progress in multi user config

modules/system/common/qbittorrent.nix

@@ -0,0 +1,113 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.qbittorrent;
+  UID = 888;
+  GID = 888;
+in
+{
+  options.services.qbittorrent = {
+    enable = mkEnableOption (lib.mdDoc "qBittorrent headless");
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/qbittorrent";
+      description = lib.mdDoc ''
+        The directory where qBittorrent stores its data files.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "qbittorrent";
+      description = lib.mdDoc ''
+        User account under which qBittorrent runs.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "qbittorrent";
+      description = lib.mdDoc ''
+        Group under which qBittorrent runs.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8080;
+      description = lib.mdDoc ''
+        qBittorrent web UI port.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open services.qBittorrent.port to the outside network.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.qbittorrent-nox;
+      defaultText = literalExpression "pkgs.qbittorrent-nox";
+      description = lib.mdDoc ''
+        The qbittorrent package to use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    systemd.services.qbittorrent = {
+      description = "qBittorrent-nox service";
+      documentation = [ "man:qbittorrent-nox(1)" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+
+        ExecStartPre = let
+          preStartScript = pkgs.writeScript "qbittorrent-run-prestart" ''
+            #!${pkgs.bash}/bin/bash
+
+            # Create data directory if it doesn't exist
+            if ! test -d "$QBT_PROFILE"; then
+              echo "Creating initial qBittorrent data directory in: $QBT_PROFILE"
+              install -d -m 0755 -o "${cfg.user}" -g "${cfg.group}" "$QBT_PROFILE"
+            fi
+         '';
+        in
+          "!${preStartScript}";
+
+        ExecStart = "${cfg.package}/bin/qbittorrent-nox";
+      };
+
+      environment = {
+        QBT_PROFILE = cfg.dataDir;
+        QBT_WEBUI_PORT = toString cfg.port;
+      };
+    };
+
+    users.users = mkIf (cfg.user == "qbittorrent") {
+      qbittorrent = {
+        group = cfg.group;
+        uid = UID;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "qbittorrent") {
+      qbittorrent = { gid = GID; };
+    };
+  };
+}

modules/system/networking/default.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib.meta) getExe;
+  inherit (lib.modules) mkDefault mkIf mkMerge;
+
+  cfg = config.modules.networking;
+in {
+  options.modules.networking = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "network manager";
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.NetworkManager-wait-online.enable = false;
+
+    networking = {
+      firewall.enable = true;
+
+      networkmanager = {
+        enable = mkDefault true;
+        wifi.backend = "wpa_supplicant";
+      };
+    };
+
+    hm.services.network-manager-applet.enable = true;
+  };
+}

modules/system/networking/samba.nix

@@ -0,0 +1,71 @@
+{ pkgs, options, config, lib, ... }:
+let
+  inherit (builtins) getEnv;
+  inherit (lib.modules) mkIf mkMerge;
+in
+{
+  options.modules.networking.samba = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    sharing.enable = mkEnableOption "Samba: enable NixOs -> external file-transfer";
+    receicing.enable = mkEnableOption "Samba: enable external -> NixOs file-transfer";
+  };
+
+  config = mkMerge [
+    (mkIf config.modules.networking.samba.sharing.enable {
+      users = {
+        groups.samba-guest = {};
+        users.samba-guest = {
+          isSystemUser = true;
+          description = "Residence of our Samba guest users";
+          group = "samba-guest";
+          home = "/var/empty";
+          createHome = false;
+          shell = pkgs.shadow;
+        };
+      };
+      user.extraGroups = [ "samba-guest" ];
+
+      networking.firewall = {
+        allowPing = true;
+        allowedTCPPorts = [ 5327 ];
+        allowedUDPPorts = [ 3702 ];
+      };
+
+      services.samba-wsdd.enable = true;
+
+      services.samba = {
+        enable = true;
+        openFirewall = true;
+        extraConfig = ''
+          server string = ${config.networking.hostName}
+          netbios name = ${config.networking.hostName}
+          workgroup = WORKGROUP
+          security = user
+
+          create mask 0664
+          force create mode 0664
+          directory mask 0775
+          force directory mode 0775
+          follow symlink = yes
+
+          hosts allow = 192.168.1.0/24 localhost
+          hosts deny = 0.0.0.0/0
+          guest account = nobody
+          map to guest = bad user
+        '';
+        shares = {
+          Public = {
+            path = (getEnv "HOME") + "/Public";
+            browseable = "yes";
+            "read only" = "yes";
+            "guest ok" = "yes";
+            "forse user" = "${config.user.name}";
+            "force group" = "samba-guest";
+            "write list" = "${config.user.name}";
+          };
+        };
+      };
+    })
+  ];
+}

modules/system/networking/ssh.nix

@@ -0,0 +1,28 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+  inherit (lib.attrsets) attrValues;
+in
+{
+  options.modules.networking.ssh = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "enable ssh";
+  };
+
+  config = mkIf config.modules.networking.ssh.enable {
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+      ports = [ 22 ];
+      settings = {
+        PasswordAuthentication = true;
+        AllowUsers = [ "chris" "root" ];
+        UseDns = true;
+        UsePAM = true;
+        PermitRootLogin = "prohibit-password";
+        PermitEmptyPasswords = "no";
+      };
+    };
+  };
+}

modules/system/options.nix

@@ -0,0 +1,52 @@
+{ inputs, config, options, lib, pkgs, ... }:
+let
+  inherit (builtins) pathExists toString;
+  inherit (lib.lists) findFirst;
+  inherit (lib.modules) mkAliasDefinitions;
+in
+{
+  options = let
+    inherit (lib.types) attrs path;
+    inherit (lib.my) mkOpt;
+  in
+  {
+    user = mkOpt attrs {};
+
+    sneeuwvlok = {
+      dir = mkOpt path (findFirst pathExists (toString ../.) [
+        "${config.user.home}/Github/sneeuwvlok"
+      ]);
+      hostDir = mkOpt path "${config.sneeuwvlok.dir}/hosts/${config.networking.hostName}";
+      configDir = mkOpt path "${config.sneeuwvlok.dir}/config";
+      modulesDir = mkOpt path "${config.sneeuwvlok.dir}/modules";
+      themesDir = mkOpt path "${config.sneeuwvlok.modulesDir}/themes";
+    };
+  };
+
+  config = {
+    # user = {
+    #   name = "chris";
+    #   description = "Chris Kruining";
+    #   extraGroups = [ "wheel" ];
+    #   isNormalUser = true;
+    #   home = "/home/chris";
+    #   group = "users";
+    #   uid = 1000;
+    # };
+
+    # users.users.${config.user.name} = mkAliasDefinitions options.user;
+
+    # Temp solution...
+    # home-manager.users.${config.user.name}.home.stateVersion = "23.11";
+
+    nix.settings = let
+      inherit (lib) elem attrNames filterAttrs;
+
+      users = (attrNames (filterAttrs (name: user: elem "wheel" (user.extraGroups or [])) config.users.users));# ++ [ "root" ];
+    in
+      {
+        trusted-users = users;
+        allowed-users = users;
+      };
+  };
+}

modules/system/services/auth.nix

@@ -0,0 +1,88 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  options.modules.services.auth = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Auth";
+  };
+
+  config = mkIf config.modules.services.auth.enable {
+    environment.systemPackages = with pkgs; [
+      authelia
+    ];
+
+    services.authelia.instances.testing = {
+      enable = true;
+      secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
+      secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
+      settings = {
+        log.level = "info";
+        authentication_backend.file.path = "/etc/authelia/users_database.yml";
+        access_control.default_policy = "one_factor";
+        session.domain = "kruining.eu";
+        storage.local.path = "/tmp/db.sqlite3";
+        notifier.filesystem.filename = "/tmp/notifications.txt";
+        server.endpoints.authz.forward-auth.implementation = "ForwardAuth";
+        identity_providers.oidc.clients = [];
+      };
+    };
+
+    # systemd.services."authelia-testing" = {
+    #   serviceConfig.Environment = "X_AUTHELIA_CONFIG_FILTERS=template";
+    # };
+
+    # These should not be set from nix but through other means to not leak the secret!
+    # This is purely for testing purposes!
+    environment.etc."authelia/storageEncryptionKeyFile" = {
+      mode = "0400";
+      user = "authelia-testing";
+      text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
+    };
+    environment.etc."authelia/jwtSecretFile" = {
+      mode = "0400";
+      user = "authelia-testing";
+      text = "a_very_important_secret";
+    };
+    environment.etc."authelia/users_database.yml" = {
+      mode = "0400";
+      user = "authelia-testing";
+      text = ''
+        users:
+          bob:
+            disabled: false
+            displayname: bob
+            # password of password
+            password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
+            email: bob@jim.com
+            groups:
+              - admin
+              - dev
+      '';
+    };
+
+    services.caddy = {
+      enable = true;
+      virtualHosts = {
+        "auth.kruining.eu".extraConfig = ''
+          reverse_proxy :9091
+        '';
+        "kaas.kruining.eu".extraConfig = ''
+          respond "KAAS"
+        '';
+      };
+      extraConfig = ''
+        (auth) {
+          forward_auth :9091 {
+            uri /api/authz/forward-auth
+            copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+          }
+        }
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+  };
+}

modules/system/services/default.nix

@@ -0,0 +1,11 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  options.modules.services = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Enable all services";
+  };
+}

modules/system/services/games/minecraft.nix

@@ -0,0 +1,165 @@
+{ inputs, config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  imports = [
+    inputs.nix-minecraft.nixosModules.minecraft-servers
+  ];
+
+  options.modules.services.games.minecraft = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Minecraft";
+  };
+
+  config = mkIf config.modules.services.games.minecraft.enable {
+    services = {
+      minecraft-servers = {
+        enable = true;
+        eula = true;
+        openFirewall = true;
+
+        user = "chris";
+        dataDir = "/var/lib/minecraft";
+
+        managementSystem = {
+          tmux.enable = false;
+          systemd-socket.enable = true;
+        };
+
+        servers = let
+          whitelist = {
+            ChrisPBacon = "e6128495-075b-44a9-87f6-8d844d5ea0e4";
+            satanjr616 = "1718f9d5-df1d-4aac-b10c-3229a0f1e8b2";
+            Ono95 = "010e7652-6d5d-4f9e-af89-438c8fe694ca";
+            JackLeLumber = "41910a94-8c8e-4528-a8ca-a2d7043f069d";
+            DarkyLink = "6faddb7f-12a9-4aac-bc08-dd6db892a380";
+            Archonite86 = "b5ab594d-de1c-4453-ba32-9107452be51b";
+            NotACultist86 = "44ac3f7c-0e18-4234-bb04-11a0652cdaeb";
+          };
+          ops = [
+            {
+              uuid = "e6128495-075b-44a9-87f6-8d844d5ea0e4";
+              name = "ChrisPBacon";
+              level = 4;
+              bypassesPlayerLimit = false;
+            }
+            {
+              uuid = "6faddb7f-12a9-4aac-bc08-dd6db892a380";
+              name = "DarkyLink";
+              level = 4;
+              bypassesPlayerLimit = false;
+            }
+          ];
+          jvmOpts = "-Xms2048M -Xmx2048M -XX:+UseG1GC";
+        in {
+          vanilla = {
+            enable = true;
+            autoStart = true;
+            restart = "always";
+            inherit whitelist;
+            inherit jvmOpts;
+
+            package = pkgs.fabricServers.fabric-1_21_4.override { loaderVersion = "0.16.10"; };
+
+            serverProperties = {
+              gamemode = "survival";
+              difficulty = 3;
+              motd = "Chris' vanilla server";
+              white-list = true;
+              simulation-distance = 10;
+              server-port = 25501;
+              level-name = "world";
+
+              allow-flight = true;
+              enable-command-block = true;
+              enforce-whitelist = true;
+              spawn-protection = 0;
+            };
+
+            files."ops.json" = {
+              value = ops;
+            };
+
+            symlinks = let
+              inherit (builtins) attrValues;
+              inherit (pkgs) linkFarmFromDrvs fetchurl;
+            in {
+              mods = linkFarmFromDrvs "mods" (attrValues {
+                FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; };
+                Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; };
+                # DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; };
+              });
+            };
+          };
+
+          tekxit = let
+            inherit (pkgs) fetchzip;
+
+            src = fetchzip {
+              url = "https://tekxit.b-cdn.net/downloads/tekxit4/12.0.0Tekxit4Server.zip";
+              hash = "sha256-4NqeMGOpji/gMH8XX8RemkBAOB9ID/i1S3/xXgD23to=";
+              stripRoot = true;
+            };
+          in {
+            enable = true;
+            autoStart = true;
+            restart = "no";
+            inherit whitelist;
+            inherit jvmOpts;
+
+            package = pkgs.fabricServers.fabric-1_19_2.override { loaderVersion = "0.16.9"; };
+
+            serverProperties = {
+              gamemode = "survival";
+              difficulty = 3;
+              motd = "Chris' vanilla server";
+              white-list = true;
+              simulation-distance = 10;
+              server-port = 25502;
+              level-name = "world";
+
+              allow-flight = true;
+              enable-command-block = true;
+              enforce-whitelist = true;
+              spawn-protection = 0;
+            };
+
+            files = let
+              inherit (builtins) readFile listToAttrs attrNames readDir mapAttrs;
+              inherit (lib.attrsets) nameValuePair;
+              inherit (lib) concatMapAttrs;
+              inherit (lib.my) mapFilterAttrs;
+
+              readDirRec = src: dir: fn:
+                concatMapAttrs (name: type: if type == "directory"
+                  then (readDirRec src "${dir}/${name}" fn)
+                  else { "${dir}/${name}" = (fn "${dir}/${name}"); }
+                ) (readDir "${src}/${dir}");
+
+              copyDir = dir: readDirRec src dir (x: "${src}/${x}");
+            in {
+              "ops.json" = {
+                value = ops;
+              };
+            }
+            // (copyDir "config");
+
+            symlinks = let
+              inherit (builtins) attrNames readDir map;
+              inherit (pkgs) linkFarm fetchzip;
+
+              linkFarmFromDir = name: dir: linkFarm name (map (x: { name = x; path = "${src}/${dir}/${x}"; }) (attrNames (readDir "${src}/${dir}")));
+            in {
+              Deftu = linkFarmFromDir "tekxit-deftu" "Deftu";
+              TKXAddons = linkFarmFromDir "tekxit-TKXAddons" "TKXAddons";
+              mods = linkFarmFromDir "tekxit-mods" "mods";
+              scripts = linkFarmFromDir "tekxit-scripts" "scripts";
+            };
+          };
+        };
+      };
+    };
+  };
+}

modules/system/services/games/palworld.nix

@@ -0,0 +1,25 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  options.modules.services.games.palworld = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Palworld";
+  };
+
+  config = mkIf config.modules.services.games.palworld.enable {
+#     kaas = (pkgs.mkSteamServer rec {
+#       name = "Palworld";
+#       src = pkgs.fetchSteam {
+#         inherit name;
+#         appId = "2394010";
+#         hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+#       };
+#
+#       sartCmd = "PalServer.sh";
+#       hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+#     });
+  };
+}

modules/system/services/media.nix

@@ -0,0 +1,156 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.attrsets) attrValues;
+  inherit (lib.modules) mkIf mkMerge mkForce;
+  inherit (lib.meta) getExe;
+
+  user = "media";
+  group = "media";
+  directory = "/var/media";
+in
+{
+  options.modules.services.media = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Media tools";
+  };
+
+  config = mkIf config.modules.services.media.enable {
+    environment.systemPackages = with pkgs; [
+      podman-tui
+      jellyfin
+      jellyfin-ffmpeg
+      jellyseerr
+      mediainfo
+      id3v2
+      yt-dlp
+    ];
+
+    users = {
+      users."${user}" = {
+        isSystemUser = true;
+        group = group;
+      };
+      groups."${group}" = {};
+    };
+
+    system.activationScripts.var = mkForce ''
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/series
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/movies
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/qbittorrent
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/sabnzbd
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/reiverr/config
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/downloads/incomplete
+      install -d -m 0755 -o ${user} -g ${group} ${directory}/downloads/done
+    '';
+
+    services = let
+      serviceConf = {
+        enable = true;
+        openFirewall = true;
+        user = user;
+        group = group;
+      };
+    in {
+      jellyfin = serviceConf;
+      radarr = serviceConf;
+      sonarr = serviceConf;
+      bazarr = serviceConf;
+      lidarr = serviceConf;
+
+      jellyseerr = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      prowlarr = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      qbittorrent = {
+        enable = true;
+        openFirewall = true;
+        dataDir = "${directory}/qbittorrent";
+        port = 5000;
+
+        user = user;
+        group = group;
+      };
+
+      sabnzbd = {
+        enable = true;
+        openFirewall = true;
+        configFile = "${directory}/sabnzbd/config.ini";
+
+        user = user;
+        group = group;
+      };
+
+      caddy = {
+        enable = true;
+        virtualHosts = {
+          "ping.kruining.eu".extraConfig = ''
+            respond "OK"
+          '';
+          "media.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:9494
+          '';
+          "series.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:8989
+          '';
+          "movies.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:7878
+          '';
+          "jellyfin.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:8096
+          '';
+          "indexer.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:9696
+          '';
+          "torrents.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:58080
+          '';
+          "usenet.kruining.eu".extraConfig = ''
+            reverse_proxy http://127.0.0.1:8080
+          '';
+          "cloud.kruining.eu".extraConfig = ''
+            php_fastcgi unix//run/phpfpm/nextcloud.sock {
+              env front_controller_active true
+            }
+          '';
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    modules.virtualisation = {
+      enable = true;
+      podman.enable = true;
+    };
+
+    virtualisation = {
+      oci-containers = {
+        backend = "podman";
+
+        containers = {
+          flaresolverr = {
+            image = "flaresolverr/flaresolverr";
+            autoStart = true;
+            ports = [ "127.0.0.1:8191:8191" ];
+          };
+
+          reiverr = {
+            image = "ghcr.io/aleksilassila/reiverr:v2.0.0-alpha.6";
+            autoStart = true;
+            ports = [ "127.0.0.1:9494:9494" ];
+            volumes = [ "${directory}/reiverr/config:/config" ];
+          };
+        };
+      };
+    };
+
+    systemd.services.jellyfin.serviceConfig.killSignal = lib.mkForce "SIGKILL";
+  };
+}

modules/system/services/nextcloud.nix

@@ -0,0 +1,41 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  options.modules.services.nextcloud = let
+    inherit (lib.options) mkEnableOption;
+  in {
+    enable = mkEnableOption "Nextcloud";
+  };
+
+  config = mkIf config.modules.services.nextcloud.enable {
+    home.file.".netrc".text = ''
+      login root
+      password KaasIsAwesome!
+    '';
+
+    systemd.user = {
+      services.nextcloud-autosync = {
+        Unit = {
+          Description = "Automatic nextcloud sync";
+          After = "network-online.target";
+        };
+        Service = {
+          Type = "simple";
+          ExecStart = "${pkgs.nextcloud-client}/bin/nextcloudcmd -h -n --path /var/music /home/chris/Music https://cloud.kruining.eu";
+          TimeoutStopSec = "180";
+          KillMode = "process";
+          KillSignal = "SIGINT";
+        };
+        Install.WantedBy = [ "multi-user.target" ];
+      };
+      timers.nextcloud-autosync = {
+        Unit.Description = "Automatic nextcloud sync";
+        Timer.OnBootSec = "5min";
+        Timer.OnUnitActiveSec = "60min";
+        Install.WantedBy = [ "multi-user.target" "timers.target" ];
+      };
+    };
+  };
+}

modules/system/services/oidc_clients.yml

@@ -0,0 +1,5 @@
+# Hashed client secrets go here, and unhashed ones go in the client configurations
+
+identity_providers:
+  oidc:
+    clients:

modules/system/virtualisation/default.nix

@@ -0,0 +1,12 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+in
+{
+  options.modules.virtualisation = let
+    inherit (lib.options) mkEnableOption;
+  in
+  {
+    enable = mkEnableOption "enable virtualisation";
+  };
+}

modules/system/virtualisation/podman.nix

@@ -0,0 +1,26 @@
+{ config, options, lib, pkgs, ... }:
+let
+  inherit (lib.modules) mkIf;
+
+  cfg = config.modules.virtualisation.podman;
+in
+{
+  options.modules.virtualisation.podman = let
+    inherit (lib.options) mkEnableOption;
+  in
+  {
+    enable = mkEnableOption "enable podman";
+  };
+
+  config = mkIf config.modules.virtualisation.podman.enable {
+    virtualisation = {
+      containers.enable = true;
+
+      podman = {
+        enable = true;
+        dockerCompat = true;
+        defaultNetwork.settings.dns_enabled = true;
+      };
+    };
+  };
+}