works maybe

hosts/server/configuration.nix

@@ -8,11 +8,13 @@
 {
   imports = [
     ./modules/atproto-pds.nix
+    ./modules/wafrn.nix
     ./modules/cloudflare.nix
     ./modules/tangled.nix
     ../../modules/force.nix
     ./modules/gitea.nix
     ./modules/vaultwarden.nix
+    # ./slop/openclaw.nix
   ];
 
   # gcc. shit breaks. wtf
@@ -57,6 +59,7 @@
     hyfetch
     pm2
     steam-run
+    opencode
   ];
 
   users.users.ocbwoy3 = {
@@ -70,7 +73,22 @@
     shell = pkgs.zsh;
   };
 
-  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+    enable = true;
+    daemon.settings = {
+      "log-driver" = "local";
+      "log-opts" = {
+        "max-size" = "10m";
+        "max-file" = "3";
+      };
+      "live-restore" = true;
+    };
+  };
+
+  systemd.services.docker.serviceConfig = {
+    CPUQuota = "200%";
+    MemoryMax = "12G";
+  };
 
   services.mongodb = {
     enable = true;

hosts/server/modules/wafrn.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
+
+{
+
+  # DONT ENABLE YET!!
+  services.wafrn = {
+    enable = false;
+    stateDir = "/var/lib/wafrn";
+    secretsFile = "/private/wafrn/secrets.env";
+    caddyConfigDir = "/private/wafrn/caddy";
+
+    # cloudflared doesnt need https
+    httpPort = 6767;
+    httpsPort = null;
+
+    environment = {
+      DOMAIN_NAME = "cyberworld.darkworld.download";
+      CACHE_DOMAIN = "cyberworld-cache.darkworld.download";
+      MEDIA_DOMAIN = "cyberworld-media.darkworld.download";
+      FRONTEND_MEDIA_URL = "https://cyberworld-media.darkworld.download";
+      FRONTEND_CACHE_URL = "https://cyberworld-cache.darkworld.download/api/cache?media=";
+      FRONTEND_FQDN_URL = "https://cyberworld.darkworld.download";
+      ACME_EMAIL = "kris@darkworld.download";
+    };
+  };
+
+}

hosts/server/slop/openclaw.nix

@@ -0,0 +1,46 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+
+  users.openclaw = {
+    isNormalUser = true;
+    home = "/openclaw";
+    description = "OpenClaw Agent";
+    extraGroups = [ "docker" ];
+    group = "agents";
+  };
+
+  home-manager.users.openclaw =
+    {
+      pkgs,
+    }:
+    {
+      programs.openclaw = {
+        enable = true;
+        config = {
+          gateway = {
+            mode = "local";
+            auth = {
+              token = "<gatewayToken>"; # or set OPENCLAW_GATEWAY_TOKEN
+            };
+          };
+
+          channels.telegram = {
+            tokenFile = "/run/agenix/telegram-bot-token"; # any file path works
+            allowFrom = [ 12345678 ]; # your Telegram user ID
+          };
+        };
+
+        # Built-ins (tools + skills) shipped via nix-steipete-tools.
+        plugins = [
+          { source = "github:openclaw/nix-steipete-tools?dir=tools/summarize"; }
+        ];
+      };
+    };
+
+}