no more mkCaddyConfig, manually specify ports, no more manual /etc/hosts, started using dnsmasq instead. all works!

15 files changed, 36 insertions, 460 deletions

diff --git a/modules/services/nixos/agate.nix b/modules/services/nixos/agate.nix
deleted file mode 100644
index f1593e6..0000000
--- a/modules/services/nixos/agate.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.agate;
-in
-  lib.mkIf cfg.enable {
-    services.agate = {
-      enable = true;
-      addresses = [
-        "0.0.0.0:1965"
-      ];
-      hostnames = [cfg.publicUrl];
-
-      onlyTls_1_3 = true;
-
-      contentDir = "/media/public/gmi";
-    };
-
-    networking.firewall.allowedTCPPorts = [1965];
-  }
diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix
index d27ede1..d8f4598 100644
--- a/modules/services/nixos/btopweb.nix
+++ b/modules/services/nixos/btopweb.nix
@@ -15,10 +15,6 @@
     proc_colors = true
   '';
 in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
   config = lib.mkIf cfg.enable {
     users.groups."btopweb" = {};
     users.users."btopweb" = {
@@ -40,5 +36,10 @@ in {
         ExecStart = ''${pkgs.ttyd}/bin/ttyd -W -i ${cfg.listenAddr} -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}'';
       };
     };
+
+    services.caddy.virtualHosts."btop.ganymede".extraConfig = ''
+      tls internal
+      reverse_proxy 127.0.0.1:${toString cfg.port}
+    '';
   };
 }
diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix
index df37e9a..b61a3c6 100644
--- a/modules/services/nixos/caddy.nix
+++ b/modules/services/nixos/caddy.nix
@@ -7,17 +7,10 @@
   cfg = config.collinux.services.caddy;
 in
   lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [80 443];
+    environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff
     services.caddy = {
-      # just always install this. No harm in installing an extra plugin
-      package = pkgs.caddy.withPlugins {
-        plugins = [
-          "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61"
-        ];
-        hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
-      };
       enable = true;
       environmentFile = cfg.envFile;
     };
-    networking.firewall.allowedTCPPorts = [80 443];
-    environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff
   }
diff --git a/modules/services/nixos/cgit/default.nix b/modules/services/nixos/cgit/default.nix
index 3c225ee..2a78607 100644
--- a/modules/services/nixos/cgit/default.nix
+++ b/modules/services/nixos/cgit/default.nix
@@ -20,7 +20,6 @@
   };
 in {
   imports = [
-    (import ../mkCaddyCfg.nix cfg)
     ./gitShellCommands.nix
   ];
 
@@ -82,7 +81,9 @@ in {
       };
     };
 
-    collinux.services.cgit.manualCaddyConfig = ''
+    services.caddy.virtualHosts."git.ganymede".extraConfig = ''
+      tls internal
+
       @assets path /cgit.css /cgit.js /favicon.svg /robots.txt
       handle @assets {
       	root * ${custom_cgit}
diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix
deleted file mode 100644
index 0e607e2..0000000
--- a/modules/services/nixos/copyparty.nix
+++ /dev/null
@@ -1,100 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}: let
-  cfg = config.collinux.services.copyparty;
-in {
-  imports = [
-    inputs.copyparty.nixosModules.default
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
-  config = lib.mkIf cfg.enable {
-    users.groups."fileserver".members = [config.collinux.user.name];
-
-    networking.firewall.allowedTCPPorts = lib.optional (cfg.listenAddr == "0.0.0.0") cfg.port;
-
-    services.copyparty = {
-      enable = true;
-
-      user = "copyparty";
-      group = "fileserver";
-
-      settings = {
-        i = cfg.listenAddr;
-        p = [cfg.port];
-        rproxy = "1";
-        tls = false;
-
-        name = "files@ganymede";
-        usernames = true;
-        no-robots = true;
-        chmod-d = "775";
-
-        e2dsa = true;
-        hist = "/var/lib/copyparty/cache";
-
-        # customization
-        spinner = ",padding:0;border-radius:9em;border:.2em solid #444;border-top:.2em solid #fc0"; # no more tree
-        ui-nolbar = true;
-        ui-norepl = true;
-      };
-
-      accounts =
-        cfg.users
-        |> builtins.mapAttrs (k: v: {
-          inherit (v) passwordFile;
-        });
-
-      groups.admin = cfg.users |> lib.attrsets.filterAttrs (k: v: v.isAdmin == true) |> builtins.attrNames;
-
-      volumes = lib.mkMerge ([
-          {
-            "/" = {
-              path = "/media/public";
-              access = {
-                r = "*";
-                A = "@admin";
-              };
-            };
-
-            "/public" = {
-              path = "/var/empty";
-              access.r = "*";
-            };
-
-            "/library" = {
-              path = "/media/library";
-              access = {
-                g = "*";
-                r = "@acct";
-                A = "@admin";
-              };
-              flags = {
-                fk = 6;
-                dks = 6;
-                e2ts = true; # enable music indexing
-              };
-            };
-          }
-        ]
-        ++ lib.lists.flatten (cfg.users
-          |> lib.attrsets.mapAttrsToList (k: v: [
-            {
-              "/${k}" = {
-                path = "/media/${k}";
-                access.rwd = k;
-              };
-            }
-            (lib.optionalAttrs v.hasPublicDir {
-              "/public/${k}" = {
-                path = "/media/${k}/public";
-                access.r = "*";
-              };
-            })
-          ])));
-    };
-  };
-}
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 13cdcf4..68ed3ee 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -3,17 +3,14 @@
     ./caddy.nix
     ./openssh.nix
 
-    ./forgejo.nix
     ./goaccess.nix
     ./btopweb.nix
     ./cgit
     ./ganyupload
-
     ./jta
-    ./agate.nix
+
     ./minecraft.nix
     ./ngircd.nix
-    ./copyparty.nix
     ./qbittorrent.nix
   ];
 }
diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix
deleted file mode 100644
index 9176523..0000000
--- a/modules/services/nixos/forgejo.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}: let
-  cfg = config.collinux.services.forgejo;
-in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
-  config = lib.mkIf cfg.enable {
-    services.forgejo = {
-      enable = true;
-      database.type = "sqlite3";
-      settings = {
-        server = {
-          PROTOCOL = "http";
-          ROOT_URL = "https://${
-            if cfg.publicUrl != null
-            then cfg.publicUrl
-            else if cfg.privateUrl != null
-            then cfg.privateUrl
-            else ""
-          }";
-
-          HTTP_ADDR = cfg.listenAddr;
-          HTTP_PORT = cfg.port;
-
-          OFFLINE_MODE = true; # don't use cdns or gravatar
-
-          # ssh
-          START_SSH_SERVER = false; # use system ssh server
-          SSH_USER = "forgejo";
-          SSH_DOMAIN = "williamsfam.us.com";
-          SSH_PORT = 22;
-        };
-        service = {
-          DISABLE_REGISTRATION = true;
-          ENABLE_REVERSE_PROXY_AUTHENTICATION = false;
-        };
-        repository = {
-          # disable stuff
-          DISABLE_MIGRATIONS = true;
-          DISABLE_STARS = true;
-          DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
-        };
-      };
-    };
-
-    systemd.services."forgejo" = {
-      after = lib.mkAfter ["network-online.target"];
-      wants = lib.mkAfter ["network-online.target"];
-
-      # Ensure users (https://wiki.nixos.org/wiki/Forgejo#Ensure_users)
-      preStart = let
-        adminCmd = "${lib.getExe pkgs.forgejo} admin user";
-        passwd = config.collinux.secrets."collin-forgejo-password";
-      in ''
-        ${adminCmd} create --admin --email "collin@ganymede" --username collin --password "$(tr -d '\n' < ${passwd.path})" || true
-      '';
-    };
-  };
-}
diff --git a/modules/services/nixos/ganyupload/AGENTS.md b/modules/services/nixos/ganyupload/AGENTS.md
deleted file mode 100644
index c4d9192..0000000
--- a/modules/services/nixos/ganyupload/AGENTS.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Ganyupload - Agent Instructions
-
-## Quick Context
-- Simple Go file upload service using standard `net/http`.
-- Single `main.go`, two Nix files (`default.nix`, `pkg.nix`), one README.
-- Embedded README is served on GET /.
-- Used as a NixOS module: `collinux.services.ganyupload` enables it, configures port and upload directory via systemd environment.
-
-## How to Build and Test
-
-### Build
-```bash
-nix build
-```
-
-Alternatively, from the repo root:
-```bash
-nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
-```
-
-### Test
-No dedicated test file. Verify locally by running with environment variables:
-```bash
-PORT=8080 UPLOAD_DIR=/tmp/upload go run main.go
-```
-
-Then test uploads:
-```bash
-curl -X PUT --data-binary @file.txt http://localhost:8080/file.txt
-curl http://localhost:8080/  # Read embedded README
-```
-
-## Code Style
-
-**Go:**
-- Keep `main.go` clean; use `gofmt -w .`.
-- Match existing error handling (early return, `log.Printf` for warnings, `log.Fatalf` for fatal errors).
-- Path traversal prevention is critical; do not weaken `filepath.Clean` + `..` prefix checks.
-
-**Nix:**
-- Follow `/home/collin/nixos/AGENTS.md` conventions (2-space indent, common arg pattern, `lib.mkIf` for gating).
-- `default.nix` imports `mkCaddyCfg.nix` to integrate with Caddy reverse proxy; do not remove that import.
-
-## Key Implementation Notes
-
-1. **Embedded README:** The README file is embedded at compile time using `//go:embed README`. If you update README, rebuild to reflect changes.
-2. **Environment Variables:**
-   - `UPLOAD_DIR`: Defaults to `.`, overridden by systemd service to `/media/ganyupload`.
-   - `PORT`: Defaults to `8080`, set by systemd to the configured `cfg.port`.
-3. **NixOS Integration:** The service runs as user/group `ganyupload` with home `/var/lib/ganyupload`. Ensure the service has write permission to `UPLOAD_DIR`.
-4. **Caddy Integration:** `default.nix` imports `mkCaddyCfg.nix` to configure Caddy as a reverse proxy. Changes to hostname or port must be reflected in both Nix config and the Caddy rule.
-
-## Common Tasks
-
-- **Update Go code:** Edit `main.go`, test locally, then nix build to verify.
-- **Change upload directory or port:** Update `default.nix` (systemd environment or `cfg.port`).
-- **Update README:** Edit README file, then rebuild (`nix build`) so the embedded version updates.
-- **Debug NixOS module:** Check `/etc/systemd/system/ganyupload.service` for actual service config after rebuild.
-
-## Validation
-
-After changes:
-1. Run `nix build` from this directory or `nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel` from repo root.
-2. If applicable, test via `PORT=8080 UPLOAD_DIR=/tmp go run main.go`.
-3. Verify no Nix lint issues (use repo-level `yo test` or `nix run nixpkgs#alejandra -- .` for formatting).
diff --git a/modules/services/nixos/ganyupload/default.nix b/modules/services/nixos/ganyupload/default.nix
index 0138100..2ec704b 100644
--- a/modules/services/nixos/ganyupload/default.nix
+++ b/modules/services/nixos/ganyupload/default.nix
@@ -5,13 +5,8 @@
   ...
 }: let
   cfg = config.collinux.services.ganyupload;
-
   package = pkgs.callPackage ./pkg.nix {};
 in {
-  imports = [
-    (import ../mkCaddyCfg.nix cfg)
-  ];
-
   config = lib.mkIf cfg.enable {
     users.groups."ganyupload" = {};
     users.users."ganyupload" = {
@@ -43,5 +38,9 @@ in {
 
       wantedBy = ["multi-user.target"];
     };
+
+    services.caddy.virtualHosts."upld.williamsfam.us.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:${toString cfg.port}
+    '';
   };
 }
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index 703e263..b77f370 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -14,13 +14,8 @@
     log-file = "/var/log/caddy/access-williamsfam.us.com.log";
     geoip-database = inputs.geolite-db;
 
-    ws-url =
-      if cfg.publicUrl != null
-      then "wss://${cfg.publicUrl}:443/ws"
-      else if cfg.privateUrl != null
-      then "wss://${cfg.privateUrl}:443/ws"
-      else null;
-    port = 7890;
+    ws-url = "wss://stats.ganymede:443/ws";
+    port = cfg.port;
     addr = cfg.listenAddr;
 
     real-time-html = "true";
@@ -42,10 +37,6 @@
 
   settingsFile = pkgs.writeText "goaccess.conf" (settings |> builtins.mapAttrs (k: v: "${k} ${toString v}") |> builtins.attrValues |> lib.concatStringsSep "\n");
 in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
   config = lib.mkIf cfg.enable {
     users.groups."goaccess" = {};
     users.users."goaccess" = {
@@ -59,75 +50,35 @@ in {
       restartIfChanged = true;
       wants = ["network-online.target" "caddy.service"];
       after = ["network-online.target" "caddy.service"];
+      wantedBy = ["multi-user.target"];
 
       serviceConfig = {
         User = "goaccess";
         Type = "simple";
 
+        ReadWritePaths = "/var/www/goaccess";
         WorkingDirectory = "/var/www/goaccess";
         ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}";
 
-        AmbientCapabilities = [];
-        CapabilityBoundingSet = [
-          "~CAP_RAWIO"
-          "~CAP_MKNOD"
-          "~CAP_AUDIT_CONTROL"
-          "~CAP_AUDIT_READ"
-          "~CAP_AUDIT_WRITE"
-          "~CAP_SYS_BOOT"
-          "~CAP_SYS_TIME"
-          "~CAP_SYS_MODULE"
-          "~CAP_SYS_PACCT"
-          "~CAP_LEASE"
-          "~CAP_LINUX_IMMUTABLE"
-          "~CAP_IPC_LOCK"
-          "~CAP_BLOCK_SUSPEND"
-          "~CAP_WAKE_ALARM"
-          "~CAP_SYS_TTY_CONFIG"
-          "~CAP_MAC_ADMIN"
-          "~CAP_MAC_OVERRIDE"
-          "~CAP_NET_ADMIN"
-          "~CAP_NET_BROADCAST"
-          "~CAP_NET_RAW"
-          "~CAP_SYS_ADMIN"
-          "~CAP_SYS_PTRACE"
-          "~CAP_SYSLOG"
-        ];
-        DevicePolicy = "closed";
-        KeyringMode = "private";
-        LockPersonality = true;
         NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
         PrivateTmp = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
+        ProtectSystem = "strict";
         ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        ProtectSystem = "full";
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_UNIX"
-          "AF_INET"
-          "AF_INET6"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
       };
-
-      wantedBy = ["multi-user.target"];
     };
 
     systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"];
 
-    collinux.services.goaccess.manualCaddyConfig = ''
+    services.caddy.virtualHosts."stats.ganymede".extraConfig = ''
+      tls internal
+
       root * /var/www/goaccess
       file_server
 
-      reverse_proxy /ws 127.0.0.1:7890
+      reverse_proxy /ws 127.0.0.1:${toString cfg.port}
     '';
   };
 }
diff --git a/modules/services/nixos/jta/default.nix b/modules/services/nixos/jta/default.nix
index d2908bc..31f5bbd 100644
--- a/modules/services/nixos/jta/default.nix
+++ b/modules/services/nixos/jta/default.nix
@@ -5,13 +5,8 @@
   ...
 }: let
   cfg = config.collinux.services.jta;
-
   package = pkgs.callPackage ./pkg.nix {};
 in {
-  imports = [
-    (import ../mkCaddyCfg.nix cfg)
-  ];
-
   config = lib.mkIf cfg.enable {
     users.groups."jta" = {};
     users.users."jta" = {
@@ -25,7 +20,6 @@ in {
     };
 
     systemd.services."jta" = {
-      description = "Juksere trives aldri, kids";
       restartIfChanged = true;
       wants = ["network-online.target" "caddy.service"];
       after = ["network-online.target" "caddy.service"];
@@ -46,5 +40,9 @@ in {
 
       wantedBy = ["multi-user.target"];
     };
+
+    services.caddy.virtualHosts."jta.williamsfam.us.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:${toString cfg.port}
+    '';
   };
 }
diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix
deleted file mode 100644
index 02b9a0a..0000000
--- a/modules/services/nixos/mkCaddyCfg.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-cfg: let
-  caddyConfig =
-    if cfg ? reverseProxy && cfg.reverseProxy == true
-    then ''reverse_proxy ${cfg.listenAddr}:${toString cfg.port}''
-    else cfg.manualCaddyConfig;
-in {
-  networking.extraHosts =
-    if cfg.privateUrl != null
-    then "127.0.0.1 ${cfg.privateUrl}"
-    else "";
-
-  services.caddy.virtualHosts =
-    (
-      if cfg.publicUrl != null
-      then {
-        ${cfg.publicUrl}.extraConfig = caddyConfig;
-      }
-      else {}
-    )
-    // (
-      if cfg.privateUrl != null
-      then {
-        "${cfg.privateUrl}".extraConfig = ''
-          tls internal
-          ${caddyConfig}
-        '';
-      }
-      else {}
-    );
-}
diff --git a/modules/services/nixos/mopidy.nix b/modules/services/nixos/mopidy.nix
deleted file mode 100644
index 844a387..0000000
--- a/modules/services/nixos/mopidy.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.collinux.services.mopidy;
-in {
-  config = lib.mkIf cfg.enable {
-    services.mopidy = {
-      enable = true;
-      extensionPackages = with pkgs; [mopidy-youtube mopidy-mpd mopidy-local];
-      settings = {
-        mpd = {
-          enabled = true;
-          hostname = "0.0.0.0";
-          port = cfg.port;
-        };
-
-        # disable default plugins
-        file.enabled = false;
-        http.enabled = false; # only use mpd
-
-        local = {
-          enabled = true;
-          media_dir = "/media/library/music";
-        };
-
-        youtube = {
-          enabled = true;
-          allow_cache = true;
-          musicapi_enabled = true;
-          youtube_dl_package = "yt_dlp";
-          autoplay_enabled = true;
-          strict_autoplay = false;
-          search_results = 15;
-        };
-      };
-    };
-  };
-}
diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix
index 13bf114..bb0fab7 100644
--- a/modules/services/nixos/qbittorrent.nix
+++ b/modules/services/nixos/qbittorrent.nix
@@ -5,10 +5,6 @@
 }: let
   cfg = config.collinux.services.qbittorrent;
 in {
-  imports = [
-    (import ./mkCaddyCfg.nix cfg)
-  ];
-
   config = lib.mkIf cfg.enable {
     users.users."qbittorrent" = {
       uid = 985;
@@ -23,7 +19,11 @@ in {
       webuiPort = cfg.port;
       torrentingPort = 49252;
     };
-
     systemd.services.qbittorrent.serviceConfig.PrivateUsers = lib.mkForce false;
+
+    services.caddy.virtualHosts."bittorrent.ganymede".extraConfig = ''
+      tls internal
+      reverse_proxy ${toString cfg.port}
+    '';
   };
 }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 1888f5b..1cb1019 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -9,7 +9,6 @@
   # A helper function to generate the submodule
   webserviceOptions = {
     service_name,
-    default_port ? null,
     reverse_proxy ? true,
   }:
     {
@@ -41,7 +40,6 @@
         port = mkOption {
           description = "The port on which ${service_name} will listen for incomming connections";
           type = lib.types.port;
-          default = default_port;
         };
       }
       else {
@@ -78,7 +76,7 @@ in {
       public = mkEnableOption "whether to make this service accessable over the internet";
     };
     ngircd = {
-      enable = mkEnableOption "ncircd IRC server";
+      enable = mkEnableOption "ngircd IRC server";
       port = mkOption {
         type = lib.types.port;
         default = 6667;
@@ -86,33 +84,21 @@ in {
 
       public = mkEnableOption "whether to make this service accessable over the internet";
     };
-    agate = {
-      enable = mkEnableOption "Agate Gemini Protocol Server";
-      publicUrl = mkOption {
-        description = "domain to run this gemini server on";
-        type = lib.types.str;
-      };
-    };
 
     jta = webserviceOptions {
       service_name = "jta";
-      default_port = 8072;
     };
     ganyupload = webserviceOptions {
       service_name = "ganyupload";
-      default_port = 8073;
     };
     forgejo = webserviceOptions {
       service_name = "forgejo";
-      default_port = 8010;
     };
     btopweb = webserviceOptions {
       service_name = "btopweb";
-      default_port = 8017;
     };
     goaccess = webserviceOptions {
       service_name = "goaccess";
-      reverse_proxy = false;
     };
     cgit = webserviceOptions {
       service_name = "cgit";
@@ -120,34 +106,7 @@ in {
     };
     qbittorrent = webserviceOptions {
       service_name = "qbittorrent";
-      default_port = 8076;
     };
-    copyparty =
-      (webserviceOptions {
-        service_name = "copyparty";
-        default_port = 8099;
-      })
-      // {
-        users = mkOption {
-          description = "List of users to configure on the copyparty server";
-          type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
-            options = {
-              name = mkOption {
-                type = lib.types.str;
-                default = config._module.args.name;
-                internal = true;
-              };
-              isAdmin = mkEnableOption "whether this user is an admin";
-              passwordFile = mkOption {
-                description = "Absolute path to a file containing the password for this user";
-                type = lib.types.str;
-                example = "/run/secrets.d/copyparty-passwd";
-              };
-              hasPublicDir = mkEnableOption "give this user a world-readable directory at /public/<username>";
-            };
-          }));
-        };
-      };
 
     caddy = {
       enable = mkEnableOption "caddy https server";