upd

modules/home/desktop/plasma/default.nix

@@ -25,24 +25,28 @@ in
     programs.plasma = {
       enable = true;
 
-      workspace = {
-        colorScheme = "BreezeDark";
-        cursor = {
-          theme = "breeze_cursors";
-          size = 24;
-        };
-        iconTheme = "breeze-dark";
-        theme = "breeze-dark";
-        lookAndFeel = "org.kde.breezedark.desktop";
-        # Explicitly set Breeze to prevent QT_STYLE_OVERRIDE=kvantum (set by
-        # Stylix's qt6ct target) from being picked up by KWin/plasmashell, which
-        # would cause a fatal "module kvantum is not installed" QML error and
-        # leave the desktop blank.
-        widgetStyle = "Breeze";
+      configFile.kded5rc = {
+        "Module-gtkconfig"."autoload" = false;
       };
 
-      # input.mice and input.touchpads require device-specific vendorId/productId
-      # identifiers — configure those per-host in the home config instead.
+      # workspace = {
+      #   colorScheme = "BreezeDark";
+      #   cursor = {
+      #     theme = "breeze_cursors";
+      #     size = 24;
+      #   };
+      #   iconTheme = "breeze-dark";
+      #   theme = "breeze-dark";
+      #   lookAndFeel = "org.kde.breezedark.desktop";
+      #   # Explicitly set Breeze to prevent QT_STYLE_OVERRIDE=kvantum (set by
+      #   # Stylix's qt6ct target) from being picked up by KWin/plasmashell, which
+      #   # would cause a fatal "module kvantum is not installed" QML error and
+      #   # leave the desktop blank.
+      #   widgetStyle = "Breeze";
+      # };
+
+      # # input.mice and input.touchpads require device-specific vendorId/productId
+      # # identifiers — configure those per-host in the home config instead.
 
       kscreenlocker = {
         autoLock = true;
@@ -67,20 +71,20 @@ in
         };
       };
 
-      panels = [
-        {
-          location = "bottom";
-          floating = true;
-          height = 44;
-          widgets = [
-            "org.kde.plasma.kickoff"
-            "org.kde.plasma.icontasks"
-            "org.kde.plasma.marginsseparator"
-            "org.kde.plasma.systemtray"
-            "org.kde.plasma.digitalclock"
-          ];
-        }
-      ];
+      # panels = [
+      #   {
+      #     location = "bottom";
+      #     floating = true;
+      #     height = 44;
+      #     widgets = [
+      #       "org.kde.plasma.kickoff"
+      #       "org.kde.plasma.icontasks"
+      #       "org.kde.plasma.marginsseparator"
+      #       "org.kde.plasma.systemtray"
+      #       "org.kde.plasma.digitalclock"
+      #     ];
+      #   }
+      # ];
 
       shortcuts = {
         kwin = {

modules/nixos/services/actual/default.nix

@@ -15,6 +15,20 @@ let
     description = "Actual Personal Finance Planner";
     options = { };
     moduleConfig = {
+      sops = {
+        secrets = {
+          "jallen-nas/actual/client-id" = {
+            sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+            owner = "actual";
+            restartUnits = [ "actual.service" ];
+          };
+          "jallen-nas/actual/client-secret" = {
+            sopsFile = lib.snowfall.fs.get-file "secrets/nas-secrets.yaml";
+            owner = "actual";
+            restartUnits = [ "actual.service" ];
+          };
+        };
+      };
       services.actual = {
         inherit (cfg) openFirewall;
         enable = true;
@@ -24,6 +38,13 @@ let
           serverFiles = "${cfg.configDir}/${name}/server-files";
           userFiles = "${cfg.configDir}/${name}/user-files";
           dataDir = "${cfg.configDir}/${name}";
+          openId = {
+            discoveryURL = "https://authentik.mjallen.dev/application/o/actual/.well-known/openid-configuration";
+            client_id._secret = config.sops.secrets."jallen-nas/actual/client-id".path;
+            client_secret._secret = config.sops.secrets."jallen-nas/actual/client-secret".path;
+            server_hostname = "https://authentik.mjallen.dev";
+            authMethod = "openid";
+          };
         };
       };
 

modules/nixos/services/owncloud/default.nix

@@ -60,6 +60,11 @@ in
   };
 
   config = mkIf cfg.enable {
+    systemd.services."podman-${cfg.name}".unitConfig.RequiresMountsFor = [
+      cfg.configPath
+      cfg.dataPath
+    ];
+
     virtualisation.oci-containers.containers."${cfg.name}" = {
       inherit (cfg) autoStart image;
       ports = [ "${cfg.httpPort}:9200" ];