From 3b73fe8ca496a393dbd0459d3c389b4bc8a7794c Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Wed, 31 Jul 2024 19:00:50 -0500
Subject: [PATCH 1/5] No slippi on thablet

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index c5af357..11ebc54 100644
--- a/flake.nix
+++ b/flake.nix
@@ -379,7 +379,7 @@
                 cargo
                 firefox-no-tabs
                 linux-desktop-environment-config
-                slippi.homeManagerModules.default
+                # slippi.homeManagerModules.default
               ];
             };
           }

From 2563ecbfede7c7cfe3e26556e1041cd438b257f2 Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Wed, 31 Jul 2024 21:13:37 -0500
Subject: [PATCH 2/5] Re-add cache

---
 flake.nix                 | 15 +++++++++++++--
 modules/nixos/default.nix |  2 +-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index c5af357..7be1c5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -210,8 +210,19 @@
         };
       };
 
-      modifications = final: prev: {
-        final.helix = helix.outputs.packages.${prev.system}.helix;
+      modifications = final: prev: rec {
+        helix = helix.outputs.packages.${prev.system}.helix;
+        final.helix = helix;
+        wezterm = prev.wezterm.overrideAttrs rec {
+          version = "56a27e93a9ee50aab50ff4d78308f9b3154b5122";
+          src = prev.fetchFromGitHub {
+            owner = "wez";
+            repo = "wezterm";
+            rev = version;
+            fetchSubmodules = true;
+            hash = "sha256-zl0Me24ncrpXUCvkQHlbgUucf0zrkhFFI242wsSQKLw=";
+          };
+        };
       };
 
       unstable-packages = final: _prev: {
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 1d64f83..62c9a22 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -250,7 +250,7 @@
           "https://cache.nixos.org/"
           "https://helix.cachix.org"
           "https://nix-community.cachix.org"
-          # "https://nix.h.lyte.dev"
+          "https://nix.h.lyte.dev"
           "https://hyprland.cachix.org"
         ];
         trusted-public-keys = [

From 63047aec551f28671c39a1debbb235c2d561b767 Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Thu, 1 Aug 2024 09:53:48 -0500
Subject: [PATCH 3/5] Add todo for wezterm upgrade

---
 flake.nix | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/flake.nix b/flake.nix
index 8d2248e..535c090 100644
--- a/flake.nix
+++ b/flake.nix
@@ -213,16 +213,20 @@
       modifications = final: prev: rec {
         helix = helix.outputs.packages.${prev.system}.helix;
         final.helix = helix;
-        wezterm = prev.wezterm.overrideAttrs rec {
-          version = "56a27e93a9ee50aab50ff4d78308f9b3154b5122";
-          src = prev.fetchFromGitHub {
-            owner = "wez";
-            repo = "wezterm";
-            rev = version;
-            fetchSubmodules = true;
-            hash = "sha256-zl0Me24ncrpXUCvkQHlbgUucf0zrkhFFI242wsSQKLw=";
-          };
-        };
+        # TODO: would love to use a current wezterm build so I can make use of ssh/mux functionality without breakage
+        # source: https://github.com/wez/wezterm/issues/3771
+        # wezterm = prev.wezterm.overrideAttrs rec {
+        #   version = "56a27e93a9ee50aab50ff4d78308f9b3154b5122";
+        #   src = prev.fetchFromGitHub {
+        #     owner = "wez";
+        #     repo = "wezterm";
+        #     rev = version;
+        #     fetchSubmodules = true;
+        #     hash = "sha256-zl0Me24ncrpXUCvkQHlbgUucf0zrkhFFI242wsSQKLw=";
+        #   };
+        #   cargoLockFile = null;
+        #   cargoHash = "";
+        # };
       };
 
       unstable-packages = final: _prev: {

From ab03e929d4ae79cd5218608d88d4435c3f7445cb Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Mon, 5 Aug 2024 20:42:50 -0500
Subject: [PATCH 4/5] WIP kanidm deployment

---
 modules/nixos/kanidm/client.toml |   2 ++
 modules/nixos/kanidm/kanidm.db   | Bin 0 -> 73728 bytes
 modules/nixos/kanidm/server.toml |  10 ++++++++++
 nixos/beefcake.nix               |  32 +++++++++++++++++++++++++++++++
 nixos/router.nix                 |   1 +
 templates/rust/flake.nix         |   2 ++
 6 files changed, 47 insertions(+)
 create mode 100644 modules/nixos/kanidm/client.toml
 create mode 100644 modules/nixos/kanidm/kanidm.db
 create mode 100644 modules/nixos/kanidm/server.toml

diff --git a/modules/nixos/kanidm/client.toml b/modules/nixos/kanidm/client.toml
new file mode 100644
index 0000000..1ea48a5
--- /dev/null
+++ b/modules/nixos/kanidm/client.toml
@@ -0,0 +1,2 @@
+uri = "https://idm.foxtrot.hare-cod.ts.net:8443"
+ca_path = "/tmp/cert.pem"
diff --git a/modules/nixos/kanidm/kanidm.db b/modules/nixos/kanidm/kanidm.db
new file mode 100644
index 0000000000000000000000000000000000000000..2a0e7c7d26881f9589f10fbc95b0837e8dff78ce
GIT binary patch
literal 73728
zcmeI)%}yIv7zW@OFt#CpLn>scQN#o(YKVqv&Uj{QXVW@lf~>fv7}7SXBG<tVvA{OP
zcA6;4B9tt80o}G2kwv@f9dyyFsJhE4Rabq#u`#A#LZzxz+}FZke$LN#o^y;CzN4(I
z=BllV@u0C=E47S-c3#tU?L))RG%bwx1-uVlavnN3!FRpyc+g>3d%yVZRP1+cCh}5?
zU5foQ`SbK|(?3k_Pp?k=IQjkL&SYlt!uW3V+wl(~FQZ=!YKGS-KmiI+fCB$}f#=uG
zN8*<+>w9yp(*5nq!)C2mF11R<*5T32Qo+xx`^I|aM$R`5uNzk<i~+B$$`fPV|7_j(
zxRCuQQ@Cr~_V1blOFt@Yw=2et+{z6jzp`%R@8ohPmR(59gyYMXb*)-2R~|RN+{P~(
z#ZtS~2+oU#krmb9@rCE_O-JH$bNb$;-UzGpR%d|0LG0N0g3JH@@Kh`u_vcO<UJzJk
zbiv{Iy``yO`u10Y!PP3Y`<30sgJSFOX!^+T4zCXw-)6Dhu9kz@J9)-RZz^zWrQm0m
z^D^gGJFP7k1^<>`@bgRlnz6atXzvtTSEZW;<EGpw1S>0>&#q@Px!m3EMgQi>0ra=u
z3Fb)qrHze7TPC>M!%80Q<$NsQrOet==B9saZ7uA58jZv+UesTV1&ZAWyWhr-_;oK1
z!0XYydEwVfwMyqRa<Jx&JNfMD9slG(H+SlPqx5FATyM)#FtYh|f7vheK3J!A(rRo~
z>PJ6_Cr49xyi?tMf=}v4ej&TmYy7zE;$%3Uxj1M^cQK1j_h4%A+*yhzy2U3KC(csb
z?iN3{IDVGms#|>GYi%_6!SP}xSQWi>)jJ3sSsA^{!?`wgO3mh1joosvJWgH}|NQb%
zk<)%6_QZ=$?=Y&uXRDIvRf(vvvsJNsRl+KCwkoPuW$gK!9*JMMqVMU!aw^|1KC0|C
ztBrcG)qgy4WKs3s8L+OpKdj&U6Q|qV!H<OFAJ*hZIDY%epbu+*C`HwOHj3Y(qVk*6
z6yAF5wT3UgC_n)UP=Epypa2CZKmiI+fC3a4E`dmBbauQ}s@5kkE<XPc*W_|E6rcbF
zC_n)UP=Epypa2CZK!L76baYmi$N!Mz|FP+xFA7kA0u-PC1t>rP3Q&Lo6rcbFhFC!I
z|9t)*;tA%^C_n)UP=Epypa2CZKmiI+fC3QU^FNmX1t>rP3Q&Lo6rcbFC_n)UP+<54
z`20WobIcJ^fC3bt00k&O0SZun0u-PC1^E2WH9!FhP=Epypa2CZKmiI+fC3a4egXdf
zf5Sh=93cfLKmiI+fC3bt00k&O0SZun`G2kf3Q&Lo6rcbFC_n)UP=Epypuq48@cDoE
z=a?g;00k&O0SZun0u-PC1t>rP3h?=#Yk&e2pa2CZKmiI+fC3bt00k&8`~rObAO1P!
z2q{1T3Q&Lo6rcbFC_n)UP=Esb|NpoKC_n)UP=Epypa2CZKmiI+fC9rWAkY6JQ@?1_
zzv3UhC_n)UP=Epypa2CZKmiI+;4Ko^duJpxyFdT1R@!(vzt(urT6<WsUGEb$fBotF
zR^`e3_0Mfvnd!8dNSW!BX(yDa9M8m&<(RmdG?kUWJ833tQ`xxg;xvI0wuy?KYo<^!
zZQ3?&r}4Hd6ZMlQ=-{elo30n!L>c#<Io~R6N}mZQxTjKP3b)Z>(m}tt=%h>!eac%x
zk-oj4IfdTrgoP%mkI;fjqU9u7_Ry^*bvz4AN|^-SZl}6J2@JtjR?vg(BEWmkp6$)*
zp_%<_wXKdxrqYDT@<y$nMWJ^L6Y-#V<(aMoh~{04uVW-b#rPFERvt7Q7afV0B_=pi
zX%tK&Ky;6uQ#f<sqHssfh0H-+v}n6d&qg^2*h-_Fpmhf!L%>#DBp0m+1#Tle+m&uG
zIJDu2Z-67!gK0uED2Wz?%EDYB7|S!$u8Dwg%}ZmBJCk9-MfU%X#9nE!SFu0dqD9V7
zDL?@VP=Epypa2CZKmiI+fC3aaO&~fttIOYpM#e^G#%o)W|JSF!)9}R?1t>rP3Q&Lo
z6rcbFC_n)U{AU9DMLiV%CRHsXZ{JB=`y1uvU(@;BB)%<~WgIJ{cx~kNl_c4bFjlr}
zO0GSLys?}jWsj`7nGW*j3h8VQ`DLVt74qGZpq2!C3RUsVmdr6S%E(tEA08y6Q)mTg
zWL!xg<BSs|zLENO(Whjkk>!`>kocBe14zUt<)Y;0ksnW*NR6Wk_7r$1hda`mjo1*P
zoJ!=9MaL!q#3fae*a?6{wu81L8!nL|g`PH%A4d`%=Rw|FlK&W%Y#+cT0hK~CHfkZf
zpgG)>D9{gb;Ml65kQWbbNR}NV_7I<7Nk&}`F=9l44F<040g!DG5+oAt3MqMXg0Ud2
z9_%uZN*KQ6{eztVaF87c7>~dRS`Zt65SJWUeQAFr<rTEB2?7V`6%D1(sbgY#6oxJC
zlKht$!%RqEo;t|*%hm}LOCdN+JRmU`h0^%4E$lgfH%iF3(X*(?rT{O2>W^J3J%7F4
t-rnxy|Ml2w4PSgwfC3bt00k&O0SZun0u-PC1t>6F0@2a<c<@)HKLKtsRdxUX

literal 0
HcmV?d00001

diff --git a/modules/nixos/kanidm/server.toml b/modules/nixos/kanidm/server.toml
new file mode 100644
index 0000000..3e35d9e
--- /dev/null
+++ b/modules/nixos/kanidm/server.toml
@@ -0,0 +1,10 @@
+bindaddress = "[::]:8443"
+db_path = "/home/daniel/code/nix/modules/nixos/kanidm/kanidm.db"
+tls_chain = "/tmp/cert.pem"
+tls_key = "/tmp/key.pem"
+domain = "idm.foxtrot.hare-cod.ts.net"
+origin = "https://idm.foxtrot.hare-cod.ts.net:8443"
+
+[online_backup]
+path = "/tmp/kanidm/backups/"
+schedule = "00 22 * * *"
diff --git a/nixos/beefcake.nix b/nixos/beefcake.nix
index 0583aea..0f520ed 100644
--- a/nixos/beefcake.nix
+++ b/nixos/beefcake.nix
@@ -999,6 +999,38 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
         26966
       ];
     }
+    {
+      # kanidm
+      services.kanidm = {
+        enableClient = true;
+        enablePam = true;
+        enableServer = true;
+
+        serverSettings = {
+          bindaddress = "[::]:8443";
+          db_path = "/storage/kanidm/data/kanidm.db";
+          # TODO: these will need permissions?
+          tls_chain = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.crt";
+          tls_key = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.key";
+          domain = "idm.foxtrot.hare-cod.ts.net";
+          origin = "https://idm.h.lyte.dev:8443";
+
+          online_backup = {
+            path = "/storage/kanidm/backups/";
+            schedule = "00 22 * * *";
+          };
+        };
+
+        clientSettings = {
+          uri = "https://idm.h.lyte.dev";
+          # ca_path = "/tmp/cert.pem";
+        };
+      };
+
+      services.caddy.virtualHosts."idm.h.lyte.dev" = {
+        extraConfig = ''reverse_proxy :8443'';
+      };
+    }
   ];
 
   # TODO: non-root processes and services that access secrets need to be part of
diff --git a/nixos/router.nix b/nixos/router.nix
index 1931dad..f1c7cd1 100644
--- a/nixos/router.nix
+++ b/nixos/router.nix
@@ -46,6 +46,7 @@
       additionalHosts = [
         ".beefcake.lan"
         "nix.h.lyte.dev"
+        "idm.h.lyte.dev"
         "git.lyte.dev"
         "video.lyte.dev"
         "a.lyte.dev"
diff --git a/templates/rust/flake.nix b/templates/rust/flake.nix
index f7c6efa..d1b1f18 100644
--- a/templates/rust/flake.nix
+++ b/templates/rust/flake.nix
@@ -52,6 +52,8 @@
         src = ./.;
         hash = pkgs.lib.fakeHash;
         cargoHash = "sha256-W7VQlMktGsRPQL9VGVmxYV6C5u2eJ48S7eTpOM+3n8U=";
+
+        RUSTFLAGS = pkgs.lib.optionalString pkgs.stdenv.isLinux "-C link-arg=-fuse-ld=mold";
       };
 
       default = outputs.packages.${pkgs.system}.my-package;

From e356a7ccbae3698d8aa320f0b118a0b472ee20bc Mon Sep 17 00:00:00 2001
From: Daniel Flanagan <daniel@lyte.dev>
Date: Tue, 6 Aug 2024 10:33:09 -0500
Subject: [PATCH 5/5] WIP kanidm

---
 modules/nixos/kanidm/client.toml |   2 --
 modules/nixos/kanidm/kanidm.db   | Bin 73728 -> 0 bytes
 modules/nixos/kanidm/server.toml |  10 ----------
 nixos/beefcake.nix               |  16 ++++++++++++----
 safe-remote-upgrade.bash         |   4 ++--
 5 files changed, 14 insertions(+), 18 deletions(-)
 delete mode 100644 modules/nixos/kanidm/client.toml
 delete mode 100644 modules/nixos/kanidm/kanidm.db
 delete mode 100644 modules/nixos/kanidm/server.toml

diff --git a/modules/nixos/kanidm/client.toml b/modules/nixos/kanidm/client.toml
deleted file mode 100644
index 1ea48a5..0000000
--- a/modules/nixos/kanidm/client.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-uri = "https://idm.foxtrot.hare-cod.ts.net:8443"
-ca_path = "/tmp/cert.pem"
diff --git a/modules/nixos/kanidm/kanidm.db b/modules/nixos/kanidm/kanidm.db
deleted file mode 100644
index 2a0e7c7d26881f9589f10fbc95b0837e8dff78ce..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 73728
zcmeI)%}yIv7zW@OFt#CpLn>scQN#o(YKVqv&Uj{QXVW@lf~>fv7}7SXBG<tVvA{OP
zcA6;4B9tt80o}G2kwv@f9dyyFsJhE4Rabq#u`#A#LZzxz+}FZke$LN#o^y;CzN4(I
z=BllV@u0C=E47S-c3#tU?L))RG%bwx1-uVlavnN3!FRpyc+g>3d%yVZRP1+cCh}5?
zU5foQ`SbK|(?3k_Pp?k=IQjkL&SYlt!uW3V+wl(~FQZ=!YKGS-KmiI+fCB$}f#=uG
zN8*<+>w9yp(*5nq!)C2mF11R<*5T32Qo+xx`^I|aM$R`5uNzk<i~+B$$`fPV|7_j(
zxRCuQQ@Cr~_V1blOFt@Yw=2et+{z6jzp`%R@8ohPmR(59gyYMXb*)-2R~|RN+{P~(
z#ZtS~2+oU#krmb9@rCE_O-JH$bNb$;-UzGpR%d|0LG0N0g3JH@@Kh`u_vcO<UJzJk
zbiv{Iy``yO`u10Y!PP3Y`<30sgJSFOX!^+T4zCXw-)6Dhu9kz@J9)-RZz^zWrQm0m
z^D^gGJFP7k1^<>`@bgRlnz6atXzvtTSEZW;<EGpw1S>0>&#q@Px!m3EMgQi>0ra=u
z3Fb)qrHze7TPC>M!%80Q<$NsQrOet==B9saZ7uA58jZv+UesTV1&ZAWyWhr-_;oK1
z!0XYydEwVfwMyqRa<Jx&JNfMD9slG(H+SlPqx5FATyM)#FtYh|f7vheK3J!A(rRo~
z>PJ6_Cr49xyi?tMf=}v4ej&TmYy7zE;$%3Uxj1M^cQK1j_h4%A+*yhzy2U3KC(csb
z?iN3{IDVGms#|>GYi%_6!SP}xSQWi>)jJ3sSsA^{!?`wgO3mh1joosvJWgH}|NQb%
zk<)%6_QZ=$?=Y&uXRDIvRf(vvvsJNsRl+KCwkoPuW$gK!9*JMMqVMU!aw^|1KC0|C
ztBrcG)qgy4WKs3s8L+OpKdj&U6Q|qV!H<OFAJ*hZIDY%epbu+*C`HwOHj3Y(qVk*6
z6yAF5wT3UgC_n)UP=Epypa2CZKmiI+fC3a4E`dmBbauQ}s@5kkE<XPc*W_|E6rcbF
zC_n)UP=Epypa2CZK!L76baYmi$N!Mz|FP+xFA7kA0u-PC1t>rP3Q&Lo6rcbFhFC!I
z|9t)*;tA%^C_n)UP=Epypa2CZKmiI+fC3QU^FNmX1t>rP3Q&Lo6rcbFC_n)UP+<54
z`20WobIcJ^fC3bt00k&O0SZun0u-PC1^E2WH9!FhP=Epypa2CZKmiI+fC3a4egXdf
zf5Sh=93cfLKmiI+fC3bt00k&O0SZun`G2kf3Q&Lo6rcbFC_n)UP=Epypuq48@cDoE
z=a?g;00k&O0SZun0u-PC1t>rP3h?=#Yk&e2pa2CZKmiI+fC3bt00k&8`~rObAO1P!
z2q{1T3Q&Lo6rcbFC_n)UP=Esb|NpoKC_n)UP=Epypa2CZKmiI+fC9rWAkY6JQ@?1_
zzv3UhC_n)UP=Epypa2CZKmiI+;4Ko^duJpxyFdT1R@!(vzt(urT6<WsUGEb$fBotF
zR^`e3_0Mfvnd!8dNSW!BX(yDa9M8m&<(RmdG?kUWJ833tQ`xxg;xvI0wuy?KYo<^!
zZQ3?&r}4Hd6ZMlQ=-{elo30n!L>c#<Io~R6N}mZQxTjKP3b)Z>(m}tt=%h>!eac%x
zk-oj4IfdTrgoP%mkI;fjqU9u7_Ry^*bvz4AN|^-SZl}6J2@JtjR?vg(BEWmkp6$)*
zp_%<_wXKdxrqYDT@<y$nMWJ^L6Y-#V<(aMoh~{04uVW-b#rPFERvt7Q7afV0B_=pi
zX%tK&Ky;6uQ#f<sqHssfh0H-+v}n6d&qg^2*h-_Fpmhf!L%>#DBp0m+1#Tle+m&uG
zIJDu2Z-67!gK0uED2Wz?%EDYB7|S!$u8Dwg%}ZmBJCk9-MfU%X#9nE!SFu0dqD9V7
zDL?@VP=Epypa2CZKmiI+fC3aaO&~fttIOYpM#e^G#%o)W|JSF!)9}R?1t>rP3Q&Lo
z6rcbFC_n)U{AU9DMLiV%CRHsXZ{JB=`y1uvU(@;BB)%<~WgIJ{cx~kNl_c4bFjlr}
zO0GSLys?}jWsj`7nGW*j3h8VQ`DLVt74qGZpq2!C3RUsVmdr6S%E(tEA08y6Q)mTg
zWL!xg<BSs|zLENO(Whjkk>!`>kocBe14zUt<)Y;0ksnW*NR6Wk_7r$1hda`mjo1*P
zoJ!=9MaL!q#3fae*a?6{wu81L8!nL|g`PH%A4d`%=Rw|FlK&W%Y#+cT0hK~CHfkZf
zpgG)>D9{gb;Ml65kQWbbNR}NV_7I<7Nk&}`F=9l44F<040g!DG5+oAt3MqMXg0Ud2
z9_%uZN*KQ6{eztVaF87c7>~dRS`Zt65SJWUeQAFr<rTEB2?7V`6%D1(sbgY#6oxJC
zlKht$!%RqEo;t|*%hm}LOCdN+JRmU`h0^%4E$lgfH%iF3(X*(?rT{O2>W^J3J%7F4
t-rnxy|Ml2w4PSgwfC3bt00k&O0SZun0u-PC1t>6F0@2a<c<@)HKLKtsRdxUX

diff --git a/modules/nixos/kanidm/server.toml b/modules/nixos/kanidm/server.toml
deleted file mode 100644
index 3e35d9e..0000000
--- a/modules/nixos/kanidm/server.toml
+++ /dev/null
@@ -1,10 +0,0 @@
-bindaddress = "[::]:8443"
-db_path = "/home/daniel/code/nix/modules/nixos/kanidm/kanidm.db"
-tls_chain = "/tmp/cert.pem"
-tls_key = "/tmp/key.pem"
-domain = "idm.foxtrot.hare-cod.ts.net"
-origin = "https://idm.foxtrot.hare-cod.ts.net:8443"
-
-[online_backup]
-path = "/tmp/kanidm/backups/"
-schedule = "00 22 * * *"
diff --git a/nixos/beefcake.nix b/nixos/beefcake.nix
index 0f520ed..9c8b3cd 100644
--- a/nixos/beefcake.nix
+++ b/nixos/beefcake.nix
@@ -447,7 +447,6 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
       users.groups.daniel.members = ["daniel"];
       users.groups.nixadmin.members = ["daniel"];
       users.users.daniel = {
-        packages = [pkgs.weechat];
         extraGroups = [
           "nixadmin" # write access to /etc/nixos/ files
           "wheel" # sudo access
@@ -778,6 +777,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
             gitMinimal
             gnused
             nodejs
+            gnutar # needed for cache action
             wget
           ];
         };
@@ -1008,19 +1008,27 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
 
         serverSettings = {
           bindaddress = "[::]:8443";
-          db_path = "/storage/kanidm/data/kanidm.db";
+          # ldapbindaddress
           # TODO: these will need permissions?
           tls_chain = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.crt";
           tls_key = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev.key";
-          domain = "idm.foxtrot.hare-cod.ts.net";
-          origin = "https://idm.h.lyte.dev:8443";
+          domain = "idm.h.lyte.dev";
+          origin = "https://idm.h.lyte.dev";
+          # log_level
 
           online_backup = {
             path = "/storage/kanidm/backups/";
             schedule = "00 22 * * *";
+            # versions = 7;
           };
         };
 
+        unixSettings = {
+          uri = "https://idm.h.lyte.dev";
+          pam_allowed_login_groups = [];
+          # ca_path = "/path/to/ca.pem";
+        };
+
         clientSettings = {
           uri = "https://idm.h.lyte.dev";
           # ca_path = "/tmp/cert.pem";
diff --git a/safe-remote-upgrade.bash b/safe-remote-upgrade.bash
index d620fe6..530ca3d 100755
--- a/safe-remote-upgrade.bash
+++ b/safe-remote-upgrade.bash
@@ -30,9 +30,9 @@ git add -A
 
 ssh "root@$target_host" "bash -c '
   set -m
-  # sleep 5 mins
+  # sleep 15 mins
   echo \"Starting background reboot job...\"
-  (sleep 300; reboot;) &
+  (sleep 900; reboot;) &
   jobs -p
   disown
 '" &