added merge_group to build_systems and treefmt

Flake lock file updates:

• Updated input 'firefox-addons':
    'gitlab:rycee/nur-expressions/369dccacc0a8214600773b3bbbf68d98a19b74e8?dir=pkgs/firefox-addons&narHash=sha256-TVWYBcNpeQ3fEloryVP9N2yJnC3vuPpoZF1RqFFWFt0%3D' (2025-07-18)
  → 'gitlab:rycee/nur-expressions/553afee4efb5a7dea03cf654deafacd8fa1004f9?dir=pkgs/firefox-addons&narHash=sha256-45s1L4h/6t3M%2B/ppqow1OFUgfk9jZHsR4jxNgxIWWmM%3D' (2025-07-25)
• Updated input 'home-manager':
    'github:nix-community/home-manager/d0300c8808e41da81d6edfc202f3d3833c157daf?narHash=sha256-irfg7lnfEpJY%2B3Cffkluzp2MTVw1Uq9QGxFp6qadcXI%3D' (2025-07-18)
  → 'github:nix-community/home-manager/a1817d1c0e5eabe7dfdfe4caa46c94d9d8f3fdb6?narHash=sha256-hOUWU5L62G9sm8NxdiLWlLIJZz9H52VuFiDllHdwmVA%3D' (2025-07-25)
• Updated input 'nixos-hardware':
    'github:nixos/nixos-hardware/d1bfa8f6ccfb5c383e1eba609c1eb67ca24ed153?narHash=sha256-P8J72psdc/rWliIvp8jUpoQ6qRDlVzgSDDlgkaXQ0Fw%3D' (2025-07-16)
  → 'github:nixos/nixos-hardware/cc66fddc6cb04ab479a1bb062f4d4da27c936a22?narHash=sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM%3D' (2025-07-21)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/6e987485eb2c77e5dcc5af4e3c70843711ef9251?narHash=sha256-RKwfXA4OZROjBTQAl9WOZQFm7L8Bo93FQwSJpAiSRvo%3D' (2025-07-16)
  → 'github:nixos/nixpkgs/fc02ee70efb805d3b2865908a13ddd4474557ecf?narHash=sha256-i%2BCQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s%3D' (2025-07-23)
• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/cda03d762aa4d6930f41c2a60b946e0f8a743630?narHash=sha256-ppPL0jXpeeFtyP9I01o807u3iVADQ3YkqpN2lUZk4LY%3D' (2025-07-19)
  → 'github:nixos/nixpkgs/ce6b0611ca70423d97fab2a3f53f61f1fa4ff0a4?narHash=sha256-Iy/9c6DaxCY9ECCLgpoo%2BuwY1K5YTmJLU7fSg7JeALk%3D' (2025-07-26)

.github/workflows/build_systems.yml

@@ -2,6 +2,7 @@ name: build_systems
 on:
   workflow_dispatch:
   pull_request:
+  merge_group:
   push:
     branches: [main]
   schedule:

.github/workflows/merge_flake_lock_update.yml

@@ -0,0 +1,29 @@
+name: merge_flake_lock_update
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * 6"
+
+jobs:
+  merge:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: merge_flake_lock_update
+        run: |
+          pr_number=$(gh pr list --state open --author RichieCahill --label flake_lock_update --json number --jq '.[0].number')
+          echo "pr_number=$pr_number" >> $GITHUB_ENV
+          if [ -n "$pr_number" ]; then
+            gh pr merge "$pr_number" --rebase
+          else
+            echo "No open PR found with label flake_lock_update"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATES }}

.github/workflows/treefmt.yml

@@ -2,6 +2,7 @@ name: treefmt
 on:
   workflow_dispatch:
   pull_request:
+  merge_group:
   push:
     branches: [main]
 

.github/workflows/update-flake-lock.yml

@@ -2,7 +2,7 @@ name: update-flake-lock
 on:
   workflow_dispatch:
   schedule:
-    - cron: "0 0 * * *"
+    - cron: "0 0 * * 6"
 
 jobs:
   lockfile:
@@ -20,3 +20,4 @@ jobs:
           pr-labels: |
             dependencies
             automated
+            flake_lock_update

common/global/default.nix

@@ -56,7 +56,14 @@
 
   programs.zsh.enable = true;
 
-  security.auditd.enable = lib.mkDefault true;
+  security = {
+    auditd.enable = lib.mkDefault true;
+    sudo-rs = {
+      enable = true;
+      execWheelOnly = true;
+    };
+    sudo.enable = false;
+  };
 
   users.mutableUsers = lib.mkDefault false;
 

common/global/locale.nix

@@ -4,8 +4,7 @@
   console.keyMap = lib.mkDefault "us";
 
   i18n = {
-    defaultLocale = lib.mkDefault "en_US.utf8";
+    defaultLocale = lib.mkDefault "en_US.UTF-8";
-    supportedLocales = lib.mkDefault [ "en_US.UTF-8/UTF-8" ];
     extraLocaleSettings = lib.mkDefault {
       LC_ADDRESS = "en_US.UTF-8";
       LC_IDENTIFICATION = "en_US.UTF-8";

common/global/nix.nix

@@ -15,17 +15,14 @@ in
       ];
       trusted-substituters = [
         "https://cache.nixos.org"
-        "https://cache.tmmworkshop.com"
         "https://nix-community.cachix.org"
       ];
       substituters = [
         "https://cache.nixos.org/?priority=2&want-mass-query=true"
-        "https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
         "https://nix-community.cachix.org/?priority=10&want-mass-query=true"
       ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
       auto-optimise-store = lib.mkDefault true;

common/optional/desktop.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 {
   boot = {
-    kernelPackages = pkgs.linuxPackages_6_13;
+    kernelPackages = pkgs.linuxPackages_6_15;
     zfs.package = pkgs.zfs_2_3;
   };
 

common/optional/tmmworkshop_cache.nix

@@ -0,0 +1,7 @@
+{
+  nix.settings = {
+    trusted-substituters = [ "http://cache.tmmworkshop.com" ];
+    substituters = [ "http://cache.tmmworkshop.com/?priority=1&want-mass-query=true" ];
+    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
+  };
+}

flake.lock

@@ -8,11 +8,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1747022610,
+        "lastModified": 1753416229,
-        "narHash": "sha256-d6SvA0gTHDrOqt4tZRVD0Gm5G4w6jAFJ6lis79PjSPw=",
+        "narHash": "sha256-45s1L4h/6t3M+/ppqow1OFUgfk9jZHsR4jxNgxIWWmM=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "d4b3ffe3e719e42b175ccdef13598516f0a8025d",
+        "rev": "553afee4efb5a7dea03cf654deafacd8fa1004f9",
         "type": "gitlab"
       },
       "original": {
@@ -22,24 +22,6 @@
         "type": "gitlab"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -47,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747081732,
+        "lastModified": 1753470191,
-        "narHash": "sha256-VnR33UmH0KzvTuVg+6oYkDVpnPuHanQisNUXytCRBPQ=",
+        "narHash": "sha256-hOUWU5L62G9sm8NxdiLWlLIJZz9H52VuFiDllHdwmVA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f0a7db5ec1d369721e770a45e4d19f8e48186a69",
+        "rev": "a1817d1c0e5eabe7dfdfe4caa46c94d9d8f3fdb6",
         "type": "github"
       },
       "original": {
@@ -60,35 +42,13 @@
         "type": "github"
       }
     },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "system_tools",
-          "poetry2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1729742964,
-        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1747083103,
+        "lastModified": 1753122741,
-        "narHash": "sha256-dMx20S2molwqJxbmMB4pGjNfgp5H1IOHNa1Eby6xL+0=",
+        "narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "d1d68fe8b00248caaa5b3bbe4984c12b47e0867d",
+        "rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
         "type": "github"
       },
       "original": {
@@ -100,11 +60,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746904237,
+        "lastModified": 1753250450,
-        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
+        "narHash": "sha256-i+CQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
+        "rev": "fc02ee70efb805d3b2865908a13ddd4474557ecf",
         "type": "github"
       },
       "original": {
@@ -116,11 +76,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1747094543,
+        "lastModified": 1753489269,
-        "narHash": "sha256-WJ55VutSzEjVjq9jYpUvJp6fRB8ncgVzFpWoAwfvppg=",
+        "narHash": "sha256-Iy/9c6DaxCY9ECCLgpoo+uwY1K5YTmJLU7fSg7JeALk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bee20293bce36bd20f2ed6627a60db76eaa7e9b4",
+        "rev": "ce6b0611ca70423d97fab2a3f53f61f1fa4ff0a4",
         "type": "github"
       },
       "original": {
@@ -146,31 +106,53 @@
         "type": "github"
       }
     },
-    "poetry2nix": {
+    "pyproject-build-systems": {
       "inputs": {
-        "flake-utils": [
-          "system_tools",
-          "flake-utils"
-        ],
-        "nix-github-actions": "nix-github-actions",
         "nixpkgs": [
           "system_tools",
           "nixpkgs"
         ],
-        "systems": "systems_2",
+        "pyproject-nix": [
-        "treefmt-nix": "treefmt-nix"
+          "system_tools",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "system_tools",
+          "uv2nix"
+        ]
       },
       "locked": {
-        "lastModified": 1736884309,
+        "lastModified": 1744599653,
-        "narHash": "sha256-eiCqmKl0BIRiYk5/ZhZozwn4/7Km9CWTbc15Cv+VX5k=",
+        "narHash": "sha256-nysSwVVjG4hKoOjhjvE6U5lIKA8sEr1d1QzEfZsannU=",
-        "owner": "nix-community",
+        "owner": "pyproject-nix",
-        "repo": "poetry2nix",
+        "repo": "build-system-pkgs",
-        "rev": "75d0515332b7ca269f6d7abfd2c44c47a7cbca7b",
+        "rev": "7dba6dbc73120e15b558754c26024f6c93015dd7",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "pyproject-nix",
-        "repo": "poetry2nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "system_tools",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1746540146,
+        "narHash": "sha256-QxdHGNpbicIrw5t6U3x+ZxeY/7IEJ6lYbvsjXmcxFIM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e09c10c24ebb955125fda449939bfba664c467fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
         "type": "github"
       }
     },
@@ -184,7 +166,7 @@
         "nixpkgs-stable": "nixpkgs-stable",
         "sops-nix": "sops-nix",
         "system_tools": "system_tools",
-        "systems": "systems_3"
+        "systems": "systems"
       }
     },
     "sops-nix": {
@@ -194,11 +176,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746485181,
+        "lastModified": 1752544651,
-        "narHash": "sha256-PxrrSFLaC7YuItShxmYbMgSuFFuwxBB+qsl9BZUnRvg=",
+        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "e93ee1d900ad264d65e9701a5c6f895683433386",
+        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
         "type": "github"
       },
       "original": {
@@ -209,18 +191,19 @@
     },
     "system_tools": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "poetry2nix": "poetry2nix"
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1741571944,
+        "lastModified": 1747501237,
-        "narHash": "sha256-PM7dz99nb6dDiw/3naRGB/dUl5U7dJVspR9uevhW3xo=",
+        "narHash": "sha256-woyaUwmZurfNTXBEFM6M7ueSd/Udixs+4DUInhL835c=",
         "owner": "RichieCahill",
         "repo": "system_tools",
-        "rev": "c9979e045bca52ec85a0dc560b238f3e5ae2f01c",
+        "rev": "68ab5d1c17ac3fe2487f73dbbb4848bd2291139e",
         "type": "github"
       },
       "original": {
@@ -230,36 +213,6 @@
       }
     },
     "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -274,25 +227,28 @@
         "type": "github"
       }
     },
-    "treefmt-nix": {
+    "uv2nix": {
       "inputs": {
         "nixpkgs": [
           "system_tools",
-          "poetry2nix",
           "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "system_tools",
+          "pyproject-nix"
         ]
       },
       "locked": {
-        "lastModified": 1730120726,
+        "lastModified": 1747441483,
-        "narHash": "sha256-LqHYIxMrl/1p3/kvm2ir925tZ8DkI0KA10djk8wecSk=",
+        "narHash": "sha256-W8BFXk5R0TuJcjIhcGoMpSOaIufGXpizK0pm+uTqynA=",
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
-        "rev": "9ef337e492a5555d8e17a51c911ff1f02635be15",
+        "rev": "582024dc64663e9f88d467c2f7f7b20d278349de",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "pyproject-nix",
-        "repo": "treefmt-nix",
+        "repo": "uv2nix",
         "type": "github"
       }
     }

flake.nix

@@ -4,12 +4,10 @@
   nixConfig = {
     extra-substituters = [
       "https://cache.nixos.org/?priority=2&want-mass-query=true"
-      "https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
       "https://nix-community.cachix.org/?priority=10&want-mass-query=true"
     ];
     extra-trusted-public-keys = [
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" # cspell:disable-line
-      "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" # cspell:disable-line
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" # cspell:disable-line
       "cache-nix-dot:Od9KN34LXc6Lu7y1ozzV1kIXZa8coClozgth/SYE7dU=" # cspell:disable-line
     ];

systems/jeeves/docker/great_cloud_of_witnesses.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  vars = import ../vars.nix;
+in
+{
+
+  # environment.systemPackages = with pkgs; [ php.withExtensions ({ all, ... }: [ all.pdo_pgsql ]) ];
+
+  services.httpd = {
+    enable = true;
+    adminAddr = "webmaster@localhost";
+
+    enablePHP = true;
+    phpPackage = pkgs.php.withExtensions (
+      { enabled, all }:
+      enabled
+      ++ [
+        all.pdo
+        all.pdo_pgsql
+      ]
+    );
+    extraModules = [ "rewrite" ];
+    virtualHosts.great_cloud_of_witnesses = {
+      hostName = "localhost";
+      listen = [
+        {
+          ip = "*";
+          port = 8092;
+        }
+
+      ];
+      documentRoot = "${vars.services}/great_cloud_of_witnesses";
+      extraConfig = ''
+        <Directory "${vars.services}/great_cloud_of_witnesses">
+          AllowOverride All
+          Require all granted
+        </Directory>
+      '';
+    };
+  };
+
+  sops.secrets.gcw_password = {
+    sopsFile = ../../../users/secrets.yaml;
+    neededForUsers = true;
+  };
+
+  users = {
+    users.gcw = {
+      isSystemUser = true;
+      hashedPasswordFile = config.sops.secrets.gcw_password.path;
+      group = "gcw";
+    };
+    groups.gcw = { };
+  };
+}

systems/jeeves/networking.nix

@@ -11,8 +11,8 @@
     networks = {
       "10-1GB_Primary" = {
         matchConfig.Name = "enp98s0f0";
-        address = [ "192.168.95.14/24" ];
+        address = [ "192.168.99.14/24" ];
-        routes = [ { Gateway = "192.168.95.1"; } ];
+        routes = [ { Gateway = "192.168.99.1"; } ];
         linkConfig.RequiredForOnline = "routable";
       };
       "10-1GB_Secondary" = {

systems/jeeves/runners/nix_builder.nix

@@ -64,7 +64,7 @@ in
             Host jeeves
               Port 629
               User github-runners
-              HostName 192.168.95.14
+              HostName 192.168.99.14
               IdentityFile ${vars.secrets}/services/github-runners/id_ed25519_github-runners
               StrictHostKeyChecking no
               UserKnownHostsFile /dev/null

systems/jeeves/services/duckdns.nix

@@ -1,10 +0,0 @@
-let
-  vars = import ../vars.nix;
-in
-{
-  services.duckdns = {
-    enable = true;
-    tokenFile = "${vars.secrets}/services/duckdns/token";
-    domainsFile = "${vars.secrets}/services/duckdns/domains";
-  };
-}

systems/jeeves/services/haproxy.cfg

@@ -31,7 +31,7 @@ frontend ContentSwitching
   acl host_homeassistant  hdr(host) -i homeassistant.tmmworkshop.com
   acl host_jellyfin  hdr(host) -i jellyfin.tmmworkshop.com
   acl host_share  hdr(host) -i share.tmmworkshop.com
-  acl host_uptime_kuma  hdr(host) -i uptimekuma-jeeves.tmmworkshop.com
+  acl host_gcw  hdr(host) -i gcw.tmmworkshop.com
 
   use_backend audiobookshelf_nodes if host_audiobookshelf
   use_backend cache_nodes  if host_cache
@@ -39,7 +39,7 @@ frontend ContentSwitching
   use_backend homeassistant_nodes  if host_homeassistant
   use_backend jellyfin if host_jellyfin
   use_backend share_nodes  if host_share
-  use_backend uptime_kuma_nodes  if host_uptime_kuma
+  use_backend gcw_nodes  if host_gcw
 
 backend audiobookshelf_nodes
   mode http
@@ -68,6 +68,6 @@ backend share_nodes
   mode http
   server server 127.0.0.1:8091
 
-backend uptime_kuma_nodes
+backend gcw_nodes
   mode http
-  server server 127.0.0.1:3001
+  server server 127.0.0.1:8092

systems/jeeves/services/home_assistant.nix

@@ -19,7 +19,7 @@ in
         http = {
           server_port = 8123;
           server_host = [
-            "192.168.95.14"
+            "192.168.99.14"
             "192.168.90.40"
             "127.0.0.1"
           ];
@@ -72,7 +72,6 @@ in
           rokuecp
           uiprotect
           wakeonlan
-          wyoming
         ];
       extraComponents = [ "isal" ];
     };
@@ -81,23 +80,5 @@ in
       openFirewall = true;
       address = "192.168.90.40";
     };
-    wyoming = {
-      faster-whisper.servers.main = {
-        enable = true;
-        uri = "tcp://0.0.0.0:10300";
-        model = "medium.en";
-        language = "en";
-        device = "cuda";
-      };
-      piper.servers.main = {
-        enable = true;
-        uri = "tcp://0.0.0.0:10200";
-        voice = "en_GB-alba-medium";
-      };
-      openwakeword = {
-        enable = true;
-        uri = "tcp://0.0.0.0:10400";
-      };
-    };
   };
 }

systems/jeeves/services/postgress.nix

@@ -23,18 +23,31 @@ in
       host  all  richie   127.0.0.1/32    trust
       host  all  richie   ::1/128         trust
       host  all  richie   192.168.90.1/24 trust
-      host  all  richie   192.168.95.1/24 trust
+      host  all  richie   192.168.99.1/24 trust
 
 
       #type database DBuser origin-address auth-method
-      local hass     hass      trust
+      local hass     hass     trust
 
       # ipv4
-      host  hass     hass       192.168.90.1/24 trust
+      host  hass     hass     192.168.90.1/24 trust
-      host  hass     hass       127.0.0.1/32 trust
+      host  hass     hass     127.0.0.1/32 trust
 
       # ipv6
       host hass      hass     ::1/128         trust
+
+      # megan
+      host  megan    megan    192.168.90.1/24 trust
+      host  megan    megan    127.0.0.1/32 trust
+
+      host  gcw      megan    192.168.90.1/24 trust
+      host  gcw      megan    127.0.0.1/32 trust
+
+      # gcw
+      local gcw      gcw      trust
+      host  gcw      gcw      192.168.90.1/24 trust
+      host  gcw      gcw      127.0.0.1/32 trust
+
     '';
 
     identMap = ''
@@ -77,9 +90,31 @@ in
           replication = true;
         };
       }
+      {
+        name = "megan";
+        ensureDBOwnership = true;
+        ensureClauses = {
+          login = true;
+          createrole = true;
+          createdb = true;
+          replication = true;
+        };
+      }
+      {
+        name = "gcw";
+        ensureDBOwnership = true;
+        ensureClauses = {
+          login = true;
+          createrole = true;
+          createdb = true;
+          replication = true;
+        };
+      }
     ];
     ensureDatabases = [
+      "gcw"
       "hass"
+      "megan"
       "mxr_dev"
       "mxr_prod"
       "richie"

systems/jeeves/services/transmission.nix

@@ -12,7 +12,7 @@ in
     openRPCPort = true;
     downloadDirPermissions = "770";
     settings = {
-      bind-address-ipv4 = "192.168.95.14";
+      bind-address-ipv4 = "192.168.99.14";
       cache-size-mb = 0;
       download-dir = "${vars.transmission}/complete";
       download-queue-enabled = false;

users/megan/default.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  sops.secrets.megan_password = {
+    sopsFile = ../secrets.yaml;
+    neededForUsers = true;
+  };
+
+  users = {
+    users.megan = {
+      isNormalUser = true;
+      hashedPasswordFile = "${config.sops.secrets.megan_password.path}";
+
+      shell = pkgs.zsh;
+      group = "megan";
+      extraGroups = [
+        "audio"
+        "video"
+        "users"
+      ];
+      uid = 1101;
+    };
+
+    groups.megan.gid = 1101;
+  };
+  home-manager.users.megan = import ./systems/${config.networking.hostName}.nix;
+}

users/megan/home/cli/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./direnv.nix
+    ./git.nix
+    ./zsh.nix
+  ];
+
+  programs.starship.enable = true;
+}

users/megan/home/cli/direnv.nix

@@ -0,0 +1,8 @@
+{
+
+  programs.direnv = {
+    enable = true;
+    enableZshIntegration = true;
+    nix-direnv.enable = true;
+  };
+}

users/megan/home/cli/git.nix

@@ -0,0 +1,12 @@
+{
+  programs.git = {
+    enable = true;
+    userEmail = "mousikos112@gmail.com";
+    userName = "megan";
+    extraConfig = {
+      pull.rebase = true;
+      color.ui = true;
+    };
+    lfs.enable = true;
+  };
+}

users/megan/home/cli/zsh.nix

@@ -0,0 +1,31 @@
+{
+  programs.zsh = {
+    enable = true;
+    syntaxHighlighting.enable = true;
+    history.size = 10000;
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "docker"
+        "docker-compose"
+        "colored-man-pages"
+        "rust"
+        "systemd"
+        "tmux"
+        "ufw"
+        "z"
+      ];
+    };
+    shellAliases = {
+      "lrt" = "eza --icons -lsnew";
+      "ls" = "eza";
+      "ll" = "eza --long --group";
+      "la" = "eza --all";
+
+      "rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
+      "rebuild" = "sudo nixos-rebuild switch --flake /home/richie/dotfiles#$HOST";
+      "nix-test" = "nixos-rebuild test --flake /home/richie/dotfiles";
+    };
+  };
+}

users/megan/home/global.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+{
+  imports = [
+    ./cli
+    ./programs.nix
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    git.enable = true;
+  };
+
+  home = {
+    username = "megan";
+    homeDirectory = "/home/${config.home.username}";
+    stateVersion = "24.05";
+  };
+}

users/megan/home/programs.nix

@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    # cli
+    bat
+    btop
+    eza
+    fd
+    ffmpegthumbnailer
+    fzf
+    git
+    gnupg
+    imagemagick
+    jq
+    ncdu
+    neofetch
+    ouch
+    p7zip
+    poppler
+    rar
+    ripgrep
+    starship
+    tmux
+    unzip
+    yazi
+    zoxide
+    # system info
+    hwloc
+    lynis
+    pciutils
+    smartmontools
+    usbutils
+    # networking
+    iperf3
+    nmap
+    wget
+    # python
+    poetry
+    python313
+    ruff
+  ];
+}

users/megan/systems/jeeves.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../home/global.nix
+  ];
+}

users/richie/home/cli/zsh.nix

@@ -23,9 +23,9 @@
       "ll" = "eza --long --group";
       "la" = "eza --all";
 
-      "rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
+      "rebuild" = "sudo nixos-rebuild switch --flake $HOME/dotfiles#$HOST";
-      "rebuild" = "sudo nixos-rebuild switch --flake /home/richie/dotfiles#$HOST";
+      "rebuild_backup" =
-      "nix-test" = "nixos-rebuild test --flake /home/richie/dotfiles";
+        "sudo nixos-rebuild switch --flake $HOME/dotfiles#$HOST --option substituters 'https://nix-community.cachix.org' --option trusted-public-keys 'cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY='";
     };
   };
 }

users/richie/home/programs.nix

@@ -38,6 +38,7 @@
     poetry
     python313
     ruff
+    uv
     # Rust packages
     trunk
     wasm-pack

users/richie/home/ssh_config.nix

@@ -11,7 +11,7 @@
         dynamicForwards = [ { port = 9050; } ];
       };
       unlock-jeeves = {
-        hostname = "192.168.95.14";
+        hostname = "192.168.99.14";
         user = "root";
         identityFile = "~/.ssh/id_ed25519";
         port = 2222;

users/secrets.yaml

@@ -1,10 +1,8 @@
 richie_password: ENC[AES256_GCM,data:DMi3M8aqrQ60APIofr8wJMh+VZ14hLRxz6jWZgzswr0pV/QVSX53ShBFr90ruO3mucOLYv0l+bI31covfqMAhXWBJp9wUgtC2Q==,iv:qgtn30hZfIL4dBnQSLkjbo7zPJA4m9TR0f52sTFc0v4=,tag:ydLbcGyXjv0fE+4b5ECX5w==,type:str]
 gaming_password: ENC[AES256_GCM,data:i692UsQaCOjE4V1y9d8yYDlK+TRMIprCHJkhl1UBZRMqe9a2LTUtmbbn/xlCYQd2tADJvn+dkx1jLfV4CqaqWOj5YSUFfpgsEw==,iv:3Y7hXQcmpzNN7hF+BDvO52uFB4o5D0dHvxemJ0ZoSIM=,tag:zzLGNDVAMCs2GPMqXp2BtQ==,type:str]
+megan_password: ENC[AES256_GCM,data:Udrs9OWFI2TDM1yxRwfy7uiONh1G3Mr9HabwpmRykp1Xw9KK+q245nxN7QQbR0AiTCyyyivhn6GB2+DvBBY/6UrN5iGs+LaXgg==,iv:n02HzE8jvWM5xDfaPB9BHxtfoAZQ/Tk80XuySY2NyoU=,tag:L9wPVy7zt6mp09qWhzdLpg==,type:str]
+gcw_password: ENC[AES256_GCM,data:T5CliWyyw4igunGRokOW7dNTOQ7DbOhM4gLa8YN4gbVLEVU7n3jxAVF9Uy9zM7LBBqdLvyXnqGzC1HBSBmE+pKBV7YIN3aQkng==,iv:SLq4aeLHdwfq0+A4N6UO4Dz7oBoC0ZDKBr74hheHQFw=,tag:4a71PZcyzoWjOmYEPx07ag==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
           enc: |
@@ -51,8 +49,7 @@ sops:
             UzQzWEFtSDJwR201cmZoeXh5T0RmSk0KWLOpw5cWbtnfVP/ISa7n1vZchoD+nxmn
             7yr7igpEIro0Sd238KinOQYswVaT0NHB9p1dSW/mN+aGQliSNLzkDQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-07T20:13:43Z"
+    lastmodified: "2025-06-05T00:52:15Z"
-    mac: ENC[AES256_GCM,data:Q5fmv+MRVYGUQ4j+28CcGWHmgT1178N+haVS9xa0c99OKuPZdfSndAG0QVDhh/jYq+7zXs6zzLtBjB+egkoDfxJXfJOmg3E46UMO3vDHaEcIZD16ZbWJaz4Z/+yabqhDURKtgfGiu4xPv3OtGbwcP5kud17WcHNfY/LT+Y+LSD8=,iv:y3K3kCroIh+RTplUe4tM8B9rbLgIHCbE6FJawngam8Q=,tag:2VTIWlLp4cOwm18BfIlz5g==,type:str]
+    mac: ENC[AES256_GCM,data:FVj9SmI6uq5ujIX3NwFSLcappRIX0K1U/GXks4Wj0gJH//Tqo5Ur07+WdE5JNmHdS1gXW34RhzFmEbQ9KR2OoP8cfTG+a7qCftzEQbV5aBBEMxstsl48TLtRTwRuSrEnVOHh/0EfFOkXTUO/rVS4jDmd57eAB6OBJQePQk+P+0Q=,iv:P1aeFC+6xG4Koph0Dynwek/861OsH1asui3qtpu1JUI=,tag:1RYayU758c+yAULOgQuWgw==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.2