From 29119bf74ff7d961c4482ff8ca7b7c903a01d1f2 Mon Sep 17 00:00:00 2001
From: Noratrieb <48135649+Noratrieb@users.noreply.github.com>
Date: Sat, 6 Jun 2026 17:25:16 +0200
Subject: [PATCH 1/3] metrics

---
 nixos/desktop.nix   | 83 +++++++++++++++++++++++++++++++++++++++++++--
 nixos/paperless.nix | 46 -------------------------
 2 files changed, 81 insertions(+), 48 deletions(-)
 delete mode 100644 nixos/paperless.nix

diff --git a/nixos/desktop.nix b/nixos/desktop.nix
index 8cdefb9..58f1b48 100644
--- a/nixos/desktop.nix
+++ b/nixos/desktop.nix
@@ -1,7 +1,6 @@
 { pkgs, config, ... }: {
   imports = [
     ./desktop-hardware-configuration.nix
-    ./paperless.nix
     ./configuration.nix
   ];
 
@@ -43,6 +42,82 @@
 
   programs.coolercontrol.enable = true;
 
+  # it would be cool if this didnt use up so many different ports...
+  # maybe a network namespace and bridge or something??
+  # unix sockets dont appear to be supported sadly
+  services.victoriametrics.enable = true;
+  services.vmagent = {
+    enable = true;
+    remoteWrite.url = "http://127.0.0.1:8428/api/v1/write";
+    prometheusConfig = {
+      scrape_configs = [
+        {
+          job_name = "node-exporter";
+          static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
+        }
+        {
+          job_name = "cadvisor";
+          static_configs = [{ targets = [ "127.0.0.1:8080" ]; }];
+        }
+        {
+          job_name = "systemd";
+          static_configs = [{ targets = [ "127.0.0.1:9558" ]; }];
+        }
+        {
+          job_name = "coolercontrol";
+          authorization = {
+            type = "Bearer";
+            credentials = "cc_5fed8f3b7bd44424b7ffc67cce940e55";
+          };
+          static_configs = [{ targets = [ "127.0.0.1:11987" ]; }];
+        }
+      ];
+    };
+  };
+  services.prometheus.exporters = {
+    node.enable = true;
+    systemd.enable = true;
+  };
+  services.cadvisor = {
+    enable = true;
+    extraOptions = [
+      # significantly decreases CPU usage (https://github.com/google/cadvisor/issues/2523)
+      "--housekeeping_interval=30s"
+    ];
+  };
+  services.grafana = {
+    enable = true;
+
+    settings = {
+      security = {
+        # here are my secrets, use them while they're hot
+        admin_user = "admin";
+        admin_password = "admin";
+        secret_key = "SW2YcwTIb9zpOOhoPsMm";
+      };
+      server.http_port = 4444;
+    };
+
+    declarativePlugins = [
+      pkgs.grafanaPlugins.victoriametrics-metrics-datasource
+    ];
+
+    provision = {
+      enable = true;
+      datasources.settings = {
+        apiVersion = 1;
+        datasources = [
+          {
+            name = "victoriametrics";
+            type = "victoriametrics-metrics-datasource";
+            access = "proxy";
+            url = "http://127.0.0.1:8428";
+          }
+        ];
+      };
+    };
+  };
+
   services.tailscale = {
     enable = true;
     useRoutingFeatures = "both";
@@ -80,7 +155,11 @@
   networking.firewall = {
     trustedInterfaces = [ "tailscale0" ];
     allowedUDPPorts = [ config.services.tailscale.port ];
-    allowedTCPPorts = [ /*SSH*/ 22 ];
+    allowedTCPPorts = [
+      /*SSH*/
+      22
+      11434
+    ];
 
     # https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111
     checkReversePath = "loose";
diff --git a/nixos/paperless.nix b/nixos/paperless.nix
deleted file mode 100644
index cdcee4e..0000000
--- a/nixos/paperless.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, pkgs, ... }:
-let localDir = "/home/nora/.local/share/paperless-ngx"; nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
-  services.paperless = {
-    enable = true;
-    dataDir = "${localDir}/data";
-    mediaDir = "${localDir}/media";
-    consumptionDir = "${nasDir}/consume";
-    address = "0.0.0.0";
-    port = 8010;
-    user = "nora";
-    environmentFile = "${localDir}/secrets-environment";
-    settings = {
-      PAPERLESS_TIME_ZONE = "Europe/Zurich";
-      PAPERLESS_ADMIN_USER = "nora";
-      PAPERLESS_OCR_LANGUAGE = "deu+eng";
-    };
-    exporter = {
-      enable = true;
-      directory = "${nasDir}/export";
-    };
-  };
-
-
-  systemd.services.paperless-ngx-backup = {
-    description = "paperless-ngx data backup to NAS";
-    serviceConfig = {
-      Type = "oneshot";
-      User = "nora";
-      ExecStart = ''
-        ${lib.getExe pkgs.rsync} -a -v --delete --exclude=redis ${localDir}/ ${nasDir}/backup
-      '';
-    };
-  };
-  systemd.timers.paperless-ngx-backup = {
-    description = "paperless-ngx data backup to NAS";
-    wantedBy = [ "timers.target" ];
-    after = [ "mnt-nas.mount" ];
-    timerConfig = {
-      Unit = "paperless-ngx-backup.service";
-      OnCalendar = "daily UTC";
-      RandomizedDelaySec = 1800;
-      FixedRandomDelay = true;
-      Persistent = true; # ensure it still runs if the computer was down at the timer of trigger
-    };
-  };
-}

From 8ed10881f82d636efa0905a08fb5b45ec111a2b2 Mon Sep 17 00:00:00 2001
From: Noratrieb <48135649+Noratrieb@users.noreply.github.com>
Date: Sat, 6 Jun 2026 23:45:20 +0200
Subject: [PATCH 2/3] try better cgroups for fuzzel apps

note that this only half works because niri won't put the process in the
cgroup if it forks too quickly
---
 home-manager/config.kdl | 2 +-
 home-manager/home.nix   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/home-manager/config.kdl b/home-manager/config.kdl
index 485f1b8..8f9d169 100644
--- a/home-manager/config.kdl
+++ b/home-manager/config.kdl
@@ -356,7 +356,7 @@ binds {
 
     // Suggested binds for running programs: terminal, app launcher, screen locker.
     Mod+T { spawn "alacritty"; }
-    Mod+D { spawn "fuzzel"; }
+    Mod+D { spawn "fuzzel-in-niri"; }
     Super+Alt+L { spawn "lock-and-power-off-screen"; }
 
     // You can also use a shell. Do this if you need pipes, multiple commands, etc.
diff --git a/home-manager/home.nix b/home-manager/home.nix
index cfbbf59..7c268ee 100644
--- a/home-manager/home.nix
+++ b/home-manager/home.nix
@@ -3,6 +3,7 @@
 
 { pkgs
 , inputs
+, lib
 , ...
 }:
 let
@@ -67,6 +68,12 @@ in
         exec swaylock
       '';
     })
+    (pkgs.writeShellApplication {
+      name = "fuzzel-in-niri";
+      text = ''
+        ${lib.getExe pkgs.fuzzel} --launch-prefix "${lib.getExe pkgs.niri} msg action spawn --"
+      '';
+    })
     (pkgs.writeShellApplication {
       name = "shell.nix";
       text = ''

From 11d958c8b29ad0b75077c1b2cd4e45730954586b Mon Sep 17 00:00:00 2001
From: Noratrieb <48135649+Noratrieb@users.noreply.github.com>
Date: Sun, 7 Jun 2026 00:17:54 +0200
Subject: [PATCH 3/3] crazy shit

---
 home-manager/home.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/home-manager/home.nix b/home-manager/home.nix
index 7c268ee..34e7b32 100644
--- a/home-manager/home.nix
+++ b/home-manager/home.nix
@@ -8,6 +8,22 @@
 }:
 let
   customPkgs = import ../custom-pkgs/default.nix pkgs;
+  fuzzel-launch-prefix = (pkgs.writeShellApplication {
+    name = "fuzzel-launch-prefix";
+    text = ''
+      name=$(basename "$1")
+
+      # https://stackoverflow.com/questions/13043344/search-and-replace-in-bash-using-regular-expressions
+      # https://github.com/niri-wm/niri/blob/f717ae030fe56fc52522ebef69f17f3f09064ac4/src/utils/spawning.rs#L429
+      re='(.*)[^a-zA-Z0-9:_\.]+(.*)'
+      while [[ $name =~ $re ]]; do
+        # niri doesn't just yeet it out but encode it but that's too complicated for us
+        name="$${BASH_REMATCH[1]}$${BASH_REMATCH[2]}"
+      done
+
+      exec systemd-run --scope --user --unit "app-$name" "$@"
+    '';
+  });
 in
 {
   # You can import other home-manager modules here
@@ -71,7 +87,7 @@ in
     (pkgs.writeShellApplication {
       name = "fuzzel-in-niri";
       text = ''
-        ${lib.getExe pkgs.fuzzel} --launch-prefix "${lib.getExe pkgs.niri} msg action spawn --"
+        ${lib.getExe pkgs.fuzzel} --launch-prefix "${lib.getExe fuzzel-launch-prefix}"
       '';
     })
     (pkgs.writeShellApplication {