fix: give priorities to nix option in hm standalone vs as module

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779213149,
-        "narHash": "sha256-Cf+p/T4Z3n9Sw0TiR3kQaIwQI+/hfvLJcoTzeq6yS3E=",
+        "lastModified": 1785496534,
+        "narHash": "sha256-EASdusMYLuPhOCrE3LmsAGOvGhX3vnKBLxFvj9lI8tU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bd868f769a69d3b6091a1da68a75cb83a181033c",
+        "rev": "e8827fbbb12015a8dd9f66285aec79d655bcb9f6",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1785454630,
+        "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746",
         "type": "github"
       },
       "original": {
@@ -57,20 +57,34 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1784555310,
+        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
+        "nixpkgs": "nixpkgs_2",
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1779296766,
-        "narHash": "sha256-kbgeL14JdJL2prN7khpZtYT88ibaSUNDSUJkaHlz4xQ=",
+        "lastModified": 1785364321,
+        "narHash": "sha256-BLuHl+nZKb+FDq3GAM6L+UBEiyVepXANA31fT1F56pw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "c7e82d37c2ed3cbddf54e36b8a13b3518ff1dc2f",
+        "rev": "acd69cc15d57004e8cb4495034320263a3d362ea",
         "type": "github"
       },
       "original": {
@@ -94,11 +108,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {
@@ -109,15 +123,16 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }

flake.nix

@@ -11,10 +11,7 @@
       url = "github:mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixvim = {
-      url = "github:nix-community/nixvim";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    nixvim.url = "github:nix-community/nixvim";
   };
 
   outputs =

home-manager/base/default.nix

@@ -1,7 +1,9 @@
 {
   config,
   osConfig ? null,
+  inputs,
   lib,
+  pkgs,
   ...
 }:
 let
@@ -20,6 +22,24 @@ in
 
   kekleo = lib.mkIf (osConfig != null) (mkDefaultSharedAttrs config.kekleo (osConfig.kekleo or { }));
 
+  nix =
+    let
+      flakeInputs = lib.filterAttrs (_: lib.isType "flake") inputs;
+    in
+    lib.mkDefault {
+      package = pkgs.nix;
+
+      settings = {
+        experimental-features = osConfig.nix.settings.experimental-features or "nix-command flakes";
+        # Opinionated: disable global registry
+        flake-registry = "";
+      };
+
+      # Opinionated: make flake registry and nix path match flake inputs
+      registry = lib.mapAttrs (_: flake: { inherit flake; }) flakeInputs;
+      nixPath = lib.mapAttrsToList (n: _: "${n}=flake:${n}") flakeInputs;
+    };
+
   home.sessionVariables = {
     XDG_CACHE_HOME = "$HOME/.cache";
     XDG_CONFIG_HOME = "$HOME/.config";

home-manager/base/git.nix

@@ -1,12 +1,9 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
 {
   home.packages = with pkgs; [
-    git-credential-oauth
     git-crypt
   ];
 
@@ -15,10 +12,6 @@
     settings = {
       user.name = "Leonhard Kost";
       user.email = "leonhard.kost@gmail.com";
-      credential.helper = [
-        "cache --timeout 21600"
-        ("oauth" + lib.optionalString (!config.kekleo.graphical) " -device")
-      ];
     };
   };
 }

home-manager/base/nixvim/plugins/default.nix

@@ -2,7 +2,7 @@
 {
   imports = [
     ./cmp.nix
-    ./dap.nix
+    #./dap.nix
     ./lsp.nix
     ./fmt.nix
     ./treesitter.nix

nixos/base/default.nix

@@ -16,7 +16,7 @@
     let
       flakeInputs = lib.filterAttrs (_: lib.isType "flake") inputs;
     in
-    {
+    lib.mkForce {
       settings = {
         experimental-features = "nix-command flakes";
         # Opinionated: disable global registry

nixos/server/default.nix

@@ -7,6 +7,7 @@
     ./hardware-configuration.nix
     ./secrets
     ./dyndns
+    ./gitea.nix
     ./vaultwarden.nix
   ];
 
@@ -47,7 +48,25 @@
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
       PermitRootLogin = "no";
-      AllowUsers = [ "leonhard" ];
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@${config.kekleo.domain}";
+    defaults.webroot = "/var/lib/acme/acme-challenge/";
+    certs.${config.kekleo.domain} = {
+      group = config.services.nginx.group;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${config.kekleo.domain} = {
+      forceSSL = true;
+      useACMEHost = config.kekleo.domain;
+      locations."/.well-known/".root = config.security.acme.defaults.webroot;
     };
   };
 }

nixos/server/gitea.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  ...
+}:
+let
+  domain = config.kekleo.domain;
+  gitDomain = "git.${domain}";
+in
+{
+  services.gitea = {
+    enable = true;
+    settings.server.ROOT_URL = "https://${gitDomain}";
+    settings.server.SSH_PORT = builtins.elemAt config.services.openssh.ports 0;
+    settings.service.DISABLE_REGISTRATION = true;
+    settings.log.LEVEL = "Critical";
+  };
+
+  security.acme.certs.${domain}.extraDomainNames = [
+    gitDomain
+  ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${gitDomain} = {
+      forceSSL = true;
+      useACMEHost = config.kekleo.domain;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

nixos/server/vaultwarden.nix

@@ -20,17 +20,16 @@ in
     };
   };
 
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "admin@${domain}";
-  };
+  security.acme.certs.${domain}.extraDomainNames = [
+    vaultDomain
+  ];
 
   services.nginx = {
     enable = true;
 
     virtualHosts.${vaultDomain} = {
       forceSSL = true;
-      enableACME = true;
+      useACMEHost = config.kekleo.domain;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
         proxyWebsockets = true;