prepare repo for switching back to nixos

2 files changed, 460 insertions, 346 deletions

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index ab36f02..c53c3eb 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -21,14 +21,6 @@
       allowUnfreePredicate =
         pkg:
         builtins.elem (lib.getName pkg) [
-          /*
-                    "cuda_cccl"
-                    "cuda_cudart"
-                    "cuda_nvcc"
-                    "cudnn"
-                    "libcublas"
-                    "libcufile"
-          */
           "steam"
           "steam-unwrapped"
         ];
@@ -44,30 +36,6 @@
 
     overlays = [
       (self: super: {
-        invidious = super.invidious.overrideAttrs (old: {
-          # try removing shorts by ignoring any videos shorter than 65 seconds
-          postPatch =
-            old.postPatch
-            + ''
-              sed -i '/GROUP BY channel/a\      AND length_seconds > 65' src/invidious/database/channels.cr
-              sed -i 's/\({view_name}\) \(ORDER BY published\)/\1 WHERE length_seconds > 65 \2/' src/invidious/users.cr
-              sed -i 's/\({values})\) \(ORDER BY published\)/\1 AND length_seconds > 65 \2/' src/invidious/users.cr
-            '';
-        });
-      })
-      (self: super: {
-        inv-sig-helper = super.inv-sig-helper.overrideAttrs (old: {
-          version = "0-unstable-2025-04-23";
-
-          src = super.fetchFromGitHub {
-            owner = "iv-org";
-            repo = "inv_sig_helper";
-            rev = "5d3c7a4574fafe0bc5fbed9e7e33483889832fd4";
-            hash = "sha256-WGh62tjKGe9OD19aq+lP9GfYs5PrGqkeT6VvmtNottQ=";
-          };
-        });
-      })
-      (self: super: {
         alvr = super.alvr.overrideAttrs (old: {
           buildInputs = old.buildInputs ++ [
             super.android-tools
@@ -91,11 +59,8 @@
 
   # decrypt agenix secrets
   age.secrets = {
-    tailscale_demiurge = {
-      file = ../../secrets/tailscale_demiurge.age;
-      owner = "root";
-      group = "root";
-    };
+    wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
+    wg1_demiurge.file = ../../secrets/wg0_demiurge.age;
   };
 
   # boot options
@@ -114,7 +79,7 @@
 
     zfs.extraPools = [
       "data_wd"
-      "nvme_warm"
+      "data"
     ];
   };
 
@@ -134,34 +99,101 @@
       allowedUDPPorts = [ 51413 ];
     };
 
-    # mullvad to miami
-    wg-quick.interfaces.us-mia-wg-002 = {
-      address = [
-        "10.135.221.102/32"
-        "fc00:bbbb:bbbb:bb01:d:0:7:dd66/128"
-      ];
-      privateKey = "***REDACTED_WG_KEY***=";
+    wg-quick.interfaces = {
+      # mullvad
+      wg0 = {
+        address = [
+          "10.68.117.111/32"
+          "fc00:bbbb:bbbb:bb01::5:756e/128"
+        ];
+        privateKeyFile = config.age.secrets.wg0_demiurge.path;
 
-      # supposed to be done by tailscale instead \_(:/)_/
-      postUp = ''
-        ip route add 100.64.0.0/24 dev tailscale0
-        ip route add 100.100.100.100/32 dev tailscale0
-      '';
-      postDown = ''
-        ip route del 100.64.0.0/24 dev tailscale0
-        ip route del 100.100.100.100/32 dev tailscale0
-      '';
+        postUp = "ip route add 45.134.142.206 dev eth0";
+        postDown = "ip route del 45.134.142.206 dev eth0";
 
-      peers = [
-        {
-          allowedIPs = [
-            "0.0.0.0/0"
-            "::0/0"
-          ];
-          endpoint = "45.134.142.206:51820";
-          publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
-        }
-      ];
+        peers = [{
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::0/0"
+            ];
+            endpoint = "45.134.142.206:51820";
+            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+        }];
+      };
+
+      # epistemia
+      wg1 = {
+        address = [
+          "10.0.13.2/24"
+          "fd00:b0ba:cafe:babe::2/64"
+        ];
+        privateKeyFile = config.age.secrets.wg1_demiurge.path;
+        listenPort = 51820;
+        fwMark = 51821;
+        MTU = 1420;
+
+        table = false;
+        postUp = ''
+PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000
+PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000
+PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821
+
+# NAT iphonebob and allow traffic between peers (when routing through demiurge)
+PostUp = iptables -F FORWARD
+PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
+PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
+PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+        '';
+        preDown = ''
+PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000
+PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000
+PreDown = ip route flush table 51821
+
+PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+PreDown = iptables -F FORWARD
+        '';
+
+        peers = [
+          # saklas
+          {
+            allowedIPs = [
+              "10.0.13.1/32"
+              "fd00:b0ba:cafe:babe::1/128"
+            ];
+            endpoint = "157.180.125.215:51820";
+            persistentKeepalive = 25;
+            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+          }
+          # hastur
+          {
+            allowedIPs = [
+              "10.0.13.3/32"
+              "fd00:b0ba:cafe:babe::3/128"
+            ];
+            persistentKeepalive = 25;
+            publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc=";
+          }
+          # iphonebob
+          {
+            allowedIPs = [
+              "10.0.13.4/32"
+              "fd00:b0ba:cafe:babe::4/128"
+            ];
+            persistentKeepalive = 25;
+            publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
+          }
+          # lab
+          {
+            allowedIPs = [
+              "10.0.13.5/32"
+              "fd00:b0ba:cafe:babe::5/128"
+            ];
+            persistentKeepalive = 25;
+            publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
+          }          
+        ];
+      };
     };
   };
 
@@ -186,24 +218,19 @@
       isNormalUser = true;
 
       extraGroups = [
-        "input"
-        "kvm"
-        "libvirtd"
         "transmission"
-        "video"
         "wheel"
       ];
 
       shell = pkgs.zsh;
 
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
       ];
 
       packages = with pkgs; [
         alvr
         bs-manager
-        distrobox
         (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
         #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
       ];
@@ -249,9 +276,6 @@
     # steam, proprietary. I sometimes like playing nonfree games too.
     steam.enable = true;
 
-    # virtualization
-    virt-manager.enable = true;
-
     # configuration in home-manager
     zsh.enable = true;
     zsh.promptInit = "PS1='$ '";
@@ -270,53 +294,57 @@
       ];
     };
 
-    pki.certificates = [
-      ''
-        -----BEGIN CERTIFICATE-----
-        MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL
-        BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw
-        OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh
-        MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M
-        639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+
-        WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv
-        sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv
-        lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U
-        B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH
-        hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV
-        HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw
-        zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF
-        vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx
-        OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l
-        nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4
-        FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM
-        /ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0
-        3eGfkQ==
-        -----END CERTIFICATE-----
-      ''
-    ];
-
     sudo.enable = false;
   };
 
   services = {
-    # control unicorn barf
-    hardware.openrgb.enable = true;
-
     # dns
-    dnsmasq = {
+    unbound = {
       enable = true;
       settings = {
-        server = [
-          "192.168.1.1"
-          "/epistemia/100.100.100.100"
-        ];
+              server = {
+                interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
+          access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
+
+                hide-identity = yes;
+                hide-version = yes;
+
+                # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+                # https://tools.ietf.org/html/rfc8198
+                aggressive-nsec = no;
+
+                local-zone = "saklas.epistemia." redirect;
+                local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
+                local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
+                local-zone = "demiurge.epistemia." redirect;
+                local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
+                local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
+                local-zone = "hastur.epistemia." redirect;
+                local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
+                local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
+                local-zone = "iphonebob.epistemia." redirect;
+                local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
+                local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
+                local-zone = "lab.epistemia." redirect;
+                local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
+                local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
+                local-zone = "paraclete.epistemia." redirect;
+                local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
+                local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+        };
 
-        interface = "lo";
-        listen-address = "127.0.0.1";
-        bind-interfaces = true;
-        no-resolv = true;
+        # hagezi for dns-based adblocking (in addition to others)
+        rpz = {
+          name = "hagezi.ultimate";
+          zonefile = "hagezi.ultimate";
+          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+        };
 
-        conf-file = "/data/src/clones/networking/hagezi_dns-blocklists/dnsmasq/ultimate.txt";
+        # go through mullvad for regular dns queries
+              forward-zone = {
+                name = ".";
+                forward-addr = [ "100.64.0.3" ];
+        };
       };
     };
 
@@ -361,39 +389,6 @@
       };
     };
 
-    # invidious
-    invidious = {
-      enable = true;
-
-      http3-ytproxy.enable = true;
-      nginx.enable = true;
-      sig-helper.enable = true;
-
-      domain = "invidious.demiurge.epistemia";
-      extraSettingsFile = "/run/invidious_settings";
-      settings = {
-        admins = [ "vin" ];
-        captcha_enabled = false;
-        registration_enabled = false;
-        hmac_key = "zCYyRa7vD0qt";
-        default_user_preferences = {
-          captions = [ "English" ];
-          dark_mode = "dark";
-          feed_menu = [
-            "Popular"
-            "Subscriptions"
-            "Playlists"
-          ];
-          max_results = 100;
-          quality = "dash";
-          save_player_pos = true;
-          unseen_only = true;
-          local = true;
-          extend_desc = true;
-        };
-      };
-    };
-
     # graphical input
     libinput = {
       enable = true;
@@ -420,7 +415,7 @@
     nginx = {
       enable = true;
 
-      defaultListenAddresses = [ "100.64.0.2" ];
+      defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ];
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -460,22 +455,14 @@
         };
 
         "sdui.demiurge.epistemia" = {
-          #          addSSL = true;
-          #          sslCertificate = "/var/demiurge.epistemia.crt";
-          #          sslCertificateKey = "/var/demiurge.epistemia.key";
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/" = {
             proxyPass = "http://127.0.0.1:7860";
             proxyWebsockets = true;
           };
         };
-
-        "invidious.demiurge.epistemia" = {
-          addSSL = true;
-          enableACME = false;
-          forceSSL = false;
-          sslCertificate = "/var/demiurge.epistemia.crt";
-          sslCertificateKey = "/var/demiurge.epistemia.key";
-        };
       };
     };
 
@@ -508,7 +495,127 @@
     # using pulseaudio and home-manager, so had to disable pulseaudio.
     pipewire = {
       enable = true;
+      alsa.enable = true;
+      audio.enable = true;
       pulse.enable = true;
+
+      extraConfig.pipewire = {
+        "99-filter-he5xx.conf" = {
+          "context.modules" = [
+            {
+              name = "libpipewire-module-filter-chain";
+              args = {
+                node.name = "peq-he5xx-sink";
+                node.description = "PEQ HE5XX (auto)";
+                # playback.props is the virtual sink/device properties
+                playback.props = {
+                  media.class = "Audio/Sink";
+                  "filter.smart" = true;
+                  "filter.smart.name" = "peq-he5xx";
+                  # tell WirePlumber what target properties this filter is intended for
+                  # (we leave this unset here; smart target matching will be done by wireplumber)
+                };
+                # filter graph: single builtin param_eq node that loads the param file
+                filter.graph = [
+                  {
+                    type = "builtin";
+                    name = "param_eq";
+                    label = "param_eq_he5xx";
+                    config.filename = "/etc/pipewire/parametric/he5xx.txt";
+                  }
+                ];
+              };
+            };
+          ];
+        };
+
+        "99-filter-airpods.conf" = {
+          "context.modules" = [
+            {
+              name = "libpipewire-module-filter-chain";
+              args = {
+                node.name = "peq-airpods-pro-2-sink";
+                node.description = "PEQ AirPods Pro 2 (auto)";
+                playback.props = {
+                  media.class = "Audio/Sink";
+                  "filter.smart" = true;
+                  "filter.smart.name" = "peq-airpods-pro-2";
+                };
+                filter.graph = [
+                  {
+                    type = "builtin";
+                    name = "param_eq";
+                    label = "param_eq_airpods";
+                    config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt";
+                  }
+                ];
+              };
+            }
+          ];
+        };
+      };
+
+      # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
+      wireplumber = {
+        enable = true;
+        extraConfig."50-smartfilters-airpods.conf".text = ''
+        {
+          "monitor.bluez.rules" : [
+          # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+          # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+        ],
+
+        "policy.rules" : [
+          # The core smart filter matching is done by matching the target.node properties
+          # WirePlumber's smart filters will look for filter.smart.target (set below).
+        ],
+
+        "policy" : {
+          "smart_filters" : {
+            "rules" : [
+              {
+                "matches" : [
+                  { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+                ],
+                "actions" : {
+                  # If target device matches, set the 'target.node' metadata for smart filters to use
+                  "update-metadata" : {
+                    "target.node" : { "name" : "bluez_output.*AirPods.*" }
+                  }
+                }
+              }
+            ]
+          }
+        },
+
+        "endpoint.rules" : [
+          {
+            "matches" : [
+              { "node.name" : "peq-airpods-pro-2-sink" }
+            ],
+            "actions" : {
+              "update-props" : {
+                # Mark this WF sink as intended for a specific target device.
+                # WirePlumber will use filter.smart.target to identify which device to chain to.
+                "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+              }
+            }
+          },
+          {
+            "matches" : [
+              { "node.name" : "peq-he5xx-sink" }
+            ],
+            "actions" : {
+              "update-props" : {
+                # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
+                "filter.smart.target" : {}
+              }
+            }
+          }
+        ]
+      }
+      '';
+      };
     };
 
     # reddit
@@ -555,11 +662,11 @@
         # Disable autoplay videos by default
         REDLIB_DEFAULT_AUTOPLAY_VIDEOS = false;
         # Define a default list of subreddit subscriptions (format: sub1+sub2+sub3)
-        REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+factorio+warframe+elitedangerous+unixporn+usabilityporn";
+        REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+elitedangerous";
         # Define a default list of subreddit filters (format: sub1+sub2+sub3)
         REDLIB_DEFAULT_FILTERS = "popular+all+funny+memes";
         # Hide awards by default
-        REDLIB_DEFAULT_HIDE_AWARDS = false;
+        REDLIB_DEFAULT_HIDE_AWARDS = true;
         # Hide sidebar and summary
         REDLIB_DEFAULT_HIDE_SIDEBAR_AND_SUMMARY = false;
         # Disable the confirmation before visiting Reddit
@@ -604,8 +711,8 @@
 
         hostnames = {
           replace = {
-            "(.*\.)?youtube\.com$" = "invidious.demiurge.epistemia";
-            "(.*\.)?youtu\.be$" = "invidious.demiurge.epistemia";
+            "(.*\.)?youtube\.com$" = "yewtu.be";
+            "(.*\.)?youtu\.be$" = "yewtu.be";
             "(.*\.)?reddit\.com$" = "redlib.demiurge.epistemia";
             "(.*\.)?redd\.it$" = "redlib.demiurge.epistemia";
           };
@@ -967,7 +1074,6 @@
         doi_resolvers = {
           "oadoi.org" = "https://oadoi.org/";
           "doi.org" = "https://doi.org/";
-          "doai.io" = "https://dissem.in/";
           "sci-hub.se" = "https://sci-hub.se/";
           "sci-hub.st" = "https://sci-hub.st/";
           "sci-hub.ru" = "https://sci-hub.ru/";
@@ -977,25 +1083,10 @@
       };
     };
 
-    # vpn
-    tailscale = {
-      enable = true;
-      authKeyFile = config.age.secrets.tailscale_demiurge.path;
-      extraDaemonFlags = [ "--no-logs-no-support" ];
-      extraUpFlags = [
-        "--login-server=https://headscale.13f0.net"
-        "--advertise-exit-node"
-      ];
-      openFirewall = true;
-    };
-
     # udev rules
     udev = {
       enable = true;
       extraRules = ''
-        # ST-Link v2.1
-        SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666"
-
         # Oculus Quest 2
         SUBSYSTEM=="usb", ATTR{idVendor}=="2833", ATTR{idProduct}=="0186", MODE="0660",
         GROUP="input", SYMLINK+="ocuquest%n"
@@ -1015,53 +1106,10 @@
   };
 
   # extra systemd stuff
-  systemd = {
-    services = {
-      invidious_token = {
-        script = ''
-          set -euo pipefail
-
-          a="$(${pkgs.podman}/bin/podman run quay.io/invidious/youtube-trusted-session-generator | sed -n 4,5p)"
-          visitor_data=$(echo "$a" | sed -n 1p | cut -d' ' -f2)
-          po_token=$(echo "$a" | sed -n 2p | cut -d' ' -f2)
-          day=$(date +%e | tr -d ' ')
-
-          printf '{"visitor_data": "%s",\n"po_token": "%s",\n' \
-                 "$visitor_data" "$po_token" \
-                 >/run/invidious_settings
-
-          if [ $((day % 2)) -eq 0 ]; then
-              printf '"force_resolve": "ipv6"}\n' >>/run/invidious_settings
-          else
-              printf '"force_resolve": "ipv4"}\n' >>/run/invidious_settings
-          fi
-
-          ${pkgs.systemd}/bin/systemctl restart invidious-sig-helper
-          ${pkgs.systemd}/bin/systemctl restart invidious
-        '';
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-        };
-      };
-
-      nginx = {
-        after = [ "tailscaled.service" ];
-        requires = [ "tailscaled.service" ];
-        serviceConfig.Type = lib.mkForce "idle";
-      };
-
-      postgresql.serviceConfig.Type = lib.mkForce "idle";
-      tailscaled.serviceConfig.Type = lib.mkForce "idle";
-    };
-
-    timers.invidious_token = {
-      timerConfig = {
-        OnCalendar = "hourly";
-        Persistent = true;
-      };
-      wantedBy = [ "timers.target" ];
-    };
+  systemd.services.nginx = {
+    after = [ "wg-quick@wg1.service" ];
+    requires = [ "wg-quick@wg1.service" ];
+    serviceConfig.Type = lib.mkForce "idle";
   };
 
   # create caches and use mandoc
@@ -1072,20 +1120,5 @@
     mandoc.enable = true;
   };
 
-  # virtualization stuff
-  virtualisation = {
-    libvirtd.enable = true;
-
-    podman = {
-      enable = true;
-      dockerCompat = true;
-    };
-  };
-
-  xdg.portal = {
-    config.common.default = [ "wlr" ];
-    wlr.enable = true;
-  };
-
   system.stateVersion = "24.05";
 }
diff --git a/hosts/hastur/default.nix b/hosts/hastur/default.nix
index 5127533..d9507c4 100644
--- a/hosts/hastur/default.nix
+++ b/hosts/hastur/default.nix
@@ -19,11 +19,9 @@
 
   # decrypt agenix secrets
   age.secrets = {
-    tailscale_hastur = {
-      file = ../../secrets/tailscale_hastur.age;
-      owner = "root";
-      group = "root";
-    };
+    wg0_hastur.file = ../../secrets/wg0_hastur.age;
+    wg1_hastur.file = ../../secrets/wg1_hastur.age;
+    wpa_supplicant.file = ../../secrets/wpa_supplicant.age;
   };
 
   # boot options
@@ -40,34 +38,14 @@
     ];
   };
 
-  # disable wifi and open some ports
   networking = {
     hostName = "hastur";
     hostId = "deadcafe";
 
     wireless = {
       enable = true;
-
-      networks = {
-        OpenDyna.pskRaw = "***REDACTED_PSK***";
-
-        FloridaPoly = {
-          authProtocols = [ "WPA-EAP" ];
-          auth = ''
-            eap=PEAP
-            phase2="auth=MSCHAPv2"
-            identity="***REDACTED_EMAIL***"
-            password="***REDACTED_PASSWORD***"
-          '';
-        };
-
-        USF-Guest = { };
-
-        iphonebob.pskRaw = "***REDACTED_PSK***";
-        Retreat_86WiFi.pskRaw = "***REDACTED_PSK***";
-        Orbi-1.pskRaw = "***REDACTED_PSK***";
-        SETUP-E55E.pskRaw = "***REDACTED_PSK***";
-      };
+      userControlled = true;
+      allowAuxiliaryImperativeNetworks = true;
     };
 
     firewall = {
@@ -75,34 +53,58 @@
       #      allowedUDPPorts = [ ];
     };
 
-    # mullvad to miami
-    wg-quick.interfaces.us-mia-wg-001 = {
-      address = [
-        "10.70.235.16/32"
-        "fc00:bbbb:bbbb:bb01::7:eb0f/128"
-      ];
-      privateKey = "***REDACTED_WG_KEY***=";
-
-      # supposed to be done by tailscale instead \_(:/)_/
-      postUp = ''
-        ip route add 100.64.0.0/24 dev tailscale0
-        ip route add 100.100.100.100/32 dev tailscale0
-      '';
-      postDown = ''
-        ip route del 100.64.0.0/24 dev tailscale0
-        ip route del 100.100.100.100/32 dev tailscale0
-      '';
+    wg-quick.interfaces = {
+      # mullvad
+      wg0 = {
+        address = [
+          "10.75.226.117/32"
+          "fc00:bbbb:bbbb:bb01::c:e274/128"
+        ];
+        privateKeyFile = config.age.secrets.wg0_hastur.path;
+
+        peers = [{
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::0/0"
+            ];
+            endpoint = "45.134.142.206:51820";
+            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+        }];
+      };
 
-      peers = [
-        {
-          allowedIPs = [
-            "0.0.0.0/0"
-            "::0/0"
-          ];
-          endpoint = "45.134.142.219:51820";
-          publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
-        }
-      ];
+      # epistemia
+      wg1 = {
+        address = [
+          "10.0.13.3/24"
+          "fd00:b0ba:cafe:babe::3/64"
+        ];
+        privateKeyFile = config.age.secrets.wg1_hastur.path;
+
+        peers = [
+          # saklas
+          {
+            allowedIPs = [
+              "10.0.13.1/32"
+              "fd00:b0ba:cafe:babe::1/128"
+            ];
+            endpoint = "vineetk.net:51820";
+            persistentKeepalive = 25;
+            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+          }
+          # demiurge (and lab through it)
+          {
+            allowedIPs = [
+              "10.0.13.2/32"
+              "10.0.13.5/32"
+              "fd00:b0ba:cafe:babe::2/128"
+              "fd00:b0ba:cafe:babe::5/128"
+            ];
+            endpoint = "carcosa.13f0.net:51820";
+            persistentKeepalive = 25;
+            publicKey = "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=";
+          }
+        ];
+      };
     };
   };
 
@@ -126,8 +128,6 @@
     isNormalUser = true;
 
     extraGroups = [
-      "kvm"
-      "libvirtd"
       "transmission"
       "wheel"
     ];
@@ -135,7 +135,12 @@
     shell = pkgs.zsh;
 
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@hastur"
+    ];
+
+    packages = with pkgs; [
+      acpi
+      acpilight
     ];
   };
 
@@ -149,6 +154,8 @@
     ];
 
     pathsToLink = [ "/share/zsh" ];
+
+    etc."wpa_supplicant.conf".source = config.age.secrets.wpa_supplicant.path;
   };
 
   # enable bluetooth and add some udev rules
@@ -190,39 +197,57 @@
       ];
     };
 
-    pki.certificates = [
-      ''
-        -----BEGIN CERTIFICATE-----
-        MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
-        MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
-        MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
-        ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-        AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
-        E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-        HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
-        BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
-        LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
-        -----END CERTIFICATE-----
-      ''
-    ];
-
     sudo.enable = false;
   };
 
   services = {
     # dns
-    dnsmasq = {
+    unbound = {
       enable = true;
       settings = {
-        server = [
-          "/epistemia/100.100.100.100"
-          "9.9.9.9"
-        ];
+              server = {
+                interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
+          access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
+
+                hide-identity = yes;
+                hide-version = yes;
+
+                # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+                # https://tools.ietf.org/html/rfc8198
+                aggressive-nsec = no;
+
+                local-zone = "saklas.epistemia." redirect;
+                local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
+                local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
+                local-zone = "demiurge.epistemia." redirect;
+                local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
+                local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
+                local-zone = "hastur.epistemia." redirect;
+                local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
+                local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
+                local-zone = "iphonebob.epistemia." redirect;
+                local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
+                local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
+                local-zone = "lab.epistemia." redirect;
+                local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
+                local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
+                local-zone = "paraclete.epistemia." redirect;
+                local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
+                local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+        };
+
+        # hagezi for dns-based adblocking (in addition to others)
+        rpz = {
+          name = "hagezi.ultimate";
+          zonefile = "hagezi.ultimate";
+          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+        };
 
-        interface = "lo";
-        listen-address = "127.0.0.1";
-        bind-interfaces = true;
-        no-resolv = true;
+        # go through mullvad for regular dns queries
+              forward-zone = {
+                name = ".";
+                forward-addr = [ "100.64.0.3" ];
+        };
       };
     };
 
@@ -258,33 +283,90 @@
     # using pulseaudio and home-manager, so had to disable pulseaudio.
     pipewire = {
       enable = true;
+      alsa.enable = true;
+      audio.enable = true;
       pulse.enable = true;
-    };
 
-    # vpn
-    tailscale = {
-      enable = true;
-      authKeyFile = config.age.secrets.tailscale_hastur.path;
-      extraDaemonFlags = [ "--no-logs-no-support" ];
-      extraUpFlags = [
-        "--login-server=https://headscale.13f0.net"
-        "--advertise-exit-node"
-      ];
-      openFirewall = true;
+      extraConfig.pipewire = {
+        "99-filter-airpods.conf" = {
+          "context.modules" = [
+            {
+              name = "libpipewire-module-filter-chain";
+              args = {
+                node.name = "peq-airpods-pro-2-sink";
+                node.description = "PEQ AirPods Pro 2 (auto)";
+                playback.props = {
+                  media.class = "Audio/Sink";
+                  "filter.smart" = true;
+                  "filter.smart.name" = "peq-airpods-pro-2";
+                };
+                filter.graph = [
+                  {
+                    type = "builtin";
+                    name = "param_eq";
+                    label = "param_eq_airpods";
+                    config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt";
+                  }
+                ];
+              };
+            }
+          ];
+        };
+      };
+
+      # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
+      wireplumber = {
+        enable = true;
+        extraConfig."50-smartfilters-airpods.conf".text = ''
+        {
+          "monitor.bluez.rules" : [
+          # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+          # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+        ],
+
+        "policy.rules" : [
+          # The core smart filter matching is done by matching the target.node properties
+          # WirePlumber's smart filters will look for filter.smart.target (set below).
+        ],
+
+        "policy" : {
+          "smart_filters" : {
+            "rules" : [
+              {
+                "matches" : [
+                  { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+                ],
+                "actions" : {
+                  # If target device matches, set the 'target.node' metadata for smart filters to use
+                  "update-metadata" : {
+                    "target.node" : { "name" : "bluez_output.*AirPods.*" }
+                  }
+                }
+              }
+            ]
+          }
+        },
+
+        "endpoint.rules" : [
+          {
+            "matches" : [
+              { "node.name" : "peq-airpods-pro-2-sink" }
+            ],
+            "actions" : {
+              "update-props" : {
+                "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+              }
+            }
+          }
+        ]
+      }
+      '';
+      };
     };
 
     # enable better power management
     tlp.enable = true;
 
-    # udev rules
-    udev = {
-      enable = true;
-      extraRules = ''
-        # ST-Link v2.1
-        SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666"
-      '';
-    };
-
     # to get startx and use amdgpu driver
     # WM in home-manager
     xserver = {
@@ -295,6 +377,11 @@
     };
   };
 
+  systemd.services."wg-quick@wg1" = {
+    after = [ "wg-quick@wg0.service" ];
+    requires = [ "wg-quick@wg0.service" ];
+  };
+
   # create caches and use mandoc
   documentation.man = {
     enable = true;
@@ -303,11 +390,5 @@
     mandoc.enable = true;
   };
 
-  # virtualization stuff
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-  };
-
   system.stateVersion = "24.05";
 }