mob next [ci-skip] [ci skip] [skip ci]

lastFile:machines/saturn/configuration.nix
update(inventory.json): Installed saturn
2026-05-26 13:46:36 +07:00 · 2026-05-26 10:41:13 +07:00 · 2026-05-26 10:31:37 +07:00 · 2026-05-26 10:30:33 +07:00 · 2026-05-26 10:29:29 +07:00 · 2026-05-26 10:28:23 +07:00
591 changed files with 22972 additions and 1191 deletions
@@ -1,5 +1,58 @@
 {
  "nodes": {
+    "arion": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "haskell-flake": "haskell-flake",
+        "nixpkgs": [
+          "frappix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733918465,
+        "narHash": "sha256-hSuGa8Hh67EHr2x812Ay6WFyFT2BGKn+zk+FJWeKXPg=",
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "rev": "f01c95c10f9d4f04bb08d97b3233b530b180f12e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "type": "github"
+      }
+    },
+    "blank": {
+      "locked": {
+        "lastModified": 1625557891,
+        "narHash": "sha256-O8/MWsPBGhhyPoPLHZAuoZiiHo9q6FLlEeIDEXuj6T4=",
+        "owner": "divnix",
+        "repo": "blank",
+        "rev": "5a5d2684073d9f563072ed07c871d577a6c614a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "blank",
+        "type": "github"
+      }
+    },
+    "call-flake": {
+      "locked": {
+        "lastModified": 1687380775,
+        "narHash": "sha256-bmhE1TmrJG4ba93l9WQTLuYM53kwGQAjYHRvHOeuxWU=",
+        "owner": "divnix",
+        "repo": "call-flake",
+        "rev": "74061f6c241227cd05e79b702db9a300a2e4131a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "call-flake",
+        "type": "github"
+      }
+    },
    "clan-core": {
      "inputs": {
        "data-mesher": "data-mesher",
@@ -100,6 +153,39 @@
        "type": "github"
      }
    },
+    "dmerge": {
+      "inputs": {
+        "haumea": [
+          "frappix",
+          "std",
+          "haumea"
+        ],
+        "nixlib": [
+          "frappix",
+          "std",
+          "lib"
+        ],
+        "yants": [
+          "frappix",
+          "std",
+          "yants"
+        ]
+      },
+      "locked": {
+        "lastModified": 1686862774,
+        "narHash": "sha256-ojGtRQ9pIOUrxsQEuEPerUkqIJEuod9hIflfNkY+9CE=",
+        "owner": "divnix",
+        "repo": "dmerge",
+        "rev": "9f7f7a8349d33d7bd02e0f2b484b1f076e503a96",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "ref": "0.2.1",
+        "repo": "dmerge",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -120,6 +206,146 @@
        "type": "github"
      }
    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "frappix",
+          "arion",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "frappix": {
+      "inputs": {
+        "arion": "arion",
+        "devshell": [
+          "devshell"
+        ],
+        "microvm": "microvm",
+        "n2c": "n2c",
+        "nixago": "nixago",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "std": "std"
+      },
+      "locked": {
+        "lastModified": 1779175997,
+        "narHash": "sha256-Ps/4s3jwaZdLVEpO+1cRs54VbPbgMeXJUqa4CWSPJSY=",
+        "owner": "kurogeek",
+        "repo": "frappix",
+        "rev": "0f1b4bcfb8c3b976e808a57e491d10857a1a45ac",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kurogeek",
+        "repo": "frappix",
+        "type": "github"
+      }
+    },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1675296942,
+        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "ref": "0.1.0",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
+    "haumea": {
+      "inputs": {
+        "nixpkgs": [
+          "frappix",
+          "std",
+          "lib"
+        ]
+      },
+      "locked": {
+        "lastModified": 1685133229,
+        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
+        "owner": "nix-community",
+        "repo": "haumea",
+        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.2.2",
+        "repo": "haumea",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -155,14 +381,51 @@
        "type": "github"
      }
    },
+    "incl": {
+      "inputs": {
+        "nixlib": [
+          "frappix",
+          "std",
+          "lib"
+        ]
+      },
+      "locked": {
+        "lastModified": 1693483555,
+        "narHash": "sha256-Beq4WhSeH3jRTZgC1XopTSU10yLpK1nmMcnGoXO0XYo=",
+        "owner": "divnix",
+        "repo": "incl",
+        "rev": "526751ad3d1e23b07944b14e3f6b7a5948d3007b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "incl",
+        "type": "github"
+      }
+    },
+    "lib": {
+      "locked": {
+        "lastModified": 1722128034,
+        "narHash": "sha256-L8rwzYPsLo/TYtydPJoQyYOfetuiyQYnTWYcyB8UE/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "d15f6f6021693898fcd2c6a9bb13707383da9bbc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
    "liminix": {
      "flake": false,
      "locked": {
-        "lastModified": 1773253359,
-        "narHash": "sha256-LogvYVd2NfZnTlxAkl5K9tqX9c7wEEPdnYJsW9WTSG4=",
+        "lastModified": 1777223456,
+        "narHash": "sha256-yqZ9OFSXoKgdT6nWwt2d0OFwmfQXASl73hhjtvAD11A=",
        "ref": "refs/heads/main",
-        "rev": "7f23c5dc0f442de9fe07c076297c3a74f2a34e72",
-        "revCount": 1656,
+        "rev": "5f2abc0d2b30eb5878d60488a72138958c228976",
+        "revCount": 1672,
        "type": "git",
        "url": "https://gti.telent.net/dan/liminix"
      },
@@ -171,6 +434,48 @@
        "url": "https://gti.telent.net/dan/liminix"
      }
    },
+    "microvm": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "frappix",
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1737981104,
+        "narHash": "sha256-7AGmPPBgLHHWgzzFYDJcyhv/NiuCrpgzg8IyA7Q/H9o=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "3768f4937f38334898c67e03f40e244a57a74caa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
+    "n2c": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1730479402,
+        "narHash": "sha256-79NLeNjpCa4mSasmFsE3QA6obURezF0TUO5Pm+1daog=",
+        "owner": "nlewo",
+        "repo": "nix2container",
+        "rev": "5fb215a1564baa74ce04ad7f903d94ad6617e17a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nlewo",
+        "repo": "nix2container",
+        "type": "github"
+      }
+    },
    "nix-darwin": {
      "inputs": {
        "nixpkgs": [
@@ -205,13 +510,53 @@
        "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
      }
    },
+    "nixago": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixago-exts": [
+          "frappix"
+        ],
+        "nixpkgs": [
+          "frappix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1714086354,
+        "narHash": "sha256-yKVQMxL9p7zCWUhnGhDzRVT8sDgHoI3V595lBK0C2YA=",
+        "owner": "nix-community",
+        "repo": "nixago",
+        "rev": "5133633e9fe6b144c8e00e3b212cdbd5a173b63d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixago",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1772173633,
-        "narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
+        "lastModified": 1712920918,
+        "narHash": "sha256-1yxFvUcJfUphK9V91KufIQom7gCsztza0H4Rz2VCWUU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "92323443a56f4e9fc4e4b712e3119f66d0969297",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1778458615,
+        "narHash": "sha256-cY07EsdhBJ8tFXPzDYevgqxRev9ZLxFonuq9wmq5kwg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
+        "rev": "c6e5ca3c836a5f4dd9af9f2c1fc1c38f0fac988a",
        "type": "github"
      },
      "original": {
@@ -221,6 +566,68 @@
        "type": "github"
      }
    },
+    "nosys": {
+      "locked": {
+        "lastModified": 1668010795,
+        "narHash": "sha256-JBDVBnos8g0toU7EhIIqQ1If5m/nyBqtHhL3sicdPwI=",
+        "owner": "divnix",
+        "repo": "nosys",
+        "rev": "feade0141487801c71ff55623b421ed535dbdefa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "nosys",
+        "type": "github"
+      }
+    },
+    "paisano": {
+      "inputs": {
+        "call-flake": "call-flake",
+        "nixpkgs": [
+          "frappix",
+          "std",
+          "nixpkgs"
+        ],
+        "nosys": "nosys",
+        "yants": [
+          "frappix",
+          "std",
+          "yants"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708640854,
+        "narHash": "sha256-EpcAmvIS4ErqhXtVEfd2GPpU/E/s8CCRSfYzk6FZ/fY=",
+        "owner": "paisano-nix",
+        "repo": "core",
+        "rev": "adcf742bc9463c08764ca9e6955bd5e7dcf3a3fe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "paisano-nix",
+        "ref": "0.2.0",
+        "repo": "core",
+        "type": "github"
+      }
+    },
+    "paisano-tui": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708637035,
+        "narHash": "sha256-R19YURSK+MY/Rw6FZnojQS9zuDh+OoTAyngQAjjoubc=",
+        "owner": "paisano-nix",
+        "repo": "tui",
+        "rev": "231761b260587a64817e4ffae3afc15defaa15db",
+        "type": "github"
+      },
+      "original": {
+        "owner": "paisano-nix",
+        "ref": "v0.5.0",
+        "repo": "tui",
+        "type": "github"
+      }
+    },
    "plasma-manager": {
      "inputs": {
        "home-manager": [
@@ -249,10 +656,11 @@
        "clan-core": "clan-core",
        "devshell": "devshell",
        "flake-parts": "flake-parts",
+        "frappix": "frappix",
        "home-manager": "home-manager",
        "import-tree": "import-tree",
        "liminix": "liminix",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
        "plasma-manager": "plasma-manager",
        "treefmt-nix": "treefmt-nix"
      }
@@ -278,6 +686,82 @@
        "type": "github"
      }
    },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733308308,
+        "narHash": "sha256-+RcbMAjSxV1wW5UpS9abIG1lFZC8bITPiFIKNnE7RLs=",
+        "ref": "refs/heads/main",
+        "rev": "80c9e9830d460c944c8f730065f18bb733bc7ee2",
+        "revCount": 792,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
+    "std": {
+      "inputs": {
+        "arion": [
+          "frappix",
+          "arion"
+        ],
+        "blank": "blank",
+        "devshell": [
+          "frappix",
+          "devshell"
+        ],
+        "dmerge": "dmerge",
+        "haumea": "haumea",
+        "incl": "incl",
+        "lib": "lib",
+        "makes": [
+          "frappix",
+          "std",
+          "blank"
+        ],
+        "microvm": [
+          "frappix",
+          "microvm"
+        ],
+        "n2c": [
+          "frappix",
+          "n2c"
+        ],
+        "nixago": [
+          "frappix",
+          "nixago"
+        ],
+        "nixpkgs": [
+          "frappix",
+          "nixpkgs"
+        ],
+        "paisano": "paisano",
+        "paisano-tui": "paisano-tui",
+        "terranix": [
+          "frappix",
+          "std",
+          "blank"
+        ],
+        "yants": "yants"
+      },
+      "locked": {
+        "lastModified": 1738072995,
+        "narHash": "sha256-jfwWnAVeQzIBS5Pex0xSUbGk88g1GFF2w+ohOtbRtcY=",
+        "owner": "divnix",
+        "repo": "std",
+        "rev": "2874513c4b76be4c4200779814993b546fe4a909",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "ref": "v0.33.4",
+        "repo": "std",
+        "type": "github"
+      }
+    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
@@ -293,6 +777,36 @@
        "type": "github"
      }
    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -300,11 +814,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1768158989,
-        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -312,6 +826,28 @@
        "repo": "treefmt-nix",
        "type": "github"
      }
+    },
+    "yants": {
+      "inputs": {
+        "nixpkgs": [
+          "frappix",
+          "std",
+          "lib"
+        ]
+      },
+      "locked": {
+        "lastModified": 1686863218,
+        "narHash": "sha256-kooxYm3/3ornWtVBNHM3Zh020gACUyFX2G0VQXnB+mk=",
+        "owner": "divnix",
+        "repo": "yants",
+        "rev": "8f0da0dba57149676aa4817ec0c880fbde7a648d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "divnix",
+        "repo": "yants",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -34,6 +34,11 @@
      url = "git+https://gti.telent.net/dan/liminix";
      flake = false;
    };
+    frappix = {
+      url = "github:kurogeek/frappix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.devshell.follows = "devshell";
+    };
  };
  outputs =
    {
@@ -50,6 +55,8 @@
          ./fmt.nix
          ./shell.nix

+          ./overlays
+          ./modules/nixos
          ./machines
          ./routers
          ./inventories
@@ -65,12 +72,18 @@
              inherit system;
              overlays = [
                inputs.self.overlays.packagesOverlay
+                inputs.self.overlays.frappixFrappeOverlay
+                inputs.self.overlays.frappixLibsOverlay
+                inputs.self.overlays.frappixPythonOverlay
+                inputs.self.overlays.frappixToolsOverlay
              ];
              config = { };
            };
            packages.think = pkgs.think-gtcm;
            packages.think-be = pkgs.think-backend-gtcm;
            packages.file-uploader = pkgs.gtcm-file-uploader;
+            packages.erpnext_thailand = pkgs.erpnext_thailand;
+            packages.thai_payroll = pkgs.thai_payroll;
          };
      }
    );
@@ -10,6 +10,11 @@
        glom = [
          "vega"
          "ramus"
+          "canopus"
+        ];
+        poy = [
+          "deneb"
+          "bosona"
        ];
        w = [ "sirius" ];
        b4l = [
@@ -17,6 +22,7 @@
          "neptune"
          "rana"
          "petra"
+          "alasia"
        ];
        phonebox = [
          "neptune"
@@ -30,29 +36,42 @@
        global-network = [
          "rana"
          "sirius"
+          "hadar"
+          "procyon"
+          "alasia"
        ];
      };

      instances = {
-        admin = {
+
+        sshd = {
+          roles.server.tags."all" = { };
+          roles.server.settings = {
+            authorizedKeys = {
+              "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
+              "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
+              "vi" =
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
+              "kurogeek" =
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
+              "matthewcroughan" =
+                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
+              "matthewcroughan-1" =
+                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
+              "matthewcroughan-2" =
+                "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
+            };
+          };
+        };
+
+        root-password = {
          module = {
-            name = "admin";
+            name = "users";
            input = "clan-core";
          };
          roles.default.tags."all" = { };
-          roles.default.settings.allowedKeys = {
-            "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
-            "davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
-            "vi" =
-              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387";
-            "kurogeek" =
-              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
-            "matthewcroughan" =
-              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
-            "matthewcroughan-1" =
-              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
-            "matthewcroughan-2" =
-              "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
+          roles.default.settings = {
+            user = "root";
          };
        };

@@ -96,6 +115,20 @@
          roles.peer.tags.b4l = { };
        };

+        poy-network = {
+          module = {
+            name = "zerotier";
+            input = "clan-core";
+          };
+          roles.controller.machines."deneb" = {
+            settings.allowedIps = [
+              #kurogeek
+              "fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
+            ];
+          };
+          roles.peer.tags."poy" = { };
+        };
+
        yggdrasil-global-network = {
          module = {
            name = "yggdrasil";
@@ -110,6 +143,23 @@
          ];
        };

+        newedge-headscale = {
+          module = {
+            name = "headscale";
+            input = "self";
+          };
+          roles.server.machines."alasia".settings = {
+            public_url = "tailvpn.public.newedge.house";
+            base_domain = "tailnet.newedge.house";
+            advertise_routes = [ "10.0.10.0/24" ];
+            nameservers = [
+              "10.0.10.82"
+              "1.1.1.1"
+              "8.8.8.8"
+            ];
+          };
+        };
+
        yggdrasil-phone-network = {
          module = {
            name = "yggdrasil";
@@ -135,62 +185,6 @@
          };
        };

-        pocket-id = {
-          module = {
-            name = "pocket-id";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        nextcloud = {
-          module = {
-            name = "nextcloud";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        stirling-pdf = {
-          module = {
-            name = "stirling-pdf";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        actual-budget = {
-          module = {
-            name = "actual-budget";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        victoriametrics = {
-          module = {
-            name = "victoriametrics";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        vikunja = {
-          module = {
-            name = "vikunja";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        grafana = {
-          module = {
-            name = "grafana";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
-        paperless = {
-          module = {
-            name = "paperless";
-            input = "self";
-          };
-          roles.default.machines.b4l = { };
-        };
        pulse-stream = {
          module = {
            name = "pulse-stream";
@@ -18,9 +18,8 @@ in
        roles.peer.tags.emmie = { };
        roles.peer.settings = {
          folders = {
-            Syncthing = {
-              path = "${userhome}/Share/Syncthing";
-            };
+            Syncthing.path = "${userhome}/Share/Syncthing";
+            Desktop.path = "${userhome}/Desktop";
          };
          extraDevices = {
            pixel7a = {
@@ -29,6 +29,27 @@
    },
    "sirius": {
      "installedAt": 1770974584
+    },
+    "deneb": {
+      "installedAt": 1775718970
+    },
+    "canopus": {
+      "installedAt": 1775793532
+    },
+    "hadar": {
+      "installedAt": 1774427255
+    },
+    "procyon": {
+      "installedAt": 1775458442
+    },
+    "alasia": {
+      "installedAt": 1778661666
+    },
+    "bosona": {
+      "installedAt": 1779098893
+    },
+    "saturn": {
+      "installedAt": 1779766873
    }
  }
 }
@@ -8,6 +8,7 @@
  # clan.core.networking.targetHost = "root@";

  clan.core.settings.name = "adhil";
-  # clan.meta.description = "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";
+  clan.core.settings.machine.description =
+    "Raspberry Pi 4 SBC board for one of w phone network. (With w office)";

 }
@@ -0,0 +1,15 @@
+{
+  clan.core.settings.machine.description = "VM machine to host headplane instance";
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = false;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -8,6 +8,6 @@
  # clan.core.networking.targetHost = "root@";

  clan.core.settings.name = "almach";
-  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";

 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -8,6 +8,6 @@
  # clan.core.networking.targetHost = "root@";

  clan.core.settings.name = "alpheratz";
-  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";

 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -1,36 +0,0 @@
-{ inputs, config, ... }:
-{
-  imports = [
-    (inputs.import-tree ./services)
-  ];
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-  };
-  boot.loader.grub.devices = [ "/dev/disk/by-id/FIXME" ];
-  fileSystems = {
-    "/".device = "/dev/FIXME";
-  };
-  networking.fqdn = "b4l.co.th";
-  system.stateVersion = "25.11";
-  clan.core.sops.defaultGroups = [ "admins" ];
-
-  security.acme.defaults.email = "admin@b4l.co.th";
-  security.acme.acceptTerms = true;
-  services.nginx.virtualHosts."${config.networking.fqdn}" = {
-    enableACME = true;
-  };
-
-  clan.core.vars.generators.acme = {
-    share = true;
-    files.email.secret = false;
-
-    prompts.email = {
-      type = "line";
-      description = "Email for ACME registeration";
-    };
-
-    script = ''
-      cat $prompts/email > $out/email
-    '';
-  };
-}
@@ -1,36 +0,0 @@
-{ config, ... }:
-let
-  abDomain = "${config.clan.core.vars.generators.b4l-actual-budget.files.subdomain.value}.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.b4l-actual-budget = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Actual Budget app. Default:(budget)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo -n "budget" > $out/subdomain'';
-  };
-
-  services.actual = {
-    settings = {
-      allowedLoginMethods = [
-        "password"
-        "openid"
-      ];
-      trustedProxies = [ "127.0.0.1" ];
-    };
-  };
-  services.nginx.virtualHosts."${abDomain}" = {
-    useACMEHost = "${config.networking.fqdn}";
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.actual.settings.port}";
-    };
-  };
-}
@@ -1,79 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-with lib;
-let
-  serviceName = "${config.networking.hostName}-grafana";
-  gfDomain = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-
-  settingsFormatIni = pkgs.formats.ini {
-    listToValue = concatMapStringsSep " " (generators.mkValueStringDefault { });
-    mkKeyValue = generators.mkKeyValueDefault {
-      mkValueString = v: if v == null then "" else generators.mkValueStringDefault { } v;
-    } "=";
-  };
-  configFile = settingsFormatIni.generate "config.ini" config.services.grafana.settings;
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      adminpassword.secret = true;
-      subdomain.secret = false;
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Grafana. Default:(grafana)";
-      };
-      adminpassword = {
-        persist = true;
-        type = "hidden";
-        description = "Password for the admin user. Leave empty to auto-generate.";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "grafana" > "$out"/subdomain
-      fi
-
-      prompt_password=$(cat "$prompts"/adminpassword)
-      if [[ -n "''${prompt_password-}" ]]; then
-        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
-      else
-        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
-      fi
-    '';
-  };
-
-  systemd.services.grafana.serviceConfig.ExecStartPre = [
-    "+${pkgs.writeShellScript "grafana-set-password" ''
-      ${pkgs.grafana}/bin/grafana cli --homepath ${config.services.grafana.dataDir} --config ${configFile} admin reset-admin-password $(cat ${
-        config.clan.core.vars.generators."${serviceName}".files.adminpassword.path
-      })
-    ''}"
-  ];
-
-  services.nginx.virtualHosts."${gfDomain}" = {
-    forceSSL = true;
-    useACMEHost = "${config.networking.fqdn}";
-    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grafana.settings.server.http_port}";
-    };
-  };
-
-}
@@ -1,35 +0,0 @@
-{ config, pkgs, ... }:
-let
-  ncDomain = "${config.clan.core.vars.generators.b4l-nextcloud.files.subdomain.value}.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.b4l-nextcloud = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Nextcloud app. Default:(cloud)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo -n "cloud" > $out/subdomain'';
-  };
-
-  services.nextcloud = {
-    hostName = ncDomain;
-    package = pkgs.nextcloud32;
-
-    settings = {
-
-      overwriteprotocol = "https";
-      trusted_domains = [ ];
-      trusted_proxies = [ ];
-    };
-  };
-  services.nginx.virtualHosts."${ncDomain}" = {
-    useACMEHost = "${config.networking.fqdn}";
-    forceSSL = true;
-  };
-}
@@ -1,67 +0,0 @@
-{ config, pkgs, ... }:
-let
-  serviceName = "${config.networking.hostName}-paperless";
-  domain-name = "${
-    config.clan.core.vars.generators."${serviceName}".files.subdomain.value
-  }.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators."${serviceName}" = {
-    files = {
-      subdomain.secret = false;
-      adminpassword = {
-        secret = true;
-        owner = config.services.paperless.user;
-        group = config.services.paperless.user;
-      };
-    };
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Paperless. Default:(paperless)";
-      };
-      adminpassword = {
-        persist = true;
-        type = "hidden";
-        description = "Password for the admin user. Leave empty to auto-generate.";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "paperless" > "$out"/subdomain
-      fi
-
-      prompt_password=$(cat "$prompts"/adminpassword)
-      if [[ -n "''${prompt_password-}" ]]; then
-        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
-      else
-        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
-      fi
-    '';
-  };
-
-  environment.systemPackages = [ pkgs.toybox ];
-
-  services.paperless = {
-    passwordFile = config.clan.core.vars.generators."${serviceName}".files.adminpassword.path;
-  };
-
-  services.nginx.virtualHosts."${domain-name}" = {
-    forceSSL = true;
-    useACMEHost = "${config.networking.fqdn}";
-    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.paperless.port}";
-    };
-  };
-
-}
@@ -1,35 +0,0 @@
-{ config, ... }:
-let
-  pidDomain = "${config.clan.core.vars.generators.b4l-pocket-id.files.subdomain.value}.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.b4l-pocket-id = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Pocket-ID app. Default:(auth)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo -n "auth" > $out/subdomain'';
-  };
-
-  services.pocket-id = {
-    settings = {
-      APP_ENV = "production";
-      APP_URL = "https://${pidDomain}";
-      TRUST_PROXY = true;
-    };
-  };
-
-  services.nginx.virtualHosts."${pidDomain}" = {
-    useACMEHost = "${config.networking.fqdn}";
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.pocket-id.settings.PORT}";
-    };
-  };
-}
@@ -1,26 +0,0 @@
-{ config, ... }:
-let
-  stDomain = "${config.clan.core.vars.generators.b4l-stirling-pdf.files.subdomain.value}.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.b4l-stirling-pdf = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Stirling PDF app. Default:(pdf)";
-      };
-    };
-    script = ''cat $prompts/subdomain || echo -n "pdf" > $out/subdomain'';
-  };
-
-  services.nginx.virtualHosts."${stDomain}" = {
-    forceSSL = true;
-    useACMEHost = "${config.networking.fqdn}";
-    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.stirling-pdf.environment.SERVER_PORT}";
-    };
-  };
-}
@@ -1,73 +0,0 @@
-{ config, pkgs, ... }:
-let
-  vmDomain = "${config.clan.core.vars.generators.b4l-victoriametrics.files.subdomain.value}.${config.networking.fqdn}";
-in
-{
-  clan.core.vars.generators.b4l-victoriametrics = {
-    files.subdomain.secret = false;
-    files.adminuser.secret = false;
-    files.adminpassword.secret = true;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Victoria Metrics app. Default:(metrics)";
-      };
-      adminuser = {
-        persist = true;
-        type = "line";
-        description = "Username for an admin user. Default:(admin)";
-      };
-      adminpassword = {
-        persist = true;
-        type = "hidden";
-        description = "Password for the admin user. Leave empty to auto-generate.";
-      };
-    };
-
-    runtimeInputs = [
-      pkgs.xkcdpass
-      pkgs.coreutils
-    ];
-
-    script = ''
-      prompt_domain=$(cat "$prompts"/subdomain)
-      if [[ -n "''${prompt_domain-}" ]]; then
-        echo $prompt_domain | tr -d "\n" > "$out"/subdomain
-      else
-        echo -n "metrics" > "$out"/subdomain
-      fi
-
-      prompt_adminuser=$(cat "$prompts"/adminuser)
-      if [[ -n "''${prompt_adminuser-}" ]]; then
-        echo $prompt_adminuser | tr -d "\n" > "$out"/adminuser
-      else
-        echo -n "admin" > "$out"/adminuser
-      fi
-
-      prompt_password=$(cat "$prompts"/adminpassword)
-      if [[ -n "''${prompt_password-}" ]]; then
-        echo "$prompt_password" | tr -d "\n" > "$out"/adminpassword
-      else
-        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminpassword
-      fi
-    '';
-  };
-
-  services.victoriametrics = {
-    extraOptions = [
-      "-httpAuth.username=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminuser.path}"
-      "-httpAuth.password=file://${config.clan.core.vars.generators.b4l-victoriametrics.files.adminpassword.path}"
-    ];
-  };
-
-  services.nginx.virtualHosts."${vmDomain}" = {
-    forceSSL = true;
-    useACMEHost = "${config.networking.fqdn}";
-    locations."/" = {
-      proxyPass = "http://localhost${builtins.toString config.services.victoriametrics.listenAddress}";
-    };
-  };
-
-}
@@ -1,26 +0,0 @@
-{ config, ... }:
-{
-  clan.core.vars.generators.b4l-vikunja = {
-    files.subdomain.secret = false;
-
-    prompts = {
-      subdomain = {
-        persist = true;
-        type = "line";
-        description = "Sub-domain for Vikunja todo app. Default:(todo)";
-      };
-    };
-
-    script = ''cat $prompts/subdomain || echo "todo" > $out/subdomain'';
-  };
-  services.vikunja = {
-    frontendHostname = "${config.clan.core.vars.generators.b4l-vikunja.files.subdomain.value}.${config.networking.fqdn}";
-  };
-  services.nginx.virtualHosts."${config.services.vikunja.frontendHostname}" = {
-    useACMEHost = "${config.networking.fqdn}";
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "${config.services.vikunja.frontendScheme}://${config.services.vikunja.frontendHostname}:${builtins.toString config.services.vikunja.port}";
-    };
-  };
-}
@@ -0,0 +1,105 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+let
+  sitename = "tempoerp.newedge.house";
+in
+{
+  clan.core.settings.machine.description = "VM machine that host ERPNext for tempo";
+  imports = [
+    inputs.frappix.nixosModules.x86_64-linux.frappix
+  ];
+  nixpkgs.overlays = [
+    inputs.self.overlays.frappixFrappeOverlay
+    inputs.self.overlays.frappixLibsOverlay
+    inputs.self.overlays.frappixPythonOverlay
+    inputs.self.overlays.frappixToolsOverlay
+  ];
+
+  clan.core.vars.generators.frappix = {
+    files = {
+      sslCertificate.secret = false;
+      sslCertificateKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      adminPassword.secret = true;
+    };
+    runtimeInputs = with pkgs; [
+      openssl
+      xkcdpass
+    ];
+    script = ''
+      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
+    '';
+  };
+
+  services.frappe = {
+    enable = true;
+    project = "poyerp";
+    gunicorn_workers = 2;
+    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
+    apps = [
+      pkgs.frappix.erpnext
+      pkgs.frappix.hrms
+      pkgs.frappix.crm
+    ];
+    sites = {
+      "${sitename}" = {
+        domains = [ sitename ];
+        apps = [
+          "frappe"
+          "erpnext"
+          "hrms"
+          "crm"
+        ];
+      };
+    };
+  };
+  services.nginx.virtualHosts."${sitename}" = {
+    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
+    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
+  };
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -8,6 +8,7 @@
  # clan.core.networking.targetHost = "root@";

  clan.core.settings.name = "buna";
-  # clan.meta.description = "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";
+  clan.core.settings.machine.description =
+    "Radxa X4 SBC board for one of w phone network. (With w whitehouse)";

 }
@@ -0,0 +1,110 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+let
+  sitename = "glomerp.newedge.house";
+  nbClientName = "netbird-b4l";
+in
+{
+  clan.core.settings.machine.description = "VM machine that host ERPNext for glomglom";
+
+  imports = [ inputs.frappix.nixosModules.x86_64-linux.frappix ];
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+    inputs.self.overlays.frappixFrappeOverlay
+    inputs.self.overlays.frappixLibsOverlay
+    inputs.self.overlays.frappixPythonOverlay
+    inputs.self.overlays.frappixToolsOverlay
+  ];
+
+  clan.core.vars.generators.frappix = {
+    files = {
+      sslCertificate.secret = false;
+      sslCertificateKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      adminPassword.secret = true;
+    };
+    runtimeInputs = with pkgs; [
+      openssl
+      xkcdpass
+    ];
+    script = ''
+      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
+    '';
+  };
+
+  services.frappe = {
+    enable = true;
+    project = "glomerp";
+    gunicorn_workers = 2;
+    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
+    apps = [
+      pkgs.frappix.erpnext
+      pkgs.frappix.hrms
+    ];
+    sites = {
+      "${sitename}" = {
+        domains = [ sitename ];
+        apps = [
+          "frappe"
+          "erpnext"
+          "hrms"
+        ];
+      };
+    };
+  };
+  services.nginx.virtualHosts."${sitename}" = {
+    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
+    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
+  };
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -1,4 +1,8 @@
-{ inputs, self, ... }:
+{
+  inputs,
+  self,
+  ...
+}:
 {
  imports = [
    inputs.clan-core.flakeModules.default
@@ -0,0 +1,119 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+let
+  sitename = "poyerp.newedge.house";
+in
+{
+  clan.core.settings.machine.description = "VM machine that host ERPNext for poysound";
+  imports = [
+    inputs.frappix.nixosModules.x86_64-linux.frappix
+
+    # (import ../../lib/auto-accept-zerotier-members.nix {
+    #   memberIds = [
+    #     # Alex Caddy gateway
+    #     "dbe44c0287"
+    #     "e3d6559697"
+    #   ];
+    # })
+  ];
+  nixpkgs.overlays = [
+    inputs.self.overlays.frappixFrappeOverlay
+    inputs.self.overlays.frappixLibsOverlay
+    inputs.self.overlays.frappixPythonOverlay
+    inputs.self.overlays.frappixToolsOverlay
+  ];
+
+  clan.core.vars.generators.frappix = {
+    files = {
+      sslCertificate.secret = false;
+      sslCertificateKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      adminPassword.secret = true;
+    };
+    runtimeInputs = with pkgs; [
+      openssl
+      xkcdpass
+    ];
+    script = ''
+      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=kurogeek/CN=kurogeek.home" 
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
+    '';
+  };
+
+  services.frappe = {
+    enable = true;
+    project = "poyerp";
+    gunicorn_workers = 2;
+    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
+    apps = [
+      pkgs.frappix.erpnext
+      pkgs.frappix.hrms
+      pkgs.frappix.crm
+    ];
+    sites = {
+      "${sitename}" = {
+        domains = [ sitename ];
+        apps = [
+          "frappe"
+          "erpnext"
+          "hrms"
+          "crm"
+        ];
+      };
+    };
+  };
+  services.nginx.virtualHosts."${sitename}" = {
+    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
+    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
+  };
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -0,0 +1,100 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
+let
+  domain = "poy-inventory.newedge.house";
+in
+{
+  clan.core.settings.machine.description = "VM machine that host Inventree system for Poy";
+  imports = [
+    inputs.self.nixosModules.inventree
+  ];
+
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.inventree = {
+    files = {
+      secret-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      oidc-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      admin-password = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+    };
+    runtimeInputs = [
+      pkgs.pwgen
+      pkgs.xkcdpass
+    ];
+    script = ''
+      pwgen -s 32 1 > $out/secret-key
+      pwgen -s 32 1 > $out/oidc-key
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/admin-password
+    '';
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  services.inventree = {
+    enable = true;
+    hostName = "${domain}";
+    config.site_url = "https://${config.services.inventree.hostName}";
+    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
+    config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
+  };
+
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -8,6 +8,6 @@
  # clan.core.networking.targetHost = "root@";

  clan.core.settings.name = "mirach";
-  # clan.meta.description = "Radxa X4 SBC board for one of w phone network.";
+  clan.core.settings.machine.description = "Radxa X4 SBC board for one of w phone network.";

 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -57,6 +57,6 @@
  ];

  clan.core.settings.name = "neptune";
-  # clan.meta.description = "Radxa SBC board for testing. (With vi)";
+  clan.core.settings.machine.description = "Radxa SBC board for testing. (With vi)";

 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -9,4 +9,5 @@
  };
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
+  clan.core.settings.machine.description = "A personal computer for Chocolate Shop";
 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -0,0 +1,100 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}:
+let
+  domain = "glom-inventory.newedge.house";
+in
+{
+  clan.core.settings.machine.description = "VM machine that host Inventree system for Glom";
+  imports = [
+    inputs.self.nixosModules.inventree
+  ];
+
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+  ];
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.inventree = {
+    files = {
+      secret-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      oidc-key = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+      admin-password = {
+        owner = "inventree";
+        group = "inventree";
+        secret = true;
+      };
+    };
+    runtimeInputs = [
+      pkgs.pwgen
+      pkgs.xkcdpass
+    ];
+    script = ''
+      pwgen -s 32 1 > $out/secret-key
+      pwgen -s 32 1 > $out/oidc-key
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/admin-password
+    '';
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  services.inventree = {
+    enable = true;
+    hostName = "${domain}";
+    config.site_url = "https://${config.services.inventree.hostName}";
+    secretKeyFile = config.clan.core.vars.generators.inventree.files.secret-key.path;
+    config.oidc_private_key_file = config.clan.core.vars.generators.inventree.files.oidc-key.path;
+    config.adminPasswordFile = config.clan.core.vars.generators.inventree.files.admin-password.path;
+  };
+
+  # services.nginx.virtualHosts."${domain}" = {
+  #   forceSSL = true;
+  #   sslCertificate = config.clan.core.vars.generators.nginx.files.sslCert.path;
+  #   sslCertificateKey = config.clan.core.vars.generators.nginx.files.sslKey.path;
+  # };
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -6,9 +6,7 @@
  };

  clan.core.settings.name = "ramus";
-  # clan.meta.description = ''
-  #   A Hetzner VPS machine own by Alex.
-  # '';
+  clan.core.settings.machine.description = "A Hetzner VPS machine own by Alex.";

  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -1,5 +1,7 @@
-{ self, ... }:
+{ self, pkgs, ... }:
 {
+  clan.core.settings.machine.description = "Emmie personal computer";
+
  imports = [
    self.nixosModules.common
  ];
@@ -9,4 +11,12 @@
  };
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
+
+  boot.kernelParams = [
+    "amdgpu.dcdebugmask=0x10"
+    "amdgpu.cwsr_enable=0"
+    "amdgpu.gpu_recovery=1"
+  ];
+
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
 }
@@ -14,6 +14,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -13,4 +13,6 @@
  system.stateVersion = "25.11";
  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";
+
+  clan.core.settings.machine.description = "Zima board computer for testing in B4L";
 }
@@ -0,0 +1,107 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
+let
+  sitename = "test.newedge.house";
+in
+{
+  clan.core.settings.machine.description = "VM machine for test things";
+
+  imports = [ inputs.frappix.nixosModules.x86_64-linux.frappix ];
+  nixpkgs.overlays = [
+    inputs.self.overlays.packagesOverlay
+    inputs.self.overlays.frappixFrappeOverlay
+    inputs.self.overlays.frappixLibsOverlay
+    inputs.self.overlays.frappixPythonOverlay
+    inputs.self.overlays.frappixToolsOverlay
+  ];
+
+  clan.core.vars.generators.frappix = {
+    files = {
+      sslCertificate.secret = false;
+      sslCertificateKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      adminPassword.secret = true;
+    };
+    runtimeInputs = with pkgs; [
+      openssl
+      xkcdpass
+    ];
+    script = ''
+      openssl req -x509 -newkey rsa:4096 -keyout $out/sslCertificateKey -out $out/sslCertificate -sha256 -days 3650 -nodes -subj "/C=TH/ST=ChiangMai/L=ChiangMai/O=localhost/CN=localhost" 
+      xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/adminPassword
+    '';
+  };
+
+  services.frappe = {
+    enable = true;
+    project = "glomerp";
+    gunicorn_workers = 2;
+    adminPassword = config.clan.core.vars.generators.frappix.files.adminPassword.path;
+    apps = [
+      pkgs.frappix.erpnext
+      pkgs.frappix.hrms
+      pkgs.erpnext_thailand
+      pkgs.thai_payroll
+    ];
+    sites = {
+      "${sitename}" = {
+        domains = [ sitename ];
+        apps = [
+          "frappe"
+          "erpnext"
+          "hrms"
+          "erpnext_thailand"
+          "thai_payroll"
+        ];
+      };
+    };
+  };
+  services.nginx.virtualHosts."${sitename}" = {
+    sslCertificate = config.clan.core.vars.generators.frappix.files.sslCertificate.path;
+    sslCertificateKey = config.clan.core.vars.generators.frappix.files.sslCertificateKey.path;
+  };
+
+  nixpkgs.hostPlatform = {
+    system = "x86_64-linux";
+  };
+
+  clan.core.vars.generators.nginx = {
+    files = {
+      sslCert = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+      sslKey = {
+        owner = "nginx";
+        group = "nginx";
+        secret = true;
+      };
+    };
+
+    runtimeInputs = [
+      pkgs.openssl
+    ];
+    script = ''
+      openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout $out/sslKey \
+        -out $out/sslCert \
+        -subj "/CN=localhost"
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  system.stateVersion = "25.11";
+  clan.core.sops.defaultGroups = [ "admins" ];
+}
@@ -0,0 +1,85 @@
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
+in
+{
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
+  disko.devices = {
+    disk = {
+      "os-${hashDisk os}" = {
+        type = "disk";
+        device = os;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "nofail" ];
+              };
+            };
+            system = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          mountpoint = "none";
+          compression = "lz4";
+          acltype = "posixacl";
+          xattr = "sa";
+          "com.sun:auto-snapshot" = "true";
+        };
+        options.ashift = "12";
+        datasets = {
+          "root" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
+            mountpoint = "/";
+          };
+          "root/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
+          };
+          "root/tmp" = {
+            type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -1,5 +1,6 @@
 {
  self,
+  pkgs,
  ...
 }:
 {
@@ -15,6 +16,8 @@
    ];
  };

+  clan.core.settings.machine.description = "w NAS";
+
  clan.core.sops.defaultGroups = [ "admins" ];

  nixpkgs.hostPlatform = {
@@ -42,6 +45,8 @@
  boot.loader.grub.enable = false;
  boot.loader.generic-extlinux-compatible.enable = true;

+  boot.zfs.forceImportRoot = false;
+
  boot.zfs.extraPools = [ "zdata" ];
  boot.supportedFilesystems = [ "zfs" ];
  boot.initrd.availableKernelModules = [
@@ -70,4 +75,22 @@
    ];
  };

+  systemd.services.heartbeat-push = {
+    description = "Heartbeat push to uptime monitor";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.curl}/bin/curl -s -o /dev/null https://uptime.b4l.co.th/api/push/X0WCHAcY5gPf1U8If7BT1FLjpacZqGZu?status=up&msg=OK&ping=";
+    };
+  };
+
+  systemd.timers.heartbeat-push = {
+    description = "Heartbeat push timer";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "60s";
+      OnUnitActiveSec = "60s";
+      Unit = "heartbeat-push.service";
+    };
+  };
+
 }
@@ -22,6 +22,8 @@
  clan.core.sops.defaultGroups = [ "admins" ];
  clan.core.networking.targetHost = "root@[${config.clan.core.vars.generators.zerotier.files.zerotier-ip.value}]";

+  clan.core.settings.machine.description = "Glom NAS";
+
  nixpkgs.hostPlatform = {
    system = "x86_64-linux";
  };
@@ -18,6 +18,8 @@ in
    };
  };

+  boot.zfs.forceImportRoot = true;
+
  disko.devices = {
    disk = {
      "os-${hashDisk os}" = {
@@ -5,6 +5,7 @@
  name = "service-actual-budget";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -20,6 +20,7 @@
    '';

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -0,0 +1,182 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "headscale";
+  manifest.description = "An open source, self-hosted implementation of the Tailscale control server";
+  manifest.readme = "An open source, self-hosted implementation of the Tailscale control server";
+  manifest.categories = [ "System" ];
+
+  roles.server = {
+    description = "A server role";
+
+    interface =
+      { lib, config, ... }:
+      {
+        options = {
+          public_url = lib.mkOption {
+            type = with lib.types; nullOr str;
+            default = config.services.headscale.settings.server_url;
+            description = "Public URL for accessing the instance";
+          };
+
+          base_domain = lib.mkOption {
+            type = with lib.types; str;
+            default = "";
+            description = "Defines the base domain to create the hostnames for MagicDNS in Headscale. `base_domain` must be a FQDN, without the trailing dot. The FQDN of the hosts will be `hostname.base_domain (e.g. myhost.tailnet.example.com)";
+          };
+
+          advertise_routes = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [ ];
+            description = "Expose physical subnet routes to your entire Tailscale network.";
+            example = [ "192.168.1.0/24" ];
+          };
+
+          nameservers = lib.mkOption {
+            type = with lib.types; listOf str;
+            default = [
+              "1.1.1.1"
+              "8.8.8.8"
+            ];
+            description = "List of nameservers to pass to Tailscale clients";
+            example = [ "10.0.10.1" ];
+          };
+        };
+      };
+
+    perInstance =
+      { settings, ... }:
+      {
+        nixosModule =
+          {
+            config,
+            pkgs,
+            lib,
+            ...
+          }:
+          let
+            preAuthKeyFile = "/var/lib/headscale/preauth.key";
+
+            routes = lib.concatStringsSep "," settings.advertise_routes;
+          in
+          {
+
+            systemd.services.headscale-auto-enroll =
+              let
+                serverUser = "hcserver";
+              in
+              {
+                description = "Enroll this machine into headscale automatically";
+                after = [
+                  "headscale.service"
+                  "tailscaled.service"
+                ];
+                requires = [
+                  "headscale.service"
+                  "tailscaled.service"
+                ];
+                wantedBy = [ "multi-user.target" ];
+
+                serviceConfig = {
+                  Type = "oneshot";
+                  RemainAfterExit = true;
+                  User = "root";
+                };
+
+                path = [ pkgs.jq ];
+
+                script = ''
+                  set -euo pipefail
+
+                  if ${pkgs.tailscale}/bin/tailscale status &>/dev/null; then
+                    echo "Already enrolled, skipping."
+                    exit 0
+                  fi
+
+                  for i in $(seq 1 30); do
+                    ${pkgs.headscale}/bin/headscale users list &>/dev/null && break
+                    sleep 1
+                  done
+
+                  ${pkgs.headscale}/bin/headscale users create ${serverUser} 2>/dev/null || true
+
+                  USER_ID=$(${pkgs.headscale}/bin/headscale users list --name ${serverUser} -o json | jq '.[0].id')
+
+                  KEY=$(${pkgs.headscale}/bin/headscale preauthkeys create \
+                    --user $USER_ID \
+                    --reusable \
+                    --expiration 30m \
+                    --output json | ${pkgs.jq}/bin/jq -r '.key')
+
+                  echo "$KEY" > ${preAuthKeyFile}
+                  chmod 600 ${preAuthKeyFile}
+
+                  ${pkgs.tailscale}/bin/tailscale up \
+                    --login-server=https://${settings.public_url} \
+                    --authkey="$KEY" \
+                    --accept-routes \
+                    --advertise-routes=${routes}
+                '';
+              };
+
+            systemd.services.headscale-approve-routes = {
+              description = "Auto approve routes";
+              after = [
+                "headscale.service"
+                "tailscaled.service"
+                "headscale-auto-enroll.service"
+              ];
+              requires = [
+                "headscale.service"
+                "tailscaled.service"
+                "headscale-auto-enroll.service"
+              ];
+
+              path = [ pkgs.jq ];
+
+              wantedBy = [ "multi-user.target" ];
+
+              serviceConfig = {
+                Type = "oneshot";
+                User = "root";
+              };
+
+              script = ''
+                set -euo pipefail
+                NODE_ID=$(${pkgs.tailscale}/bin/tailscale status --json | jq '.Self.ID' | tr -d '"')
+                ${pkgs.headscale}/bin/headscale node approve-routes --identifier $NODE_ID --routes ${routes}
+              '';
+
+            };
+
+            systemd.services.tailscaled-autoconnect.after = [
+              "tailscaled.service"
+              "headscale-auto-enroll.service"
+            ];
+
+            services.tailscale = {
+              enable = true;
+              useRoutingFeatures = "server";
+              openFirewall = true;
+            };
+
+            networking.firewall.allowedTCPPorts = [
+              config.services.headscale.port
+            ];
+
+            services.headscale = {
+              enable = true;
+              address = "0.0.0.0";
+              settings.server_url = "https://${settings.public_url}";
+
+              settings.dns = {
+                base_domain = settings.base_domain;
+                override_local_dns = true;
+                nameservers.global = settings.nameservers;
+              };
+            };
+
+          };
+      };
+  };
+}
@@ -0,0 +1,19 @@
+{ self, inputs, ... }:
+let
+  module = ./default.nix;
+in
+{
+  clan.modules = {
+    headscale = module;
+  };
+  # perSystem =
+  #   { ... }:
+  #   {
+  #     clan.nixosTests.service-headplane = {
+  #       imports = [ ./tests/vm/default.nix ];
+  #       _module.args = { inherit self inputs; };
+  #
+  #       clan.modules."@clan/headplane" = module;
+  #     };
+  #   };
+}
@@ -5,6 +5,7 @@
  name = "service-nextcloud";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -5,6 +5,7 @@
  name = "service-paperless";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -22,11 +22,27 @@ let

 in
 {
+  environment.systemPackages = [ pkgs.simple-scan ];
+  nixpkgs.config.allowUnfreePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "brgenml1lpr"
+      "cups-brother-dcpt310"
+      "cups-brother-dcpt720dw"
+      "cups-brother-dcpt725dw"
+    ];
+  # nixpkgs.config.allowUnfree = true;
+  services.ipp-usb.enable = true;
  services.printing = {
    enable = true;
    drivers = [
      pkgs.brlaser
      pkgs.gutenprint
+      pkgs.brgenml1lpr
+      pkgs.brgenml1cupswrapper
+      pkgs.cups-brother-dcpt310
+      pkgs.cups-brother-dcpt720dw
+      pkgs.cups-brother-dcpt725dw
    ];

    extraFilesConf = ''
@@ -21,6 +21,7 @@
    '';

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -3,6 +3,7 @@
  name = "service-pocket-id";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -23,6 +23,7 @@ in
    '';

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -5,6 +5,7 @@
  name = "service-stirling-pdf";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -5,6 +5,7 @@
  name = "service-victoriametrics";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -6,6 +6,7 @@
  name = "service-vikunja";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -5,6 +5,7 @@
  name = "service-yggdrasil";

  clan = {
+    test.useContainers = false;
    directory = ./.;
    inventory = {
      machines.server = { };
@@ -0,0 +1,5 @@
+{
+  flake.nixosModules = {
+    inventree = import ../nixos/inventree;
+  };
+}
@@ -0,0 +1,334 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    ;
+
+  configFormat = pkgs.formats.json { };
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+  configFile = "${cfg.dataDir}/config.json";
+
+  env = {
+    INVENTREE_CONFIG_FILE = configFile;
+    INVENTREE_SECRET_KEY_FILE = cfg.secretKeyFile;
+    INVENTREE_AUTO_UPDATE = "1";
+    INVENTREE_PLUGINS_ENABLED = "1";
+    INVENTREE_PLUGIN_NOINSTALL = "0";
+    INVENTREE_STATIC_ROOT = cfg.config.static_root;
+    INVENTREE_MEDIA_ROOT = cfg.config.media_root;
+    INVENTREE_BACKUP_DIR = cfg.config.backup_dir;
+    INVENTREE_OIDC_PRIVATE_KEY_FILE = cfg.config.oidc_private_key_file;
+    INVENTREE_DB_ENGINE = cfg.config.database.ENGINE;
+    INVENTREE_DB_NAME = cfg.config.database.NAME;
+    INVENTREE_DB_HOST = cfg.config.database.HOST;
+    INVENTREE_DB_USER = "inventree";
+    INVENTREE_ADMIN_USER = cfg.config.adminUser;
+    INVENTREE_ADMIN_PASSWORD_FILE = cfg.config.adminPasswordFile;
+    INVENTREE_USE_X_FORWARDED_HOST = "1";
+    INVENTREE_CORS_ORIGIN_ALLOW_ALL = "1";
+    INVENTREE_FRONTEND_SETTINGS = ''{"mobile_mode":"allow-always"}'';
+
+    INVENTREE_SITE_URL = cfg.config.site_url;
+
+    PYTHONPATH = pkg.pythonPath;
+  };
+
+  inventree-invoke = pkgs.writeShellApplication {
+    name = "inventree-invoke";
+    text = ''
+      export INVENTREE_CONFIG_FILE=${configFile}
+      export INVENTREE_SECRET_KEY_FILE=${cfg.secretKeyFile}
+      export PYTHONPATH=${pkg.pythonPath}
+
+      exec -a "$0" ${pkgs.python3Packages.invoke}/bin/invoke -r ${cfg.package}/opt/inventree "$@"
+    '';
+  };
+in
+{
+  options.services.inventree = {
+    enable = mkEnableOption "InvenTree parts manager";
+
+    package = lib.mkOption {
+      type = types.package;
+      default = pkgs.inventree;
+      description = ''
+        InvenTree package to use
+      '';
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      description = "FQDN for the InvenTree instance.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/inventree";
+      example = "/var/lib/inventree";
+      description = ''
+        The default path for all inventree data.
+      '';
+    };
+
+    secretKeyFile = mkOption {
+      type = types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    config = mkOption {
+      type = types.submodule ({
+        freeformType = configFormat.type;
+        options = {
+          adminUser = mkOption {
+            type = types.str;
+            default = "admin";
+          };
+          adminPasswordFile = mkOption {
+            type = types.path;
+            description = "Path to password file for user `admin`";
+          };
+          site_url = mkOption {
+            type = types.str;
+            default = "https://${cfg.hostName}";
+          };
+          static_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/static";
+            description = ''
+              Static file storage
+            '';
+          };
+          media_root = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/media_root";
+            description = "Media root directory";
+          };
+          backup_dir = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/backups";
+            description = "Backup directory";
+          };
+          oidc_private_key_file = mkOption {
+            type = types.path;
+            default = "${cfg.dataDir}/oidc.key";
+          };
+        };
+      });
+      default = { };
+      description = ''
+        Config options, see https://docs.inventree.org/en/stable/start/config/
+        for details
+      '';
+    };
+
+    serverStartTimeout = mkOption {
+      type = types.str;
+      default = "10min";
+      description = ''
+        TimeoutStartSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStartSec=
+        for more details
+      '';
+    };
+
+    serverStopTimeout = mkOption {
+      type = types.str;
+      default = "5min";
+      description = ''
+        TimeoutStopSec for the server systemd service.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#TimeoutStopSec=
+        for more details
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ inventree-invoke ];
+
+    systemd.tmpfiles.rules = (
+      map (dir: "d ${dir} 0755 inventree inventree") [
+        "${cfg.dataDir}"
+        "${cfg.dataDir}/static"
+        "${cfg.dataDir}/media_root"
+        "${cfg.dataDir}/backups"
+      ]
+    );
+
+    services.inventree.config = {
+      plugins_enabled = false;
+      plugin_file = "${cfg.dataDir}/plugins.txt";
+      plugin_dir = "${cfg.dataDir}/plugins";
+      database = {
+        ENGINE = "postgresql";
+        NAME = "inventree";
+        HOST = "/run/postgresql";
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "inventree" ];
+      ensureUsers = [
+        {
+          name = "inventree";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    users.users.inventree = {
+      group = "inventree";
+      isSystemUser = true;
+      description = "InvenTree daemon user";
+    };
+
+    users.groups.inventree = { };
+
+    services.nginx.enable = true;
+
+    services.nginx.virtualHosts.${cfg.hostName} = {
+      locations =
+        let
+          unixPath = config.systemd.sockets.inventree-gunicorn.socketConfig.ListenStream;
+        in
+        {
+          "/" = {
+            extraConfig = ''
+              client_max_body_size 100M;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            '';
+            proxyPass = "http://unix:${unixPath}";
+          };
+          "/static/" = {
+            alias = "${cfg.config.static_root}/";
+            extraConfig = ''
+              expires 30d;
+            '';
+          };
+          "/media/" = {
+            alias = "${cfg.config.media_root}/";
+            extraConfig = ''
+              auth_request /auth;
+            '';
+          };
+          "/auth" = {
+            extraConfig = ''
+              internal;
+            '';
+            proxyPass = "http://unix:${unixPath}:/auth/";
+          };
+        };
+    };
+
+    systemd.targets.inventree = {
+      description = "Target for all InvenTree services";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+    };
+
+    systemd.services.inventree-config = {
+      description = "Inventree config generation";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [
+        "inventree-static.service"
+        "inventree-gunicorn.service"
+        "inventree-qcluster.service"
+      ];
+      serviceConfig = {
+        # User = "root";
+        # Group = "root";
+        User = "inventree";
+        Group = "inventree";
+        Type = "oneshot";
+        RemainAfterExit = true;
+        PrivateTmp = true;
+      };
+      environment = env;
+      script = ''
+        set -euo pipefail
+
+        umask u=rwx,g=,o=
+
+        # chown inventree:inventree ${configFile}
+
+        ${pkg}/opt/inventree/src/backend/InvenTree/manage.py migrate
+      '';
+    };
+
+    systemd.services.inventree-static = {
+      description = "InvenTree static migration";
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      before = [ "inventree-gunicorn.service" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py collectstatic  --no-input
+        '';
+      };
+    };
+
+    systemd.services.inventree-gunicorn = {
+      description = "InvenTree Gunicorn server";
+      requiredBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      #wantedBy = [ "inventree.target" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg.gunicorn}/bin/gunicorn InvenTree.wsgi \
+            --pythonpath ${pkg}/opt/inventree/src/backend/InvenTree
+        '';
+      };
+    };
+
+    systemd.sockets.inventree-gunicorn = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "inventree.target" ];
+      socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+    };
+
+    systemd.services.inventree-qcluster = {
+      description = "InvenTree qcluster server";
+      requiredBy = [ "inventree.target" ];
+      wantedBy = [ "inventree.target" ];
+      partOf = [ "inventree.target" ];
+      environment = env;
+      serviceConfig = {
+        User = "inventree";
+        Group = "inventree";
+        StateDirectory = "inventree";
+        #RuntimeDirectory = "inventree";
+        PrivateTmp = true;
+        ExecStart = ''
+          ${pkg}/opt/inventree/src/backend/InvenTree/manage.py qcluster
+        '';
+      };
+    };
+  };
+}
@@ -1,6 +1,11 @@
-{ ... }:
+{ inputs, ... }:
 {
  flake.overlays = {
    packagesOverlay = import ../pkgs/overlay.nix;
+
+    frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
+    frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;
+    frappixPythonOverlay = inputs.frappix.pythonOverlay.x86_64-linux;
+    frappixToolsOverlay = inputs.frappix.toolsOverlay.x86_64-linux;
  };
 }
@@ -0,0 +1,37 @@
+{
+  buildPythonPackage,
+  pythonRelaxDepsHook,
+  flit-core,
+  fetchFromGitHub,
+  mkAssets,
+  pandas,
+}:
+buildPythonPackage (finalAttrs: {
+
+  pname = "erpnext_thailand";
+  version = "1.0.2";
+  format = "pyproject";
+
+  src =
+    let
+      erpnext_thailand_src = fetchFromGitHub {
+        owner = "ecosoft-frappe";
+        repo = "erpnext_thailand";
+        rev = "69ebd41b6e616a96677f79f57019a4bcd310b638";
+        hash = "sha256-72acMrJQKEQKp/u3gcUSBZ6mYbAKCD240j2zMARwUEc=";
+      };
+    in
+    mkAssets {
+      src = erpnext_thailand_src;
+      inherit (finalAttrs) pname version;
+      yarnHash = "";
+    };
+
+  dependencies = [ pandas ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    flit-core
+  ];
+
+})
@@ -0,0 +1,37 @@
+{
+  buildPythonPackage,
+  pythonRelaxDepsHook,
+  flit-core,
+  fetchFromGitHub,
+  mkAssets,
+  pandas,
+}:
+buildPythonPackage (finalAttrs: {
+
+  pname = "thai_payroll";
+  version = "0.0.1";
+  format = "pyproject";
+
+  src =
+    let
+      erpnext_thailand_src = fetchFromGitHub {
+        owner = "ecosoft-frappe";
+        repo = "thai_payroll";
+        rev = "c3ceefb0fc6f29ed05c1086bb6dfb4eeaf59f779";
+        hash = "sha256-tYJU6EmIqa8hZ1eNaOVvJUjg8S+ANqZVAqWnnjY/2oY=";
+      };
+    in
+    mkAssets {
+      src = erpnext_thailand_src;
+      inherit (finalAttrs) pname version;
+      yarnHash = "";
+    };
+
+  dependencies = [ pandas ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    flit-core
+  ];
+
+})
@@ -0,0 +1,161 @@
+{
+  stdenvNoCC,
+  python3,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  nodejs,
+}:
+let
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "inventree";
+    repo = "InvenTree";
+    tag = "${version}";
+    hash = "sha256-GAATo5zkkNCes9fCQsYUsZ9auhgYEUnevN4obWj3ZRA=";
+  };
+
+  frontend = stdenvNoCC.mkDerivation {
+    name = "inventree-frontend";
+    inherit version src;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${src}/src/frontend/yarn.lock";
+      hash = "sha256-Ijbkx+INZgsvMhkzo8h/FUY75W3UHnKAdUjQRD8kJZw=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    patchPhase = ''
+      runHook prePatch
+      cd src/frontend
+      runHook postPatch
+    '';
+
+    buildPhase = ''
+      echo "Running lingui"
+      ./node_modules/.bin/lingui compile --typescript
+      echo building lib
+      ./node_modules/.bin/tsc --p ./tsconfig.lib.json
+      ./node_modules/.bin/vite --config vite.lib.config.ts build
+      echo "Running tsc"
+      ./node_modules/.bin/tsc
+      echo "Running vite"
+      ./node_modules/.bin/vite build --emptyOutDir --outDir $out
+    '';
+  };
+
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "InvenTree";
+  inherit version src;
+
+  format = "other";
+
+  dependencies =
+    with python3.pkgs;
+    [
+      coreapi
+      cryptography
+      distutils
+      dj-rest-auth
+      django
+      django-allauth
+      django-allauth.optional-dependencies.openid
+      django-allauth.optional-dependencies.mfa
+      django-allauth.optional-dependencies.socialaccount
+      django-cleanup
+      django-cors-headers
+      django-dbbackup
+      django-error-report-2
+      django-filter
+      django-flags
+      django-formtools
+      django-ical
+      django-js-asset
+      django-maintenance-mode
+      django-markdownify
+      django-money
+      django-mptt
+      django-mailbox
+      django-anymail
+      django-redis
+      django-oauth-toolkit
+      django-otp
+      django-q-sentry
+      django-q2
+      django-redis
+      django-sesame
+      django-sql-utils
+      django-structlog
+      django-stdimage
+      django-taggit
+      django-user-sessions
+      django-weasyprint
+      djangorestframework
+      djangorestframework-simplejwt
+      djangorestframework-simplejwt.optional-dependencies.crypto
+      django-xforwardedfor-middleware
+      django-storages
+      drf-spectacular
+      dulwich
+      feedparser
+      gunicorn
+      pdf2image
+      pillow
+      pint
+      pip-licenses
+      pypdf
+      python-barcode
+      python-barcode.optional-dependencies.images
+      python-dotenv
+      pyyaml
+      qrcode
+      qrcode.optional-dependencies.pil
+      rapidfuzz
+      sentry-sdk
+      tablib
+      tablib.optional-dependencies.xls
+      tablib.optional-dependencies.xlsx
+      tablib.optional-dependencies.yaml
+      weasyprint
+      whitenoise
+
+      psycopg2
+      fido2
+
+      opentelemetry-api
+      opentelemetry-sdk
+      opentelemetry-exporter-otlp
+      opentelemetry-instrumentation-django
+      opentelemetry-instrumentation-requests
+      opentelemetry-instrumentation-redis
+      opentelemetry-instrumentation-sqlite3
+      opentelemetry-instrumentation-system-metrics
+      opentelemetry-instrumentation-wsgi
+    ]
+    ++ django-anymail.optional-dependencies.amazon-ses;
+
+  installPhase = ''
+    substituteInPlace src/backend/InvenTree/InvenTree/settings.py --replace-fail "django_slowtests.testrunner.DiscoverSlowestTestsRunner" "django.test.runner.DiscoverRunner"
+
+    mkdir -p $out/opt/inventree
+    cp -r . $out/opt/inventree
+
+    echo "Installing frontend"
+
+    mkdir -p $out/opt/inventree/src/backend/InvenTree/web/static/web
+    cp -r ${frontend}/* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+    cp -r ${frontend}/.* $out/opt/inventree/src/backend/InvenTree/web/static/web/
+  '';
+
+  passthru = {
+    pythonPath = python3.pkgs.makePythonPath dependencies;
+    gunicorn = python3.pkgs.gunicorn;
+    inherit frontend;
+  };
+}
@@ -2,4 +2,30 @@ final: prev: {
  think-gtcm = final.callPackage ./think-gtcm.nix { };
  think-backend-gtcm = final.callPackage ./think-backend-gtcm.nix { php = final.php83; };
  gtcm-file-uploader = final.callPackage ./gtcm-file-uploader.nix { };
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (py-final: py-prev: {
+      django-dbbackup = py-final.callPackage ./python/django-dbbackup { };
+      django-error-report-2 = py-final.callPackage ./python/django-error-report-2 { };
+      django-flags = py-final.callPackage ./python/django-flags { };
+      django-ical = py-final.callPackage ./python/django-ical { };
+      django-markdownify = py-final.callPackage ./python/django-markdownify { };
+      django-money = py-final.callPackage ./python/django-money { };
+      django-q-sentry = py-final.callPackage ./python/django-q-sentry { };
+      django-recurrence = py-final.callPackage ./python/django-recurrence { };
+      django-slowtests = py-final.callPackage ./python/django-slowtests { };
+      django-structlog = py-final.callPackage ./python/django-structlog { };
+      django-stdimage = py-final.callPackage ./python/django-stdimage { };
+      django-user-sessions = py-final.callPackage ./python/django-user-sessions { };
+      django-weasyprint = py-final.callPackage ./python/django-weasyprint { };
+      django-xforwardedfor-middleware = py-final.callPackage ./python/django-xforwardedfor-middleware { };
+      pip-licenses = py-final.callPackage ./python/pip-licenses { };
+      py-moneyed = py-final.callPackage ./python/py-moneyed { };
+      pytest-pycodestyle = py-final.callPackage ./python/pytest-codestyle { };
+      sentry-sdk = py-final.callPackage ./python/sentry-sdk { };
+    })
+  ];
+  inventree = final.callPackage ./inventree { python3 = final.python312; };
+  erpnext_thailand = final.python3.pkgs.callPackage ./frappe/erpnext_thailand/default.nix { };
+  thai_payroll = final.python3.pkgs.callPackage ./frappe/thai_payroll/default.nix { };
 }
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  pytz,
+}:
+
+buildPythonPackage rec {
+  pname = "django-dbbackup";
+  version = "4.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-dbbackup";
+    rev = version;
+    hash = "sha256-GD+f9mbImGPQ6MOUK3ftHqiGv7TT39jNQsFvd0dnnWU=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pytz
+  ];
+
+  pythonImportsCheck = [ "dbbackup" ];
+
+  meta = {
+    description = "Management commands to help backup and restore your project database and media files";
+    homepage = "https://github.com/jazzband/django-dbbackup";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+    mainProgram = "django-dbbackup";
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-error-report-2";
+  version = "0.4.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "matmair";
+    repo = "django-error-report-2";
+    rev = version;
+    hash = "sha256-ZCaslqgruJxM8345/jSlZGruM+27H9hvwL0wtPkUzc0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "error_report" ];
+
+  meta = {
+    description = "Log/View Django server errors";
+    homepage = "https://github.com/matmair/django-error-report-2";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-flags";
+  version = "5.0.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cfpb";
+    repo = "django-flags";
+    rev = version;
+    hash = "sha256-WPMfFYoP6WaVzZmVtqAz4LlY761aCRyPhd5npc8bOOI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "flags" ];
+
+  meta = {
+    description = "Feature flags for Django projects";
+    homepage = "https://github.com/cfpb/django-flags";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  django-recurrence,
+  icalendar,
+}:
+
+buildPythonPackage rec {
+  pname = "django-ical";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-ical";
+    rev = version;
+    hash = "sha256-DUe0loayGcUS7MTyLn+g0KBxbIY7VsaoQNHGSMbMI3U=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    django-recurrence
+    icalendar
+  ];
+
+  pythonImportsCheck = [ "django_ical" ];
+
+  meta = {
+    description = "ICal feeds for Django based on Django's syndication feed framework";
+    homepage = "https://github.com/jazzband/django-ical";
+    changelog = "https://github.com/jazzband/django-ical/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  bleach,
+  django,
+  markdown,
+}:
+
+buildPythonPackage rec {
+  pname = "django-markdownify";
+  version = "0.9.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "erwinmatijsen";
+    repo = "django-markdownify";
+    rev = version;
+    hash = "sha256-KYU8p8NRD4EIS/KhOk9nvmXCf0RWEc+IFZ57YtsDSWE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    bleach
+    django
+    markdown
+  ];
+
+  pythonImportsCheck = [ "markdownify" ];
+
+  meta = {
+    description = "Markdown template filter for Django";
+    homepage = "https://github.com/erwinmatijsen/django-markdownify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+  py-moneyed,
+}:
+
+buildPythonPackage rec {
+  pname = "django-money";
+  version = "3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-money";
+    repo = "django-money";
+    rev = version;
+    hash = "sha256-eL26NsreUqtMJ26TmvmB53EJI4Sjs7qjFDnnt4N0vdI=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    django
+    py-moneyed
+  ];
+
+  pythonImportsCheck = [ "djmoney" ];
+
+  meta = {
+    description = "Money fields for Django forms and models";
+    homepage = "https://github.com/django-money/django-money";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  setuptools,
+  sentry-sdk,
+}:
+
+buildPythonPackage rec {
+  pname = "django-q-sentry";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "danielwelch";
+    repo = "django-q-sentry";
+    rev = "d3a43a90c82734244d5ebf3295652223053f1354";
+    hash = "sha256-3C7A+X18c7p19HWD/uPRtAMf29VjmrfXXh2z5PPOREY=";
+  };
+
+  build-system = [
+    poetry-core
+    setuptools
+  ];
+
+  dependencies = [ sentry-sdk ];
+
+  pythonImportsCheck = [ "django_q_sentry" ];
+
+  meta = {
+    description = "Bringing Sentry error tracking to Django Q";
+    homepage = "https://github.com/danielwelch/django-q-sentry";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pdm-backend,
+  django,
+  flake8,
+  pytest,
+  pytest-cov,
+  pytest-django,
+  pytest-sugar,
+  python-dateutil,
+  sphinx,
+  sphinx-rtd-theme,
+  tox,
+}:
+
+buildPythonPackage rec {
+  pname = "django-recurrence";
+  version = "1.12.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-recurrence";
+    rev = version;
+    hash = "sha256-Q33zyMa1wI13RNLxynGAJHlagahpnFHCmZbHp0aPC/w=";
+  };
+
+  build-system = [ pdm-backend ];
+
+  dependencies = [
+    django
+    flake8
+    pytest
+    pytest-cov
+    pytest-django
+    pytest-sugar
+    python-dateutil
+    sphinx
+    sphinx-rtd-theme
+    tox
+  ];
+
+  pythonRelaxDeps = true;
+
+  pythonImportsCheck = [ "recurrence" ];
+
+  meta = {
+    description = "Utility for working with recurring dates in Django";
+    homepage = "https://github.com/django-recurrence/django-recurrence";
+    changelog = "https://github.com/django-recurrence/django-recurrence/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-slowtests";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "realpython";
+    repo = "django-slow-tests";
+    rev = version;
+    hash = "sha256-gW9AZiMpXJp1m2X1cbm6GdZ9cH+TFqjNLQJFmsvGjB0=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "django_slowtests" ];
+
+  meta = {
+    description = "Locate your slowest tests";
+    homepage = "https://github.com/realpython/django-slow-tests";
+    changelog = "https://github.com/realpython/django-slow-tests/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+  pillow,
+  gettext,
+}:
+
+buildPythonPackage rec {
+  pname = "django-stdimage";
+  version = "6.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "codingjoe";
+    repo = "django-stdimage";
+    rev = version;
+    hash = "sha256-uwVU3Huc5fitAweShJjcMW//GBeIpJcxqKKLGo/EdIs=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    django
+    pillow
+  ];
+
+  nativeBuildInputs = [ gettext ];
+
+  preBuild = ''
+    echo "bla bla"
+    echo $PATH
+  '';
+
+  pythonImportsCheck = [ "stdimage" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/codingjoe/django-stdimage";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  asgiref,
+  django,
+  django-ipware,
+  structlog,
+  celery,
+  django-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "django-structlog";
+  version = "9.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jrobichaud";
+    repo = "django-structlog";
+    rev = version;
+    hash = "sha256-SEigOdlXZtfLAgRgGkv/eDNDAiiHd7YthRJ/H6e1v5U=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    asgiref
+    django
+    django-ipware
+    structlog
+  ];
+
+  optional-dependencies = {
+    celery = [ celery ];
+    commands = [ django-extensions ];
+  };
+
+  pythonImportsCheck = [ "django_structlog" ];
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/jrobichaud/django-structlog";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-user-sessions";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jazzband";
+    repo = "django-user-sessions";
+    rev = version;
+    hash = "sha256-Wexy6G2pZ8LTnqtJkBZIePV7qhQW8gu/mKiQfZtgf/o=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "user_sessions" ];
+
+  meta = {
+    description = "Extend Django sessions with a foreign key back to the user, allowing enumerating all user's sessions";
+    homepage = "http://github.com/jazzband/django-user-sessions";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  weasyprint,
+}:
+
+buildPythonPackage rec {
+  pname = "django-weasyprint";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdemmer";
+    repo = "django-weasyprint";
+    rev = "v${version}";
+    hash = "sha256-eSh1p+5MyYb6GIEgSdlFxPzVCenlkwSCTkTzgKjezIg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    weasyprint
+  ];
+
+  pythonImportsCheck = [ "django_weasyprint" ];
+
+  meta = {
+    description = "A Django class-based view generating PDF resposes using WeasyPrint";
+    homepage = "https://github.com/fdemmer/django-weasyprint";
+    changelog = "https://github.com/fdemmer/django-weasyprint/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-xforwardedfor-middleware";
+  version = "2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "allo-";
+    repo = "django-xforwardedfor-middleware";
+    rev = "v${version}";
+    hash = "sha256-dDXSb17kXOSeIgY6wid1QFHhUjrapasWgCEb/El51eA=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [ django ];
+
+  pythonImportsCheck = [ "x_forwarded_for" ];
+
+  meta = {
+    description = "Use the X-Forwarded-For header to get the real ip of a request";
+    homepage = "https://github.com/allo-/django-xforwardedfor-middleware";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  prettytable,
+  tomli,
+  autopep8,
+  black,
+  docutils,
+  isort,
+  mypy,
+  pip-tools,
+  pypandoc,
+  pytest-cov,
+  pytest-pycodestyle,
+  pytestrunner,
+  tomli-w,
+  twine,
+}:
+
+buildPythonPackage rec {
+  pname = "pip-licenses";
+  version = "5.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "raimon49";
+    repo = "pip-licenses";
+    rev = "v-${version}";
+    hash = "sha256-6xw6BCuXSzNcwkpHaEFC5UPpubPUwhx/pg6vZq2er7A=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [
+    prettytable
+    tomli
+  ];
+
+  optional-dependencies = {
+    dev = [
+      autopep8
+      black
+      docutils
+      isort
+      mypy
+      pip-tools
+      pypandoc
+      pytest-cov
+      pytest-pycodestyle
+      pytestrunner
+      tomli-w
+      twine
+      wheel
+    ];
+  };
+
+  pythonImportsCheck = [ "piplicenses" ];
+
+  meta = {
+    description = "Dump the license list of packages installed with pip";
+    homepage = "https://github.com/raimon49/pip-licenses";
+    changelog = "https://github.com/raimon49/pip-licenses/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  babel,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "py-moneyed";
+  version = "3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "py-moneyed";
+    repo = "py-moneyed";
+    rev = "v${version}";
+    hash = "sha256-k0ZbLwog6TYxKDLZV7eH1Br8buMPfpOkgp+pMN/qdB8=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    babel
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "moneyed" ];
+
+  meta = {
+    description = "Provides Currency and Money classes for use in your Python code";
+    homepage = "http://github.com/py-moneyed/py-moneyed";
+    changelog = "https://github.com/py-moneyed/py-moneyed/blob/${src.rev}/CHANGES.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  wheel,
+  certifi,
+  urllib3,
+}:
+
+buildPythonPackage rec {
+  pname = "sentry-sdk";
+  version = "2.26.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "getsentry";
+    repo = "sentry-python";
+    rev = version;
+    hash = "sha256-Wl8yq2X9GuPcqaS93hkKXs2cDzz282Xceaai4NjbVZY=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    certifi
+    urllib3
+  ];
+
+  pythonImportsCheck = [ "sentry_sdk" ];
+
+  meta = {
+    description = "The official Python SDK for Sentry.io";
+    homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+  };
+}
@@ -5,5 +5,9 @@
      device = (import "${inputs.liminix}/devices/gl-ar750");
      liminix-config = import ./white-house/configuration.nix { inherit inputs; };
    };
+    whitehouse-router-2 = import "${inputs.liminix}/default.nix" {
+      device = (import "${inputs.liminix}/devices/gl-ar750");
+      liminix-config = import ./white-house-2/configuration.nix { inherit inputs; };
+    };
  };
 }
@@ -0,0 +1,82 @@
+{ inputs }:
+{
+  config,
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+let
+  secrets = {
+    firewallRules = { };
+  }
+  // (import ./secrets.nix);
+  wirelessConfig = {
+    country_code = "TH";
+    inherit (secrets) wpa_passphrase;
+    wmm_enabled = 1;
+  };
+  svc = config.system.service;
+in
+{
+  imports = [
+    "${inputs.liminix}/modules/wlan.nix"
+    "${inputs.liminix}/modules/ssh"
+    "${modulesPath}/profiles/wap.nix"
+  ];
+
+  hostname = "whitehouse2";
+  boot = {
+    tftp = {
+      freeSpaceBytes = 3 * 1024 * 1024;
+      serverip = "${secrets.lan.prefix}.149";
+      ipaddr = "${secrets.lan.prefix}.252";
+    };
+  };
+
+  services.sshd = svc.ssh.build {
+    authorizedKeys.root = secrets.root.openssh.authorizedKeys.keys;
+  };
+
+  users.root = secrets.root;
+
+  profile.wap = {
+    interfaces = with config.hardware.networkInterfaces; [
+      wan
+      lan
+      wlan
+      wlan5
+    ];
+
+    wireless.networks = {
+      "${secrets.ssid}" = {
+        interface = config.hardware.networkInterfaces.wlan;
+        hw_mode = "g";
+        channel = "6";
+        ieee80211n = 1;
+      }
+      // wirelessConfig;
+      "${secrets.ssid}-5" = rec {
+        interface = config.hardware.networkInterfaces.wlan5;
+        hw_mode = "a";
+        channel = 36;
+        ht_capab = "[HT40+]";
+        vht_oper_chwidth = 1;
+        vht_oper_centr_freq_seg0_idx = channel + 6;
+        ieee80211n = 1;
+        ieee80211ac = 1;
+      }
+      // wirelessConfig;
+    };
+  };
+
+  system.service.network.forward.enableIPv4 = false;
+  system.service.network.forward.enableIPv6 = false;
+
+  defaultProfile.packages = with pkgs; [
+    busybox
+    iw
+    nftables
+  ];
+
+}
@@ -0,0 +1,16 @@
+{
+  wpa_passphrase = "";
+  ssid = "GL-AR750";
+  root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmgyEGuY/r7SDlJgrzYmQqpcWS5W+fCzRi3OS59ne4W openpgp:0xFF687387"
+    ];
+  };
+
+  lan = {
+    prefix = "192.168.1";
+  };
+}
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1yrqpfs0wtaxg9p9058g2gyq7kffjnnqdw26wa4a4uvjqkzvmq5wqvdtgxl",
+    "type": "age"
+  }
+]
@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1xzasw9ggd9gf39nx90jpe4qu8p4nzke98e70t7e8sl9mutkgrd4s0elqcl",
+    "type": "age"
+  }
+]
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kurogeek	2ca158ebf8	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/saturn/configuration.nix	2026-05-26 13:46:36 +07:00
kurogeek	85f75812fc	update(inventory.json): Installed saturn	2026-05-26 10:41:13 +07:00
kurogeek	78822deb2d	Update vars via generator openssh-cert (machine: saturn)	2026-05-26 10:31:37 +07:00
kurogeek	73ffd2057e	Update vars via generator user-password-root (machine: saturn)	2026-05-26 10:30:33 +07:00
kurogeek	ff653cdd86	Update vars via generator tor_tor (machine: saturn)	2026-05-26 10:29:29 +07:00
kurogeek	62c1a63208	Update vars via generator state-version (machine: saturn)	2026-05-26 10:28:23 +07:00
kurogeek	fedf0be4d4	Update vars via generator openssh (machine: saturn)	2026-05-26 10:28:11 +07:00
kurogeek	e57f73bcfe	Update vars via generator nginx (machine: saturn)	2026-05-26 10:27:33 +07:00
kurogeek	0fffc56ca7	Update vars via generator frappix (machine: saturn)	2026-05-26 10:26:29 +07:00
kurogeek	9381f54f66	Add machine saturn to secrets	2026-05-26 10:25:37 +07:00
kurogeek	c765ea319b	Update secret saturn-age.key	2026-05-26 10:25:37 +07:00
kurogeek	2318eb48ed	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/saturn/configuration.nix	2026-05-26 10:21:53 +07:00
kurogeek	c2c9428805	mob next [ci-skip] [ci skip] [skip ci] lastFile:machines/canopus/configuration.nix	2026-05-25 17:05:09 +07:00
kurogeek	54d5290d0a	mob next [ci-skip] [ci skip] [skip ci] lastFile:flake.nix	2026-05-25 16:35:19 +07:00
kurogeek	bc16c72707	machines/canopus: localhost -> sitename	2026-05-25 14:20:44 +07:00
kurogeek	3a26403590	inventory/tags: add alasia to b4l and global-network tags	2026-05-20 14:05:29 +07:00
kurogeek	5681a65c6f	Update vars via generator zerotier (machine: alasia)	2026-05-20 12:49:31 +07:00
kurogeek	175087e9fd	Update vars via generator zerotier (machine: alasia)	2026-05-20 12:49:17 +07:00
kurogeek	0b82ffa913	Update vars via generator yggdrasil (machine: alasia)	2026-05-20 12:48:43 +07:00
kurogeek	5d216dd56f	Update vars via generator yggdrasil (machine: alasia)	2026-05-20 12:48:27 +07:00
kurogeek	48ea7cb6ea	machines/deneb: unauthorized dbe44c0287 and e3d6559697	2026-05-20 10:45:13 +07:00
kurogeek	0f79022907	machines/bosona: ERPNext machine for Tempo	2026-05-19 17:11:55 +07:00
kurogeek	c15ac6fca5	inputs/frappix: bump version	2026-05-19 14:41:52 +07:00
kurogeek	e9ae808a7d	machines/deneb: frappe add module crm	2026-05-18 12:22:27 +07:00
kurogeek	8e085211f7	machines/alasia: headscale server	2026-05-15 18:00:31 +07:00
kurogeek	47c4f3143e	rm b4l	2026-05-12 17:21:37 +07:00
kurogeek	f1e914b927	Revert "rm b4l" This reverts commit `06f1f990f0`.	2026-05-12 17:16:23 +07:00
kurogeek	210a3101de	specify boot.zfs.forceImportRoot	2026-05-12 16:49:03 +07:00
kurogeek	06f1f990f0	rm b4l	2026-05-12 16:48:30 +07:00
kurogeek	781e70287d	inputs: bump nixpkgs, frappix, treefmt-nix	2026-05-12 16:46:07 +07:00
kurogeek	c030b045a2	routers/whitehouse-2: init whitehouse-2 as an AP	2026-05-07 10:52:05 +07:00
kurogeek	6a29794575	vars/canopus: rm zerotier/zerotier-network-id	2026-05-06 16:32:12 +07:00
kurogeek	da9ad2523c	Update vars via generator zerotier (machine: canopus)	2026-05-06 15:47:51 +07:00
kurogeek	052082d631	revert: clan-core and zerotier update	2026-05-06 15:42:44 +07:00
kurogeek	1aab77c302	machines/deneb: localhost -> poyerp.newedge.house	2026-05-04 16:59:31 +07:00
kurogeek	f146eaf0a5	machines/deneb: allow Alex gateway	2026-05-04 16:59:02 +07:00
kurogeek	0aabd4f527	inventory/poy-network: add	2026-05-04 15:05:09 +07:00
kurogeek	a22582502b	vars: update via generator zerotier (machine: deneb)	2026-05-04 14:29:27 +07:00
kurogeek	0c7c791f19	vars: update via generator zerotier (machine: canopus)	2026-05-04 14:13:25 +07:00
kurogeek	87a1ebba2c	machines/canopus: rm netbird service, disconnect from the internet	2026-05-04 11:42:40 +07:00
kurogeek	bc04896b63	machines/all: machine description	2026-05-01 11:13:53 +07:00
kurogeek	1d823afe58	inputs/frappix: bump version	2026-05-01 09:58:26 +07:00
kurogeek	898f9f9320	machines/canopus: netbird service	2026-04-30 17:10:19 +07:00
kurogeek	a89a98d233	vars: update via generator netbird (machine: canopus)	2026-04-30 15:47:46 +07:00
kurogeek	1923c096aa	inputs/clan-core: bump clan-core	2026-04-28 15:59:32 +07:00
kurogeek	1e72ccb391	vars: update via generator zerotier (machine: vega)	2026-04-28 14:50:57 +07:00
kurogeek	cbcc9e74c0	vars: update via generator zerotier (machine: sirius)	2026-04-28 14:50:56 +07:00
kurogeek	83e366a2b8	vars: update via generator zerotier (machine: rigel)	2026-04-28 14:50:56 +07:00
kurogeek	85333e6a3e	vars: update via generator zerotier (machine: rana)	2026-04-28 14:50:55 +07:00
kurogeek	6af195a3fd	vars: update via generator zerotier (machine: ramus)	2026-04-28 14:50:55 +07:00
kurogeek	85497d5777	vars: update via generator zerotier (machine: petra)	2026-04-28 14:50:53 +07:00
kurogeek	753e264c89	vars: update via generator zerotier (machine: neptune)	2026-04-28 14:50:52 +07:00
kurogeek	10a5a2265c	vars: update via generator zerotier-controller (shared)	2026-04-28 14:50:51 +07:00
kurogeek	29a09c53a6	machines/b4l: nextcloud32 -> nextcloud33	2026-04-28 13:56:54 +07:00
kurogeek	c608c2f856	clanService/admin: migrated due to deprecated	2026-04-28 13:44:37 +07:00
kurogeek	86b7d4bda5	inputs/liminix: bump version	2026-04-27 14:01:23 +07:00
kurogeek	e573bfd98a	inventree services are running on procyon and hadar machines	2026-04-24 11:35:50 +07:00
kurogeek	94901da15e	test.useContainers = false for all tests	2026-04-23 18:08:35 +07:00
kurogeek	ecbd5e00a6	erpnext services are running on deneb and canopus machines	2026-04-23 15:26:18 +07:00
kurogeek	d5b70b050c	inventory/emmie: add syncthing path	2026-04-21 09:29:31 +07:00
kurogeek	79eeb2a491	machines/sirius: add monitoring system	2026-04-11 15:19:03 +07:00
kurogeek	f5930ae9e6	flake/inputs: bump liminix	2026-04-06 10:15:20 +07:00
kurogeek	aa3db27c77	machines/rana: hardcode kernel to version 6.12 to fix freezing issue	2026-04-02 17:53:37 +07:00
kurogeek	44210e6bbb	machines/rana: boot.kernelParams adjusted	2026-04-02 17:16:30 +07:00
kurogeek	984d587d00	machines/rana: update facter.json	2026-04-02 11:20:24 +07:00
kurogeek	79be24d581	machines/rana: fixed randomly freeze	2026-04-01 10:49:48 +07:00
kurogeek	1518cd7db6	inputs/nixpkgs: bump version	2026-03-31 13:45:49 +07:00
kurogeek	ac7117c13d	clanService/personal-computer: added more drivers	2026-03-31 13:45:23 +07:00