hosts/artemis/default.nix

@@ -6,18 +6,7 @@
     ./macos.nix
   ];
   environment.systemPackages = with pkgs; [
-    (pkgs.vscodium.overrideAttrs (oldAttrs: {
-      postInstall = (oldAttrs.postInstall or "") + ''
-        substituteInPlace $out/Applications/VSCodium.app/Contents/Resources/app/product.json \
-          --replace '"extensionsGallery": {}' '"extensionsGallery": {
-            "serviceUrl": "https://visualstudio.com",
-            "cacheUrl": "https://windows.net",
-            "itemUrl": "https://visualstudio.com",
-            "controlUrl": "https://msecnd.net",
-            "recommendationsUrl": "https://visualstudio.com/recommendations"
-          }'
-      '';
-    }))
+    vscodium 
     git
   ];
 

hosts/artemis/homebrew.nix

@@ -39,16 +39,15 @@
   homebrew = {
     enable = true;
     onActivation.cleanup = "zap"; # Cleans packages not defined here
-    enableZshIntegration = true;
-    brews = [
-      "python@3.14"
-    ];
+
+    # Use Mac Casks instead of standard Nix packages for GUI apps
     casks = [
       "steam"
       "discord"
       "discord@canary"
       "Sikarugir-App/sikarugir/sikarugir"
       "zen"
+      "python"
     ];
   };
 }

modules/k3s/default.nix

@@ -66,6 +66,16 @@ in
         key = "token";
         sopsFile = "${inputs.secrets}/cluster/k3s.json";
       };
+      pg_pass = {
+        format = "json";
+        key = "pg-pass";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
+      authentik_secret_key = {
+        format = "json";
+        key = "authentik-secret-key";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
     };
     
     services.rpcbind.enable = true;

modules/k3s/deployments/vaultwarden.nix

@@ -29,30 +29,6 @@
                     containerPort = 80; 
                   }
                 ];
-                env = [
-                  { name = "DOMAIN"; value = "https://vault.nyxerinys.dev"; }
-                  { name = "SSO_ENABLED"; value = "true"; }
-                  { name = "SSO_AUTHORITY"; value = "https://authentik.company/application/o/vaultwarden/"; }
-                  { name = "SSO_SCOPES"; value = "email profile offline_access"; }
-                  { name = "SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION"; value = "false"; }
-                  { name = "SSO_CLIENT_CACHE_EXPIRATION"; value = "0"; }
-                  { name = "SSO_ONLY"; value = "true"; }
-                  { name = "SSO_SIGNUPS_MATCH_EMAIL"; value = "true"; }
-                  {
-                    name = "SSO_CLIENT_ID";
-                    valueFrom.secretKeyRef = {
-                      name = "vaultwarden-secrets";
-                      key = "sso_client_id";
-                    };
-                  }
-                  {
-                    name = "SSO_CLIENT_SECRET";
-                    valueFrom.secretKeyRef = {
-                      name = "vaultwarden-secrets";
-                      key = "sso_client_secret";
-                    };
-                  }
-                ];
                 volumeMounts = [
                   {
                     mountPath = "/data";

modules/k3s/secrets.nix

@@ -4,30 +4,7 @@ let
   cfg = config.nyxs-nix.services.k3s;
 in
 {
-  sops = mkIf cfg.enable {
-    secrets = {
-      pg_pass = {
-        format = "json";
-        key = "pg-pass";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
-      authentik_secret_key = {
-        format = "json";
-        key = "authentik-secret-key";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
-      sso_client_id = {
-        format = "json";
-        key = "sso_client_id";
-        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
-      };
-      sso_client_secret = {
-        format = "json";
-        key = "sso_client_secret";
-        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
-      }
-    };
-    templates = {
+  sops.templates = mkIf cfg.enable {
      "authentik-secrets.yaml" = {
       content = ''
         apiVersion: v1
@@ -42,20 +19,5 @@ in
       '';
       path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
      };
-      "vaultwarden-secrets.yaml" = {
-        content = ''
-          apiVersion: v1
-          kind: Secret
-          metadata:
-            name: vaultwarden-secrets
-            namespace: default
-          type: Opaque
-          stringData:
-            sso_client_id: ${config.sops.placeholder."sso_client_id"}
-            sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
-        '';
-        path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
-      };
-    };
   };
 }