Default";
+    };
+  };
+
+  # TODO: Slowly remove
+  modules.impermanence = {
+    directories = [
+      ".cache"
+      ".config"
+      ".cargo"
+      ".dbus"
+      ".gnupg"
+      ".local"
+      ".MathWorks"
+      ".mozilla"
+      ".ssh"
+      ".steam"
+      ".SteamCloud"
+      ".thunderbird"
+      ".vscode"
+      ".wine"
+      ".Wolfram"
+    ];
+  };
+}
@@ -15,14 +15,14 @@ in
  };

  config = mkIf cfg.enable {
-    # TODO: Enable extensions with dconf
+    # TODO: Enable extensions (declaratively) with dconf

    home.pointerCursor = {
+      enable = true;
      name = "capitaine-cursors";
      size = 24;
      package = pkgs.capitaine-cursors;
      gtk.enable = true;
-      x11.enable = true;
    };

    home.packages =
@@ -50,32 +50,51 @@ in
        file-roller
        mission-center
        dconf-editor
+        gnome-calendar
+        gnome-backgrounds
+        gnome-bluetooth
+        gnome-color-manager
+        epiphany

        # For theming gtk3
-        adw-gtk3
+        # adw-gtk3 # TODO: Do this better, same for morewaita, not sure if it even works
+
+        # More icons
+        # morewaita-icon-theme
      ]
      ++ (with pkgs.gnomeExtensions; [
        gsconnect
        disable-workspace-animation
        wallpaper-slideshow
        media-progress
-        # luminus-desktop
+        mpris-label
+        pip-on-top
+        rounded-window-corners-reborn
      ]);

-    # Enable and set the gtk themes
-    gtk = {
+    # Set up gnome terminal as changing the default terminal is a pain
+    programs.gnome-terminal = {
      enable = true;
-      gtk3.extraConfig = {
-        gtk-theme-name = "adw-gtk3";
-      };
-      gtk4.extraConfig = {
-        gtk-theme-name = "Adwaita";
+      profile."12d2da79-b36c-43d5-8e1f-cf70907b84b3" = {
+        visibleName = "Default";
+        default = true;
      };
    };

+    # Enable and set the gtk themes
+    # gtk = {
+    #   enable = true;
+    #   gtk3.extraConfig = {
+    #     gtk-theme-name = "adw-gtk3";
+    #   };
+    #   gtk4.extraConfig = {
+    #     gtk-theme-name = "Adwaita";
+    #   };
+    # };
+
    # Set the theme with dconf
-    dconf.settings."org/gnome/desktop/interface" = {
-      gtk-theme = "adw-gtk3";
-    };
+    # dconf.settings."org/gnome/desktop/interface" = {
+    #   gtk-theme = "adw-gtk3";
+    # };
  };
 }
@@ -45,9 +45,9 @@ in
        };
      };

-      userName = cfg.user;
-      userEmail = cfg.email;
-      ignores = cfg.ignores;
+      settings.user.name = cfg.user;
+      settings.user.email = cfg.email;
+      # ignores = cfg.ignores;
    };
  };
 }
@@ -0,0 +1,42 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.go;
+in
+{
+  options.modules.go = {
+    enable = mkEnableOption "go";
+  };
+
+  config = mkIf cfg.enable {
+    # Development packages
+    home.packages = with pkgs; [
+    ];
+
+    # VSCode configuration
+    programs.vscode = {
+      profiles.default = {
+        extensions = with pkgs.vscode-extensions; [
+          golang.go
+
+        ];
+
+        userSettings = {
+        };
+      };
+    };
+
+    # Neovim configuration
+    # programs.nixvim = {
+    #   plugins.rustaceanvim = {
+    #     enable = true;
+    #   };
+    # };
+  };
+}
@@ -9,10 +9,11 @@ with lib;
 let
  cfg = config.modules.mathematica;

-  my-mathematica = pkgs.mathematica.override {
+  my-mathematica = pkgs.mathematica.overrideAttrs (old: {
+    force-rebuild = "1";
    # TODO: Just use a generic name for the installer?
    # source = ./Wolfram_14.2.1_LIN_Bndl.sh;
-  };
+  });
 in
 {
  options.modules.mathematica = {
@@ -21,6 +22,7 @@ in

  config = mkIf cfg.enable {
    home.packages = [
+      # pkgs.mathematica-cuda
      my-mathematica
    ];
  };
@@ -43,6 +43,7 @@ in
          tomoki1207.pdf
          ms-vsliveshare.vsliveshare
          ms-vscode-remote.remote-ssh
+          myriad-dreamin.tinymist
        ];

        userSettings =
@@ -0,0 +1,22 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.bitwarden;
+in
+{
+  options.modules.bitwarden = {
+    enable = mkEnableOption "Bitwarden";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      bitwarden-desktop
+    ];
+  };
+}
@@ -53,5 +53,8 @@ in
      fzf
      grc
    ];
+
+    # Impermanence
+    modules.impermanence.files = [ ".local/share/fish/fish_history" ];
  };
 }
@@ -24,10 +24,9 @@ in
  };

  config = mkIf cfg.enable {
-    home.persistence."/persist/home/${config.home.username}" = {
+    home.persistence."/persist/home" = {
      enable = true;
      hideMounts = true;
-      allowOther = true;
      directories = cfg.directories;
      files = cfg.files;
    };
@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in .config/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "${config.home.homeDirectory}/.config/sops/sops_ed25519_key"
+      # "/persist/home/${config.home.username}/.config/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ ".config/sops" ];
+  };
+}
@@ -16,5 +16,8 @@ in
      systemd-boot.editor = false;
      efi.canTouchEfiVariables = true;
    };
+
+    # Initrd
+    boot.initrd.systemd.enable = true;
  };
 }
@@ -20,5 +20,7 @@ in
    };
  };

-  config = mkIf cfg.enable { disko.devices = profile.disko.devices; };
+  config = mkIf cfg.enable {
+    disko.devices = profile.disko.devices;
+  };
 }
@@ -0,0 +1,218 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.domain;
+  domain = inputs.secrets.lab.domain;
+  domainUpper = lib.strings.toUpper domain;
+in
+{
+  options.modules.domain = {
+    enable = mkEnableOption "Domain Integration";
+    join = {
+      userFile = mkOption {
+        type = types.str;
+        description = "File containing the user used to join the computer.";
+      };
+      passwordFile = mkOption {
+        type = types.str;
+        description = "File containing the password for the join user.";
+      };
+      domainOUFile = mkOption {
+        type = types.str;
+        description = "The OU to join the computer to.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set network domain
+    networking.domain = domain;
+    networking.search = [ domain ];
+
+    # Automatically join the domain
+    systemd.services.adcli-join = {
+      description = "Automatically join the domain";
+      wantedBy = [ "default.target" ];
+      before = [ "sssd.service" ];
+      requiredBy = [ "sssd.service" ];
+      after = [
+        "network-online.target"
+      ];
+      requires = [
+        "network-online.target"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        ADCLI_JOIN_USER=$(cat ${cfg.join.userFile})
+        ADCLI_JOIN_OU=$(cat ${cfg.join.domainOUFile})
+        ${pkgs.adcli}/bin/adcli join -D ${domain} \
+          -U $ADCLI_JOIN_USER \
+          -O $ADCLI_JOIN_OU \
+          --dont-expire-password=true \
+          --stdin-password < ${cfg.join.passwordFile}
+      '';
+    };
+
+    # Set up Kerberos
+    security.krb5 = {
+      enable = true;
+      settings = {
+        libdefaults = {
+          default_realm = domainUpper;
+        };
+        realms.${domainUpper} = {
+        };
+        domain_realm = {
+          "${domain}" = domainUpper;
+          ".${domain}" = domainUpper;
+        };
+      };
+    };
+
+    # Set up SSSD
+    services.sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        domains = ${domain}
+        config_file_version = 2
+        services = nss, pam
+
+        [nss]
+        filter_users = ${concatStringsSep "," (lib.attrNames config.users.users)}
+        filter_groups = ${concatStringsSep "," (lib.attrNames config.users.groups)}
+
+        [domain/${domain}]
+        enumerate = False
+        ad_domain = ${domain}
+        krb5_realm = ${domainUpper}H
+        id_provider = ad
+        auth_provider = ad
+        access_provider = ad
+        chpass_provider = ad
+        use_fully_qualified_names = False
+        ldap_schema = ad
+        ldap_id_mapping = True
+        ad_gpo_access_control = enforcing
+        ad_gpo_implicit_deny = True
+        dyndns_update = True
+        dyndns_update_ptr = False
+        dyndns_refresh_interval = 86400
+        dyndns_ttl = 3600
+      '';
+    };
+    security.pam.services.login.sssdStrictAccess = true;
+    security.pam.services.sshd.sssdStrictAccess = true;
+    security.pam.services.su.sssdStrictAccess = true;
+
+    # Set up Sudo
+    security.sudo =
+      let
+        admin_group = "host_${lib.replaceStrings [ "-" ] [ "_" ] config.networking.hostName}_admin";
+      in
+      {
+        extraConfig = ''
+          %${admin_group} ALL=(ALL) SETENV: ALL
+        '';
+      };
+
+    # Set up SSH
+    programs.ssh = {
+      package = pkgs.openssh_gssapi;
+      extraConfig = ''
+        GSSAPIAuthentication yes
+      '';
+    };
+    services.openssh = {
+      package = pkgs.openssh_gssapi;
+      settings = {
+        GSSAPIAuthentication = true;
+        GSSAPICleanupCredentials = true;
+        GSSAPIStrictAcceptorCheck = true;
+      };
+    };
+
+    # Set up home directory
+    security.pam.services.login.makeHomeDir = true;
+    security.pam.services.sshd.makeHomeDir = true;
+    security.pam.services.su.makeHomeDir = true;
+    environment.etc.profile.text =
+      let
+        # TODO: Activate configuration based on AD group
+        homeConfiguration = inputs.home-manager.lib.homeManagerConfiguration {
+          inherit pkgs;
+          modules = [
+            (
+              { lib, ... }:
+              {
+                home.stateVersion = "24.11";
+                home.username = "$USER";
+                home.homeDirectory = "/.$HOME";
+                modules.profiles.base.enable = true;
+
+                # Mount the directories from the network share
+                # home.activation.dirMount =
+                #   let
+                #     bindScript = dir: ''
+                #       mkdir -p /network/$USER/${dir}
+                #       mkdir -p $HOME/${dir}
+                #       ${pkgs.bindfs}/bin/bindfs /network/$USER/${dir} $HOME/${dir}
+                #     '';
+                #   in
+                #   lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+                #     if ! ${pkgs.krb5}/bin/klist -s; then
+                #       echo "No kerberos ticket found"
+                #       ${pkgs.krb5}/bin/kinit
+                #     fi
+
+                #     if ${pkgs.krb5}/bin/klist -s; then
+                #       echo "Kerberos ticket found, mounting home directory"
+                #       ${bindScript "Documents"}
+                #       ${bindScript "Music"}
+                #       ${bindScript "Pictures"}
+                #       ${bindScript "Video"}
+                #     else
+                #       echo "Still no kerberos ticket found, skipping home directory mount"
+                #     fi
+                #   '';
+              }
+            )
+          ] ++ config.home-manager.sharedModules;
+        };
+      in
+      mkAfter ''
+        # Activate Home Manager configuration for domain users
+        if id | egrep -o 'groups=.*' | sed 's/,/\n/g' | cut -d'(' -f2 | sed 's/)//' | egrep -o "^domain users$"; then
+          echo "Setting up environment for domain user"
+          SKIP_SANITY_CHECKS=1 ${homeConfiguration.activationPackage}/activate
+          if test -f "$HOME/.bashrc"; then
+            . $HOME/.bashrc
+          fi
+        fi
+      '';
+
+    # Automatically mount home share
+    # Can be accessed at /network/$USER
+    # services.autofs = {
+    #   enable = true;
+    #   autoMaster =
+    #     let
+    #       networkMap = pkgs.writeText "auto" ''
+    #         * -fstype=cifs,sec=krb5,user=&,uid=$UID,gid=$GID,cruid=$UID ://${inputs.secrets.lab.nas.host}/home
+    #       '';
+    #     in
+    #     ''
+    #       /network ${networkMap} --timeout=30
+    #     '';
+    # };
+  };
+}
@@ -20,6 +20,12 @@ in
    console.font = "dina";
    console.earlySetup = true;

+    fonts.packages = with pkgs; [
+      noto-fonts
+      fira
+      jetbrains-mono
+    ];
+
    # TODO: Disable default fonts, fonts should be managed per user
    # fonts.enableDefaultPackages = false;
    # fonts.fontconfig = {
@@ -17,10 +17,9 @@ in

  config = mkIf cfg.enable {
    # Enable GDM and Gnome
-    services.xserver.enable = true;
-    services.xserver.displayManager.gdm.enable = true;
-    services.xserver.desktopManager.gnome.enable = true;
-    services.gnome.core-utilities.enable = false;
+    services.displayManager.gdm.enable = true;
+    services.desktopManager.gnome.enable = true;
+    services.gnome.core-apps.enable = false;
    services.gnome.games.enable = false;
    services.gnome.core-developer-tools.enable = false;
    environment.gnome.excludePackages = with pkgs; [
@@ -29,31 +28,14 @@ in
      gnome-backgrounds
      gnome-bluetooth
      gnome-color-manager
-      gnome-control-center
      gnome-shell-extensions
      gnome-tour
      gnome-user-docs
      glib
      gnome-menus
      gtk3.out
-      xdg-user-dirs
-      xdg-user-dirs-gtk
    ];

-    # Enable Gnome Remote Desktop
-    services.gnome.gnome-remote-desktop.enable = true;
-    systemd.services."gnome-remote-desktop".wantedBy = [ "graphical.target" ];
-    networking.firewall = {
-      allowedTCPPorts = [
-        3389
-        3390
-      ];
-      allowedUDPPorts = [
-        3389
-        3390
-      ];
-    };
-
    # For GSConnect/KDE Connect
    # TODO: Move to host config?
    networking.firewall = {
@@ -72,8 +54,12 @@ in
    };

    # Enable dependencies
-    modules = {
-      networkmanager.enable = true;
-    };
+    modules.networkmanager.enable = true;
+
+    # Impermanence
+    modules.impermanence.directories = [
+      "/etc/NetworkManager/system-connections"
+      "/var/lib/bluetooth"
+    ];
  };
 }
@@ -24,23 +24,58 @@ in
    resetScript = mkOption {
      type = types.lines;
      description = ''
-        Script to run on boot that resets the root partition.
+        Script to run in order to reset the system to a clean state.
      '';
    };
  };

  config = mkIf cfg.enable {
+    # Filesystem setup
    fileSystems."/persist".neededForBoot = true;
-    boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+    # boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+    # TODO: Reduce dependency on the root filesystem being ZFS?
+    boot.initrd.systemd.services.impermanence-rollback = {
+      description = "Rollback filesystem to clean state.";
+      wantedBy = [ "initrd.target" ];
+      after = [ "zfs-import.target" ];
+      before = [ "sysroot.mount" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig.Type = "oneshot";
+      script = cfg.resetScript;
+    };

    # For home-manager persistence
    programs.fuse.userAllowOther = true;

-    environment.persistence."/persist/system" = {
+    # For testing purposes with VM
+    virtualisation.vmVariantWithDisko.virtualisation.fileSystems."/persist".neededForBoot = true;
+
+    environment.persistence = {
+      "/persist/system" = {
        enable = true;
        hideMounts = true;
        directories = cfg.directories;
        files = cfg.files;
      };
+      # "/persist/home" = {
+      #   enable = true;
+      #   hideMounts = true;
+      #   users = (
+      #     lib.mapAttrs' (
+      #       name: value:
+      #       let
+      #         user = name;
+      #         homeDir = "/home/${user}";
+      #         impConfig = value.modules.impermanence;
+      #       in
+      #       lib.nameValuePair user {
+      #         home = homeDir;
+      #         directories = impConfig.directories;
+      #         files = impConfig.files;
+      #       }
+      #     ) config.home-manager.users
+      #   );
+      # };
+    };
  };
 }
@@ -11,5 +11,7 @@ in
  config = mkIf cfg.enable {
    # TODO: Add sudo users to the networkmanager group?
    networking.networkmanager.enable = true;
+
+    networking.firewall.checkReversePath = false;
  };
 }
@@ -0,0 +1,44 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in /etc/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "/etc/sops/sops_ed25519_key"
+      "/persist/system/etc/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ "/etc/sops" ];
+    virtualisation.vmVariantWithDisko.sops.age.sshKeyPaths = [ "/tmp/shared/sops_ed25519_key" ];
+  };
+}
@@ -9,7 +9,24 @@ in
    enable = mkEnableOption "ssh";
  };
  config = mkIf cfg.enable {
-    services.openssh.enable = true;
-    # TODO: Is this default configuration secure?
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+      };
+      hostKeys = mkIf (config.modules.impermanence.enable) [
+        {
+          type = "ed25519";
+          path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
+        }
+        {
+          type = "rsa";
+          bits = 4096;
+          path = "/persist/system/etc/ssh/ssh_host_rsa_key";
+        }
+      ];
+    };
  };
 }
@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+with pkgs;
+rustPlatform.buildRustPackage {
+  pname = "carla_osc_bridge";
+  version = "master";
+
+  src = fetchFromGitea {
+    domain = "git.bulthuis.dev";
+    owner = "Jan";
+    repo = "carla_osc_bridge";
+    rev = "c037e2d2a1b29b785d8acc10fa0cb761afdb3fcf";
+    hash = "sha256-Wvdfm+4dfygZwkvaUhO9w7DrrUl3ZYvtD7nYrPSD0eA=";
+  };
+
+  cargoHash = "sha256-s1ZKbhHudgPOy7613zbT8TkbM6B7oloLEuTYHoWjX5o=";
+
+  useFetchCargoVendor = true;
+}
@@ -0,0 +1,37 @@
+{
+  jq,
+  lib,
+  moreutils,
+  tinymist,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "tinymist-vscode-html";
+    publisher = "myriad-dreamin";
+    inherit (tinymist) version;
+    hash = "";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ tinymist ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+    description = "VSCode extension for providing an integration solution for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+    homepage = "https://github.com/myriad-dreamin/tinymist";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
+}
@@ -0,0 +1,104 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  nodejs_20,
+  electron,
+  python3,
+  nix-update-script,
+}:
+
+buildNpmPackage rec {
+  pname = "open-stage-control";
+  version = "1.29.8";
+
+  src = fetchFromGitHub {
+    owner = "jean-emmanuel";
+    repo = "open-stage-control";
+    rev = "v${version}";
+    hash = "sha256-518KXvNffLOV2aIWlLJcnPzxEbWxYdjWeiDBC1jlecQ=";
+  };
+
+  # Remove some Electron stuff from package.json
+  postPatch = ''
+    sed -i -e '/"electron"\|"electron-installer-debian"/d' package.json
+  '';
+
+  npmDepsHash = "sha256-U4zwYL5URNW0y0W4WvWAVL0hubiiU+2z9F5mDE9l8UU=";
+
+  nodejs = nodejs_20;
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [
+    python3.pkgs.python-rtmidi
+  ];
+
+  doInstallCheck = true;
+
+  makeCacheWritable = true;
+  npmFlags = [
+    "--legacy-peer-deps"
+    "--skip-pkg"
+  ];
+
+  # Override installPhase so we can copy the only directory that matters (app)
+  installPhase = ''
+    runHook preInstall
+
+    # copy built app and node_modules directories
+    mkdir -p $out/lib/node_modules/open-stage-control
+    cp -r app $out/lib/node_modules/open-stage-control/
+
+    # copy icon
+    install -Dm644 resources/images/logo.png $out/share/icons/hicolor/256x256/apps/open-stage-control.png
+    install -Dm644 resources/images/logo.svg $out/share/icons/hicolor/scalable/apps/open-stage-control.svg
+
+    # wrap electron and include python-rtmidi
+    makeWrapper '${electron}/bin/electron' $out/bin/open-stage-control \
+      --inherit-argv0 \
+      --add-flags $out/lib/node_modules/open-stage-control/app \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : '${lib.makeBinPath [ python3 ]}'
+
+    runHook postInstall
+  '';
+
+  installCheckPhase = ''
+    XDG_CONFIG_HOME="$(mktemp -d)" $out/bin/open-stage-control --help
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "open-stage-control";
+      exec = "open-stage-control";
+      icon = "open-stage-control";
+      desktopName = "Open Stage Control";
+      comment = meta.description;
+      categories = [
+        "Network"
+        "Audio"
+        "AudioVideo"
+        "Midi"
+      ];
+      startupWMClass = "open-stage-control";
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Libre and modular OSC / MIDI controller";
+    homepage = "https://openstagecontrol.ammd.net/";
+    license = licenses.gpl3Only;
+    maintainers = [ ];
+    platforms = platforms.linux;
+    mainProgram = "open-stage-control";
+  };
+}
@@ -0,0 +1,82 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        imageSize = "32G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-4G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+      longhorn = {
+        type = "disk";
+        device = "/dev/sdb";
+        imageSize = "64G"; # For longhorn storage
+        content = {
+          type = "gpt";
+          partitions = {
+            main = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}
@@ -3,6 +3,8 @@
    disk = {
      main = {
        type = "disk";
+        device = "/dev/sda";
+        imageSize = "32G"; # For test VMs
        content = {
          type = "gpt";
          partitions = {
@@ -17,12 +19,19 @@
              };
            };
            zfs = {
-              size = "100%";
+              end = "-4G";
              content = {
                type = "zfs";
                pool = "tank";
              };
            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
          };
        };
      };
@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda"; # How do I handle this for laptops
+        imageSize = "64G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-16G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda";
+        imageSize = "64G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-16G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}
@@ -16,6 +16,7 @@ in

  config = mkIf cfg.enable {
    modules = {
+      impermanence.enable = true;
      # btop.enable = true;
      direnv.enable = true;
      fish.enable = true;
@@ -16,9 +16,62 @@ in

  config = mkIf cfg.enable {
    home.packages = with pkgs; [
-      firefox # TODO: Move to dediated module
+      # firefox # TODO: Move to dediated module
    ];

+    dconf.settings = {
+      "org/gnome/calendar" = {
+        active-view = "week";
+      };
+      "org/gnome/desktop/background" = {
+        picture-uri = "file://${config.home.homeDirectory}/.local/share/backgrounds/background";
+      };
+      "org/gnome/desktop/input-sources" = {
+        sources = [
+          (lib.gvariant.mkTuple [
+            "xkb"
+            "us"
+          ])
+        ];
+        xkb-options = [ "caps:escape_shifted_capslock" ];
+      };
+      "org/gnome/desktop/interface" = {
+        accent-color = "purple";
+        enable-hot-corners = false;
+      };
+      "org/gnome/desktop/peripherals/touchpad" = {
+        speed = 0.214;
+        two-finger-scrolling-enabled = true;
+      };
+      "org/gnome/mutter" = {
+        workspaces-only-on-primary = true;
+      };
+      "org/gnome/nautilus/icon-view" = {
+        default-zoom-level = "small";
+      };
+      "org/gnome/nautilus/preferences" = {
+        default-folder-viewer = "icon-view";
+      };
+      "org/gnome/settings-daemon/plugins/color" = {
+        night-light-enabled = true;
+        night-light-schedule-automatic = false;
+        night-light-schedule-from = 20.0;
+        night-light-schedule-to = 6.0;
+        night-light-temperature = 2700;
+      };
+      "org/gnome/shell" = {
+        disable-extension-version-validation = true;
+        enabled-extensions = [
+          "disable-workspace-animation@ethnarque"
+          "gsconnect@andyholmes.github.io"
+          "rounded-window-corners@fxgn"
+          "media-progress@krypion17"
+          "mprisLabel@moon-0xff.github.com"
+        ];
+        last-selected-power-profile = "power-saver";
+      };
+    };
+
    modules = {
      profiles.base.enable = true;

@@ -1,7 +1,9 @@
 {
  pkgs,
+  pkgs-stable,
  lib,
  config,
+  inputs,
  ...
 }:

@@ -16,34 +18,162 @@ in

  config = mkIf cfg.enable {
    home.packages = with pkgs; [
-      libreoffice-still
+      firefox
+      # inputs.stable-nixpkgs.legacyPackages.${config.nixpkgs.hostPlatform}.libreoffice
+      libreoffice
      remmina
      thunderbird
      signal-desktop
      prusa-slicer
-      freecad-wayland
+      pkgs-stable.freecad-wayland
      inkscape
-      ente-auth
-      bitwarden
+      # ente-auth
+      audacity
      carla
-      winbox
-      whatsapp-for-linux
+      # pkgs-stable.winbox
+      winbox4
+      # whatsapp-for-linux
+      wasistlos
      discord
      steam
      spotify
-      # feishin # TODO: Fix or replace as insecure
+      # feishin
      eduvpn-client
-      river # TODO: Move
      ryubing
      bottles
      prismlauncher
      foliate
      wireshark
+      obsidian
+      # devenv
+      # kicad
+      vlc
+      authenticator
+      hotspot
+
+      podman
+      podman-compose
+
+      gnome-network-displays
+      gnome-logs
+    ];
+
+    programs.helix = {
+      enable = true;
+      defaultEditor = true;
+      # settings = {
+      #   theme = {
+      #     light = "adwaita-light";
+      #     dark = "adwaita-dark";
+      #     fallback = "default";
+      #   };
+      # };
+      extraPackages = with pkgs; [
+        bash-language-server # Bash
+        fish-lsp # Fish
+        systemd-lsp # Systemd
+        yaml-language-server # Yaml
+        taplo # Toml
+        nixd # Nix
+        protols # Protobuf
+        dockerfile-language-server # Dockerfile
+        docker-compose-language-service # Docker compose
+
+        clang-tools # C, C++
+        neocmakelsp # Cmake
+        rust-analyzer # Rust
+        lldb # C, C++, Rust
+        zls # Zig
+
+        texlab # Latex
+        tinymist # Typst
+        marksman # Markdown
+        markdown-oxide # Markdown
+        vscode-langservers-extracted # HTML, CSS, JSON, ESLint
+        typescript-language-server # Typescript, Javascript
+        intelephense # PHP
+        vue-language-server # Vue
+
+        ruff # Python
+        basedpyright # Python
+
+        helix-gpt # Copilot
+
+        # texlab # Latex, Bibtex
+        # bibtex-tidy # Bibtex
+        # docker-langserver # Dockerfile
+        # docker-compose-langserver # Docker compose
+        # elixir-ls # Elixir
+        # gopls # Go
+        # golangci-lint-langserver # Go
+        # dlv # Go
+        # haskell-language-server # Haskell
+        # julia # Julia
+        # kotlin-language-server # Kotlin
+        # lua-language-server # Lua
+        # slint-lsp # Slint
+        # tinymist # Typst
+      ];
+      languages = {
+        language-server = {
+          basedpyright = {
+            command = "basedpyright-langserver";
+            args = [ "--stdio" ];
+          };
+          tinymist = {
+            command = "tinymist";
+            config.preview.background = {
+              enabled = true;
+              args = [
+                "--data-plane-host=127.0.0.1:23635"
+                "--invert-colors=never"
+                "--open"
+              ];
+            };
+          };
+        };
+        language = [
+          {
+            name = "python";
+            language-servers = [
+              {
+                name = "basedpyright";
+                except-features = [ "diagnostics" ];
+              }
+              "ruff"
+            ];
+            auto-format = true;
+            formatter = {
+              command = "ruff";
+              args = [
+                "format"
+                "-"
+              ];
+            };
+          }
+        ];
+      };
+    };
+
+    systemd.user.tmpfiles.rules = [
+      "d ${config.home.homeDirectory}/Downloads - - - - -"
    ];

    modules = {
      profiles.gnome.enable = true;

+      impermanence = {
+        directories = [
+          "Code"
+          "Documents"
+          "Games"
+          "Models"
+          "Music"
+          "Pictures"
+          "Videos"
+        ];
+      };
+
      # Gaming
      # retroarch.enable = true;
      # ryujinx.enable = true;
@@ -61,17 +191,18 @@ in
          "flake.lock"
        ];
      };
+      bitwarden.enable = true;
      xpra = {
        enable = true;
        hosts = [
-          "mixer@10.20.60.251"
+          "mixer@10.20.40.100"
        ];
      };

      # Development
      # docker.enable = true;
      # matlab.enable = true;
-      mathematica.enable = true;
+      # mathematica.enable = true;

      # Languages
      haskell.enable = false;
@@ -80,8 +211,9 @@ in
      rust.enable = true;
      python.enable = true;
      cpp.enable = true;
-      tex.enable = true;
-      jupyter.enable = false;
+      tex.enable = false;
+      jupyter.enable = true;
+      go.enable = true;
    };
  };
 }
@@ -1,5 +1,4 @@
 {
-  mkModule,
  pkgs,
  lib,
  config,
@@ -20,13 +19,27 @@ in
      bootloader.enable = mkDefault true;
      ssh.enable = mkDefault true;

-      # Setup sensible default persistent data
-      impermanence.directories = [
+      impermanence = {
+        files = [
+          "/etc/machine-id"
+          "/etc/zfs/zpool.cache" # TODO: Move to zfs module?
+        ];
+        directories = [
+          "/var/log/journal"
          "/var/lib/nixos"
+          "/var/lib/systemd"
        ];
-      impermanence.files = [
-        "/etc/shadow"
-      ];
+      };
+
+      # TODO: Remove the secrets module and use sops directly?
+      secrets = {
+        enable = true;
+        secrets = {
+          "ssh-keys/deploy-priv" = {
+            path = "/root/.ssh/id_ed25519";
+          };
+        };
+      };
    };

    # Localization
@@ -40,9 +53,6 @@ in
      defaultEditor = true;
    };

-    # Allow unfree packages
-    nixpkgs.config.allowUnfree = true;
-
    # Enable the usage of flakes
    nix.settings.experimental-features = [
      "nix-command"
@@ -65,6 +75,8 @@ in
      zip
      unzip
      tmux
+      unixtools.net-tools
+      tcpdump
    ];
  };
 }
@@ -1,5 +1,4 @@
 {
-  mkModule,
  pkgs,
  lib,
  config,
@@ -21,7 +20,7 @@ in
      profiles.base.enable = true;
      disko = {
        enable = true;
-        profile = "vm";
+        profile = mkDefault "vm";
      };
      impermanence = {
        enable = true;
@@ -30,17 +29,50 @@ in
          zfs rollback -r tank/root@blank
        '';
      };
+      domain = {
+        enable = true;
+        join = {
+          userFile = config.sops.secrets."vm-join/user".path;
+          passwordFile = config.sops.secrets."vm-join/password".path;
+          domainOUFile = config.sops.secrets."vm-join/ou".path;
+        };
+      };
      ssh.enable = true;
    };

-    # Admin users
+    # Initialize domain join secrets
+    sops.secrets."vm-join/user" = { };
+    sops.secrets."vm-join/password" = { };
+    sops.secrets."vm-join/ou" = { };
+
+    # Autologin to root for access from hypervisor
+    services.getty.autologinUser = "root";
+
+    # Local user
+    sops.secrets."passwords/local-hashed".neededForUsers = true;
+    users.mutableUsers = false;
    users.users.local = {
-      initialPassword = "local";
+      isNormalUser = true;
+      group = "local";
+      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
      extraGroups = [ "wheel" ];
      openssh.authorizedKeys.keys = [
-        "ssh-ed25519  jan@bulthuis.dev"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
      ];
    };
+    users.groups.local = { };
+    home-manager.users.local =
+      { ... }:
+      {
+        home.stateVersion = "24.11";
+        modules.profiles.base.enable = true;
+      };
+
+    # System packages
+    environment.systemPackages = with pkgs; [
+      # TODO: Make module for utilities/scripts
+      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
+    ];

    # Enable qemu guest agent
    services.qemuGuest.enable = true;
@@ -48,7 +80,7 @@ in
    # Machine platform
    nixpkgs.hostPlatform = "x86_64-linux";

-    # Set hostid for ZFS
+    # Set hostid (required for ZFS)
    networking.hostId = "deadbeef";

    # Hardware configuration
@@ -56,22 +88,22 @@ in
    boot.initrd.availableKernelModules = [
      "ata_piix"
      "uhci_hcd"
+      "virtio_net"
      "virtio_pci"
+      "virtio_mmio"
+      "virtio_blk"
      "virtio_scsi"
+      "9p"
+      "9pnet_virtio"
      "sd_mod"
      "sr_mod"
    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ "kvm-intel" ];
-    boot.extraModulePackages = [ ];
-    hardware.cpu.intel.updateMicrocode = true;
-
-    # Swapfile
-    swapDevices = [
-      {
-        device = "/var/lib/swapfile";
-        size = 6 * 1024;
-      }
+    boot.kernelModules = [
+      "kvm-intel"
+      "virtio_balloon"
+      "virtio_console"
+      "virtio_rng"
+      "virtio_gpu"
    ];
  };
 }
Author	SHA1	Message	Date
Jan-Bulthuis	c991768cc2	chore: Update	2026-02-07 17:12:07 +01:00
Jan-Bulthuis	268879ee01	fix: Add Downloads folder fix preference for workspaces	2026-02-07 17:02:56 +01:00
Jan-Bulthuis	7e9f617965	chore: Update impermanence	2026-02-07 17:02:17 +01:00
Jan-Bulthuis	7d6482587a	feat: Move to Cilium	2026-01-28 15:28:47 +01:00
Jan-Bulthuis	cf10e1e963	feat: Declarative K3S node	2025-12-31 02:00:35 +01:00
Jan-Bulthuis	02b2b9cf32	fix: Git settings setup	2025-12-23 12:17:38 +01:00
Jan-Bulthuis	dfe6ec5518	feat: Add typst extension	2025-12-23 12:16:46 +01:00
Jan-Bulthuis	517d793c88	fix: Add additional impermanence directories	2025-12-23 12:16:09 +01:00
Jan-Bulthuis	657a65522f	feat: Declarative GNOME setup	2025-12-23 12:15:48 +01:00
Jan-Bulthuis	7bc3ab64dd	feat: Install some basic fonts	2025-12-23 12:15:17 +01:00
Jan-Bulthuis	2b5cfe0934	feat: Add some GNOME packages	2025-12-23 12:15:05 +01:00
Jan-Bulthuis	cf345521e8	feat: Impermanence move to bind mounts for user impermanence	2025-12-23 12:14:46 +01:00
Jan-Bulthuis	f43945d0d2	bug: Add very wide initial impermanence setup	2025-12-23 12:13:59 +01:00
Jan-Bulthuis	7874412a48	fix: NetworkManager impermanence	2025-12-23 12:13:28 +01:00
Jan-Bulthuis	e33a6e181e	chore: Remove Helix package	2025-12-23 12:12:35 +01:00
Jan-Bulthuis	928dc4a240	feat: Add Tinymist VSCode extension	2025-12-23 12:12:22 +01:00
Jan-Bulthuis	63d34640f7	feat: Impermanence and GRD	2025-12-23 12:10:40 +01:00
Jan-Bulthuis	921565fe12	fix: Add fish history to impermanence	2025-12-23 12:08:17 +01:00
Jan-Bulthuis	88792d86db	chore: Remove old configuration	2025-12-23 12:00:01 +01:00
Jan-Bulthuis	49b4ade156	chore: Update	2025-12-23 11:59:10 +01:00
Jan-Bulthuis	34f179465d	feat: Finished user setup	2025-11-30 16:19:03 +01:00
Jan-Bulthuis	588bea133c	feat: Set up disk layout for ws-think	2025-11-30 12:42:41 +01:00
Jan-Bulthuis	61ec61e22e	fix: Disable GNOME extension version validation	2025-11-30 12:29:31 +01:00
Jan-Bulthuis	10a3de42ac	chore: Install software	2025-11-30 12:29:12 +01:00
Jan-Bulthuis	6f98d674b1	fix: Improve unfree consistency	2025-11-30 12:28:52 +01:00
Jan-Bulthuis	4278ceebc1	feat: Add new laptop configuration	2025-11-30 12:28:39 +01:00
Jan-Bulthuis	3358dd324e	fix: Allow unfree consistently	2025-11-30 12:27:59 +01:00
Jan-Bulthuis	c3014ec109	chore: Update	2025-11-30 12:27:42 +01:00
Jan-Bulthuis	08ca6a2846	fix: Fix mathematica	2025-11-14 14:32:52 +01:00
Jan-Bulthuis	2fbe36d497	featL Add helix and osc package	2025-11-14 14:32:38 +01:00
Jan-Bulthuis	9929cd297a	feat: Helix configuration	2025-11-14 14:32:20 +01:00
Jan-Bulthuis	869a219ab7	feat: Add initial carla project	2025-11-14 14:31:09 +01:00
Jan-Bulthuis	af1a275dd8	feat: Add NAT64 VM	2025-11-14 14:23:18 +01:00
Jan-Bulthuis	9d302345ac	fix: Remove gtk3 theme	2025-11-14 14:22:50 +01:00
Jan-Bulthuis	e0b3fe191c	break: Add temporary laptop configuration	2025-11-14 14:22:33 +01:00
Jan-Bulthuis	d3681fcd4f	feat: Switch from tayga to jool	2025-11-07 22:04:13 +01:00
Jan-Bulthuis	5458f74c83	fix: Set correct subnet for tayga	2025-11-07 21:30:13 +01:00
Jan-Bulthuis	13302deaef	chore: Update flake	2025-11-07 21:16:24 +01:00
Jan-Bulthuis	828face9d5	fix: Set tayga IPv6 address	2025-11-07 21:11:35 +01:00
Jan-Bulthuis	e4402eaf19	fix: Update tayga address	2025-11-07 20:47:22 +01:00
Jan-Bulthuis	081084648f	Add VM for NAT64	2025-11-03 13:45:59 +01:00
Jan-Bulthuis	9d629c4656	Change home-manager to use global packages	2025-11-03 13:45:34 +01:00
Jan-Bulthuis	4a65f64a20	Update nixpkgs	2025-11-03 13:45:14 +01:00
Jan-Bulthuis	d3b3e9be1c	Updated flake	2025-09-26 08:28:14 +02:00
Jan-Bulthuis	5224a6e4b6	Add carla_osc_bridge package	2025-09-26 08:17:59 +02:00
Jan-Bulthuis	dd0778e5f0	Make omada controller logs non-persistent	2025-09-26 08:17:39 +02:00
Jan-Bulthuis	7247fc94ab	Update audio vm	2025-09-26 08:17:21 +02:00
Jan-Bulthuis	655803bd1f	Add MADD as flake input	2025-09-26 08:16:40 +02:00
Jan-Bulthuis	9992039edb	Set up ssh client with GSSAPI auth	2025-07-30 16:06:17 +02:00
Jan-Bulthuis	f31c0f92da	Installed vlc and go	2025-07-30 16:05:56 +02:00
Jan-Bulthuis	307aac4ae0	Added initial workstation disko config	2025-07-30 16:05:46 +02:00
Jan-Bulthuis	160185ef20	Remove gnome control center from system-wide install	2025-07-30 16:05:27 +02:00
Jan-Bulthuis	42619807bc	Enable gnome terminal	2025-07-30 16:04:53 +02:00
Jan-Bulthuis	86c853de20	Added module for go support	2025-07-30 16:03:56 +02:00
Jan-Bulthuis	f52e880b4c	Opened up firewall	2025-07-23 12:25:40 +02:00
Jan-Bulthuis	e157071962	Add omada user and group	2025-07-23 12:15:41 +02:00
Jan-Bulthuis	d324c957be	Make logs persist	2025-07-23 12:09:30 +02:00
Jan-Bulthuis	1fa6092498	Fixed ulimit argument	2025-07-23 12:06:41 +02:00
Jan-Bulthuis	e43a91fe31	Run as root	2025-07-23 12:01:41 +02:00
Jan-Bulthuis	f06880d6d7	Added Omada software controller to vm-oddjob	2025-07-23 10:52:23 +02:00
Jan-Bulthuis	fa17ce5b03	Switched mc server to fabric	2025-07-13 16:04:16 +02:00
Jan-Bulthuis	cf42666c1f	Reverted delay	2025-07-05 13:29:25 +02:00
Jan-Bulthuis	df49791fb7	Added delay to adcli-join	2025-07-05 13:24:44 +02:00
Jan-Bulthuis	cf4a324617	Set up ssh client, temporarily removed network home mount	2025-07-05 13:05:04 +02:00
Jan-Bulthuis	66b2662030	Updated vm-minecraft	2025-07-04 19:55:22 +02:00
Jan-Bulthuis	21045c3dd1	Installed kicad	2025-07-04 19:36:25 +02:00
Jan-Bulthuis	5f68b9b1e6	Updated vm-minecraft	2025-07-04 19:34:30 +02:00
Jan-Bulthuis	bb6edfdefd	Updated systemd credentials for backup job	2025-06-21 18:03:38 +02:00
Jan-Bulthuis	afebac0d46	Updated backup script to unmount shares	2025-06-21 17:48:16 +02:00
Jan-Bulthuis	06eaf13ec0	Limit amount of open file handles for backup job	2025-06-20 00:27:04 +02:00
Jan-Bulthuis	0b5beaf63d	Updated VM-Oddjob to generically update multiple shares	2025-06-19 21:36:26 +02:00
Jan-Bulthuis	03604f9352	Updated GNOME config	2025-06-19 21:36:06 +02:00
Jan-Bulthuis	5047f1ab24	Updated secrets	2025-06-19 21:35:51 +02:00
Jan-Bulthuis	22271d33d1	Make homedir for su users	2025-06-11 17:33:55 +02:00
Jan-Bulthuis	c8bf78999a	Added test VM	2025-06-11 17:21:19 +02:00
Jan-Bulthuis	0d25c1deff	Fixed wireguard VPNs	2025-06-11 17:13:53 +02:00
Jan-Bulthuis	3603fe28a7	Removed authorizedKeys integration from sssd	2025-06-11 14:27:16 +02:00
Jan-Bulthuis	ce7c940f65	Switched to openssh package with kerberos support	2025-06-11 14:21:57 +02:00
Jan-Bulthuis	d8327c3edf	Updated SSH to use GSSAPI	2025-06-11 14:13:25 +02:00
Jan-Bulthuis	af9f7e0ee0	Updated sssd dyndns config	2025-06-11 13:01:02 +02:00
Jan-Bulthuis	3285b483e2	Created standard local user hm config for VMs	2025-06-11 12:42:06 +02:00
Jan-Bulthuis	affa333969	Moved to systemd for initrd, added integration for vmWithDisko	2025-06-11 11:58:54 +02:00
Jan-Bulthuis	3c20190709	Create additional directories	2025-06-10 03:27:46 +02:00
Jan-Bulthuis	0305b8d33a	Moved to bind mounts	2025-06-10 03:23:30 +02:00
Jan-Bulthuis	5ade637e57	Included package path	2025-06-10 03:07:57 +02:00
Jan-Bulthuis	029ff0c9a3	Added link creation to activation script	2025-06-10 03:04:44 +02:00
Jan-Bulthuis	db4bd8cfd9	Used persistence for mounting network folders	2025-06-10 02:37:26 +02:00
Jan-Bulthuis	41d25d9695	Updated autofs	2025-06-10 02:12:19 +02:00
Jan-Bulthuis	7e2e012f3a	Changed autofs map	2025-06-10 01:56:23 +02:00
Jan-Bulthuis	071e904990	Updated autofs setup	2025-06-10 01:27:47 +02:00
Jan-Bulthuis	b68ca558d8	Set up autofs	2025-06-10 01:15:50 +02:00
Jan-Bulthuis	cf760b8b85	Simplified sude config	2025-06-10 00:07:58 +02:00
Jan-Bulthuis	7d4ee43283	Filter out locally defined users and groups	2025-06-10 00:07:22 +02:00
Jan-Bulthuis	4e08366901	Changed backup ID	2025-06-09 16:39:13 +02:00
Jan-Bulthuis	a0ca155f7c	Set backup id	2025-06-09 16:34:42 +02:00
Jan-Bulthuis	110aa4215f	Added dependency on network for krb5 auth	2025-06-09 16:28:37 +02:00
Jan-Bulthuis	08a161ff0d	Set up mount dependencies	2025-06-09 16:18:02 +02:00
Jan-Bulthuis	f4472de631	Updated backup script	2025-06-09 16:13:25 +02:00
Jan-Bulthuis	3c154de819	Changed correct script	2025-06-09 16:00:05 +02:00
Jan-Bulthuis	709040c072	exported configuration	2025-06-09 15:55:53 +02:00
Jan-Bulthuis	28193823c8	Added backup cron job	2025-06-09 15:45:14 +02:00
Jan-Bulthuis	dd25c9323d	Reenabled kinit	2025-06-09 15:15:17 +02:00
Jan-Bulthuis	5796bee499	Removed unneeded dependencies	2025-06-09 15:11:13 +02:00
Jan-Bulthuis	986afe4b32	Added packages	2025-06-09 15:07:54 +02:00
Jan-Bulthuis	537e30a347	Move request-key configuration	2025-06-09 15:00:44 +02:00
Jan-Bulthuis	2fec5ead38	Use kinit from krb5 package	2025-06-09 14:28:54 +02:00
Jan-Bulthuis	d4e6283c2f	Added service to set up user keytab	2025-06-09 14:23:11 +02:00
Jan-Bulthuis	32e7d99292	Set up request-key.conf	2025-06-09 13:54:31 +02:00
Jan-Bulthuis	d9dab5b9d3	Resource bashrc	2025-06-09 13:24:58 +02:00
Jan-Bulthuis	cdd94eefb3	Enabled base profile for domain users	2025-06-09 13:06:29 +02:00
Jan-Bulthuis	209dbea02a	Disable sanity checks	2025-06-09 13:01:56 +02:00
Jan-Bulthuis	c683809a78	Added initial homeConfiguration for domain users	2025-06-09 12:50:30 +02:00
Jan-Bulthuis	739e335c28	Added test loginShellInit	2025-06-09 04:29:25 +02:00
Jan-Bulthuis	3c6758b343	Quick fix	2025-06-09 04:07:18 +02:00
Jan-Bulthuis	799b91a509	Update PAM	2025-06-09 04:05:52 +02:00
Jan-Bulthuis	50ff958d35	Setup strict ssh auth	2025-06-09 03:42:25 +02:00
Jan-Bulthuis	ecc2779ce9	Made SSSD strict for login in PAM	2025-06-09 03:28:39 +02:00
Jan-Bulthuis	10dab81fb5	Disable PTR update	2025-06-09 03:09:14 +02:00
Jan-Bulthuis	03e96662cc	Set ad_gpo_implicit_deny to true	2025-06-09 02:57:06 +02:00
Jan-Bulthuis	d6d54e213e	Implement SSH domain integration	2025-06-09 02:36:07 +02:00
Jan-Bulthuis	f491be0ace	Added sudo domain integration	2025-06-09 02:17:05 +02:00
Jan-Bulthuis	fef1eff181	Simplified kerberos config	2025-06-09 01:54:39 +02:00
Jan-Bulthuis	e869e5d790	Setup kerberos config	2025-06-09 01:47:48 +02:00
Jan-Bulthuis	48caacd9e5	Enforce GPO access control	2025-06-09 01:34:29 +02:00
Jan-Bulthuis	ce4401033a	Enabled dyndns	2025-06-08 03:45:33 +02:00
Jan-Bulthuis	8b331ad3ae	Added SSSD config	2025-06-08 03:39:12 +02:00
Jan-Bulthuis	417383f89b	Updated adcli script	2025-06-08 03:22:10 +02:00
Jan-Bulthuis	cc75c95ad4	Moved domain config	2025-06-08 03:04:14 +02:00
Jan-Bulthuis	a321251b93	Update secrets	2025-06-08 03:04:00 +02:00
Jan-Bulthuis	54677248af	Installed some packages	2025-06-08 00:56:26 +02:00
Jan-Bulthuis	d8f18016cd	Added krb5 setup	2025-06-08 00:10:13 +02:00
Jan-Bulthuis	6522ebc15e	Added krb5 as sec for smb mount	2025-06-07 23:47:20 +02:00
Jan-Bulthuis	10216784e8	Set correct hostname	2025-06-07 23:38:38 +02:00
Jan-Bulthuis	f3abb6d2f3	Added samba mount	2025-06-07 23:36:21 +02:00
Jan-Bulthuis	936d654877	Added oddjob VM	2025-06-07 21:15:31 +02:00
Jan-Bulthuis	61d207db04	Installed obsidian	2025-06-07 21:15:14 +02:00
Jan-Bulthuis	e7b66cb40c	Added kerberos config	2025-06-07 21:14:59 +02:00
Jan-Bulthuis	c9b18219af	Updated secrets	2025-06-07 21:14:43 +02:00
Jan-Bulthuis	d5c4a78fba	Updated README.md	2025-06-07 21:14:28 +02:00
Jan-Bulthuis	369d655a38	Autologin to root for access from hypervisor	2025-05-30 16:44:23 +02:00
Jan-Bulthuis	eab130b99d	Removed swapfile	2025-05-30 16:38:25 +02:00
Jan-Bulthuis	5ce6b9bdf2	Added swap partition	2025-05-30 16:37:48 +02:00
Jan-Bulthuis	5db52a4f84	Removed need for password for local wheel group on VMs	2025-05-30 16:22:09 +02:00
Jan-Bulthuis	3524f6b038	Replaced key	2025-05-30 16:19:12 +02:00
Jan-Bulthuis	0cf53a97cf	Restricted SSH access	2025-05-30 16:15:52 +02:00
Jan-Bulthuis	46fe5b8056	Set local password	2025-05-30 16:15:42 +02:00
Jan-Bulthuis	ec3d9e6049	Updated modules	2025-05-30 16:08:51 +02:00
Jan-Bulthuis	fc0476ca5a	Added admin-pub secret	2025-05-30 16:08:39 +02:00
Jan-Bulthuis	4b7c62d00b	Gave local passwordless sudo, rerolled and encrypted the authorized key.	2025-05-30 16:05:00 +02:00
Jan-Bulthuis	cfc276184f	Updated README.md	2025-05-30 15:37:19 +02:00
Jan-Bulthuis	87b50bfb4d	Updated secrets	2025-05-30 15:26:05 +02:00
Jan-Bulthuis	1bc34518e1	Added deployment key to root account	2025-05-30 15:11:22 +02:00
Jan-Bulthuis	f1dcb8c72b	Updated sops-nix to also directly point at /persist	2025-05-30 14:35:59 +02:00
Jan-Bulthuis	ec002467fa	Updated secrets	2025-05-30 14:03:14 +02:00
Jan-Bulthuis	5a228cb375	Updated update script	2025-05-30 14:03:05 +02:00
Jan-Bulthuis	d53e395d42	Added a module for SOPS	2025-05-30 13:56:50 +02:00
Jan-Bulthuis	cb39f82a48	Updated flake.lock	2025-05-30 12:42:35 +02:00
Jan-Bulthuis	0efee5bceb	Added dependency on nixos-secrets	2025-05-30 12:06:21 +02:00
Jan-Bulthuis	844118055c	Updated README.md	2025-05-29 21:00:40 +02:00
Jan-Bulthuis	0ba9de0030	Set disk device for vm disko	2025-05-29 20:46:44 +02:00
Jan-Bulthuis	a745b35c84	Added update script	2025-05-29 20:37:12 +02:00
Jan-Bulthuis	6c74dcbc22	Automatically login to user	2025-05-29 20:32:19 +02:00
Jan-Bulthuis	76e609372f	Added persistence to ssh host keys	2025-05-29 20:28:07 +02:00
Jan-Bulthuis	cd91944b1e	Updated local user configuration	2025-05-29 20:20:18 +02:00
Jan-Bulthuis	bebd2748d1	Moved bitwarden to a module	2025-05-29 19:23:52 +02:00
Jan	12a4ba0482	Merge pull request 'Add disko support' (#2 ) from disko into main Reviewed-on: Jan/dotfiles#2	2025-05-29 16:33:31 +00:00