Trust cni and flannel on robin to prevent issues when metallb node is assigned to robin

modules/features/flameshot.nix

@@ -1,21 +1,19 @@
 {
-  flake.nixosModules.flameshot = {
-    services.flameshot = {
-      enable = true;
-      General = {
-        showStartupLaunchMessage = false;
-	useGrimAdapter = true;
-	disabledGrimWarning = true;
-      };
-    };
+  flake.nixosModules.flameshot = { pkgs, ... }: {
+    environment.systemPackages = with pkgs; [
+      flameshot
+      grim
+      slurp
+      satty
+      wl-clipboard
+    ];
+
+    environment.etc."xdg/flameshot/flameshot.ini".text = ''
+      [General]
+      contrastOpacity=188
+      startupLaunch=true
+      useGrimAdapter=true
+    '';
   };
 
-
-  environment.systemPackages = [
-    flameshot
-    grim
-    slurp
-    satty
-    wl-copy
-  ];
 }

modules/features/tiling/niri.nix

@@ -123,9 +123,21 @@
 	    };
 	  }
 	  {
-    	    matches = [ { app-id="^flameshot$" } ];
+    	    matches = [ { app-id="^flameshot$"; } ];
             open-floating  = true;
-	  };
+	  }
+	  {
+            matches = [ { app-id="^Lens$"; } ];
+	    open-maximized = true;
+	  }
+	  {
+            matches = [ { app-id="^element$"; } ];
+	    open-maximized = true;
+	  }
+	  {
+	    matches = [ { app-id = "^brave-.+-Default$"; title = "^Bitwarden$"; } ];
+	    open-floating = true;
+	  }
         ];
 
         binds = {

modules/hosts/crow/configuration.nix

@@ -37,6 +37,42 @@
       lutris
       steam
       easyeffects
+      openssl
+      jq
+
+      # Wrap Element so it knows where gnome-libsecret is
+      # Additionally, override the config to disable legacy call protocol
+      (let
+        elementConfig = pkgs.writeText "element-config.json" (builtins.toJSON {
+          default_server_config = {
+            "m.homeserver" = {
+              base_url = "https://starling.mynest.love";
+              server_name = "starling.mynest.love";
+            };
+          };
+          features = {
+            "feature_group_calls" = true;
+            "feature_video_rooms" = true;
+            "feature_element_call_video_rooms" = true;
+          };
+          element_call = {
+            url = null;
+            use_exclusively = true;
+          };
+	  jitsi = {
+            preferred_domain = null;
+	  };
+        });
+      in symlinkJoin {
+        name = "element-desktop";
+        paths = [ element-desktop ];
+        nativeBuildInputs = [ makeWrapper ];
+        postBuild = ''
+          wrapProgram $out/bin/element-desktop \
+            --add-flags "--password-store=gnome-libsecret" \
+            --set ELEMENT_DESKTOP_CONFIG_JSON "${elementConfig}"
+        '';
+      })
     ];
 
     nixpkgs.overlays = [
@@ -63,6 +99,29 @@
       blueman.enable = true;
     };
 
+    services.ollama = {
+      enable = true;
+      package = pkgs.ollama-rocm;
+      environmentVariables = {
+        HSA_OVERRIDE_GFX_VERSION = "10.3.0";
+      };
+      loadModels = [ "deepseek-r1:32b" "qwen3.5:14b" ];
+    };
+
+    services.open-webui = {
+      enable = true;
+      host = "127.0.0.1";
+      port = 8080;
+      environment = {
+        OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
+    
+        # Keep telemetry disabled to ensure complete privacy
+        ANONYMIZED_TELEMETRY = "False";
+        DO_NOT_TRACK = "True";
+        SCARF_NO_ANALYTICS = "True";
+      };
+    };
+
     boot = {
       loader = {
         systemd-boot.enable = true;

modules/hosts/robin/configuration.nix

@@ -37,6 +37,7 @@
     services.k3s = {
       enable = true;
       role = "agent";
+      package = pkgs.k3s_1_36;
       
       serverAddr = "https://192.168.1.122:6443"; 
       tokenFile = "/var/lib/rancher/k3s/join-token";
@@ -87,6 +88,7 @@
       server.enable = true;
       server.exports = ''
         /export/yarr 192.168.1.0/16(rw,secure,anonuid=1000,anongid=1000,all_squash)
+	/export/nextcloud 192.168.1.0/16(rw,secure,no_root_squash)
         /export 192.168.1.0/16(ro,fsid=0,root_squash,subtree_check,secure)
       '';
 
@@ -101,9 +103,16 @@
       fsType = "ext4";
       options = [ "bind" ];
     };
+    
+    fileSystems."/export/nextcloud" = {
+      device = "/mnt/raid/nextcloud";
+      fsType = "ext4";
+      options = [ "bind" ];
+    };
 
     networking.firewall = {
       enable = true;
+      trustedInterfaces = [ "cni0" "flannel.1" ];
       
       allowedTCPPorts = [ 
 	22 # SSH (CRITICAL: Do not remove)

modules/users/nest.nix

@@ -3,7 +3,7 @@
     users.users.nest = {
       description = "nest";
       isNormalUser = true;
-      extraGroups = [ "wheel" "network" ];
+      extraGroups = [ "wheel" "network" "render" "video" ];
       shell = pkgs.zsh;
     };
   };