Merge remote-tracking branch 'lass/master'

29 files changed, 890 insertions, 113 deletions

diff --git a/lass/2configs/antimicrox/default.nix b/lass/2configs/antimicrox/default.nix
new file mode 100644
index 000000000..16f546ce6
--- /dev/null
+++ b/lass/2configs/antimicrox/default.nix
@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.services.antimicrox = {
+    wantedBy = [ "multi-user.target" ];
+    environment = {
+      DISPLAY = ":0";
+    };
+    serviceConfig = {
+      User = config.users.users.mainUser.name;
+      ExecStartPre = lib.singleton (pkgs.writeDash "init_state" "echo 0 > /tmp/gamepad.state");
+      ExecStart = "${pkgs.antimicrox}/bin/antimicrox --no-tray --hidden --profile ${./mouse.amgp}";
+    };
+  };
+
+  environment.systemPackages = [
+    (pkgs.writers.writeDashBin "gamepad_mouse_disable" ''
+      echo 1 > /tmp/gamepad.state
+      ${pkgs.antimicrox}/bin/antimicrox --profile ${./empty.amgp}
+    '')
+    (pkgs.writers.writeDashBin "gamepad_mouse_enable" ''
+      echo 0 > /tmp/gamepad.state
+      ${pkgs.antimicrox}/bin/antimicrox --profile ${./mouse.amgp}
+    '')
+    (pkgs.writers.writeDashBin "gamepad_mouse_toggle" ''
+      state=$(${pkgs.coreutils}/bin/cat /tmp/gamepad.state)
+      if [ "$state" = 1 ]; then
+        /run/current-system/sw/bin/gamepad_mouse_enable
+      else
+        /run/current-system/sw/bin/gamepad_mouse_disable
+      fi
+    '')
+  ];
+}
diff --git a/lass/2configs/antimicrox/empty.amgp b/lass/2configs/antimicrox/empty.amgp
new file mode 100644
index 000000000..0257bfe71
--- /dev/null
+++ b/lass/2configs/antimicrox/empty.amgp
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<gamecontroller configversion="19" appversion="3.3.2">
+    <!--The SDL name for a joystick is included for informational purposes only.-->
+    <sdlname>XInput Controller</sdlname>
+    <!--The Unique ID for a joystick is included for informational purposes only.-->
+    <uniqueID>030000005e0400008e020000010100001118654</uniqueID>
+    <stickAxisAssociation index="2" xAxis="3" yAxis="4"/>
+    <stickAxisAssociation index="1" xAxis="1" yAxis="2"/>
+    <vdpadButtonAssociations index="1">
+        <vdpadButtonAssociation axis="0" button="12" direction="1"/>
+        <vdpadButtonAssociation axis="0" button="13" direction="4"/>
+        <vdpadButtonAssociation axis="0" button="14" direction="8"/>
+        <vdpadButtonAssociation axis="0" button="15" direction="2"/>
+    </vdpadButtonAssociations>
+    <names>
+        <controlstickname index="2">R Stick</controlstickname>
+        <controlstickname index="1">L Stick</controlstickname>
+    </names>
+    <sets/>
+</gamecontroller>
diff --git a/lass/2configs/antimicrox/mouse.amgp b/lass/2configs/antimicrox/mouse.amgp
new file mode 100644
index 000000000..313e598de
--- /dev/null
+++ b/lass/2configs/antimicrox/mouse.amgp
@@ -0,0 +1,272 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<gamecontroller configversion="19" appversion="3.3.2">
+    <!--The SDL name for a joystick is included for informational purposes only.-->
+    <sdlname>XInput Controller</sdlname>
+    <!--The Unique ID for a joystick is included for informational purposes only.-->
+    <uniqueID>030000005e0400008e020000010100001118654</uniqueID>
+    <stickAxisAssociation index="2" xAxis="3" yAxis="4"/>
+    <stickAxisAssociation index="1" xAxis="1" yAxis="2"/>
+    <vdpadButtonAssociations index="1">
+        <vdpadButtonAssociation axis="0" button="12" direction="1"/>
+        <vdpadButtonAssociation axis="0" button="13" direction="4"/>
+        <vdpadButtonAssociation axis="0" button="14" direction="8"/>
+        <vdpadButtonAssociation axis="0" button="15" direction="2"/>
+    </vdpadButtonAssociations>
+    <names>
+        <controlstickname index="2">Stick 2</controlstickname>
+        <controlstickname index="1">Stick 1</controlstickname>
+    </names>
+    <sets>
+        <set index="1">
+            <stick index="2">
+                <deadZone>1</deadZone>
+                <maxZone>29501</maxZone>
+                <modifierZone>1412</modifierZone>
+                <diagonalRange>90</diagonalRange>
+                <stickbutton index="7">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                    <accelerationmultiplier>4</accelerationmultiplier>
+                    <startaccelmultiplier>20</startaccelmultiplier>
+                    <minaccelthreshold>3</minaccelthreshold>
+                    <extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
+                    <slots>
+                        <slot>
+                            <code>3</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="6">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                </stickbutton>
+                <stickbutton index="5">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                    <accelerationmultiplier>4</accelerationmultiplier>
+                    <startaccelmultiplier>20</startaccelmultiplier>
+                    <minaccelthreshold>3</minaccelthreshold>
+                    <extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
+                    <slots>
+                        <slot>
+                            <code>2</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="4">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                </stickbutton>
+                <stickbutton index="3">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                    <accelerationmultiplier>4</accelerationmultiplier>
+                    <startaccelmultiplier>20</startaccelmultiplier>
+                    <minaccelthreshold>3</minaccelthreshold>
+                    <extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
+                    <slots>
+                        <slot>
+                            <code>4</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="2">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                </stickbutton>
+                <stickbutton index="1">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                    <accelerationmultiplier>4</accelerationmultiplier>
+                    <startaccelmultiplier>20</startaccelmultiplier>
+                    <minaccelthreshold>3</minaccelthreshold>
+                    <extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
+                    <slots>
+                        <slot>
+                            <code>1</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="8">
+                    <mousespeedx>74</mousespeedx>
+                    <mousespeedy>74</mousespeedy>
+                </stickbutton>
+            </stick>
+            <stick index="1">
+                <deadZone>2578</deadZone>
+                <maxZone>30799</maxZone>
+                <stickbutton index="7">
+                    <mouseacceleration>linear</mouseacceleration>
+                    <slots>
+                        <slot>
+                            <code>6</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="6">
+                    <mouseacceleration>linear</mouseacceleration>
+                </stickbutton>
+                <stickbutton index="5">
+                    <mouseacceleration>linear</mouseacceleration>
+                    <slots>
+                        <slot>
+                            <code>5</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="4">
+                    <mouseacceleration>linear</mouseacceleration>
+                </stickbutton>
+                <stickbutton index="3">
+                    <mouseacceleration>linear</mouseacceleration>
+                    <slots>
+                        <slot>
+                            <code>7</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="2">
+                    <mouseacceleration>linear</mouseacceleration>
+                </stickbutton>
+                <stickbutton index="1">
+                    <mouseacceleration>linear</mouseacceleration>
+                    <slots>
+                        <slot>
+                            <code>4</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="8">
+                    <mouseacceleration>linear</mouseacceleration>
+                </stickbutton>
+            </stick>
+            <dpad index="1">
+                <dpadbutton index="6">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                </dpadbutton>
+                <dpadbutton index="4">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>0x1000017</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="3">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                </dpadbutton>
+                <dpadbutton index="2">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>0x1000011</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="1">
+                    <wheelspeedx>10</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>0x1000016</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="12">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                </dpadbutton>
+                <dpadbutton index="9">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                </dpadbutton>
+                <dpadbutton index="8">
+                    <wheelspeedx>2</wheelspeedx>
+                    <wheelspeedy>10</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>0x1000010</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+            </dpad>
+            <trigger index="6">
+                <deadZone>2000</deadZone>
+                <throttle>positivehalf</throttle>
+                <triggerbutton index="1">
+                    <mousespeedx>100</mousespeedx>
+                    <mousespeedy>100</mousespeedy>
+                </triggerbutton>
+                <triggerbutton index="2">
+                    <mousespeedx>100</mousespeedx>
+                    <mousespeedy>100</mousespeedy>
+                    <slots>
+                        <slot>
+                            <code>250</code>
+                            <mode>mousespeedmod</mode>
+                        </slot>
+                    </slots>
+                </triggerbutton>
+            </trigger>
+            <trigger index="5">
+                <throttle>positivehalf</throttle>
+            </trigger>
+            <button index="11">
+                <slots>
+                    <slot>
+                        <code>1</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="5">
+                <slots>
+                    <slot>
+                        <code>1</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="3">
+                <slots>
+                    <slot>
+                        <code>2</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="2">
+                <slots>
+                    <slot>
+                        <code>3</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="1">
+                <slots>
+                    <slot>
+                        <code>1</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+        </set>
+    </sets>
+</gamecontroller>
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index efd6c8a24..79777429a 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -91,11 +91,11 @@ in {
     xorg.xhost
     xsel
     zathura
-    flameshot-once
+    flameshot
     (pkgs.writeDashBin "screenshot" ''
       set -efu
 
-      ${pkgs.flameshot-once}/bin/flameshot-once
+      ${pkgs.flameshot}/bin/flameshot gui
       ${pkgs.klem}/bin/klem
     '')
   ];
diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index 00a5d2db0..ea6fb644b 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -1,12 +1,8 @@
 { config, lib, pkgs, ... }:
 {
-  lass.browser.config = {
-    cr = { groups = [ "audio" "video" ]; precedence = 9; };
-  };
-  programs.chromium = {
-    enable = true;
-    extensions = [
-      "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
-    ];
-  };
+  programs.firefox.nativeMessagingHosts.tridactyl = true;
+  environment.variables.BROWSER = "${pkgs.firefox}/bin/firefox";
+  environment.systemPackages = [
+    pkgs.firefox
+  ];
 }
diff --git a/lass/2configs/jitsi.nix b/lass/2configs/jitsi.nix
deleted file mode 100644
index fa41f6634..000000000
--- a/lass/2configs/jitsi.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-
-  services.jitsi-meet = {
-    enable = true;
-    hostName = "jitsi.lassul.us";
-    config = {
-      enableWelcomePage = true;
-      requireDisplayName = true;
-      analytics.disabled = true;
-    };
-    interfaceConfig = {
-      SHOW_JITSI_WATERMARK = false;
-      SHOW_WATERMARK_FOR_GUESTS = false;
-      DISABLE_PRESENCE_STATUS = true;
-      GENERATE_ROOMNAMES_ON_WELCOME_PAGE = false;
-    };
-  };
-
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p tcp --dport 4443"; target = "ACCEPT"; }
-    { predicate = "-p udp --dport 10000"; target = "ACCEPT"; }
-  ];
-}
diff --git a/lass/2configs/mail.nix b/lass/2configs/mail.nix
index f5b2e22b7..0adef8f8c 100644
--- a/lass/2configs/mail.nix
+++ b/lass/2configs/mail.nix
@@ -93,8 +93,6 @@ let
   tag-new-mails = pkgs.writeDashBin "nm-tag-init" ''
     ${pkgs.notmuch}/bin/notmuch new
     ${lib.concatMapStringsSep "\n" (i: ''
-    '') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
-    ${lib.concatMapStringsSep "\n" (i: ''
       mkdir -p "$HOME/Maildir/.${i.name}/cur"
       for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files 'tag:inbox and (${lib.concatMapStringsSep " or " (f: "${f}") i.value})'); do
         if test -e "$mail"; then
@@ -186,7 +184,9 @@ let
     "<enter-command>unset wait_key<enter> \
     <shell-escape>${pkgs.writeDash "muchsync" ''
       set -efu
-      ${pkgs.muchsync}/bin/muchsync -F lass@green.r
+      until ${pkgs.muchsync}/bin/muchsync -F lass@green.r; do
+        sleep 1
+      done
     ''}<enter> \
     'run muchsync to green.r'
 
diff --git a/lass/2configs/mumble-reminder.nix b/lass/2configs/mumble-reminder.nix
index fe75a96a6..c4cc60dc5 100644
--- a/lass/2configs/mumble-reminder.nix
+++ b/lass/2configs/mumble-reminder.nix
@@ -23,7 +23,7 @@
     Kois
     Faulaffen
     Schraubenziegen
-    Nachtigalle
+    Nachtigallen
     Okapis
     Stachelschweine
     Kurzschwanzkängurus
@@ -49,7 +49,7 @@
           pattern = "^nerv nicht$";
           activate = "match";
           command = {
-            filename = pkgs.writeDash "add_remind" ''
+            filename = pkgs.writeDash "del_remind" ''
               ${pkgs.gnused}/bin/sed -i "/$_from/d" /var/lib/reaktor2-mumble-reminder/users
               echo "okok, Ich werde $_from nich mehr errinern"
             '';
@@ -80,7 +80,7 @@ in {
   };
   systemd.services.mumble-reminder-nixos = {
     description = "weekly reminder for nixos mumble";
-    startAt = "Thu *-*-* 19:00:00 Europe/Berlin";
+    startAt = "Thu *-*-* 17:00:00 Europe/Berlin";
     serviceConfig = {
       ExecStart = pkgs.writers.writeDash "mumble_reminder" ''
         animals='
diff --git a/lass/2configs/murmur.nix b/lass/2configs/murmur.nix
deleted file mode 100644
index 42670dfbb..000000000
--- a/lass/2configs/murmur.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  services.murmur = {
-    enable = true;
-    allowHtml = false;
-    bandwidth = 10000000;
-    registerName = "lassul.us";
-    autobanTime = 30;
-    sslCert = "/var/lib/acme/lassul.us/cert.pem";
-    sslKey = "/var/lib/acme/lassul.us/key.pem";
-  };
-  users.groups.lasscert.members = [
-    "murmur"
-  ];
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
-    { predicate = "-p udp --dport 64738"; target = "ACCEPT";}
-  ];
-
-  systemd.services.docker-mumble-web.serviceConfig = {
-    StandardOutput = lib.mkForce "journal";
-    StandardError = lib.mkForce "journal";
-  };
-  virtualisation.oci-containers.containers.mumble-web = {
-    image = "rankenstein/mumble-web:0.5";
-    environment = {
-      MUMBLE_SERVER = "lassul.us:64738";
-    };
-    ports = [
-      "64739:8080"
-    ];
-  };
-
-  services.nginx.virtualHosts."mumble.lassul.us" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://localhost:64739";
-      proxyWebsockets = true;
-    };
-  };
-}
diff --git a/lass/2configs/print.nix b/lass/2configs/print.nix
index c2b3e8377..5769f9b15 100644
--- a/lass/2configs/print.nix
+++ b/lass/2configs/print.nix
@@ -6,5 +6,19 @@
       pkgs.foomatic-filters
       pkgs.gutenprint
     ];
+    browsing = true;
+    browsedConf = ''
+      BrowseDNSSDSubTypes _cups,_print
+      BrowseLocalProtocols all
+      BrowseRemoteProtocols all
+      CreateIPPPrinterQueues All
+
+      BrowseProtocols all
+    '';
+  };
+  services.avahi = {
+    enable = true;
+    openFirewall = true;
+    nssmdns = true;
   };
 }
diff --git a/lass/2configs/services/coms/default.nix b/lass/2configs/services/coms/default.nix
new file mode 100644
index 000000000..4bc5f744b
--- /dev/null
+++ b/lass/2configs/services/coms/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./jitsi.nix
+    ./murmur.nix
+  ];
+}
diff --git a/lass/2configs/services/coms/jitsi.nix b/lass/2configs/services/coms/jitsi.nix
new file mode 100644
index 000000000..bbcb36166
--- /dev/null
+++ b/lass/2configs/services/coms/jitsi.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+{
+
+  services.jitsi-meet = {
+    enable = true;
+    hostName = "jitsi.lassul.us";
+    config = {
+      enableWelcomePage = true;
+      requireDisplayName = true;
+      analytics.disabled = true;
+      startAudioOnly = true;
+      channelLastN = 4;
+      stunServers = [
+        # - https://www.kuketz-blog.de/jitsi-meet-server-einstellungen-fuer-einen-datenschutzfreundlichen-betrieb/
+        { urls = "turn:turn.matrix.org:3478?transport=udp"; }
+        { urls = "turn:turn.matrix.org:3478?transport=tcp"; }
+        # - services.coturn:
+        #{ urls = "turn:turn.${domainName}:3479?transport=udp"; }
+        #{ urls = "turn:turn.${domainName}:3479?transport=tcp"; }
+      ];
+      constraints.video.height = {
+        ideal = 720;
+        max = 1080;
+        min = 240;
+      };
+    };
+    interfaceConfig = {
+      SHOW_JITSI_WATERMARK = false;
+      SHOW_WATERMARK_FOR_GUESTS = false;
+      DISABLE_PRESENCE_STATUS = true;
+      GENERATE_ROOMNAMES_ON_WELCOME_PAGE = false;
+    };
+  };
+
+  services.jitsi-videobridge.config = {
+    org.jitsi.videobridge.TRUST_BWE = false;
+  };
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 4443"; target = "ACCEPT"; }
+    { predicate = "-p udp --dport 10000"; target = "ACCEPT"; }
+  ];
+}
diff --git a/lass/2configs/services/coms/murmur.nix b/lass/2configs/services/coms/murmur.nix
new file mode 100644
index 000000000..40c53da36
--- /dev/null
+++ b/lass/2configs/services/coms/murmur.nix
@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+{
+  services.murmur = {
+    enable = true;
+    # allowHtml = false;
+    bandwidth = 10000000;
+    registerName = "lassul.us";
+    autobanTime = 30;
+    sslCert = "/var/lib/acme/lassul.us/cert.pem";
+    sslKey = "/var/lib/acme/lassul.us/key.pem";
+    extraConfig = ''
+      opusthreshold=0
+      # rememberchannelduration=10000
+    '';
+  };
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
+    { predicate = "-p udp --dport 64738"; target = "ACCEPT";}
+  ];
+
+  # services.botamusique = {
+  #   enable = true;
+  #   settings = {
+  #     server.host = "lassul.us";
+  #     bot.auto_check_updates = false;
+  #     bot.max_track_duration = 360;
+  #     webinterface.enabled = true;
+  #   };
+  # };
+
+  services.nginx.virtualHosts."lassul.us" = {
+    enableACME = true;
+  };
+  security.acme.certs."lassul.us" = {
+    group = "lasscert";
+  };
+  users.groups.lasscert.members = [
+    "nginx"
+    "murmur"
+  ];
+
+  # services.nginx.virtualHosts."bota.r" = {
+  #   locations."/" = {
+  #     proxyPass = "http://localhost:8181";
+  #   };
+  # };
+}
diff --git a/lass/2configs/services/coms/proxy.nix b/lass/2configs/services/coms/proxy.nix
new file mode 100644
index 000000000..57e132151
--- /dev/null
+++ b/lass/2configs/services/coms/proxy.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+let
+  tcpports = [
+    4443 # jitsi
+    64738 # murmur
+  ];
+  udpports = [
+    10000 # jitsi
+    64738 # murmur
+  ];
+  target = "orange.r";
+in
+{
+  networking.firewall.allowedTCPPorts = tcpports;
+  networking.firewall.allowedUDPPorts = udpports;
+  services.nginx.streamConfig = ''
+    ${lib.concatMapStringsSep "\n" (port: ''
+      server {
+        listen ${toString port};
+        proxy_pass ${target}:${toString port};
+      }
+    '') tcpports}
+    ${lib.concatMapStringsSep "\n" (port: ''
+      server {
+        listen ${toString port} udp;
+        proxy_pass ${target}:${toString port};
+      }
+    '') udpports}
+  '';
+
+  services.nginx.virtualHosts."jitsi.lassul.us" = {
+    enableACME = true;
+    acmeFallbackHost = "${target}";
+    addSSL = true;
+    locations."/" = {
+      recommendedProxySettings = true;
+      proxyWebsockets = true;
+      proxyPass = "http://${target}";
+    };
+  };
+}
diff --git a/lass/2configs/services/flix/container-host.nix b/lass/2configs/services/flix/container-host.nix
new file mode 100644
index 000000000..1c5b81128
--- /dev/null
+++ b/lass/2configs/services/flix/container-host.nix
@@ -0,0 +1,40 @@
+{ config, pkgs, ... }:
+{
+  krebs.sync-containers3.containers.yellow = {
+    sshKey = "${toString <secrets>}/yellow.sync.key";
+  };
+  containers.yellow.bindMounts."/var/lib" = {
+    hostPath = "/var/lib/sync-containers3/yellow/state";
+    isReadOnly = false;
+  };
+  containers.yellow.bindMounts."/var/download" = {
+    hostPath = "/var/download";
+    isReadOnly = false;
+  };
+  # krebs.iptables.tables.filter.FORWARD.rules = [
+  #   { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip4.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v6 = false; }
+  #   { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip6.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v4 = false; }
+  # ];
+  # krebs.iptables.tables.nat.PREROUTING.rules = [
+  #   { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; }
+  #   { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; }
+  # ];
+  networking.firewall.allowedTCPPorts = [ 8096 8920 ];