uuuuh

12 files changed, 185 insertions, 50 deletions

diff --git a/flake.lock b/flake.lock
index b81dcbc..86809a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -145,11 +145,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779969295,
-        "narHash": "sha256-HwIJ3tOcwSMiV75L7KqJXciXR9UfT+d7rwOZMX7cTnA=",
+        "lastModified": 1782749631,
+        "narHash": "sha256-slFTUgDy0KTPA4LBAmC/9SngDq8GCPdX+ZR0yQHHN1E=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "61e2c9659324181e0f0ed911958c536333b1d4f6",
+        "rev": "5d72a29fc36ac21adae6ae35568fe5ee6700850f",
         "type": "github"
       },
       "original": {
@@ -160,11 +160,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
         "type": "github"
       },
       "original": {
@@ -191,16 +191,32 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "lastModified": 1782535326,
+        "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1782535326,
+        "narHash": "sha256-ZeRxu4yn6shd3SNF5ZUQb4r7BaVo1zBKMjRhfoNSBmw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "714a5f8c4ead6b31148d829288440ed033ccc041",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -214,7 +230,7 @@
         "nixpkgs-stable": "nixpkgs-stable",
         "sops-nix": "sops-nix",
         "stalwart-nix": "stalwart-nix",
-        "treefmt-nix": "treefmt-nix"
+        "treefmt-nix": "treefmt-nix_2"
       }
     },
     "rust-analyzer-src": {
@@ -241,11 +257,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1782165805,
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
         "type": "github"
       },
       "original": {
@@ -256,19 +272,15 @@
     },
     "stalwart-nix": {
       "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": [
-          "treefmt-nix"
-        ]
+        "nixpkgs": "nixpkgs_2",
+        "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1780211733,
-        "narHash": "sha256-9keQVrQN6ZhODsyITo25sPMfbWlmBYfLQ59MyiX8Y38=",
+        "lastModified": 1782750101,
+        "narHash": "sha256-mpLDFwjW0XedqONTlBJ5AAwjgKF8CusVkNF1i+BUgWw=",
         "owner": "Wilkuu-2",
         "repo": "stalwart-nix",
-        "rev": "3752aa11c22073b00507b67e1c14ba17e7ed3629",
+        "rev": "1fa32a16578553816383079896453a711298ae1e",
         "type": "github"
       },
       "original": {
@@ -280,15 +292,36 @@
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
+          "stalwart-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index bf012fc..430dc96 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,14 +3,15 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
 
     stalwart-nix = {
       # local testing
       # url = "path:/store2/code/stalwart-nix";
       url = "github:Wilkuu-2/stalwart-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.treefmt-nix.follows = "treefmt-nix";
+      # Letting stalwart-nix using it's own nixpkgs prevents unnecessary rebuilds at the cost of some disk space. 
+      # inputs.nixpkgs.follows = "nixpkgs";
+      # inputs.treefmt-nix.follows = "treefmt-nix";
     };
 
     sops-nix = {
diff --git a/home-modules/apps/desktop/default.nix b/home-modules/apps/desktop/default.nix
index 11a3152..614e627 100644
--- a/home-modules/apps/desktop/default.nix
+++ b/home-modules/apps/desktop/default.nix
@@ -88,7 +88,8 @@ in
       })
       (lib.mkIf cfg.browser.enable {
         home.packages = with pkgs; [
-          librewolf
+          # librewolf
+          firefox
         ];
       })
       (lib.mkIf cfg.work.enable {
diff --git a/hosts/omega-relay/certs.nix b/hosts/omega-relay/certs.nix
new file mode 100644
index 0000000..affa18e
--- /dev/null
+++ b/hosts/omega-relay/certs.nix
@@ -0,0 +1,18 @@
+{pkgs, config, lib, ...}: 
+  let 
+    names = [
+      "moni.wilkuu.xyz"
+      "matrix.wilkuu.xyz"
+      "rss.wilkuu.xyz" 
+      "bulwark.wilkuu.xyz"
+      "uptime.wilkuu.xyz"
+      "bitwarden.wilkuu.xyz"
+      "wilkuu.xyz"
+    ];
+    in
+{
+  services.nginx.virtualHosts = lib.genAttrs names (name: {
+    enableACME = lib.mkForce false; 
+    useACMEHost = "wilkuu.xyz";
+  }); 
+} 
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 27cbf13..181add4 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -10,6 +10,7 @@
     ./disko.nix
     ./vm.nix
     ./hardware-configuration.nix
+    ./certs.nix
     ../../services/mysql.nix
     ../../services/vaultwarden.nix
     ../../services/uptimekuma.nix
@@ -53,7 +54,7 @@
       prometheus.enableExporters = true;
       desecDyn = {
         enable = true;
-        domains."wilkuu.dedyn.io" = {
+        domains."wilkuu.xyz" = {
           doWildcard = true;
           enableDDNS = true;
           enableACME = true;
@@ -174,18 +175,10 @@
           tryFiles = "$uri $uri/ =404";
         };
       };
-      virtualHosts."wilkuu.dedyn.io" = {
-        forceSSL = true;
-        useACMEHost = "wilkuu.dedyn.io";
-        root = "/srv/www/wilkuu.dedyn.io/";
-        locations."/" = {
-          index = "index.html";
-          tryFiles = "$uri $uri/ =404";
-        };
-      };
       virtualHosts."moni.wilkuu.xyz" = {
         forceSSL = true;
-        enableACME = true;
+        enableACME = false;
+        useACMEHost = "wilkuu.xyz";  
         locations."/" = {
           proxyPass = "http://192.168.88.5:3132";
           recommendedProxySettings = true;
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index c276831..4bbc77a 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -79,10 +79,10 @@ in
             ];
             presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
             publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk=";
-            # endpoint       = "45.138.54.155:16556";
-            endpoint = "wilkuu.duckdns.org:16556";
+            endpoint       = "45.138.54.155:16556";
+            # endpoint = "wilkuu.duckdns.org:16556";
             name = "wg-home-chronosphere";
-
+            persistentKeepalive = 5;
           }
         ];
       };
diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix
index f4a135c..50d5542 100644
--- a/hosts/tacitus/default.nix
+++ b/hosts/tacitus/default.nix
@@ -64,4 +64,61 @@
       PermitRootLogin = "no";
     };
   };
+  users.groups.mikrotik-exporter = { };
+  users.users.mikrotik-exporter = {
+    isSystemUser = true;
+    group = "mikrotik-exporter";
+  };
+
+  # TODO: "Make each device hold it's own password."
+  sops.secrets."prometheus/mikrotik/username" = {
+    owner = "mikrotik-exporter";
+    sopsFile = ../../secrets/tacitus/prometheus.yaml;
+  };
+  sops.secrets."prometheus/mikrotik/password" = {
+    owner = "mikrotik-exporter";
+    sopsFile = ../../secrets/tacitus/prometheus.yaml;
+  };
+
+  sops.templates."prometheus-mikrotik-config" = {
+    owner = "mikrotik-exporter";
+    content = lib.generators.toYAML {} {
+      devices = [
+        {
+          name = "chronosphere";
+          address = "192.168.88.1";
+          user = config.sops.placeholder."prometheus/mikrotik/username";
+          password = config.sops.placeholder."prometheus/mikrotik/password";
+        }
+        {
+          name = "geneticmutator";
+          address = "192.168.88.2";
+          user = config.sops.placeholder."prometheus/mikrotik/username";
+          password = config.sops.placeholder."prometheus/mikrotik/password";
+        }
+
+      ];
+      features = {
+        dhcp = true;
+        dhcpv6 = true; 
+        optics = true;
+        health = true;
+        poe = true;
+        wlansta = true;
+        wlanif = true;
+        monitor=true;
+        routes = true; 
+        firware = true; 
+        netwatch = true;
+        conntrack = true;
+      };
+    };
+  };
+
+  services.prometheus.exporters.mikrotik = {
+    enable = true;
+    group = "mikrotik-exporter";
+    user = "mikrotik-exporter";
+    configFile = config.sops.templates.prometheus-mikrotik-config.path;
+  };
 }
diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index d29e73f..df48a9b 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -6,7 +6,7 @@ let
     25
     80
     443
-    config.services.grafana.port
+    config.services.grafana.settings.server.http_port
     config.services.prometheus.port
   ]
   ++ lib.mapAttrsToList (_: opt: opt.port) (
diff --git a/modules/prometheus.nix b/modules/prometheus.nix
index 22db413..63b761f 100644
--- a/modules/prometheus.nix
+++ b/modules/prometheus.nix
@@ -114,7 +114,7 @@ in
               job_name = "mikrotik";
               static_configs =
                 let
-                  port = toString config.services.prometheus.exporters.fail2ban.port;
+                  port = toString config.services.prometheus.exporters.mikrotik.port;
                 in
                 [
                   { targets = [ "localhost:${port}" ]; }
diff --git a/secrets/omega-relay/desec.yaml b/secrets/omega-relay/desec.yaml
index 2d409c1..5fab9cb 100644
--- a/secrets/omega-relay/desec.yaml
+++ b/secrets/omega-relay/desec.yaml
@@ -1,5 +1,6 @@
 desec:
-    token: ENC[AES256_GCM,data:NM3nh8FNd0Xy0Iw4s8N0xdKR7jOIlnnw6S2oDg==,iv:ETgIEHoV4fboFZDALT3jlxFppscaurgpLz9LPRI+xXc=,tag:XAzBbuOjR0p24/8Vutwsfg==,type:str]
+    old_token: ENC[AES256_GCM,data:cqLMWgqrvEn8iZurjL3hEdcpAc3ScHJoYLLXCg==,iv:vqJqqEpGWeW0Be6A09v45UD0LzsrW3Doew7P4VGcMtM=,tag:3zSHdVSmPCl+UtBVpujXXQ==,type:str]
+    token: ENC[AES256_GCM,data:BzqGC7pd80cWxnqR2E103lTVbQeExx9Stja8Gw==,iv:VO4XvkxMGLaqph890TVmXnRLgUxYJDr+O9xVahOKOPg=,tag:z0hzKFfHPByp1mplOSE/+A==,type:str]
 sops:
     age:
         - enc: |
@@ -38,7 +39,7 @@ sops:
             Wfcz+DURBsqrPGkUhdss8kwzD+ngrjBvLr9e4u/ew94rFiSzTCNpPA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
-    lastmodified: "2026-06-07T19:57:02Z"
-    mac: ENC[AES256_GCM,data:8n3YQFFeg7BMuxSiyEMdXN7jMVwT04sbpswfjfNLgpb6/JaAwLwLyfqnJwDqn9bdU2QpeXtpWCauSbzAxZ6n6MrkWDc3ZMXdGn/YqrJW0iBShAu0snfcMNrG0/av3JoD0Xf5A6JhLnhs8mxw+gCT36kItJxdEKtDV3jESTDxMW4=,iv:iEHvyqFXnrHPrnlMUMKnTlnLEPK8Sms/3Cxbj/Pka0k=,tag:g8lMSdCyJPnq9IMxVw3KuQ==,type:str]
+    lastmodified: "2026-06-22T14:08:32Z"
+    mac: ENC[AES256_GCM,data:+ag6vA/5lHOrLtdcAilIOpplUT4VzlUVm8kvnosb8sFd/m6UK4h4fGM0ivKEsb1Ot/I596Qxy/4wh2vNZgrUBXZFAQwwsmIWPLHT5vQYttiz6Yx1pq/tnIVWfK/25PASdSNBrAAI2sr03ikW4/ywKNbm1/uMqLW3X9LoHkH7Skk=,iv:ysxIT3b2PcUH6SSas6ieJ7pQs/0kar0IQ58eAQewOjc=,tag:JVacMGMCppLGvkQ8SVOC9g==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1
diff --git a/secrets/tacitus/prometheus.yaml b/secrets/tacitus/prometheus.yaml
new file mode 100644
index 0000000..562875a
--- /dev/null
+++ b/secrets/tacitus/prometheus.yaml
@@ -0,0 +1,31 @@
+prometheus:
+    stalwart-pass: ENC[AES256_GCM,data:hZJXAnjoUzMyMM9KUcg8pFGJQO3VT4Unz5c51Osu47Q=,iv:HacjhSg+c6Eia7X3k6JtKbyiUFGB0Leea1wamjGBEFM=,tag:QIz/uncRORzojlEehnxyJQ==,type:str]
+    mikrotik:
+        username: ENC[AES256_GCM,data:bC7SChQg6xi1Sw==,iv:4hMXhV1le5Jxvmatc6Rw0RZTj6/HNKtJ1E8CUExpY1Y=,tag:LImUR9ApbWJqd0DN67L0Xg==,type:str]
+        password: ENC[AES256_GCM,data:FI0DZAEwK/PU+FqGvn44GofMCeMhiPyt2gNHr0HFOoJt,iv:QrCs2hK+rxi9E1DoZQPmTDnXBGoZnlxRZXt0a8rGguk=,tag:JioHPEX/MIa/gkSmKD3RmQ==,type:str]
+grafana:
+    secret: ENC[AES256_GCM,data:FVMjDWPusLf0P1oqnHFZBIl39dwY+rXgQHl0kaeyQwFnI2t2SAUuDy6mbWPXE4tbZj6EJ2NeenvAXCfAb6KbrQ==,iv:+D5MBCrLmsgV54ptB8xM+1GR87HgDwnSBZV8U0EDQDU=,tag:g37+3XKf0djIaEGxe/jdeA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5U09oaUlseWJyUkM1WWcy
+            a1Z5c0I0YXVuejdoKy9GaHlUMnZ5eTVaVGxvCmo0TjZ2d2RSMkRCZzU5bFgrVEJR
+            UjI1OEtsRUpXUGtwVlh5RzArZy8yMlEKLS0tIGp4Q1V4N3pMMnljYkJ4WjdvODdX
+            azV1a2lFUW1Ic2VacktoZkdjK3M5Y1UKfSob+dIKNmb4XjZt4wyEDhq6/AC/1X2m
+            +LUun1SFiLOQzlAzM9IczrobHe+ThlffObl8ESq6pKwpBC2fP2QIPg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdVFkbHdtVDRnN2o2d09B
+            WExJNGhMTk9zVEFURW5MckF3V01lMTJ6azNBCldDektkWms5aHU1TTV0RDZhUjZG
+            NHhpWUJHRG9nV29rV1FKZFRuME1lMHMKLS0tIHhwQ0d5YlhrdW5mUkxGT0NjS3hR
+            VGdYeFc2QWNic2RuQ05KRnhkUmZUYlEKXUA4WE/+5gKZ774P+n2phQfnulXBPCek
+            ZrGi8v9dUJAJpv0mTzksNCotiMrMi9R3RS1J1k24a97FTyNNG10WOA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht
+    lastmodified: "2026-06-22T14:52:00Z"
+    mac: ENC[AES256_GCM,data:p/uvg7wUDHhiXHgxiN0e/2F4urxqO+gI40Vy8AMu78GhkSheZymokmQMBO5QsNyP3kjnbOQfQoqaBaMOBIEzU+FQagbtAnZvrVCmzwZ6BcPVjC0BLBCQFtpbXigXbAuGJArez2LuJM76u3YreOdp/zxTvQVN4t6iFI+LmXjRP6U=,iv:53BCVeGW5zMPpGv+diufmhzbF6b+89RcWK419z2mPPM=,tag:9ecyz00IaPccGP6XN0X/bQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
diff --git a/services/ddns.nix b/services/ddns.nix
index 2a04a26..014b122 100644
--- a/services/ddns.nix
+++ b/services/ddns.nix
@@ -48,7 +48,7 @@ in
             (
               lib.optional dcfg.doWildcard ({
                 provider = "desec";
-                domains = "*.${name}";
+                domain = "*.${name}";
                 token = config.sops.placeholder.${cfg.tokenSopsName};
                 ip_version = "ipv4";
               })