Add Cloudflare Turnstile integration to Gitea configuration

- Introduced `cloudflare-turnstile` secrets in `secrets.yaml` for enhanced CAPTCHA support.
- Updated Gitea service configuration to enable Turnstile CAPTCHA with the new secret and site keys.
- Modified last modified date and MAC in `secrets.yaml` for security compliance.

flake.lock

@@ -38,11 +38,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780452866,
+        "lastModified": 1782389081,
-        "narHash": "sha256-Fq5cR/qGYcGwOOZf6sShtM+kljwecgntgcKXnIBrQDE=",
+        "narHash": "sha256-60aWPXGfLy3fVDTgwd1noQ2W+gryGy0EnNB0jLjfsUY=",
         "ref": "refs/heads/main",
-        "rev": "344f4065e69455adbcdfb4db1cd8d07a73ae7140",
+        "rev": "0feb09ad82ab1800ce5727bb94191deb500ad184",
-        "revCount": 114,
+        "revCount": 123,
         "type": "git",
         "url": "https://git.chiasson.cloud/Olivier/cursor-nixos-flake"
       },
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778679554,
+        "lastModified": 1782185186,
-        "narHash": "sha256-zoPgnxIlDja91/4TmnCui+Fzc/xU/1jdJFu9bovtOk8=",
+        "narHash": "sha256-URMC6ppMqe9WQOdH/oTeOqUcJggJGJaNOrhdzwSKyYo=",
         "owner": "AvengeMedia",
         "repo": "dgop",
-        "rev": "06574b54fa4878a93d8605962d50b13e9528a4ca",
+        "rev": "28558a7e79ab5c81b6d832fe48f40ea499866496",
         "type": "github"
       },
       "original": {
@@ -172,11 +172,11 @@
     "dms-plugin-calculator": {
       "flake": false,
       "locked": {
-        "lastModified": 1778511624,
+        "lastModified": 1782146268,
-        "narHash": "sha256-hiqrO8WkzmWGVlUrzxmffUZBs4t1QM2mMTBUxZqCIyU=",
+        "narHash": "sha256-j8C62+sevr6b+akzVSAqUVysIhb6Vbr8jnWcTXeOtE8=",
         "owner": "rochacbruno",
         "repo": "DankCalculator",
-        "rev": "73073d051d08254633f28f89d2609344c8289813",
+        "rev": "1db5865419a40a33171a475855a59e0b8bf7187f",
         "type": "github"
       },
       "original": {
@@ -473,6 +473,27 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "hermes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
@@ -490,7 +511,7 @@
         "type": "github"
       }
     },
-    "flake-parts_3": {
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "navi",
@@ -512,7 +533,29 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "navi",
+          "tofunix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736143030,
+        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_6": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_3"
       },
@@ -530,7 +573,7 @@
         "type": "github"
       }
     },
-    "flake-parts_5": {
+    "flake-parts_7": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -553,7 +596,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -571,7 +614,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -587,6 +630,29 @@
         "type": "github"
       }
     },
+    "hermes": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs",
+        "npm-lockfile-fix": "npm-lockfile-fix",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1783286111,
+        "narHash": "sha256-t0NRlftLETETXef9nGI0wvD0YvouudXsKQMpyOpCSc4=",
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "rev": "c9a150d6407b700b4fb2f693415ba143b56a40eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -594,11 +660,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780679734,
+        "lastModified": 1782423922,
-        "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=",
+        "narHash": "sha256-qPNd6lUohHP5gcJhqQ7rLV87RwIx0xYR2A4Frb9Zjc4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b2b7db486e06e098711dc291bb25db82850e1d16",
+        "rev": "5d320ab301cfaaca7d32514f13815d19d109f5f4",
         "type": "github"
       },
       "original": {
@@ -615,11 +681,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780515920,
+        "lastModified": 1781497404,
-        "narHash": "sha256-8KX2hEeOX6KP3hBBJJI8dGWVrzbOOf1rBPmg/GUG24U=",
+        "narHash": "sha256-9GAF8sSsnkyCVCWkomXR0T+zdSxyUlfPt6neQidimdg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4c5c1e8ba14f1c7475fa31ff11bc1c19cd220974",
+        "rev": "1285cd3d6882a9847f2d56ed5541b3350c8a6162",
         "type": "github"
       },
       "original": {
@@ -662,18 +728,19 @@
     "navi": {
       "inputs": {
         "crane": "crane",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nix-github-actions": "nix-github-actions",
         "nixos-anywhere": "nixos-anywhere",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
-        "stable": "stable"
+        "stable": "stable",
+        "tofunix": "tofunix"
       },
       "locked": {
-        "lastModified": 1777283737,
+        "lastModified": 1781964794,
-        "narHash": "sha256-sVwTOYwxzUUqAEr5kjOZooJ/v8H2hcuZ42f17MgCqX8=",
+        "narHash": "sha256-DpmkR7ifgSLj7890ayIsri3eioB7V8KhA6ys3ivXAPw=",
         "owner": "cafkafk",
         "repo": "navi",
-        "rev": "b060683e4ca2bd37a1c3bcb4e04abd2296190e9d",
+        "rev": "f6e15457cebefb3a8aa6e30e1961288676c9c7f1",
         "type": "github"
       },
       "original": {
@@ -744,18 +811,18 @@
     "nixcord": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_6",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1780751320,
+        "lastModified": 1782436508,
-        "narHash": "sha256-3PlWrZkSwElqYHMnWi4d0A+GxlvCXk0JaMsTGghmQGE=",
+        "narHash": "sha256-F91/VTVJmeERWwiJMHfEjkCEXWcNECSOiBsil3TlX9k=",
         "owner": "KaylorBen",
         "repo": "nixcord",
-        "rev": "2b70dbed679d2705696deb36f0778c9ef9f1ded2",
+        "rev": "9c530d99735c236db405f6a1ed58de0872ff9a19",
         "type": "github"
       },
       "original": {
@@ -767,7 +834,7 @@
     "nixos-anywhere": {
       "inputs": {
         "disko": "disko",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nix-vm-test": "nix-vm-test",
         "nixos-images": "nixos-images",
         "nixos-stable": "nixos-stable",
@@ -887,11 +954,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750134718,
+        "lastModified": 1775036866,
-        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
         "type": "github"
       },
       "original": {
@@ -964,11 +1031,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1780243769,
+        "lastModified": 1750134718,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
@@ -978,7 +1061,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1780336545,
         "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
@@ -1013,19 +1096,40 @@
         "url": "https://flakehub.com/f/AshleyYakeley/NixVirt/%2A.tar.gz"
       }
     },
+    "npm-lockfile-fix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "type": "github"
+      }
+    },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_5",
+        "flake-parts": "flake-parts_7",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1780771425,
+        "lastModified": 1782441318,
-        "narHash": "sha256-qxX2a/MnwrIkMUZ7nLafJkDvaDaLLsPRC0NK2VXW+sc=",
+        "narHash": "sha256-e+EWubnfN/CqogQ3qFL7i5Yg8ST7hg/19WS+BAOYFb8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "a144829f0faf14576d4faa88a42cd62bebb7428b",
+        "rev": "548388638a8f389437bc81e14122667244a36912",
         "type": "github"
       },
       "original": {
@@ -1066,11 +1170,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779906441,
+        "lastModified": 1780803198,
-        "narHash": "sha256-py8KJJMi4awjZHi5FWBPYfbRPvk3Rg9SeFkPJydsG2E=",
+        "narHash": "sha256-H7wxhe9HJKUvPSDuBKHh/COx+YTZDaQlb6g8b+ZGtE8=",
         "ref": "refs/heads/main",
-        "rev": "339a9ba1ef79dc9976af77f1fea0302de8a696d0",
+        "rev": "46fe1e10e650e078799d0a35ffc05a5bba0733ed",
-        "revCount": 16,
+        "revCount": 17,
         "type": "git",
         "url": "https://git.chiasson.cloud/Olivier/Personal-Website"
       },
@@ -1079,6 +1183,56 @@
         "url": "https://git.chiasson.cloud/Olivier/Personal-Website"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "hermes",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772555609,
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "c37f66a953535c394244888598947679af231863",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772865871,
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "quickshell": {
       "inputs": {
         "nixpkgs": [
@@ -1126,6 +1280,7 @@
         "dms-plugin-widget-group": "dms-plugin-widget-group",
         "dms-plugin-wvkbd-toggle": "dms-plugin-wvkbd-toggle",
         "flake-parts": "flake-parts",
+        "hermes": "hermes",
         "home-manager": "home-manager",
         "import-tree": "import-tree",
         "mobile-nixos": "mobile-nixos",
@@ -1133,7 +1288,7 @@
         "nix-monitor": "nix-monitor",
         "nixcord": "nixcord",
         "nixos-raspberrypi": "nixos-raspberrypi",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixvirt": "nixvirt",
         "nur": "nur",
         "oom-hardware": "oom-hardware",
@@ -1155,11 +1310,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1782165805,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
         "type": "github"
       },
       "original": {
@@ -1173,14 +1328,14 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1780422259,
+        "lastModified": 1782031037,
-        "narHash": "sha256-dWGk4SEdI189kQW5cE4Uo1Mc+P+kQEdgMcyMgTtmQOA=",
+        "narHash": "sha256-a7oWSyS7SN81UOqVt481yIEMDsMpaJ7GNdV6Eaz5Yqg=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "8414bbf2fcc7bc0a22c675e498e3c7365c1aec0a",
+        "rev": "9cb27462cfd20edac174353f1e95bc03aa888863",
         "type": "github"
       },
       "original": {
@@ -1271,6 +1426,21 @@
         "type": "github"
       }
     },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "t2fanrd": {
       "inputs": {
         "nixpkgs": [
@@ -1294,11 +1464,11 @@
     "t2linux-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1779914035,
+        "lastModified": 1782419564,
-        "narHash": "sha256-VsHuI2CbQ8gFplW+51gUJvCqo1Ts10Ueks9aTtkAOiw=",
+        "narHash": "sha256-Rz6BsjpS9SETgcSkTz/QYuncR5CB0TM61SCzTiIcRI0=",
         "owner": "t2linux",
         "repo": "linux-t2-patches",
-        "rev": "7ee7d19c38e5df31a386b2a0c35ca8f064003960",
+        "rev": "ff59395cc61769dc255b5eab6faac27e8ce441f7",
         "type": "github"
       },
       "original": {
@@ -1307,6 +1477,29 @@
         "type": "github"
       }
     },
+    "tofunix": {
+      "inputs": {
+        "flake-parts": "flake-parts_5",
+        "nixpkgs": [
+          "navi",
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1769620829,
+        "narHash": "sha256-OGZn7OKNm3wuLvtynXAk5C1GUd0jKHyfirhkbdbMIgo=",
+        "owner": "cafkafk",
+        "repo": "tofunix",
+        "rev": "472fe73ec92e3c21c470361d7531c67c4ced2861",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cafkafk",
+        "repo": "tofunix",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -1329,6 +1522,31 @@
         "type": "github"
       }
     },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773039484,
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "wallpapers": {
       "flake": false,
       "locked": {
@@ -1347,14 +1565,14 @@
     },
     "wrapper-modules": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1780661205,
+        "lastModified": 1782135443,
-        "narHash": "sha256-3F5DixT3Gk91lBI9E+TGMm0ko5HrRbDiL23di16TJGA=",
+        "narHash": "sha256-vAmbArdCyjqpVW+37aCy/PMBOLIqukUXLQuEKLwUhA4=",
         "owner": "BirdeeHub",
         "repo": "nix-wrapper-modules",
-        "rev": "8dd304c3582ddd339217e1cc5fb53f50acb63c2d",
+        "rev": "6e7f66fa2cdf4d63162580b438f7fcf87c28a46f",
         "type": "github"
       },
       "original": {
@@ -1371,11 +1589,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780567926,
+        "lastModified": 1782144240,
-        "narHash": "sha256-LVaiAnBwgr2YotaIlrcwCgmbwHsE2ccegRztLjur/d4=",
+        "narHash": "sha256-RgCWSv7AJZCwPhCzz+J0lvwp1WBz9ouvCnnlmvu0xfw=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "eea9ae34eb9011aee9b8ce8ee2bc2dd111ee8285",
+        "rev": "d1693556428967f8b4eef128feb090421ddcaf15",
         "type": "github"
       },
       "original": {

flake.nix

@@ -200,6 +200,9 @@
       url = "https://flakehub.com/f/AshleyYakeley/NixVirt/*.tar.gz";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    hermes = {
+      url = "github:NousResearch/hermes-agent";
+    };
   };
 
   outputs = inputs:

modules/hosts/14900k/_private/ai.nix

@@ -0,0 +1,11 @@
+{config, inputs, pkgs, ...}: {
+  imports = [
+    inputs.hermes.nixosModules.default
+  ];
+  services.ollama = {
+    enable = true;
+    # Replace the old acceleration line with this:
+    package = pkgs.ollama-cuda; 
+  };
+  chiasson.users.extraModules.olivier = [{chiasson.home.extraPackages = with pkgs; [ zed-editor windsurf];}];
+}

modules/hosts/14900k/_private/displays.nix

@@ -1,5 +1,5 @@
 # Monitor layout for 14900k.
-# NVIDIA (default): DP-2 ultrawide, HDMI-A-3 + DP-4 side/top stack.
+# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 side/top stack; DP-2 virtual 4K when streamingDisplay enabled.
 # Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 Samsung to the left.
 # Niri: `extraSettings` (KDL via `extraConfig`, other wrapper-modules keys) + `extraBinds` (merged keybinds).
 # Hyprland: `chiasson.desktop.hyprland.settings` (merged in HM when `chiasson.desktop.hyprland.enable`).
@@ -8,9 +8,20 @@
 { config, lib, ... }:
 let
   gpuPassthru = config.chiasson.system.gpuPassthru.enable;
+  streamingDisplay = config.chiasson.system.streamingDisplay.enable or false;
+  streamingCfg = config.chiasson.system.streamingDisplay or { };
+
+  virtualOutputNiri =
+    lib.optionalString streamingDisplay ''
+      output "${streamingCfg.connector}" {
+          mode "${streamingCfg.mode}"
+          scale ${toString (streamingCfg.niriScale or 1.0)}
+          position ${streamingCfg.niriPosition}
+      }
+    '';
 
   niriOutputs =
-    if gpuPassthru then
+    (if gpuPassthru then
       ''
         output "DP-1" {
             mode "2560x1080@144"
@@ -42,10 +53,15 @@ let
             scale 1.0
             position x=0 y=-1080
         }
-      '';
+      '')
+    + virtualOutputNiri;
+
+  virtualOutputHyprland =
+    lib.optionalString streamingDisplay
+      "${streamingCfg.connector}, ${streamingCfg.mode}, 7680x0, ${toString (streamingCfg.niriScale or 1.0)}";
 
   hyprlandMonitors =
-    if gpuPassthru then
+    (if gpuPassthru then
       [
         "DP-1, 2560x1080@144, 0x0, 1"
         "HDMI-A-2, 1920x1080@60, -1920x0, 1"
@@ -55,7 +71,8 @@ let
         "DP-3, 2560x1080@144, 0x0, 1"
         "DP-4, 1920x1080@144, 0x-1080, 1"
         "HDMI-A-3, 1920x1080@60, -1920x0, 1"
-      ];
+      ])
+    ++ lib.optional streamingDisplay virtualOutputHyprland;
 
   hyprlandWorkspaces =
     if gpuPassthru then

modules/hosts/14900k/_private/generate-virtual-edid.py

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+"""Generate a virtual-display EDID with 4K CTA VICs (trimmed from EnriqueWood POC)."""
+
+import math
+import sys
+
+
+def cvt_rb(w, h, refresh):
+    hblank, hfront, hsync = 160, 48, 32
+    htotal = w + hblank
+    vfront, vsync = 3, 8
+    rb_min_vblank = 460e-6
+    vblank = math.ceil(rb_min_vblank * refresh * h / (1.0 - rb_min_vblank * refresh))
+    vblank = max(vblank, vfront + vsync + 6)
+    vtotal = h + vblank
+    pixclk_khz = int(round(htotal * vtotal * refresh / 10000.0)) * 10
+    return dict(
+        w=w,
+        h=h,
+        refresh=refresh,
+        htotal=htotal,
+        vtotal=vtotal,
+        hblank=hblank,
+        hfront=hfront,
+        hsync=hsync,
+        vblank=vblank,
+        vfront=vfront,
+        vsync=vsync,
+        pixclk_khz=pixclk_khz,
+    )
+
+
+def make_dtd(t, hmm=600, vmm=340):
+    w, h = t["w"], t["h"]
+    hblank, vblank = t["hblank"], t["vblank"]
+    hfront, hsync = t["hfront"], t["hsync"]
+    vfront, vsync = t["vfront"], t["vsync"]
+    pc = t["pixclk_khz"] // 10
+    d = bytearray(18)
+    d[0] = pc & 0xFF
+    d[1] = (pc >> 8) & 0xFF
+    d[2] = w & 0xFF
+    d[3] = hblank & 0xFF
+    d[4] = ((w >> 4) & 0xF0) | ((hblank >> 8) & 0x0F)
+    d[5] = h & 0xFF
+    d[6] = vblank & 0xFF
+    d[7] = ((h >> 4) & 0xF0) | ((vblank >> 8) & 0x0F)
+    d[8] = hfront & 0xFF
+    d[9] = hsync & 0xFF
+    d[10] = ((vfront & 0x0F) << 4) | (vsync & 0x0F)
+    d[11] = (
+        (((hfront >> 8) & 3) << 6)
+        | (((hsync >> 8) & 3) << 4)
+        | (((vfront >> 4) & 3) << 2)
+        | ((vsync >> 4) & 3)
+    )
+    d[12] = hmm & 0xFF
+    d[13] = vmm & 0xFF
+    d[14] = ((hmm >> 4) & 0xF0) | ((vmm >> 8) & 0x0F)
+    d[17] = 0x1E
+    return bytes(d)
+
+
+def make_name(name):
+    d = bytearray(18)
+    d[3] = 0xFC
+    nb = name.encode("ascii")[:13]
+    d[5 : 5 + len(nb)] = nb
+    pos = 5 + len(nb)
+    if pos < 18:
+        d[pos] = 0x0A
+        pos += 1
+    for i in range(pos, 18):
+        d[i] = 0x20
+    return bytes(d)
+
+
+def make_range(min_v, max_v, min_h, max_h, max_pixclk_mhz):
+    d = bytearray(18)
+    d[3] = 0xFD
+    flags = 0
+    mv, mh = max_v, max_h
+    if mh > 255:
+        flags |= 0x08
+        mh -= 255
+    if mv > 255:
+        flags |= 0x02
+        mv -= 255
+    d[4] = flags
+    d[5] = min_v
+    d[6] = mv
+    d[7] = min_h
+    d[8] = mh
+    d[9] = max_pixclk_mhz // 10
+    d[10] = 0x01
+    for i in range(11, 18):
+        d[i] = 0x0A if i == 11 else 0x20
+    return bytes(d)
+
+
+def checksum(block):
+    return (256 - (sum(block[:-1]) % 256)) % 256
+
+
+VICS = [97, 118, 96, 95, 63, 16, 4]
+
+
+def build_base(base_dtds, name, max_pixclk_mhz):
+    b = bytearray(128)
+    b[0:8] = b"\x00\xFF\xFF\xFF\xFF\xFF\xFF\x00"
+    b[8:10] = b"\x50\x74"
+    b[10:12] = b"\x70\x02"
+    b[16] = 22
+    b[17] = 34
+    b[18] = 1
+    b[19] = 4
+    b[20] = 0xA5
+    b[21] = 60
+    b[22] = 34
+    b[23] = 120
+    b[24] = 0x2E
+    b[25:35] = bytes([0x35, 0x85, 0xA6, 0x56, 0x48, 0x9A, 0x24, 0x12, 0x50, 0x54])
+    for i in range(8):
+        b[38 + i * 2] = 0x01
+        b[39 + i * 2] = 0x01
+    b[54:72] = make_dtd(base_dtds[0])
+    b[72:90] = make_dtd(base_dtds[1])
+    b[90:108] = make_range(24, 240, 30, 510, max_pixclk_mhz)
+    b[108:126] = make_name(name)
+    b[126] = 1
+    b[127] = checksum(b)
+    return b
+
+
+def build_cta_primary(dtds):
+    b = bytearray(128)
+    b[0] = 0x02
+    b[1] = 0x03
+    pos = 4
+    b[pos] = (2 << 5) | len(VICS)
+    for i, v in enumerate(VICS):
+        b[pos + 1 + i] = v
+    pos += 1 + len(VICS)
+    b[pos] = (1 << 5) | 3
+    b[pos + 1], b[pos + 2], b[pos + 3] = 0x17, 0x7F, 0x07
+    pos += 4
+    b[pos] = (4 << 5) | 3
+    b[pos + 1] = 0x4F
+    pos += 4
+    b[2] = pos
+    b[3] = 0x40
+    used, p = [], pos
+    for t in dtds:
+        if p + 18 > 127:
+            break
+        b[p : p + 18] = make_dtd(t)
+        used.append(t)
+        p += 18
+    b[127] = checksum(b)
+    return b, used
+
+
+def build(custom, name, max_pixclk_mhz=1200):
+    if len(custom) < 2:
+        custom = custom + custom[:1] * (2 - len(custom))
+    base = build_base(custom[0:2], name, max_pixclk_mhz)
+    rest = custom[2:]
+    cta1, _used = build_cta_primary(rest)
+    base[126] = 1
+    base[127] = checksum(base)
+    return bytes(base + cta1)
+
+
+def main():
+    output = sys.argv[1]
+    custom = [
+        cvt_rb(3840, 2160, 60),
+        cvt_rb(2560, 1440, 60),
+        cvt_rb(1920, 1080, 60),
+    ]
+    edid = build(custom, "SUN-4K")
+    with open(output, "wb") as f:
+        f.write(edid)
+    assert len(edid) % 128 == 0
+    for i in range(len(edid) // 128):
+        block = edid[i * 128 : (i + 1) * 128]
+        assert sum(block) % 256 == 0
+
+
+if __name__ == "__main__":
+    main()

modules/hosts/14900k/_private/streaming-display.nix

@@ -0,0 +1,126 @@
+# Headless 4K virtual output for Sunshine → Moonlight on a client TV.
+#
+# NVIDIA proprietary driver: both kernel params are required —
+#   video=<connector>:e              force-enables the connector
+#   drm.edid_firmware=<connector>:…  loads modes from the EDID blob
+#
+# Pick a connector that is disconnected on the host (check after boot):
+#   grep -H . /sys/class/drm/card*-*/status
+#
+# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070;
+# 4K@120 on a sink-less connector needs driver patches (see NVIDIA issue #1184).
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.chiasson.system.streamingDisplay;
+
+  edidFirmware = pkgs.runCommand "sunshine-virtual-4k-edid" {
+    nativeBuildInputs = [ pkgs.python3 ];
+  } ''
+    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $TMPDIR/${cfg.edidFileName}
+    mkdir -p $out/lib/firmware/edid
+    cp $TMPDIR/${cfg.edidFileName} $out/lib/firmware/edid/${cfg.edidFileName}
+  '';
+
+  # Sunshine 2025.924 wlr capture only accepts a numeric monitor index (not "DP-2").
+  # If the index drifts after hotplug, check:
+  #   journalctl --user -u sunshine -b | rg 'Monitor [0-9]+ is'
+  streamDisplayUp = pkgs.writeShellScriptBin "stream-display-up" ''
+    ${pkgs.niri}/bin/niri msg output ${cfg.connector} scale ${toString cfg.niriScale}
+    ${pkgs.niri}/bin/niri msg action focus-monitor ${cfg.connector}
+    ${pkgs.niri}/bin/niri msg action move-window-to-monitor ${cfg.connector} || true
+  '';
+
+  streamDisplayDown = pkgs.writeShellScriptBin "stream-display-down" ''
+    ${pkgs.niri}/bin/niri msg action focus-monitor ${cfg.focusMonitorOnEnd}
+  '';
+in
+{
+  options.chiasson.system.streamingDisplay = {
+    enable = lib.mkEnableOption ''
+      Force-enable a spare NVIDIA DRM connector with a 4K EDID for Sunshine/Moonlight.
+      Requires reboot. Pair with `chiasson.desktop.niri` output config in `displays.nix`.
+    '';
+
+    connector = lib.mkOption {
+      type = lib.types.str;
+      default = "DP-2";
+      example = "HDMI-A-1";
+      description = ''
+        DRM connector name (e.g. `DP-2`, `HDMI-A-1`). Must be unused on the host —
+        14900k desk uses DP-3, DP-4, and HDMI-A-3 by default.
+      '';
+    };
+
+    edidFileName = lib.mkOption {
+      type = lib.types.str;
+      default = "virtual-4k.bin";
+      description = "Filename under `/lib/firmware/edid/` referenced by `drm.edid_firmware`.";
+    };
+
+    mode = lib.mkOption {
+      type = lib.types.str;
+      default = "3840x2160@60";
+      description = "Mode Niri should use on the virtual output (must match EDID).";
+    };
+
+    niriPosition = lib.mkOption {
+      type = lib.types.str;
+      default = "x=7680 y=0";
+      description = ''
+        Niri `position` for the virtual panel — keep it clear of desk monitors
+        so streamed windows do not overlap your ultrawide layout.
+      '';
+    };
+
+    niriScale = lib.mkOption {
+      type = lib.types.float;
+      default = 1.5;
+      example = 1.5;
+      description = ''
+        Niri `scale` on the virtual panel. Values above 1.0 enlarge UI and text
+        on the 4K framebuffer (helpful when viewing on a TV from the couch).
+      '';
+    };
+
+    focusMonitorOnEnd = lib.mkOption {
+      type = lib.types.str;
+      default = "DP-3";
+      description = "Niri monitor to refocus when a Moonlight session ends.";
+    };
+
+    sunshineOutputIndex = lib.mkOption {
+      type = lib.types.str;
+      default = "3";
+      example = "3";
+      description = ''
+        Wayland/wlr monitor index for Sunshine `output_name`. Sunshine 2025.924 ignores
+        connector strings like `DP-2` and falls back to monitor 0 (your primary).
+        Find the index with:
+        `journalctl --user -u sunshine -b | rg "Monitor [0-9]+ is ${cfg.connector}"`
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      hardware.firmware = [ edidFirmware ];
+
+      boot.kernelParams = [
+        "video=${cfg.connector}:e"
+        "drm.edid_firmware=${cfg.connector}:edid/${cfg.edidFileName}"
+      ];
+
+      environment.systemPackages = [
+        streamDisplayUp
+        streamDisplayDown
+      ];
+    }
+    (lib.mkIf config.chiasson.system.gaming.sunshine.enable {
+      services.sunshine.settings = {
+        capture = "wlr";
+        output_name = cfg.sunshineOutputIndex;
+        global_prep_cmd = "[{\"do\":\"${streamDisplayUp}/bin/stream-display-up\",\"undo\":\"${streamDisplayDown}/bin/stream-display-down\"}]";
+      };
+    })
+  ]);
+}

modules/hosts/14900k/configuration.nix

@@ -19,12 +19,15 @@
         ./_private/peripherals.nix
         # ./_private/printing-epson.nix
         ./_private/displays.nix
+        ./_private/streaming-display.nix
+        ./_private/ai.nix
         ./_private/media-disk.nix
         ./_private/jellyfin-nfs-export.nix
         ./_private/moonfin-flatpak.nix
       ];
 
      services.cloudflare-warp.enable = true;
+     programs.nix-ld.enable = true;
 
       boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
       boot.kernel.sysctl."fs.inotify.max_user_instances" = 2048;
@@ -76,6 +79,10 @@
         gaming.sunshine.enable = true;
         gaming.sunshine.cudaSupport = true;
 
+        streamingDisplay.enable = true;
+        # Spare NVIDIA port — verify with: grep -H . /sys/class/drm/card*-*/status
+        streamingDisplay.connector = "DP-2";
+
         monitorInput.enable = true;
 
         flatpak.enable = true;

modules/hosts/nix-server/_services/cloudflare-dyndns.nix

@@ -16,7 +16,7 @@ in
       "blackfry.day"
       "yestur.day"
       "rp-own.life"
-      "xn--1iu.cc"
+      "慧.cc"
     ];
     proxied = true;
     ipv4 = true;

modules/hosts/nix-server/_services/gitea.nix

@@ -1,5 +1,13 @@
-{ lib, ... }:
+{ lib, config, ... }:
+let
+  secretFilePath = ../secrets.yaml;
+  in
 {
+
+  sops.secrets."cloudflare-turnstile/secret-key".sopsFile = secretFilePath;
+  sops.secrets."cloudflare-turnstile/site-key".sopsFile = secretFilePath;
+  
+
   services.gitea = {
     enable = true;
 
@@ -22,7 +30,16 @@
         SSH_LISTEN_PORT = 222;
       };
 
-      service.DISABLE_REGISTRATION = false;
+      service = {
+        DISABLE_REGISTRATION = false;
+        ENABLE_CAPTCHA = true;
+        CAPTCHA_TYPE = "cfturnstile";
+        CF_TURNSTILE_SECRET = config.sops.secrets."cloudflare-turnstile/secret-key".path;
+        CF_TURNSTILE_SITEKEY = config.sops.secrets."cloudflare-turnstile/site-key".path;
+        REGISTER_EMAIL_CONFIRM = false;
+        ENABLE_NOTIFY_MAIL = false;
+      };
+
     };
   };
 

modules/hosts/nix-server/secrets.yaml

@@ -17,6 +17,9 @@ personal-website:
     oauth-discord-client-secret: ENC[AES256_GCM,data:YegPgoSRKNcDaID9LPWxHDz4T7VnhFfuWMyALfFhpg8=,iv:VSLWA1HG1+Y70tKnRoFulBZSKdoJTYmIDzCXIZeFYCc=,tag:yNR8rrm/7Mrj/RIVNLFfsg==,type:str]
 cloudflare-ddns:
     api-token: ENC[AES256_GCM,data:wFKbclETO0YQTcfNUdKyr6mxQODeiaYn3gLeC1mWeRda97rOvlum+Q==,iv:IuT4exNhh0z+9DbY3WNnVqEy4398DTm7aluhOv9XFss=,tag:GGPoSJLBScTmXyQ7Vab6EA==,type:str]
+cloudflare-turnstile:
+    secret-key: ENC[AES256_GCM,data:fSsH5HRLvzwyovBezNQnil7due6+FCE2yW/S91aOwqb4yow=,iv:7hTu9YyACvOys42n8XFBmVykKJ0op8btb3xQ6tGpqP4=,tag:Z4FvKKPsb1rAQuWY4v5frg==,type:str]
+    site-key: ENC[AES256_GCM,data:qKmx5EY3Yl5A3zsofFfskN3DrZI+yrHJ,iv:ZGnhkm12VG/O0TNQsKOIb53BlxXPqhBmSPh6rlLGpN4=,tag:C0vQsXRil72z6SRoLiifcA==,type:str]
 sops:
     age:
         - enc: |
@@ -46,7 +49,7 @@ sops:
             Nf0uOoSWPTJ/2SRNkSu7FMumATH4ldQ6TFSwKda3mBfBwhnFzLq10Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1p05z980kdtngk9mw67hfev72h7xhslplpxfk9yskgmf0hl4lu3ls04zht9
-    lastmodified: "2026-06-12T00:44:20Z"
+    lastmodified: "2026-07-10T20:47:30Z"
-    mac: ENC[AES256_GCM,data:cyI5NH6+OR/Q4T3atFN+gXsJbRaR/Q5I+MyJHy5qXsShh8LnQvEKBnnIPKz2xpuDwFvKd4DabMOxcu5xe6IRH9TN7G411vp+vruM+TicoCJ4U2xAP/J9Tlh3YKT6kZJqj/zAhvP5qPCzvz7xkFTvluLrWgPlaHWn/rlCskh0t5M=,iv:WBeS1rqjJblNGMVa7hEn5MXbZJU8WKd6541BCxu2rGI=,tag:OfOzQI6ESUdUYCbBEq9GFw==,type:str]
+    mac: ENC[AES256_GCM,data:gqrsaZ7GwS+qkuVRwGkrTJjL1qfBid3RdbGLEZIr1P4XuKatqiFWs0ihj/Qm6jItktoPXwMHcejzx/wQgTImBvdNXDW5TbgF39VJYCZ8r/ToTX2LdZXCBJHim8F9eVE+aBJfsb/LHyvTJLcp3BgrOFyNYjt067585hDt/D3Tmh0=,iv:cKUPZI1lH1wMJVhgR0/TB3iDU6TUSv8vLo+vlThk2AU=,tag:eT2BwsN8mL5RgpQ+pAaKPg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1