wow

2026-07-03 00:45:07 +09:00 · 2026-07-03 00:45:07 +09:00 · bbac123a8d
commit bbac123a8d
144 changed files with 7059 additions and 0 deletions
--- a/.forgejo/workflows/main.yml
+++ b/.forgejo/workflows/main.yml
@ -0,0 +1,74 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "hosts/machine/kanade/**"
+  pull_request:
+    paths-ignore:
+      - "hosts/machine/kanade/**"
+
+jobs:
+  check:
+    runs-on: x86_64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Check flake
+        run: |
+          source /etc/bashrc
+          nix flake check
+  ida:
+    runs-on: x86_64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Prefetch IDA
+        run: |
+          source /etc/bashrc
+          nix-prefetch-url --type sha256 https://file.mizuki.guru/.ida/ida-free-pc_93_x64linux.run
+  cpt:
+    runs-on: x86_64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Prefetch Cisco Packet Tracer
+        run: |
+          source /etc/bashrc
+          nix-prefetch-url --type sha256 https://file.mizuki.guru/.cpt/CiscoPacketTracer_900_Ubuntu_64bit.deb
+          nix-prefetch-url --type sha256 https://file.mizuki.guru/.cpt/CiscoPacketTracer822_amd64_signed.deb
+
+  build-nixos:
+    needs: check
+    runs-on: x86_64
+    strategy:
+      fail-fast: false
+      matrix:
+        host: [mizuki, ena, hako, kazusa]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build NixOS configuration with nom
+        run: |
+          source /etc/bashrc
+          nix build .#nixosConfigurations.${{ matrix.host }}.config.system.build.toplevel
+
+      - name: Cache & Push to Attic
+        if: success()
+        env:
+          ATTIC_SERVER: ${{ secrets.ATTIC_SERVER }}
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          source /etc/bashrc
+          nix shell nixpkgs#attic-client -c bash -c "
+            attic login imnyang \"$ATTIC_SERVER\" \"$ATTIC_TOKEN\"
+            attic push imnyang ./result
+          "
+      - name: Clean Builder Environment
+        if: success()
+        run: |
+          nix-collect-garbage -d
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,13 @@
+result
+result-*
+*.swp
+*.swo
+*~
+
+# sops: keep encrypted secret files in git, ignore local key material/artifacts
+*.dec
+*.decrypted
+.sops-age-key
+keys.txt
+
+.DS_Store
--- a/README.md
+++ b/README.md
@ -0,0 +1,3 @@
+nr
+clean
+update
--- a/assets/1password.desktop
+++ b/assets/1password.desktop
@ -0,0 +1,19 @@
+[Desktop Entry]
+Categories=Office;
+Comment[en_US]=Password manager and secure wallet
+Comment=Password manager and secure wallet
+Exec=1password --silent %U
+GenericName[en_US]=
+GenericName=
+Icon=1password
+MimeType=
+Name[en_US]=1Password
+Name=1Password
+Path=
+StartupNotify=true
+StartupWMClass=1Password
+Terminal=false
+TerminalOptions=
+Type=Application
+X-KDE-SubstituteUID=false
+X-KDE-Username=
--- a/assets/Kawa.colors
+++ b/assets/Kawa.colors
@ -0,0 +1,147 @@
+[ColorEffects:Disabled]
+Color=56,56,56
+ColorAmount=0
+ColorEffect=0
+ContrastAmount=0.65
+ContrastEffect=1
+IntensityAmount=0.1
+IntensityEffect=2
+
+[ColorEffects:Inactive]
+ChangeSelectionColor=true
+Color=112,111,110
+ColorAmount=0.025
+ColorEffect=2
+ContrastAmount=0.1
+ContrastEffect=2
+Enable=false
+IntensityAmount=0
+IntensityEffect=0
+
+[Colors:Button]
+BackgroundAlternate=163,212,250
+BackgroundNormal=252,248,249
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=25,16,23
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:Complementary]
+BackgroundAlternate=27,30,32
+BackgroundNormal=42,46,50
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=161,169,177
+ForegroundLink=29,153,243
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=252,252,252
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:Header]
+BackgroundAlternate=239,240,241
+BackgroundNormal=222,224,226
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=35,38,41
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:Header][Inactive]
+BackgroundAlternate=227,229,231
+BackgroundNormal=239,240,241
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=35,38,41
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:Selection]
+BackgroundAlternate=163,212,250
+BackgroundNormal=236,183,213
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=255,255,255
+ForegroundInactive=112,125,138
+ForegroundLink=253,188,75
+ForegroundNegative=176,55,69
+ForegroundNeutral=198,92,0
+ForegroundNormal=25,16,23
+ForegroundPositive=23,104,57
+ForegroundVisited=155,89,182
+
+[Colors:Tooltip]
+BackgroundAlternate=239,240,241
+BackgroundNormal=247,247,247
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=35,38,41
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:View]
+BackgroundAlternate=247,247,247
+BackgroundNormal=252,248,249
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=25,16,23
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[Colors:Window]
+BackgroundAlternate=227,229,231
+BackgroundNormal=252,248,249
+DecorationFocus=61,174,233
+DecorationHover=61,174,233
+ForegroundActive=61,174,233
+ForegroundInactive=112,125,138
+ForegroundLink=41,128,185
+ForegroundNegative=218,68,83
+ForegroundNeutral=246,116,0
+ForegroundNormal=25,16,23
+ForegroundPositive=39,174,96
+ForegroundVisited=155,89,182
+
+[General]
+ColorScheme=BreezeLight
+Name=Kawa
+shadeSortColumn=true
+
+[KDE]
+contrast=4
+
+[WM]
+activeBackground=227,229,231
+activeBlend=227,229,231
+activeForeground=35,38,41
+inactiveBackground=239,240,241
+inactiveBlend=239,240,241
+inactiveForeground=112,125,138
--- a/assets/avatar.webp
+++ b/assets/avatar.webp
--- a/assets/wallpaper/README.md
+++ b/assets/wallpaper/README.md
@ -0,0 +1,4 @@
+[wallpaper1.jpg - @Drift0827](https://x.com/Drift0827/status/1990350670445306010?s=20)
+[wallpaper2.png - 服作り奮闘中 Card](https://sekai.best/card/1356)
+[wallpaper3.png - 気づいてしまった想い Card](https://sekai.best/card/202)
+[wallpaper4.png - 当たり前になった打ち上げ](https://sekai.best/card/363)
--- a/assets/wallpaper/wallpaper1.jpg
+++ b/assets/wallpaper/wallpaper1.jpg
--- a/assets/wallpaper/wallpaper2.png
+++ b/assets/wallpaper/wallpaper2.png
--- a/assets/wallpaper/wallpaper3.png
+++ b/assets/wallpaper/wallpaper3.png
--- a/assets/wallpaper/wallpaper4.png
+++ b/assets/wallpaper/wallpaper4.png
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@ -0,0 +1,139 @@
+{
+  description = "imnyang's Nix Configuration";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    nixpkgs-2511.url = "github:NixOS/nixpkgs/nixos-25.11";
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    spicetify-nix.url = "github:Gerg-L/spicetify-nix";
+
+    catppuccin.url = "github:catppuccin/nix";
+
+    nix-flatpak.url = "github:gmodena/nix-flatpak/";
+
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
+
+    darwin = {
+      url = "github:nix-darwin/nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixcord.url = "github:FlameFlag/nixcord";
+    # nixcord.url = "path:/home/imnyang/workspaces/git/imnyang/nixcord";
+
+    vscode-nigo = {
+      url = "git+https://git.pari.ng/imnyang/vscode-nigo.git?ref=main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    notion-desktop = {
+      url = "github:heytcass/notion-mac-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    notion-calendar-electron.url = "github:czlabinger/notion-calendar-electron";
+
+    millennium.url = "github:SteamClientHomebrew/Millennium?dir=packages/nix";
+
+    vicinae.url = "github:vicinaehq/vicinae";
+
+    vicinae-extensions = {
+      url = "github:vicinaehq/extensions";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
+
+    codex-app = {
+      url = "github:ilysenko/codex-desktop-linux";
+    };
+
+    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
+
+    rustfs = {
+      url = "github:rustfs/rustfs-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    imnyang.url = "git+https://git.mizuki.guru/imnyang/nix-packages.git";
+
+    paring.url = "git+https://git.pari.ng/paring/nix-packages.git";
+
+    mizuki-nc.url = "git+https://git.mizuki.guru/imnyang/mizuki.guru.git?rev=70b1c9a2befc933c63f2b3197655b4f1166f9fbb";
+
+    muvel.url = "github:imnyang/muvel-nix";
+  };
+
+  outputs =
+    inputs@{
+      imnyang,
+      paring,
+      ...
+    }:
+    let
+      # Overlays
+      overlays = [
+        paring.overlays.default
+        imnyang.overlays.default
+        inputs.millennium.overlays.default
+        (import ./overlays/spotx.nix)
+        (final: prev: {
+          pythonPackagesExtensions = (prev.pythonPackagesExtensions or [ ]) ++ [
+            (python-final: python-prev: {
+              uefi-firmware-parser = python-prev.uefi-firmware-parser.overridePythonAttrs (old: {
+                build-system = (old.build-system or [ ]) ++ [
+                  python-final.setuptools-scm
+                ];
+              });
+            })
+          ];
+        })
+        (import ./overlays/hoffice)
+      ];
+
+      mkHost =
+        hostPath: overlays:
+        import hostPath {
+          inherit inputs overlays;
+        };
+    in
+    {
+      nixosConfigurations = {
+        # Machine
+        mafuyu = mkHost ./hosts/machine/mafuyu overlays;
+        mizuki = mkHost ./hosts/machine/mizuki overlays;
+        ena = mkHost ./hosts/machine/ena overlays;
+        ribbon = mkHost ./hosts/machine/ribbon [
+          paring.overlays.default
+          imnyang.overlays.default
+        ];
+
+        # Server
+        hikari = mkHost ./hosts/server/hikari/default overlays;
+        hako = mkHost ./hosts/server/hikari/hako overlays;
+        natsu = mkHost ./hosts/server/natsu overlays;
+        kazusa = mkHost ./hosts/server/kazusa overlays;
+      };
+
+      darwinConfigurations = {
+        # Machine
+        kanade = mkHost ./hosts/machine/kanade overlays;
+      };
+    };
+}
--- a/hosts/machine/ena/configuration.nix
+++ b/hosts/machine/ena/configuration.nix
@ -0,0 +1,59 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/fonts.nix"
+    "${inputs.self}/modules/nixos/features/plasma.nix"
+    "${inputs.self}/modules/nixos/features/sound.nix"
+    "${inputs.self}/modules/nixos/features/packages.nix"
+    "${inputs.self}/modules/nixos/features/catppuccin.nix"
+    "${inputs.self}/modules/nixos/features/figma-agent.nix"
+    "${inputs.self}/modules/nixos/features/sbctl.nix"
+    "${inputs.self}/modules/nixos/features/grub-standalone.nix"
+    "${inputs.self}/modules/nixos/features/virtualisation.nix"
+    "${inputs.self}/modules/nixos/features/cockpit.nix"
+    "${inputs.self}/modules/nixos/features/bluetooth.nix"
+    "${inputs.self}/modules/nixos/features/graphics.nix"
+    "${inputs.self}/modules/nixos/features/steam.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+  ];
+
+  networking = {
+    hostName = "ena";
+    networkmanager.enable = true;
+    firewall.enable = false;
+  };
+
+  networking.networkmanager.plugins = [
+    pkgs.networkmanager-ssh
+  ];
+
+  services.printing.enable = true;
+  services.power-profiles-daemon.enable = true;
+  services.asusd.enable = true;
+  services.netbird.enable = true;
+
+  systemd.services.asusctl-battery-limit = {
+    description = "Set ASUS battery charge limit";
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "asusd.service" ];
+    after = [ "asusd.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.asusctl}/bin/asusctl battery limit 95";
+      RemainAfterExit = true;
+    };
+  };
+
+  services.cloudflare-warp.enable = true;
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/machine/ena/default.nix
+++ b/hosts/machine/ena/default.nix
@ -0,0 +1,42 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    home-manager
+    catppuccin
+    nix-flatpak
+    plasma-manager
+    spicetify-nix
+    vicinae
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    catppuccin.nixosModules.catppuccin
+    nix-flatpak.nixosModules.nix-flatpak
+    # lanzaboote.nixosModules.lanzaboote
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.sharedModules = [
+        plasma-manager.homeModules.plasma-manager
+        spicetify-nix.homeManagerModules.default
+        vicinae.homeManagerModules.default
+      ];
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/machine/ena/hardware-configuration.nix
+++ b/hosts/machine/ena/hardware-configuration.nix
@ -0,0 +1,71 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usbhid"
+  ];
+  boot.initrd.kernelModules = [ "xe" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelParams = [
+    # NVMe APST(Autonomous Power State Transition) 관련 이슈 방지
+    "nvme_core.default_ps_max_latency_us=0"
+    "xe.enable_psr=0"
+    "intel_idle.max_cstate=2" # C-state를 깊게 들어가지 않도록 제한 (테스트 후 점진적으로 상향 가능)
+  ];
+  hardware.enableRedistributableFirmware = true;
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/161e6b72-1ec6-4b9c-b1b7-325dd4320c2e";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."luks-5a2a5e2d-749d-408e-82df-82e8607ae67e" = {
+    device = "/dev/disk/by-uuid/5a2a5e2d-749d-408e-82df-82e8607ae67e";
+    allowDiscards = true;
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7078-16D1";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      intel-compute-runtime
+      vpl-gpu-rt # Lunar Lake 비디오 가속을 위한 핵심 패키지
+    ];
+  };
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  services.thermald.enable = true; # 인텔 CPU 발열 및 전력 관리 보조
+  services.fstrim.enable = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  # hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/machine/ena/home/config/plasma.nix
+++ b/hosts/machine/ena/home/config/plasma.nix
@ -0,0 +1,15 @@
+{ inputs, ... }:
+let
+  assets = "${inputs.self}/assets";
+in
+{
+  imports = [ "${inputs.self}/modules/home/plasma.nix" ];
+
+  programs.plasma.workspace.cursor = {
+    theme = "pjsk-cursor-n25-ena-ani";
+  };
+
+  programs.plasma.workspace.wallpaper = "${assets}/wallpaper/wallpaper1.jpg";
+
+  programs.plasma.kscreenlocker.appearance.wallpaper = "${assets}/wallpaper/wallpaper3.png";
+}
--- a/hosts/machine/ena/home/config/shell.nix
+++ b/hosts/machine/ena/home/config/shell.nix
@ -0,0 +1,57 @@
+{
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      # 디렉토리 네비게이션
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      # ls 별칭
+      ls = "eza --icons=always";
+      ll = "eza --icons=always -l";
+      la = "eza --icons=always -a";
+      lla = "eza --icons=always -la";
+
+      # NixOS 관련
+      rebuild = "nr";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "🎨 $directory:$character";
+      add_newline = false;
+      # username = {
+      #   style_user = "purple";
+      #   style_root = "purple";
+      #   format = "[$user]($style)";
+      #   show_always = true;
+      # };
+      # hostname = {
+      #   style = "green";
+      #   format = "[$hostname]($style)";
+      #   ssh_only = false;
+      # };
+      directory = {
+        style = "fg:#fbb6c4";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " 💕";
+        error_symbol = " ⚠️";
+      };
+    };
+  };
+}
--- a/hosts/machine/ena/home/default.nix
+++ b/hosts/machine/ena/home/default.nix
@ -0,0 +1,46 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  xdg.enable = true;
+  # gtk.enable = true;
+
+  home.stateVersion = "25.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+  home.packages = import ./packages.nix { inherit pkgs inputs; };
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    VISUAL = "nano";
+  };
+
+  xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".force = true;
+
+  programs.vicinae = {
+    enable = true;
+    systemd = {
+      enable = true;
+      autoStart = true;
+      environment = {
+        USE_LAYER_SHELL = 1;
+      };
+    };
+  };
+
+  imports = [
+    "${inputs.self}/modules/home/git.nix"
+    # "${inputs.self}/modules/home/firefox.nix
+    "${inputs.self}/modules/home/neovim.nix"
+    "${inputs.self}/modules/home/spicetify.nix"
+    "${inputs.self}/modules/home/ghostty.nix"
+    "${inputs.self}/modules/home/zed.nix"
+    "${inputs.self}/modules/home/discord/linux.nix"
+    "${inputs.self}/modules/home/vscode.nix"
+    ./config/shell.nix
+    ./config/plasma.nix
+  ];
+}
--- a/hosts/machine/ena/home/packages.nix
+++ b/hosts/machine/ena/home/packages.nix
@ -0,0 +1,27 @@
+{ pkgs, inputs }:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+  pkgsPacketTracer8 = import inputs.nixpkgs-2511 {
+    inherit system;
+    config = {
+      allowUnfree = true;
+      permittedInsecurePackages = [
+        "ciscoPacketTracer8-8.2.2"
+      ];
+    };
+  };
+in
+with pkgs;
+(import ../../../../modules/home/packages.nix { inherit pkgs inputs; })
++ [
+  # tail-tray
+  kdePackages.kcolorchooser
+  fastfetch
+  # amnezia-vpn
+  # inputs.waterfox.packages.${pkgs.system}.waterfox
+  gnome-network-displays
+  element-desktop
+  cisco-packet-tracer_9
+  pkgsPacketTracer8.ciscoPacketTracer8
+  # hoffice
+]
--- a/hosts/machine/kanade/configuration.nix
+++ b/hosts/machine/kanade/configuration.nix
@ -0,0 +1,23 @@
+{
+  pkgs,
+  inputs,
+  overlays ? [ ],
+  ...
+}:
+{
+  imports = [
+    ./modules/nix.nix
+    ./modules/user.nix
+    ./modules/mac
+    ./modules/packages.nix
+    ./modules/homebrew/default.nix
+    "${inputs.self}/modules/home/discord/mac.nix"
+  ];
+
+  nixpkgs = {
+    hostPlatform = "aarch64-darwin";
+    overlays = overlays;
+  };
+
+  system.stateVersion = 5;
+}
--- a/hosts/machine/kanade/default.nix
+++ b/hosts/machine/kanade/default.nix
@ -0,0 +1,36 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs) darwin home-manager;
+in
+darwin.lib.darwinSystem {
+  system = "aarch64-darwin";
+  modules = [
+    ./configuration.nix
+    home-manager.darwinModules.home-manager
+    inputs.nix-homebrew.darwinModules.nix-homebrew
+    {
+      nix-homebrew = {
+        enable = true;
+        user = "imnyang";
+        mutableTaps = true;
+        # nix-darwin's Homebrew module uses /opt/homebrew/bin/brew directly.
+        # The nix-homebrew integration calls `brew` before it is on PATH.
+        enableFishIntegration = false;
+      };
+    }
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/machine/kanade/home/config/git.nix
+++ b/hosts/machine/kanade/home/config/git.nix
@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  programs.git = {
+    enable = true;
+
+    # 기본 사용자 설정
+    # userName = "imnyang";
+    # userEmail = "imnyang@pm.me";
+
+    settings = {
+      user = {
+        signingkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD";
+        name = "imnyang";
+        email = "imnyang@pm.me";
+      };
+      # gpg = {
+      #   format = "ssh";
+      #   "ssh".program = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign";
+      # };
+      # commit.gpgsign = true;
+      init.defaultBranch = "main";
+      pull.rebase = false;
+      includeIf."gitdir:~/workspaces/git/adofai.gg/" = {
+        path = builtins.toFile "gitconfig-adofaigg" ''
+          [user]
+            email = imnyang@adofai.gg
+        '';
+      };
+    };
+  };
+}
--- a/hosts/machine/kanade/home/config/shell.nix
+++ b/hosts/machine/kanade/home/config/shell.nix
@ -0,0 +1,64 @@
+{
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza --icons=always";
+      ll = "eza --icons=always -l";
+      la = "eza --icons=always -a";
+      lla = "eza --icons=always -la";
+
+      # nix-darwin 관련
+      rebuild = "sudo darwin-rebuild switch --flake .#kanade";
+      update = "nix flake update";
+      clean = "nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+
+      set -gx ANDROID_HOME "$HOME/Library/Android/sdk"
+      if test -d "$ANDROID_HOME/ndk"
+        set -l ndk_versions "$ANDROID_HOME"/ndk/*
+        if test (count $ndk_versions) -gt 0
+          set -gx NDK_HOME $ndk_versions[-1]
+        end
+      end
+
+      set -gx SSH_AUTH_SOCK /Users/imnyang/.ssh/proton-pass-agent.sock
+    '';
+  };
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "🎼 $directory:$character";
+      add_newline = false;
+      # username = {
+      #   style_user = "purple";
+      #   style_root = "purple";
+      #   format = "[$user]($style)";
+      #   show_always = true;
+      # };
+      # hostname = {
+      #   style = "green";
+      #   format = "[$hostname]($style)";
+      #   ssh_only = false;
+      # };
+      directory = {
+        style = "fg:#fbb6c4";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " 💕";
+        error_symbol = " ⚠️";
+      };
+    };
+  };
+}
--- a/hosts/machine/kanade/home/default.nix
+++ b/hosts/machine/kanade/home/default.nix
@ -0,0 +1,27 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  xdg.enable = true;
+
+  home.stateVersion = "25.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/Users/imnyang";
+  home.packages = import ./packages.nix { inherit pkgs inputs; };
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  imports = [
+    "${inputs.self}/modules/home/neovim.nix"
+    "${inputs.self}/modules/home/ghostty.nix"
+    "${inputs.self}/modules/home/zed.nix"
+    ./config/git.nix
+    ./config/shell.nix
+  ];
+}
--- a/hosts/machine/kanade/home/packages.nix
+++ b/hosts/machine/kanade/home/packages.nix
@ -0,0 +1,55 @@
+{ pkgs, inputs, ... }:
+let
+  dr = import ../../../../modules/nixos/features/packages/dr.nix { inherit pkgs; };
+in
+with pkgs;
+[
+  # Language runtimes and package managers
+  nodejs
+  pnpm
+  yarn
+  bun
+  python3
+  rustup
+  go
+
+  # Editors and database tools
+  neovide
+  jetbrains.datagrip
+  jetbrains.idea
+
+  # CLI utilities
+  ripgrep
+  fd
+  bat
+  fzf
+  jq
+  eza
+  fastfetch
+  btop
+
+  # Source control
+  gh
+  lazygit
+
+  # Browsers
+  google-chrome
+
+  # Development applications
+  postman
+  scrcpy
+
+  # Virtualisation
+  utm
+
+  # Media
+  iina
+
+  # Gaming
+  prismlauncher
+
+  # Nix workflows
+  dr
+
+  inputs.muvel.packages.${pkgs.stdenv.hostPlatform.system}.muvel
+]
--- a/hosts/machine/kanade/modules/homebrew/brews.nix
+++ b/hosts/machine/kanade/modules/homebrew/brews.nix
@ -0,0 +1,8 @@
+[
+  # Apple and mobile development
+  "cocoapods"
+  "watchman"
+
+  # Media customisation
+  "spicetify-cli"
+]
--- a/hosts/machine/kanade/modules/homebrew/casks.nix
+++ b/hosts/machine/kanade/modules/homebrew/casks.nix
@ -0,0 +1,46 @@
+[
+  # Security and networking
+  "1password"
+  "cloudflare-warp"
+  "protonvpn"
+  "microsoft-edge@canary"
+
+  # Communication
+  "discord"
+  "discord@canary"
+  "proton-mail"
+  "signal"
+  "zoom"
+
+  # Productivity and design
+  "camo-studio"
+  "proton-drive"
+  "figma"
+  "notion"
+
+  # Development
+  "android-studio"
+  "burp-suite"
+  "docker-desktop"
+  "unity-hub"
+  "visual-studio-code@insiders"
+  "zed"
+  "codex"
+  "codex-app"
+  "codexbar"
+
+  # Media and audio
+  "finetune"
+  "spotify"
+
+  # Gaming and remote access
+  "parsec"
+  "steam"
+
+  # macOS utilities
+  "alt-tab"
+  "keka"
+  "raycast"
+  "thaw"
+  "mole-app"
+]
--- a/hosts/machine/kanade/modules/homebrew/default.nix
+++ b/hosts/machine/kanade/modules/homebrew/default.nix
@ -0,0 +1,18 @@
+{
+  ...
+}:
+{
+  homebrew = {
+    enable = true;
+    enableFishIntegration = true;
+
+    onActivation = {
+      autoUpdate = true;
+      cleanup = "zap";
+      upgrade = true;
+    };
+
+    brews = import ./brews.nix;
+    casks = import ./casks.nix;
+  };
+}
--- a/hosts/machine/kanade/modules/mac/avatar.nix
+++ b/hosts/machine/kanade/modules/mac/avatar.nix
@ -0,0 +1,34 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  avatar = pkgs.runCommand "kanade-avatar.jpg" { nativeBuildInputs = [ pkgs.imagemagick ]; } ''
+    magick "${inputs.self}/assets/avatar.webp" -quality 92 "$out"
+  '';
+in
+{
+  system.activationScripts.postActivation.text = ''
+    avatarPath="/Library/User Pictures/imnyang.jpg"
+    importFile="$(/usr/bin/mktemp /tmp/imnyang-avatar.XXXXXX)"
+
+    /usr/bin/install -d -m 0755 "/Library/User Pictures"
+    /usr/bin/install -m 0644 "${avatar}" "$avatarPath"
+
+    # Replace both account-picture representations. JPEGPhoto is embedded in
+    # the directory record and is used by the login screen and System Settings.
+    /usr/bin/dscl . -delete /Users/imnyang JPEGPhoto >/dev/null 2>&1 || true
+    /usr/bin/dscl . -delete /Users/imnyang Picture >/dev/null 2>&1 || true
+    /usr/bin/dscl . -create /Users/imnyang Picture "$avatarPath"
+
+    /usr/bin/printf '%s\n%s:%s' \
+      '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName externalbinary:dsAttrTypeStandard:JPEGPhoto' \
+      'imnyang' \
+      "$avatarPath" > "$importFile"
+    /usr/bin/dsimport "$importFile" /Local/Default M
+    /bin/rm -f "$importFile"
+
+    /usr/bin/dscacheutil -flushcache
+  '';
+}
--- a/hosts/machine/kanade/modules/mac/default.nix
+++ b/hosts/machine/kanade/modules/mac/default.nix
@ -0,0 +1,10 @@
+{
+  imports = [
+    ./avatar.nix
+    ./dock.nix
+    ./keyboard.nix
+    ./preferences.nix
+    ./touch-id.nix
+    ./wallpaper.nix
+  ];
+}
--- a/hosts/machine/kanade/modules/mac/dock.nix
+++ b/hosts/machine/kanade/modules/mac/dock.nix
@ -0,0 +1,36 @@
+{ pkgs, ... }:
+{
+  system.defaults.dock = {
+    autohide = false;
+    show-recents = true;
+
+    wvous-bl-corner = 1;
+    wvous-br-corner = 1;
+    wvous-tl-corner = 1;
+    wvous-tr-corner = 1;
+
+    persistent-apps = [
+      "/System/Applications/Apps.app"
+      "/Applications/Microsoft Edge Canary.app"
+      "/Applications/Discord.app"
+      "/Applications/KakaoTalk.app"
+      "/Applications/Signal.app"
+      "/Applications/Proton Mail.app"
+      # "/Applications/Proton Pass.app"
+      # "/System/Applications/Mail.app"
+      "/Applications/1Password.app"
+      "/Applications/Figma.app"
+      "/Applications/Notion.app"
+      # "/Applications/Notion Calendar.app"
+      "${pkgs.utm}/Applications/UTM.app"
+      "/Applications/Spotify.app"
+      "${pkgs.ghostty-bin}/Applications/Ghostty.app"
+      "/Applications/Visual Studio Code - Insiders.app"
+      "/Applications/Zed.app"
+      "/System/Applications/System Settings.app"
+    ];
+    mru-spaces = false;
+    tilesize = 48;
+    orientation = "bottom";
+  };
+}
--- a/hosts/machine/kanade/modules/mac/keyboard.nix
+++ b/hosts/machine/kanade/modules/mac/keyboard.nix
@ -0,0 +1,14 @@
+{
+  system.keyboard.enableKeyMapping = true;
+
+  system.defaults.NSGlobalDomain = {
+    ApplePressAndHoldEnabled = false;
+    InitialKeyRepeat = 15;
+    KeyRepeat = 2;
+    NSAutomaticCapitalizationEnabled = false;
+    NSAutomaticDashSubstitutionEnabled = false;
+    NSAutomaticPeriodSubstitutionEnabled = false;
+    NSAutomaticQuoteSubstitutionEnabled = false;
+    NSAutomaticSpellingCorrectionEnabled = false;
+  };
+}
--- a/hosts/machine/kanade/modules/mac/preferences.nix
+++ b/hosts/machine/kanade/modules/mac/preferences.nix
@ -0,0 +1,92 @@
+{ pkgs, ... }:
+{
+  # sudo_local is managed as a regular file by touch-id.nix because macOS 26
+  # rejects nix-darwin's symlink-based /etc/pam.d management.
+  security.pam.services.sudo_local.enable = false;
+
+  networking = {
+    hostName = "kanade";
+    computerName = "kanade";
+    localHostName = "kanade";
+  };
+
+  time.timeZone = "Asia/Seoul";
+
+  # Keep the terminal font declared in the Ghostty Home Manager module available
+  # to native macOS applications as well.
+  fonts.packages = [ pkgs.nerd-fonts.jetbrains-mono ];
+
+  system.defaults = {
+    NSGlobalDomain = {
+      AppleICUForce24HourTime = true;
+      AppleMeasurementUnits = "Centimeters";
+      AppleTemperatureUnit = "Celsius";
+
+      AppleInterfaceStyleSwitchesAutomatically = false;
+      AppleInterfaceStyle = null;
+
+      NSAutomaticCapitalizationEnabled = false;
+      NSAutomaticDashSubstitutionEnabled = false;
+      NSAutomaticPeriodSubstitutionEnabled = false;
+      NSAutomaticQuoteSubstitutionEnabled = false;
+      NSAutomaticSpellingCorrectionEnabled = false;
+
+      AppleShowAllExtensions = true;
+      AppleShowAllFiles = true;
+      NSNavPanelExpandedStateForSaveMode = true;
+      NSNavPanelExpandedStateForSaveMode2 = true;
+      "com.apple.sound.beep.feedback" = 0;
+    };
+
+    SoftwareUpdate = {
+      AutomaticallyInstallMacOSUpdates = false;
+    };
+
+    finder = {
+      AppleShowAllExtensions = true;
+      FXEnableExtensionChangeWarning = false;
+      FXDefaultSearchScope = "SCcf";
+      FXRemoveOldTrashItems = true;
+      ShowPathbar = true;
+      ShowStatusBar = true;
+      # _FXShowPosixPathInTitle = true;
+    };
+
+    menuExtraClock = {
+      ShowAMPM = false;
+      ShowDate = 1;
+      ShowSeconds = false;
+      Show24Hour = true;
+    };
+
+    trackpad = {
+      Clicking = true;
+      TrackpadRightClick = true;
+      TrackpadThreeFingerDrag = true;
+    };
+
+    loginwindow.GuestEnabled = false;
+
+    CustomUserPreferences = {
+      "com.apple.AdLib" = {
+        allowApplePersonalizedAdvertising = false;
+      };
+      "com.apple.controlcenter" = {
+        BatteryShowPercentage = true;
+      };
+      "com.apple.desktopservices" = {
+        DSDontWriteNetworkStores = true;
+        DSDontWriteUSBStores = true;
+      };
+      "com.apple.finder"._FXSortFoldersFirst = true;
+      "com.apple.screensaver" = {
+        askForPassword = 1;
+        askForPasswordDelay = 0;
+      };
+    };
+  };
+
+  system.activationScripts.postActivation.text = ''
+    /System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/activateSettings -u
+  '';
+}
--- a/hosts/machine/kanade/modules/mac/touch-id.nix
+++ b/hosts/machine/kanade/modules/mac/touch-id.nix
@ -0,0 +1,12 @@
+{ pkgs, ... }:
+let
+  sudoLocal = pkgs.writeText "sudo_local" ''
+    # Managed by nix-darwin: use Touch ID for sudo with password fallback.
+    auth       sufficient     pam_tid.so
+  '';
+in
+{
+  system.activationScripts.postActivation.text = ''
+    /usr/bin/install -m 0444 "${sudoLocal}" /etc/pam.d/sudo_local
+  '';
+}
--- a/hosts/machine/kanade/modules/mac/wallpaper.nix
+++ b/hosts/machine/kanade/modules/mac/wallpaper.nix
@ -0,0 +1,42 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  wallpaper = "${inputs.self}/assets/wallpaper/wallpaper1.jpg";
+  setWallpaperScript = pkgs.writeShellScriptBin "set-wallpaper-script" ''
+    set -eu
+
+    # System Events runs in the logged-in Aqua session and updates every Space.
+    # Retry because launch agents can start before the desktop is fully ready.
+    for attempt in {1..12}; do
+      if /usr/bin/osascript <<'APPLESCRIPT'
+        tell application "System Events"
+          tell every desktop
+            set picture to "${wallpaper}"
+          end tell
+        end tell
+APPLESCRIPT
+      then
+        exit 0
+      fi
+
+      /bin/sleep 5
+    done
+
+    exit 1
+  '';
+in
+{
+  environment.systemPackages = [ setWallpaperScript ];
+
+  launchd.user.agents.set-wallpaper = {
+    command = "${setWallpaperScript}/bin/set-wallpaper-script";
+    serviceConfig = {
+      RunAtLoad = true;
+      ProcessType = "Interactive";
+      LimitLoadToSessionType = "Aqua";
+    };
+  };
+}
--- a/hosts/machine/kanade/modules/nix.nix
+++ b/hosts/machine/kanade/modules/nix.nix
@ -0,0 +1,37 @@
+{ ... }:
+{
+  nixpkgs.config.allowUnfree = true;
+
+  nix.settings = {
+    sandbox = "relaxed";
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    # Optimising during every build can race on Darwin. Run it separately instead.
+    auto-optimise-store = false;
+    trusted-users = [
+      "imnyang"
+    ];
+    substituters = [
+      "https://cache.mizuki.guru"
+      "https://nix.mizuki.my/public"
+    ];
+    trusted-public-keys = [
+      "cache.mizuki.guru-1:EbUC9b0ryD7BJKqfT8fl4GoS2ojLV+hI9fW1al5Whp0="
+      "public:SnHrtrxbCPcZujbJdgsKFeObTfRKQl5KhrI+LljtZUE="
+    ];
+  };
+
+  nix.optimise.automatic = true;
+
+  nix.gc = {
+    automatic = true;
+    interval = {
+      Weekday = 0;
+      Hour = 3;
+      Minute = 15;
+    };
+    options = "--delete-older-than 7d";
+  };
+}
--- a/hosts/machine/kanade/modules/packages.nix
+++ b/hosts/machine/kanade/modules/packages.nix
@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    # Recovery and bootstrap tools
+    curl
+    wget
+    vim
+
+    # Nix tooling
+    nixd
+    nil
+  ];
+}
--- a/hosts/machine/kanade/modules/user.nix
+++ b/hosts/machine/kanade/modules/user.nix
@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  system.primaryUser = "imnyang";
+
+  users.users.imnyang = {
+    name = "imnyang";
+    home = "/Users/imnyang";
+    shell = pkgs.fish;
+  };
+
+  environment.shells = [ pkgs.fish ];
+
+  programs.fish.enable = true;
+  programs.zsh.enable = true;
+}
--- a/hosts/machine/mafuyu/configuration.nix
+++ b/hosts/machine/mafuyu/configuration.nix
@ -0,0 +1,64 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/fonts.nix"
+    "${inputs.self}/modules/nixos/features/packages.nix"
+    "${inputs.self}/modules/nixos/features/plasma.nix"
+    "${inputs.self}/modules/nixos/features/sound.nix"
+    "${inputs.self}/modules/nixos/features/catppuccin.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/steam.nix"
+    "${inputs.self}/modules/nixos/features/sunshine.nix"
+  ];
+
+  networking = {
+    hostName = "mafuyu";
+    networkmanager.enable = true;
+    firewall.enable = false;
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts."http://broadcast.epc.mizuki.arpa".extraConfig = ''
+      @preflight method OPTIONS
+
+      header {
+        Access-Control-Allow-Origin *
+        Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        Access-Control-Allow-Headers *
+      }
+
+      respond @preflight "" 204
+
+      reverse_proxy 127.0.0.1:6769
+    '';
+    virtualHosts."http://broadcast.epc.mizuki.arpa:8027".extraConfig = ''
+      @preflight method OPTIONS
+
+      header {
+        Access-Control-Allow-Origin *
+        Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        Access-Control-Allow-Headers *
+      }
+
+      respond @preflight "" 204
+
+      reverse_proxy 127.0.0.1:1108
+    '';
+  };
+
+  services.displayManager = {
+    plasma-login-manager.enable = true;
+    autoLogin.user = "imnyang";
+  };
+
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@mizuki"
+  ];
+
+  system.stateVersion = "26.05";
+}
--- a/hosts/machine/mafuyu/default.nix
+++ b/hosts/machine/mafuyu/default.nix
@ -0,0 +1,37 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    home-manager
+    catppuccin
+    plasma-manager
+    spicetify-nix
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    catppuccin.nixosModules.catppuccin
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.sharedModules = [
+        plasma-manager.homeModules.plasma-manager
+        spicetify-nix.homeManagerModules.default
+      ];
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/machine/mafuyu/hardware-configuration.nix
+++ b/hosts/machine/mafuyu/hardware-configuration.nix
@ -0,0 +1,79 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.kernelParams = [
+    # 가상 디스플레이(해상도) 1개 생성
+    "video=virtual:1920x1080@60"
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/223889e0-caa4-4dc5-a7b3-e5260230896f";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7233-6B3C";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = true;
+    powerManagement.finegrained = false; # 이슈 있으면 비활하기
+
+    open = false;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+
+    extraPackages = with pkgs; [
+      libva-vdpau-driver
+      libvdpau-va-gl
+      vulkan-loader
+      nvidia-vaapi-driver
+      vulkan-validation-layers
+      vulkan-extension-layer
+    ];
+    extraPackages32 = with pkgs.pkgsi686Linux; [
+      libva-vdpau-driver
+      libvdpau-va-gl
+    ];
+  };
+}
--- a/hosts/machine/mafuyu/home/config/plasma.nix
+++ b/hosts/machine/mafuyu/home/config/plasma.nix
@ -0,0 +1,16 @@
+{ inputs, ... }:
+let
+  assets = "${inputs.self}/assets";
+in
+{
+  imports = [ "${inputs.self}/modules/home/plasma.nix" ];
+  services.kdeconnect.enable = true;
+
+  programs.plasma.workspace.cursor = {
+    theme = "pjsk-cursor-n25-mafuyu-ani";
+  };
+
+  programs.plasma.workspace.wallpaper = "${assets}/wallpaper/wallpaper3.png";
+
+  programs.plasma.kscreenlocker.appearance.wallpaper = "${assets}/wallpaper/wallpaper3.png";
+}
--- a/hosts/machine/mafuyu/home/config/shell.nix
+++ b/hosts/machine/mafuyu/home/config/shell.nix
@ -0,0 +1,54 @@
+{
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza --icons=always";
+      ll = "eza --icons=always -l";
+      la = "eza --icons=always -a";
+      lla = "eza --icons=always -la";
+
+      rebuild = "nr";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "❄️ $directory:$character";
+      add_newline = false;
+      # username = {
+      #   style_user = "purple";
+      #   style_root = "purple";
+      #   format = "[$user]($style)";
+      #   show_always = true;
+      # };
+      # hostname = {
+      #   style = "green";
+      #   format = "[$hostname]($style)";
+      #   ssh_only = false;
+      # };
+      directory = {
+        style = "fg:#fbb6c4";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " 💕";
+        error_symbol = " ⚠️";
+      };
+    };
+  };
+}
--- a/hosts/machine/mafuyu/home/default.nix
+++ b/hosts/machine/mafuyu/home/default.nix
@ -0,0 +1,44 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  xdg.enable = true;
+
+  home.stateVersion = "25.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+  home.packages = import ./packages.nix { inherit pkgs inputs; };
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".force = true;
+
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "imnyang";
+        email = "imnyang@pm.me";
+      };
+      commit.gpgsign = false;
+      init.defaultBranch = "main";
+      pull.rebase = false;
+    };
+  };
+
+  imports = [
+    "${inputs.self}/modules/home/firefox.nix"
+    "${inputs.self}/modules/home/neovim.nix"
+    "${inputs.self}/modules/home/ghostty.nix"
+    "${inputs.self}/modules/home/zed.nix"
+    "${inputs.self}/modules/home/discord/linux.nix"
+    ./config/shell.nix
+    ./config/plasma.nix
+  ];
+}
--- a/hosts/machine/mafuyu/home/packages.nix
+++ b/hosts/machine/mafuyu/home/packages.nix
@ -0,0 +1,7 @@
+{ pkgs, inputs }:
+with pkgs;
+[
+  pjsk-cursor.n25.ani
+  codex
+  inputs.codex-app.packages.${stdenv.buildPlatform.system}.codex-desktop
+]
--- a/hosts/machine/mizuki/configuration.nix
+++ b/hosts/machine/mizuki/configuration.nix
@ -0,0 +1,55 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/fonts.nix"
+    "${inputs.self}/modules/nixos/features/packages.nix"
+    "${inputs.self}/modules/nixos/features/plasma.nix"
+    "${inputs.self}/modules/nixos/features/sound.nix"
+    "${inputs.self}/modules/nixos/features/catppuccin.nix"
+    "${inputs.self}/modules/nixos/features/figma-agent.nix"
+    "${inputs.self}/modules/nixos/features/cockpit.nix"
+    "${inputs.self}/modules/nixos/features/bluetooth.nix"
+    "${inputs.self}/modules/nixos/features/graphics.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/virtualisation.nix"
+    "${inputs.self}/modules/nixos/features/steam.nix"
+    "${inputs.self}/modules/nixos/features/sunshine.nix"
+  ];
+
+  networking = {
+    hostName = "mizuki";
+    networkmanager.enable = true;
+    firewall.enable = false;
+    interfaces = {
+      enp3s0 = {
+        wakeOnLan.enable = true;
+      };
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts."http://broadcast.epc.mizuki.arpa".extraConfig = ''
+      @preflight method OPTIONS
+
+      header {
+        Access-Control-Allow-Origin *
+        Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        Access-Control-Allow-Headers *
+      }
+
+      respond @preflight "" 204
+
+      reverse_proxy 127.0.0.1:6769
+    '';
+  };
+
+  services.printing.enable = true;
+  services.flatpak.enable = true;
+
+  system.stateVersion = "26.05";
+}
--- a/hosts/machine/mizuki/default.nix
+++ b/hosts/machine/mizuki/default.nix
@ -0,0 +1,41 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    home-manager
+    catppuccin
+    nix-flatpak
+    plasma-manager
+    spicetify-nix
+    vicinae
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    catppuccin.nixosModules.catppuccin
+    nix-flatpak.nixosModules.nix-flatpak
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.sharedModules = [
+        plasma-manager.homeModules.plasma-manager
+        spicetify-nix.homeManagerModules.default
+        vicinae.homeManagerModules.default
+      ];
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/machine/mizuki/hardware-configuration.nix
+++ b/hosts/machine/mizuki/hardware-configuration.nix
@ -0,0 +1,91 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelParams = [ "nvidia.NV_temporaryFilePath=/var/tmp" ];
+  boot.extraModulePackages = [ ];
+  boot.extraModprobeConfig = ''
+    options nvidia NVreg_PreserveVideoMemoryAllocations=1
+  '';
+
+  fileSystems."/" =
+    { device = "/dev/mapper/luks-f103ab07-586f-4bfe-b8e9-cdee9d504a0a";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."luks-f103ab07-586f-4bfe-b8e9-cdee9d504a0a".device = "/dev/disk/by-uuid/f103ab07-586f-4bfe-b8e9-cdee9d504a0a";
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/C9F2-8CD3";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0fa840c5-07ad-46b5-a0e8-0ed958d1bb7a";
+    fsType = "ext4";
+    options = [
+      "defaults"
+      "nofail"
+    ];
+  };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 32 * 1024;
+    }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = true;
+    powerManagement.finegrained = false; # 이슈 있으면 비활하기
+
+    open = false;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+
+    extraPackages = with pkgs; [
+      libva-vdpau-driver
+      libvdpau-va-gl
+      vulkan-loader
+      nvidia-vaapi-driver
+      vulkan-validation-layers
+      vulkan-extension-layer
+    ];
+    extraPackages32 = with pkgs.pkgsi686Linux; [
+      libva-vdpau-driver
+      libvdpau-va-gl
+    ];
+  };
+}
--- a/hosts/machine/mizuki/home/config/plasma.nix
+++ b/hosts/machine/mizuki/home/config/plasma.nix
@ -0,0 +1,16 @@
+{ inputs, ... }:
+let
+  assets = "${inputs.self}/assets";
+in
+{
+  imports = [ "${inputs.self}/modules/home/plasma.nix" ];
+  services.kdeconnect.enable = true;
+
+  programs.plasma.workspace.cursor = {
+    theme = "pjsk-cursor-n25-mizuki-ani";
+  };
+
+  programs.plasma.workspace.wallpaper = "${assets}/wallpaper/wallpaper1.jpg";
+
+  programs.plasma.kscreenlocker.appearance.wallpaper = "${assets}/wallpaper/wallpaper3.png";
+}
--- a/hosts/machine/mizuki/home/config/shell.nix
+++ b/hosts/machine/mizuki/home/config/shell.nix
@ -0,0 +1,54 @@
+{
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza --icons=always";
+      ll = "eza --icons=always -l";
+      la = "eza --icons=always -a";
+      lla = "eza --icons=always -la";
+
+      rebuild = "nr";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "🎀 $directory:$character";
+      add_newline = false;
+      # username = {
+      #   style_user = "purple";
+      #   style_root = "purple";
+      #   format = "[$user]($style)";
+      #   show_always = true;
+      # };
+      # hostname = {
+      #   style = "green";
+      #   format = "[$hostname]($style)";
+      #   ssh_only = false;
+      # };
+      directory = {
+        style = "fg:#fbb6c4";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " 💕";
+        error_symbol = " ⚠️";
+      };
+    };
+  };
+}
--- a/hosts/machine/mizuki/home/default.nix
+++ b/hosts/machine/mizuki/home/default.nix
@ -0,0 +1,61 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  xdg.enable = true;
+  # gtk.enable = true;
+
+  home.stateVersion = "25.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+  home.packages = import ./packages.nix { inherit pkgs inputs; };
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  programs.ssh = {
+    enable = true;
+    matchBlocks = {
+      "*" = {
+        forwardAgent = false;
+        identityAgent = "~/.1password/agent.sock";
+        setEnv = {
+          TERM = "xterm-256color";
+        };
+        extraOptions = {
+          ServerAliveInterval = "0";
+          ServerAliveCountMax = "3";
+          Compression = "no";
+          AddKeysToAgent = "no";
+          HashKnownHosts = "no";
+          UserKnownHostsFile = "~/.ssh/known_hosts";
+          ControlMaster = "no";
+          ControlPath = "~/.ssh/master-%r@%n:%p";
+          ControlPersist = "no";
+        };
+      };
+    };
+  };
+
+  xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".force = true;
+
+  imports = [
+    "${inputs.self}/modules/home/git.nix"
+    "${inputs.self}/modules/home/neovim.nix"
+    "${inputs.self}/modules/home/spicetify.nix"
+    "${inputs.self}/modules/home/ghostty.nix"
+    "${inputs.self}/modules/home/zed.nix"
+    "${inputs.self}/modules/home/vicinae.nix"
+    ./config/shell.nix
+    ./config/plasma.nix
+    "${inputs.self}/modules/home/discord/linux.nix"
+    "${inputs.self}/modules/home/obs-studio.nix"
+    "${inputs.self}/modules/home/vscode.nix"
+    "${inputs.self}/modules/home/ciscopackettracer.nix"
+  ];
+}
--- a/hosts/machine/mizuki/home/packages.nix
+++ b/hosts/machine/mizuki/home/packages.nix
@ -0,0 +1,16 @@
+{ pkgs, inputs }:
+with pkgs;
+(import ../../../../modules/home/packages.nix { inherit pkgs inputs; })
++ [
+  # tail-tray
+  kdePackages.kcolorchooser
+  fastfetch
+  android-studio
+  lmstudio
+
+  # dotnet-runtime
+  dotnet-sdk
+  jetbrains.rider
+  # waterfox-bin
+  # inputs.waterfox.packages.${pkgs.system}.waterfox
+]
--- a/hosts/machine/ribbon/configuration.nix
+++ b/hosts/machine/ribbon/configuration.nix
@ -0,0 +1,21 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+  ];
+
+  wsl.enable = true;
+  wsl.defaultUser = "imnyang";
+
+  networking = {
+    hostName = "ribbon";
+    firewall.enable = false;
+  };
+
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@mizuki"
+  ];
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/machine/ribbon/default.nix
+++ b/hosts/machine/ribbon/default.nix
@ -0,0 +1,31 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    nixos-wsl
+    home-manager
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    nixos-wsl.nixosModules.default
+    ./configuration.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.sharedModules = [];
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home/home.nix;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/machine/ribbon/home/config/shell.nix
+++ b/hosts/machine/ribbon/home/config/shell.nix
@ -0,0 +1,57 @@
+{
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      # 디렉토리 네비게이션
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      # ls 별칭
+      ls = "eza --icons=always";
+      ll = "eza --icons=always -l";
+      la = "eza --icons=always -a";
+      lla = "eza --icons=always -la";
+
+      # NixOS 관련
+      rebuild = "nr";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "$username@$hostname:$directory$character";
+      add_newline = false;
+      username = {
+        style_user = "purple";
+        style_root = "purple";
+        format = "[$user]($style)";
+        show_always = true;
+      };
+      hostname = {
+        style = "green";
+        format = "[$hostname]($style)";
+        ssh_only = false;
+      };
+      directory = {
+        style = "blue";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " >";
+        error_symbol = " >";
+      };
+    };
+  };
+}
--- a/hosts/machine/ribbon/home/home.nix
+++ b/hosts/machine/ribbon/home/home.nix
@ -0,0 +1,35 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  home.stateVersion = "25.11";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+  home.packages = import ./packages.nix { inherit pkgs inputs; };
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "imnyang";
+        email = "imnyang@pm.me";
+      };
+      commit.gpgsign = false;
+      init.defaultBranch = "main";
+      pull.rebase = false;
+    };
+  };
+
+  imports = [
+    "${inputs.self}/modules/home/neovim.nix"
+    ./config/shell.nix
+  ];
+}
--- a/hosts/machine/ribbon/home/packages.nix
+++ b/hosts/machine/ribbon/home/packages.nix
@ -0,0 +1,10 @@
+{ pkgs, inputs }:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+with pkgs;
+[
+    nr
+    nrr
+]
--- a/hosts/server/hikari/default/.sops.yaml
+++ b/hosts/server/hikari/default/.sops.yaml
@ -0,0 +1,7 @@
+creation_rules:
+  - path_regex: secrets/.*\.ya?ml$
+    age:
+      - age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
+      - age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako
+      - age1wnxeqyzqsnylm4vdgzrlyu7k4yev82zuru6nzy72hwvu6htde4gq9wc5vu # hikari
+      - age1hlld327xfhm44hns9l9j6h4csrl5cl50h2qkhpl3969awgl665fsnxd3zc # kanade
--- a/hosts/server/hikari/default/configuration.nix
+++ b/hosts/server/hikari/default/configuration.nix
@ -0,0 +1,55 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/cockpit.nix"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/podman.nix"
+
+    ./services/rustfs.nix
+    ./services/nextcloud.nix
+  ];
+
+  # 1. 크론 설정
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "0 1 * * * imnyang printf '\\n%s : ' \"$(date)\" >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
+    ];
+  };
+
+  services.qemuGuest.enable = true;
+
+  # 2. 사용자 SSH 키 등록
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    eza
+    neovim
+    nil
+    nixd
+  ];
+
+  programs.git.config = {
+    safe.directory = "*";
+  };
+
+  nix.settings.require-sigs = false;
+
+  networking = {
+    hostName = "hikari";
+    networkmanager.enable = true;
+    firewall.enable = false;
+    bridges.br0 = {
+      interfaces = [
+        "eno1"
+      ];
+    };
+  };
+
+  system.stateVersion = "26.05";
+}
--- a/hosts/server/hikari/default/default.nix
+++ b/hosts/server/hikari/default/default.nix
@ -0,0 +1,33 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    home-manager
+    quadlet-nix
+    sops-nix
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    sops-nix.nixosModules.sops
+    home-manager.nixosModules.home-manager
+    inputs.rustfs.nixosModules.rustfs
+    quadlet-nix.nixosModules.quadlet
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home.nix;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/server/hikari/default/hardware-configuration.nix
+++ b/hosts/server/hikari/default/hardware-configuration.nix
@ -0,0 +1,65 @@
+# Do not modify this file! It was generated by nixos-generate-config
+# and may be overwritten by future invocations. Please make changes
+# to configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/mapper/luks-32ac59f9-fa04-4ec7-a7a2-9b6821c19e35";
+    fsType = "ext4";
+  };
+  fileSystems."/".neededForBoot = true;
+
+  boot.initrd.luks.devices."luks-32ac59f9-fa04-4ec7-a7a2-9b6821c19e35" = {
+    device = "/dev/disk/by-uuid/32ac59f9-fa04-4ec7-a7a2-9b6821c19e35";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/ED22-EDE6";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  fileSystems."/mnt/snow" = {
+    device = "/dev/disk/by-uuid/68ecc71d-66d7-4900-9ac2-1ddde0d607a8";
+    fsType = "ext4";
+  };
+
+  fileSystems."/mnt/rain" = {
+    device = "/dev/disk/by-uuid/311b9c03-eb92-42f1-824b-d1a997916abb";
+    fsType = "ext4";
+  };
+
+  swapDevices = [ ];
+
+  hardware.ksm.enable = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/server/hikari/default/home.nix
+++ b/hosts/server/hikari/default/home.nix
@ -0,0 +1,66 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+{
+  home.stateVersion = "26.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+
+  home.packages = [
+    nr
+    nrr
+  ];
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    VISUAL = "nano";
+  };
+
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza";
+      ll = "eza -l";
+      la = "eza -a";
+      lla = "eza -la";
+
+      rebuild = "sudo nixos-rebuild switch --flake .#hako";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+
+    functions = {
+      fish_prompt = ''
+        set_color purple
+        echo -n (whoami)
+        set_color normal
+        echo -n "@"
+        set_color green
+        echo -n (hostname)
+        set_color normal
+        echo -n ":"
+        set_color blue
+        echo -n (prompt_pwd)
+        set_color normal
+        echo -n " > "
+      '';
+    };
+  };
+}
--- a/hosts/server/hikari/default/secrets/rustfs.yaml
+++ b/hosts/server/hikari/default/secrets/rustfs.yaml
@ -0,0 +1,45 @@
+rustfs:
+    access-key: ENC[AES256_GCM,data:Cn7OLVdATw==,iv:D4SufuFFUMcX+yvVSoEQewjRKuYn2lTs1q6AD4mxUv4=,tag:ZW39Ss9aH0Yex1jyf29dFA==,type:str]
+    secret-key: ENC[AES256_GCM,data:cGvzwMB8GImZ7gqNzQ==,iv:R8zKJ7S7pZLvDR0+4NKoq1HGK75XGJU+kR7OZr5By20=,tag:dos2R8yxuXBMkh/0NkPMag==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuS1FVMkkvTm9iYzFjU0NB
+            UFRxRCsxK3FqYVVweTRNcktvOGl6MDdwRmljCllmaFVCZ2hmYmJtdjBqcDlLZTZk
+            SVl5SE05YnEvK3hkdEVYT3E2WGM5RzgKLS0tIHZlTEtwZmZZRTVWdVJxL1pGRlBt
+            ZEpCT3JuMXNtN1N2OGZpVFZPYm5HK1UKyGlt3NFaloUMJRNeRVFi8LCSAg6vXBMu
+            RJbfkCJBrzpHTPxNOKeFgsrgWt3FEmSSNN8180o4jymPyXhHqqOTEw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUHlOUExVb0Z2U3FZUXgr
+            UVc4b0VBZXpxQm11eVN5UTF6MXNnZVBmV2hVCkxXRnFTY1IxWmI2dlJDS0kxU1lx
+            Rmd3QXZwTWhMRG1ncVhPM1FCK1RkZnMKLS0tIHdZR2VwRzB6UFQzbEpLalhJdk5Z
+            ZElITjd3U2laaUVIZklRQVJubmcwNXcK7mSlmQF9tG5sPsCxjTXb3qhRvny2rVbS
+            txx0i7WXyzNbzL/FC6T7vPhsmZMEt0aAQpNOPAF4mayr4zfL7X1QsA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJQnFQR0ZUSEZRbzQ5V01j
+            emZldE9tc2MwM1VSZzRGbGhvaHVTZm43elZnCk14MitpU0hRVzlvK1VSQktmYlFS
+            bWswd29nTUMycWpoVXkxbGl5TDZjN2MKLS0tIGhOcUw4T1hEdlU3bzY1TjNLcFlq
+            YjhTK3A2UVlLODZwa3cra0o5bEJ5QTQKgS9sFXhgqWmdqXRpfsN7g9SgFByVUhVq
+            L0TTu/5PUkAt88KdUQlFUsm1PgaFnfJWPqfkIclmW+RJHaO0fQWBBQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wnxeqyzqsnylm4vdgzrlyu7k4yev82zuru6nzy72hwvu6htde4gq9wc5vu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQb3E4K1d4NHJ2a1kwR3h5
+            RWt4T0ppcTVFWjU3NUdPU1krejBqZjZkV0M4Ci9iYUdxd3NDOUlwZ1p2ODJOY1dk
+            SzE2MWZ5R2xXRFV1bVFpRzhEOWZJV2sKLS0tIEFDRTNnRmZMOVIxeGFGcmQ2aWhP
+            dTJYbEhlcCt2ZURReVlZWWpSQndiVXcKw+3Y9kIRgCdQGcpl++4llH8cAeQyhT/E
+            I3Pxi5GXMRMEgGGKom46WT8UzwXWT3tlCYQpPEmFp6OiJeuxUtU2mg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hlld327xfhm44hns9l9j6h4csrl5cl50h2qkhpl3969awgl665fsnxd3zc
+    lastmodified: "2026-06-09T01:25:36Z"
+    mac: ENC[AES256_GCM,data:+I6s5nI7FKxolC3dVUToBFU4jULtTjCouKqR+VLT9XNUeZTin258mi0kD5fDhDWpKlC3pEzZ1lTvSOkPb3JX73fvHYjCKbchaW36HgEZi/QF7pQIaZZQUMQZ8ga5KpeUWOvRhJPdbZ/QwKB3+nCAJv7lDMpSLMEDHV2im9sT2e4=,iv:8gMmUef18qK/KIAFojyzVG/n/hOyjVy03aX05/dNukU=,tag:uqn3NSsSDsuyWfkrXvAW1Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
--- a/hosts/server/hikari/default/services/nextcloud.nix
+++ b/hosts/server/hikari/default/services/nextcloud.nix
@ -0,0 +1,133 @@
+{ ... }:
+
+{
+  networking.firewall.allowedTCPPorts = [
+    60300
+    9980
+  ];
+
+  virtualisation.quadlet = {
+    networks.nextcloud = { };
+
+    containers = {
+      nextcloud-db = {
+        containerConfig = {
+          image = "postgres:17";
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/data/nextcloud/db:/var/lib/postgresql/data:Z"
+          ];
+
+          environmentFiles = [
+            "/data/nextcloud/db.env"
+          ];
+
+          exec = "postgres -c listen_addresses='*' -c unix_socket_directories=''";
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-redis = {
+        containerConfig = {
+          image = "redis:alpine";
+          networks = [ "nextcloud" ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-app = {
+        containerConfig = {
+          image = "nextcloud:apache";
+
+          publishPorts = [ "60300:80" ];
+
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/mnt/snow/Docker/nextcloud/data:/var/www/html:z"
+          ];
+
+          # environments로 변경 및 attrset 형식으로 정의
+          environments = {
+            POSTGRES_HOST = "nextcloud-db";
+            REDIS_HOST = "nextcloud-redis";
+            NEXTCLOUD_OVERWRITEPROTOCOL = "https";
+          };
+
+          environmentFiles = [
+            "/data/nextcloud/db.env"
+          ];
+        };
+
+        unitConfig = {
+          Requires = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+
+          After = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-cron = {
+        containerConfig = {
+          image = "nextcloud:apache";
+
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/mnt/snow/Docker/nextcloud/data:/var/www/html:z"
+          ];
+
+          exec = "/cron.sh";
+        };
+
+        unitConfig = {
+          Requires = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+
+          After = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      collabora = {
+        containerConfig = {
+          image = "collabora/code:latest";
+
+          hostname = "collabora";
+
+          publishPorts = [ "9980:9980" ];
+
+          addCapabilities = [ "MKNOD" ];
+
+          podmanArgs = [
+            "--privileged"
+            "--tty"
+          ];
+
+          # environments로 변경 및 attrset 형식으로 정의
+          environments = {
+            extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+          };
+        };
+
+        serviceConfig.Restart = "always";
+      };
+    };
+  };
+}
--- a/hosts/server/hikari/default/services/rustfs.nix
+++ b/hosts/server/hikari/default/services/rustfs.nix
@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  # sops.secrets = {
+  #   "rustfs/access-key" = {
+  #     sopsFile = ../secrets/rustfs.yaml;
+  #     owner = config.services.rustfs.user;
+  #     group = config.services.rustfs.group;
+  #     mode = "0400";
+  #     restartUnits = [ "rustfs.service" ];
+  #   };
+
+  #   "rustfs/secret-key" = {
+  #     sopsFile = ../secrets/rustfs.yaml;
+  #     owner = config.services.rustfs.user;
+  #     group = config.services.rustfs.group;
+  #     mode = "0400";
+  #     restartUnits = [ "rustfs.service" ];
+  #   };
+  # };
+
+  services.rustfs = {
+    enable = true;
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    accessKeyFile = "/etc/secrets/rustfs-access-key";
+    secretKeyFile = "/etc/secrets/rustfs-secret-key";
+
+    volumes = "/mnt/snow/rustfs";
+    address = ":9000";
+    consoleAddress = ":9001";
+    consoleEnable = true;
+  };
+}
--- a/hosts/server/hikari/hako/.sops.yaml
+++ b/hosts/server/hikari/hako/.sops.yaml
@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: secrets/.*\.ya?ml$
+    age:
+      - age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
+      - age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako
--- a/hosts/server/hikari/hako/configuration.nix
+++ b/hosts/server/hikari/hako/configuration.nix
@ -0,0 +1,43 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/docker.nix"
+  ];
+
+  # 1. 크론 설정
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "0 1 * * * imnyang printf '\\n%s : ' \"$(date)\" >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
+    ];
+  };
+
+  services.qemuGuest.enable = true;
+
+  # 2. 사용자 SSH 키 등록
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    eza
+    neovim
+    nil
+    nixd
+  ];
+
+  programs.git.config = {
+    safe.directory = "*";
+  };
+
+  nix.settings.require-sigs = false;
+
+  networking.firewall.enable = false;
+
+  networking.hostName = "hako";
+  system.stateVersion = "26.05";
+}
--- a/hosts/server/hikari/hako/default.nix
+++ b/hosts/server/hikari/hako/default.nix
@ -0,0 +1,32 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs) nixpkgs home-manager sops-nix;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    sops-nix.nixosModules.sops
+    ./services/forgejo.nix
+    ./services/immich.nix
+    ./services/attic.nix
+    ./services/postgresql.nix
+    ./services/nc.nix
+
+    ./configuration.nix
+    ./hardware-configuration.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home.nix;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/server/hikari/hako/hardware-configuration.nix
+++ b/hosts/server/hikari/hako/hardware-configuration.nix
@ -0,0 +1,51 @@
+# Do not modify this file! It was generated by nixos-generate-config
+# and may be overwritten by future invocations. Please make changes
+# to configuration.nix instead.
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/d65b2c3a-c630-4a07-bcf3-ec1b728129c0";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/67DC-8A41";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  fileSystems."/mnt/data" = {
+    device = "/dev/disk/by-uuid/edc0420b-8bec-438d-856d-bb345238e735";
+    fsType = "ext4";
+  };
+
+  fileSystems."/mnt/attic" = {
+    device = "/dev/disk/by-uuid/f45e0247-d2eb-4150-8116-e8d257c01aac";
+    fsType = "ext4";
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/hosts/server/hikari/hako/home.nix
+++ b/hosts/server/hikari/hako/home.nix
@ -0,0 +1,66 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+{
+  home.stateVersion = "26.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+
+  home.packages = [
+    nr
+    nrr
+  ];
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    VISUAL = "nano";
+  };
+
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza";
+      ll = "eza -l";
+      la = "eza -a";
+      lla = "eza -la";
+
+      rebuild = "sudo nixos-rebuild switch --flake .#hako";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+
+    functions = {
+      fish_prompt = ''
+        set_color purple
+        echo -n (whoami)
+        set_color normal
+        echo -n "@"
+        set_color green
+        echo -n (hostname)
+        set_color normal
+        echo -n ":"
+        set_color blue
+        echo -n (prompt_pwd)
+        set_color normal
+        echo -n " > "
+      '';
+    };
+  };
+}
--- a/hosts/server/hikari/hako/secrets/forgejo.yaml
+++ b/hosts/server/hikari/hako/secrets/forgejo.yaml
@ -0,0 +1,29 @@
+forgejo:
+    server_lfs_jwt_secret: ENC[AES256_GCM,data:mBK+mUvGTlSPLEifBahWuKMWMAlMNXmgA5jdGl+RElA4+msogvHB1g7V1g==,iv:YDc7ZgDPP0st0hYLJGbsapkVAG2L372AXFGwax9y+hc=,tag:4rfv0tfvgk/octiBkFnD6Q==,type:str]
+    security_internal_token: ENC[AES256_GCM,data:zmEnyWTmZrcUQTu7zu/QaVGzMzNvzkWYpRsCygD/SKzQe+kHG/FGr8rPwUQGIoUvdc2FcAykfsFZtnBwDgIeEonG+jdGYF41yIrh18hAXG00jn+K5fhq9x2IAGJz6qtvM7usiw2aCLLF,iv:DkkKZl9KKbtOKk1OHxoQmBMhN91NGHKAijcaJVxHXgM=,tag:FJkWGty/yAUJQaZB6RNcuQ==,type:str]
+    oauth2_jwt_secret: ENC[AES256_GCM,data:SpTNvHaxR1Ai8hdoTVcl3HVm5ZwA4oNoXUD5Cw8J5cy63ZLOZMX6tCBLCg==,iv:cm0uqiaizsEqPWD6b1cusME6LGXhSEhmd2bcdf/kxUM=,tag:iYpIDsIRd6ahJdL2RgjPTw==,type:str]
+    mailer_passwd: ENC[AES256_GCM,data:FXQN7xvjtR2MJGp/DkiF6jyglztjZ7vKxmHB7YWux0E=,iv:G5DSbqeKykq1HjQfWwHdLeS3bHkCbjsgH57Nfaaev84=,tag:8Q1RC3f8wNjUPm1nL+J4IQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQ1hzM3BEUEdqaUlnckhK
+            VXhHSzI1SmxBUCsxbU1FZmZhTkppa2xCbzNnCjhjc05oTFdnbjByR0N6eklpZTVh
+            dXNid290ZWRqNStKdkhiczdaQ1FaZlUKLS0tIEkvRmN5UTQ0dXBRRDB3YkR5UklL
+            OUh4NVZER0FOcGtZMksrdzk2c2ZHVHcKgkrUSWjK2+44+svbVSzHn31QPieTtXb2
+            7/A689V4CgGO+eoECxaKepEbWmXb2iCuLa2fNhUQIv1veKq/ga1aNA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVbjNtWjBRVFFEdGdKbXBC
+            RWo1UngvVEpqNW92MGlHZHI4dG9pWGdaS1VNCjhzakYyNUwzaWM3WjY4cHNvUW9t
+            N3hsTlpkV3BEQXZSSGh4MGlKVkNuWDAKLS0tIGFDcFNuQlBnaFN6SWs2K1dDVlVW
+            M1Z4VFdsWlhOTEZxR256a0xqa1dVcUkKrL52dR1o186VXcxp3ap5cyZUh5pjgQPC
+            TmBnn6qSneJHztKUBTz5PBsesdDrNX4m/UYahb7feRO70dQvGxeo0A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+    lastmodified: "2026-05-25T05:46:33Z"
+    mac: ENC[AES256_GCM,data:GY6EpM2BwOHFHtOGuQ6qHepH94xhEMnQDxshl+aGhIVGCi+34YW6WjFtBcFFLcmxSuMbEx8w2jK0T6PE7cyAwnphkz/G0qx2AAn836SN0wlfyY3Ni1czcdcuc9s2QdlBc9VhVU8s70fnso2tZxQsyM5wplgparJAJfxNycLFr9g=,iv:sHxJZm6waB+PW76rs6H26ffelsty1KAQFzwgbLv7Qls=,tag:Ofir+9DXvlSU/RtG4ivNCQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
--- a/hosts/server/hikari/hako/secrets/immich.yaml
+++ b/hosts/server/hikari/hako/secrets/immich.yaml
@ -0,0 +1,28 @@
+immich:
+    oauth2:
+        client-id: ENC[AES256_GCM,data:HY69lAGt3g7JqRG1EzmWXZpSCGSPwm2vqdIU2RkhXdon3C4JeXb9fw==,iv:Ew2r4kOx6cP2uZD6btyPmFpT0SOkJFM2WeT/fq6zaLc=,tag:aZimoy63KoR2hwRQUOGPRw==,type:str]
+        client-secret: ENC[AES256_GCM,data:U9YE9DnsNbLU2bTZWRWjEWFCCl0b2GS7IWfg2ooGrbmSi/A9DFzGSxvUdJQHKVbsX3bFCDd55citwJRVUQDiFSNSX78npQSzRJ8Jj9VSYOmHsO376I/Wm8sLQfvApcvltwaNV1rzfQyKGaBqGkFb58AbG55h/6bObqWWOl6+g5I=,iv:/odWOJedazBbMYsNwNVLPbBdAJb8f73brz+PUpaNwDg=,tag:VdY5zAHbPkYBRrmZyGSSTg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOXo0RkpUekJZN3lhaU1S
+            ZWNDaUdud0EzbUhIbU9lYVRyQ3pQazRrMlZRCjdPMDZDNVpST3p2VHJ0Tmg2WUZP
+            eWF4R0dBaW1zRmJNdjVaVWV3UjgvL2MKLS0tIFJQQ1pMQzB5aU9wNmYxYktJdHU5
+            NWV6Q0NuWUwrMTZ5RE9PV3ZVMTkvK00KJaPJojaZGx8NNfgxO4Q6AUbbCRGxEHAz
+            QX4zycDizXnL3kWmF1T66Cew6EuhHZSl5ZYFYUilHjq8r0lx2RuCOg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTjFKQlZVUCtNLzUzUGRO
+            TjlDYjQ3dmxEd0ZUcGZpTk5wU3kzWXVpRUY4CnI1bjBubU91dWJmSjlUOFlyYkNm
+            MkxIZTZ5SmFuT1ZqT3dkYVZQcmFWZk0KLS0tIGhPYzZpNEkwcTJzQUpwdndNNmlN
+            a05vWkZLeEpmaWpka1Z6RXRUdFRRZ3cKQBfF4IYpt5RO9+XmooTI58cSmkqwnQmN
+            aSt73yBzGVPJulggcYuDsy/k8lfPhPseKVvuR8p/jzwKG6iNGNm86g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+    lastmodified: "2026-04-02T15:08:04Z"
+    mac: ENC[AES256_GCM,data:uDCTiO0f3Ogj+dMNGoFIPptCBgLbN0goh/KDiLqCJXvLVkNCqpJYK0V46CmwQnSNyrth2jEQhnx0TBF2JSKfyU+UNpgC9zcLsuUznYQiBl+s2cT2nbApcLgJBSxWcvCpEEGqUp71jw8ajaUwjaLGdHePNsn4K3rAOL0j1Yythxo=,iv:bx3ctA+6hEeq0BHJqf4BQBJhihh3uGlS7NwalmXJgXg=,tag:sM4wAT0qfUZMI7gE0b++3g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
--- a/hosts/server/hikari/hako/secrets/nc.yaml
+++ b/hosts/server/hikari/hako/secrets/nc.yaml
@ -0,0 +1,26 @@
+google:
+    api-key: ENC[AES256_GCM,data:1BdTd7JyoeZ/U/6kWKAcgYeRokjR/mD0OLrmJrp7fXTE6rI4YT/RdQZauAA+xiGLBELdVCo=,iv:s9ms0pr7iwQW7HxhlpQSHCRc9pWlbnY3MH6iKxnoFYg=,tag:uWTmkMWikoFVGCeyG6fOrQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0U1FuMjg4Q0llaU1yUCtX
+            SG5aUnVoUGRaRG9WSGNKQlFmNFdtS1JOdDFVCjlDbHVnUWlCWWtQcXJjSExTL3JT
+            cHM3RTRNK1BVZzdXZ1g0bFdYcnltU2cKLS0tIHpHQmRqTndLNUJWYnR4TVVHOGJ0
+            ZExCNlphODcrbGdxa0tYNGxQS1lJNDQKes+ZdaWVPmAHxsomvBhGSha58T0vOTvN
+            T14s3k+nAtyOq0oJ71AuzZVsWS/1ubMFvtOAnVTsCae1BZ5AAGTU0A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMQXNaR0dldTBMa3YrK1ZE
+            K1NhclpZblJzdVFGU1hLVHRtSFR1bmhBeFZjCmRyNXNRVGxrYUZEWGpQR2gycHd2
+            TGJUVmpVTjcvaFBtZFpBTjNqVHVTcHMKLS0tIDUrYVI4LytnN0tCM3RZdzMwekFi
+            NnJkRGc5VUd3WUNXODRLZ2dkbWZ0QlUKPkU0P/fuGIVRwGgdwkxxEoeXTM7BBL7m
+            29fTZi7bgVajYoaA52CIjGFYnzt6phqlvjMC6PFlGG23ifaYEKlgQQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+    lastmodified: "2026-06-25T09:28:44Z"
+    mac: ENC[AES256_GCM,data:uZWZQ4u5gqfTnNp9uVqfXOqwAgaTL4hT5a/A5d+o0D6MCpM/f80hnaWBynFryI1NlPUFjQ6gyGBTFxkEeUnhB/pQit6XBE0Ex0F+UKy5U8QAcPhN2/5if/Upd9l3yiLaul+kH49FkkHwRhpA++GXFUr66stsHYPMFXM2vQAJQgQ=,iv:AwE69cX+jmrUz/pJqAIsS9Vhl2rd947xAViQYz6gkSA=,tag:qg4jpYHTYjBkt9vfER+YkA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
--- a/hosts/server/hikari/hako/services/attic.nix
+++ b/hosts/server/hikari/hako/services/attic.nix
@ -0,0 +1,21 @@
+{
+  services.atticd = {
+    enable = true;
+
+    # Replace with absolute path to your environment file
+    environmentFile = "/etc/atticd.env";
+
+    settings = {
+      listen = "[::]:8080";
+
+      jwt = { };
+
+      database.url = "postgresql:///attic";
+
+      storage = {
+        type = "local";
+        path = "/mnt/attic";
+      };
+    };
+  };
+}
--- a/hosts/server/hikari/hako/services/forgejo.nix
+++ b/hosts/server/hikari/hako/services/forgejo.nix
@ -0,0 +1,130 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  sops = {
+    defaultSopsFile = ../secrets/forgejo.yaml;
+    validateSopsFiles = false;
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    secrets = {
+      "forgejo/server_lfs_jwt_secret" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/security_internal_token" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/oauth2_jwt_secret" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/mailer_passwd" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+
+    database = {
+      type = "postgres";
+      createDatabase = true;
+      host = "/run/postgresql/";
+      name = "forgejo";
+      user = "forgejo";
+    };
+
+    settings = {
+      DEFAULT = {
+        APP_NAME = "git.mizuki.guru";
+        APP_SLOGAN = "with 🎀";
+        RUN_MODE = "prod";
+      };
+
+      federation = {
+        ENABLED = true;
+      };
+
+      server = {
+        DOMAIN = "git.mizuki.guru";
+        SSH_DOMAIN = "mizuki.guru";
+        HTTP_PORT = 3000;
+        ROOT_URL = "https://git.mizuki.guru/";
+        DISABLE_SSH = false;
+        SSH_PORT = 22;
+        LFS_START_SERVER = true;
+        OFFLINE_MODE = false;
+      };
+
+      security = {
+        INSTALL_LOCK = true;
+        PASSWORD_HASH_ALGO = "pbkdf2_hi";
+      };
+
+      service = {
+        REGISTER_EMAIL_CONFIRM = true;
+        ENABLE_NOTIFY_MAIL = true;
+        DISABLE_REGISTRATION = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+        ENABLE_CAPTCHA = false;
+        REQUIRE_SIGNIN_VIEW = false;
+        DEFAULT_KEEP_EMAIL_PRIVATE = false;
+        DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
+        DEFAULT_ENABLE_TIMETRACKING = true;
+        NO_REPLY_ADDRESS = "noreply.relay.imnya.ng";
+      };
+
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "mail.mizuki.guru";
+        SMTP_PORT = 587;
+        FROM = "systemmail@mizuki.guru";
+        USER = "systemmail@mizuki.guru";
+      };
+
+      oauth2 = {
+        ENABLED = true;
+      };
+
+      actions = {
+        ENABLED = true;
+      };
+
+      ui = {
+        THEMES = "dark,light,auto,forgejo-auto,forgejo-light,forgejo-dark";
+        DEFAULT_THEME = "auto";
+      };
+
+      repository = {
+        ROOT = "/var/lib/forgejo/repositories";
+      };
+      "repository.pull-request".DEFAULT_MERGE_STYLE = "merge";
+      "repository.signing".DEFAULT_TRUST_MODEL = "committer";
+      "cron.update_checker".ENABLED = true;
+      session.PROVIDER = "file";
+      oauth2_client.ENABLE_AUTO_REGISTRATION = true;
+    };
+
+    secrets = {
+      server.LFS_JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/server_lfs_jwt_secret".path;
+      security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets."forgejo/security_internal_token".path;
+      oauth2.JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/oauth2_jwt_secret".path;
+      mailer.PASSWD = lib.mkForce config.sops.secrets."forgejo/mailer_passwd".path;
+    };
+  };
+}
--- a/hosts/server/hikari/hako/services/immich.nix
+++ b/hosts/server/hikari/hako/services/immich.nix
@ -0,0 +1,37 @@
+{ config, ... }:
+let
+  immichSecret = key: {
+    sopsFile = ../secrets/immich.yaml;
+    inherit key;
+    owner = "immich";
+  };
+in
+{
+  sops.secrets."immich/oauth2/client-id" = immichSecret "immich/oauth2/client-id";
+  sops.secrets."immich/oauth2/client-secret" = immichSecret "immich/oauth2/client-secret";
+
+  services.immich = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 10040;
+
+    mediaLocation = "/mnt/data/immich/media";
+    openFirewall = true;
+    machine-learning.enable = false;
+
+    settings = {
+      server.externalDomain = "https://i.mizuki.guru";
+      machineLearning = {
+        enabled = false;
+      };
+      oauth = {
+        enabled = true;
+        issuerUrl = "https://auth.mizuki.guru/application/o/immich/.well-known/openid-configuration";
+        clientId._secret = config.sops.secrets."immich/oauth2/client-id".path;
+        clientSecret._secret = config.sops.secrets."immich/oauth2/client-secret".path;
+        scope = "openid email profile";
+        buttonText = "Login with mizuki";
+      };
+    };
+  };
+}
--- a/hosts/server/hikari/hako/services/nc.nix
+++ b/hosts/server/hikari/hako/services/nc.nix
@ -0,0 +1,63 @@
+{
+  pkgs,
+  inputs,
+  config,
+  ...
+}:
+
+let
+  ncSecret = key: {
+    sopsFile = ../secrets/nc.yaml;
+    inherit key;
+    owner = "mizuki-nc";
+    group = "mizuki-nc";
+    mode = "0400";
+  };
+in
+{
+  users.users.mizuki-nc = {
+    isSystemUser = true;
+    group = "mizuki-nc";
+  };
+
+  users.groups.mizuki-nc = { };
+
+  sops.secrets."google/api-key" = ncSecret "google/api-key";
+
+  systemd.services.mizuki-nc = {
+    description = "mizuki.guru";
+    wantedBy = [ "multi-user.target" ];
+
+    preStart = ''
+      set -eu
+      umask 077
+
+      rm -f /var/lib/mizuki-nc/config.toml
+
+      cat > /tmp/mizuki-nc-config.toml <<EOF
+[google]
+api-key = "$(cat ${config.sops.secrets."google/api-key".path})"
+EOF
+
+      install -o mizuki-nc -g mizuki-nc -m 0400 \
+        /tmp/mizuki-nc-config.toml \
+        /var/lib/mizuki-nc/config.toml
+
+      rm -f /tmp/mizuki-nc-config.toml
+    '';
+
+    serviceConfig = {
+      User = "mizuki-nc";
+      Group = "mizuki-nc";
+
+      StateDirectory = "mizuki-nc";
+      StateDirectoryMode = "0750";
+      WorkingDirectory = "/var/lib/mizuki-nc";
+
+      ExecStart = "${inputs.mizuki-nc.packages.${pkgs.system}.default}/bin/mizuki-nc";
+
+      Restart = "always";
+      RestartSec = 3;
+    };
+  };
+}
--- a/hosts/server/hikari/hako/services/postgresql.nix
+++ b/hosts/server/hikari/hako/services/postgresql.nix
@ -0,0 +1,16 @@
+{ pkgs, ... }: {
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_17.withPackages (ps: with ps; [
+      pgvector
+      vectorchord
+    ]);
+    ensureDatabases = [ "attic" "atticd" ];
+    ensureUsers = [
+      {
+        name = "atticd";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+}
--- a/hosts/server/kazusa/.sops.yaml
+++ b/hosts/server/kazusa/.sops.yaml
@ -0,0 +1,6 @@
+creation_rules:
+  - path_regex: secrets/.*\.ya?ml$
+    age:
+      - age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
+      - age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako
+      - age1hlsu7fdwwfm93rjt686j9cdy5klefwdus9jdxt5e0vaqh8c2la9qu5utns # kazusa
--- a/hosts/server/kazusa/configuration.nix
+++ b/hosts/server/kazusa/configuration.nix
@ -0,0 +1,103 @@
+{
+  pkgs,
+  inputs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/docker.nix"
+    ./services/mailserver.nix
+    ./services/caddy.nix
+  ];
+
+  # Override shared boot.nix for Legacy BIOS
+  boot.loader.grub.enableCryptodisk = lib.mkForce false;
+
+  services.netbird.enable = true;
+
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrpjEYOBx7LTGb7QsPrmPBboqyTUNm/e+4+yqWruljv imnyang@natsu"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    eza
+    neovim
+    nil
+    nixd
+    bun
+  ];
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
+  programs.git.config = {
+    safe.directory = "*";
+  };
+
+  networking = {
+    hostName = "kazusa";
+    domain = "icn.mizuki.guru";
+    nameservers = [
+      "1.1.1.1"
+      "1.0.0.1"
+      "9.9.9.9"
+      "149.112.112.112"
+    ];
+    useDHCP = false;
+    dhcpcd.enable = false;
+    interfaces.ens18 = {
+      ipv4.addresses = [
+        {
+          address = "82.21.82.30";
+          prefixLength = 24;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "82.21.82.1";
+      interface = "ens18";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+  ];
+
+  systemd.services.gnaynmi = {
+    description = "discord bot";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "imnyang";
+      WorkingDirectory = "/home/imnyang/gnaynmi";
+      EnvironmentFile = "/home/imnyang/gnaynmi/.env";
+      ExecStart = "${pkgs.bun}/bin/bun run src/index.ts";
+      Restart = "always";
+      RestartSec = 5;
+    };
+
+    path = [
+      pkgs.bun
+      pkgs.stdenv.cc.cc.lib
+    ];
+    environment = {
+      LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
+    };
+  };
+
+  services.qemuGuest.enable = true;
+
+  system.stateVersion = "26.05";
+}
--- a/hosts/server/kazusa/default.nix
+++ b/hosts/server/kazusa/default.nix
@ -0,0 +1,26 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs) nixpkgs home-manager sops-nix;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    sops-nix.nixosModules.sops
+    ./configuration.nix
+    ./hardware-configuration.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/server/kazusa/hardware-configuration.nix
+++ b/hosts/server/kazusa/hardware-configuration.nix
@ -0,0 +1,45 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/bfc62982-b6e4-43b9-99d7-951e7bcb1b31";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/0BA0-4E1A";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/hosts/server/kazusa/home/default.nix
+++ b/hosts/server/kazusa/home/default.nix
@ -0,0 +1,77 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+{
+  home.stateVersion = "26.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+
+  home.packages = [
+    nr
+    nrr
+  ];
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+  };
+
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza";
+      ll = "eza -l";
+      la = "eza -a";
+      lla = "eza -la";
+
+      rebuild = "sudo nixos-rebuild switch --flake .#natsu";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "$username@$hostname:$directory$character";
+      add_newline = false;
+      username = {
+        style_user = "purple";
+        style_root = "purple";
+        format = "[$user]($style)";
+        show_always = true;
+      };
+      hostname = {
+        style = "green";
+        format = "[$hostname]($style)";
+        ssh_only = false;
+      };
+      directory = {
+        style = "blue";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " >";
+        error_symbol = " >";
+      };
+    };
+  };
+}
--- a/hosts/server/kazusa/secrets/mailserver.yaml
+++ b/hosts/server/kazusa/secrets/mailserver.yaml
@ -0,0 +1,37 @@
+mailserver:
+    oauth:
+        client-id: ENC[AES256_GCM,data:oO2l88K/Tv0EMXQ/8KHpmWspYSKUENboPrWJHhbsrgR9HU9B1xXbnw==,iv:hhXZjZwAcx2KDaiMekv3lO6oFO6p/q4PpiN5R0jUBFs=,tag:fm3ykAcO2jU0JkSFZiQ15Q==,type:str]
+        client-secret: ENC[AES256_GCM,data:b+yUxUCqa8hXbUxMY2GqNMsEf0nG1Mpx36s98WIgSZEWVoLNvjQmPQDJpjP9/ESWqHP4ygc2KLFU+JpG+P0pNw==,iv:7gfq/sK2TtPXIC2ghYt7bYqg6gcXTtU4OAACITbbt5g=,tag:NB3EtaUEqK0VjVsEFLC/uQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSVXNQTzcydW1aaUhPWVNU
+            ME45VlF2a0tMOXM1Y05NQkphS3Mxd1BzNjJBCkoyT21XNnNyN3l2N3dUendabVRX
+            UU1BNWNYaEJuc0xhM2dCUDBrOFc2UnMKLS0tIGJlUUcxa0lLdGpDc3oyOC9Yc2hu
+            US83Q3hCNFRPeWtRckEza2l6eTk3Mm8K4U+9Xv+ygFAaV2avf8AoK9+P5w1Ni8PR
+            +msTgvLI3x8pXA2nYXq6s/yRwXwtbe+cLg0js7zWf6QCFdKFzqoQNw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQ1krS3A2b1IwZ3RPemhn
+            R0tiYVpJOEVHeGI3ZitxMVpBWHFNUlNrMkNFCnUzTHBDUGVPTXh3WGhrdmJJSDl3
+            T0RPalZFTGlpRkhPOW5tcmJuZHNQdlEKLS0tIE9lY0pIRWIwYkJHd1JocWpUY2c3
+            elkvcUJsT1UwRHV4SDRMS2w0R3Y0WjgKb0vtH0Ta2WyhBuusOYds25ikZ4FEG415
+            EbSGxQQo84gBg5nfY0W+JnOttJpGUAnxf5kQYYR3rVSxwPc0J7YJJg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNHFKcTRzV2hSa1Eybnk2
+            cjRZdXRwSFBLLzRRRnpGcFp5Z042UUlVL3djCjhJTWJMbklxTWhzOWQ2NmxyMUJm
+            T0QxUTZTNzRGUnlaY3FhWlk2bkhSb2MKLS0tIDd4MWhhK2JNeGFQTE1zSVE2Zmt3
+            TVp2NlJqMWtzY3JJSU5ITlNoR3VSalUKFxw0yQLsHNeR28Nfa8w9SMW7gT94vAZ0
+            y4hREV9XkRpoqoAFcc32TLcp9jdZE0Mh74tuyXDEtbHubWT7z9umhA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hlsu7fdwwfm93rjt686j9cdy5klefwdus9jdxt5e0vaqh8c2la9qu5utns
+    lastmodified: "2026-05-24T20:07:18Z"
+    mac: ENC[AES256_GCM,data:7V/0fPY/c0nS3DjvDoBTq7wcvAZ/aFUMM/A6bo90U90tmtVIn9Iu8aeYdxbQeHJLzlAKb1oiRNmcKPmlrAI7AT9eaLX52JYZhYcDsLrHzoWo2tRBP4ZEvgvs2bZfqPfzvrdk4mCJ21WWYGLO4lm8i5V4ZDYMb3ezA/h132cpFfs=,iv:0sdfZ5W8KHp92u3HfCZUZexFoomugzbhatatcsdrucs=,tag:nV3OjlNl/ufROREDuE4WVw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
--- a/hosts/server/kazusa/services/caddy.nix
+++ b/hosts/server/kazusa/services/caddy.nix
@ -0,0 +1,48 @@
+{ pkgs, ... }:
+
+{
+  services.caddy = {
+    enable = true;
+    # globalConfig = ''
+    #   servers {
+    #     trusted_proxies static cloudflare
+    #   }
+    # '';
+    virtualHosts."http://kazusa.icn.mizuki.guru".extraConfig = ''
+      respond "우응" 200
+    '';
+    virtualHosts."designmerge.co.kr".extraConfig = ''
+      reverse_proxy 127.0.0.1:1108
+    '';
+    virtualHosts."plutos.dazzle.st".extraConfig = ''
+      reverse_proxy epc.hikari.mizuki.arpa:3000
+    '';
+    virtualHosts."kurumi.dazzle.st".extraConfig = ''
+      respond 204
+    '';
+    virtualHosts."pluto.dazzle.st".extraConfig = ''
+      respond 204
+    '';
+    virtualHosts."note.dazzle.st".extraConfig = ''
+      respond 204
+    '';
+    virtualHosts."report.dazzle.st".extraConfig = ''
+      respond 204
+    '';
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        "github.com/caddy-dns/cloudflare@v0.2.2"
+        "github.com/aksdb/caddy-cgi/v2@v2.2.6"
+        "github.com/shift72/caddy-geo-ip@v0.6.0"
+        "github.com/lolPants/caddy-requestid@v1.1.2"
+        "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
+        "github.com/caddyserver/ntlm-transport@v0.1.2"
+        "github.com/ueffel/caddy-brotli@v1.6.0"
+        "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
+        "github.com/neodyme-labs/user_agent_parse@v0.0.1"
+      ];
+      hash = "sha256-n0LkDBE3JB3zrGYND0EGrKXC+CT0SzRiIjj0QXNZZ8k=";
+    };
+  };
+}
--- a/hosts/server/kazusa/services/mailserver.nix
+++ b/hosts/server/kazusa/services/mailserver.nix
@ -0,0 +1,201 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  mailSecret = key: {
+    sopsFile = ../secrets/mailserver.yaml;
+    inherit key;
+    owner = "nginx";
+    group = "nginx";
+    mode = "0440";
+    restartUnits = [
+      "phpfpm-roundcube.service"
+      "dovecot.service"
+    ];
+  };
+
+  clientIdSecret = config.sops.secrets."mailserver/oauth/client-id".path;
+  clientSecret = config.sops.secrets."mailserver/oauth/client-secret".path;
+in
+{
+  sops.secrets."mailserver/oauth/client-id" = mailSecret "mailserver/oauth/client-id";
+
+  sops.secrets."mailserver/oauth/client-secret" = mailSecret "mailserver/oauth/client-secret";
+
+  imports = [
+    (builtins.fetchTarball {
+      url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/51726d7b7fd94aa69829fd42749a803914cbf3b7/nixos-mailserver-51726d7b7fd94aa69829fd42749a803914cbf3b7.tar.gz";
+      sha256 = "0449ssnpwbgfv0cyddzb8s6g641gy5xh1hd3shg32x8pv0a5qy3a";
+    })
+  ];
+
+  security.acme.acceptTerms = false;
+
+  services.roundcube = {
+    enable = true;
+    hostName = "mail.mizuki.guru";
+
+    package = pkgs.roundcube.withPlugins (
+      plugins: with plugins; [
+        persistent_login
+      ]
+    );
+
+    plugins = [
+      "persistent_login"
+      "managesieve"
+    ];
+
+    dicts = with pkgs.aspellDicts; [
+      en
+    ];
+
+    maxAttachmentSize = config.mailserver.messageSizeLimit / 1024 / 1024;
+
+    extraConfig = ''
+      $_SERVER['HTTPS'] = 'on';
+      $_SERVER['SERVER_PORT'] = 443;
+      $_SERVER['HTTP_X_FORWARDED_PORT'] = 443;
+      $_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https';
+      $_SERVER['HTTP_HOST'] = 'mail.mizuki.guru';
+
+      $config['proxy_ips'] = '127.0.0.1';
+
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+
+      $config['managesieve_host'] = "tls://${config.mailserver.fqdn}";
+      $config['managesieve_port'] = 4190;
+      $config['managesieve_usetls'] = true;
+
+      $config['oauth_provider'] = 'generic';
+      $config['oauth_provider_name'] = 'authentik';
+
+      $config['oauth_client_id'] =
+        trim(file_get_contents('${clientIdSecret}'));
+
+      $config['oauth_client_secret'] =
+        trim(file_get_contents('${clientSecret}'));
+
+      $config['oauth_auth_uri'] =
+        'https://auth.mizuki.guru/application/o/authorize/';
+
+      $config['oauth_token_uri'] =
+        'https://auth.mizuki.guru/application/o/token/';
+
+      $config['oauth_identity_uri'] =
+        'https://auth.mizuki.guru/application/o/userinfo/';
+
+      $config['oauth_scope'] =
+        "email openid dovecotprofile offline_access";
+
+      $config['oauth_auth_parameters'] = [];
+      $config['oauth_identity_fields'] = ['email'];
+    '';
+  };
+
+  services.nginx.virtualHosts.${config.services.roundcube.hostName} = {
+    forceSSL = false;
+    enableACME = false;
+
+    listen = [
+      {
+        addr = "127.0.0.1";
+        port = 5656;
+      }
+    ];
+
+    extraConfig = ''
+      set_real_ip_from 127.0.0.1;
+      real_ip_header X-Forwarded-For;
+      real_ip_recursive on;
+    '';
+  };
+
+  services.caddy = {
+    enable = true;
+
+    virtualHosts."mail.mizuki.guru" = {
+      extraConfig = ''
+        reverse_proxy localhost:5656
+      '';
+    };
+  };
+
+  services.dovecot2.settings = {
+    auth_mechanisms = lib.mkForce [
+      "plain"
+      "login"
+      "xoauth2"
+      "oauthbearer"
+    ];
+
+    oauth2_tokeninfo_url = "https://auth.mizuki.guru/application/o/userinfo/?access_token=";
+
+    # 주의:
+    # 여기는 아직 secret '값'이 아니라 secret '경로'가 들어감.
+    # Dovecot이 URL 안에서 file_get_contents 같은 처리를 안 하므로
+    # 이 방식은 제대로 동작하지 않을 가능성이 큼.
+    oauth2_introspection_url = "https://auth.mizuki.guru/application/o/introspect/";
+
+    oauth2_introspection_mode = "post";
+    oauth2_force_introspection = "yes";
+    oauth2_active_attribute = "active";
+    oauth2_active_value = "true";
+    oauth2_username_attribute = "email";
+  };
+
+  users.users.dovecot = {
+    isSystemUser = true;
+    group = "dovecot";
+    extraGroups = [ "caddy" ];
+  };
+
+  users.groups.dovecot = { };
+
+  users.users.postfix.extraGroups = [ "caddy" ];
+
+  mailserver = {
+    enable = true;
+    stateVersion = 4;
+    fqdn = "mail.mizuki.guru";
+    domains = [ "mizuki.guru" ];
+
+    x509 = {
+      certificateFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.mizuki.guru/mail.mizuki.guru.crt";
+
+      privateKeyFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.mizuki.guru/mail.mizuki.guru.key";
+    };
+
+    ldap = {
+      enable = true;
+      uris = [ "ldap://10.11.8.102" ];
+
+      bind = {
+        dn = "cn=mailserver,ou=users,dc=ldap,dc=goauthentik,dc=io";
+        passwordFile = "/var/lib/secrets/authentik-ldap-bind-pw";
+      };
+
+      base = "ou=users,dc=ldap,dc=goauthentik,dc=io";
+      scope = "sub";
+
+      attributes = {
+        uuid = "uid";
+        username = "mail";
+        mail = "mail";
+      };
+
+      dovecot = {
+        passFilter = "mail=%{user}\n  bind = yes";
+      };
+    };
+
+    accounts = { };
+  };
+}
--- a/hosts/server/natsu/.sops.yaml
+++ b/hosts/server/natsu/.sops.yaml
@ -0,0 +1,6 @@
+creation_rules:
+  - path_regex: secrets/.*\.ya?ml$
+    age:
+      - age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
+      - age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako
+      - age1p0hw9lwk33x5w83a4gkjva325leq5h0pgeglhcwm4c9kju4qtu4ss7qppr # natsu
--- a/hosts/server/natsu/configuration.nix
+++ b/hosts/server/natsu/configuration.nix
@ -0,0 +1,83 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/docker.nix"
+  ];
+
+  # 1. Docker 추가 설정 (IPv6)
+  virtualisation.docker.daemon.settings = {
+    fixed-cidr-v6 = "fd00::/80";
+    ipv6 = true;
+  };
+
+  # 2. 크론 설정
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "1 0 * * *  imnyang  * * * * * printf '\n%s : ' '$(date)' >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
+    ];
+  };
+  services.netbird.enable = true;
+
+  # 3. 사용자 SSH 키 등록
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrpjEYOBx7LTGb7QsPrmPBboqyTUNm/e+4+yqWruljv imnyang@natsu"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    eza
+    neovim
+    nil
+    nixd
+    bun
+    stdenv.cc.cc.lib
+  ];
+
+  programs.nix-ld.enable = true;
+
+  systemd.services.blog = {
+    description = "blog.imnya.ng";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "imnyang";
+      Environment = [
+        "LD_LIBRARY_PATH=${pkgs.stdenv.cc.cc.lib}/lib"
+      ];
+      WorkingDirectory = "/home/imnyang/git/imnyang/blog";
+      ExecStart = "${pkgs.bun}/bin/bun run preview";
+      Restart = "always";
+      RestartSec = 5;
+    };
+
+    path = [ pkgs.bun ];
+  };
+
+  services.qemuGuest.enable = true;
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
+  programs.git.config = {
+    safe.directory = "*";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+  ];
+
+  networking.hostName = "natsu";
+  system.stateVersion = "26.05";
+}
--- a/hosts/server/natsu/default.nix
+++ b/hosts/server/natsu/default.nix
@ -0,0 +1,30 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs) nixpkgs home-manager sops-nix;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    sops-nix.nixosModules.sops
+    # ./services/attic.nix
+    ./services/caddy.nix
+    ./services/forgejo-runner.nix
+    # ./services/harmonia.nix
+    ./configuration.nix
+    ./hardware-configuration.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home.nix;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}
--- a/hosts/server/natsu/hardware-configuration.nix
+++ b/hosts/server/natsu/hardware-configuration.nix
@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/ffe787e4-f39c-4c9b-b2f5-273386198307";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E854-0DD3";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}
+
--- a/hosts/server/natsu/home.nix
+++ b/hosts/server/natsu/home.nix
@ -0,0 +1,80 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+{
+  home.stateVersion = "26.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+
+  home.packages = [
+    nr
+    nrr
+  ];
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    VISUAL = "nano";
+  };
+
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      # 디렉토리 네비게이션
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      # ls 별칭
+      ls = "eza";
+      ll = "eza -l";
+      la = "eza -a";
+      lla = "eza -la";
+
+      # NixOS 관련
+      rebuild = "sudo nixos-rebuild switch --flake .#natsu";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+  };
+
+  programs.starship = {
+    enable = true;
+    settings = {
+      format = "$username@$hostname:$directory$character";
+      add_newline = false;
+      username = {
+        style_user = "purple";
+        style_root = "purple";
+        format = "[$user]($style)";
+        show_always = true;
+      };
+      hostname = {
+        style = "green";
+        format = "[$hostname]($style)";
+        ssh_only = false;
+      };
+      directory = {
+        style = "blue";
+        format = "[$path]($style)";
+        truncation_length = 3;
+      };
+      character = {
+        success_symbol = " >";
+        error_symbol = " >";
+      };
+    };
+  };
+}
--- a/hosts/server/natsu/secrets/forgejo-runner.yaml
+++ b/hosts/server/natsu/secrets/forgejo-runner.yaml
@ -0,0 +1,35 @@
+forgejo-runner:
+    token: ENC[AES256_GCM,data:NBOcn5Z99hyQEHotUuVOwvlOqd/lKrXy4pUSobbmPSnVB5yAzTdUv5vv+J9z27z4wg==,iv:C9QBd+Kw2BcX+LkTwuRHpl/G6fw8iGWJPIWDvL8lcKU=,tag:2ZRQzx2P6THlpuDDdpuZgw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNzVoeHM2LzRYdGp5Snlj
+            UUlKNThlczFZcFJKMXpJSG42eHVLbjFsamxNCkZiaGNJRFA4bmZHT0g4ZytjZEJY
+            SHhWblNOa2ZGUWtJZzZLYi9RTjJjcW8KLS0tIHRBV0Z6bEdybUppSHpGMHBsN1A2
+            ZitWOTJsUHlvUXp3NEtUK0Jwc1VSU1EK9tZNPBKuY9G0vsDP0RMA/W2xBrN5LBj1
+            0j9N309gyFNqCuR3ZEpoarAx6rpD1Q8wQYhhZQw+z7h2+eGPNp9Qvw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10kkqzxkxdkr9322fd536gcs43xqvdw609ffpc4vqqf3f77tzmvlq45q55s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VDI1L0lzZHVTMHNaRTZS
+            Y3prZnpNMFEwL2dPdlZreGRjRzNLUGFFZEVNCndML3BHKy9EaGpqREVlQVJCdkRC
+            MXlMeW5sTXZzUE83d2FtbW5ybHh5dzAKLS0tIDVKdTNxdC9yRCtvQmhNbzhtdFA4
+            OFJtaG0rcHFPaHJUVjNKckl5UGpDSm8K1cyMiVEVir4uaFJuwQkpcbLmXet4txX+
+            9QrM+WQr73JfoIirHZhZLM0aAXQDwXG791N6iu2x/Q9BbbqLT5c73A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTzJNUkZWVCtQNVpyeEpj
+            TG44TEppaXkrR2M4K3Y2TEVFWHlKWDYwaFY0CmxNN3Awb0wzUHo0Q21yUERBUXBz
+            WXYzL0VHcnQxa3UwS3hMRzM0cndtUjAKLS0tIERjaDhZYzlJWmZ6R09Ub0NmTytT
+            QjZxRUJGU01XRCs5aGZVUElTQ2wxTUEKhnM25DGalV+mfPp8FD40x25Eq5/XudPn
+            jBWu84zEtL8Ja9XECKaXJiP7oi1YaX8+BV8BdlIfDGR9ceiZRIhlrA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1p0hw9lwk33x5w83a4gkjva325leq5h0pgeglhcwm4c9kju4qtu4ss7qppr
+    lastmodified: "2026-05-28T02:55:30Z"
+    mac: ENC[AES256_GCM,data:DSY6wQyYBBWcA9aqZkFVJ7JyvFTvXm3r6Zu4xE0dStBgyv/0O5l0pEmekKlYuMWXd3VmAWhH7VCsVN7RyeoLpimm97MfedKIfd/wVISuBy0SA2q3frfwbuith6yfXRqmsGNzG7ivnZ146w8uWGf5RCef1m2Nl9QPeai7dUcB/3c=,iv:XPV8gTSWJzXoOj5bqa+R23deWD2GUaQp+w2b9ThG6V4=,tag:BLWeaRbfYjV8fzieemVBfg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
--- a/hosts/server/natsu/services/caddy.nix
+++ b/hosts/server/natsu/services/caddy.nix
@ -0,0 +1,122 @@
+{ pkgs, ... }:
+
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts."http://natsu.icn.mizuki.guru".extraConfig = ''
+      respond "우응" 200
+    '';
+    virtualHosts."https://file.mizuki.guru".extraConfig = ''
+        reverse_proxy 10.11.8.112 {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+          header_up X-Forwarded-For {remote_host}
+      }
+    '';
+    virtualHosts."http://file.mizuki.guru".extraConfig = ''
+        reverse_proxy 10.11.8.112 {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+          header_up X-Forwarded-For {remote_host}
+      }
+    '';
+
+    virtualHosts."auth.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:9080
+    '';
+
+    virtualHosts."plutos.dazzle.st".extraConfig = ''
+      reverse_proxy epc.hikari.mizuki.arpa:3000
+    '';
+
+    virtualHosts."event.dazzle.st".extraConfig = ''
+      reverse_proxy 10.11.8.102:9794
+    '';
+
+    virtualHosts."pve.hikari.icn.mizuki.guru".extraConfig = ''
+      reverse_proxy https://10.11.8.100:8006 {
+               header_up X-Real-Ip {remote_host}
+               header_up X-Http-Version {http.request.proto}
+               transport http {
+                       tls_insecure_skip_verify
+               }
+       }
+    '';
+
+    virtualHosts."cockpit.hikari.icn.mizuki.guru".extraConfig = ''
+      reverse_proxy https://10.11.8.100:9090 {
+              header_up X-Real-Ip {remote_host}
+              header_up X-Http-Version {http.request.proto}
+              transport http {
+                      tls_insecure_skip_verify
+              }
+      }
+    '';
+
+    virtualHosts."cache.mizuki.guru".extraConfig = ''
+      reverse_proxy 127.0.0.1:5000
+    '';
+
+    virtualHosts."paste.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:11108
+    '';
+    virtualHosts."komodo.mizuki.guru".extraConfig = ''
+      reverse_proxy 10.11.8.102:9120
+    '';
+
+    virtualHosts."ena.mizuki.guru".extraConfig = ''
+      basic_auth {
+        imnyang $2a$10$zA83XKt84pcXiwfkuvNmKOpQ5Cw0IP6m/.1AX0ahkVQaPOzrmFlxm
+      }
+      reverse_proxy 10.20.31.103:3000
+    '';
+
+    virtualHosts."akiyama.mizuki.guru".extraConfig = ''
+      rewrite / /index.avif
+      root * /var/static/akiyama.mizuki.guru
+      file_server
+    '';
+
+    virtualHosts."chef.mizuki.guru".extraConfig = ''
+      root * /var/static/chef.mizuki.guru
+      rewrite / /CyberChef_v10.22.1.html
+      file_server {
+        precompressed br gzip
+      }
+      header {
+        Cache-Control "public, max-age=31536000"
+      }
+    '';
+
+    virtualHosts."blog.imnya.ng".extraConfig = ''
+      reverse_proxy 127.0.0.1:4321
+    '';
+    virtualHosts."netbird.mizuki.guru".extraConfig = ''
+      # Native gRPC (needs HTTP/2 cleartext to backend)
+      @grpc header Content-Type application/grpc*
+      reverse_proxy @grpc h2c://127.0.0.1:8081
+
+      # Combined server paths (relay, signal, management, OAuth2)
+      @backend path /relay* /ws-proxy/* /api/* /oauth2/*
+      reverse_proxy @backend 127.0.0.1:8081
+
+      # Dashboard (everything else)
+      reverse_proxy /* 127.0.0.1:8080
+    '';
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        "github.com/caddy-dns/cloudflare@v0.2.2"
+        "github.com/aksdb/caddy-cgi/v2@v2.2.6"
+        "github.com/shift72/caddy-geo-ip@v0.6.0"
+        "github.com/lolPants/caddy-requestid@v1.1.2"
+        "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
+        "github.com/caddyserver/ntlm-transport@v0.1.2"
+        "github.com/ueffel/caddy-brotli@v1.6.0"
+        "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
+        "github.com/neodyme-labs/user_agent_parse@v0.0.1"
+      ];
+      hash = "sha256-n0LkDBE3JB3zrGYND0EGrKXC+CT0SzRiIjj0QXNZZ8k=";
+    };
+  };
+}
--- a/hosts/server/natsu/services/forgejo-runner.nix
+++ b/hosts/server/natsu/services/forgejo-runner.nix
@ -0,0 +1,67 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  runnerSecret = key: {
+    sopsFile = ../secrets/forgejo-runner.yaml;
+    inherit key;
+    owner = "root";
+    group = "root";
+  };
+in
+{
+  sops.secrets."forgejo-runner/token" = runnerSecret "forgejo-runner/token";
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.my-forgejo-instance = {
+      enable = true;
+      name = "natsu-cicd";
+      tokenFile = config.sops.secrets."forgejo-runner/token".path;
+      url = "https://git.mizuki.guru/";
+      labels = [
+        "node-24:docker://node:24-bookworm"
+        "nixos-latest:docker://nixos/nix"
+        "native:host"
+        "AArch64:host"
+        "ubuntu-latest:docker://git.mizuki.guru/packages/act:ubuntu-latest-aarch64"
+      ];
+
+      # act 엔진의 컨테이너 보안 가드 및 디렉토리 이탈 방지 설정 주입
+      settings = {
+        container = {
+          # 호스트 측의 임시 디렉토리 마운트 허용 범위를 명시
+          valid_volumes = [
+            "/var/run/docker.sock"
+            "/tmp"
+            "/run/user"
+          ];
+          # 컨테이너 내 작업 디렉토리를 절대 경로로 고정하여 탈출 방지
+          workdir = "/workspace";
+        };
+        runner = {
+          # act 실행 환경 내부 임시 경로 강제 고정
+          envs = {
+            ACT_TEMP_DIR = "/tmp/act";
+          };
+        };
+      };
+
+      hostPackages = with pkgs; [
+        bash
+        git
+        python3
+        docker
+        docker-compose
+        docker-buildx
+        nodejs
+        bun
+        wget
+        curl
+      ];
+    };
+  };
+}
--- a/modules/home/ciscopackettracer.nix
+++ b/modules/home/ciscopackettracer.nix
@ -0,0 +1,19 @@
+{ pkgs, inputs, ... }:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+  pkgsPacketTracer8 = import inputs.nixpkgs-2511 {
+    inherit system;
+    config = {
+      allowUnfree = true;
+      permittedInsecurePackages = [
+        "ciscoPacketTracer8-8.2.2"
+      ];
+    };
+  };
+in
+{
+  home.packages = [
+    pkgs.cisco-packet-tracer_9
+    pkgsPacketTracer8.ciscoPacketTracer8
+  ];
+}
--- a/modules/home/discord/linux.nix
+++ b/modules/home/discord/linux.nix
@ -0,0 +1,34 @@
+{
+  pkgs,
+  inputs,
+  lib,
+  options,
+  ...
+}:
+{
+  imports = [ inputs.nixcord.homeModules.nixcord ];
+  # imports = [ inputs.nixcord.nixosModules.nixcord ];
+  programs.nixcord = {
+    enable = true;
+
+    discord = {
+      branch = "canary";
+      vencord.enable = false;
+      equicord.enable = true;
+      krisp.enable = true;
+    };
+
+    vesktop.enable = true;
+    # equibop.enable = true;
+    config.plugins = import ./plugin.nix;
+  };
+  home.packages = with pkgs; [
+    discord-gamesdk
+  ];
+
+  # home.activation.krispPatch = lib.mkIf (!pkgs.stdenv.isDarwin) (
+  #   lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+  #     ${krisp-patcher}/bin/krisp-patcher $(${pkgs.findutils}/bin/find $HOME/.config/discord/ -name "discord_krisp.node" -path "*/modules/discord_krisp/*") || true
+  #   ''
+  # );
+}
--- a/modules/home/discord/mac.nix
+++ b/modules/home/discord/mac.nix
@ -0,0 +1,23 @@
+# darwin-configuration.nix
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.nixcord.darwinModules.nixcord ];
+
+  programs.nixcord = {
+    enable = true;
+    user = "imnyang"; # Needed for system-level config
+
+    discord = {
+      package = pkgs.discord-canary;
+      vencord.enable = false;
+      equicord.enable = true;
+      # krisp.enable = true;
+    };
+
+    equibop.enable = true;
+
+    config.plugins = import ./plugin.nix;
+  };
+
+  environment.systemPackages = [ pkgs.discord-gamesdk ];
+}
--- a/modules/home/discord/plugin.nix
+++ b/modules/home/discord/plugin.nix
@ -0,0 +1,69 @@
+{
+  alwaysAnimate.enable = true;
+  alwaysExpandRoles.enable = true;
+  blurNsfw.enable = true;
+  callTimer = {
+    enable = true;
+    format = "human";
+  };
+  crashHandler.enable = true;
+  disableCallIdle.enable = true;
+  dontRoundMyTimestamps.enable = true;
+  fixCodeblockGap.enable = true;
+  fixImagesQuality.enable = true;
+  fixYoutubeEmbeds.enable = true;
+  forceOwnerCrown.enable = true;
+  messageLogger = {
+    enable = true;
+  };
+  clientSideBlock = {
+    enable = true;
+    hideBlockedUsers = true;
+    hideBlockedMessages = true;
+    hideEmptyRoles = false;
+    hideVc = true;
+    blockedReplyDisplay = "hideReply";
+  };
+  serverListIndicators.enable = true;
+  showTimeoutDuration.enable = true;
+  # silentTyping.enable = true;
+  textReplace.enable = true;
+  textReplace.regexRules = [
+    {
+      find = "https?:\\/\\/(www\\.)?instagram\\.com\\/[^\\/]+\\/(p|reel)\\/([A-Za-z0-9-_]+)\\/?";
+      replace = "https://g.ddinstagram.com/$2/$3";
+    }
+    {
+      find = "https:\\/\\/x\\.com\\/([^\\/]+\\/status\\/[0-9]+)";
+      replace = "https://fixupx.com/$1";
+    }
+    {
+      find = "https:\\/\\/twitter\\.com\\/([^\\/]+\\/status\\/[0-9]+)";
+      replace = "https://fixupx.com/$1";
+    }
+    {
+      find = "https:\\/\\/(www\\.|old\\.)?reddit\\.com\\/(r\\/[a-zA-Z0-9_]+\\/comments\\/[a-zA-Z0-9_]+\\/[^\\s]*)";
+      replace = "https://vxreddit.com/$2";
+    }
+    {
+      find = "https:\\/\\/(www\\.)?pixiv\\.net\\/(.*)";
+      replace = "https://phixiv.net/$2";
+    }
+    {
+      find = "https:\\/\\/(?:www\\.|m\\.)?twitch\\.tv\\/twitch\\/clip\\/(.*)";
+      replace = "https://clips.fxtwitch.tv/$1";
+    }
+    {
+      find = "https:\\/\\/(?:www\\.)?youtube\\.com\\/(?:watch\\?v=|shorts\\/)([a-zA-Z0-9_-]+)";
+      replace = "https://youtu.be/$1";
+    }
+  ];
+  translate.enable = true;
+  typingIndicator.enable = true;
+  typingTweaks.enable = true;
+  userVoiceShow.enable = true;
+  validReply.enable = true;
+  validUser.enable = true;
+  volumeBooster.enable = true;
+  spotifyCrack.enable = true;
+}
--- a/modules/home/firefox.nix
+++ b/modules/home/firefox.nix
@ -0,0 +1,29 @@
+{ pkgs, config, ... }:
+{
+  programs.firefox = {
+    enable = true;
+    configPath = ".mozilla/firefox";
+    package = pkgs.firefox-devedition;
+    policies = {
+      Preferences = {
+        "widget.use-xdg-desktop-portal.file-picker" = {
+          Value = 1;
+          Status = "default";
+        };
+        "middlemouse.paste" = {
+          Value = false;
+          Status = "default";
+        };
+      };
+      ExtensionSettings = {
+        "figma-windows-ua-spoofer@imnyang.local" = {
+          installation_mode = "force_installed";
+          install_url = "https://git.mizuki.guru/imnyang/thisiswindowsfigma/releases/download/v1.0.0/d168a70cb6a24fe4a478-1.0.0.xpi";
+        };
+      };
+    };
+  };
+
+  home.file.".waterfox/native-messaging-hosts".source =
+    config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/.mozilla/native-messaging-hosts";
+}
--- a/Show more
+++ b/Show more