Add vps capabilities

17 files changed, 296 insertions, 107 deletions

diff --git a/agenda.org b/agenda.org
index 19714dc..e45fe76 100644
--- a/agenda.org
+++ b/agenda.org
@@ -19,14 +19,8 @@ project, it can be referenced here.
 
 * Tasks
 These are general life tasks that I need to do, which don't depend on a specific time or date.
-** TODO [#B] ToughNix
-I need to work on my monorepo flake which builds all my systems, and should accommodate future
-systems and also should be relatively abstractable (i.e. identifiers tied to me should be easily
-removed from the flake).
-*** TODO [#B] Migration
+** TODO [#B] NixOS VPS Migration
 Migrate all my services to NixOS.
-** TODO [#B] CSS
-I need to update my CSS for my website to look better.
 ** TODO [#B] Nullring
 Update the nullring to be in org mode, and also include a couple more sites.
 ** TODO [#B] Umami
@@ -48,12 +42,17 @@ I want to make an analogue computer.
 * Scheduled tasks
 These are one-time tasks that are scheduled at a particular date, and that don't require regular
 schedules.
+** TODO [#A] Clean House
+I need to clean my house very soon.
 ** Friends
 These are tasks related to seeing my friends. There will be tasks listed here when I schedule
 something.
 * Habits
 These are some habits I want to track. They are repeated according to a calendar schedule in
 general.
+** TODO Run
+SCHEDULED: <2025-02-11 Tue .+1d>
+I want to be able to run or bike every day so that I get my exercise in.
 ** TODO Stretch
 SCHEDULED: <2025-02-12 Wed .+1d>
 :PROPERTIES:
diff --git a/config/emacs.el b/config/emacs.el
index 787b8d9..f71897f 100644
--- a/config/emacs.el
+++ b/config/emacs.el
@@ -106,7 +106,7 @@
   (org-latex-preview-image-directory (expand-file-name "~/.cache/ltximg/") "don't use weird cache location")
   (org-preview-latex-image-directory (expand-file-name "~/.cache/ltximg/") "don't use weird cache location")
   (TeX-PDF-mode t)
-  (org-latex-compiler "xelatex")
+  (org-latex-compiler "xelatex" "Use latex as default")
   (org-latex-pdf-process '("xelatex -interaction=nonstopmode -output-directory=%o %f") "set xelatex as default")
   (TeX-engine 'xetex "set xelatex as default engine")
   (preview-default-option-list '("displaymath" "textmath" "graphics") "preview latex")
diff --git a/config/nix.org b/config/nix.org
index 718fd8b..d19cebe 100644
--- a/config/nix.org
+++ b/config/nix.org
@@ -354,18 +354,18 @@ underlying interface and it breaks significantly less often.
 ** SSH
 My SSH daemon configuration.
 #+begin_src nix :tangle ../nix/modules/ssh.nix
-{ config, ... }:
-{
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = true;
-      AllowUsers = [ config.monorepo.vars.userName ];
-      PermitRootLogin = "prohibit-password";
-      KbdInteractiveAuthentication = false;
+  { config, lib, ... }:
+  {
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = lib.mkDefault (! config.monorepo.profiles.server.enable);
+        AllowUsers = [ config.monorepo.vars.userName "root" "git" ];
+        PermitRootLogin = "yes";
+        KbdInteractiveAuthentication = false;
+      };
     };
-  };
-}
+  }
 #+end_src
 ** Tor
 This is my tor configuration, used for my cryptocurrency wallets and whatever else I want
@@ -462,7 +462,6 @@ Use postfix as an smtps server.
     services.gitDaemon = {
       enable = lib.mkDefault config.monorepo.profiles.server.enable;
       exportAll = true;
-      listenAddress = "0.0.0.0";
       basePath = "/srv/git";
     };
   }
@@ -473,7 +472,7 @@ Use postfix as an smtps server.
   {
     services.nginx = {
       enable = lib.mkDefault config.monorepo.profiles.server.enable;
-
+      user = "nginx";
       # Use recommended settings
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -481,42 +480,88 @@ Use postfix as an smtps server.
       recommendedTlsSettings = true;
 
       # Only allow PFS-enabled ciphers with AES256
-      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+      # sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
 
-      appendHttpConfig = ''
-    # Add HSTS header with preloading to HTTPS requests.
-    # Adding this header to HTTP requests is discouraged
-    map $scheme $hsts_header {
-  	https   "max-age=31536000; includeSubdomains; preload";
-    }
-    add_header Strict-Transport-Security $hsts_header;
-
-    # Enable CSP for your services.
-    #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
-
-    # Minimize information leaked to other domains
-    add_header 'Referrer-Policy' 'origin-when-cross-origin';
-
-    # Disable embedding as a frame
-    add_header X-Frame-Options DENY;
+      appendHttpConfig = '''';
 
-    # Prevent injection of code in other mime types (XSS Attacks)
-    add_header X-Content-Type-Options nosniff;
-
-    # This might create errors
-    proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
-  '';
+      gitweb = {
+        enable = true;
+        virtualHost = "ret2pop.net";
+      };
 
       virtualHosts = {
-  	    "ret2pop.nullring.xyz" = {
-  	      # addSSL = true;
-  	      # enableACME = true;
-  	      root = "/home/preston/ret2pop-website/";
+        "matrix.ret2pop.net" = {
+          enableACME = true;
+          forceSSL = true;
+          listen = [
+            {
+              addr = "0.0.0.0";
+              port = 443;
+              ssl = true;
+            }
+            {
+              addr = "[::]";
+              port = 443;
+              ssl = true;
+            }          {
+              addr = "0.0.0.0";
+              port = 8448;
+              ssl = true;
+            }
+            {
+              addr = "[::]";
+              port = 8448;
+              ssl = true;
+            }
+          ];
+          locations."/_matrix/" = {
+            proxyPass = "http://127.0.0.1:6167";
+            extraConfig = ''
+              proxy_set_header Host $host;
+              proxy_buffers 32 16k;
+              proxy_read_timeout 5m;
+            '';
+          };
+
+          extraConfig = ''
+            merge_slashes off;
+          '';
+        };
+  	    "ret2pop.net" = {
+          serverName = "ret2pop.net";
+  	      root = "/var/www/ret2pop-website/";
+  	      addSSL = true;
+  	      enableACME = true;
   	    };
       };
     };
   }
 #+end_src
+** Git Web Interface
+#+begin_src nix :tangle ../nix/modules/gitweb.nix
+  { lib, config, ... }:
+  {
+    services.gitweb = {
+      gitwebTheme = true;
+      projectroot = "/srv/git/";
+    };
+  }
+#+end_src
+** Conduit
+#+begin_src nix :tangle ../nix/modules/conduit.nix
+  { config, lib, ... }:
+  {
+    services.matrix-conduit = {
+      enable = lib.mkDefault config.monorepo.profiles.server.enable;
+      # random comment
+      settings.global = {
+        server_name = "matrix.ret2pop.net";
+        address = "0.0.0.0";
+        port = 6167;
+      };
+    };
+  }
+#+end_src
 ** Nvidia
 #+begin_src nix :tangle ../nix/modules/nvidia.nix
   { config, lib, pkgs, ... }:
@@ -574,6 +619,8 @@ because they enhance security.
       ./dovecot.nix
       ./ollama.nix
       ./i2pd.nix
+      ./gitweb.nix
+      ./conduit.nix
     ];
 
     documentation = {
@@ -801,6 +848,10 @@ because they enhance security.
     };
 
     security = {
+      acme = {
+        acceptTerms = true;
+        defaults.email = "ret2pop@gmail.com";
+      };
       apparmor = {
     	  enable = true;
     	  killUnconfinedConfinables = true;
@@ -840,16 +891,39 @@ because they enhance security.
       config.common.default = "*";
     };
 
+    environment.etc."gitconfig".text = ''
+    [init]
+    defaultBranch = main
+    '';
+    environment.extraInit = ''
+    umask 0022
+    '';
     environment.systemPackages = with pkgs; [
       restic
       sbctl
       git
       vim
       curl
+      nmap
+      (writeShellScriptBin "new-repo"
+        ''
+    #!/bin/bash
+    cd /srv/git
+    git init --bare "$1"
+    vim "$1/description"
+    chown -R git:git "$1"
+    ''
+      )
     ];
 
-    users.groups.git = {};
+    users.groups.nginx = lib.mkDefault {};
+    users.groups.git = lib.mkDefault {};
     users.users = {
+      nginx.group = "nginx";
+      nginx.isSystemUser = lib.mkDefault true;
+      nginx.extraGroups = [
+        "acme"
+      ];
       root.openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
       ];
@@ -859,8 +933,14 @@ because they enhance security.
     	  home = "/srv/git";
     	  shell = "${pkgs.git}/bin/git-shell";
         group = "git";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
+        ];
       };
       "${config.monorepo.vars.userName}" = {
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
+        ];
     	  initialPassword = "${config.monorepo.vars.userName}";
     	  isNormalUser = true;
     	  description = config.monorepo.vars.fullName;
@@ -874,7 +954,12 @@ because they enhance security.
       "olm-3.2.16"
     ];
 
-    nix.settings.experimental-features = "nix-command flakes";
+    nix = {
+      settings = {
+        experimental-features = "nix-command flakes";
+        trusted-users = [ "@wheel" ];
+      };
+    };
     time.timeZone = config.monorepo.vars.timeZone;
     i18n.defaultLocale = "en_CA.UTF-8";
     system.stateVersion = "24.11";
@@ -2486,7 +2571,7 @@ standard.
     programs.zsh = {
       enable = true;
       initExtra = ''
-      umask 0077
+      umask 0022
       export EXTRA_CCFLAGS="-I/usr/include"
       source ${pkgs.zsh-vi-mode}/share/zsh-vi-mode/zsh-vi-mode.plugin.zsh
       export QT_QPA_PLATFORM="wayland"
@@ -2618,7 +2703,8 @@ for these configurations.
         (writeShellScriptBin "remote-build"
           ''
   #!/bin/bash
-  nixos-rebuild --target-host "$1" switch --flake .#spontaneity
+  cd ~/monorepo/nix
+  nixos-rebuild --use-remote-sudo --target-host "$1" switch --flake .#spontaneity
   ''
         )
         (writeShellScriptBin "install-vps"
@@ -2755,6 +2841,10 @@ Spontaneity is my VPS instance.
         grub.enable = true;
       };
     };
+    config.networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
   }
 #+end_src
 *** Home
@@ -2806,7 +2896,7 @@ This contains the installation script I use to install my systems.
       enable = true;
       ports = [ 22 ];
       settings = {
-        PasswordAuthentication = true;
+        PasswordAuthentication = false;
         AllowUsers = null;
         UseDns = true;
         PermitRootLogin = lib.mkForce "prohibit-password";
diff --git a/journal/20250211.org b/journal/20250211.org
index 37a9a41..481fc5d 100644
--- a/journal/20250211.org
+++ b/journal/20250211.org
@@ -12,3 +12,9 @@ Today I wrote most of my resume, which is published to html and LaTeX
 outputs automatically. This was a kind of miserable task but I did it
 anyways. I'm going to maybe try to write some form of javascript CDN
 for my NullRing webring so that I'm not manually updating everything.
+** 05:40 
+My agenda is also working pretty well. I think I often look to my
+org-agenda as my source of truth now, and that's really been helping
+with keeping track of things.
+** 18:17 
+Today I'm showing my brother the monorepo and its abilites.
diff --git a/nix/modules/cgit.nix b/nix/modules/cgit.nix
new file mode 100644
index 0000000..cfb9158
--- /dev/null
+++ b/nix/modules/cgit.nix
@@ -0,0 +1,6 @@
+{ config, lib, ... }:
+{
+  services.cgit = {
+    enable = true;
+  };
+}
diff --git a/nix/modules/conduit.nix b/nix/modules/conduit.nix
new file mode 100644
index 0000000..954e5fc
--- /dev/null
+++ b/nix/modules/conduit.nix
@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.matrix-conduit = {
+    enable = lib.mkDefault config.monorepo.profiles.server.enable;
+    # random comment
+    settings.global = {
+      server_name = "matrix.ret2pop.net";
+      address = "0.0.0.0";
+      port = 6167;
+    };
+  };
+}
diff --git a/nix/modules/configuration.nix b/nix/modules/configuration.nix
index 6f8f314..bd37c77 100644
--- a/nix/modules/configuration.nix
+++ b/nix/modules/configuration.nix
@@ -14,6 +14,8 @@
     ./dovecot.nix
     ./ollama.nix
     ./i2pd.nix
+    ./gitweb.nix
+    ./conduit.nix
   ];
 
   documentation = {
@@ -241,6 +243,10 @@
   };
 
   security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "ret2pop@gmail.com";
+    };
     apparmor = {
   	  enable = true;
   	  killUnconfinedConfinables = true;
@@ -280,16 +286,39 @@
     config.common.default = "*";
   };
 
+  environment.etc."gitconfig".text = ''
+  [init]
+  defaultBranch = main
+  '';
+  environment.extraInit = ''
+  umask 0022
+  '';
   environment.systemPackages = with pkgs; [
     restic
     sbctl
     git
     vim
     curl
+    nmap
+    (writeShellScriptBin "new-repo"
+      ''
+  #!/bin/bash
+  cd /srv/git
+  git init --bare "$1"
+  vim "$1/description"
+  chown -R git:git "$1"
+  ''
+    )
   ];
 
-  users.groups.git = {};
+  users.groups.nginx = lib.mkDefault {};
+  users.groups.git = lib.mkDefault {};
   users.users = {
+    nginx.group = "nginx";
+    nginx.isSystemUser = lib.mkDefault true;
+    nginx.extraGroups = [
+      "acme"
+    ];
     root.openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
     ];
@@ -299,8 +328,14 @@
   	  home = "/srv/git";
   	  shell = "${pkgs.git}/bin/git-shell";
       group = "git";
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
+      ];
     };
     "${config.monorepo.vars.userName}" = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell"
+      ];
   	  initialPassword = "${config.monorepo.vars.userName}";
   	  isNormalUser = true;
   	  description = config.monorepo.vars.fullName;
@@ -314,7 +349,12 @@
     "olm-3.2.16"
   ];
 
-  nix.settings.experimental-features = "nix-command flakes";
+  nix = {
+    settings = {
+      experimental-features = "nix-command flakes";
+      trusted-users = [ "@wheel" ];
+    };
+  };
   time.timeZone = config.monorepo.vars.timeZone;
   i18n.defaultLocale = "en_CA.UTF-8";
   system.stateVersion = "24.11";
diff --git a/nix/modules/git-daemon.nix b/nix/modules/git-daemon.nix
index e71356e..e5e2192 100644
--- a/nix/modules/git-daemon.nix
+++ b/nix/modules/git-daemon.nix
@@ -3,7 +3,6 @@
   services.gitDaemon = {
     enable = lib.mkDefault config.monorepo.profiles.server.enable;
     exportAll = true;
-    listenAddress = "0.0.0.0";
     basePath = "/srv/git";
   };
 }
diff --git a/nix/modules/gitweb.nix b/nix/modules/gitweb.nix
new file mode 100644
index 0000000..51cff87
--- /dev/null
+++ b/nix/modules/gitweb.nix
@@ -0,0 +1,7 @@
+{ lib, config, ... }:
+{
+  services.gitweb = {
+    gitwebTheme = true;
+    projectroot = "/srv/git/";
+  };
+}
diff --git a/nix/modules/home/user.nix b/nix/modules/home/user.nix
index 85b6a70..7872d53 100644
--- a/nix/modules/home/user.nix
+++ b/nix/modules/home/user.nix
@@ -65,7 +65,8 @@
       (writeShellScriptBin "remote-build"
         ''
 #!/bin/bash
-nixos-rebuild --target-host "$1" switch --flake .#spontaneity
+cd ~/monorepo/nix
+nixos-rebuild --use-remote-sudo --target-host "$1" switch --flake .#spontaneity
 ''
       )
       (writeShellScriptBin "install-vps"
diff --git a/nix/modules/home/zsh.nix b/nix/modules/home/zsh.nix
index fc041e9..0c5bced 100644
--- a/nix/modules/home/zsh.nix
+++ b/nix/modules/home/zsh.nix
@@ -3,7 +3,7 @@
   programs.zsh = {
     enable = true;
     initExtra = ''
-    umask 0077
+    umask 0022
     export EXTRA_CCFLAGS="-I/usr/include"
     source ${pkgs.zsh-vi-mode}/share/zsh-vi-mode/zsh-vi-mode.plugin.zsh
     export QT_QPA_PLATFORM="wayland"
diff --git a/nix/modules/nginx.nix b/nix/modules/nginx.nix
index 18becfe..af2d42f 100644
--- a/nix/modules/nginx.nix
+++ b/nix/modules/nginx.nix
@@ -2,7 +2,7 @@
 {
   services.nginx = {
     enable = lib.mkDefault config.monorepo.profiles.server.enable;
-
+    user = "nginx";
     # Use recommended settings
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
@@ -10,37 +10,58 @@
     recommendedTlsSettings = true;
 
     # Only allow PFS-enabled ciphers with AES256
-    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-
-    appendHttpConfig = ''
-  # Add HSTS header with preloading to HTTPS requests.
-  # Adding this header to HTTP requests is discouraged
-  map $scheme $hsts_header {
-	https   "max-age=31536000; includeSubdomains; preload";
-  }
-  add_header Strict-Transport-Security $hsts_header;
-
-  # Enable CSP for your services.
-  #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
-
-  # Minimize information leaked to other domains
-  add_header 'Referrer-Policy' 'origin-when-cross-origin';
+    # sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
 
-  # Disable embedding as a frame
-  add_header X-Frame-Options DENY;
+    appendHttpConfig = '''';
 
-  # Prevent injection of code in other mime types (XSS Attacks)
-  add_header X-Content-Type-Options nosniff;
-
-  # This might create errors
-  proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
-'';
+    gitweb = {
+      enable = true;
+      virtualHost = "ret2pop.net";
+    };
 
     virtualHosts = {
-	    "ret2pop.nullring.xyz" = {
-	      # addSSL = true;
-	      # enableACME = true;
-	      root = "/home/preston/ret2pop-website/";
+      "matrix.ret2pop.net" = {
+        enableACME = true;
+        forceSSL = true;
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 443;
+            ssl = true;
+          }
+          {
+            addr = "[::]";
+            port = 443;
+            ssl = true;
+          }          {
+            addr = "0.0.0.0";
+            port = 8448;
+            ssl = true;
+          }
+          {
+            addr = "[::]";
+            port = 8448;
+            ssl = true;
+          }
+        ];
+        locations."/_matrix/" = {
+          proxyPass = "http://127.0.0.1:6167";
+          extraConfig = ''
+            proxy_set_header Host $host;
+            proxy_buffers 32 16k;
+            proxy_read_timeout 5m;
+          '';
+        };
+
+        extraConfig = ''
+          merge_slashes off;
+        '';
+      };
+	    "ret2pop.net" = {
+        serverName = "ret2pop.net";
+	      root = "/var/www/ret2pop-website/";
+	      addSSL = true;
+	      enableACME = true;
 	    };
     };
   };
diff --git a/nix/modules/ssh.nix b/nix/modules/ssh.nix
index 5c705c9..076ee47 100644
--- a/nix/modules/ssh.nix
+++ b/nix/modules/ssh.nix
@@ -1,11 +1,11 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
   services.openssh = {
     enable = true;
     settings = {
-      PasswordAuthentication = true;
-      AllowUsers = [ config.monorepo.vars.userName ];
-      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = lib.mkDefault (! config.monorepo.profiles.server.enable);
+      AllowUsers = [ config.monorepo.vars.userName "root" "git" ];
+      PermitRootLogin = "yes";
       KbdInteractiveAuthentication = false;
     };
   };
diff --git a/nix/systems/installer/default.nix b/nix/systems/installer/default.nix
index d3d1693..90a58db 100644
--- a/nix/systems/installer/default.nix
+++ b/nix/systems/installer/default.nix
@@ -21,7 +21,7 @@ in
     enable = true;
     ports = [ 22 ];
     settings = {
-      PasswordAuthentication = true;
+      PasswordAuthentication = false;
       AllowUsers = null;
       UseDns = true;
       PermitRootLogin = lib.mkForce "prohibit-password";
diff --git a/nix/systems/spontaneity/default.nix b/nix/systems/spontaneity/default.nix
index df3dc6b..a40c53a 100644
--- a/nix/systems/spontaneity/default.nix
+++ b/nix/systems/spontaneity/default.nix
@@ -17,4 +17,8 @@
       grub.enable = true;
     };
   };
+  config.networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }
diff --git a/resume.pdf b/resume.pdf
index c8d7f42..5e674f8 100644
--- a/resume.pdf
+++ b/resume.pdf
diff --git a/resume.tex b/resume.tex
index 50eeed0..8ec1d1b 100644
--- a/resume.tex
+++ b/resume.tex
@@ -1,4 +1,4 @@
-% Created 2025-02-11 Tue 03:12
+% Created 2025-02-11 Tue 18:22
 % Intended LaTeX compiler: xelatex
 \documentclass[10pt,letterpaper]{article}
 \usepackage[rm]{roboto}
@@ -36,14 +36,18 @@
 \usepackage{microtype}
 \sloppy
 \date{}
-\title{Preston's Resume}
+\title{My Resume}
 \begin{document}
 
-\section*{Resume -- Preston Pan}
-\label{sec:org2a32c6c}
+\section*{Introduction}
+\label{sec:orgfe25a86}
+This is the HTML form of my resume. There is a \href{resume.pdf}{pdf form} of my resume as well, if that's what you want.
+I'm excited to hear from you!
+\section*{Preston Pan}
+\label{sec:org6d476f9}
 \begin{minipage}[t]{0.47\textwidth}
 \subsection*{CONTACT}
-\label{sec:org846763a}
+\label{sec:org2a864bf}
 \begin{itemize}
 \item 📧 \textbf{\textbf{Email:}} ret2pop@gmail.com
 \item 📍 \textbf{\textbf{Location:}} Vancouver, BC, Canada
@@ -51,7 +55,7 @@
 \item 🖥️ \textbf{\textbf{GitHub:}} \href{https://github.com/ret2pop}{https://github.com/ret2pop}
 \end{itemize}
 \subsection*{SKILLS}
-\label{sec:orgdecc8d6}
+\label{sec:org2892f13}
 \begin{itemize}
 \item \textbf{\textbf{Programming:}} Python, Solidity, Rust, C, x86-64 Assembly, Shell
 \item \textbf{\textbf{DevOps:}} Docker, Kubernetes, NixOS, declarative configurations
@@ -62,9 +66,9 @@
 
 \vfill
 \subsection*{EXPERIENCE}
-\label{sec:orge5307a0}
+\label{sec:org6ef9801}
 \subsubsection*{\textbf{Software Engineer} - LayerZero Labs}
-\label{sec:orged9d799}
+\label{sec:org8ea673e}
 \begin{itemize}
 \item Shipped production-ready smart contract code as part of a world-class blockchain engineering team.
 \item Discovered and fixed critical vulnerabilities in TON and Aptos blockchain code, preventing potential losses of millions.
@@ -77,37 +81,37 @@
 \hfill
 \begin{minipage}[t]{0.47\textwidth}
 \subsection*{PROJECTS}
-\label{sec:org9cd42b8}
+\label{sec:orge82cd19}
 \subsubsection*{Stem}
-\label{sec:orgef7a6a4}
+\label{sec:orgfb19df5}
 \begin{itemize}
 \item Designed a stack-based programming language, written entirely in C.
 \item Reached \#1 on HackerNews; led to an offer at LayerZero.
 \end{itemize}
 \subsubsection*{Cognition}
-\label{sec:orga262a78}
+\label{sec:org4df69fe}
 \begin{itemize}
 \item Engineered a stack-based programming language featuring advanced metaprogramming capabilities.
 \item Another blog post that reached \#1 on HackerNews
 \end{itemize}
 \subsubsection*{NoExcess}
-\label{sec:org6fefc71}
+\label{sec:org93f1121}
 \begin{itemize}
 \item Developed a Lisp-like programming language with scoping, written in C.
 \end{itemize}
 \subsubsection*{Server/Website}
-\label{sec:org73f6fd4}
+\label{sec:orga313b21}
 \begin{itemize}
 \item Maintains a website/server with a blog and mindmap — runs a webring (\href{https://nullring.xyz}{nullring.xyz}).
 \end{itemize}
 \subsubsection*{Snake3}
-\label{sec:orgb89d92d}
+\label{sec:org49e5353}
 \begin{itemize}
 \item Created a threaded, multiplayer snake game in C.
 \item Available at \href{https://git.aberrantflux.xyz/snake3.git}{https://git.aberrantflux.xyz/snake3.git}
 \end{itemize}
 \subsection*{INTERESTS}
-\label{sec:org844b368}
+\label{sec:org1f6da6e}
 \begin{itemize}
 \item Cryptography, decentralized governance, Economic systems
 \item low-level programming, compiler design
@@ -116,7 +120,7 @@
 
 \vfill
 \subsection*{Let's Connect}
-\label{sec:org863f885}
+\label{sec:orgc9f3fcc}
 I'm open to opportunities in low level programming, blockchain, and cryptography. Feel free to reach out via email or Linkedin!
 \end{minipage}
 \end{document}