flake.lock: Update

Flake lock file updates:

• Updated input 'lix':
    'daadfed9ae.tar.gz?narHash=sha256-tRg8zU/ZzWWWH%2BwnqW9o1NbgbgaquLR0shHUA5Sm%2Bbg%3D' (2026-03-20)
  → '66d702d28d.tar.gz?narHash=sha256-mSqGD2H8XxPKCwEWN08IejYS253csZewtVOk7M0Gkv0%3D' (2026-03-21)

.gitignore

@@ -1,2 +1,2 @@
 .envrc
-
+system/services/containerization/authentik.nix

flake.lock

@@ -23,11 +23,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1765121682,
-        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
@@ -94,11 +94,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765980955,
-        "narHash": "sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs+zlQ07dGQFk4=",
+        "lastModified": 1774007980,
+        "narHash": "sha256-FOnZjElEI8pqqCvB6K/1JRHTE8o4rer8driivTpq2uo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "89c9508bbe9b40d36b3dc206c2483ef176f15173",
+        "rev": "9670de2921812bc4e0452f6e3efd8c859696c183",
         "type": "github"
       },
       "original": {
@@ -110,11 +110,11 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1766001599,
-        "narHash": "sha256-avWZpy84s8bdMGsbOjfc4n0LYUqR5H5+Wj4QmgwsBzg=",
-        "rev": "32d7c02b96259d05f50a482c2b7e55d59a70294c",
+        "lastModified": 1774114723,
+        "narHash": "sha256-mSqGD2H8XxPKCwEWN08IejYS253csZewtVOk7M0Gkv0=",
+        "rev": "66d702d28d273a07a0e15ecfac03447dbee274cc",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/32d7c02b96259d05f50a482c2b7e55d59a70294c.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/66d702d28d273a07a0e15ecfac03447dbee274cc.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -133,11 +133,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764519849,
-        "narHash": "sha256-XnNABKfIYKSimQVvKc9FnlC2H0LurOhd9MS6l0Z67lE=",
-        "rev": "6c95c0b6f73f831226453fc6905c216ab634c30f",
+        "lastModified": 1773460763,
+        "narHash": "sha256-y9kC3ff89btXS8RD6pAtM50g0qtsim1I8HXBtgSqdbI=",
+        "rev": "5e56f5a973e24292b125dca9e9d506b0a91d6903",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/6c95c0b6f73f831226453fc6905c216ab634c30f.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/5e56f5a973e24292b125dca9e9d506b0a91d6903.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -150,11 +150,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1765841014,
-        "narHash": "sha256-55V0AJ36V5Egh4kMhWtDh117eE3GOjwq5LhwxDn9eHg=",
+        "lastModified": 1773882647,
+        "narHash": "sha256-VzcOcE0LLpEnyoxLuMuptZ9ZWCkSBn99bTgEQoz5Viw=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "be4af8042e7a61fa12fda58fe9a3b3babdefe17b",
+        "rev": "fd0eae98d1ecee31024271f8d64676250a386ee7",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1765472234,
-        "narHash": "sha256-9VvC20PJPsleGMewwcWYKGzDIyjckEz8uWmT0vCDYK0=",
+        "lastModified": 1773734432,
+        "narHash": "sha256-IF5ppUWh6gHGHYDbtVUyhwy/i7D261P7fWD1bPefOsw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2fbfb1d73d239d2402a8fe03963e37aab15abe8b",
+        "rev": "cda48547b432e8d3b18b4180ba07473762ec8558",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1765779637,
-        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
+        "lastModified": 1773821835,
+        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
         "type": "github"
       },
       "original": {

home/autumn/sysconfs/hoardfrost.nix

@@ -10,9 +10,11 @@
       gnumake
       neofetch
       oh-my-zsh
+      home-manager
     ];
   };
-  xdg.configFile."starship.toml".source = ./packages/starship/starship.toml;
+  xdg.configFile."starship.toml".source = ../../packages/starship/starship.toml;
+  xdg.configFile."rust-motd/rust-motd.kdl".source = ../../packages/rust-motd/rust-motd.kdl;
   # programs.bash.initExtra = [
   #   "zsh"
   #   "starship init zsh"
@@ -25,6 +27,10 @@
     userName = "autumn";
   };
 
+  imports = [
+    ../../packages/zellij/zellij.nix
+  ];
+
   programs.zsh = {
     enable = true;
     antidote = {

home/packages/rust-motd/rust-motd.kdl

@@ -0,0 +1,28 @@
+global {
+	version "1.0"
+}
+components{
+	command color="blue" "hostname | figlet -f sblood"
+	weather loc="Denver" style="full"
+	service-status{
+		service display-name="samba" unit="samba-wsdd.service"
+		service display-name="openssh" unit="sshd.service"
+		service display-name="mealie" unit="podman-mealie.service"
+		service display-name="mealiedb" unit="podman-postgres.service"
+		service display-name="stirling" unit="podman-stirling-pdf.service"
+		service display-name="tbrowser" unit="podman-torrent-browser.service"
+		service display-name="seas" unit="podman-trainsmission-openvpn.service"
+		service display-name="tailscale" unit="tailscaled.service"
+		service display-name="firewall" unit="firewall.service"
+		service display-name="endlessh" unit="endlessh.service"
+	}
+	uptime prefix="up"
+	memory swap-pos="beside"
+	last-login {
+		user username="marcel" num-logins=2
+	}
+	filesystems {
+		filesystem name="root" mount-point="/"
+	}
+	load-avg format="Load (1, 5, 15 min.): {one:.02}, {five:.02}, {fifteen:.02}"
+}

home/packages/sway/sway.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+
+{
+
+home.packages = with pkgs; [
+];
+
+  programs. = {
+    enable = true;
+  
+  };
+  
+}
+

system/hoardfrost/configuration.nix

@@ -13,14 +13,16 @@
     ../services/samba.nix
     ../services/openssh.nix
     ../services/endlessh.nix
+    ../services/podman.nix
     # ./services/currents.nix
     #. ./services/tailscale.nix.
 
     # ./services/containerization/currents.nix
     ../services/containerization/docker.nix
-    ../services/containerization/mealie.nix
+    ../services/containerization/mealie-2.nix
     ../services/containerization/transtun.nix
     ../services/containerization/stirlingpdf.nix
+    #../services/containerization/authentik.nix #teehee secrets in file, regenerate if lost
   ];
 
   # Bootloader.
@@ -120,16 +122,15 @@
     nil
     inetutils
     nh
-    toybox
+    busybox
     nodejs_24
     jdk17
     rustup
+    compose2nix
+    openssl
     #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
     #  wget
   ];
-  virtualisation.podman = {
-    enable = true;
-  };
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.

system/hoardfrost/hardware-configuration.nix

@@ -24,6 +24,11 @@
       options = [ "fmask=0077" "dmask=0077" ];
     };
 
+  fileSystems."/srv/samba/hoardfrost/mainstore/media" = {
+    device = "/dev/disk/by-uuid/2ca2827b-405a-4eb4-b6ba-98620c0a07c8";
+    fsType = "ext4";
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

system/packages/rust-motd/rust-motd.nix

@@ -23,13 +23,13 @@
         command = "hostname | figlet -f sblood";
       };
       weather = {
-        loc = "Denver,Colorado";
-        style = "full";
+        url = "https://wttr.in/denver?0";
       };
       service_status = {
         samba = "samba-wsdd.service";
         openssh = "sshd.service";
-        mealie = "podman-postgres-mealie.service";
+        mealie = "podman-mealie.service";
+        mealiedb = "podman-postgres.service";
         stirling = "podman-stirling-pdf.service";
         tbrowser = "podman-torrent-browser.service";
         seas = "podman-transmission-openvpn.service";
@@ -41,13 +41,14 @@
         prefix = "up";
       };
       memory = {
-        swap_pos = "beside";
+        swap_pos = "none";
       };
       last_login = {
         autumn = 2;
       };
       filesystems = {
         root = "/";
+        mediastore = "/srv/samba/hoardfrost/mainstore/media";
       };
       load_avg = {
         format = "Load (1, 5, 15 min.): {one:.02}, {five:.02}, {fifteen:.02}";

system/services/containerization/mealie-2.nix

@@ -0,0 +1,148 @@
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, config, ... }:
+
+{
+  # Containers
+  virtualisation.oci-containers.containers."mealie" = {
+    image = "ghcr.io/mealie-recipes/mealie:v3.6.1";
+    environment = {
+      "ALLOW_SIGNUP" = "false";
+      "BASE_URL" = "https://mealie.yourdomain.com";
+      "DB_ENGINE" = "postgres";
+      "PGID" = "1000";
+      "POSTGRES_DB" = "mealie";
+      "POSTGRES_PASSWORD" = "mealie";
+      "POSTGRES_PORT" = "5432";
+      "POSTGRES_SERVER" = "postgres";
+      "POSTGRES_USER" = "mealie";
+      "PUID" = "1000";
+      "TZ" = "America/Denver";
+    };
+    volumes = [
+      "mealie-data:/app/data:rw"
+    ];
+    ports = [
+      "9925:9000/tcp"
+    ];
+    dependsOn = [
+      "postgres"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--memory=1048576000b"
+      "--network-alias=mealie"
+      "--network=mealieio_default"
+    ];
+  };
+  systemd.services."podman-mealie" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-mealieio_default.service"
+      "podman-volume-mealieio_mealie-data.service"
+    ];
+    requires = [
+      "podman-network-mealieio_default.service"
+      "podman-volume-mealieio_mealie-data.service"
+    ];
+    partOf = [
+      "podman-compose-mealieio-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mealieio-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."postgres" = {
+    image = "postgres:17";
+    environment = {
+      "PGUSER" = "mealie";
+      "POSTGRES_DB" = "mealie";
+      "POSTGRES_PASSWORD" = "mealie";
+      "POSTGRES_USER" = "mealie";
+    };
+    volumes = [
+      "mealie-pgdata:/var/lib/postgresql/data:rw"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--health-cmd=[\"pg_isready\"]"
+      "--health-interval=30s"
+      "--health-retries=3"
+      "--health-timeout=20s"
+      "--network-alias=postgres"
+      "--network=mealieio_default"
+    ];
+  };
+  systemd.services."podman-postgres" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-mealieio_default.service"
+      "podman-volume-mealieio_mealie-pgdata.service"
+    ];
+    requires = [
+      "podman-network-mealieio_default.service"
+      "podman-volume-mealieio_mealie-pgdata.service"
+    ];
+    partOf = [
+      "podman-compose-mealieio-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mealieio-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-mealieio_default" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f mealieio_default";
+    };
+    script = ''
+      podman network inspect mealieio_default || podman network create mealieio_default
+    '';
+    partOf = [ "podman-compose-mealieio-root.target" ];
+    wantedBy = [ "podman-compose-mealieio-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."podman-volume-mealieio_mealie-data" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect mealieio_mealie-data || podman volume create mealieio_mealie-data
+    '';
+    partOf = [ "podman-compose-mealieio-root.target" ];
+    wantedBy = [ "podman-compose-mealieio-root.target" ];
+  };
+  systemd.services."podman-volume-mealieio_mealie-pgdata" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect mealieio_mealie-pgdata || podman volume create mealieio_mealie-pgdata
+    '';
+    partOf = [ "podman-compose-mealieio-root.target" ];
+    wantedBy = [ "podman-compose-mealieio-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-mealieio-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

system/services/podman.nix

@@ -0,0 +1,20 @@
+
+{ pkgs, lib, config, ... }:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    # dockerCompat = true;
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces = let
+    matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+  in {
+    "${matchAll}".allowedUDPPorts = [ 53 ];
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+}

system/yukigekko/configuration.nix

@@ -93,6 +93,7 @@
     cifs-utils
     polkit
     waypaper
+    ristretto
     # wayland
     # wayland-protocols
     # libxkbcommon