router: add host configurations for test routers

flake.lock

@@ -1,58 +1,5 @@
 {
   "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1781825982,
-        "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "pre-commit",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -60,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1791642191,
+        "lastModified": 1749178927,
-        "narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
+        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
+        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
         "type": "github"
       },
       "original": {
@@ -73,30 +20,6 @@
         "type": "github"
       }
     },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit": "pre-commit",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1782141370,
-        "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v1.1.0",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
     "nixlib": {
       "locked": {
         "lastModified": 1736643958,
@@ -120,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769813415,
+        "lastModified": 1747663185,
-        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
         "type": "github"
       },
       "original": {
@@ -135,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791594108,
+        "lastModified": 1748929857,
-        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
         "type": "github"
       },
       "original": {
@@ -159,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785762349,
+        "lastModified": 1748196248,
-        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
+        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
+        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
         "type": "github"
       },
       "original": {
@@ -172,60 +95,15 @@
         "type": "github"
       }
     },
-    "pre-commit": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781733627,
-        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
-        "lanzaboote": "lanzaboote",
         "nixos-generators": "nixos-generators",
         "nixpkgs": "nixpkgs",
         "plasma-manager": "plasma-manager",
         "secrix": "secrix"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1782012058,
-        "narHash": "sha256-9mWUnReOUXfKjZuJAL/bAFH3LUyECTRtXgSNVjRw3UY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "8534567325bd8a8d2928e6afd81e0a87d19efd3c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
     "secrix": {
       "inputs": {
         "nixpkgs": [
@@ -233,11 +111,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787124737,
+        "lastModified": 1746643487,
-        "narHash": "sha256-EnQcFCdcQs1agb8U/h3kn7+A3c3uorANCPP2WakZjAk=",
+        "narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
         "owner": "Platonic-Systems",
         "repo": "secrix",
-        "rev": "9c0a7db4e355c28fe67643656821b06161b4df61",
+        "rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -22,20 +22,16 @@
       url = "github:Platonic-Systems/secrix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v1.1.0";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
-  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote }:
+  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix }:
   let
     hmModule = file: {
       imports = [ home-manager.nixosModules.home-manager ];
 
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
-      home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
+      home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];
 
       home-manager.users.cazzzer = import file;
       # Optionally, use home-manager.extraSpecialArgs to pass
@@ -74,7 +70,6 @@
       Yura-TPX13 = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
-          lanzaboote.nixosModules.lanzaboote
           ./modules
           ./hosts/common.nix
           ./hosts/common-desktop.nix

home/modules/fish.nix

@@ -5,11 +5,11 @@
     enable = true;
     shellInit = "set fish_greeting";
     shellAliases = {
-      # Replace ls with eza
+      # Replace ls with exa
-      ls = "eza -al --color=always --group-directories-first --icons=always"; # preferred listing
+      ls = "exa -al --color=always --group-directories-first --icons"; # preferred listing
-      la = "eza -a --color=always --group-directories-first --icons=always";  # all files and dirs
+      la = "exa -a --color=always --group-directories-first --icons";  # all files and dirs
-      ll = "eza -l --color=always --group-directories-first --icons=always";  # long format
+      ll = "exa -l --color=always --group-directories-first --icons";  # long format
-      lt = "eza -aT --color=always --group-directories-first --icons=always"; # tree listing
+      lt = "exa -aT --color=always --group-directories-first --icons"; # tree listing
       "l." = "exa -a | rg '^\.'";                                      # show only dotfiles
 
       # Replace cat with bat

home/modules/git.nix

@@ -8,23 +8,21 @@ in
   programs.git = {
     enable = true;
 
+    userName = name;
+    userEmail = email;
+
     signing = {
       key = signingKey;
       signByDefault = true;
       format = "ssh";
     };
 
-    settings = {
+    aliases = {
-      user = {
+      co = "checkout";
-        name = name;
+      s = "switch";
-        email = email;
+    };
-      };
-      
-      alias = {
-        co = "checkout";
-        s = "switch";
-      };
 
+    extraConfig = {
       url = {
         "https://gitea.cazzzer.com/" = {
           insteadOf = "caztea:";

home/modules/plasma.nix

@@ -55,8 +55,6 @@
         activities-icons."809dc779-bf5b-49e6-8e3f-cbe283cb05b6" = "keyboard";
         activities-icons."b34a506d-ac4f-4797-8c08-6ef45bc49341" = "preferences-desktop-gaming";
       };
-      baloofilerc.General."exclude folders".persistent = true;
-      systemsettingsrc.systemsettings_sidebar_mode.HighlightNonDefaultSettings=true;
     };
   };
 

hosts/Yura-PC/default.nix

@@ -31,10 +31,6 @@
     intel-media-driver # LIBVA_DRIVER_NAME=iHD
   ];
 
-  environment.systemPackages = with pkgs; [
-    lmstudio
-  ];
-
   networking.hostName = "Yura-PC"; # Define your hostname.
   networking.hostId = "110a2814"; # Required for ZFS.
 

hosts/Yura-PC/hardware-configuration.nix

@@ -18,11 +18,6 @@
       fsType = "zfs";
     };
 
-  fileSystems."/nix" =
-    { device = "zroot/data/nix";
-      fsType = "zfs";
-    };
-
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/970C-6A15";
       fsType = "vfat";

hosts/Yura-TPX13/default.nix

@@ -11,18 +11,10 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.loader.systemd-boot.enable = false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
-
   networking.hostName = "Yura-TPX13"; # Define your hostname.
   networking.hostId = "8425e349"; # Required for ZFS.
 
   services.fprintd.enable = true;
-  security.pam.services.login.fprintAuth = false;
-
 
   # Install firefox.
   programs.firefox.enable = true;

hosts/common-desktop.nix

@@ -7,20 +7,15 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_7_2;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
   boot.loader = {
     efi.canTouchEfiVariables = true;
     timeout = 3;
-    systemd-boot.enable = lib.mkDefault true;
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+    };
   };
-  boot.kernel.sysctl = {
-    # https://wiki.archlinux.org/title/Zram#Optimizing_swap_on_zram
-    "vm.swappiness" = 180;
-    "vm.watermark_boost_factor" = 0;
-    "vm.watermark_scale_factor" = 125;
-    "vm.page-cluster" = 0;
-  };
-  zramSwap.enable = true;
 
   # https://nixos.wiki/wiki/Accelerated_Video_Playback
   hardware.graphics.enable = true;
@@ -29,16 +24,14 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
-  networking.networkmanager.plugins = [
-    pkgs.networkmanager-openvpn
-  ];
 
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
   services.xserver.enable = false;
 
   # Enable the KDE Plasma Desktop Environment.
-  services.displayManager.plasma-login-manager.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.displayManager.sddm.wayland.enable = true;
   services.desktopManager.plasma6.enable = true;
 
   # Enable CUPS to print documents.
@@ -65,28 +58,28 @@
   programs.git.enable = true;
   programs.git.lfs.enable = true;
   # https://nixos.wiki/wiki/Git
-  programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
+  programs.git.package = pkgs.git.override { withLibsecret = true; };
   programs.lazygit.enable = true;
   programs.neovim.enable = true;
   programs.wireshark.enable = true;
   programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
   programs.bat.enable = true;
   programs.htop.enable = true;
-  programs.nix-ld.enable = true;
-  # programs.steam.enable = true;
 
   # https://nixos.wiki/wiki/Docker
   virtualisation.docker.enable = true;
   virtualisation.docker.enableOnBoot = false;
+  virtualisation.docker.package = pkgs.docker_28;
 
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
+  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     fantasque-sans-mono
     nerd-fonts.fantasque-sans-mono
     noto-fonts
-    noto-fonts-color-emoji
+    noto-fonts-emoji
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     jetbrains-mono
@@ -114,13 +107,12 @@
     jq
     ldns
     mediainfo
-    powertop
     rbw
     restic
+    resticprofile
     rclone
     ripgrep-all
     rustscan
-    unrar
     whois
     wireguard-tools
     yt-dlp
@@ -128,88 +120,48 @@
     bitwarden-desktop
     darkman
     host-spawn # for flatpaks
-    jellyfin-mpv-shim
     kdePackages.filelight
     kdePackages.flatpak-kcm
     kdePackages.kate
     kdePackages.yakuake
-    (mpv.override {
+    mpv
-      scripts = with pkgs.mpvScripts; [
-        mpris
-        videoclip
-      ];
-    })
     nextcloud-client
-    # lutris
     lxqt.pavucontrol-qt
-    pinentry-all
+    pinentry
     tela-circle-icon-theme
-    typst
     virt-viewer
     waypipe
   ] ++ [
     # jetbrains.rust-rover
     # jetbrains.goland
     jetbrains.clion
-    # jetbrains.idea
+    jetbrains.idea-ultimate
-    jetbrains.pycharm
+    jetbrains.pycharm-professional
     jetbrains.webstorm
     android-studio
     rustup
     zed-editor
-    package-version-server # for zed
-    antigravity-cli
-    antigravity-ide-fhs
-    codex
-    # codex-acp
-    # github-copilot-cli
-    # opencode
-    # opencode-desktop
   ] ++ [
-    # C
-    gcc
-    valgrind
-    
     # Python
     python3
     poetry
 
     # Haskell
-    cabal-install
-    haskell-language-server
-    # haskellPackages.hls-cabal-plugin
     haskellPackages.ghc
     haskellPackages.stack
 
     # Node
-    nodejs_24
+    nodejs_22
     pnpm
     bun
 
     # Nix
     nil
     nixd
-    nixfmt
+    nixfmt-rfc-style
 
     # Gleam
     gleam
-    beamMinimal28Packages.erlang
+    beamMinimal26Packages.erlang
-    
-    # Racket
-    racket
-    
-    # Ruby
-    ruby
-
-    # Java
-    zulu
-
-    # spacetimedb
-  ] ++ [
-    jujutsu
-    lazyjj
-    jjui
-    # jj-fzf
-    gg-jj
   ];
 }

hosts/router/hardware-configuration.nix

@@ -14,12 +14,12 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/0dec41bf-aba0-4b7b-9f61-bbb572e5bd1e";
+    { device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/9F5E-672F";
+    { device = "/dev/disk/by-uuid/12CE-A600";
       fsType = "vfat";
       options = [ "fmask=0022" "dmask=0022" ];
     };

hosts/vm/default.nix

@@ -70,6 +70,7 @@
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
+#  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif

modules/default.nix

@@ -1,5 +1,6 @@
 { ... }: {
   imports = [
     ./opts
+    ./workarounds
   ];
 }

modules/opts/kb-input/default.nix

@@ -45,7 +45,7 @@ in {
       enable = true;
       type = "fcitx5";
       fcitx5.waylandFrontend = true;
-      # fcitx5.plasma6Support = true;
+      fcitx5.plasma6Support = true;
       fcitx5.addons = [ pkgs.fcitx5-mozc ];
     };
   };

modules/router/default.nix

@@ -9,7 +9,6 @@ in
       ./opts.nix
       ./ifconfig.nix
       ./wireguard.nix
-      ./tailscale.nix
       ./firewall.nix
       ./dns.nix
       ./kea.nix
@@ -28,7 +27,7 @@ in
 
   boot.loader.timeout = 2;
   boot.loader.systemd-boot.configurationLimit = 5;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_18;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
   boot.growPartition = true;
 
   # Enable the X11 windowing system.
@@ -77,7 +76,6 @@ in
     starship
     tealdeer
     transcrypt
-    wakeonlan
     waypipe
     whois
     wireguard-tools

modules/router/dns.nix

@@ -28,8 +28,6 @@ let
     "|woodpecker."
     "||pgrok."
     "|sync."
-    "|minecruft."
-    "|n8n."
   ];
 in
 {
@@ -54,17 +52,17 @@ in
       enable_dnssec = true;
       bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
       upstream_dns = [
+        # Default upstreams
+        "quic://p0.freedns.controld.com"
+        "tls://one.one.one.one"
+        "tls://dns.quad9.net"
+
         # Adguard uses upstream and not rewrite rules to resolve cname rewrites,
         # and obviously my sysdomain entries don't exist in cloudflare.
         "[/${sysdomain}/][::1]"           # Sys domains to self (for cname rewrites)
 
         "[/${ldomain}/][::1]:1053"        # Local domains to Knot (ddns)
         "[/home/][${ifs.lan.ulaPrefix}::250]"  # .home domains to opnsense (temporary)
-
-        # Default upstreams
-        "quic://p0.freedns.controld.com"
-        "tls://one.one.one.one"
-        "tls://dns.quad9.net"
       ];
     };
     # https://adguard-dns.io/kb/general/dns-filtering-syntax/
@@ -82,14 +80,11 @@ in
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
-      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
-
       # Lab DNS rewrites
       "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
-      "@@||stats.grafana.org"
     ]
       # Alpina DNS rewrites
       ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;

modules/router/firewall.nix

@@ -15,11 +15,6 @@ let
         ${ifs.lan50.name},
         ${ifs.wg0.name},
     }
-    # Tailscale is its own zone, since tailnet traffic is already filtered by tailscale ACLs
-    # and needs some special handling (exit node NAT with CGNAT/ULA addrs)
-    define ZONE_TAILSCALE_IFS = { ${ifs.ts0.name} }
-    define TAILSCALE_NET4 = ${ifs.ts0.net4}
-    define TAILSCALE_NET6 = ${ifs.ts0.net6}
     define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
     define ZONE_LAN_EXTRA_NET6 = {
         # TODO: reevaluate this statement
@@ -61,13 +56,6 @@ in
               udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
               udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
               udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
-              # Amnezia VPN server
-              udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
-              tcp . 38247 : ${vars.extra.amnezia.addr4} . 22,
-              # Minecruft server
-              tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
-              udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
           }
       }
 
@@ -85,8 +73,6 @@ in
 
           # Masquerade LAN addrs
           oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
-          # Masquerade tailnet addrs (tailscale exit node)
-          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 masquerade
       }
     '';
   };
@@ -104,28 +90,12 @@ in
     '';
   };
 
-  # IPv6 masquerading for tailnet addrs only (tailscale exit node)
-  # Tailscale only assigns ULAs from $TAILSCALE_NET6, so NAT is unavoidable here
-  networking.nftables.tables.nat6_tailscale = {
-    family = "ip6";
-    content = ''
-      ${nftIdentifiers}
-      chain postrouting {
-          type nat hook postrouting priority srcnat; policy accept;
-          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 masquerade
-      }
-    '';
-  };
-
   networking.nftables.tables.firewall = {
     family = "inet";
     content = ''
       ${nftIdentifiers}
       define ALLOWED_TCP_PORTS = { ssh }
-      define ALLOWED_UDP_PORTS = {
+      define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
-          ${toString vars.ifs.wg0.listenPort},
-          ${toString vars.ifs.ts0.listenPort},  # tailscale direct connections
-      }
       define ALLOWED_TCP_LAN_PORTS = { ssh, https }
       define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
       set port_forward_v6 {
@@ -184,8 +154,6 @@ in
           # iifname $ZONE_LAN_IFS accept
           iifname $ZONE_LAN_IFS jump zone_lan_input
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
-          # Tailscale zone input rules
-          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_input
 
           # log
       }
@@ -201,8 +169,6 @@ in
           # LAN zone forward rules
           iifname $ZONE_LAN_IFS jump zone_lan_forward
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
-          # Tailscale zone forward rules
-          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_forward
       }
 
       chain zone_wan_input {
@@ -242,23 +208,6 @@ in
 
           # Allow traffic between LANs
           oifname $ZONE_LAN_IFS accept
-
-          # Allow LAN to reach tailnet (no SNAT, tailnet peers see real LAN addrs)
-          oifname $ZONE_TAILSCALE_IFS accept
-      }
-
-      chain zone_tailscale_input {
-          # Tailnet access is restricted by tailscale ACLs, treat like LAN
-          jump zone_lan_input
-      }
-
-      chain zone_tailscale_forward {
-          # Subnet router: allow tailnet to LANs (advertised routes)
-          oifname $ZONE_LAN_IFS accept
-
-          # Exit node: allow tailnet to WAN (masqueraded in nat4 / nat6_tailscale)
-          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 accept
-          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 accept
       }
 
       chain output {

modules/router/ifconfig.nix

@@ -52,9 +52,6 @@ in
   # since my WAN and LAN20 are technically bridged.
   # https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac
   boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1;
-  # Later I discovered that rp_filter might also be good to set
-  # Strict mode (1) drops packets if the src ip isn't a local route on the interface
-  boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1;
 
   # It is impossible to do multiple prefix requests with networkd,
   # so I use dhcpcd for this

modules/router/secrets/grafana-secret-key.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
-vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
---- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
-9‡Ài¨*¡-oš·}Ć(Š5[¬[ÕyKr)¾-­cùäóŽù¼R0?Ë8`Èô×{

modules/router/services.nix

@@ -29,12 +29,10 @@ in
   };
 
   # https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
-  secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
   services.grafana = {
     enable = true;
     settings = {
       security.allow_embedding = true;
-      security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
       server = {
         http_port = 3001;
         domain = "grouter.${domain}";
@@ -59,37 +57,28 @@ in
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
+      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
     };
-    virtualHosts."*.${domain}".extraConfig = ''
+    virtualHosts."grouter.${domain}".extraConfig = ''
       encode
       tls {
           dns cloudflare {env.CF_API_KEY}
           resolvers 1.1.1.1
       }
-
+      @grafana path /grafana /grafana/*
-      @grouter host grouter.${domain}
+      handle @grafana {
-      handle @grouter {
+          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
-          @grafana path /grafana /grafana/*
+      }
-          handle @grafana {
+      redir /adghome /adghome/
-              reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
+      handle_path /adghome/* {
-          }
+          reverse_proxy localhost:${toString config.services.adguardhome.port}
-          redir /adghome /adghome/
+          basic_auth {
-          handle_path /adghome/* {
+              Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
-              reverse_proxy localhost:${toString config.services.adguardhome.port}
-              basic_auth {
-                  Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
-              }
-          }
-          handle /* {
-              reverse_proxy localhost:${toString config.services.glance.settings.server.port}
           }
       }
-
+      handle /* {
-      @hass host hass.${domain}
+          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
-      handle @hass {
-          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
       }
     '';
   };

modules/router/tailscale.nix

@@ -1,44 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  vars = import ./vars.nix config;
-  ifs = vars.ifs;
-  ts0 = ifs.ts0;
-
-  # Subnets advertised to the tailnet (still need to be approved in the admin console)
-  advertisedRoutes = [
-    "${vars.p4}.0.0/16"          # all LAN v4 subnets
-    "${vars.ulaPrefix}::/48"     # all LAN ULA subnets
-  ];
-in
-{
-  # One-time setup after deploying: `sudo tailscale up`
-  # (state is persisted in /var/lib/tailscale)
-  services.tailscale = {
-    enable = true;
-    port = ts0.listenPort;
-    interfaceName = ts0.name;
-    # Enables ip forwarding (already enabled globally by networkd anyway).
-    # Not using "both", since that sets rp_filter to loose on all interfaces.
-    useRoutingFeatures = "server";
-    # Firewall is managed manually in firewall.nix (networking.firewall is disabled)
-    openFirewall = false;
-    # Applied with `tailscale set` on every start, so these stay declarative
-    extraSetFlags = [
-      # Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
-      "--netfilter-mode=off"
-      # Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
-      # (preserves real source addrs for logging/ACLs on LAN hosts)
-      "--snat-subnet-routes=false"
-      # The router is its own DNS server, don't let tailscale mess with resolv.conf
-      "--accept-dns=false"
-      "--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
-      "--advertise-exit-node"
-    ];
-  };
-
-  # networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
-  # policy routing rules (table 52). This is extra important since networkd is
-  # restarted every minute (see ifconfig.nix).
-  # The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
-  systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
-}

modules/router/vars.nix

@@ -111,14 +111,6 @@ rec {
     } // {
       listenPort = 51944;
     };
-    # Tailscale addresses are assigned by the coordination server,
-    # these are the fixed ranges tailscale allocates node addrs from.
-    ts0 = {
-      name = "tailscale0";
-      listenPort = 41641;
-      net4 = "100.64.0.0/10";
-      net6 = "fd7a:115c:a1e0::/48";
-    };
   };
 
   extra = {
@@ -143,7 +135,5 @@ rec {
         }
       ];
     };
-    amnezia.addr4 = "${ifs.lan10.p4}.31";
-    minecruft.addr4 = "${ifs.lan.p4}.11";
   };
 }

modules/workarounds/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./flatpak.nix
+  ];
+}

modules/workarounds/flatpak.nix

@@ -0,0 +1,44 @@
+# https://github.com/knightpp/nixos-cfg/blob/main/modules/workarounds/flatpak.nix
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.workarounds.flatpak;
+in {
+  options = {
+    workarounds.flatpak = {
+      enable = lib.mkEnableOption "flatpak workaround";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    system.fsPackages = [pkgs.bindfs];
+    fileSystems = let
+      mkRoSymBind = path: {
+        device = path;
+        fsType = "fuse.bindfs";
+        options = ["ro" "resolve-symlinks" "x-gvfs-hide"];
+      };
+      aggregated = pkgs.buildEnv {
+        name = "system-fonts-and-icons";
+        paths = builtins.attrValues {
+          inherit (pkgs.kdePackages) breeze;
+          inherit
+            (pkgs)
+            noto-fonts
+            noto-fonts-emoji
+            noto-fonts-cjk-sans
+            noto-fonts-cjk-serif
+            ;
+        };
+        pathsToLink = ["/share/fonts" "/share/icons"];
+      };
+    in {
+      # Create an FHS mount to support flatpak host icons/fonts
+      "/usr/share/icons" = mkRoSymBind "${aggregated}/share/icons";
+      "/usr/share/fonts" = mkRoSymBind "${aggregated}/share/fonts";
+    };
+  };
+}

users/cazzzer/default.nix

@@ -5,7 +5,7 @@
     isNormalUser = true;
     description = "Yura";
     group = "cazzzer";
-    extraGroups = [ "wheel" "dialout" ]
+    extraGroups = [ "wheel" ]
       ++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
       ++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
       ++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]