Merge pull request 'Dev' (#2 ) from dev into master

Reviewed-on: #2
remove hermes permission service
2026-07-23 12:48:53 -05:00 · 2026-07-23 11:18:42 -05:00 · 2026-07-23 11:15:51 -05:00 · 2026-07-21 21:25:58 -05:00 · 2026-07-21 21:18:20 -05:00 · 2026-07-21 20:15:00 -05:00
48 changed files with 1147 additions and 427 deletions
@@ -1,5 +1,26 @@
 {
  "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
    "aquamarine": {
      "inputs": {
        "hyprutils": [
@@ -20,11 +41,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745357003,
-        "narHash": "sha256-jYwzQkv1r7HN/4qrAuKp+NR4YYNp2xDrOX5O9YVqkWo=",
+        "lastModified": 1784368054,
+        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "a19cf76ee1a15c1c12083fa372747ce46387289f",
+        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
        "type": "github"
      },
      "original": {
@@ -33,92 +54,85 @@
        "type": "github"
      }
    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
    "flake-compat": {
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
        "repo": "flake-compat",
        "type": "github"
      }
    },
    "flake-parts": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "pre-commit-hooks",
+        "nixpkgs-lib": [
+          "hermes-agent",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "hermes-agent": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": "nixpkgs_2",
+        "npm-lockfile-fix": "npm-lockfile-fix",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1784644108,
+        "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=",
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
        "type": "github"
      }
    },
@@ -129,11 +143,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1747038076,
-        "narHash": "sha256-vy+My+8yRRu0OG6XBEPDR8ebfrPS4iuruyQ1ZUyHq6s=",
+        "lastModified": 1784601896,
+        "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=",
        "owner": "feel-co",
        "repo": "hjem",
-        "rev": "7d674eaded6586554910e62baed5eadad6496315",
+        "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679",
        "type": "github"
      },
      "original": {
@@ -147,18 +161,17 @@
        "hjem": [
          "hjem"
        ],
-        "ndg": "ndg",
+        "nix-darwin": "nix-darwin",
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
+        ]
      },
      "locked": {
-        "lastModified": 1747217237,
-        "narHash": "sha256-rYWxmjGpdGYlJd8gwripamC3t9mCihBDZJiz84CrUHI=",
+        "lastModified": 1784361899,
+        "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=",
        "owner": "snugnug",
        "repo": "hjem-rum",
-        "rev": "1d3bf26bb71dced495a99e05a0141db24c49ca6f",
+        "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60",
        "type": "github"
      },
      "original": {
@@ -170,16 +183,16 @@
    "home-manager": {
      "inputs": {
        "nixpkgs": [
-          "zen-browser",
+          "agenix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1752603129,
-        "narHash": "sha256-S+wmHhwNQ5Ru689L2Gu8n1OD6s9eU9n9mD827JNR+kw=",
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e8c19a3cec2814c754f031ab3ae7316b64da085b",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
        "type": "github"
      },
      "original": {
@@ -204,11 +217,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745948457,
-        "narHash": "sha256-lzTV10FJTCGNtMdgW5YAhCAqezeAzKOd/97HbQK8GTU=",
+        "lastModified": 1776511930,
+        "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=",
        "owner": "hyprwm",
        "repo": "hyprcursor",
-        "rev": "ac903e80b33ba6a88df83d02232483d99f327573",
+        "rev": "39435900785d0c560c6ae8777d29f28617d031ef",
        "type": "github"
      },
      "original": {
@@ -233,11 +246,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745015490,
-        "narHash": "sha256-apEJ9zoSzmslhJ2vOKFcXTMZLUFYzh1ghfB6Rbw3Low=",
+        "lastModified": 1782566056,
+        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "60754910946b4e2dc1377b967b7156cb989c5873",
+        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
        "type": "github"
      },
      "original": {
@@ -251,22 +264,23 @@
        "aquamarine": "aquamarine",
        "hyprcursor": "hyprcursor",
        "hyprgraphics": "hyprgraphics",
+        "hyprland-guiutils": "hyprland-guiutils",
        "hyprland-protocols": "hyprland-protocols",
-        "hyprland-qtutils": "hyprland-qtutils",
        "hyprlang": "hyprlang",
        "hyprutils": "hyprutils",
        "hyprwayland-scanner": "hyprwayland-scanner",
-        "nixpkgs": "nixpkgs",
+        "hyprwire": "hyprwire",
+        "nixpkgs": "nixpkgs_3",
        "pre-commit-hooks": "pre-commit-hooks",
-        "systems": "systems",
+        "systems": "systems_2",
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1746125293,
-        "narHash": "sha256-uRNqLIZISbzdCi1NSuecT0bUgDv1oQYe7as5q+YYRgU=",
+        "lastModified": 1784641930,
+        "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "2670b8f7724e94020f21fe81483e69d73e1337cf",
+        "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda",
        "type": "github"
      },
      "original": {
@@ -275,6 +289,52 @@
        "type": "github"
      }
    },
+    "hyprland-guiutils": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprlang"
+        ],
+        "hyprtoolkit": "hyprtoolkit",
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784196523,
+        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprland-guiutils",
+        "type": "github"
+      }
+    },
    "hyprland-protocols": {
      "inputs": {
        "nixpkgs": [
@@ -287,11 +347,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743714874,
-        "narHash": "sha256-yt8F7NhMFCFHUHy/lNjH/pjZyIDFNk52Q4tivQ31WFo=",
+        "lastModified": 1772460177,
+        "narHash": "sha256-/6G/MsPvtn7bc4Y32pserBT/Z4SUUdBd4XYJpOEKVR4=",
        "owner": "hyprwm",
        "repo": "hyprland-protocols",
-        "rev": "3a5c2bda1c1a4e55cc1330c782547695a93f05b2",
+        "rev": "1cb6db5fd6bb8aee419f4457402fa18293ace917",
        "type": "github"
      },
      "original": {
@@ -300,74 +360,6 @@
        "type": "github"
      }
    },
-    "hyprland-qt-support": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "hyprland-qtutils",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "hyprland-qtutils",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1737634706,
-        "narHash": "sha256-nGCibkfsXz7ARx5R+SnisRtMq21IQIhazp6viBU8I/A=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "rev": "8810df502cdee755993cb803eba7b23f189db795",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qt-support",
-        "type": "github"
-      }
-    },
-    "hyprland-qtutils": {
-      "inputs": {
-        "hyprland-qt-support": "hyprland-qt-support",
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "hyprutils": [
-          "hyprland",
-          "hyprland-qtutils",
-          "hyprlang",
-          "hyprutils"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745951494,
-        "narHash": "sha256-2dModE32doiyQMmd6EDAQeZnz+5LOs6KXyE0qX76WIg=",
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "rev": "4be1d324faf8d6e82c2be9f8510d299984dfdd2e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-qtutils",
-        "type": "github"
-      }
-    },
    "hyprlang": {
      "inputs": {
        "hyprutils": [
@@ -384,11 +376,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745357019,
-        "narHash": "sha256-q/C3qj9FWHQenObXuw/nGIT8iIsWFjgmcQYcA+ZfpPs=",
+        "lastModified": 1777320127,
+        "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=",
        "owner": "hyprwm",
        "repo": "hyprlang",
-        "rev": "397600c42b8d7a443a5b4e92aa15f46650a90f18",
+        "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc",
        "type": "github"
      },
      "original": {
@@ -397,6 +389,58 @@
        "type": "github"
      }
    },
+    "hyprtoolkit": {
+      "inputs": {
+        "aquamarine": [
+          "hyprland",
+          "hyprland-guiutils",
+          "aquamarine"
+        ],
+        "hyprgraphics": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprgraphics"
+        ],
+        "hyprlang": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprlang"
+        ],
+        "hyprutils": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprutils"
+        ],
+        "hyprwayland-scanner": [
+          "hyprland",
+          "hyprland-guiutils",
+          "hyprwayland-scanner"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "hyprland-guiutils",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "hyprland-guiutils",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782554491,
+        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprtoolkit",
+        "type": "github"
+      }
+    },
    "hyprutils": {
      "inputs": {
        "nixpkgs": [
@@ -409,11 +453,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745975815,
-        "narHash": "sha256-s3GzsRxBL/N/xYgUXZhQh4t62uR1BN4zxXgWBtJ3lWM=",
+        "lastModified": 1784323413,
+        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "05878d9470c9e5cbc8807813f9ec2006627a0ca0",
+        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
        "type": "github"
      },
      "original": {
@@ -434,11 +478,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1739870480,
-        "narHash": "sha256-SiDN5BGxa/1hAsqhgJsS03C3t2QrLgBT8u+ENJ0Qzwc=",
+        "lastModified": 1777159683,
+        "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=",
        "owner": "hyprwm",
        "repo": "hyprwayland-scanner",
-        "rev": "206367a08dc5ac4ba7ad31bdca391d098082e64b",
+        "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404",
        "type": "github"
      },
      "original": {
@@ -447,94 +491,83 @@
        "type": "github"
      }
    },
-    "ndg": {
+    "hyprwire": {
+      "inputs": {
+        "hyprutils": [
+          "hyprland",
+          "hyprutils"
+        ],
+        "nixpkgs": [
+          "hyprland",
+          "nixpkgs"
+        ],
+        "systems": [
+          "hyprland",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778410714,
+        "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=",
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hyprwm",
+        "repo": "hyprwire",
+        "type": "github"
+      }
+    },
+    "nix-darwin": {
      "inputs": {
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
        "nixpkgs": [
          "hjem-rum",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1746459301,
-        "narHash": "sha256-QcAaxXdcPMqY5IppLa9fHCq3Rzq597DQqq8s2fKuE0k=",
-        "owner": "feel-co",
-        "repo": "ndg",
-        "rev": "2864a9901102a86db82157f72998809c570c36bb",
+        "lastModified": 1779036909,
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
        "type": "github"
      },
      "original": {
-        "owner": "feel-co",
-        "ref": "v2",
-        "repo": "ndg",
-        "type": "github"
-      }
-    },
-    "nix4nvchad": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nvchad-starter": "nvchad-starter"
-      },
-      "locked": {
-        "lastModified": 1759653262,
-        "narHash": "sha256-uTiQXY/ZlplEq1j2jH0k6oDzldid0xHgnLsLQyRRbvk=",
-        "owner": "nix-community",
-        "repo": "nix4nvchad",
-        "rev": "9d91858966b5d4e87ee52e16993988dfea9b0f94",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix4nvchad",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1745930157,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "lastModified": 1754028485,
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1745930157,
-        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
-        "owner": "nixos",
+        "lastModified": 1775036866,
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
@@ -542,11 +575,27 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1755615617,
-        "narHash": "sha256-HMwfAJBdrr8wXAkbGhtcby1zGFvs+StOp19xNsbqdOg=",
+        "lastModified": 1784356753,
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1784497964,
+        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "20075955deac2583bb12f07151c2df830ef346b4",
+        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
        "type": "github"
      },
      "original": {
@@ -556,38 +605,41 @@
        "type": "github"
      }
    },
-    "nvchad-starter": {
-      "flake": false,
+    "npm-lockfile-fix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1753939018,
-        "narHash": "sha256-xdLr6tlU9uA+wu0pqha2br0fdVm+1MjgjbB5awz9ICU=",
-        "owner": "NvChad",
-        "repo": "starter",
-        "rev": "e3572e1f5e1c297212c3deeb17b7863139ce663e",
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
        "type": "github"
      },
      "original": {
-        "owner": "NvChad",
-        "ref": "main",
-        "repo": "starter",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
        "type": "github"
      }
    },
    "pre-commit-hooks": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "gitignore": "gitignore",
+        "flake-compat": "flake-compat",
        "nixpkgs": [
          "hyprland",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1742649964,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "lastModified": 1784288435,
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
        "type": "github"
      },
      "original": {
@@ -596,32 +648,67 @@
        "type": "github"
      }
    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes-agent",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "hermes-agent",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772555609,
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "c37f66a953535c394244888598947679af231863",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772865871,
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
+        "agenix": "agenix",
+        "hermes-agent": "hermes-agent",
        "hjem": "hjem",
        "hjem-rum": "hjem-rum",
        "hyprland": "hyprland",
-        "nix4nvchad": "nix4nvchad",
-        "nixpkgs": "nixpkgs_2",
-        "zen-browser": "zen-browser"
+        "nixpkgs": "nixpkgs_4"
      }
    },
    "systems": {
-      "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
-        "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default-linux",
-        "type": "github"
-      }
-    },
-    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -636,24 +723,43 @@
        "type": "github"
      }
    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "hjem-rum",
-          "nixpkgs"
-        ]
-      },
+    "systems_2": {
      "locked": {
-        "lastModified": 1746216483,
-        "narHash": "sha256-4h3s1L/kKqt3gMDcVfN8/4v2jqHrgLIe4qok4ApH5x4=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "29ec5026372e0dec56f890e50dbe4f45930320fd",
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes-agent",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773039484,
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
        "type": "github"
      }
    },
@@ -685,11 +791,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1745871725,
-        "narHash": "sha256-M24SNc2flblWGXFkGQfqSlEOzAGZnMc9QG3GH4K/KbE=",
+        "lastModified": 1784371182,
+        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
        "owner": "hyprwm",
        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "76bbf1a6b1378e4ab5230bad00ad04bc287c969e",
+        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
        "type": "github"
      },
      "original": {
@@ -697,25 +803,6 @@
        "repo": "xdg-desktop-portal-hyprland",
        "type": "github"
      }
-    },
-    "zen-browser": {
-      "inputs": {
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1759965431,
-        "narHash": "sha256-HvXr+rOkSZeseOYCruuMKMAUedcDkHOuYpFbnlIPs8Y=",
-        "owner": "0xc000022070",
-        "repo": "zen-browser-flake",
-        "rev": "391a133511ad7e09651b9c3939d8cf8d379766b1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "0xc000022070",
-        "repo": "zen-browser-flake",
-        "type": "github"
-      }
    }
  },
  "root": "root",
@@ -1,7 +1,10 @@
 {
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
    hyprland.url = "github:hyprwm/Hyprland";
+    hermes-agent.url = "github:NousResearch/hermes-agent";
+    agenix.url = "github:ryantm/agenix";

    hjem = {
      url = "github:feel-co/hjem";
@@ -13,35 +16,37 @@
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.hjem.follows = "hjem";
    };
-
-    zen-browser = {
-      url = "github:0xc000022070/zen-browser-flake";
-      #inputs.nixpkgs.follows
-    };
-
-    nix4nvchad = {
-      url = "github:nix-community/nix4nvchad";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs =
-    { self, nixpkgs, ... }@inputs:
+    {
+      self,
+      nixpkgs,
+      ...
+    }@inputs:
    let
      system = "x86_64-linux";
      username = "poslop";
+      mkHost =
+        host: modules:
+        nixpkgs.lib.nixosSystem {
+          modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules;
+          specialArgs = {
+            inherit
+              self
+              inputs
+              username
+              host
+              ;
+          };
+        };
    in
    {
      nixosConfigurations = {
-        nixos-vm2 = nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [ ./hosts/nixos-vm2/configuration.nix ];
-          specialArgs = {
-            host = "nixos-vm2";
-            inherit self inputs username;
-          };
-        };
+        nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ];
+        qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ];
+        goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ];
+        hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ];
      };
-
    };
 }
@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    ../../modules/k3s/k3s.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "25.11";
+}
@@ -2,33 +2,46 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
+  config,
  lib,
+  pkgs,
  modulesPath,
  ...
 }:

 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];

  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
    "ahci"
-    "xhci_pci"
    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
    "sr_mod"
-    "virtio_blk"
  ];
  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/39b3801f-ffcd-421f-966f-46625fb8d4ca";
+    device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb";
    fsType = "ext4";
  };

-  swapDevices = [ { device = "/dev/disk/by-uuid/7043d338-93f0-40a7-9033-6616685e32f3"; } ];
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C838-5FC2";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };

-  networking.useDHCP = lib.mkDefault true;
+  swapDevices = [ ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    ../../modules/hermes
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "25.11";
+}
@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/4a546e61-4a4d-4e09-8b00-3f56acc14ccb";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C838-5FC2";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
@@ -1,42 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  nix.settings = {
-    experimental-features = "nix-command flakes";
-  };
-
-  imports = [
-    ./hardware-configuration.nix
-    ./modules
-  ];
-
-  programs.hyprland.enable = true;
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
-  networking.hostName = "poslop-nixvm";
-  networking.networkmanager.enable = true;
-
-  time.timeZone = "America/Chicago";
-
-  services.printing.enable = true;
-
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    kitty
-    vim
-    wget
-    git
-    curl
-    zsh
-  ];
-
-  system.stateVersion = "24.11";
-}
@@ -9,7 +9,7 @@
  ];

  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.device = "/dev/sda";

  services.spice-vdagentd.enable = true;
  services.qemuGuest.enable = true;
@@ -1,39 +1,25 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
+{ config, lib, pkgs, modulesPath, ... }:

 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [ ];

-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "xhci_pci"
-    "virtio_pci"
-    "sr_mod"
-    "virtio_blk"
-  ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "ehci_pci" "ahci" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/b8c66f3c-759d-4d4f-9d1a-3f2e04d91e23";
-    fsType = "ext4";
-  };
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/8762fc76-e399-4d11-adb9-377841204c4b";
+      fsType = "ext4";
+    };

-  swapDevices = [ { device = "/dev/disk/by-uuid/b7d73851-7f85-44fa-b62a-e35deb0ea98a"; } ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/94573296-7dcb-423f-a882-342b98b8147a"; }
+    ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.virtualbox.guest.enable = true;
 }
@@ -0,0 +1,18 @@
+{
+  ...
+}:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+  ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+
+  services.spice-vdagentd.enable = true;
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "24.11";
+}
@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/b8c66f3c-759d-4d4f-9d1a-3f2e04d91e23";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/b7d73851-7f85-44fa-b62a-e35deb0ea98a"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp8s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
@@ -1,14 +1,13 @@
 {
  imports = [
+    ./nvim.nix
    ./zsh
    ./git.nix
-    ./fonts.nix
    ./hjem.nix
    ./network.nix
-    ./packages.nix
+    ./packages
    ./timezone.nix
    ./nix.nix
-    ./pipewire.nix
    ./program.nix
    ./user.nix
    ./ssh.nix
@@ -1,6 +1,3 @@
-{
-  ...
-}:
 {
  hj.rum.programs.git = {
    enable = true;
@@ -12,6 +9,9 @@
      core = {
        editor = "nvim -f";
      };
+      credential = {
+        helper = "store";
+      };
    };
  };
 }
@@ -1,4 +1,6 @@
+{ host, ... }:
+
 {
-  networking.hostName = "poslop-nixvm2";
+  networking.hostName = host;
  networking.networkmanager.enable = true;
 }
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  environment.variables.EDITOR = "nvim";
+
+  systemd.user.services."nvim-config" = {
+    description = "Clone Neovim config into ~/.config/nvim";
+    after = [ "network.target" ];
+    wantedBy = [ "default.target" ];
+    enable = true;
+    serviceConfig = {
+      Type = "oneshot";
+    };
+
+    script = ''
+      set -e
+
+      if [ ! -d "$HOME/.config/nvim/.git" ]; then
+        echo "Cloning Neovim config..."
+        ${pkgs.git}/bin/git clone https://git.archfox.org/poslop/nvbad.git "$HOME/.config/nvim"
+      else
+        echo "Neovim config already exists, skipping."
+      fi
+    '';
+  };
+}
@@ -1,17 +0,0 @@
-{ pkgs, username, inputs, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    inputs.nix4nvchad.packages.${system}.nvchad
-    zsh
-  ];
-
-  hjem.users.${username}.packages = with pkgs; [
-    btop
-    curl
-    git
-    neofetch
-    statix
-    wget
-    wl-clipboard
-  ];
-}
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./dev.nix
+    ./system.nix
+    ./utils.nix
+  ];
+}
@@ -0,0 +1,19 @@
+{ pkgs, username, ... }:
+{
+  hjem.users.${username}.packages = with pkgs; [
+    # general
+    neovim
+    git
+    tree-sitter
+    gcc
+
+    # lua
+    stylua
+    lua-language-server
+
+    # nix
+    nixd
+    nixfmt
+    statix
+  ];
+}
@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    zsh
+  ];
+
+}
@@ -0,0 +1,11 @@
+{ pkgs, username, ... }:
+{
+  hjem.users.${username}.packages = with pkgs; [
+    btop
+    curl
+    tlrc
+    unzip
+    wget
+    wl-clipboard
+  ];
+}
@@ -1,4 +1,7 @@
 _:
 {
-  programs.zsh.enable = true;
+  programs = {
+    zsh.enable = true;
+    nix-ld.enable = true; 
+  };
 }
@@ -4,7 +4,10 @@
  users.users.${username} = {
    isNormalUser = true;
    description = "${username}";
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
    shell = pkgs.zsh;
  };
  nix.settings.allowed-users = [ "@wheel" ];
@@ -10,3 +10,35 @@ zstyle :compinstall filename '/home/poslop/.zshrc'

 autoload -Uz compinit
 compinit
+
+alias gc='git commit'
+alias gp='git push'
+alias gs='git status'
+
+alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
+
+alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
+
+ga() {
+  if [[ -z "$1" ]]; then
+    git add -u
+  else
+    git add "$1"
+  fi
+}
+
+rerice() {
+  local flake_dir="/etc/rice-flakes"
+  local host="$(hostname -s)"
+  local OPTIND=1
+
+  while getopts ":h:" opt; do
+    case $opt in
+      h) host="$OPTARG" ;;
+      :) echo "Option -$OPTARG requires an argument." >&2; return 1 ;;
+      \?) echo "Unknown option: -$OPTARG" >&2; return 1 ;;
+    esac
+  done
+
+  sudo nixos-rebuild switch --flake "${flake_dir}#${host}"
+}
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./sudo.nix
+    ./hermes.nix
+    ./secrets
+  ];
+}
@@ -0,0 +1,63 @@
+{
+  inputs,
+  config,
+  ...
+}:
+
+{
+  imports = [ inputs.hermes-agent.nixosModules.default ];
+
+  services.hermes-agent = {
+    enable = true;
+    addToSystemPackages = true;
+    environmentFiles = [
+      config.age.secrets.hermes-env.path
+    ];
+
+    container = {
+      image = "debian:bookworm";
+      backend = "docker";
+      enable = true;
+      hostUsers = [ "poslop" ];
+      extraOptions = [
+        "-p"
+        "9119:9119"
+        "-p"
+        "8642:8642"
+      ];
+    };
+
+    settings = {
+      approvals = {
+        mode = "off";
+        cron_mode = "deny";
+        mcp_reload_confirm = "false";
+      };
+
+      memory = {
+        memory_enabled = true;
+        user_profile_enabled = true;
+      };
+
+      display = {
+        credits_notices = true;
+      };
+
+      delegation = {
+        model = "openai/gpt-5.6-luna";
+        provider = "nous";
+      };
+
+      discord = {
+        group_sessions_per_user = false;
+        reactions = false;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    8080
+    9119
+    8642
+  ];
+}
@@ -0,0 +1,15 @@
+{
+  inputs,
+  pkgs,
+  username,
+  ...
+}:
+
+{
+  imports = [ inputs.agenix.nixosModules.default ];
+  age.secrets."hermes-env".file = ./hermes-env.age;
+
+  hjem.users.${username}.packages = with pkgs; [
+    inputs.agenix.packages."${system}".default
+  ];
+}
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./agenix.nix
+  ];
+}
@@ -0,0 +1,6 @@
+let
+  hermes-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFqtbtEYL4pPNvJV64FjDXT6zT2ew0IFK8XHJ9LP7ae";
+in
+{
+  "hermes-env.age".publicKeys = [ hermes-vm ];
+}
@@ -0,0 +1,13 @@
+{
+  security.sudo.extraRules = [
+    {
+      users = [ "poslop" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/docker";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+}
@@ -1,6 +1,8 @@
 {
  imports = [
    ./hyprland
+    ./pipewire.nix
    ./packages.nix
+    ./fonts.nix
  ];
 }
@@ -1,7 +1,7 @@
 {
  programs.hyprland.enable = true;
  hj = {
-    rum.programs.hyprland.enable = true;
+    rum.desktops.hyprland.enable = true;

    files = {
      ".config/hypr".source = ./hypr;
@@ -1,13 +1,11 @@
 {
  pkgs,
  username,
-  inputs,
  ...
 }:

 {
  hjem.users.${username}.packages = with pkgs; [
-    inputs.zen-browser.packages."${system}".default
    kitty
    foot
  ];
@@ -0,0 +1,22 @@
+{
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      traefik-namespace    = { source = ./traefik/namespace.yaml; };
+      traefik-rbac         = { source = ./traefik/rbac.yaml; };
+      traefik-pvc          = { source = ./traefik/pvc.yaml; };
+      traefik-deployment   = { source = ./traefik/deployment.yaml; };
+      traefik-service      = { source = ./traefik/service.yaml; };
+      netbird-namespace    = { source = ./netbird/namespace.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress      = { source = ./netbird/ingress.yaml; };
+    };
+  };
+}
@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"
@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird
@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          env:
+            - name: NETBIRD_STORE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP
@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik:v3.4
+          args:
+            - --log.level=INFO
+            - --api.dashboard=true
+            - --entrypoints.web.address=:80
+            - --providers.kubernetescrd=true
+            - --providers.kubernetesingress=true
+          ports:
+            - name: web
+              containerPort: 80
+          volumeMounts:
+            - name: acme-storage
+              mountPath: /data
+      volumes:
+        - name: acme-storage
+          persistentVolumeClaim:
+            claimName: traefik-acme
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-acme
+  namespace: traefik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi
@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  namespace: traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["update"]
+  - apiGroups: ["traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
+                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
+                "serverstransports", "serverstransporttcps"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: 80
+    - name: websecure
+      port: 443
+      targetPort: 443
@@ -1 +1 @@
-sudo nixos-rebuild switch --flake ./#nixos-vm2
+sudo nixos-rebuild switch --flake ./#qemu-vm
Author	SHA1	Message	Date
poslop	35b065ec49	Merge pull request 'Dev' (#2 ) from dev into master Reviewed-on: #2	2026-07-23 12:48:53 -05:00
poslop	9698a57aa0	remove hermes permission service	2026-07-23 11:18:42 -05:00
poslop	6ab209cd5e	k3s into configuration for goyplex	2026-07-23 11:15:51 -05:00
poslop	9a0e03657a	netbird: pull encryptionKey from k8s secret	2026-07-21 21:25:58 -05:00
poslop	fcaa023730	netbird: change STUN to port 3479, add trustedHTTPProxies	2026-07-21 21:18:20 -05:00
poslop	f42fd8684e	traefik: add nodes, namespaces, pods to rbac	2026-07-21 20:15:00 -05:00
poslop	2e30fec972	traefik: add endpointslices and configmaps rbac	2026-07-21 20:14:35 -05:00
poslop	7af7864701	traefik: remove TLS/redirect, caddy handles TLS	2026-07-21 20:09:28 -05:00
poslop	40a82aad64	netbird: use web entrypoint, caddy handles TLS	2026-07-21 19:28:35 -05:00
poslop	d2a6887834	refactor(netbird): migrate to single netbird-server container	2026-07-21 19:06:19 -05:00
poslop	9b5af62a47	k3s init	2026-07-21 17:58:58 -05:00
poslop	106cf13597	hermes alias	2026-07-21 11:26:41 -05:00
poslop	336242e201	hermes update	2026-07-21 11:26:28 -05:00
poslop	6875e11f68	updates and hermes changes	2026-07-16 08:54:41 -05:00
poslop	3651da7577	hemres permission service	2026-07-09 11:18:29 -05:00
poslop	82dd99c699	hermes changes	2026-07-09 10:15:06 -05:00
poslop	015de3eade	packages and update	2026-06-03 20:08:53 -05:00
poslop	ed2b049717	mod	2026-06-02 01:01:50 -05:00
poslop	b661acc7f1	hermes memory	2026-05-30 19:48:59 -05:00
poslop	5f994ccf0a	hermes	2026-05-29 20:54:22 -05:00
poslop	5cd20d6a35	remove c++ tools	2026-04-24 18:56:23 -05:00
poslop	bb19efac38	reorg pkgs	2026-04-24 18:51:05 -05:00
poslop	9e56c695f0	ga alias -> function	2026-04-24 18:35:15 -05:00
poslop	2a17c5ecdf	lua ls	2026-04-24 18:30:14 -05:00
poslop	5a7f060075	nixd package	2026-04-24 18:18:33 -05:00
poslop	32cfdc0f3d	simplify inputs	2026-04-24 18:16:07 -05:00
poslop	aa7520e487	git alias	2026-04-24 17:53:00 -05:00
poslop	c86f9f4dc1	renamed rum.desktops.hyprland	2026-04-24 17:44:45 -05:00
poslop	011afecb6f	goyplex-vm	2026-04-24 17:35:33 -05:00
poslop	99a93326b9	packages reformat	2026-02-20 14:08:18 -06:00
poslop	98b245bbf0	rename reflake to rerice	2026-02-19 15:49:13 -06:00
poslop	aa55dc0251	host	2026-02-19 13:08:11 -06:00
poslop	570687deae	credential store	2026-01-30 23:34:47 -06:00
poslop	9c4ec53b0f	nix lsp for nvim	2026-01-30 23:29:19 -06:00
poslop	b038dd3a41	package clean	2026-01-30 22:36:31 -06:00
poslop	c08fb243cc	moved fonts to home	2026-01-30 20:30:30 -06:00
poslop	835e7498e4	nvim systemd for cloning	2026-01-30 20:24:40 -06:00
poslop	4b4e3a95bf	rmeove upstream nvchad flake	2026-01-27 23:51:43 -06:00
poslop	d66af8be39	changed git import	2025-11-07 16:19:50 -06:00