Apply changes from messing around and making things work

11 files changed, 197 insertions, 70 deletions

diff --git a/certs/pi_ed25519.pub b/certs/pi_ed25519.pub
new file mode 100644
index 0000000..c48e71e
--- /dev/null
+++ b/certs/pi_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHyI7t5cN7ClErKx/wCwAMlNZoQqzJr7R3+gWWJ1MGIO wilkuu@iron-curtain
diff --git a/flake.lock b/flake.lock
index f8248ba..b454977 100644
--- a/flake.lock
+++ b/flake.lock
@@ -61,11 +61,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763906693,
-        "narHash": "sha256-inm7paa3myo8gE4TzjM8OPvsEg8xocWreIZBgBPEKgo=",
+        "lastModified": 1770164260,
+        "narHash": "sha256-mQgOAYWlVJyuyXjZN6yxqXWyODvQI5P/UZUCU7IOuYo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3d6c1c8fa0bea3a1a7ba23d6fa5993116766073b",
+        "rev": "4fda26500b4539e0a1e3afba9f0e1616bdad4f85",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763678758,
-        "narHash": "sha256-+hBiJ+kG5IoffUOdlANKFflTT5nO3FrrR2CA3178Y5s=",
+        "lastModified": 1770115704,
+        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "117cc7f94e8072499b0a7aa4c52084fa4e11cc9b",
+        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
         "type": "github"
       },
       "original": {
@@ -92,11 +92,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1763622513,
-        "narHash": "sha256-1jQnuyu82FpiSxowrF/iFK6Toh9BYprfDqfs4BB+19M=",
+        "lastModified": 1767313136,
+        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b",
+        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
         "type": "github"
       },
       "original": {
@@ -124,11 +124,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763870012,
-        "narHash": "sha256-AHxFfIu73SpNLAOZbu/AvpLhZ/Szhx6gRPj9ufZtaZA=",
+        "lastModified": 1770145881,
+        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "4e7d74d92398b933cc0e0e25af5b0836efcfdde3",
+        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
         "type": "github"
       },
       "original": {
@@ -182,11 +182,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766000401,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "lastModified": 1769691507,
+        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
         "type": "github"
       },
       "original": {
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 2235a04..3c7272c 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -24,12 +24,14 @@
     desktop.xfce.enable = lib.mkForce false;
 
     gpg.enable = true;
+    virtualisation.guest = true; 
   };
   boot.loader.grub = {
     enable = true;
     efiSupport = false;
   };
 
+
   environment.systemPackages = with pkgs; [
     lynx
     chawan
@@ -41,29 +43,29 @@
     in
     {
       stalwart = {
-        enable = false;
+        enable = true;
         domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
         doACME = !isVM;
       };
 
       vaultwarden = {
-        enable = false;
+        enable = true;
         signupWhitelist = [
           "wilkuu.xyz"
           "omega-relay.local"
         ];
         backupDir = "/srv/data/vaultwarden";
-        domain = if isVM then "vaultwarden.omega-relay.local" else "vaultwarden.wilkuu.xyz";
+        domain = if isVM then "bitwarden.omega-relay.local" else "bitwarden.wilkuu.xyz";
         doACME = !isVM;
       };
       uptimekuma = {
-        enable = false;
+        enable = true;
         domain = if isVM then "uptime.omega-relay.local" else "uptime.wilkuu.xyz";
         dataDir = "/srv/data/uptimekuma";
         doACME = !isVM;
       };
       freshrss = {
-        enable = false;
+        enable = true;
         domain = if isVM then "rss.omega-relay.local" else "rss.wilkuu.xyz";
         doACME = !isVM;
       };
@@ -74,10 +76,27 @@
       };
     };
 
+  services.fail2ban = {
+    enable = true; 
+    maxretry = 5;
+    ignoreIP = [
+      "192.168.80.0/24" 
+      "192.168.80.0/24"
+    ]; 
+    bantime = "24h"; 
+    bantime-increment = {
+      enable = true; # Enable increment of bantime after each violation
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      # multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h"; # Do not ban for more than 1 week
+      overalljails = true; # Calculate the bantime based on all the violations
+    }; 
+  };
+	
   # TODO: Make a nginx module
   security.acme = lib.mkIf (!config.addons.virtualisation.isTestVM) {
     acceptTerms = true;
-    defaults.email = "jakub@wilkuu.xyz";
+    defaults.email = "jstachurski9991@gmail.com";
   };
   services.nginx =
     let
@@ -89,11 +108,11 @@
       virtualHosts."${domain}" = {
         enableACME = !isVM;
         addSSL = !isVM;
-        locations."/" = {
-          root = "/srv/www/wilkuu.xyz/";
-          index = "index.html";
-          tryFiles = "$uri $uri/ =404";
-        };
+        root = "/srv/www/wilkuu.xyz/";
+	locations."/" = {
+		index = "index.html";
+		tryFiles = "$uri $uri/ =404";
+	};
       };
     };
 
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 15a96b6..c90a903 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,5 +1,6 @@
-{ ... }:
+{ config, lib, pkgs, ... }:
 let
+  wgHomePort = 16888;
   baseTCP = [
     20
     22
@@ -11,7 +12,7 @@ let
     465
   ];
   baseUDP = [
-    16555 # Wireguard
+    wgHomePort # Wireguard
   ];
   baseTCPRanges = [
   ];
@@ -33,17 +34,60 @@ let
   ];
 in
 {
+  sops.secrets = let 
+	secrets = [
+	  "wg/home/privateKey" 
+	  "wg/home/chrono/PSK" 
+	  "wg/home/chrono/PK" 
+	  "wg/home/chrono/endpoint" 
+	];  
+  in lib.genAttrs secrets (name: {
+	sopsFile = ../../secrets/${config.networking.hostName}/wireguard.yaml;
+	key = lib.removePrefix "wg/" name; 
+  });
+
+  networking.wireguard = {
+	enable = true; 
+	useNetworkd = true; 
+	interfaces = {
+	  wg-home = {
+	    ips = ["192.168.80.100/24"]; 
+	    extraOptions = {
+		DNS = "192.168.88.1"; 
+	    };
+	    privateKeyFile = config.sops.secrets."wg/home/privateKey".path; 
+	    listenPort = wgHomePort;
+	    dynamicEndpointRefreshSeconds = 45;
+	    
+	    peers = [
+	      {
+	        allowedIPs = ["192.168.88.0/24" "192.168.80.0/24"]; 
+		presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
+		publicKey  = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk="; 
+	    	# endpoint       = "45.138.54.155:16556";
+	    	endpoint       = "wilkuu.duckdns.org:16556";
+		name = "wg-home-chronosphere"; 
+
+	      } 
+	    ]; 
+	  }; 
+	};
+  }; 
+  systemd.network.networks."40-wg-home".dns = ["192.168.88.1"];
   systemd.network.enable = true;
   systemd.network.networks."10-uplink" = {
-    matchConfig.Name = "eth*";
-    networkConfig.DHCP = "ipv4";
-    linkConfig.RequiredForOnline="routable";
+    matchConfig.Name = "ens18";
+    # TODO: Cloudinit
+    address = ["45.136.141.133/26" "2a12:bec0:650:128::133/64"];   
+    gateway = ["45.136.141.129"    "2a12:bec0:650:128::"];
+    dns     = ["1.1.1.1"           "2606:4700:4700:0000:0000:0000:0000:1002"];
+    linkConfig.RequiredForOnline="yes";
   };
   systemd.network.networks."99-fallback" = {
     matchConfig.Type = "ether";
     networkConfig.DHCP = "ipv4";
     linkConfig.RequiredForOnline="routable";
-  }
+  };
 
   networking.useDHCP = false;
   networking.useNetworkd = true;
diff --git a/secrets/omega-relay/wireguard.yaml b/secrets/omega-relay/wireguard.yaml
new file mode 100644
index 0000000..95f27da
--- /dev/null
+++ b/secrets/omega-relay/wireguard.yaml
@@ -0,0 +1,48 @@
+home:
+    privateKey: ENC[AES256_GCM,data:PwNzM+UHWum6JBGelD8TtabrqQMaWHOsmF7kRMbkuAsuJiwEweXcorIBJ78=,iv:PxDWTtK7UcjIQgVpccBKi6lCDP5oSqYIox8mKSt0J/8=,tag:+9nVhwL2ofYvf70slwM9ag==,type:str]
+    chrono:
+        PSK: ENC[AES256_GCM,data:G0+qwm6avgdynHrYWUn5VFXEXjc0R46ABaWzCLmLx9FmkrHaMnha+A5fWaA=,iv:VL3fQJ+WTTcnAdT47ONdKVSRv+0tEGDT3FabK1krEbo=,tag:1w5rKM+h/xxlyU0IZdpBLg==,type:str]
+        PK: ENC[AES256_GCM,data:ilTlT/GhuKF/0nb0XPnP/V79djqIoGsue8t1N8u8olW2nlTCZQGSgjF0B+U=,iv:N8yIjZ1QYC0AmXa8NgbsXJpd6aULmDRGoL4FoB+UXrg=,tag:gLJYV/aktHt1AHmWovUdRg==,type:str]
+        endpoint: ENC[AES256_GCM,data:XqCJCDb0G4J71T/JV3ZAIZEN,iv:T9LCW4Ep+sFmQEYVpIO46NR26vdAoLl+TDYEkdK+TpM=,tag:RVR/G4uVQ0F6j4ofjx2HSg==,type:str]
+sops:
+    age:
+        - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUFBGcFBaRFZkMktJckc5
+            ZjgxQ3huc3F6ZDlSVjlySFliRDN2WmxtVUFZCkszTkYwcE45TUlUb2UrRFNpS1Rs
+            bUU3SHNJbG4ycnpIcnBzL0VYdVVEb0kKLS0tIDlIblpWbVF1alZ4RDNXcFhQWlBG
+            YlBFbWtaYnh5dlRoY3AzbTlSNnp3czgK6CV8Kccid3ZDRBaFYN9zu6b+2v5DYkVE
+            gd1Gug9snU38FAHyTUFYbuqOa8KhqAjQjMvHf7RXT441yXYgun75Rw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaFZBUTBtRWpud3BxSVFz
+            N0lvM3ZCcUhlQnhjZVh5RXlFKzJSOEVrUzJnCm5IOW5yWnFwSTJzVEJWcW9aMWht
+            SngwQzFMdSs0Rzd6QWdpY3F3QmxtUUUKLS0tIG5Nc3NUaU9NUnE2R2diNDFOSGZC
+            QzVLQkxha1gxQnJMVnZCRWowWENQYXcKwZlrSmiz12d6OD79LF8ydzqDmfJBi3or
+            RehJPP8Su92z4ApiC4CoThxu7jh5aeJ9RG4FHaYlGueOek5y7nxGuA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQeDZjbmxibUMwUURTcVhF
+            YkFvNm9Uc1JvTWpVaEFjc0Z2SHlENnZmREQwCjN5S2NsYmpGbVpDY3BLdnB5YjZI
+            M2FyVFZVQ1hmb1dBdmtxa0wwaER6SFUKLS0tIDNNbmlPUDkwaFhnNTgvemRwUHBT
+            K0pkT21kMk1OUU40RlQvbllwMGgxbkUKRDCRGs2yHZR6uE+B3kHtxHX99scWY4PV
+            fM0bnhngVts9akxMyhThpsl+5R9O7e0EbQ5xQMIfcFsgiaBCLoxwkg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRENMcVlGaVNaaFZvcEls
+            YlFUVHloS0gyVkpxclptM0VhcVF5dWR1SUZNCjlYc3FUMjlRQkR1M1R3eHpqdWQz
+            NmhJYzI0WVBPKzJ1MEEzLzRBMXFtTmcKLS0tIDQ2MDN0MHAya2hzc3hxdHVPSlVN
+            OWI1UW1kSGVnSGY1VVNwUHZvQk1OcVEKPON0phRrXYGalHpow1WqIfbZVSl8huvq
+            J96723TLUED+Nk9wrXY+q8XzjyI036MMDt6fAYiAZgparb+hNXGyUg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-04T17:22:48Z"
+    mac: ENC[AES256_GCM,data:G7fBQ96Odd3Lp1SRJWOWGaNU2zUdTRe3d0+RkS5/+QubUYLwVdJPSpqpwxQe+O/K+V5qnJJw/AAFdw8qH3OtCDfm6uOARkREWHFPG9msxP56m118ISgMDZMxnij1UBpuU/z2y5UVt4usxNSv+z82Mg3trAesWYFgPMMmrK/xJSA=,iv:/a3bWf97Qc6VGx5WMIRx2lZUW+eKgfYBSGoaU+Hrbi8=,tag:P84BGXpHoJWZR1aIncYeHA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/services/email.nix b/services/email.nix
index 5fbd04a..906b44d 100644
--- a/services/email.nix
+++ b/services/email.nix
@@ -33,7 +33,7 @@ in
       secrets = [ "user_admin_password" ];
       toSops = (sname: "stalwart/${sname}");
       toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
-      toStalwartCred = name: "%{file:/run/credentials/stalwart-mail.service/${name}}%";
+      toStalwartCred = name: "%{file:/run/credentials/${config.systemd.services.stalwart.name}/${name}}%";
 
       basicListener = proto: port: tls: {
         bind = [ "[::]:${toString port}" ];
@@ -63,10 +63,10 @@ in
 
       # Need this bc otherwise sops will complain for some reason
       users = {
-        groups.stalwart-mail = { };
-        users.stalwart-mail = {
+        groups.stalwart = { };
+        users.stalwart = {
           isSystemUser = true;
-          group = "stalwart-mail";
+          group = "stalwart";
         };
       };
 
@@ -93,39 +93,37 @@ in
                 uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME
               ));
           })
-        ))
-        //
+        )) //
+        { ${cfg.domain} = {
+	      addSSL = cfg.doACME;
+	      enableACME = cfg.doACME;
+	      serverName = "${cfg.domain}";
+	      locations."/" = {
+		proxyPass = "http://localhost:3080";
+		recommendedProxySettings = true;
+	      };
+        };};
 
-          (lib.genAttrs
-            (map (x: "${x}${cfg.domain}") [
-              ""
-              "autodiscover."
-              "autoconfig."
-            ])
-            (domain: {
-              addSSL = cfg.doACME;
-              enableACME = cfg.doACME;
-              serverName = "${domain}";
-              locations."/" = {
-                proxyPass = "http://localhost:3080";
-                recommendedProxySettings = true;
-              };
-            })
-          );
-
-      services.stalwart-mail = {
+      services.stalwart = {
         enable = true;
         dataDir = cfg.dataDir;
         openFirewall = false;
-        credentials = lib.genAttrs secrets toCredfilePath;
+        credentials = (lib.genAttrs secrets toCredfilePath) // (let 
+		acme_dir = config.security.acme.certs.${cfg.domain}.directory;
+		cert_path = file: "${acme_dir}/${file}";
+	in (if cfg.doACME then {
+		"tls_cert.pem" = cert_path "cert.pem";
+		"tls_key.pem"  = cert_path  "key.pem";
+	} else {}));
+
         settings = {
           server.listener = {
             smtp = basicListener "smtp" 25 false;
             submission = basicListener "smtp" 465 true;
             imaptls = basicListener "imap" 993 true;
             imap = basicListener "imap" 143 true;
-            webdav = basicListener "http" 3080 false;
-            jmap = basicListener "http" 3080 false;
+            # webdav = basicListener "http" 3080 false;
+            # jmap = basicListener "http" 3080 false;
             http = basicListener "http" 3080 false;
           };
 
@@ -155,8 +153,20 @@ in
 
           http = {
             use-x-forwarded = true;
-            url = "protocol + \"${cfg.domain}\"";
+            url = "protocol + \"://${cfg.domain}\"";
           };
+
+	  session.connect = {
+		hostname = "config_get('server.hostname')";
+	  };
+
+	  server.hostname = "${cfg.domain}";  
+
+	  certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME {
+		cert = toStalwartCred "tls_cert.pem"; 
+		private-key = toStalwartCred "tls_key.pem";
+		default = true; 
+	  };  
         };
       };
     }
diff --git a/services/freshrss.nix b/services/freshrss.nix
index 2c28baa..26a1853 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -59,6 +59,7 @@ in
         enable = true;
         users."freshrss" = {
           sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+	  host = "localhost";
         };
         databases."freshrss" = {
           enable = true;
diff --git a/services/mysql.nix b/services/mysql.nix
index 83a5033..06edfcb 100644
--- a/services/mysql.nix
+++ b/services/mysql.nix
@@ -23,10 +23,10 @@ let
       (
         ''
           -- Clauses for user ${name}
-          ALTER USER IF EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; 
-          CREATE USER IF NOT EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}';  
+          ALTER USER IF EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; 
+          CREATE USER IF NOT EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}';  
         ''
-        + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'name'@'%'") (create_users_ensure name))
+        + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (create_users_ensure name))
       )
     else
       " -- Ommitted user ${name}";
@@ -84,6 +84,10 @@ in
               allowedRanges = mkOption {
                 type = types.listOf types.str;
               };
+	      host = mkOption {
+		type = types.str; 
+		default = "%"; 
+	      };
             };
           }
         );
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index d98a0b3..720040d 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -67,10 +67,12 @@ in
     services.uptime-kuma = {
       enable = true;
       settings = {
-        UPTIME_KUMA_PORT = "3111";
-        UPTIME_KUMA_HOST = "127.0.0.1";
-        UPTIME_KUMA_DB_TYPE = "sqlite";
-        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
+        UPTIME_KUMA_PORT        = "3111";
+        UPTIME_KUMA_HOST        = "127.0.0.1";
+        UPTIME_KUMA_DB_TYPE     = "sqlite";
+        #UPTIME_KUMA_DB_SOCKET   = "/run/mysqld/mysqld.sock";
+	#UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User;
+	#UPTIME_KUMA_DB_NAME     = "uptimekuma"; 
       };
     };
   });
diff --git a/users/wilkuu-server.nix b/users/wilkuu-server.nix
index d53fc50..b982ddf 100644
--- a/users/wilkuu-server.nix
+++ b/users/wilkuu-server.nix
@@ -6,10 +6,9 @@
 {
   imports = [ ./user-common.nix ];
   programs.zsh.enable = true;
-  programs.adb.enable = true;
   users.users.wilkuu = {
     shell = pkgs.zsh;
-    openssh.authorizedKeys.keyFiles = [ ../certs/wilkuu_rsa.pub ];
+    openssh.authorizedKeys.keyFiles = [ ../certs/wilkuu_rsa.pub ../certs/pi_ed25519.pub];
     isNormalUser = true;
     initialPassword = "PleazeChangeThis123";
     extraGroups = [
diff --git a/users/wilkuu.nix b/users/wilkuu.nix
index 8804ebb..cada172 100644
--- a/users/wilkuu.nix
+++ b/users/wilkuu.nix
@@ -5,7 +5,6 @@
 {
   imports = [ ./user-common.nix ];
   programs.zsh.enable = true;
-  programs.adb.enable = true;
   users.users.wilkuu = {
     shell = pkgs.zsh;
     isNormalUser = true;