2022-09-20

38 files changed, 324 insertions, 328 deletions

diff --git a/modules/nixfiles/alacritty.nix b/modules/nixfiles/alacritty.nix
index 728e6ee..bafc0d9 100644
--- a/modules/nixfiles/alacritty.nix
+++ b/modules/nixfiles/alacritty.nix
@@ -20,7 +20,7 @@ in {
           };
           dynamic_padding = false;
           decorations =
-            if (kde.enable || gnome.enable)
+            if kde.enable
             then "full"
             else "none";
         };
diff --git a/modules/nixfiles/alertmanager.nix b/modules/nixfiles/alertmanager.nix
index ee53467..e6564fb 100644
--- a/modules/nixfiles/alertmanager.nix
+++ b/modules/nixfiles/alertmanager.nix
@@ -28,11 +28,7 @@ in {
       upstreams.alertmanager.servers."127.0.0.1:${toString cfg.port}" = {};
       virtualHosts.${cfg.domain}.locations."/" = {
         proxyPass = "http://alertmanager";
-        extraConfig = ''
-          if ($internal != 1) {
-            return 403;
-          }
-        '';
+        extraConfig = nginxInternalOnly;
       };
     };
 
diff --git a/modules/nixfiles/aspell.nix b/modules/nixfiles/aspell.nix
deleted file mode 100644
index f397944..0000000
--- a/modules/nixfiles/aspell.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.nixfiles.modules.aspell;
-in {
-  options.nixfiles.modules.aspell.enable =
-    mkEnableOption "GNU Aspell";
-
-  config = mkIf cfg.enable {
-    hm.home = {
-      file.".aspell.conf".text = ''
-        personal /dev/null
-        repl /dev/null
-      '';
-
-      packages = with pkgs; [(aspellWithDicts (p: with p; [en ru]))];
-    };
-  };
-}
diff --git a/modules/nixfiles/bluetooth.nix b/modules/nixfiles/bluetooth.nix
index 69622a1..a1fd58f 100644
--- a/modules/nixfiles/bluetooth.nix
+++ b/modules/nixfiles/bluetooth.nix
@@ -24,11 +24,6 @@ in {
           UserspaceHID = true;
         };
       };
-
-      systemPackages = with pkgs;
-      with config.nixfiles.modules;
-        optional gnome.enable gnome.gnome-bluetooth
-        ++ optional kde.enable plasma5Packages.bluedevil;
     };
   };
 }
diff --git a/modules/nixfiles/chromium.nix b/modules/nixfiles/chromium.nix
index 0f5a93e..337acc8 100644
--- a/modules/nixfiles/chromium.nix
+++ b/modules/nixfiles/chromium.nix
@@ -11,7 +11,11 @@ in {
 
   config = mkIf cfg.enable {
     hm = {
-      # home.sessionVariables.BROWSER = mkOverride 300 "chromium";
+      home = {
+        # sessionVariables.BROWSER = mkOverride 300 "chromium";
+
+        packages = with pkgs; [profile-cleaner];
+      };
 
       programs.chromium = {
         enable = true;
@@ -21,15 +25,6 @@ in {
         extensions =
           [
             {id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";} # UBlock Origin
-            {id = "clngdbkpkpeebahjckkjfobafhncgmne";} # Stylus
-            {id = "cnojnbdhbhnkbcieeekonklommdnndci";} # Search By Image
-            {id = "doojmbjmlfjjnbmnoijecmcbfeoakpjm";} # NoScript
-            {id = "eimadpbcbfnmbkopoojfekhnkhdbieeh";} # Dark Reader
-            {id = "hlepfoohegkhhmjieoechaddaejaokhf";} # Refined GitHub
-            {id = "jinjaccalgkegednnccohejagnlnfdag";} # Violentmonkey
-            {id = "nibjojkomfdiaoajekhjakgkdhaomnch";} # IPFS Companion
-            {id = "nngceckbapebfimnlniiiahkandclblb";} # Bitwarden
-            {id = "pmcmeagblkinmogikoikkdjiligflglb";} # Privacy Redirect
           ]
           ++ optional config.nixfiles.modules.kde.enable {
             id = "cimiefiiaegbelhefglklhhakcgmhkai"; # KDE Plasma Integration
diff --git a/modules/nixfiles/common/nix/default.nix b/modules/nixfiles/common/nix/default.nix
index 9fc585b..878505c 100644
--- a/modules/nixfiles/common/nix/default.nix
+++ b/modules/nixfiles/common/nix/default.nix
@@ -82,23 +82,43 @@ with lib; {
           '';
         });
 
+        helm = with super;
+          kubernetes-helm-wrapped.override {
+            plugins = with kubernetes-helmPlugins; [helm-secrets];
+          };
+
         alejandra = super.alejandra.overrideAttrs (_: _: {
           patches = [./patches/alejandra-no-ads.patch];
         });
 
-        # https://github.com/NixOS/nixpkgs/pull/190714
-        inherit (pkgsPR "190714" "sha256-T2SXzubuN0q74QmmamPWvZHgxH7YpU8JRU0bg9RLKls=") nheko;
+        # https://github.com/NixOS/nixpkgs/pull/191633
+        inherit
+          (pkgsPR
+            "191633"
+            "sha256-gk0x/hZ/XfLo5PZ4lai4oRhawDUw68LsE2dp5c3FYIA=")
+          soju
+          ;
+
+        # Currently broken in Nixpkgs.
+        inherit
+          (pkgsRev
+            "ee01de29d2f58d56b1be4ae24c24bd91c5380cea"
+            "sha256-R18MixER2iwduNqOlLzXUms0Z7G3emnKZOKyQS52SSA=")
+          gotify-server
+          ;
       }
       // (with super; let
         np = nodePackages;
       in {
         # Normalises package names. This is done purely for aesthetics.
+        css-language-server = np.vscode-css-languageserver-bin;
         dockerfile-language-server = np.dockerfile-language-server-nodejs;
         editorconfig = editorconfig-core-c;
+        html-language-server = np.vscode-html-languageserver-bin;
         inherit (np) bash-language-server;
         inherit (np) vim-language-server;
         inherit (np) yaml-language-server;
-        json-language-server = np.vscode-json-languageserver;
+        json-language-server = np.vscode-json-languageserver-bin;
         k3d = kube3d;
         lua-language-server = sumneko-lua-language-server;
         nix-language-server = rnix-lsp;
diff --git a/modules/nixfiles/common/xdg.nix b/modules/nixfiles/common/xdg.nix
index 60d5286..8ddf1ac 100644
--- a/modules/nixfiles/common/xdg.nix
+++ b/modules/nixfiles/common/xdg.nix
@@ -25,16 +25,14 @@ with lib; {
       in {
         enable = true;
 
-        createDirectories = this.isHeadful;
-
         desktop = tmp;
         documents = "${home}/doc";
         download = tmp;
         music = tmp;
         pictures = tmp;
-        videos = tmp;
-        templates = tmp;
         publicShare = "${home}/share";
+        templates = tmp;
+        videos = tmp;
       };
     }
     (mkIf this.isHeadful {
@@ -59,7 +57,7 @@ with lib; {
               "x-scheme-handler/http"
               "x-scheme-handler/https"
             ];
-            gwenview = [
+            imv = [
               "image/bmp"
               "image/gif"
               "image/jpeg"
diff --git a/modules/nixfiles/curl.nix b/modules/nixfiles/curl.nix
index ac5e938..e7bee31 100644
--- a/modules/nixfiles/curl.nix
+++ b/modules/nixfiles/curl.nix
@@ -11,7 +11,7 @@ in {
     mkEnableOption "Wether to enable cURL.";
 
   config = mkIf cfg.enable {
-    hm.xdg.configFile.".curlrc".text = ''
+    hm.home.file.".curlrc".text = ''
       connect-timeout = 60
       progress-bar
       referer = ";auto"
diff --git a/modules/nixfiles/default.nix b/modules/nixfiles/default.nix
index c85ae77..d59273e 100644
--- a/modules/nixfiles/default.nix
+++ b/modules/nixfiles/default.nix
@@ -4,7 +4,6 @@
     ./alacritty.nix
     ./alertmanager.nix
     ./aria2.nix
-    ./aspell.nix
     ./bat.nix
     ./beets.nix
     ./bluetooth.nix
@@ -22,7 +21,6 @@
     ./fonts.nix
     ./games
     ./git.nix
-    ./gnome.nix
     ./gnupg.nix
     ./gotify.nix
     ./grafana.nix
diff --git a/modules/nixfiles/emacs/default.nix b/modules/nixfiles/emacs/default.nix
index 41b2085..6b73151 100644
--- a/modules/nixfiles/emacs/default.nix
+++ b/modules/nixfiles/emacs/default.nix
@@ -21,7 +21,7 @@ in {
 
     nixfiles.modules = {
       fonts.enable = true;
-      git.enable = true;
+      git.client.enable = true;
       gnupg.enable = true;
       x11.enable = true;
     };
@@ -40,12 +40,25 @@ in {
           # NOTE gopls will require a Go executable, which must be provided by
           # the project's flake.
           extraBins = with pkgs; [
-            (aspellWithDicts (p: with p; [en ru])) # :checkers spell (+aspell)
+            (aspellWithDicts (p: with p; [en ru])) # :checkers (spell +aspell)
+            (python3.withPackages (p:
+              with p; [
+                # :lang python :ui (treemacs +lsp)
+                black # :lang python :editor format
+                isort # :lang python
+                pyflakes # :lang python
+                python-lsp-server # :lang (python +lsp)
+              ]))
+            python3Packages.black
+            python3Packages.isort
+            python3Packages.pyflakes
+            python3Packages.python-lsp-server
             asmfmt # :editor format
             bash-language-server # :lang (sh +lsp)
             clang-tools # :lang (cc +lsp) :editor format
             cmake-format # :lang cc :editor format
             cmigemo # :lang japanese
+            css-language-server # :lang (web +lsp)
             dockerfile-language-server # :tools (docker +lsp)
             editorconfig # :tools editorconfig
             fd # doom!
@@ -62,8 +75,10 @@ in {
             haskellPackages.cabal-fmt # :lang haskell :editor format
             haskellPackages.cabal-install # :lang haskell
             haskellPackages.hoogle # :lang haskell
+            html-language-server # :lang (web +lsp)
             html-tidy # :lang web
             jre # :lang plantuml
+            json-language-server # :lang (json +lsp)
             lua-language-server # :lang (lua +lsp)
             nix-language-server # :lang (nix +lsp)
             nixfmt # :lang nix :editor format
@@ -74,11 +89,9 @@ in {
             pandoc # :lang org markdown latex
             pinentry-emacs # doom!
             pre-commit # :tools magit
-            python3Packages.black # :lang python :editor format
-            python3Packages.isort # :lang python
-            python3Packages.pyflakes # :lang python
             ripgrep # doom!
-            rust-analyzer # :lang rust
+            rust-analyzer # :lang (rust +lsp)
+            rustfmt # :lang rust
             shellcheck # :lang sh
             shfmt # :lang sh :editor format
             sqlite # :lang (org +roam2) :tools lookup
diff --git a/modules/nixfiles/emacs/doom/init.el b/modules/nixfiles/emacs/doom/init.el
index 9da7f4b..98317ec 100644
--- a/modules/nixfiles/emacs/doom/init.el
+++ b/modules/nixfiles/emacs/doom/init.el
@@ -20,7 +20,7 @@
        ophints
        (popup +defaults)
        ;; tabs
-       ;; (treemacs +lsp)
+       (treemacs +lsp)
        ;; unicode
        (vc-gutter +diff-hl +pretty)
        window-select
@@ -90,7 +90,7 @@
        (java +lsp +tree-sitter)
        (javascript +lsp +tree-sitter)
        json
-       (latex +lsp)
+       (latex +lsp +tree-sittter)
        (lua +lsp +tree-sitter)
        markdown
        (nix +lsp)
diff --git a/modules/nixfiles/endlessh-go.nix b/modules/nixfiles/endlessh-go.nix
index b89ffc4..891d484 100644
--- a/modules/nixfiles/endlessh-go.nix
+++ b/modules/nixfiles/endlessh-go.nix
@@ -27,7 +27,7 @@ in {
           listenAddress = this.wireguard.ipv4.address;
           port = 9229;
         };
-        extraOptions = ["-conn_type=tcp4" "-geoip_supplier=ip-api" "-v=1"];
+        extraOptions = ["-geoip_supplier=ip-api" "-v=1"];
       };
 
       networking.firewall.allowedTCPPorts = [port];
diff --git a/modules/nixfiles/firefox/default.nix b/modules/nixfiles/firefox/default.nix
index 6e42d76..6dde7c3 100644
--- a/modules/nixfiles/firefox/default.nix
+++ b/modules/nixfiles/firefox/default.nix
@@ -7,7 +7,7 @@
 with lib; let
   cfg = config.nixfiles.modules.firefox;
 in {
-  options.nixfiles.modules.firefox.enable = mkEnableOption "";
+  options.nixfiles.modules.firefox.enable = mkEnableOption "Firefox";
 
   config = mkIf cfg.enable {
     hm = {
@@ -16,7 +16,7 @@ in {
 
         packages = with pkgs; [
           (writeShellScriptBin "firefox-vanilla" ''
-            ${config.hm.programs.firefox.package}/bin/firefox -p vanilla $@
+            ${config.hm.programs.firefox.package}/bin/firefox -p vanilla "$@"
           '')
           profile-cleaner
         ];
@@ -28,7 +28,6 @@ in {
         package = pkgs.firefox.override {
           cfg = with config.nixfiles.modules; {
             enablePlasmaBrowserIntegration = kde.enable;
-            enableGnomeExtensions = gnome.enable;
           };
         };
 
@@ -39,9 +38,8 @@ in {
             bitwarden
             darkreader
             ipfs-companion
+            libredirect
             noscript
-            privacy-redirect
-            refined-github
             stylus
             ublock-origin
             violentmonkey
diff --git a/modules/nixfiles/firefox/profile.nix b/modules/nixfiles/firefox/profile.nix
index 6735db3..93ade51 100644
--- a/modules/nixfiles/firefox/profile.nix
+++ b/modules/nixfiles/firefox/profile.nix
@@ -474,7 +474,7 @@ in {
     # Toolbar
     #
     "browser.uiCustomization.state" = ''
-      {"placements":{"widget-overflow-fixed-list":["ublock0_raymondhill_net-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","ipfs-firefox-addon_lidel_org-browser-action","addon_darkreader_org-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action"],"nav-bar":["back-button","forward-button","urlbar-container","save-to-pocket-button"],"toolbar-menubar":["menubar-items"],"TabsToolbar":["tabbrowser-tabs","new-tab-button","alltabs-button"],"PersonalToolbar":["personal-bookmarks"]},"seen":["addon_darkreader_org-browser-action","ipfs-firefox-addon_lidel_org-browser-action","plasma-browser-integration_kde_org-browser-action","ublock0_raymondhill_net-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action","_b7f9d2cd-d772-4302-8c3f-eb941af36f76_-browser-action","developer-button","_a4c4eda4-fb84-4a84-b4a1-f7c1cbf2a1ad_-browser-action"],"dirtyAreaCache":["nav-bar","widget-overflow-fixed-list","toolbar-menubar","TabsToolbar","PersonalToolbar"],"currentVersion":17,"newElementCount":7}
+      {"placements":{"widget-overflow-fixed-list":["ublock0_raymondhill_net-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","7esoorv3_alefvanoon_anonaddy_me-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","ipfs-firefox-addon_lidel_org-browser-action","addon_darkreader_org-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action"],"nav-bar":["back-button","forward-button","urlbar-container","save-to-pocket-button"],"toolbar-menubar":["menubar-items"],"TabsToolbar":["tabbrowser-tabs","new-tab-button","alltabs-button"],"PersonalToolbar":["personal-bookmarks"]},"seen":["addon_darkreader_org-browser-action","ipfs-firefox-addon_lidel_org-browser-action","plasma-browser-integration_kde_org-browser-action","ublock0_raymondhill_net-browser-action","_2e5ff8c8-32fe-46d0-9fc8-6b8986621f3c_-browser-action","_446900e4-71c2-419f-a6a7-df9c091e268b_-browser-action","_73a6fe31-595d-460b-a920-fcc0f8843232_-browser-action","_7a7a4a92-a2a0-41d1-9fd7-1e92480d612d_-browser-action","_aecec67f-0d10-4fa7-b7c7-609a2db280cf_-browser-action","_b7f9d2cd-d772-4302-8c3f-eb941af36f76_-browser-action","developer-button","_a4c4eda4-fb84-4a84-b4a1-f7c1cbf2a1ad_-browser-action","7esoorv3_alefvanoon_anonaddy_me-browser-action"],"dirtyAreaCache":["nav-bar","widget-overflow-fixed-list","toolbar-menubar","TabsToolbar","PersonalToolbar"],"currentVersion":17,"newElementCount":8}
     '';
   };
 }
diff --git a/modules/nixfiles/firefox/userContent.css b/modules/nixfiles/firefox/userContent.css
index a6421e7..1dc3add 100644
--- a/modules/nixfiles/firefox/userContent.css
+++ b/modules/nixfiles/firefox/userContent.css
@@ -16,7 +16,7 @@
     }
 }
 
-@-moz-document regexp("https?:\/\/(\.*.)?gitlab(\..*)?\.(com|org).*") {
+@-moz-document regexp("https?:\/\/(.*.)?gitlab(\..*)?\.(com|org).*") {
     code {
         font-family: var(--monospace-font-family) !important;
         font-size: var(--monospace-font-size) !important;
@@ -235,11 +235,14 @@
 }
 
 @-moz-document regexp("https?:\/\/tabs\.ultimate-guitar\.com.*") {
-    #comment,
+    #comments,
     #shots,
     a[rel*="noreferrer"],
     a[target="_blank"],
-    div[class*="SiteWideBanner"] {
+    button,
+    div[class*="SiteWideBanner"],
+    footer,
+    iframe {
         display: none !important;
     }
 }
diff --git a/modules/nixfiles/git.nix b/modules/nixfiles/git.nix
index e3659f4..bccb4b3 100644
--- a/modules/nixfiles/git.nix
+++ b/modules/nixfiles/git.nix
@@ -8,120 +8,223 @@
 with lib; let
   cfg = config.nixfiles.modules.git;
 in {
-  options.nixfiles.modules.git.enable = mkEnableOption "Git";
-
-  config = mkIf cfg.enable {
-    secrets = {
-      glab-cli-config = {
-        file = "${inputs.self}/secrets/glab-cli-config";
-        path = "${config.dirs.config}/glab-cli/config.yml";
-        owner = my.username;
-        inherit (config.my) group;
-      };
-      gh-hosts = {
-        file = "${inputs.self}/secrets/gh-hosts";
-        path = "${config.dirs.config}/gh/hosts.yml";
-        owner = my.username;
-        inherit (config.my) group;
+  options.nixfiles.modules.git = {
+    client.enable = mkEnableOption "Git client";
+    server = {
+      enable = mkEnableOption "Git server";
+
+      domain = mkOption {
+        description = "Domain name sans protocol scheme.";
+        type = with types; nullOr str;
+        default = "git.${config.networking.domain}";
       };
-      hut = {
-        file = "${inputs.self}/secrets/hut";
-        path = "${config.dirs.config}/hut/config";
-        owner = my.username;
-        inherit (config.my) group;
+
+      package = mkOption {
+        description = "Package.";
+        type = types.package;
+        default = pkgs.cgit-pink;
       };
     };
+  };
 
-    hm = {
-      home.packages = with pkgs; [glab hut];
+  config = mkMerge [
+    (mkIf cfg.client.enable {
+      secrets = {
+        glab-cli-config = {
+          file = "${inputs.self}/secrets/glab-cli-config";
+          path = "${config.dirs.config}/glab-cli/config.yml";
+          owner = my.username;
+          inherit (config.my) group;
+        };
+        gh-hosts = {
+          file = "${inputs.self}/secrets/gh-hosts";
+          path = "${config.dirs.config}/gh/hosts.yml";
+          owner = my.username;
+          inherit (config.my) group;
+        };
+        hut = {
+          file = "${inputs.self}/secrets/hut";
+          path = "${config.dirs.config}/hut/config";
+          owner = my.username;
+          inherit (config.my) group;
+        };
+      };
 
-      programs = {
-        git = {
-          enable = true;
+      hm = {
+        home.packages = with pkgs; [glab hut];
 
-          package = pkgs.git.override {
-            sendEmailSupport = true;
-            withSsh = true;
-          };
+        programs = {
+          git = {
+            enable = true;
 
-          userName = my.fullname;
-          userEmail = my.email;
-          signing = {
-            inherit (my.pgp) key;
-            signByDefault = true;
-          };
+            package = pkgs.git.override {
+              doInstallCheck = false;
+              pythonSupport = false;
+              sendEmailSupport = true;
+              withLibsecret = false;
+              withSsh = true;
+            };
+
+            userName = my.fullname;
+            userEmail = my.email;
+            signing = {
+              inherit (my.pgp) key;
+              signByDefault = true;
+            };
 
-          extraConfig =
-            {
-              advice.detachedHead = false;
-              color.ui = true;
-              core.whitespace = "trailing-space";
-              diff = {
-                mnemonicPrefix = true;
-                renames = "copies";
-                submodule = "log";
+            extraConfig =
+              {
+                advice.detachedHead = false;
+                color.ui = true;
+                core.whitespace = "trailing-space";
+                diff = {
+                  mnemonicPrefix = true;
+                  renames = "copies";
+                  submodule = "log";
+                };
+                init.defaultBranch = "master";
+                status.submoduleSummary = true;
+                github.user = my.username;
+                gitlab.user = my.username;
+              }
+              // mapAttrs'
+              (n: v: nameValuePair ''url "git@${v}:"'' {insteadOf = "${n}:";}) {
+                "bitbucket" = "bitbucket.com";
+                "codeberg" = "codeberg.org";
+                "github" = "github.com";
+                "gitlab" = "gitlab.com";
+                "sourcehut" = "git.sr.ht";
               };
-              init.defaultBranch = "master";
-              status.submoduleSummary = true;
-              github.user = my.username;
-              gitlab.user = my.username;
-            }
-            // mapAttrs'
-            (n: v: nameValuePair ''url "git@${v}:"'' {insteadOf = "${n}:";}) {
-              "bitbucket" = "bitbucket.com";
-              "codeberg" = "codeberg.org";
-              "github" = "github.com";
-              "gitlab" = "gitlab.com";
-              "sourcehut" = "git.sr.ht";
+
+            aliases = let
+              git = "${config.hm.programs.git.package}/bin/git";
+              curl = "${pkgs.curl}/bin/curl";
+            in {
+              fuck = "!${git} reset --hard && ${git} clean -fdx";
+              gud = ''commit -m "git gud"'';
+              wtc = "!${curl} -sq whatthecommit.com/index.txt | ${git} commit -F -";
             };
 
-          aliases = let
-            git = "${config.hm.programs.git.package}/bin/git";
-            curl = "${pkgs.curl}/bin/curl";
-          in {
-            fuck = "!${git} reset --hard && ${git} clean -fdx";
-            gud = ''commit -m "git gud"'';
-            wtc = "!${curl} -sq whatthecommit.com/index.txt | ${git} commit -F -";
+            # All helper tools/editor generated files should go here. This must
+            # be kept relatively clean and void of any project-specific residual
+            # files.
+            ignores = [
+              "*~"
+              ".cache/clangd/"
+              ".ccls-cache/"
+              ".dir-locals.el"
+              ".gdb_history"
+              ".netrwhist"
+              ".projectile"
+              "[._]*.s[a-v][a-z]"
+              "[._]*.sw[a-p]"
+              "[._]s[a-rt-v][a-z]"
+              "[._]ss[a-gi-z]"
+              "[._]sw[a-p]"
+              "\#*\#"
+              "compile_commands.json"
+              "cscope.*"
+              "vgcore.*"
+            ];
+          };
+
+          gh = {
+            enable = true;
+            settings.git_protocol = "ssh";
           };
 
-          # All helper tool/editor generated files should go here. This must be
-          # kept relatively clean and void of any tooling/project-specific
-          # residual files.
-          ignores = [
-            "*~"
-            ".ccls-cache/"
-            ".clangd/"
-            ".dir-locals.el"
-            ".gdb_history"
-            ".netrwhist"
-            "[._]*.s[a-v][a-z]"
-            "[._]*.sw[a-p]"
-            "[._]s[a-rt-v][a-z]"
-            "[._]ss[a-gi-z]"
-            "[._]sw[a-p]"
-            "\\#*\\#"
-            "compile_commands.json"
-            "cscope.*"
-            "vgcore.*"
-          ];
+          bash = {
+            shellAliases.gl = "${pkgs.glab}/bin/glab";
+            initExtra = mkAfter "_complete_alias gl __start_glab glab";
+          };
         };
 
-        gh = {
-          enable = true;
-          settings.git_protocol = "ssh";
+        xdg.configFile."glab-cli/aliases.yml".text = generators.toYAML {} {
+          ci = "pipeline ci";
+          co = "mr checkout";
+          li = "ci lint";
         };
+      };
+    })
+    (mkIf cfg.server.enable {
+      nixfiles.modules.nginx = {
+        enable = true;
+        virtualHosts.${cfg.server.domain} = {
+          locations = {
+            "/".extraConfig = let
+              projectList = pkgs.writeText "cgit-project-list" ''
+                nixfiles.git
+              '';
+
+              cgitrc = pkgs.writeText "cgitrc" ''
+                root-title=azahi’s git stuff
+                root-desc=鯛も一人はうまからず
+
+                about-filter=${cfg.server.package}/lib/cgit/filters/about-formatting.sh
+                source-filter=${cfg.server.package}/lib/cgit/filters/syntax-highlighting.py
+                commit-filter=${cfg.server.package}/lib/cgit/filters/commit-links.sh
+
+                enable-blame=1
+                enable-commit-graph=1
+                enable-follow-links=1
+                enable-git-config=1
+                enable-html-serving=1
+                enable-index-links=1
+                enable-index-owner=1
+                enable-log-filecount=1
+                enable-log-linecount=1
+                enable-remote-branches=1
+                enable-subject-links=1
+                enable-tree-linenumbers=1
+
+                remove-suffix=1
+
+                snapshots=tar.gz tar.bz2 zip
+
+                readme=:README
+                readme=:README.md
+                readme=:README.org
+                readme=:README.txt
+                readme=:readme
+                readme=:readme.md
+                readme=:readme.org
+                readme=:readme.txt
 
-        bash = {
-          shellAliases.gl = "${pkgs.glab}/bin/glab";
-          initExtra = mkAfter "_complete_alias gl __start_glab glab";
+                project-list=${projectList}
+                scan-path=${config.services.gitolite.dataDir}/repositories
+              '';
+            in ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              fastcgi_split_path_info ^(/?)(.+)$;
+              fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+              fastcgi_param SCRIPT_FILENAME ${cfg.server.package}/cgit/cgit.cgi;
+              fastcgi_param CGIT_CONFIG ${cgitrc};
+              fastcgi_param PATH_INFO $uri;
+              fastcgi_param QUERY_STRING $args;
+              fastcgi_param HTTP_HOST $server_name;
+            '';
+            "~* ^/(.+.(ico|css|png))$".extraConfig = ''
+              alias ${cfg.server.package}/cgit/$1;
+            '';
+          };
         };
       };
 
-      xdg.configFile."glab-cli/aliases.yml".text = generators.toYAML {} {
-        ci = "pipeline ci";
-        co = "mr checkout";
-        li = "ci lint";
+      services = let
+        user = "git";
+        group = "git";
+      in {
+        gitolite = {
+          enable = true;
+          inherit user group;
+          adminPubkey = my.ssh.key;
+        };
+
+        fcgiwrap = {
+          enable = true;
+          inherit user group;
+        };
       };
-    };
-  };
+    })
+  ];
 }
diff --git a/modules/nixfiles/gnome.nix b/modules/nixfiles/gnome.nix
deleted file mode 100644
index 4646d94..0000000
--- a/modules/nixfiles/gnome.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.nixfiles.modules.gnome;
-in {
-  options.nixfiles.modules.gnome.enable =
-    mkEnableOption "GNOME desktop environment";
-
-  config = mkIf cfg.enable {
-    nixfiles.modules = {
-      gnupg.pinentry = mkForce "gnome";
-      sound.enable = true;
-      x11.enable = true;
-    };
-
-    services = {
-      xserver = {
-        enable = true;
-        desktopManager.gnome.enable = true;
-        displayManager.gdm = {
-          enable = true;
-          wayland = false;
-        };
-      };
-
-      gnome = {
-        core-os-services.enable = true;
-        core-shell.enable = true;
-        core-utilities.enable = false;
-        core-developer-tools.enable = false;
-        games.enable = false;
-
-        chrome-gnome-shell.enable = false;
-        gnome-initial-setup.enable = false;
-        gnome-online-accounts.enable = false;
-        gnome-remote-desktop.enable = false;
-        gnome-settings-daemon.enable = true;
-        gnome-user-share.enable = false;
-        rygel.enable = false;
-        tracker-miners.enable = false;
-        tracker.enable = false;
-      };
-
-      dleyna-renderer.enable = false;
-      dleyna-server.enable = false;
-    };
-
-    environment = {
-      gnome = {
-        excludePackages = with pkgs.gnome; [
-          geary
-          gnome-disk-utility
-          seahorse
-          sushi
-        ];
-      };
-
-      systemPackages = with pkgs; [pinentry-gnome];
-    };
-  };
-}
diff --git a/modules/nixfiles/gnupg.nix b/modules/nixfiles/gnupg.nix
index 67d36d8..c1419e4 100644
--- a/modules/nixfiles/gnupg.nix
+++ b/modules/nixfiles/gnupg.nix
@@ -12,12 +12,7 @@ in {
     pinentry = mkOption {
       description = "Name of a pinentry implementation.";
       type = types.str;
-      default = with config.nixfiles.modules;
-        if kde.enable
-        then "qt"
-        else if gnome.enable
-        then "gnome"
-        else "curses";
+      default = "curses";
     };
   };
 
diff --git a/modules/nixfiles/gotify.nix b/modules/nixfiles/gotify.nix
index 1cfd9a7..8489e93 100644
--- a/modules/nixfiles/gotify.nix
+++ b/modules/nixfiles/gotify.nix
@@ -27,11 +27,7 @@ in {
           virtualHosts.${cfg.domain}.locations."/" = {
             proxyPass = "http://gotify";
             proxyWebsockets = true;
-            extraConfig = ''
-              if ($internal != 1) {
-                return 403;
-              }
-            '';
+            extraConfig = nginxInternalOnly;
           };
         };
         postgresql.enable = true;
diff --git a/modules/nixfiles/grafana.nix b/modules/nixfiles/grafana.nix
index fcc85f8..c29bf75 100644
--- a/modules/nixfiles/grafana.nix
+++ b/modules/nixfiles/grafana.nix
@@ -44,11 +44,7 @@ in {
         virtualHosts.${cfg.domain}.locations."/" = {
           proxyPass = "http://grafana";
           proxyWebsockets = true;
-          extraConfig = ''
-            if ($internal != 1) {
-              return 403;
-            }
-          '';
+          extraConfig = nginxInternalOnly;
         };
       };
       postgresql.enable = true;
diff --git a/modules/nixfiles/ipfs.nix b/modules/nixfiles/ipfs.nix
index 1b1c802..f998d6d 100644
--- a/modules/nixfiles/ipfs.nix
+++ b/modules/nixfiles/ipfs.nix
@@ -159,11 +159,7 @@ in {
             # TODO Redirect "/" to "/webui" but keep other endpoints.
             locations."/" = {
               proxyPass = "http://ipfs_api";
-              extraConfig = ''
-                if ($internal != 1) {
-                  return 403;
-                }
-              '';
+              extraConfig = nginxInternalOnly;
             };
           };
         };
diff --git a/modules/nixfiles/kde.nix b/modules/nixfiles/kde.nix
index 934f114..e22663c 100644
--- a/modules/nixfiles/kde.nix
+++ b/modules/nixfiles/kde.nix
@@ -7,17 +7,26 @@
 with lib; let
   cfg = config.nixfiles.modules.kde;
 in {
-  options.nixfiles.modules.kde.enable = mkEnableOption "KDE Plasma 5 desktop environment";
+  options.nixfiles.modules.kde.enable = mkEnableOption "KDE Plasma";
 
   config = mkIf cfg.enable {
     nixfiles.modules = {
-      gnupg.pinentry = mkForce "qt";
+      gnupg.pinentry = "qt";
       sound.enable = true;
       x11.enable = true;
     };
 
     services.xserver = {
-      desktopManager.plasma5.enable = true;
+      desktopManager.plasma5 = {
+        enable = true;
+        excludePackages = with pkgs.plasma5Packages; [
+          elisa
+          gwenview
+          khelpcenter
+          okular
+          print-manager
+        ];
+      };
       displayManager.sddm.enable = true;
     };
 
diff --git a/modules/nixfiles/loki.nix b/modules/nixfiles/loki.nix
index 77b6ca0..4d9aab7 100644
--- a/modules/nixfiles/loki.nix
+++ b/modules/nixfiles/loki.nix
@@ -29,11 +29,7 @@ in {
       upstreams.loki.servers."127.0.0.1:${toString cfg.port}" = {};
       virtualHosts.${domain}.locations."/" = {
         proxyPass = "http://loki";
-        extraConfig = ''
-          if ($internal != 1) {
-            return 403;
-          }
-        '';
+        extraConfig = nginxInternalOnly;
       };
     };
 
diff --git a/modules/nixfiles/matrix/dendrite.nix b/modules/nixfiles/matrix/dendrite.nix
index 4792f0e..8dbc318 100644
--- a/modules/nixfiles/matrix/dendrite.nix
+++ b/modules/nixfiles/matrix/dendrite.nix
@@ -21,7 +21,7 @@ in {
   config = mkIf cfg.enable {
     secrets.dendrite-private-key = {
       file = "${inputs.self}/secrets/dendrite-private-key";
-      mode = "0444"; # User is dynamic.
+      mode = "0444"; # FIXME User is dynamic so the file must be world-readable.
     };
 
     nixfiles.modules = {
diff --git a/modules/nixfiles/monitoring/default.nix b/modules/nixfiles/monitoring/default.nix
index c439614..35261e2 100644
--- a/modules/nixfiles/monitoring/default.nix
+++ b/modules/nixfiles/monitoring/default.nix
@@ -7,7 +7,7 @@
 with lib; let
   cfg = config.nixfiles.modules.monitoring;
 in {
-  options.nixfiles.modules.monitoring.enable = mkEnableOption "custom monitoring stack";
+  options.nixfiles.modules.monitoring.enable = mkEnableOption "a custom monitoring stack";
 
   config = mkIf cfg.enable {
     nixfiles.modules = {
@@ -65,6 +65,8 @@ in {
       loki.configuration.ruler.alertmanager_url = "https://${config.nixfiles.modules.alertmanager.domain}";
 
       prometheus = {
+        # It would be nice if these could be generated dynamically. That would
+        # require a complete rework of how configurations are defined, though.
         scrapeConfigs = with my.configurations;
         with config.services.prometheus.exporters; [
           {
diff --git a/modules/nixfiles/nsd.nix b/modules/nixfiles/nsd.nix
index acbfd07..57973ee 100644
--- a/modules/nixfiles/nsd.nix
+++ b/modules/nixfiles/nsd.nix
@@ -26,7 +26,6 @@ in {
         ipTransparent = true;
         ratelimit.enable = true;
 
-        # TODO DNSSEC.
         zones = let
           dns = inputs.dns-nix.lib;
         in
@@ -37,7 +36,6 @@ in {
                 AAAA = [(aaaa ipv6.address)];
               };
 
-            # TODO Try moving DKIM keys somewhere in "my" or secrets maybe?
             mkEmailEntries = {
               domain ? my.domain.shire,
               dkimKey ? null,
@@ -70,7 +68,7 @@ in {
                   SOA = {
                     nameServer = "${cfg.fqdn}.";
                     adminEmail = "admin+dns@${my.domain.shire}";
-                    serial = 2022091420;
+                    serial = 2022091601; # Don't forget to bump the revision!
                   };
 
                   NS = with my.domain; [
@@ -84,6 +82,10 @@ in {
                 extra
               ]);
             };
+
+            # https://ariadne.id/
+            # https://docs.keyoxide.org/service-providers/dns/
+            ariadneIdProof.TXT = ["openpgp4fpr:${my.pgp.fingerprint}"];
           in
             mkMerge [
               (mkZone {
@@ -105,15 +107,18 @@ in {
                       # ns2 = varda;
 
                       alertmanager = manwe;
-                      flood = yavanna;
+                      git = manwe;
                       gotify = manwe;
                       grafana = manwe;
                       loki = manwe;
-                      minecraft = varda;
                       prometheus = manwe;
                       radicale = manwe;
                       rss-bridge = manwe;
                       vaultwarden = manwe;
+
+                      minecraft = varda;
+
+                      flood = yavanna;
                     };
                   }
                 ];
@@ -124,8 +129,9 @@ in {
                   (mkEmailEntries {
                     dkimKey = "@DKIM_KEY@";
                   })
+                  ariadneIdProof
                   {
-                    TXT = ["openpgp4fpr:${my.pgp.fingerprint}"]; # https://docs.keyoxide.org/service-providers/dns/
+                    subdomains.git = ips "manwe";
                   }
                 ];
               })
@@ -136,7 +142,7 @@ in {
                     dkimKey = "@DKIM_KEY@";
                   })
                   {
-                    subdomains.frodo = ips "manwe";
+                    subdomains.frodo = ips "manwe" // ariadneIdProof;
                   }
                 ];
               })
@@ -147,7 +153,7 @@ in {
                     dkimKey = "@DKIM_KEY@";
                   })
                   {
-                    subdomains.frodo = ips "manwe";
+                    subdomains.frodo = ips "manwe" // ariadneIdProof;
                   }
                 ];
               })
diff --git a/modules/nixfiles/openssh.nix b/modules/nixfiles/openssh.nix
index 2bae2da..bf470ca 100644
--- a/modules/nixfiles/openssh.nix
+++ b/modules/nixfiles/openssh.nix
@@ -54,9 +54,11 @@ in {
             in
               internalServers
               // (mapAttrs' mkBlock {
-                # Custom blocks go here.
-                #
-                # example.hostname = "129.168.70.80";
+                gitolite = {
+                  user = "git";
+                  hostname = "git.${my.domain.shire}";
+                  inherit port;
+                };
               });
           };
         };
diff --git a/modules/nixfiles/profiles/dev/default.nix b/modules/nixfiles/profiles/dev/default.nix
index 14c0730..1a0ad07 100644
--- a/modules/nixfiles/profiles/dev/default.nix
+++ b/modules/nixfiles/profiles/dev/default.nix
@@ -20,7 +20,7 @@ in {
       bat.enable = true;
       curl.enable = true;
       direnv.enable = true;
-      git.enable = true;
+      git.client.enable = true;
       gnupg.enable = true;
       nmap.enable = true;
       wget.enable = true;
diff --git a/modules/nixfiles/profiles/dev/pystartup.py b/modules/nixfiles/profiles/dev/pystartup.py
index 1a78b55..adde66c 100644
--- a/modules/nixfiles/profiles/dev/pystartup.py
+++ b/modules/nixfiles/profiles/dev/pystartup.py
@@ -32,9 +32,7 @@ class TermColors(dict):
     color_base = "\001\033[%sm\002"
 
     def __init__(self):
-        self.update(
-            dict([(k, self.color_base % v) for k, v in self.color_templates])
-        )
+        self.update(dict([(k, self.color_base % v) for k, v in self.color_templates]))
 
 
 class Completer(object):
@@ -44,16 +42,12 @@ class Completer(object):
         readline.write_history_file(self.python_histfile)
 
     def __init__(self):
-        self.python_dir = os.path.expanduser(
-            "%s/python" % os.environ["XDG_DATA_HOME"]
-        )
+        self.python_dir = os.path.expanduser("%s/python" % os.environ["XDG_DATA_HOME"])
 
         if not os.path.exists(self.python_dir):
             os.mkdir(self.python_dir)
 
-        self.python_histfile = os.path.expanduser(
-            "%s/history" % self.python_dir
-        )
+        self.python_histfile = os.path.expanduser("%s/history" % self.python_dir)
 
         if os.path.exists(self.python_histfile):
             readline.read_history_file(self.python_histfile)
diff --git a/modules/nixfiles/profiles/headful.nix b/modules/nixfiles/profiles/headful.nix
index ba54b03..afe9194 100644
--- a/modules/nixfiles/profiles/headful.nix
+++ b/modules/nixfiles/profiles/headful.nix
@@ -27,7 +27,6 @@ in {
       x11.enable = true;
 
       dwm.enable = mkDefault false;
-      gnome.enable = mkDefault false;
       kde.enable = mkDefault true;
       xmonad.enable = mkDefault false;
     };
@@ -35,8 +34,7 @@ in {
     hm = {
       home.packages = with pkgs; [
         calibre
-        convmv
-        dos2unix
+        imv
         kotatogram-desktop
         nheko
         tor-browser
diff --git a/modules/nixfiles/prometheus.nix b/modules/nixfiles/prometheus.nix
index e816b74..0b0c096 100644
--- a/modules/nixfiles/prometheus.nix
+++ b/modules/nixfiles/prometheus.nix
@@ -28,11 +28,7 @@ in {
       upstreams.prometheus.servers."127.0.0.1:${toString cfg.port}" = {};
       virtualHosts.${domain}.locations."/" = {
         proxyPass = "http://prometheus";
-        extraConfig = ''
-          if ($internal != 1) {
-            return 403;
-          }
-        '';
+        extraConfig = nginxInternalOnly;
       };
     };
 
diff --git a/modules/nixfiles/qutebrowser.nix b/modules/nixfiles/qutebrowser.nix
index dd1d027..186623a 100644
--- a/modules/nixfiles/qutebrowser.nix
+++ b/modules/nixfiles/qutebrowser.nix
@@ -245,7 +245,7 @@ in {
           };
 
           window = {
-            hide_decoration = false; # TODO Test in a WM.
+            hide_decoration = false;
             title_format = "{perc}{current_title}{title_sep}qutebrowser";
           };
 
diff --git a/modules/nixfiles/radicale.nix b/modules/nixfiles/radicale.nix
index 679a8be..76f6b49 100644
--- a/modules/nixfiles/radicale.nix
+++ b/modules/nixfiles/radicale.nix
@@ -32,11 +32,7 @@ in {
         upstreams.radicale.servers."127.0.0.1:${toString port}" = {};
         virtualHosts.${cfg.domain}.locations."/" = {
           proxyPass = "http://radicale";
-          extraConfig = ''
-            if ($internal != 1) {
-              return 403;
-            }
-          '';
+          extraConfig = nginxInternalOnly;
         };
       };
 
diff --git a/modules/nixfiles/rtorrent.nix b/modules/nixfiles/rtorrent.nix
index 121f1ca..9f28c61 100644
--- a/modules/nixfiles/rtorrent.nix
+++ b/modules/nixfiles/rtorrent.nix
@@ -196,22 +196,16 @@ in {
               locations = {
                 "/" = {
                   tryFiles = "$uri /index.html";
-                  extraConfig = ''
-                    if ($internal != 1) {
-                      return 403;
-                    }
-                  '';
+                  extraConfig = nginxInternalOnly;
                 };
                 "/api" = {
                   proxyPass = "http://flood";
-                  extraConfig = ''
-                    proxy_buffering off;
-                    proxy_cache off;
-
-                    if ($internal != 1) {
-                      return 403;
-                    }
-                  '';
+                  extraConfig =
+                    nginxInternalOnly
+                    + ''
+                      proxy_buffering off;
+                      proxy_cache off;
+                    '';
                 };
               };
             };
diff --git a/modules/nixfiles/searx.nix b/modules/nixfiles/searx.nix
index fd11904..24482cc 100644
--- a/modules/nixfiles/searx.nix
+++ b/modules/nixfiles/searx.nix
@@ -35,11 +35,7 @@ in {
       upstreams.searx.servers."127.0.0.1:${toString cfg.port}" = {};
       virtualHosts.${cfg.domain}.locations."/" = {
         proxyPass = "http://searx";
-        extraConfig = ''
-          if ($internal != 1) {
-            return 403;
-          }
-        '';
+        extraConfig = nginxInternalOnly;
       };
     };
 
diff --git a/modules/nixfiles/shadowsocks.nix b/modules/nixfiles/shadowsocks.nix
index 6e98e97..b59359c 100644
--- a/modules/nixfiles/shadowsocks.nix
+++ b/modules/nixfiles/shadowsocks.nix
@@ -19,10 +19,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    secrets.shadowsocks-password = {
-      file = "${inputs.self}/secrets/shadowsocks-password";
-      mode = "0444"; # User is dynamic.
-    };
+    secrets.shadowsocks-password.file = "${inputs.self}/secrets/shadowsocks-password";
 
     services = {
       shadowsocks = {
diff --git a/modules/nixfiles/syncthing.nix b/modules/nixfiles/syncthing.nix
index 31286fa..ed51e73 100644
--- a/modules/nixfiles/syncthing.nix
+++ b/modules/nixfiles/syncthing.nix
@@ -137,11 +137,7 @@ in {
         upstreams.syncthing.servers.${config.services.syncthing.guiAddress} = {};
         virtualHosts.${cfg.domain}.locations."/" = {
           proxyPass = "http://syncthing";
-          extraConfig = ''
-            if ($internal != 1) {
-              return 403;
-            }
-          '';
+          extraConfig = nginxInternalOnly;
         };
       };
     })
diff --git a/modules/nixfiles/zathura.nix b/modules/nixfiles/zathura.nix
index 03a8311..1a0b39a 100644
--- a/modules/nixfiles/zathura.nix
+++ b/modules/nixfiles/zathura.nix
@@ -112,8 +112,8 @@ in {
           scroll-wrap = true;
           scroll-page-aware = false;
 
-          selection-clipboard = with config.nixfiles.modules;
-            if (kde.enable || gnome.enable)
+          selection-clipboard =
+            if config.nixfiles.modules.kde.enable
             then "clipboard"
             else "primary";
           selection-notification = false;