updates and formatting

.vscode/tasks.json

@@ -6,11 +6,28 @@
         {
             "label": "rebuild",
             "type": "shell",
+            "command": "#!/usr/bin/env bash sudo nixos-rebuild boot",
+            "problemMatcher": [],
+            "group": {
+                "kind": "build",
+            }
+        },
+        {
+            "label": "switch",
+            "type": "shell",
             "command": "#!/usr/bin/env bash sudo nixos-rebuild switch",
             "problemMatcher": [],
             "group": {
                 "kind": "build",
-                "isDefault": true
+            }
+        },
+        {
+            "label": "rebuild nas",
+            "type": "shell",
+            "command": "#!/usr/bin/env bash nixos-rebuild boot --use-remote-sudo --target-host admin@10.0.1.18 --build-host admin@10.0.1.18 --flake ~/nix-config#jallen-nas",
+            "problemMatcher": [],
+            "group": {
+                "kind": "build",
             }
         }
     ]

flake.lock

@@ -14,16 +14,15 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1734115107,
+        "lastModified": 1736445563,
-        "narHash": "sha256-0Rz8OZNMH1/a06Mw6TprwSw93PH6y3WyFTWJ2UJERvw=",
+        "narHash": "sha256-+f1MWPtja+LRlTHJP/i/3yxmnzo2LGtZmxtJJTdAp8o=",
-        "owner": "fpletz",
+        "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "f6742fc5dd624ad3bfae2cf6daef24ce49e1432b",
+        "rev": "bf5a5bf42189ff5f468f0ff26c9296233a97eb6c",
         "type": "github"
       },
       "original": {
-        "owner": "fpletz",
+        "owner": "nix-community",
-        "ref": "24.11",
         "repo": "authentik-nix",
         "type": "github"
       }
@@ -31,16 +30,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1733849292,
+        "lastModified": 1736440980,
-        "narHash": "sha256-gJYgrRxytoGHkjeEsiKY/tl06D8XOnZZ9SDpK1WSyUw=",
+        "narHash": "sha256-Z3rFFrXrOKaF9NpY/fInsEbzdOWnWqLfEYl7YX9hFEU=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "0edd7531a152910e6bdd4f7d3d0cde3ed5fdd956",
+        "rev": "9d81f0598c7735e2b4616ee865ab896056a67408",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2024.10.5",
+        "ref": "version/2024.12.2",
         "repo": "authentik",
         "type": "github"
       }
@@ -238,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736785676,
+        "lastModified": 1737478403,
-        "narHash": "sha256-TY0jUwR3EW0fnS0X5wXMAVy6h4Z7Y6a3m+Yq++C9AyE=",
+        "narHash": "sha256-e6PJI4Bd+QdpukHyd5F/fQY8fRUiNfCwvCRU8WXMSk8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fc52a210b60f2f52c74eac41a8647c1573d2071d",
+        "rev": "96dee79b178d295b716052feca3ee46abc085abe",
         "type": "github"
       },
       "original": {
@@ -364,11 +363,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1736631212,
+        "lastModified": 1737423230,
-        "narHash": "sha256-mG9lRZBcPiAGiVJ9B97BJoIGQcSBWIVlBiN30QYCtG0=",
+        "narHash": "sha256-WEOiNmkcmlaeXy2HGW1PYxYmCPiHdsI7a7SpjhBYxRg=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "6ace2f2d12bdf74235d5cbf9fbd34a71c9716685",
+        "rev": "46d0fa4ded0a7532f19870f9bbedaf62269fe3f7",
         "type": "github"
       },
       "original": {
@@ -406,11 +405,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1735172763,
+        "lastModified": 1737392146,
-        "narHash": "sha256-a6n8RsiAolz6p24Fsr/gTndx9xr9USpKqKK6kzBeXQc=",
+        "narHash": "sha256-fqDBMzFFZLYxNxnvM/9AABAsRgfgsLoDhdQXUvU0OnM=",
         "owner": "tpwrules",
         "repo": "nixos-apple-silicon",
-        "rev": "3daf0637409689d7a1304cedc50d20542bc47905",
+        "rev": "8adcb4b702511620bcaa4127f8f8af1ce7622d38",
         "type": "github"
       },
       "original": {
@@ -421,11 +420,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1736441705,
+        "lastModified": 1737359802,
-        "narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=",
+        "narHash": "sha256-utplyRM6pqnN940gfaLFBb9oUCSzkan86IvmkhsVlN8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337",
+        "rev": "61c79181e77ef774ab0468b28a24bc2647d498d6",
         "type": "github"
       },
       "original": {
@@ -481,11 +480,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1736684107,
+        "lastModified": 1737299813,
-        "narHash": "sha256-vH5mXxEvZeoGNkqKoCluhTGfoeXCZ1seYhC2pbMN0sg=",
+        "narHash": "sha256-Qw2PwmkXDK8sPQ5YQ/y/icbQ+TYgbxfjhgnkNJyT1X8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "635e887b48521e912a516625eee7df6cf0eba9c1",
+        "rev": "107d5ef05c0b1119749e381451389eded30fb0d5",
         "type": "github"
       },
       "original": {
@@ -497,11 +496,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1736701207,
+        "lastModified": 1737062831,
-        "narHash": "sha256-jG/+MvjVY7SlTakzZ2fJ5dC3V1PrKKrUEOEE30jrOKA=",
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ed4a395ea001367c1f13d34b1e01aa10290f67d6",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
         "type": "github"
       },
       "original": {
@@ -513,25 +512,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1718149104,
+        "lastModified": 1736241350,
-        "narHash": "sha256-Ds1QpobBX2yoUDx9ZruqVGJ/uQPgcXoYuobBguyKEh8=",
+        "narHash": "sha256-CHd7yhaDigUuJyDeX0SADbTM9FXfiWaeNyY34FL1wQU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e913ae340076bbb73d9f4d3d065c2bca7caafb16",
+        "rev": "8c9fd3e564728e90829ee7dbac6edc972971cd0f",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
-        "type": "indirect"
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1734649271,
+        "lastModified": 1737062831,
-        "narHash": "sha256-4EVBRhOjMDuGtMaofAIqzJbg4Ql7Ai0PSeuVZTHjyKQ=",
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d70bd19e0a38ad4790d3913bf08fcbfc9eeca507",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
         "type": "github"
       },
       "original": {
@@ -559,11 +560,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1730284601,
+        "lastModified": 1735164664,
-        "narHash": "sha256-eHYcKVLIRRv3J1vjmxurS6HVdGphB53qxUeAkylYrZY=",
+        "narHash": "sha256-DaWy+vo3c4TQ93tfLjUgcpPaSoDw4qV4t76Y3Mhu84I=",
         "owner": "nix-community",
         "repo": "poetry2nix",
-        "rev": "43a898b4d76f7f3f70df77a2cc2d40096bc9d75e",
+        "rev": "1fb01e90771f762655be7e0e805516cd7fa4d58e",
         "type": "github"
       },
       "original": {
@@ -663,11 +664,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736777442,
+        "lastModified": 1737411508,
-        "narHash": "sha256-eON7amRmBl59QH6K9uypewkKveaNbosY6CtUgRcv7YU=",
+        "narHash": "sha256-j9IdflJwRtqo9WpM0OfAZml47eBblUHGNQTe62OUqTw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "0f4744b5a95151a85c4f35010dd2d748228f7f53",
+        "rev": "015d461c16678fc02a2f405eb453abb509d4e1d4",
         "type": "github"
       },
       "original": {

flake.nix

@@ -13,8 +13,7 @@
 
     # Authentik
     authentik-nix = {
-      # url = "github:nix-community/authentik-nix";
+      url = "github:nix-community/authentik-nix";
-      url = "github:fpletz/authentik-nix/24.11"; # for some reason  this is broken in stable and unstable
       inputs.nixpkgs.follows = "nixpkgs-stable";
     };
 

hosts/desktop/home.nix

@@ -90,7 +90,7 @@ in
     morph
     nextcloud-client
     nixfmt-rfc-style
-    stable.orca-slicer
+    orca-slicer
     papirus-icon-theme
     piper
     pop-gtk-theme

hosts/nas/apps/arrs/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   radarrPort = 7878;
@@ -14,7 +19,8 @@ let
   mediaDir = "/media";
   arrUserId = config.users.users.nix-apps.uid;
   arrGroupId = config.users.groups.jallen-nas.gid;
-  # sonarrPkg = pkgs.stable.sonarr;
+  sonarrPkg = pkgs.stable.sonarr;
+  jackettPkg = pkgs.unstable.jackett;
 in
 {
   nixpkgs.config.permittedInsecurePackages = [
@@ -30,7 +36,14 @@ in
     hostAddress = "10.0.1.18";
     localAddress = "10.0.1.51";
 
-    config = { config, pkgs, lib, ... }: {
+    config =
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
+      {
         nixpkgs.config.allowUnfree = true;
         nixpkgs.config.permittedInsecurePackages = [
           "aspnetcore-runtime-6.0.36"
@@ -85,6 +98,7 @@ in
           user = "arrs";
           group = "media";
           openFirewall = true;
+          package = jackettPkg;
         };
 
         # Create required users and groups
@@ -96,7 +110,9 @@ in
         };
 
         users.groups = {
-        media = { gid = lib.mkForce arrGroupId; };
+          media = {
+            gid = lib.mkForce arrGroupId;
+          };
           downloads = { };
         };
 
@@ -137,7 +153,11 @@ in
         networking = {
           firewall = {
             enable = true;
-            allowedTCPPorts = [ radarrPort sonarrPort sabnzbdPort ];
+            allowedTCPPorts = [
+              radarrPort
+              sonarrPort
+              sabnzbdPort
+            ];
           };
           # Use systemd-resolved inside the container
           # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686

hosts/nas/apps/jellyfin/default.nix

@@ -1,161 +1,4 @@
-{
+{ ... }:
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-# let
-#   jellyfinPort = 8096;
-#   jellyfinUserId = config.users.users.nix-apps.uid;
-#   jellyfinGroupId = config.users.groups.jallen-nas.gid;
-#   package = pkgs.jellyfin;
-# in {
-#   containers.jellyfin = {
-#     autoStart = true;
-#     privateNetwork = true;
-#     hostAddress = "10.0.1.18";
-#     localAddress = "10.0.2.25";
-
-#     config = { config, pkgs, lib, ... }: {
-#       # Enable jellyfin service
-#       nixpkgs.config.allowUnfree = true;
-#         hardware = {
-#         # Nvidia
-#         nvidia = {
-#           package = config.boot.kernelPackages.nvidiaPackages.latest;
-#           # Modesetting is required.
-#           modesetting.enable = true;
-#           # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
-#           powerManagement.enable = true;
-#           # Fine-grained power management. Turns off GPU when not in use.
-#           # Experimental and only works on modern Nvidia GPUs (Turing or newer).
-#           powerManagement.finegrained = false;
-#           # Use the NVidia open source kernel module (not to be confused with the
-#           # independent third-party "nouveau" open source driver).
-#           # Support is limited to the Turing and later architectures. Full list of 
-#           # supported GPUs is at: 
-#           # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus 
-#           # Only available from driver 515.43.04+
-#           # Currently alpha-quality/buggy, so false is currently the recommended setting.
-#           open = true;
-
-#           # Enable the Nvidia settings menu,
-#           # accessible via `nvidia-settings`.
-#           nvidiaSettings = true;
-#         };
-
-#         # Enable graphics
-#         graphics = {
-#           enable = true;
-#           enable32Bit = true;
-#         };
-#       };
-
-#       # Services configs
-#       services.xserver = {
-#         # Load nvidia driver for Xorg and Wayland
-#         videoDrivers = [ "nvidia" ];
-#       };
-
-#       services.jellyfin = {
-#         enable = true;
-#         openFirewall = true;
-#         user = "jellyfin";
-#         group = "media";
-#         dataDir = "/data";
-#         configDir = "/config";
-#         # cacheDir = "/cache";
-#       };
-
-#       # Create required users and groups
-#       users.users.jellyfin = {
-#         isSystemUser = true;
-#         uid = lib.mkForce jellyfinUserId;
-#         group = "media";
-#         extraGroups = [ "downloads" ];
-#       };
-
-#       users.groups = {
-#         media = { gid = lib.mkForce jellyfinGroupId; };
-#         downloads = { };
-#       };
-
-#       networking = {
-#         firewall = {
-#           enable = true;
-#           allowedTCPPorts = [ jellyfinPort ];
-#         };
-#         # Use systemd-resolved inside the container
-#         # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-#         useHostResolvConf = lib.mkForce false;
-#       };
-
-#       # System packages
-#       environment.systemPackages = with pkgs; [ 
-#         sqlite 
-#         mono 
-#         mediainfo 
-#         # ffmpeg 
-#         # nvidiaPackages.gpu
-#         # nvidiaPackages.nvidia-settings
-#         # nvidiaPackages.nvidia-x11
-#       ];
-
-#       services.resolved.enable = true;
-#       system.stateVersion = "23.11";
-#     };
-
-#     # Bind mount directories from host
-#     bindMounts = {
-#       "/data" = {
-#         hostPath = "/media/nas/ssd/nix-app-data/jellyfin";
-#         isReadOnly = false;
-#       };
-#       "/tv" = {
-#         hostPath = "/media/nas/main/tv";
-#         isReadOnly = false;
-#       };
-#       "/movies" = {
-#         hostPath = "/media/nas/main/movies";
-#         isReadOnly = false;
-#       };
-#       "/dev/nvidia0" = { hostPath = "/dev/nvidia0"; };  # GPU device
-#       "/dev/nvidiactl" = { hostPath = "/dev/nvidiactl"; }; # NVIDIA control
-#       "/dev/nvidia-modeset" = { hostPath = "/dev/nvidia-modeset"; }; # modesetting
-#     };
-
-#     # allowedDevices = [
-#     #   {
-#     #     modifier = "rw";
-#     #     node = "/dev/nvidia0";
-#     #   }
-#     #   {
-#     #     modifier = "rw";
-#     #     node = "/dev/nvidiactl";
-#     #   } 
-#     #   {
-#     #     modifier = "rw";
-#     #     node = "/dev/nvidia-modeset";
-#     #   } 
-#     #   {
-#     #     modifier = "rw";
-#     #     node = "/dev/nvidia-uvm";
-#     #   }
-#     #   {
-#     #     modifier = "rw";
-#     #     node = "/dev/nvidia-uvm-tools";
-#     #   }
-#     # ];
-#   };
-
-#   networking.nat = {
-#     forwardPorts = [{
-#       destination = "10.0.2.25:8096";
-#       sourcePort = jellyfinPort;
-#     }];
-#   };
-# }
 {
   services.jellyfin = {
     enable = true;

hosts/nas/apps/nextcloud/default.nix

@@ -136,7 +136,9 @@ in
         };
 
         users.groups = {
-        nextcloud = { gid = lib.mkForce nextcloudGroupId; };
+          nextcloud = {
+            gid = lib.mkForce nextcloudGroupId;
+          };
           downloads = { };
         };
 
@@ -158,7 +160,10 @@ in
         networking = {
           firewall = {
             enable = true;
-          allowedTCPPorts = [ 80 443 ];
+            allowedTCPPorts = [
+              80
+              443
+            ];
           };
           # Use systemd-resolved inside the container
           # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686

hosts/nas/apps/paperless-ai/default.nix

@@ -11,7 +11,11 @@ in
     virtualisation.oci-containers.containers.${cfg.name} = {
       autoStart = true;
       image = cfg.image;
-      extraOptions = [ "--device=nvidia.com/gpu=0" "--network=bridge" "--add-host=host.docker.internal:host-gateway" ];
+      extraOptions = [
+        "--device=nvidia.com/gpu=0"
+        "--network=bridge"
+        "--add-host=host.docker.internal:host-gateway"
+      ];
       volumes = [ "${cfg.configPath}:/app/data" ];
       ports = [ "${cfg.port}:3000" ];
       environment = {

hosts/nas/apps/paperless/default.nix

@@ -4,12 +4,12 @@
   lib,
   ...
 }:
-
 let
   paperlessPort = 28981;
   paperlessUserId = config.users.users.nix-apps.uid;
   paperlessGroupId = config.users.groups.jallen-nas.gid;
   passwordFile = config.sops.secrets."jallen-nas/admin_password".path;
+  paperlessPkg = pkgs.stable.paperless-ngx;
 in
 {
   containers.paperless = {
@@ -31,6 +31,7 @@ in
         # Enable paperless service
         services.paperless = {
           enable = true;
+          package = paperlessPkg;
           port = paperlessPort;
           user = "paperless";
           address = "0.0.0.0";

hosts/nas/configuration.nix

@@ -139,7 +139,10 @@ in
 
   # Configure nixpkgs
   nixpkgs = {
-    overlays = [ outputs.overlays.nixpkgs-unstable ];
+    overlays = [
+      outputs.overlays.nixpkgs-unstable
+      outputs.overlays.nixpkgs-stable
+    ];
 
     config = {
       # Enable non free