From ab5a7b2abf422ce102bf7a22b874fe7aa48f08e1 Mon Sep 17 00:00:00 2001
From: intergrav <devin@devins.page>
Date: Fri, 14 Aug 2026 20:31:27 +0000
Subject: [PATCH] refactor: cleanup

---
 flake.lock | 22 +++++++++++-----------
 flake.nix | 2 ++
 hosts/darwin/d-macbook/default.nix | 4 ++--
 hosts/darwin/d-macbook/users/default.nix | 6 ++++++
 hosts/darwin/d-macbook/users/devin/restray.nix | 2 +-
 hosts/darwin/default.nix | 14 ++------------
 hosts/nixos/bluepill-proxy/default.nix | 9 +--------
 hosts/nixos/bluepill-proxy/services/tinysub.nix | 2 +-
 hosts/nixos/bluepill/default.nix | 14 ++------------
 hosts/nixos/bluepill/programs/restray.nix | 2 +-
 hosts/nixos/bluepill/services/restic.nix | 10 ++++++++--
 hosts/nixos/bluepill/services/samba.nix | 10 +++++-----
 hosts/nixos/bluepill/services/slskd.nix | 2 +-
 hosts/nixos/bluepill/services/tranquil-pds.nix | 6 +-----
 hosts/nixos/bluepill/services/transmission.nix | 2 +-
 hosts/nixos/bluepill/users/default.nix | 3 +++
 hosts/nixos/d-latitude/default.nix | 12 ++----------
 hosts/nixos/d-latitude/hardware.nix | 1 -
 hosts/nixos/d-latitude/users/default.nix | 5 +++++
 hosts/nixos/default.nix | 10 +++-------
 justfile | 2 +-
 modules/common/default.nix | 1 +
 modules/darwin/default.nix | 12 +++++++++++-
 modules/nixos/default.nix | 7 ++++---
 modules/nixos/server.nix | 10 ++++++++++
 modules/nixos/services/tailscaled.nix | 9 +++++++--
 modules/users/devin/default.nix | 5 +++--
 modules/users/devin/desktop/default.nix | 11 +++--------
 modules/users/devin/programs/git.nix | 2 +-
 secrets/secrets.nix | 1 -
 30 file(s) changed, 99 insertion(s)(+), 99 deletion(s)(-)

diff --git a/flake.lock b/flake.lock
--- a/flake.lock
+++ b/flake.lock
@@ -347,11 +347,11 @@ "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1786031233,
-        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
+        "lastModified": 1786719456,
+        "narHash": "sha256-B74DLQs/VjlqyhnnX3tguWwghqJHWSJX30TKZuAljIg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7834e82588860aaf780cec1366524456a70898d7",
+        "rev": "83b7606dcf44abe3a94b86e8bb2b3355d22e8797",
         "type": "github"
       },
       "original": {
@@ -626,11 +626,11 @@ }
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1785967620,
-        "narHash": "sha256-929m7iW8q2uv3mZHNwY8Um6XKj99rbIcZsWS9cT1vaI=",
-        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
+        "lastModified": 1786599213,
+        "narHash": "sha256-yjGG65gA1jORt0hWxjzrnw3AYkIn8EWolp8vezwXZ3I=",
+        "rev": "0e251e24a4f24e036a084b6b4b2d2491af4167f4",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1048607.b7c2ada94fe9/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1053317.0e251e24a4f2/nixexprs.tar.zst"
       },
       "original": {
         "type": "tarball",
@@ -888,11 +888,11 @@ "sqlite-lib-src": "sqlite-lib-src",
         "tailwindcss-animated-src": "tailwindcss-animated-src"
       },
       "locked": {
-        "lastModified": 1786007269,
-        "narHash": "sha256-qyiznPAvQXmAuR7Dmctbx9oFdz5zhQEubCpptyw3dyc=",
+        "lastModified": 1786717989,
+        "narHash": "sha256-b1TcthI3G/0tLS1udegvGyY3TvoZcyhA8XfD0Apjuq8=",
         "ref": "refs/heads/master",
-        "rev": "bc73af0594d43e3718142b072b3c6f6e815bed81",
-        "revCount": 3093,
+        "rev": "7ccb643019f40022b48296c202091be23af90fcc",
+        "revCount": 3111,
         "type": "git",
         "url": "https://tangled.org/tangled.org/core"
       },
diff --git a/flake.nix b/flake.nix
--- a/flake.nix
+++ b/flake.nix
@@ -1,4 +1,6 @@
 {
+  description = "Devin's configurations";
+
   inputs = {
     nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
     nix-darwin = {
diff --git a/hosts/darwin/d-macbook/default.nix b/hosts/darwin/d-macbook/default.nix
--- a/hosts/darwin/d-macbook/default.nix
+++ b/hosts/darwin/d-macbook/default.nix
@@ -3,7 +3,7 @@ pkgs,
   inputs,
   ...
 }: {
-  home-manager.users.devin.imports = [./users/devin/restray.nix];
+  imports = [./users];
 
   environment.systemPackages = with pkgs; [
     cinny-desktop
@@ -25,7 +25,7 @@ tailscale-gui
     transmission_4
     utm
 
-    inputs.restray.packages.${pkgs.system}.default
+    inputs.restray.packages.${pkgs.stdenv.hostPlatform.system}.default
   ];
 
   fonts.packages = with pkgs; [
diff --git a/hosts/darwin/d-macbook/users/default.nix b/hosts/darwin/d-macbook/users/default.nix
new file mode 100644
--- /dev/null
+++ b/hosts/darwin/d-macbook/users/default.nix
@@ -0,0 +1,6 @@
+{
+  home-manager.users.devin.imports = [
+    ../../../../modules/users/devin/desktop
+    ./devin/restray.nix
+  ];
+}
diff --git a/hosts/darwin/d-macbook/users/devin/restray.nix b/hosts/darwin/d-macbook/users/devin/restray.nix
--- a/hosts/darwin/d-macbook/users/devin/restray.nix
+++ b/hosts/darwin/d-macbook/users/devin/restray.nix
@@ -14,7 +14,7 @@ path = "${config.home.homeDirectory}/.local/state/agenix/restray-onedrive";
   };
 
   home.packages = with pkgs; [
-    inputs.restray.packages.${pkgs.system}.default
+    inputs.restray.packages.${pkgs.stdenv.hostPlatform.system}.default
     restic
   ];
 
diff --git a/hosts/darwin/default.nix b/hosts/darwin/default.nix
--- a/hosts/darwin/default.nix
+++ b/hosts/darwin/default.nix
@@ -9,28 +9,18 @@ [./${host}]
         ++ [
           ../../modules/common
           ../../modules/darwin
-          inputs.agenix.darwinModules.default
-          inputs.home-manager.darwinModules.default
-          inputs.mac-app-util.darwinModules.default
-          ({inputs, ...}: {
-            home-manager.sharedModules = [inputs.mac-app-util.homeManagerModules.default];
-          })
+          ../../modules/users/devin
         ]
         ++ extraModules;
     }
 ) {
-  d-macbook = [
-    ../../modules/users/devin
-    ../../modules/users/devin/desktop
-  ];
+  d-macbook = [];
 
   bluellama = [
-    ../../modules/users/devin
     ../../modules/darwin/services/tailscaled.nix
   ];
 
   bluellama2 = [
-    ../../modules/users/devin
     ../../modules/darwin/services/tailscaled.nix
   ];
 }
diff --git a/hosts/nixos/bluepill-proxy/default.nix b/hosts/nixos/bluepill-proxy/default.nix
--- a/hosts/nixos/bluepill-proxy/default.nix
+++ b/hosts/nixos/bluepill-proxy/default.nix
@@ -8,17 +8,10 @@
   networking = {
     hostName = "bluepill-proxy";
     domain = "vps.ovh.us";
-    useNetworkd = true;
   };
 
   system = {
-    autoUpgrade = {
-      enable = true;
-      flake = "git+https://tangled.org/devins.page/flake";
-      flags = ["-L"];
-      dates = "04:40";
-      allowReboot = true;
-    };
+    autoUpgrade.allowReboot = true;
     stateVersion = "24.11";
   };
 }
diff --git a/hosts/nixos/bluepill-proxy/services/tinysub.nix b/hosts/nixos/bluepill-proxy/services/tinysub.nix
--- a/hosts/nixos/bluepill-proxy/services/tinysub.nix
+++ b/hosts/nixos/bluepill-proxy/services/tinysub.nix
@@ -5,7 +5,7 @@ ...
 }: {
   services.caddy.virtualHosts."tinysub.devins.page" = {
     extraConfig = ''
-      root ${inputs.tinysub.packages.${pkgs.system}.default}
+      root ${inputs.tinysub.packages.${pkgs.stdenv.hostPlatform.system}.default}
 
       encode
 
diff --git a/hosts/nixos/bluepill/default.nix b/hosts/nixos/bluepill/default.nix
--- a/hosts/nixos/bluepill/default.nix
+++ b/hosts/nixos/bluepill/default.nix
@@ -3,9 +3,8 @@ imports = [
     ./hardware.nix
     ./programs
     ./services
+    ./users
   ];
-
-  home-manager.users.devin.imports = [./users/devin/beets.nix];
 
   nixpkgs.config.permittedInsecurePackages = [
     "olm-3.2.16"
@@ -13,16 +12,7 @@ ];
 
   networking = {
     hostName = "bluepill";
-    useNetworkd = true;
   };
 
-  system = {
-    autoUpgrade = {
-      enable = true;
-      flake = "git+https://tangled.org/devins.page/flake";
-      flags = ["-L"];
-      dates = "04:40";
-    };
-    stateVersion = "24.11";
-  };
+  system.stateVersion = "24.11";
 }
diff --git a/hosts/nixos/bluepill/programs/restray.nix b/hosts/nixos/bluepill/programs/restray.nix
--- a/hosts/nixos/bluepill/programs/restray.nix
+++ b/hosts/nixos/bluepill/programs/restray.nix
@@ -4,7 +4,7 @@ pkgs,
   ...
 }: {
   environment.systemPackages = with pkgs; [
-    inputs.restray.packages.${pkgs.system}.default
+    inputs.restray.packages.${pkgs.stdenv.hostPlatform.system}.default
     restic
   ];
 }
diff --git a/hosts/nixos/bluepill/services/restic.nix b/hosts/nixos/bluepill/services/restic.nix
--- a/hosts/nixos/bluepill/services/restic.nix
+++ b/hosts/nixos/bluepill/services/restic.nix
@@ -1,7 +1,13 @@
-{
+_: let
+  dataDir = "/mnt/backup/restic";
+in {
   services.restic.server = {
     enable = true;
-    dataDir = "/mnt/backup/restic";
+    inherit dataDir;
     privateRepos = true;
   };
+
+  systemd.tmpfiles.rules = [
+    "Z ${dataDir} - restic restic -"
+  ];
 }
diff --git a/hosts/nixos/bluepill/services/samba.nix b/hosts/nixos/bluepill/services/samba.nix
--- a/hosts/nixos/bluepill/services/samba.nix
+++ b/hosts/nixos/bluepill/services/samba.nix
@@ -1,4 +1,4 @@
-{pkgs, ...}: {
+{
   users.groups.share-general.members = ["transmission" "devin"];
   users.groups.share-media.members = ["jellyfin" "navidrome" "gonic" "slskd" "transmission" "devin"];
 
@@ -38,22 +38,22 @@ };
       "transmission" = {
         "path" = "/var/lib/transmission";
         "comment" = "transmission daemon directory";
-        "writeable" = "yes";
+        "read only" = "no";
       };
       "slskd" = {
         "path" = "/var/lib/slskd";
         "comment" = "soulseek daemon directory";
-        "writeable" = "yes";
+        "read only" = "no";
       };
       "general" = {
         "path" = "/srv/general";
         "comment" = "general miscellaneous stuff, like docs and downloads and other archival things";
-        "writeable" = "yes";
+        "read only" = "no";
       };
       "media" = {
         "path" = "/srv/media";
         "comment" = "devin's music, tv (mostly anime), movies, and more";
-        "writeable" = "yes";
+        "read only" = "no";
       };
     };
   };
diff --git a/hosts/nixos/bluepill/services/slskd.nix b/hosts/nixos/bluepill/services/slskd.nix
--- a/hosts/nixos/bluepill/services/slskd.nix
+++ b/hosts/nixos/bluepill/services/slskd.nix
@@ -21,6 +21,6 @@ };
   };
 
   systemd.tmpfiles.rules = [
-    "Z /var/lib/slskd 0775 slskd slskd -"
+    "d /var/lib/slskd 2770 slskd slskd -"
   ];
 }
diff --git a/hosts/nixos/bluepill/services/tranquil-pds.nix b/hosts/nixos/bluepill/services/tranquil-pds.nix
--- a/hosts/nixos/bluepill/services/tranquil-pds.nix
+++ b/hosts/nixos/bluepill/services/tranquil-pds.nix
@@ -1,8 +1,4 @@
-{
-  config,
-  lib,
-  ...
-}: {
+{config, ...}: {
   age.secrets.tranquil-pds = {
     file = ../../../../secrets/tranquil-pds.age;
     owner = "tranquil-pds";
diff --git a/hosts/nixos/bluepill/services/transmission.nix b/hosts/nixos/bluepill/services/transmission.nix
--- a/hosts/nixos/bluepill/services/transmission.nix
+++ b/hosts/nixos/bluepill/services/transmission.nix
@@ -29,6 +29,6 @@ };
   };
 
   systemd.tmpfiles.rules = [
-    "Z /var/lib/transmission 0770 transmission transmission -"
+    "d /var/lib/transmission 2770 transmission transmission -"
   ];
 }
diff --git a/hosts/nixos/bluepill/users/default.nix b/hosts/nixos/bluepill/users/default.nix
new file mode 100644
--- /dev/null
+++ b/hosts/nixos/bluepill/users/default.nix
@@ -0,0 +1,3 @@
+{
+  home-manager.users.devin.imports = [./devin/beets.nix];
+}
diff --git a/hosts/nixos/d-latitude/default.nix b/hosts/nixos/d-latitude/default.nix
--- a/hosts/nixos/d-latitude/default.nix
+++ b/hosts/nixos/d-latitude/default.nix
@@ -1,10 +1,7 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   imports = [
     ./hardware.nix
+    ./users
   ];
 
   boot.loader.systemd-boot.enable = true;
@@ -72,11 +69,6 @@ wayland-utils # Wayland diagnostic tools
     wl-clipboard # Wayland copy/paste support
     vlc # Media player
   ];
-
-  nixpkgs.config.permittedInsecurePackages = [
-    "pnpm-9.15.9"
-  ];
-  nixpkgs.config.allowUnfree = true;
 
   system.stateVersion = "26.11";
 }
diff --git a/hosts/nixos/d-latitude/hardware.nix b/hosts/nixos/d-latitude/hardware.nix
--- a/hosts/nixos/d-latitude/hardware.nix
+++ b/hosts/nixos/d-latitude/hardware.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }: {
diff --git a/hosts/nixos/d-latitude/users/default.nix b/hosts/nixos/d-latitude/users/default.nix
new file mode 100644
--- /dev/null
+++ b/hosts/nixos/d-latitude/users/default.nix
@@ -0,0 +1,5 @@
+{
+  home-manager.users.devin.imports = [
+    ../../../../modules/users/devin/desktop
+  ];
+}
diff --git a/hosts/nixos/default.nix b/hosts/nixos/default.nix
--- a/hosts/nixos/default.nix
+++ b/hosts/nixos/default.nix
@@ -2,33 +2,29 @@ {inputs}:
 inputs.nixpkgs.lib.mapAttrs (
   host: extraModules:
     inputs.nixpkgs.lib.nixosSystem {
-      system = "x86_64-linux";
       specialArgs = {inherit inputs;};
       modules =
         [./${host}]
         ++ [
           ../../modules/common
           ../../modules/nixos
-          inputs.agenix.nixosModules.default
-          inputs.home-manager.nixosModules.default
+          ../../modules/users/devin
         ]
         ++ extraModules;
     }
 ) {
   bluepill = [
-    ../../modules/users/devin
+    ../../modules/nixos/server.nix
     inputs.tangled.nixosModules.knot
     inputs.tangled.nixosModules.spindle
     inputs.restray.nixosModules.default
   ];
 
   bluepill-proxy = [
-    ../../modules/users/devin
+    ../../modules/nixos/server.nix
   ];
 
   d-latitude = [
-    ../../modules/users/devin
-    ../../modules/users/devin/desktop
     inputs.aerothemeplasma-nix.nixosModules.aerothemeplasma-nix
   ];
 }
diff --git a/justfile b/justfile
--- a/justfile
+++ b/justfile
@@ -18,4 +18,4 @@ fi
 
 # garbage collection/cleanup
 gc:
-    nix run nixpkgs#nh clean all
\ No newline at end of file
+    nix run nixpkgs#nh clean all
diff --git a/modules/common/default.nix b/modules/common/default.nix
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -6,6 +6,7 @@ }: {
   age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
 
   home-manager.extraSpecialArgs = {inherit inputs;};
+  home-manager.sharedModules = [inputs.agenix.homeManagerModules.default];
   home-manager.useGlobalPkgs = true;
 
   nix = {
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -1,4 +1,14 @@
-{
+{inputs, ...}: {
+  imports = [
+    inputs.agenix.darwinModules.default
+    inputs.home-manager.darwinModules.default
+    inputs.mac-app-util.darwinModules.default
+  ];
+
+  home-manager.sharedModules = [
+    inputs.mac-app-util.homeManagerModules.default
+  ];
+
   homebrew = {
     enable = true;
     enableFishIntegration = true;
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -1,10 +1,11 @@
-{
+{inputs, ...}: {
   imports = [
+    inputs.agenix.nixosModules.default
+    inputs.home-manager.nixosModules.default
     ./programs
     ./services
   ];
 
-  nix.settings.trusted-users = ["root"];
-
+  home-manager.useUserPackages = true;
   zramSwap.enable = true;
 }
diff --git a/modules/nixos/server.nix b/modules/nixos/server.nix
new file mode 100644
--- /dev/null
+++ b/modules/nixos/server.nix
@@ -0,0 +1,10 @@
+{
+  networking.useNetworkd = true;
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://tangled.org/devins.page/flake";
+    flags = ["-L"];
+    dates = "04:40";
+  };
+}
diff --git a/modules/nixos/services/tailscaled.nix b/modules/nixos/services/tailscaled.nix
--- a/modules/nixos/services/tailscaled.nix
+++ b/modules/nixos/services/tailscaled.nix
@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
   services.tailscale = {
     enable = true;
     useRoutingFeatures = "both";
@@ -10,7 +15,7 @@ "net.ipv4.ip_forward" = 1;
     "net.ipv6.conf.all.forwarding" = 1;
   };
 
-  services.networkd-dispatcher = {
+  services.networkd-dispatcher = lib.mkIf (config.networking.useNetworkd || config.systemd.network.enable) {
     enable = true;
     rules."50-tailscale-optimizations" = {
       onState = ["routable"];
diff --git a/modules/users/devin/default.nix b/modules/users/devin/default.nix
--- a/modules/users/devin/default.nix
+++ b/modules/users/devin/default.nix
@@ -1,11 +1,12 @@
 {
   config,
+  lib,
   pkgs,
   ...
 }: {
   nix.settings.trusted-users = ["devin"];
 
-  system = pkgs.lib.optionalAttrs pkgs.stdenv.isDarwin {
+  system = lib.optionalAttrs pkgs.stdenv.isDarwin {
     primaryUser = "devin";
   };
 
@@ -18,7 +19,7 @@ else "/home/devin";
       shell = pkgs.fish;
       openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILyOJLlmq653uVs/1KdVnaMzi+EolB7EJMJ7AdBxVi6m devin@devins.page"];
     }
-    // pkgs.lib.optionalAttrs pkgs.stdenv.isLinux {
+    // lib.optionalAttrs pkgs.stdenv.isLinux {
       isNormalUser = true;
       extraGroups = ["networkmanager" "wheel"];
     };
diff --git a/modules/users/devin/desktop/default.nix b/modules/users/devin/desktop/default.nix
--- a/modules/users/devin/desktop/default.nix
+++ b/modules/users/devin/desktop/default.nix
@@ -1,9 +1,4 @@
-{inputs, ...}: {
-  home-manager.users.devin = {config, ...}: {
-    age.identityPaths = ["${config.home.homeDirectory}/.config/age/keys.txt"];
-    imports = [
-      inputs.agenix.homeManagerModules.default
-      ./mail.nix
-    ];
-  };
+{config, ...}: {
+  age.identityPaths = ["${config.home.homeDirectory}/.config/age/keys.txt"];
+  imports = [./mail.nix];
 }
diff --git a/modules/users/devin/programs/git.nix b/modules/users/devin/programs/git.nix
--- a/modules/users/devin/programs/git.nix
+++ b/modules/users/devin/programs/git.nix
@@ -1,4 +1,4 @@
-{pkgs, ...}: {
+{
   programs.git = {
     enable = true;
     settings = {
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,6 +1,5 @@
 let
   bluepill = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlO7ODA+//BwvI4IEr+7vTgVTQl1rvs/DMr67F6Ztr4";
-  bluepill-proxy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9k6d9zNhRAFv1cnSHEZ3i4qSLOnzE4ekHxMuRdkhi";
   d-macbook = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExg7LMVUJNVIZrUXRMIDgK70IjlG/fZG3hgTR20sEu6";
   devin = "age1reah3h72zsk29ahhd0eskyque2s3exjvpt695mrytc6wqzetpcdqqr758y";
 in {

--
tangled.sh