chore(flake): update locked inputs

refactor(journald): migrate retention setting
feat(homelab): update network and swap configuration
2026-09-21 08:53:06 -03:00 · 2026-09-21 08:52:55 -03:00 · 2026-09-21 08:52:47 -03:00 · 2026-09-21 08:43:50 -03:00 · 2026-09-07 22:55:53 -03:00 · 2026-09-05 20:01:42 -03:00
25 changed files with 926 additions and 218 deletions
@@ -0,0 +1,5 @@
+## Me
+
+[mcp_servers.nixos]
+command = "nix"
+args = ["run", "github:utensils/mcp-nixos", "--"]
@@ -1,3 +1 @@
- Evaluate Plasma Manager when Plasma 6.7 support improves
 - Review system-wide package list periodically
- Add additional hosts
@@ -1,5 +1,28 @@
 {
  "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
    "apple-fonts": {
      "inputs": {
        "ci": "ci",
@@ -14,11 +37,11 @@
        "sf-pro": "sf-pro"
      },
      "locked": {
-        "lastModified": 1786018145,
-        "narHash": "sha256-4cjJFmq6JC0Gk9wWt3aZzqovtmM9mikrDWjsBL2ZWu8=",
+        "lastModified": 1789419105,
+        "narHash": "sha256-T5A/AqlF4iL908aIZh45e35Mvj8lTJKq8ddS5bk7nd8=",
        "owner": "Lyndeno",
        "repo": "apple-fonts.nix",
-        "rev": "66b5379c6a429ad4ea6ff3943cc1f651df55cc70",
+        "rev": "3861e2249cb244bfbc7cfab2303c152cf5f9d9e9",
        "type": "github"
      },
      "original": {
@@ -73,15 +96,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1784665499,
-        "narHash": "sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep+wpUzquA29VU=",
-        "owner": "nix-community",
+        "lastModified": 1788011267,
+        "narHash": "sha256-mEq2kU+ljompTToZ44Afvm7d/rHJ5iMBl0tjZuyShJs=",
+        "owner": "Mic92",
        "repo": "bun2nix",
-        "rev": "0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729",
+        "rev": "5765b0614591f75ee8ba5596e81ae85c167d1071",
        "type": "github"
      },
      "original": {
-        "owner": "nix-community",
+        "owner": "Mic92",
+        "ref": "fix-structured-attrs-hook",
        "repo": "bun2nix",
        "type": "github"
      }
@@ -108,6 +132,28 @@
        "type": "github"
      }
    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -116,11 +162,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785627969,
-        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -150,15 +196,36 @@
    "home-manager": {
      "inputs": {
        "nixpkgs": [
+          "agenix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1786031233,
-        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "7834e82588860aaf780cec1366524456a70898d7",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789978077,
+        "narHash": "sha256-p/e37FfVifxJQJM7OiiVbUXdpj6eXmOJk34TKLKyYe4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "a26f7158fbc4aa740fcc7fa79a01e1ed29910bc2",
        "type": "github"
      },
      "original": {
@@ -172,15 +239,15 @@
        "bun2nix": "bun2nix",
        "flake-parts": "flake-parts",
        "nixpkgs": "nixpkgs_2",
-        "systems": "systems",
+        "systems": "systems_2",
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1786236470,
-        "narHash": "sha256-eIRMdjSQKSUf5aug00ycVSsO+8kIVQy5bH+K28U9LfE=",
+        "lastModified": 1789987094,
+        "narHash": "sha256-jzlT1EofmNifqUjpiSJMPbm/GiU17r65WUi44Kfkmdc=",
        "owner": "numtide",
        "repo": "llm-agents.nix",
-        "rev": "bd89b8dd8837cc8d3098524c7cfe08c884ad5569",
+        "rev": "7c0157f864d113d9f0ce324a78496de6da6e7e07",
        "type": "github"
      },
      "original": {
@@ -210,11 +277,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1786241478,
-        "narHash": "sha256-K/jbo7rTV0jRcDdHKL9VxGURqH61OJcCat9al7q9oMg=",
+        "lastModified": 1789964597,
+        "narHash": "sha256-L+tPmy48VrsS/qVrj504pETaGEcVFMs1QpU5kKpBo0U=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "c7e586ad09d79ab867b055b818d4122334ff6dfe",
+        "rev": "fa4ec37adf8d8c725bfd8915c497ed41c7cb0f70",
        "type": "github"
      },
      "original": {
@@ -256,11 +323,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1785975029,
-        "narHash": "sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU=",
+        "lastModified": 1789813231,
+        "narHash": "sha256-dsU+UU4X3ND95E/O6Z33qK5jPxIeB/7akn/+NfAk+nY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "70ce234312134a463ba7728e94da2486a1d237ac",
+        "rev": "c80073788adf88abfdc443465311f00e7a231600",
        "type": "github"
      },
      "original": {
@@ -288,11 +355,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1786106723,
-        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
+        "lastModified": 1789785513,
+        "narHash": "sha256-B44WL6h0XoLjJ41bUPJk0X5SDinLCII//6EcBLXKiJ0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
+        "rev": "20b1ddd1aa5ace70c9468305030aa4f9ef79671b",
        "type": "github"
      },
      "original": {
@@ -339,8 +406,9 @@
    },
    "root": {
      "inputs": {
+        "agenix": "agenix",
        "apple-fonts": "apple-fonts",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
        "llm-agents": "llm-agents",
        "nix-flatpak": "nix-flatpak",
        "nix-vscode-extensions": "nix-vscode-extensions",
@@ -377,7 +445,7 @@
    "sf-compact": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-83JwqfF9O4+gemMQXWHLRg2GNz2jHxsej1F1IkM2dug=",
+        "narHash": "sha256-KjCzuJOrNxgptsMLGaR8wcrU/bBxCpwtUGzGDcCxJTc=",
        "type": "file",
        "url": "https://devimages-cdn.apple.com/design/resources/download/SF-Compact.dmg"
      },
@@ -425,7 +493,7 @@
    "sf-pro": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-vINUEMyFmNzZRBOX2aQ4heScWur6RyA/MPmsqlMPIx4=",
+        "narHash": "sha256-dvGLO786y9ygKRSKDJlhIF6AGmn2NTJ5tBulKinPRxY=",
        "type": "file",
        "url": "https://devimages-cdn.apple.com/design/resources/download/SF-Pro.dmg"
      },
@@ -441,11 +509,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785827118,
-        "narHash": "sha256-tS2eSSpa1uLPUyIAJBpf00+A9KSHpC92gKMLavmHuio=",
+        "lastModified": 1789899222,
+        "narHash": "sha256-B00sDpFqhTYuVQIesCdR7GeYJFNogz5U1VmJlSEJnmc=",
        "owner": "wimpysworld",
        "repo": "sidra",
-        "rev": "0597e5438fe98fef935cb528c2c9aa5db60171c9",
+        "rev": "ebba6a85eadd15de9d324503b012f84bf5eaf4ce",
        "type": "github"
      },
      "original": {
@@ -469,6 +537,21 @@
        "type": "github"
      }
    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -477,11 +560,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785945821,
-        "narHash": "sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw=",
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "ae7910970dddc408fe6ab1c8e4b277bb21d72dc0",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
        "type": "github"
      },
      "original": {
@@ -1,5 +1,5 @@
 {
-  description = "NixOS configuration for my homelab";
+  description = "my nixos configurations";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
@@ -23,9 +23,13 @@
    vscode-server.url = "github:nix-community/nixos-vscode-server";
    llm-agents.url = "github:numtide/llm-agents.nix";
    nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

-  outputs = { self, nixpkgs, apple-fonts, home-manager, plasma-manager, sidra, vscode-server, nix-vscode-extensions, ... }@inputs: {
+  outputs = { self, nixpkgs, apple-fonts, home-manager, plasma-manager, sidra, vscode-server, nix-vscode-extensions, agenix, ... }@inputs: {
    nixosConfigurations = {
      miku-homelab = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
@@ -36,6 +40,7 @@
          home-manager.nixosModules.home-manager
          inputs.nix-flatpak.nixosModules.nix-flatpak
          vscode-server.nixosModules.default
+          agenix.nixosModules.default
          {
            nixpkgs.overlays = [
              inputs.nix-vscode-extensions.overlays.default
@@ -49,7 +54,29 @@
            home-manager.sharedModules = [
              plasma-manager.homeModules.plasma-manager
            ];
-            home-manager.users.emmatherock = import ./home/emmatherock/home.nix;
+            home-manager.users.emmatherock = { osConfig, ... }: {
+              imports = [ ./home/emmatherock/core.nix ] ++ osConfig.myHomeProfile.extraPrograms;
+            };
+          }
+        ];
+      };
+
+      vps = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+
+        specialArgs = { inherit inputs; };
+        modules = [
+          ./hosts/vps
+          home-manager.nixosModules.home-manager
+          vscode-server.nixosModules.default
+          agenix.nixosModules.default
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = { inherit inputs; };
+            home-manager.users.emmatherock = { osConfig, ... }: {
+              imports = [ ./home/emmatherock/core.nix ] ++ osConfig.myHomeProfile.extraPrograms;
+            };
          }
        ];
      };
@@ -5,8 +5,9 @@ let
 in
 {
  home.packages = with agents; [
-    antigravity-cli
    codex
+    codex-acp
    claude-code
+    claude-agent-acp
  ];
 }
@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./git.nix
+    ./shell.nix
+  ];
+
+  programs.home-manager.enable = true;
+  programs.btop.enable = true;
+
+  # Per-project toolchain resolution through nix-shell / flake devShell.
+  programs.direnv = {
+    enable = true;
+    nix-direnv.enable = true;
+  };
+  home.packages = with pkgs; [
+    fastfetch
+  ];
+
+  home.stateVersion = "25.11";
+}
@@ -1,18 +0,0 @@
-{
-  imports = [
-    ./agents.nix
-    ./audio.nix
-    ./desktop-apps.nix
-    ./deskflow.nix
-    ./gaming.nix
-    ./git.nix
-    ./media.nix
-    ./packages.nix
-    ./plasma.nix
-    ./shell.nix
-    ./vscode.nix
-  ];
-
-  programs.home-manager.enable = true;
-  home.stateVersion = "25.11";
-}
@@ -1,10 +1,8 @@
 { pkgs, ... }:
 {
+  programs.btop.package = pkgs.btop.override { cudaSupport = false; rocmSupport = true; };
+
  home.packages = with pkgs; [
-    # --- Base y Terminal ---
-    vim
-    fastfetch
-    (btop.override { cudaSupport = false; rocmSupport = true; })
    nvtopPackages.full
  ];
 }
@@ -1,10 +1,23 @@
 { config, pkgs, ... }:
 {
-  home.packages = [ pkgs.bibata-cursors pkgs.breeze-enhanced ];
+  home.packages = [ pkgs.layan-cursors pkgs.breeze-enhanced ];
+
+    home.pointerCursor = {
+    enable = true;
+    name = "layan-cursors";
+    package = pkgs.layan-cursors;
+    size = 24;
+    gtk.enable = true;
+  };
  
  programs.plasma = {
    enable = true;

+    workspace.cursor = {
+      theme = "layan-cursors";
+      size = 24;
+    };
+
    shortcuts = {

      # Atajos personalizados para scripts propios (net.local.*)
@@ -1,26 +1,104 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:

 {
  imports = [
    ./hardware-configuration.nix
-    ../../modules/security/secureboot.nix
-    ../../modules/services/maintenance.nix
-    ../../modules/services/flatpak.nix
-    ../../modules/system/audio.nix
-    ../../modules/system/fonts.nix
-    ../../modules/system/gaming.nix
-    ../../modules/system/graphics.nix
+    ../../modules/profiles/desktop.nix
+    ../../modules/profiles/server.nix
+    ../../modules/services/ollama.nix
+    ../../modules/services/samba.nix
+    ../../modules/system/home-profile.nix
    ../../modules/system/nix-ld.nix
    ../../modules/system/packages.nix
-    ../../modules/system/shells.nix
-    ../../modules/system/users.nix
-    ../../modules/system/networking.nix
-    ../../modules/desktop/firefox.nix
-    ../../modules/desktop/plasma.nix
-    ../../modules/services/containers.nix
-    ../../modules/services/vscode-server.nix
  ];

+  age.secrets.miku-homelab-wg.file = ../../secrets/miku-homelab-wg.age;
+
+  myPackages.extra = with pkgs; [
+    rocmPackages.rocm-smi
+    btrfs-progs
+    distrobox
+    steam-run
+  ];
+
+  myHomeProfile.extraPrograms = [
+    ../../home/emmatherock/agents.nix
+    ../../home/emmatherock/audio.nix
+    ../../home/emmatherock/desktop-apps.nix
+    ../../home/emmatherock/deskflow.nix
+    ../../home/emmatherock/gaming.nix
+    ../../home/emmatherock/media.nix
+    ../../home/emmatherock/packages.nix
+    ../../home/emmatherock/plasma.nix
+    ../../home/emmatherock/vscode.nix
+  ];
+
+  myNetworking = {
+    hostName = "miku-homelab";
+    useNetworkManager = true;
+    staticIp = {
+      interface = "enp9s0";
+      address = "10.1.1.21";
+      prefixLength = 24;
+      gateway = "10.1.1.1";
+      nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    };
+    extraUdpPorts = [ 80 443 4242 49983 24800 26900 60977 ];
+    extraTcpPorts = [ 80 443 4242 49983 24800 26900 60977 ];
+    sshAllowUsers = [ "emmatherock" ];
+    wireguard = {
+      enable = true;
+      ips = [ "10.20.0.2/24" ];
+      privateKeyFile = config.age.secrets.miku-homelab-wg.path;
+      peers = [
+        {
+          publicKey = "BKs9VlsIEM1np6wHeVFL4NfbS1l69xnwins6Q12ByAM=";
+          allowedIPs = [ "10.20.0.1/32" ];
+          endpoint = "vps.external.mikufanclub.lat:51822";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  myUsers = {
+    admins.emmatherock = {
+      description = "EmmaTheRock";
+      shell = pkgs.fish;
+      extraGroups = [ "plugdev" "networkmanager" "wheel" "video" "mikushare-group" "render" ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6pnKpUEaeoNXqlenc8MAz1GG8P6BRILyIHMSLtvdeF termius"
+      ];
+    };
+    serviceUsers.mikushare = {
+      description = "Acceso remoto Mikufanclub";
+      group = "mikushare-group";
+      createHome = false;
+    };
+    extraGroups = [ "mikushare-group" "plugdev" ];
+  };
+
+  myContainers = {
+    enable = true;
+    storageDriver = "btrfs";
+    globalNetwork = "homelab_net";
+    composeStacks = {
+      tools = {
+        path = "/mnt/containers/tools";
+        after = [ "network-online.target" "tailscaled.service" ];
+      };
+      arrs = {
+        path = "/mnt/containers/arrs";
+        after = [ "docker-compose-tools.service" "local-fs.target" ];
+      };
+      gameservers = {
+        path = "/mnt/containers/gameserver";
+        after = [ "docker-compose-tools.service" ];
+      };
+    };
+  };
+
  boot = {
    loader = {
      efi.canTouchEfiVariables = true;
@@ -33,7 +111,35 @@
    plymouth.enable = true;
    initrd.kernelModules = [ "amdgpu" ];
    kernelPackages = pkgs.linuxPackages_latest;
-    kernelParams = [ "quiet" "splash" "boot.shell_on_fail" "loglevel=3" "iommu=pt" ];
+    kernelParams = [
+      "quiet"
+      "splash"
+      "boot.shell_on_fail"
+      "loglevel=3"
+      "iommu=pt"
+      "zswap.enabled=1"
+      "zswap.compressor=zstd"
+      "zswap.max_pool_percent=20"
+      "zswap.zpool=zsmalloc"
+    ];
+  };
+
+  swapDevices = [
+    {
+      device = "/dev/disk/by-label/optane-swap-1";
+      priority = 50;
+    }
+    {
+      device = "/dev/disk/by-label/optane-swap-2";
+      priority = 50;
+    }
+  ];
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    memoryPercent = 50;
+    priority = 100;
  };

  time.timeZone = "America/Argentina/Buenos_Aires";
@@ -63,6 +169,17 @@
    SUBSYSTEM=="drm", KERNEL=="card*", SUBSYSTEMS=="pci", DRIVERS=="amdgpu", RUN+="/bin/sh -c 'chmod -R g+r /sys/class/drm/%k/device/'"
  '';

+  systemd.services.tailscale-udp-gro = {
+    description = "Configurar UDP GRO para Tailscale";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.ethtool}/bin/ethtool -K enp9s0 rx-udp-gro-forwarding on rx-gro-list on";
+      RemainAfterExit = true;
+    };
+  };
+
  nixpkgs.config.allowUnfree = true;
  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
@@ -0,0 +1,89 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/profiles/server.nix
+    ../../modules/system/home-profile.nix
+    ../../modules/system/nix-ld.nix
+    ../../modules/system/packages.nix
+  ];
+
+  age.secrets.vps-wg.file = ../../secrets/vps-wg.age;
+
+  myHomeProfile.extraPrograms = [
+    ../../home/emmatherock/agents.nix
+  ];
+
+  myNetworking = {
+    hostName = "vps";
+    useNetworkManager = false;
+    useNetworkd = true;
+    staticIp = {
+      interface = "ens3";
+      address = "23.175.41.196";
+      prefixLength = 27;
+      gateway = "23.175.41.225";
+      nameservers = [ "1.1.1.1" "1.0.0.1" ];
+      onlinkGateway = true;
+    };
+
+    extraTcpPorts = [ 80 443 ];
+    extraUdpPorts = [ 51822 ];
+    sshAllowUsers = [ "emmatherock" ];
+    wireguard = {
+      enable = true;
+      ips = [ "10.20.0.1/24" ];
+      privateKeyFile = config.age.secrets.vps-wg.path;
+      listenPort = 51822;
+      peers = [
+        {
+          publicKey = "bqxDHQNxOSFpTo3We9ujC2WljtaRBgiNEewW+Rlu10k=";
+          allowedIPs = [ "10.20.0.2/32" ];
+        }
+        {
+          publicKey = "6aw0w7v9uFGvLn/eSdf7z/ljvzz4kviYlSOSj0LKp1E=";
+          allowedIPs = [ "10.20.0.3/32" ];
+        }
+      ];
+    };
+  };
+
+  myUsers = {
+    admins.emmatherock = {
+      description = "EmmaTheRock";
+      shell = pkgs.fish;
+      extraGroups = [ "wheel" ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEUCpjAuJobymPPAoPjLdL1eD6g4v6wrquu3cyHP22Wj emmatherock@NixOS"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO6pnKpUEaeoNXqlenc8MAz1GG8P6BRILyIHMSLtvdeF termius"
+      ];
+    };
+  };
+
+  myContainers = {
+    enable = true;
+    composeStacks.core = {
+      path = "/opt/containers/core";
+      after = [ "network-online.target" ];
+    };
+  };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.systemd-boot.configurationLimit = 10;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Required for this host to act as a Tailscale/Headscale exit node.
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
+  time.timeZone = "America/Argentina/Buenos_Aires";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  system.stateVersion = "26.05";
+}
@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sd_mod" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9601-188F";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/2fe62056-55d1-4d2a-97a4-74451f7a63d0";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
@@ -0,0 +1,12 @@
+{
+  imports = [
+    ../desktop/firefox.nix
+    ../desktop/plasma.nix
+    ../system/gaming.nix
+    ../system/audio.nix
+    ../system/graphics.nix
+    ../system/fonts.nix
+    ../security/secureboot.nix
+    ../services/flatpak.nix
+  ];
+}
@@ -0,0 +1,10 @@
+{
+  imports = [
+    ../system/networking.nix
+    ../system/users.nix
+    ../system/shells.nix
+    ../services/containers.nix
+    ../services/maintenance.nix
+    ../services/vscode-server.nix
+  ];
+}
@@ -1,5 +1,63 @@
-{ pkgs, ... }: 
+{ lib, pkgs, config, ... }:
+
+let
+  cfg = config.myContainers;
+
+  composeStackOpts = { ... }: {
+    options = {
+      path = lib.mkOption {
+        type = lib.types.path;
+        description = "Directory containing the docker-compose.yml for this stack.";
+      };
+      after = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Extra systemd units this stack's compose service should start after and want, beyond docker.service.";
+      };
+    };
+  };
+
+  mkComposeService = name: stack: {
+    name = "docker-compose-${name}";
+    value = {
+      description = "Docker Compose stack: ${name}";
+      after = [ "docker.service" ] ++ lib.optional (cfg.globalNetwork != null) "init-docker-networks.service" ++ stack.after;
+      wants = [ "docker.service" ] ++ lib.optional (cfg.globalNetwork != null) "init-docker-networks.service" ++ stack.after;
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        WorkingDirectory = stack.path;
+        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
+        ExecStop = "${pkgs.docker}/bin/docker compose down";
+      };
+    };
+  };
+in
 {
+  options.myContainers = {
+    enable = lib.mkEnableOption "Docker/Podman container support and Docker Compose stacks";
+
+    storageDriver = lib.mkOption {
+      type = lib.types.nullOr (lib.types.enum [ "aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs" ]);
+      default = null;
+      description = "Docker storage driver to use. Leave null to let Docker choose.";
+    };
+
+    globalNetwork = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Name of a shared Docker network to create on boot, for compose stacks to join. Leave null to skip.";
+    };
+
+    composeStacks = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule composeStackOpts);
+      default = { };
+      description = "Docker Compose stacks to run as systemd services, each producing a docker-compose-<name> unit.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
    virtualisation = {
      containers.enable = true;
      podman = {
@@ -8,63 +66,27 @@
      };
      docker = {
        enable = true;
-      storageDriver = "btrfs";
+        storageDriver = cfg.storageDriver;
        daemon.settings = {
          dns = [ "1.1.1.1" "8.8.8.8" ];
        };
      };
    };

- systemd.services = {
+    systemd.services =
+      lib.optionalAttrs (cfg.globalNetwork != null) {
        init-docker-networks = {
-    description = "Crear redes globales de Docker si no existen";
+          description = "Create the ${cfg.globalNetwork} Docker network if it doesn't exist";
          after = [ "docker.service" ];
          requires = [ "docker.service" ];
          wantedBy = [ "multi-user.target" ];
          serviceConfig = {
            Type = "oneshot";
            RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.docker}/bin/docker network inspect homelab_net >/dev/null 2>&1 || ${pkgs.docker}/bin/docker network create homelab_net'";
-    };
-  };
-  docker-compose-tools = {
-    description = "Stack de Docker Compose: Tools";
-    after = [ "docker.service" "network-online.target" "tailscaled.service" ];
-    wants = [ "docker.service" "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/tools";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
-    };
-  };
-  docker-compose-arrs = {
-    description = "Stack de Docker Compose: Arrs";
-    after = [ "docker.service" "docker-compose-tools.service" "local-fs.target" ];
-    wants = [ "docker.service" "docker-compose-tools.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/arrs";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
-    };
-  };
-  docker-compose-gameservers = {
-    description = "Stack de Docker Compose: Gameservers";
-    after = [ "docker.service" "docker-compose-tools.service" ];
-    wants = [ "docker.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/gameserver";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
-    };
+            ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.docker}/bin/docker network inspect ${cfg.globalNetwork} >/dev/null 2>&1 || ${pkgs.docker}/bin/docker network create ${cfg.globalNetwork}'";
          };
        };
      }
+      // lib.mapAttrs' mkComposeService cfg.composeStacks;
+  };
+}
@@ -9,5 +9,7 @@
    options = "--delete-older-than 14d";
  };

-  services.journald.extraConfig = "SystemMaxUse=500M";
+  services.journald.settings.Journal = {
+    SystemMaxUse = "500M";
+  };
 }
@@ -0,0 +1,35 @@
+{ pkgs, ... }:
+
+{
+  services.ollama = {
+    enable = true;
+    # `services.ollama.acceleration` does not exist (that option only lives on
+    # services.tabby); GPU backend selection for ollama is done by package choice.
+    package = pkgs.ollama-rocm;
+
+    # Same "don't expose services directly" pattern as the rest of the homelab:
+    # bind to localhost only. If this needs to be reachable from other devices
+    # later, put it behind Traefik + Headscale like the other services instead
+    # of opening it up directly.
+    host = "127.0.0.1";
+    port = 11434;
+
+    environmentVariables = {
+      # Ollama is on-demand by design: it loads a model into VRAM on the first
+      # request and unloads it after this much idle time. 5m is already the
+      # ollama default, set explicitly so it's not an implicit behavior.
+      OLLAMA_KEEP_ALIVE = "5m";
+    };
+
+    # RDNA4 (gfx1200/gfx1201, incl. the RX 9060 XT) has official ROCm support
+    # since ROCm 6.4.4. Verified on this host (2026-08-30) with rocmPackages.clr
+    # 7.2.3: `rocminfo` correctly reports "Name: gfx1200" and `rocm-smi
+    # --showmeminfo vram` reports the full 16GiB, so the "detected with 0 VRAM,
+    # falls back to CPU" issue does not reproduce here and rocmOverrideGfx is
+    # not needed. If a future nixpkgs bump regresses this, re-check with:
+    #   nix shell nixpkgs#rocmPackages.rocminfo -c rocminfo | grep -i gfx
+    #   nix shell nixpkgs#rocmPackages.rocm-smi -c rocm-smi --showmeminfo vram
+    # and only then set rocmOverrideGfx = "12.0.0"; (gfx1200) if VRAM reports 0.
+    # rocmOverrideGfx = "12.0.0";
+  };
+}
@@ -0,0 +1,27 @@
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "vfs objects" = "acl_xattr";
+        "map acl inherit" = "yes";
+        "store dos attributes" = "yes";
+      };
+      mikufanclub = {
+        path = "/mnt/data/mikufanclub";
+        writable = "yes";
+        "valid users" = "mikushare emmatherock";
+        "force group" = "mikushare-group";
+        "create mask" = "0660";
+        "directory mask" = "0770";
+      };
+      data-private = {
+        path = "/mnt/data";
+        writable = "yes";
+        "valid users" = "emmatherock";
+        "browseable" = "yes";
+      };
+    };
+  };
+}
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  options.myHomeProfile.extraPrograms = lib.mkOption {
+    type = lib.types.listOf lib.types.path;
+    default = [ ];
+    description = "Extra Home Manager modules to import for this user, on top of the core profile.";
+  };
+}
@@ -1,81 +1,207 @@
-{ config, pkgs, ... }: {
-  networking = {
-    hostName = "miku-homelab";
-    networkmanager.enable = true;
+{ config, lib, ... }:
+
+let
+  cfg = config.myNetworking;
+
+  wireguardPeerOpts = { ... }: {
+    options = {
+      publicKey = lib.mkOption {
+        type = lib.types.str;
+        description = "Public key of the remote WireGuard peer.";
+      };
+      allowedIPs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "IP ranges routed through this peer.";
+      };
+      endpoint = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Endpoint (host:port) of the remote peer, if it has a stable address.";
+      };
+      persistentKeepalive = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
+        default = null;
+        description = "Interval in seconds for sending keepalive packets to this peer.";
+      };
+    };
+  };
+in
+{
+  options.myNetworking = {
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      description = "The system hostname.";
+    };
+
+    useNetworkManager = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to enable NetworkManager to manage network interfaces.";
+    };
+
+    useNetworkd = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to configure the static IP via systemd-networkd instead of the classic scripted networking backend. Needed for reliable onlink default routes.";
+    };
+
+    staticIp = lib.mkOption {
+      type = lib.types.nullOr (lib.types.submodule {
+        options = {
+          interface = lib.mkOption {
+            type = lib.types.str;
+            description = "Network interface to assign the static address to.";
+          };
+          address = lib.mkOption {
+            type = lib.types.str;
+            description = "Static IPv4 address for the interface.";
+          };
+          prefixLength = lib.mkOption {
+            type = lib.types.int;
+            description = "IPv4 prefix length for the static address.";
+          };
+          gateway = lib.mkOption {
+            type = lib.types.str;
+            description = "Default gateway address.";
+          };
+          nameservers = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "1.1.1.1" "8.8.8.8" ];
+            description = "DNS nameservers to use.";
+          };
+          onlinkGateway = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Whether the gateway lies outside the interface's subnet, requiring the onlink flag on the default route.";
+          };
+        };
+      });
+      default = null;
+      description = "Static IPv4 configuration for this host. Leave null to rely on DHCP or NetworkManager.";
+    };
+
+    extraUdpPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+      description = "Additional UDP ports to open in the firewall, beyond the Tailscale port.";
+    };
+
+    extraTcpPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+      description = "Additional TCP ports to open in the firewall, beyond SSH.";
+    };
+
+    sshAllowUsers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Usernames allowed to log in over SSH. Empty means no restriction is applied.";
+    };
+
+    wireguard = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to configure a WireGuard interface named wg-<hostName> on this host.";
+      };
+      ips = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "IP addresses (with prefix length) assigned to the local WireGuard interface.";
+      };
+      privateKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Path to the file containing this host's WireGuard private key.";
+      };
+      listenPort = lib.mkOption {
+        type = lib.types.nullOr lib.types.port;
+        default = null;
+        description = "UDP port for the WireGuard interface to listen on. Leave null to auto-select, which is fine for hosts that only initiate connections outward.";
+      };
+      peers = lib.mkOption {
+        type = lib.types.listOf (lib.types.submodule wireguardPeerOpts);
+        default = [ ];
+        description = "WireGuard peers this host connects to.";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      networking = lib.mkMerge [
+        {
+          hostName = cfg.hostName;
+          networkmanager.enable = cfg.useNetworkManager;
          firewall = {
            enable = true;
-      allowedUDPPorts = [ config.services.tailscale.port 80 443 4242 49983 24800 26900 60977];
-      allowedTCPPorts = [ 22 80 443 4242 49983 24800 26900 60977];
+            allowedUDPPorts = [ config.services.tailscale.port ] ++ cfg.extraUdpPorts;
+            allowedTCPPorts = [ 22 ] ++ cfg.extraTcpPorts;
          };
-    useDHCP = false;
-    interfaces.enp6s0.ipv4.addresses = [{
-      address = "10.1.1.21";
-      prefixLength = 24;
-    }];
-    defaultGateway = "10.1.1.1";
-    nameservers = [ "1.1.1.1" "8.8.8.8" ];
-
-    wireguard.interfaces = {
-      wg-miku-homelab = {
-        ips = [ "10.20.0.2/24" ];
-        privateKeyFile = "/etc/wireguard/miku-homelab_private.key";
-
-        peers = [
-          {
-            publicKey = "zERcSEQhan+xtmPOIjuVSkQaBynTjH96SgZZF9CZNV8=";
-            allowedIPs = [ "10.20.0.1/32" ];
-            endpoint = "vps.external.mikufanclub.lat:51822";
-            persistentKeepalive = 25;
        }
+        (lib.mkIf (cfg.staticIp != null && !cfg.useNetworkd) {
+          useDHCP = false;
+          interfaces.${cfg.staticIp.interface}.ipv4.addresses = [{
+            address = cfg.staticIp.address;
+            prefixLength = cfg.staticIp.prefixLength;
+          }];
+          nameservers = cfg.staticIp.nameservers;
+        })
+        (lib.mkIf (cfg.staticIp != null && !cfg.useNetworkd && !cfg.staticIp.onlinkGateway) {
+          defaultGateway = cfg.staticIp.gateway;
+        })
+        (lib.mkIf cfg.wireguard.enable {
+          wireguard.interfaces."wg-${cfg.hostName}" = {
+            ips = cfg.wireguard.ips;
+            privateKeyFile = cfg.wireguard.privateKeyFile;
+            listenPort = cfg.wireguard.listenPort;
+            peers = map (peer: {
+              inherit (peer) publicKey allowedIPs;
+            } // lib.optionalAttrs (peer.endpoint != null) {
+              inherit (peer) endpoint;
+            } // lib.optionalAttrs (peer.persistentKeepalive != null) {
+              inherit (peer) persistentKeepalive;
+            }) cfg.wireguard.peers;
+          };
+        })
      ];
-      };
-    };
-  };

      services.tailscale.enable = true;
+
      services.openssh = {
        enable = true;
        settings = {
          PermitRootLogin = "no";
          PasswordAuthentication = false;
-      AllowUsers = [ "emmatherock" ];
-    };
-  };
-
-  services.samba = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      global = {
-        "vfs objects" = "acl_xattr";
-        "map acl inherit" = "yes";
-        "store dos attributes" = "yes";
-      };
-      mikufanclub = {
-        path = "/mnt/data/mikufanclub";
-        writable = "yes";
-        "valid users" = "mikushare emmatherock";
-        "force group" = "mikushare-group";
-        "create mask" = "0660";
-        "directory mask" = "0770";
-      };
-      data-private = {
-        path = "/mnt/data";
-        writable = "yes";
-        "valid users" = "emmatherock";
-        "browseable" = "yes";
-      };
-    };
-  };
-
-  systemd.services.tailscale-udp-gro = {
-    description = "Configurar UDP GRO para Tailscale";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${pkgs.ethtool}/bin/ethtool -K enp6s0 rx-udp-gro-forwarding on rx-gro-list on";
-      RemainAfterExit = true;
+        } // lib.optionalAttrs (cfg.sshAllowUsers != [ ]) {
+          AllowUsers = cfg.sshAllowUsers;
        };
      };
    }
+
+    (lib.mkIf (cfg.staticIp != null && cfg.useNetworkd) {
+      networking.useDHCP = false;
+      systemd.network.enable = true;
+      services.resolved.enable = true;
+
+      systemd.network.networks."10-${cfg.staticIp.interface}" = {
+        matchConfig.Name = cfg.staticIp.interface;
+        address = [ "${cfg.staticIp.address}/${toString cfg.staticIp.prefixLength}" ];
+        dns = cfg.staticIp.nameservers;
+        routes = [
+          ({
+            routeConfig = {
+              Gateway = cfg.staticIp.gateway;
+            } // lib.optionalAttrs cfg.staticIp.onlinkGateway {
+              GatewayOnLink = true;
+            };
+          })
+        ];
+        networkConfig = {
+          DHCP = "no";
+        };
+        linkConfig.RequiredForOnline = "routable";
+      };
+    })
+  ];
+}
@@ -1,14 +1,25 @@
-{pkgs, ... }: 
+{ lib, pkgs, config, ... }:
+
+let
+  cfg = config.myPackages;
+in
 {
+  options.myPackages = {
+    extra = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = "Extra packages to install on this host, beyond the core set.";
+    };
+  };
+
+  config = {
    environment.systemPackages = with pkgs; [
      git
      wget
      curl
      ethtool
      fish
-    rocmPackages.rocm-smi
-    btrfs-progs
-    distrobox
-    steam-run
-  ];
+      tmux
+    ] ++ cfg.extra;
+  };
 }
@@ -1,25 +1,88 @@
-{ pkgs, ... }: {
+{ lib, pkgs, config, ... }:
+
+let
+  cfg = config.myUsers;
+
+  adminOpts = { ... }: {
+    options = {
+      description = lib.mkOption {
+        type = lib.types.str;
+        description = "Human-readable description (full name) for this user.";
+      };
+      shell = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.bash;
+        description = "Login shell package for this user.";
+      };
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Extra groups this user belongs to.";
+      };
+      authorizedKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "OpenSSH public keys authorized to log in as this user.";
+      };
+    };
+  };
+
+  serviceUserOpts = { ... }: {
+    options = {
+      description = lib.mkOption {
+        type = lib.types.str;
+        description = "Human-readable description for this service user.";
+      };
+      group = lib.mkOption {
+        type = lib.types.str;
+        description = "Primary group for this service user.";
+      };
+      createHome = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to create a home directory for this service user.";
+      };
+    };
+  };
+in
+{
+  options.myUsers = {
+    admins = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule adminOpts);
+      default = { };
+      description = "Admin users with interactive shell access.";
+    };
+
+    serviceUsers = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule serviceUserOpts);
+      default = { };
+      description = "Service users without administrative privileges, used for things like file shares.";
+    };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra system groups to create, beyond the ones implied by admins/serviceUsers.";
+    };
+  };
+
+  config = {
    environment.localBinInPath = true;

-  users.groups.mikushare-group = {};
+    users.groups = lib.genAttrs cfg.extraGroups (_: { });

-  users.groups.plugdev = {};
-
-  users.users.emmatherock = {
+    users.users = lib.mapAttrs
+      (_: admin: {
        isNormalUser = true;
-    description = "EmmaTheRock";
-    shell = pkgs.fish;
-    extraGroups = [ "plugdev" "networkmanager" "wheel" "video" "mikushare-group" "render" ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIpTslcK0yQ6k+h8foNl17wVRyJUfEGzq7f1h3014WNB s21 plus"
-    ];
-  };
-
-  users.users.mikushare = {
-    isNormalUser = true;
-    description = "Acceso remoto Mikufanclub";
-    group = "mikushare-group";
-    createHome = false;
+        inherit (admin) description shell extraGroups;
+        openssh.authorizedKeys.keys = admin.authorizedKeys;
+      })
+      cfg.admins
+    // lib.mapAttrs
+      (_: svc: {
+        isSystemUser = true;
+        inherit (svc) description group createHome;
+      })
+      cfg.serviceUsers;
  };
 }
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 IW6ZLQ fGdkbwV5VE8c5ueKCr/q3Agl9cKnqzmpPUGQsOTMqVU
+ZvXNujDfCWxuprM/2k7FR7aeNcpwU+cAd9H+ZByYOkE
+-> ssh-ed25519 h0IYxQ 3PzwNp8Sn8eeYBNMBKOJ+hoH9uxVlgV0RtqsPdZNtnM
+WDLCfjfmKsj3u0GL+luYLwwXit98RLbgwMBNzp+x24U
+-> ssh-ed25519 4D7N4w 3ndiKKCZSJoZNpn1HElFnyPOx8DeFJPm9iAMQdtm4SM
+KqX/oScwxOhOqHM1Z+uoXWMRZrCpl5ax6BuHiy6puwc
+--- CEVnIJUTA60ffvNCDrodud14KIfucXHub+tl7tXX/N4
+ÅÐ¨b³ú_zj(Ãö…s>îãF¼x£UßãFØ¹ÝÓÛñS·ˆ`†ŸOdÙ…N‰lÛFã%š LfÇ—FfÞ‡#ê6ò‘ðÎ
@@ -0,0 +1,19 @@
+let
+  # Emma's personal SSH keys (same ones authorized in modules/system/users.nix),
+  # so secrets can be edited/re-keyed from his own workstations.
+  emma-main-pc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC";
+  emma-s21-plus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIpTslcK0yQ6k+h8foNl17wVRyJUfEGzq7f1h3014WNB s21 plus";
+  emma-nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEUCpjAuJobymPPAoPjLdL1eD6g4v6wrquu3cyHP22Wj emmatherock@NixOS";
+
+  # Host SSH host keys, used by agenix at runtime to decrypt (via the default
+  # age.identityPaths, which points at services.openssh host keys).
+  miku-homelab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH7zsQdzX7RHRd2plwrTKJR89uwR2YfzBm1n+HkcYEbb root@NixOS";
+
+  vps = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDh8+hpWkGLRszFI4TC1/YHB8IiSdM0UUOsWbOwXPLn6 root@vps";
+
+  admins = [ emma-main-pc emma-s21-plus emma-nixos ];
+in
+{
+  "miku-homelab-wg.age".publicKeys = admins ++ [ miku-homelab ];
+  "vps-wg.age".publicKeys = admins ++ [ vps ];
+}
Author	SHA1	Message	Date
emmatherock	437697cbd5	chore(flake): update locked inputs	2026-09-21 08:53:06 -03:00
emmatherock	367c4bde11	refactor(journald): migrate retention setting	2026-09-21 08:52:55 -03:00
emmatherock	af50f7f39d	feat(homelab): update network and swap configuration	2026-09-21 08:52:47 -03:00
emmatherock	627c848d1d	refactor(neovim): move configuration to nixvim branch	2026-09-21 08:43:50 -03:00
emmatherockandClaude Sonnet 5	09b138391b	feat(vps): add wireguard peer 10.20.0.3 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-07 22:55:53 -03:00
emmatherock	0aa0cc0e0d	feat(neovim): add OSC 52 clipboard support for SSH sessions Lets "+y/"+p sync with the system clipboard over SSH (Termius -> VPS/homelab) without relying on a local clipboard provider.	2026-09-05 20:01:42 -03:00
emmatherock	5d9cd9d835	feat(neovim): add snippets, autopairs and surround	2026-09-04 20:51:47 -03:00
emmatherockandClaude Sonnet 5	656fc82d7f	feat(neovim): add Dockerfile/Compose LSP and treesitter support Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-04 18:06:36 -03:00
emmatherockandClaude Sonnet 5	f37b4db130	chore(flake): update flake.lock inputs Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018myBNc8EqfqaQmYrKdkxVM	2026-09-03 21:55:35 -03:00
emmatherockandClaude Sonnet 5	52c6a60404	feat(vps): enable IP forwarding for exit node support Required so the host can route traffic as a Tailscale/Headscale exit node. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-01 15:43:17 -03:00
emmatherock	f7c68efe3d	chore(codex): configure NixOS MCP server	2026-08-31 03:59:06 -03:00
emmatherock	07c53ac387	docs(todo): remove completed items	2026-08-31 03:59:06 -03:00
emmatherock	0ea3a46059	fix(neovim): use canonical Codex adapter name	2026-08-31 03:59:06 -03:00
emmatherock	b4443ea131	feat(homelab): add Ollama service with ROCm	2026-08-31 03:59:06 -03:00
emmatherockandClaude Sonnet 5	e47eef6e56	refactor(neovim): switch CodeCompanion adapter from gemini_cli to codex_acp Reuses the codex CLI's ChatGPT login (auth_method = "chat-gpt") instead of gemini's oauth-personal, and disables adapter preset noise in the picker. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-30 15:47:09 -03:00
emmatherock	f4ac164633	feat(neovim): add vim-fugitive for Git integration Enables interactive status, commits, push/pull, and file diffs via <leader>g{s,c,p,l,d}, complementing gitsigns' hunk-level view.	2026-08-30 12:54:29 -03:00
emmatherock	b14d48b3e2	refactor(agents): drop gemini-cli from home packages	2026-08-30 12:54:23 -03:00
emmatherock	3475d0cde1	feat(neovim): add chat window configuration with vertical layout	2026-08-29 15:49:04 -03:00
emmatherock	65d251504a	refactor(flake.lock): remove obsolete nixpkgs_5 entry and update nixvim inputs	2026-08-29 14:45:01 -03:00
emmatherock	2b24333e3f	feat(flake): restructure nixvim input to include follows attribute	2026-08-29 14:44:56 -03:00
emmatherock	8d0589e157	feat(neovim): add additional formatting and search tools to plugins	2026-08-29 14:44:51 -03:00
emmatherock	bb549a8ad9	feat(agents): add codex-acp and claude-agent-acp to home packages	2026-08-29 14:06:10 -03:00
emmatherock	9ab0508157	feat(flake.lock): update flake inputs and locked versions for nixvim and flake-parts	2026-08-29 13:09:55 -03:00
emmatherock	ca6e2b5a57	refactor(packages): remove vim and fastfetch from home packages	2026-08-29 13:09:49 -03:00
emmatherock	ce139a1eec	feat(core): add fastfetch to home packages	2026-08-29 13:09:44 -03:00
emmatherock	679d18b278	feat(agents): update home packages to include gemini-cli and codex	2026-08-29 13:09:37 -03:00
emmatherock	b4f0765591	feat(neovim): add Neovim configuration and integrate with home profiles	2026-08-29 13:09:27 -03:00
emmatherock	01753a10f6	feat(default.nix): add extraPrograms to myHomeProfile for agent configuration	2026-08-26 03:49:00 -03:00
emmatherock	125edfb31b	fix(users): update authorizedKeys for user emmatherock	2026-08-26 01:46:33 -03:00
emmatherock	58a47d94fb	fix(users): update authorizedKeys for user emmatherock	2026-08-26 01:46:15 -03:00
emmatherock	81a7e80360	fix(flake.lock): update locked dependencies and their revisions	2026-08-26 01:28:03 -03:00
emmatherock	44d14fca6d	feat(configuration): update NixOS description and enhance direnv integration	2026-08-26 01:27:52 -03:00
emmatherock	8770e95bbe	fix(flake.lock): update locked dependencies and their revisions	2026-08-18 13:28:34 -03:00
emmatherock	2ecc910de4	feat(networking): enable useNetworkd option for static IP configuration	2026-08-18 13:24:02 -03:00
emmatherock	40f0dc0d45	feat(networking): add onlinkGateway option for static IP configuration	2026-08-13 21:34:30 -03:00
emmatherock	7a276567c6	fix(vps): update network interface from eth0 to ens3	2026-08-13 02:47:07 -03:00
emmatherockandClaude Sonnet 5	5a4b51112f	feat(home-manager): add core+extras profile and wire it into vps Introduce myHomeProfile.extraPrograms (mirrors myPackages.extra) so each host's NixOS config declares which extra Home Manager modules it needs on top of a shared core (fish, starship, btop, git). miku-homelab's former home.nix becomes its extras list; vps gets home-manager for the first time using core alone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 02:43:27 -03:00
emmatherockandClaude Sonnet 5	e008288d52	feat(vps): switch to systemd-boot, set Buenos Aires timezone, bump stateVersion Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 04:00:48 -03:00
emmatherockandClaude Sonnet 5	1dcd29fd96	chore(vps): remove stale placeholder comment for vps-wg secret Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 03:54:31 -03:00
emmatherockandClaude Sonnet 5	64b031ceba	feat(vps): add real vps WireGuard key and update miku-homelab peer Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 03:53:32 -03:00
emmatherockandClaude Sonnet 5	f3ddbb162c	feat(secrets): wire up real vps SSH host key and new admin key Fills in the real vps host key (replacing the install placeholder) and registers vps-wg.age for agenix. Also adds Emma's NixOS-machine SSH key as an admin decrypt key and to the vps host's authorizedKeys. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 03:41:10 -03:00
emmatherockandClaude Sonnet 5	d0cb1b5090	feat(vps): use real generated hardware-configuration.nix Replaces the placeholder with the actual output of nixos-generate-config from the installed VPS (real disk UUIDs, qemu-guest profile, virtio kernel modules). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 03:21:07 -03:00
emmatherockandClaude Sonnet 5	7c2a09a360	refactor(packages): split core packages from per-host extras modules/system/packages.nix now exposes myPackages.extra so hosts can add their own tools on top of the always-installed core set, instead of hardcoding every host's packages in one shared list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 03:20:28 -03:00
emmatherock	933afc7d11	feat(plasma): update cursor theme to layan-cursors and enable pointer cursor	2026-08-12 00:08:38 -03:00
emmatherockandClaude Sonnet 5	42e60a3bb5	feat(hosts): make config multi-host and add vps host Parametrize networking, users, and containers modules under myNetworking/myUsers/myContainers so both hosts share the same logic instead of duplicating it, and split desktop/server module imports into modules/profiles/. Adds hosts/vps (not installed yet, hardware config and bootloader device are placeholders) to run Traefik, Headscale, Headplane, and Gitea via a combined Docker Compose stack. Wires up agenix for secrets and migrates miku-homelab's WireGuard private key off a plain filesystem path into an encrypted secrets/miku-homelab-wg.age. The vps side of that tunnel still needs its own key generated and encrypted after install. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 00:07:55 -03:00