Add NixOS configuration files. This is a foundation git commit that has now been deployed and working

.idea/discord.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="DiscordProjectSettings">
-    <option name="show" value="ASK" />
+    <option name="show" value="PROJECT_FILES" />
     <option name="description" value="" />
     <option name="applicationTheme" value="default" />
     <option name="iconsTheme" value="default" />

maintence_cheatsheet.md

@@ -0,0 +1,4 @@
+# Upload the config to the server
+```zsh
+rsync -avz --progress2 FILE root@HOSTNAME:/etc/nixos/configuration-knot.nix
+```

nix-system-configs/build/configuration.nix

@@ -0,0 +1,267 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Add Lix instead of Nix
+
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # Add to your configuration.nix
+  # Optimize builds
+  nix.settings = {
+    # Enable parallel building
+    max-jobs = "auto";
+    cores = 0; # Use all available cores
+
+    # Optimize store operations
+    auto-optimise-store = true;
+
+    # Build settings
+    sandbox = true;
+    keep-outputs = true;
+    keep-derivations = true;
+  };
+
+  # Enable distributed builds (optional, for your VM setup)
+  nix.buildMachines = [];
+  nix.distributedBuilds = false;
+
+  # Optimize garbage collection
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  # Increase build speed with tmpfs for builds (if you have enough RAM)
+  # Comment out if low on memory
+  systemd.services.nix-daemon.environment = {
+    TMPDIR = "/tmp";
+  };
+  boot.tmp.useTmpfs = true;
+  boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
+
+  # For image building specifically
+  virtualisation.vmVariant = {
+    virtualisation = {
+      memorySize = 4096; # Adjust for build-vm
+      cores = 2;
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Enable Tailscale
+  services.tailscale.enable = true;
+
+  networking.hostName = "nixos-build-machine"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_AU.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_AU.UTF-8";
+    LC_IDENTIFICATION = "en_AU.UTF-8";
+    LC_MEASUREMENT = "en_AU.UTF-8";
+    LC_MONETARY = "en_AU.UTF-8";
+    LC_NAME = "en_AU.UTF-8";
+    LC_NUMERIC = "en_AU.UTF-8";
+    LC_PAPER = "en_AU.UTF-8";
+    LC_TELEPHONE = "en_AU.UTF-8";
+    LC_TIME = "en_AU.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "au";
+    variant = "";
+  };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.nixosbm = {
+    isNormalUser = true;
+    description = "NixOS Build Machine";
+    extraGroups = ["networkmanager" "wheel"];
+    packages = with pkgs; [];
+  };
+
+  # Remote builder server setup
+  users.users.nixremote = {
+    isNormalUser = true;
+    description = "Nix Remote Builder";
+    home = "/home/nixremote";
+    createHome = true;
+
+    # Lock the user account (no login shell)
+    shell = pkgs.shadow;
+
+    # SSH key for remote builds
+    openssh.authorizedKeys.keys = [
+      # Add the public key from your client machines here
+      # Example: "ssh-ed25519 AAAAC3... root@client-machine"
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "z /home/nixremote 0555 nixremote nixremote - -"
+    "z /home/nixremote/.ssh 0555 nixremote nixremote - -"
+  ];
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    fastfetch
+    hyfetch
+    helix
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.3";
+      #dns = "10.1.1.2";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+  environment.etc."resolv.conf".text = ''
+    nameserver 10.1.1.2
+  '';
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+
+  # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
+  #  nix.distributedBuilds = true;
+  #  nix.buildMachines = [
+  #    {
+  #      hostName = "nixos-build-machine";
+  #      system = "x86_64-linux";
+  #      sshUser = "nixremote";
+  #      sshKey = "/root/.ssh/nixremote";
+  #      maxJobs = 4;
+  #      speedFactor = 2;
+  #          supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+  #    }
+  #  ];
+  #
+  # Generate SSH key for remote building
+  #systemd.services.generate-nixremote-key = {
+  #  description = "Generate SSH key for remote Nix builds";
+  #  wantedBy = [ "multi-user.target" ];
+  #  serviceConfig = {
+  #    Type = "oneshot";
+  #    RemainAfterExit = true;
+  #  };
+  #  script = ''
+  #    if [ ! -f /root/.ssh/nixremote ]; then
+  #      ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
+  #    fi
+  #  '';
+  #};
+  #
+  #programs.ssh.extraConfig = ''
+  #  Host nixos-build-machine
+  #    HostName 192.168.1.175
+  #    IdentitiesOnly yes
+  #    IdentityFile /root/.ssh/nixremote
+  #    User nixremoteStrictHostKeyChecking accept-new
+  #'';
+  #
+  # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
+  # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
+  # then rebuild the build machine.
+  # i.e on the client: run "cat /root.ssh/nixremote.pub"
+  # and copy the output to the build machine's configuration.nix
+}

nix-system-configs/database/configuration.nix

@@ -0,0 +1,180 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Add Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "nixosdd"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_AU.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_AU.UTF-8";
+    LC_IDENTIFICATION = "en_AU.UTF-8";
+    LC_MEASUREMENT = "en_AU.UTF-8";
+    LC_MONETARY = "en_AU.UTF-8";
+    LC_NAME = "en_AU.UTF-8";
+    LC_NUMERIC = "en_AU.UTF-8";
+    LC_PAPER = "en_AU.UTF-8";
+    LC_TELEPHONE = "en_AU.UTF-8";
+    LC_TIME = "en_AU.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.nixosdd = {
+    isNormalUser = true;
+    description = "NixOS Dedicated Database";
+    extraGroups = ["networkmanager" "wheel"];
+    packages = with pkgs; [
+      #  thunderbird
+    ];
+  };
+
+  # Enable Tailscale
+  services.tailscale.enable = true;
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    helix
+    fastfetch
+    hyfetch
+    pgadmin4
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # List services that you want to enable:
+
+  # Enable PostgreSQL
+  services.postgresql = {
+    enable = true;
+    enableTCPIP = true;
+    ensureDatabases = ["forgejo"];
+    settings = {
+      listen_addresses = "*";
+    };
+    authentication = pkgs.lib.mkOverride 10 ''
+      local   all             all                                 trust
+      host    all             all             10.1.1.4/32         scram-sha-256
+      host    all             all             127.0.0.1/32        trust
+      host    all             all             ::1/128             trust
+    '';
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [5432]; # PostgreSQL default port
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.251";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+  environment.etc."resolv.conf".text = ''
+    nameserver 10.1.1.2
+  '';
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/dns/configuration-knot.nix

@@ -0,0 +1,391 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    (import "${home-manager}/nixos")
+  ];
+
+  ## Ensure that configuration is copied after installing this NixOS image
+  system.copySystemConfiguration = true;
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Bootloader - GRUB for Proxmox
+  # Bootloader - systemd-boot with UEFI
+  boot.loader.grub.enable = lib.mkForce false;
+  boot. loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  # Proxmox configuration
+  proxmox.qemuConf = {
+    bios = "ovmf"; # Use OVMF for UEFI
+  };
+
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+
+  networking.hostName = "nixosp"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.useDHCP = lib.mkDefault true;
+  # Serial console for Proxmox
+  boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
+  # Enable QEMU Guest for Proxmox integration
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # Copy this later to generate more custom users.
+  users.users.nixosp = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.nixosp = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing isues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Add the ability to create NixOS images
+    nixos-generators
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+
+    # Development tools
+    knot-dns
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # Attach the system to the IPFire network: set a static IP on the Proxmox bridge (vmbr0)
+  # Adjust `vmbr0` and the address below to your environment.
+  networking.interfaces.vmbr0.ipv4.addresses = [
+    {
+      address = "192.168.2.6";
+      prefixLength = 24;
+    } # Using this IP for DNS server
+  ];
+  networking.defaultGateway = "192.168.2.1";
+
+  # Make the system use your new DNS by default (optional)
+  networking.nameservers = ["192.168.2.6"];
+
+  # Expose DNS ports to the LAN
+  networking.firewall.allowedUDPPorts = lib.mkDefault [53];
+  networking.firewall.allowedTCPPorts = lib.mkDefault [53];
+
+  # Knot configuration using YAML-like settings supported by the Nix module
+  services.knot = {
+    enable = true;
+
+    settings = {
+      server = [
+        {
+          listen = ["192.168.2.6@53"];
+          identity = "knot-homelab";
+          pid-file = "/var/run/knot.pid";
+          # worker-count = 2;
+        }
+      ];
+
+      control = [
+        {
+          listen = "127.0.0.1@7520";
+        }
+      ];
+
+      log = [
+        {
+          target = "syslog";
+          any = "info";
+        }
+      ];
+    };
+  };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/dns/configuration-pihole-green.nix

@@ -0,0 +1,687 @@
+# Edit this configuration file to define what should be installed on
+# your system.   Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running 'nixos-help').
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    (import "${home-manager}/nixos")
+  ];
+
+  ## Ensure that configuration is copied after installing this NixOS image
+  system.copySystemConfiguration = true;
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev. lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix. package = pkgs.lixPackageSets.stable. lix;
+
+  # Bootloader - GRUB for Proxmox
+  # Bootloader - systemd-boot with UEFI
+  boot.loader.grub.enable = lib.mkForce false;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  # Proxmox configuration
+  proxmox.qemuConf = {
+    bios = "ovmf"; # Use OVMF for UEFI
+  };
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+
+  networking.hostName = "piholeprg"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager. enable = true;
+  networking. useDHCP = lib.mkDefault true;
+  # Serial console for Proxmox
+  boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
+  # Enable QEMU Guest for Proxmox integration
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time. timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver. xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services. gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  # Copy this later to generate more custom users.
+  users.users.piholeprg = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.piholeprg = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs. hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono. NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Configure LibreWolf browser
+    programs.librewolf = {
+      enable = true;
+      # Enable WebGL, cookies and history
+      settings = {
+        "webgl.disabled" = false;
+        "privacy.resistFingerprinting" = true;
+        "privacy.clearOnShutdown. history" = false;
+        "privacy.clearOnShutdown.cookies" = true;
+      };
+    };
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh. enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo. wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth. enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Add the ability to create NixOS images
+    nixos-generators
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+
+    # Development tools
+    knot-dns
+
+    # Browser for web interface access
+    librewolf
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  networking = {
+    hosts = {
+      "10.1.123.1" = ["ipfire.server.prg" "ipfire"];
+      "10.1.123.2" = ["pi-hole.server.prg" "pi-hole"];
+      # "10.1.123.15" = ["nas.server.prg" "nas"];
+    };
+  };
+
+  #
+  # Services
+  #
+  services = {
+    # I'm not actually using the dnsmasq service.  Pi-hole provides
+    # it's own dnsmasq. I'm using Nix' ability to manage the
+    # dnsmasq-style configuration file that Pi-hole utilizes.
+    dnsmasq = {
+      enable = false;
+      settings = {
+        address = [
+          #"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
+          #"/feelinsonice. appspot.com/ # Block Snapchat"
+          #"/snapchat.com/ # Block Snapchat"
+        ];
+        dhcp-name-match = [
+          #"set: hostname-ignore,wpad"
+          #"set:hostname-ignore,localhost"
+        ];
+        # Set DHCP option 6 to the DNS server you nodes should use.
+        dhcp-option = [
+          "vendor: MSFT,2,1i"
+          "6,10.1.123.2"
+        ];
+        domain = [
+          "server.prg,192.168.33.0/24,local"
+        ];
+      };
+    };
+
+    pihole-ftl = {
+      enable = true;
+      lists = [
+        {
+          url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
+          type = "block";
+          enabled = true;
+          description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
+        }
+      ];
+      openFirewallDNS = true;
+      openFirewallDHCP = true;
+      openFirewallWebserver = true;
+      queryLogDeleter.enable = true;
+      settings = {
+        # See https://docs.pi-hole.net/ftldns/configfile/
+        dhcp = {
+          active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
+          end = "10.1.123.254";
+          hosts = [
+            # Add new statics here
+          ];
+          ipv6 = true;
+          leaseTime = "1h";
+          start = "10.1.123.122";
+          rapidCommit = true;
+          multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
+          resolver = {
+            resolveIPv6 = false;
+          };
+          router = "10.1.123.1";
+        };
+
+        ### COMMENT THIS AFTER INSTALLATION!
+        misc. readOnly = false;
+        dns = {
+          cnameRecords = [
+            #"color-printer,office-printer"
+            #"color-printer. homelab. me,office-printer.homelab.me"
+          ];
+          domain = "server.prg";
+          domainNeeded = true;
+          expandHosts = true;
+          interface = "ens18";
+          hosts = [
+            "10.1.123.1   ipfire"
+            "10.1.123.2   pi-hole"
+            #"10.1.123.15  nas"
+          ];
+          upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
+        };
+        ntp = {
+          ipv4.active = true;
+          ipv6.active = true;
+          sync.active = true;
+        };
+        webserver = {
+          api = {
+            # To manage the web login:
+            # 1) Temporarily set misc.readOnly to false in
+            #    configuration.nix and switch to it.
+            # 2) Manually set a password:
+            #    Pi-hole web console > Settings > All settings >
+            #    Webserver and API > webserver. api.password > Value:  ******
+            # 3) Read the generated hash:
+            #    sudo pihole-FTL --config webserver.api.pwhash
+          };
+          session = {
+            timeout = 43200; # 12h
+          };
+        };
+      };
+      useDnsmasqConfig = true;
+    };
+
+    pihole-web = {
+      enable = true;
+      ports = [80];
+    };
+
+    resolved = {
+      extraConfig = ''
+        DNSStubListener=no
+        MulticastDNS=off
+      '';
+    };
+
+    # Unbound recursive DNS server configuration
+    # Based on Pi-hole + Unbound guide:  https://docs.pi-hole.net/guides/dns/unbound/
+    unbound = {
+      enable = true;
+      package = pkgs.unbound-with-systemd;
+
+      settings = {
+        server = {
+          # Listen only on localhost for Pi-hole queries
+          interface = ["127.0.0.1"];
+          port = 5335;
+
+          # Access control - only allow localhost
+          access-control = [
+            "127.0.0.0/8 allow"
+            "0.0.0.0/0 refuse"
+          ];
+
+          # Enable both IPv4 and IPv6
+          do-ip4 = true;
+          do-ip6 = true;
+          do-udp = true;
+          do-tcp = true;
+
+          # Prefer IPv4 (recommended for most setups)
+          prefer-ip6 = false;
+
+          # Security enhancements
+          harden-glue = true;
+          harden-dnssec-stripped = true;
+          use-caps-for-id = false; # Prevents DNSSEC issues
+
+          # Performance optimizations from Pi-hole guide
+          edns-buffer-size = 1232; # Prevents UDP fragmentation
+          prefetch = true; # Prefetch expiring cache entries
+
+          # Threading (1 thread sufficient for most home setups)
+          num-threads = 1;
+
+          # Increase socket buffer for high query rates
+          so-rcvbuf = "1m";
+
+          # Privacy - ensure no queries leak to public IPs
+          private-address = [
+            "192.168.0.0/16"
+            "169.254.0.0/16"
+            "172.16.0.0/12"
+            "10.0.0.0/8"
+            "fd00::/8"
+            "fe80::/10"
+            # RFC6303 addresses
+            "192.0.2.0/24"
+            "198.51.100.0/24"
+            "203.0.113.0/24"
+            "255.255.255.255/32"
+            "2001:db8::/32"
+          ];
+
+          # Logging configuration (set to 0 for production, higher for debugging)
+          verbosity = 0;
+          log-queries = false;
+
+          # Additional security
+          hide-identity = true;
+          hide-version = true;
+
+          # Cache settings
+          cache-min-ttl = 0;
+          cache-max-ttl = 86400;
+
+          # Hardening options
+          harden-below-nxdomain = true;
+          harden-referral-path = false;
+          harden-algo-downgrade = false;
+        };
+
+        # Optional: Forward to encrypted DNS (comment out for pure recursive)
+        # Uncomment below to use Quad9 with DNS-over-TLS
+        # forward-zone = [
+        #   {
+        #     name = ". ";
+        #     forward-addr = [
+        #       "9.9.9.9@853#dns.quad9.net"
+        #       "149.112.112.112@853#dns.quad9.net"
+        #     ];
+        #     forward-tls-upstream = true;
+        #   }
+        # ];
+      };
+    };
+  };
+
+  # Systemd configuration for Unbound and Pi-hole integration
+  systemd = {
+    # Create necessary directories and files
+    tmpfiles.rules = [
+      # Silence benign FTL. log warning
+      "f /etc/pihole/versions 0644 pihole pihole - -"
+
+      # Unbound directories (if needed for custom configs)
+      "d /var/lib/unbound 0755 unbound unbound - -"
+    ];
+
+    services = {
+      # Ensure Unbound starts before Pi-hole FTL
+      pihole-ftl = {
+        after = ["unbound.service"];
+        wants = ["unbound.service"];
+      };
+
+      # Automatic root hints updater (runs monthly)
+      unbound-root-hints-updater = {
+        description = "Update Unbound Root Hints";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
+            #!/usr/bin/env bash
+            set -euo pipefail
+
+            HINTS_FILE="/var/lib/unbound/root. hints"
+            TEMP_FILE=$(mktemp)
+
+            echo "Downloading latest root hints..."
+            ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
+
+            if [ -s "$TEMP_FILE" ]; then
+              mv "$TEMP_FILE" "$HINTS_FILE"
+              chown unbound:unbound "$HINTS_FILE"
+              chmod 644 "$HINTS_FILE"
+              echo "Root hints updated successfully"
+              systemctl restart unbound. service
+            else
+              echo "Failed to download root hints"
+              rm -f "$TEMP_FILE"
+              exit 1
+            fi
+          ''}";
+        };
+      };
+    };
+
+    timers = {
+      # Run root hints update monthly
+      unbound-root-hints-updater = {
+        description = "Monthly Unbound Root Hints Update";
+        wantedBy = ["timers.target"];
+        timerConfig = {
+          OnCalendar = "monthly";
+          Persistent = true;
+          RandomizedDelaySec = "1h";
+        };
+      };
+    };
+  };
+
+  # System activation scripts
+  system.activationScripts = {
+    print-pi-hole = {
+      text = builtins.trace "Building the pi-hole configuration..." "";
+    };
+
+    # Initialize unbound root hints on first boot
+    unbound-root-hints = {
+      text = ''
+        if [ ! -f /var/lib/unbound/root.hints ]; then
+          echo "Initializing Unbound root hints..."
+          ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
+            -o /var/lib/unbound/root.hints || true
+          if [ -f /var/lib/unbound/root.hints ]; then
+            chown unbound:unbound /var/lib/unbound/root. hints
+            chmod 644 /var/lib/unbound/root.hints
+          fi
+        fi
+      '';
+    };
+
+    # Fix socket buffer size warning
+    unbound-socket-buffer = {
+      text = ''
+        # Set kernel parameter for unbound socket buffer
+        if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
+          echo "Setting net.core.rmem_max=1048576 for Unbound"
+          sysctl -w net.core.rmem_max=1048576 || true
+        fi
+      '';
+    };
+  };
+
+  # Make socket buffer size permanent
+  boot.kernel.sysctl = {
+    "net.core.rmem_max" = 1048576; # 1MB for Unbound
+  };
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.123.2";
+      prefixLength = 24;
+    } # Using this IP for DNS server
+  ];
+  networking.defaultGateway = "10.1.123.1";
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ...  ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/dns/configuration-pihole-inside-system.nix

@@ -0,0 +1,688 @@
+# Edit this configuration file to define what should be installed on
+# your system.   Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running 'nixos-help').
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    (import "${home-manager}/nixos")
+  ];
+
+  ## Ensure that configuration is copied after installing this NixOS image
+  system.copySystemConfiguration = true;
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev. lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix. package = pkgs.lixPackageSets.stable. lix;
+
+  # Bootloader - GRUB for Proxmox
+  # Bootloader - systemd-boot with UEFI
+  boot.loader.grub.enable = lib.mkForce false;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  # Proxmox configuration
+  proxmox.qemuConf = {
+    bios = "ovmf"; # Use OVMF for UEFI
+  };
+
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+
+  networking.hostName = "piholeprg"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager. enable = true;
+  networking. useDHCP = lib.mkDefault true;
+  # Serial console for Proxmox
+  boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
+  # Enable QEMU Guest for Proxmox integration
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time. timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver. xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services. gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  # Copy this later to generate more custom users.
+  users.users.piholeprg = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.piholeprg = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs. hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono. NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Configure LibreWolf browser
+    programs.librewolf = {
+      enable = true;
+      # Enable WebGL, cookies and history
+      settings = {
+        "webgl.disabled" = false;
+        "privacy.resistFingerprinting" = true;
+        "privacy.clearOnShutdown. history" = false;
+        "privacy.clearOnShutdown.cookies" = true;
+      };
+    };
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh. enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo. wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth. enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Add the ability to create NixOS images
+    nixos-generators
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+
+    # Development tools
+    knot-dns
+
+    # Browser for web interface access
+    librewolf
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  networking = {
+    hosts = {
+      "10.1.1.1" = ["ipfire.server.prg" "ipfire"];
+      "10.1.1.2" = ["pi-hole.server.prg" "pi-hole"];
+      # "10.1.1.15" = ["nas.server.prg" "nas"];
+    };
+  };
+
+  #
+  # Services
+  #
+  services = {
+    # I'm not actually using the dnsmasq service.  Pi-hole provides
+    # it's own dnsmasq. I'm using Nix' ability to manage the
+    # dnsmasq-style configuration file that Pi-hole utilizes.
+    dnsmasq = {
+      enable = false;
+      settings = {
+        address = [
+          #"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
+          #"/feelinsonice. appspot.com/ # Block Snapchat"
+          #"/snapchat.com/ # Block Snapchat"
+        ];
+        dhcp-name-match = [
+          #"set: hostname-ignore,wpad"
+          #"set:hostname-ignore,localhost"
+        ];
+        # Set DHCP option 6 to the DNS server you nodes should use.
+        dhcp-option = [
+          "vendor: MSFT,2,1i"
+          "6,10.1.1.2"
+        ];
+        domain = [
+          "server.prg,192.168.33.0/24,local"
+        ];
+      };
+    };
+
+    pihole-ftl = {
+      enable = true;
+      lists = [
+        {
+          url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
+          type = "block";
+          enabled = true;
+          description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
+        }
+      ];
+      openFirewallDNS = true;
+      openFirewallDHCP = true;
+      openFirewallWebserver = true;
+      queryLogDeleter.enable = true;
+      settings = {
+        # See https://docs.pi-hole.net/ftldns/configfile/
+        dhcp = {
+          active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
+          end = "10.1.1.254";
+          hosts = [
+            # Add new statics here
+          ];
+          ipv6 = true;
+          leaseTime = "24h";
+          multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
+          start = "10.1.1.122";
+          rapidCommit = true;
+          resolver = {
+            resolveIPv6 = false;
+          };
+          router = "10.1.1.1";
+        };
+
+        ### COMMENT THIS AFTER INSTALLATION!
+        misc. readOnly = false;
+        dns = {
+          cnameRecords = [
+            #"color-printer,office-printer"
+            #"color-printer. homelab. me,office-printer.homelab.me"
+          ];
+          domain = "server.prg";
+          domainNeeded = true;
+          expandHosts = true;
+          interface = "ens18";
+          hosts = [
+            "10.1.1.1   ipfire"
+            "10.1.1.2   pi-hole"
+            #"10.1.1.15  nas"
+          ];
+          upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
+        };
+        ntp = {
+          ipv4.active = true;
+          ipv6.active = true;
+          sync.active = true;
+        };
+        webserver = {
+          api = {
+            # To manage the web login:
+            # 1) Temporarily set misc.readOnly to false in
+            #    configuration.nix and switch to it.
+            # 2) Manually set a password:
+            #    Pi-hole web console > Settings > All settings >
+            #    Webserver and API > webserver. api.password > Value:  ******
+            # 3) Read the generated hash:
+            #    sudo pihole-FTL --config webserver.api.pwhash
+          };
+          session = {
+            timeout = 43200; # 12h
+          };
+        };
+      };
+      useDnsmasqConfig = true;
+    };
+
+    pihole-web = {
+      enable = true;
+      ports = [80];
+    };
+
+    resolved = {
+      extraConfig = ''
+        DNSStubListener=no
+        MulticastDNS=off
+      '';
+    };
+
+    # Unbound recursive DNS server configuration
+    # Based on Pi-hole + Unbound guide:  https://docs.pi-hole.net/guides/dns/unbound/
+    unbound = {
+      enable = true;
+      package = pkgs.unbound-with-systemd;
+
+      settings = {
+        server = {
+          # Listen only on localhost for Pi-hole queries
+          interface = ["127.0.0.1"];
+          port = 5335;
+
+          # Access control - only allow localhost
+          access-control = [
+            "127.0.0.0/8 allow"
+            "0.0.0.0/0 refuse"
+          ];
+
+          # Enable both IPv4 and IPv6
+          do-ip4 = true;
+          do-ip6 = true;
+          do-udp = true;
+          do-tcp = true;
+
+          # Prefer IPv4 (recommended for most setups)
+          prefer-ip6 = false;
+
+          # Security enhancements
+          harden-glue = true;
+          harden-dnssec-stripped = true;
+          use-caps-for-id = false; # Prevents DNSSEC issues
+
+          # Performance optimizations from Pi-hole guide
+          edns-buffer-size = 1232; # Prevents UDP fragmentation
+          prefetch = true; # Prefetch expiring cache entries
+
+          # Threading (1 thread sufficient for most home setups)
+          num-threads = 1;
+
+          # Increase socket buffer for high query rates
+          so-rcvbuf = "1m";
+
+          # Privacy - ensure no queries leak to public IPs
+          private-address = [
+            "192.168.0.0/16"
+            "169.254.0.0/16"
+            "172.16.0.0/12"
+            "10.0.0.0/8"
+            "fd00::/8"
+            "fe80::/10"
+            # RFC6303 addresses
+            "192.0.2.0/24"
+            "198.51.100.0/24"
+            "203.0.113.0/24"
+            "255.255.255.255/32"
+            "2001:db8::/32"
+          ];
+
+          # Logging configuration (set to 0 for production, higher for debugging)
+          verbosity = 0;
+          log-queries = false;
+
+          # Additional security
+          hide-identity = true;
+          hide-version = true;
+
+          # Cache settings
+          cache-min-ttl = 0;
+          cache-max-ttl = 86400;
+
+          # Hardening options
+          harden-below-nxdomain = true;
+          harden-referral-path = false;
+          harden-algo-downgrade = false;
+        };
+
+        # Optional: Forward to encrypted DNS (comment out for pure recursive)
+        # Uncomment below to use Quad9 with DNS-over-TLS
+        # forward-zone = [
+        #   {
+        #     name = ". ";
+        #     forward-addr = [
+        #       "9.9.9.9@853#dns.quad9.net"
+        #       "149.112.112.112@853#dns.quad9.net"
+        #     ];
+        #     forward-tls-upstream = true;
+        #   }
+        # ];
+      };
+    };
+  };
+
+  # Systemd configuration for Unbound and Pi-hole integration
+  systemd = {
+    # Create necessary directories and files
+    tmpfiles.rules = [
+      # Silence benign FTL. log warning
+      "f /etc/pihole/versions 0644 pihole pihole - -"
+
+      # Unbound directories (if needed for custom configs)
+      "d /var/lib/unbound 0755 unbound unbound - -"
+    ];
+
+    services = {
+      # Ensure Unbound starts before Pi-hole FTL
+      pihole-ftl = {
+        after = ["unbound.service"];
+        wants = ["unbound.service"];
+      };
+
+      # Automatic root hints updater (runs monthly)
+      unbound-root-hints-updater = {
+        description = "Update Unbound Root Hints";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
+            #!/usr/bin/env bash
+            set -euo pipefail
+
+            HINTS_FILE="/var/lib/unbound/root. hints"
+            TEMP_FILE=$(mktemp)
+
+            echo "Downloading latest root hints..."
+            ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
+
+            if [ -s "$TEMP_FILE" ]; then
+              mv "$TEMP_FILE" "$HINTS_FILE"
+              chown unbound:unbound "$HINTS_FILE"
+              chmod 644 "$HINTS_FILE"
+              echo "Root hints updated successfully"
+              systemctl restart unbound. service
+            else
+              echo "Failed to download root hints"
+              rm -f "$TEMP_FILE"
+              exit 1
+            fi
+          ''}";
+        };
+      };
+    };
+
+    timers = {
+      # Run root hints update monthly
+      unbound-root-hints-updater = {
+        description = "Monthly Unbound Root Hints Update";
+        wantedBy = ["timers.target"];
+        timerConfig = {
+          OnCalendar = "monthly";
+          Persistent = true;
+          RandomizedDelaySec = "1h";
+        };
+      };
+    };
+  };
+
+  # System activation scripts
+  system.activationScripts = {
+    print-pi-hole = {
+      text = builtins.trace "Building the pi-hole configuration..." "";
+    };
+
+    # Initialize unbound root hints on first boot
+    unbound-root-hints = {
+      text = ''
+        if [ ! -f /var/lib/unbound/root.hints ]; then
+          echo "Initializing Unbound root hints..."
+          ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
+            -o /var/lib/unbound/root.hints || true
+          if [ -f /var/lib/unbound/root.hints ]; then
+            chown unbound:unbound /var/lib/unbound/root. hints
+            chmod 644 /var/lib/unbound/root.hints
+          fi
+        fi
+      '';
+    };
+
+    # Fix socket buffer size warning
+    unbound-socket-buffer = {
+      text = ''
+        # Set kernel parameter for unbound socket buffer
+        if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
+          echo "Setting net.core.rmem_max=1048576 for Unbound"
+          sysctl -w net.core.rmem_max=1048576 || true
+        fi
+      '';
+    };
+  };
+
+  # Make socket buffer size permanent
+  boot.kernel.sysctl = {
+    "net.core.rmem_max" = 1048576; # 1MB for Unbound
+  };
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.2";
+      prefixLength = 24;
+    } # Using this IP for DNS server
+  ];
+  networking.defaultGateway = "10.1.1.1";
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ...  ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/dns/configuration-pihole-orange.nix

@@ -0,0 +1,688 @@
+# Edit this configuration file to define what should be installed on
+# your system.   Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running 'nixos-help').
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    (import "${home-manager}/nixos")
+  ];
+
+  ## Ensure that configuration is copied after installing this NixOS image
+  system.copySystemConfiguration = true;
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev. lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix. package = pkgs.lixPackageSets.stable. lix;
+
+  # Bootloader - GRUB for Proxmox
+  # Bootloader - systemd-boot with UEFI
+  boot.loader.grub.enable = lib.mkForce false;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  # Proxmox configuration
+  proxmox.qemuConf = {
+    bios = "ovmf"; # Use OVMF for UEFI
+  };
+
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+
+  networking.hostName = "piholeprg"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager. enable = true;
+  networking. useDHCP = lib.mkDefault true;
+  # Serial console for Proxmox
+  boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
+  # Enable QEMU Guest for Proxmox integration
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time. timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver. xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services. gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  # Copy this later to generate more custom users.
+  users.users.piholeprg = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.piholeprg = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs. hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono. NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Configure LibreWolf browser
+    programs.librewolf = {
+      enable = true;
+      # Enable WebGL, cookies and history
+      settings = {
+        "webgl.disabled" = false;
+        "privacy.resistFingerprinting" = true;
+        "privacy.clearOnShutdown. history" = false;
+        "privacy.clearOnShutdown.cookies" = true;
+      };
+    };
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh. enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo. wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth. enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Add the ability to create NixOS images
+    nixos-generators
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+
+    # Development tools
+    knot-dns
+
+    # Browser for web interface access
+    librewolf
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  networking = {
+    hosts = {
+      "10.1.121.1" = ["ipfire.server.prg" "ipfire"];
+      "10.1.121.2" = ["pi-hole.server.prg" "pi-hole"];
+      # "10.1.121.15" = ["nas.server.prg" "nas"];
+    };
+  };
+
+  #
+  # Services
+  #
+  services = {
+    # I'm not actually using the dnsmasq service.  Pi-hole provides
+    # it's own dnsmasq. I'm using Nix' ability to manage the
+    # dnsmasq-style configuration file that Pi-hole utilizes.
+    dnsmasq = {
+      enable = false;
+      settings = {
+        address = [
+          #"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
+          #"/feelinsonice. appspot.com/ # Block Snapchat"
+          #"/snapchat.com/ # Block Snapchat"
+        ];
+        dhcp-name-match = [
+          #"set: hostname-ignore,wpad"
+          #"set:hostname-ignore,localhost"
+        ];
+        # Set DHCP option 6 to the DNS server you nodes should use.
+        dhcp-option = [
+          "vendor: MSFT,2,1i"
+          "6,10.1.121.2"
+        ];
+        domain = [
+          "server.prg,192.168.33.0/24,local"
+        ];
+      };
+    };
+
+    pihole-ftl = {
+      enable = true;
+      lists = [
+        {
+          url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
+          type = "block";
+          enabled = true;
+          description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
+        }
+      ];
+      openFirewallDNS = true;
+      openFirewallDHCP = true;
+      openFirewallWebserver = true;
+      queryLogDeleter.enable = true;
+      settings = {
+        # See https://docs.pi-hole.net/ftldns/configfile/
+        dhcp = {
+          active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
+          end = "10.1.121.254";
+          hosts = [
+            # Add new statics here
+          ];
+          ipv6 = true;
+          leaseTime = "24h";
+          multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
+          start = "10.1.121.122";
+          rapidCommit = true;
+          resolver = {
+            resolveIPv6 = false;
+          };
+          router = "10.1.121.1";
+        };
+
+        ### COMMENT THIS AFTER INSTALLATION!
+        misc. readOnly = false;
+        dns = {
+          cnameRecords = [
+            #"color-printer,office-printer"
+            #"color-printer. homelab. me,office-printer.homelab.me"
+          ];
+          domain = "server.prg";
+          domainNeeded = true;
+          expandHosts = true;
+          interface = "ens18";
+          hosts = [
+            "10.1.121.1   ipfire"
+            "10.1.121.2   pi-hole"
+            #"10.1.121.15  nas"
+          ];
+          upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
+        };
+        ntp = {
+          ipv4.active = true;
+          ipv6.active = true;
+          sync.active = true;
+        };
+        webserver = {
+          api = {
+            # To manage the web login:
+            # 1) Temporarily set misc.readOnly to false in
+            #    configuration.nix and switch to it.
+            # 2) Manually set a password:
+            #    Pi-hole web console > Settings > All settings >
+            #    Webserver and API > webserver. api.password > Value:  ******
+            # 3) Read the generated hash:
+            #    sudo pihole-FTL --config webserver.api.pwhash
+          };
+          session = {
+            timeout = 43200; # 12h
+          };
+        };
+      };
+      useDnsmasqConfig = true;
+    };
+
+    pihole-web = {
+      enable = true;
+      ports = [80];
+    };
+
+    resolved = {
+      extraConfig = ''
+        DNSStubListener=no
+        MulticastDNS=off
+      '';
+    };
+
+    # Unbound recursive DNS server configuration
+    # Based on Pi-hole + Unbound guide:  https://docs.pi-hole.net/guides/dns/unbound/
+    unbound = {
+      enable = true;
+      package = pkgs.unbound-with-systemd;
+
+      settings = {
+        server = {
+          # Listen only on localhost for Pi-hole queries
+          interface = ["127.0.0.1"];
+          port = 5335;
+
+          # Access control - only allow localhost
+          access-control = [
+            "127.0.0.0/8 allow"
+            "0.0.0.0/0 refuse"
+          ];
+
+          # Enable both IPv4 and IPv6
+          do-ip4 = true;
+          do-ip6 = true;
+          do-udp = true;
+          do-tcp = true;
+
+          # Prefer IPv4 (recommended for most setups)
+          prefer-ip6 = false;
+
+          # Security enhancements
+          harden-glue = true;
+          harden-dnssec-stripped = true;
+          use-caps-for-id = false; # Prevents DNSSEC issues
+
+          # Performance optimizations from Pi-hole guide
+          edns-buffer-size = 1232; # Prevents UDP fragmentation
+          prefetch = true; # Prefetch expiring cache entries
+
+          # Threading (1 thread sufficient for most home setups)
+          num-threads = 1;
+
+          # Increase socket buffer for high query rates
+          so-rcvbuf = "1m";
+
+          # Privacy - ensure no queries leak to public IPs
+          private-address = [
+            "192.168.0.0/16"
+            "169.254.0.0/16"
+            "172.16.0.0/12"
+            "10.0.0.0/8"
+            "fd00::/8"
+            "fe80::/10"
+            # RFC6303 addresses
+            "192.0.2.0/24"
+            "198.51.100.0/24"
+            "203.0.113.0/24"
+            "255.255.255.255/32"
+            "2001:db8::/32"
+          ];
+
+          # Logging configuration (set to 0 for production, higher for debugging)
+          verbosity = 0;
+          log-queries = false;
+
+          # Additional security
+          hide-identity = true;
+          hide-version = true;
+
+          # Cache settings
+          cache-min-ttl = 0;
+          cache-max-ttl = 86400;
+
+          # Hardening options
+          harden-below-nxdomain = true;
+          harden-referral-path = false;
+          harden-algo-downgrade = false;
+        };
+
+        # Optional: Forward to encrypted DNS (comment out for pure recursive)
+        # Uncomment below to use Quad9 with DNS-over-TLS
+        # forward-zone = [
+        #   {
+        #     name = ". ";
+        #     forward-addr = [
+        #       "9.9.9.9@853#dns.quad9.net"
+        #       "149.112.112.112@853#dns.quad9.net"
+        #     ];
+        #     forward-tls-upstream = true;
+        #   }
+        # ];
+      };
+    };
+  };
+
+  # Systemd configuration for Unbound and Pi-hole integration
+  systemd = {
+    # Create necessary directories and files
+    tmpfiles.rules = [
+      # Silence benign FTL. log warning
+      "f /etc/pihole/versions 0644 pihole pihole - -"
+
+      # Unbound directories (if needed for custom configs)
+      "d /var/lib/unbound 0755 unbound unbound - -"
+    ];
+
+    services = {
+      # Ensure Unbound starts before Pi-hole FTL
+      pihole-ftl = {
+        after = ["unbound.service"];
+        wants = ["unbound.service"];
+      };
+
+      # Automatic root hints updater (runs monthly)
+      unbound-root-hints-updater = {
+        description = "Update Unbound Root Hints";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
+            #!/usr/bin/env bash
+            set -euo pipefail
+
+            HINTS_FILE="/var/lib/unbound/root. hints"
+            TEMP_FILE=$(mktemp)
+
+            echo "Downloading latest root hints..."
+            ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
+
+            if [ -s "$TEMP_FILE" ]; then
+              mv "$TEMP_FILE" "$HINTS_FILE"
+              chown unbound:unbound "$HINTS_FILE"
+              chmod 644 "$HINTS_FILE"
+              echo "Root hints updated successfully"
+              systemctl restart unbound. service
+            else
+              echo "Failed to download root hints"
+              rm -f "$TEMP_FILE"
+              exit 1
+            fi
+          ''}";
+        };
+      };
+    };
+
+    timers = {
+      # Run root hints update monthly
+      unbound-root-hints-updater = {
+        description = "Monthly Unbound Root Hints Update";
+        wantedBy = ["timers.target"];
+        timerConfig = {
+          OnCalendar = "monthly";
+          Persistent = true;
+          RandomizedDelaySec = "1h";
+        };
+      };
+    };
+  };
+
+  # System activation scripts
+  system.activationScripts = {
+    print-pi-hole = {
+      text = builtins.trace "Building the pi-hole configuration..." "";
+    };
+
+    # Initialize unbound root hints on first boot
+    unbound-root-hints = {
+      text = ''
+        if [ ! -f /var/lib/unbound/root.hints ]; then
+          echo "Initializing Unbound root hints..."
+          ${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
+            -o /var/lib/unbound/root.hints || true
+          if [ -f /var/lib/unbound/root.hints ]; then
+            chown unbound:unbound /var/lib/unbound/root. hints
+            chmod 644 /var/lib/unbound/root.hints
+          fi
+        fi
+      '';
+    };
+
+    # Fix socket buffer size warning
+    unbound-socket-buffer = {
+      text = ''
+        # Set kernel parameter for unbound socket buffer
+        if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
+          echo "Setting net.core.rmem_max=1048576 for Unbound"
+          sysctl -w net.core.rmem_max=1048576 || true
+        fi
+      '';
+    };
+  };
+
+  # Make socket buffer size permanent
+  boot.kernel.sysctl = {
+    "net.core.rmem_max" = 1048576; # 1MB for Unbound
+  };
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.121.2";
+      prefixLength = 24;
+    } # Using this IP for DNS server
+  ];
+  networking.defaultGateway = "10.1.121.1";
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ...  ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/docker-containers/services/part-db/docker-compose.yml

@@ -0,0 +1,61 @@
+version: '3.3'
+services:
+  partdb:
+    container_name: partdb
+    # By default Part-DB will be running under Port 8080, you can change it here
+    ports:
+      - '633:80'
+    volumes:
+      # By default
+      - ./uploads:/var/www/html/uploads
+      - ./public_media:/var/www/html/public/media
+      - ./db:/var/www/html/var/db
+    restart: unless-stopped
+    image: jbtronics/part-db1:latest
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.myservice.rule=Host(`myservice.YOUR.DOMAIN`)"
+      - "traefik.http.routers.myservice.entrypoints=websecure"
+      - "traefik.http.services.myservice.loadbalancer. server.port=80"
+    depends_on:
+      - database
+    environment:
+      # Replace 4321112sss with the value of MYSQL_PASSWORD from below
+      - DATABASE_URL=mysql://partdb:4321112sss@database:3306/partdb
+      # In docker env logs will be redirected to stderr
+      - APP_ENV=docker
+
+        # Uncomment this, if you want to use the automatic database migration feature. With this you do not have to
+        # run the doctrine:migrations:migrate commands on installation or upgrade. A database backup is written to the uploads/
+        # folder (under .automigration-backup), so you can restore it, if the migration fails.
+        # This feature is currently experimental, so use it at your own risk!
+      - DB_AUTOMIGRATE=true
+
+      # You can configure Part-DB using the webUI or environment variables
+      # However you can add any other environment configuration you want here
+      # See .env file for all available options or https://docs.part-db.de/configuration.html
+
+      # Override value if you want to show a given text on homepage.
+      # When this is commented out the webUI can be used to configure the banner
+      #- BANNER=This is a test banner<br>with a line break
+
+      # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
+      # - COMPOSER_EXTRA_PACKAGES=symfony/mailgun-mailer symfony/sendgrid-mailer
+
+  database:
+    container_name: partdb_database
+    image: mysql:8.0
+    restart: unless-stopped
+    command: --default-authentication-plugin=mysql_native_password --log-bin-trust-function-creators=1
+    environment:
+      # Change this Password
+      MYSQL_ROOT_PASSWORD: jijoioajdiojasdas1123
+      MYSQL_DATABASE: partdb
+      MYSQL_USER: partdb
+      MYSQL_PASSWORD: 4321112sss
+    # Uncomment the following line if you need to access, your MySQL database from outside of docker (e.g. for debugging), normally you should leave that disabled
+    #ports:
+    #  - '4306:3306'
+    volumes:
+      - ./mysql:/var/lib/mysql
+

nix-system-configs/forgejo/forgejo-git-post.nix

@@ -0,0 +1,418 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+in {
+  # Home Manager Configuration
+  imports = [
+    # Include the results of the hardware scan.
+    (import "${home-manager}/nixos")
+  ];
+
+  networking.hostName = "forgejoprg"; # Define your hostname.
+  # BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+
+  users.users.forgejoprg = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.forgejoprg = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Enable Fedgejo service
+  services.nginx = {
+    enable = true;
+    virtualHosts."git.prg.local" = {
+      # Remove forceSSL and enableACME for local network
+      # forceSSL = true;
+      # enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+    };
+  };
+
+  # Enable PostgreSQL for Forgejo
+  services.postgresql.enable = true;
+
+  # Forgejo configuration
+  services.forgejo = {
+    enable = true;
+    database = {
+      type = "postgres";
+      host = "10.1.1.251"; # IP of your database server
+      name = "forgejo";
+      user = "forgejo";
+      passwordFile = "/home/nixosbm/manual_builds/password.txt"; # Store password in a separate file for security
+    };
+    lfs.enable = true;
+
+    settings = {
+      server = {
+        DOMAIN = "git.prg.local";
+        ROOT_URL = "http://${srv.DOMAIN}/";
+        HTTP_PORT = 3000;
+        # SSH integration
+        SSH_PORT = lib.head config.services.openssh.ports;
+      };
+
+      # Temporarily allow registration to create admin user
+      service.DISABLE_REGISTRATION = false;
+
+      # Enable Actions support
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+
+      # Optional: Email configuration
+      # mailer = {
+      #   ENABLED = false;
+      # };
+    };
+  };
+
+  # Bootloader - GRUB for Legacy BIOS
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda"; # Install GRUB to the disk
+    efiSupport = false; # Disable UEFI
+  };
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+  fileSystems."/" = {
+    device = "/dev/vda1";
+    fsType = "ext4"; # Use "btrfs" or "xfs" if you formatted it differently
+  };
+
+  # Enable Rsync
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_AU.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+    arp-scan
+
+    # Monitoring
+    btop
+    htop
+    iotop
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [3000];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.4";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+
+  # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
+  nix.distributedBuilds = true;
+  nix.buildMachines = [
+    {
+      hostName = "nixos-build-machine";
+      system = "x86_64-linux";
+      sshUser = "nixremote";
+      sshKey = "/root/.ssh/nixremote";
+      maxJobs = 4;
+      speedFactor = 2;
+      supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
+    }
+  ];
+
+  # Generate SSH key for remote building
+  systemd.services.generate-nixremote-key = {
+    description = "Generate SSH key for remote Nix builds";
+    wantedBy = ["multi-user.target"];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      if [ ! -f /root/.ssh/nixremote ]; then
+        ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
+      fi
+    '';
+  };
+
+  programs.ssh.extraConfig = ''
+    Host nixos-build-machine
+      HostName 10.1.1.3
+      IdentitiesOnly yes
+      IdentityFile /root/.ssh/nixremote
+      User nixremoteStrictHostKeyChecking accept-new
+  '';
+
+  # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
+  # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
+  # then rebuild the build machine.
+  # i.e on the client: run "cat /root.ssh/nixremote.pub"
+  # and copy the output to the build machine's configuration.nix
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/forgejo/forgejo-git.nix

@@ -0,0 +1,415 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+in {
+  # Home Manager Configuration
+  imports = [
+    # Include the results of the hardware scan.
+    (import "${home-manager}/nixos")
+  ];
+
+  networking.hostName = "forgejoprg"; # Define your hostname.
+  # BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+
+  users.users.forgejoprg = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  home-manager.users.forgejoprg = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Enable Fedgejo service
+  services.nginx = {
+    enable = true;
+    virtualHosts."git.prg.local" = {
+      # Remove forceSSL and enableACME for local network
+      # forceSSL = true;
+      # enableACME = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
+    };
+  };
+
+  # Enable PostgreSQL for Forgejo
+  services.postgresql.enable = true;
+
+  # Forgejo configuration
+  services.forgejo = {
+    enable = true;
+    database = {
+      type = "postgres";
+      host = "10.1.1.251"; # IP of your database server
+      name = "forgejo";
+      user = "forgejo";
+      passwordFile = "/home/nixosbm/manual_builds/password.txt"; # Store password in a separate file for security
+    };
+    lfs.enable = true;
+
+    settings = {
+      server = {
+        DOMAIN = "git.prg.local";
+        ROOT_URL = "http://${srv.DOMAIN}/";
+        HTTP_PORT = 3000;
+        # SSH integration
+        SSH_PORT = lib.head config.services.openssh.ports;
+      };
+
+      # Temporarily allow registration to create admin user
+      service.DISABLE_REGISTRATION = false;
+
+      # Enable Actions support
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "github";
+      };
+
+      # Optional: Email configuration
+      # mailer = {
+      #   ENABLED = false;
+      # };
+    };
+  };
+
+  # Bootloader - GRUB for Legacy BIOS
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda"; # Install GRUB to the disk
+    efiSupport = false; # Disable UEFI
+  };
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+  virtualisation.diskSize = 19432; # 96GB in MiB
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_AU.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+    arp-scan
+
+    # Monitoring
+    btop
+    htop
+    iotop
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [3000];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.4";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+
+  # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
+  nix.distributedBuilds = true;
+  nix.buildMachines = [
+    {
+      hostName = "nixos-build-machine";
+      system = "x86_64-linux";
+      sshUser = "nixremote";
+      sshKey = "/root/.ssh/nixremote";
+      maxJobs = 4;
+      speedFactor = 2;
+      supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
+    }
+  ];
+
+  # Generate SSH key for remote building
+  systemd.services.generate-nixremote-key = {
+    description = "Generate SSH key for remote Nix builds";
+    wantedBy = ["multi-user.target"];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      if [ ! -f /root/.ssh/nixremote ]; then
+        ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
+      fi
+    '';
+  };
+
+  programs.ssh.extraConfig = ''
+    Host nixos-build-machine
+      HostName 10.1.1.3
+      IdentitiesOnly yes
+      IdentityFile /root/.ssh/nixremote
+      User nixremoteStrictHostKeyChecking accept-new
+  '';
+
+  # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
+  # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
+  # then rebuild the build machine.
+  # i.e on the client: run "cat /root.ssh/nixremote.pub"
+  # and copy the output to the build machine's configuration.nix
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/gateway/gateway.nix

@@ -0,0 +1,330 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    (import "${home-manager}/nixos")
+  ];
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    default = 0;
+    enable = true;
+    useOSProber = true;
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+    device = "nodev";
+  };
+
+  #boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  networking.hostName = "nixosp"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.interfaces.wlo1.ipv4.addresses = [
+    {
+      address = "192.168.1.15";
+      prefixLength = 32;
+    }
+  ];
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # Copy this later to generate more custom users.
+  users.users.nixosp = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+  };
+
+  home-manager.users.nixosp = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "fastfetch"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/nixos-gateway.nix

@@ -256,7 +256,6 @@
     ];
   };
 
-
   # Passwordless sudo for wheel group
   security.sudo.wheelNeedsPassword = false;
 

nix-system-configs/prg-blank-setup/blank-proxmox-partition.nix

@@ -0,0 +1,358 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    (import "${home-manager}/nixos")
+  ];
+
+  ## Ensure that configuration is copied after installing this NixOS image
+  system.copySystemConfiguration = true;
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Bootloader - GRUB for Proxmox
+  # Bootloader - systemd-boot with UEFI
+  boot.loader.grub.enable = lib.mkForce false;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+
+  # Proxmox configuration
+  proxmox.qemuConf = {
+    bios = "ovmf"; # Use OVMF for UEFI
+  };
+
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+
+  networking.hostName = "nixosp"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.useDHCP = lib.mkDefault true;
+  # Serial console for Proxmox
+  boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
+  # Enable QEMU Guest for Proxmox integration
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # Copy this later to generate more custom users.
+  users.users.nixosp = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+    initialPassword = "nixos"; # Simple, change on first login
+  };
+
+  # Configure LibreWolf browser
+  programs.librewolf = {
+    enable = true;
+    # Enable WebGL, cookies and history
+    settings = {
+      "webgl.disabled" = false;
+      "privacy.resistFingerprinting" = true;
+      "privacy.clearOnShutdown.history" = false;
+      "privacy.clearOnShutdown.cookies" = true;
+    };
+  };
+
+  home-manager.users.nixosp = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina # System info backend
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Add the ability to create NixOS images
+    nixos-generators
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # Attach the system to the IPFire network: set a static IP on the Proxmox bridge (vmbr0)
+  # Adjust `vmbr0` and the address below to your environment.
+  networking.interfaces.vmbr0.ipv4.addresses = [
+    {
+      address = "10.1.1.22";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

nix-system-configs/prg-blank-setup/example.nix

@@ -0,0 +1,354 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration-knot.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
+in {
+  # Home Manager Configuration
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    (import "${home-manager}/nixos")
+  ];
+
+  networking.hostName = "nixosp"; # Define your hostname.
+  # BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+
+  users.users.nixosp = {
+    isNormalUser = true;
+    description = "NixOS Playground";
+    extraGroups = ["networkmanager" "wheel" "seat"];
+    packages = with pkgs; [];
+  };
+
+  home-manager.users.nixosp = {pkgs, ...}: {
+    home.packages = [
+      pkgs.atool
+      pkgs.httpie
+      pkgs.alacritty # Terminal emulator
+      pkgs.hyfetch # Add fetching packages
+      pkgs.macchina
+      pkgs.wayland # Wayland display server
+      pkgs.wlroots # Wayland compositor library
+      pkgs.maple-mono.NF # Font for better terminal appearance
+      pkgs.wl-clipboard # Clipboard utilities for Wayland
+      pkgs.mako # Wayland Sway Notification Daemon
+      pkgs.btop # Resource monitor
+    ];
+
+    # Set Alacritty as the default terminal emulator
+    home.sessionVariables = {
+      TERMINAL = "alacritty";
+    };
+
+    # Use Zsh as the default shell
+    programs.zsh.enable = true;
+
+    # Configure Alacritty as the default terminal emulator
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        # Window configuration
+        window = {
+          opacity = 1.0;
+          padding = {
+            x = 10;
+            y = 10;
+          };
+        };
+
+        # Font configuration - fixes spacing issues
+        font = {
+          normal = {
+            family = "Maple Mono NF";
+            style = "Regular";
+          };
+          bold = {
+            family = "Maple Mono NF";
+            style = "Bold";
+          };
+          italic = {
+            family = "Maple Mono NF";
+            style = "Italic";
+          };
+          bold_italic = {
+            family = "Maple Mono NF";
+            style = "Bold Italic";
+          };
+          size = 14.0;
+        };
+
+        # Colors (optional - using default Alacritty colors)
+        colors = {
+          primary = {
+            background = "#1e1e2e";
+            foreground = "#cdd6f4";
+          };
+        };
+      };
+    };
+
+    # Configure Hyfetch system info fetcher
+    programs.hyfetch = {
+      enable = true;
+      settings = {
+        preset = "lesbian"; # Use lesbian flag preset
+        mode = "rgb"; # Use RGB color mode
+        lightness = 0.55; # Set to 55% brightness
+        backend = "macchina"; # Use macchina as the backend
+        logo_size = "small"; # Make small logo
+        pride_month_disable = false; # Enable pride month mode (or true to disable)
+        pride_month_shown = []; # List of shown pride month flags
+        color_align = {
+          mode = "horizontal";
+        };
+      };
+    };
+
+    # The state version is required and should stay at the version you
+    # originally installed.
+    home.stateVersion = "25.11";
+  };
+
+  # Use Lix instead of Nix
+  nixpkgs.overlays = [
+    (final: prev: {
+      inherit
+        (prev.lixPackageSets.stable)
+        nixpkgs-review
+        nix-eval-jobs
+        nix-fast-build
+        colmena
+        ;
+    })
+  ];
+
+  nix.package = pkgs.lixPackageSets.stable.lix;
+
+  # Enable Bootloader for Proxmox partition setup
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda"; # Install GRUB to the disk
+    efiSupport = false; # Disable UEFI
+  };
+  boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
+  fileSystems."/" = {
+    device = "/dev/vda1";
+    fsType = "ext4"; # Use "btrfs" or "xfs" if you formatted it differently
+  };
+  #        virtualisation.diskSize = 19432; # 96GB in MiB
+
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Enable Rsymc
+  services.rsync.enable = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.interfaces.wlo1.ipv4.addresses = [
+    {
+      address = "192.168.1.15";
+      prefixLength = 32;
+    }
+  ];
+
+  # Enable SSH
+  services.openssh = {
+    enable = true;
+    ports = [22];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      UseDns = true;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Copenhagen";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "et_EE.UTF-8";
+    LC_IDENTIFICATION = "et_EE.UTF-8";
+    LC_MEASUREMENT = "et_EE.UTF-8";
+    LC_MONETARY = "et_EE.UTF-8";
+    LC_NAME = "et_EE.UTF-8";
+    LC_NUMERIC = "et_EE.UTF-8";
+    LC_PAPER = "et_EE.UTF-8";
+    LC_TELEPHONE = "et_EE.UTF-8";
+    LC_TIME = "et_EE.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable Seatd for Wayland sessions
+  # IMPORTANT: Enable seatd service for River WM
+  services.seatd = {
+    enable = true;
+    logLevel = "info";
+  };
+
+  # Enable the gnome-keyring secrets vault.
+  # Will be exposed through DBus to programs willing to store secrets.
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable Sway window manager
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Configure security to allow seatd access
+  security.polkit.enable = true;
+
+  # Configure GPU support
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # Passwordless sudo for wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Hardware U2F support - Passwordless sudo with hardware key
+  security.pam.u2f = {
+    enable = true;
+    settings = {
+      authfile = "/etc/u2f_keys";
+      cue = true;
+      pinverification = 0; # No PIN verification
+      userpresence = 1; # Require user presence (touch)
+    };
+  };
+
+  # SSH Agent authentication
+  security.pam.sshAgentAuth.enable = true;
+
+  # Automatic upgrades
+  system.autoUpgrade = {
+    enable = true; # Set to true for automatic updates
+    dates = "daily";
+    allowReboot = false;
+  };
+
+  # System packages
+  environment.systemPackages = with pkgs; [
+    # Network tools
+    wget
+    curl
+    dig
+    tcpdump
+    ethtool
+    iptables
+    nftables
+    iproute2
+    bridge-utils
+    netcat-gnu
+    traceroute
+    mtr
+
+    # Monitoring
+    btop
+    htop
+    iotop
+    bandwhich
+
+    # Editors
+    micro
+    vim
+    helix
+
+    # Add ability to generate NixOS images
+    nixos-generators
+
+    # System info
+    fastfetch
+    lshw
+    pciutils
+    usbutils
+
+    # Filesystem utilities
+    btrfs-progs
+    e2fsprogs
+    ntfs3g
+    dosfstools
+    os-prober
+  ];
+
+  # Enable zram swap
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Attach the system to the IPFire network:  set a static IP on the Proxmox bridge (ens18)
+  # Adjust `ens18` and the address below to your environment.
+  networking.interfaces.ens18.ipv4.addresses = [
+    {
+      address = "10.1.1.XXX";
+      prefixLength = 24;
+    }
+  ];
+  networking.defaultGateway = "10.1.1.1";
+  environment.etc."resolv.conf".text = ''
+    nameserver 10.1.1.2
+  '';
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}