Remove some weird ass symlink

Now we mount the directory directly, as we should

.claude/plugins/config.json

@@ -0,0 +1,3 @@
+{
+  "repositories": {}
+}

.claude/settings.json

@@ -0,0 +1,8 @@
+{
+  "env": {
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "glm-4.5-air",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL": "glm-4.6",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL": "glm-4.6"
+  },
+  "alwaysThinkingEnabled": true
+}

.gitattributes

@@ -1,2 +0,0 @@
-cln filter=lfs diff=lfs merge=lfs -text
-cln.exe filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,13 @@
+.claude/ide
+.claude/file-history
+.claude/shell-snapshots
+.claude/statsig
+.claude/todos
+.claude/history.jsonl
+.claude/projects
+syncthing-sparky/index-v0.14.0.db
+syncthing-sparky/index-v0.14.0.db.2025-08-27
+syncthing-sparky/index-v0.14.0.db-old
+*.lock
+syncthing-bigbox/index-v2
+*.log

.tmux.conf

@@ -0,0 +1 @@
+set -g set-clipboard on

backup/backup-sync-rm.sh

@@ -0,0 +1,13 @@
+curl \
+-H "Content-Type: application/json" \
+-d '{"content": "Backup sync started"}' \
+-X POST https://discord.com/api/webhooks/1334539455209668649/t-vD9dwMHqtQbW6YNXjFRtpN7qTWwD2sYVHAxRjnaDMjpg6gwM3QbF_ofLeb0b0_q-wV
+
+sudo rsync --log-file=/mnt/data/persistent/backup.log -ahvisPH --delete --size-only --sparse --inplace --partial \
+--exclude 'docker/buildkit/' \
+--exclude 'docker/plugins/' \
+--exclude 'docker/runtimes/' \
+--exclude 'docker/swarm/' \
+--exclude 'docker/tmp/' \
+--exclude 'docker/overlay2' \
+/mnt/data/ /mnt/databckp

backup/backup-sync.sh

@@ -0,0 +1,13 @@
+curl \
+-H "Content-Type: application/json" \
+-d '{"content": "Backup sync started"}' \
+-X POST https://discord.com/api/webhooks/1334539455209668649/t-vD9dwMHqtQbW6YNXjFRtpN7qTWwD2sYVHAxRjnaDMjpg6gwM3QbF_ofLeb0b0_q-wV
+
+sudo rsync --log-file=/mnt/data/persistent/backup.log -ahvisPH --size-only --sparse --inplace --partial \
+--exclude 'docker/buildkit/' \
+--exclude 'docker/plugins/' \
+--exclude 'docker/runtimes/' \
+--exclude 'docker/swarm/' \
+--exclude 'docker/tmp/' \
+--exclude 'docker/overlay2' \
+/mnt/data/ /mnt/databckp

backup/backup-tmux-rm.conf

@@ -0,0 +1,11 @@
+# tmux-oneshot.conf
+# Configuration file for tmux-oneshot.sh
+
+# Session name (leave empty to use first word of command)
+SESSION="backup-rm"
+
+# Command to run (leave empty to use command line arguments)
+COMMAND="sh backup-sync-rm.sh"
+
+# Whether to attach to session after running command (0 or 1)
+ATTACH_SESSION=1

backup/backup-tmux-rm.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# tmux-oneshot.sh
+# Run a single command in a tmux session
+
+# Load config file if it exists
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_NAME=$(basename "$0" .sh)
+CONFIG_FILE="${SCRIPT_DIR}/${SCRIPT_NAME}.conf"
+if [ -f "$CONFIG_FILE" ]; then
+    echo "Loading config from $CONFIG_FILE"
+    source "$CONFIG_FILE"
+else
+    echo "Config file $CONFIG_FILE not found, generating template..."
+    cat > "$CONFIG_FILE" << 'EOF'
+# tmux-oneshot.conf
+# Configuration file for tmux-oneshot.sh
+
+# Session name (leave empty to use first word of command)
+SESSION=""
+
+# Command to run (leave empty to use command line arguments)
+COMMAND=""
+
+# Whether to attach to session after running command (0 or 1)
+ATTACH_SESSION=0
+EOF
+    echo "Generated $CONFIG_FILE with default values. Please edit and run again."
+    exit 0
+fi
+
+# Validate required variables
+if [ -z "$SESSION" ] && [ -z "$COMMAND" ]; then
+    echo "Error: Either SESSION or COMMAND must be set in $CONFIG_FILE" >&2
+    exit 1
+fi
+
+# Use command line arguments if provided, otherwise use config
+if [ $# -gt 0 ]; then
+    COMMAND="$*"
+    echo "Using command line arguments: $COMMAND"
+else
+    if [ -z "$COMMAND" ]; then
+        echo "Error: No command provided and COMMAND not set in config" >&2
+        exit 1
+    fi
+    echo "Using config command: $COMMAND"
+fi
+
+# Use session name from config, or first word of command if not set
+if [ -z "$SESSION" ]; then
+    SESSION=$(echo "$COMMAND" | awk '{print $1}')
+fi
+
+# Create session if missing
+if ! tmux has-session -t $SESSION 2>/dev/null; then
+    echo "Creating tmux session: $SESSION"
+    tmux new-session -d -s $SESSION
+else
+    echo "Session $SESSION exists, reusing..."
+fi
+
+# Send command to session
+echo "Running command: $COMMAND"
+tmux send-keys -t $SESSION "$COMMAND" C-m
+
+if [ $ATTACH_SESSION -eq 1 ]; then
+    echo "Attaching to tmux session: $SESSION"
+    tmux attach -t $SESSION
+fi

backup/backup-tmux.conf

@@ -0,0 +1,11 @@
+# tmux-oneshot.conf
+# Configuration file for tmux-oneshot.sh
+
+# Session name (leave empty to use first word of command)
+SESSION="backup"
+
+# Command to run (leave empty to use command line arguments)
+COMMAND="sh backup-sync.sh"
+
+# Whether to attach to session after running command (0 or 1)
+ATTACH_SESSION=1

backup/backup-tmux.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# tmux-oneshot.sh
+# Run a single command in a tmux session
+
+# Load config file if it exists
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_NAME=$(basename "$0" .sh)
+CONFIG_FILE="${SCRIPT_DIR}/${SCRIPT_NAME}.conf"
+if [ -f "$CONFIG_FILE" ]; then
+    echo "Loading config from $CONFIG_FILE"
+    source "$CONFIG_FILE"
+else
+    echo "Config file $CONFIG_FILE not found, generating template..."
+    cat > "$CONFIG_FILE" << 'EOF'
+# tmux-oneshot.conf
+# Configuration file for tmux-oneshot.sh
+
+# Session name (leave empty to use first word of command)
+SESSION=""
+
+# Command to run (leave empty to use command line arguments)
+COMMAND=""
+
+# Whether to attach to session after running command (0 or 1)
+ATTACH_SESSION=0
+EOF
+    echo "Generated $CONFIG_FILE with default values. Please edit and run again."
+    exit 0
+fi
+
+# Validate required variables
+if [ -z "$SESSION" ] && [ -z "$COMMAND" ]; then
+    echo "Error: Either SESSION or COMMAND must be set in $CONFIG_FILE" >&2
+    exit 1
+fi
+
+# Use command line arguments if provided, otherwise use config
+if [ $# -gt 0 ]; then
+    COMMAND="$*"
+    echo "Using command line arguments: $COMMAND"
+else
+    if [ -z "$COMMAND" ]; then
+        echo "Error: No command provided and COMMAND not set in config" >&2
+        exit 1
+    fi
+    echo "Using config command: $COMMAND"
+fi
+
+# Use session name from config, or first word of command if not set
+if [ -z "$SESSION" ]; then
+    SESSION=$(echo "$COMMAND" | awk '{print $1}')
+fi
+
+# Create session if missing
+if ! tmux has-session -t $SESSION 2>/dev/null; then
+    echo "Creating tmux session: $SESSION"
+    tmux new-session -d -s $SESSION
+else
+    echo "Session $SESSION exists, reusing..."
+fi
+
+# Send command to session
+echo "Running command: $COMMAND"
+tmux send-keys -t $SESSION "$COMMAND" C-m
+
+if [ $ATTACH_SESSION -eq 1 ]; then
+    echo "Attaching to tmux session: $SESSION"
+    tmux attach -t $SESSION
+fi

configuration.nix

@@ -0,0 +1,211 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running 'nixos-help').
+
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    /etc/nixos/hardware-configuration.nix
+  ];
+
+  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.grub.useOSProber = true;
+
+  networking.hostName = "nixos"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.nameservers = [
+    "1.1.1.1"
+    "8.8.8.8"
+  ];
+
+  # Set your time zone.
+  time.timeZone = "Europe/Zagreb";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "hr_HR.UTF-8";
+    LC_IDENTIFICATION = "hr_HR.UTF-8";
+    LC_MEASUREMENT = "hr_HR.UTF-8";
+    LC_MONETARY = "hr_HR.UTF-8";
+    LC_NAME = "hr_HR.UTF-8";
+    LC_NUMERIC = "hr_HR.UTF-8";
+    LC_PAPER = "hr_HR.UTF-8";
+    LC_TELEPHONE = "hr_HR.UTF-8";
+    LC_TIME = "hr_HR.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  # You can disable this if you're only using the Wayland session.
+  services.xserver.enable = true;
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "hr";
+    variant = "";
+  };
+
+  # Configure console keymap
+  console.keyMap = "croat";
+
+  # Enable CUPS to print documents.
+  services.printing.enable = false;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  services.samba = {
+    enable = true;
+    securityType = "user";
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "SAMBA";
+        "security" = "user";
+        "passdb backend" = "tdbsam";
+        "vfs objects" = "acl_xattr";
+        "map acl inherit" = "yes";
+        "store dos attributes" = "yes";
+      };
+      "data" = {
+        "path" = "/mnt/data";
+        "read only" = "no";
+        "browsable" = "yes";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "valid users" = "dave,jana";
+      };
+      "dave" = {
+        "path" = "/home/dave";
+        "read only" = "no";
+        "browsable" = "yes";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "valid users" = "dave,jana";
+      };
+      "homework" = {
+        "path" = "/mnt/data/docker/volumes/captain--sync-data/_data/Homework";
+        "read only" = "no";
+        "browsable" = "yes";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "valid users" = "dave";
+      };
+      "torrent" = {
+        "path" = "/home/dave/volumes/captain--torrent-downloads/_data";
+        "read only" = "no";
+        "browsable" = "yes";
+        "guest ok" = "no";
+        "writable" = "yes";
+        "valid users" = "dave";
+      };
+    };
+  };
+
+  services.samba-wsdd = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  users.users.dave = {
+    isNormalUser = true;
+    description = "Dave";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    packages = with pkgs; [
+      kdePackages.kate
+      #  thunderbird
+    ];
+  };
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = true;
+      AllowUsers = [ "dave" ];
+      UseDns = true;
+      X11Forwarding = false;
+      PermitRootLogin = "no";
+    };
+  };
+  services.resolved.enable = true;
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    lazygit
+    tmux
+    nixfmt-rfc-style
+    btop
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+  networking.firewall.enable = true;
+  networking.firewall.allowPing = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

docker/monitoring-compose.yml

@@ -0,0 +1,121 @@
+services:
+    prometheus:
+        image: prom/prometheus:v3.5.0
+        container_name: prometheus
+        volumes:
+            - /mnt/data/persistent/monitoring/prometheus/config:/etc/prometheus
+            - /mnt/data/persistent/monitoring/prometheus/data:/prometheus
+        command:
+            - "--config.file=/etc/prometheus/prometheus.yml"
+            - "--storage.tsdb.path=/prometheus"
+            - "--web.console.libraries=/etc/prometheus/console_libraries"
+            - "--web.console.templates=/etc/prometheus/consoles"
+            - "--storage.tsdb.retention.time=1d"
+            - "--web.enable-lifecycle"
+            - "--web.listen-address=:43261"
+        restart: unless-stopped
+        expose:
+            - 43261
+        network_mode: "host"
+        labels:
+            org.label-schema.group: "monitoring"
+
+    nodeexporter:
+        image: prom/node-exporter:v1.8.2
+        container_name: nodeexporter
+        volumes:
+            - /proc:/host/proc:ro
+            - /sys:/host/sys:ro
+            - /:/rootfs:ro
+        command:
+            - "--path.procfs=/host/proc"
+            - "--path.rootfs=/rootfs"
+            - "--path.sysfs=/host/sys"
+            - "--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)"
+            - "--web.listen-address=:56546"
+        restart: unless-stopped
+        expose:
+            - 56546
+        network_mode: "host"
+        labels:
+            org.label-schema.group: "monitoring"
+
+    # cadvisor:
+    #     image: gcr.io/google-containers/cadvisor:v0.34.0
+    #     container_name: cadvisor
+    #     volumes:
+    #         - /:/rootfs:ro
+    #         - /var/run:/var/run:rw
+    #         - /sys:/sys:ro
+    #         - /var/lib/docker:/var/lib/docker:ro
+    #         #- /cgroup:/cgroup:ro #doesn't work on MacOS only for Linux
+    #     restart: unless-stopped
+    #     expose:
+    #         - 8080
+    #     network_mode: "host"
+    #     labels:
+    #         org.label-schema.group: "monitoring"
+
+    # We run grafana via coolify so that it may be exposed to internet
+    # grafana:
+    #     image: grafana/grafana:11.5
+    #     container_name: grafana
+    #     volumes:
+    #         - ./grafana/data:/var/lib/grafana
+    #         - ./grafana/config:/etc/grafana
+    #     environment:
+    #         - GF_SECURITY_ADMIN_USER=dave
+    #         - GF_SECURITY_ADMIN_PASSWORD=9@^F@93qHv48JXHvi3Bf
+    #         - GF_USERS_ALLOW_SIGN_UP=true
+    #     restart: unless-stopped
+    #     expose:
+    #         - 43621
+    #     network_mode: "host"
+    #     labels:
+    #         org.label-schema.group: "monitoring"
+
+    #loki:
+    #    container_name: loki
+    #    image: grafana/loki:3.3.2
+    #    expose:
+    #      - 43622
+    #    command: -config.file=/etc/loki/config.yaml
+    #    restart: unless-stopped
+    #    volumes:
+    #      - ./loki/config:/etc/loki
+    #      - ./loki/data:/data/loki
+    #    network_mode: "host"
+
+    #promtail:
+    #    container_name: promtail
+    #    image: grafana/promtail:3.3.2
+    #    expose:
+    #      - 43623
+    #    volumes:
+    #      - /var/log:/var/log
+    #      - /mnt/data/docker/containers:/var/lib/docker/containers:ro
+    #      - ./promtail/config:/etc/promtail
+    #    command: -config.file=/etc/promtail/config.yml
+    #    restart: unless-stopped
+    #    network_mode: "host"
+
+    #pinger:
+    #    image: pinger
+    #    container_name: pinger
+    #    restart: unless-stopped
+    #    network_mode: "host"
+    #    volumes:
+    #      - ./pinger/logs:/logs
+    victoriametrics:
+        image: victoriametrics/victoria-metrics
+        container_name: victoriametrics
+        volumes:
+          - /mnt/data/persistent/monitoring/victoriametrics/data:/victoria-metrics-data
+        command: 
+          - "--retentionPeriod=100y"
+        restart: unless-stopped
+        expose:
+            - 8428
+        network_mode: "host"
+        labels:
+            org.label-schema.group: "monitoring"

docker/syncthing-compose.yml

@@ -0,0 +1,18 @@
+services:
+  syncthing:
+    image: syncthing/syncthing:1.29
+    container_name: syncthing
+    hostname: cyka-syncthing
+    environment:
+      - PUID=1000
+      - PGID=1000
+    volumes:
+      - /mnt/data/docker/volumes/captain--sync-data/_data:/var/syncthing
+      - /mnt/data/linux/config/syncthing-sparky:/var/syncthing/config
+    network_mode: host
+    restart: unless-stopped
+    healthcheck:
+      test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1
+      interval: 1m
+      timeout: 10s
+      retries: 3

prometheus.yml

@@ -0,0 +1,56 @@
+# 793fc68064b5a5917eccf004ee6f30395a0464e7# my global config
+global:
+  scrape_interval: 5s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
+  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
+  # scrape_timeout is set to the global default (10s).
+
+# Alertmanager configuration
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets:
+          # - alertmanager:9093
+
+# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
+rule_files:
+  # - "first_rules.yml"
+  # - "second_rules.yml"
+
+# A scrape configuration containing exactly one endpoint to scrape:
+# Here it's Prometheus itself.
+scrape_configs:
+  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
+  - job_name: "prometheus"
+    static_configs:
+      - targets: ["localhost:43261"]
+
+  - job_name: 'node_exporter'
+    static_configs:
+      - targets: ['localhost:56546']
+    
+  - job_name: 'node_exporter_lilbox'
+    static_configs:
+      - targets: ['192.168.1.78:56546']
+
+  - job_name: 'power-meter-reader'
+    scrape_interval: 30s
+    static_configs:
+      - targets: ['localhost:20132']
+
+#   - job_name: 'windows-exporter'
+#     scrape_interval: 10s
+#     static_configs:
+#       - targets: ['192.168.1.64:9182']
+#
+  - job_name: 'libre-metrics-exporter-dave'
+    scrape_interval: 10s
+    static_configs:
+      - targets: ['192.168.1.64:9646']
+
+#   - job_name: 'libre-metrics-exporter-jana'
+#     scrape_interval: 10s
+#     static_configs:
+#       - targets: ['192.168.1.64:9646']
+
+remote_write:
+  - url: "http://127.0.0.1:8428/api/v1/write"

smb.conf

@@ -0,0 +1,66 @@
+# See smb.conf.example for a more detailed config file or
+# read the smb.conf manpage.
+# Run 'testparm' to verify the config is correct after
+# you modified it.
+#
+# Note:
+# SMB1 is disabled by default. This means clients without support for SMB2 or
+# SMB3 are no longer able to connect to smbd (by default).
+
+[global]
+	workgroup = SAMBA
+	security = user
+
+	passdb backend = tdbsam
+
+	printing = cups
+	printcap name = cups
+	load printers = yes
+	cups options = raw
+
+	vfs objects = acl_xattr
+	map acl inherit = yes
+	store dos attributes = yes
+
+	# Install samba-usershares package for support
+	include = /etc/samba/usershares.conf
+
+[data]
+	path = /mnt/data
+	read only = no
+	browsable = yes
+	guest ok = no
+	writable = yes
+	valid users = dave,jana
+
+[dave]
+	path = /home/dave
+	read only = no
+	browsable = yes
+	guest ok = no
+	writable = yes
+	valid users = dave,jana
+
+[localbin]
+	path = /usr/local/bin
+	read only = no
+	browsable = yes
+	guest ok = no
+	writable = yes
+	valid users = dave
+
+[homework]
+	path = /mnt/data/docker/volumes/captain--sync-data/_data/Homework
+	read only = no
+	browsable = yes
+	guest ok = no
+	writable = yes
+	valid users = dave
+
+[torrent]
+	path = /home/dave/volumes/captain--torrent-downloads/_data
+	read only = no
+	browsable = yes
+	guest ok = no
+	writable = yes
+	valid users = dave

sync-bigbox.yml

@@ -1,3 +1,19 @@
 - source: lazygit
   target: ~/AppData/Local/lazygit
   delete: true
+- source: .claude
+  target: ~/.claude
+  delete: true
+
+- source: syncthing-bigbox
+  target: ~/scoop/apps/syncthing/current/config
+  delete: true
+- source: syncthing-bigbox
+  target: ~/scoop/persist/syncthing/config
+  delete: true
+- source: syncthing-bigbox
+  target: ~/AppData/Local/syncthing
+  delete: true
+- source: syncthing-bigbox
+  target: ~/Seafile/Syncthing/config
+  delete: true

sync-sparky.yml

@@ -4,3 +4,17 @@
 - source: lazygit
   target: /home/dave/lazygit
   delete: true
+- source: .tmux.conf
+  target: ~/.tmux.conf
+  delete: true
+- source: .tmux.conf
+  target: /home/dave/~/.tmux.conf
+  delete: true
+- source: configuration.nix
+  target: /etc/nixos/configuration.nix
+  delete: true
+- source: prometheus.yml
+  target: /mnt/data/persistent/monitoring/prometheus/config/prometheus.yml
+- source: smb.conf
+  target: /etc/samba/smb.conf
+  delete: true

syncthing-bigbox/cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICHTCCAaOgAwIBAgIJANwThvbWCIqvMAoGCCqGSM49BAMCMEoxEjAQBgNVBAoT
+CVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0ZWQxEjAQ
+BgNVBAMTCXN5bmN0aGluZzAeFw0yNDA4MTIwMDAwMDBaFw00NDA4MDcwMDAwMDBa
+MEoxEjAQBgNVBAoTCVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBH
+ZW5lcmF0ZWQxEjAQBgNVBAMTCXN5bmN0aGluZzB2MBAGByqGSM49AgEGBSuBBAAi
+A2IABD/pjuosOFugTRTSgcjgqJEH3YYmNW+EdXpCFQ8OAAffn4doMj5LRqgDCInP
+NAV42iWY+Gi2sqInnzyNK/BgtHeXiUIckKEGrvejwAzyK7a31L7HklAENTzogsxo
+ojuUeKNVMFMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
+BgEFBQcDAjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCXN5bmN0aGluZzAKBggq
+hkjOPQQDAgNoADBlAjEAsqGonHzUt9FfCr77IqwxG82ftJagA2XyFe61YWHdjzQX
+C93pyw6oavO4hFtHngPwAjBkBik8mHK/FRSP/M3HCNWx+pl8KT1P6yLcXgzy/rMO
+UtnAJRJ9f3yFkn98pnFrncQ=
+-----END CERTIFICATE-----

syncthing-bigbox/https-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICLTCCAbSgAwIBAgIIZqg7ZlG9/tAwCgYIKoZIzj0EAwIwUDESMBAGA1UEChMJ
+U3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdlbmVyYXRlZDEYMBYG
+A1UEAxMPd2luLW85bjN1M3VrYWN2MB4XDTI0MDgxMjAwMDAwMFoXDTI2MTExMDAw
+MDAwMFowUDESMBAGA1UEChMJU3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNh
+bGx5IEdlbmVyYXRlZDEYMBYGA1UEAxMPd2luLW85bjN1M3VrYWN2MHYwEAYHKoZI
+zj0CAQYFK4EEACIDYgAE8L65LMej7U+mVfwZVRTvzWGaGxrCD0J811hF5uaBCAoI
+ukQGqGeawbeAiVwL5zHIFBiguWoUa3d5Uy6OsI4CoI6ZRHFwdOhh1LzZPaq16sWp
+JqWuqe6AI43Qb6/wg55Io1swWTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwGgYDVR0RBBMwEYIPd2lu
+LW85bjN1M3VrYWN2MAoGCCqGSM49BAMCA2cAMGQCMCQNSY30mQb+Z81FrPhL5ve1
+3whd7i32i8GEyIkW6uGzNUg3roR3ik44g93m7QKs1QIwN5APr97vhFV6N1WQOwy8
+lJDrsj3QvE5/1TE5KwiyFIywXWs1UxGmrBO0s5ZzloaW
+-----END CERTIFICATE-----

syncthing-bigbox/https-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDQ2sUqk3Ar+Ig2+8PMfa54Y7rUgFMrObxqDxwGGWbOU56Lf23keEBY
+qIJJdah+K2mgBwYFK4EEACKhZANiAATwvrksx6PtT6ZV/BlVFO/NYZobGsIPQnzX
+WEXm5oEICgi6RAaoZ5rBt4CJXAvnMcgUGKC5ahRrd3lTLo6wjgKgjplEcXB06GHU
+vNk9qrXqxakmpa6p7oAjjdBvr/CDnkg=
+-----END EC PRIVATE KEY-----

syncthing-bigbox/key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDAEiSe6tJOTl5kxnI1iiTHRON9P3mmdAo6BbLWZywCmsrxECWjiAygh
+nxaCkgWef1+gBwYFK4EEACKhZANiAAQ/6Y7qLDhboE0U0oHI4KiRB92GJjVvhHV6
+QhUPDgAH35+HaDI+S0aoAwiJzzQFeNolmPhotrKiJ588jSvwYLR3l4lCHJChBq73
+o8AM8iu2t9S+x5JQBDU86ILMaKI7lHg=
+-----END EC PRIVATE KEY-----

syncthing-sparky/cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICHTCCAaKgAwIBAgIIFwAkUdZaAxYwCgYIKoZIzj0EAwIwSjESMBAGA1UEChMJ
+U3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdlbmVyYXRlZDESMBAG
+A1UEAxMJc3luY3RoaW5nMB4XDTI0MDgxMjAwMDAwMFoXDTQ0MDgwNzAwMDAwMFow
+SjESMBAGA1UEChMJU3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdl
+bmVyYXRlZDESMBAGA1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEdsWI6lX9tEVGOpbxL1ThCaCRpPxpYjtoI8xr8A8C1mp3oO7SSaofSg56natb
+dPWyxSpGjsZFtIsWqBNatAEpLagsftC8VK6qSdwpYEP6AnJ52w2roHgnZkmleX4p
+2CzHo1UwUzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
+AQUFBwMCMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJc3luY3RoaW5nMAoGCCqG
+SM49BAMCA2kAMGYCMQD/UL8KMSPsq9/cBnczC69PtpM7wq9EhUMsuLGAI9S+CKU1
+/p+qAScuxRtqv+A6QJ8CMQD43Fa+7gptA1hv/TH3utvOh6IrGj+FFV9PTiOUgIOh
+4EofqFMx2TM2NwP7uqc3BMo=
+-----END CERTIFICATE-----

syncthing-sparky/https-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICJTCCAaugAwIBAgIIK7RHpsXTQe4wCgYIKoZIzj0EAwIwTTESMBAGA1UEChMJ
+U3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdlbmVyYXRlZDEVMBMG
+A1UEAxMMMjA5ZTJkNGM4ZWNkMB4XDTI0MDgxMjAwMDAwMFoXDTI2MTExMDAwMDAw
+MFowTTESMBAGA1UEChMJU3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5
+IEdlbmVyYXRlZDEVMBMGA1UEAxMMMjA5ZTJkNGM4ZWNkMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEeUFMdmiSKr3yrfRZ82eEVoYI8dX6vDUSWjDpIpNOUvfRw2kPDkS7
+VNcygtDLc7eR5ofyex+x4buPAaDVZm61CxdgAjatj4fizAB41Esg2OaBZobjPMyk
+iO7cUMLhCyDIo1gwVjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH
+AwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwFwYDVR0RBBAwDoIMMjA5ZTJkNGM4
+ZWNkMAoGCCqGSM49BAMCA2gAMGUCMQCSYQHHmTRyvsB9i+aOCtmve0TdEE8gV7Xu
+OlXcDXUODhUDCvXAsyr9F9g8ZHKen4sCMC1eYQSHtfrCeEX3C754V7hl856lvpYN
+kQfhpU8svudgWFWB5NHsEsGfQMiDv5XXnw==
+-----END CERTIFICATE-----

syncthing-sparky/https-key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDAo/OHVJ3p6YI9JIL12KiL98uiayUaXlZcccHmtjyFJvJlTNgreDEbZ
+Lg7UaQujK3SgBwYFK4EEACKhZANiAAR5QUx2aJIqvfKt9FnzZ4RWhgjx1fq8NRJa
+MOkik05S99HDaQ8ORLtU1zKC0Mtzt5Hmh/J7H7Hhu48BoNVmbrULF2ACNq2Ph+LM
+AHjUSyDY5oFmhuM8zKSI7txQwuELIMg=
+-----END EC PRIVATE KEY-----

syncthing-sparky/key.pem

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDC3ifPQbyGy1NA7fkhhK6e7P61Gx8fZSGeshRC+fcmZSK3YVwu+zddu
+jhXuamgoKMKgBwYFK4EEACKhZANiAAR2xYjqVf20RUY6lvEvVOEJoJGk/GliO2gj
+zGvwDwLWaneg7tJJqh9KDnqdq1t09bLFKkaOxkW0ixaoE1q0ASktqCx+0LxUrqpJ
+3ClgQ/oCcnnbDaugeCdmSaV5finYLMc=
+-----END EC PRIVATE KEY-----

tmux-daemon.sh

@@ -1,22 +1,28 @@
 #!/bin/bash
-# tmux-daemonizer.sh
+# tmux-daemon.sh
-# Idempotent tmux daemon manager with optional per-command workdir
+# Idempotent tmux daemon manager with config file support
 
+# Load config file if it exists
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_NAME=$(basename "$0" .sh)
+CONFIG_FILE="${SCRIPT_DIR}/${SCRIPT_NAME}.conf"
+if [ -f "$CONFIG_FILE" ]; then
+    echo "Loading config from $CONFIG_FILE"
+    source "$CONFIG_FILE"
+else
+    echo "Config file $CONFIG_FILE not found, generating template..."
+    cat > "$CONFIG_FILE" << 'EOF'
+# tmux-daemon.conf
+# Configuration file for tmux-daemon.sh
+
+# Session name
 SESSION="example"
-echo "[main] SESSION: $SESSION"
 
+# Whether to attach to session after setup (0 or 1)
 ATTACH_SESSION=0
 
-while getopts "a" opt; do
+# Commands to run (array format)
-    case "$opt" in
+# Format: "workdir:::command" OR just "command"
-        a) ATTACH_SESSION=1 ;;
-        \?) echo "Usage: $0 [-a]" >&2
-             exit 1 ;;
-    esac
-done
-shift $((OPTIND-1))
-
-# Define commands: "workdir:::command" OR just "command"
 CMDS=(
     "ping google.com"
     "ping google.com"
@@ -26,6 +32,23 @@ CMDS=(
     "ping google.com"
     "ping google.com"
 )
+EOF
+    echo "Generated $CONFIG_FILE with default values. Please edit and run again."
+    exit 0
+fi
+
+# Validate required variables
+if [ -z "$SESSION" ]; then
+    echo "Error: SESSION must be set in $CONFIG_FILE" >&2
+    exit 1
+fi
+
+if [ ${#CMDS[@]} -eq 0 ]; then
+    echo "Error: CMDS array must be set in $CONFIG_FILE" >&2
+    exit 1
+fi
+
+echo "[main] SESSION: $SESSION"
 echo "[main] Commands: ${CMDS[*]}"
 
 # Create session if missing

tmux-oneshot.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+# tmux-oneshot.sh
+# Run a single command in a tmux session
+
+# Built-in prompt patterns (command_pattern:prompt_pattern:timeout_seconds)
+PROMPT_PATTERNS=(
+    "ssh*:Password|password:5"
+    "sudo*:Password|password|\\[sudo\\] password for:5"
+    "su*:Password|password:5"
+    "mysql*:Enter password:3"
+    "docker*:Password:2"
+)
+
+# Generic function to wait for prompts based on command patterns
+wait_for_prompt() {
+    local cmd="$1"
+    
+    # Find matching pattern for this command
+    for pattern in "${PROMPT_PATTERNS[@]}"; do
+        IFS=':' read -r cmd_pattern prompt_pattern timeout <<< "$pattern"
+        if [[ "$cmd" == $cmd_pattern ]]; then
+            echo "Waiting for prompt: $prompt_pattern (timeout: ${timeout}s)"
+            timeout=$((timeout * 10))  # Convert to 0.1s intervals
+            while [ $timeout -gt 0 ] && ! tmux capture-pane -t $SESSION -p | tail -3 | grep -E "($prompt_pattern)" >/dev/null 2>&1; do
+                sleep 0.1
+                timeout=$((timeout - 1))
+            done
+            if [ $timeout -eq 0 ]; then
+                echo "Timeout waiting for prompt: $prompt_pattern"
+            fi
+            return
+        fi
+    done
+    
+    # No pattern matched, brief pause
+    sleep 0.5
+}
+
+# Load config file if it exists
+SCRIPT_DIR=$(dirname "$0")
+SCRIPT_NAME=$(basename "$0" .sh)
+CONFIG_FILE="${SCRIPT_DIR}/${SCRIPT_NAME}.conf"
+if [ -f "$CONFIG_FILE" ]; then
+    echo "Loading config from $CONFIG_FILE"
+    source "$CONFIG_FILE"
+else
+    echo "Config file $CONFIG_FILE not found, generating template..."
+    cat > "$CONFIG_FILE" << 'EOF'
+# tmux-oneshot.conf
+# Configuration file for tmux-oneshot.sh
+
+# Session name (leave empty to use first word of command)
+SESSION=""
+
+# For multiple commands, use an array:
+# COMMANDS=("ssh root@server" "sudo su" "password123")
+COMMANDS=()
+
+# Whether to attach to session after running command (0 or 1)
+ATTACH_SESSION=0
+EOF
+    echo "Generated $CONFIG_FILE with default values. Please edit and run again."
+    exit 0
+fi
+
+# Validate required variables
+if [ -z "$SESSION" ] && [ ${#COMMANDS[@]} -eq 0 ]; then
+    echo "Error: Either SESSION or COMMANDS must be set in $CONFIG_FILE" >&2
+    exit 1
+fi
+
+# Use command line arguments if provided, otherwise use config
+if [ $# -gt 0 ]; then
+    COMMANDS=("$*")
+    echo "Using command line arguments: $*"
+else
+    if [ ${#COMMANDS[@]} -eq 0 ]; then
+        echo "Error: No commands provided and no commands set in config" >&2
+        exit 1
+    fi
+    echo "Using config commands: ${COMMANDS[*]}"
+fi
+
+# Use session name from config, or first word of first command if not set
+if [ -z "$SESSION" ]; then
+    SESSION=$(echo "${COMMANDS[0]}" | awk '{print $1}')
+fi
+
+# Create session if missing
+if ! tmux has-session -t $SESSION 2>/dev/null; then
+    echo "Creating tmux session: $SESSION"
+    tmux new-session -d -s $SESSION
+else
+    echo "Session $SESSION exists, reusing..."
+fi
+
+# Send commands individually with proper timing
+echo "Running commands: ${COMMANDS[*]}"
+for i in "${!COMMANDS[@]}"; do
+    cmd="${COMMANDS[$i]}"
+    echo "Running: $cmd"
+    tmux send-keys -t $SESSION "$cmd" C-m
+    # Only wait if there is a subsequent command
+    if [ $i -lt $((${#COMMANDS[@]} - 1)) ]; then
+        # Wait for command to complete or prompt for input with timeout
+        wait_for_prompt "$cmd"
+    fi
+done
+
+if [ $ATTACH_SESSION -eq 1 ]; then
+    echo "Attaching to tmux session: $SESSION"
+    tmux attach -t $SESSION
+fi