Add new server modules and configurations for various services

- Introduced `default-creds` module for managing default credentials with Umami integration.
- Added `fail2ban` module for brute-force attack protection with configurable ban times.
- Created `firewall` module to enable and configure basic firewall settings.
- Implemented `gitea` module for self-hosted Git service with PostgreSQL backend.
- Developed `glance` module for a customizable dashboard with various widgets and themes.
- Added `iknowyou` module for a self-hosted password manager with production and demo environments.
- Introduced `kernel-hardening` module for enhancing kernel security settings.
- Created `mazanoke` module for a simple web application with Nginx integration.
- Added `mealie` module for a self-hosted meal planning application.
- Implemented `stirling-pdf` module for PDF generation service.
- Developed `umami` module for self-hosted analytics with secret management.
- Added `ssh` module for secure SSH configuration with user restrictions.
- Introduced `nixy` theme for a customized aesthetic experience across services.

nixos/amd-graphics.nix

@@ -0,0 +1,11 @@
+{pkgs, ...}: {
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      rocmPackages.clr.icd
+      # Support VA-API pour AMD
+      libvdpau-va-gl
+      libva-vdpau-driver
+    ];
+  };
+}

nixos/audio.nix

@@ -0,0 +1,23 @@
+# Audio configuration for NixOS using PipeWire
+{
+  security.rtkit.enable = true;
+  services.pulseaudio.enable = false;
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = true;
+    wireplumber = {
+      enable = true;
+      extraConfig = {
+        "10-disable-camera" = {
+          "wireplumber.profiles" = {
+            main."monitor.libcamera" = "disabled";
+          };
+        };
+      };
+    };
+  };
+}

nixos/bluetooth.nix

@@ -0,0 +1,7 @@
+# Bluetooth configuration for NixOS
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+}

nixos/docker.nix

@@ -0,0 +1,5 @@
+{config, pkgs, ...}: {
+  virtualisation.docker.enable = true;
+  virtualisation.docker.package = pkgs.docker_29;
+  users.users."${config.var.username}".extraGroups = ["docker"];
+}

nixos/fonts.nix

@@ -0,0 +1,26 @@
+# Fonts configuration for NixOS
+{pkgs, ...}: {
+  fonts = {
+    packages = with pkgs; [
+      roboto
+      work-sans
+      comic-neue
+      source-sans
+      comfortaa
+      inter
+      lato
+      lexend
+      jost
+      dejavu_fonts
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+      nerd-fonts.fira-code
+      nerd-fonts.meslo-lg
+      openmoji-color
+      twemoji-color-font
+    ];
+
+    enableDefaultPackages = false;
+  };
+}

nixos/home-manager.nix

@@ -0,0 +1,20 @@
+# Home-manager configuration for NixOS
+{
+  inputs,
+  pkgs,
+  ...
+}: {
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    backupFileExtension = "hm-backup";
+    extraSpecialArgs = {
+      inherit inputs;
+      pkgs-stable = import inputs.nixpkgs-stable {
+        system = pkgs.stdenv.hostPlatform.system;
+        config.allowUnfree = true;
+      };
+      pkgs-nur-hadi = inputs.nur-anotherhadi.packages.${pkgs.stdenv.hostPlatform.system};
+    };
+  };
+}

nixos/hyprland.nix

@@ -0,0 +1,14 @@
+# Hyprland is a dynamic tiling Wayland compositor.
+{
+  inputs,
+  pkgs,
+  ...
+}: {
+  programs.hyprland = {
+    enable = true;
+    withUWSM = true;
+    package = inputs.hyprland.packages."${pkgs.stdenv.hostPlatform.system}".hyprland;
+    portalPackage =
+      inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
+  };
+}

nixos/nix.nix

@@ -0,0 +1,63 @@
+# Nix configuration for NixOS
+{
+  config,
+  inputs,
+  ...
+}: let
+  autoGarbageCollector = config.var.autoGarbageCollector;
+in {
+  # Ask for password once per SSH session (tied to the tty, expires when session closes)
+  security.sudo.extraConfig = ''
+    Defaults timestamp_type=tty,timestamp_timeout=-1
+  '';
+
+  security.sudo.extraRules = [
+    {
+      users = [config.var.username];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = ["NOPASSWD"];
+        }
+      ];
+    }
+  ];
+  nixpkgs.config = {
+    allowUnfree = true;
+    allowBroken = false;
+  };
+  nix = {
+    nixPath = ["nixpkgs=${inputs.nixpkgs}"];
+    channel.enable = false;
+    extraOptions = ''
+      warn-dirty = false
+    '';
+    settings = {
+      download-buffer-size = 262144000; # 250 MB (250 * 1024 * 1024)
+      auto-optimise-store = true;
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      substituters = [
+        # high priority since it's almost always used
+        "https://cache.nixos.org?priority=10"
+
+        "https://hyprland.cachix.org"
+        "https://nix-community.cachix.org"
+        "https://numtide.cachix.org"
+      ];
+      trusted-public-keys = [
+        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
+      ];
+    };
+    gc = {
+      automatic = autoGarbageCollector;
+      persistent = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+}

nixos/nvidia.nix

@@ -0,0 +1,102 @@
+# Nvidia configuration for NixOS with Wayland and Hyprland support
+# Import this module only if you have an Nvidia GPU
+{
+  pkgs,
+  config,
+  ...
+}: let
+  # Using beta driver for recent GPUs like RTX 4070
+  nvidiaDriverChannel = config.boot.kernelPackages.nvidiaPackages.production;
+in {
+  # Video drivers configuration for Xorg and Wayland
+  services.xserver.videoDrivers = ["nvidia"]; # Simplified - other modules are loaded automatically
+
+  # Kernel parameters for better Wayland and Hyprland integration
+  boot.kernelParams = [
+    "nvidia-drm.modeset=1" # Enable mode setting for Wayland
+    "nvidia.NVreg_PreserveVideoMemoryAllocations=1" # Improves resume after sleep
+  ];
+
+  # Blacklist nouveau to avoid conflicts
+  boot.blacklistedKernelModules = ["nouveau"];
+
+  # Environment variables for better compatibility
+  environment.variables = {
+    LIBVA_DRIVER_NAME = "nvidia"; # Hardware video acceleration
+    GBM_BACKEND = "nvidia-drm"; # Graphics backend for Wayland
+    __GLX_VENDOR_LIBRARY_NAME = "nvidia"; # Use Nvidia driver for GLX
+    NIXOS_OZONE_WL = "1"; # Wayland support for Electron apps
+    __GL_GSYNC_ALLOWED = "1"; # Enable G-Sync if available
+    __GL_VRR_ALLOWED = "1"; # Enable VRR (Variable Refresh Rate)
+    NVD_BACKEND = "direct"; # Configuration for new driver
+    MOZ_ENABLE_WAYLAND = "1"; # Wayland support for Firefox
+  };
+
+  # Configuration for proprietary packages
+  nixpkgs.config = {
+    nvidia.acceptLicense = true;
+  };
+
+  # Nvidia configuration
+  hardware = {
+    nvidia = {
+      open = false; # Proprietary driver for better performance
+      nvidiaSettings = true; # Nvidia settings utility
+      powerManagement = {
+        enable = true; # Power management
+        finegrained = true; # More precise power consumption control
+      };
+      modesetting.enable = true; # Required for Wayland
+      package = nvidiaDriverChannel;
+      forceFullCompositionPipeline = true; # Prevents screen tearing
+
+      # Configuration for hybrid AMD+Nvidia laptop
+      prime = {
+        # Optimized configuration for switchable graphics laptops
+        offload = {
+          enable = true; # Mode optimized for power saving
+          enableOffloadCmd = true; # Allows running applications with dedicated GPU
+        };
+        # sync.enable disabled as offload is generally better for laptops
+        sync.enable = false;
+        # PCI IDs verified for your hardware
+        amdgpuBusId = "PCI:5:0:0"; # Integrated AMD GPU
+        nvidiaBusId = "PCI:1:0:0"; # Dedicated Nvidia GPU
+      };
+    };
+
+    # Enhanced graphics support
+    graphics = {
+      enable = true;
+      enable32Bit = true;
+      extraPackages = with pkgs; [
+        nvidia-vaapi-driver
+        libva-vdpau-driver
+        libvdpau-va-gl
+        mesa
+        egl-wayland
+        vulkan-loader
+        vulkan-validation-layers
+        libva
+      ];
+    };
+  };
+
+  # Nix cache for CUDA
+  nix.settings = {
+    substituters = ["https://cuda-maintainers.cachix.org"];
+    trusted-public-keys = [
+      "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
+    ];
+  };
+
+  # Additional useful packages
+  environment.systemPackages = with pkgs; [
+    vulkan-tools
+    mesa-demos
+    libva-utils # VA-API debugging tools
+  ];
+
+  # Enable Nvidia container toolkit for GPU acceleration in containers (docker)
+  hardware.nvidia-container-toolkit.enable = false;
+}

nixos/omen.nix

@@ -0,0 +1,64 @@
+# Omen laptop configuration for NixOS
+# Import this only if you have an HP Omen laptop
+{
+  config,
+  pkgs,
+  ...
+}: let
+  hp-omen-linux-module = pkgs.callPackage (
+    {
+      kernel ? config.boot.kernelPackages.kernel,
+      stdenv,
+      fetchFromGitHub,
+    }:
+      stdenv.mkDerivation (finalAttrs: {
+        pname = "hp-omen-linux-module";
+        version = "rebase-6.14";
+        src = fetchFromGitHub {
+          owner = "ranisalt";
+          repo = "hp-omen-linux-module";
+          rev = finalAttrs.version;
+          sha256 = "sha256-2zCm29bdboSjRm/caMjBPGNc0tZXPUnIIYlHxxfhAok=";
+        };
+        setSourceRoot = ''
+          export sourceRoot=$(pwd)/${finalAttrs.src.name}/src
+        '';
+        nativeBuildInputs = kernel.moduleBuildDependencies;
+        makeFlags = [
+          "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+        ];
+        installPhase = ''
+          runHook preInstall
+          install hp-wmi.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86/hp/
+          runHook postInstall
+        '';
+      })
+  ) {kernel = config.boot.kernelPackages.kernel;};
+in {
+  boot.extraModulePackages = [hp-omen-linux-module];
+  boot.kernelModules = ["hp-wmi"];
+  boot.kernelParams = ["hp_wmi.force_slow_fan_control=1"];
+
+  users.groups.omen-rgb = {};
+  users.users.${config.var.username}.extraGroups = ["omen-rgb"];
+
+  systemd.tmpfiles.rules = [
+    "w /sys/devices/platform/hp-wmi/rgb_zones/zone00 0660 root omen-rgb -"
+    "w /sys/devices/platform/hp-wmi/rgb_zones/zone01 0660 root omen-rgb -"
+    "w /sys/devices/platform/hp-wmi/rgb_zones/zone02 0660 root omen-rgb -"
+    "w /sys/devices/platform/hp-wmi/rgb_zones/zone03 0660 root omen-rgb -"
+  ];
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="platform", KERNEL=="hp-wmi", ACTION=="add", \
+    RUN+="${pkgs.coreutils-full}/bin/sleep 2", \
+    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone00", \
+    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone00", \
+    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone01", \
+    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone01", \
+    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone02", \
+    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone02", \
+    RUN+="${pkgs.coreutils}/bin/chgrp omen-rgb /sys/devices/platform/hp-wmi/rgb_zones/zone03", \
+    RUN+="${pkgs.coreutils}/bin/chmod 0660 /sys/devices/platform/hp-wmi/rgb_zones/zone03"
+  '';
+}

nixos/systemd-boot.nix

@@ -0,0 +1,43 @@
+# Systemd-boot configuration for NixOS
+{pkgs, ...}: {
+  boot = {
+    bootspec.enable = true;
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot = {
+        enable = true;
+        consoleMode = "auto";
+        configurationLimit = 8;
+      };
+    };
+    tmp.cleanOnBoot = true;
+    kernelPackages = pkgs.linuxPackages_latest; # _zen, _hardened, _rt, _rt_latest, etc.
+
+    # Silent boot
+    kernelParams = [
+      "quiet"
+      "splash"
+      "rd.systemd.show_status=false"
+      "rd.udev.log_level=3"
+      "udev.log_priority=3"
+      "boot.shell_on_fail"
+    ];
+    consoleLogLevel = 0;
+    initrd.verbose = false;
+
+    # plymouth = {
+    #   enable = true;
+    #   theme = lib.mkForce "cuts_alt";
+    #   themePackages = with pkgs; [
+    #     (adi1090x-plymouth-themes.override {
+    #       selected_themes = ["cuts_alt"];
+    #     })
+    #   ];
+    # };
+  };
+
+  # To avoid systemd services hanging on shutdown
+  systemd.settings.Manager = {
+    DefaultTimeoutStopSec = "10s";
+  };
+}

nixos/tuigreet.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}: let
+  c = config.lib.stylix.colors;
+  tuigreet = inputs.notashelf-tuigreet.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+  theme = lib.concatStringsSep ";" [
+    "border=#${c.base0D}"
+    "text=#${c.base05}"
+    "prompt=#${c.base0D}"
+    "action=#${c.base0C}"
+    "button=#${c.base0D}"
+    "container=#${c.base00}"
+    "input=#${c.base02}"
+  ];
+
+  tuigreet-launch = pkgs.writeShellScript "tuigreet-launch" ''
+    exec ${tuigreet}/bin/tuigreet \
+      --time \
+      --time-format '%H:%M  %A %d %B' \
+      --sessions /run/current-system/sw/share/wayland-sessions \
+      --remember \
+      --remember-user-session \
+      --asterisks \
+      --greeting 'Welcome' \
+      --container-padding 2 \
+      --theme '${theme}' \
+      --power-shutdown 'systemctl poweroff' \
+      --power-reboot 'systemctl reboot'
+  '';
+in {
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${tuigreet-launch}";
+        user = "greeter";
+      };
+    };
+  };
+
+  # this is a life saver.
+  # literally no documentation about this anywhere.
+  # might be good to write about this...
+  # https://www.reddit.com/r/NixOS/comments/u0cdpi/tuigreet_with_xmonad_how/
+  systemd.services.greetd.serviceConfig = {
+    Type = "idle";
+    StandardInput = "tty";
+    StandardOutput = "tty";
+    StandardError = "journal"; # Without this errors will spam on screen
+    # Without these bootlogs will spam on screen
+    TTYReset = true;
+    TTYVHangup = true;
+    TTYVTDisallocate = true;
+  };
+
+  environment.systemPackages = [tuigreet];
+}

nixos/usbguard.nix

@@ -0,0 +1,10 @@
+{config, ...}: {
+  services.usbguard = {
+    enable = true;
+    implicitPolicyTarget = "block";
+    IPCAllowedUsers = [
+      "root"
+      config.var.username
+    ];
+  };
+}

nixos/users.nix

@@ -0,0 +1,22 @@
+# Users configuration for NixOS
+{
+  config,
+  pkgs,
+  ...
+}: let
+  username = config.var.username;
+in {
+  programs.zsh.enable = true;
+  users = {
+    defaultUserShell = pkgs.zsh;
+
+    users.${username} = {
+      isNormalUser = true;
+      description = "${username} account";
+      extraGroups = [
+        "networkmanager"
+        "wheel"
+      ];
+    };
+  };
+}

nixos/utils.nix

@@ -0,0 +1,151 @@
+# Misc
+{
+  pkgs,
+  config,
+  ...
+}: let
+  hostname = config.var.hostname;
+  keyboardLayout = config.var.keyboardLayout;
+  configDir = config.var.configDirectory;
+  timeZone = config.var.timeZone;
+  defaultLocale = config.var.defaultLocale;
+  extraLocale = config.var.extraLocale;
+  autoUpgrade = config.var.autoUpgrade;
+in {
+  networking.hostName = hostname;
+
+  networking.networkmanager.enable = true;
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  system.autoUpgrade = {
+    enable = autoUpgrade;
+    dates = "04:00";
+    flake = "${configDir}";
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "--commit-lock-file"
+    ];
+    allowReboot = false;
+  };
+
+  time = {
+    timeZone = timeZone;
+  };
+  i18n.defaultLocale = defaultLocale;
+  i18n.inputMethod = {
+    enable = true;
+    type = "fcitx5";
+    fcitx5.addons = with pkgs; [fcitx5-gtk];
+  };
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = extraLocale;
+    LC_IDENTIFICATION = extraLocale;
+    LC_MEASUREMENT = extraLocale;
+    LC_MONETARY = extraLocale;
+    LC_NAME = extraLocale;
+    LC_NUMERIC = extraLocale;
+    LC_PAPER = extraLocale;
+    LC_TELEPHONE = extraLocale;
+    LC_TIME = extraLocale;
+  };
+
+  services = {
+    xserver = {
+      enable = true;
+      xkb.layout = keyboardLayout;
+      xkb.variant = "";
+    };
+    gnome.gnome-keyring.enable = true;
+    psd = {
+      enable = true;
+      resyncTimer = "10m";
+    };
+  };
+  console.keyMap = keyboardLayout;
+
+  environment.variables = {
+    XDG_DATA_HOME = "$HOME/.local/share";
+    PASSWORD_STORE_DIR = "$HOME/.local/share/password-store";
+    EDITOR = "nvim";
+  };
+
+  services.libinput.enable = true;
+  programs.dconf.enable = true;
+  services = {
+    dbus = {
+      enable = true;
+      implementation = "broker";
+      packages = with pkgs; [
+        gcr
+        gnome-settings-daemon
+      ];
+    };
+    gvfs.enable = true;
+    upower.enable = true;
+    power-profiles-daemon.enable = true;
+    udisks2.enable = true;
+  };
+
+  # enable zsh autocompletion for system packages (systemd, etc)
+  environment.pathsToLink = ["/share/zsh"];
+
+  # Faster rebuilding
+  documentation = {
+    enable = true;
+    doc.enable = false;
+    man.enable = true;
+    dev.enable = false;
+    info.enable = false;
+    nixos.enable = false;
+  };
+
+  environment.systemPackages = with pkgs; [
+    fd
+    bc
+    gcc
+    file
+    git-ignore
+    xdg-utils
+    wget
+    curl
+    gnupg
+    openssl
+    vim
+    go
+    comma
+    zip
+    unzip
+    optipng
+    jpegoptim
+    pfetch
+    btop
+    unrar
+    p7zip
+  ];
+
+  xdg.portal = {
+    enable = true;
+    xdgOpenUsePortal = true;
+    config = {
+      common.default = ["gtk"];
+      hyprland.default = [
+        "gtk"
+        "hyprland"
+      ];
+    };
+
+    extraPortals = [pkgs.xdg-desktop-portal-gtk];
+  };
+
+  security = {
+    # allow wayland lockers to unlock the screen
+    pam.services.hyprlock.text = "auth include login";
+
+    # userland niceness
+    rtkit.enable = true;
+
+    # don't ask for password for wheel group
+    sudo.wheelNeedsPassword = false;
+  };
+}