Add new server modules and configurations for various services

- Introduced `default-creds` module for managing default credentials with Umami integration.
- Added `fail2ban` module for brute-force attack protection with configurable ban times.
- Created `firewall` module to enable and configure basic firewall settings.
- Implemented `gitea` module for self-hosted Git service with PostgreSQL backend.
- Developed `glance` module for a customizable dashboard with various widgets and themes.
- Added `iknowyou` module for a self-hosted password manager with production and demo environments.
- Introduced `kernel-hardening` module for enhancing kernel security settings.
- Created `mazanoke` module for a simple web application with Nginx integration.
- Added `mealie` module for a self-hosted meal planning application.
- Implemented `stirling-pdf` module for PDF generation service.
- Developed `umami` module for self-hosted analytics with secret management.
- Added `ssh` module for secure SSH configuration with user restrictions.
- Introduced `nixy` theme for a customized aesthetic experience across services.

home/system/caelestia-shell/default.nix

@@ -0,0 +1,80 @@
+# Caelestia Shell Home Manager Configuration
+# See https://github.com/caelestia-dots/shell
+{
+  pkgs,
+  inputs,
+  lib,
+  ...
+}: {
+  imports = [
+    inputs.caelestia-shell.homeManagerModules.default
+    ./bar.nix
+    ./launcher.nix
+    ./appearance.nix
+    ./scheme.nix
+    ./swappy.nix
+  ];
+
+  programs.caelestia = {
+    enable = true;
+    systemd.enable = false;
+    settings = {
+      services.weatherLocation = "Paris";
+      general = {
+        apps = {
+          terminal = ["ghostty"];
+          audio = ["pavucontrol"];
+          explorer = ["thunar"];
+        };
+        idle = {
+          timeouts = [];
+        };
+      };
+    };
+    cli = {
+      enable = true;
+      settings.theme = {
+        enableTerm = false;
+        enableDiscord = false;
+        enableSpicetify = false;
+        enableBtop = false;
+        enableCava = false;
+        enableHypr = false;
+        enableGtk = false;
+        enableQt = false;
+      };
+    };
+  };
+
+  home.packages = with pkgs; [
+    gpu-screen-recorder
+  ];
+
+  wayland.windowManager.hyprland.settings.exec-once = [
+    "uwsm app -- caelestia resizer -d"
+    "uwsm app -- caelestia shell -d"
+    "caelestia scheme set -n onedark"
+    "caelestia scheme set -n custom"
+  ];
+
+  # shell.json is managed by home-manager (read-only symlink) but caelestia
+  # needs to write to it at runtime: replace the symlink with a mutable copy.
+  # The stale .hm-backup must be removed before linkGeneration so HM can
+  # back up the runtime-modified shell.json without hitting a conflict.
+  home.activation.caelestiaCleanBackup = lib.hm.dag.entryBefore ["linkGeneration"] ''
+    $DRY_RUN_CMD rm -f "$HOME/.config/caelestia/shell.json.hm-backup"
+  '';
+
+  home.activation.caelestiaWritableShellConfig = lib.hm.dag.entryAfter ["linkGeneration"] ''
+    if [ -L "$HOME/.config/caelestia/shell.json" ]; then
+      $DRY_RUN_CMD cp --remove-destination \
+        "$(readlink -f "$HOME/.config/caelestia/shell.json")" \
+        "$HOME/.config/caelestia/shell.json"
+    fi
+  '';
+
+  services.cliphist = {
+    enable = true;
+    allowImages = true;
+  };
+}