From 99ad3058a35caefdd2ca44ccd18b4872bfffb7e1 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 11 Mar 2026 19:24:17 +0700
Subject: [PATCH 001/427] integrate sops-nix for secret management

---
 .sops.yaml                         | 25 +++++++++++++
 modules/system/homelab/auth.nix    |  4 +-
 modules/system/homelab/dash.nix    |  4 +-
 modules/system/homelab/pass.nix    |  4 +-
 modules/system/homelab/proxy.nix   |  7 ++--
 modules/system/homelab/sops.nix    | 59 ++++++++++++++++++++++++++++++
 modules/system/homelab/tunnels.nix |  8 ++--
 modules/system/server.nix          |  5 ++-
 scripts/check-sops.sh              | 30 +++++++++++++++
 secrets/homelab.yaml               | 11 ++++++
 10 files changed, 141 insertions(+), 16 deletions(-)
 create mode 100644 .sops.yaml
 create mode 100644 modules/system/homelab/sops.nix
 create mode 100755 scripts/check-sops.sh
 create mode 100644 secrets/homelab.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..a2c7b59
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,25 @@
+# To set up sops-nix:
+# 1. Generate an age key on each host:
+#      mkdir -p ~/.config/sops/age
+#      age-keygen -o ~/.config/sops/age/keys.txt
+#    Or derive from the host SSH key:
+#      nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
+#
+# 2. Replace the placeholder age keys below with the actual public keys.
+#
+# 3. Encrypt secret files:
+#      sops secrets/homelab.yaml
+#
+# 4. To re-key after changing keys:
+#      sops updatekeys secrets/homelab.yaml
+
+keys:
+  - &homelab age1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX # replace with: ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
+  - &admin   age1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX # replace with: age-keygen output from your admin machine
+
+creation_rules:
+  - path_regex: secrets/homelab\.yaml$
+    key_groups:
+      - age:
+          - *homelab
+          - *admin
\ No newline at end of file
diff --git a/modules/system/homelab/auth.nix b/modules/system/homelab/auth.nix
index 57823b9..62e4f39 100644
--- a/modules/system/homelab/auth.nix
+++ b/modules/system/homelab/auth.nix
@@ -1,7 +1,7 @@
-{ homelab, ... }: {
+{ config, homelab, ... }: {
   services.pocket-id = {
     enable = true;
-    credentials.ENCRYPTION_KEY = "/mnt/data/pocketid/encryption-key";
+    credentials.ENCRYPTION_KEY = config.sops.secrets.pocketid_encryption_key.path;
     dataDir = "/mnt/data/pocketid/data";
     settings = {
       PORT = "1411";
diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 3923242..a27e591 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -1,4 +1,4 @@
-{ timezone, homelab, ... }: let 
+{ config, timezone, homelab, ... }: let 
   rss = [
     "https://www.raspberrypi.com/news/feed/"
     "https://www.jeffgeerling.com/blog.xml"
@@ -96,7 +96,7 @@ in {
   };
   services.glance = {
     enable = true;
-    environmentFile = "/var/lib/glance/.env";
+    environmentFile = config.sops.secrets.glance_env.path;
     settings = {
       server = {
         host = "127.0.0.1";
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 89ea489..d3f5805 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -1,9 +1,9 @@
-{ homelab, ... }: {
+{ config, homelab, ... }: {
   services.vaultwarden = {
     enable = true;
     domain = "pass.proxy.${homelab.domain}";
     backupDir = "/mnt/data/vaultwarden/backups";
-    environmentFile = "/mnt/data/vaultwarden/.env";
+    environmentFile = config.sops.secrets.vaultwarden_env.path;
     config = {
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 85671a5..37909e7 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,4 +1,4 @@
-{ homelab, lib, ... }: let
+{ config, homelab, lib, ... }: let
   base = "proxy.${homelab.domain}";
   hosts = {
     "server"     = { dest = "https://server.dns.${homelab.domain}:8006"; auth = false; };
@@ -45,8 +45,7 @@ in {
       domain = "*.${base}";
       extraDomainNames = [ base ];
       dnsProvider = "cloudflare";
-      environmentFile = "/var/lib/acme/cloudflare.env";
-      # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
+      environmentFile = config.sops.templates."cloudflare.env".path;
     };
   };
   
@@ -81,7 +80,7 @@ in {
         locations."/" = {
           proxyPass = cfg.dest;
           proxyWebsockets = true;
-          basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
+          basicAuthFile = if cfg.auth then config.sops.secrets.nginx_htpasswd.path else null;
           extraConfig = exta-conf;
         };
       }) hosts;
diff --git a/modules/system/homelab/sops.nix b/modules/system/homelab/sops.nix
new file mode 100644
index 0000000..4ce61b7
--- /dev/null
+++ b/modules/system/homelab/sops.nix
@@ -0,0 +1,59 @@
+{ config, ... }: {
+  sops = {
+    defaultSopsFile = ../../../secrets/homelab.yaml;
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+    secrets = {
+      cloudflare_dns_api_token = {
+        owner = "acme";
+        group = "acme";
+      };
+
+      cloudflared_tunnel_credentials = {
+        owner = "cloudflared";
+        group = "cloudflared";
+      };
+
+      cloudflared_cert = {
+        owner = "cloudflared";
+        group = "cloudflared";
+      };
+
+      vaultwarden_env = {
+        owner = "vaultwarden";
+        group = "vaultwarden";
+        restartUnits = [ "vaultwarden.service" ];
+      };
+
+      glance_env = {
+        owner = "glance";
+        group = "glance";
+        restartUnits = [ "glance.service" ];
+      };
+
+      pocketid_encryption_key = {
+        owner = "root";
+        group = "root";
+        restartUnits = [ "pocket-id.service" ];
+      };
+
+      tailscale_authkey = {
+        owner = "root";
+        group = "root";
+        restartUnits = [ "tailscaled.service" ];
+      };
+
+      nginx_htpasswd = {
+        owner = "nginx";
+        group = "nginx";
+        restartUnits = [ "nginx.service" ];
+      };
+    };
+
+    templates."cloudflare.env" = {
+      owner = "acme";
+      group = "acme";
+      content = "CLOUDFLARE_DNS_API_TOKEN=${config.sops.placeholder.cloudflare_dns_api_token}";
+    };
+  };
+}
\ No newline at end of file
diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index 8cf0fb6..4c5402a 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, homelab, ... }: let
+{ config, pkgs, lib, homelab, ... }: let
   routes = {
     "git.${homelab.domain}"     = "http://localhost:5080";
     "auth.${homelab.domain}"    = "http://localhost:1411";
@@ -10,8 +10,8 @@ in {
   services.cloudflared = {
     enable = true;
     tunnels.homelab = {
-      credentialsFile = "/mnt/data/cloudflared/homelab.json";
-      certificateFile = "/mnt/data/cloudflared/cert.pem";
+      credentialsFile = config.sops.secrets.cloudflared_tunnel_credentials.path;
+      certificateFile = config.sops.secrets.cloudflared_cert.path;
       default = "http_status:404";
       ingress = routes;
     };
@@ -31,7 +31,7 @@ in {
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert ${config.sops.secrets.cloudflared_cert.path} route dns ${homelab.cf-tunnel-id} ${domain} || true
     '') (builtins.attrNames routes);
   };
 }
diff --git a/modules/system/server.nix b/modules/system/server.nix
index fc7e686..0b1e3d9 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -1,4 +1,4 @@
-{ lib, homelab, ... }: let
+{ config, lib, homelab, ... }: let
   ts-flags = [
     "--advertise-exit-node"
     "--advertise-routes=10.3.14.0/24,192.168.1.0/24"
@@ -20,6 +20,7 @@ in {
     ./homelab/dns.nix
     ./homelab/git.nix
     ./homelab/ai.nix
+    ./homelab/sops.nix
     
     ./core/swapfile.nix
     ./core/oom.nix
@@ -29,7 +30,7 @@ in {
 
   services.tailscale = {
     enable = true;
-    authKeyFile = "/mnt/data/tailscale/authkey";
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
     useRoutingFeatures = "server";
     extraUpFlags = ts-flags;
     extraSetFlags = ts-flags;
diff --git a/scripts/check-sops.sh b/scripts/check-sops.sh
new file mode 100755
index 0000000..dd4daf2
--- /dev/null
+++ b/scripts/check-sops.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Pre-commit hook: block commits containing unencrypted sops secret files.
+# Install with: ln -sf ../../scripts/check-sops.sh .git/hooks/pre-commit
+
+set -euo pipefail
+
+staged_secrets=$(git diff --cached --name-only --diff-filter=ACM -- 'secrets/*.yaml' 'secrets/*.yml' 'secrets/*.json')
+
+if [ -z "$staged_secrets" ]; then
+    exit 0
+fi
+
+failed=0
+
+for file in $staged_secrets; do
+    # sops-encrypted YAML/JSON files always contain a top-level "sops" key with metadata
+    if ! git show ":$file" | grep -q '"sops"\|sops:'; then
+        echo "ERROR: $file is not encrypted with sops! Encrypt it first:"
+        echo "       sops $file"
+        echo
+        echo "hint: bypass with: git commit --no-verify"
+        failed=1
+    fi
+done
+
+if [ "$failed" -ne 0 ]; then
+    echo ""
+    echo "Commit aborted. Encrypt secret files before committing."
+    exit 1
+fi
\ No newline at end of file
diff --git a/secrets/homelab.yaml b/secrets/homelab.yaml
new file mode 100644
index 0000000..93cb53a
--- /dev/null
+++ b/secrets/homelab.yaml
@@ -0,0 +1,11 @@
+# This file should be encrypted with sops before committing.
+# Run: sops secrets/homelab.yaml
+# All values below are placeholders. Replace them with actual values.
+cloudflare_dns_api_token: REPLACE_ME
+cloudflared_tunnel_credentials: REPLACE_ME
+cloudflared_cert: REPLACE_ME
+vaultwarden_env: REPLACE_ME
+glance_env: REPLACE_ME
+pocketid_encryption_key: REPLACE_ME
+tailscale_authkey: REPLACE_ME
+nginx_htpasswd: REPLACE_ME

From 65bffeaa79dc83a5e49a5508d7e382cfa14d478d Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 11 Mar 2026 22:52:02 +0700
Subject: [PATCH 002/427] update bar macro

---
 modules/home/rice/waybar.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/rice/waybar.nix b/modules/home/rice/waybar.nix
index 461bdac..27a04dd 100644
--- a/modules/home/rice/waybar.nix
+++ b/modules/home/rice/waybar.nix
@@ -45,8 +45,8 @@
           interval = 1;
           format = " {usage:2}% {avg_frequency}GHz";
           on-click = "auto-cpufreq-gtk";
-          on-click-right = "pkexec tlp power-saver && notify-send ${hostname} \"TLP set to: $(tlp-stat -s | grep 'Power profile' | awk -F '=' '{print $2}' | xargs)\"";
-          on-click-middle = "pkexec tlp start && notify-send ${hostname} \"TLP set to: $(tlp-stat -s | grep 'Power profile' | awk -F '=' '{print $2}' | xargs)\"";
+          on-click-right = "pkexec auto-cpufreq --force powersave && notify-send ${hostname} \"CPU Governor Powersave Overide\"";
+          on-click-middle = "pkexec auto-cpufreq --force reset && notify-send ${hostname} \"CPU Governor Overide Reset\"";
         };
         "memory" = {
           states = {

From ea698f46b5ff899d64a4bc55b7b70f7fa24e776a Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 11 Mar 2026 22:58:40 +0700
Subject: [PATCH 003/427] use zen kernel

---
 modules/hardware/thinkpad.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/hardware/thinkpad.nix b/modules/hardware/thinkpad.nix
index c52765d..f7e193a 100644
--- a/modules/hardware/thinkpad.nix
+++ b/modules/hardware/thinkpad.nix
@@ -12,7 +12,7 @@
   ];
 
   boot = {
-    kernelPackages = pkgs.linuxPackages;
+    kernelPackages = pkgs.linuxPackages_zen;
     kernel.sysctl."vm.laptop_mode" = 5;
     initrd.availableKernelModules = [ "thinkpad_acpi" ];
     kernelParams = [

From 4bc1e961a2b007cd13289236f4239a981c437115 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 15:15:55 +0700
Subject: [PATCH 004/427] remove proton mail

---
 modules/home/core/apps.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 13146b3..e08ee37 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -8,7 +8,7 @@
 
       slack
       discord
-      protonmail-desktop
+      # protonmail-desktop # https://www.reddit.com/r/NixOS/comments/1rm9alf/protonmail_in_nixos/
       
       vlc
       brave

From 9708e59cf4e6425d4aecd74dfc5cc4d92c2d634d Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 16:02:22 +0700
Subject: [PATCH 005/427] tweaks and fixes

---
 modules/home/core/zsh.nix      | 2 +-
 modules/home/rice/hyprland.nix | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/home/core/zsh.nix b/modules/home/core/zsh.nix
index a1c27ae..ca4bd4f 100644
--- a/modules/home/core/zsh.nix
+++ b/modules/home/core/zsh.nix
@@ -66,7 +66,7 @@
         "gh-author-setup" = "git config user.name $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user | jq -r .login) && git config user.email $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user/emails | jq -r \".[1].email\")";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";
         
-        "mcl" = "portablemc start -l $(cat .minecraft/portablemc-launch-params.json | jq -r .email) $(cat .minecraft/portablemc-launch-params.json | jq -r .version)";
+        "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version)";
         "mc" = "ferium upgrade; mcl";
       };
       initContent = ''
diff --git a/modules/home/rice/hyprland.nix b/modules/home/rice/hyprland.nix
index 2db9add..b701605 100644
--- a/modules/home/rice/hyprland.nix
+++ b/modules/home/rice/hyprland.nix
@@ -155,7 +155,8 @@
         "stay_focused on, suppress_event fullscreen maximize, dim_around on, float on, match:title ^(Hyprland Polkit Agent|Unlock Login Keyring|KeePassXC -.*)$"
         "float on, match:title ^(Open|Print|Save|Rename|Move|Copy|Confirm).*"
         "float on, match:title ^(Preferences|Settings|Options|About|Passbolt).*"
-        "float on, match:title ^(MainPicker|Volume Control|File Operation Progress|Network Connections|Choose an Application| )$"
+        "float on, match:title ^(MainPicker|Volume Control|File Operation Progress|Network Connections|Choose an Application)$"
+        "float on, match:title ^(Please wait)$"
       ];
     };
   };

From bfd72420f17eeb4895acaa21d296d5e190dcf811 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 17:05:03 +0700
Subject: [PATCH 006/427] add modrinth handler and some other tweaks

---
 modules/home/core/xdg.nix             |  1 -
 modules/home/core/zed.nix             |  8 +++++++-
 modules/home/desktop.nix              |  1 +
 modules/home/misc/scheme-handlers.nix | 18 ++++++++++++++++++
 modules/home/rice/keybinds.nix        |  4 +---
 5 files changed, 27 insertions(+), 5 deletions(-)
 create mode 100644 modules/home/misc/scheme-handlers.nix

diff --git a/modules/home/core/xdg.nix b/modules/home/core/xdg.nix
index 141e9c0..ffc2a13 100644
--- a/modules/home/core/xdg.nix
+++ b/modules/home/core/xdg.nix
@@ -9,7 +9,6 @@
         "application/pdf" = "brave-browser.desktop";
         "x-scheme-handler/http" = "brave-browser.desktop";
         "x-scheme-handler/https" = "brave-browser.desktop";
-        "x-scheme-handler/terminal" = "kitty.desktop";
         "x-terminal-emulator" = "kitty.desktop";
         "inode/directory" = "pcmanfm-qt.desktop";
         "audio/mpeg" = "vlc.desktop";
diff --git a/modules/home/core/zed.nix b/modules/home/core/zed.nix
index 8c6ff8e..99bb706 100644
--- a/modules/home/core/zed.nix
+++ b/modules/home/core/zed.nix
@@ -5,7 +5,6 @@
     extensions = [ "nix" ];
     userSettings = {
       format_on_save = "off";
-      features.edit_prediction_provider = "copilot";
       vim_mode = true;
       git.inline_blame.enabled = true;
       gutter.line_numbers = true;
@@ -19,6 +18,13 @@
       file_types.tailwindcss = [ "*.css" ];
       auto_install_extensions.catppuccin-icons = true;
       icon_theme = "Catppuccin Mocha";
+      agent = {
+        tool_permissions.default = "allow";
+        default_model = {
+          provider = "copilot_chat";
+          model = "claude-opus-4.6";
+        };
+      };
       theme = {
         mode = "dark";
         light = "Catppuccin Mocha (sapphire)";
diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index 3c71de0..a7a0bc1 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -10,6 +10,7 @@
     ./rice/cursor.nix
     ./rice/theme.nix
     ./rice/keybinds.nix
+    ./misc/scheme-handlers.nix
     ./misc/kde-connect.nix
     ./core/apps.nix
     ./core/zed.nix
diff --git a/modules/home/misc/scheme-handlers.nix b/modules/home/misc/scheme-handlers.nix
new file mode 100644
index 0000000..dc7c0e8
--- /dev/null
+++ b/modules/home/misc/scheme-handlers.nix
@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+let
+  ferium-installer-script = pkgs.writeShellScript "ferium-installer" ''
+    mod=$(echo "$1" | awk -F'/' '{print $NF}')
+    ${pkgs.kitty}/bin/kitty sh -c "ferium add $mod; read"
+  '';
+in
+{
+  xdg.desktopEntries."ferium-installer" = {
+    name = "Intercept Modrinth Links to Ferium";
+    exec = "${ferium-installer-script} %u";
+    mimeType = [ "x-scheme-handler/modrinth" ];
+  };
+
+  xdg.mimeApps.defaultApplications = {
+    "x-scheme-handler/modrinth" = "ferium-installer.desktop";
+  }; 
+}
\ No newline at end of file
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index d84ed78..d0c4d97 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -106,9 +106,7 @@
         ", PRINT, exec, hyprshot -zm region -o ~/Pictures/Screenshots; killall -9 hyprpicker hyprshot"
 
         "SUPER, R, exec, rofi -show drun -show-icons -display-drun '' -run-command \"uwsm app -- {cmd}\""
-        "SUPER, RETURN, exec, rofi -show window -show-icons -drun-display '' -window-format '{c} {t}'"
-        "SUPER CTRL, RETURN, exec, rofi rofi -dmenu -p 'run nixpkgs' -lines 0 < /dev/null | xargs -r -I {} kitty -- nix run 'nixpkgs#{}'"
-        "SUPER ALT, RETURN, exec, rofi rofi -dmenu -p 'shell nixpkgs' -lines 0 < /dev/null | xargs -r -I {} kitty -- nde`ix shell 'nixpkgs#{}'"
+        "SUPER, RETURN, exec, ls ~/Projects | rofi -dmenu -p \"Open Project\" | xargs -I {} sh -c 'mkdir -p ~/Projects/\"{}\" && zeditor ~/Projects/\"{}\"'"
         "SUPER, V, exec, rofi -modi clipboard:cliphist-rofi-img -show clipboard -show-icons"
         # "SUPER, B, exec, rofi -show calc -modi calc -no-show-match -no-sort"
 

From a36bd9d945a22279737c140227576230072d473d Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 21:23:10 +0700
Subject: [PATCH 007/427] enable push to create

---
 modules/system/homelab/git.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 68aa3d9..e5a48ca 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -42,6 +42,7 @@
       repository = {
         DISABLE_STARS = true;
         DISABLE_FORKS = true;
+        ENABLE_PUSH_CREATE_USER = true;
       };
     };
   };

From 188c8309dd0a4167d710de10db41281fc5e727df Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 21:50:30 +0700
Subject: [PATCH 008/427] fix monitor not found

---
 modules/system/homelab/dash.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 3923242..b739573 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -70,7 +70,7 @@
     [ "PocketID" "authentik" "https://auth.${homelab.domain}" "http://localhost:1411/" ]
     [ "Forgejo" "forgejo" "https://git.${homelab.domain}" "http://localhost:5080/" ]
     [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
-    [ "Traefik" "traefikproxy" "https://dynamic.proxy.${homelab.domain}/dashboard/" "http://localhost:81/dashboard/" ]
+    [ "Traefik" "traefikproxy" "https://dynamic.proxy.${homelab.domain}/dashboard/" "" ]
     [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]
     [ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ]
     [ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ]

From 62591b1d5ab09e9a62aab41ef3d40957b5863467 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 21:54:33 +0700
Subject: [PATCH 009/427] unauthorized is good

---
 modules/system/homelab/dash.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index b739573..fd8c9f0 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -255,6 +255,7 @@ in {
                         title = builtins.elemAt e 0;
                         icon = "si:${builtins.elemAt e 1}";
                         url = builtins.elemAt e 2;
+                        alt-status-codes = [ 401 ];
                       }) bookmarks;
                     }
                   ];

From 6ca1d51cba2089387e6353b1351590a0a634a985 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 12 Mar 2026 22:01:23 +0700
Subject: [PATCH 010/427] add usermap

---
 modules/system/homelab/remote.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/remote.nix b/modules/system/homelab/remote.nix
index 2eae11e..c8b6671 100644
--- a/modules/system/homelab/remote.nix
+++ b/modules/system/homelab/remote.nix
@@ -8,6 +8,7 @@
     guacamole-client = {
       enable = true;
       enableWebserver = true;
+      userMappingXml = "/mnt/data/guacamole/user-mapping.xml";
       settings = {
         guacd-hostname = "127.0.0.1";
         guacd-port = 4822;

From 556fce950df53d2721f9ee747dd48ba715ee6142 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 10:35:09 +0700
Subject: [PATCH 011/427] error lens and keybind fix

---
 modules/home/core/zed.nix      | 11 +++++++++++
 modules/home/rice/keybinds.nix |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/modules/home/core/zed.nix b/modules/home/core/zed.nix
index 99bb706..67342c3 100644
--- a/modules/home/core/zed.nix
+++ b/modules/home/core/zed.nix
@@ -18,6 +18,17 @@
       file_types.tailwindcss = [ "*.css" ];
       auto_install_extensions.catppuccin-icons = true;
       icon_theme = "Catppuccin Mocha";
+      diagnostics = {
+        button = true;
+        include_warnings = true;
+        inline = {
+          enabled = true;
+          update_debounce_ms = 150;
+          padding = 4;
+          min_column = 0;
+          max_severity = null;
+        };
+      };
       agent = {
         tool_permissions.default = "allow";
         default_model = {
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index d0c4d97..4fdf413 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -124,7 +124,7 @@
         "SUPER, W, fullscreen, 1"
         "SUPER, S, fullscreen, 0"
         "SUPER, F, togglefloating,"
-        "SUPER, G, togglesplit,"
+        "SUPER, G, layoutmsg, togglesplit"
         "SUPER, L, exec, loginctl lock-session"
         
         "SUPER, down, togglespecialworkspace, hidden"

From da966f152278fee5ce569eb3cf9299f66948f12a Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 10:38:05 +0700
Subject: [PATCH 012/427] enable git tree view

---
 modules/home/core/zed.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/zed.nix b/modules/home/core/zed.nix
index 67342c3..9060a36 100644
--- a/modules/home/core/zed.nix
+++ b/modules/home/core/zed.nix
@@ -18,6 +18,7 @@
       file_types.tailwindcss = [ "*.css" ];
       auto_install_extensions.catppuccin-icons = true;
       icon_theme = "Catppuccin Mocha";
+      git_panel.tree_view = true;
       diagnostics = {
         button = true;
         include_warnings = true;

From 95dfaa9888ff2f3cbf48dbf3ae29a1e4021d1332 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 11:05:21 +0700
Subject: [PATCH 013/427] add ntfy and searxng along with other tweaks

---
 modules/system/homelab/dash.nix   |  2 ++
 modules/system/homelab/notify.nix |  9 +++++++++
 modules/system/homelab/proxy.nix  |  2 ++
 modules/system/homelab/search.nix | 19 +++++++++++++++++++
 modules/system/server.nix         |  4 +++-
 5 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 modules/system/homelab/notify.nix
 create mode 100644 modules/system/homelab/search.nix

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index fd8c9f0..97ddade 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -75,6 +75,8 @@
     [ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ]
     [ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ]
     [ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ]
+    [ "Ntfy" "ntfy" "https://notify.proxy.${homelab.domain}" "http://localhost:8067/" ]
+    [ "SearXNG" "searxng" "https://search.proxy.${homelab.domain}" "http://localhost:8091/" ]
     [ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ]
     [ "Guacamole" "apacheguacamole" "https://remote.proxy.${homelab.domain}/guacamole" "http://localhost:8085/guacamole/" ]
   ];
diff --git a/modules/system/homelab/notify.nix b/modules/system/homelab/notify.nix
new file mode 100644
index 0000000..48fbd12
--- /dev/null
+++ b/modules/system/homelab/notify.nix
@@ -0,0 +1,9 @@
+{ homelab, ... }: {
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      listen-http = "127.0.0.1:8067";
+      base-url = "https://ntfy.proxy.${homelab.domain}";
+    };
+  };
+}
\ No newline at end of file
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 85671a5..206abed 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -55,6 +55,8 @@ in {
       enable = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
       virtualHosts = {
         "_" = {
           default = true;
diff --git a/modules/system/homelab/search.nix b/modules/system/homelab/search.nix
new file mode 100644
index 0000000..3c41aed
--- /dev/null
+++ b/modules/system/homelab/search.nix
@@ -0,0 +1,19 @@
+{ ... }: {
+  services.searx = {
+    enable = true;
+    redisCreateLocally = true;
+    settings = {
+      server = {
+        bind_address = "127.0.0.1";
+        port = 8091;
+      };
+      general = {
+        debug = false;
+        donation_url = false;
+        contact_url = false;
+        privacy_policy_url = false;
+        enable_metrics = true;
+      };
+    };
+  };
+}
\ No newline at end of file
diff --git a/modules/system/server.nix b/modules/system/server.nix
index fc7e686..e86d6fa 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -2,7 +2,7 @@
   ts-flags = [
     "--advertise-exit-node"
     "--advertise-routes=10.3.14.0/24,192.168.1.0/24"
-    "--ssh" # "--webclient"
+    "--ssh" "--webclient"
   ];
 in {
   imports = [
@@ -12,6 +12,8 @@ in {
     ./homelab/gallery.nix
     ./homelab/tunnels.nix
     ./homelab/remote.nix
+    ./homelab/notify.nix
+    ./homelab/search.nix
     ./homelab/media.nix
     ./homelab/proxy.nix
     ./homelab/auth.nix

From fba19b47cc93edcae5c1b4986df1ed03327371ad Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 11:08:27 +0700
Subject: [PATCH 014/427] add proxy entries

---
 modules/system/homelab/proxy.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 206abed..b8a9054 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -11,6 +11,8 @@
     "containers" = { dest = "http://localhost:5001"; auth = false; };
     "gallery"    = { dest = "http://localhost:2283"; auth = false; };
     "remote"     = { dest = "http://localhost:8085"; auth = false; };
+    "search"     = { dest = "http://localhost:8091"; auth = false; };
+    "notify"     = { dest = "http://localhost:8067"; auth = false; };
     "media"      = { dest = "http://localhost:8096"; auth = false; };
     "pass"       = { dest = "http://localhost:8060"; auth = false; };
     "auth"       = { dest = "http://localhost:1411"; auth = false; };

From 946f4dc081f6e1493c825716087ec02f7e52ae8c Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 11:14:42 +0700
Subject: [PATCH 015/427] fix add secret key

---
 modules/system/homelab/search.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/homelab/search.nix b/modules/system/homelab/search.nix
index 3c41aed..30d3118 100644
--- a/modules/system/homelab/search.nix
+++ b/modules/system/homelab/search.nix
@@ -2,10 +2,12 @@
   services.searx = {
     enable = true;
     redisCreateLocally = true;
+    environmentFile = "/mnt/data/searxng/.env";
     settings = {
       server = {
         bind_address = "127.0.0.1";
         port = 8091;
+        secret_key = "$SECRET_KEY";
       };
       general = {
         debug = false;

From 6f8090c1df7ab6f1addf22c1afa919dbe0d1d62c Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 13 Mar 2026 11:21:58 +0700
Subject: [PATCH 016/427] rm unused setting

---
 modules/system/homelab/proxy.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index b8a9054..de27f58 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -111,7 +111,6 @@ in {
         providers.docker = {
           endpoint = "unix:///var/run/docker.sock";
           exposedByDefault = false; 
-          defaultRule = "Host(`ct-{{ normalize .Name }}.${base}`)";
         };
       };
     };

From bb6e8105843912ae8cb521156f3aaa0d22380a41 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 08:17:08 +0700
Subject: [PATCH 017/427] add shell alias

---
 lib/options.nix           | 2 ++
 modules/home/core/zsh.nix | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index b865080..c25e663 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -62,6 +62,8 @@
   };
 
   git = { # setup your git author
+    username = "satr14"; # forgejo username
+    server = "https://git.satr14.my.id"; # forgejo server url
     user = "Satria";
     email = "admin@satr14.my.id";
   };
diff --git a/modules/home/core/zsh.nix b/modules/home/core/zsh.nix
index ca4bd4f..8ce99d3 100644
--- a/modules/home/core/zsh.nix
+++ b/modules/home/core/zsh.nix
@@ -1,4 +1,4 @@
-{ hostname, flake-path, zsh-theme, ... }: {
+{ git, hostname, flake-path, zsh-theme, ... }: {
   programs = {
     pay-respects = {
       enable = true;
@@ -64,6 +64,7 @@
         "wm-disp" = "wm-ctl dispatch dpms";
 
         "gh-author-setup" = "git config user.name $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user | jq -r .login) && git config user.email $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user/emails | jq -r \".[1].email\")";
+        "fg-create-repo" = "git remote add origin ${git.server}/${git.username}/$(basename $PWDw).git && git push";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";
         
         "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version)";

From 20608300ae47e0267ac424bd736d4c71de0a4497 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 08:17:25 +0700
Subject: [PATCH 018/427] env file change

---
 modules/system/homelab/proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index de27f58..3edaf2a 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -47,7 +47,7 @@ in {
       domain = "*.${base}";
       extraDomainNames = [ base ];
       dnsProvider = "cloudflare";
-      environmentFile = "/var/lib/acme/cloudflare.env";
+      environmentFile = "/mnt/data/acme/.env";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
     };
   };

From 814aec297f8190b8a4025985d7ec91596bbebc27 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 08:19:28 +0700
Subject: [PATCH 019/427] add openwebui env file

---
 modules/system/homelab/ai.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/ai.nix b/modules/system/homelab/ai.nix
index ba83a32..cdd6793 100644
--- a/modules/system/homelab/ai.nix
+++ b/modules/system/homelab/ai.nix
@@ -14,6 +14,7 @@
     open-webui = {
       enable = true;
       port = 8080;
+      environmentFile = "/mnt/data/ollama/.env";
       environment = {
         OLLAMA_BASE_URL = "http://localhost:11434";
         # WEBUI_AUTH = "False";

From 7072841f27eb5e7b92af9ee066eab0f2b2178e88 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 08:34:05 +0700
Subject: [PATCH 020/427] remove env var

---
 modules/system/homelab/pass.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 89ea489..192208d 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -8,7 +8,6 @@
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";
-      SIGNUPS_ALLOWED = true;
     };
   };
 }
\ No newline at end of file

From f5d8213a7dd1f748962206816fef9def3a1db471 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 09:20:06 +0700
Subject: [PATCH 021/427] forgejo runner for nixos rebuild

---
 modules/system/homelab/git.nix | 103 +++++++++++++++++++--------------
 1 file changed, 60 insertions(+), 43 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index e5a48ca..212beda 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,48 +1,65 @@
 { pkgs, homelab, ... }: {
-  services.forgejo = {
-    enable = true;
-    lfs.enable = true;
-    stateDir = "/mnt/data/forgejo";
-    package = pkgs.forgejo;
-    #secrets = {
-    #  oauth2.JWT_SECRET = "/mnt/data/forgejo/custom/conf/oauth2_jwt_secret";
-    #  server.LFS_JWT_SECRET = "/mnt/data/forgejo/custom/conf/lfs_jwt_secret";
-    #  security = {
-    #    INTERNAL_TOKEN = "/mnt/data/forgejo/custom/conf/internal_token";
-    #    SECRET_KEY = "/mnt/data/forgejo/custom/conf/secret_key";
-    #  };
-    #};
-    settings = {
-      server = {
-        DISABLE_SSH = false;
-        START_SSH_SERVER = true;
-        SSH_DOMAIN = "main.dns.${homelab.domain}";
-        SSH_LISTEN_HOST = "0.0.0.0";
-        SSH_LISTEN_PORT = 5822;
-        SSH_PORT = 5822;
-        DOMAIN = "git.${homelab.domain}";
-        HTTP_ADDR = "127.0.0.1";
-        HTTP_PORT = 5080;
-        PROTOCOL = "http";
-        ROOT_URL = "https://git.${homelab.domain}";
-        LANDING_PAGE = "explore";
+  security.sudo.extraRules = [{ # for configuration activation on push to git
+    users = [ "gitea-runner" ]; 
+    commands = [{ 
+      command = "/run/current-system/sw/bin/nixos-rebuild"; 
+      options = [ "NOPASSWD" ]; 
+    }];
+  }];
+  services = {
+    forgejo = {
+      enable = true;
+      lfs.enable = true;
+      stateDir = "/mnt/data/forgejo";
+      package = pkgs.forgejo;
+      #secrets = {
+      #  oauth2.JWT_SECRET = "/mnt/data/forgejo/custom/conf/oauth2_jwt_secret";
+      #  server.LFS_JWT_SECRET = "/mnt/data/forgejo/custom/conf/lfs_jwt_secret";
+      #  security = {
+      #    INTERNAL_TOKEN = "/mnt/data/forgejo/custom/conf/internal_token";
+      #    SECRET_KEY = "/mnt/data/forgejo/custom/conf/secret_key";
+      #  };
+      #};
+      settings = {
+        server = {
+          DISABLE_SSH = false;
+          START_SSH_SERVER = true;
+          SSH_DOMAIN = "main.dns.${homelab.domain}";
+          SSH_LISTEN_HOST = "0.0.0.0";
+          SSH_LISTEN_PORT = 5822;
+          SSH_PORT = 5822;
+          DOMAIN = "git.${homelab.domain}";
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = 5080;
+          PROTOCOL = "http";
+          ROOT_URL = "https://git.${homelab.domain}";
+          LANDING_PAGE = "explore";
+        };
+        oauth2_client.ENABLE_AUTO_REGISTRATION=true;
+        service = {
+          DISABLE_REGISTRATION = true;
+          ENABLE_OPENID_SIGNIN = false;
+          ENABLE_OPENID_SIGNUP = false;
+          ENABLE_INTERNAL_SIGNIN = true; 
+          SHOW_REGISTRATION_BUTTON = false;
+          ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+          ALLOW_ONLY_INTERNAL_REGISTRATION = false;
+          REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = true;
+        };
+        user.ENABLE_FOLLOWING = false;
+        repository = {
+          DISABLE_STARS = true;
+          DISABLE_FORKS = true;
+          ENABLE_PUSH_CREATE_USER = true;
+        };
       };
-      oauth2_client.ENABLE_AUTO_REGISTRATION=true;
-      service = {
-        DISABLE_REGISTRATION = true;
-        ENABLE_OPENID_SIGNIN = false;
-        ENABLE_OPENID_SIGNUP = false;
-        ENABLE_INTERNAL_SIGNIN = true; # TODO: set false after migration complete
-        SHOW_REGISTRATION_BUTTON = false;
-        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-        ALLOW_ONLY_INTERNAL_REGISTRATION = false;
-        REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = true;
-      };
-      user.ENABLE_FOLLOWING = false;
-      repository = {
-        DISABLE_STARS = true;
-        DISABLE_FORKS = true;
-        ENABLE_PUSH_CREATE_USER = true;
+      gitea-actions-runner.instances.nixos-deploy = {
+        enable = true;
+        name = "nixos-server-runner";
+        url = "https://git.proxy.${homelab.domain}";
+        tokenFile = "/mnt/data/forgejo/runner/nixos_deploy_runner_token"; 
+        labels = [ "nixos-server" ];
+        hostPackages = with pkgs; [ bash coreutils git nix ];
       };
     };
   };

From 6d46ec1d54e50ab959fda7f09e818d9f765f44b8 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 09:21:30 +0700
Subject: [PATCH 022/427] fix scope error

---
 modules/system/homelab/git.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 212beda..d94756d 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -53,14 +53,14 @@
           ENABLE_PUSH_CREATE_USER = true;
         };
       };
-      gitea-actions-runner.instances.nixos-deploy = {
-        enable = true;
-        name = "nixos-server-runner";
-        url = "https://git.proxy.${homelab.domain}";
-        tokenFile = "/mnt/data/forgejo/runner/nixos_deploy_runner_token"; 
-        labels = [ "nixos-server" ];
-        hostPackages = with pkgs; [ bash coreutils git nix ];
-      };
+    };
+    gitea-actions-runner.instances.nixos-deploy = {
+      enable = true;
+      name = "nixos-server-runner";
+      url = "https://git.proxy.${homelab.domain}";
+      tokenFile = "/mnt/data/forgejo/runner/nixos_deploy_runner_token"; 
+      labels = [ "nixos-server" ];
+      hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
 }

From b1406939d21b78427276e2115673aa7ebd7fff55 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 09:34:53 +0700
Subject: [PATCH 023/427] change token path and add workflow file

---
 .forgejo/workflows/activate.yml | 13 +++++++++++++
 modules/system/homelab/git.nix  |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 .forgejo/workflows/activate.yml

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
new file mode 100644
index 0000000..4b7c1d2
--- /dev/null
+++ b/.forgejo/workflows/activate.yml
@@ -0,0 +1,13 @@
+name: Activate NixOS Configuration On Push
+on:
+  push:
+    branches:
+      - main
+jobs:
+  deploy:
+    runs-on: nixos-server
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Build and activate system
+        run: sudo nixos-rebuild switch --flake .#homelab
\ No newline at end of file
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index d94756d..c0d0ff1 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -58,7 +58,7 @@
       enable = true;
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
-      tokenFile = "/mnt/data/forgejo/runner/nixos_deploy_runner_token"; 
+      tokenFile = "/root/forgejo-token-runner"; 
       labels = [ "nixos-server" ];
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };

From 129db0f841dbae790778a6b7cd398bca0381616d Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:08:48 +0700
Subject: [PATCH 024/427] add nodejs to runner

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index c0d0ff1..360f002 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -60,7 +60,7 @@
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
       labels = [ "nixos-server" ];
-      hostPackages = with pkgs; [ bash coreutils git nix ];
+      hostPackages = with pkgs; [ bash coreutils git nix nodejs ];
     };
   };
 }

From 6d7e88f08211af15dcb4cf0002413e12208fa6a9 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:10:01 +0700
Subject: [PATCH 025/427] name changes

---
 .forgejo/workflows/activate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 4b7c1d2..cb11874 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,10 +1,10 @@
-name: Activate NixOS Configuration On Push
+name: Activate NixOS Homelab Configuration On Push
 on:
   push:
     branches:
       - main
 jobs:
-  deploy:
+  build-and-activate:
     runs-on: nixos-server
     steps:
       - name: Checkout code

From 39f5b1b4f8ebf705f81df4e830bd46aed8c127fa Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:17:39 +0700
Subject: [PATCH 026/427] fix runner

---
 .forgejo/workflows/activate.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index cb11874..95ef84b 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -7,7 +7,11 @@ jobs:
   build-and-activate:
     runs-on: nixos-server
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Build and activate system
-        run: sudo nixos-rebuild switch --flake .#homelab
\ No newline at end of file
+      - name: Clone
+        run: git clone http://localhost:5080/satr14/nix-flake.git src
+      - name: Build
+        run: nixos-rebuild build --flake ./src#homelab
+      - name: Activate
+        run: sudo nixos-rebuild switch --flake ./src#homelab
+      - name: Clean
+        run: rm -rf src
\ No newline at end of file

From a008b0e806b081de8f81ba2318bea07ee44a08f9 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:21:58 +0700
Subject: [PATCH 027/427] add shell fix

---
 .forgejo/workflows/activate.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 95ef84b..d63013b 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -8,10 +8,14 @@ jobs:
     runs-on: nixos-server
     steps:
       - name: Clone
+        shell: /bin/sh -e {0}
         run: git clone http://localhost:5080/satr14/nix-flake.git src
       - name: Build
+        shell: /bin/sh -e {0}
         run: nixos-rebuild build --flake ./src#homelab
       - name: Activate
+        shell: /bin/sh -e {0}
         run: sudo nixos-rebuild switch --flake ./src#homelab
       - name: Clean
+        shell: /bin/sh -e {0}
         run: rm -rf src
\ No newline at end of file

From 0bfffe7acb3ce11dd3d22f8b97f2f0993ccc2425 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:27:29 +0700
Subject: [PATCH 028/427] path fixes

---
 .forgejo/workflows/activate.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index d63013b..420d2b2 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -3,19 +3,22 @@ on:
   push:
     branches:
       - main
+      
+env:
+  PATH: /run/current-system/sw/bin:/run/wrappers/bin
+      
 jobs:
   build-and-activate:
     runs-on: nixos-server
+    defaults:
+      run:
+        shell: /bin/sh -e {0}
     steps:
       - name: Clone
-        shell: /bin/sh -e {0}
         run: git clone http://localhost:5080/satr14/nix-flake.git src
       - name: Build
-        shell: /bin/sh -e {0}
         run: nixos-rebuild build --flake ./src#homelab
       - name: Activate
-        shell: /bin/sh -e {0}
         run: sudo nixos-rebuild switch --flake ./src#homelab
       - name: Clean
-        shell: /bin/sh -e {0}
         run: rm -rf src
\ No newline at end of file

From 6024695830f9054fe5b03554ada09b77ab4ead3a Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:33:04 +0700
Subject: [PATCH 029/427] workflow verbosity and sudo fix

---
 .forgejo/workflows/activate.yml | 8 ++++----
 modules/system/homelab/git.nix  | 8 +++++++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 420d2b2..6bbb687 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -15,10 +15,10 @@ jobs:
         shell: /bin/sh -e {0}
     steps:
       - name: Clone
-        run: git clone http://localhost:5080/satr14/nix-flake.git src
+        run: git clone -v http://localhost:5080/satr14/nix-flake.git src
       - name: Build
-        run: nixos-rebuild build --flake ./src#homelab
+        run: nixos-rebuild build --flake ./src#homelab -L --show-trace -v
       - name: Activate
-        run: sudo nixos-rebuild switch --flake ./src#homelab
+        run: sudo nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
       - name: Clean
-        run: rm -rf src
\ No newline at end of file
+        run: rm -rfv src
\ No newline at end of file
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 360f002..2af435c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,4 +1,4 @@
-{ pkgs, homelab, ... }: {
+{ lib, pkgs, homelab, ... }: {
   security.sudo.extraRules = [{ # for configuration activation on push to git
     users = [ "gitea-runner" ]; 
     commands = [{ 
@@ -63,4 +63,10 @@
       hostPackages = with pkgs; [ bash coreutils git nix nodejs ];
     };
   };
+  systemd.services."gitea-runner-nixos-deploy".serviceConfig = {
+    # Force systemd to allow privilege escalation (sudo) for this service
+    NoNewPrivileges = lib.mkForce false;
+    RestrictSUIDSGID = lib.mkForce false;
+    PrivateUsers = lib.mkForce false;
+  };
 }

From 7f7611cec92bc35cb8d922d53e5c79cf35d04984 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:35:20 +0700
Subject: [PATCH 030/427] remove unused code

---
 modules/system/homelab/git.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 2af435c..81f7251 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -12,14 +12,6 @@
       lfs.enable = true;
       stateDir = "/mnt/data/forgejo";
       package = pkgs.forgejo;
-      #secrets = {
-      #  oauth2.JWT_SECRET = "/mnt/data/forgejo/custom/conf/oauth2_jwt_secret";
-      #  server.LFS_JWT_SECRET = "/mnt/data/forgejo/custom/conf/lfs_jwt_secret";
-      #  security = {
-      #    INTERNAL_TOKEN = "/mnt/data/forgejo/custom/conf/internal_token";
-      #    SECRET_KEY = "/mnt/data/forgejo/custom/conf/secret_key";
-      #  };
-      #};
       settings = {
         server = {
           DISABLE_SSH = false;
@@ -64,7 +56,6 @@
     };
   };
   systemd.services."gitea-runner-nixos-deploy".serviceConfig = {
-    # Force systemd to allow privilege escalation (sudo) for this service
     NoNewPrivileges = lib.mkForce false;
     RestrictSUIDSGID = lib.mkForce false;
     PrivateUsers = lib.mkForce false;

From 04700f6f657da9fad4ce59ce7d8c60152dc1d323 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 10:50:19 +0700
Subject: [PATCH 031/427] disable sandbox

---
 modules/system/homelab/git.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 81f7251..1903a4f 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -52,12 +52,16 @@
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
       labels = [ "nixos-server" ];
-      hostPackages = with pkgs; [ bash coreutils git nix nodejs ];
+      hostPackages = with pkgs; [ bash coreutils git nix nodejs sudo ];
+      container.enable = false;
     };
   };
-  systemd.services."gitea-runner-nixos-deploy".serviceConfig = {
-    NoNewPrivileges = lib.mkForce false;
-    RestrictSUIDSGID = lib.mkForce false;
-    PrivateUsers = lib.mkForce false;
+  systemd.services."gitea-runner-nixos-deploy" = {
+    restartIfChanged = false;
+    serviceConfig = {
+      NoNewPrivileges = lib.mkForce false;
+      RestrictSUIDSGID = lib.mkForce false;
+      PrivateUsers = lib.mkForce false;
+    };
   };
 }

From 6e8692e44e3ef865fede7ee61f1753a29d2dee35 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:25:23 +0700
Subject: [PATCH 032/427] use ssh instead of sudo

---
 .forgejo/workflows/activate.yml | 27 +++++++++++++++++----------
 lib/options.nix                 |  3 +++
 modules/system/homelab/git.nix  | 21 +++------------------
 modules/system/server.nix       |  2 ++
 4 files changed, 25 insertions(+), 28 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 6bbb687..edec26a 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -6,19 +6,26 @@ on:
       
 env:
   PATH: /run/current-system/sw/bin:/run/wrappers/bin
-      
+  
 jobs:
-  build-and-activate:
+  deploy:
     runs-on: nixos-server
     defaults:
       run:
         shell: /bin/sh -e {0}
+    
     steps:
-      - name: Clone
-        run: git clone -v http://localhost:5080/satr14/nix-flake.git src
-      - name: Build
-        run: nixos-rebuild build --flake ./src#homelab -L --show-trace -v
-      - name: Activate
-        run: sudo nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
-      - name: Clean
-        run: rm -rfv src
\ No newline at end of file
+      - name: 1. Clone Repository
+        run: |
+          rm -rf src
+          git clone https://git.satr14.my.id/satr14/nix-flake.git src
+
+      - name: 2. Setup SSH Key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
+
+      - name: 3. Deploy System over SSH
+        run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file
diff --git a/lib/options.nix b/lib/options.nix
index c25e663..0c497a0 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -16,6 +16,9 @@
   homelab = rec {
     domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
     cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
+    ssh-keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
+    ];
     disks = {
       gallery = "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
       data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 1903a4f..4ea9bc1 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,11 +1,4 @@
 { lib, pkgs, homelab, ... }: {
-  security.sudo.extraRules = [{ # for configuration activation on push to git
-    users = [ "gitea-runner" ]; 
-    commands = [{ 
-      command = "/run/current-system/sw/bin/nixos-rebuild"; 
-      options = [ "NOPASSWD" ]; 
-    }];
-  }];
   services = {
     forgejo = {
       enable = true;
@@ -51,17 +44,9 @@
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
-      labels = [ "nixos-server" ];
-      hostPackages = with pkgs; [ bash coreutils git nix nodejs sudo ];
-      container.enable = false;
-    };
-  };
-  systemd.services."gitea-runner-nixos-deploy" = {
-    restartIfChanged = false;
-    serviceConfig = {
-      NoNewPrivileges = lib.mkForce false;
-      RestrictSUIDSGID = lib.mkForce false;
-      PrivateUsers = lib.mkForce false;
+      labels = [ "nixos-server:host" ];
+      hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
+  systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
 }
diff --git a/modules/system/server.nix b/modules/system/server.nix
index e86d6fa..fd10d22 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -29,6 +29,8 @@ in {
     ./base.nix
   ];
 
+  users.users.root.openssh.authorizedKeys.keys = homelab.ssh-keys;
+  
   services.tailscale = {
     enable = true;
     authKeyFile = "/mnt/data/tailscale/authkey";

From be24bb6bd3b96d6385f9287fc18522dfc19f6dd9 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:25:54 +0700
Subject: [PATCH 033/427] remove numbering

---
 .forgejo/workflows/activate.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index edec26a..b9a40c2 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -15,17 +15,17 @@ jobs:
         shell: /bin/sh -e {0}
     
     steps:
-      - name: 1. Clone Repository
+      - name: Clone Repository
         run: |
           rm -rf src
           git clone https://git.satr14.my.id/satr14/nix-flake.git src
 
-      - name: 2. Setup SSH Key
+      - name: Setup SSH Key
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H localhost >> ~/.ssh/known_hosts
 
-      - name: 3. Deploy System over SSH
+      - name: Deploy System over SSH
         run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file

From 79aed28d47ab3c252dbcab758a49abe6d944f7b9 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:35:16 +0700
Subject: [PATCH 034/427] add manual trigger

---
 .forgejo/workflows/activate.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index b9a40c2..992794d 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,5 +1,6 @@
 name: Activate NixOS Homelab Configuration On Push
 on:
+  workflow_dispatch:
   push:
     branches:
       - main

From 334b9e2fb91efc565c7c80c05a102acfa1d401d9 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:46:32 +0700
Subject: [PATCH 035/427] fix ssh key not connecting

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 992794d..8f501b6 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -26,7 +26,7 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
+          ssh-keyscan -H localhost 127.0.0.1 ::1 >> ~/.ssh/known_hosts
 
       - name: Deploy System over SSH
         run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file

From ccb6ea4f90cddf1fa6ce0fddeed48d8f3ebb52e3 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:49:58 +0700
Subject: [PATCH 036/427] skip host key check

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 8f501b6..469f04f 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -26,7 +26,7 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H localhost 127.0.0.1 ::1 >> ~/.ssh/known_hosts
+          printf '%s\n' 'Host localhost 127.0.0.1 ::1' '  StrictHostKeyChecking no' '  UserKnownHostsFile /dev/null' >> ~/.ssh/config
 
       - name: Deploy System over SSH
         run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file

From c5056ea3743cd08b5ee06af67f00b70aceeba9dd Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 11:54:38 +0700
Subject: [PATCH 037/427] setup ssh with uses

---
 .forgejo/workflows/activate.yml | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 469f04f..2f39882 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -16,17 +16,26 @@ jobs:
         shell: /bin/sh -e {0}
     
     steps:
-      - name: Clone Repository
-        run: |
-          rm -rf src
-          git clone https://git.satr14.my.id/satr14/nix-flake.git src
-
-      - name: Setup SSH Key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          printf '%s\n' 'Host localhost 127.0.0.1 ::1' '  StrictHostKeyChecking no' '  UserKnownHostsFile /dev/null' >> ~/.ssh/config
+      # - name: Clone Repository
+      #   run: |
+      #     rm -rf src
+      #     git clone https://git.satr14.my.id/satr14/nix-flake.git src
 
+      # - name: Setup SSH Key
+      #   run: |
+      #     mkdir -p ~/.ssh
+      #     echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+      #     chmod 600 ~/.ssh/id_ed25519
+      #     printf '%s\n' 'Host localhost 127.0.0.1 ::1' '  StrictHostKeyChecking no' '  UserKnownHostsFile /dev/null' >> ~/.ssh/config
+          
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        
+      - name: Setup SSH
+        id: setupssh
+        uses: actions/setup-ssh@v1
+        with:
+          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
+            
       - name: Deploy System over SSH
         run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file

From 21c7809cb6e07021f4e5ea4a12a4ca5f4d067231 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 20:53:28 +0700
Subject: [PATCH 038/427] Revert "disable sandbox"

This reverts commit 04700f6f657da9fad4ce59ce7d8c60152dc1d323.
---
 modules/system/homelab/git.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 4ea9bc1..792246c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,5 +48,10 @@
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
+  systemd.services."gitea-runner-nixos-deploy".serviceConfig = {
+    NoNewPrivileges = lib.mkForce false;
+    RestrictSUIDSGID = lib.mkForce false;
+    PrivateUsers = lib.mkForce false;
+  };
   systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
 }

From 22ac4b4b5e66f643b2b5e9d627c83d4fdfde10d3 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 20:59:04 +0700
Subject: [PATCH 039/427] update workflow and sudo perms

---
 .forgejo/workflows/activate.yml | 5 +++--
 modules/system/homelab/git.nix  | 7 +++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 2f39882..d1ef9f1 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -10,7 +10,7 @@ env:
   
 jobs:
   deploy:
-    runs-on: nixos-server
+    runs-on: nixos-server:host
     defaults:
       run:
         shell: /bin/sh -e {0}
@@ -38,4 +38,5 @@ jobs:
           ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
             
       - name: Deploy System over SSH
-        run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
\ No newline at end of file
+        run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
+
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 792246c..59359d1 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,4 +1,11 @@
 { lib, pkgs, homelab, ... }: {
+  security.sudo.extraRules = [{
+    users = [ "gitea-runner" ]; 
+    commands = [{ 
+      command = "/run/current-system/sw/bin/nixos-rebuild"; 
+      options = [ "NOPASSWD" ]; 
+    }];
+  }];
   services = {
     forgejo = {
       enable = true;

From 8fa6ca28b114b151e32f7f4a01ebded33aee9ffc Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:24:14 +0700
Subject: [PATCH 040/427] use diff labels

---
 .forgejo/workflows/activate.yml | 2 +-
 modules/system/homelab/git.nix  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index d1ef9f1..c95d089 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -10,7 +10,7 @@ env:
   
 jobs:
   deploy:
-    runs-on: nixos-server:host
+    runs-on: self-hosted:host
     defaults:
       run:
         shell: /bin/sh -e {0}
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 59359d1..e39f8d6 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -51,7 +51,7 @@
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
-      labels = [ "nixos-server:host" ];
+      labels = [ "self-hosted:host" "docker" ];
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };

From 59d1b62395401c05eec2f137cff53c31312091a4 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:33:08 +0700
Subject: [PATCH 041/427] fix label workflow

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index c95d089..ca4ea57 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -10,7 +10,7 @@ env:
   
 jobs:
   deploy:
-    runs-on: self-hosted:host
+    runs-on: self-hosted
     defaults:
       run:
         shell: /bin/sh -e {0}

From 719548c778e28401bbc4f70d2360ee88b9e8abe6 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:38:43 +0700
Subject: [PATCH 042/427] change workflow to use she commands

---
 .forgejo/workflows/activate.yml | 38 +++++++++------------------------
 1 file changed, 10 insertions(+), 28 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index ca4ea57..9b162e4 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,42 +1,24 @@
 name: Activate NixOS Homelab Configuration On Push
 on:
-  workflow_dispatch:
   push:
     branches:
       - main
       
 env:
   PATH: /run/current-system/sw/bin:/run/wrappers/bin
-  
+      
 jobs:
-  deploy:
+  build-and-activate:
     runs-on: self-hosted
     defaults:
       run:
         shell: /bin/sh -e {0}
-    
     steps:
-      # - name: Clone Repository
-      #   run: |
-      #     rm -rf src
-      #     git clone https://git.satr14.my.id/satr14/nix-flake.git src
-
-      # - name: Setup SSH Key
-      #   run: |
-      #     mkdir -p ~/.ssh
-      #     echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
-      #     chmod 600 ~/.ssh/id_ed25519
-      #     printf '%s\n' 'Host localhost 127.0.0.1 ::1' '  StrictHostKeyChecking no' '  UserKnownHostsFile /dev/null' >> ~/.ssh/config
-          
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        
-      - name: Setup SSH
-        id: setupssh
-        uses: actions/setup-ssh@v1
-        with:
-          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
-            
-      - name: Deploy System over SSH
-        run: nixos-rebuild switch --flake ./src#homelab --target-host root@localhost -L --show-trace 
-
+      - name: Clone
+        run: git clone -v http://localhost:5080/satr14/nix-flake.git src
+      - name: Build
+        run: nixos-rebuild build --flake ./src#homelab -L --show-trace -v
+      - name: Activate
+        run: sudo nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
+      - name: Clean
+        run: rm -rfv src

From c2512306ace779af2e3dd2e77a4c00772c42209d Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:43:56 +0700
Subject: [PATCH 043/427] verbosity fix

---
 .forgejo/workflows/activate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 9b162e4..caa3857 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -15,9 +15,9 @@ jobs:
         shell: /bin/sh -e {0}
     steps:
       - name: Clone
-        run: git clone -v http://localhost:5080/satr14/nix-flake.git src
+        run: git clone http://localhost:5080/satr14/nix-flake.git src
       - name: Build
-        run: nixos-rebuild build --flake ./src#homelab -L --show-trace -v
+        run: nixos-rebuild build --flake ./src#homelab -L --show-trace
       - name: Activate
         run: sudo nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
       - name: Clean

From 389b38628edc0a64f6822ff10e8008d66a83e714 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:46:29 +0700
Subject: [PATCH 044/427] force runner as root

---
 .forgejo/workflows/activate.yml | 2 +-
 modules/system/homelab/git.nix  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index caa3857..7cd9dcc 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -19,6 +19,6 @@ jobs:
       - name: Build
         run: nixos-rebuild build --flake ./src#homelab -L --show-trace
       - name: Activate
-        run: sudo nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
+        run: nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
       - name: Clean
         run: rm -rfv src
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index e39f8d6..92b4982 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -59,6 +59,9 @@
     NoNewPrivileges = lib.mkForce false;
     RestrictSUIDSGID = lib.mkForce false;
     PrivateUsers = lib.mkForce false;
+    User = lib.mkForce "root";
+    ProtectSystem = lib.mkForce false;
+    ProtectHome = lib.mkForce false;
   };
   systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
 }

From 374efdd33a92ed370c7c949e5fbedfb9248adfdb Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:48:57 +0700
Subject: [PATCH 045/427] verbose fix

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 7cd9dcc..aa00711 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -19,6 +19,6 @@ jobs:
       - name: Build
         run: nixos-rebuild build --flake ./src#homelab -L --show-trace
       - name: Activate
-        run: nixos-rebuild switch --flake ./src#homelab -L --show-trace -v
+        run: nixos-rebuild switch --flake ./src#homelab -L --show-trace
       - name: Clean
         run: rm -rfv src

From c63a9c8b6a0875e60b934eeec6b262de2f5b39ff Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 14 Mar 2026 21:53:55 +0700
Subject: [PATCH 046/427] fix mount issue

---
 modules/system/homelab/git.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 92b4982..7e34e3c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -62,6 +62,7 @@
     User = lib.mkForce "root";
     ProtectSystem = lib.mkForce false;
     ProtectHome = lib.mkForce false;
+    ReadWritePaths = lib.mkForce [ "/" ];
   };
   systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
 }

From c0f955598fa616275c03d33ee6af85e055c82da8 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 08:44:19 +0700
Subject: [PATCH 047/427] add my own ssh keys

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 0c497a0..792167e 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -17,7 +17,7 @@
     domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
     cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
     ssh-keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESvQFXoUBafatqnxTd6qk3WEOcfwb3AIWVTstR3lHzX forgejo"
     ];
     disks = {
       gallery = "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 

From afc2575c4d5f0a5d31f617560a0d9a8524b3fbdc Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 08:50:24 +0700
Subject: [PATCH 048/427] retry sudo and fix workflow

---
 .forgejo/workflows/activate.yml | 26 +++++++++++------
 modules/system/homelab/git.nix  | 51 ++++++++++++++++++++++-----------
 2 files changed, 52 insertions(+), 25 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index aa00711..bb38a85 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -3,10 +3,10 @@ on:
   push:
     branches:
       - main
-      
+
 env:
-  PATH: /run/current-system/sw/bin:/run/wrappers/bin
-      
+  PATH: /run/current-system/sw/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin
+
 jobs:
   build-and-activate:
     runs-on: self-hosted
@@ -15,10 +15,18 @@ jobs:
         shell: /bin/sh -e {0}
     steps:
       - name: Clone
-        run: git clone http://localhost:5080/satr14/nix-flake.git src
-      - name: Build
-        run: nixos-rebuild build --flake ./src#homelab -L --show-trace
+        run: git clone --depth 1 http://localhost:5080/satr14/nix-flake.git src
+
       - name: Activate
-        run: nixos-rebuild switch --flake ./src#homelab -L --show-trace
-      - name: Clean
-        run: rm -rfv src
+        run: sudo nixos-rebuild switch --flake ./src#homelab -L
+
+      - name: Rollback on failure
+        if: failure()
+        run: sudo nixos-rebuild --rollback
+
+      - name: Show generation
+        run: nixos-version
+
+      - name: Clean up
+        if: always()
+        run: rm -rf src
\ No newline at end of file
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 7e34e3c..a1a8b4e 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,11 +1,4 @@
 { lib, pkgs, homelab, ... }: {
-  security.sudo.extraRules = [{
-    users = [ "gitea-runner" ]; 
-    commands = [{ 
-      command = "/run/current-system/sw/bin/nixos-rebuild"; 
-      options = [ "NOPASSWD" ]; 
-    }];
-  }];
   services = {
     forgejo = {
       enable = true;
@@ -55,14 +48,40 @@
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
-  systemd.services."gitea-runner-nixos-deploy".serviceConfig = {
-    NoNewPrivileges = lib.mkForce false;
-    RestrictSUIDSGID = lib.mkForce false;
-    PrivateUsers = lib.mkForce false;
-    User = lib.mkForce "root";
-    ProtectSystem = lib.mkForce false;
-    ProtectHome = lib.mkForce false;
-    ReadWritePaths = lib.mkForce [ "/" ];
+  systemd.services."gitea-runner-nixos-deploy" = {
+    restartIfChanged = true;
+    serviceConfig = {
+      # User  = lib.mkForce "root";
+      # Group = lib.mkForce "root";
+
+      NoNewPrivileges         = lib.mkForce false;
+      RestrictSUIDSGID        = lib.mkForce false;
+      PrivateUsers            = lib.mkForce false;
+      # PrivateTmp              = lib.mkForce false;
+      # PrivateDevices          = lib.mkForce false;
+      # ProtectSystem           = lib.mkForce false;
+      # ProtectHome             = lib.mkForce false;
+      # ProtectKernelTunables   = lib.mkForce false;
+      # ProtectKernelModules    = lib.mkForce false;
+      # ProtectKernelLogs       = lib.mkForce false;
+      # ProtectControlGroups    = lib.mkForce false;
+      # RestrictNamespaces      = lib.mkForce false;
+      # RestrictRealtime        = lib.mkForce false;
+      # LockPersonality         = lib.mkForce false;
+      # MemoryDenyWriteExecute  = lib.mkForce false;
+      # ProtectProc             = lib.mkForce "default";
+      # SystemCallArchitectures = lib.mkForce "";
+      # SystemCallFilter        = lib.mkForce [];
+      # ReadWritePaths          = lib.mkForce [];
+      # ReadOnlyPaths           = lib.mkForce [];
+      # InaccessiblePaths       = lib.mkForce [];
+    };
   };
-  systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
+  security.sudo.extraRules = [{
+    users = [ "gitea-runner" ]; 
+    commands = [{ 
+      command = "/run/current-system/sw/bin/nixos-rebuild"; 
+      options = [ "NOPASSWD" ]; 
+    }];
+  }];
 }

From c5f129375917adef1bb033f69a4928713ce367b7 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 08:52:55 +0700
Subject: [PATCH 049/427] add manual trigger

---
 .forgejo/workflows/activate.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index bb38a85..8184d36 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,5 +1,6 @@
 name: Activate NixOS Homelab Configuration On Push
 on:
+  workflow_dispatch:
   push:
     branches:
       - main

From a48b426cc002596c64df611ad68bb2b97583a954 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:06:28 +0700
Subject: [PATCH 050/427] sandbox bypass run as root

---
 .forgejo/workflows/activate.yml |  4 ++--
 modules/system/homelab/git.nix  | 40 ++++++++++++++++-----------------
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 8184d36..903a7f4 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -19,11 +19,11 @@ jobs:
         run: git clone --depth 1 http://localhost:5080/satr14/nix-flake.git src
 
       - name: Activate
-        run: sudo nixos-rebuild switch --flake ./src#homelab -L
+        run: nixos-rebuild switch --flake ./src#homelab -L
 
       - name: Rollback on failure
         if: failure()
-        run: sudo nixos-rebuild --rollback
+        run: nixos-rebuild --rollback
 
       - name: Show generation
         run: nixos-version
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index a1a8b4e..8638803 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -51,30 +51,30 @@
   systemd.services."gitea-runner-nixos-deploy" = {
     restartIfChanged = true;
     serviceConfig = {
-      # User  = lib.mkForce "root";
-      # Group = lib.mkForce "root";
+      User  = lib.mkForce "root";
+      Group = lib.mkForce "root";
 
       NoNewPrivileges         = lib.mkForce false;
       RestrictSUIDSGID        = lib.mkForce false;
       PrivateUsers            = lib.mkForce false;
-      # PrivateTmp              = lib.mkForce false;
-      # PrivateDevices          = lib.mkForce false;
-      # ProtectSystem           = lib.mkForce false;
-      # ProtectHome             = lib.mkForce false;
-      # ProtectKernelTunables   = lib.mkForce false;
-      # ProtectKernelModules    = lib.mkForce false;
-      # ProtectKernelLogs       = lib.mkForce false;
-      # ProtectControlGroups    = lib.mkForce false;
-      # RestrictNamespaces      = lib.mkForce false;
-      # RestrictRealtime        = lib.mkForce false;
-      # LockPersonality         = lib.mkForce false;
-      # MemoryDenyWriteExecute  = lib.mkForce false;
-      # ProtectProc             = lib.mkForce "default";
-      # SystemCallArchitectures = lib.mkForce "";
-      # SystemCallFilter        = lib.mkForce [];
-      # ReadWritePaths          = lib.mkForce [];
-      # ReadOnlyPaths           = lib.mkForce [];
-      # InaccessiblePaths       = lib.mkForce [];
+      PrivateTmp              = lib.mkForce false;
+      PrivateDevices          = lib.mkForce false;
+      ProtectSystem           = lib.mkForce false;
+      ProtectHome             = lib.mkForce false;
+      ProtectKernelTunables   = lib.mkForce false;
+      ProtectKernelModules    = lib.mkForce false;
+      ProtectKernelLogs       = lib.mkForce false;
+      ProtectControlGroups    = lib.mkForce false;
+      RestrictNamespaces      = lib.mkForce false;
+      RestrictRealtime        = lib.mkForce false;
+      LockPersonality         = lib.mkForce false;
+      MemoryDenyWriteExecute  = lib.mkForce false;
+      ProtectProc             = lib.mkForce "default";
+      SystemCallArchitectures = lib.mkForce "";
+      SystemCallFilter        = lib.mkForce [];
+      ReadWritePaths          = lib.mkForce [];
+      ReadOnlyPaths           = lib.mkForce [];
+      InaccessiblePaths       = lib.mkForce [];
     };
   };
   security.sudo.extraRules = [{

From 60341e7c0ba3eafb516158b98dabfef0580da439 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:25:32 +0700
Subject: [PATCH 051/427] simpler method

---
 .forgejo/workflows/activate.yml |  6 +--
 modules/system/homelab/git.nix  | 65 +++++++++++++++++----------------
 2 files changed, 36 insertions(+), 35 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 903a7f4..3a0f83a 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -6,7 +6,7 @@ on:
       - main
 
 env:
-  PATH: /run/current-system/sw/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin
+  PATH: /current-system/sw/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin
 
 jobs:
   build-and-activate:
@@ -19,11 +19,11 @@ jobs:
         run: git clone --depth 1 http://localhost:5080/satr14/nix-flake.git src
 
       - name: Activate
-        run: nixos-rebuild switch --flake ./src#homelab -L
+        run: sudo nixos-rebuild switch --flake ./src#homelab -L
 
       - name: Rollback on failure
         if: failure()
-        run: nixos-rebuild --rollback
+        run: sudo nixos-rebuild --rollback
 
       - name: Show generation
         run: nixos-version
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 8638803..fe9bad2 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,40 +48,41 @@
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
+  users.users.gitea-runner.isSystemUser = true;
   systemd.services."gitea-runner-nixos-deploy" = {
     restartIfChanged = true;
-    serviceConfig = {
-      User  = lib.mkForce "root";
-      Group = lib.mkForce "root";
+    # serviceConfig = {
+    #   User  = lib.mkForce "root";
+    #   Group = lib.mkForce "root";
 
-      NoNewPrivileges         = lib.mkForce false;
-      RestrictSUIDSGID        = lib.mkForce false;
-      PrivateUsers            = lib.mkForce false;
-      PrivateTmp              = lib.mkForce false;
-      PrivateDevices          = lib.mkForce false;
-      ProtectSystem           = lib.mkForce false;
-      ProtectHome             = lib.mkForce false;
-      ProtectKernelTunables   = lib.mkForce false;
-      ProtectKernelModules    = lib.mkForce false;
-      ProtectKernelLogs       = lib.mkForce false;
-      ProtectControlGroups    = lib.mkForce false;
-      RestrictNamespaces      = lib.mkForce false;
-      RestrictRealtime        = lib.mkForce false;
-      LockPersonality         = lib.mkForce false;
-      MemoryDenyWriteExecute  = lib.mkForce false;
-      ProtectProc             = lib.mkForce "default";
-      SystemCallArchitectures = lib.mkForce "";
-      SystemCallFilter        = lib.mkForce [];
-      ReadWritePaths          = lib.mkForce [];
-      ReadOnlyPaths           = lib.mkForce [];
-      InaccessiblePaths       = lib.mkForce [];
-    };
+    #   NoNewPrivileges         = lib.mkForce false;
+    #   RestrictSUIDSGID        = lib.mkForce false;
+    #   PrivateUsers            = lib.mkForce false;
+    #   PrivateTmp              = lib.mkForce false;
+    #   PrivateDevices          = lib.mkForce false;
+    #   ProtectSystem           = lib.mkForce false;
+    #   ProtectHome             = lib.mkForce false;
+    #   ProtectKernelTunables   = lib.mkForce false;
+    #   ProtectKernelModules    = lib.mkForce false;
+    #   ProtectKernelLogs       = lib.mkForce false;
+    #   ProtectControlGroups    = lib.mkForce false;
+    #   RestrictNamespaces      = lib.mkForce false;
+    #   RestrictRealtime        = lib.mkForce false;
+    #   LockPersonality         = lib.mkForce false;
+    #   MemoryDenyWriteExecute  = lib.mkForce false;
+    #   ProtectProc             = lib.mkForce "default";
+    #   SystemCallArchitectures = lib.mkForce "";
+    #   SystemCallFilter        = lib.mkForce [];
+    #   ReadWritePaths          = lib.mkForce [];
+    #   ReadOnlyPaths           = lib.mkForce [];
+    #   InaccessiblePaths       = lib.mkForce [];
+    # };
   };
-  security.sudo.extraRules = [{
-    users = [ "gitea-runner" ]; 
-    commands = [{ 
-      command = "/run/current-system/sw/bin/nixos-rebuild"; 
-      options = [ "NOPASSWD" ]; 
-    }];
-  }];
+  # security.sudo.extraRules = [{
+  #   users = [ "gitea-runner" ]; 
+  #   commands = [{ 
+  #     command = "/run/current-system/sw/bin/nixos-rebuild"; 
+  #     options = [ "NOPASSWD" ]; 
+  #   }];
+  # }];
 }

From 056ec34d909a2e4ee528fc4d3c9732f2f389686f Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:28:19 +0700
Subject: [PATCH 052/427] create group fix

---
 modules/system/homelab/git.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index fe9bad2..aaaf885 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,7 +48,11 @@
       hostPackages = with pkgs; [ bash coreutils git nix ];
     };
   };
-  users.users.gitea-runner.isSystemUser = true;
+  users.users.gitea-runner = {
+    isSystemUser = true;
+    group = "gitea-runner";
+  };
+  users.groups.gitea-runner = {};
   systemd.services."gitea-runner-nixos-deploy" = {
     restartIfChanged = true;
     # serviceConfig = {

From 50c5788e6bc4394956585d0cb603885918af8c63 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:49:32 +0700
Subject: [PATCH 053/427] uses ssh instead

---
 .forgejo/workflows/activate.yml | 46 ++++++++++++++++-----------------
 lib/options.nix                 |  1 +
 modules/system/homelab/git.nix  | 41 ++---------------------------
 3 files changed, 25 insertions(+), 63 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 3a0f83a..5aa6dbe 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,33 +1,31 @@
-name: Activate NixOS Homelab Configuration On Push
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
+name: NixOS Rebuild
 
-env:
-  PATH: /current-system/sw/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
 
 jobs:
-  build-and-activate:
+  rebuild:
     runs-on: self-hosted
-    defaults:
-      run:
-        shell: /bin/sh -e {0}
     steps:
-      - name: Clone
-        run: git clone --depth 1 http://localhost:5080/satr14/nix-flake.git src
+      - name: Setup SSH key
+        run: |
+          mkdir -p ./ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ./ssh/deploy_key
+          chmod 600 ./ssh/deploy_key
+          echo "StrictHostKeyChecking no" > ./ssh/config
 
-      - name: Activate
-        run: sudo nixos-rebuild switch --flake ./src#homelab -L
-
-      - name: Rollback on failure
-        if: failure()
-        run: sudo nixos-rebuild --rollback
+      - name: Rebuild (${{ github.event.inputs.action || 'switch' }})
+        run: |
+          ssh -i ./ssh/deploy_key root@localhost \
+            "nixos-rebuild switch \
+              --flake git+http://localhost:5080/satr14/nix-flake#homelab -L"
 
       - name: Show generation
-        run: nixos-version
-
-      - name: Clean up
         if: always()
-        run: rm -rf src
\ No newline at end of file
+        run: ssh -i ./ssh/deploy_key root@localhost "nixos-version"
+
+      - name: Clean Up
+        if: always()
+        run: rm -f ./ssh/deploy_key
\ No newline at end of file
diff --git a/lib/options.nix b/lib/options.nix
index 792167e..882af83 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -18,6 +18,7 @@
     cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
     ssh-keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESvQFXoUBafatqnxTd6qk3WEOcfwb3AIWVTstR3lHzX forgejo"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
       gallery = "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index aaaf885..7ca738c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -45,48 +45,11 @@
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
       labels = [ "self-hosted:host" "docker" ];
-      hostPackages = with pkgs; [ bash coreutils git nix ];
+      hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };
   };
-  users.users.gitea-runner = {
-    isSystemUser = true;
-    group = "gitea-runner";
-  };
   users.groups.gitea-runner = {};
   systemd.services."gitea-runner-nixos-deploy" = {
-    restartIfChanged = true;
-    # serviceConfig = {
-    #   User  = lib.mkForce "root";
-    #   Group = lib.mkForce "root";
-
-    #   NoNewPrivileges         = lib.mkForce false;
-    #   RestrictSUIDSGID        = lib.mkForce false;
-    #   PrivateUsers            = lib.mkForce false;
-    #   PrivateTmp              = lib.mkForce false;
-    #   PrivateDevices          = lib.mkForce false;
-    #   ProtectSystem           = lib.mkForce false;
-    #   ProtectHome             = lib.mkForce false;
-    #   ProtectKernelTunables   = lib.mkForce false;
-    #   ProtectKernelModules    = lib.mkForce false;
-    #   ProtectKernelLogs       = lib.mkForce false;
-    #   ProtectControlGroups    = lib.mkForce false;
-    #   RestrictNamespaces      = lib.mkForce false;
-    #   RestrictRealtime        = lib.mkForce false;
-    #   LockPersonality         = lib.mkForce false;
-    #   MemoryDenyWriteExecute  = lib.mkForce false;
-    #   ProtectProc             = lib.mkForce "default";
-    #   SystemCallArchitectures = lib.mkForce "";
-    #   SystemCallFilter        = lib.mkForce [];
-    #   ReadWritePaths          = lib.mkForce [];
-    #   ReadOnlyPaths           = lib.mkForce [];
-    #   InaccessiblePaths       = lib.mkForce [];
-    # };
+    restartIfChanged = false;
   };
-  # security.sudo.extraRules = [{
-  #   users = [ "gitea-runner" ]; 
-  #   commands = [{ 
-  #     command = "/run/current-system/sw/bin/nixos-rebuild"; 
-  #     options = [ "NOPASSWD" ]; 
-  #   }];
-  # }];
 }

From 30daa0b3cc547435987b3fab19bb3fc89fa73ffb Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:55:55 +0700
Subject: [PATCH 054/427] re-order

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 5aa6dbe..804f386 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,9 +1,9 @@
 name: NixOS Rebuild
 
 on:
+  workflow_dispatch:
   push:
     branches: [ main ]
-  workflow_dispatch:
 
 jobs:
   rebuild:

From f3fd07c743b926b9378ef0157228e2c931858b81 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:57:31 +0700
Subject: [PATCH 055/427] path fix

---
 .forgejo/workflows/activate.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 804f386..8dd1442 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -5,6 +5,9 @@ on:
   push:
     branches: [ main ]
 
+env:
+  PATH: /run/current-system/sw/bin:/run/wrappers/bin
+
 jobs:
   rebuild:
     runs-on: self-hosted
@@ -16,7 +19,7 @@ jobs:
           chmod 600 ./ssh/deploy_key
           echo "StrictHostKeyChecking no" > ./ssh/config
 
-      - name: Rebuild (${{ github.event.inputs.action || 'switch' }})
+      - name: Rebuild
         run: |
           ssh -i ./ssh/deploy_key root@localhost \
             "nixos-rebuild switch \

From 349d5d026a4b030b93a2e89db33e314e87000d14 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 09:59:35 +0700
Subject: [PATCH 056/427] fix strict checking

---
 .forgejo/workflows/activate.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 8dd1442..da09f8f 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -17,17 +17,15 @@ jobs:
           mkdir -p ./ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ./ssh/deploy_key
           chmod 600 ./ssh/deploy_key
-          echo "StrictHostKeyChecking no" > ./ssh/config
 
       - name: Rebuild
         run: |
-          ssh -i ./ssh/deploy_key root@localhost \
-            "nixos-rebuild switch \
-              --flake git+http://localhost:5080/satr14/nix-flake#homelab -L"
+          ssh -i ./ssh/deploy_key -o StrictHostKeyChecking=no root@localhost \
+            "nixos-rebuild switch --flake git+http://localhost:5080/satr14/nix-flake#homelab -L"
 
       - name: Show generation
         if: always()
-        run: ssh -i ./ssh/deploy_key root@localhost "nixos-version"
+        run: ssh -i ./ssh/deploy_key -o StrictHostKeyChecking=no root@localhost "nixos-version"
 
       - name: Clean Up
         if: always()

From d525c8b04d005d11c4bb1287521479594331741b Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:06:06 +0700
Subject: [PATCH 057/427] fix known host checks

---
 .forgejo/workflows/activate.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index da09f8f..4a6e341 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -17,15 +17,22 @@ jobs:
           mkdir -p ./ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ./ssh/deploy_key
           chmod 600 ./ssh/deploy_key
-
+          
       - name: Rebuild
         run: |
-          ssh -i ./ssh/deploy_key -o StrictHostKeyChecking=no root@localhost \
+          ssh -i ./ssh/deploy_key \
+            -o StrictHostKeyChecking=no \
+            -o UserKnownHostsFile=/dev/null \
+            root@localhost \
             "nixos-rebuild switch --flake git+http://localhost:5080/satr14/nix-flake#homelab -L"
 
       - name: Show generation
         if: always()
-        run: ssh -i ./ssh/deploy_key -o StrictHostKeyChecking=no root@localhost "nixos-version"
+        run: |
+          ssh -i ./ssh/deploy_key \
+            -o StrictHostKeyChecking=no \
+            -o UserKnownHostsFile=/dev/null \
+            root@localhost "nixos-version"
 
       - name: Clean Up
         if: always()

From b129aab03d2cf097c3c369b6a8d21d3cf4d8c069 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:12:21 +0700
Subject: [PATCH 058/427] propper path fix

---
 .forgejo/workflows/activate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 4a6e341..78561f1 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -24,7 +24,7 @@ jobs:
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             root@localhost \
-            "nixos-rebuild switch --flake git+http://localhost:5080/satr14/nix-flake#homelab -L"
+            "bash -lc 'nixos-rebuild switch --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
 
       - name: Show generation
         if: always()
@@ -32,7 +32,7 @@ jobs:
           ssh -i ./ssh/deploy_key \
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
-            root@localhost "nixos-version"
+            root@localhost "bash -lc 'nixos-version'"
 
       - name: Clean Up
         if: always()

From 4d9b826d39f65ed590aa7c3429fe6968ecf004a6 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:33:25 +0700
Subject: [PATCH 059/427] disable root password auth

---
 .forgejo/workflows/activate.yml | 2 ++
 hosts/bootstrap/config.nix      | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 78561f1..8d1ad80 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -21,6 +21,7 @@ jobs:
       - name: Rebuild
         run: |
           ssh -i ./ssh/deploy_key \
+            -o PasswordAuthentication=no \
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             root@localhost \
@@ -30,6 +31,7 @@ jobs:
         if: always()
         run: |
           ssh -i ./ssh/deploy_key \
+            -o PasswordAuthentication=no \
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             root@localhost "bash -lc 'nixos-version'"
diff --git a/hosts/bootstrap/config.nix b/hosts/bootstrap/config.nix
index 7eeca52..0e549ca 100644
--- a/hosts/bootstrap/config.nix
+++ b/hosts/bootstrap/config.nix
@@ -21,7 +21,7 @@
     tailscale.enable = true;
     openssh = {
       enable = true;
-      settings.PermitRootLogin = "yes";
+      settings.PermitRootLogin = "prohibit-password";
     };
   };
   users.users."${username}" = {

From 3daa0c438b9ae127dc6a2f876d4749af1ffd24dc Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:43:27 +0700
Subject: [PATCH 060/427] remove unused group

---
 modules/system/homelab/git.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 7ca738c..aefa420 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,7 +48,6 @@
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };
   };
-  users.groups.gitea-runner = {};
   systemd.services."gitea-runner-nixos-deploy" = {
     restartIfChanged = false;
   };

From 6e025358342eb0c282bc86059b180e8158934164 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:53:23 +0700
Subject: [PATCH 061/427] cleanup

---
 modules/system/homelab/git.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index aefa420..80fb950 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,7 +48,5 @@
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };
   };
-  systemd.services."gitea-runner-nixos-deploy" = {
-    restartIfChanged = false;
-  };
+  systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
 }

From cdf5828fc84b5cdb02569183af5e3b83f19c10da Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 10:53:33 +0700
Subject: [PATCH 062/427] cpu hotplug

---
 modules/hardware/homelab.nix          | 12 ++++++++++--
 modules/hardware/misc/cpu-hotplug.nix |  5 +++++
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 modules/hardware/misc/cpu-hotplug.nix

diff --git a/modules/hardware/homelab.nix b/modules/hardware/homelab.nix
index 08bfec3..ac3cb0c 100644
--- a/modules/hardware/homelab.nix
+++ b/modules/hardware/homelab.nix
@@ -2,11 +2,19 @@
   imports = [
     ./core/firmware.nix
     ./core/igpu.nix
-    ./misc/disks.nix
+    ./misc/cpu-hotplug.nix
     ./misc/serial.nix
+    ./misc/disks.nix
   ];
   
-  boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "virtio_console" ]; 
+  boot.initrd.availableKernelModules = [
+    "virtio_net"
+    "virtio_pci"
+    "virtio_mmio"
+    "virtio_blk"
+    "virtio_scsi"
+    "virtio_console"
+  ]; 
   services = {
     qemuGuest.enable = true;
     spice-vdagentd.enable = true;
diff --git a/modules/hardware/misc/cpu-hotplug.nix b/modules/hardware/misc/cpu-hotplug.nix
new file mode 100644
index 0000000..64cd3f9
--- /dev/null
+++ b/modules/hardware/misc/cpu-hotplug.nix
@@ -0,0 +1,5 @@
+{ ... }: {
+  services.udev.extraRules = ''
+    SUBSYSTEM=="cpu", ACTION=="add", TEST=="online", ATTR{online}=="0", ATTR{online}="1"
+  '';
+}
\ No newline at end of file

From b4bfacdc44c9fe0a349bb4d4e35cc5dd2c8a46e8 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 11:06:50 +0700
Subject: [PATCH 063/427] enable auth on dockge

---
 modules/system/homelab/proxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 3edaf2a..0eb1e49 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -5,10 +5,10 @@
     "router"     = { dest = "http://router.dns.${homelab.domain}:80"; auth = false; };
     "home"       = { dest = "http://home.dns.${homelab.domain}:8123"; auth = false; };
     
-    "dynamic"    = { dest = "http://127.0.0.1:8082"; auth = true; };
+    "containers" = { dest = "http://localhost:5001"; auth = true; };
+    "dynamic"    = { dest = "http://localhost:8082"; auth = true; };
     "dns"        = { dest = "http://localhost:8088"; auth = true; };
     
-    "containers" = { dest = "http://localhost:5001"; auth = false; };
     "gallery"    = { dest = "http://localhost:2283"; auth = false; };
     "remote"     = { dest = "http://localhost:8085"; auth = false; };
     "search"     = { dest = "http://localhost:8091"; auth = false; };

From e6805c0e6b3dbcb7b9d572c00d54e171930ec3a5 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 11:34:34 +0700
Subject: [PATCH 064/427] remove docker label

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 80fb950..39f2961 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -44,7 +44,7 @@
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
       tokenFile = "/root/forgejo-token-runner"; 
-      labels = [ "self-hosted:host" "docker" ];
+      labels = [ "self-hosted:host" ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };
   };

From 00a759d8fe7d714fac22ee3ce20ac83da1d53fb0 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 15 Mar 2026 13:22:56 +0700
Subject: [PATCH 065/427] add refresh flag

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 8d1ad80..abbd723 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -25,7 +25,7 @@ jobs:
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             root@localhost \
-            "bash -lc 'nixos-rebuild switch --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
+            "bash -lc 'nixos-rebuild switch --refresh --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
 
       - name: Show generation
         if: always()

From a945955835e1bdd7f828c96e6a77a240bddcf0cf Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 18 Mar 2026 11:29:14 +0700
Subject: [PATCH 066/427] update name

---
 .forgejo/workflows/activate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index abbd723..869f0f4 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -1,4 +1,4 @@
-name: NixOS Rebuild
+name: Activate Homelab Configuration
 
 on:
   workflow_dispatch:
@@ -18,7 +18,7 @@ jobs:
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ./ssh/deploy_key
           chmod 600 ./ssh/deploy_key
           
-      - name: Rebuild
+      - name: Rebuild and switch
         run: |
           ssh -i ./ssh/deploy_key \
             -o PasswordAuthentication=no \

From ac542840a0ecba7c61e11b2c199c5baf15136a28 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 19 Mar 2026 21:19:46 +0700
Subject: [PATCH 067/427] fix broken dest

---
 modules/system/homelab/proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 0eb1e49..de38a69 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -74,7 +74,7 @@ in {
       } // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair "${subdomain}.${base}" {
         useACMEHost = base;
         forceSSL = true;
-        locations."/".return = "301 ${base}";
+        locations."/".return = "301 ${cfg.dest}";
       }) redirects // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair (if subdomain == "@" then base else "${subdomain}.${base}") {
         useACMEHost = base;
         forceSSL = true;

From 1b40da95a7ffedc4225c912d3f37e8fe2e5a16fc Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 19 Mar 2026 21:20:09 +0700
Subject: [PATCH 068/427] disable forgejo internal sign in

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 39f2961..3d436ca 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -25,7 +25,7 @@
           DISABLE_REGISTRATION = true;
           ENABLE_OPENID_SIGNIN = false;
           ENABLE_OPENID_SIGNUP = false;
-          ENABLE_INTERNAL_SIGNIN = true; 
+          ENABLE_INTERNAL_SIGNIN = false; 
           SHOW_REGISTRATION_BUTTON = false;
           ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
           ALLOW_ONLY_INTERNAL_REGISTRATION = false;

From 2890b8b5030ec472956d9fc248639ba5b067da51 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Thu, 19 Mar 2026 21:46:11 +0700
Subject: [PATCH 069/427] preinstall extensions

---
 modules/home/core/zed.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/modules/home/core/zed.nix b/modules/home/core/zed.nix
index 9060a36..b3d3dc2 100644
--- a/modules/home/core/zed.nix
+++ b/modules/home/core/zed.nix
@@ -2,7 +2,14 @@
   programs.zed-editor = {
     enable = true;
     package = pkgs.zed-editor;
-    extensions = [ "nix" ];
+    extensions = [
+      "html" "html-snippets"
+      "svelte" "svelte-snippets"
+      "wakatime" "discord-presence"
+      "catppuccin" "catppuccin-icons"
+      "git-firefly"
+      "nix"
+    ];
     userSettings = {
       format_on_save = "off";
       vim_mode = true;

From 028a3702996273b4983c94fb24985d43c53ab3f6 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 20 Mar 2026 06:49:51 +0700
Subject: [PATCH 070/427] battery notifier

---
 modules/hardware/misc/battery-power.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index bd8ee20..a8dbc96 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -1,4 +1,4 @@
-{ pkgs, resume-dev, ... }: {
+{ pkgs, username, resume-dev, ... }: {
   powerManagement.powertop.enable = true;
 
   services = {
@@ -10,6 +10,18 @@
         echo 85 > /sys/class/power_supply/BAT*/charge_control_end_threshold || true
       ''}"
     '';
+    cron = {
+      enable = true;
+      systemCronJobs = [
+        "* * * * * ${username} bash -x ${pkgs.writeShellScript "low-battery-notifier" ''
+          BAT_PCT=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
+          BAT_STA=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
+          echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
+          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u normal   "Low Battery" "\$\{BAT_PCT}% remaining."
+          test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u critical "Low Battery" "Shutdown at 10%."
+        ''} > /tmp/cron.batt.log 2>&1"
+      ];
+    };
     upower = {
       enable = true;
       percentageCritical = 15;

From fb22490bd8afa7dc0b62857cfd4195357b9d5b48 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 20 Mar 2026 07:39:12 +0700
Subject: [PATCH 071/427] fix build error and typos

---
 modules/system/homelab/proxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index de38a69..e3b533a 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -23,7 +23,7 @@
   redirects = {
     "www"  = "https://proxy.${homelab.domain}";
     "dash" = "https://${homelab.domain}";
-    "immich" = "https://gallery.proxy${homelab.domain}";
+    "immich" = "https://gallery.proxy.${homelab.domain}";
   };
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;
@@ -74,7 +74,7 @@ in {
       } // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair "${subdomain}.${base}" {
         useACMEHost = base;
         forceSSL = true;
-        locations."/".return = "301 ${cfg.dest}";
+        locations."/".return = "301 ${cfg}";
       }) redirects // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair (if subdomain == "@" then base else "${subdomain}.${base}") {
         useACMEHost = base;
         forceSSL = true;

From 836d36b8d4c4e1a01c6c0673a3aeb38b76894897 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 20 Mar 2026 07:46:44 +0700
Subject: [PATCH 072/427] change redirect

---
 modules/system/homelab/proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index e3b533a..b363758 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -22,7 +22,7 @@
   };
   redirects = {
     "www"  = "https://proxy.${homelab.domain}";
-    "dash" = "https://${homelab.domain}";
+    "dash" = "https://proxy.${homelab.domain}";
     "immich" = "https://gallery.proxy.${homelab.domain}";
   };
   exta-conf = ''

From fa2e98a353cc7d665662ef7ec3aee8ac25d18b2c Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Fri, 20 Mar 2026 13:19:18 +0700
Subject: [PATCH 073/427] remove prismlauncher

---
 modules/home/core/apps.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index e08ee37..657bc7e 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -37,7 +37,6 @@
 
       ferium
       portablemc
-      prismlauncher
       steamguard-cli
       # modrinth-app
     ];

From 5e2c8dfa6e4e74ccae53607f58af6d9eec58b300 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 22 Mar 2026 20:37:26 +0700
Subject: [PATCH 074/427] add redirect

---
 modules/system/homelab/proxy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index b363758..90978c2 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -24,6 +24,7 @@
     "www"  = "https://proxy.${homelab.domain}";
     "dash" = "https://proxy.${homelab.domain}";
     "immich" = "https://gallery.proxy.${homelab.domain}";
+    "2fa" = "https://2fa.${homelab.domain}"
   };
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;

From dd7d994cc9975bf9ee45a515e67bd4cde1077dc4 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 22 Mar 2026 20:44:23 +0700
Subject: [PATCH 075/427] forgot a semicolon

---
 modules/system/homelab/proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 90978c2..6117f91 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -24,7 +24,7 @@
     "www"  = "https://proxy.${homelab.domain}";
     "dash" = "https://proxy.${homelab.domain}";
     "immich" = "https://gallery.proxy.${homelab.domain}";
-    "2fa" = "https://2fa.${homelab.domain}"
+    "2fa" = "https://2fa.${homelab.domain}";
   };
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;

From 6b2553b3e9add59e402537c3605f7ff0fa3d7cf6 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Tue, 24 Mar 2026 08:35:05 +0700
Subject: [PATCH 076/427] disable trafik's auth and new helper functions

---
 modules/system/homelab/proxy.nix | 35 +++++++++++++++++---------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 6117f91..02e8fa0 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,24 +1,27 @@
 { homelab, lib, ... }: let
+  d = domain: { dest = d; auth = false; };
+  da = domain: { dest = d; auth = true; };
+
   base = "proxy.${homelab.domain}";
   hosts = {
-    "server"     = { dest = "https://server.dns.${homelab.domain}:8006"; auth = false; };
-    "router"     = { dest = "http://router.dns.${homelab.domain}:80"; auth = false; };
-    "home"       = { dest = "http://home.dns.${homelab.domain}:8123"; auth = false; };
+    "server"     = d "https://server.dns.${homelab.domain}:8006";
+    "router"     = d "http://router.dns.${homelab.domain}:80";
+    "home"       = d "http://home.dns.${homelab.domain}:8123";
     
-    "containers" = { dest = "http://localhost:5001"; auth = true; };
-    "dynamic"    = { dest = "http://localhost:8082"; auth = true; };
-    "dns"        = { dest = "http://localhost:8088"; auth = true; };
+    "containers" = da "http://localhost:5001";
+    "dns"        = da "http://localhost:8088";
     
-    "gallery"    = { dest = "http://localhost:2283"; auth = false; };
-    "remote"     = { dest = "http://localhost:8085"; auth = false; };
-    "search"     = { dest = "http://localhost:8091"; auth = false; };
-    "notify"     = { dest = "http://localhost:8067"; auth = false; };
-    "media"      = { dest = "http://localhost:8096"; auth = false; };
-    "pass"       = { dest = "http://localhost:8060"; auth = false; };
-    "auth"       = { dest = "http://localhost:1411"; auth = false; };
-    "git"        = { dest = "http://localhost:5080"; auth = false; };
-    "ai"         = { dest = "http://localhost:8080"; auth = false; };
-    "@"          = { dest = "http://localhost:5070"; auth = false; };
+    "gallery"    = d "http://localhost:2283";
+    "dynamic"    = d "http://localhost:8082";
+    "remote"     = d "http://localhost:8085";
+    "search"     = d "http://localhost:8091";
+    "notify"     = d "http://localhost:8067";
+    "media"      = d "http://localhost:8096";
+    "pass"       = d "http://localhost:8060";
+    "auth"       = d "http://localhost:1411";
+    "git"        = d "http://localhost:5080";
+    "ai"         = d "http://localhost:8080";
+    "@"          = d "http://localhost:5070";
   };
   redirects = {
     "www"  = "https://proxy.${homelab.domain}";

From 4d854b12f0ec24f1d17d055ecc27a32efe889215 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Tue, 24 Mar 2026 08:36:41 +0700
Subject: [PATCH 077/427] fix helper

---
 modules/system/homelab/proxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 02e8fa0..083a86f 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,6 +1,6 @@
 { homelab, lib, ... }: let
-  d = domain: { dest = d; auth = false; };
-  da = domain: { dest = d; auth = true; };
+  d = dest: { inherit dest; auth = false; };
+  da = dest: { inherit dest; auth = true; };
 
   base = "proxy.${homelab.domain}";
   hosts = {

From a0f980ef310133eb7230777205eb8913f719b82a Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Tue, 24 Mar 2026 08:39:50 +0700
Subject: [PATCH 078/427] add auth middleware

---
 modules/system/homelab/proxy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 083a86f..0486260 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -104,6 +104,7 @@ in {
             forwardedHeaders.trustedIPs = [ "127.0.0.1/32" ];
           };
         };
+        http.middlewares.auth.basicAuth.usersFile = "/var/lib/nginx/.htpasswd";
         api = {
           dashboard = true;
           insecure = true;

From 706e789ce03e090d291dcebbbb2687a0752156e1 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Tue, 24 Mar 2026 08:55:29 +0700
Subject: [PATCH 079/427] move to dynamic config

---
 modules/system/homelab/proxy.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 0486260..10a6a32 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -96,6 +96,9 @@ in {
     };
     traefik = {
       enable = true;
+      dynamicConfigOptions = {
+        http.middlewares.auth.basicAuth.usersFile = "/var/lib/nginx/.htpasswd";
+      };
       staticConfigOptions = {
         entryPoints = {
           traefik.address = "127.0.0.1:8082";
@@ -104,7 +107,6 @@ in {
             forwardedHeaders.trustedIPs = [ "127.0.0.1/32" ];
           };
         };
-        http.middlewares.auth.basicAuth.usersFile = "/var/lib/nginx/.htpasswd";
         api = {
           dashboard = true;
           insecure = true;

From 0f75aa474ae8ddd6fc0a35c579b995ec7061215c Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Tue, 24 Mar 2026 09:59:38 +0700
Subject: [PATCH 080/427] add qwen cloud

---
 modules/system/homelab/ai.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/ai.nix b/modules/system/homelab/ai.nix
index cdd6793..a731d14 100644
--- a/modules/system/homelab/ai.nix
+++ b/modules/system/homelab/ai.nix
@@ -8,7 +8,7 @@
       home = "/mnt/data/ollama";
       loadModels = [ 
         "gemma3n:e4b" # "gemma3n:e2b" 
-        # "codellama:7b" "starcoder:3b"
+        "qwen3-coder-next:cloud" # "codellama:7b" "starcoder:3b"
       ];
     };
     open-webui = {

From d2574636d6da1796551f3298dd71c97ff91952ad Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 25 Mar 2026 16:24:04 +0700
Subject: [PATCH 081/427] small cleanup

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 3d436ca..72c6050 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, homelab, ... }: {
+{ pkgs, homelab, ... }: {
   services = {
     forgejo = {
       enable = true;

From 1cfee15d258791bb03295b954ec565be7952aa60 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 25 Mar 2026 16:36:02 +0700
Subject: [PATCH 082/427] remove unused services

---
 modules/system/homelab/dash.nix   |  1 -
 modules/system/homelab/proxy.nix  |  1 -
 modules/system/homelab/remote.nix | 19 -----------------
 modules/system/homelab/share.nix  | 34 -------------------------------
 modules/system/server.nix         |  1 -
 5 files changed, 56 deletions(-)
 delete mode 100644 modules/system/homelab/remote.nix
 delete mode 100644 modules/system/homelab/share.nix

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 97ddade..727faf4 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -78,7 +78,6 @@
     [ "Ntfy" "ntfy" "https://notify.proxy.${homelab.domain}" "http://localhost:8067/" ]
     [ "SearXNG" "searxng" "https://search.proxy.${homelab.domain}" "http://localhost:8091/" ]
     [ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ]
-    [ "Guacamole" "apacheguacamole" "https://remote.proxy.${homelab.domain}/guacamole" "http://localhost:8085/guacamole/" ]
   ];
   bookmarks = [
     [ "Tailscale" "tailscale" "https://login.tailscale.com/" ]
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 10a6a32..f831f17 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -13,7 +13,6 @@
     
     "gallery"    = d "http://localhost:2283";
     "dynamic"    = d "http://localhost:8082";
-    "remote"     = d "http://localhost:8085";
     "search"     = d "http://localhost:8091";
     "notify"     = d "http://localhost:8067";
     "media"      = d "http://localhost:8096";
diff --git a/modules/system/homelab/remote.nix b/modules/system/homelab/remote.nix
deleted file mode 100644
index c8b6671..0000000
--- a/modules/system/homelab/remote.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ ... }: {
-  services = {
-    guacamole-server = {
-      enable = true;
-      host = "127.0.0.1";
-      port = 4822;
-    };
-    guacamole-client = {
-      enable = true;
-      enableWebserver = true;
-      userMappingXml = "/mnt/data/guacamole/user-mapping.xml";
-      settings = {
-        guacd-hostname = "127.0.0.1";
-        guacd-port = 4822;
-      };
-    };
-    tomcat.port = 8085;
-  };
-}
\ No newline at end of file
diff --git a/modules/system/homelab/share.nix b/modules/system/homelab/share.nix
deleted file mode 100644
index 6a01a39..0000000
--- a/modules/system/homelab/share.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ ... }: {
-  services = {
-    httpd = {
-      enable = true;
-      virtualHosts."cdn" = {
-        listen = [{ ip = "127.0.0.1"; port = 3000; }];
-        documentRoot = "/mnt/share";
-      };
-    };
-
-    samba = {
-      enable = true;
-      settings = {
-        global = {
-          workgroup = "WORKGROUP";
-          "disable netbios" = "yes";
-          "allow insecure wide links" = "yes";
-          "server min protocol" = "SMB2_02";
-        };
-        "NAS" = {
-          path = "/mnt/share";
-          browseable = "yes";
-          "read only" = "no";
-          "create mask" = "0664";
-          "force create mode" = "0664";
-          "directory mask" = "0775";
-          "force directory mode" = "0775";
-          "follow symlinks" = "yes";
-          "wide links" = "yes";
-        };
-      };
-    };
-  };
-}
\ No newline at end of file
diff --git a/modules/system/server.nix b/modules/system/server.nix
index fd10d22..daa3747 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -11,7 +11,6 @@ in {
     ./homelab/containers.nix
     ./homelab/gallery.nix
     ./homelab/tunnels.nix
-    ./homelab/remote.nix
     ./homelab/notify.nix
     ./homelab/search.nix
     ./homelab/media.nix

From 78444c3b83b0bedfb16a1a255b9a67919d1b1799 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 25 Mar 2026 16:36:14 +0700
Subject: [PATCH 083/427] add credits and hosts

---
 README.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 76cad4e..1c27513 100644
--- a/README.md
+++ b/README.md
@@ -2,4 +2,11 @@
 rewrite of my nixos flake with hopefully better structuring and modularity
 
 > [!WARNING]
-> this flake is ment for personal use. code is not well documented and is not ment to be used by others. use at your own risk.
\ No newline at end of file
+> this flake is ment for personal use. code is not well documented and is not ment to be used by others. use at your own risk.
+
+## hosts
+- `thinkpad` - my thinkpad t480 with an i5 8350u, 16gb of ram, and 256gb nvme ssd (140 allocated for nixos, rest for windows 11)
+- `homelab` - my homelab server in a vm on a proxmox host with an i7 8700t, 32gb of ram, and 512gb boot drive (with hotplug enabled for cpu and ram)
+
+## credits
+- [orangc's flake](https://git.orangc.net/c/dots)
\ No newline at end of file

From c71da4411975e06e1643cdff0c6329845e5f642a Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 25 Mar 2026 16:38:00 +0700
Subject: [PATCH 084/427] remove unused sops

---
 flake.lock | 37 +------------------------------------
 flake.nix  |  3 ---
 2 files changed, 1 insertion(+), 39 deletions(-)

diff --git a/flake.lock b/flake.lock
index cc8baa0..c00515b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -123,47 +123,12 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1772736753,
-        "narHash": "sha256-au/m3+EuBLoSzWUCb64a/MZq6QUtOV8oC0D9tY2scPQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "917fec990948658ef1ccd07cef2a1ef060786846",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "ctp": "ctp",
         "gl": "gl",
         "hm": "hm",
-        "nixpkgs": "nixpkgs_3",
-        "sops": "sops"
-      }
-    },
-    "sops": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_4"
-      },
-      "locked": {
-        "lastModified": 1773096132,
-        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
+        "nixpkgs": "nixpkgs_3"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index 692ca4d..8130e57 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,7 +7,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     
-    sops.url = "github:Mic92/sops-nix";
     gl.url = "github:nix-community/nixGL";
     ctp.url = "github:catppuccin/nix";
   };
@@ -31,7 +30,6 @@
       modules = [
         ./hosts/${host}/config.nix
         inputs.ctp.nixosModules.catppuccin
-        inputs.sops.nixosModules.sops
       ];
     };
     
@@ -41,7 +39,6 @@
       modules = [
         ./hosts/${host}/config.nix
         inputs.ctp.nixosModules.catppuccin
-        inputs.sops.nixosModules.sops
         inputs.hm.nixosModules.home-manager
         {
           home-manager = {

From ee28bb7c42ddddc9b9ee953deceb5435325eea08 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Wed, 25 Mar 2026 18:34:03 +0700
Subject: [PATCH 085/427] cleanup and rename

---
 modules/home/core/apps.nix                    | 94 ++++++++++++-------
 modules/home/core/{zed.nix => code.nix}       |  0
 modules/home/core/{zsh.nix => shell.nix}      |  0
 modules/home/core/xdg.nix                     | 25 -----
 modules/home/default.nix                      |  2 +-
 modules/home/desktop.nix                      | 23 +++--
 .../{scheme-handlers.nix => handlers.nix}     |  0
 .../home/misc/{kde-connect.nix => phone.nix}  |  0
 modules/home/rice/{waybar.nix => bar.nix}     |  0
 .../rice/{hyprland.nix => compositor.nix}     |  0
 modules/home/rice/{hypridle.nix => idle.nix}  |  0
 .../rice/{hyprlock.nix => lockscreen.nix}     |  0
 modules/home/rice/{wlogout.nix => logout.nix} |  0
 modules/home/rice/{rofi.nix => menu.nix}      |  0
 modules/home/rice/{dunst.nix => notifs.nix}   |  0
 15 files changed, 71 insertions(+), 73 deletions(-)
 rename modules/home/core/{zed.nix => code.nix} (100%)
 rename modules/home/core/{zsh.nix => shell.nix} (100%)
 delete mode 100644 modules/home/core/xdg.nix
 rename modules/home/misc/{scheme-handlers.nix => handlers.nix} (100%)
 rename modules/home/misc/{kde-connect.nix => phone.nix} (100%)
 rename modules/home/rice/{waybar.nix => bar.nix} (100%)
 rename modules/home/rice/{hyprland.nix => compositor.nix} (100%)
 rename modules/home/rice/{hypridle.nix => idle.nix} (100%)
 rename modules/home/rice/{hyprlock.nix => lockscreen.nix} (100%)
 rename modules/home/rice/{wlogout.nix => logout.nix} (100%)
 rename modules/home/rice/{rofi.nix => menu.nix} (100%)
 rename modules/home/rice/{dunst.nix => notifs.nix} (100%)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 657bc7e..99fb001 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -1,43 +1,67 @@
 { pkgs, ... }: {
   nixpkgs.config.allowUnfree = true;
 
+  xdg = {
+    autostart.enable = true;
+    mimeApps = {
+      enable = true;
+      defaultApplications = {
+        "text/plain" = "nvim.desktop";
+        "text/html" = "brave-browser.desktop";
+        "application/pdf" = "brave-browser.desktop";
+        "x-scheme-handler/http" = "brave-browser.desktop";
+        "x-scheme-handler/https" = "brave-browser.desktop";
+        "x-terminal-emulator" = "kitty.desktop";
+        "inode/directory" = "pcmanfm-qt.desktop";
+        "audio/mpeg" = "vlc.desktop";
+        "audio/mp3" = "vlc.desktop";
+        "audio/wav" = "vlc.desktop";
+        "audio/flac" = "vlc.desktop";
+        "video/mp4" = "vlc.desktop";
+        "video/x-matroska" = "vlc.desktop";
+        "video/webm" = "vlc.desktop";
+        "video/x-msvideo" = "vlc.desktop";
+      };
+    };
+  };
+  
   home.packages = with pkgs; [
-      zed-editor
-      # kicad-small
-      # arduino-ide
+    zed-editor
+    # kicad-small
+    # arduino-ide
 
-      slack
-      discord
-      # protonmail-desktop # https://www.reddit.com/r/NixOS/comments/1rm9alf/protonmail_in_nixos/
-      
-      vlc
-      brave
-      libreoffice
-      appimage-run
-      # keepassxc
+    slack
+    discord
+    # protonmail-desktop # https://www.reddit.com/r/NixOS/comments/1rm9alf/protonmail_in_nixos/
+    
+    vlc
+    brave
+    libreoffice
+    appimage-run
+    # keepassxc
 
-      virt-manager
-      # winboat
-      
-      remmina
-      moonlight-qt
-      # rustdesk
-      
-      
-      # inkscape
-      # davinci-resolve
-      # kdePackages.kdenlive
-      (wrapOBS {
-        plugins = with obs-studio-plugins; [
-          wlrobs
-          obs-backgroundremoval
-          obs-pipewire-audio-capture
-        ];
-      })
+    virt-manager
+    # winboat
+    
+    remmina
+    moonlight-qt
+    # rustdesk
+    
+    
+    # inkscape
+    # davinci-resolve
+    # kdePackages.kdenlive
+    (wrapOBS {
+      plugins = with obs-studio-plugins; [
+        wlrobs
+        obs-backgroundremoval
+        obs-pipewire-audio-capture
+      ];
+    })
 
-      ferium
-      portablemc
-      steamguard-cli
-      # modrinth-app
-    ];
+    ferium
+    portablemc
+    steamguard-cli
+    # modrinth-app
+  ];
 }
diff --git a/modules/home/core/zed.nix b/modules/home/core/code.nix
similarity index 100%
rename from modules/home/core/zed.nix
rename to modules/home/core/code.nix
diff --git a/modules/home/core/zsh.nix b/modules/home/core/shell.nix
similarity index 100%
rename from modules/home/core/zsh.nix
rename to modules/home/core/shell.nix
diff --git a/modules/home/core/xdg.nix b/modules/home/core/xdg.nix
deleted file mode 100644
index ffc2a13..0000000
--- a/modules/home/core/xdg.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ ... }: {
-  xdg = {
-    autostart.enable = true;
-    mimeApps = {
-      enable = true;
-      defaultApplications = {
-        "text/plain" = "nvim.desktop";
-        "text/html" = "brave-browser.desktop";
-        "application/pdf" = "brave-browser.desktop";
-        "x-scheme-handler/http" = "brave-browser.desktop";
-        "x-scheme-handler/https" = "brave-browser.desktop";
-        "x-terminal-emulator" = "kitty.desktop";
-        "inode/directory" = "pcmanfm-qt.desktop";
-        "audio/mpeg" = "vlc.desktop";
-        "audio/mp3" = "vlc.desktop";
-        "audio/wav" = "vlc.desktop";
-        "audio/flac" = "vlc.desktop";
-        "video/mp4" = "vlc.desktop";
-        "video/x-matroska" = "vlc.desktop";
-        "video/webm" = "vlc.desktop";
-        "video/x-msvideo" = "vlc.desktop";
-      };
-    };
-  };
-}
\ No newline at end of file
diff --git a/modules/home/default.nix b/modules/home/default.nix
index 23334fd..8fa2337 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -1,7 +1,7 @@
 { username, ... }: {
   imports = [
+    ./core/shell.nix
     ./core/cli.nix
-    ./core/zsh.nix
   ];
 
   home = {
diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index a7a0bc1..3fbd229 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -1,20 +1,19 @@
 { pkgs, ... }: {
   imports = [
-    ./rice/hyprland.nix
-    ./rice/hyprlock.nix
-    ./rice/waybar.nix
-    ./rice/rofi.nix
-    ./rice/wlogout.nix
-    ./rice/hypridle.nix
-    ./rice/dunst.nix
+    ./rice/compositor.nix
+    ./rice/lockscreen.nix
+    ./rice/keybinds.nix
+    ./rice/logout.nix
+    ./rice/notifs.nix
     ./rice/cursor.nix
     ./rice/theme.nix
-    ./rice/keybinds.nix
-    ./misc/scheme-handlers.nix
-    ./misc/kde-connect.nix
+    ./rice/menu.nix
+    ./rice/idle.nix
+    ./rice/bar.nix
+    ./misc/handlers.nix
+    ./misc/phone.nix
     ./core/apps.nix
-    ./core/zed.nix
-    ./core/xdg.nix
+    ./core/code.nix
   ];
 
   services = {
diff --git a/modules/home/misc/scheme-handlers.nix b/modules/home/misc/handlers.nix
similarity index 100%
rename from modules/home/misc/scheme-handlers.nix
rename to modules/home/misc/handlers.nix
diff --git a/modules/home/misc/kde-connect.nix b/modules/home/misc/phone.nix
similarity index 100%
rename from modules/home/misc/kde-connect.nix
rename to modules/home/misc/phone.nix
diff --git a/modules/home/rice/waybar.nix b/modules/home/rice/bar.nix
similarity index 100%
rename from modules/home/rice/waybar.nix
rename to modules/home/rice/bar.nix
diff --git a/modules/home/rice/hyprland.nix b/modules/home/rice/compositor.nix
similarity index 100%
rename from modules/home/rice/hyprland.nix
rename to modules/home/rice/compositor.nix
diff --git a/modules/home/rice/hypridle.nix b/modules/home/rice/idle.nix
similarity index 100%
rename from modules/home/rice/hypridle.nix
rename to modules/home/rice/idle.nix
diff --git a/modules/home/rice/hyprlock.nix b/modules/home/rice/lockscreen.nix
similarity index 100%
rename from modules/home/rice/hyprlock.nix
rename to modules/home/rice/lockscreen.nix
diff --git a/modules/home/rice/wlogout.nix b/modules/home/rice/logout.nix
similarity index 100%
rename from modules/home/rice/wlogout.nix
rename to modules/home/rice/logout.nix
diff --git a/modules/home/rice/rofi.nix b/modules/home/rice/menu.nix
similarity index 100%
rename from modules/home/rice/rofi.nix
rename to modules/home/rice/menu.nix
diff --git a/modules/home/rice/dunst.nix b/modules/home/rice/notifs.nix
similarity index 100%
rename from modules/home/rice/dunst.nix
rename to modules/home/rice/notifs.nix

From 1d5efe00995504e44901a05f7ed4ae0f2c2fc82e Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 09:32:21 +0700
Subject: [PATCH 086/427] use angie

---
 modules/system/homelab/proxy.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index f831f17..84cf723 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,4 +1,4 @@
-{ homelab, lib, ... }: let
+{ pkgs, homelab, lib, ... }: let
   d = dest: { inherit dest; auth = false; };
   da = dest: { inherit dest; auth = true; };
 
@@ -58,6 +58,7 @@ in {
   services = {
     nginx = {
       enable = true;
+      package = pkgs.angie;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
       recommendedGzipSettings = true;

From dd2757013767ebd90aa5e2458e9c5f7ad0cdf933 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 19:47:22 +0700
Subject: [PATCH 087/427] add code-server

---
 modules/system/homelab/code.nix  | 12 ++++++++++++
 modules/system/homelab/dash.nix  |  1 +
 modules/system/homelab/proxy.nix |  3 ++-
 modules/system/server.nix        |  1 +
 4 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 modules/system/homelab/code.nix

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
new file mode 100644
index 0000000..52d5d7d
--- /dev/null
+++ b/modules/system/homelab/code.nix
@@ -0,0 +1,12 @@
+{ pkgs, username, ... }: {
+  services.code-server = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 8443;
+    user = username;
+    disableTelemetry = true;
+    extensionsDir = "/mnt/data/code-server/extensions";
+    userDataDit = "/mnt/data/code-server/user-data";
+    extraPackages = with pkgs; [];
+  };
+}
diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 727faf4..9a32422 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -69,6 +69,7 @@
   services = [
     [ "PocketID" "authentik" "https://auth.${homelab.domain}" "http://localhost:1411/" ]
     [ "Forgejo" "forgejo" "https://git.${homelab.domain}" "http://localhost:5080/" ]
+    [ "CodeServer" "coder" "https://code.${homelab.domain}" "http://localhost:8443/" ]
     [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
     [ "Traefik" "traefikproxy" "https://dynamic.proxy.${homelab.domain}/dashboard/" "" ]
     [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 84cf723..7afecfa 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -9,6 +9,7 @@
     "home"       = d "http://home.dns.${homelab.domain}:8123";
     
     "containers" = da "http://localhost:5001";
+    "code"       = da "http://localhost:8443";
     "dns"        = da "http://localhost:8088";
     
     "gallery"    = d "http://localhost:2283";
@@ -122,4 +123,4 @@ in {
       };
     };
   };
-}
\ No newline at end of file
+}
diff --git a/modules/system/server.nix b/modules/system/server.nix
index daa3747..da48085 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -18,6 +18,7 @@ in {
     ./homelab/auth.nix
     ./homelab/pass.nix
     ./homelab/dash.nix
+    ./homelab/code.nix
     ./homelab/dns.nix
     ./homelab/git.nix
     ./homelab/ai.nix

From d2f3f3a9adb393ea2202ede329b0bb3ec047dcaf Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 19:53:44 +0700
Subject: [PATCH 088/427] typo fix

Signed-off-by: satr14 <admin@satr14.my.id>
---
 modules/system/homelab/code.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 52d5d7d..93b9df1 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -6,7 +6,7 @@
     user = username;
     disableTelemetry = true;
     extensionsDir = "/mnt/data/code-server/extensions";
-    userDataDit = "/mnt/data/code-server/user-data";
+    userDataDir = "/mnt/data/code-server/user-data";
     extraPackages = with pkgs; [];
   };
 }

From 08ea39b54b0795eda4aa7f7c6147c2a281e02aef Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 19:56:29 +0700
Subject: [PATCH 089/427] change git username

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 882af83..05563c4 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -68,7 +68,7 @@
   git = { # setup your git author
     username = "satr14"; # forgejo username
     server = "https://git.satr14.my.id"; # forgejo server url
-    user = "Satria";
+    user = "satr14";
     email = "admin@satr14.my.id";
   };
 }

From 8190825296ed79061e6ef60782fa52c0b983339e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 19:59:04 +0700
Subject: [PATCH 090/427] add proxy prefix

---
 modules/system/homelab/dash.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 9a32422..c3f3fba 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -69,7 +69,7 @@
   services = [
     [ "PocketID" "authentik" "https://auth.${homelab.domain}" "http://localhost:1411/" ]
     [ "Forgejo" "forgejo" "https://git.${homelab.domain}" "http://localhost:5080/" ]
-    [ "CodeServer" "coder" "https://code.${homelab.domain}" "http://localhost:8443/" ]
+    [ "CodeServer" "coder" "https://code.proxy.${homelab.domain}" "http://localhost:8443/" ]
     [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
     [ "Traefik" "traefikproxy" "https://dynamic.proxy.${homelab.domain}/dashboard/" "" ]
     [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]

From 0442180b59a9ac52d34b5d7c5cf475c8b07bad6f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 28 Mar 2026 20:05:38 +0700
Subject: [PATCH 091/427] disable internal auth

---
 modules/system/homelab/code.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 93b9df1..3c560e7 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -4,6 +4,7 @@
     host = "127.0.0.1";
     port = 8443;
     user = username;
+    auth = "none";
     disableTelemetry = true;
     extensionsDir = "/mnt/data/code-server/extensions";
     userDataDir = "/mnt/data/code-server/user-data";

From 0ce7ecf71d0e80b0f4fe61bf20b36ad105d585cb Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 09:13:38 +0700
Subject: [PATCH 092/427] move some configs to options.nix

---
 lib/options.nix                  | 48 +++++++++++++++++++++++++++++++-
 modules/system/homelab/dash.nix  | 17 +----------
 modules/system/homelab/proxy.nix | 48 ++++++--------------------------
 3 files changed, 57 insertions(+), 56 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 05563c4..8409c21 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -1,4 +1,7 @@
-{
+let
+  d = dest: { inherit dest; auth = false; };
+  da = dest: { inherit dest; auth = true; };
+in {
   flake-path = "~/Projects/nix-flake"; # set this to the cloned repo path
 
   username = "satr14";
@@ -25,6 +28,49 @@
       data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
       host = "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
     };
+    dash = [
+      [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
+      [ "Forgejo" "forgejo" "https://git.${domain}" "http://localhost:5080/" ]
+      [ "CodeServer" "coder" "https://code.proxy.${domain}" "http://localhost:8443/" ]
+      [ "AdGuardHome" "adguard" "https://dns.proxy.${domain}" "http://localhost:8088/" ]
+      [ "Traefik" "traefikproxy" "https://dynamic.proxy.${domain}/dashboard/" "" ]
+      [ "Immich" "immich" "https://gallery.proxy.${domain}" "http://localhost:2283/" ]
+      [ "Jellyfin" "jellyfin" "https://media.proxy.${domain}" "http://localhost:8096/" ]
+      [ "VaultWarden" "vaultwarden" "https://pass.proxy.${domain}" "http://localhost:8060/" ]
+      [ "Ollama" "ollama" "https://ai.proxy.${domain}" "http://localhost:8080/" ]
+      [ "Ntfy" "ntfy" "https://notify.proxy.${domain}" "http://localhost:8067/" ]
+      [ "SearXNG" "searxng" "https://search.proxy.${domain}" "http://localhost:8091/" ]
+      [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
+    ];
+    proxy = {
+      base = "proxy.${domain}";
+      hosts = {
+        "server"     = d "https://server.dns.${domain}:8006";
+        "router"     = d "http://router.dns.${domain}:80";
+        "home"       = d "http://home.dns.${domain}:8123";
+        
+        "containers" = da "http://localhost:5001";
+        "code"       = da "http://localhost:8443";
+        "dns"        = da "http://localhost:8088";
+        
+        "gallery"    = d "http://localhost:2283";
+        "dynamic"    = d "http://localhost:8082";
+        "search"     = d "http://localhost:8091";
+        "notify"     = d "http://localhost:8067";
+        "media"      = d "http://localhost:8096";
+        "pass"       = d "http://localhost:8060";
+        "auth"       = d "http://localhost:1411";
+        "git"        = d "http://localhost:5080";
+        "ai"         = d "http://localhost:8080";
+        "@"          = d "http://localhost:5070";
+      };
+      redirects = {
+        "www"  = "https://${proxy.base}";
+        "dash" = "https://${proxy.base}";
+        "immich" = "https://gallery.${proxy.base}";
+        "2fa" = "https://2fa.${domain}";
+      };
+    };
     records = [
       [ "server.dns.${domain}"     "10.3.14.69"         ]
       [ "router.dns.${domain}"     "10.3.14.1"          ]
diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index c3f3fba..7839729 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -56,7 +56,6 @@
     [ "Hypervisor" "https://10.3.14.69:8006/" ]
     [ "Router" "http://10.3.14.1:80/" ]
     [ "DNS" "http://localhost:8088/" ]
-    [ "CDN" "http://nas.local:3000/" ]
     [ "Proxy" "https://proxy.${homelab.domain}/" ]
   ];
   external = [
@@ -66,20 +65,6 @@
     [ "OpenMediaVault" "openmediavault" "https://nas.local:80" "http://nas.local:80/" ]
     [ "ApacheHTTPD" "apache" "https://nas.local:3000" "http://nas.local:3000/" ]
   ];
-  services = [
-    [ "PocketID" "authentik" "https://auth.${homelab.domain}" "http://localhost:1411/" ]
-    [ "Forgejo" "forgejo" "https://git.${homelab.domain}" "http://localhost:5080/" ]
-    [ "CodeServer" "coder" "https://code.proxy.${homelab.domain}" "http://localhost:8443/" ]
-    [ "AdGuardHome" "adguard" "https://dns.proxy.${homelab.domain}" "http://localhost:8088/" ]
-    [ "Traefik" "traefikproxy" "https://dynamic.proxy.${homelab.domain}/dashboard/" "" ]
-    [ "Immich" "immich" "https://gallery.proxy.${homelab.domain}" "http://localhost:2283/" ]
-    [ "Jellyfin" "jellyfin" "https://media.proxy.${homelab.domain}" "http://localhost:8096/" ]
-    [ "VaultWarden" "vaultwarden" "https://pass.proxy.${homelab.domain}" "http://localhost:8060/" ]
-    [ "Ollama" "ollama" "https://ai.proxy.${homelab.domain}" "http://localhost:8080/" ]
-    [ "Ntfy" "ntfy" "https://notify.proxy.${homelab.domain}" "http://localhost:8067/" ]
-    [ "SearXNG" "searxng" "https://search.proxy.${homelab.domain}" "http://localhost:8091/" ]
-    [ "Dockge" "docker" "https://containers.proxy.${homelab.domain}" "http://localhost:5001/" ]
-  ];
   bookmarks = [
     [ "Tailscale" "tailscale" "https://login.tailscale.com/" ]
     [ "Cloudflare" "cloudflare" "https://dash.cloudflare.com/" ]
@@ -302,7 +287,7 @@ in {
                     icon = "si:${builtins.elemAt e 1}";
                     url = builtins.elemAt e 2;
                     check-url = builtins.elemAt e 3;
-                  }) services;
+                  }) homelab.dash;
                 }
                 {
                   type = "docker-containers";
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 7afecfa..4977a68 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,34 +1,4 @@
 { pkgs, homelab, lib, ... }: let
-  d = dest: { inherit dest; auth = false; };
-  da = dest: { inherit dest; auth = true; };
-
-  base = "proxy.${homelab.domain}";
-  hosts = {
-    "server"     = d "https://server.dns.${homelab.domain}:8006";
-    "router"     = d "http://router.dns.${homelab.domain}:80";
-    "home"       = d "http://home.dns.${homelab.domain}:8123";
-    
-    "containers" = da "http://localhost:5001";
-    "code"       = da "http://localhost:8443";
-    "dns"        = da "http://localhost:8088";
-    
-    "gallery"    = d "http://localhost:2283";
-    "dynamic"    = d "http://localhost:8082";
-    "search"     = d "http://localhost:8091";
-    "notify"     = d "http://localhost:8067";
-    "media"      = d "http://localhost:8096";
-    "pass"       = d "http://localhost:8060";
-    "auth"       = d "http://localhost:1411";
-    "git"        = d "http://localhost:5080";
-    "ai"         = d "http://localhost:8080";
-    "@"          = d "http://localhost:5070";
-  };
-  redirects = {
-    "www"  = "https://proxy.${homelab.domain}";
-    "dash" = "https://proxy.${homelab.domain}";
-    "immich" = "https://gallery.proxy.${homelab.domain}";
-    "2fa" = "https://2fa.${homelab.domain}";
-  };
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;
     proxy_read_timeout 600s;
@@ -47,9 +17,9 @@ in {
   security.acme = {
     acceptTerms = true;
     defaults.email = "admin@${homelab.domain}";
-    certs."${base}" = {
-      domain = "*.${base}";
-      extraDomainNames = [ base ];
+    certs."${homelab.proxy.base}" = {
+      domain = "*.${homelab.proxy.base}";
+      extraDomainNames = [ homelab.proxy.base ];
       dnsProvider = "cloudflare";
       environmentFile = "/mnt/data/acme/.env";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
@@ -68,7 +38,7 @@ in {
         "_" = {
           default = true;
           forceSSL = true;
-          useACMEHost = base;
+          useACMEHost = homelab.proxy.base;
           # locations."/".return = "404";
           locations."/" = {
             proxyPass = "http://127.0.0.1:81"; # traefik for docker container dynamic proxy
@@ -76,12 +46,12 @@ in {
             extraConfig = exta-conf;
           };
         };
-      } // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair "${subdomain}.${base}" {
-        useACMEHost = base;
+      } // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair "${subdomain}.${homelab.proxy.base}" {
+        useACMEHost = homelab.proxy.base;
         forceSSL = true;
         locations."/".return = "301 ${cfg}";
-      }) redirects // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair (if subdomain == "@" then base else "${subdomain}.${base}") {
-        useACMEHost = base;
+      }) homelab.proxy.redirects // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair (if subdomain == "@" then homelab.proxy.base else "${subdomain}.${homelab.proxy.base}") {
+        useACMEHost = homelab.proxy.base;
         forceSSL = true;
         extraConfig = ''
           access_log /var/log/nginx/${subdomain}.access.log;
@@ -93,7 +63,7 @@ in {
           basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
           extraConfig = exta-conf;
         };
-      }) hosts;
+      }) homelab.proxy.hosts;
     };
     traefik = {
       enable = true;

From 609cf85814221a2ad55d19eff4d227b136f6adc7 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 09:18:24 +0700
Subject: [PATCH 093/427] update flake

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index c00515b..d8728c4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1773146250,
-        "narHash": "sha256-azzOjRqTxAqByzRP87jUUsmfOQ85i7h/YkrgTX0jZgg=",
+        "lastModified": 1774616169,
+        "narHash": "sha256-fP4bU3SOH5sefSl6EagqULFs+bXoo3h3VLQCCyJplo4=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "0fa0d06dd3cd09f37f76d19b389d7ff947dfd7e8",
+        "rev": "e616c61cd9f7b05b32af266bc005fa266860dacf",
         "type": "github"
       },
       "original": {
@@ -62,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773179137,
-        "narHash": "sha256-EdW2bwzlfme0vbMOcStnNmKlOAA05Bp6su2O8VLGT0k=",
+        "lastModified": 1774738535,
+        "narHash": "sha256-2jfBEZUC67IlnxO5KItFCAd7Oc+1TvyV/jQlR+2ykGQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3f98e2bbc661ec0aaf558d8a283d6955f05f1d09",
+        "rev": "769e07ef8f4cf7b1ec3b96ef015abec9bc6b1e2a",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "lastModified": 1773821835,
+        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
         "type": "github"
       },
       "original": {
@@ -109,11 +109,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1772963539,
-        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
+        "lastModified": 1774386573,
+        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
+        "rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
         "type": "github"
       },
       "original": {

From 6c96c4ca0fdd2e58b420a8c73367562bec620bb0 Mon Sep 17 00:00:00 2001
From: Satria <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 09:46:51 +0700
Subject: [PATCH 094/427] disable forgejo restart on update

---
 modules/system/homelab/git.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 72c6050..8e6b25d 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -48,5 +48,8 @@
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };
   };
-  systemd.services."gitea-runner-nixos-deploy".restartIfChanged = false;
+  systemd.services = {
+    "gitea-runner-nixos-deploy".restartIfChanged = false;
+    "forgejo".restartIfChanged = false;
+  };
 }

From 8c76b31111cfd4cb7df436ee0515f7c9a24e2c07 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 10:47:54 +0700
Subject: [PATCH 095/427] disable reload after sleep

---
 modules/home/rice/idle.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/rice/idle.nix b/modules/home/rice/idle.nix
index 18d162d..80434de 100644
--- a/modules/home/rice/idle.nix
+++ b/modules/home/rice/idle.nix
@@ -6,7 +6,7 @@
         lock_cmd = "hyprlock";
         unlock_cmd = "pkill -USR1 hyprlock";
         before_sleep_cmd = "hyprctl dispatch dpms off && hyprlock";
-        after_sleep_cmd = "hyprctl dispatch dpms on && pkill -USR2 hyprlock";
+        after_sleep_cmd = "hyprctl dispatch dpms on";
       };
       listener = [
         {

From 78731e97baa7712538cd14324fa1884a52f92ad3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 11:00:42 +0700
Subject: [PATCH 096/427] add new share mount

---
 lib/options.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/options.nix b/lib/options.nix
index 8409c21..d73ebb0 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -25,6 +25,7 @@ in {
     ];
     disks = {
       gallery = "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
+      share = "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for media collection (named host for backwards compatibility)
       data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
       host = "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
     };

From 7716d6e599001c0cdbc26c48d1229681374acd9d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 11:22:50 +0700
Subject: [PATCH 097/427] make mount optional

---
 lib/options.nix                 | 11 +++++++----
 modules/hardware/misc/disks.nix | 10 ++++++++--
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index d73ebb0..aa12642 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -1,6 +1,9 @@
 let
   d = dest: { inherit dest; auth = false; };
   da = dest: { inherit dest; auth = true; };
+  
+  o = path: { inherit path; required = false; };
+  r = path: { inherit path; required = true; };
 in {
   flake-path = "~/Projects/nix-flake"; # set this to the cloned repo path
 
@@ -24,10 +27,10 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
-      gallery = "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
-      share = "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for media collection (named host for backwards compatibility)
-      data = "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
-      host = "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
+      share = o "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for file share and storage
+      gallery = r "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
+      data = r "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
+      host = r "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
     };
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
diff --git a/modules/hardware/misc/disks.nix b/modules/hardware/misc/disks.nix
index ea0948a..9479fe1 100644
--- a/modules/hardware/misc/disks.nix
+++ b/modules/hardware/misc/disks.nix
@@ -7,7 +7,13 @@
 in {
   fileSystems = {
     "/".autoResize = true;
-  } // lib.mapAttrs' (name: device:
-    lib.nameValuePair "/mnt/${name}" (globalOpts // { inherit device; })
+  } // lib.mapAttrs' (name: dev:
+    lib.nameValuePair "/mnt/${name}" (globalOpts // {
+      device = dev.path;
+      options = if dev.required == false then [
+        "nofail"
+        "x-systemd.automount"
+      ] else [];
+    })
   ) homelab.disks;
 }
\ No newline at end of file

From 5d082a11c3117abad8090ab83fb5ce85fdc8269a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 11:26:11 +0700
Subject: [PATCH 098/427] fix build error

---
 modules/hardware/misc/disks.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/hardware/misc/disks.nix b/modules/hardware/misc/disks.nix
index 9479fe1..0988ea9 100644
--- a/modules/hardware/misc/disks.nix
+++ b/modules/hardware/misc/disks.nix
@@ -13,7 +13,7 @@ in {
       options = if dev.required == false then [
         "nofail"
         "x-systemd.automount"
-      ] else [];
+      ] else [ "defaults" ];
     })
   ) homelab.disks;
 }
\ No newline at end of file

From 9e5f99b718ff9fa15146646c5a7d8cec14bcb9b9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 29 Mar 2026 11:30:08 +0700
Subject: [PATCH 099/427] fix fstype

---
 lib/options.nix                 | 12 ++++++------
 modules/hardware/misc/disks.nix |  6 +-----
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index aa12642..a421e5c 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -2,8 +2,8 @@ let
   d = dest: { inherit dest; auth = false; };
   da = dest: { inherit dest; auth = true; };
   
-  o = path: { inherit path; required = false; };
-  r = path: { inherit path; required = true; };
+  ext4 = path: { inherit path; type = "ext4"; };
+  btrfs = path: { inherit path; type = "btrfs"; };
 in {
   flake-path = "~/Projects/nix-flake"; # set this to the cloned repo path
 
@@ -27,10 +27,10 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
-      share = o "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for file share and storage
-      gallery = r "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
-      data = r "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
-      host = r "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
+      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for file share and storage
+      gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
+      data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
+      host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
     };
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
diff --git a/modules/hardware/misc/disks.nix b/modules/hardware/misc/disks.nix
index 0988ea9..b874ff7 100644
--- a/modules/hardware/misc/disks.nix
+++ b/modules/hardware/misc/disks.nix
@@ -1,6 +1,5 @@
 { lib, homelab, ... }: let
   globalOpts = {
-    fsType = "ext4";
     autoFormat = true;
     autoResize = true;
   };
@@ -10,10 +9,7 @@ in {
   } // lib.mapAttrs' (name: dev:
     lib.nameValuePair "/mnt/${name}" (globalOpts // {
       device = dev.path;
-      options = if dev.required == false then [
-        "nofail"
-        "x-systemd.automount"
-      ] else [ "defaults" ];
+      fsType = dev.type;
     })
   ) homelab.disks;
 }
\ No newline at end of file

From 16bba9d9f3de789edc1e80c8e1d6048c28ab85d5 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Apr 2026 17:14:16 +0700
Subject: [PATCH 100/427] fix bat pct and cpu overheating; add vim line numbers
 and cli themes to default

---
 modules/hardware/misc/battery-power.nix | 2 +-
 modules/hardware/misc/cpu-freq.nix      | 2 +-
 modules/home/core/cli.nix               | 1 +
 modules/home/default.nix                | 1 +
 modules/home/desktop.nix                | 1 -
 5 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index a8dbc96..12043dd 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -17,7 +17,7 @@
           BAT_PCT=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
           BAT_STA=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
           echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
-          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u normal   "Low Battery" "\$\{BAT_PCT}% remaining."
+          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u normal   "Low Battery" "Battery remaining: $BAT_PCT%."
           test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u critical "Low Battery" "Shutdown at 10%."
         ''} > /tmp/cron.batt.log 2>&1"
       ];
diff --git a/modules/hardware/misc/cpu-freq.nix b/modules/hardware/misc/cpu-freq.nix
index 2b6476a..ad87022 100644
--- a/modules/hardware/misc/cpu-freq.nix
+++ b/modules/hardware/misc/cpu-freq.nix
@@ -51,7 +51,7 @@
       enable = true; # wait for fix: https://github.com/AdnanHodzic/auto-cpufreq/issues/906
       settings = {
         charger = {
-          governor = "performance";
+          governor = "powersave"; # "performance";
           energy_performance_preference = "performance";
           turbo = "always";
           platform_profile = "performance";
diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 4d5cd63..b3a6372 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -51,6 +51,7 @@
         vim.api.nvim_create_autocmd("VimEnter", {
           callback = function()
             -- vim.cmd("NvimTreeOpen")
+            vim.cmd("set nu")
             vim.cmd.wincmd 'p'
           end,
         })
diff --git a/modules/home/default.nix b/modules/home/default.nix
index 8fa2337..590e901 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -1,5 +1,6 @@
 { username, ... }: {
   imports = [
+    ./rice/theme.nix
     ./core/shell.nix
     ./core/cli.nix
   ];
diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index 3fbd229..cafb780 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -6,7 +6,6 @@
     ./rice/logout.nix
     ./rice/notifs.nix
     ./rice/cursor.nix
-    ./rice/theme.nix
     ./rice/menu.nix
     ./rice/idle.nix
     ./rice/bar.nix

From 1328b445aa9ba5f3e8f95f3d46b811f98f4667a0 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 8 Apr 2026 17:58:59 +0700
Subject: [PATCH 101/427] update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index d8728c4..fb30067 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1774616169,
-        "narHash": "sha256-fP4bU3SOH5sefSl6EagqULFs+bXoo3h3VLQCCyJplo4=",
+        "lastModified": 1775213373,
+        "narHash": "sha256-wJHsijC2l/E+ovmlpPGha8pXA6RHSwHWmBV97gvkmyI=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "e616c61cd9f7b05b32af266bc005fa266860dacf",
+        "rev": "ba73719e673e7c2d89ac2f8df0bc0d48983e4907",
         "type": "github"
       },
       "original": {
@@ -62,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774738535,
-        "narHash": "sha256-2jfBEZUC67IlnxO5KItFCAd7Oc+1TvyV/jQlR+2ykGQ=",
+        "lastModified": 1775622785,
+        "narHash": "sha256-/yFxO+7oS1SymDfJ2iVO7K5vJKcYfe9XGIJ+quLqz0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "769e07ef8f4cf7b1ec3b96ef015abec9bc6b1e2a",
+        "rev": "527e47b78fe67213072f706bf933a9705a8c4974",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1773821835,
-        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
+        "lastModified": 1775036866,
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
         "type": "github"
       },
       "original": {
@@ -109,11 +109,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1774386573,
-        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
+        "lastModified": 1775423009,
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {

From d15920c908da430ccfb576a4e42f14c14c366d0d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 8 Apr 2026 20:16:41 +0700
Subject: [PATCH 102/427] screen hide lock

---
 modules/home/rice/keybinds.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 4fdf413..ad2cfc5 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -126,6 +126,7 @@
         "SUPER, F, togglefloating,"
         "SUPER, G, layoutmsg, togglesplit"
         "SUPER, L, exec, loginctl lock-session"
+        "SUPER SHIFT, L, exec, hyprctl dispatch dpms off && loginctl lock-session && sleep 1 && hyprctl dispatch dpms on"
         
         "SUPER, down, togglespecialworkspace, hidden"
         "SUPER SHIFT, down, movetoworkspace, special:hidden"

From a880332346f8b964be9180ae6f0f8cc4643135d1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 8 Apr 2026 20:17:35 +0700
Subject: [PATCH 103/427] fix eval warnings

---
 modules/home/core/cli.nix        | 3 +++
 modules/home/core/shell.nix      | 2 +-
 modules/home/desktop.nix         | 2 +-
 modules/home/rice/compositor.nix | 4 ++--
 modules/home/rice/keybinds.nix   | 4 ++--
 modules/home/rice/theme.nix      | 1 +
 6 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index b3a6372..3cd45ea 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -44,6 +44,8 @@
       enable = true;
       defaultEditor = true;
       vimAlias = true;
+      withRuby = false;
+      withPython3 = false;
       initLua = ''
         vim.opt.clipboard = "unnamedplus"
         vim.opt.termguicolors = true
@@ -81,6 +83,7 @@
     };
     git = {
       enable = true;
+      signing.format = null;
       settings = {
         pull.rebase = "true";
         credential.helper = "cache --timeout=3600";
diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index 8ce99d3..2a23a42 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -32,7 +32,7 @@
       '';
       shellAliases = {
         "cd-gvfs" = "cd /run/user/$(id -u)/gvfs";
-        "wlp-set" = "swww img --transition-type=grow --transition-duration=1";
+        "wlp-set" = "awww img --transition-type=grow --transition-duration=1";
         "ssh" = "TERM=xterm-256color ssh";
         "cd" = "z";
 
diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index cafb780..aa51784 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -16,7 +16,7 @@
   ];
 
   services = {
-    swww.enable = true;
+    awww.enable = true;
     hyprpolkitagent.enable = true;
   };
 
diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index b701605..1c84e92 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -30,7 +30,7 @@
 
         #"dunst &"
         #"hypridle &"
-        #"swww-daemon &"
+        #"awww-daemon &"
         "uwsm app -s s -- waybar &"
         "uwsm app -s b -- sunshine &"
 
@@ -140,7 +140,7 @@
       layerrule = [
         "no_anim on, match:namespace selection" # hyprshot overlay
         "no_anim on, match:namespace hyprpicker"
-        "animation fade, match:namespace swww-daemon"
+        "animation fade, match:namespace awww-daemon"
         "animation fade, match:namespace logout_dialog"
         "animation fade, match:namespace hyprshutdown"
         "above_lock 2, match:namespace notifications"
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index ad2cfc5..c0d4634 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -95,10 +95,10 @@
         "SUPER, N, exec, uwsm app -- rofi-network-manager"
 
         "SUPER, J, exec, notify-send -u critical ${hostname} 'Caffein Mode' && notify-send '(SUPER+X to reset)' && systemctl --user stop hypridle"
-        "SUPER, K, exec, notify-send -u critical ${hostname} 'Focus Mode' && notify-send '(SUPER+X to reset)' && systemctl --user stop swww && pkill -SIGUSR1 waybar && hyprctl --batch 'keyword decoration:inactive_opacity 1.0; keyword decoration:blur:enabled 0; keyword general:gaps_in 0; keyword general:gaps_out 0; keyword general:border_size 1; keyword decoration:rounding 0; keyword decoration:shadow:enabled false'"
+        "SUPER, K, exec, notify-send -u critical ${hostname} 'Focus Mode' && notify-send '(SUPER+X to reset)' && systemctl --user stop awww && pkill -SIGUSR1 waybar && hyprctl --batch 'keyword decoration:inactive_opacity 1.0; keyword decoration:blur:enabled 0; keyword general:gaps_in 0; keyword general:gaps_out 0; keyword general:border_size 1; keyword decoration:rounding 0; keyword decoration:shadow:enabled false'"
         "SUPER, B, submap, disabled-all-keybinds"
         "SUPER, H, exec, notify-send ${hostname} 'Animations Off' && hyprctl keyword animations:enabled 0"
-        "SUPER, X, exec, dunstctl close-all && hyprctl reload && hyprctl dispatch submap reset && pkill -SIGUSR2 waybar && systemctl --user restart swww hypridle fusuma"
+        "SUPER, X, exec, dunstctl close-all && hyprctl reload && hyprctl dispatch submap reset && pkill -SIGUSR2 waybar && systemctl --user restart awww hypridle fusuma"
         "SUPER, Z, exec, dunstctl close-all"
 
         "SUPER SHIFT, S, exec, hyprshot -zm region -o ~/Pictures/Screenshots; killall -9 hyprpicker hyprshot"
diff --git a/modules/home/rice/theme.nix b/modules/home/rice/theme.nix
index 0b994c5..71120dc 100644
--- a/modules/home/rice/theme.nix
+++ b/modules/home/rice/theme.nix
@@ -18,6 +18,7 @@
   gtk = {
     enable = true;
     gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
+    gtk4.theme = null;
     iconTheme = {
       name = "Papirus-Dark";
       package = lib.mkForce pkgs.papirus-icon-theme;

From 3e3bcd95844bc785961e5b206a5c091d8282ca88 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 9 Apr 2026 12:15:33 +0700
Subject: [PATCH 104/427] add dns record

---
 lib/options.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/options.nix b/lib/options.nix
index a421e5c..dd3f22a 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -79,6 +79,7 @@ in {
       [ "server.dns.${domain}"     "10.3.14.69"         ]
       [ "router.dns.${domain}"     "10.3.14.1"          ]
       [ "home.dns.${domain}"       "10.3.14.235"        ]
+      [ "games.dns.${domain}"      "10.3.14.37"         ]
       [ "workspace.dns.${domain}"  "10.3.14.57"         ]
       [ "old-main.dns.${domain}"   "10.3.14.42"         ] # old main machine for connecting while migrating
       

From 74754554e85a9af337eab8f0205fb6e7885603e3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 13 Apr 2026 08:03:22 +0700
Subject: [PATCH 105/427] move tunnels to options.nix

---
 lib/options.nix                    |  7 +++++++
 modules/system/homelab/tunnels.nix | 14 +++-----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index dd3f22a..65e2f7e 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -46,6 +46,13 @@ in {
       [ "SearXNG" "searxng" "https://search.proxy.${domain}" "http://localhost:8091/" ]
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
+    routes = {
+      "git.${domain}"     = "http://localhost:5080";
+      "auth.${domain}"    = "http://localhost:1411";
+      "dash.${domain}"    = "http://localhost:5070";
+      "media.${domain}"   = "http://localhost:8096";
+      "gallery.${domain}" = "http://localhost:2284";
+    };
     proxy = {
       base = "proxy.${domain}";
       hosts = {
diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index 8cf0fb6..c1a9c8d 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -1,19 +1,11 @@
-{ pkgs, lib, homelab, ... }: let
-  routes = {
-    "git.${homelab.domain}"     = "http://localhost:5080";
-    "auth.${homelab.domain}"    = "http://localhost:1411";
-    "dash.${homelab.domain}"    = "http://localhost:5070";
-    "media.${homelab.domain}"   = "http://localhost:8096";
-    "gallery.${homelab.domain}" = "http://localhost:2284";
-  };
-in {
+{ pkgs, lib, homelab, ... }: {
   services.cloudflared = {
     enable = true;
     tunnels.homelab = {
       credentialsFile = "/mnt/data/cloudflared/homelab.json";
       certificateFile = "/mnt/data/cloudflared/cert.pem";
       default = "http_status:404";
-      ingress = routes;
+      ingress = homelab.routes;
     };
   };
   
@@ -32,6 +24,6 @@ in {
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
       ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
-    '') (builtins.attrNames routes);
+    '') (builtins.attrNames homelab.routes);
   };
 }

From 4b2c7464f066b9ea16e4ff8b4e60a995c194a659 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 13 Apr 2026 08:16:16 +0700
Subject: [PATCH 106/427] cryptpad and copyparty

---
 lib/options.nix                 |  5 +++++
 modules/system/homelab/cdn.nix  |  5 +++++
 modules/system/homelab/docs.nix | 15 +++++++++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 modules/system/homelab/cdn.nix
 create mode 100644 modules/system/homelab/docs.nix

diff --git a/lib/options.nix b/lib/options.nix
index 65e2f7e..18a0ca1 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -35,6 +35,8 @@ in {
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
       [ "Forgejo" "forgejo" "https://git.${domain}" "http://localhost:5080/" ]
+      [ "Copyparty" "files" "https://cdn.${domain}" "http://localhost:3923/" ]
+      [ "CryptPad" "cryptpad" "https://docs.${domain}" "http://localhost:7090/" ]
       [ "CodeServer" "coder" "https://code.proxy.${domain}" "http://localhost:8443/" ]
       [ "AdGuardHome" "adguard" "https://dns.proxy.${domain}" "http://localhost:8088/" ]
       [ "Traefik" "traefikproxy" "https://dynamic.proxy.${domain}/dashboard/" "" ]
@@ -48,6 +50,8 @@ in {
     ];
     routes = {
       "git.${domain}"     = "http://localhost:5080";
+      "cdn.${domain}"     = "http://localhost:3923";
+      "docs.${domain}"    = "http://localhost:7090";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";
       "media.${domain}"   = "http://localhost:8096";
@@ -72,6 +76,7 @@ in {
         "pass"       = d "http://localhost:8060";
         "auth"       = d "http://localhost:1411";
         "git"        = d "http://localhost:5080";
+        "cdn"        = d "http://localhost:3923";
         "ai"         = d "http://localhost:8080";
         "@"          = d "http://localhost:5070";
       };
diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
new file mode 100644
index 0000000..a481800
--- /dev/null
+++ b/modules/system/homelab/cdn.nix
@@ -0,0 +1,5 @@
+{ pkgs, ... }: {
+  environment.systemPackages = with pkgs; [ copyparty-most ];
+
+  # TODO: systemd service
+}
diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
new file mode 100644
index 0000000..849e23d
--- /dev/null
+++ b/modules/system/homelab/docs.nix
@@ -0,0 +1,15 @@
+{ homelab, ... }: let
+  domain = "docs.${homelab.domain}";
+in {
+  services.cryptpad = {
+    enable = true;
+    settings = {
+      httpPort = 7090;
+      websocketPort = 7080;
+      httpUnsafeOrigin = "https://${domain}";
+      httpSafeOrigin = "https://${domain}";
+      blockDailyCheck = true;
+      disableIntegratedEviction = true;
+    };
+  };
+}
\ No newline at end of file

From d66e964bd97e735dd626a967897d0c17d108bf8c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 10:25:28 +0700
Subject: [PATCH 107/427] add disk

---
 lib/options.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 18a0ca1..b08e852 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -27,10 +27,14 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
-      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # disk for file share and storage
       gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
       data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
       host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
+      # ^^ virtual disks
+      
+      apps = ext4 "/dev/disk/by-uuid/aa453135-4b7a-4b12-8efc-f3dda093d2b7"; # app data
+      # achive = ext4 "/dev/disk/by-uuid/"; # long term archival 
+      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # file share
     };
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]

From 52a06a539fa9841531de33855bbc4dcdbc0822ff Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 13:09:17 +0700
Subject: [PATCH 108/427] seperate ctp theming from that file

---
 modules/home/default.nix    | 10 +++++++++-
 modules/home/rice/theme.nix |  7 -------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 590e901..a998633 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -1,9 +1,17 @@
-{ username, ... }: {
+{ username, ctp-opt, ... }: {
   imports = [
     ./rice/theme.nix
     ./core/shell.nix
     ./core/cli.nix
   ];
+  
+  catppuccin = {
+    enable = true;
+    hyprlock.useDefaultConfig = false;
+    
+    flavor = ctp-opt.flavor;
+    accent = ctp-opt.accent;
+  };
 
   home = {
     stateVersion = "24.11";
diff --git a/modules/home/rice/theme.nix b/modules/home/rice/theme.nix
index 71120dc..83e5a2e 100644
--- a/modules/home/rice/theme.nix
+++ b/modules/home/rice/theme.nix
@@ -1,11 +1,4 @@
 { lib, pkgs, ctp-opt, rice, ... }: {
-  catppuccin = {
-    enable = true;
-    hyprlock.useDefaultConfig = false;
-    
-    flavor = ctp-opt.flavor;
-    accent = ctp-opt.accent;
-  };
   
   dconf = {
     enable = true;

From 021c7f72000f7c08067bd70090e6be90a3aa0ebe Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 13:13:54 +0700
Subject: [PATCH 109/427] remove theme import

---
 modules/hardware/homelab.nix | 19 +++++--------------
 modules/home/core/apps.nix   |  1 +
 modules/home/default.nix     |  1 -
 3 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/modules/hardware/homelab.nix b/modules/hardware/homelab.nix
index ac3cb0c..906b24b 100644
--- a/modules/hardware/homelab.nix
+++ b/modules/hardware/homelab.nix
@@ -1,22 +1,13 @@
 { ... }: {
   imports = [
+    # ./misc/cpu-hotplug.nix
+    # ./misc/serial.nix 
+    # ./misc/qemu-virtio.nix
+    # ^^ only used if vm
+    
     ./core/firmware.nix
     ./core/igpu.nix
-    ./misc/cpu-hotplug.nix
-    ./misc/serial.nix
     ./misc/disks.nix
   ];
   
-  boot.initrd.availableKernelModules = [
-    "virtio_net"
-    "virtio_pci"
-    "virtio_mmio"
-    "virtio_blk"
-    "virtio_scsi"
-    "virtio_console"
-  ]; 
-  services = {
-    qemuGuest.enable = true;
-    spice-vdagentd.enable = true;
-  };
 }
diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 99fb001..c20f566 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -36,6 +36,7 @@
     
     vlc
     brave
+    flameshot
     libreoffice
     appimage-run
     # keepassxc
diff --git a/modules/home/default.nix b/modules/home/default.nix
index a998633..00bbbb6 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -1,6 +1,5 @@
 { username, ctp-opt, ... }: {
   imports = [
-    ./rice/theme.nix
     ./core/shell.nix
     ./core/cli.nix
   ];

From 4050b28ee3d79287a7331da510a350a837eb02b0 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 13:14:23 +0700
Subject: [PATCH 110/427] seperate qemu settings

---
 modules/hardware/homelab.nix          |  6 +++---
 modules/hardware/misc/qemu-virtio.nix | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)
 create mode 100644 modules/hardware/misc/qemu-virtio.nix

diff --git a/modules/hardware/homelab.nix b/modules/hardware/homelab.nix
index 906b24b..ba76f66 100644
--- a/modules/hardware/homelab.nix
+++ b/modules/hardware/homelab.nix
@@ -1,8 +1,8 @@
 { ... }: {
   imports = [
-    # ./misc/cpu-hotplug.nix
-    # ./misc/serial.nix 
-    # ./misc/qemu-virtio.nix
+    ./misc/cpu-hotplug.nix
+    ./misc/serial.nix 
+    ./misc/qemu-virtio.nix
     # ^^ only used if vm
     
     ./core/firmware.nix
diff --git a/modules/hardware/misc/qemu-virtio.nix b/modules/hardware/misc/qemu-virtio.nix
new file mode 100644
index 0000000..fef199b
--- /dev/null
+++ b/modules/hardware/misc/qemu-virtio.nix
@@ -0,0 +1,14 @@
+{ ... }: {
+  boot.initrd.availableKernelModules = [
+    "virtio_net"
+    "virtio_pci"
+    "virtio_mmio"
+    "virtio_blk"
+    "virtio_scsi"
+    "virtio_console"
+  ]; 
+  services = {
+    qemuGuest.enable = true;
+    spice-vdagentd.enable = true;
+  };
+}
\ No newline at end of file

From e187cecb794bd0789503058f42cf293ff2b56d17 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 20:05:36 +0700
Subject: [PATCH 111/427] change disks paths

---
 lib/options.nix                       | 10 +++++-----
 modules/system/homelab/ai.nix         |  4 ++--
 modules/system/homelab/auth.nix       |  4 ++--
 modules/system/homelab/code.nix       |  4 ++--
 modules/system/homelab/containers.nix |  5 +++--
 modules/system/homelab/gallery.nix    |  2 +-
 modules/system/homelab/git.nix        |  2 +-
 modules/system/homelab/pass.nix       |  4 ++--
 modules/system/homelab/proxy.nix      |  2 +-
 modules/system/homelab/search.nix     |  2 +-
 modules/system/homelab/tunnels.nix    |  6 +++---
 modules/system/server.nix             |  2 +-
 12 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index b08e852..6205a07 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -27,14 +27,14 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
     ];
     disks = {
-      gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
-      data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
-      host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
+      # gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 
+      # data = ext4 "/dev/disk/by-uuid/a5752dd6-092d-484c-969c-2fdc7cb4a5f0"; # disk for app data
+      # host = ext4 "/dev/disk/by-uuid/968f14a4-631e-4325-8cd1-f9aec0da9e4d"; # disk for media collection (named host for backwards compatibility)
       # ^^ virtual disks
       
-      apps = ext4 "/dev/disk/by-uuid/aa453135-4b7a-4b12-8efc-f3dda093d2b7"; # app data
       # achive = ext4 "/dev/disk/by-uuid/"; # long term archival 
-      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # file share
+      data = ext4 "/dev/disk/by-uuid/aa453135-4b7a-4b12-8efc-f3dda093d2b7"; # app data
+      share = btrfs "/dev/disk/by-uuid/f1ee1d17-e852-4e02-ae86-eaf6116a2aeb"; # file server
     };
     dash = [
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
diff --git a/modules/system/homelab/ai.nix b/modules/system/homelab/ai.nix
index a731d14..34dde0b 100644
--- a/modules/system/homelab/ai.nix
+++ b/modules/system/homelab/ai.nix
@@ -5,7 +5,7 @@
       host = "127.0.0.1";
       port = 11434;
       user = "ollama";
-      home = "/mnt/data/ollama";
+      home = "/mnt/data/apps/ollama";
       loadModels = [ 
         "gemma3n:e4b" # "gemma3n:e2b" 
         "qwen3-coder-next:cloud" # "codellama:7b" "starcoder:3b"
@@ -14,7 +14,7 @@
     open-webui = {
       enable = true;
       port = 8080;
-      environmentFile = "/mnt/data/ollama/.env";
+      environmentFile = "/mnt/data/apps/ollama/.env";
       environment = {
         OLLAMA_BASE_URL = "http://localhost:11434";
         # WEBUI_AUTH = "False";
diff --git a/modules/system/homelab/auth.nix b/modules/system/homelab/auth.nix
index 57823b9..a93350b 100644
--- a/modules/system/homelab/auth.nix
+++ b/modules/system/homelab/auth.nix
@@ -1,8 +1,8 @@
 { homelab, ... }: {
   services.pocket-id = {
     enable = true;
-    credentials.ENCRYPTION_KEY = "/mnt/data/pocketid/encryption-key";
-    dataDir = "/mnt/data/pocketid/data";
+    credentials.ENCRYPTION_KEY = "/mnt/data/apps/pocketid/encryption-key";
+    dataDir = "/mnt/data/apps/pocketid/data";
     settings = {
       PORT = "1411";
       HOST = "127.0.0.1";
diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 3c560e7..779e069 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -6,8 +6,8 @@
     user = username;
     auth = "none";
     disableTelemetry = true;
-    extensionsDir = "/mnt/data/code-server/extensions";
-    userDataDir = "/mnt/data/code-server/user-data";
+    extensionsDir = "/mnt/data/apps/code-server/extensions";
+    userDataDir = "/mnt/data/apps/code-server/user-data";
     extraPackages = with pkgs; [];
   };
 }
diff --git a/modules/system/homelab/containers.nix b/modules/system/homelab/containers.nix
index abff513..2ca748c 100644
--- a/modules/system/homelab/containers.nix
+++ b/modules/system/homelab/containers.nix
@@ -1,5 +1,6 @@
 { homelab, lib, ... }: let
-  stacks-dir = "/mnt/data/dockge/stacks";
+  dockge-dir = "/mnt/data/apps/dockge";
+  stacks-dir = "${dockge-dir}/stacks";
 in {
   virtualisation.oci-containers.containers."dockge" = {
     image = "louislam/dockge:nightly";
@@ -8,7 +9,7 @@ in {
     };
     volumes = [
       "${stacks-dir}:${stacks-dir}:rw"
-      "/mnt/data/dockge/data:/app/data:rw"
+      "${dockge-dir}/data:/app/data:rw"
       "/var/run/docker.sock:/var/run/docker.sock:rw"
     ];
     ports = [
diff --git a/modules/system/homelab/gallery.nix b/modules/system/homelab/gallery.nix
index ef890f6..c38787e 100644
--- a/modules/system/homelab/gallery.nix
+++ b/modules/system/homelab/gallery.nix
@@ -6,7 +6,7 @@
       enable = true;
       port = 2283;
       host = "127.0.0.1";
-      mediaLocation = "/mnt/gallery";
+      mediaLocation = "/mnt/data/gallery";
       accelerationDevices = null;
       environment.DB_URL = lib.mkForce "postgresql:///immich?host=/var/run/postgresql&user=immich"; # https://github.com/immich-app/immich/issues/26140
       machine-learning.enable = true;
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 8e6b25d..4ea36f7 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -3,7 +3,7 @@
     forgejo = {
       enable = true;
       lfs.enable = true;
-      stateDir = "/mnt/data/forgejo";
+      stateDir = "/mnt/data/apps/forgejo";
       package = pkgs.forgejo;
       settings = {
         server = {
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 192208d..7c4e85d 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -2,8 +2,8 @@
   services.vaultwarden = {
     enable = true;
     domain = "pass.proxy.${homelab.domain}";
-    backupDir = "/mnt/data/vaultwarden/backups";
-    environmentFile = "/mnt/data/vaultwarden/.env";
+    backupDir = "/mnt/data/apps/vaultwarden/backups";
+    environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 4977a68..2900e1f 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -21,7 +21,7 @@ in {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
       dnsProvider = "cloudflare";
-      environmentFile = "/mnt/data/acme/.env";
+      environmentFile = "/mnt/data/apps/acme/.env";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
     };
   };
diff --git a/modules/system/homelab/search.nix b/modules/system/homelab/search.nix
index 30d3118..ba46b70 100644
--- a/modules/system/homelab/search.nix
+++ b/modules/system/homelab/search.nix
@@ -2,7 +2,7 @@
   services.searx = {
     enable = true;
     redisCreateLocally = true;
-    environmentFile = "/mnt/data/searxng/.env";
+    environmentFile = "/mnt/data/apps/searxng/.env";
     settings = {
       server = {
         bind_address = "127.0.0.1";
diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index c1a9c8d..adc75a7 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -2,8 +2,8 @@
   services.cloudflared = {
     enable = true;
     tunnels.homelab = {
-      credentialsFile = "/mnt/data/cloudflared/homelab.json";
-      certificateFile = "/mnt/data/cloudflared/cert.pem";
+      credentialsFile = "/mnt/data/apps/cloudflared/homelab.json";
+      certificateFile = "/mnt/data/apps/cloudflared/cert.pem";
       default = "http_status:404";
       ingress = homelab.routes;
     };
@@ -23,7 +23,7 @@
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
     '') (builtins.attrNames homelab.routes);
   };
 }
diff --git a/modules/system/server.nix b/modules/system/server.nix
index da48085..b87b355 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -33,7 +33,7 @@ in {
   
   services.tailscale = {
     enable = true;
-    authKeyFile = "/mnt/data/tailscale/authkey";
+    authKeyFile = "/mnt/data/apps/tailscale/authkey";
     useRoutingFeatures = "server";
     extraUpFlags = ts-flags;
     extraSetFlags = ts-flags;

From ffb5b1c54628e83f5b943e60508dca33e7171669 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 20:42:02 +0700
Subject: [PATCH 112/427] move from dotfile

---
 modules/system/homelab/proxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 2900e1f..8ca2d5f 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -21,7 +21,7 @@ in {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
       dnsProvider = "cloudflare";
-      environmentFile = "/mnt/data/apps/acme/.env";
+      environmentFile = "/mnt/data/apps/acme/cf-api.env";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
     };
   };

From ec196f085e69ee9f497d31b9883d756c9cdaa03c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 20:45:52 +0700
Subject: [PATCH 113/427] dns overwrite

---
 modules/system/homelab/tunnels.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index adc75a7..c28f51d 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -23,7 +23,7 @@
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns ${homelab.cf-tunnel-id} ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns ${homelab.cf-tunnel-id} ${domain} || true
     '') (builtins.attrNames homelab.routes);
   };
 }

From a9326bf3943a300c846c14e5c9c5d4d6dca03930 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 21:33:48 +0700
Subject: [PATCH 114/427] fix cf tunnel dns issue

---
 lib/options.nix                    | 1 -
 modules/system/homelab/tunnels.nix | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 6205a07..d628f9b 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -21,7 +21,6 @@ in {
   
   homelab = rec {
     domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
-    cf-tunnel-id = "26318288-cdd7-4e58-904b-c45f10d3e40a";
     ssh-keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESvQFXoUBafatqnxTd6qk3WEOcfwb3AIWVTstR3lHzX forgejo"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index c28f51d..1b83bd5 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -23,7 +23,7 @@
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns ${homelab.cf-tunnel-id} ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns $(cat /mnt/data/apps/cloudflared/homelab.json | jq -r .TunnelID) ${domain} || true
     '') (builtins.attrNames homelab.routes);
   };
 }

From 8e320469ff987170e96c17c265f9a0781a58a906 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 15 Apr 2026 21:36:01 +0700
Subject: [PATCH 115/427] fix path err

---
 modules/system/homelab/tunnels.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/tunnels.nix b/modules/system/homelab/tunnels.nix
index 1b83bd5..1ad43f7 100644
--- a/modules/system/homelab/tunnels.nix
+++ b/modules/system/homelab/tunnels.nix
@@ -23,7 +23,7 @@
 
     script = lib.concatMapStringsSep "\n" (domain: ''
       echo "Ensuring DNS route for ${domain}..."
-      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns $(cat /mnt/data/apps/cloudflared/homelab.json | jq -r .TunnelID) ${domain} || true
+      ${pkgs.cloudflared}/bin/cloudflared tunnel --origincert /mnt/data/apps/cloudflared/cert.pem route dns --overwrite-dns $(cat /mnt/data/apps/cloudflared/homelab.json | ${pkgs.jq}/bin/jq -r .TunnelID) ${domain} || true
     '') (builtins.attrNames homelab.routes);
   };
 }

From ba1064ed43839639d0306b97ce133627586c7178 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 13:05:18 +0700
Subject: [PATCH 116/427] cleanup and add https

---
 lib/options.nix                    | 2 +-
 modules/system/homelab/gallery.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index d628f9b..24869c5 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -53,7 +53,7 @@ in {
     ];
     routes = {
       "git.${domain}"     = "http://localhost:5080";
-      "cdn.${domain}"     = "http://localhost:3923";
+      "cdn.${domain}"     = "https://localhost:3923";
       "docs.${domain}"    = "http://localhost:7090";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";
diff --git a/modules/system/homelab/gallery.nix b/modules/system/homelab/gallery.nix
index c38787e..1b52208 100644
--- a/modules/system/homelab/gallery.nix
+++ b/modules/system/homelab/gallery.nix
@@ -1,4 +1,4 @@
-{ lib, homelab, ... }: {
+{ lib, ... }: {
   users.users.immich.extraGroups = [ "video" "render" ];
 
   services = {

From 2f37165d19e5f17ff355917a899ba9f55237dee4 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 13:53:28 +0700
Subject: [PATCH 117/427] self signed certs

---
 lib/options.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 24869c5..45f0188 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -4,6 +4,8 @@ let
   
   ext4 = path: { inherit path; type = "ext4"; };
   btrfs = path: { inherit path; type = "btrfs"; };
+  
+  selfSigned = service: { inherit service; originRequest.noTLSVerify = true; };
 in {
   flake-path = "~/Projects/nix-flake"; # set this to the cloned repo path
 
@@ -52,8 +54,8 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
+      "cdn.${domain}"     = selfSigned "https://localhost:3923";
       "git.${domain}"     = "http://localhost:5080";
-      "cdn.${domain}"     = "https://localhost:3923";
       "docs.${domain}"    = "http://localhost:7090";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";

From e4d1fdc40d222301022f587dbc5b2f928080fe8b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 19:48:06 +0700
Subject: [PATCH 118/427] copyparty service

---
 modules/system/homelab/cdn.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index a481800..8710072 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,5 +1,14 @@
 { pkgs, ... }: {
   environment.systemPackages = with pkgs; [ copyparty-most ];
 
-  # TODO: systemd service
+  systemd.services.copyparty = {
+    description = "File Sharing Service";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      Restart = "on-failure";
+      User = "nobody";
+    };
+  };
 }

From a6c8935bf2677e20d0c9b3c2395ee1263cb3ad6a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 19:48:28 +0700
Subject: [PATCH 119/427] move data to data drive

---
 modules/system/homelab/db.nix   | 7 +++++++
 modules/system/homelab/pass.nix | 1 +
 modules/system/server.nix       | 1 +
 3 files changed, 9 insertions(+)
 create mode 100644 modules/system/homelab/db.nix

diff --git a/modules/system/homelab/db.nix b/modules/system/homelab/db.nix
new file mode 100644
index 0000000..11cfedc
--- /dev/null
+++ b/modules/system/homelab/db.nix
@@ -0,0 +1,7 @@
+{ pkgs, ... }: {
+  services.postgresql = {
+    enable = true;
+    dataDir = "/mnt/data/apps/postgresql"; 
+    package = pkgs.postgresql_16;
+  };
+}
\ No newline at end of file
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 7c4e85d..028f99d 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -5,6 +5,7 @@
     backupDir = "/mnt/data/apps/vaultwarden/backups";
     environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
+      DATA_FOLDER = "/mnt/data/apps/vaultwarden/data";
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";
diff --git a/modules/system/server.nix b/modules/system/server.nix
index b87b355..460c46a 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -22,6 +22,7 @@ in {
     ./homelab/dns.nix
     ./homelab/git.nix
     ./homelab/ai.nix
+    ./homelab/db.nix
     
     ./core/swapfile.nix
     ./core/oom.nix

From 65aa2759d0191b737edfae60cfdbb8d2730e5f82 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 19:57:02 +0700
Subject: [PATCH 120/427] cleanup

---
 modules/system/homelab/code.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 779e069..3d79fc7 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -1,4 +1,4 @@
-{ pkgs, username, ... }: {
+{ username, ... }: {
   services.code-server = {
     enable = true;
     host = "127.0.0.1";
@@ -8,6 +8,5 @@
     disableTelemetry = true;
     extensionsDir = "/mnt/data/apps/code-server/extensions";
     userDataDir = "/mnt/data/apps/code-server/user-data";
-    extraPackages = with pkgs; [];
   };
 }

From a6020b2dbed53325cbdbfc6b0b8380674083805b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 19:57:10 +0700
Subject: [PATCH 121/427] enable service

---
 modules/system/homelab/cdn.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 8710072..22a3b52 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -3,6 +3,7 @@
 
   systemd.services.copyparty = {
     description = "File Sharing Service";
+    enable = true;
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {

From a1cd1172199e757b26f7806428542b8aa98f64c1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 19:59:46 +0700
Subject: [PATCH 122/427] fix user

---
 modules/system/homelab/cdn.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 22a3b52..a2bd042 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -9,7 +9,6 @@
     serviceConfig = {
       ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
-      User = "nobody";
     };
   };
 }

From 99c5fade9bbafafb3b0b0b8184b306f06931f1d3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 21:37:26 +0700
Subject: [PATCH 123/427] revert because of error

---
 modules/system/homelab/pass.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 028f99d..e854d9a 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -5,7 +5,7 @@
     backupDir = "/mnt/data/apps/vaultwarden/backups";
     environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
-      DATA_FOLDER = "/mnt/data/apps/vaultwarden/data";
+      # DATA_FOLDER = "/mnt/data/apps/vaultwarden/data"; # [vaultwarden][ERROR] Error creating private key '/mnt/data/apps/vaultwarden/data/rsa_key.pem'
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";

From db140f48990dd19e2197500d43f3a847f2bcf475 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 21:44:54 +0700
Subject: [PATCH 124/427] dashboard changes

---
 modules/system/homelab/dash.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 7839729..27ba4e9 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -83,7 +83,6 @@ in {
   };
   services.glance = {
     enable = true;
-    environmentFile = "/var/lib/glance/.env";
     settings = {
       server = {
         host = "127.0.0.1";
@@ -260,7 +259,7 @@ in {
                   type = "server-stats";
                   servers = [{
                     type = "local";
-                    mountpoints."/nix/store".hide = true;
+                    # mountpoints."/nix/store".hide = true;
                   }];
                 }
                 {

From c36733605b3fce051a0d843355a8e942d5f9937b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 21:46:37 +0700
Subject: [PATCH 125/427] change key location

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 4ea36f7..39f4de1 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -43,7 +43,7 @@
       enable = true;
       name = "nixos-server-runner";
       url = "https://git.proxy.${homelab.domain}";
-      tokenFile = "/root/forgejo-token-runner"; 
+      tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
       labels = [ "self-hosted:host" ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
     };

From eb090161b8172568f251dcd40af079dae664892d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 21:51:10 +0700
Subject: [PATCH 126/427] move config files to drive

---
 modules/system/homelab/media.nix | 3 ++-
 modules/system/homelab/proxy.nix | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/media.nix b/modules/system/homelab/media.nix
index 2393ccf..0c7a17f 100644
--- a/modules/system/homelab/media.nix
+++ b/modules/system/homelab/media.nix
@@ -5,6 +5,7 @@
   services = {
     jellyfin = {
       enable = true;
+      dataDir = "/mnt/data/apps/jellyfin";
       hardwareAcceleration = {
         enable = true;
         device = "/dev/dri/renderD128";
@@ -43,4 +44,4 @@
     #   port = 8191;
     # };
   };
-}
\ No newline at end of file
+}
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 8ca2d5f..ee3930e 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -1,4 +1,5 @@
 { pkgs, homelab, lib, ... }: let
+  htpasswd = "/mnt/data/apps/nginx/htpasswd";
   exta-conf = ''
     # proxy_set_header X-Auth-User $remote_user;
     proxy_read_timeout 600s;
@@ -60,7 +61,7 @@ in {
         locations."/" = {
           proxyPass = cfg.dest;
           proxyWebsockets = true;
-          basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
+          basicAuthFile = if cfg.auth then htpasswd else null;
           extraConfig = exta-conf;
         };
       }) homelab.proxy.hosts;
@@ -68,7 +69,7 @@ in {
     traefik = {
       enable = true;
       dynamicConfigOptions = {
-        http.middlewares.auth.basicAuth.usersFile = "/var/lib/nginx/.htpasswd";
+        http.middlewares.auth.basicAuth.usersFile = htpasswd;
       };
       staticConfigOptions = {
         entryPoints = {

From 50e0af48e679a3bf0d8565fc1d01d5f94ad7bb23 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 16 Apr 2026 22:14:56 +0700
Subject: [PATCH 127/427] add cdn import

---
 modules/system/server.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/server.nix b/modules/system/server.nix
index 460c46a..d4289d3 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -21,6 +21,7 @@ in {
     ./homelab/code.nix
     ./homelab/dns.nix
     ./homelab/git.nix
+    ./homelab/cdn.nix
     ./homelab/ai.nix
     ./homelab/db.nix
     

From 41b53dca9fddf2201e1a516f1658127ae317013b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 17 Apr 2026 09:05:31 +0700
Subject: [PATCH 128/427] remove unused links

---
 modules/system/homelab/dash.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 27ba4e9..ff6656d 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -61,9 +61,6 @@
   external = [
     [ "Proxmox" "proxmox" "https://server.proxy.${homelab.domain}" "http://server.dns.${homelab.domain}:8006/" ]
     [ "OpenWRT" "openwrt" "https://router.proxy.${homelab.domain}" "http://router.dns.${homelab.domain}:80/" ]
-    [ "HomeAssistant" "homeassistant" "https://home.proxy.${homelab.domain}" "http://home.dns.${homelab.domain}:8123/" ]
-    [ "OpenMediaVault" "openmediavault" "https://nas.local:80" "http://nas.local:80/" ]
-    [ "ApacheHTTPD" "apache" "https://nas.local:3000" "http://nas.local:3000/" ]
   ];
   bookmarks = [
     [ "Tailscale" "tailscale" "https://login.tailscale.com/" ]

From f72ab504f47a853c16079b2674a50af9d32b18f3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Apr 2026 06:32:28 +0700
Subject: [PATCH 129/427] add cf and cloud utils

---
 modules/system/misc/utilities.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/misc/utilities.nix b/modules/system/misc/utilities.nix
index 8f5be3a..c43144a 100644
--- a/modules/system/misc/utilities.nix
+++ b/modules/system/misc/utilities.nix
@@ -29,6 +29,8 @@
     blueman
     shared-mime-info
     usbutils
+    cloudflared
+    cloud-utils
     
     hplipWithPlugin
 

From 7dbb09ebff7681ab9b0b48c69c1de5e320023a3b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 29 Apr 2026 18:50:48 +0700
Subject: [PATCH 130/427] organization

---
 modules/system/misc/utilities.nix | 90 ++++++++++++++++++-------------
 1 file changed, 54 insertions(+), 36 deletions(-)

diff --git a/modules/system/misc/utilities.nix b/modules/system/misc/utilities.nix
index c43144a..29c4c6f 100644
--- a/modules/system/misc/utilities.nix
+++ b/modules/system/misc/utilities.nix
@@ -1,62 +1,80 @@
 { pkgs, ... }: {
   environment.systemPackages = with pkgs; [
+    # Disk & Storage
     baobab
-    file-roller
-    gnome-network-displays
     gnome-disk-utility
-    
-    parted
-    smartmontools
-    lm_sensors
-    ntfs3g
-    virt-viewer
-    dconf2nix
-    pciutils
     gparted
+    parted
+    ntfs3g
     exfatprogs
-    pavucontrol
-    jq
+    smartmontools
+    ncdu
+    ventoy-full-qt
+
+    # System Monitoring & Hardware
+    htop
+    sysstat
     powertop
+    lm_sensors
     fastfetch
+    pciutils
+    usbutils
+    stress
+    stress-ng
+
+    # Networking
+    gnome-network-displays
     ethtool
     dig
     dnslookup
-    lsof
-    gucharmap
-    ncdu
-    zip
-    unzip
-    blueman
-    shared-mime-info
-    usbutils
+    nmap
+    netcat
+    traceroute
+    wakeonlan
     cloudflared
     cloud-utils
-    
-    hplipWithPlugin
 
-    android-tools
-    scrcpy
+    # Archives & Compression
+    file-roller
+    zip
+    unzip
+    p7zip
+
+    # GUI Utilities
+    pavucontrol
+    gucharmap
+    lxappearance
+    blueman
+    shared-mime-info
+
+    # Virtualization & Containers
+    virt-viewer
     distrobox
 
-    ventoy-full-qt
+    # Android
+    android-tools
+    scrcpy
+
+    # Remote Access
+    freerdp
+
+    # Media
     ffmpeg
+
+    # Printing
+    hplipWithPlugin
+
+    # CLI Essentials
     vim
     wget
     curl
     openssl_3
-    htop
-    nmap
-    sysstat
-    netcat
-    p7zip
-    stress
-    stress-ng
-    wakeonlan
     coreutils-full
-    traceroute
-    lxappearance
-    freerdp
+    jq
+    lsof
 
+    # Nix & Development
+    dconf2nix
     home-manager
     nix-index
     nixd

From bd7e1766714f4c25a34a1a121ba1ef0b8887840b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 29 Apr 2026 19:00:06 +0700
Subject: [PATCH 131/427] cryptpad config

---
 modules/system/homelab/docs.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 849e23d..a82219c 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -1,15 +1,30 @@
 { homelab, ... }: let
   domain = "docs.${homelab.domain}";
+  sandbox = "docs-sandbox.${homelab.domain}";
+  data-dir = "/mnt/data/apps/cryptpad";
 in {
   services.cryptpad = {
     enable = true;
     settings = {
       httpPort = 7090;
-      websocketPort = 7080;
+      httpAddress = "127.0.0.1";
       httpUnsafeOrigin = "https://${domain}";
-      httpSafeOrigin = "https://${domain}";
+      httpSafeOrigin = "https://${sandbox}";
       blockDailyCheck = true;
       disableIntegratedEviction = true;
+      archivePath = "${data-dir}/archive";
+      pinPath = "${data-dir}/pins";
+      taskPath = "${data-dir}/tasks";
+      blockPath = "${data-dir}/block";
+      blobPath = "${data-dir}/blob";
+      blobStagingPath = "${data-dir}/blobstage";
+      decreePath = "${data-dir}/decrees";
+      logPath = "${data-dir}/logs";
     };
   };
+  
+  systemd.services.cryptpad.serviceConfig = {
+    ReadWritePaths = [ data-dir ];
+    ProtectMountPoints = false;
+  };
 }
\ No newline at end of file

From a694fe1f9bccb634e27f86fcb10948875b643b71 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 29 Apr 2026 20:27:15 +0700
Subject: [PATCH 132/427] enable cryptpad

---
 lib/options.nix           | 3 ++-
 modules/system/server.nix | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 45f0188..96a2002 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -54,9 +54,10 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
+      "docs-sandbox.${domain}" = "http://localhost:7090";
+      "docs.${domain}"         = "http://localhost:7090";
       "cdn.${domain}"     = selfSigned "https://localhost:3923";
       "git.${domain}"     = "http://localhost:5080";
-      "docs.${domain}"    = "http://localhost:7090";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";
       "media.${domain}"   = "http://localhost:8096";
diff --git a/modules/system/server.nix b/modules/system/server.nix
index d4289d3..7df13d2 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -19,6 +19,7 @@ in {
     ./homelab/pass.nix
     ./homelab/dash.nix
     ./homelab/code.nix
+    ./homelab/docs.nix
     ./homelab/dns.nix
     ./homelab/git.nix
     ./homelab/cdn.nix

From 5af8c832ef5f0b858ffbfc315913b3f07d39b761 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 30 Apr 2026 17:38:19 +0700
Subject: [PATCH 133/427] notif tweaks

---
 modules/hardware/misc/battery-power.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index 12043dd..3a2ca6b 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -17,8 +17,8 @@
           BAT_PCT=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
           BAT_STA=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
           echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
-          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u normal   "Low Battery" "Battery remaining: $BAT_PCT%."
-          test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -c device -u critical "Low Battery" "Shutdown at 10%."
+          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send "Low Battery" "Battery remaining: $BAT_PCT%."
+          test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -u critical "Low Battery" "Shutdown at 10%."
         ''} > /tmp/cron.batt.log 2>&1"
       ];
     };

From bd07e04d51faf40345aa5fce76487c893f8e9645 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 07:36:39 +0700
Subject: [PATCH 134/427] change acme dir

---
 modules/system/homelab/proxy.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index ee3930e..c5cfc80 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -21,8 +21,9 @@ in {
     certs."${homelab.proxy.base}" = {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
-      dnsProvider = "cloudflare";
+      directory = "/mnt/data/apps/acme/${homelab.proxy.base}";
       environmentFile = "/mnt/data/apps/acme/cf-api.env";
+      dnsProvider = "cloudflare";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
     };
   };

From 9dbaf614846afc51ce9c58023d0dc6ad1104ffb8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 07:42:44 +0700
Subject: [PATCH 135/427] change data dir

---
 modules/system/homelab/pass.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index e854d9a..028f99d 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -5,7 +5,7 @@
     backupDir = "/mnt/data/apps/vaultwarden/backups";
     environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
-      # DATA_FOLDER = "/mnt/data/apps/vaultwarden/data"; # [vaultwarden][ERROR] Error creating private key '/mnt/data/apps/vaultwarden/data/rsa_key.pem'
+      DATA_FOLDER = "/mnt/data/apps/vaultwarden/data";
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";

From 19c95a7d7013c7007ff01d233d08b61defb731a7 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 07:50:17 +0700
Subject: [PATCH 136/427] fix perms error

---
 modules/system/homelab/docs.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index a82219c..2d9ff74 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -3,6 +3,10 @@
   sandbox = "docs-sandbox.${homelab.domain}";
   data-dir = "/mnt/data/apps/cryptpad";
 in {
+  systemd.tmpfiles.rules = [
+    "d ${data-dir} 0750 cryptpad cryptpad -"
+  ];
+
   services.cryptpad = {
     enable = true;
     settings = {
@@ -22,9 +26,6 @@ in {
       logPath = "${data-dir}/logs";
     };
   };
-  
-  systemd.services.cryptpad.serviceConfig = {
-    ReadWritePaths = [ data-dir ];
-    ProtectMountPoints = false;
-  };
-}
\ No newline at end of file
+
+  systemd.services.cryptpad.serviceConfig.ReadWritePaths = [ data-dir ];
+}

From 853e5a3d99cc89795a8bdb5fe1d0a8f2cf26d6d3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 07:50:23 +0700
Subject: [PATCH 137/427] revert dir set

---
 modules/system/homelab/proxy.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index c5cfc80..7f46967 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -21,7 +21,6 @@ in {
     certs."${homelab.proxy.base}" = {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
-      directory = "/mnt/data/apps/acme/${homelab.proxy.base}";
       environmentFile = "/mnt/data/apps/acme/cf-api.env";
       dnsProvider = "cloudflare";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX

From 14a65b8c7e5b17d25960f3f013b36b3b9a574401 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 07:58:04 +0700
Subject: [PATCH 138/427] revert not working fix

---
 modules/system/homelab/docs.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 2d9ff74..caa5c9c 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -3,10 +3,6 @@
   sandbox = "docs-sandbox.${homelab.domain}";
   data-dir = "/mnt/data/apps/cryptpad";
 in {
-  systemd.tmpfiles.rules = [
-    "d ${data-dir} 0750 cryptpad cryptpad -"
-  ];
-
   services.cryptpad = {
     enable = true;
     settings = {
@@ -26,6 +22,4 @@ in {
       logPath = "${data-dir}/logs";
     };
   };
-
-  systemd.services.cryptpad.serviceConfig.ReadWritePaths = [ data-dir ];
 }

From d4de48420f06c77dc06ea6694b5c093ea2685491 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 08:05:02 +0700
Subject: [PATCH 139/427] bind mount loophole

---
 modules/system/homelab/docs.nix | 14 ++++++--------
 modules/system/homelab/pass.nix |  7 ++++++-
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index caa5c9c..fad718c 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -12,14 +12,12 @@ in {
       httpSafeOrigin = "https://${sandbox}";
       blockDailyCheck = true;
       disableIntegratedEviction = true;
-      archivePath = "${data-dir}/archive";
-      pinPath = "${data-dir}/pins";
-      taskPath = "${data-dir}/tasks";
-      blockPath = "${data-dir}/block";
-      blobPath = "${data-dir}/blob";
-      blobStagingPath = "${data-dir}/blobstage";
-      decreePath = "${data-dir}/decrees";
-      logPath = "${data-dir}/logs";
     };
   };
+  
+  fileSystems."/var/lib/cryptpad" = {
+    device = "/mnt/data/apps/cryptpad";
+    dependsOn = [ "/mnt/data" ]; 
+    options = [ "bind" "nofail" ];
+  };
 }
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 028f99d..86a4707 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -5,10 +5,15 @@
     backupDir = "/mnt/data/apps/vaultwarden/backups";
     environmentFile = "/mnt/data/apps/vaultwarden/.env";
     config = {
-      DATA_FOLDER = "/mnt/data/apps/vaultwarden/data";
       ROCKET_PORT = 8060;
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_LOG = "critical";
     };
   };
+  
+  fileSystems."/var/lib/vaultwarden" = {
+    device = "/mnt/data/apps/vaultwarden/data";
+    dependsOn = [ "/mnt/data" ];
+    options = [ "bind" "nofail" ];
+  };
 }
\ No newline at end of file

From ac8e025f67dfa706e7d8e00a05f3a8c016f4de48 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 08:10:22 +0700
Subject: [PATCH 140/427] fix option name

---
 modules/system/homelab/docs.nix | 2 +-
 modules/system/homelab/pass.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index fad718c..aa355c5 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -17,7 +17,7 @@ in {
   
   fileSystems."/var/lib/cryptpad" = {
     device = "/mnt/data/apps/cryptpad";
-    dependsOn = [ "/mnt/data" ]; 
+    depends = [ "/mnt/data" ]; 
     options = [ "bind" "nofail" ];
   };
 }
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index 86a4707..ec2c43c 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -13,7 +13,7 @@
   
   fileSystems."/var/lib/vaultwarden" = {
     device = "/mnt/data/apps/vaultwarden/data";
-    dependsOn = [ "/mnt/data" ];
+    depends = [ "/mnt/data" ];
     options = [ "bind" "nofail" ];
   };
 }
\ No newline at end of file

From 4924eebbc2c402718a26e349176b3704749979d2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 08:13:10 +0700
Subject: [PATCH 141/427] bind mount for cert storage

---
 modules/system/homelab/proxy.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 7f46967..446197e 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -27,6 +27,12 @@ in {
     };
   };
   
+  fileSystems."/var/lib/acme/${homelab.proxy.base}" = {
+    device = "/mnt/data/apps/acme/${homelab.proxy.base}";
+    depends = [ "/mnt/data" ];
+    options = [ "bind" "nofail" ];
+  };
+  
   services = {
     nginx = {
       enable = true;

From b135e301f1b2baceb9700048e1ced54bc1e66401 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 08:18:29 +0700
Subject: [PATCH 142/427] fix cryptpad websocket port

---
 modules/system/homelab/docs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index aa355c5..a8126b0 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -1,11 +1,11 @@
 { homelab, ... }: let
   domain = "docs.${homelab.domain}";
   sandbox = "docs-sandbox.${homelab.domain}";
-  data-dir = "/mnt/data/apps/cryptpad";
 in {
   services.cryptpad = {
     enable = true;
     settings = {
+      websocketPort = 7091;
       httpPort = 7090;
       httpAddress = "127.0.0.1";
       httpUnsafeOrigin = "https://${domain}";

From 54d2d8a6c6bf0f6fe4c982cc6d488af972a16849 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 08:56:54 +0700
Subject: [PATCH 143/427] dns cleanup

---
 lib/options.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 96a2002..f0282ee 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -96,12 +96,8 @@ in {
     records = [
       [ "server.dns.${domain}"     "10.3.14.69"         ]
       [ "router.dns.${domain}"     "10.3.14.1"          ]
-      [ "home.dns.${domain}"       "10.3.14.235"        ]
-      [ "games.dns.${domain}"      "10.3.14.37"         ]
-      [ "workspace.dns.${domain}"  "10.3.14.57"         ]
-      [ "old-main.dns.${domain}"   "10.3.14.42"         ] # old main machine for connecting while migrating
       
-      [ "main.dns.${domain}"       "10.3.14.215"        ] # this machine
+      [ "main.dns.${domain}"       "homelab.axolotl-chameleon.ts.net" ] # this machine
       [ "proxy.${domain}"          "main.dns.${domain}" ]
       [ "*.proxy.${domain}"        "proxy.${domain}"    ]
       

From 994fcf66bc76dc0bbbdaca374f1a92a1757ba2c9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 10:22:42 +0700
Subject: [PATCH 144/427] update and migrate

---
 flake.lock                   | 24 ++++++++++++------------
 modules/hardware/homelab.nix |  6 +++---
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index fb30067..e972eea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1775213373,
-        "narHash": "sha256-wJHsijC2l/E+ovmlpPGha8pXA6RHSwHWmBV97gvkmyI=",
+        "lastModified": 1777505151,
+        "narHash": "sha256-ul1iRBfVX2vc971tHHhVtxX2hycU3nVwgO005OcOKnw=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "ba73719e673e7c2d89ac2f8df0bc0d48983e4907",
+        "rev": "e82c195f2276825b0a08024fdaff80f965edcd69",
         "type": "github"
       },
       "original": {
@@ -62,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775622785,
-        "narHash": "sha256-/yFxO+7oS1SymDfJ2iVO7K5vJKcYfe9XGIJ+quLqz0Q=",
+        "lastModified": 1777518431,
+        "narHash": "sha256-SwgiG2T5pbyo33Vz7/vUCAhEMgwCK8Pa2nDSx5a6/WE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "527e47b78fe67213072f706bf933a9705a8c4974",
+        "rev": "2e54a938cdd4c8e414b2518edc3d82308027c670",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775036866,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "lastModified": 1776548001,
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
@@ -109,11 +109,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1775423009,
-        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
diff --git a/modules/hardware/homelab.nix b/modules/hardware/homelab.nix
index ba76f66..906b24b 100644
--- a/modules/hardware/homelab.nix
+++ b/modules/hardware/homelab.nix
@@ -1,8 +1,8 @@
 { ... }: {
   imports = [
-    ./misc/cpu-hotplug.nix
-    ./misc/serial.nix 
-    ./misc/qemu-virtio.nix
+    # ./misc/cpu-hotplug.nix
+    # ./misc/serial.nix 
+    # ./misc/qemu-virtio.nix
     # ^^ only used if vm
     
     ./core/firmware.nix

From 5c72b53939fd454775c024d1004346fa4119dc36 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 15:15:07 +0700
Subject: [PATCH 145/427] fix fstype checks

---
 modules/system/homelab/docs.nix  | 1 +
 modules/system/homelab/pass.nix  | 1 +
 modules/system/homelab/proxy.nix | 1 +
 3 files changed, 3 insertions(+)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index a8126b0..58784a3 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -19,5 +19,6 @@ in {
     device = "/mnt/data/apps/cryptpad";
     depends = [ "/mnt/data" ]; 
     options = [ "bind" "nofail" ];
+    fsType = "none";
   };
 }
diff --git a/modules/system/homelab/pass.nix b/modules/system/homelab/pass.nix
index ec2c43c..85b22e2 100644
--- a/modules/system/homelab/pass.nix
+++ b/modules/system/homelab/pass.nix
@@ -15,5 +15,6 @@
     device = "/mnt/data/apps/vaultwarden/data";
     depends = [ "/mnt/data" ];
     options = [ "bind" "nofail" ];
+    fsType = "none";
   };
 }
\ No newline at end of file
diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index 446197e..d977892 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -31,6 +31,7 @@ in {
     device = "/mnt/data/apps/acme/${homelab.proxy.base}";
     depends = [ "/mnt/data" ];
     options = [ "bind" "nofail" ];
+    fsType = "none";
   };
   
   services = {

From 3906d680da6d03eac1e118f78fc845dc5fe9d5f6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 15:20:43 +0700
Subject: [PATCH 146/427] update hardware config

---
 modules/scans/homelab.nix | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/modules/scans/homelab.nix b/modules/scans/homelab.nix
index ae9dcbc..97b2ba6 100644
--- a/modules/scans/homelab.nix
+++ b/modules/scans/homelab.nix
@@ -5,26 +5,35 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e33ab472-e518-4b4d-89d1-d75cfecb9f06";
+    { device = "/dev/disk/by-uuid/e5a7d45d-b9e9-43e7-ba5f-f4e67821bd0b";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/880C-9F0A";
+    { device = "/dev/disk/by-uuid/EC01-36B5";
       fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
\ No newline at end of file
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+} 
\ No newline at end of file

From 678676793a3b7bcc62a4c922bf5e5d52d15e806e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 16:05:12 +0700
Subject: [PATCH 147/427] fix ventoy warning

---
 flake.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/flake.nix b/flake.nix
index 8130e57..0c8d584 100644
--- a/flake.nix
+++ b/flake.nix
@@ -6,18 +6,18 @@
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    
+
     gl.url = "github:nix-community/nixGL";
     ctp.url = "github:catppuccin/nix";
   };
 
-  outputs = inputs: let 
+  outputs = inputs: let
     pkgs = import inputs.nixpkgs {
       system = "x86_64-linux";
       overlays = [ inputs.gl.overlay ];
       config = {
         allowUnfree = true;
-        permittedInsecurePackages = [ "ventoy-qt5-1.1.10" ];
+        permittedInsecurePackages = [ "ventoy-qt5-1.1.12" ];
       };
     };
     args = {
@@ -32,7 +32,7 @@
         inputs.ctp.nixosModules.catppuccin
       ];
     };
-    
+
     nixosConfigWithHome = host: inputs.nixpkgs.lib.nixosSystem {
       inherit pkgs;
       specialArgs = args // { hostname = host; };
@@ -50,7 +50,7 @@
         }
       ];
     };
-    
+
     homeConfig = host: inputs.hm.lib.homeManagerConfiguration {
       extraSpecialArgs = args // { hostname = host; };
       inherit pkgs;

From 3133e2bc51e8804b9d2575b7b283db67d4d1134b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 16:36:29 +0700
Subject: [PATCH 148/427] remove flag

---
 modules/system/server.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/server.nix b/modules/system/server.nix
index 7df13d2..019d474 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -2,7 +2,7 @@
   ts-flags = [
     "--advertise-exit-node"
     "--advertise-routes=10.3.14.0/24,192.168.1.0/24"
-    "--ssh" "--webclient"
+    "--ssh"
   ];
 in {
   imports = [

From 1a35ba2ecfacec60ca4f359cd120c20247d02597 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 16:45:01 +0700
Subject: [PATCH 149/427] use tsip

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index f0282ee..1bb94e7 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -97,7 +97,7 @@ in {
       [ "server.dns.${domain}"     "10.3.14.69"         ]
       [ "router.dns.${domain}"     "10.3.14.1"          ]
       
-      [ "main.dns.${domain}"       "homelab.axolotl-chameleon.ts.net" ] # this machine
+      [ "main.dns.${domain}"       "100.113.147.93" ] # this machine
       [ "proxy.${domain}"          "main.dns.${domain}" ]
       [ "*.proxy.${domain}"        "proxy.${domain}"    ]
       

From 086b6f826e2e9aecfeb801e378669d80beb5761a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 16:57:25 +0700
Subject: [PATCH 150/427] remove deps on other stuff

---
 lib/options.nix                 |  7 -------
 modules/system/homelab/dash.nix | 17 -----------------
 modules/system/homelab/git.nix  |  2 +-
 3 files changed, 1 insertion(+), 25 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 1bb94e7..3a81736 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -66,10 +66,6 @@ in {
     proxy = {
       base = "proxy.${domain}";
       hosts = {
-        "server"     = d "https://server.dns.${domain}:8006";
-        "router"     = d "http://router.dns.${domain}:80";
-        "home"       = d "http://home.dns.${domain}:8123";
-        
         "containers" = da "http://localhost:5001";
         "code"       = da "http://localhost:8443";
         "dns"        = da "http://localhost:8088";
@@ -94,9 +90,6 @@ in {
       };
     };
     records = [
-      [ "server.dns.${domain}"     "10.3.14.69"         ]
-      [ "router.dns.${domain}"     "10.3.14.1"          ]
-      
       [ "main.dns.${domain}"       "100.113.147.93" ] # this machine
       [ "proxy.${domain}"          "main.dns.${domain}" ]
       [ "*.proxy.${domain}"        "proxy.${domain}"    ]
diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index ff6656d..9f55182 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -58,10 +58,6 @@
     [ "DNS" "http://localhost:8088/" ]
     [ "Proxy" "https://proxy.${homelab.domain}/" ]
   ];
-  external = [
-    [ "Proxmox" "proxmox" "https://server.proxy.${homelab.domain}" "http://server.dns.${homelab.domain}:8006/" ]
-    [ "OpenWRT" "openwrt" "https://router.proxy.${homelab.domain}" "http://router.dns.${homelab.domain}:80/" ]
-  ];
   bookmarks = [
     [ "Tailscale" "tailscale" "https://login.tailscale.com/" ]
     [ "Cloudflare" "cloudflare" "https://dash.cloudflare.com/" ]
@@ -259,19 +255,6 @@ in {
                     # mountpoints."/nix/store".hide = true;
                   }];
                 }
-                {
-                  type = "monitor";
-                  cache = "1m";
-                  title = "External";
-                  sites = map (e: { 
-                    same-tab = true;
-                    allow-insecure = true;
-                    title = builtins.elemAt e 0;
-                    icon = "si:${builtins.elemAt e 1}";
-                    url = builtins.elemAt e 2;
-                    check-url = builtins.elemAt e 3;
-                  }) external;
-                }
                 {
                   type = "monitor";
                   cache = "1m";
diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 39f4de1..ddf6df2 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -42,7 +42,7 @@
     gitea-actions-runner.instances.nixos-deploy = {
       enable = true;
       name = "nixos-server-runner";
-      url = "https://git.proxy.${homelab.domain}";
+      url = "https://localhost:5080"; #"https://git.proxy.${homelab.domain}";
       tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
       labels = [ "self-hosted:host" ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];

From afb46f4d86efbd3d7fd20b47481e121f9159e51e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:00:48 +0700
Subject: [PATCH 151/427] fix https warning

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index ddf6df2..db30c7a 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -42,7 +42,7 @@
     gitea-actions-runner.instances.nixos-deploy = {
       enable = true;
       name = "nixos-server-runner";
-      url = "https://localhost:5080"; #"https://git.proxy.${homelab.domain}";
+      url = "http://localhost:5080"; #"https://git.proxy.${homelab.domain}";
       tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
       labels = [ "self-hosted:host" ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];

From 2eb33f25266d52a92a76cca0aaa1dc85347b2f00 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:03:55 +0700
Subject: [PATCH 152/427] remove unused monitor

---
 modules/system/homelab/dash.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 9f55182..f419efb 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -53,8 +53,6 @@
     [ "Google Web Results Only" "!s" "https://google.com/search?udm=14&q={QUERY}" ]
   ];
   monitor = [
-    [ "Hypervisor" "https://10.3.14.69:8006/" ]
-    [ "Router" "http://10.3.14.1:80/" ]
     [ "DNS" "http://localhost:8088/" ]
     [ "Proxy" "https://proxy.${homelab.domain}/" ]
   ];

From 5a3783628aa45be4f884c7b48750881d14a2b517 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:08:40 +0700
Subject: [PATCH 153/427] cryptpad fix

---
 modules/system/homelab/docs.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 58784a3..ebc729a 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -1,7 +1,9 @@
-{ homelab, ... }: let
+{ lib, homelab, ... }: let
   domain = "docs.${homelab.domain}";
   sandbox = "docs-sandbox.${homelab.domain}";
 in {
+  systemd.services.cryptpad.confinement.enable = lib.mkForce false;
+  
   services.cryptpad = {
     enable = true;
     settings = {

From 2b04bb766891f5a0294886c4841561bf52e559b2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:13:25 +0700
Subject: [PATCH 154/427] hide duplicate mountpoints

---
 modules/system/homelab/dash.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index f419efb..4c25bf9 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -250,7 +250,12 @@ in {
                   type = "server-stats";
                   servers = [{
                     type = "local";
-                    # mountpoints."/nix/store".hide = true;
+                    mountpoints = {
+                      "/nix/store".hide = true;
+                      "/var/lib/cryptpad".hide = true;
+                      "/var/lib/vaultwarden".hide = true;
+                      "/var/lib/acme/proxy.satr14.my.id".hide = true;
+                    };
                   }];
                 }
                 {

From 83e174cc6b1744282680ef842b36ad54037b2a62 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:22:52 +0700
Subject: [PATCH 155/427] fix 2: point to private

---
 modules/system/homelab/docs.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index ebc729a..077f95b 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -1,9 +1,7 @@
-{ lib, homelab, ... }: let
+{ homelab, ... }: let
   domain = "docs.${homelab.domain}";
   sandbox = "docs-sandbox.${homelab.domain}";
 in {
-  systemd.services.cryptpad.confinement.enable = lib.mkForce false;
-  
   services.cryptpad = {
     enable = true;
     settings = {
@@ -17,7 +15,7 @@ in {
     };
   };
   
-  fileSystems."/var/lib/cryptpad" = {
+  fileSystems."/var/lib/private/cryptpad" = {
     device = "/mnt/data/apps/cryptpad";
     depends = [ "/mnt/data" ]; 
     options = [ "bind" "nofail" ];

From 7e4905561c0eab2ce4f2b245f7ecb87aac8fd754 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:26:44 +0700
Subject: [PATCH 156/427] switch to private

---
 modules/system/homelab/dash.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 4c25bf9..78b68f4 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -252,8 +252,8 @@ in {
                     type = "local";
                     mountpoints = {
                       "/nix/store".hide = true;
-                      "/var/lib/cryptpad".hide = true;
                       "/var/lib/vaultwarden".hide = true;
+                      "/var/lib/private/cryptpad".hide = true;
                       "/var/lib/acme/proxy.satr14.my.id".hide = true;
                     };
                   }];

From e6fcd6bb41754ce786e029305c998e7c4b59140f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 1 May 2026 17:37:17 +0700
Subject: [PATCH 157/427] add my key

---
 modules/system/homelab/docs.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 077f95b..2cae519 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -12,6 +12,9 @@ in {
       httpSafeOrigin = "https://${sandbox}";
       blockDailyCheck = true;
       disableIntegratedEviction = true;
+      adminKeys = [ 
+        "[satr14@docs.satr14.my.id/f1A82fmBuqQka2bNqrCb1WbB9r2ex5A3rdys5xLX3Hc=]"
+      ];
     };
   };
   

From 33688e44964149796639c6aa9177e84939a567cc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 17:50:59 +0700
Subject: [PATCH 158/427] disable guest usage

---
 modules/system/homelab/docs.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 2cae519..9682a0e 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -12,6 +12,8 @@ in {
       httpSafeOrigin = "https://${sandbox}";
       blockDailyCheck = true;
       disableIntegratedEviction = true;
+      disableAnonymousStore = true;
+      disableAnonymousPadCreation = true;
       adminKeys = [ 
         "[satr14@docs.satr14.my.id/f1A82fmBuqQka2bNqrCb1WbB9r2ex5A3rdys5xLX3Hc=]"
       ];

From 2940656cf158fbd388d8b227334229fd6db9bb38 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 18:41:49 +0700
Subject: [PATCH 159/427] mc server

---
 flake.lock                        | 70 ++++++++++++++++++++++++++++-
 flake.nix                         |  2 +
 lib/options.nix                   |  4 ++
 modules/system/homelab/mc.nix     | 73 +++++++++++++++++++++++++++++++
 modules/system/misc/utilities.nix |  1 +
 modules/system/server.nix         |  1 +
 6 files changed, 150 insertions(+), 1 deletion(-)
 create mode 100644 modules/system/homelab/mc.nix

diff --git a/flake.lock b/flake.lock
index e972eea..5970bab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,6 +18,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -76,6 +92,26 @@
         "type": "github"
       }
     },
+    "mc": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs_3",
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1777692910,
+        "narHash": "sha256-rPszOFTm7gP9n/JGiFH4SeuEALC8FBJtXu5owvHVjaQ=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "0707737282f65e25ed8e6e73f8767872659b7fb8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1776548001,
@@ -108,6 +144,22 @@
       }
     },
     "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1777268161,
         "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
@@ -128,7 +180,8 @@
         "ctp": "ctp",
         "gl": "gl",
         "hm": "hm",
-        "nixpkgs": "nixpkgs_3"
+        "mc": "mc",
+        "nixpkgs": "nixpkgs_4"
       }
     },
     "systems": {
@@ -145,6 +198,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 0c8d584..3ccbd5c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,6 +9,8 @@
 
     gl.url = "github:nix-community/nixGL";
     ctp.url = "github:catppuccin/nix";
+    
+    mc.url = "github:Infinidoge/nix-minecraft";
   };
 
   outputs = inputs: let
diff --git a/lib/options.nix b/lib/options.nix
index 3a81736..9cc0282 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -54,9 +54,13 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
+      "mc0.${domain}"     = "tcp://localhost:25565";
+      
       "docs-sandbox.${domain}" = "http://localhost:7090";
       "docs.${domain}"         = "http://localhost:7090";
+      
       "cdn.${domain}"     = selfSigned "https://localhost:3923";
+      
       "git.${domain}"     = "http://localhost:5080";
       "auth.${domain}"    = "http://localhost:1411";
       "dash.${domain}"    = "http://localhost:5070";
diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
new file mode 100644
index 0000000..7ebfffd
--- /dev/null
+++ b/modules/system/homelab/mc.nix
@@ -0,0 +1,73 @@
+{ inputs, pkgs, ... }: let
+  ram-allocation = "10240M";
+  auth-server = "https://mc.satr14.my.id";
+  # modpack = pkgs.fetchPackwizModpack {
+  #   url = "";
+  #   packHash = "";
+  # };
+in {
+  imports = [ inputs.mc.nixosModules.minecraft-servers ];
+  nixpkgs.overlays = [ inputs.mc.overlay ];
+  
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+   
+    servers.mc0-explorers-creativity = {
+      enable = true;
+      autoStart = true;
+      restart = "always";
+      enableReload = true;
+      
+      package = pkgs.fabricServers.fabric-26_1.override { loaderVersion = "0.19.2"; };
+      jvmOpts = let
+        authlib-injector = pkgs.fetchurl {
+          url = "https://github.com/yushijinhun/authlib-injector/releases/download/v1.2.7/authlib-injector-1.2.7.jar";
+          sha256 = "0av58bz0fn7wn9bf7sib62cn4vgkk4mr9mavpn2xiizzmk2lpwga";
+        };
+      in ''
+        -Xms${ram-allocation} -Xmx${ram-allocation} -javaagent:${authlib-injector}=${auth-server}
+        
+        -add-modules=jdk.incubator.vector -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20
+      '';
+      
+      serverProperties = {
+        server-port = 25565;
+        server-name = "Digit Association";
+        motd = "\u00a7lSeason 3\u00a7r - \u00a7dExplorers Creativity \ud83d\udd25";
+        
+        difficulty = "normal";
+        gamemode = "survival";
+        max-world-size = 25000;
+        spawn-protection = 0;
+        pvp = true;
+        
+        online-mode = true;
+        enforce-secure-profile = false;
+        pevent-proxy-connections = false;
+        allow-flight = false;
+        player-idle-timeout = 0;
+        
+        # resource-pack = "https://cdn.satr14.my.id/public/fullslide-1.21.11.zip";
+        # resource-pack-sha1 = "e0958dcef5755286f390c22280700c471ec34a65";
+        # resource-pack-enforce = false;
+        
+        simulation-distance = 16;
+        view-distance = 4;
+        
+        enable-rcon = true;
+        sync-chunk-writes = false;
+        "rcon.password" = "howdy";
+        "rcon.port" = 25575;
+      };
+      
+      symlinks = {
+        # "resources/datapack/required" = "${modpack}/datapacks";
+        # "mods" = "${modpack}/mods";
+        
+        # "server-icon.png" = "${modpack}/server-icon.png";
+        # "config" = "";
+      };
+    };
+  };
+}
\ No newline at end of file
diff --git a/modules/system/misc/utilities.nix b/modules/system/misc/utilities.nix
index 29c4c6f..de5d35e 100644
--- a/modules/system/misc/utilities.nix
+++ b/modules/system/misc/utilities.nix
@@ -74,6 +74,7 @@
     lsof
 
     # Nix & Development
+    rcon-cli
     dconf2nix
     home-manager
     nix-index
diff --git a/modules/system/server.nix b/modules/system/server.nix
index 019d474..57a3ff0 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -25,6 +25,7 @@ in {
     ./homelab/cdn.nix
     ./homelab/ai.nix
     ./homelab/db.nix
+    ./homelab/mc.nix
     
     ./core/swapfile.nix
     ./core/oom.nix

From cbafaefb34a2dc20efed6b909db5ec98b41cf320 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 18:50:46 +0700
Subject: [PATCH 160/427] fix flags error

---
 modules/system/homelab/mc.nix | 36 +++++++++++++++++++++++++++++------
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 7ebfffd..ccc9f62 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,4 +1,4 @@
-{ inputs, pkgs, ... }: let
+{ inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id";
   # modpack = pkgs.fetchPackwizModpack {
@@ -25,11 +25,35 @@ in {
           url = "https://github.com/yushijinhun/authlib-injector/releases/download/v1.2.7/authlib-injector-1.2.7.jar";
           sha256 = "0av58bz0fn7wn9bf7sib62cn4vgkk4mr9mavpn2xiizzmk2lpwga";
         };
-      in ''
-        -Xms${ram-allocation} -Xmx${ram-allocation} -javaagent:${authlib-injector}=${auth-server}
-        
-        -add-modules=jdk.incubator.vector -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20
-      '';
+        flags = [
+          "-Xms${ram-allocation}"
+          "-Xmx${ram-allocation}"
+          "-javaagent:${authlib-injector}=${auth-server}"
+          "--add-modules=jdk.incubator.vector"
+
+          # Aikar's GC flags
+          "-XX:+UseG1GC"
+          "-XX:+ParallelRefProcEnabled"
+          "-XX:MaxGCPauseMillis=200"
+          "-XX:+UnlockExperimentalVMOptions"
+          "-XX:+DisableExplicitGC"
+          "-XX:+AlwaysPreTouch"
+          "-XX:G1HeapWastePercent=5"
+          "-XX:G1MixedGCCountTarget=4"
+          "-XX:InitiatingHeapOccupancyPercent=15"
+          "-XX:G1MixedGCLiveThresholdPercent=90"
+          "-XX:G1RSetUpdatingPauseTimePercent=5"
+          "-XX:SurvivorRatio=32"
+          "-XX:+PerfDisableSharedMem"
+          "-XX:MaxTenuringThreshold=1"
+          "-Dusing.aikars.flags=https://mcflags.emc.gs"
+          "-Daikars.new.flags=true"
+          "-XX:G1NewSizePercent=30"
+          "-XX:G1MaxNewSizePercent=40"
+          "-XX:G1HeapRegionSize=8M"
+          "-XX:G1ReservePercent=20"
+        ];
+      in lib.concatStringsSep " " flags;
       
       serverProperties = {
         server-port = 25565;

From f831c98840d00cb0976f9792ed88edc5a543f0db Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 18:56:38 +0700
Subject: [PATCH 161/427] fix error

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index ccc9f62..4a21456 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -19,6 +19,7 @@ in {
       restart = "always";
       enableReload = true;
       
+      managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
       package = pkgs.fabricServers.fabric-26_1.override { loaderVersion = "0.19.2"; };
       jvmOpts = let
         authlib-injector = pkgs.fetchurl {

From b1a1913b5179b014d5793a4d6ccbef872103c6ff Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:01:34 +0700
Subject: [PATCH 162/427] fix error 2

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4a21456..d342f14 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -12,6 +12,7 @@ in {
   services.minecraft-servers = {
     enable = true;
     eula = true;
+    managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
    
     servers.mc0-explorers-creativity = {
       enable = true;
@@ -19,7 +20,6 @@ in {
       restart = "always";
       enableReload = true;
       
-      managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
       package = pkgs.fabricServers.fabric-26_1.override { loaderVersion = "0.19.2"; };
       jvmOpts = let
         authlib-injector = pkgs.fetchurl {

From 9e28753c9afb3ef749cbb7a140c18383d0a57498 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:03:49 +0700
Subject: [PATCH 163/427] [skip ci] ref issue

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d342f14..50065e5 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -13,6 +13,7 @@ in {
     enable = true;
     eula = true;
     managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
+    # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
    
     servers.mc0-explorers-creativity = {
       enable = true;

From 5d6c14ffa7c7ab065949fdf1bade0de16dc8a267 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:22:03 +0700
Subject: [PATCH 164/427] fix jre missmatch

---
 modules/system/homelab/mc.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 50065e5..19f173d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -21,7 +21,11 @@ in {
       restart = "always";
       enableReload = true;
       
-      package = pkgs.fabricServers.fabric-26_1.override { loaderVersion = "0.19.2"; };
+      package = pkgs.fabricServers.fabric-26_1.override {
+        loaderVersion = "0.19.2";
+        jre_headless = pkgs.javaPackages.compiler.temurin-bin.jre-25;
+      };
+
       jvmOpts = let
         authlib-injector = pkgs.fetchurl {
           url = "https://github.com/yushijinhun/authlib-injector/releases/download/v1.2.7/authlib-injector-1.2.7.jar";

From cafbb5453d13a56c5fd7133a50332289597a9108 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:53:49 +0700
Subject: [PATCH 165/427] 1.21.11 downgrade

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 19f173d..9caa3b2 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -21,7 +21,7 @@ in {
       restart = "always";
       enableReload = true;
       
-      package = pkgs.fabricServers.fabric-26_1.override {
+      package = pkgs.fabricServers.fabric-1_21_11.override {
         loaderVersion = "0.19.2";
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jre-25;
       };

From 78e626156cf020448af5ed4d0a9b10656f5a426c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:57:13 +0700
Subject: [PATCH 166/427] temp disable

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9caa3b2..18ff72f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -10,13 +10,13 @@ in {
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
   services.minecraft-servers = {
-    enable = true;
+    enable = false;
     eula = true;
     managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
    
     servers.mc0-explorers-creativity = {
-      enable = true;
+      enable = false;
       autoStart = true;
       restart = "always";
       enableReload = true;

From 52464e7afe751e948e7f01e1be28113021d5a008 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 19:59:29 +0700
Subject: [PATCH 167/427] reenable

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 18ff72f..9caa3b2 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -10,13 +10,13 @@ in {
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
   services.minecraft-servers = {
-    enable = false;
+    enable = true;
     eula = true;
     managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
    
     servers.mc0-explorers-creativity = {
-      enable = false;
+      enable = true;
       autoStart = true;
       restart = "always";
       enableReload = true;

From ae4c4702b2680f3a5a9d21fd2deac3ebcff81600 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 2 May 2026 20:02:56 +0700
Subject: [PATCH 168/427] fix motd

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9caa3b2..7920048 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -64,7 +64,7 @@ in {
       serverProperties = {
         server-port = 25565;
         server-name = "Digit Association";
-        motd = "\u00a7lSeason 3\u00a7r - \u00a7dExplorers Creativity \ud83d\udd25";
+        motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
         
         difficulty = "normal";
         gamemode = "survival";

From 112fd500874efb3a1e02a1e70f40d649ca717a5a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 05:18:00 +0700
Subject: [PATCH 169/427] temp disable

---
 modules/system/homelab/code.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 3d79fc7..6fc9254 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -1,6 +1,6 @@
 { username, ... }: {
   services.code-server = {
-    enable = true;
+    enable = false;
     host = "127.0.0.1";
     port = 8443;
     user = username;

From 0d28d1e48cccd3502098e9f9b2d7a415f0e7b5dc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 06:17:07 +0700
Subject: [PATCH 170/427] Update modules/system/homelab/code.nix

---
 modules/system/homelab/code.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/code.nix b/modules/system/homelab/code.nix
index 6fc9254..3d79fc7 100644
--- a/modules/system/homelab/code.nix
+++ b/modules/system/homelab/code.nix
@@ -1,6 +1,6 @@
 { username, ... }: {
   services.code-server = {
-    enable = false;
+    enable = true;
     host = "127.0.0.1";
     port = 8443;
     user = username;

From 352908c0f326fe1a6c946f68fe2750a45714aa61 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 07:16:59 +0700
Subject: [PATCH 171/427] [skip ci] vsc config

---
 .vscode/settings.json | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 .vscode/settings.json

diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..a5a5a12
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "nixEnvSelector.suggestion": false
+}
\ No newline at end of file

From 7bb998d022a95ee0659e383b5b604bc3ec05cec1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 07:22:10 +0700
Subject: [PATCH 172/427] install modpack mods

---
 modules/system/homelab/mc.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 7920048..b00b4fb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,10 +1,10 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id";
-  # modpack = pkgs.fetchPackwizModpack {
-  #   url = "";
-  #   packHash = "";
-  # };
+  modpack = pkgs.fetchPackwizModpack {
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/a1372bf1b044fd178d5ca29a8b01805f56c9ee4f/pack.toml";
+    packHash = "sha256-TCBGa4W+hi6iMzaI9GkapgaQGib0mvhnOObTdEgO/Rs=";
+  };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -93,7 +93,7 @@ in {
       
       symlinks = {
         # "resources/datapack/required" = "${modpack}/datapacks";
-        # "mods" = "${modpack}/mods";
+        "mods" = "${modpack}/mods";
         
         # "server-icon.png" = "${modpack}/server-icon.png";
         # "config" = "";

From 0f2bc17be007804161eac73dfc9516f89a37c0d1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 09:10:25 +0700
Subject: [PATCH 173/427] readme update

---
 README.md | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 1c27513..ee0d382 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,11 @@
 ![nix-flake](ss.png)
-rewrite of my nixos flake with hopefully better structuring and modularity
 
 > [!WARNING]
-> this flake is ment for personal use. code is not well documented and is not ment to be used by others. use at your own risk.
+> This flake is ment for personal use. The code is not well documented nor structured and is not ment to be used by others. **Use at your own risk.**
 
-## hosts
-- `thinkpad` - my thinkpad t480 with an i5 8350u, 16gb of ram, and 256gb nvme ssd (140 allocated for nixos, rest for windows 11)
-- `homelab` - my homelab server in a vm on a proxmox host with an i7 8700t, 32gb of ram, and 512gb boot drive (with hotplug enabled for cpu and ram)
+## Hosts
+- `thinkpad` - Thinkpad T480, i5 8350U, 16GB RAM, 256GB NVME
+- `homelab` - i7 8700T, 32GB RAM, 512GB NVME, 1TB 2.5" SATA
 
-## credits
+## Credits
 - [orangc's flake](https://git.orangc.net/c/dots)
\ No newline at end of file

From 7693a23c84331f88367306c72995a917af9e453e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 12:17:20 +0700
Subject: [PATCH 174/427] enable query

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index b00b4fb..2f0d710 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -73,6 +73,7 @@ in {
         pvp = true;
         
         online-mode = true;
+        enable-query = true;
         enforce-secure-profile = false;
         pevent-proxy-connections = false;
         allow-flight = false;

From f1d468f26be0a0939ddbc90e75dc899450fa2369 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:03:25 +0700
Subject: [PATCH 175/427] use built in flags instead of authlib injector

---
 modules/system/homelab/mc.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2f0d710..cfa2a7b 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,6 +1,6 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
-  auth-server = "https://mc.satr14.my.id";
+  auth-server = "https://mc.satr14.my.id"; # self hosted drasl server
   modpack = pkgs.fetchPackwizModpack {
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/a1372bf1b044fd178d5ca29a8b01805f56c9ee4f/pack.toml";
     packHash = "sha256-TCBGa4W+hi6iMzaI9GkapgaQGib0mvhnOObTdEgO/Rs=";
@@ -27,15 +27,18 @@ in {
       };
 
       jvmOpts = let
-        authlib-injector = pkgs.fetchurl {
-          url = "https://github.com/yushijinhun/authlib-injector/releases/download/v1.2.7/authlib-injector-1.2.7.jar";
-          sha256 = "0av58bz0fn7wn9bf7sib62cn4vgkk4mr9mavpn2xiizzmk2lpwga";
-        };
         flags = [
           "-Xms${ram-allocation}"
           "-Xmx${ram-allocation}"
-          "-javaagent:${authlib-injector}=${auth-server}"
           "--add-modules=jdk.incubator.vector"
+          
+          # Custom auth server
+          "-Dminecraft.api.env=custom"
+          "-Dminecraft.api.auth.host=${auth-server}/auth"
+          "-Dminecraft.api.account.host=${auth-server}/account"
+          "-Dminecraft.api.profiles.host=${auth-server}/account"
+          "-Dminecraft.api.session.host=${auth-server}/session"
+          "-Dminecraft.api.services.host=${auth-server}/services"
 
           # Aikar's GC flags
           "-XX:+UseG1GC"

From e9400208dcd446d64117ddd69acebaa3bed98b9d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:15:03 +0700
Subject: [PATCH 176/427] update modpack

---
 modules/system/homelab/mc.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index cfa2a7b..acdb803 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,9 +1,9 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
-  auth-server = "https://mc.satr14.my.id"; # self hosted drasl server
+  auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = pkgs.fetchPackwizModpack {
-    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/a1372bf1b044fd178d5ca29a8b01805f56c9ee4f/pack.toml";
-    packHash = "sha256-TCBGa4W+hi6iMzaI9GkapgaQGib0mvhnOObTdEgO/Rs=";
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/e8a47c7f6dbf26cf436d40d68eed17ac4a98decc/pack.toml";
+    packHash = "";
   };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];

From 75d033c63cbb5bfd4254f4c8bb4446a966c72f45 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:18:33 +0700
Subject: [PATCH 177/427] code cleanup and dev changes

---
 modules/system/homelab/mc.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index acdb803..ab2de9b 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -19,11 +19,11 @@ in {
       enable = true;
       autoStart = true;
       restart = "always";
-      enableReload = true;
+      enableReload = false; # NOTE: development phase, disable in production
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
-        loaderVersion = "0.19.2";
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jre-25;
+        loaderVersion = "0.19.2";
       };
 
       jvmOpts = let
@@ -67,7 +67,7 @@ in {
       serverProperties = {
         server-port = 25565;
         server-name = "Digit Association";
-        motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
+        motd = "§lSeason 3 TESTING§r - §dExplorers Creativity 🔥";
         
         difficulty = "normal";
         gamemode = "survival";

From 6b13c4bf509b987965fe732a2357d998465ab216 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:20:17 +0700
Subject: [PATCH 178/427] hash update

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index ab2de9b..4491759 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,7 +3,7 @@
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = pkgs.fetchPackwizModpack {
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/e8a47c7f6dbf26cf436d40d68eed17ac4a98decc/pack.toml";
-    packHash = "";
+    packHash = "sha256-VJ018vTOASlS9Ndp+dI2N5bla2lQcDxY+MPS2qXYufE=";
   };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];

From ae5521f823e62ce5c4aaa11a60c578e0ba000e52 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:49:21 +0700
Subject: [PATCH 179/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4491759..75df76f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,8 +2,8 @@
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = pkgs.fetchPackwizModpack {
-    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/e8a47c7f6dbf26cf436d40d68eed17ac4a98decc/pack.toml";
-    packHash = "sha256-VJ018vTOASlS9Ndp+dI2N5bla2lQcDxY+MPS2qXYufE=";
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/ffd94a9909407a5d1ca2c1a2c35b19b048815dbd/pack.toml";
+    packHash = "";
   };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];

From 60926ab38d8545eb372a2a491d12e10fba7b1b7f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 19:52:26 +0700
Subject: [PATCH 180/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 75df76f..9d36ea8 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,7 +3,7 @@
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = pkgs.fetchPackwizModpack {
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/ffd94a9909407a5d1ca2c1a2c35b19b048815dbd/pack.toml";
-    packHash = "";
+    packHash = "sha256-ipG+TlkQDKODpybJ+Obwpvq8DALc6YaGCBGsn7ayLi0=";
   };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];

From aa133738f317aad4dd71004ade37a61ddc9299e9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 3 May 2026 20:13:09 +0700
Subject: [PATCH 181/427] [skip ci] some formating

---
 modules/system/homelab/mc.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9d36ea8..15c595d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,9 +1,11 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
-  modpack = pkgs.fetchPackwizModpack {
-    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/ffd94a9909407a5d1ca2c1a2c35b19b048815dbd/pack.toml";
+  modpack = let
+    commit = "ffd94a9909407a5d1ca2c1a2c35b19b048815dbd";
+  in pkgs.fetchPackwizModpack {
     packHash = "sha256-ipG+TlkQDKODpybJ+Obwpvq8DALc6YaGCBGsn7ayLi0=";
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
@@ -40,7 +42,7 @@ in {
           "-Dminecraft.api.session.host=${auth-server}/session"
           "-Dminecraft.api.services.host=${auth-server}/services"
 
-          # Aikar's GC flags
+          # Aikar's GC flags (tuned for 10GB)
           "-XX:+UseG1GC"
           "-XX:+ParallelRefProcEnabled"
           "-XX:MaxGCPauseMillis=200"

From 0e1357d07bf51ae458ffdb643e8ac4b547405918 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:16:32 +0700
Subject: [PATCH 182/427] [skip ci] desktop theme fix

---
 modules/home/desktop.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index aa51784..9e34895 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -6,6 +6,7 @@
     ./rice/logout.nix
     ./rice/notifs.nix
     ./rice/cursor.nix
+    ./rice/theme.nix
     ./rice/menu.nix
     ./rice/idle.nix
     ./rice/bar.nix

From 5979fe81290327e5bf063a2a3b55993c406d996d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:16:49 +0700
Subject: [PATCH 183/427] [skip ci] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 15c595d..257c805 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,7 +2,7 @@
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "ffd94a9909407a5d1ca2c1a2c35b19b048815dbd";
+    commit = "664e8130a15ac597a1d7e889f599205ff6147c06";
   in pkgs.fetchPackwizModpack {
     packHash = "sha256-ipG+TlkQDKODpybJ+Obwpvq8DALc6YaGCBGsn7ayLi0=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";

From 5fb4f3c661074e1b9f9a8550eeb663a48fbef0d3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:18:03 +0700
Subject: [PATCH 184/427] [skip ci] add packwiz

---
 modules/home/core/apps.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index c20f566..14d3701 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -61,6 +61,7 @@
     })
 
     ferium
+    packwiz
     portablemc
     steamguard-cli
     # modrinth-app

From 1d2711e59f06868359ce0c31c0471a488dbac56a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:29:15 +0700
Subject: [PATCH 185/427] commit change

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 257c805..7e7fe08 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "664e8130a15ac597a1d7e889f599205ff6147c06";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-ipG+TlkQDKODpybJ+Obwpvq8DALc6YaGCBGsn7ayLi0=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 2f710301008c22b09dbb6268a7dd54c28006432c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:32:16 +0700
Subject: [PATCH 186/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 7e7fe08..50a750d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "664e8130a15ac597a1d7e889f599205ff6147c06";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-OYYOd33ouwPpHGlZznBZ+9wGOzr+J00Ln7yYInSVmtY=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From ede2c6e2e440aaef93a6aa7c2d9d7b32b3dc67fd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:54:02 +0700
Subject: [PATCH 187/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 50a750d..a599d51 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "664e8130a15ac597a1d7e889f599205ff6147c06";
+    commit = "9e2538b25a2e6f81c45062c8f6ea3234676a9c8e";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-OYYOd33ouwPpHGlZznBZ+9wGOzr+J00Ln7yYInSVmtY=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 5e317059099ada1a1dde7b7208a47bd7544e4702 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 11:57:18 +0700
Subject: [PATCH 188/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index a599d51..c5c84ec 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "9e2538b25a2e6f81c45062c8f6ea3234676a9c8e";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-GPMiCg2S9IQ4my5NPjet7MJNjgc+jf64a59fDbjEGVI=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From a6b4d41da1abbbcb76a7a419aef2ce47ac95dac2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 20:50:10 +0700
Subject: [PATCH 189/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index c5c84ec..6c491ff 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation = "10240M";
   auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "9e2538b25a2e6f81c45062c8f6ea3234676a9c8e";
+    commit = "c76c7fc2037c4f9d6870d49c9444d33dd9480014";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-GPMiCg2S9IQ4my5NPjet7MJNjgc+jf64a59fDbjEGVI=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 2426cdea08f8a3f324ea070885a8a443a8306dd1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 21:25:03 +0700
Subject: [PATCH 190/427] disable guest storage

---
 modules/system/homelab/docs.nix | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 9682a0e..adfa357 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -1,4 +1,4 @@
-{ homelab, ... }: let
+{ lib, pkgs, homelab, ... }: let
   domain = "docs.${homelab.domain}";
   sandbox = "docs-sandbox.${homelab.domain}";
 in {
@@ -12,14 +12,31 @@ in {
       httpSafeOrigin = "https://${sandbox}";
       blockDailyCheck = true;
       disableIntegratedEviction = true;
-      disableAnonymousStore = true;
-      disableAnonymousPadCreation = true;
       adminKeys = [ 
         "[satr14@docs.satr14.my.id/f1A82fmBuqQka2bNqrCb1WbB9r2ex5A3rdys5xLX3Hc=]"
       ];
     };
   };
   
+  systemd.tmpfiles.rules = lib.singleton "f /var/lib/cryptpad/customize/application_config.js 0644 root root - ${pkgs.writeText "cryptpad-application-config.js" ''
+    (() => {
+      const factory = (AppConfig) => {
+          AppConfig.disableAnonymousPadCreation = true;
+          AppConfig.disableAnonymousStore = true;
+          AppConfig.defaultDarkTheme = 'true';
+          return AppConfig;
+      };
+  
+      if (typeof(module) !== 'undefined' && module.exports) {
+          module.exports = factory(
+              require('../www/common/application_config_internal.js')
+          );
+      } else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
+          define(['/common/application_config_internal.js'], factory);
+      }
+    })();
+  ''}";
+  
   fileSystems."/var/lib/private/cryptpad" = {
     device = "/mnt/data/apps/cryptpad";
     depends = [ "/mnt/data" ]; 

From a2315ae2bb7e51234e3ed59d9cfc7e8bb83f7ebf Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 21:27:34 +0700
Subject: [PATCH 191/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 6c491ff..3118249 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "c76c7fc2037c4f9d6870d49c9444d33dd9480014";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-ZTzI6hhpqkirkbwcqV7ufC0XB2qSmiNYec+z/kr/HpE=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 801fac269c7a55589b9a27d81afc000ca6703c75 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 4 May 2026 21:43:00 +0700
Subject: [PATCH 192/427] [skip ci] zed tweaks

---
 modules/home/core/code.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/home/core/code.nix b/modules/home/core/code.nix
index b3d3dc2..21268ff 100644
--- a/modules/home/core/code.nix
+++ b/modules/home/core/code.nix
@@ -11,6 +11,8 @@
       "nix"
     ];
     userSettings = {
+      diff_view_style =  "unified";
+      cli_default_open_behavior = "existing_window";
       format_on_save = "off";
       vim_mode = true;
       git.inline_blame.enabled = true;
@@ -41,7 +43,9 @@
         tool_permissions.default = "allow";
         default_model = {
           provider = "copilot_chat";
-          model = "claude-opus-4.6";
+          model = "claude-sonnet-4.6";
+          effort = "high";
+          enable_thinking = false;
         };
       };
       theme = {

From cf9f6b8882a9980e6d891649603bbba4cf6d3084 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 09:21:06 +0700
Subject: [PATCH 193/427] remove variable

---
 modules/system/homelab/docs.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index adfa357..960cbc8 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -23,7 +23,6 @@ in {
       const factory = (AppConfig) => {
           AppConfig.disableAnonymousPadCreation = true;
           AppConfig.disableAnonymousStore = true;
-          AppConfig.defaultDarkTheme = 'true';
           return AppConfig;
       };
   

From b5b13a63bf48d59a23f80f29a2bd9cb2629aa594 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 14:01:27 +0700
Subject: [PATCH 194/427] update modpack with auth server support

---
 modules/system/homelab/mc.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 3118249..540c264 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,10 +1,10 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation = "10240M";
-  auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
+  # auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "c76c7fc2037c4f9d6870d49c9444d33dd9480014";
+    commit = "3ce321be116ec909aa2f2188b6d3e9351806dd7e";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-ZTzI6hhpqkirkbwcqV7ufC0XB2qSmiNYec+z/kr/HpE=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {
@@ -35,12 +35,12 @@ in {
           "--add-modules=jdk.incubator.vector"
           
           # Custom auth server
-          "-Dminecraft.api.env=custom"
-          "-Dminecraft.api.auth.host=${auth-server}/auth"
-          "-Dminecraft.api.account.host=${auth-server}/account"
-          "-Dminecraft.api.profiles.host=${auth-server}/account"
-          "-Dminecraft.api.session.host=${auth-server}/session"
-          "-Dminecraft.api.services.host=${auth-server}/services"
+          # "-Dminecraft.api.env=custom"
+          # "-Dminecraft.api.auth.host=${auth-server}/auth"
+          # "-Dminecraft.api.account.host=${auth-server}/account"
+          # "-Dminecraft.api.profiles.host=${auth-server}/account"
+          # "-Dminecraft.api.session.host=${auth-server}/session"
+          # "-Dminecraft.api.services.host=${auth-server}/services"
 
           # Aikar's GC flags (tuned for 10GB)
           "-XX:+UseG1GC"

From 7635987ea0d41c038e6b270e55de87b59f8aba0b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 14:03:43 +0700
Subject: [PATCH 195/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 540c264..3ba3dc0 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "3ce321be116ec909aa2f2188b6d3e9351806dd7e";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-RJjaUNHLWrgb43PbKIDO9SWV6Lo/o1uSEDiMDpokSU8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From df8a2680d62133bd7ad9762dd608ff842cc54175 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 17:51:40 +0700
Subject: [PATCH 196/427] flake.lock: Update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flake lock file updates:

• Updated input 'ctp':
    'github:catppuccin/nix/e82c195f2276825b0a08024fdaff80f965edcd69?narHash=sha256-ul1iRBfVX2vc971tHHhVtxX2hycU3nVwgO005OcOKnw%3D' (2026-04-29)
  → 'github:catppuccin/nix/e68cf5deaf1a7afed2e548835dba2ae99f5a3ccb?narHash=sha256-kbIhdhDPaTP6gxAPkcRYeB%2BcqPFDpTM/bnw%2Bm%2B26vkI%3D' (2026-05-02)
• Updated input 'ctp/nixpkgs':
    'github:NixOS/nixpkgs/b12141ef619e0a9c1c84dc8c684040326f27cdcc?narHash=sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24%3D' (2026-04-18)
  → 'github:NixOS/nixpkgs/1c3fe55ad329cbcb28471bb30f05c9827f724c76?narHash=sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M%2BC8yzzIRYbE%3D' (2026-04-27)
• Updated input 'hm':
    'github:nix-community/home-manager/2e54a938cdd4c8e414b2518edc3d82308027c670?narHash=sha256-SwgiG2T5pbyo33Vz7/vUCAhEMgwCK8Pa2nDSx5a6/WE%3D' (2026-04-30)
  → 'github:nix-community/home-manager/7ef1c04d11f7ef69fd946b118c768c32de0b89a5?narHash=sha256-8ceIdvijN2tm9fIAUgnIZ8BM8TlsFx7pRYKRoxNsi1k%3D' (2026-05-05)
• Updated input 'mc':
    'github:Infinidoge/nix-minecraft/0707737282f65e25ed8e6e73f8767872659b7fb8?narHash=sha256-rPszOFTm7gP9n/JGiFH4SeuEALC8FBJtXu5owvHVjaQ%3D' (2026-05-02)
  → 'github:Infinidoge/nix-minecraft/34a46e4de360c5004ee1866f5e3de78bf5e8b289?narHash=sha256-8dQ/DOUvQI8x5i6MZ309/xZLLVfV1CgWbD2%2BJiQ7Hd4%3D' (2026-05-05)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/1c3fe55ad329cbcb28471bb30f05c9827f724c76?narHash=sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M%2BC8yzzIRYbE%3D' (2026-04-27)
  → 'github:nixos/nixpkgs/15f4ee454b1dce334612fa6843b3e05cf546efab?narHash=sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM%2BZ4%3D' (2026-04-30)
---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5970bab..5ab99ba 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1777505151,
-        "narHash": "sha256-ul1iRBfVX2vc971tHHhVtxX2hycU3nVwgO005OcOKnw=",
+        "lastModified": 1777734189,
+        "narHash": "sha256-kbIhdhDPaTP6gxAPkcRYeB+cqPFDpTM/bnw+m+26vkI=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "e82c195f2276825b0a08024fdaff80f965edcd69",
+        "rev": "e68cf5deaf1a7afed2e548835dba2ae99f5a3ccb",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777518431,
-        "narHash": "sha256-SwgiG2T5pbyo33Vz7/vUCAhEMgwCK8Pa2nDSx5a6/WE=",
+        "lastModified": 1777977606,
+        "narHash": "sha256-8ceIdvijN2tm9fIAUgnIZ8BM8TlsFx7pRYKRoxNsi1k=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2e54a938cdd4c8e414b2518edc3d82308027c670",
+        "rev": "7ef1c04d11f7ef69fd946b118c768c32de0b89a5",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1777692910,
-        "narHash": "sha256-rPszOFTm7gP9n/JGiFH4SeuEALC8FBJtXu5owvHVjaQ=",
+        "lastModified": 1777952170,
+        "narHash": "sha256-8dQ/DOUvQI8x5i6MZ309/xZLLVfV1CgWbD2+JiQ7Hd4=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "0707737282f65e25ed8e6e73f8767872659b7fb8",
+        "rev": "34a46e4de360c5004ee1866f5e3de78bf5e8b289",
         "type": "github"
       },
       "original": {
@@ -114,11 +114,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
@@ -161,11 +161,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1777578337,
+        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
         "type": "github"
       },
       "original": {

From 4ea96369890e1f14cc6fdc9a0463fe0c96b0989f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 17:59:37 +0700
Subject: [PATCH 197/427] fix cryptpad error

---
 modules/system/homelab/docs.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index 960cbc8..eee4911 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -23,6 +23,7 @@ in {
       const factory = (AppConfig) => {
           AppConfig.disableAnonymousPadCreation = true;
           AppConfig.disableAnonymousStore = true;
+          AppConfig.defaultDarkTheme = true;
           return AppConfig;
       };
   

From 6d3f4f33b56d8cd0e7aaef8f779ef01da54343fe Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 5 May 2026 19:10:06 +0700
Subject: [PATCH 198/427] fix qt theme

---
 modules/home/rice/compositor.nix | 1 +
 modules/home/rice/theme.nix      | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 1c84e92..00f19e0 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -51,6 +51,7 @@
         "GTK_APPLICATION_PREFER_DARK_THEME,1"
         "GTK_THEME,Adwaita:dark"
         "QT_QPA_PLATFORMTHEME,kvantum"
+        "QT_STYLE_OVERRIDE,kvantum"
       ];
 
       general = {
diff --git a/modules/home/rice/theme.nix b/modules/home/rice/theme.nix
index 83e5a2e..7946bf5 100644
--- a/modules/home/rice/theme.nix
+++ b/modules/home/rice/theme.nix
@@ -1,10 +1,9 @@
 { lib, pkgs, ctp-opt, rice, ... }: {
-  
   dconf = {
     enable = true;
     settings."org/gnome/desktop/interface" = {
       color-scheme = "prefer-dark";
-      gtk-theme = "Adwaita-dark";
+      gtk-theme = lib.mkForce "Adwaita-dark";
     };
   };
 
@@ -24,6 +23,11 @@
   
   qt = {
     enable = true;
+    kvantum = {
+      enable = true;
+      themes = with pkgs; [ catppuccin-kvantum ];
+      settings.General.theme = "catppuccin-${ctp-opt.flavor}-${ctp-opt.accent}";
+    };
     platformTheme.name = "kvantum";
     style = {
       name = "kvantum";

From b150f36224ec4e5d00a01d47aa569c8e2a35226d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 6 May 2026 10:25:34 +0700
Subject: [PATCH 199/427] unfree license fix

---
 modules/home/core/cli.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 3cd45ea..86b3c08 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -66,7 +66,6 @@
         telescope-file-browser-nvim
         nvim-tree-lua
         nvim-cmp
-        barbar-nvim
         indent-blankline-nvim
         markdown-preview-nvim
       ];

From 3a52bd329a3297f42a2f552a2cad53bb6ec5d909 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 6 May 2026 13:27:01 +0700
Subject: [PATCH 200/427] fix to symlink

---
 modules/system/homelab/docs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
index eee4911..58d6738 100644
--- a/modules/system/homelab/docs.nix
+++ b/modules/system/homelab/docs.nix
@@ -18,7 +18,7 @@ in {
     };
   };
   
-  systemd.tmpfiles.rules = lib.singleton "f /var/lib/cryptpad/customize/application_config.js 0644 root root - ${pkgs.writeText "cryptpad-application-config.js" ''
+  systemd.tmpfiles.rules = lib.singleton "L+ /var/lib/cryptpad/customize/application_config.js - - - - ${pkgs.writeText "cryptpad-application-config.js" ''
     (() => {
       const factory = (AppConfig) => {
           AppConfig.disableAnonymousPadCreation = true;

From eca24f7e0797e29777d6c38fe45c960998edddae Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 7 May 2026 05:11:16 +0700
Subject: [PATCH 201/427] hide boot partition

---
 modules/system/homelab/dash.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index 78b68f4..d973699 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -251,6 +251,7 @@ in {
                   servers = [{
                     type = "local";
                     mountpoints = {
+                      "/boot".hide = true;
                       "/nix/store".hide = true;
                       "/var/lib/vaultwarden".hide = true;
                       "/var/lib/private/cryptpad".hide = true;

From e9e66d75f98528746aecd0a1190977a8adbc75ae Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 7 May 2026 21:23:53 +0700
Subject: [PATCH 202/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 3ba3dc0..cf598ba 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation = "10240M";
   # auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "3ce321be116ec909aa2f2188b6d3e9351806dd7e";
+    commit = "5123157952be9149f429c694388d003b0acaa61b";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-RJjaUNHLWrgb43PbKIDO9SWV6Lo/o1uSEDiMDpokSU8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 760007425269055f9838eef2dde8bd03c147da0e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 7 May 2026 21:47:27 +0700
Subject: [PATCH 203/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index cf598ba..f1c4d74 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,7 +2,7 @@
   ram-allocation = "10240M";
   # auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
   modpack = let
-    commit = "5123157952be9149f429c694388d003b0acaa61b";
+    commit = "667aadf36aac9b0689289f4988a76b924bbb9cbc";
   in pkgs.fetchPackwizModpack {
     packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";

From 6b13eb332304d81c53b9b4dcb15403d418a74ecd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 7 May 2026 22:07:55 +0700
Subject: [PATCH 204/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index f1c4d74..276ab69 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "667aadf36aac9b0689289f4988a76b924bbb9cbc";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-sNWuqTIpqnwxhoof5PkJXrvVE5x/wnhc3LoqomjYBNs=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 37867492a9856725f69720c91aeb1c4a94a5d22d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 16:33:02 +0700
Subject: [PATCH 205/427] performance tweaks (zgc, sysctl, jvmopts, etc)

---
 modules/system/homelab/mc.nix | 69 ++++++++++++++---------------------
 1 file changed, 27 insertions(+), 42 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 276ab69..4e45400 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,6 +1,5 @@
 { inputs, lib, pkgs, ... }: let
-  ram-allocation = "10240M";
-  # auth-server = "https://mc.satr14.my.id"; # TODO: self hosted drasl server
+  ram-allocation-mb = 12288;
   modpack = let
     commit = "667aadf36aac9b0689289f4988a76b924bbb9cbc";
   in pkgs.fetchPackwizModpack {
@@ -11,6 +10,12 @@ in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
+  powerManagement.cpuFreqGovernor = "schedutil";
+  boot.kernel.sysctl = {
+    "vm.nr_hugepages" = 6656;
+    "vm.swappiness" = 10;
+  };
+  
   services.minecraft-servers = {
     enable = true;
     eula = true;
@@ -21,54 +26,34 @@ in {
       enable = true;
       autoStart = true;
       restart = "always";
-      enableReload = false; # NOTE: development phase, disable in production
+      enableReload = true; # NOTE: development phase, disable in production
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
-        jre_headless = pkgs.javaPackages.compiler.temurin-bin.jre-25;
+        jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
         loaderVersion = "0.19.2";
       };
 
-      jvmOpts = let
-        flags = [
-          "-Xms${ram-allocation}"
-          "-Xmx${ram-allocation}"
-          "--add-modules=jdk.incubator.vector"
-          
-          # Custom auth server
-          # "-Dminecraft.api.env=custom"
-          # "-Dminecraft.api.auth.host=${auth-server}/auth"
-          # "-Dminecraft.api.account.host=${auth-server}/account"
-          # "-Dminecraft.api.profiles.host=${auth-server}/account"
-          # "-Dminecraft.api.session.host=${auth-server}/session"
-          # "-Dminecraft.api.services.host=${auth-server}/services"
+      jvmOpts = let flags = [
+        "-Xms${toString ram-allocation-mb}M"
+        "-Xmx${toString ram-allocation-mb}M"
 
-          # Aikar's GC flags (tuned for 10GB)
-          "-XX:+UseG1GC"
-          "-XX:+ParallelRefProcEnabled"
-          "-XX:MaxGCPauseMillis=200"
-          "-XX:+UnlockExperimentalVMOptions"
-          "-XX:+DisableExplicitGC"
-          "-XX:+AlwaysPreTouch"
-          "-XX:G1HeapWastePercent=5"
-          "-XX:G1MixedGCCountTarget=4"
-          "-XX:InitiatingHeapOccupancyPercent=15"
-          "-XX:G1MixedGCLiveThresholdPercent=90"
-          "-XX:G1RSetUpdatingPauseTimePercent=5"
-          "-XX:SurvivorRatio=32"
-          "-XX:+PerfDisableSharedMem"
-          "-XX:MaxTenuringThreshold=1"
-          "-Dusing.aikars.flags=https://mcflags.emc.gs"
-          "-Daikars.new.flags=true"
-          "-XX:G1NewSizePercent=30"
-          "-XX:G1MaxNewSizePercent=40"
-          "-XX:G1HeapRegionSize=8M"
-          "-XX:G1ReservePercent=20"
-        ];
-      in lib.concatStringsSep " " flags;
+        # Exposes SIMD instructions (requires full JDK, useful with performance mods)
+        "--add-modules=jdk.incubator.vector"
+
+        # ZGC flags (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+        "-XX:+UseZGC"
+        "-XX:+UseLargePages"
+        "-XX:+AlwaysPreTouch"
+        "-XX:+DisableExplicitGC"
+        "-XX:+PerfDisableSharedMem"
+        "-XX:+UseCompactObjectHeaders"
+        "-XX:ZAllocationSpikeTolerance=5"
+        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M"
+      ]; in lib.concatStringsSep " " flags;
       
       serverProperties = {
         server-port = 25565;
-        server-name = "Digit Association";
+        server-name = "Minecraft Server";
         motd = "§lSeason 3 TESTING§r - §dExplorers Creativity 🔥";
         
         difficulty = "normal";
@@ -88,7 +73,7 @@ in {
         # resource-pack-sha1 = "e0958dcef5755286f390c22280700c471ec34a65";
         # resource-pack-enforce = false;
         
-        simulation-distance = 16;
+        simulation-distance = 12;
         view-distance = 4;
         
         enable-rcon = true;

From 02c4edc9084d91fd8b69efd25562b9f4b76450cd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 19:04:56 +0700
Subject: [PATCH 206/427] add rclone

---
 modules/system/misc/utilities.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/misc/utilities.nix b/modules/system/misc/utilities.nix
index de5d35e..a637e8d 100644
--- a/modules/system/misc/utilities.nix
+++ b/modules/system/misc/utilities.nix
@@ -8,6 +8,7 @@
     ntfs3g
     exfatprogs
     smartmontools
+    rclone
     ncdu
     ventoy-full-qt
 

From 3afe1f226f41f91d5fe82621b0bfd55ca831aee7 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 21:09:20 +0700
Subject: [PATCH 207/427] update modpack and add credits to readme

---
 README.md                     | 3 ++-
 modules/system/homelab/mc.nix | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index ee0d382..2eb43c0 100644
--- a/README.md
+++ b/README.md
@@ -8,4 +8,5 @@
 - `homelab` - i7 8700T, 32GB RAM, 512GB NVME, 1TB 2.5" SATA
 
 ## Credits
-- [orangc's flake](https://git.orangc.net/c/dots)
\ No newline at end of file
+- [orangc's flake](https://git.orangc.net/c/dots)
+- [vimjoyer's tutorials](https://www.youtube.com/@vimjoyer)
\ No newline at end of file
diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4e45400..eb11851 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,9 +1,9 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
   modpack = let
-    commit = "667aadf36aac9b0689289f4988a76b924bbb9cbc";
+    commit = "c82e271f5e8a8067ed62af6e870307459580e812";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-sNWuqTIpqnwxhoof5PkJXrvVE5x/wnhc3LoqomjYBNs=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 73428f1501f29b3b24ae48fe1216734d13a00704 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 21:12:56 +0700
Subject: [PATCH 208/427] update fix

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index eb11851..4b3adc6 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,7 +1,7 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
   modpack = let
-    commit = "c82e271f5e8a8067ed62af6e870307459580e812";
+    commit = "2465b8364a9dd8166921dbe854c5cc7d530cdc7c";
   in pkgs.fetchPackwizModpack {
     packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";

From 05f27f292734a2ff3bdc59581a888a612a5c7324 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 21:15:37 +0700
Subject: [PATCH 209/427] update fix 2

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4b3adc6..57a23b0 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,7 +1,7 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
   modpack = let
-    commit = "2465b8364a9dd8166921dbe854c5cc7d530cdc7c";
+    commit = "d1c0e4d6813e912a861345aa172eb52b83f93da9";
   in pkgs.fetchPackwizModpack {
     packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";

From 21f3df0cb42c39e2b71281c4ec8a46511d70fbdc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 8 May 2026 21:16:40 +0700
Subject: [PATCH 210/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 57a23b0..1e0affc 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,7 +3,7 @@
   modpack = let
     commit = "d1c0e4d6813e912a861345aa172eb52b83f93da9";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-qeiJlkMBkTW+WQemGt9W0N+iTgG6TKsq/5YiJuph1Sk=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From e3202701ef094ee3c0db015625b09420983b3ae0 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 14:21:30 +0700
Subject: [PATCH 211/427] wp source

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 2eb43c0..9172fc5 100644
--- a/README.md
+++ b/README.md
@@ -9,4 +9,5 @@
 
 ## Credits
 - [orangc's flake](https://git.orangc.net/c/dots)
-- [vimjoyer's tutorials](https://www.youtube.com/@vimjoyer)
\ No newline at end of file
+- [vimjoyer's tutorials](https://www.youtube.com/@vimjoyer)
+- [wallpaper source](https://github.com/er2de2/catppuccin_walls/blob/master/wallpapers_png/autumn_2.0.png)
\ No newline at end of file

From 0cdce64701ad540db7ccdbc0f9db29582db95926 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 14:21:45 +0700
Subject: [PATCH 212/427] dynamic large pages and update modpack

---
 modules/system/homelab/mc.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 1e0affc..8bb9344 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,9 +1,9 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
   modpack = let
-    commit = "d1c0e4d6813e912a861345aa172eb52b83f93da9";
+    commit = "476d4e5c08caded28ef0e24193249bec75cf52e6";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-qeiJlkMBkTW+WQemGt9W0N+iTgG6TKsq/5YiJuph1Sk=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {
@@ -12,7 +12,7 @@ in {
   
   powerManagement.cpuFreqGovernor = "schedutil";
   boot.kernel.sysctl = {
-    "vm.nr_hugepages" = 6656;
+    "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
     "vm.swappiness" = 10;
   };
   

From 81bf3f71187d93a4b3e6746b200e452c12a21e81 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 14:23:15 +0700
Subject: [PATCH 213/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8bb9344..a017ca8 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,7 +3,7 @@
   modpack = let
     commit = "476d4e5c08caded28ef0e24193249bec75cf52e6";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-zO7r8nXsK5Z3EnkUZNVDmPU1xqLI6qbZfS2tw0LLi0Q=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 59163a8f067fc66cb4fea8699a1833195384426d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 19:49:35 +0700
Subject: [PATCH 214/427] update modpack include worldgen

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index a017ca8..adbdcf0 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,9 +1,9 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
   modpack = let
-    commit = "476d4e5c08caded28ef0e24193249bec75cf52e6";
+    commit = "9241d6b4642239a6dfb5629ddb822a127bf93dff";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-zO7r8nXsK5Z3EnkUZNVDmPU1xqLI6qbZfS2tw0LLi0Q=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 48c4c03b738191211c6a61357b09af9ce3acd34f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 19:56:01 +0700
Subject: [PATCH 215/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index adbdcf0..9149da2 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,7 +3,7 @@
   modpack = let
     commit = "9241d6b4642239a6dfb5629ddb822a127bf93dff";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-GwXJf81iXuEEQeg97nKxzGG/dYl9l8xMW0+mOHRiSAQ=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
 in {

From 2844bce5a33a83220a8282dffec98b3846545bdb Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 20:40:07 +0700
Subject: [PATCH 216/427] add mc group and gamerule

---
 modules/system/homelab/mc.nix | 18 ++++++++++++++----
 modules/system/user.nix       |  1 +
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9149da2..42e1e2e 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,11 +1,13 @@
 { inputs, lib, pkgs, ... }: let
   ram-allocation-mb = 12288;
+  rcon-pass = "howdy";
   modpack = let
     commit = "9241d6b4642239a6dfb5629ddb822a127bf93dff";
   in pkgs.fetchPackwizModpack {
     packHash = "sha256-GwXJf81iXuEEQeg97nKxzGG/dYl9l8xMW0+mOHRiSAQ=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
+  
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -50,6 +52,16 @@ in {
         "-XX:ZAllocationSpikeTolerance=5"
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M"
       ]; in lib.concatStringsSep " " flags;
+
+      extraStartPost = let gamerules = {
+        "locator_bar" = false;
+        "mob_explosion_drop_decay" = false;
+        # "reduced_debug_info" = false;
+        # "global_sound_events" = false;
+      }; in lib.concatStringsSep "\n" (map
+        (rule: "rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
+        (lib.attrNames gamerules)
+      );
       
       serverProperties = {
         server-port = 25565;
@@ -78,16 +90,14 @@ in {
         
         enable-rcon = true;
         sync-chunk-writes = false;
-        "rcon.password" = "howdy";
+        "rcon.password" = rcon-pass;
         "rcon.port" = 25575;
       };
       
       symlinks = {
+        # "server-icon.png" = "${modpack}/server-icon.png";
         # "resources/datapack/required" = "${modpack}/datapacks";
         "mods" = "${modpack}/mods";
-        
-        # "server-icon.png" = "${modpack}/server-icon.png";
-        # "config" = "";
       };
     };
   };
diff --git a/modules/system/user.nix b/modules/system/user.nix
index 44910e9..5f50a54 100644
--- a/modules/system/user.nix
+++ b/modules/system/user.nix
@@ -7,6 +7,7 @@
     shell = pkgs.zsh;
     extraGroups = [
       "networkmanager"
+      "minecraft"
       "wheel"
       "dialout"
       "libvirtd"

From 51ea85202650d2e21eed01a51198fb331d638268 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:31:50 +0700
Subject: [PATCH 217/427] update modpack and include datapacks

---
 modules/system/homelab/mc.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 42e1e2e..cc64bb7 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "9241d6b4642239a6dfb5629ddb822a127bf93dff";
+    commit = "c204d7f5891543b9f15b5d6ba9a7904bab93bfde";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-GwXJf81iXuEEQeg97nKxzGG/dYl9l8xMW0+mOHRiSAQ=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   
@@ -96,7 +96,7 @@ in {
       
       symlinks = {
         # "server-icon.png" = "${modpack}/server-icon.png";
-        # "resources/datapack/required" = "${modpack}/datapacks";
+        "world/datapacks" = "${modpack}/datapacks";
         "mods" = "${modpack}/mods";
       };
     };

From c48283a6e237a017b4c69525c12893e36e7f0597 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:35:23 +0700
Subject: [PATCH 218/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index cc64bb7..409b5a3 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "c204d7f5891543b9f15b5d6ba9a7904bab93bfde";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-mzUO3/jVS0kLmSEa1MVaVG7+kDwMiOorwGJw0IVCRMk=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From b2ecd770c8e55d82961754665f07298571a52050 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:40:13 +0700
Subject: [PATCH 219/427] fix rcon-cli path

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 409b5a3..0c778cb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -59,7 +59,7 @@ in {
         # "reduced_debug_info" = false;
         # "global_sound_events" = false;
       }; in lib.concatStringsSep "\n" (map
-        (rule: "rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
+        (rule: "${pkgs.rcon-cli} --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
         (lib.attrNames gamerules)
       );
       

From 68455e7ce4f7d3400daba6e6ebea5b76797ad6cc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:41:18 +0700
Subject: [PATCH 220/427] fix bin path

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0c778cb..9fc0966 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -59,7 +59,7 @@ in {
         # "reduced_debug_info" = false;
         # "global_sound_events" = false;
       }; in lib.concatStringsSep "\n" (map
-        (rule: "${pkgs.rcon-cli} --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
+        (rule: "${pkgs.rcon-cli}/bin/rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
         (lib.attrNames gamerules)
       );
       

From 7d2be949cad00463c08b81289bc80f52861bdc23 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:43:30 +0700
Subject: [PATCH 221/427] startpost remove

---
 modules/system/homelab/mc.nix | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9fc0966..51444c4 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -53,15 +53,16 @@ in {
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M"
       ]; in lib.concatStringsSep " " flags;
 
-      extraStartPost = let gamerules = {
-        "locator_bar" = false;
-        "mob_explosion_drop_decay" = false;
-        # "reduced_debug_info" = false;
-        # "global_sound_events" = false;
-      }; in lib.concatStringsSep "\n" (map
-        (rule: "${pkgs.rcon-cli}/bin/rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
-        (lib.attrNames gamerules)
-      );
+      # extraStartPost = let gamerules = {
+      #   "locator_bar" = false;
+      #   "mob_explosion_drop_decay" = false;
+      #   # "reduced_debug_info" = false;
+      #   # "global_sound_events" = false;
+      # }; in lib.concatStringsSep "\n" (map
+      #   (rule: "${pkgs.rcon-cli}/bin/rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
+      #   (lib.attrNames gamerules)
+      # );
+      # TODO: figure out how to set gamerules on start (script above runs **before** server ready)
       
       serverProperties = {
         server-port = 25565;

From 2740bb817587c5a04b5db9c30bbf9becc4e43922 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:46:33 +0700
Subject: [PATCH 222/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 51444c4..50a7865 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "c204d7f5891543b9f15b5d6ba9a7904bab93bfde";
+    commit = "d2b9f6d5059ec68df3323328dab70a918195e487";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-mzUO3/jVS0kLmSEa1MVaVG7+kDwMiOorwGJw0IVCRMk=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From b917409d106facc8d0ce66b80b52bd7968530e77 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:49:38 +0700
Subject: [PATCH 223/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 50a7865..0edebbb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "d2b9f6d5059ec68df3323328dab70a918195e487";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-p2Lg2VldNcujIcI2DsmwZtZeF6rdAIQzcf0QaEPn15A=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From acf495fae239919577c3701351b7b4b3eb9774ab Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:54:44 +0700
Subject: [PATCH 224/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0edebbb..9e77ee5 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,7 +2,7 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "d2b9f6d5059ec68df3323328dab70a918195e487";
+    commit = "4da142e626638de11e454db604251dce6cc14c58";
   in pkgs.fetchPackwizModpack {
     packHash = "sha256-p2Lg2VldNcujIcI2DsmwZtZeF6rdAIQzcf0QaEPn15A=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";

From 4b6a8a6fa28d534681b43feb80b55818e53355d1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:56:17 +0700
Subject: [PATCH 225/427] refresh hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9e77ee5..29fb169 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "4da142e626638de11e454db604251dce6cc14c58";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-p2Lg2VldNcujIcI2DsmwZtZeF6rdAIQzcf0QaEPn15A=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From c03567baa351aae858aa28ee28d435795495fb00 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 9 May 2026 23:57:24 +0700
Subject: [PATCH 226/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 29fb169..096c885 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "4da142e626638de11e454db604251dce6cc14c58";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-xpVxreoFVF5e3VidtlqgiIWZYcBy8OY9vrSv3dgV/u8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From e9306f35153be41bd24ae1db242f7a232951b0dd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 00:03:51 +0700
Subject: [PATCH 227/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 096c885..913cc36 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "4da142e626638de11e454db604251dce6cc14c58";
+    commit = "a52f65c1234b9f2dbe1392c471cb32a0614c5073";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-xpVxreoFVF5e3VidtlqgiIWZYcBy8OY9vrSv3dgV/u8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 13041a04a5a31aa0145c304075c26d7a908a9533 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 00:06:31 +0700
Subject: [PATCH 228/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 913cc36..fc641c7 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "a52f65c1234b9f2dbe1392c471cb32a0614c5073";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-WplCmvuCmA8TNeRVBKMwkvizmYlBcU9PDugXXSKTBaA=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 0b2ef091ee9c7dd8a7cd9ab1981da47d5c682d59 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 10:43:02 +0700
Subject: [PATCH 229/427] got some things mixed up :p

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index fc641c7..d47f5db 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -86,8 +86,8 @@ in {
         # resource-pack-sha1 = "e0958dcef5755286f390c22280700c471ec34a65";
         # resource-pack-enforce = false;
         
-        simulation-distance = 12;
-        view-distance = 4;
+        view-distance = 12;
+        simulation-distance = 4;
         
         enable-rcon = true;
         sync-chunk-writes = false;

From 6e02ff9c9c1de4a695ea8c2d6b32e1e0a58fa4f6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 10:49:39 +0700
Subject: [PATCH 230/427] remove datapacks

---
 modules/system/homelab/mc.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d47f5db..505c34f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -97,7 +97,6 @@ in {
       
       symlinks = {
         # "server-icon.png" = "${modpack}/server-icon.png";
-        "world/datapacks" = "${modpack}/datapacks";
         "mods" = "${modpack}/mods";
       };
     };

From 3dc56278c9e83efbbce8206634c14c9d81f08ffa Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 10:50:02 +0700
Subject: [PATCH 231/427] zgc lag from pause fix

---
 modules/system/homelab/mc.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 505c34f..531253a 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -51,6 +51,10 @@ in {
         "-XX:+UseCompactObjectHeaders"
         "-XX:ZAllocationSpikeTolerance=5"
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M"
+
+        # High MSPT due to ZGC pauses
+        "-XX:ZUncommitDelay=300"
+        "-XX:ZCollectionInterval=5"
       ]; in lib.concatStringsSep " " flags;
 
       # extraStartPost = let gamerules = {

From 90ed03a7aeb3cb8d3cde86e261531e02d41bef25 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 11:20:55 +0700
Subject: [PATCH 232/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 531253a..03171a9 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "a52f65c1234b9f2dbe1392c471cb32a0614c5073";
+    commit = "ac9278758cf96b97fbb4f816aca0fb2f94ccf3a2";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-WplCmvuCmA8TNeRVBKMwkvizmYlBcU9PDugXXSKTBaA=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 7e2c4b5169971e46a296d9a3428eebffa5fa857f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 11:27:44 +0700
Subject: [PATCH 233/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 03171a9..18a49a9 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "ac9278758cf96b97fbb4f816aca0fb2f94ccf3a2";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-X9CTYHfGRx6caCHfe+KS6/jhXV5fPCZ9hr8O2tlXus0=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 51b83d617ed394ed0b5533293353f040dae84989 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 18:52:32 +0700
Subject: [PATCH 234/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 18a49a9..182a82f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "ac9278758cf96b97fbb4f816aca0fb2f94ccf3a2";
+    commit = "918b281754d4c289a3567cca083774087b2a2ec0";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-X9CTYHfGRx6caCHfe+KS6/jhXV5fPCZ9hr8O2tlXus0=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From b8b5084352287158eb9011d9b6d9eb57d27e13f5 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 10 May 2026 18:54:43 +0700
Subject: [PATCH 235/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 182a82f..70c9dc0 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "918b281754d4c289a3567cca083774087b2a2ec0";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-HmTDQac9FCQXBPWiZIxu9zmHyl2vqMVQpZpDHp+2lBA=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 35185583ee71deb26f0bad0a45cbd25e8544ddff Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 11 May 2026 16:12:48 +0700
Subject: [PATCH 236/427] fix battery notif

---
 modules/hardware/misc/battery-power.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index 3a2ca6b..8c529e1 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -17,8 +17,10 @@
           BAT_PCT=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
           BAT_STA=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
           echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
-          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send "Low Battery" "Battery remaining: $BAT_PCT%."
-          test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && DISPLAY=:0.0 ${pkgs.libnotify}/bin/notify-send -u critical "Low Battery" "Shutdown at 10%."
+          export DISPLAY=:0
+          export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus
+          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && ${pkgs.libnotify}/bin/notify-send "Low Battery" "Battery remaining: $BAT_PCT%."
+          test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && ${pkgs.libnotify}/bin/notify-send -u critical "Low Battery" "Shutdown at 10%."
         ''} > /tmp/cron.batt.log 2>&1"
       ];
     };

From 23d4592783c0fc2991375912b8b1b890ddd7bf81 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 11 May 2026 16:26:43 +0700
Subject: [PATCH 237/427] cleanup flag config and update modpack

---
 modules/system/homelab/mc.nix | 32 +++++++++++++-------------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 70c9dc0..d545f0b 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "918b281754d4c289a3567cca083774087b2a2ec0";
+    commit = "506050af820a4cf370c6f2021c5991d665ba902a";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-HmTDQac9FCQXBPWiZIxu9zmHyl2vqMVQpZpDHp+2lBA=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   
@@ -38,23 +38,17 @@ in {
       jvmOpts = let flags = [
         "-Xms${toString ram-allocation-mb}M"
         "-Xmx${toString ram-allocation-mb}M"
-
-        # Exposes SIMD instructions (requires full JDK, useful with performance mods)
-        "--add-modules=jdk.incubator.vector"
-
-        # ZGC flags (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
-        "-XX:+UseZGC"
-        "-XX:+UseLargePages"
-        "-XX:+AlwaysPreTouch"
-        "-XX:+DisableExplicitGC"
-        "-XX:+PerfDisableSharedMem"
-        "-XX:+UseCompactObjectHeaders"
-        "-XX:ZAllocationSpikeTolerance=5"
-        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M"
-
-        # High MSPT due to ZGC pauses
-        "-XX:ZUncommitDelay=300"
-        "-XX:ZCollectionInterval=5"
+        
+        "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+        "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
+        
+        "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods)
+        "-XX:+UseLargePages" # Large pages support (requires hugepages configured on the system)
+        "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
+        "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
+        "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+        "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players (causes unnecessary GC load at idle)
+        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom for off-heap memory (native code, mods, and ZGC overhead)
       ]; in lib.concatStringsSep " " flags;
 
       # extraStartPost = let gamerules = {

From 33f323d1ec2ede8aeb11f98e9818a2a31ae55ea8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 11 May 2026 16:39:50 +0700
Subject: [PATCH 238/427] cleanup config, use new dir, update hash

---
 modules/system/homelab/mc.nix | 87 +++++++++++++++--------------------
 1 file changed, 36 insertions(+), 51 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d545f0b..cc44d20 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "506050af820a4cf370c6f2021c5991d665ba902a";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-Haonn1K74z0aREXCfb/t88DtYD6Kboq23kS6wxqKc3Y=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   
@@ -21,14 +21,46 @@ in {
   services.minecraft-servers = {
     enable = true;
     eula = true;
-    managementSystem.systemd-socket.enable = true; # Referenced but unset environment variable evaluates to an empty string: MAINPID
+    managementSystem.systemd-socket.enable = true;
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
+    
+    # TODO: figure out how to set gamerules on start (script above runs **before** server ready)
+    # gamerules to disable: locator_bar, mob_explosion_drop_decay 
    
-    servers.mc0-explorers-creativity = {
+    servers.da-s3 = {
       enable = true;
       autoStart = true;
       restart = "always";
-      enableReload = true; # NOTE: development phase, disable in production
+      enableReload = false;
+      
+      serverProperties = {
+        server-port = 25565;
+        server-name = "Minecraft Server";
+        motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
+        
+        difficulty = "normal";
+        gamemode = "survival";
+        max-world-size = 25000;
+        spawn-protection = 0;
+        pvp = true;
+        
+        online-mode = true;
+        enable-query = true;
+        enforce-secure-profile = false;
+        pevent-proxy-connections = false;
+        allow-flight = false;
+        player-idle-timeout = 0;
+        
+        view-distance = 12;
+        simulation-distance = 4;
+        
+        enable-rcon = true;
+        sync-chunk-writes = false;
+        "rcon.password" = rcon-pass;
+        "rcon.port" = 25575;
+      };
+      
+      symlinks."mods" = "${modpack}/mods";
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
@@ -50,53 +82,6 @@ in {
         "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players (causes unnecessary GC load at idle)
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom for off-heap memory (native code, mods, and ZGC overhead)
       ]; in lib.concatStringsSep " " flags;
-
-      # extraStartPost = let gamerules = {
-      #   "locator_bar" = false;
-      #   "mob_explosion_drop_decay" = false;
-      #   # "reduced_debug_info" = false;
-      #   # "global_sound_events" = false;
-      # }; in lib.concatStringsSep "\n" (map
-      #   (rule: "${pkgs.rcon-cli}/bin/rcon-cli --password ${rcon-pass} gamerule ${rule} ${toString (gamerules.${rule})}")
-      #   (lib.attrNames gamerules)
-      # );
-      # TODO: figure out how to set gamerules on start (script above runs **before** server ready)
-      
-      serverProperties = {
-        server-port = 25565;
-        server-name = "Minecraft Server";
-        motd = "§lSeason 3 TESTING§r - §dExplorers Creativity 🔥";
-        
-        difficulty = "normal";
-        gamemode = "survival";
-        max-world-size = 25000;
-        spawn-protection = 0;
-        pvp = true;
-        
-        online-mode = true;
-        enable-query = true;
-        enforce-secure-profile = false;
-        pevent-proxy-connections = false;
-        allow-flight = false;
-        player-idle-timeout = 0;
-        
-        # resource-pack = "https://cdn.satr14.my.id/public/fullslide-1.21.11.zip";
-        # resource-pack-sha1 = "e0958dcef5755286f390c22280700c471ec34a65";
-        # resource-pack-enforce = false;
-        
-        view-distance = 12;
-        simulation-distance = 4;
-        
-        enable-rcon = true;
-        sync-chunk-writes = false;
-        "rcon.password" = rcon-pass;
-        "rcon.port" = 25575;
-      };
-      
-      symlinks = {
-        # "server-icon.png" = "${modpack}/server-icon.png";
-        "mods" = "${modpack}/mods";
-      };
     };
   };
 }
\ No newline at end of file

From 3ac6b06f434621f34edfae825e13768708595244 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 12 May 2026 21:28:06 +0700
Subject: [PATCH 239/427] fix luckperms error

---
 modules/system/homelab/mc.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index cc44d20..ece3dec 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -60,7 +60,9 @@ in {
         "rcon.port" = 25575;
       };
       
-      symlinks."mods" = "${modpack}/mods";
+      symlinks = lib.mapAttrs'
+        (name: _: lib.nameValuePair "mods/${name}" "${modpack}/mods/${name}")
+        (builtins.readDir "${modpack}/mods");
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;

From c2924a2a58d45cb6b22087944f2d9d363077cfeb Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 13 May 2026 15:15:01 +0700
Subject: [PATCH 240/427] enable jstat

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index ece3dec..7c35d85 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -80,7 +80,7 @@ in {
         "-XX:+UseLargePages" # Large pages support (requires hugepages configured on the system)
         "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
         "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
-        "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+        # "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
         "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players (causes unnecessary GC load at idle)
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom for off-heap memory (native code, mods, and ZGC overhead)
       ]; in lib.concatStringsSep " " flags;

From 7791a235909caf9a3670184872f25927ba1bfa38 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 13 May 2026 15:18:29 +0700
Subject: [PATCH 241/427] shorten journal output

---
 modules/home/core/shell.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index 2a23a42..7c69e47 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -37,9 +37,9 @@
         "cd" = "z";
 
         "sys" = "sudo systemctl --runtime";
-        "sys-log" = "journalctl -f -b -u";
+        "sys-log" = "journalctl -o cat -f -b -u";
         "user" = "systemctl --user --runtime";
-        "user-log" = "journalctl -f -b --user-unit";
+        "user-log" = "journalctl -o cat -f -b --user-unit";
 
         "ts" = "sudo tailscale";
         "tsip" = "tailscale ip -4";

From d97d291c981753666b7925ba32c506f6aa2fe680 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 14 May 2026 09:08:05 +0700
Subject: [PATCH 242/427] set to perf overclock

---
 modules/system/homelab/mc.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 7c35d85..0834b82 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -12,7 +12,7 @@ in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
-  powerManagement.cpuFreqGovernor = "schedutil";
+  powerManagement.cpuFreqGovernor = "performance";
   boot.kernel.sysctl = {
     "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
     "vm.swappiness" = 10;
@@ -83,6 +83,8 @@ in {
         # "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
         "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players (causes unnecessary GC load at idle)
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom for off-heap memory (native code, mods, and ZGC overhead)
+        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every 1s — prevents allocation stalls when ZGC falls behind Minecraft's bursty allocation
+        "-XX:ConcGCThreads=4" # Threads ZGC uses for concurrent work; default (cpu/8+1) is often just 2, too slow to keep up with allocation rate
       ]; in lib.concatStringsSep " " flags;
     };
   };

From c3db68fad698a12efb507bbf5ef3189bcb15ef5c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 14 May 2026 09:21:54 +0700
Subject: [PATCH 243/427] try powersave

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0834b82..8682e1d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -12,7 +12,7 @@ in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
-  powerManagement.cpuFreqGovernor = "performance";
+  powerManagement.cpuFreqGovernor = "powersave";
   boot.kernel.sysctl = {
     "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
     "vm.swappiness" = 10;

From 0ebe87c5c376ff4f0b6927611c79f227dbc57a1f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 15 May 2026 21:01:29 +0700
Subject: [PATCH 244/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8682e1d..2362e61 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "506050af820a4cf370c6f2021c5991d665ba902a";
+    commit = "c7d1a2d8d181104707dd549fc65fffda956b8f40";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-Haonn1K74z0aREXCfb/t88DtYD6Kboq23kS6wxqKc3Y=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 05b6c5f45074bdc262a6a5b6c9f0cb0e68c0a0d6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 15 May 2026 21:02:56 +0700
Subject: [PATCH 245/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2362e61..20b8b5f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "c7d1a2d8d181104707dd549fc65fffda956b8f40";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-h/hQalxd8C5D5LADgsok3bMeQSb2Bgpg6UIbZWM0fw8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 6a106d606c28cdffe6e0d82aed9f1b93a25776b9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:23:54 +0700
Subject: [PATCH 246/427] add clipboard support

---
 modules/home/core/cli.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 86b3c08..4f2dbf6 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -49,10 +49,20 @@
       initLua = ''
         vim.opt.clipboard = "unnamedplus"
         vim.opt.termguicolors = true
+        vim.g.clipboard = {
+          name = "OSC 52",
+          copy = {
+            ["+"] = require("vim.ui.clipboard.osc52").copy("+"),
+            ["*"] = require("vim.ui.clipboard.osc52").copy("*"),
+          },
+          paste = {
+            ["+"] = require("vim.ui.clipboard.osc52").paste("+"),
+            ["*"] = require("vim.ui.clipboard.osc52").paste("*"),
+          },
+        }
         require("nvim-tree").setup()
         vim.api.nvim_create_autocmd("VimEnter", {
           callback = function()
-            -- vim.cmd("NvimTreeOpen")
             vim.cmd("set nu")
             vim.cmd.wincmd 'p'
           end,

From 70fa5793315a4202dcf3fe2d4e794967d8cc0289 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:35:48 +0700
Subject: [PATCH 247/427] update modpack and add me as an op

---
 modules/system/homelab/mc.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 20b8b5f..be0d461 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "c7d1a2d8d181104707dd549fc65fffda956b8f40";
+    commit = "81067d9cea4e3c48acceb42c8c62c252ab1bd3b2";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-h/hQalxd8C5D5LADgsok3bMeQSb2Bgpg6UIbZWM0fw8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   
@@ -33,6 +33,13 @@ in {
       restart = "always";
       enableReload = false;
       
+      operators."satr14" = {
+        uuid = "54441a30-fe73-46e7-adca-c476bd4fc6d2";
+        bypassesPlayerLimit = true;
+        level = 4;
+      };
+      # ^^ DISABLE ON PROD
+      
       serverProperties = {
         server-port = 25565;
         server-name = "Minecraft Server";

From 9993ed52a750e83df48070c918ea4e74dcbce83e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:36:43 +0700
Subject: [PATCH 248/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index be0d461..2c85010 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "81067d9cea4e3c48acceb42c8c62c252ab1bd3b2";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-D34uF8LUPNM1LTvOM3V8tvo4yfG++UODxW2qH2tXs/8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From df27e80f4a0d51202150f8ab6afe550986492da7 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:37:57 +0700
Subject: [PATCH 249/427] [skip ci] small note

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2c85010..ca92440 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -12,7 +12,7 @@ in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
   
-  powerManagement.cpuFreqGovernor = "powersave";
+  powerManagement.cpuFreqGovernor = "powersave"; # performance governor causes overheating and thermal throttling, works fine with powesave
   boot.kernel.sysctl = {
     "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
     "vm.swappiness" = 10;

From 858e77735fe3cdf1cec7543212f2dd94914c30be Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:51:20 +0700
Subject: [PATCH 250/427] [skip ci] add extra notes

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index ca92440..6a0cdf3 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -26,6 +26,7 @@ in {
     
     # TODO: figure out how to set gamerules on start (script above runs **before** server ready)
     # gamerules to disable: locator_bar, mob_explosion_drop_decay 
+    # gamerules to enable (temporarily): noend:disable_end
    
     servers.da-s3 = {
       enable = true;

From 3db7568fa65f527a0e2264b9cb47e2b92f426e5f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:51:48 +0700
Subject: [PATCH 251/427] [skip ci] fix comment

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 6a0cdf3..944ea4a 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -24,7 +24,7 @@ in {
     managementSystem.systemd-socket.enable = true;
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
     
-    # TODO: figure out how to set gamerules on start (script above runs **before** server ready)
+    # TODO: figure out how to set gamerules on start
     # gamerules to disable: locator_bar, mob_explosion_drop_decay 
     # gamerules to enable (temporarily): noend:disable_end
    

From 180521963ab5ed0dc27d6ecd1ffb37393e05f00e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:53:54 +0700
Subject: [PATCH 252/427] [skip ci] todo comments

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 944ea4a..0baf6cc 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -25,7 +25,7 @@ in {
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
     
     # TODO: figure out how to set gamerules on start
-    # gamerules to disable: locator_bar, mob_explosion_drop_decay 
+    # gamerules to disable: locator_bar, mob_explosion_drop_decay, (and possibly) reduced_debug_info, global_sound_events 
     # gamerules to enable (temporarily): noend:disable_end
    
     servers.da-s3 = {

From 287458eec01d0e12beec8d386959a051d59be691 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 07:59:29 +0700
Subject: [PATCH 253/427] disable ip logging

---
 modules/system/homelab/mc.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0baf6cc..f63a1fb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -42,9 +42,11 @@ in {
       # ^^ DISABLE ON PROD
       
       serverProperties = {
+        # server-ip = "localhost";
         server-port = 25565;
         server-name = "Minecraft Server";
         motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
+        log-ips = false; # TODO: figure out how to get ips from cloudflared tunnel
         
         difficulty = "normal";
         gamemode = "survival";

From 092883606a36dca791e9a69582dc40ec3659a562 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 08:57:32 +0700
Subject: [PATCH 254/427] switch dashboard to be main page

---
 modules/system/homelab/dash.nix | 190 ++++++++++++++++----------------
 1 file changed, 95 insertions(+), 95 deletions(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index d973699..e7d62bf 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -89,6 +89,101 @@ in {
       };
 
       pages = [
+        {
+          name = "Dashboard";
+          show-mobile-header = true;
+          width = "slim";
+          columns = [
+            {
+              size = "small";
+              widgets = [
+                {
+                  type = "monitor";
+                  title = "Critical Systems";
+                  cache = "15s";
+                  style = "compact";
+                  show-failing-only = true;
+                  sites = map (e: {
+                    same-tab = true;
+                    allow-insecure = true;
+                    title = builtins.elemAt e 0;
+                    url = builtins.elemAt e 1;
+                  }) monitor;
+                }
+                {
+                  type = "dns-stats";
+                  title = "DNS Stats";
+                  service = "adguard";
+                  url = "http://localhost:8088/";
+                  hour-format = "12h";
+                }
+                {
+                  type = "bookmarks";
+                  groups = [
+                    {
+                      links = [{
+                        same-tab = true;
+                        title = "NixFlake";
+                        icon = "si:nixos";
+                        url = "https://flake.satr14.my.id";
+                      }];
+                    }
+                    {
+                      links = map (e: {
+                        same-tab = true;
+                        title = builtins.elemAt e 0;
+                        icon = "si:${builtins.elemAt e 1}";
+                        url = builtins.elemAt e 2;
+                        alt-status-codes = [ 401 ];
+                      }) bookmarks;
+                    }
+                  ];
+                }
+                {
+                  type = "to-do";
+                  id = "tasks";
+                }
+              ];
+            }
+            {
+              size = "full";
+              widgets = [
+                {
+                  type = "server-stats";
+                  servers = [{
+                    type = "local";
+                    mountpoints = {
+                      "/boot".hide = true;
+                      "/nix/store".hide = true;
+                      "/var/lib/vaultwarden".hide = true;
+                      "/var/lib/private/cryptpad".hide = true;
+                      "/var/lib/acme/proxy.satr14.my.id".hide = true;
+                    };
+                  }];
+                }
+                {
+                  type = "monitor";
+                  cache = "1m";
+                  title = "Services";
+                  sites = map (e: { 
+                    same-tab = true;
+                    allow-insecure = true;
+                    title = builtins.elemAt e 0;
+                    icon = "si:${builtins.elemAt e 1}";
+                    url = builtins.elemAt e 2;
+                    check-url = builtins.elemAt e 3;
+                  }) homelab.dash;
+                }
+                {
+                  type = "docker-containers";
+                  title = "Containers";
+                  format-container-names = true;
+                  hide-by-default = true;
+                }
+              ];
+            }
+          ];
+        }
         {
           name = "Home";
           show-mobile-header = true;
@@ -187,101 +282,6 @@ in {
             }
           ];
         }
-        {
-          name = "Dashboard";
-          show-mobile-header = true;
-          width = "slim";
-          columns = [
-            {
-              size = "small";
-              widgets = [
-                {
-                  type = "monitor";
-                  title = "Critical Systems";
-                  cache = "15s";
-                  style = "compact";
-                  show-failing-only = true;
-                  sites = map (e: {
-                    same-tab = true;
-                    allow-insecure = true;
-                    title = builtins.elemAt e 0;
-                    url = builtins.elemAt e 1;
-                  }) monitor;
-                }
-                {
-                  type = "dns-stats";
-                  title = "DNS Stats";
-                  service = "adguard";
-                  url = "http://localhost:8088/";
-                  hour-format = "12h";
-                }
-                {
-                  type = "bookmarks";
-                  groups = [
-                    {
-                      links = [{
-                        same-tab = true;
-                        title = "NixFlake";
-                        icon = "si:nixos";
-                        url = "https://flake.satr14.my.id";
-                      }];
-                    }
-                    {
-                      links = map (e: {
-                        same-tab = true;
-                        title = builtins.elemAt e 0;
-                        icon = "si:${builtins.elemAt e 1}";
-                        url = builtins.elemAt e 2;
-                        alt-status-codes = [ 401 ];
-                      }) bookmarks;
-                    }
-                  ];
-                }
-                {
-                  type = "to-do";
-                  id = "tasks";
-                }
-              ];
-            }
-            {
-              size = "full";
-              widgets = [
-                {
-                  type = "server-stats";
-                  servers = [{
-                    type = "local";
-                    mountpoints = {
-                      "/boot".hide = true;
-                      "/nix/store".hide = true;
-                      "/var/lib/vaultwarden".hide = true;
-                      "/var/lib/private/cryptpad".hide = true;
-                      "/var/lib/acme/proxy.satr14.my.id".hide = true;
-                    };
-                  }];
-                }
-                {
-                  type = "monitor";
-                  cache = "1m";
-                  title = "Services";
-                  sites = map (e: { 
-                    same-tab = true;
-                    allow-insecure = true;
-                    title = builtins.elemAt e 0;
-                    icon = "si:${builtins.elemAt e 1}";
-                    url = builtins.elemAt e 2;
-                    check-url = builtins.elemAt e 3;
-                  }) homelab.dash;
-                }
-                {
-                  type = "docker-containers";
-                  title = "Containers";
-                  format-container-names = true;
-                  hide-by-default = true;
-                }
-              ];
-            }
-          ];
-        }
       ];
     };
   };

From b349172b599782b41da2fc54961d2794511d2319 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 17 May 2026 13:11:18 +0700
Subject: [PATCH 255/427] jvm tuning

---
 modules/system/homelab/mc.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index f63a1fb..3923e3a 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -90,11 +90,11 @@ in {
         "-XX:+UseLargePages" # Large pages support (requires hugepages configured on the system)
         "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
         "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
-        # "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
-        "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players (causes unnecessary GC load at idle)
-        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom for off-heap memory (native code, mods, and ZGC overhead)
-        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every 1s — prevents allocation stalls when ZGC falls behind Minecraft's bursty allocation
-        "-XX:ConcGCThreads=4" # Threads ZGC uses for concurrent work; default (cpu/8+1) is often just 2, too slow to keep up with allocation rate
+        "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+        "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
+        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom
+        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
+        "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
       ]; in lib.concatStringsSep " " flags;
     };
   };

From 79fd698e12845f87c0231fcd2d00b057d686c61f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 19 May 2026 17:28:15 +0700
Subject: [PATCH 256/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 3923e3a..cf6b40c 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -2,9 +2,9 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "81067d9cea4e3c48acceb42c8c62c252ab1bd3b2";
+    commit = "8523f89493ace13087eb68cd9fe3b5eb4f669440";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-D34uF8LUPNM1LTvOM3V8tvo4yfG++UODxW2qH2tXs/8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 8745a66a2a00828c358a3899f9247751dd8a0c4b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 19 May 2026 17:37:50 +0700
Subject: [PATCH 257/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index cf6b40c..2084d2e 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   modpack = let
     commit = "8523f89493ace13087eb68cd9fe3b5eb4f669440";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-xB9Oc/aneogSQ9r7L42vyVM6xwq+QkoTaXYNuUzeo6M=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
   };
   

From 89931de313b72ff38235ea8f82d261cf11cf5a5c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 30 May 2026 18:29:01 +0700
Subject: [PATCH 258/427] enable netbird

---
 modules/system/server.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/modules/system/server.nix b/modules/system/server.nix
index 57a3ff0..a2cef9f 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -35,14 +35,17 @@ in {
 
   users.users.root.openssh.authorizedKeys.keys = homelab.ssh-keys;
   
-  services.tailscale = {
-    enable = true;
-    authKeyFile = "/mnt/data/apps/tailscale/authkey";
-    useRoutingFeatures = "server";
-    extraUpFlags = ts-flags;
-    extraSetFlags = ts-flags;
+  services = {
+    netbird.enable = true;
+    tailscale = {
+      enable = true;
+      authKeyFile = "/mnt/data/apps/tailscale/authkey";
+      useRoutingFeatures = "server";
+      extraUpFlags = ts-flags;
+      extraSetFlags = ts-flags;
+    };
   };
-  
+
   virtualisation = {
     oci-containers.backend = "docker";
     docker = {

From dced4e3a58e48f5387d0deebb3321b919f3211d8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 4 Jun 2026 13:51:24 +0700
Subject: [PATCH 259/427] add bun

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index db30c7a..2544f90 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -45,7 +45,7 @@
       url = "http://localhost:5080"; #"https://git.proxy.${homelab.domain}";
       tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
       labels = [ "self-hosted:host" ];
-      hostPackages = with pkgs; [ bash coreutils git nix openssh nodejs ];
+      hostPackages = with pkgs; [ bash coreutils git nix openssh bun ];
     };
   };
   systemd.services = {

From cabd26d2323b6b8a733a11c4d89ef06324cc9d4a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 4 Jun 2026 13:51:57 +0700
Subject: [PATCH 260/427] prod toggle

---
 modules/system/homelab/mc.nix | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2084d2e..90e2e76 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,11 +1,13 @@
 { inputs, lib, pkgs, ... }: let
+  production = true;
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
     commit = "8523f89493ace13087eb68cd9fe3b5eb4f669440";
+    path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
     packHash = "sha256-xB9Oc/aneogSQ9r7L42vyVM6xwq+QkoTaXYNuUzeo6M=";
-    url = "https://git.satr14.my.id/satr14/server-modpack/raw/commit/${commit}/pack.toml";
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
   
 in {
@@ -32,14 +34,25 @@ in {
       enable = true;
       autoStart = true;
       restart = "always";
-      enableReload = false;
+      enableReload = production;
+      # extraReload = ''
+      #   function rcon() {
+      #     ${pkgs.rcon-cli}/bin/rcon-cli -p ${rcon-pass} $@
+      #   }
+
+      #   rcon "gamerule locator_bar false"
+      #   rcon "gamerule mob_explosion_drop_decay false"
+      #   rcon "gamerule reduced_debug_info false"
+      #   rcon "gamerule global_sound_events false"
+      # '';
       
-      operators."satr14" = {
-        uuid = "54441a30-fe73-46e7-adca-c476bd4fc6d2";
-        bypassesPlayerLimit = true;
-        level = 4;
+      operators = lib.mkIf (!production) {
+        "satr14" = {
+          uuid = "54441a30-fe73-46e7-adca-c476bd4fc6d2";
+          bypassesPlayerLimit = true;
+          level = 4;
+        };
       };
-      # ^^ DISABLE ON PROD
       
       serverProperties = {
         # server-ip = "localhost";

From 598737859c3473fb72e52a303ba72a0438e3ff0b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 4 Jun 2026 13:52:20 +0700
Subject: [PATCH 261/427] todo

---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 9172fc5..f8496c7 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,11 @@
 - `thinkpad` - Thinkpad T480, i5 8350U, 16GB RAM, 256GB NVME
 - `homelab` - i7 8700T, 32GB RAM, 512GB NVME, 1TB 2.5" SATA
 
+## Todo
+- Automatic backups to external drives.
+- Better documentation and code structure.
+- Use NixOS modules system. 
+
 ## Credits
 - [orangc's flake](https://git.orangc.net/c/dots)
 - [vimjoyer's tutorials](https://www.youtube.com/@vimjoyer)

From 2e38a8834faa6d972f66ac381b4a4c0033e4da44 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 09:21:09 +0700
Subject: [PATCH 262/427] git tweaks

---
 modules/home/core/cli.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 4f2dbf6..b88d171 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -94,6 +94,7 @@
       enable = true;
       signing.format = null;
       settings = {
+        push.autoSetupRemote = true;
         pull.rebase = "true";
         credential.helper = "cache --timeout=3600";
         user = {

From 604e74c074fbe6a1dd188fe5a7adb8b87e7635a3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 09:42:13 +0700
Subject: [PATCH 263/427] [skip ci] add extra labels

---
 modules/system/homelab/git.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 2544f90..1d3409c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -44,7 +44,12 @@
       name = "nixos-server-runner";
       url = "http://localhost:5080"; #"https://git.proxy.${homelab.domain}";
       tokenFile = "/mnt/data/apps/forgejo/token-runner"; 
-      labels = [ "self-hosted:host" ];
+      labels = [
+        "self-hosted:host"
+        "bun:docker://docker.io/oven/bun"
+        "debian:docker://docker.io/library/debian:trixie-slim"
+        "aio:docker://git.satr14.my.id/satr14/aio-container:latest"
+      ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh bun ];
     };
   };

From b25a385ec36ae338070d074250f4de5d29b664cb Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 10:03:56 +0700
Subject: [PATCH 264/427] [skip ci] change image

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 1d3409c..7341d16 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -47,7 +47,7 @@
       labels = [
         "self-hosted:host"
         "bun:docker://docker.io/oven/bun"
-        "debian:docker://docker.io/library/debian:trixie-slim"
+        "debian:docker://docker.io/library/node:26-trixie-slim"
         "aio:docker://git.satr14.my.id/satr14/aio-container:latest"
       ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh bun ];

From 56293e353c34c6a87f25ad682c6bbfda79906281 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 10:13:12 +0700
Subject: [PATCH 265/427] fix actions url

---
 modules/system/homelab/git.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 7341d16..5f6bfa7 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -20,7 +20,8 @@
           ROOT_URL = "https://git.${homelab.domain}";
           LANDING_PAGE = "explore";
         };
-        oauth2_client.ENABLE_AUTO_REGISTRATION=true;
+        actions.DEFAULT_ACTIONS_URL = "https://git.satr14.my.id";
+        oauth2_client.ENABLE_AUTO_REGISTRATION = true;
         service = {
           DISABLE_REGISTRATION = true;
           ENABLE_OPENID_SIGNIN = false;

From 2a180db15394ae0e7a253d62fd1bc1485c462cb4 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 10:42:24 +0700
Subject: [PATCH 266/427] hide players

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 90e2e76..e0296a2 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -60,6 +60,7 @@ in {
         server-name = "Minecraft Server";
         motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
         log-ips = false; # TODO: figure out how to get ips from cloudflared tunnel
+        hide-online-players = true; 
         
         difficulty = "normal";
         gamemode = "survival";

From 21246f1c67a71c568a67411adfed0f7ef3e85177 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 11:09:50 +0700
Subject: [PATCH 267/427] motd faker

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index e0296a2..dd53017 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -58,7 +58,7 @@ in {
         # server-ip = "localhost";
         server-port = 25565;
         server-name = "Minecraft Server";
-        motd = "§lSeason 3§r - §dExplorers Creativity 🔥";
+        motd = "§cCan't connect to server";
         log-ips = false; # TODO: figure out how to get ips from cloudflared tunnel
         hide-online-players = true; 
         

From bfb714119aa3055b9d2379db90d75a860aeef7fa Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 6 Jun 2026 22:48:45 +0700
Subject: [PATCH 268/427] set mc client mem

---
 modules/home/core/shell.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index 7c69e47..74bfd8f 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -67,7 +67,7 @@
         "fg-create-repo" = "git remote add origin ${git.server}/${git.username}/$(basename $PWDw).git && git push";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";
         
-        "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version)";
+        "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version) --jvm-arg=-Xmx6G";
         "mc" = "ferium upgrade; mcl";
       };
       initContent = ''

From acc6d5b85398120cd3c2edb399205286d6b36f4f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 11 Jun 2026 13:07:43 +0700
Subject: [PATCH 269/427] inc sim distance

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index dd53017..0bbb83d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -76,7 +76,7 @@ in {
         player-idle-timeout = 0;
         
         view-distance = 12;
-        simulation-distance = 4;
+        simulation-distance = 6;
         
         enable-rcon = true;
         sync-chunk-writes = false;

From 946109445df09278790298fff7b0c55a6b42d594 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 11 Jun 2026 16:40:14 +0700
Subject: [PATCH 270/427] add suda vim

---
 modules/home/core/cli.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index b88d171..d6a8ee9 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -78,6 +78,7 @@
         nvim-cmp
         indent-blankline-nvim
         markdown-preview-nvim
+        suda-vim
       ];
     };
     gh = {

From 70db3cc58e0a0a244d10e873c6344ecef5f13fa7 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 11 Jun 2026 18:45:52 +0700
Subject: [PATCH 271/427] use built in systray

---
 modules/home/desktop.nix         | 2 +-
 modules/home/rice/compositor.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index 9e34895..bad0b65 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -24,7 +24,7 @@
   home = {
     packages = with pkgs; [
       playerctl brightnessctl
-      networkmanagerapplet tailscale-systray
+      networkmanagerapplet
       qt6Packages.qt6ct kdePackages.qtstyleplugin-kvantum
       nwg-displays
       lxqt.pcmanfm-qt
diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 00f19e0..17c16c0 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -36,7 +36,7 @@
 
         "uwsm app -s b -- blueman-applet &"
         "uwsm app -s b -- nm-applet &"
-        "uwsm app -s b -- tailscale-systray &"
+        "uwsm app -s b -- tailscale systray &"
         #"keepassxc &"
       ];
 

From c573a72350001dff53ea5e625be0db3be8f40471 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 12 Jun 2026 19:12:19 +0700
Subject: [PATCH 272/427] packsquash binary

---
 modules/system/homelab/mc.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0bbb83d..13e3ada 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -9,7 +9,18 @@
     packHash = "sha256-xB9Oc/aneogSQ9r7L42vyVM6xwq+QkoTaXYNuUzeo6M=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
-  
+
+  packsquash-binary = pkgs.runCommand "packsquash" {
+    src = pkgs.fetchurl {
+      url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+      sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+    };
+    nativeBuildInputs = [ pkgs.unzip ];
+  } ''
+    mkdir -p $out/bin
+    unzip $src -d $out/bin
+    chmod +x $out/bin/packsquash
+  '';
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -86,7 +97,8 @@ in {
       
       symlinks = lib.mapAttrs'
         (name: _: lib.nameValuePair "mods/${name}" "${modpack}/mods/${name}")
-        (builtins.readDir "${modpack}/mods");
+        (builtins.readDir "${modpack}/mods")
+        // { "polymer/packsquash" = "${packsquash-binary}/bin/packsquash"; };
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;

From 0ed0ebb3856c6a8258ef098d71f5ced57c5d2f8e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 12 Jun 2026 19:44:11 +0700
Subject: [PATCH 273/427] fix typo

---
 modules/home/core/shell.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index 74bfd8f..a8d0e67 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -67,7 +67,7 @@
         "fg-create-repo" = "git remote add origin ${git.server}/${git.username}/$(basename $PWDw).git && git push";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";
         
-        "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version) --jvm-arg=-Xmx6G";
+        "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version) --jvm-args=-Xmx6G";
         "mc" = "ferium upgrade; mcl";
       };
       initContent = ''

From 3d9cd77735b902237e8e2d43411f485ec27e8f57 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 12 Jun 2026 20:25:22 +0700
Subject: [PATCH 274/427] update route

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 9cc0282..c2bfd16 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -54,7 +54,7 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
-      "mc0.${domain}"     = "tcp://localhost:25565";
+      "mc.${domain}"     = "tcp://localhost:25565";
       
       "docs-sandbox.${domain}" = "http://localhost:7090";
       "docs.${domain}"         = "http://localhost:7090";

From d2ec32a73e737e12cad5c07f344bdfad2555e6f9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 12 Jun 2026 20:47:01 +0700
Subject: [PATCH 275/427] dockge fix

---
 modules/system/homelab/containers.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/modules/system/homelab/containers.nix b/modules/system/homelab/containers.nix
index 2ca748c..44bec89 100644
--- a/modules/system/homelab/containers.nix
+++ b/modules/system/homelab/containers.nix
@@ -32,10 +32,8 @@ in {
       RestartSec = lib.mkOverride 500 "100ms";
       RestartSteps = lib.mkOverride 500 9;
     };
-    wantedBy = [
-      "multi-user.target"
-      "network.target"
-      "docker.service"
-    ];
+    after = [ "docker.service" "docker.socket" ];
+    requires = [ "docker.service" "docker.socket" ];
+    wantedBy = [ "multi-user.target" ];
   };
 }

From 2d8b290cb59866624e4ba769c3a11b750717441e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 13 Jun 2026 07:34:32 +0700
Subject: [PATCH 276/427] add prism launcher

---
 modules/home/core/apps.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 14d3701..b2c848b 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -60,6 +60,10 @@
       ];
     })
 
+    (prismlauncher.override {
+      jdks = [ javaPackages.compiler.temurin-bin.jdk-25 ];
+    })
+
     ferium
     packwiz
     portablemc

From 2fd983225d71895222ad802a573ae8210bf7ac68 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 13 Jun 2026 08:07:48 +0700
Subject: [PATCH 277/427] add more runtimes

---
 modules/home/core/apps.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index b2c848b..ea867c0 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -61,7 +61,7 @@
     })
 
     (prismlauncher.override {
-      jdks = [ javaPackages.compiler.temurin-bin.jdk-25 ];
+      jdks = with javaPackages.compiler.temurin-bin; [ jre-25 jre-21 ];
     })
 
     ferium

From df94792d9c5486e1a5dfa68383962aeda9381eca Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 13 Jun 2026 08:08:39 +0700
Subject: [PATCH 278/427] evaluation warning fix

---
 modules/home/core/cli.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index d6a8ee9..17a6dfa 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -78,7 +78,7 @@
         nvim-cmp
         indent-blankline-nvim
         markdown-preview-nvim
-        suda-vim
+        vim-suda
       ];
     };
     gh = {

From c80266e25d091e33967187844d2e396b6723d72d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 08:15:36 +0700
Subject: [PATCH 279/427] update modpack s3.1

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 13e3ada..c0fe22f 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,10 +3,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "8523f89493ace13087eb68cd9fe3b5eb4f669440";
+    commit = "6dc66117471b4f290e0d6776ac449d9f7f870c90";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-xB9Oc/aneogSQ9r7L42vyVM6xwq+QkoTaXYNuUzeo6M=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 

From 39cdbdc2393f673bf4badaa3c7f26c73b568fe9a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 08:35:49 +0700
Subject: [PATCH 280/427] add proxy prot conf and update hash

---
 modules/system/homelab/mc.nix | 52 ++++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index c0fe22f..a95f0cb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -6,21 +6,10 @@
     commit = "6dc66117471b4f290e0d6776ac449d9f7f870c90";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-J3KdjRer1d8jOeO84rET05nFdjCXjgz5A7mJysFwu6Q=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 
-  packsquash-binary = pkgs.runCommand "packsquash" {
-    src = pkgs.fetchurl {
-      url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
-      sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
-    };
-    nativeBuildInputs = [ pkgs.unzip ];
-  } ''
-    mkdir -p $out/bin
-    unzip $src -d $out/bin
-    chmod +x $out/bin/packsquash
-  '';
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -46,16 +35,6 @@ in {
       autoStart = true;
       restart = "always";
       enableReload = production;
-      # extraReload = ''
-      #   function rcon() {
-      #     ${pkgs.rcon-cli}/bin/rcon-cli -p ${rcon-pass} $@
-      #   }
-
-      #   rcon "gamerule locator_bar false"
-      #   rcon "gamerule mob_explosion_drop_decay false"
-      #   rcon "gamerule reduced_debug_info false"
-      #   rcon "gamerule global_sound_events false"
-      # '';
       
       operators = lib.mkIf (!production) {
         "satr14" = {
@@ -66,11 +45,10 @@ in {
       };
       
       serverProperties = {
-        # server-ip = "localhost";
         server-port = 25565;
         server-name = "Minecraft Server";
         motd = "§cCan't connect to server";
-        log-ips = false; # TODO: figure out how to get ips from cloudflared tunnel
+        log-ips = true;
         hide-online-players = true; 
         
         difficulty = "normal";
@@ -98,7 +76,31 @@ in {
       symlinks = lib.mapAttrs'
         (name: _: lib.nameValuePair "mods/${name}" "${modpack}/mods/${name}")
         (builtins.readDir "${modpack}/mods")
-        // { "polymer/packsquash" = "${packsquash-binary}/bin/packsquash"; };
+        // {
+          "polymer/packsquash" = let 
+            packsquash-binary = pkgs.runCommand "packsquash" {
+              src = pkgs.fetchurl {
+                url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+                sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+              };
+              nativeBuildInputs = [ pkgs.unzip ];
+            } ''
+              mkdir -p $out/bin
+              unzip $src -d $out/bin
+              chmod +x $out/bin/packsquash
+            '';
+          in "${packsquash-binary}/bin/packsquash";
+          "config/proxy_protocol_support.json" = {
+            enableProxyProtocol = true;
+            whitelistTCPShieldServers = false;
+            proxyServerIPs = [ "127.0.0.1" "::1" ];
+            directAccessIPs = [
+              "127.0.0.1" "::1" # localhost
+              "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
+              "192.168.1.0/24" "10.3.14.0/24" # lan
+            ];
+          };
+        };
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;

From 9025adc997f2af39754a750bf07e489f45f693e0 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 08:38:36 +0700
Subject: [PATCH 281/427] fix proxy prot conf

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index a95f0cb..70d4fd5 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -90,7 +90,7 @@ in {
               chmod +x $out/bin/packsquash
             '';
           in "${packsquash-binary}/bin/packsquash";
-          "config/proxy_protocol_support.json" = {
+          "config/proxy_protocol_support.json".value = {
             enableProxyProtocol = true;
             whitelistTCPShieldServers = false;
             proxyServerIPs = [ "127.0.0.1" "::1" ];

From 2624881507fbac1cbbf8b386a04b310ee6b0a401 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 08:47:22 +0700
Subject: [PATCH 282/427] fix read only error

---
 modules/system/homelab/mc.nix | 56 +++++++++++++++++------------------
 1 file changed, 27 insertions(+), 29 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 70d4fd5..8b02ac2 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -9,7 +9,7 @@
     packHash = "sha256-J3KdjRer1d8jOeO84rET05nFdjCXjgz5A7mJysFwu6Q=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
-
+  inherit (inputs.nix-minecraft.lib) collectFilesAt;
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -73,34 +73,32 @@ in {
         "rcon.port" = 25575;
       };
       
-      symlinks = lib.mapAttrs'
-        (name: _: lib.nameValuePair "mods/${name}" "${modpack}/mods/${name}")
-        (builtins.readDir "${modpack}/mods")
-        // {
-          "polymer/packsquash" = let 
-            packsquash-binary = pkgs.runCommand "packsquash" {
-              src = pkgs.fetchurl {
-                url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
-                sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
-              };
-              nativeBuildInputs = [ pkgs.unzip ];
-            } ''
-              mkdir -p $out/bin
-              unzip $src -d $out/bin
-              chmod +x $out/bin/packsquash
-            '';
-          in "${packsquash-binary}/bin/packsquash";
-          "config/proxy_protocol_support.json".value = {
-            enableProxyProtocol = true;
-            whitelistTCPShieldServers = false;
-            proxyServerIPs = [ "127.0.0.1" "::1" ];
-            directAccessIPs = [
-              "127.0.0.1" "::1" # localhost
-              "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
-              "192.168.1.0/24" "10.3.14.0/24" # lan
-            ];
-          };
-        };
+      symlinks = collectFilesAt modpack "mods" // {
+        "polymer/packsquash" = let 
+          packsquash-binary = pkgs.runCommand "packsquash" {
+            src = pkgs.fetchurl {
+              url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+              sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+            };
+            nativeBuildInputs = [ pkgs.unzip ];
+          } ''
+            mkdir -p $out/bin
+            unzip $src -d $out/bin
+            chmod +x $out/bin/packsquash
+          '';
+        in "${packsquash-binary}/bin/packsquash";
+      };
+
+      files."config/proxy_protocol_support.json".value = {
+        enableProxyProtocol = true;
+        whitelistTCPShieldServers = false;
+        proxyServerIPs = [ "127.0.0.1" "::1" ];
+        directAccessIPs = [
+          "127.0.0.1" "::1" # localhost
+          "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
+          "192.168.1.0/24" "10.3.14.0/24" # lan
+        ];
+      };
       
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;

From d99b01efd29870c2213eaa619fa2b85a398ec8a8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 08:50:45 +0700
Subject: [PATCH 283/427] fix import err

---
 modules/system/homelab/mc.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8b02ac2..29b45ba 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -9,7 +9,6 @@
     packHash = "sha256-J3KdjRer1d8jOeO84rET05nFdjCXjgz5A7mJysFwu6Q=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
-  inherit (inputs.nix-minecraft.lib) collectFilesAt;
 in {
   imports = [ inputs.mc.nixosModules.minecraft-servers ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
@@ -73,7 +72,7 @@ in {
         "rcon.port" = 25575;
       };
       
-      symlinks = collectFilesAt modpack "mods" // {
+      symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
         "polymer/packsquash" = let 
           packsquash-binary = pkgs.runCommand "packsquash" {
             src = pkgs.fetchurl {

From 426bb80002cb722f423074108886a104d83561ce Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 09:15:41 +0700
Subject: [PATCH 284/427] fix ip range

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 29b45ba..e8b8c53 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -93,7 +93,7 @@ in {
         whitelistTCPShieldServers = false;
         proxyServerIPs = [ "127.0.0.1" "::1" ];
         directAccessIPs = [
-          "127.0.0.1" "::1" # localhost
+          "127.0.0.0/8" "::1/128" # localhost
           "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
           "192.168.1.0/24" "10.3.14.0/24" # lan
         ];

From 4a70c0c122995aa383edae66339151aa818628ba Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 14 Jun 2026 10:09:49 +0700
Subject: [PATCH 285/427] add proxy ip

---
 modules/system/homelab/mc.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index e8b8c53..5342df8 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -91,7 +91,10 @@ in {
       files."config/proxy_protocol_support.json".value = {
         enableProxyProtocol = true;
         whitelistTCPShieldServers = false;
-        proxyServerIPs = [ "127.0.0.1" "::1" ];
+        proxyServerIPs = [
+          "127.0.0.1" "::1"
+          "127.185.172.53" # playit
+        ];
         directAccessIPs = [
           "127.0.0.0/8" "::1/128" # localhost
           "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale

From 56c74b2a7916182c54cfb8f97733dc83a5c5333b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 07:45:48 +0700
Subject: [PATCH 286/427] switch to jdk

---
 modules/home/core/apps.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index ea867c0..b8e09d6 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -61,7 +61,7 @@
     })
 
     (prismlauncher.override {
-      jdks = with javaPackages.compiler.temurin-bin; [ jre-25 jre-21 ];
+      jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
     })
 
     ferium

From 342ab4f76a6264d2c14673d86ebe4617ce17f7e3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 07:52:32 +0700
Subject: [PATCH 287/427] nvim transparent bg

---
 modules/home/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 00bbbb6..d3a590f 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -6,10 +6,11 @@
   
   catppuccin = {
     enable = true;
-    hyprlock.useDefaultConfig = false;
-    
     flavor = ctp-opt.flavor;
     accent = ctp-opt.accent;
+    
+    hyprlock.useDefaultConfig = false;
+    nvim.settings.transparent_background = true;
   };
 
   home = {

From daf77251f7657a8b57b4e3f23442f893f40f146f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 07:52:43 +0700
Subject: [PATCH 288/427] tmux clipboard

---
 modules/home/core/cli.nix | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 17a6dfa..1714f16 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -8,7 +8,14 @@
   home.packages = with pkgs; [ bun ];
 
   programs = {
-    tmux.enable = true;
+    tmux = {
+      enable = true;
+      extraConfig = ''
+        set -g set-clipboard on
+        set -ag terminal-overrides ",*:Ms=\\E[52;%p1%s;%p2%s\\007"
+        set -g allow-passthrough on
+      '';
+    };
     vim.enable = true;
     bat.enable = true;
     kitty = {
@@ -49,16 +56,11 @@
       initLua = ''
         vim.opt.clipboard = "unnamedplus"
         vim.opt.termguicolors = true
+        local osc52 = require("vim.ui.clipboard.osc52")
         vim.g.clipboard = {
           name = "OSC 52",
-          copy = {
-            ["+"] = require("vim.ui.clipboard.osc52").copy("+"),
-            ["*"] = require("vim.ui.clipboard.osc52").copy("*"),
-          },
-          paste = {
-            ["+"] = require("vim.ui.clipboard.osc52").paste("+"),
-            ["*"] = require("vim.ui.clipboard.osc52").paste("*"),
-          },
+          copy  = { ["+"] = osc52.copy("+"),  ["*"] = osc52.copy("*")  },
+          paste = { ["+"] = osc52.paste("+"), ["*"] = osc52.paste("*") },
         }
         require("nvim-tree").setup()
         vim.api.nvim_create_autocmd("VimEnter", {

From da1de4a9f5a76c1e956f2684c936d8a185de3fb0 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 07:52:52 +0700
Subject: [PATCH 289/427] blur tweaks

---
 modules/home/rice/compositor.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 17c16c0..dbf640e 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -87,9 +87,15 @@
 
         blur = {
           enabled = true;
-          size = 3;
-          passes = 1;
-          vibrancy = 0.1696;
+          size = 7;
+          passes = 3;
+          ignore_opacity = true;
+
+          noise = 0.05;
+          contrast = 1.5;
+
+          xray = false;
+          new_optimizations = true;
         };
       };
 

From 13b3ce6f3340ced154fb469158028bbd4c8bea54 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 07:57:55 +0700
Subject: [PATCH 290/427] [skip ci] flake update

---
 flake.lock | 41 +++++++++++++++++++----------------------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5ab99ba..4a9bf3d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1777734189,
-        "narHash": "sha256-kbIhdhDPaTP6gxAPkcRYeB+cqPFDpTM/bnw+m+26vkI=",
+        "lastModified": 1781255309,
+        "narHash": "sha256-n2P5xkAYGylrJ3feu7L6uaCUw/+jW8rk+HO127gDbFA=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "e68cf5deaf1a7afed2e548835dba2ae99f5a3ccb",
+        "rev": "036c78ea4cd8a42c8546c6316a944fd7d59d4341",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777977606,
-        "narHash": "sha256-8ceIdvijN2tm9fIAUgnIZ8BM8TlsFx7pRYKRoxNsi1k=",
+        "lastModified": 1781557312,
+        "narHash": "sha256-QOIRYSUFSq7L5mY3dZymaVhcnne3tPgoR9riB0WocjA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7ef1c04d11f7ef69fd946b118c768c32de0b89a5",
+        "rev": "c03e4752899e55705dfa63979abd885c582a5c48",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1777952170,
-        "narHash": "sha256-8dQ/DOUvQI8x5i6MZ309/xZLLVfV1CgWbD2+JiQ7Hd4=",
+        "lastModified": 1780375694,
+        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "34a46e4de360c5004ee1866f5e3de78bf5e8b289",
+        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
         "type": "github"
       },
       "original": {
@@ -114,18 +114,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
-        "type": "github"
+        "lastModified": 1781173989,
+        "narHash": "sha256-zqS1Hjp9o14nN/YhXu/uqm36ot058fF9wmd7/H/hRKc=",
+        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1015022.8c91a71d1345/nixexprs.tar.xz"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
     "nixpkgs_2": {
@@ -161,11 +158,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1777578337,
-        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
       "original": {

From afdf350a88181bd71a4cce27533e318260bee02b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 10:37:55 +0700
Subject: [PATCH 291/427] hyprland half fix

---
 modules/home/rice/compositor.nix | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index dbf640e..786afbc 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -6,18 +6,18 @@
   wayland.windowManager.hyprland = {
     enable = true;
     package = pkgs.hyprland; # inputs.hl.packages."${pkgs.system}".hyprland;
+    configType = "hyprlang"; # keep legacy config format (home.stateVersion < 26.05)
     systemd.enable = false;
     xwayland.enable = true;
     settings = {
+      dwindle.preserve_split = true;
+      
       debug = {
         error_position = 1;
         disable_logs = true;
+        vfr = true;
       };
 
-      # monitor = [
-      #   "eDP-1,preferred,auto,1"
-      #   ",preferred,auto,1"
-      # ];
       source = [
         "~/.config/hypr/monitors.conf"
         "~/.config/hypr/workspaces.conf"
@@ -28,16 +28,11 @@
         "wl-paste --type text --watch cliphist store"
         "wl-paste --type image --watch cliphist store"
 
-        #"dunst &"
-        #"hypridle &"
-        #"awww-daemon &"
         "uwsm app -s s -- waybar &"
         "uwsm app -s b -- sunshine &"
-
         "uwsm app -s b -- blueman-applet &"
         "uwsm app -s b -- nm-applet &"
         "uwsm app -s b -- tailscale systray &"
-        #"keepassxc &"
       ];
 
       env = [
@@ -66,11 +61,6 @@
         "col.inactive_border" = if rice.borders.colored then "$overlay2" else "$crust";
       };
 
-      dwindle = {
-        preserve_split = true;
-        pseudotile = true;
-      };
-
       decoration = {
         rounding = rice.borders.rounded;
         rounding_power = 2;
@@ -130,7 +120,6 @@
         exit_window_retains_fullscreen = true;
         on_focus_under_fullscreen = 1;
         background_color = "$base";
-        vfr = true;
       };
 
       input = {

From 81368080778012b9ee24580ac0b1b5a37e581790 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 10:38:11 +0700
Subject: [PATCH 292/427] catppuccin eval warning fix

---
 modules/home/default.nix      | 1 +
 modules/system/misc/theme.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index d3a590f..b6c5e9d 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -6,6 +6,7 @@
   
   catppuccin = {
     enable = true;
+    autoEnable = true;
     flavor = ctp-opt.flavor;
     accent = ctp-opt.accent;
     
diff --git a/modules/system/misc/theme.nix b/modules/system/misc/theme.nix
index e0754ff..2c588fd 100644
--- a/modules/system/misc/theme.nix
+++ b/modules/system/misc/theme.nix
@@ -7,6 +7,7 @@
 
   catppuccin = {
     enable = true;
+    autoEnable = true;
     flavor = ctp-opt.flavor;
     accent = ctp-opt.accent;
   };

From 36acd0c5b05893feb3e091c6618cd6548f1e87b2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 10:40:21 +0700
Subject: [PATCH 293/427] app debloat

---
 modules/home/core/apps.nix | 28 +++-------------------------
 modules/home/core/cli.nix  |  2 +-
 2 files changed, 4 insertions(+), 26 deletions(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index b8e09d6..bcb3363 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -27,47 +27,25 @@
   
   home.packages = with pkgs; [
     zed-editor
-    # kicad-small
-    # arduino-ide
 
     slack
     discord
-    # protonmail-desktop # https://www.reddit.com/r/NixOS/comments/1rm9alf/protonmail_in_nixos/
+    protonmail-desktop
     
     vlc
     brave
     flameshot
     libreoffice
     appimage-run
-    # keepassxc
 
     virt-manager
-    # winboat
-    
     remmina
     moonlight-qt
-    # rustdesk
-    
-    
-    # inkscape
-    # davinci-resolve
-    # kdePackages.kdenlive
-    (wrapOBS {
-      plugins = with obs-studio-plugins; [
-        wlrobs
-        obs-backgroundremoval
-        obs-pipewire-audio-capture
-      ];
-    })
+    gpu-screen-recorder
+    gpu-screen-recorder-gtk
 
     (prismlauncher.override {
       jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
     })
-
-    ferium
-    packwiz
-    portablemc
-    steamguard-cli
-    # modrinth-app
   ];
 }
diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 1714f16..c1ed15f 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -5,7 +5,7 @@
     TERMINAL = "kitty";
   };
 
-  home.packages = with pkgs; [ bun ];
+  home.packages = with pkgs; [ bun packwiz ];
 
   programs = {
     tmux = {

From 781e364ec637852563a276481f27e0608e0864f8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 22:28:45 +0700
Subject: [PATCH 294/427] browser config

---
 modules/home/core/browser.nix | 25 +++++++++++++++++++++++++
 modules/home/desktop.nix      |  1 +
 2 files changed, 26 insertions(+)
 create mode 100644 modules/home/core/browser.nix

diff --git a/modules/home/core/browser.nix b/modules/home/core/browser.nix
new file mode 100644
index 0000000..6cf4809
--- /dev/null
+++ b/modules/home/core/browser.nix
@@ -0,0 +1,25 @@
+{ pkgs, ... }: {
+  programs.chromium = {
+    enable = true;
+    package = pkgs.brave;
+    extensions = map (id: { inherit id; }) [
+      "nngceckbapebfimnlniiiahkandclblb" # bitwarden 
+      "kokhpbhfeokchmbimdlaldcmlinjpipm" # 2fauth
+      "gppongmhjkpfnbhagpmjfkannfbllamg" # wappalyzer
+      
+      "cejckpjfigehbeecbbfhangbknpidcnh" # timezone changer 
+      "dmghijelimhndkbmpgbldicpogfkceaj" # dark mode 
+      "cebifddlogbjhoibpjobhlamopmlpckl" # disable page visibility
+      "efknglbfhoddmmfabeihlemgekhhnabb" # json viewer
+      "bhchdcejhohfmigjafbampogmaanbfkg" # user agent switcher
+      
+      "ocabkmapohekeifbkoelpmppmfbcibna" # xoom redirector
+      "fkagelmloambgokoeokbpihmgpkbgbfm" # indie wiki buddy
+      "bggfcpfjbdkhfhfmkjpbhnkhnpjjeomc" # github material icons
+      "hfckonpdalooejghjpbpimhcgighijck" # chess move confirm
+      "babnnfmbjokkeieobamoifmeapbbfhje" # medium unlock
+      "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsor block
+      "ekcgkejcjdcmonfpmnljobemcbpnkamh" # whatsapp web plus
+    ];
+  };
+}
\ No newline at end of file
diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index bad0b65..1a151d3 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -14,6 +14,7 @@
     ./misc/phone.nix
     ./core/apps.nix
     ./core/code.nix
+    ./core/browser.nix
   ];
 
   services = {

From 8b1c10335ad72d197c51b0000fcac4ea64cf6bab Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 16 Jun 2026 22:29:48 +0700
Subject: [PATCH 295/427] temp fix cuz too lazy to migrate to lua

---
 modules/home/rice/compositor.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 786afbc..7133dc9 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -3,6 +3,8 @@
     ./keybinds.nix
   ];
 
+  catppuccin.hyprland.enable = false; # temp fix until i get things migrated to lua
+  
   wayland.windowManager.hyprland = {
     enable = true;
     package = pkgs.hyprland; # inputs.hl.packages."${pkgs.system}".hyprland;
@@ -57,8 +59,8 @@
         allow_tearing = false;
         layout = "dwindle";
 
-        "col.active_border" = if rice.borders.colored then "$accent" else "$overlay0";
-        "col.inactive_border" = if rice.borders.colored then "$overlay2" else "$crust";
+        "col.active_border" = if rice.borders.colored then "$accent" else "rgb(108,112,134)"; # accent overlay0
+        "col.inactive_border" = if rice.borders.colored then "rgb(147,153,178)" else "rgb(17,17,27)"; # overlay2 crust
       };
 
       decoration = {
@@ -71,8 +73,8 @@
           enabled = true;
           range = 6;
           render_power = 3;
-          color_inactive = "rgba($crustAlpha99)";
-          color = "rgba($crustAlphaee)";
+          color_inactive = "rgba(17,17,27,99)"; # crust alpha 99
+          color = "rgba(17,17,27,238)"; # crust alpha ee
         };
 
         blur = {
@@ -119,7 +121,7 @@
         middle_click_paste = false;
         exit_window_retains_fullscreen = true;
         on_focus_under_fullscreen = 1;
-        background_color = "$base";
+        background_color = "rgb(17, 17, 27)"; # crust
       };
 
       input = {

From 2e11be00c4daae472c79aa7bbe2517d44c11b9c8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 18:42:41 +0700
Subject: [PATCH 296/427] remove unnecesarry things

---
 modules/system/homelab/dash.nix | 62 ---------------------------------
 1 file changed, 62 deletions(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index e7d62bf..c6c14bb 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -1,18 +1,4 @@
 { timezone, homelab, ... }: let 
-  rss = [
-    "https://www.raspberrypi.com/news/feed/"
-    "https://www.jeffgeerling.com/blog.xml"
-    "https://www.howtogeek.com/feed/"
-    "https://hackaday.com/feed/rss"
-    "https://www.xda-developers.com/feed/"
-    "https://9to5mac.com/feed/"
-    "https://9to5google.com/feed/"
-    "https://www.cnx-software.com/feed/"
-    "https://selfh.st/rss/"
-    "https://www.joshwcomeau.com/rss.xml"
-    "https://samwho.dev/rss.xml"
-    "https://ishadeed.com/feed.xml"
-  ];
   yt = [
     "UCXuqSBlHAE6Xw-yeJA0Tunw" # LinusTechTips
     "UCsBjURrPoezykLs9EqgamOA" # Fireship
@@ -34,24 +20,6 @@
     "UCGKEMK3s-ZPbjVOIuAV8clQ" # CoreDumped
     "UCWQaM7SpSECp9FELz-cHzuQ" # DreamsOfCode
   ];
-  gh = [
-    "tailscale/tailscale"
-    "glanceapp/glance"
-    "nixos/nixpkgs"
-    "ollama/ollama"
-    "nginx/nginx"
-    "oven-sh/bun"
-  ];
-  search = [
-    [ "Website" "!!" "https://{QUERY}" ]
-    [ "CVE" "!cve" "https://securityvulnerability.io/vulnerability/CVE-{QUERY}" ]
-    [ "YouTube" "!yt" "https://www.youtube.com/results?search_query={QUERY}" ]
-    [ "GitHub" "!gh" "https://github.com/search?q={QUERY}" ]
-    [ "Nix Packages" "!nix" "https://search.nixos.org/packages?channel=unstable&type=packages&query={QUERY}" ]
-    [ "Nix Options" "!opt" "https://mynixos.com/search?q={QUERY}" ]
-    [ "Flight Radar 24" "!f" "https://www.flightradar24.com/data/flights/{QUERY}" ]
-    [ "Google Web Results Only" "!s" "https://google.com/search?udm=14&q={QUERY}" ]
-  ];
   monitor = [
     [ "DNS" "http://localhost:8088/" ]
     [ "Proxy" "https://proxy.${homelab.domain}/" ]
@@ -202,30 +170,11 @@ in {
                   hide-header = true;
                   first-day-of-week = "monday";
                 }
-                {
-                  type = "rss";
-                  hide-header = true;
-                  title = "rss";
-                  limit = 12;
-                  cache = "12h";
-                  feeds = map (e: { url = e; }) rss;
-                }
               ];
             }
             {
               size = "full";
               widgets = [
-                {
-                  type = "search";
-                  hide-header = true;
-                  autofocus = true;
-                  search-engine = "google";
-                  bangs = map (e: {
-                    title = builtins.elemAt e 0;
-                    shortcut = builtins.elemAt e 1;
-                    url = builtins.elemAt e 2;
-                  }) search;
-                }
                 {
                   type = "hacker-news";
                   hide-header = true;
@@ -251,11 +200,6 @@ in {
                   units = "metric";
                   hour-format = "12h";
                 }
-                {
-                  type = "to-do";
-                  id = "tasks";
-                  hide-header = true;
-                }
                 {
                   type = "repository";
                   repository = "is-a-dev/register";
@@ -272,12 +216,6 @@ in {
                   commits-limit = 0;
                   hide-header = true;
                 }
-                {
-                  type = "releases";
-                  cache = "1d";
-                  hide-header = true;
-                  repositories = gh;
-                }
               ];
             }
           ];

From b4edc1439e07f18623a9c3f01b84b6c74cf8f86f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 18:54:36 +0700
Subject: [PATCH 297/427] ntfy notif

---
 .forgejo/workflows/activate.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 869f0f4..05eee76 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -27,14 +27,15 @@ jobs:
             root@localhost \
             "bash -lc 'nixos-rebuild switch --refresh --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
 
-      - name: Show generation
-        if: always()
+      - name: Notify on failure
+        if: failure()
         run: |
-          ssh -i ./ssh/deploy_key \
-            -o PasswordAuthentication=no \
-            -o StrictHostKeyChecking=no \
-            -o UserKnownHostsFile=/dev/null \
-            root@localhost "bash -lc 'nixos-version'"
+          curl -s -X POST https://notify.proxy.satr14.my.id/git-flake-updates \
+            -H "Title: NixOS Homelab Rebuild Failed" \
+            -H "Priority: high" \
+            -H "Tags: x" \
+            -H "Actions: view, View Logs, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}; view, View Commit, ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}" \
+            -d "${{ github.event.head_commit.message }}"
 
       - name: Clean Up
         if: always()

From 5bb61fc69dfbf5eb5ea24e9ae0f644a3c3e00b52 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 18:55:32 +0700
Subject: [PATCH 298/427] syntax error test

---
 modules/system/homelab/dash.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index c6c14bb..d8972a0 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -1,4 +1,4 @@
-{ timezone, homelab, ... }: let 
+{ timezone, homelab, ... }:$ let 
   yt = [
     "UCXuqSBlHAE6Xw-yeJA0Tunw" # LinusTechTips
     "UCsBjURrPoezykLs9EqgamOA" # Fireship

From 1fab087ccbf034692bbedb7f6a33223b779db68a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 18:56:51 +0700
Subject: [PATCH 299/427] fix url

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 05eee76..a3b99d4 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -34,7 +34,7 @@ jobs:
             -H "Title: NixOS Homelab Rebuild Failed" \
             -H "Priority: high" \
             -H "Tags: x" \
-            -H "Actions: view, View Logs, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}; view, View Commit, ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}" \
+            -H "Actions: view, View Logs, https://git.satr14.my.id/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             -d "${{ github.event.head_commit.message }}"
 
       - name: Clean Up

From e1d8f209bcb3bf910ea2a8f2f72eba034cb97144 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 19:00:27 +0700
Subject: [PATCH 300/427] fix buttons

---
 .forgejo/workflows/activate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index a3b99d4..456285f 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -34,7 +34,7 @@ jobs:
             -H "Title: NixOS Homelab Rebuild Failed" \
             -H "Priority: high" \
             -H "Tags: x" \
-            -H "Actions: view, View Logs, https://git.satr14.my.id/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            -H "Actions: view, Action Runs, https://git.satr14.my.id/${{ github.repository }}/actions?workflow=activate.yml; view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
             -d "${{ github.event.head_commit.message }}"
 
       - name: Clean Up

From 4bb9be86c413bdfcb4bb0d27b2113e7995c3d471 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 17 Jun 2026 19:02:05 +0700
Subject: [PATCH 301/427] syntax fix and success notif

---
 .forgejo/workflows/activate.yml | 9 +++++++++
 modules/system/homelab/dash.nix | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 456285f..f338572 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -37,6 +37,15 @@ jobs:
             -H "Actions: view, Action Runs, https://git.satr14.my.id/${{ github.repository }}/actions?workflow=activate.yml; view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
             -d "${{ github.event.head_commit.message }}"
 
+      - name: Notify on success
+        if: success()
+        run: |
+          curl -s -X POST https://notify.proxy.satr14.my.id/git-flake-updates \
+            -H "Title: NixOS Homelab Rebuild Succeeded" \
+            -H "Tags: white_check_mark" \
+            -H "Actions: view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
+            -d "${{ github.event.head_commit.message }}"
+
       - name: Clean Up
         if: always()
         run: rm -f ./ssh/deploy_key
\ No newline at end of file
diff --git a/modules/system/homelab/dash.nix b/modules/system/homelab/dash.nix
index d8972a0..c6c14bb 100644
--- a/modules/system/homelab/dash.nix
+++ b/modules/system/homelab/dash.nix
@@ -1,4 +1,4 @@
-{ timezone, homelab, ... }:$ let 
+{ timezone, homelab, ... }: let 
   yt = [
     "UCXuqSBlHAE6Xw-yeJA0Tunw" # LinusTechTips
     "UCsBjURrPoezykLs9EqgamOA" # Fireship

From 0dd0277755e0aacebd786d37b06c6bccecabb4d2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 20 Jun 2026 15:05:20 +0700
Subject: [PATCH 302/427] add extension

---
 modules/home/core/browser.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/browser.nix b/modules/home/core/browser.nix
index 6cf4809..b4a0f82 100644
--- a/modules/home/core/browser.nix
+++ b/modules/home/core/browser.nix
@@ -12,6 +12,7 @@
       "cebifddlogbjhoibpjobhlamopmlpckl" # disable page visibility
       "efknglbfhoddmmfabeihlemgekhhnabb" # json viewer
       "bhchdcejhohfmigjafbampogmaanbfkg" # user agent switcher
+      "bbppejejjfancffmhncgkhjdaikdgagc" # undisposition
       
       "ocabkmapohekeifbkoelpmppmfbcibna" # xoom redirector
       "fkagelmloambgokoeokbpihmgpkbgbfm" # indie wiki buddy

From bb99c22324842a81a169416cd30a3e7690499085 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 20 Jun 2026 15:05:41 +0700
Subject: [PATCH 303/427] remove non effective flags

---
 modules/system/homelab/mc.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 5342df8..f320d31 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -121,8 +121,6 @@ in {
         "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
         "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom
-        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
-        "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
       ]; in lib.concatStringsSep " " flags;
     };
   };

From ee1ef1350330b33d9d9b94993eb6c7c6d35239a6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 13:44:36 +0700
Subject: [PATCH 304/427] new mc server

---
 modules/system/homelab/mc.nix | 46 +++++++++++++++++++++++------------
 1 file changed, 31 insertions(+), 15 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index f320d31..8928efd 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -3,10 +3,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "6dc66117471b4f290e0d6776ac449d9f7f870c90";
+    commit = "3956a42f139b93b049ff5004bba62cf29c9d3b99";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-J3KdjRer1d8jOeO84rET05nFdjCXjgz5A7mJysFwu6Q=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {
@@ -29,7 +29,7 @@ in {
     # gamerules to disable: locator_bar, mob_explosion_drop_decay, (and possibly) reduced_debug_info, global_sound_events 
     # gamerules to enable (temporarily): noend:disable_end
    
-    servers.da-s3 = {
+    servers.mc0-vanilla-plus = {
       enable = true;
       autoStart = true;
       restart = "always";
@@ -88,20 +88,36 @@ in {
         in "${packsquash-binary}/bin/packsquash";
       };
 
-      files."config/proxy_protocol_support.json".value = {
-        enableProxyProtocol = true;
-        whitelistTCPShieldServers = false;
-        proxyServerIPs = [
-          "127.0.0.1" "::1"
-          "127.185.172.53" # playit
-        ];
-        directAccessIPs = [
-          "127.0.0.0/8" "::1/128" # localhost
-          "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
-          "192.168.1.0/24" "10.3.14.0/24" # lan
-        ];
+      files = inputs.mc.lib.collectFilesAt modpack "config" // {
+        "config/proxy_protocol_support.json".value = {
+          enableProxyProtocol = false; # polymer auto host has issues with proxy protocol
+          whitelistTCPShieldServers = false;
+          proxyServerIPs = [
+            "127.0.0.1" "::1"
+            "127.185.172.53" # playit
+          ];
+          directAccessIPs = [
+            "127.0.0.0/8" "::1/128" # localhost
+            "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
+            "192.168.1.0/24" "10.3.14.0/24" # lan
+          ];
+        };
       };
       
+      extraStartPre = let sed-commands = lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (placeholder: file: 
+          ''sed -i "s|${placeholder}|''${${placeholder}}|g" ${file}''
+        ) {
+          "REPLACE_SVC_HOST"      = "config/voicechat/voicechat-server.properties";
+          "REPLACE_RP_LINK"       = "config/welcomemessage.json5";
+          "REPLACE_DC_BOT_TOKEN"  = "config/simple-discord-link/simple-discord-link.toml";
+          "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
+        }
+      ); in ''
+        source modpack-config.env
+        ${sed-commands}
+      '';
+      
       package = pkgs.fabricServers.fabric-1_21_11.override {
         jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
         loaderVersion = "0.19.2";

From e91ad01c947169fc3712c98b2be69009087368cd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 13:49:36 +0700
Subject: [PATCH 305/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8928efd..a893a0d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -6,7 +6,7 @@
     commit = "3956a42f139b93b049ff5004bba62cf29c9d3b99";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-g3PNwhFJkF8pSAx8sp2TLE3RH2vjgDuFElSS/ok8EfI=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 958adf4037d078fcb75be305b75bec2b09838d54 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 13:56:37 +0700
Subject: [PATCH 306/427] shellcheck fix

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index a893a0d..86acd00 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -114,6 +114,7 @@ in {
           "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
         }
       ); in ''
+        # shellcheck disable=SC1091
         source modpack-config.env
         ${sed-commands}
       '';

From e78eb16fe622fce6f56efc8a9dc058d19e04640b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 14:03:57 +0700
Subject: [PATCH 307/427] relative line numbers

---
 modules/home/core/cli.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index c1ed15f..9e9b94e 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -65,7 +65,7 @@
         require("nvim-tree").setup()
         vim.api.nvim_create_autocmd("VimEnter", {
           callback = function()
-            vim.cmd("set nu")
+            vim.cmd("set nu rnu")
             vim.cmd.wincmd 'p'
           end,
         })

From acaafb21243a111e4f723a4450cbace03dfa7c8b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 14:07:28 +0700
Subject: [PATCH 308/427] fix libstdc++ not found

---
 modules/system/homelab/mc.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 86acd00..d73c44a 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -1,4 +1,5 @@
 { inputs, lib, pkgs, ... }: let
+  name = "mc0-vanilla-plus";
   production = true;
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
@@ -18,6 +19,10 @@ in {
     "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
     "vm.swappiness" = 10;
   };
+
+  systemd.services."minecraft-server-${name}".environment = {
+    LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
+  };
   
   services.minecraft-servers = {
     enable = true;
@@ -29,7 +34,7 @@ in {
     # gamerules to disable: locator_bar, mob_explosion_drop_decay, (and possibly) reduced_debug_info, global_sound_events 
     # gamerules to enable (temporarily): noend:disable_end
    
-    servers.mc0-vanilla-plus = {
+    servers.${name} = {
       enable = true;
       autoStart = true;
       restart = "always";
@@ -45,7 +50,7 @@ in {
       
       serverProperties = {
         server-port = 25565;
-        server-name = "Minecraft Server";
+        server-name = name;
         motd = "§cCan't connect to server";
         log-ips = true;
         hide-online-players = true; 

From 9b69189570e6718ac3a84db8ee40fba3d40e2281 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 14:10:34 +0700
Subject: [PATCH 309/427] remove mc cf

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index c2bfd16..15876ec 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -54,7 +54,7 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
-      "mc.${domain}"     = "tcp://localhost:25565";
+      # "mc.${domain}"     = "tcp://localhost:25565";
       
       "docs-sandbox.${domain}" = "http://localhost:7090";
       "docs.${domain}"         = "http://localhost:7090";

From 28737db2cf0f61f28c46cfe0f44b41c75536fe93 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 21 Jun 2026 14:20:22 +0700
Subject: [PATCH 310/427] [skip ci] add comment note

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d73c44a..c95cd55 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -22,7 +22,7 @@ in {
 
   systemd.services."minecraft-server-${name}".environment = {
     LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
-  };
+  }; # ^^^ physics mod fix
   
   services.minecraft-servers = {
     enable = true;

From 11b2c7315a5a8fbd9fa3be5976f18faf043629e9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 22 Jun 2026 14:44:04 +0700
Subject: [PATCH 311/427] update modpack and remove success notif

---
 .forgejo/workflows/activate.yml | 16 ++++++++--------
 modules/system/homelab/mc.nix   |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index f338572..329cd4f 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -37,14 +37,14 @@ jobs:
             -H "Actions: view, Action Runs, https://git.satr14.my.id/${{ github.repository }}/actions?workflow=activate.yml; view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
             -d "${{ github.event.head_commit.message }}"
 
-      - name: Notify on success
-        if: success()
-        run: |
-          curl -s -X POST https://notify.proxy.satr14.my.id/git-flake-updates \
-            -H "Title: NixOS Homelab Rebuild Succeeded" \
-            -H "Tags: white_check_mark" \
-            -H "Actions: view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
-            -d "${{ github.event.head_commit.message }}"
+      # - name: Notify on success
+      #   if: success()
+      #   run: |
+      #     curl -s -X POST https://notify.proxy.satr14.my.id/git-flake-updates \
+      #       -H "Title: NixOS Homelab Rebuild Succeeded" \
+      #       -H "Tags: white_check_mark" \
+      #       -H "Actions: view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
+      #       -d "${{ github.event.head_commit.message }}"
 
       - name: Clean Up
         if: always()
diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index c95cd55..2555b67 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "3956a42f139b93b049ff5004bba62cf29c9d3b99";
+    commit = "e47a428b61fc087f4c733258e5a282c21b32d9c3";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-g3PNwhFJkF8pSAx8sp2TLE3RH2vjgDuFElSS/ok8EfI=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From f191ba452187581bfa8c157d8a32090a3bbb81a2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 23 Jun 2026 06:44:34 +0700
Subject: [PATCH 312/427] update hash and add back args

---
 modules/system/homelab/mc.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2555b67..941e939 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "e47a428b61fc087f4c733258e5a282c21b32d9c3";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-/gQw/FeNv/jbschhFzujloO9jaqTmfvBbzouWUJGr6w=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {
@@ -143,6 +143,8 @@ in {
         "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
         "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom
+        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
+        "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
       ]; in lib.concatStringsSep " " flags;
     };
   };

From 91b40f534453dff8b11243f3ac458dea7bc8490f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 23 Jun 2026 08:22:45 +0700
Subject: [PATCH 313/427] add opencode

---
 modules/home/core/apps.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index bcb3363..214a70c 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -27,6 +27,7 @@
   
   home.packages = with pkgs; [
     zed-editor
+    opencode
 
     slack
     discord

From 1a059b929bc510837d7c7d8c6567e91a1d3789e2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 23 Jun 2026 08:25:22 +0700
Subject: [PATCH 314/427] add spell check

---
 modules/home/core/code.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/home/core/code.nix b/modules/home/core/code.nix
index 21268ff..fa074e5 100644
--- a/modules/home/core/code.nix
+++ b/modules/home/core/code.nix
@@ -3,12 +3,12 @@
     enable = true;
     package = pkgs.zed-editor;
     extensions = [
-      "html" "html-snippets"
-      "svelte" "svelte-snippets"
       "wakatime" "discord-presence"
       "catppuccin" "catppuccin-icons"
-      "git-firefly"
-      "nix"
+      "codebook"
+      "git-firefly" "nix"
+      "html" "html-snippets"
+      "svelte" "svelte-snippets"
     ];
     userSettings = {
       diff_view_style =  "unified";

From 8187e32d5dab9070c46ad3e6a3d9750818140b73 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 09:41:37 +0700
Subject: [PATCH 315/427] reenable tunnel

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 15876ec..c2bfd16 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -54,7 +54,7 @@ in {
       [ "Dockge" "docker" "https://containers.proxy.${domain}" "http://localhost:5001/" ]
     ];
     routes = {
-      # "mc.${domain}"     = "tcp://localhost:25565";
+      "mc.${domain}"     = "tcp://localhost:25565";
       
       "docs-sandbox.${domain}" = "http://localhost:7090";
       "docs.${domain}"         = "http://localhost:7090";

From 2fa86ba6b2114973ab101afb1563f09ecdd34af2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 11:33:49 +0700
Subject: [PATCH 316/427] update modpack and perf tweaks

---
 modules/system/homelab/mc.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 941e939..10f2e34 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "e47a428b61fc087f4c733258e5a282c21b32d9c3";
+    commit = "583df6751eb0b88830fa7e4a424587aedc241653";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-/gQw/FeNv/jbschhFzujloO9jaqTmfvBbzouWUJGr6w=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {
@@ -20,9 +20,10 @@ in {
     "vm.swappiness" = 10;
   };
 
-  systemd.services."minecraft-server-${name}".environment = {
-    LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
-  }; # ^^^ physics mod fix
+  systemd.services."minecraft-server-${name}" = {
+    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
+    serviceConfig.Nice = -5; # higher scheduling priority
+  };
   
   services.minecraft-servers = {
     enable = true;
@@ -141,10 +142,10 @@ in {
         "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
         "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
         "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
-        "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
         "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom
-        "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
-        "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
+        # "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
+        # "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
+        # "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
       ]; in lib.concatStringsSep " " flags;
     };
   };

From 9b4016b2f714ffc4a55d64a1b7f77c47de9c8d3c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 11:42:41 +0700
Subject: [PATCH 317/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 10f2e34..61a7d38 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "583df6751eb0b88830fa7e4a424587aedc241653";
+    commit = "de8b0138c870fda24f1dbe1a8ebbe3c1a55734d4";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
     packHash = "";

From ea57dcb9f6fb32fe2e1d04064c64cdf2663ce36d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 11:50:03 +0700
Subject: [PATCH 318/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 61a7d38..4ae7a3b 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "de8b0138c870fda24f1dbe1a8ebbe3c1a55734d4";
+    commit = "9b9111cd1f0508c268b7972ee6226e882a3e6595";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
     packHash = "";

From de0179e95a21aa6ef74fa62915c0658173401971 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 11:52:22 +0700
Subject: [PATCH 319/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4ae7a3b..8b26988 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "9b9111cd1f0508c268b7972ee6226e882a3e6595";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-QzetffsXC9kqv8RQrckYbbBkl4csEuzYKxR9YnfxgHk=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 4322fa53107be5f7e4c11c00f80fde522e2b07de Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 12:02:00 +0700
Subject: [PATCH 320/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8b26988..2e7b74b 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "9b9111cd1f0508c268b7972ee6226e882a3e6595";
+    commit = "25d32f01168e787a8a7c9136d5a026fccd5d9925";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-QzetffsXC9kqv8RQrckYbbBkl4csEuzYKxR9YnfxgHk=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From edcbd1dbc7eef9603586e46765ddf34b3c1649f6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 12:03:55 +0700
Subject: [PATCH 321/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 2e7b74b..9652a38 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "25d32f01168e787a8a7c9136d5a026fccd5d9925";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-roe5MxbmEKoly3rJkm7ICYeHSNy77r0Cxs+TXPvTbv8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From e543796e79b86a6fc9a8c19cee19ccdf3d3d4245 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 24 Jun 2026 12:53:58 +0700
Subject: [PATCH 322/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9652a38..f5ccdb3 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "25d32f01168e787a8a7c9136d5a026fccd5d9925";
+    commit = "36be7619e1c5fb0ee312c6ccb5913aef8c83e3d7";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-roe5MxbmEKoly3rJkm7ICYeHSNy77r0Cxs+TXPvTbv8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From ede3381d6619cb47c93793259a09e9c247e96058 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 07:54:39 +0700
Subject: [PATCH 323/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index f5ccdb3..482759c 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "36be7619e1c5fb0ee312c6ccb5913aef8c83e3d7";
+    commit = "bd5c266b2aaaf293aa4b0b0fbefd363fe1ef4a36";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
     packHash = "";

From 527d34a533b3c1b93ae57bf4b05e6c7a29e3ce7d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 08:00:13 +0700
Subject: [PATCH 324/427] [skip ci] fix ssh key leaked and roll

---
 .forgejo/workflows/activate.yml | 3 ++-
 lib/options.nix                 | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index 329cd4f..fab8702 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -7,6 +7,7 @@ on:
 
 env:
   PATH: /run/current-system/sw/bin:/run/wrappers/bin
+  SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
 
 jobs:
   rebuild:
@@ -15,7 +16,7 @@ jobs:
       - name: Setup SSH key
         run: |
           mkdir -p ./ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ./ssh/deploy_key
+          echo "$SSH_KEY" > ./ssh/deploy_key
           chmod 600 ./ssh/deploy_key
           
       - name: Rebuild and switch
diff --git a/lib/options.nix b/lib/options.nix
index c2bfd16..cef1177 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -25,7 +25,7 @@ in {
     domain = "satr14.my.id"; # root domain for dns, ssl certs, reverse proxy, etc.
     ssh-keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESvQFXoUBafatqnxTd6qk3WEOcfwb3AIWVTstR3lHzX forgejo"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtdH1YqRH9xhuHMivezLvj/hpH77yfH3HUCaRboB/hb forgejo-deploy-runner"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7nkis5iB9qJ0OLi8YO4MX1F/ISmBng/xYdNcupGAJC forgejo-actions"
     ];
     disks = {
       # gallery = ext4 "/dev/disk/by-uuid/834f51c1-90ee-4601-ba76-ef0419198d67"; # disk for photo gallery 

From 2728a6e83d41ff3ae2ad3c7741f81e23bbd3fe7e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 08:02:45 +0700
Subject: [PATCH 325/427] [skip ci] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 482759c..429be36 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "bd5c266b2aaaf293aa4b0b0fbefd363fe1ef4a36";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-JqO8oSWCGvSKcB91sb64889q3zinjUH0jrSfpKPfvt8=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From b855713365298488f9780fc932e5c9e4becafe32 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 08:13:44 +0700
Subject: [PATCH 326/427] test actions


From 0796dec27461b97146fc59756259275d9d2a95bd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 18:49:38 +0700
Subject: [PATCH 327/427] generational zgc

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 429be36..35a136e 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -135,6 +135,7 @@ in {
         "-Xmx${toString ram-allocation-mb}M"
         
         "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+        "-XX:+ZGenerational" # Use generational ZGC
         "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
         
         "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods)

From f2030a5e2fbd9b6dc340346549e2aae89368728b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 26 Jun 2026 18:54:05 +0700
Subject: [PATCH 328/427] [skip ci] add comments

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 35a136e..4074dea 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -135,10 +135,10 @@ in {
         "-Xmx${toString ram-allocation-mb}M"
         
         "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
-        "-XX:+ZGenerational" # Use generational ZGC
+        "-XX:+ZGenerational" # Use generational ZGC (newer and better ZGC, requires Java v21+)
         "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
         
-        "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods)
+        "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods like C2ME)
         "-XX:+UseLargePages" # Large pages support (requires hugepages configured on the system)
         "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
         "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC

From e236078e9e5e73eef85030bda6d7676d9d999dca Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 27 Jun 2026 19:36:50 +0700
Subject: [PATCH 329/427] update modpack

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4074dea..d8f6ca4 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,7 +4,7 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "bd5c266b2aaaf293aa4b0b0fbefd363fe1ef4a36";
+    commit = "1271207650d091b510b92044a28de486c1176a35";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
     packHash = "sha256-JqO8oSWCGvSKcB91sb64889q3zinjUH0jrSfpKPfvt8=";

From a2c055b182f2d38bc1f195821124aa94e0603a9c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 27 Jun 2026 20:08:40 +0700
Subject: [PATCH 330/427] remove hash to trigger rebuild

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d8f6ca4..fbc37eb 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "1271207650d091b510b92044a28de486c1176a35";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-JqO8oSWCGvSKcB91sb64889q3zinjUH0jrSfpKPfvt8=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From bd9c290f7d4c4cb334e459d93acc7ce5065ce95d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 27 Jun 2026 20:15:38 +0700
Subject: [PATCH 331/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index fbc37eb..af57404 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "1271207650d091b510b92044a28de486c1176a35";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-yEVxsTyu9g3sDFnQM2KC2bU98ojJPUzJT3GiOEoAXbM=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 8084af3e68fe2848c9aee82f5213aa14b6f077dd Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 28 Jun 2026 14:23:30 +0700
Subject: [PATCH 332/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index af57404..4afb315 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "1271207650d091b510b92044a28de486c1176a35";
+    commit = "a22477190ee93aed8d1c33687f1824550f0712cf";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-yEVxsTyu9g3sDFnQM2KC2bU98ojJPUzJT3GiOEoAXbM=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 544140b778504e59cbc7a613a19d96a9b7481cdf Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 28 Jun 2026 14:39:55 +0700
Subject: [PATCH 333/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 4afb315..9ec4c66 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "a22477190ee93aed8d1c33687f1824550f0712cf";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-9bPnK3xohEcwrFc5LoXemIzQwQullJmuoJ8zjEoIV/U=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 7c0166bd4228b57b2341b2de287cad9bb30e4ee1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 29 Jun 2026 09:15:29 +0700
Subject: [PATCH 334/427] lazymc config

---
 modules/system/homelab/mc.nix | 92 ++++++++++++++++++++++++++---------
 1 file changed, 68 insertions(+), 24 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 9ec4c66..7e20a9a 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -20,9 +20,56 @@ in {
     "vm.swappiness" = 10;
   };
 
-  systemd.services."minecraft-server-${name}" = {
-    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
-    serviceConfig.Nice = -5; # higher scheduling priority
+  systemd.services = {
+    lazymc = let
+      wrapperCommand = pkgs.writeShellScript "lazymc-${name}-wrapper" ''
+        #!/usr/bin/env bash
+        trap 'systemctl stop --wait "minecraft-server-${name}"; exit 0' SIGTERM
+        systemctl start "minecraft-server-${name}"
+        while systemctl is-active --quiet "minecraft-server-${name}"; do sleep 1; done
+      '';
+      config = {
+        public = {
+          address = "0.0.0.0:25565"; # external proxy port
+          version = "1.21.11";
+        };
+        server = {
+          wake_whitelist = true;
+          address = "127.0.0.1:25566"; # internal server port
+          directory = "/srv/minecraft/${name}";
+          command = wrapperCommand;
+        };
+        time.sleep_after = 600;
+        motd.from_server = true;
+        join = {
+          methods = [ "hold" ];
+          hold.timeout = 60;
+        };
+        advanced.rewrite_server_properties = false; # might get overridden by nix-minecraft
+        config.version = "0.2.11";
+      };
+    in {
+      description = "Wake-up Proxy for Minecraft Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        User = "root";
+        Group = "root";
+        ExecStart = let
+          toml = pkgs.formats.toml {};
+          configFile = toml.generate "lazymc-${name}.toml" config;
+        in "${pkgs.lazymc}/bin/lazymc --config ${configFile}"; 
+        Restart = "always";
+      };
+    };
+    "minecraft-server-${name}" = {
+      environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
+      serviceConfig = {
+        # Nice = -5; # higher scheduling priority
+        TimeoutStopSec = 180; # just in case saving takes a while
+      };
+    };
   };
   
   services.minecraft-servers = {
@@ -37,7 +84,7 @@ in {
    
     servers.${name} = {
       enable = true;
-      autoStart = true;
+      autoStart = false;
       restart = "always";
       enableReload = production;
       
@@ -50,7 +97,8 @@ in {
       };
       
       serverProperties = {
-        server-port = 25565;
+        server-ip = "127.0.0.1";
+        server-port = 25566;
         server-name = name;
         motd = "§cCan't connect to server";
         log-ips = true;
@@ -79,19 +127,17 @@ in {
       };
       
       symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
-        "polymer/packsquash" = let 
-          packsquash-binary = pkgs.runCommand "packsquash" {
-            src = pkgs.fetchurl {
-              url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
-              sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
-            };
-            nativeBuildInputs = [ pkgs.unzip ];
-          } ''
-            mkdir -p $out/bin
-            unzip $src -d $out/bin
-            chmod +x $out/bin/packsquash
-          '';
-        in "${packsquash-binary}/bin/packsquash";
+        "polymer/packsquash" = let packsquash-binary = pkgs.runCommand "packsquash" {
+          src = pkgs.fetchurl {
+            url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+            sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+          };
+          nativeBuildInputs = [ pkgs.unzip ];
+        } ''
+          mkdir -p $out/bin
+          unzip $src -d $out/bin
+          chmod +x $out/bin/packsquash
+        ''; in "${packsquash-binary}/bin/packsquash";
       };
 
       files = inputs.mc.lib.collectFilesAt modpack "config" // {
@@ -100,12 +146,9 @@ in {
           whitelistTCPShieldServers = false;
           proxyServerIPs = [
             "127.0.0.1" "::1"
-            "127.185.172.53" # playit
           ];
           directAccessIPs = [
             "127.0.0.0/8" "::1/128" # localhost
-            "100.64.0.0/10" "fd7a:115c:a1e0::/48" # tailscale
-            "192.168.1.0/24" "10.3.14.0/24" # lan
           ];
         };
       };
@@ -120,9 +163,10 @@ in {
           "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
         }
       ); in ''
-        # shellcheck disable=SC1091
-        source modpack-config.env
-        ${sed-commands}
+        if [ -f modpack-config.env ]; then
+          source modpack-config.env
+          ${sed-commands}
+        fi
       '';
       
       package = pkgs.fabricServers.fabric-1_21_11.override {

From e82d9f84e8915965582690617a532c15227496a3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 29 Jun 2026 09:26:33 +0700
Subject: [PATCH 335/427] fix dup opt

---
 modules/system/homelab/mc.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 7e20a9a..d72b998 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -65,10 +65,7 @@ in {
     };
     "minecraft-server-${name}" = {
       environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
-      serviceConfig = {
-        # Nice = -5; # higher scheduling priority
-        TimeoutStopSec = 180; # just in case saving takes a while
-      };
+      # serviceConfig.Nice = -5; # higher scheduling priority
     };
   };
   

From 80fc0e0d8316b71a9eccb8e7f01a22e9d7761aec Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 29 Jun 2026 09:32:45 +0700
Subject: [PATCH 336/427] shellcheck fix

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index d72b998..429ceb4 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -160,6 +160,7 @@ in {
           "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
         }
       ); in ''
+        # shellcheck disable=SC1091
         if [ -f modpack-config.env ]; then
           source modpack-config.env
           ${sed-commands}

From 9df3f14e4743b028553326dee41df50c0f6afb42 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 30 Jun 2026 07:41:41 +0800
Subject: [PATCH 337/427] update modpack

---
 modules/system/homelab/mc.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 429ceb4..0e7da88 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -4,10 +4,10 @@
   ram-allocation-mb = 12288;
   rcon-pass = "howdy";
   modpack = let
-    commit = "a22477190ee93aed8d1c33687f1824550f0712cf";
+    commit = "b128b9f93b365570ad650d9b6fea149c54b586c5";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-9bPnK3xohEcwrFc5LoXemIzQwQullJmuoJ8zjEoIV/U=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 7e0cc853eb501623f7e6b58ab0e8a37f4adfa08f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 30 Jun 2026 07:43:25 +0800
Subject: [PATCH 338/427] update hash

---
 modules/system/homelab/mc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 0e7da88..8295853 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -7,7 +7,7 @@
     commit = "b128b9f93b365570ad650d9b6fea149c54b586c5";
     path = if production then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-i0N/Yb4dgSpJLfazm6KSZC9dehU53AmvhXWLKHCU0aA=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From a2de33cb91b703df244177f1e2ae95179adf9134 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 30 Jun 2026 07:16:41 +0700
Subject: [PATCH 339/427] add rcon

---
 modules/system/homelab/mc.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 8295853..562e5ab 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -45,6 +45,11 @@ in {
           methods = [ "hold" ];
           hold.timeout = 60;
         };
+        rcon = {
+          enabled = true;
+          port = 25575;
+          password = rcon-pass;
+        };
         advanced.rewrite_server_properties = false; # might get overridden by nix-minecraft
         config.version = "0.2.11";
       };

From a625259f20f66fd2017747384d811ea64f9eb518 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 30 Jun 2026 07:22:06 +0700
Subject: [PATCH 340/427] fix error

---
 modules/system/homelab/mc.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 562e5ab..84cf79d 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -49,6 +49,7 @@ in {
           enabled = true;
           port = 25575;
           password = rcon-pass;
+          randomize_password = false;
         };
         advanced.rewrite_server_properties = false; # might get overridden by nix-minecraft
         config.version = "0.2.11";

From 806f8d01de88275921ffaea9db2815a3d0705e2e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 30 Jun 2026 11:50:02 +0800
Subject: [PATCH 341/427] remove lazymc due to complexity

---
 modules/system/homelab/mc.nix | 70 ++++-------------------------------
 1 file changed, 8 insertions(+), 62 deletions(-)

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
index 84cf79d..4ffdee7 100644
--- a/modules/system/homelab/mc.nix
+++ b/modules/system/homelab/mc.nix
@@ -20,59 +20,9 @@ in {
     "vm.swappiness" = 10;
   };
 
-  systemd.services = {
-    lazymc = let
-      wrapperCommand = pkgs.writeShellScript "lazymc-${name}-wrapper" ''
-        #!/usr/bin/env bash
-        trap 'systemctl stop --wait "minecraft-server-${name}"; exit 0' SIGTERM
-        systemctl start "minecraft-server-${name}"
-        while systemctl is-active --quiet "minecraft-server-${name}"; do sleep 1; done
-      '';
-      config = {
-        public = {
-          address = "0.0.0.0:25565"; # external proxy port
-          version = "1.21.11";
-        };
-        server = {
-          wake_whitelist = true;
-          address = "127.0.0.1:25566"; # internal server port
-          directory = "/srv/minecraft/${name}";
-          command = wrapperCommand;
-        };
-        time.sleep_after = 600;
-        motd.from_server = true;
-        join = {
-          methods = [ "hold" ];
-          hold.timeout = 60;
-        };
-        rcon = {
-          enabled = true;
-          port = 25575;
-          password = rcon-pass;
-          randomize_password = false;
-        };
-        advanced.rewrite_server_properties = false; # might get overridden by nix-minecraft
-        config.version = "0.2.11";
-      };
-    in {
-      description = "Wake-up Proxy for Minecraft Server";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        User = "root";
-        Group = "root";
-        ExecStart = let
-          toml = pkgs.formats.toml {};
-          configFile = toml.generate "lazymc-${name}.toml" config;
-        in "${pkgs.lazymc}/bin/lazymc --config ${configFile}"; 
-        Restart = "always";
-      };
-    };
-    "minecraft-server-${name}" = {
-      environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
-      # serviceConfig.Nice = -5; # higher scheduling priority
-    };
+  systemd.services."minecraft-server-${name}" = {
+    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
+    # serviceConfig.Nice = -5; # higher scheduling priority (causes fan noise even when idle)
   };
   
   services.minecraft-servers = {
@@ -87,7 +37,7 @@ in {
    
     servers.${name} = {
       enable = true;
-      autoStart = false;
+      autoStart = true;
       restart = "always";
       enableReload = production;
       
@@ -100,8 +50,8 @@ in {
       };
       
       serverProperties = {
-        server-ip = "127.0.0.1";
-        server-port = 25566;
+        server-ip = "0.0.0.0";
+        server-port = 25565;
         server-name = name;
         motd = "§cCan't connect to server";
         log-ips = true;
@@ -147,12 +97,8 @@ in {
         "config/proxy_protocol_support.json".value = {
           enableProxyProtocol = false; # polymer auto host has issues with proxy protocol
           whitelistTCPShieldServers = false;
-          proxyServerIPs = [
-            "127.0.0.1" "::1"
-          ];
-          directAccessIPs = [
-            "127.0.0.0/8" "::1/128" # localhost
-          ];
+          proxyServerIPs = [ "127.0.0.1" "::1" ];
+          directAccessIPs = [ "127.0.0.0/8" "::1/128" ];
         };
       };
       

From 5ba636a0965a944ca3d44a0625d1beee76946651 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 5 Jul 2026 11:11:32 +0800
Subject: [PATCH 342/427] new mc server and config structuring

---
 modules/system/homelab/mc.nix                 | 147 ------------------
 modules/system/homelab/mc/default.nix         |  17 ++
 .../system/homelab/mc/mc0-vanilla-plus.nix    | 115 ++++++++++++++
 .../system/homelab/mc/mc1-pure-vanilla.nix    |  71 +++++++++
 modules/system/server.nix                     |   2 +-
 5 files changed, 204 insertions(+), 148 deletions(-)
 delete mode 100644 modules/system/homelab/mc.nix
 create mode 100644 modules/system/homelab/mc/default.nix
 create mode 100644 modules/system/homelab/mc/mc0-vanilla-plus.nix
 create mode 100644 modules/system/homelab/mc/mc1-pure-vanilla.nix

diff --git a/modules/system/homelab/mc.nix b/modules/system/homelab/mc.nix
deleted file mode 100644
index 4ffdee7..0000000
--- a/modules/system/homelab/mc.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{ inputs, lib, pkgs, ... }: let
-  name = "mc0-vanilla-plus";
-  production = true;
-  ram-allocation-mb = 12288;
-  rcon-pass = "howdy";
-  modpack = let
-    commit = "b128b9f93b365570ad650d9b6fea149c54b586c5";
-    path = if production then "commit/${commit}" else "branch/main";
-  in pkgs.fetchPackwizModpack {
-    packHash = "sha256-i0N/Yb4dgSpJLfazm6KSZC9dehU53AmvhXWLKHCU0aA=";
-    url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
-  };
-in {
-  imports = [ inputs.mc.nixosModules.minecraft-servers ];
-  nixpkgs.overlays = [ inputs.mc.overlay ];
-  
-  powerManagement.cpuFreqGovernor = "powersave"; # performance governor causes overheating and thermal throttling, works fine with powesave
-  boot.kernel.sysctl = {
-    "vm.nr_hugepages" = (ram-allocation-mb / 2) + 512; # (heap_mb / 2MB per page) + 512 pages (1GB) for ZGC off-heap overhead
-    "vm.swappiness" = 10;
-  };
-
-  systemd.services."minecraft-server-${name}" = {
-    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
-    # serviceConfig.Nice = -5; # higher scheduling priority (causes fan noise even when idle)
-  };
-  
-  services.minecraft-servers = {
-    enable = true;
-    eula = true;
-    managementSystem.systemd-socket.enable = true;
-    # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
-    
-    # TODO: figure out how to set gamerules on start
-    # gamerules to disable: locator_bar, mob_explosion_drop_decay, (and possibly) reduced_debug_info, global_sound_events 
-    # gamerules to enable (temporarily): noend:disable_end
-   
-    servers.${name} = {
-      enable = true;
-      autoStart = true;
-      restart = "always";
-      enableReload = production;
-      
-      operators = lib.mkIf (!production) {
-        "satr14" = {
-          uuid = "54441a30-fe73-46e7-adca-c476bd4fc6d2";
-          bypassesPlayerLimit = true;
-          level = 4;
-        };
-      };
-      
-      serverProperties = {
-        server-ip = "0.0.0.0";
-        server-port = 25565;
-        server-name = name;
-        motd = "§cCan't connect to server";
-        log-ips = true;
-        hide-online-players = true; 
-        
-        difficulty = "normal";
-        gamemode = "survival";
-        max-world-size = 25000;
-        spawn-protection = 0;
-        pvp = true;
-        
-        online-mode = true;
-        enable-query = true;
-        enforce-secure-profile = false;
-        pevent-proxy-connections = false;
-        allow-flight = false;
-        player-idle-timeout = 0;
-        
-        view-distance = 12;
-        simulation-distance = 6;
-        
-        enable-rcon = true;
-        sync-chunk-writes = false;
-        "rcon.password" = rcon-pass;
-        "rcon.port" = 25575;
-      };
-      
-      symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
-        "polymer/packsquash" = let packsquash-binary = pkgs.runCommand "packsquash" {
-          src = pkgs.fetchurl {
-            url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
-            sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
-          };
-          nativeBuildInputs = [ pkgs.unzip ];
-        } ''
-          mkdir -p $out/bin
-          unzip $src -d $out/bin
-          chmod +x $out/bin/packsquash
-        ''; in "${packsquash-binary}/bin/packsquash";
-      };
-
-      files = inputs.mc.lib.collectFilesAt modpack "config" // {
-        "config/proxy_protocol_support.json".value = {
-          enableProxyProtocol = false; # polymer auto host has issues with proxy protocol
-          whitelistTCPShieldServers = false;
-          proxyServerIPs = [ "127.0.0.1" "::1" ];
-          directAccessIPs = [ "127.0.0.0/8" "::1/128" ];
-        };
-      };
-      
-      extraStartPre = let sed-commands = lib.concatStringsSep "\n" (
-        lib.mapAttrsToList (placeholder: file: 
-          ''sed -i "s|${placeholder}|''${${placeholder}}|g" ${file}''
-        ) {
-          "REPLACE_SVC_HOST"      = "config/voicechat/voicechat-server.properties";
-          "REPLACE_RP_LINK"       = "config/welcomemessage.json5";
-          "REPLACE_DC_BOT_TOKEN"  = "config/simple-discord-link/simple-discord-link.toml";
-          "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
-        }
-      ); in ''
-        # shellcheck disable=SC1091
-        if [ -f modpack-config.env ]; then
-          source modpack-config.env
-          ${sed-commands}
-        fi
-      '';
-      
-      package = pkgs.fabricServers.fabric-1_21_11.override {
-        jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
-        loaderVersion = "0.19.2";
-      };
-
-      jvmOpts = let flags = [
-        "-Xms${toString ram-allocation-mb}M"
-        "-Xmx${toString ram-allocation-mb}M"
-        
-        "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
-        "-XX:+ZGenerational" # Use generational ZGC (newer and better ZGC, requires Java v21+)
-        "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
-        
-        "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods like C2ME)
-        "-XX:+UseLargePages" # Large pages support (requires hugepages configured on the system)
-        "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
-        "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
-        "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
-        "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - 2048)}M" # Leave 2GB headroom
-        # "-XX:ZAllocationSpikeTolerance=5" # Helps when server is active with many players
-        # "-XX:ZCollectionInterval=1" # Force a GC cycle at minimum every second
-        # "-XX:ConcGCThreads=8" # Threads ZGC uses for concurrent work
-      ]; in lib.concatStringsSep " " flags;
-    };
-  };
-}
\ No newline at end of file
diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
new file mode 100644
index 0000000..b2a0af4
--- /dev/null
+++ b/modules/system/homelab/mc/default.nix
@@ -0,0 +1,17 @@
+{ inputs, ... }: {
+  imports = [
+    ./mc0-vanilla-plus.nix
+    inputs.mc.nixosModules.minecraft-servers
+  ];
+  nixpkgs.overlays = [ inputs.mc.overlay ];
+  
+  powerManagement.cpuFreqGovernor = "powersave"; # performance governor causes overheating and thermal throttling, works fine with powesave
+  boot.kernel.sysctl."vm.swappiness" = 10; # reduce swap usage and keep memory performance smooth
+
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    managementSystem.systemd-socket.enable = true;
+    # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
+  };
+}
\ No newline at end of file
diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
new file mode 100644
index 0000000..f98d9bc
--- /dev/null
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -0,0 +1,115 @@
+{ inputs, lib, pkgs, ... }: let
+  name = "mc0-vanilla-plus";
+  ram-allocation-mb = 12288;
+  headroom-allocation-mb = 2048;
+  rcon-pass = "howdy";
+  modpack = let
+    useLatest = false;
+    commit = "b128b9f93b365570ad650d9b6fea149c54b586c5";
+    path = if !useLatest then "commit/${commit}" else "branch/main";
+  in pkgs.fetchPackwizModpack {
+    packHash = "sha256-i0N/Yb4dgSpJLfazm6KSZC9dehU53AmvhXWLKHCU0aA=";
+    url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
+  };
+in {
+  systemd.services."minecraft-server-${name}" = {
+    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
+    # serviceConfig.Nice = -5; # higher scheduling priority (causes fan noise even when idle)
+  };
+  
+  services.minecraft-servers.servers.${name} = {
+    enable = true;
+    autoStart = true;
+    restart = "always";
+    
+    serverProperties = {
+      server-ip = "0.0.0.0";
+      server-port = 25565;
+      server-name = name;
+      motd = "§cCan't connect to server";
+      log-ips = false;
+      hide-online-players = true; 
+      
+      difficulty = "normal";
+      gamemode = "survival";
+      max-world-size = 25000;
+      spawn-protection = 0;
+      pvp = true;
+      
+      online-mode = true;
+      enable-query = true;
+      enforce-secure-profile = false;
+      pevent-proxy-connections = false;
+      allow-flight = false;
+      player-idle-timeout = 0;
+      
+      view-distance = 12;
+      simulation-distance = 6;
+      
+      enable-rcon = true;
+      sync-chunk-writes = false;
+      "rcon.password" = rcon-pass;
+      "rcon.port" = 25575;
+    };
+    
+    symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
+      "polymer/packsquash" = let packsquash-binary = pkgs.runCommand "packsquash" {
+        src = pkgs.fetchurl {
+          url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+          sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+        };
+        nativeBuildInputs = [ pkgs.unzip ];
+      } ''
+        mkdir -p $out/bin
+        unzip $src -d $out/bin
+        chmod +x $out/bin/packsquash
+      ''; in "${packsquash-binary}/bin/packsquash";
+    };
+
+    files = inputs.mc.lib.collectFilesAt modpack "config" // {
+      "config/proxy_protocol_support.json".value = {
+        enableProxyProtocol = false; # polymer auto host has issues with proxy protocol
+        whitelistTCPShieldServers = false;
+        proxyServerIPs = [ "127.0.0.1" "::1" ];
+        directAccessIPs = [ "127.0.0.0/8" "::1/128" ];
+      };
+    };
+    
+    extraStartPre = let sed-commands = lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (substitution: file: 
+        ''sed -i "s|${substitution}|''${${substitution}}|g" ${file}''
+      ) {
+        "REPLACE_SVC_HOST"      = "config/voicechat/voicechat-server.properties";
+        "REPLACE_RP_LINK"       = "config/welcomemessage.json5";
+        "REPLACE_DC_BOT_TOKEN"  = "config/simple-discord-link/simple-discord-link.toml";
+        "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
+      }
+    ); in ''
+      # shellcheck disable=SC1091
+      if [ -f modpack-config.env ]; then
+        source modpack-config.env
+        ${sed-commands}
+      fi
+    '';
+    
+    package = pkgs.fabricServers.fabric-1_21_11.override {
+      jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
+      loaderVersion = "0.19.2";
+    };
+
+    jvmOpts = let flags = [
+      "-Xms${toString ram-allocation-mb}M"
+      "-Xmx${toString ram-allocation-mb}M"
+      
+      "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+      "-XX:+ZGenerational" # Use generational ZGC (newer and better ZGC, requires Java v21+)
+      "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
+      
+      "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods like C2ME)
+      "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
+      "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
+      "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+      "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - headroom-allocation-mb)}M" # Leave 2GB headroom
+    ]; in lib.concatStringsSep " " flags;
+  };
+}
\ No newline at end of file
diff --git a/modules/system/homelab/mc/mc1-pure-vanilla.nix b/modules/system/homelab/mc/mc1-pure-vanilla.nix
new file mode 100644
index 0000000..1c2f491
--- /dev/null
+++ b/modules/system/homelab/mc/mc1-pure-vanilla.nix
@@ -0,0 +1,71 @@
+{ inputs, lib, pkgs, ... }: let
+  name = "mc1-pure-vanilla";
+  ram-allocation-mb = 8192;
+  headroom-allocation-mb = 1024;
+  rcon-pass = "howdy";
+  
+  modpack = pkgs.fetchModrinthModpack {
+      url = "https://cdn.modrinth.com/data/2wkV8mHp/versions/mFGJP1Ye/Server%20Optimization%201.21.11-2.1.mrpack";
+      packHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+      side = "server";
+    };
+in {
+  services.minecraft-servers.servers.${name} = {
+    enable = true;
+    autoStart = true;
+    restart = "always";
+    
+    serverProperties = {
+      server-ip = "0.0.0.0";
+      server-port = 25566;
+      server-name = name;
+      motd = "Season 4 - §6§lPure Vanilla ⛏";
+      log-ips = false;
+      hide-online-players = true; 
+      
+      difficulty = "normal";
+      gamemode = "survival";
+      max-world-size = 25000;
+      spawn-protection = 0;
+      pvp = true;
+      
+      online-mode = true;
+      enable-query = true;
+      enforce-secure-profile = false;
+      pevent-proxy-connections = false;
+      allow-flight = false;
+      player-idle-timeout = 0;
+      
+      view-distance = 10;
+      simulation-distance = 4;
+      
+      enable-rcon = true;
+      sync-chunk-writes = false;
+      "rcon.password" = rcon-pass;
+      "rcon.port" = 25576;
+    };
+    
+    symlinks = inputs.mc.lib.collectFilesAt modpack "mods"; # TODO: add cracked support
+    files = inputs.mc.lib.collectFilesAt modpack "config";
+    
+    package = pkgs.fabricServers.fabric-1_21_11.override {
+      jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
+      loaderVersion = "0.19.2";
+    };
+
+    jvmOpts = let flags = [
+      "-Xms${toString ram-allocation-mb}M"
+      "-Xmx${toString ram-allocation-mb}M"
+      
+      "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+      "-XX:+ZGenerational" # Use generational ZGC (newer and better ZGC, requires Java v21+)
+      "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
+      
+      "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods like C2ME)
+      "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
+      "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
+      "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+      "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - headroom-allocation-mb)}M" # Leave 2GB headroom
+    ]; in lib.concatStringsSep " " flags;
+  };
+}
\ No newline at end of file
diff --git a/modules/system/server.nix b/modules/system/server.nix
index a2cef9f..9db8dfa 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -25,7 +25,7 @@ in {
     ./homelab/cdn.nix
     ./homelab/ai.nix
     ./homelab/db.nix
-    ./homelab/mc.nix
+    ./homelab/mc
     
     ./core/swapfile.nix
     ./core/oom.nix

From 543b99ffe28b03f9321b42eb7af3ea809b6bb0f9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 5 Jul 2026 10:40:43 +0700
Subject: [PATCH 343/427] activate second server

---
 modules/system/homelab/mc/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
index b2a0af4..ae55545 100644
--- a/modules/system/homelab/mc/default.nix
+++ b/modules/system/homelab/mc/default.nix
@@ -1,6 +1,7 @@
 { inputs, ... }: {
   imports = [
     ./mc0-vanilla-plus.nix
+    ./mc1-pure-vanilla.nix
     inputs.mc.nixosModules.minecraft-servers
   ];
   nixpkgs.overlays = [ inputs.mc.overlay ];

From 2e2d1c1d8b9b12c8d05fbc74858ce5313793d5b6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 5 Jul 2026 11:26:04 +0700
Subject: [PATCH 344/427] minimize ram usage

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index f98d9bc..b4d19c3 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -1,7 +1,7 @@
 { inputs, lib, pkgs, ... }: let
   name = "mc0-vanilla-plus";
-  ram-allocation-mb = 12288;
-  headroom-allocation-mb = 2048;
+  ram-allocation-mb = 8192;
+  headroom-allocation-mb = 1024;
   rcon-pass = "howdy";
   modpack = let
     useLatest = false;

From cc13b146aac49e5c5ac5dae59ed155c49cf4c027 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 5 Jul 2026 11:26:40 +0700
Subject: [PATCH 345/427] update hash

---
 modules/system/homelab/mc/mc1-pure-vanilla.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc/mc1-pure-vanilla.nix b/modules/system/homelab/mc/mc1-pure-vanilla.nix
index 1c2f491..3ea2b96 100644
--- a/modules/system/homelab/mc/mc1-pure-vanilla.nix
+++ b/modules/system/homelab/mc/mc1-pure-vanilla.nix
@@ -6,7 +6,7 @@
   
   modpack = pkgs.fetchModrinthModpack {
       url = "https://cdn.modrinth.com/data/2wkV8mHp/versions/mFGJP1Ye/Server%20Optimization%201.21.11-2.1.mrpack";
-      packHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+      packHash = "sha256-odvJs6s1/T13RQhE3NnpCIrulc98nd9vo9Alg/aU404=";
       side = "server";
     };
 in {

From 52e1801f73095ac519e881628da1748e8dcfac45 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 07:25:29 +0700
Subject: [PATCH 346/427] simplify home page

---
 modules/system/homelab/git.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 5f6bfa7..c392c0c 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -31,6 +31,10 @@
           ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
           ALLOW_ONLY_INTERNAL_REGISTRATION = false;
           REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = true;
+          explore = {
+            DISABLE_USERS_PAGE = true;
+            DISABLE_ORGANIZATIONS_PAGE = true;
+          };
         };
         user.ENABLE_FOLLOWING = false;
         repository = {

From b395e631d497c6b0e85832aea025ca8ce6c4e53e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:19:00 +0800
Subject: [PATCH 347/427] add offline and bedrock support

---
 modules/system/homelab/mc/mc1-pure-vanilla.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/modules/system/homelab/mc/mc1-pure-vanilla.nix b/modules/system/homelab/mc/mc1-pure-vanilla.nix
index 3ea2b96..951b5f9 100644
--- a/modules/system/homelab/mc/mc1-pure-vanilla.nix
+++ b/modules/system/homelab/mc/mc1-pure-vanilla.nix
@@ -5,10 +5,10 @@
   rcon-pass = "howdy";
   
   modpack = pkgs.fetchModrinthModpack {
-      url = "https://cdn.modrinth.com/data/2wkV8mHp/versions/mFGJP1Ye/Server%20Optimization%201.21.11-2.1.mrpack";
-      packHash = "sha256-odvJs6s1/T13RQhE3NnpCIrulc98nd9vo9Alg/aU404=";
-      side = "server";
-    };
+    url = "https://cdn.modrinth.com/data/2wkV8mHp/versions/mFGJP1Ye/Server%20Optimization%201.21.11-2.1.mrpack";
+    packHash = "sha256-odvJs6s1/T13RQhE3NnpCIrulc98nd9vo9Alg/aU404=";
+    side = "server";
+  };
 in {
   services.minecraft-servers.servers.${name} = {
     enable = true;
@@ -19,7 +19,7 @@ in {
       server-ip = "0.0.0.0";
       server-port = 25566;
       server-name = name;
-      motd = "Season 4 - §6§lPure Vanilla ⛏";
+      motd = "§cCan't connect to server";
       log-ips = false;
       hide-online-players = true; 
       
@@ -45,8 +45,14 @@ in {
       "rcon.port" = 25576;
     };
     
-    symlinks = inputs.mc.lib.collectFilesAt modpack "mods"; # TODO: add cracked support
     files = inputs.mc.lib.collectFilesAt modpack "config";
+    symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
+      mods = pkgs.linkFarmFromDrvs "mods" (builtins.attrValues {
+        EasyAuth = pkgs.fetchurl { url = "https://cdn.modrinth.com/data/aZj58GfX/versions/R4EX0C3V/easyauth-mc1.21.11-3.4.3.jar"; hash = "sha256-T1PfPlyfkieOCsfoab+BpW8pB/CSDKlxGrS5FMgSMEU="; };
+        Floodgate = pkgs.fetchurl { url = "https://cdn.modrinth.com/data/bWrNNfkb/versions/81EuNxeZ/Floodgate-Fabric-2.2.6-b60.jar"; hash = "sha256-voH1QWv5GVm6EziJ3ERPjn5cx09/et73QiZlJ7l3foM="; };
+        Geyser = pkgs.fetchurl { url = "https://cdn.modrinth.com/data/wKkoqHrH/versions/6uw7I3Qj/geyser-fabric-Geyser-Fabric-2.9.6-b1133.jar"; hash = "sha256-aWMlDdHvNz6VaLVPdmO01YBAlQ7m4w8aUe47TbXxM60="; };
+      });
+    };
     
     package = pkgs.fabricServers.fabric-1_21_11.override {
       jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;

From 3b4ba3be3fae92f406dac4f413270889a8dcf4a6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:19:21 +0800
Subject: [PATCH 348/427] switch to sonnet 5

---
 modules/home/core/code.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/core/code.nix b/modules/home/core/code.nix
index fa074e5..8596eb2 100644
--- a/modules/home/core/code.nix
+++ b/modules/home/core/code.nix
@@ -43,7 +43,7 @@
         tool_permissions.default = "allow";
         default_model = {
           provider = "copilot_chat";
-          model = "claude-sonnet-4.6";
+          model = "claude-sonnet-5";
           effort = "high";
           enable_thinking = false;
         };

From 5d762091f14c8e5a4598c45a2664e5622a4e8331 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:19:40 +0800
Subject: [PATCH 349/427] enable sway

---
 modules/home/rice/compositor.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 7133dc9..ced7eb7 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -5,6 +5,10 @@
 
   catppuccin.hyprland.enable = false; # temp fix until i get things migrated to lua
   
+  wayland.windowManager.sway = {
+    enable = true;
+  };
+  
   wayland.windowManager.hyprland = {
     enable = true;
     package = pkgs.hyprland; # inputs.hl.packages."${pkgs.system}".hyprland;

From 1d42c7d3fa54b6c07461a9b052766423dfc16585 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:21:32 +0800
Subject: [PATCH 350/427] fix error forgejo

---
 modules/system/homelab/git.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index c392c0c..42048ac 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -31,10 +31,10 @@
           ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
           ALLOW_ONLY_INTERNAL_REGISTRATION = false;
           REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = true;
-          explore = {
-            DISABLE_USERS_PAGE = true;
-            DISABLE_ORGANIZATIONS_PAGE = true;
-          };
+        };
+        "service.explore" = {
+          DISABLE_USERS_PAGE = true;
+          DISABLE_ORGANIZATIONS_PAGE = true;
         };
         user.ENABLE_FOLLOWING = false;
         repository = {

From 862c89a49959c59969952a6b4cfdf1306528ad66 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:38:09 +0800
Subject: [PATCH 351/427] enable ctp cache

---
 modules/home/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/default.nix b/modules/home/default.nix
index b6c5e9d..4a7a95c 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -7,6 +7,7 @@
   catppuccin = {
     enable = true;
     autoEnable = true;
+    cache.enable = true;
     flavor = ctp-opt.flavor;
     accent = ctp-opt.accent;
     

From c144591d59027c2713e369108a36fc8cc451791c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:38:17 +0800
Subject: [PATCH 352/427] update modpack

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index b4d19c3..a7fe356 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -5,10 +5,10 @@
   rcon-pass = "howdy";
   modpack = let
     useLatest = false;
-    commit = "b128b9f93b365570ad650d9b6fea149c54b586c5";
+    commit = "bf95d65e758963899f9d5a4eba6b589c50faffc9";
     path = if !useLatest then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-i0N/Yb4dgSpJLfazm6KSZC9dehU53AmvhXWLKHCU0aA=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 66e234654ce19d8e0072768fa7c0118b1d34c764 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 6 Jul 2026 15:53:18 +0800
Subject: [PATCH 353/427] update hash

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index a7fe356..2b93dd4 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -8,7 +8,7 @@
     commit = "bf95d65e758963899f9d5a4eba6b589c50faffc9";
     path = if !useLatest then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-4AbpwvbzndeQC18sCKbWkIo8npQRHTftOJ69au3AjXc=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From e13d03d3625af18c9cc63d5e0853942036d92266 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 09:28:08 +0800
Subject: [PATCH 354/427] skip discord updater

---
 modules/home/desktop.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/home/desktop.nix b/modules/home/desktop.nix
index 1a151d3..e007ef6 100644
--- a/modules/home/desktop.nix
+++ b/modules/home/desktop.nix
@@ -17,6 +17,10 @@
     ./core/browser.nix
   ];
 
+  home.file.".config/discord/settings.json".text = builtins.toJSON {
+    SKIP_HOST_UPDATE = true;
+  };
+  
   services = {
     awww.enable = true;
     hyprpolkitagent.enable = true;

From a7781200a0e01c1dd8b528e582464d0f6a5f82f3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 09:55:57 +0800
Subject: [PATCH 355/427] base niri config

---
 flake.lock                       | 124 ++++++++++++++++++++++++++++++-
 flake.nix                        |   1 +
 modules/home/rice/compositor.nix |  35 ++++++++-
 modules/home/rice/keybinds.nix   |  25 +++++++
 modules/system/desktop.nix       |  20 +++--
 5 files changed, 193 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4a9bf3d..2893c06 100644
--- a/flake.lock
+++ b/flake.lock
@@ -112,6 +112,62 @@
         "type": "github"
       }
     },
+    "niri": {
+      "inputs": {
+        "niri-stable": "niri-stable",
+        "niri-unstable": "niri-unstable",
+        "nixpkgs": "nixpkgs_4",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "xwayland-satellite-stable": "xwayland-satellite-stable",
+        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
+      },
+      "locked": {
+        "lastModified": 1783267733,
+        "narHash": "sha256-DTvaM+0vanneOcKg3NKXV7ilf0ShY4BOBz/nde5GHos=",
+        "owner": "sodiboo",
+        "repo": "niri-flake",
+        "rev": "74053f79cad0f6c3a4a0be6b7928795d2e6a9f4b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "sodiboo",
+        "repo": "niri-flake",
+        "type": "github"
+      }
+    },
+    "niri-stable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1756556321,
+        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
+        "type": "github"
+      },
+      "original": {
+        "owner": "YaLTeR",
+        "ref": "v25.08",
+        "repo": "niri",
+        "type": "github"
+      }
+    },
+    "niri-unstable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783248941,
+        "narHash": "sha256-citgYJbvR1iUKXpiWlFq3NO+fw6hXGL3Qk1ampU7lhA=",
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "rev": "a30ca7983b2f1fc3ddeb209b3fe18fa78e0dbd25",
+        "type": "github"
+      },
+      "original": {
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1781173989,
@@ -125,6 +181,22 @@
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1782847189,
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1746378225,
@@ -157,6 +229,22 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1781074563,
         "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
@@ -178,7 +266,8 @@
         "gl": "gl",
         "hm": "hm",
         "mc": "mc",
-        "nixpkgs": "nixpkgs_4"
+        "niri": "niri",
+        "nixpkgs": "nixpkgs_5"
       }
     },
     "systems": {
@@ -210,6 +299,39 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "xwayland-satellite-stable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755491097,
+        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Supreeeme",
+        "ref": "v0.7",
+        "repo": "xwayland-satellite",
+        "type": "github"
+      }
+    },
+    "xwayland-satellite-unstable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1781226823,
+        "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=",
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 3ccbd5c..6f756b4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,6 +10,7 @@
     gl.url = "github:nix-community/nixGL";
     ctp.url = "github:catppuccin/nix";
     
+    niri.url = "github:sodiboo/niri-flake";
     mc.url = "github:Infinidoge/nix-minecraft";
   };
 
diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index ced7eb7..add66fc 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -3,12 +3,39 @@
     ./keybinds.nix
   ];
 
-  catppuccin.hyprland.enable = false; # temp fix until i get things migrated to lua
-  
-  wayland.windowManager.sway = {
-    enable = true;
+  programs.niri = {
+    settings = {
+      outputs."eDP-1" = {
+        mode = { width=1920; height=1080; refresh=60.006; };
+        position = { x=0; y=0; };
+        scale   = 1.0;
+      };
+      environment = {
+        XCURSOR_SIZE = "24";
+        XCURSOR_THEME = "catppuccin-${ctp-opt.flavor}-light-cursors";
+
+        CLIPHIST_MAX_ITEMS = "36";
+
+        GTK_APPLICATION_PREFER_DARK_THEME = "1";
+        GTK_THEME = "Adwaita:dark";
+        QT_QPA_PLATFORMTHEME = "kvantum";
+        QT_STYLE_OVERRIDE = "kvantum";
+      };
+      spawn-at-startup = map (sh: { inherit sh; }) [
+        "wl-paste --type text --watch cliphist store"
+        "wl-paste --type image --watch cliphist store"
+
+        "waybar &"
+        "sunshine &"
+        "blueman-applet &"
+        "nm-applet &"
+        "tailscale systray &"
+      ];
+    };
   };
   
+  catppuccin.hyprland.enable = false; # temp fix until i get things migrated to lua
+  
   wayland.windowManager.hyprland = {
     enable = true;
     package = pkgs.hyprland; # inputs.hl.packages."${pkgs.system}".hyprland;
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index c0d4634..6a9c841 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -18,6 +18,31 @@
       };
     };
   };
+
+  programs.niri.settings.binds = {
+    "XF86AudioRaiseVolume" = { action.spawn = [ "wpctl" "set-volume" "-l" "1" "@DEFAULT_AUDIO_SINK@" "5%+" ]; allow-when-locked = true; };
+    "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-" ]; allow-when-locked = true; };
+    "XF86AudioMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle" ]; allow-when-locked = true; };
+    "XF86AudioMicMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle" ]; allow-when-locked = true; };
+    "XF86MonBrightnessUp" = { action.spawn = [ "brightnessctl" "s" "10%+" ]; allow-when-locked = true; };
+    "XF86MonBrightnessDown" = { action.spawn = [ "brightnessctl" "s" "10%-" ]; allow-when-locked = true; };
+    
+    "Mod+Q".action.close-window = {};
+    "Mod+W".action.maximize-column = {};
+    "Print".action.screenshot-screen = {};
+    
+    "Mod+Up".action.focus-workspace-up = {};
+    "Mod+Down".action.focus-workspace-down = {};
+    "Mod+Left".action.focus-column-left = {};
+    "Mod+Right".action.focus-column-right = {};
+    
+    "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" ":" "-run-command" "uwsm app -- {cmd}" ];
+    "Mod+E".action.spawn = [ "pcmanfm-qt" ];
+    "Mod+T".action.spawn = [ "kitty" ];
+    "Mod+Y".action.spawn = [ "brave" "--restore-last-session" ];
+    "Mod+Return".action.spawn-sh = "ls ~/Projects | rofi -dmenu -p \"Open Project\" | xargs -I {} sh -c 'mkdir -p ~/Projects/\"{}\" && zeditor ~/Projects/\"{}\"'";
+  };
+  
   wayland.windowManager.hyprland = {
     settings = {
       gestures = {
diff --git a/modules/system/desktop.nix b/modules/system/desktop.nix
index 9f31a27..933e8b7 100644
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -1,5 +1,8 @@
-{ pkgs, enable-dm, ... }: {
+{ inputs, pkgs, enable-dm, ... }: {
+  nixpkgs.overlays = [ inputs.niri.overlays.niri ];
   imports = [
+    inputs.niri.nixosModules.niri
+    
     ./misc/programs.nix
     ./misc/graphics.nix
     ./misc/theme.nix
@@ -7,12 +10,15 @@
     ./base.nix
   ];
 
-  programs.hyprland = {
-    enable = true;
-    withUWSM = true;
-    xwayland.enable = true;
-    package = pkgs.hyprland; # if rice.enable then inputs.hl.packages."${pkgs.system}".hyprland else pkgs.hyprland;
-    portalPackage = pkgs.xdg-desktop-portal-hyprland; # inputs.hl.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+  programs = {
+    niri.enable = true;
+    hyprland = {
+      enable = true;
+      withUWSM = true;
+      xwayland.enable = true;
+      package = pkgs.hyprland; # if rice.enable then inputs.hl.packages."${pkgs.system}".hyprland else pkgs.hyprland;
+      portalPackage = pkgs.xdg-desktop-portal-hyprland; # inputs.hl.packages.${pkgs.system}.xdg-desktop-portal-hyprland;
+    };
   };
 
   xdg.portal = {

From e1f7fb5c5f9e5276645a42cb387c442f06336919 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 12:51:41 +0800
Subject: [PATCH 356/427] migrate waybar to niri

---
 modules/home/rice/bar.nix | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/modules/home/rice/bar.nix b/modules/home/rice/bar.nix
index 27a04dd..686523f 100644
--- a/modules/home/rice/bar.nix
+++ b/modules/home/rice/bar.nix
@@ -12,15 +12,15 @@
 
         modules-left = [
           "custom/start"
-          "hyprland/workspaces"
-          "hyprland/window"
+          "niri/workspaces"
+          "niri/window"
           "mpris"
         ];
         modules-center = if rice.bar.minimal then [] else [
           "custom/dunst"
           "clock"
           "tray"
-          "hyprland/submap"
+          # "hyprland/submap"
         ];
         modules-right = if rice.bar.minimal then [
           "tray"
@@ -91,15 +91,10 @@
             balanced = "";
           };
         };
-        "hyprland/workspaces" = {
-          format = "{name}";
-          format-icons = {
-            default = " ";
-            active = " ";
-            urgent = " ";
-          };
-          on-scroll-down = "hyprctl dispatch workspace e+1";
-          on-scroll-up = "hyprctl dispatch workspace e-1";
+        "niri/workspaces" = {
+          format = "{value}";
+          on-scroll-down = "niri msg action focus-workspace-down";
+          on-scroll-up = "niri msg action focus-workspace-up";
         };
         "custom/dunst" = {
           format = "{}";
@@ -119,7 +114,7 @@
           on-click-right = "playerctl next";
           on-click = "playerctl previous";
         };
-        "hyprland/window" = {
+        "niri/window" = {
           icon = true;
           max-length = 35;
           separate-outputs = false;
@@ -128,16 +123,14 @@
             "~" = "${username}@${hostname}";
             "btop" = "${username}@${hostname}";
           };
-          on-click-right = "hyprctl dispatch fullscreen 0";
-          on-click-middle = "hyprctl dispatch killactive";
-          on-click = "hyprctl dispatch fullscreen 1";
-          on-scroll-up = "hyprctl dispatch cyclenext";
-          on-scroll-down = "hyprctl dispatch cyclenext prev";
-        };
-        "hyprland/submap" = {
-          format = " {}";
-          on-click = "hyprctl dispatch submap reset";
+          on-click-right = "niri msg action fullscreen-window";
+          on-click-middle = "niri msg action close-window";
+          on-click = "niri msg action maximize-column";
         };
+        # "hyprland/submap" = {
+        #   format = " {}";
+        #   on-click = "hyprctl dispatch submap reset";
+        # };
         "clock" = {
           format = "{:%b %d, %I:%M:%S %p}";
           interval = 1;
@@ -234,6 +227,7 @@
       #workspaces button {
         border-radius: 0px;
         margin: 0px;
+        padding: 4px;
         background: none;
         border: none;
       }

From e3070b231cf80428520690f5b86ba96af6245ecc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 13:05:45 +0800
Subject: [PATCH 357/427] use unstable, migrate the rest of the keybinds, a bit
 of styling config

---
 modules/home/rice/compositor.nix | 14 ++++++++++++++
 modules/home/rice/keybinds.nix   | 25 +++++++++++++++++++++++++
 modules/system/desktop.nix       |  5 ++++-
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index add66fc..04e0eb0 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -3,6 +3,8 @@
     ./keybinds.nix
   ];
 
+  # TODO: https://github.com/sodiboo/niri-flake/issues/1393 for nwg-displays monitor dynamic config
+
   programs.niri = {
     settings = {
       outputs."eDP-1" = {
@@ -10,6 +12,7 @@
         position = { x=0; y=0; };
         scale   = 1.0;
       };
+      
       environment = {
         XCURSOR_SIZE = "24";
         XCURSOR_THEME = "catppuccin-${ctp-opt.flavor}-light-cursors";
@@ -31,6 +34,17 @@
         "nm-applet &"
         "tailscale systray &"
       ];
+
+      prefer-no-csd = true;
+      layout = {
+        tab-indicator.enable = false;
+        gaps = rice.gap.outer;
+        border = {
+          enable = true;
+          width = rice.borders.size;
+          
+        };
+      };
     };
   };
   
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 6a9c841..a8c838f 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -29,6 +29,7 @@
     
     "Mod+Q".action.close-window = {};
     "Mod+W".action.maximize-column = {};
+    "Mod+S".action.fullscreen-window = {};
     "Print".action.screenshot-screen = {};
     
     "Mod+Up".action.focus-workspace-up = {};
@@ -36,11 +37,35 @@
     "Mod+Left".action.focus-column-left = {};
     "Mod+Right".action.focus-column-right = {};
     
+    "Mod+Space" = { action.spawn = [ "playerctl" "play-pause" ]; allow-when-locked = true; };
     "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" ":" "-run-command" "uwsm app -- {cmd}" ];
+    
     "Mod+E".action.spawn = [ "pcmanfm-qt" ];
     "Mod+T".action.spawn = [ "kitty" ];
     "Mod+Y".action.spawn = [ "brave" "--restore-last-session" ];
     "Mod+Return".action.spawn-sh = "ls ~/Projects | rofi -dmenu -p \"Open Project\" | xargs -I {} sh -c 'mkdir -p ~/Projects/\"{}\" && zeditor ~/Projects/\"{}\"'";
+
+    "Mod+M".action.spawn = [ "wlogout" ];
+    "Mod+Tab".action.spawn = [ "pkill" "-SIGUSR1" "waybar" ];
+
+    "XF86Bluetooth".action.spawn = [ "blueman-manager" ];
+    "XF86Display".action.spawn = [ "nwg-displays" ];
+    "Ctrl+Alt+Delete".action.spawn = [ "wlogout" ];
+    "Ctrl+Shift+Escape".action.spawn = [ "kitty" "btop" ];
+    "Mod+Grave".action.spawn = [ "dunstctl" "set-paused" "toggle" ];
+
+    "Mod+N".action.spawn = [ "rofi-network-manager" ];
+    "Mod+J".action.spawn-sh = "notify-send -u critical ${hostname} 'Caffein Mode' && notify-send '(SUPER+X to reset)' && systemctl --user stop hypridle";
+    "Mod+Z".action.spawn = [ "dunstctl" "close-all" ];
+
+    "Mod+V".action.spawn = [ "rofi" "-modi" "clipboard:cliphist-rofi-img" "-show" "clipboard" "-show-icons" ];
+    "Mod+A".action.spawn = [ "zeditor" ];
+    "Mod+C".action.spawn = [ "kitty" "btop" ];
+    "Mod+Shift+C".action.spawn = [ "kitty" "zsh" "-c" "fastfetch; exec zsh -i" ];
+    "Mod+D".action.spawn = [ "steam" "steam://open/bigpicture" ];
+    "Mod+Shift+D".action.spawn = [ "steam" ];
+
+    "Mod+L".action.spawn = [ "loginctl" "lock-session" ];
   };
   
   wayland.windowManager.hyprland = {
diff --git a/modules/system/desktop.nix b/modules/system/desktop.nix
index 933e8b7..04cb286 100644
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -11,7 +11,10 @@
   ];
 
   programs = {
-    niri.enable = true;
+    niri = {
+      enable = true;
+      package = pkgs.niri-unstable;
+    };
     hyprland = {
       enable = true;
       withUWSM = true;

From 67df930504239c5deefa61e7dd8f16aa5ee6c87c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 13:10:24 +0800
Subject: [PATCH 358/427] cleanup hyprlan specifics

---
 modules/home/rice/bar.nix | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/modules/home/rice/bar.nix b/modules/home/rice/bar.nix
index 686523f..4360e9c 100644
--- a/modules/home/rice/bar.nix
+++ b/modules/home/rice/bar.nix
@@ -20,7 +20,6 @@
           "custom/dunst"
           "clock"
           "tray"
-          # "hyprland/submap"
         ];
         modules-right = if rice.bar.minimal then [
           "tray"
@@ -54,7 +53,7 @@
           };
           interval = 1;
           format = " {used:0.1f}GiB";
-          on-click = "hyprctl dispatch exec '[float; size 75%]' kitty btop";
+          on-click = "kitty btop";
         };
         "disk" = {
           states = {
@@ -62,7 +61,7 @@
           };
           interval = 5;
           format = " {used}";
-          on-click = "hyprctl dispatch exec '[float; size 75%]' kitty btop";
+          on-click = "kitty btop";
           on-click-right = "kitty sh -c 'sudo nix-collect-garbage -d; nix-collect-garbage -d; nix store optimise; sudo journalctl --rotate --vacuum-time=1s --vacuum-files=1; read'";
         };
         "network" = {
@@ -81,7 +80,7 @@
           critical-threshold = 80;
           format = " {temperatureC}°C";
           interval = 1;
-          on-click = "hyprctl dispatch exec '[float; size 75%]' kitty btop";
+          on-click = "kitty btop";
         };
         "power-profiles-daemon" = {
           format = "{icon} {profile}";
@@ -127,10 +126,6 @@
           on-click-middle = "niri msg action close-window";
           on-click = "niri msg action maximize-column";
         };
-        # "hyprland/submap" = {
-        #   format = " {}";
-        #   on-click = "hyprctl dispatch submap reset";
-        # };
         "clock" = {
           format = "{:%b %d, %I:%M:%S %p}";
           interval = 1;
@@ -177,8 +172,7 @@
         };
         "custom/start" = {
           format = "";
-          on-click-middle = "wlogout";
-          on-click-right = "hyprctl dispatch togglespecialworkspace hidden";
+          on-click-right = "wlogout";
           on-click = "rofi -show drun -show-icons -display-drun '' -run-command \"uwsm app -- {cmd}\"";
         };
       }
@@ -221,8 +215,8 @@
         border: ${toString rice.borders.size}px solid transparent;
       }
 
-      #window, #submap { padding: 0px 5px; }
-      #submap, #workspaces, #cpu, #memory, #disk, #clock, #window, #tray, #pulseaudio, #battery, #network, #temperature, #power-profiles-daemon, #custom-exit, #custom-start, #custom-dunst, #mpris { padding: 0px 5px; margin: 0px 5px; }
+      #window { padding: 0px 5px; }
+      #workspaces, #cpu, #memory, #disk, #clock, #window, #tray, #pulseaudio, #battery, #network, #temperature, #power-profiles-daemon, #custom-exit, #custom-start, #custom-dunst, #mpris { padding: 0px 5px; margin: 0px 5px; }
 
       #workspaces button {
         border-radius: 0px;
@@ -241,7 +235,7 @@
         background: @base;
       }
 
-      #workspaces button.active, #submap {
+      #workspaces button.active {
         background: @surface0;
       }
 

From 02caf6655d919013412a9eee6484ca4232810582 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 13:47:22 +0800
Subject: [PATCH 359/427] input tweak

---
 modules/home/rice/compositor.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 04e0eb0..0b59e39 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -12,6 +12,13 @@
         position = { x=0; y=0; };
         scale   = 1.0;
       };
+      input = {
+        warp-mouse-to-focus.enable = true;
+        focus-follows-mouse = {
+          max-scroll-amount = "5%";
+          enable = true;
+        };
+      };
       
       environment = {
         XCURSOR_SIZE = "24";

From 0b4bc2569aea4e145cba9b1079b8e2344e895faa Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 13:53:30 +0800
Subject: [PATCH 360/427] update modpack

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index 2b93dd4..52b9608 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -5,10 +5,10 @@
   rcon-pass = "howdy";
   modpack = let
     useLatest = false;
-    commit = "bf95d65e758963899f9d5a4eba6b589c50faffc9";
+    commit = "86bf13316ed1352a676d9056d284448ea5e5a079";
     path = if !useLatest then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "sha256-4AbpwvbzndeQC18sCKbWkIo8npQRHTftOJ69au3AjXc=";
+    packHash = "";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 0f853620c1618e91408481e698b6be04bff80f3d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 13:54:28 +0800
Subject: [PATCH 361/427] update hash

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index 52b9608..79f86bc 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -8,7 +8,7 @@
     commit = "86bf13316ed1352a676d9056d284448ea5e5a079";
     path = if !useLatest then "commit/${commit}" else "branch/main";
   in pkgs.fetchPackwizModpack {
-    packHash = "";
+    packHash = "sha256-sc6vekjddYpwY2Hp3uZ/xFiXyPd4kfwcZVO/pKRRBwQ=";
     url = "https://git.satr14.my.id/satr14/server-modpack/raw/${path}/pack.toml";
   };
 in {

From 6cf91a260a46a9a86d8f829ba3a9a0c8ca4a1773 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 7 Jul 2026 19:22:35 +0800
Subject: [PATCH 362/427] xwayland support. rofi inconsistenxy fix, remove
 hyprlogout

---
 modules/home/rice/compositor.nix | 8 +++++++-
 modules/home/rice/keybinds.nix   | 2 +-
 modules/home/rice/logout.nix     | 6 +++---
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 0b59e39..a01997b 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -1,4 +1,4 @@
-{ pkgs, rice, ctp-opt, ... }: {
+{ lib, pkgs, rice, ctp-opt, ... }: {
   imports = [
     ./keybinds.nix
   ];
@@ -18,6 +18,7 @@
           max-scroll-amount = "5%";
           enable = true;
         };
+        keyboard.xkb.options = "caps:none";
       };
       
       environment = {
@@ -42,6 +43,11 @@
         "tailscale systray &"
       ];
 
+      xwayland-satellite = {
+        enable = true;
+        path = lib.getExe pkgs.xwayland-satellite;
+      };
+
       prefer-no-csd = true;
       layout = {
         tab-indicator.enable = false;
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index a8c838f..5cd72ee 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -38,7 +38,7 @@
     "Mod+Right".action.focus-column-right = {};
     
     "Mod+Space" = { action.spawn = [ "playerctl" "play-pause" ]; allow-when-locked = true; };
-    "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" ":" "-run-command" "uwsm app -- {cmd}" ];
+    "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" "" "-run-command" "uwsm app -- {cmd}" ];
     
     "Mod+E".action.spawn = [ "pcmanfm-qt" ];
     "Mod+T".action.spawn = [ "kitty" ];
diff --git a/modules/home/rice/logout.nix b/modules/home/rice/logout.nix
index da57d5a..cad5b72 100644
--- a/modules/home/rice/logout.nix
+++ b/modules/home/rice/logout.nix
@@ -4,13 +4,13 @@
     layout = [
       {
         label = "shutdown";
-        action = "hyprshutdown -t 'Shutting down...' --post-cmd 'systemctl poweroff'";
+        action = "systemctl poweroff";
         text = "(S)hutdown";
         keybind = "s";
       }
       {
         label = "reboot";
-        action = "hyprshutdown -t 'Rebooting...' --post-cmd 'systemctl reboot'";
+        action = "systemctl reboot";
         text = "(R)eboot";
         keybind = "r";
       }
@@ -28,7 +28,7 @@
       }
       {
         label = "logout";
-        action = "hyprshutdown -t 'Logging Out...' --post-cmd 'uwsm stop'";
+        action = "niri msg action quit";
         text = "L(o)gout";
         keybind = "o";
       }

From c39e13eebd8220845bc88ab3dd94164df1fa0580 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 9 Jul 2026 16:27:07 +0700
Subject: [PATCH 363/427] extra keybinds, disable fusuma, hypridle for niri,
 looks tweaks

---
 modules/home/rice/compositor.nix |  8 +++----
 modules/home/rice/idle.nix       |  8 +++----
 modules/home/rice/keybinds.nix   | 39 +++++++++++++-------------------
 3 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index a01997b..10e0813 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -15,7 +15,7 @@
       input = {
         warp-mouse-to-focus.enable = true;
         focus-follows-mouse = {
-          max-scroll-amount = "5%";
+          max-scroll-amount = "35%";
           enable = true;
         };
         keyboard.xkb.options = "caps:none";
@@ -52,11 +52,11 @@
       layout = {
         tab-indicator.enable = false;
         gaps = rice.gap.outer;
-        border = {
+        focus-ring = {
           enable = true;
-          width = rice.borders.size;
-          
+          width = rice.borders.size; 
         };
+        border.enable = false;
       };
     };
   };
diff --git a/modules/home/rice/idle.nix b/modules/home/rice/idle.nix
index 80434de..4b2d029 100644
--- a/modules/home/rice/idle.nix
+++ b/modules/home/rice/idle.nix
@@ -5,8 +5,8 @@
       general = {
         lock_cmd = "hyprlock";
         unlock_cmd = "pkill -USR1 hyprlock";
-        before_sleep_cmd = "hyprctl dispatch dpms off && hyprlock";
-        after_sleep_cmd = "hyprctl dispatch dpms on";
+        before_sleep_cmd = "niri msg action power-off-monitors && hyprlock";
+        after_sleep_cmd = "niri msg action power-on-monitors";
       };
       listener = [
         {
@@ -21,8 +21,8 @@
         }
         {
           timeout = 420;
-          on-timeout = "hyprctl dispatch dpms off";
-          on-resume = "hyprctl dispatch dpms on";
+          on-timeout = "niri msg action power-off-monitors";
+          on-resume = "niri msg action power-on-monitors";
         }
         {
           timeout = 600;
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 5cd72ee..6a96c10 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -1,24 +1,4 @@
-{ pkgs, hostname, ... }: {
-  services.fusuma = {
-    extraPackages = with pkgs; [ systemd coreutils-full xprop ];
-    enable = true;
-    settings = {
-      swipe = {
-        "4".down.sendkey = "LEFTMETA+L";
-        "4".up.sendkey = "LEFTMETA+M";
-        "3".up.sendkey = "LEFTMETA+W";
-  
-        "3".down.sendkey = "LEFTMETA+DOWN";
-        "3".right.sendkey = "LEFTMETA+LEFT";
-        "3".left.sendkey = "LEFTMETA+RIGHT";
-      };
-      hold = {
-        "3".sendkey = "LEFTMETA+TAB";
-        "4".sendkey = "LEFTMETA+SPACE";
-      };
-    };
-  };
-
+{ hostname, ... }: {
   programs.niri.settings.binds = {
     "XF86AudioRaiseVolume" = { action.spawn = [ "wpctl" "set-volume" "-l" "1" "@DEFAULT_AUDIO_SINK@" "5%+" ]; allow-when-locked = true; };
     "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-" ]; allow-when-locked = true; };
@@ -30,12 +10,22 @@
     "Mod+Q".action.close-window = {};
     "Mod+W".action.maximize-column = {};
     "Mod+S".action.fullscreen-window = {};
+    "Alt+Print".action.screenshot-window = {};
     "Print".action.screenshot-screen = {};
     
     "Mod+Up".action.focus-workspace-up = {};
     "Mod+Down".action.focus-workspace-down = {};
     "Mod+Left".action.focus-column-left = {};
     "Mod+Right".action.focus-column-right = {};
+
+    "Mod+Shift+Up".action.move-window-up-or-to-workspace-up = {};
+    "Mod+Shift+Down".action.move-window-down-or-to-workspace-down = {};
+    "Mod+Shift+Left".action.move-column-left = {};
+    "Mod+Shift+Right".action.move-column-right = {};
+
+    "Mod+G".action.center-column = {};
+    "Mod+F".action.toggle-window-floating = {};
+    "Alt+Space".action.toggle-overview = {};
     
     "Mod+Space" = { action.spawn = [ "playerctl" "play-pause" ]; allow-when-locked = true; };
     "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" "" "-run-command" "uwsm app -- {cmd}" ];
@@ -47,6 +37,7 @@
 
     "Mod+M".action.spawn = [ "wlogout" ];
     "Mod+Tab".action.spawn = [ "pkill" "-SIGUSR1" "waybar" ];
+    "Mod+H".action.show-hotkey-overlay = {};
 
     "XF86Bluetooth".action.spawn = [ "blueman-manager" ];
     "XF86Display".action.spawn = [ "nwg-displays" ];
@@ -62,9 +53,11 @@
     "Mod+A".action.spawn = [ "zeditor" ];
     "Mod+C".action.spawn = [ "kitty" "btop" ];
     "Mod+Shift+C".action.spawn = [ "kitty" "zsh" "-c" "fastfetch; exec zsh -i" ];
-    "Mod+D".action.spawn = [ "steam" "steam://open/bigpicture" ];
-    "Mod+Shift+D".action.spawn = [ "steam" ];
+    "Mod+Shift+D".action.spawn = [ "steam" "-system-composer" "steam://open/bigpicture" ];
+    "Mod+D".action.spawn = [ "prismlauncher" ];
 
+    "Mod+X".action.spawn-sh = "dunstctl close-all && pkill -SIGUSR2 waybar && systemctl --user restart awww hypridle";
+    "Mod+K".action.spawn-sh = "notify-send -u critical ${hostname} 'Focus Mode' && notify-send '(SUPER+X to reset)' && systemctl --user stop awww && pkill -SIGUSR1 waybar";
     "Mod+L".action.spawn = [ "loginctl" "lock-session" ];
   };
   

From 232aae838b78f93d518f41b74c213cbdb9e8a65a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 9 Jul 2026 16:43:11 +0700
Subject: [PATCH 364/427] update flake

---
 flake.lock | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/flake.lock b/flake.lock
index 2893c06..da78932 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1781255309,
-        "narHash": "sha256-n2P5xkAYGylrJ3feu7L6uaCUw/+jW8rk+HO127gDbFA=",
+        "lastModified": 1783545128,
+        "narHash": "sha256-APzF91kOgKOHwx/KRu7710A8MYihVtKmUbjK5dAIltc=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "036c78ea4cd8a42c8546c6316a944fd7d59d4341",
+        "rev": "28731a367cfd8fb1eaec31d72bb75fee43971db4",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781557312,
-        "narHash": "sha256-QOIRYSUFSq7L5mY3dZymaVhcnne3tPgoR9riB0WocjA=",
+        "lastModified": 1783550008,
+        "narHash": "sha256-qbbZUk9IG9dLNwCPwdPBs6I5clxwugRpP+1YU+GPK20=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c03e4752899e55705dfa63979abd885c582a5c48",
+        "rev": "f4d01c1d87c7c2ec909549165d5a8338f1bd3315",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1780375694,
-        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
+        "lastModified": 1783481424,
+        "narHash": "sha256-nUhKyzWO6YiyeTA+M/dNDGT2eLp8t5KIij8oIPlIUnw=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
+        "rev": "c0e5c94056ff42c1671aac5398c5d71df39c4e74",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1783267733,
-        "narHash": "sha256-DTvaM+0vanneOcKg3NKXV7ilf0ShY4BOBz/nde5GHos=",
+        "lastModified": 1783526091,
+        "narHash": "sha256-Zkkil0e8Wg5BcBmJkWJwBXlETefYQbYKw72xJUIBPLE=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "74053f79cad0f6c3a4a0be6b7928795d2e6a9f4b",
+        "rev": "a24d4c0dce53fd8dbeb9ad20411e282c7b9875f1",
         "type": "github"
       },
       "original": {
@@ -155,11 +155,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1783248941,
-        "narHash": "sha256-citgYJbvR1iUKXpiWlFq3NO+fw6hXGL3Qk1ampU7lhA=",
+        "lastModified": 1783522755,
+        "narHash": "sha256-dI0HkX1djETia7cD/Y64h8BNIsSOfTRMzfNum2J6UhE=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "a30ca7983b2f1fc3ddeb209b3fe18fa78e0dbd25",
+        "rev": "0777769e719b7c9b7c980d4ea66288bfbb4da5b3",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781173989,
-        "narHash": "sha256-zqS1Hjp9o14nN/YhXu/uqm36ot058fF9wmd7/H/hRKc=",
-        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
+        "lastModified": 1782918843,
+        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
+        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1015022.8c91a71d1345/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -246,11 +246,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1783224372,
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
         "type": "github"
       },
       "original": {

From bb515001916a7e37e0c013311aaeac183ea4f777 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 9 Jul 2026 16:43:38 +0700
Subject: [PATCH 365/427] add keybinds

---
 modules/home/rice/keybinds.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 6a96c10..aea5e72 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -22,6 +22,8 @@
     "Mod+Shift+Down".action.move-window-down-or-to-workspace-down = {};
     "Mod+Shift+Left".action.move-column-left = {};
     "Mod+Shift+Right".action.move-column-right = {};
+    "Mod+Ctrl+Left".action.set-column-width = [ "-5%" ];
+    "Mod+Ctrl+Right".action.set-column-width = [ "+5%" ];
 
     "Mod+G".action.center-column = {};
     "Mod+F".action.toggle-window-floating = {};

From cdfdddcfeccfd1141cea2e780384ea56e05d88c9 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 11 Jul 2026 22:10:30 +0700
Subject: [PATCH 366/427] copyparty flake

---
 flake.nix                      | 1 +
 modules/system/homelab/cdn.nix | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index 6f756b4..10f586b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,6 +12,7 @@
     
     niri.url = "github:sodiboo/niri-flake";
     mc.url = "github:Infinidoge/nix-minecraft";
+    cp.url = "github:9001/copyparty";
   };
 
   outputs = inputs: let
diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index a2bd042..85b4537 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,5 +1,7 @@
-{ pkgs, ... }: {
+{ inputs, pkgs, ... }: {
   environment.systemPackages = with pkgs; [ copyparty-most ];
+  nixpkgs.overlays = [ inputs.cp.overlays.default ];
+  imports = [ inputs.cp.nixosModules.default ];
 
   systemd.services.copyparty = {
     description = "File Sharing Service";
@@ -7,7 +9,7 @@
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      ExecStart = "${pkgs.copyparty}/bin/copyparty -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
     };
   };

From 5175119fee992fab124d0f1723510bebf538ab51 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 11 Jul 2026 22:16:04 +0700
Subject: [PATCH 367/427] push lock file

---
 flake.lock | 82 +++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 66 insertions(+), 16 deletions(-)

diff --git a/flake.lock b/flake.lock
index da78932..ed5bf65 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,8 +1,27 @@
 {
   "nodes": {
+    "cp": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1783637983,
+        "narHash": "sha256-zKYemA+ZGFiW7ac5+9w8FEounKLt4eOb7HI17wp1Rxs=",
+        "owner": "9001",
+        "repo": "copyparty",
+        "rev": "96bafb8f4af83bb7473b75e4b77ab8e1445e6b46",
+        "type": "github"
+      },
+      "original": {
+        "owner": "9001",
+        "repo": "copyparty",
+        "type": "github"
+      }
+    },
     "ctp": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1783545128,
@@ -35,6 +54,21 @@
       }
     },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1678901627,
+        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": "systems"
       },
@@ -54,8 +88,8 @@
     },
     "gl": {
       "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2"
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1762090880,
@@ -95,7 +129,7 @@
     "mc": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "systems": "systems_2"
       },
       "locked": {
@@ -116,7 +150,7 @@
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
@@ -170,15 +204,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782918843,
-        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
-        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
+        "lastModified": 1748162331,
+        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+        "id": "nixpkgs",
+        "ref": "nixos-25.05",
+        "type": "indirect"
       }
     },
     "nixpkgs-stable": {
@@ -198,6 +234,19 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1782918843,
+        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
+        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1746378225,
         "narHash": "sha256-OeRSuL8PUjIfL3Q0fTbNJD/fmv1R+K2JAOqWJd3Oceg=",
@@ -212,7 +261,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1769461804,
         "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
@@ -228,7 +277,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -244,7 +293,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -262,12 +311,13 @@
     },
     "root": {
       "inputs": {
+        "cp": "cp",
         "ctp": "ctp",
         "gl": "gl",
         "hm": "hm",
         "mc": "mc",
         "niri": "niri",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_6"
       }
     },
     "systems": {

From 99bf98c716455306935857137fab277611318b87 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 11 Jul 2026 22:20:57 +0700
Subject: [PATCH 368/427] deactivate all mc servers

---
 modules/system/homelab/mc/mc0-vanilla-plus.nix | 2 +-
 modules/system/homelab/mc/mc1-pure-vanilla.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index 79f86bc..bbcc0e0 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -18,7 +18,7 @@ in {
   };
   
   services.minecraft-servers.servers.${name} = {
-    enable = true;
+    enable = false;
     autoStart = true;
     restart = "always";
     
diff --git a/modules/system/homelab/mc/mc1-pure-vanilla.nix b/modules/system/homelab/mc/mc1-pure-vanilla.nix
index 951b5f9..6b64a85 100644
--- a/modules/system/homelab/mc/mc1-pure-vanilla.nix
+++ b/modules/system/homelab/mc/mc1-pure-vanilla.nix
@@ -11,7 +11,7 @@
   };
 in {
   services.minecraft-servers.servers.${name} = {
-    enable = true;
+    enable = false;
     autoStart = true;
     restart = "always";
     

From 3fc3bdc325bf3919498a233514d97d85763d29a2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 11 Jul 2026 22:30:48 +0700
Subject: [PATCH 369/427] fix lockfile

---
 flake.lock | 49 ++++++++++++++++++-------------------------------
 flake.nix  |  5 ++++-
 2 files changed, 22 insertions(+), 32 deletions(-)

diff --git a/flake.lock b/flake.lock
index ed5bf65..520c537 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,7 +3,9 @@
     "cp": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1783637983,
@@ -21,7 +23,7 @@
     },
     "ctp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1783545128,
@@ -89,7 +91,7 @@
     "gl": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1762090880,
@@ -129,7 +131,7 @@
     "mc": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_3",
         "systems": "systems_2"
       },
       "locked": {
@@ -150,7 +152,7 @@
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_4",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
@@ -204,17 +206,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748162331,
-        "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334",
-        "type": "github"
+        "lastModified": 1782918843,
+        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
+        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
       },
       "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-25.05",
-        "type": "indirect"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
     "nixpkgs-stable": {
@@ -234,19 +234,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1782918843,
-        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
-        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1746378225,
         "narHash": "sha256-OeRSuL8PUjIfL3Q0fTbNJD/fmv1R+K2JAOqWJd3Oceg=",
@@ -261,7 +248,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1769461804,
         "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
@@ -277,7 +264,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -293,7 +280,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -317,7 +304,7 @@
         "hm": "hm",
         "mc": "mc",
         "niri": "niri",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_5"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index 10f586b..4e43887 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,7 +12,10 @@
     
     niri.url = "github:sodiboo/niri-flake";
     mc.url = "github:Infinidoge/nix-minecraft";
-    cp.url = "github:9001/copyparty";
+    cp = {
+      url = "github:9001/copyparty";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs: let

From 83d1f4086dee92c02abbd88a806bb9e6799b7420 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 11 Jul 2026 22:35:42 +0700
Subject: [PATCH 370/427] cp: follow root nixpkgs to fix copyparty eval error

---
 modules/home/core/code.nix     | 4 ++--
 modules/home/rice/cursor.nix   | 6 ++++--
 modules/home/rice/keybinds.nix | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/modules/home/core/code.nix b/modules/home/core/code.nix
index 8596eb2..044f3a7 100644
--- a/modules/home/core/code.nix
+++ b/modules/home/core/code.nix
@@ -44,8 +44,8 @@
         default_model = {
           provider = "copilot_chat";
           model = "claude-sonnet-5";
-          effort = "high";
-          enable_thinking = false;
+          effort = "low";
+          enable_thinking = true;
         };
       };
       theme = {
diff --git a/modules/home/rice/cursor.nix b/modules/home/rice/cursor.nix
index 9a193c5..d2f0963 100644
--- a/modules/home/rice/cursor.nix
+++ b/modules/home/rice/cursor.nix
@@ -1,8 +1,10 @@
-{ pkgs, ctp-opt, ... }: {
+{ lib, pkgs, ctp-opt, ... }: {
+  catppuccin.cursors.enable = false; # managed manually below to use the "Light" cursor variant
+
   home.pointerCursor = {
     gtk.enable = true;
     package = pkgs.catppuccin-cursors."${ctp-opt.flavor}Light";
-    name = "catppuccin-${ctp-opt.flavor}-light-cursors";
+    name = lib.mkOverride 30 "catppuccin-${ctp-opt.flavor}-light-cursors";
     size = 24;
   };
 }
\ No newline at end of file
diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index aea5e72..0f00ca9 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -1,4 +1,4 @@
-{ hostname, ... }: {
+{ pkgs, lib, hostname, ... }: {
   programs.niri.settings.binds = {
     "XF86AudioRaiseVolume" = { action.spawn = [ "wpctl" "set-volume" "-l" "1" "@DEFAULT_AUDIO_SINK@" "5%+" ]; allow-when-locked = true; };
     "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-" ]; allow-when-locked = true; };
@@ -54,6 +54,7 @@
     "Mod+V".action.spawn = [ "rofi" "-modi" "clipboard:cliphist-rofi-img" "-show" "clipboard" "-show-icons" ];
     "Mod+A".action.spawn = [ "zeditor" ];
     "Mod+C".action.spawn = [ "kitty" "btop" ];
+    "Mod+Shift+F".action.spawn-sh = "${lib.getExe pkgs.labwc} $$ WAYLAND_DISPLAY=wayland-1 ${lib.getExe pkgs.kitty}";
     "Mod+Shift+C".action.spawn = [ "kitty" "zsh" "-c" "fastfetch; exec zsh -i" ];
     "Mod+Shift+D".action.spawn = [ "steam" "-system-composer" "steam://open/bigpicture" ];
     "Mod+D".action.spawn = [ "prismlauncher" ];

From 9248d2d424d1f7e74a6a03d64934b27aa6552fd7 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 11:49:14 +0700
Subject: [PATCH 371/427] give it time, update lock file

---
 flake.lock                                    | 49 ++++++++++++-------
 flake.nix                                     |  5 +-
 .../system/homelab/mc/mc0-vanilla-plus.nix    |  2 +-
 3 files changed, 33 insertions(+), 23 deletions(-)

diff --git a/flake.lock b/flake.lock
index 520c537..19c0928 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,9 +3,7 @@
     "cp": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1783637983,
@@ -23,7 +21,7 @@
     },
     "ctp": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1783545128,
@@ -91,7 +89,7 @@
     "gl": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1762090880,
@@ -131,7 +129,7 @@
     "mc": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "systems": "systems_2"
       },
       "locked": {
@@ -152,7 +150,7 @@
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
@@ -206,15 +204,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782918843,
-        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
-        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+        "id": "nixpkgs",
+        "ref": "nixos-25.05",
+        "type": "indirect"
       }
     },
     "nixpkgs-stable": {
@@ -234,6 +234,19 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1782918843,
+        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
+        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1746378225,
         "narHash": "sha256-OeRSuL8PUjIfL3Q0fTbNJD/fmv1R+K2JAOqWJd3Oceg=",
@@ -248,7 +261,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1769461804,
         "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
@@ -264,7 +277,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -280,7 +293,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -304,7 +317,7 @@
         "hm": "hm",
         "mc": "mc",
         "niri": "niri",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_6"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index 4e43887..10f586b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,10 +12,7 @@
     
     niri.url = "github:sodiboo/niri-flake";
     mc.url = "github:Infinidoge/nix-minecraft";
-    cp = {
-      url = "github:9001/copyparty";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    cp.url = "github:9001/copyparty";
   };
 
   outputs = inputs: let
diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index bbcc0e0..79f86bc 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -18,7 +18,7 @@ in {
   };
   
   services.minecraft-servers.servers.${name} = {
-    enable = false;
+    enable = true;
     autoStart = true;
     restart = "always";
     

From b3e154a0b63e9f20784354871d8dc75efb7beb30 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 11:49:30 +0700
Subject: [PATCH 372/427] copyparty package change

---
 modules/system/homelab/cdn.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 85b4537..7ec0b81 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,6 +1,5 @@
 { inputs, pkgs, ... }: {
   environment.systemPackages = with pkgs; [ copyparty-most ];
-  nixpkgs.overlays = [ inputs.cp.overlays.default ];
   imports = [ inputs.cp.nixosModules.default ];
 
   systemd.services.copyparty = {
@@ -9,7 +8,7 @@
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      ExecStart = "${pkgs.copyparty}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
     };
   };

From 8a16b161d9cd060380839c9be29ac1053d8f9f3b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 11:52:04 +0700
Subject: [PATCH 373/427] extra user groups

---
 modules/system/user.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/system/user.nix b/modules/system/user.nix
index 5f50a54..74a8b45 100644
--- a/modules/system/user.nix
+++ b/modules/system/user.nix
@@ -17,6 +17,8 @@
       "plugdev"
       "adbusers"
       "kvm"
+      "video"
+      "render"
     ];
   };
 }

From 85c19f8b433a1fde5e1685a2e96660a834f1a491 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 11:52:57 +0700
Subject: [PATCH 374/427] nix ld

---
 modules/system/desktop.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/system/desktop.nix b/modules/system/desktop.nix
index 04cb286..ec264eb 100644
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -11,6 +11,12 @@
   ];
 
   programs = {
+    nix-ld = {
+      enable = true;
+      libraries = with pkgs; [
+        libxcursor libx11 libxi libxkbcommon
+      ];
+    };
     niri = {
       enable = true;
       package = pkgs.niri-unstable;

From 309ef2ecfe61a55f93f0c7bb6ac0d3dbc5aa6e9f Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 12:14:08 +0700
Subject: [PATCH 375/427] cursor fix

---
 modules/home/rice/cursor.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/home/rice/cursor.nix b/modules/home/rice/cursor.nix
index d2f0963..293907a 100644
--- a/modules/home/rice/cursor.nix
+++ b/modules/home/rice/cursor.nix
@@ -2,9 +2,10 @@
   catppuccin.cursors.enable = false; # managed manually below to use the "Light" cursor variant
 
   home.pointerCursor = {
+    enable = true;
     gtk.enable = true;
     package = pkgs.catppuccin-cursors."${ctp-opt.flavor}Light";
     name = lib.mkOverride 30 "catppuccin-${ctp-opt.flavor}-light-cursors";
     size = 24;
   };
-}
\ No newline at end of file
+}

From 595e177ea8a4245056117650f351d6a5c4631ba8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 12:11:55 +0700
Subject: [PATCH 376/427] fix throttled dbus fail

---
 modules/hardware/thinkpad.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/hardware/thinkpad.nix b/modules/hardware/thinkpad.nix
index f7e193a..c976402 100644
--- a/modules/hardware/thinkpad.nix
+++ b/modules/hardware/thinkpad.nix
@@ -28,6 +28,13 @@
       "nvme_core.default_ps_max_latency_us=0"
     ];
   };
+  nixpkgs.overlays = [
+    (final: prev: {
+      throttled = prev.throttled.overrideAttrs (old: {
+        pythonPath = (old.pythonPath or []) ++ [ final.python3Packages.dbus-next ];
+      });
+    })
+  ];
   hardware.bluetooth = {
     enable = true;
     powerOnBoot = false;

From fe1820fdb88b6cb4a02d2c7402f2b735790ed43b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 12:16:39 +0700
Subject: [PATCH 377/427] fix typo

---
 modules/home/rice/keybinds.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 0f00ca9..99f5405 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -54,7 +54,7 @@
     "Mod+V".action.spawn = [ "rofi" "-modi" "clipboard:cliphist-rofi-img" "-show" "clipboard" "-show-icons" ];
     "Mod+A".action.spawn = [ "zeditor" ];
     "Mod+C".action.spawn = [ "kitty" "btop" ];
-    "Mod+Shift+F".action.spawn-sh = "${lib.getExe pkgs.labwc} $$ WAYLAND_DISPLAY=wayland-1 ${lib.getExe pkgs.kitty}";
+    "Mod+Shift+F".action.spawn-sh = "${lib.getExe pkgs.labwc} & WAYLAND_DISPLAY=wayland-1 ${lib.getExe pkgs.kitty}";
     "Mod+Shift+C".action.spawn = [ "kitty" "zsh" "-c" "fastfetch; exec zsh -i" ];
     "Mod+Shift+D".action.spawn = [ "steam" "-system-composer" "steam://open/bigpicture" ];
     "Mod+D".action.spawn = [ "prismlauncher" ];

From 2e44ab13f46c2b657c18c15b793a21ed3b1f7d1d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:02:02 +0700
Subject: [PATCH 378/427] labwc fallback for x11

---
 modules/home/rice/keybinds.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 99f5405..8e01baa 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -54,7 +54,8 @@
     "Mod+V".action.spawn = [ "rofi" "-modi" "clipboard:cliphist-rofi-img" "-show" "clipboard" "-show-icons" ];
     "Mod+A".action.spawn = [ "zeditor" ];
     "Mod+C".action.spawn = [ "kitty" "btop" ];
-    "Mod+Shift+F".action.spawn-sh = "${lib.getExe pkgs.labwc} & WAYLAND_DISPLAY=wayland-1 ${lib.getExe pkgs.kitty}";
+    "Mod+Shift+T".action.spawn-sh = "WAYLAND_DISPLAY=wayland-0 ${lib.getExe pkgs.kitty}";
+    "Mod+Shift+F".action.spawn = [ (lib.getExe pkgs.labwc) ];
     "Mod+Shift+C".action.spawn = [ "kitty" "zsh" "-c" "fastfetch; exec zsh -i" ];
     "Mod+Shift+D".action.spawn = [ "steam" "-system-composer" "steam://open/bigpicture" ];
     "Mod+D".action.spawn = [ "prismlauncher" ];

From 1d6b887eaaf9a0e917b3806a89d6278616eb9f7d Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:02:12 +0700
Subject: [PATCH 379/427] alias tweaks

---
 modules/home/core/shell.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index a8d0e67..a26d6d1 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -49,8 +49,6 @@
         "fetch-update" ="rm -f ~/.fetch.sh && wget https://raw.githubusercontent.com/SX-9/fetch.sh/master/fetch.sh -O ~/.fetch.sh && chmod +x ~/.fetch.sh";
         "fetch" = "~/.fetch.sh";
 
-        "hm-sw" = "home-manager switch -b bak-hm --flake";
-        "nix-sw" = "sudo nixos-rebuild switch --flake";
         "nix-hw-conf" = "nixos-generate-config --show-hardware-config";
         "nixos-diff" = "nix build .#nixosConfigurations.$(hostname).config.system.build.toplevel -o /tmp/nix-flake-diff && nvd diff /run/current-system /tmp/nix-flake-diff";
         "cd-conf" = "cd ${flake-path}";
@@ -66,6 +64,8 @@
         "gh-author-setup" = "git config user.name $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user | jq -r .login) && git config user.email $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user/emails | jq -r \".[1].email\")";
         "fg-create-repo" = "git remote add origin ${git.server}/${git.username}/$(basename $PWDw).git && git push";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";
+        "nix-fetch-hash" = "nix store prefetch-url --json";
+        "git-fix" = "git rebase --continue";
         
         "mcl" = "portablemc start -l $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .email) $(cat ~/.minecraft/portablemc-launch-params.json | jq -r .version) --jvm-args=-Xmx6G";
         "mc" = "ferium upgrade; mcl";

From e90b71760fdfecfc197ad34cebb6539726cc0685 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:05:12 +0700
Subject: [PATCH 380/427] use raw script

---
 flake.lock                     | 82 +++++++---------------------------
 flake.nix                      |  1 -
 modules/system/homelab/cdn.nix | 14 +++---
 3 files changed, 25 insertions(+), 72 deletions(-)

diff --git a/flake.lock b/flake.lock
index 19c0928..da78932 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,27 +1,8 @@
 {
   "nodes": {
-    "cp": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1783637983,
-        "narHash": "sha256-zKYemA+ZGFiW7ac5+9w8FEounKLt4eOb7HI17wp1Rxs=",
-        "owner": "9001",
-        "repo": "copyparty",
-        "rev": "96bafb8f4af83bb7473b75e4b77ab8e1445e6b46",
-        "type": "github"
-      },
-      "original": {
-        "owner": "9001",
-        "repo": "copyparty",
-        "type": "github"
-      }
-    },
     "ctp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1783545128,
@@ -54,21 +35,6 @@
       }
     },
     "flake-utils": {
-      "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "inputs": {
         "systems": "systems"
       },
@@ -88,8 +54,8 @@
     },
     "gl": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3"
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1762090880,
@@ -129,7 +95,7 @@
     "mc": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_3",
         "systems": "systems_2"
       },
       "locked": {
@@ -150,7 +116,7 @@
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_4",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
@@ -204,17 +170,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
-        "type": "github"
+        "lastModified": 1782918843,
+        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
+        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
       },
       "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-25.05",
-        "type": "indirect"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
     "nixpkgs-stable": {
@@ -234,19 +198,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1782918843,
-        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
-        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1746378225,
         "narHash": "sha256-OeRSuL8PUjIfL3Q0fTbNJD/fmv1R+K2JAOqWJd3Oceg=",
@@ -261,7 +212,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1769461804,
         "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
@@ -277,7 +228,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -293,7 +244,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1783224372,
         "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
@@ -311,13 +262,12 @@
     },
     "root": {
       "inputs": {
-        "cp": "cp",
         "ctp": "ctp",
         "gl": "gl",
         "hm": "hm",
         "mc": "mc",
         "niri": "niri",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_5"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index 10f586b..6f756b4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,7 +12,6 @@
     
     niri.url = "github:sodiboo/niri-flake";
     mc.url = "github:Infinidoge/nix-minecraft";
-    cp.url = "github:9001/copyparty";
   };
 
   outputs = inputs: let
diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 7ec0b81..407863e 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,14 +1,18 @@
-{ inputs, pkgs, ... }: {
-  environment.systemPackages = with pkgs; [ copyparty-most ];
-  imports = [ inputs.cp.nixosModules.default ];
-
+{ pkgs, ... }: let
+  version = "v1.20.18";
+  executable = pkgs.fetchurl {
+    url = "https://github.com/9001/copyparty/releases/download/${version}/copyparty-en.py";
+    hash = "sha256-8SBrKaLPat80n8sONKQYFeFSQXUnCYtwcOU7SR52h7E=";
+  }; 
+in {
   systemd.services.copyparty = {
     description = "File Sharing Service";
     enable = true;
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      # ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
+      ExecStart = "${pkgs.python3}/bin/python3 ${executable} -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
     };
   };

From 564fc0778f74f770db8f7b2cee39310b335ad271 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:06:09 +0700
Subject: [PATCH 381/427] add renovate

---
 modules/system/homelab/git.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 42048ac..e2ca799 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -57,6 +57,24 @@
       ];
       hostPackages = with pkgs; [ bash coreutils git nix openssh bun ];
     };
+    renovate = {
+      enable = true;
+      schedule = "*:0"; # every hour
+      credentials.RENOVATE_TOKEN = "/mnt/data/apps/renovate/token.env";
+      settings = {
+        platform = "forgejo";
+        endpoint = "https://git.${homelab.domain}";
+        gitAuthor = "renovate <system@${homelab.domain}>";
+        autodiscover = true;
+        nix.enabled = true;
+        lockFileMaintenance = {
+          enabled = true;
+          commitMessageAction = "update lock file(s)";
+          schedule = [ "0 0 * * 0" ]; # weekly
+        };
+      };
+      runtimePackages = with pkgs; [ bun nodejs npm nix ];
+    };
   };
   systemd.services = {
     "gitea-runner-nixos-deploy".restartIfChanged = false;

From 005ef5bd18c274bb56bc4a7a158bc67b57bb9bf2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:12:36 +0700
Subject: [PATCH 382/427] fix runtime pkgs

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index e2ca799..7db62d1 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -73,7 +73,7 @@
           schedule = [ "0 0 * * 0" ]; # weekly
         };
       };
-      runtimePackages = with pkgs; [ bun nodejs npm nix ];
+      runtimePackages = with pkgs; [ bun nix ];
     };
   };
   systemd.services = {

From f45b30fd282569e732f2d1edf344424e593a731b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:15:07 +0700
Subject: [PATCH 383/427] tweak to every midnight saturday

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 7db62d1..94f6230 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -70,7 +70,7 @@
         lockFileMaintenance = {
           enabled = true;
           commitMessageAction = "update lock file(s)";
-          schedule = [ "0 0 * * 0" ]; # weekly
+          schedule = [ "0 0 * * 6" ]; # weekly, start of weekend (Saturday)
         };
       };
       runtimePackages = with pkgs; [ bun nix ];

From 7ea7a14cf4ec40c5bb3f4e83438edf9d35095331 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 12 Jul 2026 15:16:50 +0700
Subject: [PATCH 384/427] fix cron

---
 modules/system/homelab/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/git.nix b/modules/system/homelab/git.nix
index 94f6230..e2a2c2e 100644
--- a/modules/system/homelab/git.nix
+++ b/modules/system/homelab/git.nix
@@ -70,7 +70,7 @@
         lockFileMaintenance = {
           enabled = true;
           commitMessageAction = "update lock file(s)";
-          schedule = [ "0 0 * * 6" ]; # weekly, start of weekend (Saturday)
+          schedule = [ "* 0 * * 6" ]; # weekly, midnight Saturday 
         };
       };
       runtimePackages = with pkgs; [ bun nix ];

From 526406b9828591bda78f693df1f0c801bf54b651 Mon Sep 17 00:00:00 2001
From: renovate <system@satr14.my.id>
Date: Sun, 12 Jul 2026 15:27:10 +0700
Subject: [PATCH 385/427] Add renovate.json

---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..7190a60
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

From 6b27d852ff3320913c810614ec9a29ee762f7557 Mon Sep 17 00:00:00 2001
From: renovate <system@satr14.my.id>
Date: Sat, 18 Jul 2026 00:01:20 +0700
Subject: [PATCH 386/427] update lock file(s)

---
 flake.lock | 50 +++++++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/flake.lock b/flake.lock
index da78932..1b69fe1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1783545128,
-        "narHash": "sha256-APzF91kOgKOHwx/KRu7710A8MYihVtKmUbjK5dAIltc=",
+        "lastModified": 1783674541,
+        "narHash": "sha256-vmUhEF/jBCZJeK0dInOls+HOAR0yiiQusN1+FZKaJss=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "28731a367cfd8fb1eaec31d72bb75fee43971db4",
+        "rev": "96799f24cf1366fe88e1293c3d27521a8f2129cf",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783550008,
-        "narHash": "sha256-qbbZUk9IG9dLNwCPwdPBs6I5clxwugRpP+1YU+GPK20=",
+        "lastModified": 1784129366,
+        "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f4d01c1d87c7c2ec909549165d5a8338f1bd3315",
+        "rev": "165228b0efefc3e635e5174020c40ea64271dc25",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1783481424,
-        "narHash": "sha256-nUhKyzWO6YiyeTA+M/dNDGT2eLp8t5KIij8oIPlIUnw=",
+        "lastModified": 1784258664,
+        "narHash": "sha256-/1hkRunsSzVmbKKIS84k09ss8kqvNG/gYKqnIOUGkXA=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "c0e5c94056ff42c1671aac5398c5d71df39c4e74",
+        "rev": "0d9d58d2024d823ea167503e26d38a16be0d1e26",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1783526091,
-        "narHash": "sha256-Zkkil0e8Wg5BcBmJkWJwBXlETefYQbYKw72xJUIBPLE=",
+        "lastModified": 1784189744,
+        "narHash": "sha256-D8oh9imibOynWAOUnvgG3w2EKDYqf8OTTaLCcTA4ePg=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "a24d4c0dce53fd8dbeb9ad20411e282c7b9875f1",
+        "rev": "f4b479398c967d2c8d5a38b6d2c87283ae5078c4",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782918843,
-        "narHash": "sha256-mFP086y1bNA1g9AsY/pCue3H3W2R7ayroHyRbZrcMf0=",
-        "rev": "e8273b29fe1390ec8d4603f2477357555291432e",
+        "lastModified": 1783279667,
+        "narHash": "sha256-2l8yOB5aYd+05Q9V9Y1YhgbSa1j1o5QX+nvYs5FL80A=",
+        "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025900.e8273b29fe13/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1028110.f205b5574fd0/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -230,11 +230,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1783224372,
-        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
         "type": "github"
       },
       "original": {
@@ -246,11 +246,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1783224372,
-        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
         "type": "github"
       },
       "original": {
@@ -320,11 +320,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1781226823,
-        "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=",
+        "lastModified": 1783895132,
+        "narHash": "sha256-Dl0Gvrig3EpE962hzF3ETPhUztlfuRhcmlpd8ioHN54=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e",
+        "rev": "a2b5c635d8c8c99b286967658d0d177044887eb8",
         "type": "github"
       },
       "original": {

From 4c902d0dcbf81e7a35820aa9bfb9f7fb40d5f833 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 18:34:34 +0700
Subject: [PATCH 387/427] mc server update and new aeronautics server (modpack
 in progress)

---
 .../system/homelab/mc/mc0-vanilla-plus.nix    |  11 +-
 .../system/homelab/mc/mc1-pure-vanilla.nix    |   8 +-
 .../homelab/mc/mc2-create-aeronautics.nix     | 120 ++++++++++++++++++
 3 files changed, 134 insertions(+), 5 deletions(-)
 create mode 100644 modules/system/homelab/mc/mc2-create-aeronautics.nix

diff --git a/modules/system/homelab/mc/mc0-vanilla-plus.nix b/modules/system/homelab/mc/mc0-vanilla-plus.nix
index 79f86bc..5240835 100644
--- a/modules/system/homelab/mc/mc0-vanilla-plus.nix
+++ b/modules/system/homelab/mc/mc0-vanilla-plus.nix
@@ -3,6 +3,11 @@
   ram-allocation-mb = 8192;
   headroom-allocation-mb = 1024;
   rcon-pass = "howdy";
+  ports = {
+    minecraft = 25565;
+    rcon = 25575;
+  };
+  
   modpack = let
     useLatest = false;
     commit = "86bf13316ed1352a676d9056d284448ea5e5a079";
@@ -18,13 +23,13 @@ in {
   };
   
   services.minecraft-servers.servers.${name} = {
-    enable = true;
+    enable = false;
     autoStart = true;
     restart = "always";
     
     serverProperties = {
       server-ip = "0.0.0.0";
-      server-port = 25565;
+      server-port = ports.minecraft;
       server-name = name;
       motd = "§cCan't connect to server";
       log-ips = false;
@@ -49,7 +54,7 @@ in {
       enable-rcon = true;
       sync-chunk-writes = false;
       "rcon.password" = rcon-pass;
-      "rcon.port" = 25575;
+      "rcon.port" = ports.rcon;
     };
     
     symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
diff --git a/modules/system/homelab/mc/mc1-pure-vanilla.nix b/modules/system/homelab/mc/mc1-pure-vanilla.nix
index 6b64a85..9268e35 100644
--- a/modules/system/homelab/mc/mc1-pure-vanilla.nix
+++ b/modules/system/homelab/mc/mc1-pure-vanilla.nix
@@ -3,6 +3,10 @@
   ram-allocation-mb = 8192;
   headroom-allocation-mb = 1024;
   rcon-pass = "howdy";
+  ports = {
+    minecraft = 25566;
+    rcon = 25576;
+  };
   
   modpack = pkgs.fetchModrinthModpack {
     url = "https://cdn.modrinth.com/data/2wkV8mHp/versions/mFGJP1Ye/Server%20Optimization%201.21.11-2.1.mrpack";
@@ -17,7 +21,7 @@ in {
     
     serverProperties = {
       server-ip = "0.0.0.0";
-      server-port = 25566;
+      server-port = ports.minecraft;
       server-name = name;
       motd = "§cCan't connect to server";
       log-ips = false;
@@ -42,7 +46,7 @@ in {
       enable-rcon = true;
       sync-chunk-writes = false;
       "rcon.password" = rcon-pass;
-      "rcon.port" = 25576;
+      "rcon.port" = ports.rcon;
     };
     
     files = inputs.mc.lib.collectFilesAt modpack "config";
diff --git a/modules/system/homelab/mc/mc2-create-aeronautics.nix b/modules/system/homelab/mc/mc2-create-aeronautics.nix
new file mode 100644
index 0000000..0e557c7
--- /dev/null
+++ b/modules/system/homelab/mc/mc2-create-aeronautics.nix
@@ -0,0 +1,120 @@
+{ inputs, lib, pkgs, ... }: let
+  name = "mc2-create-aeronautics";
+  ram-allocation-mb = 12288;
+  headroom-allocation-mb = 2048;
+  rcon-pass = "howdy";
+  ports = {
+    minecraft = 25567;
+    rcon = 25577;
+  };
+  
+  modpack = let
+    useLatest = true;
+    commit = "";
+    path = if !useLatest then "commit/${commit}" else "branch/main";
+  in pkgs.fetchPackwizModpack {
+    packHash = "";
+    url = "https://git.satr14.my.id/satr14/create-modpack/raw/${path}/pack.toml";
+  };
+in {
+  systemd.services."minecraft-server-${name}" = {
+    environment.LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib"; # physics toys mod fix
+    # serviceConfig.Nice = -5; # higher scheduling priority (causes fan noise even when idle)
+  };
+  
+  services.minecraft-servers.servers.${name} = {
+    enable = true;
+    autoStart = true;
+    restart = "always";
+    
+    serverProperties = {
+      server-ip = "0.0.0.0";
+      server-port = ports.minecraft;
+      server-name = name;
+      motd = "§cCan't connect to server";
+      log-ips = false;
+      hide-online-players = true; 
+      
+      difficulty = "normal";
+      gamemode = "survival";
+      max-world-size = 25000;
+      spawn-protection = 0;
+      pvp = true;
+      
+      online-mode = true;
+      enable-query = true;
+      enforce-secure-profile = false;
+      pevent-proxy-connections = false;
+      allow-flight = false;
+      player-idle-timeout = 0;
+      
+      view-distance = 12;
+      simulation-distance = 6;
+      
+      enable-rcon = true;
+      sync-chunk-writes = false;
+      "rcon.password" = rcon-pass;
+      "rcon.port" = ports.rcon;
+    };
+    
+    symlinks = inputs.mc.lib.collectFilesAt modpack "mods" // {
+      "polymer/packsquash" = let packsquash-binary = pkgs.runCommand "packsquash" {
+        src = pkgs.fetchurl {
+          url = "https://github.com/ComunidadAylas/PackSquash/releases/download/v0.4.1/packsquash-x86_64-unknown-linux-gnu.zip";
+          sha256 = "sha256-VsGZewoiO5MjhIhwjlLO5d5uHynlAK5Jh16jH2k2rPs=";
+        };
+        nativeBuildInputs = [ pkgs.unzip ];
+      } ''
+        mkdir -p $out/bin
+        unzip $src -d $out/bin
+        chmod +x $out/bin/packsquash
+      ''; in "${packsquash-binary}/bin/packsquash";
+    };
+
+    files = inputs.mc.lib.collectFilesAt modpack "config" // {
+      "config/proxy_protocol_support.json".value = {
+        enableProxyProtocol = false; # polymer auto host has issues with proxy protocol
+        whitelistTCPShieldServers = false;
+        proxyServerIPs = [ "127.0.0.1" "::1" ];
+        directAccessIPs = [ "127.0.0.0/8" "::1/128" ];
+      };
+    };
+    
+    extraStartPre = let sed-commands = lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (substitution: file: 
+        ''sed -i "s|${substitution}|''${${substitution}}|g" ${file}''
+      ) {
+        "REPLACE_SVC_HOST"      = "config/voicechat/voicechat-server.properties";
+        "REPLACE_RP_LINK"       = "config/welcomemessage.json5";
+        "REPLACE_DC_BOT_TOKEN"  = "config/simple-discord-link/simple-discord-link.toml";
+        "REPLACE_DC_OWNER_ROLE" = "config/simple-discord-link/simple-discord-link.toml";
+      }
+    ); in ''
+      # shellcheck disable=SC1091
+      if [ -f modpack-config.env ]; then
+        source modpack-config.env
+        ${sed-commands}
+      fi
+    '';
+    
+    package = pkgs.fabricServers.fabric-1_21_11.override {
+      jre_headless = pkgs.javaPackages.compiler.temurin-bin.jdk-25;
+      loaderVersion = "0.19.2";
+    };
+
+    jvmOpts = let flags = [
+      "-Xms${toString ram-allocation-mb}M"
+      "-Xmx${toString ram-allocation-mb}M"
+      
+      "-XX:+UseZGC" # Use ZGC (requires Java v25+, 8+ CPU cores, 10GB+ RAM)
+      "-XX:+ZGenerational" # Use generational ZGC (newer and better ZGC, requires Java v21+)
+      "-XX:+UseCompactObjectHeaders" # Use compact object headers (requires Java v16+, saves a couple of bits per object)
+      
+      "--add-modules=jdk.incubator.vector" # Exposes SIMD instructions (requires full JDK, useful with performance mods like C2ME)
+      "-XX:+AlwaysPreTouch" # Pre-allocates memory on startup, OS claims it immediately for JVM instead of negotiating it
+      "-XX:+DisableExplicitGC" # Disables mods from manually invoking the GC
+      "-XX:+PerfDisableSharedMem" # Disables constant /tmp writes for JVM metrics
+      "-XX:SoftMaxHeapSize=${toString (ram-allocation-mb - headroom-allocation-mb)}M" # Leave 2GB headroom
+    ]; in lib.concatStringsSep " " flags;
+  };
+}
\ No newline at end of file

From 610183cd85c9413e3d1fd380e172836443fe9fc6 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 18:34:48 +0700
Subject: [PATCH 388/427] keybind tweaks and additions

---
 modules/home/rice/keybinds.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 8e01baa..a738878 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -10,8 +10,9 @@
     "Mod+Q".action.close-window = {};
     "Mod+W".action.maximize-column = {};
     "Mod+S".action.fullscreen-window = {};
-    "Alt+Print".action.screenshot-window = {};
-    "Print".action.screenshot-screen = {};
+    "Ctrl+Print".action.screenshot-window = {};
+    "Alt+Print".action.screenshot-screen = {};
+    "Print".action.screenshot = {};
     
     "Mod+Up".action.focus-workspace-up = {};
     "Mod+Down".action.focus-workspace-down = {};
@@ -30,7 +31,8 @@
     "Alt+Space".action.toggle-overview = {};
     
     "Mod+Space" = { action.spawn = [ "playerctl" "play-pause" ]; allow-when-locked = true; };
-    "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" "" "-run-command" "uwsm app -- {cmd}" ];
+    "Mod+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" "" "-run-command" "{cmd}" ];
+    "Mod+Shift+R".action.spawn = [ "rofi" "-show" "drun" "-show-icons" "-display-drun" "wayland-0" "-run-command" "sh -c 'WAYLAND_DISPLAY=wayland-0 DISPLAY=:1 exec {cmd}'" ];
     
     "Mod+E".action.spawn = [ "pcmanfm-qt" ];
     "Mod+T".action.spawn = [ "kitty" ];

From 7b9ce69c76c752eb41efa47a0c463922151d4f44 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 18:52:01 +0700
Subject: [PATCH 389/427] LOCK IN: disable all distractions

---
 modules/home/core/apps.nix            | 7 ++++---
 modules/system/homelab/dns.nix        | 8 ++++++++
 modules/system/homelab/mc/default.nix | 3 ++-
 modules/system/homelab/media.nix      | 3 ++-
 modules/system/misc/programs.nix      | 3 ++-
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 214a70c..736f4a8 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -45,8 +45,9 @@
     gpu-screen-recorder
     gpu-screen-recorder-gtk
 
-    (prismlauncher.override {
-      jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
-    })
+    # LOCK IN
+    # (prismlauncher.override {
+    #   jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
+    # })
   ];
 }
diff --git a/modules/system/homelab/dns.nix b/modules/system/homelab/dns.nix
index a1ddbb3..4f208da 100644
--- a/modules/system/homelab/dns.nix
+++ b/modules/system/homelab/dns.nix
@@ -21,6 +21,13 @@
   whitelist = [
     "https://gist.githubusercontent.com/mul14/eb05e88fcec5bb195cbb/raw/75a1fe122a4502e8d5a5268c9d0ec28332b19d5d/hosts"
   ];
+  blocked = [
+    # LOCK IN
+    "instagram"
+    "youtube"
+    "minecraft"
+    "steam"
+  ];
 in {
   services.adguardhome = {
     enable = true;
@@ -31,6 +38,7 @@ in {
       dns = {
         upstream_dns = [ "https://security.cloudflare-dns.com/dns-query" ];
         bootstrap_dns = [ "1.1.1.2" "1.0.0.2" ];
+        blocked_services = blocked;
       };
       querylog = {
         interval = "2160h";
diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
index ae55545..2217a08 100644
--- a/modules/system/homelab/mc/default.nix
+++ b/modules/system/homelab/mc/default.nix
@@ -10,7 +10,8 @@
   boot.kernel.sysctl."vm.swappiness" = 10; # reduce swap usage and keep memory performance smooth
 
   services.minecraft-servers = {
-    enable = true;
+    # LOCK IN
+    enable = false;
     eula = true;
     managementSystem.systemd-socket.enable = true;
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
diff --git a/modules/system/homelab/media.nix b/modules/system/homelab/media.nix
index 0c7a17f..8274d1e 100644
--- a/modules/system/homelab/media.nix
+++ b/modules/system/homelab/media.nix
@@ -4,7 +4,8 @@
   ];
   services = {
     jellyfin = {
-      enable = true;
+      # LOCK IN
+      enable = false;
       dataDir = "/mnt/data/apps/jellyfin";
       hardwareAcceleration = {
         enable = true;
diff --git a/modules/system/misc/programs.nix b/modules/system/misc/programs.nix
index 778858b..acc3a7e 100644
--- a/modules/system/misc/programs.nix
+++ b/modules/system/misc/programs.nix
@@ -16,7 +16,8 @@
   };
 
   programs = {
-    steam.enable = true;
+    # LOCK IN
+    # steam.enable = true;
     gdk-pixbuf.modulePackages = [ pkgs.librsvg ];
     appimage = {
       enable = true;

From 8953a22954b3364e45dd2cba4d9fa8ef79ccd3b8 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 18:57:56 +0700
Subject: [PATCH 390/427] extra aliases

---
 modules/home/core/shell.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/home/core/shell.nix b/modules/home/core/shell.nix
index a26d6d1..70dab70 100644
--- a/modules/home/core/shell.nix
+++ b/modules/home/core/shell.nix
@@ -61,6 +61,9 @@
         "wm-lock" = "wm-ctl dispatch exec loginctl lock-session && notify-send ${hostname} 'Manual lock triggered'";
         "wm-disp" = "wm-ctl dispatch dpms";
 
+        "gz-compress" = "tar -czhf";
+        "gz-extract" = "tar -xzf";
+
         "gh-author-setup" = "git config user.name $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user | jq -r .login) && git config user.email $(gh api -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /user/emails | jq -r \".[1].email\")";
         "fg-create-repo" = "git remote add origin ${git.server}/${git.username}/$(basename $PWDw).git && git push";
         "convert-pdf" = "libreoffice --headless --convert-to pdf";

From 34f882e95c1919345017a5430f972c1abd81966e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 19:04:32 +0700
Subject: [PATCH 391/427] fix adguard conf

---
 modules/system/homelab/dns.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dns.nix b/modules/system/homelab/dns.nix
index 4f208da..3fd1acc 100644
--- a/modules/system/homelab/dns.nix
+++ b/modules/system/homelab/dns.nix
@@ -38,7 +38,7 @@ in {
       dns = {
         upstream_dns = [ "https://security.cloudflare-dns.com/dns-query" ];
         bootstrap_dns = [ "1.1.1.2" "1.0.0.2" ];
-        blocked_services = blocked;
+        blocked_services.ids = blocked;
       };
       querylog = {
         interval = "2160h";

From 2ecf41785c0f8359c5460bc2e3b5025c2623289e Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 19:09:48 +0700
Subject: [PATCH 392/427] fix wrong option

---
 modules/system/homelab/dns.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/dns.nix b/modules/system/homelab/dns.nix
index 3fd1acc..ee7e512 100644
--- a/modules/system/homelab/dns.nix
+++ b/modules/system/homelab/dns.nix
@@ -38,13 +38,13 @@ in {
       dns = {
         upstream_dns = [ "https://security.cloudflare-dns.com/dns-query" ];
         bootstrap_dns = [ "1.1.1.2" "1.0.0.2" ];
-        blocked_services.ids = blocked;
       };
       querylog = {
         interval = "2160h";
         enabled = true;
       };
       filtering = {
+        blocked_services.ids = blocked;
         blocking_mode = "null_ip";
         protection_enabled = true;
         safebrowsing_enabled = true;

From 4d4ee35941bbfddc04b6f529c14bb099b4a964d1 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 19:18:45 +0700
Subject: [PATCH 393/427] enable polkit

---
 modules/system/base.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/base.nix b/modules/system/base.nix
index 2cdea36..49a6995 100644
--- a/modules/system/base.nix
+++ b/modules/system/base.nix
@@ -17,6 +17,7 @@
   environment.localBinInPath = true;
 
   security = {
+    polkit.enable = true;
     sudo.configFile = ''
       Defaults insults
       Defaults passwd_tries = 5

From b2a83760fc8aa83a2550dcdec6459355cae18a55 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 19:52:37 +0700
Subject: [PATCH 394/427] disable hyprland and fix duplicate sunshine

---
 modules/home/rice/compositor.nix | 1 -
 modules/system/desktop.nix       | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 10e0813..1316c62 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -89,7 +89,6 @@
         "wl-paste --type image --watch cliphist store"
 
         "uwsm app -s s -- waybar &"
-        "uwsm app -s b -- sunshine &"
         "uwsm app -s b -- blueman-applet &"
         "uwsm app -s b -- nm-applet &"
         "uwsm app -s b -- tailscale systray &"
diff --git a/modules/system/desktop.nix b/modules/system/desktop.nix
index ec264eb..f1e729d 100644
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -22,7 +22,7 @@
       package = pkgs.niri-unstable;
     };
     hyprland = {
-      enable = true;
+      enable = false;
       withUWSM = true;
       xwayland.enable = true;
       package = pkgs.hyprland; # if rice.enable then inputs.hl.packages."${pkgs.system}".hyprland else pkgs.hyprland;

From 74a739b4e61cf066c5d5ab72a24d41a770ad80cc Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 20:30:35 +0700
Subject: [PATCH 395/427] activation fix

---
 .forgejo/workflows/activate.yml | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/activate.yml b/.forgejo/workflows/activate.yml
index fab8702..29bfb2d 100644
--- a/.forgejo/workflows/activate.yml
+++ b/.forgejo/workflows/activate.yml
@@ -19,14 +19,24 @@ jobs:
           echo "$SSH_KEY" > ./ssh/deploy_key
           chmod 600 ./ssh/deploy_key
           
-      - name: Rebuild and switch
+      - name: Build and set boot configuration
         run: |
           ssh -i ./ssh/deploy_key \
             -o PasswordAuthentication=no \
             -o StrictHostKeyChecking=no \
             -o UserKnownHostsFile=/dev/null \
             root@localhost \
-            "bash -lc 'nixos-rebuild switch --refresh --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
+            "bash -lc 'nixos-rebuild boot --refresh --flake git+http://localhost:5080/satr14/nix-flake#homelab -L'"
+
+      - name: Activate configuration
+        continue-on-error: true
+        run: |
+          ssh -i ./ssh/deploy_key \
+            -o PasswordAuthentication=no \
+            -o StrictHostKeyChecking=no \
+            -o UserKnownHostsFile=/dev/null \
+            root@localhost \
+            "bash -lc 'setsid nohup /nix/var/nix/profiles/system/bin/switch-to-configuration switch > /var/log/nixos-switch.log 2>&1 < /dev/null & disown'"
 
       - name: Notify on failure
         if: failure()
@@ -38,15 +48,6 @@ jobs:
             -H "Actions: view, Action Runs, https://git.satr14.my.id/${{ github.repository }}/actions?workflow=activate.yml; view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
             -d "${{ github.event.head_commit.message }}"
 
-      # - name: Notify on success
-      #   if: success()
-      #   run: |
-      #     curl -s -X POST https://notify.proxy.satr14.my.id/git-flake-updates \
-      #       -H "Title: NixOS Homelab Rebuild Succeeded" \
-      #       -H "Tags: white_check_mark" \
-      #       -H "Actions: view, View Commit, https://git.satr14.my.id/${{ github.repository }}/commit/${{ github.sha }}" \
-      #       -d "${{ github.event.head_commit.message }}"
-
       - name: Clean Up
         if: always()
         run: rm -f ./ssh/deploy_key
\ No newline at end of file

From af7663c618cebc96fd5c5f54338bc2f3f8674056 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sat, 18 Jul 2026 20:45:09 +0700
Subject: [PATCH 396/427] add gh copilot cli

---
 modules/home/core/apps.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 736f4a8..974a602 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -28,6 +28,7 @@
   home.packages = with pkgs; [
     zed-editor
     opencode
+    github-copilot-cli
 
     slack
     discord

From 15c912d324834af5e0261c68195b0978ee8f8000 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 06:26:33 +0700
Subject: [PATCH 397/427] cdn thumbnail support

---
 modules/system/homelab/cdn.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 407863e..573f55c 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,18 +1,21 @@
 { pkgs, ... }: let
-  version = "v1.20.18";
-  executable = pkgs.fetchurl {
+  python = pkgs.python3.withPackages (ps: [ ps.pillow ]);
+  script = let
+    version = "v1.20.18";
+  in pkgs.fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/${version}/copyparty-en.py";
     hash = "sha256-8SBrKaLPat80n8sONKQYFeFSQXUnCYtwcOU7SR52h7E=";
-  }; 
+  };
 in {
   systemd.services.copyparty = {
     description = "File Sharing Service";
     enable = true;
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.ffmpeg ];
     serviceConfig = {
       # ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
-      ExecStart = "${pkgs.python3}/bin/python3 ${executable} -c /mnt/share/cfg/files.conf";
+      ExecStart = "${python}/bin/python3 ${script} -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
     };
   };

From 19ac0c1f66d3fa5d6615307f33300f5d56f5322c Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 18:25:26 +0700
Subject: [PATCH 398/427] add copyparty to shell PATH

---
 modules/system/homelab/cdn.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 573f55c..f06114a 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -6,7 +6,11 @@
     url = "https://github.com/9001/copyparty/releases/download/${version}/copyparty-en.py";
     hash = "sha256-8SBrKaLPat80n8sONKQYFeFSQXUnCYtwcOU7SR52h7E=";
   };
+  executable = pkgs.writeShellScriptBin "copyparty" ''
+    exec ${python}/bin/python3 ${scriptSrc} "$@"
+  '';
 in {
+  environment.systemPackages = [ executable ];
   systemd.services.copyparty = {
     description = "File Sharing Service";
     enable = true;

From ea1c5b81c5bb51ecc10e9e400092d954f0c87e85 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 18:26:20 +0700
Subject: [PATCH 399/427] fix var naming

---
 modules/system/homelab/cdn.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index f06114a..2a0c9d1 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -7,7 +7,7 @@
     hash = "sha256-8SBrKaLPat80n8sONKQYFeFSQXUnCYtwcOU7SR52h7E=";
   };
   executable = pkgs.writeShellScriptBin "copyparty" ''
-    exec ${python}/bin/python3 ${scriptSrc} "$@"
+    exec ${python}/bin/python3 ${script} "$@"
   '';
 in {
   environment.systemPackages = [ executable ];

From bce3e9681838263a95930fc71ebbc530ff1a8b45 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 18:28:46 +0700
Subject: [PATCH 400/427] add argon to deps

---
 modules/system/homelab/cdn.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index 2a0c9d1..af13867 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }: let
-  python = pkgs.python3.withPackages (ps: [ ps.pillow ]);
+  python = pkgs.python3.withPackages (ps: with ps; [ pillow argon2 ]);
   script = let
     version = "v1.20.18";
   in pkgs.fetchurl {

From fd452f0f051e4791a4363ad4d04187a9a1c8ff62 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 18:30:35 +0700
Subject: [PATCH 401/427] fix naming

---
 modules/system/homelab/cdn.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index af13867..cce2941 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }: let
-  python = pkgs.python3.withPackages (ps: with ps; [ pillow argon2 ]);
+  python = pkgs.python3.withPackages (ps: with ps; [ pillow argon2-cffi ]);
   script = let
     version = "v1.20.18";
   in pkgs.fetchurl {

From 5ca814be31230a5c3a350e78d3cdd4b66f47fb92 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 18:37:10 +0700
Subject: [PATCH 402/427] enable hashing

---
 modules/system/homelab/cdn.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/cdn.nix b/modules/system/homelab/cdn.nix
index cce2941..28925f5 100644
--- a/modules/system/homelab/cdn.nix
+++ b/modules/system/homelab/cdn.nix
@@ -19,7 +19,7 @@ in {
     path = [ pkgs.ffmpeg ];
     serviceConfig = {
       # ExecStart = "${pkgs.copyparty-most}/bin/copyparty -c /mnt/share/cfg/files.conf";
-      ExecStart = "${python}/bin/python3 ${script} -c /mnt/share/cfg/files.conf";
+      ExecStart = "${python}/bin/python3 ${script} --ah-alg argon2 -c /mnt/share/cfg/files.conf";
       Restart = "on-failure";
     };
   };

From c609d530627c35d4446bf3a14fa43093a17d6f44 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Sun, 19 Jul 2026 20:01:53 +0700
Subject: [PATCH 403/427] add fix

---
 modules/system/homelab/gallery.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/system/homelab/gallery.nix b/modules/system/homelab/gallery.nix
index 1b52208..c809408 100644
--- a/modules/system/homelab/gallery.nix
+++ b/modules/system/homelab/gallery.nix
@@ -1,4 +1,10 @@
 { lib, ... }: {
+  # fix every update causing error:
+  # > microservices worker error: PostgresError: must be owner of function album_user_after_insert, stack: PostgresError: must be owner of function album_user_after_insert
+  systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''
+    $PSQL -d immich -c "ALTER FUNCTION album_user_after_insert() OWNER TO immich;" || true
+  '';
+
   users.users.immich.extraGroups = [ "video" "render" ];
 
   services = {

From 1bf75d2f1f633ab755bb58654462c5de72faa384 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 11:18:38 +0700
Subject: [PATCH 404/427] cockpit enable

---
 modules/system/homelab/control.nix | 9 +++++++++
 modules/system/server.nix          | 1 +
 2 files changed, 10 insertions(+)
 create mode 100644 modules/system/homelab/control.nix

diff --git a/modules/system/homelab/control.nix b/modules/system/homelab/control.nix
new file mode 100644
index 0000000..82e55c3
--- /dev/null
+++ b/modules/system/homelab/control.nix
@@ -0,0 +1,9 @@
+{ homelab, pkgs, ... }: {
+  services.cockpit = {
+    enable = true;
+    allowed-origins = [ "control.${homelab.proxy.base}" ];
+    plugins = with pkgs; [
+      cockpit-files cockpit-machines
+    ];
+  };
+}
\ No newline at end of file
diff --git a/modules/system/server.nix b/modules/system/server.nix
index 9db8dfa..b59dffe 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -11,6 +11,7 @@ in {
     ./homelab/containers.nix
     ./homelab/gallery.nix
     ./homelab/tunnels.nix
+    ./homelab/control.nix
     ./homelab/notify.nix
     ./homelab/search.nix
     ./homelab/media.nix

From bcd8e6e7dedc688eea4e09712ea54411e5d85ae2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 11:21:16 +0700
Subject: [PATCH 405/427] fix evaluation error

---
 modules/system/homelab/gallery.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/gallery.nix b/modules/system/homelab/gallery.nix
index c809408..74d2ea2 100644
--- a/modules/system/homelab/gallery.nix
+++ b/modules/system/homelab/gallery.nix
@@ -1,4 +1,4 @@
-{ lib, ... }: {
+{ pkgs, lib, ... }: {
   # fix every update causing error:
   # > microservices worker error: PostgresError: must be owner of function album_user_after_insert, stack: PostgresError: must be owner of function album_user_after_insert
   systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''

From b39151dd8e3031d09bdc05939e528b69e0b6802b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 11:59:20 +0700
Subject: [PATCH 406/427] add proxy entry

---
 lib/options.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/options.nix b/lib/options.nix
index cef1177..3c723a5 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -74,6 +74,7 @@ in {
         "code"       = da "http://localhost:8443";
         "dns"        = da "http://localhost:8088";
         
+        "control"    = d "https://localhost:9090";
         "gallery"    = d "http://localhost:2283";
         "dynamic"    = d "http://localhost:8082";
         "search"     = d "http://localhost:8091";

From 72a2679474c9fd347a550fea674207e064d4a715 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 18:47:34 +0700
Subject: [PATCH 407/427] cockpit ssl fix

---
 modules/system/homelab/proxy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/system/homelab/proxy.nix b/modules/system/homelab/proxy.nix
index d977892..5a03057 100644
--- a/modules/system/homelab/proxy.nix
+++ b/modules/system/homelab/proxy.nix
@@ -8,6 +8,7 @@
     proxy_cache off;
     send_timeout 600s;
     client_max_body_size 50000M;
+    proxy_ssl_session_reuse off;
   '';
 in {
   users.users = {

From 3e67b774a3c747ad7d86d2114874c3193b960539 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 18:48:52 +0700
Subject: [PATCH 408/427] waybar icon fix

---
 lib/options.nix           | 2 +-
 modules/home/rice/bar.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 3c723a5..b17825f 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -105,7 +105,7 @@ in {
   };
 
   rice = {
-    font = "monospace"; # global font for rice GUIs, leave empty to use monospace
+    font = "DroidSansM Nerd Font"; # global font for rice GUIs, must be a Nerd Font for icon glyphs to render correctly
     bar = {
       top = true; # false will put the bar at the bottom
       fragmented = true; # enable fragmented bar, false will make it a single block
diff --git a/modules/home/rice/bar.nix b/modules/home/rice/bar.nix
index 4360e9c..cc6b175 100644
--- a/modules/home/rice/bar.nix
+++ b/modules/home/rice/bar.nix
@@ -180,7 +180,7 @@
     style = ''
       * {
         font-size: 12px;
-        font-family: Font Awesome, ${rice.font};
+        font-family: ${rice.font};
         font-weight: bold;
         color: @text;
         transition: none;

From 882cc40d54748b2fea55164f97d979b1c1459e64 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 18:51:08 +0700
Subject: [PATCH 409/427] add cockpit to glance and fully rm cryptpad

---
 lib/options.nix                 |  5 +---
 modules/system/homelab/docs.nix | 46 ---------------------------------
 modules/system/server.nix       |  1 -
 3 files changed, 1 insertion(+), 51 deletions(-)
 delete mode 100644 modules/system/homelab/docs.nix

diff --git a/lib/options.nix b/lib/options.nix
index b17825f..55863b8 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -41,7 +41,7 @@ in {
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
       [ "Forgejo" "forgejo" "https://git.${domain}" "http://localhost:5080/" ]
       [ "Copyparty" "files" "https://cdn.${domain}" "http://localhost:3923/" ]
-      [ "CryptPad" "cryptpad" "https://docs.${domain}" "http://localhost:7090/" ]
+      [ "Cockpit" "cockpit" "https://control.${domain}" "http://localhost:9090/" ]
       [ "CodeServer" "coder" "https://code.proxy.${domain}" "http://localhost:8443/" ]
       [ "AdGuardHome" "adguard" "https://dns.proxy.${domain}" "http://localhost:8088/" ]
       [ "Traefik" "traefikproxy" "https://dynamic.proxy.${domain}/dashboard/" "" ]
@@ -56,9 +56,6 @@ in {
     routes = {
       "mc.${domain}"     = "tcp://localhost:25565";
       
-      "docs-sandbox.${domain}" = "http://localhost:7090";
-      "docs.${domain}"         = "http://localhost:7090";
-      
       "cdn.${domain}"     = selfSigned "https://localhost:3923";
       
       "git.${domain}"     = "http://localhost:5080";
diff --git a/modules/system/homelab/docs.nix b/modules/system/homelab/docs.nix
deleted file mode 100644
index 58d6738..0000000
--- a/modules/system/homelab/docs.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, pkgs, homelab, ... }: let
-  domain = "docs.${homelab.domain}";
-  sandbox = "docs-sandbox.${homelab.domain}";
-in {
-  services.cryptpad = {
-    enable = true;
-    settings = {
-      websocketPort = 7091;
-      httpPort = 7090;
-      httpAddress = "127.0.0.1";
-      httpUnsafeOrigin = "https://${domain}";
-      httpSafeOrigin = "https://${sandbox}";
-      blockDailyCheck = true;
-      disableIntegratedEviction = true;
-      adminKeys = [ 
-        "[satr14@docs.satr14.my.id/f1A82fmBuqQka2bNqrCb1WbB9r2ex5A3rdys5xLX3Hc=]"
-      ];
-    };
-  };
-  
-  systemd.tmpfiles.rules = lib.singleton "L+ /var/lib/cryptpad/customize/application_config.js - - - - ${pkgs.writeText "cryptpad-application-config.js" ''
-    (() => {
-      const factory = (AppConfig) => {
-          AppConfig.disableAnonymousPadCreation = true;
-          AppConfig.disableAnonymousStore = true;
-          AppConfig.defaultDarkTheme = true;
-          return AppConfig;
-      };
-  
-      if (typeof(module) !== 'undefined' && module.exports) {
-          module.exports = factory(
-              require('../www/common/application_config_internal.js')
-          );
-      } else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
-          define(['/common/application_config_internal.js'], factory);
-      }
-    })();
-  ''}";
-  
-  fileSystems."/var/lib/private/cryptpad" = {
-    device = "/mnt/data/apps/cryptpad";
-    depends = [ "/mnt/data" ]; 
-    options = [ "bind" "nofail" ];
-    fsType = "none";
-  };
-}
diff --git a/modules/system/server.nix b/modules/system/server.nix
index b59dffe..7213cdc 100644
--- a/modules/system/server.nix
+++ b/modules/system/server.nix
@@ -20,7 +20,6 @@ in {
     ./homelab/pass.nix
     ./homelab/dash.nix
     ./homelab/code.nix
-    ./homelab/docs.nix
     ./homelab/dns.nix
     ./homelab/git.nix
     ./homelab/cdn.nix

From 6d7cbb1066b013ec0877368c5bca2b1554d1591a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 18:52:33 +0700
Subject: [PATCH 410/427] fix domain url

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 55863b8..433cc0b 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -41,7 +41,7 @@ in {
       [ "PocketID" "authentik" "https://auth.${domain}" "http://localhost:1411/" ]
       [ "Forgejo" "forgejo" "https://git.${domain}" "http://localhost:5080/" ]
       [ "Copyparty" "files" "https://cdn.${domain}" "http://localhost:3923/" ]
-      [ "Cockpit" "cockpit" "https://control.${domain}" "http://localhost:9090/" ]
+      [ "Cockpit" "cockpit" "https://control.proxy.${domain}" "http://localhost:9090/" ]
       [ "CodeServer" "coder" "https://code.proxy.${domain}" "http://localhost:8443/" ]
       [ "AdGuardHome" "adguard" "https://dns.proxy.${domain}" "http://localhost:8088/" ]
       [ "Traefik" "traefikproxy" "https://dynamic.proxy.${domain}/dashboard/" "" ]

From 30f3ef32fadbbab480012615e157d6ec428c8965 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Mon, 20 Jul 2026 18:55:44 +0700
Subject: [PATCH 411/427] fix origins

---
 modules/system/homelab/control.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/homelab/control.nix b/modules/system/homelab/control.nix
index 82e55c3..9522910 100644
--- a/modules/system/homelab/control.nix
+++ b/modules/system/homelab/control.nix
@@ -1,7 +1,7 @@
 { homelab, pkgs, ... }: {
   services.cockpit = {
     enable = true;
-    allowed-origins = [ "control.${homelab.proxy.base}" ];
+    allowed-origins = [ "https://control.proxy.${homelab.domain}" ];
     plugins = with pkgs; [
       cockpit-files cockpit-machines
     ];

From 9daa21567239b3933add540fa43162150dfa6c94 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Tue, 21 Jul 2026 12:43:34 +0700
Subject: [PATCH 412/427] reenable games

---
 modules/home/core/apps.nix                           | 6 +++---
 modules/system/homelab/dns.nix                       | 4 ++--
 modules/system/homelab/mc/default.nix                | 2 +-
 modules/system/homelab/mc/mc2-create-aeronautics.nix | 2 +-
 modules/system/homelab/media.nix                     | 2 +-
 modules/system/misc/programs.nix                     | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 974a602..47614b8 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -47,8 +47,8 @@
     gpu-screen-recorder-gtk
 
     # LOCK IN
-    # (prismlauncher.override {
-    #   jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
-    # })
+    (prismlauncher.override {
+      jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
+    })
   ];
 }
diff --git a/modules/system/homelab/dns.nix b/modules/system/homelab/dns.nix
index ee7e512..9eb0004 100644
--- a/modules/system/homelab/dns.nix
+++ b/modules/system/homelab/dns.nix
@@ -25,8 +25,8 @@
     # LOCK IN
     "instagram"
     "youtube"
-    "minecraft"
-    "steam"
+    # "minecraft"
+    # "steam"
   ];
 in {
   services.adguardhome = {
diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
index 2217a08..09c7e41 100644
--- a/modules/system/homelab/mc/default.nix
+++ b/modules/system/homelab/mc/default.nix
@@ -11,7 +11,7 @@
 
   services.minecraft-servers = {
     # LOCK IN
-    enable = false;
+    enable = true;
     eula = true;
     managementSystem.systemd-socket.enable = true;
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
diff --git a/modules/system/homelab/mc/mc2-create-aeronautics.nix b/modules/system/homelab/mc/mc2-create-aeronautics.nix
index 0e557c7..03f96f8 100644
--- a/modules/system/homelab/mc/mc2-create-aeronautics.nix
+++ b/modules/system/homelab/mc/mc2-create-aeronautics.nix
@@ -23,7 +23,7 @@ in {
   };
   
   services.minecraft-servers.servers.${name} = {
-    enable = true;
+    enable = false;
     autoStart = true;
     restart = "always";
     
diff --git a/modules/system/homelab/media.nix b/modules/system/homelab/media.nix
index 8274d1e..760d2c4 100644
--- a/modules/system/homelab/media.nix
+++ b/modules/system/homelab/media.nix
@@ -5,7 +5,7 @@
   services = {
     jellyfin = {
       # LOCK IN
-      enable = false;
+      enable = true;
       dataDir = "/mnt/data/apps/jellyfin";
       hardwareAcceleration = {
         enable = true;
diff --git a/modules/system/misc/programs.nix b/modules/system/misc/programs.nix
index acc3a7e..ccdbaa1 100644
--- a/modules/system/misc/programs.nix
+++ b/modules/system/misc/programs.nix
@@ -17,7 +17,7 @@
 
   programs = {
     # LOCK IN
-    # steam.enable = true;
+    steam.enable = true;
     gdk-pixbuf.modulePackages = [ pkgs.librsvg ];
     appimage = {
       enable = true;

From 4da395076525f9cac7767a73ffb88fcc810d09ee Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 22 Jul 2026 18:03:14 +0700
Subject: [PATCH 413/427] fix ctrl backspace

---
 modules/home/core/cli.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/home/core/cli.nix b/modules/home/core/cli.nix
index 9e9b94e..2dc4b10 100644
--- a/modules/home/core/cli.nix
+++ b/modules/home/core/cli.nix
@@ -30,6 +30,9 @@
         cursor_trail = 10;
         copy_on_select = true;
       };
+      keybindings = {
+        "ctrl+backspace" = "send_text all \\x17";
+      };
     };
     ranger = {
       enable = true;

From bbfbfc4d183bfc03433c3d58be16def815653272 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Wed, 22 Jul 2026 18:12:39 +0700
Subject: [PATCH 414/427] add keybinds

---
 modules/home/rice/keybinds.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index a738878..00041fe 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -23,8 +23,10 @@
     "Mod+Shift+Down".action.move-window-down-or-to-workspace-down = {};
     "Mod+Shift+Left".action.move-column-left = {};
     "Mod+Shift+Right".action.move-column-right = {};
-    "Mod+Ctrl+Left".action.set-column-width = [ "-5%" ];
-    "Mod+Ctrl+Right".action.set-column-width = [ "+5%" ];
+    "Mod+Ctrl+Left".action.set-window-width = [ "-5%" ];
+    "Mod+Ctrl+Right".action.set-window-width = [ "+5%" ];
+    "Mod+Ctrl+Down".action.set-window-height = [ "+5%" ];
+    "Mod+Ctrl+Up".action.set-window-height = [ "-5%" ];
 
     "Mod+G".action.center-column = {};
     "Mod+F".action.toggle-window-floating = {};

From 62ede598434a888c67474c02eb6e7cf63741aa73 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 12:37:49 +0700
Subject: [PATCH 415/427] fix polki

---
 modules/system/base.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/system/base.nix b/modules/system/base.nix
index 49a6995..3a20057 100644
--- a/modules/system/base.nix
+++ b/modules/system/base.nix
@@ -17,7 +17,10 @@
   environment.localBinInPath = true;
 
   security = {
-    polkit.enable = true;
+    polkit = {
+      enable = true;
+      enablePkexecWrapper = true;
+    };
     sudo.configFile = ''
       Defaults insults
       Defaults passwd_tries = 5

From 22a641b29c6e7ce155a13ae1c9cfbff5391cd070 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 17:35:48 +0700
Subject: [PATCH 416/427] disable plymouth

---
 modules/system/core/bootloader.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/system/core/bootloader.nix b/modules/system/core/bootloader.nix
index cca3d3f..20d65ec 100644
--- a/modules/system/core/bootloader.nix
+++ b/modules/system/core/bootloader.nix
@@ -1,12 +1,11 @@
 { pkgs, legacy-boot, ... }: {
   boot = {
-    plymouth.enable = true;
     loader = {
       efi.canTouchEfiVariables = true;
       systemd-boot = {
         enable = !legacy-boot;
         configurationLimit = 3;
-        sortKey = "z-nixos";
+        sortKey = "nixos";
         editor = false;
       };
       grub = {

From a69e94597dd5c169dd2c2e30df7a6a7642c505c3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 17:36:52 +0700
Subject: [PATCH 417/427] re-lock in

---
 modules/home/core/apps.nix            | 6 +++---
 modules/system/homelab/dns.nix        | 4 ++--
 modules/system/homelab/mc/default.nix | 2 +-
 modules/system/homelab/media.nix      | 1 -
 modules/system/misc/programs.nix      | 2 +-
 5 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/modules/home/core/apps.nix b/modules/home/core/apps.nix
index 47614b8..974a602 100644
--- a/modules/home/core/apps.nix
+++ b/modules/home/core/apps.nix
@@ -47,8 +47,8 @@
     gpu-screen-recorder-gtk
 
     # LOCK IN
-    (prismlauncher.override {
-      jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
-    })
+    # (prismlauncher.override {
+    #   jdks = with javaPackages.compiler.temurin-bin; [ jre-21 jdk-25 ];
+    # })
   ];
 }
diff --git a/modules/system/homelab/dns.nix b/modules/system/homelab/dns.nix
index 9eb0004..ee7e512 100644
--- a/modules/system/homelab/dns.nix
+++ b/modules/system/homelab/dns.nix
@@ -25,8 +25,8 @@
     # LOCK IN
     "instagram"
     "youtube"
-    # "minecraft"
-    # "steam"
+    "minecraft"
+    "steam"
   ];
 in {
   services.adguardhome = {
diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
index 09c7e41..2217a08 100644
--- a/modules/system/homelab/mc/default.nix
+++ b/modules/system/homelab/mc/default.nix
@@ -11,7 +11,7 @@
 
   services.minecraft-servers = {
     # LOCK IN
-    enable = true;
+    enable = false;
     eula = true;
     managementSystem.systemd-socket.enable = true;
     # ^^^ https://github.com/Infinidoge/nix-minecraft/issues/119
diff --git a/modules/system/homelab/media.nix b/modules/system/homelab/media.nix
index 760d2c4..0c7a17f 100644
--- a/modules/system/homelab/media.nix
+++ b/modules/system/homelab/media.nix
@@ -4,7 +4,6 @@
   ];
   services = {
     jellyfin = {
-      # LOCK IN
       enable = true;
       dataDir = "/mnt/data/apps/jellyfin";
       hardwareAcceleration = {
diff --git a/modules/system/misc/programs.nix b/modules/system/misc/programs.nix
index ccdbaa1..acc3a7e 100644
--- a/modules/system/misc/programs.nix
+++ b/modules/system/misc/programs.nix
@@ -17,7 +17,7 @@
 
   programs = {
     # LOCK IN
-    steam.enable = true;
+    # steam.enable = true;
     gdk-pixbuf.modulePackages = [ pkgs.librsvg ];
     appimage = {
       enable = true;

From 627405c572b5767c8874c848b642c43e5bb3265b Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 17:44:29 +0700
Subject: [PATCH 418/427] disable performance profiles

---
 modules/hardware/misc/cpu-freq.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/modules/hardware/misc/cpu-freq.nix b/modules/hardware/misc/cpu-freq.nix
index ad87022..63323a3 100644
--- a/modules/hardware/misc/cpu-freq.nix
+++ b/modules/hardware/misc/cpu-freq.nix
@@ -49,23 +49,27 @@
     };
     auto-cpufreq = {
       enable = true; # wait for fix: https://github.com/AdnanHodzic/auto-cpufreq/issues/906
-      settings = {
-        charger = {
-          governor = "powersave"; # "performance";
+      settings = let
+        performance = {
+          governor = "performance";
           energy_performance_preference = "performance";
           turbo = "always";
           platform_profile = "performance";
           scaling_min_freq = 800000;
           scaling_max_freq = 3600000;
         };
-        battery = {
+        balanced = {
           governor = "powersave";
           energy_performance_preference = "balance-power";
-          platform_profile = "low-power";
           turbo = "never";
+          platform_profile = "balanced";
           scaling_min_freq = 400000;
           scaling_max_freq = 1700000;
         };
+      in {
+        battery = balanced;
+        charger = balanced; # performance;
+        # ^^ disable overclocking for purely productivity use so low temps and fan noise
       };
     };
   };

From 2e50f4940031766d8d607785f0edb776481c013a Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 17:58:24 +0700
Subject: [PATCH 419/427] small ide tweak

---
 modules/home/core/code.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/home/core/code.nix b/modules/home/core/code.nix
index 044f3a7..6803152 100644
--- a/modules/home/core/code.nix
+++ b/modules/home/core/code.nix
@@ -40,6 +40,7 @@
         };
       };
       agent = {
+        sidebar_side = "right";
         tool_permissions.default = "allow";
         default_model = {
           provider = "copilot_chat";

From 800a2f4ad18f5195938a884540769eecac6ded27 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 18:01:41 +0700
Subject: [PATCH 420/427] increase cliphist

---
 modules/home/rice/compositor.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/rice/compositor.nix b/modules/home/rice/compositor.nix
index 1316c62..cca6797 100644
--- a/modules/home/rice/compositor.nix
+++ b/modules/home/rice/compositor.nix
@@ -25,7 +25,7 @@
         XCURSOR_SIZE = "24";
         XCURSOR_THEME = "catppuccin-${ctp-opt.flavor}-light-cursors";
 
-        CLIPHIST_MAX_ITEMS = "36";
+        CLIPHIST_MAX_ITEMS = "90";
 
         GTK_APPLICATION_PREFER_DARK_THEME = "1";
         GTK_THEME = "Adwaita:dark";

From 5d538562d57bb4a03e05db5481ce1ed9be7f1cde Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Thu, 23 Jul 2026 19:21:00 +0700
Subject: [PATCH 421/427] adjust value inc and dec

---
 modules/home/rice/keybinds.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 00041fe..71a7928 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -1,11 +1,11 @@
 { pkgs, lib, hostname, ... }: {
   programs.niri.settings.binds = {
-    "XF86AudioRaiseVolume" = { action.spawn = [ "wpctl" "set-volume" "-l" "1" "@DEFAULT_AUDIO_SINK@" "5%+" ]; allow-when-locked = true; };
-    "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-" ]; allow-when-locked = true; };
+    "XF86AudioRaiseVolume" = { action.spawn = [ "wpctl" "set-volume" "-l" "1" "@DEFAULT_AUDIO_SINK@" "2%+" ]; allow-when-locked = true; };
+    "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "2%-" ]; allow-when-locked = true; };
     "XF86AudioMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle" ]; allow-when-locked = true; };
     "XF86AudioMicMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle" ]; allow-when-locked = true; };
-    "XF86MonBrightnessUp" = { action.spawn = [ "brightnessctl" "s" "10%+" ]; allow-when-locked = true; };
-    "XF86MonBrightnessDown" = { action.spawn = [ "brightnessctl" "s" "10%-" ]; allow-when-locked = true; };
+    "XF86MonBrightnessUp" = { action.spawn = [ "brightnessctl" "s" "2%+" ]; allow-when-locked = true; };
+    "XF86MonBrightnessDown" = { action.spawn = [ "brightnessctl" "s" "2%-" ]; allow-when-locked = true; };
     
     "Mod+Q".action.close-window = {};
     "Mod+W".action.maximize-column = {};
@@ -23,10 +23,10 @@
     "Mod+Shift+Down".action.move-window-down-or-to-workspace-down = {};
     "Mod+Shift+Left".action.move-column-left = {};
     "Mod+Shift+Right".action.move-column-right = {};
-    "Mod+Ctrl+Left".action.set-window-width = [ "-5%" ];
-    "Mod+Ctrl+Right".action.set-window-width = [ "+5%" ];
-    "Mod+Ctrl+Down".action.set-window-height = [ "+5%" ];
-    "Mod+Ctrl+Up".action.set-window-height = [ "-5%" ];
+    "Mod+Ctrl+Left".action.set-window-width = [ "-2%" ];
+    "Mod+Ctrl+Right".action.set-window-width = [ "+2%" ];
+    "Mod+Ctrl+Down".action.set-window-height = [ "+2%" ];
+    "Mod+Ctrl+Up".action.set-window-height = [ "-2%" ];
 
     "Mod+G".action.center-column = {};
     "Mod+F".action.toggle-window-floating = {};

From c9f4ad0e13037bf53e304767134ce74d854c49c2 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 24 Jul 2026 15:21:07 +0700
Subject: [PATCH 422/427] revert brightness

---
 modules/home/rice/keybinds.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/rice/keybinds.nix b/modules/home/rice/keybinds.nix
index 71a7928..d63a7d3 100644
--- a/modules/home/rice/keybinds.nix
+++ b/modules/home/rice/keybinds.nix
@@ -4,8 +4,8 @@
     "XF86AudioLowerVolume" = { action.spawn = [ "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "2%-" ]; allow-when-locked = true; };
     "XF86AudioMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle" ]; allow-when-locked = true; };
     "XF86AudioMicMute" = { action.spawn = [ "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle" ]; allow-when-locked = true; };
-    "XF86MonBrightnessUp" = { action.spawn = [ "brightnessctl" "s" "2%+" ]; allow-when-locked = true; };
-    "XF86MonBrightnessDown" = { action.spawn = [ "brightnessctl" "s" "2%-" ]; allow-when-locked = true; };
+    "XF86MonBrightnessUp" = { action.spawn = [ "brightnessctl" "s" "10%+" ]; allow-when-locked = true; };
+    "XF86MonBrightnessDown" = { action.spawn = [ "brightnessctl" "s" "10%-" ]; allow-when-locked = true; };
     
     "Mod+Q".action.close-window = {};
     "Mod+W".action.maximize-column = {};

From d4b19a279ec94b8846190368fa3f4eb5c1839871 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 24 Jul 2026 15:22:47 +0700
Subject: [PATCH 423/427] put swappiness and governor in base

---
 modules/system/base.nix               | 3 +++
 modules/system/homelab/mc/default.nix | 3 ---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/system/base.nix b/modules/system/base.nix
index 3a20057..d62b589 100644
--- a/modules/system/base.nix
+++ b/modules/system/base.nix
@@ -16,6 +16,9 @@
   i18n.defaultLocale = locale;
   environment.localBinInPath = true;
 
+  powerManagement.cpuFreqGovernor = "powersave";
+  boot.kernel.sysctl."vm.swappiness" = 10; # only swap when necessary
+  
   security = {
     polkit = {
       enable = true;
diff --git a/modules/system/homelab/mc/default.nix b/modules/system/homelab/mc/default.nix
index 2217a08..a452cfd 100644
--- a/modules/system/homelab/mc/default.nix
+++ b/modules/system/homelab/mc/default.nix
@@ -5,9 +5,6 @@
     inputs.mc.nixosModules.minecraft-servers
   ];
   nixpkgs.overlays = [ inputs.mc.overlay ];
-  
-  powerManagement.cpuFreqGovernor = "powersave"; # performance governor causes overheating and thermal throttling, works fine with powesave
-  boot.kernel.sysctl."vm.swappiness" = 10; # reduce swap usage and keep memory performance smooth
 
   services.minecraft-servers = {
     # LOCK IN

From c3d19551ee4e4cc404c5cf9b39b626d6955540e3 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 24 Jul 2026 15:26:59 +0700
Subject: [PATCH 424/427] lowbat brightness adjust

---
 modules/hardware/misc/battery-power.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index 8c529e1..1727fe4 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -19,7 +19,7 @@
           echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
           export DISPLAY=:0
           export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus
-          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && ${pkgs.libnotify}/bin/notify-send "Low Battery" "Battery remaining: $BAT_PCT%."
+          test $BAT_PCT -le 30 && test $BAT_PCT -gt 15 && test $BAT_STA = "Discharging" && ${pkgs.libnotify}/bin/notify-send "Low Battery" "Battery remaining: $BAT_PCT%." && brightnessctl s 30%
           test $BAT_PCT -le 15                         && test $BAT_STA = "Discharging" && ${pkgs.libnotify}/bin/notify-send -u critical "Low Battery" "Shutdown at 10%."
         ''} > /tmp/cron.batt.log 2>&1"
       ];

From eabea04a1426bfc3b692ff8f111a43892d3d3bfa Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 24 Jul 2026 15:31:37 +0700
Subject: [PATCH 425/427] script optimization

---
 modules/hardware/misc/battery-power.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/hardware/misc/battery-power.nix b/modules/hardware/misc/battery-power.nix
index 1727fe4..80c6ec9 100644
--- a/modules/hardware/misc/battery-power.nix
+++ b/modules/hardware/misc/battery-power.nix
@@ -13,9 +13,10 @@
     cron = {
       enable = true;
       systemCronJobs = [
-        "* * * * * ${username} bash -x ${pkgs.writeShellScript "low-battery-notifier" ''
-          BAT_PCT=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
-          BAT_STA=`${pkgs.acpi}/bin/acpi -b | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
+        "*/2 * * * * ${username} bash ${pkgs.writeShellScript "low-battery-notifier" ''
+          ACPI_OUT=$(${pkgs.acpi}/bin/acpi -b)
+          BAT_PCT=`echo "$ACPI_OUT" | ${pkgs.gnugrep}/bin/grep -P -o '[0-9]+(?=%)'`
+          BAT_STA=`echo "$ACPI_OUT" | ${pkgs.gnugrep}/bin/grep -P -o '\w+(?=,)'`
           echo "`date` battery status:$BAT_STA percentage:$BAT_PCT"
           export DISPLAY=:0
           export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus

From 618a41bd8837733187a5d53c9bf5fbafc2eac5f4 Mon Sep 17 00:00:00 2001
From: satr14 <admin@satr14.my.id>
Date: Fri, 24 Jul 2026 16:47:39 +0700
Subject: [PATCH 426/427] add extra portal

---
 modules/system/desktop.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/desktop.nix b/modules/system/desktop.nix
index f1e729d..0aeb936 100644
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -33,7 +33,7 @@
   xdg.portal = {
     enable = true;
     extraPortals = [
-      pkgs.xdg-desktop-portal-hyprland #inputs.hl.packages.${pkgs.system}.xdg-desktop-portal-hyprland
+      pkgs.xdg-desktop-portal-luminous
       pkgs.xdg-desktop-portal-gtk
     ];
   };

From 2b5b65168af365c858ce895d8485dd5d48eb2ae6 Mon Sep 17 00:00:00 2001
From: renovate <system@satr14.my.id>
Date: Sun, 26 Jul 2026 00:01:12 +0700
Subject: [PATCH 427/427] update lock file(s)

---
 flake.lock | 48 ++++++++++++++++++++++++------------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1b69fe1..c741025 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1783674541,
-        "narHash": "sha256-vmUhEF/jBCZJeK0dInOls+HOAR0yiiQusN1+FZKaJss=",
+        "lastModified": 1784366307,
+        "narHash": "sha256-VKatYOZwLQ+MuNkWH6/gZYxrNeSK1Mqb7mC0H1WSu+M=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "96799f24cf1366fe88e1293c3d27521a8f2129cf",
+        "rev": "673f730d0fc8db3468c51575f1d3d777cc55e51f",
         "type": "github"
       },
       "original": {
@@ -78,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784129366,
-        "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=",
+        "lastModified": 1784913159,
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "165228b0efefc3e635e5174020c40ea64271dc25",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1784258664,
-        "narHash": "sha256-/1hkRunsSzVmbKKIS84k09ss8kqvNG/gYKqnIOUGkXA=",
+        "lastModified": 1784949919,
+        "narHash": "sha256-itGqjPYHqEUqabXbQb+eHguk1c6rBTRGZS4KImp45kM=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "0d9d58d2024d823ea167503e26d38a16be0d1e26",
+        "rev": "a58c1fa23ec0273eb085be1e7874e964aa3cd34f",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1784189744,
-        "narHash": "sha256-D8oh9imibOynWAOUnvgG3w2EKDYqf8OTTaLCcTA4ePg=",
+        "lastModified": 1784874881,
+        "narHash": "sha256-u4jhSIf/Un0qZB+Cn3hTTaHSI20XeAxYbA5o4faqdJs=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "f4b479398c967d2c8d5a38b6d2c87283ae5078c4",
+        "rev": "ef7a2a3d719af46b906c22a3ebfb7d65627b2cd2",
         "type": "github"
       },
       "original": {
@@ -155,11 +155,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1783522755,
-        "narHash": "sha256-dI0HkX1djETia7cD/Y64h8BNIsSOfTRMzfNum2J6UhE=",
+        "lastModified": 1784570726,
+        "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "0777769e719b7c9b7c980d4ea66288bfbb4da5b3",
+        "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc",
         "type": "github"
       },
       "original": {
@@ -230,11 +230,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1784120854,
-        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -246,11 +246,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1784120854,
-        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -320,11 +320,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1783895132,
-        "narHash": "sha256-Dl0Gvrig3EpE962hzF3ETPhUztlfuRhcmlpd8ioHN54=",
+        "lastModified": 1784679892,
+        "narHash": "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "a2b5c635d8c8c99b286967658d0d177044887eb8",
+        "rev": "8d135d3b2854b30fd01ea6cd6c27e523dd50a839",
         "type": "github"
       },
       "original": {