feat: Lots of changes

13 files changed, 408 insertions, 83 deletions

diff --git a/computers/nixnode.nix b/computers/nixnode.nix
index b3d4745..ad19086 100644
--- a/computers/nixnode.nix
+++ b/computers/nixnode.nix
@@ -9,10 +9,8 @@
         [
             inputs.STK.nixosModules.default
             inputs.sops.nixosModules.sops
-            (builtins.fetchTarball {
-                url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-25.11/nixos-mailserver-nixos-25.11.tar.gz";
-                sha256 = "0f1mq2gdmx9wd0k89f6w61sbfzpd1wwz857l2xvyp1x0msmd2z20";
-            })
+            inputs.nixos-mailserver.nixosModules.default
+            inputs.neodrive-website.nixosModules.default
         ];
 
     teh-nix.nix.enable = true;
@@ -63,6 +61,10 @@
             mode = "440";
         };
         "mail/boss" = { };
+        "nginx/dashboard-htpasswd" = {
+            owner = "nginx";
+            mode = "400";
+        };
     };
 
     networking.firewall = {
@@ -121,6 +123,15 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
 
     services.nginx = {
         enable = true;
+        # Log the vhost at the start of each line ("vcombined") so goaccess
+        # can split traffic by subdomain
+        commonHttpConfig = ''
+log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] '
+                     '"$request" $status $body_bytes_sent '
+                     '"$http_referer" "$http_user_agent"';
+access_log /var/log/nginx/access.log vcombined;
+'';
+        # virtualHosts.${config.mailserver.fqdn}.enableACME = true;
         virtualHosts = {
             "tehbox.org" = {
                 root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www";
@@ -133,11 +144,17 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
                 enableACME = true;
                 forceSSL = true;
             };
-            "stk.lug.ac" = {
-                root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www";
+            # "stk.lug.ac" = {
+            #     root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www";
+            #     enableACME = true;
+            #     forceSSL = true;
+            #     locations."/".extraConfig = "autoindex on;\n";
+            # };
+            "dashboard.tehbox.org" = {
+                root = "/var/lib/goaccess/html";
+                basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path;
                 enableACME = true;
                 forceSSL = true;
-                locations."/".extraConfig = "autoindex on;\n";
             };
             "_" = {
                 globalRedirect = "tehbox.org";
@@ -145,6 +162,34 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
         };
     };
 
+    # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes.
+    # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations.
+    systemd.services.goaccess-report = {
+        description = "Build goaccess report for dashboard.tehbox.org";
+        serviceConfig = {
+            Type = "oneshot";
+            User = "nginx";
+            Group = "nginx";
+            StateDirectory = [ "goaccess" "goaccess/db" "goaccess/html" ];
+        };
+        script = ''
+${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \
+  --log-format=VCOMBINED \
+  --num-tests=0 \
+  --no-query-string \
+  --persist --restore --db-path=/var/lib/goaccess/db \
+  --html-report-title="tehbox.org traffic" \
+  -o /var/lib/goaccess/html/index.html
+'';
+    };
+    systemd.timers.goaccess-report = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+            OnCalendar = "*:0/10";
+            Persistent = true;
+        };
+    };
+
     teh-nix.services.cgit = {
         enable = true;
         authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys;
@@ -156,6 +201,11 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
         # onlySSL = true;
     };
 
+    services.neodrive-website = {
+            enable = true;
+            domain = "neodrive.tehbox.org";
+    };
+
     services.znc = {
         enable = true;
         mutable = true;
@@ -212,6 +262,8 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
         stateVersion = 3;
         fqdn = "tehbox.org";
         domains = [ "tehbox.org" ];
+        
+        x509.useACMEHost = config.mailserver.fqdn;
 
         loginAccounts = {
             "boss@tehbox.org" = {
@@ -220,7 +272,7 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
             };
         };
         
-        certificateScheme = "acme";
+        # certificateScheme = "acme";
     };
 
     users.users.boss = {
@@ -239,8 +291,9 @@ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j
         mtr
         sysstat
         git
+        goaccess
         inputs.self.packages.x86_64-linux.teh-website
-        inputs.self.packages.x86_64-linux.stk-installers
+        # inputs.self.packages.x86_64-linux.stk-installers
     ];
     
 
diff --git a/computers/nixy.nix b/computers/nixy.nix
index 01bf9ec..a576c8b 100644
--- a/computers/nixy.nix
+++ b/computers/nixy.nix
@@ -11,6 +11,40 @@
 	    ];
 
     teh-nix.nix.enable = true;
+    programs.nix-ld.enable = true;
+    programs.nix-ld.libraries = with pkgs; [
+        # stdenv.cc.cc
+        glib
+        glibc
+        nspr
+        nss
+        dbus
+        atk
+        cups
+        cairo
+        gtk3
+        alsa-lib
+        expat
+        fontconfig
+        freetype
+        libgbm
+        libnotify
+        libsecret
+        libxkbcommon
+        mesa
+        pango
+        libX11
+        libXcomposite
+        libXcursor
+        libXdamage
+        libXext
+        libXfixes
+        libXi
+        libXrandr
+        libXrender
+        libXtst
+        libxcb
+    ];
     
     # Use the systemd-boot EFI boot loader.
     boot = {
@@ -46,6 +80,7 @@
 
     networking.firewall = {
         allowedUDPPorts = [ 51820 ];
+        allowedTCPPorts = [ 8081 ];
     };
     networking.networkmanager.ensureProfiles = {
         profiles = {
diff --git a/flake.nix b/flake.nix
index 657d8bc..42a5067 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,49 +54,95 @@
             url = "github:Mic92/sops-nix";
             inputs.nixpkgs.follows = "nixpkgs";
         };
-    #     hytale-launcher = {
-    #         url = "github:TNAZEP/HytaleLauncherFlake";
-    #         inputs.nixpkgs.follows = "nixpkgs";
-    #     };
+        deploy-rs = {
+            url = "github:serokell/deploy-rs";
+            inputs.nixpkgs.follows = "nixpkgs";
+        };
+        nixos-mailserver = {
+            url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-26.05";
+            inputs.nixpkgs.follows = "nixpkgs";
+        };
+        claude-desktop = {
+            url = "github:aaddrick/claude-desktop-debian";
+            inputs.nixpkgs.follows = "nixpkgs";
+        };
+        neodrive-website = {
+            url = "github:BossCode45/neodrive-website";
+            inputs.nixpkgs.follows = "nixpkgs";
+        };
+            
+        #     hytale-launcher = {
+        #         url = "github:TNAZEP/HytaleLauncherFlake";
+        #         inputs.nixpkgs.follows = "nixpkgs";
+        #     };
     };
 
-    outputs = inputs@{self, nixpkgs, ... }: {
-        nixosConfigurations = {
-            nixy = nixpkgs.lib.nixosSystem {
-                system = "x86_64-linux";
-                specialArgs = {inherit inputs;};
-                modules = [
-                    ./my-pkgs
-                    ./modules
-                    
-                    ./hardware-setups/tuf.nix
-                    ./computers/nixy.nix
-                    
-                    inputs.home-manager.nixosModules.home-manager
-                    {
-                        home-manager.useGlobalPkgs = true;
-                        home-manager.useUserPackages = true;
+    outputs = inputs@{self, nixpkgs, ... }: let
+        system = "x86_64-linux";
+        pkgs = import nixpkgs { inherit system; };
+        deployPkgs = import nixpkgs {
+            inherit system;
+            overlays = [
+                inputs.deploy-rs.overlays.default # or deploy-rs.overlays.default
+                (self: super: { deploy-rs = { inherit (pkgs) deploy-rs; lib = super.deploy-rs.lib; }; })
+            ];
+        };
+    in
+      {
+          nixosConfigurations = {
+              nixy = nixpkgs.lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs = {inherit inputs;};
+                  modules = [
+                      ./my-pkgs
+                      ./modules
+                      
+                      ./hardware-setups/tuf.nix
+                      ./computers/nixy.nix
 
-                        home-manager.users.boss = import ./home-manager/home.nix;
-                        home-manager.extraSpecialArgs = {inherit inputs;};
-                    }
+                      {
+                          environment.systemPackages = [
+                              deployPkgs.deploy-rs.deploy-rs
+                          ];
+                      }
+                      
+                      inputs.home-manager.nixosModules.home-manager
+                      {
+                          home-manager.useGlobalPkgs = true;
+                          home-manager.useUserPackages = true;
 
-                    inputs.stylix.nixosModules.stylix
-                ];
-            };
-            nixnode = nixpkgs.lib.nixosSystem {
-                system = "x86_64-linux";
-                specialArgs = {inherit inputs;};
-                modules = [
-                    ./modules
-                    ./hardware-setups/linode.nix
-                    ./computers/nixnode.nix
-                ];
-            };
-        };
-        
-        packages.x86_64-linux.teh-website = (nixpkgs.legacyPackages.x86_64-linux.callPackage ./website { });
-        packages.x86_64-linux.stk-installers = (nixpkgs.legacyPackages.x86_64-linux.callPackage ./my-pkgs/stk-installers.nix { });
-    };
+                          home-manager.users.boss = import ./home-manager/home.nix;
+                          home-manager.extraSpecialArgs = {inherit inputs;};
+                      }
+
+                      inputs.stylix.nixosModules.stylix
+                  ];
+              };
+              nixnode = nixpkgs.lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs = {inherit inputs;};
+                  modules = [
+                      ./modules
+                      ./hardware-setups/linode.nix
+                      ./computers/nixnode.nix
+                  ];
+              };
+          };
+
+          deploy.nodes.nixnode = {
+              hostname = "tehbox.org";
+              profiles.system = {
+                  user = "root";
+                  sshUser = "boss";
+                  interactiveSudo = true;
+                  path = deployPkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.nixnode;
+              };
+          };
+
+          checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
+          
+          packages.x86_64-linux.teh-website = (nixpkgs.legacyPackages.x86_64-linux.callPackage ./website { });
+          packages.x86_64-linux.stk-installers = (nixpkgs.legacyPackages.x86_64-linux.callPackage ./my-pkgs/stk-installers.nix { });
+      };
 
 }
diff --git a/home-manager/claude-code-manifest-2.1.282.json b/home-manager/claude-code-manifest-2.1.282.json
new file mode 100644
index 0000000..78dbc55
--- /dev/null
+++ b/home-manager/claude-code-manifest-2.1.282.json
@@ -0,0 +1,84 @@
+{
+  "version": "2.1.282",
+  "manifestSignatureEnforcement": "flag",
+  "commit": "88e628ac87357ab077f78e21f78aee6156f01ab3",
+  "modsCommit": "d78be9481b889e11186ec4578b4f5e9301396e25",
+  "buildDate": "2026-09-24T04:11:54Z",
+  "platforms": {
+    "darwin-arm64": {
+      "binary": "claude",
+      "checksum": "fcfd837103965c64de34a6b9b94370d77a347ea71819715a27d5f0ef01775ea4",
+      "size": 222245312
+    },
+    "darwin-x64": {
+      "binary": "claude",
+      "checksum": "5c34b00b5c0f3862b76011015c334e91904c4593afea7a5451e00746ad7934c1",
+      "size": 230651344
+    },
+    "linux-arm64": {
+      "binary": "claude",
+      "checksum": "6764ffc39e9fed425a493ff61ea28506d1ba83996ce81a48d1177dbb393419c9",
+      "size": 238084088
+    },
+    "linux-x64": {
+      "binary": "claude",
+      "checksum": "3afe8535c0cc33f0e24f7b25dab7a1727b8b592196f8496a8bc302ba2161eed3",
+      "size": 238767288
+    },
+    "linux-arm64-musl": {
+      "binary": "claude",
+      "checksum": "5c3b3c9904f84b59d01c4e7f5c9305a4fc1981b18b26745688c9c1dab9cb25ae",
+      "size": 230438720
+    },
+    "linux-x64-musl": {
+      "binary": "claude",
+      "checksum": "e01fc77a210c54acf69205db13d8d50d11fa6ac62b81b6c6201de8440c293b0d",
+      "size": 232525912
+    },
+    "win32-x64": {
+      "binary": "claude.exe",
+      "checksum": "fc0e3af017705624b9e1bce913f72761864ff994804514da1f5e41380fca4484",
+      "size": 242171040
+    },
+    "win32-arm64": {
+      "binary": "claude.exe",
+      "checksum": "a7f3db85706ca2ca123ea9088e565f10a657a15a0f5d7b9b34283609d857de25",
+      "size": 229716640
+    }
+  },
+  "sdkCompat": {
+    "testedWrapperVersions": [
+      "0.3.243",
+      "0.3.245",
+      "0.3.246",
+      "0.3.247",
+      "0.3.248",
+      "0.3.250",
+      "0.3.251",
+      "0.3.252",
+      "0.3.257",
+      "0.3.258",
+      "0.3.259",
+      "0.3.260",
+      "0.3.261",
+      "0.3.263",
+      "0.3.265",
+      "0.3.266",
+      "0.3.267",
+      "0.3.268",
+      "0.3.269",
+      "0.3.270",
+      "0.3.271",
+      "0.3.272",
+      "0.3.273",
+      "0.3.274",
+      "0.3.275",
+      "0.3.276",
+      "0.3.277",
+      "0.3.278",
+      "0.3.280",
+      "0.3.281"
+    ],
+    "harnessSchema": 1
+  }
+}
diff --git a/home-manager/emacs/default.nix b/home-manager/emacs/default.nix
index 6bb1dc6..a2c2610 100644
--- a/home-manager/emacs/default.nix
+++ b/home-manager/emacs/default.nix
@@ -10,7 +10,8 @@ let
             wrapfig amsmath ulem hyperref capt-of;
     });
     myEmacs = (pkgs.emacsPackagesFor pkgs.emacs30).emacsWithPackages (epkgs: with epkgs; [
-        vterm
+        # vterm
+        ghostel
         treesit-grammars.with-all-grammars
     ]);
 in
diff --git a/home-manager/home.nix b/home-manager/home.nix
index 897a6b1..491e713 100644
--- a/home-manager/home.nix
+++ b/home-manager/home.nix
@@ -1,5 +1,11 @@
 { pkgs, lib, inputs, ... }:
+let
+    claude-code-latest = pkgs.claude-code.override {
+        manifest = lib.importJSON ./claude-code-manifest-2.1.282.json;
+    };
+in
 {
+    
     imports = [
         ./shells/bash.nix
         ./emacs
@@ -55,7 +61,7 @@
         pavucontrol
         unzip zip
         appimage-run
-        lunar-client
+        # lunar-client
         libnotify
         xclip
         (python3.withPackages (ps: with ps; [
@@ -92,6 +98,10 @@
         # inputs.hytale-launcher.packages.${pkgs.system}.default
         #adom
         flatpak
+        deadlock-mod-manager
+        nh
+        claude-code-latest
+        inputs.claude-desktop.packages.${system}.claude-desktop
         # openttd
     ];
     
@@ -116,6 +126,7 @@
     };
 
     services.gpg-agent.enable = true;
+    services.gpg-agent.pinentry.package = pkgs.pinentry-gtk2;
 
     services.dunst = {
         enable = true;
@@ -131,11 +142,11 @@
         enable = true;
 
         # optional Nvidia hardware acceleration
-        package = (
-            pkgs.obs-studio.override {
-                cudaSupport = true;
-            }
-        );
+        # package = (
+        #     pkgs.obs-studio.override {
+        #         cudaSupport = true;
+        #     }
+        # );
 
         plugins = with pkgs.obs-studio-plugins; [
             obs-pipewire-audio-capture
@@ -144,7 +155,16 @@
     };
 
     # services.easyeffects.enable = true;
-    
+
+    services.pass-secret-service.enable = true;
+    # Start with the X session rather than at boot, so it inherits DISPLAY/XAUTHORITY
+    # and gpg can show the GTK pinentry. Otherwise apps get logged out.
+    systemd.user.services.pass-secret-service = {
+        Unit.After = [ "graphical-session.target" ];
+        Unit.PartOf = lib.mkForce [ "graphical-session.target" ];
+        Install.WantedBy = lib.mkForce [ "graphical-session.target" ];
+    };
+
 
     programs.firefox = {
         enable = true;
@@ -170,6 +190,7 @@
         in
           {
               enable = true;
+              spotifyLaunchFlags = "--disable-gpu --disable-software-rasterizer";
               enabledExtensions = with spicePkgs.extensions; [
                   fullAppDisplay
                   powerBar
diff --git a/home-manager/i3/config b/home-manager/i3/config
index 554d7bd..fc0afae 100644
--- a/home-manager/i3/config
+++ b/home-manager/i3/config
@@ -47,7 +47,7 @@ set $left h
 set $right l
 
 ##STARTUP
-#exec_always --no-startup-id "feh --bg-scale ~/Wallpapers/val.png"
+exec_always --no-startup-id "feh --bg-scale ~/Wallpapers/val.png"
 #exec_always --no-startup-id nitrogen --restore
 #exec_always --no-startup-id "picom --backend glx -fD 3 --vsync"
 exec_always --no-startup-id "~/.config/polybar/launch.sh"
@@ -105,7 +105,7 @@ bindsym XF86AudioNext exec --no-startup-id playerctl next
 bindsym XF86AudioPrev exec --no-startup-id playerctl previous
 bindxym XF86AudioStop exec --no-startup-id playerctl stop
 
-bindsym $mod+bracketleft exec --no-startup-id playerctl -p zen-twilight play-pause
+bindsym $mod+bracketleft exec --no-startup-id playerctl -p firefox play-pause
 bindsym $mod+bracketright exec --no-startup-id playerctl -p spotify play-pause
 
 #Emoji picker
diff --git a/home-manager/i3/default.nix b/home-manager/i3/default.nix
index 5fba6e1..0272d79 100644
--- a/home-manager/i3/default.nix
+++ b/home-manager/i3/default.nix
@@ -37,5 +37,6 @@
 		nitrogen
         pamixer
         (pkgs.callPackage ./i3-commands.nix { })
+        (pkgs.callPackage ./rofi-passmenu.nix { })
     ];
 }
diff --git a/home-manager/i3/i3-commands.nix b/home-manager/i3/i3-commands.nix
index 9b8705d..68cf7b6 100644
--- a/home-manager/i3/i3-commands.nix
+++ b/home-manager/i3/i3-commands.nix
@@ -1,16 +1,20 @@
 {
-    stdenv
+    stdenv,
+    lib
 }:
 stdenv.mkDerivation {
     pname = "i3-commands";
     version = "0.0.1";
 
-    srcs = builtins.path { name = "scripts"; path = ./scripts/.; };
+    srcs = lib.cleanSourceWith {
+        src = ./scripts;
+        filter = path: type: baseNameOf path != "rofi-passmenu";
+    };
     
     installPhase = ''
-runHook preInstall
-mkdir -p $out/bin
-install -D -m 755 ./* $out/bin
-runHook postInstall
-'';
+        runHook preInstall
+        mkdir -p $out/bin
+        install -D -m 755 ./* $out/bin
+        runHook postInstall
+    '';
 }
diff --git a/home-manager/i3/rofi-passmenu.nix b/home-manager/i3/rofi-passmenu.nix
new file mode 100644
index 0000000..153ffc3
--- /dev/null
+++ b/home-manager/i3/rofi-passmenu.nix
@@ -0,0 +1,72 @@
+{
+    pkgs
+}:
+
+pkgs.writeShellApplication {
+  name = "rofi-passmenu";
+  
+  runtimeInputs = with pkgs; [
+    pass
+    rofi
+    xclip
+    xdotool
+    gnugrep
+    gawk
+    coreutils
+    libnotify
+  ];
+
+  text = ''
+    #!/usr/bin/env bash
+
+    store_dir="''${PASSWORD_STORE_DIR:-$HOME/.password-store}"
+
+    get_passwords() {
+        echo "[+] Add New Password"
+        if [ -d "$store_dir" ]; then
+            find "$store_dir" -name "*.gpg" | sort | while IFS= read -r file; do
+                pass="''${file#"$store_dir"/}"
+                echo "''${pass%.gpg}"
+            done
+        fi
+    }
+
+    selected=$(get_passwords | rofi -dmenu -i -p "pass")
+    [[ -z "$selected" ]] && exit 0
+
+    if [[ "$selected" == "[+] Add New Password" ]]; then
+        new_path=$(rofi -dmenu -p "Enter path/name for new password:")
+        [[ -z "$new_path" ]] && exit 0
+        
+        choice=$(echo -e "Generate\nManual" | rofi -dmenu -p "Password method:")
+        if [[ "$choice" == "Generate" ]]; then
+            pass generate "$new_path" 20
+            notify-send "Pass" "Generated password for $new_path"
+        elif [[ "$choice" == "Manual" ]]; then
+            new_pass=$(rofi -dmenu -p "Enter password:" -password)
+            [[ -n "$new_pass" ]] && echo "$new_pass" | pass insert -m "$new_path"
+        fi
+        exit 0
+    fi
+
+    action=$(echo -e "1. Type Password\n2. Type Username\n3. Copy Password\n4. Copy Username\n5. Show Password" | rofi -dmenu -i -p "$selected")
+
+    case "$action" in
+        "1. Type Password")
+            pass show "$selected" | head -n 1 | tr -d '\n' | xdotool type --clearmodifiers -fi -
+            ;;
+        "2. Type Username")
+            pass show "$selected" | grep -i "^username:" | sed 's/^[^:]*:[[:space:]]*//' | tr -d '\n' | xdotool type --clearmodifiers -fi -
+            ;;
+        "3. Copy Password")
+            pass show -c "$selected"
+            ;;
+        "4. Copy Username")
+            pass show "$selected" | grep -i "^username:" | sed 's/^[^:]*:[[:space:]]*//' | xclip -selection clipboard
+            ;;
+        "5. Show Password")
+            pass show "$selected" | head -n 1 | rofi -dmenu -p "Password for $selected"
+            ;;
+    esac
+  '';
+}
diff --git a/modules/nix.nix b/modules/nix.nix
index de1281a..64fc4a3 100644
--- a/modules/nix.nix
+++ b/modules/nix.nix
@@ -24,12 +24,18 @@
                 #     "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
                 # ];
             };
-            gc = {
-                automatic = true;
+            optimise.automatic = true;
+        };
+
+        # nh's cleaner replaces nix.gc (the nh module asserts they aren't both on)
+        programs.nh = {
+            enable = true;
+            clean = {
+                enable = true;
                 dates = "weekly";
-                options = "--delete-older-than +7";
+                # --no-direnv keeps nix-direnv's gcroots so dev shells survive
+                extraArgs = "--keep-since 7d --keep 5 --no-direnv";
             };
-            optimise.automatic = true;
         };
     };
 }
diff --git a/my-pkgs/stk-installers.nix b/my-pkgs/stk-installers.nix
index be16e9b..9718626 100644
--- a/my-pkgs/stk-installers.nix
+++ b/my-pkgs/stk-installers.nix
@@ -7,14 +7,14 @@ stdenv.mkDerivation rec {
         releaseHashes = {
             #"installer-aarch64.exe" = "sha256-orLoDvW+fUDucqY4KcC0DQ4JbA2LaG3RQtaBEjtG6HU=";
             #"installer-i686.exe" = "sha256-knC7XF6OeY/dQ2VnyjYm+IlJxU8g6s/S395Nr4HZ6Jk=";
-            "installer-x86_64.exe" = "sha256-oSYOu3PdnaE+w+N/Um8p5JSztmwAwF/XB2ezCkSX2V4=";
-            "linux-arm64.tar.gz" = "sha256-lhtLaRtEVHzcrae6OdrRVhpufnZskLIsot8foYqi5Hc=";
+            # "installer-x86_64.exe" = "sha256-oSYOu3PdnaE+w+N/Um8p5JSztmwAwF/XB2ezCkSX2V4=";
+            # "linux-arm64.tar.gz" = "sha256-lhtLaRtEVHzcrae6OdrRVhpufnZskLIsot8foYqi5Hc=";
             #"linux-armv7.tar.gz" = "sha256-jQYR2wkIu1j7c5xEfzdIa9fnQFU1wNKAVq35NZB/BzA=";
-            "linux-x86.tar.gz" = "sha256-sT57jnRV7Wa4qC8p1/fOTwXfelM66fRckdfQvqMqOOs=";
+            # "linux-x86.tar.gz" = "sha256-sT57jnRV7Wa4qC8p1/fOTwXfelM66fRckdfQvqMqOOs=";
             "linux-x86_64.tar.gz" = "sha256-VwkLbCFj62kfIBBK6XEiBKy7ToNBBZ3uCl/1MV78QBs=";
-            "mac-signed.zip" = "sha256-wmas24pjo/4w9SZS2bdJ9b66Sr655UOC+7k0sAxTswM=";
-            "src.tar.gz" = "sha256-M8+IQeT/QILYC5JIAUKVu76mHRRoPobf8QDjq497J8s=";
-            "win.zip" = "sha256-nffi1n6FYhJ6O7YzAw8b1O53+p5/CuEQiXRzAlr4rNw=";
+            # "mac-signed.zip" = "sha256-wmas24pjo/4w9SZS2bdJ9b66Sr655UOC+7k0sAxTswM=";
+            # "src.tar.gz" = "sha256-M8+IQeT/QILYC5JIAUKVu76mHRRoPobf8QDjq497J8s=";
+            # "win.zip" = "sha256-nffi1n6FYhJ6O7YzAw8b1O53+p5/CuEQiXRzAlr4rNw=";
         };
     in
       lib.attrsets.mapAttrsToList (release: hash: fetchurl {
diff --git a/secrets/general.yaml b/secrets/general.yaml
index cd251d2..7f61fcc 100644
--- a/secrets/general.yaml
+++ b/secrets/general.yaml
@@ -9,10 +9,11 @@ acme:
     linode: ENC[AES256_GCM,data:/iD40XK3SlAkIJ+zTYwXzLCFx+7Apm9lUN77LOj9joqzn7jkKpl3hMjekBlsMl5kumKYg97bkC2/swrEQZtFZQ==,iv:d70Eh3EiWY1uZEXHMxZrxHuLkpjJQ/WtEnhyHTyaYcs=,tag:AAKppdYGrDu1NygZE5pz1Q==,type:str]
 mail:
     boss: ENC[AES256_GCM,data:S/C+LZXa3ONvbd2DlDGUq1BCQbDsKG7kkLs7tWCLzgvmoioLZRmg02vcm0p2mwEMgNkkcvFHiDt4Auzz,iv:sRqFVhKuSQCWB31xWvf43msh5YLUxBahmFatetH0OZU=,tag:/6e2O5mNExQ18j7TBS8yMA==,type:str]
+nginx:
+    dashboard-htpasswd: ENC[AES256_GCM,data:0DDGcO9z0B9x+IHIlbmdom+9k6WVsYczsaNgWfO5GclYO2bO1qrLKSvbSbUn8vDSOm1XEih779kBC0o3BHNapeI=,iv:3D3d0/QnSnDXWo04jCFtVLlO2nHzDmIpyQeYZ9wWczQ=,tag:7fx04qtd0p67RJIsIGU8VQ==,type:str]
 sops:
     age:
-        - recipient: age1p3sw8q030a7zgawu4ccxm6sgsp88349nuxkd4kale0ruy9klypssdh7c9s
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RGYrTko0RFc1b0I4MXVB
             TWs2OFlKN1lVSFpjSHJ5SXJpclg0ek5FeWpjCjliam5WdmhOWlIycHhzU0hIRTlR
@@ -20,8 +21,8 @@ sops:
             MEJEY2RnT1l2YStqbUtoYWNqUEEzdzAKdVEYFyBIYx5cSdg23GS8uFDPpjn3CZSp
             SRnXsAvHrtZUPB2rX3KRlB4gCup/RmyHaQQPj6uJ59WyU5R1ZAfCsQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1g7tzey3t2jmd79kaeukn89lgxg07tpq23w0u30lgq5z37xku0vwqcregzd
-          enc: |
+          recipient: age1p3sw8q030a7zgawu4ccxm6sgsp88349nuxkd4kale0ruy9klypssdh7c9s
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlNjJVd2RYNi85UXRmWWt0
             NkNpbWZ2d1N3eStaelpVeWtEM29qVkdzcnlFCks4S04zMG5VS0ltbXA5WXR0Mklz
@@ -29,7 +30,8 @@ sops:
             RU9OZlIyTzRzSmVUVkhCQWpwUHFEekEKGv24Ilg2BYWTX9wAmXn8mA0E9CZP7xvf
             FOnUh9TQH7evO9n76w/xG9y/vDYJ1i9ljEO7ljGtEtIlGgKRx4xLjA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-28T01:42:06Z"
-    mac: ENC[AES256_GCM,data:QwSEX+OkmZIg/CbviARMIuhIfkhGbmv9xYmiNsve+0JleUYvkDwqhsi/JIzizim6jVC5OksH/cGbE1FSJvly9FGXHD9CKIwHVS/fsogMgVvk/5gnbEryHhtMCwC5B09No6Ur1Bx8VtnFsXcPqDgdZXKGVGVSkzTCJ+C4Pvl03Mc=,iv:cnjjPjs6nE/hHP9KerN3n2/wx9wrbNZ3wLY4PCSZn4A=,tag:dlNrpJUgKa2y0Da4N+Fgjw==,type:str]
+          recipient: age1g7tzey3t2jmd79kaeukn89lgxg07tpq23w0u30lgq5z37xku0vwqcregzd
+    lastmodified: "2026-10-13T22:18:08Z"
+    mac: ENC[AES256_GCM,data:mBP4EF3oH68XWPye0okrLqznhX/ScEKF3MCFwd7WnsPQeDwyDCmYF+XwzudgVrcnShgri6hdsZa75g90J8vXewJGHdeSNTIc/i3VgQyduvWg8d1Aj60k/V2kq7Yvnf8gkA7u9lNLdextZzEcrSzZ9oZNVItAgsRsPsMnbLJzlXw=,iv:8XNGrCMVQp+TFukLkHjbg4hK49411ACy/DZqh7K+K5k=,tag:Czhg08Ody1jd/COtwKo5xA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.3