a

hosts/server/configuration.nix

@@ -5,6 +5,48 @@
   ...
 }:
 
+let
+  mkUserService = pkgs.writeShellScriptBin "mk-user-service" ''
+        set -euo pipefail
+
+        if [ "$#" -lt 2 ]; then
+          echo "Usage: mk-user-service <name> <exec command...>" >&2
+          exit 1
+        fi
+
+        name="$1"
+        shift
+
+        unitDir="''${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
+        unitFile="$unitDir/$name.service"
+
+        mkdir -p "$unitDir"
+
+        if [ -e "$unitFile" ]; then
+          echo "Refusing to overwrite existing unit: $unitFile" >&2
+          exit 2
+        fi
+
+        cat > "$unitFile" <<EOF
+    [Unit]
+    Description=$name
+
+    [Service]
+    Type=simple
+    ExecStart=$*
+    Restart=on-failure
+    RestartSec=2
+
+    [Install]
+    WantedBy=default.target
+    EOF
+
+        echo "Created $unitFile"
+        echo "Next steps:"
+        echo "  systemctl --user daemon-reload"
+        echo "  systemctl --user enable --now $name.service"
+  '';
+in
 {
   imports = [
     ./modules/atproto-pds.nix
@@ -23,27 +65,6 @@
 
   services.vscode-server.enable = true;
 
-  systemd.services.ocbwoy3-start-pm2 = {
-    enable = true;
-    description = "Start PM2";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "forking";
-      User = "ocbwoy3";
-      LimitNOFILE = "infinity";
-      LimitNPROC = "infinity";
-      LimitCORE = "infinity";
-      Environment = "PM2_HOME=/home/ocbwoy3/.pm2";
-      PIDFile = "/home/ocbwoy3/.pm2/pm2.pid";
-      Restart = "on-failure";
-
-      ExecStart = "${pkgs.pm2}/bin/pm2 resurrect";
-      ExecReload = "${pkgs.pm2}/bin/pm2 reload all";
-      ExecStop = "${pkgs.pm2}/bin/pm2 kill";
-    };
-  };
-
   services.openssh.settings = lib.mkDefault {
     PubkeyAuthentication = "yes";
     TrustedUserCAKeys = "/etc/ssh/ca.pub";
@@ -56,9 +77,11 @@
   };
 
   environment.systemPackages = with pkgs; [
+    mosh
     fastfetch
     hyfetch
-    pm2
+    bash
+    jdk
     steam-run
     opencode
     bun
@@ -81,6 +104,25 @@
     shell = pkgs.zsh;
   };
 
+  users.users.kris = {
+    initialPassword = "thisisapassword42069!";
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "docker"
+    ];
+    shell = pkgs.zsh;
+    packages = [
+      pkgs.mrpack-install
+      mkUserService
+    ];
+  };
+
+  system.activationScripts.enableKrisLinger.text = ''
+    ${pkgs.systemd}/bin/loginctl enable-linger kris || true
+  '';
+
   nixpkgs.overlays = [
     (final: prev: {
       nixos-rebuild = prev.writeShellScriptBin "nixos-rebuild" ''

hosts/server/modules/vaultwarden.nix

@@ -9,10 +9,10 @@
   services.vaultwarden = {
     enable = true;
     dbBackend = "sqlite";
-    environmentFile = "/private/vaultwarden/vaultwarden.env";
+    environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
     config = {
       # Keep data alongside the secret env file so we can back it up together.
-      DATA_FOLDER = "/private/vaultwarden/data";
+      DATA_FOLDER = "/var/lib/vaultwarden/data";
       PUSH_RELAY_URI = "https://api.bitwarden.eu";
       PUSH_IDENTITY_URI = "https://identity.bitwarden.eu";
       DOMAIN = "https://vault.ocbwoy3.dev";
@@ -25,15 +25,15 @@
     };
   };
 
-  # Allow vaultwarden to write under /private/vaultwarden and ensure the directories exist.
+  # Allow vaultwarden to write under /var/lib/vaultwarden and ensure the directories exist.
   systemd.services.vaultwarden.serviceConfig = {
-    ReadWritePaths = [ "/private/vaultwarden" ];
+    ReadWritePaths = [ "/var/lib/vaultwarden" ];
   };
 
   # Create parent/data directories with proper ownership before startup.
   systemd.tmpfiles.rules = [
-    "d /private/vaultwarden 0750 vaultwarden vaultwarden -"
-    "d /private/vaultwarden/data 0750 vaultwarden vaultwarden -"
+    "d /var/lib/vaultwarden 0750 vaultwarden vaultwarden -"
+    "d /var/lib/vaultwarden/data 0750 vaultwarden vaultwarden -"
   ];
 
   # cloudflared!!