chore: m3-are to new ui

+nier wallpaper
+dms
2026-06-06 07:54:30 +02:00 · 2026-06-02 19:26:39 +02:00 · 2026-06-02 18:20:43 +02:00 · 2026-05-31 14:10:15 +02:00 · 2026-05-31 13:14:24 +02:00 · 2026-05-30 10:01:47 +02:00
110 changed files with 9386 additions and 3987 deletions
@@ -0,0 +1,3 @@
 node_modules/
 runs/
 *.log
@@ -0,0 +1,5 @@
 {
  "projectRoot": "/home/m3tam3re/p/NIX/nixos-config",
  "isNewProject": false,
  "additionalContext": "Install and configure babysitter for this existing NixOS flake configuration repository. Respect AGENTS.md instructions, Beads workflow, Nix conventions, and avoid interactive/destructive operations unless explicitly approved."
 }
@@ -0,0 +1,9 @@
 {
  "name": "nixos-config-a5c",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "dependencies": {
    "@a5c-ai/babysitter-sdk": "latest"
  }
 }
@@ -0,0 +1,596 @@
 {
  "projectName": "nixos-config",
  "description": "A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.",
  "goals": [
    {
      "id": "goal-reliability-1",
      "description": "Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment.",
      "category": "reliability",
      "priority": "high",
      "status": "active"
    },
    {
      "id": "goal-architecture-1",
      "description": "Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules.",
      "category": "architecture",
      "priority": "high",
      "status": "active"
    },
    {
      "id": "goal-modularization-1",
      "description": "Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate.",
      "category": "modularization",
      "priority": "high",
      "status": "active"
    },
    {
      "id": "goal-cicd-1",
      "description": "CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks.",
      "category": "automation",
      "priority": "medium",
      "status": "deferred"
    }
  ],
  "techStack": {
    "languages": [
      {
        "name": "Nix",
        "role": "primary system, module, overlay, and package configuration language"
      },
      {
        "name": "Markdown",
        "role": "project, agent, and workflow documentation"
      },
      {
        "name": "JSON/YAML",
        "role": "tool configuration and metadata"
      }
    ],
    "frameworks": [
      {
        "name": "Nix flakes",
        "category": "reproducible dependency and output model"
      },
      {
        "name": "NixOS modules",
        "category": "host and service configuration"
      },
      {
        "name": "Home Manager",
        "category": "user environment management"
      },
      {
        "name": "Agenix",
        "category": "encrypted secret management"
      },
      {
        "name": "Disko",
        "category": "server disk provisioning"
      },
      {
        "name": "NUR",
        "category": "community package access"
      },
      {
        "name": "llm-agents.nix",
        "category": "LLM agent packages overlay"
      },
      {
        "name": "m3ta-home",
        "category": "external reusable Home Manager profiles"
      },
      {
        "name": "m3ta-nixpkgs",
        "category": "external custom packages/modules/overlays"
      }
    ],
    "databases": [],
    "infrastructure": [
      {
        "name": "m3-ares",
        "category": "desktop NixOS host"
      },
      {
        "name": "m3-kratos",
        "category": "desktop NixOS host"
      },
      {
        "name": "m3-daedalus",
        "category": "portable laptop/Home Manager configuration"
      },
      {
        "name": "m3-atlas",
        "category": "primary server NixOS host"
      },
      {
        "name": "m3-helios",
        "category": "minimal server/AdGuard host"
      },
      {
        "name": "m3-hermes",
        "category": "secondary server/Hermes host"
      },
      {
        "name": "m3-aether",
        "category": "cloud VM/minimal server host"
      }
    ],
    "buildTools": [
      "nix",
      "nixos-rebuild",
      "nix build",
      "nix flake show",
      "alejandra",
      "statix",
      "deadnix"
    ],
    "packageManagers": [
      "nix flakes"
    ]
  },
  "architecture": {
    "pattern": "Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.",
    "modules": [
      {
        "name": "flake.nix",
        "path": "flake.nix",
        "description": "Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells."
      },
      {
        "name": "hosts/common",
        "path": "hosts/common",
        "description": "Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users."
      },
      {
        "name": "hosts",
        "path": "hosts",
        "description": "Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM."
      },
      {
        "name": "modules/nixos",
        "path": "modules/nixos",
        "description": "Reusable NixOS modules."
      },
      {
        "name": "modules/home-manager",
        "path": "modules/home-manager",
        "description": "Reusable Home Manager module exports."
      },
      {
        "name": "overlays",
        "path": "overlays",
        "description": "Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages."
      },
      {
        "name": "pkgs",
        "path": "pkgs",
        "description": "Custom package export set."
      },
      {
        "name": "secrets",
        "path": "secrets",
        "description": "Encrypted agenix secret files and registry."
      }
    ],
    "entryPoints": [
      "flake.nix",
      "hosts/<host>/default.nix",
      "hosts/<host>/configuration.nix",
      "hosts/common/default.nix",
      "hosts/common/users/m3tam3re.nix",
      "overlays/default.nix",
      "pkgs/default.nix",
      "secrets.nix"
    ],
    "dataFlow": "flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules."
  },
  "team": [
    {
      "name": "m3tam3re",
      "role": "solo developer and operator",
      "responsibilities": [
        "architecture",
        "implementation",
        "host maintenance",
        "deployments",
        "review"
      ]
    },
    {
      "name": "m3ta-chiron",
      "role": "agent contributor",
      "responsibilities": [
        "semi-autonomous implementation",
        "validation",
        "documentation updates",
        "conventional commits"
      ]
    }
  ],
  "workflows": [
    {
      "name": "development",
      "description": "Default feature-branch workflow for solo development with conventional commits and validation before push.",
      "steps": [
        "review Beads issues with bd ready --json",
        "claim work with bd update <id> --claim when applicable",
        "edit Nix modules or project files",
        "run alejandra .",
        "run statix check .",
        "run targeted nix flake or host dry-run checks",
        "commit with conventional commit format",
        "pull --rebase and push"
      ],
      "triggers": [
        "new feature",
        "bug fix",
        "refactor",
        "agent task"
      ]
    },
    {
      "name": "nix validation",
      "description": "Quality gate for Nix configuration changes.",
      "steps": [
        "alejandra .",
        "statix check .",
        "deadnix check or deadnix -w when appropriate",
        "nix flake show",
        "sudo nixos-rebuild dry-run --flake .#<host> for affected hosts"
      ],
      "triggers": [
        "Nix code changes",
        "before deployment",
        "before commit"
      ]
    },
    {
      "name": "host deployment",
      "description": "Manual deployment after successful dry-run validation.",
      "steps": [
        "sudo nixos-rebuild dry-run --flake .#<host>",
        "sudo nixos-rebuild switch --flake .#<host>"
      ],
      "triggers": [
        "manual host update"
      ]
    },
    {
      "name": "dependency/input update",
      "description": "Controlled flake input updates without manually editing flake.lock.",
      "steps": [
        "use nix flake update or nixos-rebuild --update-input <input>",
        "validate affected outputs",
        "commit flake.nix/flake.lock changes"
      ],
      "triggers": [
        "planned dependency update",
        "security update"
      ]
    },
    {
      "name": "beads issue tracking",
      "description": "Persistent issue tracking and session handoff workflow.",
      "steps": [
        "bd ready --json",
        "bd show <id>",
        "bd update <id> --claim",
        "bd close <id> --reason <summary>",
        "bd dolt push"
      ],
      "triggers": [
        "start of tracked work",
        "completion of tracked work"
      ]
    }
  ],
  "processes": [
    {
      "id": "cradle/project-install",
      "name": "Babysitter project install",
      "status": "installing",
      "purpose": "Create and save a Babysitter project profile and setup recommendations."
    }
  ],
  "tools": {
    "formatting": [
      {
        "name": "alejandra",
        "purpose": "Nix formatting",
        "configPaths": [
          "flake.nix devShells.default"
        ]
      }
    ],
    "linting": [
      {
        "name": "statix",
        "purpose": "Nix anti-pattern linting",
        "configPaths": [
          "flake.nix devShells.default"
        ]
      },
      {
        "name": "deadnix",
        "purpose": "Detect unused Nix code",
        "configPaths": [
          "flake.nix devShells.default"
        ]
      }
    ],
    "testing": [
      {
        "name": "nix flake show",
        "purpose": "Evaluate flake outputs",
        "configPaths": [
          "flake.nix"
        ]
      },
      {
        "name": "nixos-rebuild dry-run",
        "purpose": "Validate host configurations without applying changes",
        "configPaths": [
          "flake.nix",
          "hosts/*"
        ]
      },
      {
        "name": "nix build",
        "purpose": "Build selected outputs such as host toplevels or ISOs",
        "configPaths": [
          "flake.nix"
        ]
      }
    ],
    "issueTracking": [
      {
        "name": "Beads",
        "command": "bd",
        "purpose": "Persistent task tracking"
      }
    ]
  },
  "services": [
    {
      "name": "code.m3ta.dev",
      "type": "git hosting",
      "url": "git+ssh://gitea@code.m3ta.dev"
    },
    {
      "name": "GitHub",
      "type": "flake input hosting",
      "url": "github:* flake inputs"
    },
    {
      "name": "Agenix",
      "type": "secret encryption",
      "url": "github:ryantm/agenix"
    },
    {
      "name": "Hermes Agent",
      "type": "NixOS module/agent service",
      "url": "github:NousResearch/hermes-agent"
    },
    {
      "name": "RustFS",
      "type": "NixOS server service flake",
      "url": "github:rustfs/rustfs-flake"
    }
  ],
  "externalIntegrations": [
    {
      "service": "Beads",
      "category": "issue tracking",
      "enabled": true
    },
    {
      "service": "Dolt",
      "category": "Beads storage/sync",
      "enabled": true
    },
    {
      "service": "Agenix",
      "category": "secrets",
      "enabled": true
    },
    {
      "service": "Home Manager",
      "category": "user environment",
      "enabled": true
    },
    {
      "service": "m3ta-home",
      "category": "external home profiles",
      "enabled": true
    },
    {
      "service": "m3ta-nixpkgs",
      "category": "external Nix modules/packages",
      "enabled": true
    },
    {
      "service": "NUR",
      "category": "Nix packages",
      "enabled": true
    },
    {
      "service": "Disko",
      "category": "disk provisioning",
      "enabled": true
    },
    {
      "service": "Hermes Agent",
      "category": "LLM/agent service",
      "enabled": true
    }
  ],
  "cicd": {
    "provider": null,
    "enabled": false,
    "configPaths": [],
    "pipelines": [],
    "notes": "CI/CD is intentionally disabled for now. If re-enabled later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.",
    "babysitterIntegration": {
      "enabled": false,
      "triggerOn": [],
      "processIds": []
    }
  },
  "painPoints": [
    {
      "id": "pp-architecture-1",
      "description": "The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.",
      "severity": "high",
      "category": "architecture",
      "discoveredVia": "user interview",
      "suggestedRemediation": "Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs."
    },
    {
      "id": "pp-validation-1",
      "description": "A single shared Nix change can require validating several hosts to be confident.",
      "severity": "medium",
      "category": "validation",
      "discoveredVia": "repo structure and AGENTS workflow",
      "suggestedRemediation": "Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled."
    },
    {
      "id": "pp-dependency-1",
      "description": "Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.",
      "severity": "medium",
      "category": "dependency management",
      "discoveredVia": "flake and history analysis",
      "suggestedRemediation": "Update inputs intentionally, group related updates, and validate affected host outputs."
    },
    {
      "id": "pp-operations-1",
      "description": "Service additions often need synchronized module, secret, and network/TLS changes.",
      "severity": "medium",
      "category": "operations",
      "discoveredVia": "git history and tree structure",
      "suggestedRemediation": "Use checklist-style issue templates or Babysitter processes for service changes."
    }
  ],
  "bottlenecks": [
    {
      "id": "bn-flake-1",
      "description": "flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once.",
      "impact": "High; evaluation failures can block all hosts.",
      "location": "flake.nix, flake.lock",
      "frequency": "very frequent"
    },
    {
      "id": "bn-secrets-1",
      "description": "Secret registry and host secret modules must stay aligned with encrypted .age files.",
      "impact": "Medium to high; missing or mismatched secrets break host deployment.",
      "location": "secrets.nix, hosts/*/secrets.nix, secrets/*.age",
      "frequency": "recurring"
    },
    {
      "id": "bn-services-1",
      "description": "Server service changes can span service modules, secrets, Traefik/networking, and flake inputs.",
      "impact": "High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.",
      "location": "hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common",
      "frequency": "frequent"
    },
    {
      "id": "bn-home-1",
      "description": "Home Manager behavior depends on both the external m3ta-home input and local host flags.",
      "impact": "Medium; may require coordinated updates across repositories.",
      "location": "flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input",
      "frequency": "frequent after migration"
    }
  ],
  "conventions": {
    "naming": {
      "files": "hyphen-case for Nix/docs where practical; host directories use m3-* names",
      "hosts": "m3-<greek-name>",
      "modules": "one module per file/directory where possible",
      "nixVariables": "camelCase"
    },
    "git": {
      "branchStrategy": "default feature branches for non-trivial work; master as integration branch",
      "commits": "conventional commits for agent work",
      "reviews": "optional for solo development",
      "releaseCadence": "continuous/manual as needed",
      "remote": "code.m3ta.dev over SSH for private inputs and repo access"
    },
    "codeStyle": {
      "formatter": "alejandra",
      "indentation": "2 spaces",
      "nixStyle": "explicit pkgs references preferred; avoid with pkgs, builtins.fetchTarball, import <nixpkgs>, builtins.getAttr/hasAttr"
    },
    "importOrder": [
      "module function arguments",
      "imports",
      "let bindings",
      "options/config"
    ],
    "errorHandling": "Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.",
    "testingConventions": "Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.",
    "additionalRules": [
      "Use Beads for persistent task tracking.",
      "Use non-interactive flags for shell file operations.",
      "Do not modify flake.lock directly; use nix flake update.",
      "Do not commit plaintext secrets.",
      "Use SSH URLs for code.m3ta.dev flake inputs.",
      "Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions."
    ]
  },
  "repositories": [
    {
      "name": "nixos-config",
      "path": "/home/m3tam3re/p/NIX/nixos-config",
      "role": "primary multi-host NixOS configuration"
    },
    {
      "name": "m3ta-home",
      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home",
      "role": "external Home Manager profiles"
    },
    {
      "name": "m3ta-nixpkgs",
      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs",
      "role": "external custom packages/modules/overlays"
    }
  ],
  "claudeMdInstructions": [
    "Respect AGENTS.md as the source of project workflow rules.",
    "Resolve the active Babysitter process library before using library processes.",
    "Use cradle/project-install for project setup or profile refresh.",
    "Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.",
    "Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.",
    "Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.",
    "Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.",
    "Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions."
  ],
  "installedSkills": [
    "project-install",
    "babysit",
    "specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md",
    "specializations/devops-sre-platform/skills/gitops/SKILL.md",
    "specializations/devops-sre-platform/skills/secrets-management/SKILL.md"
  ],
  "installedAgents": [
    "general-purpose",
    "specializations/devops-sre-platform/agents/platform-engineer/AGENT.md",
    "specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md"
  ],
  "installedProcesses": [
    "cradle/project-install",
    "methodologies/gsd/quick.js",
    "methodologies/gsd/verify-work.js",
    "methodologies/gsd/iterative-convergence.js",
    "methodologies/evolutionary.js",
    "specializations/devops-sre-platform/iac-testing.js"
  ],
  "preferences": {
    "babysitterAutonomy": "semi-autonomous",
    "breakpointTolerance": "moderate",
    "externalIntegrationsRequested": false,
    "cicdDesired": false,
    "cicdNote": "Deferred for now; Gitea Actions is the preferred provider if CI/CD is added later."
  },
  "createdAt": "2026-05-29T15:50:48.754Z",
  "updatedAt": "2026-05-29T16:07:19.245463Z",
  "version": 1
 }
@@ -0,0 +1,238 @@
 # Project Profile: nixos-config
 A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.
 > Last updated: 2026-05-29T16:02:11.092188Z | Version: 1
 ## Goals
 - **reliability** [high]: Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment. (active)
 - **architecture** [high]: Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules. (active)
 - **modularization** [high]: Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate. (active)
 - **automation** [medium]: CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks. (deferred)
 ## Tech Stack
 ### Languages
 - Nix (primary system, module, overlay, and package configuration language)
 - Markdown (project, agent, and workflow documentation)
 - JSON/YAML (tool configuration and metadata)
 ### Frameworks
 - Nix flakes [reproducible dependency and output model]
 - NixOS modules [host and service configuration]
 - Home Manager [user environment management]
 - Agenix [encrypted secret management]
 - Disko [server disk provisioning]
 - NUR [community package access]
 - llm-agents.nix [LLM agent packages overlay]
 - m3ta-home [external reusable Home Manager profiles]
 - m3ta-nixpkgs [external custom packages/modules/overlays]
 ### Infrastructure
 - m3-ares [desktop NixOS host]
 - m3-kratos [desktop NixOS host]
 - m3-daedalus [portable laptop/Home Manager configuration]
 - m3-atlas [primary server NixOS host]
 - m3-helios [minimal server/AdGuard host]
 - m3-hermes [secondary server/Hermes host]
 - m3-aether [cloud VM/minimal server host]
 **Build tools:** nix, nixos-rebuild, nix build, nix flake show, alejandra, statix, deadnix
 **Package managers:** nix flakes
 ## Architecture
 **Pattern:** Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.
 **Data flow:** flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules.
 ### Modules
 | Module | Path | Description |
 |--------|------|-------------|
 | flake.nix | `flake.nix` | Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells. |
 | hosts/common | `hosts/common` | Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users. |
 | hosts | `hosts` | Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM. |
 | modules/nixos | `modules/nixos` | Reusable NixOS modules. |
 | modules/home-manager | `modules/home-manager` | Reusable Home Manager module exports. |
 | overlays | `overlays` | Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages. |
 | pkgs | `pkgs` | Custom package export set. |
 | secrets | `secrets` | Encrypted agenix secret files and registry. |
 **Entry points:** `flake.nix`, `hosts/<host>/default.nix`, `hosts/<host>/configuration.nix`, `hosts/common/default.nix`, `hosts/common/users/m3tam3re.nix`, `overlays/default.nix`, `pkgs/default.nix`, `secrets.nix`
 ## Team
 - **m3tam3re** (solo developer and operator): architecture, implementation, host maintenance, deployments, review
 - **m3ta-chiron** (agent contributor): semi-autonomous implementation, validation, documentation updates, conventional commits
 ## Workflows
 ### development
 Default feature-branch workflow for solo development with conventional commits and validation before push.
 **Triggers:** new feature, bug fix, refactor, agent task
 1. review Beads issues with bd ready --json
 2. claim work with bd update <id> --claim when applicable
 3. edit Nix modules or project files
 4. run alejandra .
 5. run statix check .
 6. run targeted nix flake or host dry-run checks
 7. commit with conventional commit format
 8. pull --rebase and push
 ### nix validation
 Quality gate for Nix configuration changes.
 **Triggers:** Nix code changes, before deployment, before commit
 1. alejandra .
 2. statix check .
 3. deadnix check or deadnix -w when appropriate
 4. nix flake show
 5. sudo nixos-rebuild dry-run --flake .#<host> for affected hosts
 ### host deployment
 Manual deployment after successful dry-run validation.
 **Triggers:** manual host update
 1. sudo nixos-rebuild dry-run --flake .#<host>
 2. sudo nixos-rebuild switch --flake .#<host>
 ### dependency/input update
 Controlled flake input updates without manually editing flake.lock.
 **Triggers:** planned dependency update, security update
 1. use nix flake update or nixos-rebuild --update-input <input>
 2. validate affected outputs
 3. commit flake.nix/flake.lock changes
 ### beads issue tracking
 Persistent issue tracking and session handoff workflow.
 **Triggers:** start of tracked work, completion of tracked work
 1. bd ready --json
 2. bd show <id>
 3. bd update <id> --claim
 4. bd close <id> --reason <summary>
 5. bd dolt push
 ## Processes
 - **Babysitter project install** (`cradle/project-install`, undefined)
 ## Tools
 ### Linting
 - statix
 - deadnix
 ### Testing
 - nix flake show
 - nixos-rebuild dry-run
 - nix build
 ### Formatting
 - alejandra
 ## Services
 - **code.m3ta.dev** (git hosting) - git+ssh://gitea@code.m3ta.dev
 - **GitHub** (flake input hosting) - github:* flake inputs
 - **Agenix** (secret encryption) - github:ryantm/agenix
 - **Hermes Agent** (NixOS module/agent service) - github:NousResearch/hermes-agent
 - **RustFS** (NixOS server service flake) - github:rustfs/rustfs-flake
 ## CI/CD
 **Status:** Not configured/enabled for now.
 No Babysitter CI/CD workflow is currently installed. If CI/CD is added later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.
 ## Pain Points
 - **high** [architecture]: The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.
  - Remediation: Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs.
 - **medium** [validation]: A single shared Nix change can require validating several hosts to be confident.
  - Remediation: Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled.
 - **medium** [dependency management]: Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.
  - Remediation: Update inputs intentionally, group related updates, and validate affected host outputs.
 - **medium** [operations]: Service additions often need synchronized module, secret, and network/TLS changes.
  - Remediation: Use checklist-style issue templates or Babysitter processes for service changes.
 ## Bottlenecks
 - flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once. at flake.nix, flake.lock (very frequent)
  Impact: High; evaluation failures can block all hosts.
 - Secret registry and host secret modules must stay aligned with encrypted .age files. at secrets.nix, hosts/*/secrets.nix, secrets/*.age (recurring)
  Impact: Medium to high; missing or mismatched secrets break host deployment.
 - Server service changes can span service modules, secrets, Traefik/networking, and flake inputs. at hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common (frequent)
  Impact: High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.
 - Home Manager behavior depends on both the external m3ta-home input and local host flags. at flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input (frequent after migration)
  Impact: Medium; may require coordinated updates across repositories.
 ## Conventions
 ### Naming
 - **files:** hyphen-case for Nix/docs where practical; host directories use m3-* names
 - **hosts:** m3-<greek-name>
 - **modules:** one module per file/directory where possible
 - **nixVariables:** camelCase
 ### Git
 - **branchStrategy:** default feature branches for non-trivial work; master as integration branch
 - **commits:** conventional commits for agent work
 - **reviews:** optional for solo development
 - **releaseCadence:** continuous/manual as needed
 - **remote:** code.m3ta.dev over SSH for private inputs and repo access
 **Import order:** module function arguments > imports > let bindings > options/config
 **Error handling:** Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.
 **Testing:** Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.
 ### Additional Rules
 - Use Beads for persistent task tracking.
 - Use non-interactive flags for shell file operations.
 - Do not modify flake.lock directly; use nix flake update.
 - Do not commit plaintext secrets.
 - Use SSH URLs for code.m3ta.dev flake inputs.
 - Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions.
 ## Repositories
 - **nixos-config** [`/home/m3tam3re/p/NIX/nixos-config`]
 - **m3ta-home** - git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home
 - **m3ta-nixpkgs** - git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs
 ## CLAUDE.md Instructions
 - Respect AGENTS.md as the source of project workflow rules.
 - Resolve the active Babysitter process library before using library processes.
 - Use cradle/project-install for project setup or profile refresh.
 - Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.
 - Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.
 - Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.
 - Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.
 - Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions.
 ## Installed Extensions
 - Skills: project-install, babysit, specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md, specializations/devops-sre-platform/skills/gitops/SKILL.md, specializations/devops-sre-platform/skills/secrets-management/SKILL.md
 - Agents: general-purpose, specializations/devops-sre-platform/agents/platform-engineer/AGENT.md, specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md
 - Processes: cradle/project-install, methodologies/gsd/quick.js, methodologies/gsd/verify-work.js, methodologies/gsd/iterative-convergence.js, methodologies/evolutionary.js, specializations/devops-sre-platform/iac-testing.js
@@ -0,0 +1,53 @@
 {
  "qualityThreshold": 80,
  "testCoverage": {
    "minimum": 0,
    "rationale": "NixOS configuration repository without a coverage-producing test suite."
  },
  "formatting": [
    {
      "name": "alejandra",
      "command": "alejandra .",
      "ciCommand": "alejandra --check ."
    }
  ],
  "linting": [
    {
      "name": "statix",
      "command": "statix check ."
    },
    {
      "name": "deadnix",
      "command": "deadnix . --fail"
    }
  ],
  "evaluation": [
    {
      "name": "flake outputs",
      "command": "nix flake show"
    },
    {
      "name": "affected host dry-run",
      "command": "sudo nixos-rebuild dry-run --flake .#<host>",
      "when": "Run for affected hosts when practical and safe."
    }
  ],
  "commitChecks": [
    "alejandra .",
    "statix check .",
    "deadnix . --fail",
    "nix flake show"
  ],
  "deployGates": [
    "formatting passes",
    "linting passes",
    "flake outputs evaluate",
    "affected host dry-run succeeds",
    "secrets are encrypted and host secret modules remain aligned"
  ],
  "cicdIntegrationPoints": [],
  "cicd": {
    "enabled": false,
    "notes": "No CI/CD integration is currently configured. Add Gitea Actions later if automated Babysitter or Nix validation is desired."
  }
 }
@@ -0,0 +1,73 @@
 # Dolt database (managed by Dolt, not git)
 dolt/
 embeddeddolt/
 # Runtime files
 bd.sock
 bd.sock.startlock
 sync-state.json
 last-touched
 .exclusive-lock
 # Daemon runtime (lock, log, pid)
 daemon.*
 # Interactions log (runtime, not versioned)
 interactions.jsonl
 # Push state (runtime, per-machine)
 push-state.json
 # Lock files (various runtime locks)
 *.lock
 # Credential key (encryption key for federation peer auth — never commit)
 .beads-credential-key
 # Local version tracking (prevents upgrade notification spam after git ops)
 .local_version
 # Worktree redirect file (contains relative path to main repo's .beads/)
 # Must not be committed as paths would be wrong in other clones
 redirect
 # Sync state (local-only, per-machine)
 # These files are machine-specific and should not be shared across clones
 .sync.lock
 export-state/
 export-state.json
 # Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
 ephemeral.sqlite3
 ephemeral.sqlite3-journal
 ephemeral.sqlite3-wal
 ephemeral.sqlite3-shm
 # Dolt server management (auto-started by bd)
 dolt-server.pid
 dolt-server.log
 dolt-server.lock
 dolt-server.port
 dolt-server.activity
 # Corrupt backup directories (created by bd doctor --fix recovery)
 *.corrupt.backup/
 # Backup data (auto-exported JSONL, local-only)
 backup/
 # Per-project environment file (Dolt connection config, GH#2520)
 .env
 # Legacy files (from pre-Dolt versions)
 *.db
 *.db?*
 *.db-journal
 *.db-wal
 *.db-shm
 db.sqlite
 bd.db
 # NOTE: Do NOT add negation patterns here.
 # They would override fork protection in .git/info/exclude.
 # Config files (metadata.json, config.yaml) are tracked by git by default
 # since no pattern above ignores them.
@@ -0,0 +1,81 @@
 # Beads - AI-Native Issue Tracking
 Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
 ## What is Beads?
 Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
 **Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
 ## Quick Start
 ### Essential Commands
 ```bash
 # Create new issues
 bd create "Add user authentication"
 # View all issues
 bd list
 # View issue details
 bd show <issue-id>
 # Update issue status
 bd update <issue-id> --claim
 bd update <issue-id> --status done
 # Sync with Dolt remote
 bd dolt push
 ```
 ### Working with Issues
 Issues in Beads are:
 - **Git-native**: Stored in Dolt database with version control and branching
 - **AI-friendly**: CLI-first design works perfectly with AI coding agents
 - **Branch-aware**: Issues can follow your branch workflow
 - **Always in sync**: Auto-syncs with your commits
 ## Why Beads?
 ✨ **AI-Native Design**
 - Built specifically for AI-assisted development workflows
 - CLI-first interface works seamlessly with AI coding agents
 - No context switching to web UIs
 🚀 **Developer Focused**
 - Issues live in your repo, right next to your code
 - Works offline, syncs when you push
 - Fast, lightweight, and stays out of your way
 🔧 **Git Integration**
 - Automatic sync with git commits
 - Branch-aware issue tracking
 - Dolt-native three-way merge resolution
 ## Get Started with Beads
 Try Beads in your own projects:
 ```bash
 # Install Beads
 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
 # Initialize in your repo
 bd init
 # Create your first issue
 bd create "Try out Beads"
 ```
 ## Learn More
 - **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
 - **Quick Start Guide**: Run `bd quickstart`
 - **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
 ---
 *Beads: Issue tracking that moves at the speed of thought* ⚡
@@ -0,0 +1,56 @@
 # Beads Configuration File
 # This file configures default behavior for all bd commands in this repository
 # All settings can also be set via environment variables (BD_* prefix)
 # or overridden with command-line flags
 # Issue prefix for this repository (used by bd init)
 # If not set, bd init will auto-detect from directory name
 # Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
 # issue-prefix: ""
 # Use no-db mode: JSONL-only, no Dolt database
 # When true, bd will use .beads/issues.jsonl as the source of truth
 # no-db: false
 # Enable JSON output by default
 # json: false
 # Feedback title formatting for mutating commands (create/update/close/dep/edit)
 # 0 = hide titles, N > 0 = truncate to N characters
 # output:
 #   title-length: 255
 # Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
 # actor: ""
 # Export events (audit trail) to .beads/events.jsonl on each flush/sync
 # When enabled, new events are appended incrementally using a high-water mark.
 # Use 'bd export --events' to trigger manually regardless of this setting.
 # events-export: false
 # Multi-repo configuration (experimental - bd-307)
 # Allows hydrating from multiple repositories and routing writes to the correct database
 # repos:
 #   primary: "."  # Primary repo (where this database lives)
 #   additional:   # Additional repos to hydrate from (read-only)
 #     - ~/beads-planning  # Personal planning repo
 #     - ~/work-planning   # Work planning repo
 # JSONL backup (periodic export for off-machine recovery)
 # Auto-enabled when a git remote exists. Override explicitly:
 # backup:
 #   enabled: false     # Disable auto-backup entirely
 #   interval: 15m      # Minimum time between auto-exports
 #   git-push: false    # Disable git push (export locally only)
 #   git-repo: ""       # Separate git repo for backups (default: project repo)
 # Integration settings (access with 'bd config get/set')
 # These are stored in the database, not in this file:
 # - jira.url
 # - jira.project
 # - linear.url
 # - linear.api-key
 # - github.org
 # - github.repo
 sync.remote: "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixos-config.git"
@@ -0,0 +1,24 @@
 #!/usr/bin/env sh
 # --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
  export BD_GIT_HOOK=1
  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
  if command -v timeout >/dev/null 2>&1; then
    timeout "$_bd_timeout" bd hooks run post-checkout "$@"
    _bd_exit=$?
    if [ $_bd_exit -eq 124 ]; then
      echo >&2 "beads: hook 'post-checkout' timed out after ${_bd_timeout}s — continuing without beads"
      _bd_exit=0
    fi
  else
    bd hooks run post-checkout "$@"
    _bd_exit=$?
  fi
  if [ $_bd_exit -eq 3 ]; then
    echo >&2 "beads: database not initialized — skipping hook 'post-checkout'"
    _bd_exit=0
  fi
  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
 # --- END BEADS INTEGRATION v1.0.3 ---
@@ -0,0 +1,24 @@
 #!/usr/bin/env sh
 # --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
  export BD_GIT_HOOK=1
  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
  if command -v timeout >/dev/null 2>&1; then
    timeout "$_bd_timeout" bd hooks run post-merge "$@"
    _bd_exit=$?
    if [ $_bd_exit -eq 124 ]; then
      echo >&2 "beads: hook 'post-merge' timed out after ${_bd_timeout}s — continuing without beads"
      _bd_exit=0
    fi
  else
    bd hooks run post-merge "$@"
    _bd_exit=$?
  fi
  if [ $_bd_exit -eq 3 ]; then
    echo >&2 "beads: database not initialized — skipping hook 'post-merge'"
    _bd_exit=0
  fi
  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
 # --- END BEADS INTEGRATION v1.0.3 ---
@@ -0,0 +1,24 @@
 #!/usr/bin/env sh
 # --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
  export BD_GIT_HOOK=1
  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
  if command -v timeout >/dev/null 2>&1; then
    timeout "$_bd_timeout" bd hooks run pre-commit "$@"
    _bd_exit=$?
    if [ $_bd_exit -eq 124 ]; then
      echo >&2 "beads: hook 'pre-commit' timed out after ${_bd_timeout}s — continuing without beads"
      _bd_exit=0
    fi
  else
    bd hooks run pre-commit "$@"
    _bd_exit=$?
  fi
  if [ $_bd_exit -eq 3 ]; then
    echo >&2 "beads: database not initialized — skipping hook 'pre-commit'"
    _bd_exit=0
  fi
  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
 # --- END BEADS INTEGRATION v1.0.3 ---
@@ -0,0 +1,24 @@
 #!/usr/bin/env sh
 # --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
  export BD_GIT_HOOK=1
  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
  if command -v timeout >/dev/null 2>&1; then
    timeout "$_bd_timeout" bd hooks run pre-push "$@"
    _bd_exit=$?
    if [ $_bd_exit -eq 124 ]; then
      echo >&2 "beads: hook 'pre-push' timed out after ${_bd_timeout}s — continuing without beads"
      _bd_exit=0
    fi
  else
    bd hooks run pre-push "$@"
    _bd_exit=$?
  fi
  if [ $_bd_exit -eq 3 ]; then
    echo >&2 "beads: database not initialized — skipping hook 'pre-push'"
    _bd_exit=0
  fi
  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
 # --- END BEADS INTEGRATION v1.0.3 ---
@@ -0,0 +1,24 @@
 #!/usr/bin/env sh
 # --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
  export BD_GIT_HOOK=1
  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
  if command -v timeout >/dev/null 2>&1; then
    timeout "$_bd_timeout" bd hooks run prepare-commit-msg "$@"
    _bd_exit=$?
    if [ $_bd_exit -eq 124 ]; then
      echo >&2 "beads: hook 'prepare-commit-msg' timed out after ${_bd_timeout}s — continuing without beads"
      _bd_exit=0
    fi
  else
    bd hooks run prepare-commit-msg "$@"
    _bd_exit=$?
  fi
  if [ $_bd_exit -eq 3 ]; then
    echo >&2 "beads: database not initialized — skipping hook 'prepare-commit-msg'"
    _bd_exit=0
  fi
  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
 # --- END BEADS INTEGRATION v1.0.3 ---
@@ -0,0 +1,3 @@
 {"_type":"issue","id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
@@ -0,0 +1,7 @@
 {
  "database": "dolt",
  "backend": "dolt",
  "dolt_mode": "embedded",
  "dolt_database": "home_profile_restructuring",
  "project_id": "664fc7e3-94eb-4874-aab6-e47835abe9d8"
 }
@@ -26,6 +26,7 @@ Thumbs.db
 opencode.json
 # AI agent state
 .claude/
 .sidecar/
 .sidecar-*
 .sisyphus/
@@ -37,3 +38,18 @@ opencode.json
 .td-root
 .cache
 .pi*
 .worktrees/
 docs/plans/
 CLAUDE.md
 # Beads / Dolt files (added by bd init)
 .dolt/
 *.db
 .beads-credential-key
 # --- babysitter managed ---
 .a5c/creds.env
 .a5c/creds.env.tmp.*
 .a5c/logs/
 .a5c/runs/
 # --- end babysitter managed ---
@@ -1,274 +1,445 @@
-# NIXOS CONFIGURATION KNOWLEDGE BASE
+# Agent Instructions
-**Generated:** 2025-12-31 16:13:40 UTC  
+This project uses **bd** (beads) for issue tracking. Run `bd prime` for full workflow context.
 **Commit:** ebc8291  
 **Branch:** HEAD
-## OVERVIEW
+## Quick Reference
 Personal NixOS configuration managing 6 hosts (4 servers, 2 desktops) using flakes, agenix secrets, and feature-based home-manager setup.
-## STRUCTURE
+```bash
-```
+bd ready              # Find available work
-./
+bd show <id>          # View issue details
-├── flake.nix              # Main entry: host definitions, inputs, outputs
+bd update <id> --claim  # Claim work atomically
-├── secrets.nix            # Agenix public key mappings
+bd close <id>         # Complete work
-├── hosts/
+bd dolt push          # Push beads data to remote
 │   ├── common/            # Shared: base config, users, extraServices, ports
 │   ├── m3-atlas/          # Server: 20+ containerized services with Traefik
 │   ├── m3-helios/         # Server: AdGuard, internal routing
 │   ├── m3-ares/           # Desktop: NVIDIA GPU, Btrfs
 │   ├── m3-kratos/         # Desktop: AMD GPU, ZFS
 │   └── m3-aether/         # Cloud VM
 ├── home/
 │   ├── common/            # Home-manager base config
 │   ├── features/          # Modular feature toggles (cli, desktop, coding)
 │   └── m3tam3re/          # Per-host user configs
 ├── modules/               # Custom NixOS/home-manager modules
 ├── overlays/              # Package overlays (stable, locked, pinned, master)
 ├── pkgs/                  # Custom package definitions
 └── secrets/               # Agenix encrypted .age files (19 secrets)
 ```
-## WHERE TO LOOK
+## Non-Interactive Shell Commands
-| Task | Location | Notes |
+**ALWAYS use non-interactive flags** with file operations to avoid hanging on confirmation prompts.
 |------|----------|-------|
 | Add new host | `flake.nix` + `hosts/<name>/` | Copy template from m3-atlas (server) or m3-ares (desktop) |
 | Add service to m3-atlas | `hosts/m3-atlas/services/` | See containers/ for Podman + Traefik pattern |
 | Configure desktop features | `home/features/desktop/` | Feature toggles with mkEnableOption |
 | Add CLI tool | `home/features/cli/` | Fish + Nushell integration expected |
 | Manage secrets | `secrets.nix` + `agenix -e` | SSH keys defined in secrets.nix |
 | Define ports | `hosts/common/ports.nix` | Centralized port registry |
 | Add user | `hosts/common/users/` | Shared across all hosts |
 | Custom packages | `pkgs/default.nix` | Exposed via flake outputs |
-## CONVENTIONS
+Shell commands like `cp`, `mv`, and `rm` may be aliased to include `-i` (interactive) mode on some systems, causing the agent to hang indefinitely waiting for y/n input.
-### Secrets (agenix)
+**Use these forms instead:**
 - **Create**: `agenix -e secrets/<name>.age` after adding keys to `secrets.nix`
 - **Reference**: `config.age.secrets.<name>.path` in service configs
 - **Pattern**: Service env files use `environmentFiles = [config.age.secrets.<service>-env.path]`
-### Service Organization
+```bash
- **Native services**: `hosts/<host>/services/<service>.nix`
+# Force overwrite without prompting
- **Containers**: `hosts/<host>/services/containers/<service>.nix`
+cp -f source dest           # NOT: cp source dest
- **Traefik integration**: All m3-atlas services include dynamic config for SSL + routing
+mv -f source dest           # NOT: mv source dest
- **Networking**: Containers use dedicated `web` network (10.89.0.0/24) with static IPs
+rm -f file                  # NOT: rm file
-### Port Management
+# For recursive operations
- **Registry**: All ports defined in `hosts/common/ports.nix`
+rm -rf directory            # NOT: rm -r directory
- **Access**: `config.m3ta.ports.get "service-name"`
+cp -rf source dest          # NOT: cp -r source dest
- **Convention**: Internal services use 3000-3020 range
+```
-### Home-Manager Features
+**Other commands that may prompt:**
 - **Enable**: `features.<category>.<feature>.enable = true` in user config
 - **Categories**: `cli`, `desktop`, `coding`
 - **Pattern**: Features are opt-in modules with default.nix aggregators
-### Multiple nixpkgs Inputs
+- `scp` - use `-o BatchMode=yes` for non-interactive
- **stable**: 25.11 release
+- `ssh` - use `-o BatchMode=yes` to fail instead of prompting
- **locked/pinned**: Specific commits for compatibility
+- `apt-get` - use `-y` flag
- **master**: Bleeding edge
+- `brew` - use `HOMEBREW_NO_AUTO_UPDATE=1` env var
 - **m3ta-nixpkgs**: Custom local overlay at `path:/home/m3tam3re/p/nix/nixpkgs`
-## CODING RULES
+<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
-This project uses coding rules from the AGENTS repository (`inputs.agents`) plus project-specific conventions.
+## Beads Issue Tracker
-### Standard Rules (AGENTS repo)
+This project uses **bd (beads)** for persistent task tracking. Run `bd prime` for full workflow context.
-| Rule | Source | Purpose |
+### Why Beads?
 |------|--------|---------|
 | `languages/nix.md` | AGENTS/rules/ | Nix language conventions, flake patterns |
 | `concerns/coding-style.md` | AGENTS/rules/ | General coding principles |
 | `concerns/naming.md` | AGENTS/rules/ | Naming conventions per language |
 | `concerns/documentation.md` | AGENTS/rules/ | Documentation standards |
 | `concerns/testing.md` | AGENTS/rules/ | Testing guidelines |
 | `concerns/git-workflow.md` | AGENTS/rules/ | Commit message format, branch naming |
 | `concerns/project-structure.md` | AGENTS/rules/ | Project layout conventions |
-### NixOS-Config Specific Rules
+- **Prefer Beads over ad-hoc markdown TODO lists** — Beads provides structured, queryable, shareable issue tracking with dependency management
 - **Never use `bd edit`** — it opens an interactive editor which blocks agent workflows
 - **Use flags and stdin instead** — `bd update <id> --claim`, `bd create --title "..." --estimate 2`
-#### Project Structure
+### Slash Commands (Agent Workflow)
 | Command | Purpose |
 |---------|---------|
 | `/beads:ready` | Find unblocked issues |
 | `/beads:create` | Create a new issue |
 | `/beads:update` | Update an issue (claim, status) |
 | `/beads:close` | Close completed work |
 | `/beads:stats` | Project-level snapshot |
 ### Core Workflow (6 Steps)
 #### 1. Find Unblocked Work
 ```bash
 bd ready --json
 ```
 Lists issues with no blocking dependencies that are ready to work on.
 #### 2. Claim Work
 ```bash
 bd update <id> --claim
 ```
 Atomically assigns the issue to you (sets status to "in-progress").
 #### 3. Inspect Details
 ```bash
 bd show <id>
 ```
 View full issue details including:
 - Description and acceptance criteria
 - Blocking/blocked-by dependencies
 - Time estimates
 - Status history
 #### 4. Create Newly Discovered Work
 ```bash
 # Create a new issue
 bd create \
  --title "Fix audio on m3-helios" \
  --estimate 2 \
  --priority high \
  --labels nixos,audio
 # Link dependencies
 bd dep <id> --blocks <blocked-id>      # This issue blocks another
 bd dep <id> --after <after-id>         # This issue after another completes
 bd dep <id> --requires <requires-id>  # This issue requires another
 ```
 #### 5. Complete Work
 ```bash
 bd close <id> --reason "Added PulseAudio fallback to configuration.nix"
 ```
 Provide a concise summary of what was done. The `--reason` is mandatory.
 #### 6. Project Snapshot
 ```bash
 bd status --json    # Current state of all issues
 bd stats            # Metrics: velocity, cycle time, bottlenecks
 ```
 ### Example Complete Workflow
 ```bash
 # Start session - find work
 bd ready --json
 # Claim available issue
 bd update 42 --claim
 # Do the work...
 # Discover something else needed
 bd create --title "Document hermes-agent setup" --estimate 1
 # Link as related
 bd dep 43 --after 42
 # Complete original
 bd close 42 --reason "Added Hyprland idle timeout config"
 # Close related
 bd close 43 --reason "Added setup docs to AGENTS.md"
 # Push state to remote
 bd dolt push
 ```
 ### Rules
 - Use `bd` for ALL task tracking — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
 - Run `bd prime` for detailed command reference and session close protocol
 - Use `bd remember` for persistent knowledge — do NOT use MEMORY.md files
 ## Session Completion
 **When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
 **MANDATORY WORKFLOW:**
 1. **File issues for remaining work** - Create issues for anything that needs follow-up
 2. **Run quality gates** (if code changed) - Tests, linters, builds
 3. **Update issue status** - Close finished work, update in-progress items
 4. **PUSH TO REMOTE** - This is MANDATORY:
   ```bash
   git pull --rebase
   bd dolt push
   git push
   git status  # MUST show "up to date with origin"
   ```
 5. **Clean up** - Clear stashes, prune remote branches
 6. **Verify** - All changes committed AND pushed
 7. **Hand off** - Provide context for next session
 **CRITICAL RULES:**
 - Work is NOT complete until `git push` succeeds
 - NEVER stop before pushing - that leaves work stranded locally
 - NEVER say "ready to push when you are" - YOU must push
 - If push fails, resolve and retry until it succeeds
 <!-- END BEADS INTEGRATION -->
 # Project Agent
 **Workspace Path:** `/home/m3tam3re/p/NIX/nixos-config`
 _(Note to Pi: Your file write/edit tools run in a different directory by default. You MUST use absolute paths starting with the Workspace Path above for ALL file operations!)_
 **Generated:** 2026-04-26
 ---
 ## Stack
 | Component        | Version/Source                    |
 | ---------------- | --------------------------------- |
 | **Nixpkgs**      | nixos-unstable + 25.05 stable     |
 | **Home Manager** | github:nix-community/home-manager |
 | **m3ta-home**    | code.m3ta.dev/m3tam3re/m3ta-home  |
 | **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs    |
 | **Agenix**       | github:ryantm/agenix              |
 | **Disko**        | github:nix-community/disko        |
 | **NUR**          | github:nix-community/NUR          |
 | **Formatter**    | alejandra                         |
 | **Linters**      | statix, deadnix                   |
 | **IDE**          | nixd                              |
 | **Hermes Agent** | NousResearch/hermes-agent         |
 | **LLM Agents**   | numtide/llm-agents.nix            |
 ---
 ## Structure
 ```
 nixos-config/
-├── flake.nix              # Entry point
+├── flake.nix                    # Entry point: hosts, overlays, dev shells, m3ta-home input
-├── hosts/                 # Host-specific NixOS configs
+├── coding-rules.json            # Opencode rules configuration
-│   ├── common/            # Shared: ports, users, base config
+│
-│   ├── m3-atlas/          # Server with Traefik hub
+├── hosts/                        # Per-host NixOS configurations
-│   ├── m3-helios/         # AdGuard DNS
+│   ├── common/                   # Shared across all hosts
-│   ├── m3-ares/           # Desktop (NVIDIA)
+│   │   ├── users/
-│   └── m3-kratos/         # Desktop (AMD)
+│   │   │   └── m3tam3re.nix     # ← Central user + m3ta-home integration
-├── home/                   # Home-manager configs
+│   │   ├── default.nix          # Shared NixOS settings, overlays, home-manager setup
-│   ├── common/            # Shared home config
+│   │   ├── ports.nix            # Network ports config
-│   ├── features/          # Feature modules (cli, desktop, coding)
+│   │   └── extraServices/       # Common service toggles
-│   └── m3tam3re/          # User-specific configs
+│   ├── m3-ares/                  # TUXEDO laptop (desktop)
-├── modules/               # Custom NixOS/HM modules
+│   │   └── home.nix             # Hyprland: eDP-1 + HDMI, XDG/MIME
-├── overlays/              # Package overlays
+│   ├── m3-kratos/                # AMD desktop (desktop)
 │   │   └── home.nix             # Hyprland: dual DP, XDG/MIME
 │   ├── m3-daedalus/              # Portable laptop (desktop, no Hyprland)
 │   │   └── home.nix             # XDG/MIME only
 │   ├── m3-atlas/                 # Primary server (server + coding)
 │   ├── m3-helios/                # AdGuard DNS server (minimal server)
 │   ├── m3-hermes/                # Secondary server (minimal server)
 │   └── m3-aether/                # Cloud VM (minimal server)
 │
 ├── modules/                      # Reusable NixOS modules
 │   └── nixos/                    # NixOS-specific modules
 │
 ├── overlays/                    # Package overlays (stable/locked/master/pinned)
 │   ├── default.nix
 │   └── mods/
 │
 ├── pkgs/                        # Custom packages
-└── secrets/               # Agenix encrypted secrets
+│
 ├── secrets/                     # Encrypted secrets (agenix)
 │   └── secrets.nix
 │
 ├── .opencode-rules/             # Opencode AI rules
 │   ├── concerns/
 │   ├── languages/nix.md
 │   └── USAGE.md
 │
 └── .pi/                         # Agent configuration
 ```
-#### Naming Conventions
+### Home-Manager Integration
-| Type | Convention | Example |
+Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
-|------|------------|---------|
+- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
-| Hosts | mythological-names | `m3-atlas`, `m3-helios` |
+- **Docs**: See m3ta-home README for full documentation
 | Files | hyphen-case | `my-service.nix` |
 | Variables | camelCase | `portHelpers`, `serviceConfig` |
 | Options | m3ta.* | `config.m3ta.ports.get` |
 | Packages | lowercase-hyphen | `hyprpaper-random` |
-#### Nix Module Pattern
+What lives where:
 | Concern | Location | Why |
 |---------|----------|-----|
 | Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
 | User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
 | Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
 | Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
 | XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
 | NixOS overlays | `nixos-config/overlays/` | System-level package management |
 #### Host → Profile Mapping
 Defined in `hosts/common/users/m3tam3re.nix`:
 ```nix
 hostProfiles = {
  # Desktop hosts
  m3-ares     = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
  m3-kratos   = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
  m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
  # Server hosts
  m3-atlas    = { context = "server";  sets = ["coding"]; };
  m3-helios   = { context = "server";  sets = []; };
  m3-hermes   = { context = "server";  sets = []; };
  m3-aether   = { context = "server";  sets = []; };
 };
 ```
 #### Work Identity Use Case
 The same `m3ta-home` repo supports a **work identity** for company machines:
 ```nix
 # On a work NixOS machine:
 (m3ta-lib.mkHome {
  user = "m3tam3re";
  identity = "work";       # ← switches git to sascha.koenig, SSH to AZ hosts
  context = "desktop";
  sets = ["coding"];
 })
 ```
 This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.
 ---
 ## Commands
 | Action               | Command                                                                | Notes                                             |
 | -------------------- | ---------------------------------------------------------------------- | ------------------------------------------------- |
 | **Enter dev shell**  | `nix develop`                                                          | Includes alejandra, nixd, agenix, statix, deadnix |
 | **Build host**       | `sudo nixos-rebuild switch --flake .#m3-ares`                          | Replace hostname as needed                        |
 | **Dry run build**    | `sudo nixos-rebuild dry-run --flake .#m3-ares`                         | Validate without applying                         |
 | **List hosts**       | `nix flake show`                                                       | Shows all NixOS configurations                    |
 | **Update flake**     | `sudo nixos-rebuild switch --flake .#m3-ares --update-input nixpkgs`   | Update specific input                             |
 | **Format code**      | `alejandra .`                                                          | Run before committing                             |
 | **Check lint**       | `statix check .`                                                       | Run statix for antipatterns                       |
 | **Remove dead code** | `deadnix -w .`                                                         | Clean up unused let bindings                      |
 | **Build ISO**        | `nix build .#nixosConfigurations.m3-ares.config.system.build.isoImage` | Generate install ISO                              |
 ---
 ## Conventions
 ### Formatting & Style
 - **Formatter:** `alejandra` (mandatory, run before commits)
 - **Indentation:** 2 spaces (alejandra default)
 - **Variables:** camelCase (e.g., `maxRetryAttempts`)
 - **Types/Modules:** PascalCase (e.g., `MyService`)
 - **Constants:** UPPER_SNAKE_CASE (e.g., `MAX_RETRIES`)
 - **Files:** hyphen-case (e.g., `my-file.nix`)
 ### Nix Module Patterns
 ```nix
 { config, lib, pkgs, ... }:
-with lib; let
+{
-  cfg = config.m3ta.myModule;
+  options.myService.enable = lib.mkEnableOption "my service";
-in {
+  config = lib.mkIf config.myService.enable {
-  options.m3ta.myModule = {
+    services.myService.enable = true;
    enable = mkEnableOption "my module";
  };
  config = mkIf cfg.enable {
    # Configuration here
  };
 }
 ```
-#### Anti-Patterns (Never Do)
+### Conditionals
 | Don't | Do Instead |
 |-------|------------|
 | Hardcode ports | `config.m3ta.ports.get "service"` |
 | Skip secrets.nix update | Add keys first, then `agenix -e` |
 | Containers outside web network | `--network=web --ip=10.89.0.N` |
 | Skip Traefik for public services | Configure dynamic config |
 | Bypass extraServices flags | Use feature flags properly |
 | Use `fetchTarball` | Use flake inputs |
 | Use `with pkgs;` in modules | Explicit `pkgs.package` |
 ### Formatting & Linting
 ```bash
 # Format (alejandra)
 nix fmt
 # Lint (statix, deadnix - only in dev shell)
 nix develop
 statix check .
 deadnix .
 # Validate flake
 nix flake check
 ```
 ### Commit Conventions
 Format: `<type>: <brief description>`
 Types: `feat`, `fix`, `docs`, `style`, `refactor`, `chore`
 Examples:
 - `feat: add new host m3-hermes`
 - `fix: resolve port conflict in mem0 module`
 - `docs: update AGENTS.md with new service`
 - `style: format nix files`
 - `refactor: simplify port management`
 - `chore: update nixpkgs inputs`
 ### Tools in Dev Shell
 | Tool | Purpose |
 |------|---------|
 | `alejandra` | Nix code formatter |
 | `nixd` | Nix language server |
 | `statix` | Nix linter |
 | `deadnix` | Find dead code |
 | `agenix` | Secret management |
 ## COMMANDS
 ```bash
 # Build/deploy specific host
 sudo nixos-rebuild switch --flake .#m3-ares
 # Build/deploy current host
 sudo nixos-rebuild switch --flake .#$(uname -n)
 # Home-manager update
 home-manager --flake . switch
 # Update all flake inputs
 nix flake update
 # Add/edit secret
 agenix -e secrets/<name>.age
 # Infrastructure shell (OpenTofu)
 nix develop .#infraShell
 # Check configuration (no activation)
 nixos-rebuild dry-build --flake .#<hostname>
 ```
 ## TRAEFIK PATTERNS (m3-atlas only)
 ### SSL Termination
 - **Provider**: Godaddy DNS challenge
 - **Cert storage**: `/var/lib/traefik/acme.json`
 - **Config**: `hosts/m3-atlas/services/traefik.nix`
 ### Service Integration Template
 ```nix
-services.traefik.dynamicConfigOptions.http = {
+config = lib.mkMerge [
-  services.<name>.loadBalancer.servers = [{ url = "http://127.0.0.1:<port>"; }];
+  (lib.mkIf cfg.enable { ... })
-  routers.<name> = {
+  (lib.mkIf cfg.extraConfig { ... })
-    rule = "Host(`<subdomain>.m3ta.dev`)";
+];
    service = "<name>";
    tls.certResolver = "godaddy";
  };
 };
 ```
-### Container Pattern
+### Anti-Patterns (AVOID)
 - **Network**: `--network=web --ip=10.89.0.<sequential>`
 - **Ports**: Bind localhost only (`127.0.0.1:<external>:<internal>`)
 - **Database access**: `--add-host=mysql:10.89.0.1` (gateway IP)
-## HOST ROLES
+- **Never use `with pkgs;`** — always use explicit package references
 - **Never use `builtins.fetchTarball`** — use flake inputs instead
 - **Never use `import <nixpkgs>`** — always use inputs
 - **Never use `builtins.getAttr/hasAttr`** — use `lib.attrByPath` or `lib.optionalAttrs`
 - **Avoid anonymous functions in config** — extract to named lets
-| Host | Type | Hardware | Purpose |
+### Imports
 |------|------|----------|---------|
 | m3-atlas | Server | x86_64, disko | 20+ services, Traefik hub, PostgreSQL, MySQL |
 | m3-helios | Server | x86_64, disko | AdGuard DNS, internal routing |
 | m3-ares | Desktop | NVIDIA, Btrfs | Personal workstation, n8n, PostgreSQL |
 | m3-kratos | Desktop | AMD, ZFS | Workstation, mem0, PostgreSQL |
 | m3-aether | Cloud | QEMU | General purpose VM |
 | m3-daedalus | Laptop | home-only | Portable (no full NixOS config) |
-## ANTI-PATTERNS (THIS PROJECT)
+- Use flake inputs for dependencies (e.g., `inputs.home-manager.nixosModules.home-manager`)
 - Import relative paths with `./` or `../`
 - Never use absolute paths in imports
- **DON'T** add secrets to `secrets/` without updating `secrets.nix` public keys
+### Secrets
 - **DON'T** hardcode ports - use `config.m3ta.ports.get` or add to registry
 - **DON'T** create containers outside the `web` network on m3-atlas
 - **DON'T** skip Traefik config for public-facing services on m3-atlas
 - **DON'T** bypass extraServices flags - use `hosts/common/extraServices/` pattern
 - **DON'T** commit unencrypted secrets or test with real credentials
-## UNIQUE TO THIS CONFIG
+- Secrets managed via **agenix** in `secrets/` directory
 - Never commit plaintext secrets
 - Use `.nix` extension for secret files
- **Custom m3ta-nixpkgs**: Local overlay for unreleased/patched packages
+### Flake Input URLs
 - **extraServices abstraction**: Boolean flags to toggle Podman, Ollama, virtualisation per host
 - **Mythological naming**: All hosts named after Greek mythology
 - **Dual domain strategy**: New services on `m3ta.dev`, legacy redirects from `m3tam3re.com`
 - **Per-host nixpkgs versions**: Different hosts can use different nixpkgs commits via specialArgs
 - **Container IP registry**: Static IP assignments in 10.89.0.0/24 subnet for predictable networking
-## NOTES
+All `code.m3ta.dev` inputs use **SSH** URLs:
 ```nix
 url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
 ```
 Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
- m3-atlas is the service hub - most complex configuration
+---
- Secrets require host SSH keys defined in `secrets.nix` before `agenix -e` works
+
- Fish and Nushell both configured - choose per-user with shell aliases
+## Key Files
- Color scheme (Dracula) applied via nix-colors across all visual tools
+
- See subdirectory AGENTS.md for deep dives on containers, desktop features, CLI tools
+| File                               | Purpose                                                                                    |
 | ---------------------------------- | ------------------------------------------------------------------------------------------ |
 | `flake.nix`                        | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
 | `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`)         |
 | `hosts/common/users/m3tam3re.nix`  | User definition + m3ta-home mkHome integration + per-host feature flags                    |
 | `hosts/<name>/home.nix`            | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME                      |
 | `overlays/default.nix`             | Package version overrides (stable/locked/master branches)                                  |
 | `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns                                                      |
 ---
 ## What to Avoid
 1. **Don't modify `flake.lock`** directly — use `nix flake update`
 2. **Don't use impure operations** — this is a pure flake-based config
 3. **Don't commit without formatting** — always run `alejandra .` first
 4. **Don't add packages to hosts directly** — prefer adding to overlays or using NUR
 5. **Don't hardcode paths** — use `inputs` and relative imports
 6. **Don't create monolithic modules** — keep functions under 20 lines
 7. **Don't skip the dry-run** — always test with `--dry-run` before switching
 8. **Don't use lib.mkDefault lightly** — understand the precedence implications
 ---
 ## Notes
 ### Adding a New Host
 1. Add entry to `flake.nix` → `nixosConfigurations`
 2. Create directory in `hosts/` with:
   - `default.nix` — imports common + specific configs
   - `configuration.nix` — host-specific system config
   - `hardware-configuration.nix` — from `nixos-generate-config`
   - `programs.nix`, `services/`, `secrets.nix` as needed
 3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
 4. Add feature flags in the `hostFlags` section
 5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
 6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
 ### Adding a New Package
 1. For simple packages: add to appropriate overlay in `overlays/default.nix`
 2. For complex packages: create in `pkgs/` directory
 3. For upstream packages: use NUR or add as flake input
 ### Adding a New Home-Manager Feature
 1. Create the module in `m3ta-home` under the appropriate profile directory
 2. Add the import to the parent `default.nix` in m3ta-home
 3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
 ### Development Workflow
 1. Edit config files
 2. Run `alejandra .` to format
 3. Run `statix check .` for linting
 4. Run `sudo nixos-rebuild dry-run --flake .#m3-ares`
 5. If successful: `sudo nixos-rebuild switch --flake .#m3-ares`
 ### Remote Building
 ```bash
 # Build on remote machine
 nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
 ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
 ```
@@ -1,191 +0,0 @@
 # Agenix Secret Management Guide
 A guide for creating and managing encrypted secrets using agenix in the nixos-config project.
 ## Prerequisites
 - SSH key pair (ed25519 or rsa) in `~/.ssh/`
 - Access to the nixos-config repository
 - Secret added to `secrets.nix` with appropriate public keys
 ---
 ## Creating a New Secret
 ### Step 1: Add Secret to secrets.nix
 Edit `secrets.nix` and add a new entry:
 ```nix
 "secrets/<your-secret-name>.age".publicKeys = systems ++ users;
 ```
 Where:
 - `<your-secret-name>` is the desired filename (without `.age`)
 - `systems` = hosts that can decrypt this secret
 - `users` = users that can decrypt this secret
 Example:
 ```nix
 "secrets/my-service-api-key.age".publicKeys = systems ++ users;
 ```
 ### Step 2: Create the Encrypted Secret
 Navigate to the nixos-config directory:
 ```bash
 cd ~/p/NIX/nixos-config
 ```
 Generate a secure random token (if needed):
 ```bash
 head -c 32 /dev/urandom | base64 | tr -d '\n'
 ```
 Or use a specific value:
 ```bash
 echo -n "your-secret-value-here" > /tmp/token.txt
 ```
 Encrypt and create the secret file:
 ```bash
 cat /tmp/token.txt | RULES=./secrets.nix nix develop . --command sh -c 'agenix -e secrets/<your-secret-name>.age'
 ```
 The `-e` flag encrypts stdin content into the age file. If no stdin is provided, agenix opens your editor.
 ### Step 3: Verify the Secret
 Decrypt to verify:
 ```bash
 RULES=./secrets.nix nix develop . --command agenix -d secrets/<your-secret-name>.age
 ```
 You should see your secret value printed to stdout.
 ### Step 4: Use in NixOS Configuration
 Reference the secret in your service config:
 ```nix
 { config, ... }:
 {
  # For environment files
  environmentFiles = [ config.age.secrets."my-secret-name".path ];
  # For file-based secrets
  environmentFile = config.age.secrets."my-secret-name".path;
 }
 ```
 The secret will be available at `/run/agenix/<your-secret-name>` when the system builds.
 ---
 ## Common Patterns
 ### Token-Based Registration (e.g., Tuwunel)
 ```nix
 # secrets.nix
 "secrets/tuwunel-registration-token.age".publicKeys = systems ++ users;
 ```
 ```nix
 # services/tuwunel.nix
 settings.global = {
  allow_registration = true;
  registration_token_file = config.age.secrets."tuwunel-registration-token".path;
 };
 ```
 ### API Keys via Environment Files
 ```nix
 # secrets.nix
 "secrets/my-service-env.age".publicKeys = systems ++ users;
 ```
 Create `my-service-env.age` containing:
 ```
 MY_SERVICE_API_KEY=your-key-here
 DATABASE_URL=postgres://...
 ```
 Reference in config:
 ```nix
 environmentFiles = [ config.age.secrets."my-service-env".path ];
 ```
 ### File-Based Secrets
 For binary files or specific file paths:
 ```nix
 settings = {
  tls.cert = config.age.secrets."tls-cert".path;
  tls.key = config.age.secrets."tls-key".path;
 };
 ```
 ---
 ## Agenix Command Reference
 | Command | Description |
 |---------|-------------|
 | `agenix -e <file.age>` | Edit/create encrypted secret (opens editor or uses stdin) |
 | `agenix -d <file.age>` | Decrypt and print to stdout |
 | `agenix -r` | Re-encrypt all secrets (after changing public keys) |
 | `agenix --validate-config` | Validate secrets.nix syntax |
 ### Environment Variables
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `RULES` | `./secrets.nix` | Path to secrets.nix file |
 | `EDITOR` | `$EDITOR` | Editor for interactive editing |
 ---
 ## Troubleshooting
 ### "No identity found to decrypt"
 **Cause**: No SSH private key available.
 **Solution**: Ensure your private key is in `~/.ssh/`:
 - `~/.ssh/id_rsa`
 - `~/.ssh/id_ed25519`
 - Or specify with `-i /path/to/private/key`
 ### "Failed to find config root"
 **Cause**: Agenix can't find `secrets.nix`.
 **Solution**: Use `RULES=./secrets.nix` or run from the nixos-config directory.
 ### Rekeying Secrets
 After adding new public keys to `secrets.nix`, re-encrypt all secrets:
 ```bash
 cd ~/p/NIX/nixos-config
 RULES=./secrets.nix nix develop . --command agenix -r
 ```
 ---
 ## Security Notes
 - Never commit plaintext secrets to git
 - Always use `secrets.nix` for encryption keys
 - Include only necessary hosts/users in public keys
 - Rotate secrets periodically
 - Use `agenix -r` after modifying public keys
@@ -15,15 +15,14 @@
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
    nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
    nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
    nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
    nixpkgs-master.url = "github:nixos/nixpkgs/master";
-    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
+    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
    # m3ta-nixpkgs.url = "path:/home/m3tam3re/p/NIX/nixpkgs";
    llm-agents.url = "github:numtide/llm-agents.nix";
    #
@@ -40,32 +39,26 @@
    nixos-generators = {url = "github:nix-community/nixos-generators";};
    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
    rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
    nix-colors.url = "github:misterio77/nix-colors";
-    agents = {
+    m3ta-home = {
-      # url = "path:/home/m3tam3re/p/AI/AGENTS";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
-      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
+      # url = "path:/home/m3tam3re/p/NIX/m3ta-home";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    ## Skills
+
-    skills-basecamp = {
+    agent-lib = {
-      url = "github:basecamp/basecamp-cli";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib";
-      flake = false;
+      inputs.nixpkgs.follows = "nixpkgs";
    };
-    skills-anthropic = {
+
-      url = "github:anthropics/skills";
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.29.2";
-      flake = false;
+
    rustfs = {
      url = "github:rustfs/rustfs-flake";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    skills-kestra = {
      url = "github:kestra-io/agent-skills";
      flake = false;
    };
    skills-vercel = {
      url = "github:vercel-labs/skills";
      flake = false;
    };
    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.4.23";
  };
  outputs = {
@@ -75,7 +68,6 @@
    nixpkgs,
    m3ta-nixpkgs,
    nur,
    agents,
    ...
  } @ inputs: let
    inherit (self) outputs;
@@ -91,7 +83,7 @@
  in {
    packages =
      forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = builtins.removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
    lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
    homeManagerModules = import ./modules/home-manager;
@@ -119,6 +111,7 @@
          inputs.disko.nixosModules.disko
          agenix.nixosModules.default
          m3ta-nixpkgs.nixosModules.default
          inputs.rustfs.nixosModules.rustfs
        ];
      };
      m3-kratos = nixpkgs.lib.nixosSystem {
@@ -177,11 +170,6 @@
        inherit system;
        config.allowUnfree = true; # Allow unfree packages in devShell
      };
      m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
      rules = m3taLib.coding-rules.mkCodingRules {
        inherit agents;
        languages = ["nix"];
      };
    in {
      default = pkgs.mkShell {
        buildInputs = with pkgs; [
@@ -192,7 +180,6 @@
          statix
          deadnix
        ];
        inherit (rules) instructions shellHook;
      };
    });
  };
@@ -1,56 +0,0 @@
 {
  inputs,
  lib,
  outputs,
  pkgs,
  system,
  ...
 }: {
  imports = [
    inputs.nix-colors.homeManagerModules.default
    inputs.m3ta-nixpkgs.homeManagerModules.default
  ]; #imports = builtins.attrValues outputs.homeManagerModules;
  nixpkgs = {
    # You can add overlays here
    overlays = [
      # Add overlays your own flake exports (from overlays and pkgs dir):
      #outputs.overlays.additions
      #outputs.overlays.modifications
      outputs.overlays.temp-packages
      outputs.overlays.stable-packages
      outputs.overlays.locked-packages
      outputs.overlays.pinned-packages
      outputs.overlays.master-packages
      inputs.nur.overlays.default
      inputs.m3ta-nixpkgs.overlays.default
      inputs.m3ta-nixpkgs.overlays.modifications
      (outputs.lib.mkLlmAgentsOverlay system)
      # You can also add overlays exported from other flakes:
      # neovim-nightly-overlay.overlays.default
      # Or define it inline, for example:
      # (final: prev: {
      #   hi = final.hello.overrideAttrs (oldAttrs: {
      #     patches = [ ./change-hello-to-hi.patch ];
      #   });
      # })
    ];
    # Configure your nixpkgs instance
    config = {
      # Disable if you don't want unfree packages
      allowUnfree = true;
      # Workaround for https://github.com/nix-community/home-manager/issues/2942
      allowUnfreePredicate = _: true;
    };
  };
  nix = {
    package = lib.mkDefault pkgs.nix;
    settings = {
      experimental-features = ["nix-command" "flakes"];
      warn-dirty = false;
    };
  };
  colorScheme = inputs.nix-colors.colorSchemes.dracula;
 }
@@ -1,65 +0,0 @@
 # CLI FEATURES (home-manager)
 **Shell and terminal tooling with Fish + Nushell dual configuration**
 ## OVERVIEW
 8 CLI modules with integrated tooling across Fish and Nushell shells.
 ## STRUCTURE
 ```
 cli/
 ├── default.nix      # Imports + shared tools (bat, eza, direnv)
 ├── fish.nix         # Fish shell + aliases
 ├── fzf.nix          # Fuzzy finder
 ├── nitch.nix        # System info tool
 ├── nushell.nix      # Nushell + aliases
 ├── secrets.nix      # Password-store integration
 ├── starship.nix     # Shell prompt
 └── zellij.nix       # Terminal multiplexer
 ```
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
 | Add CLI tool | default.nix home.packages | Check if shell integration needed |
 | Shell aliases | fish.nix or nushell.nix | Kept in sync between shells |
 | Prompt config | starship.nix | Uses nerd-fonts symbols |
 | Secret access | secrets.nix | Agenix integration |
 ## CONVENTIONS
 ### Shell Integration Pattern
 Tools with shell hooks enabled in both Fish and Nushell:
 - **carapace**: Completions
 - **zoxide**: Smart cd
 - **eza**: ls replacement
 - **direnv**: Directory environments
 - **fzf**: Fuzzy finding
 ### NixOS Rebuild Aliases (both shells)
 ```
 nr/nrs    - nixos-rebuild [switch]
 snr/snrs  - sudo nixos-rebuild [switch]
 hms       - home-manager switch
 ```
 ### Bat Theme
 Custom `universal` theme generated from nix-colors palette in default.nix (lines 34-157).
 ### Secrets Integration
 Fish/Nushell source `$HOME/.secrets` if `secrets.enable = true` (CLI secrets feature).
 ## ANTI-PATTERNS
 - **DON'T** add aliases to only one shell - keep Fish/Nushell in sync
 - **DON'T** use `programs.bash` - Nushell is default shell
 - **DON'T** bypass carapace for completions - integrated by default
 ## NOTES
 - zellij-ps custom package for project session management
 - Default shell set to Nushell in hosts/common/default.nix
 - Bat theme dynamically generated (no external theme files)
 - lf file manager uses bat for previews
 - Agenix CLI (agenix-cli) included for secret management
@@ -1,230 +0,0 @@
 {
  config,
  pkgs,
  videoDrivers,
  ...
 }: {
  imports = [
    ./fish.nix
    ./fzf.nix
    ./nitch.nix
    ./nushell.nix
    ./secrets.nix
    ./starship.nix
    ./television.nix
    ./zellij.nix
  ];
  programs.carapace = {
    enable = true;
    enableFishIntegration = true;
    enableNushellIntegration = true;
    enableBashIntegration = true;
  };
  programs.zoxide = {
    enable = true;
    enableFishIntegration = true;
    enableNushellIntegration = true;
  };
  programs.bat = {
    enable = true;
    config = {theme = "universal";};
    themes = {
      universal = {
        src = pkgs.writeText "universal.tmTheme" ''
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>name</key>
            <string>Universal (nix-colors)</string>
            <key>settings</key>
            <array>
              <dict>
                <key>settings</key>
                <dict>
                  <key>background</key>
                  <string>#${config.colorScheme.palette.base00}</string>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base05}</string>
                  <key>caret</key>
                  <string>#${config.colorScheme.palette.base05}</string>
                  <key>selection</key>
                  <string>#${config.colorScheme.palette.base02}</string>
                  <key>selectionForeground</key>
                  <string>#${config.colorScheme.palette.base05}</string>
                  <key>lineHighlight</key>
                  <string>#${config.colorScheme.palette.base01}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Comment</string>
                <key>scope</key>
                <string>comment</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base03}</string>
                  <key>fontStyle</key>
                  <string>italic</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>String</string>
                <key>scope</key>
                <string>string</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base0A}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Number</string>
                <key>scope</key>
                <string>constant.numeric</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base0E}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Keyword</string>
                <key>scope</key>
                <string>keyword</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base08}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Function</string>
                <key>scope</key>
                <string>entity.name.function</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base0B}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Type</string>
                <key>scope</key>
                <string>entity.name.type, storage.type</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base0D}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Variable</string>
                <key>scope</key>
                <string>variable</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base05}</string>
                </dict>
              </dict>
              <dict>
                <key>name</key>
                <string>Constant</string>
                <key>scope</key>
                <string>constant</string>
                <key>settings</key>
                <dict>
                  <key>foreground</key>
                  <string>#${config.colorScheme.palette.base0E}</string>
                </dict>
              </dict>
            </array>
          </dict>
          </plist>
        '';
      };
    };
  };
  programs.direnv = {
    enable = true;
    enableNushellIntegration = true;
    nix-direnv.enable = true;
  };
  programs.eza = {
    enable = true;
    enableFishIntegration = true;
    enableBashIntegration = true;
    extraOptions = ["-l" "--icons" "--git" "-a"];
  };
  programs.lf = {
    enable = true;
    settings = {
      preview = true;
      drawbox = true;
      hidden = true;
      icons = true;
      theme = "Dracula";
      previewer = "bat";
    };
  };
  cli.zellij-ps = {
    enable = true;
    projectFolders = ["/home/m3tam3re/p"];
  };
  home.packages = with pkgs; [
    basecamp
    comma
    coreutils
    devenv
    fabric-ai
    fd
    gcc
    go
    htop
    httpie
    hyprpaper-random
    jq
    just
    lazygit
    llm
    lf
    nix-index
    nix-update
    libnotify
    nushellPlugins.skim
    progress
    ripgrep
    rocmPackages.rocm-smi
    rocmPackages.rocminfo
    rocmPackages.rocm-runtime
    sqlite
    sqlite-vec
    tldr
    pomodoro-timer
    trash-cli
    unimatrix
    unzip
    vulkan-tools
    wttrbar
    wireguard-tools
    yazi
    zellij-ps
    zip
  ];
 }
@@ -1,116 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.fish;
 in {
  options.features.cli.fish.enable = mkEnableOption "enable fish shell";
  config = mkIf cfg.enable {
    programs.fish = {
      enable = true;
      interactiveShellInit = ''
        # Fish colors using universal nix-colors palette
        # Text colors
        set -g fish_color_normal ${config.colorScheme.palette.base05}      # text
        set -g fish_color_param ${config.colorScheme.palette.base05}       # text
        set -g fish_color_comment ${config.colorScheme.palette.base03}     # muted
        set -g fish_color_autosuggestion ${config.colorScheme.palette.base03} # muted
        # Command colors
        set -g fish_color_command ${config.colorScheme.palette.base0D}     # accent6 (blue)
        set -g fish_color_quote ${config.colorScheme.palette.base0A}       # accent3 (yellow)
        set -g fish_color_redirection ${config.colorScheme.palette.base0E} # accent7 (purple)
        set -g fish_color_end ${config.colorScheme.palette.base08}         # accent1 (red)
        set -g fish_color_error ${config.colorScheme.palette.base08}       # accent1 (red)
        set -g fish_color_operator ${config.colorScheme.palette.base0C}    # accent5 (cyan)
        set -g fish_color_escape ${config.colorScheme.palette.base09}      # accent2 (orange)
        # Path colors
        set -g fish_color_cwd ${config.colorScheme.palette.base0B}         # accent4 (green)
        set -g fish_color_cwd_root ${config.colorScheme.palette.base08}    # accent1 (red)
        set -g fish_color_valid_path --underline
        # Interactive colors
        set -g fish_color_match ${config.colorScheme.palette.base0B}       # accent4 (green)
        set -g fish_color_selection --background=${config.colorScheme.palette.base02} # overlay
        set -g fish_color_search_match --background=${config.colorScheme.palette.base02} # overlay
        set -g fish_color_history_current --bold
        set -g fish_color_user ${config.colorScheme.palette.base0B}        # accent4 (green)
        set -g fish_color_host ${config.colorScheme.palette.base0D}        # accent6 (blue)
        set -g fish_color_cancel -r
        # Pager colors
        set -g fish_pager_color_completion normal
        set -g fish_pager_color_description ${config.colorScheme.palette.base03} # muted
        set -g fish_pager_color_prefix ${config.colorScheme.palette.base0E}      # accent7 (purple)
        set -g fish_pager_color_progress ${config.colorScheme.palette.base0B}    # accent4 (green)
      '';
      loginShellInit = ''
        set -x NIX_PATH nixpkgs=channel:nixos-unstable
        set -x NIX_LOG info
        set -x WEBKIT_DISABLE_COMPOSITING_MODE 1
        set -x TERMINAL ghostty
        set -x EDITOR nvim
        set -x VISUAL zed
        set -x XDG_DATA_HOME $HOME/.local/share
        set -x FZF_CTRL_R_OPTS "
        --preview='bat --color=always -n {}'
        --preview-window up:3:hidden:wrap
        --bind 'ctrl-/:toggle-preview'
        --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'
        --color header:bold
        --header 'Press CTRL-Y to copy command into clipboard'"
        set -x FZF_DEFAULT_COMMAND fd --type f --exclude .git --follow --hidden
        set -x FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
        set -x FLAKE $HOME/p/nixos/nixos-config
        source /run/agenix/${config.home.username}-secrets
        if test (tty) = "/dev/tty1"
          exec uwsm start -F /run/current-system/sw/bin/Hyprland
        end
        if test (tty) = "/dev/tty2"
          exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
        end
      '';
      shellAbbrs = {
        ".." = "cd ..";
        "..." = "cd ../..";
        b = "yazi";
        ls = "eza";
        l = "eza -l --icons --git -a";
        lt = "eza --tree --level=2 --long --icons --git";
        grep = "rg";
        ps = "procs";
        just = "just --unstable";
        node = "bun";
        npx = "bunx";
        fs = "du -ah . | sort -hr | head -n 10";
        n = "nix";
        nd = "nix develop -c $SHELL";
        ns = "nix shell";
        nsn = "nix shell nixpkgs#";
        nb = "nix build";
        nbn = "nix build nixpkgs#";
        nf = "nix flake";
        nr = "sudo nixos-rebuild --flake .";
        nrs = "sudo nixos-rebuild switch --flake .#(uname -n)";
        snr = "sudo nixos-rebuild --flake .";
        snrs = "sudo nixos-rebuild --flake . switch";
        hm = "home-manager --flake .";
        hms = "home-manager --flake . switch";
        hmr = "cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch";
        tsu = "sudo tailscale up";
        tsd = "sudo tailscale down";
        vi = "nvim";
        vim = "nvim";
      };
    };
  };
 }
@@ -1,40 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.fzf;
 in {
  options.features.cli.fzf.enable = mkEnableOption "enable fuzzy finder";
  config = mkIf cfg.enable {
    programs.fzf = {
      enable = true;
      enableFishIntegration = true;
      colors = {
        "fg" = "#${config.colorScheme.palette.base05}";
        "bg" = "#${config.colorScheme.palette.base00}";
        "hl" = "#${config.colorScheme.palette.base0E}";
        "fg+" = "#${config.colorScheme.palette.base05}";
        "bg+" = "#${config.colorScheme.palette.base02}";
        "hl+" = "#${config.colorScheme.palette.base0E}";
        "info" = "#${config.colorScheme.palette.base09}";
        "prompt" = "#${config.colorScheme.palette.base0B}";
        "pointer" = "#${config.colorScheme.palette.base08}";
        "marker" = "#${config.colorScheme.palette.base08}";
        "spinner" = "#${config.colorScheme.palette.base09}";
        "header" = "#${config.colorScheme.palette.base03}";
      };
      defaultOptions = [
        "--preview='bat --color=always -n {}'"
        "--bind 'ctrl-/:toggle-preview'"
        "--header 'Press CTRL-Y to copy command into clipboard'"
        "--bind 'ctrl-/:toggle-preview'"
        "--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
      ];
      defaultCommand = "fd --type f --exclude .git --follow --hidden";
      changeDirWidgetCommand = "fd --type d --exclude .git --follow --hidden";
    };
  };
 }
@@ -1,15 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.cli.nitch;
 in {
  options.features.cli.nitch.enable = mkEnableOption "enable nitch";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [nitch];
  };
 }
@@ -1,91 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.nushell;
 in {
  options.features.cli.nushell.enable = mkEnableOption "enable nushell";
  config = mkIf cfg.enable {
    programs.nushell = {
      enable = true;
      envFile.text = ''
        $env.config.show_banner = false
        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
        $env.NIX_LOG = "iunfo"
        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
        $env.TERMINAL = "ghostty"
        $env.EDITOR = "nvim"
        $env.VISUAL = "zeditor"
        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always -n {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy command into clipboard' --bind 'ctrl-/:toggle-preview' --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort' --color bg:#282a36,bg+:#44475a,fg:#f8f8f2,fg+:#f8f8f2,header:#6272a4,hl:#bd93f9,hl+:#bd93f9,info:#ffb86c,marker:#ff79c6,pointer:#ff79c6,prompt:#50fa7b,spinner:#ffb86c"
        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
        $env.NPM_CONFIG_PREFIX = $"($env.HOME)/.npm-global"
        $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
        # Load kestractl-env from agenix
        if ("/run/agenix/kestractl-env" | path exists) {
          open /run/agenix/kestractl-env
            | lines
            | where {($in | str trim | str length) > 0}
            | parse "{key}={value}"
            | update value {str trim -c '"'}
            | transpose -r -d
            | load-env
        }
      '';
      # if (tty) == "/dev/tty1" {
      #   exec uwsm start -S -F /run/current-system/sw/bin/Hyprland
      # }
      # if (tty) == "/dev/tty2" {
      #   exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
      # }
      configFile.text = ''
        # Aliases
        alias .. = cd ..
        alias ... = cd ...
        alias h = cd $env.HOME
        alias b = yazi
        alias lt = eza --tree --level=2 --long --icons --git
        alias grep = rg
        alias just = just --unstable
        alias node = bun
        alias npx = bunx
        alias n = nix
        alias nd = nix develop -c $nu.current-shell
        alias ns = nix shell
        alias nsn = nix shell nixpkgs#
        alias nb = nix build
        alias nbn = nix build nixpkgs#
        alias nf = nix flake
        alias nr = sudo nixos-rebuild --flake .
        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
        alias snr = sudo nixos-rebuild --flake .
        alias snrs = sudo nixos-rebuild --flake . switch
        alias hm = home-manager --flake .
        alias hms = home-manager --flake . switch
        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
        alias tsu = sudo tailscale up
        alias tsd = sudo tailscale down
        alias vi = nvim
        alias vim = nvim
        if (which tv | is-not-empty) {
          mkdir ($nu.data-dir | path join "vendor/autoload")
          tv init nu | save -f ($nu.data-dir | path join "vendor/autoload/tv.nu")
        }
      '';
    };
  };
 }
@@ -1,22 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.cli.secrets;
 in {
  options.features.cli.secrets.enable = mkEnableOption "enable secrets";
  config = mkIf cfg.enable {
    programs.password-store = {
      enable = true;
      package =
        pkgs.pass-wayland.withExtensions
        (exts: [exts.pass-otp exts.pass-import]);
      settings = {PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store";};
    };
    home.packages = with pkgs; [pinentry-gnome3];
  };
 }
@@ -1,68 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.starship;
 in {
  options.features.cli.starship.enable = mkEnableOption "enable starship prompt";
  config = mkIf cfg.enable {
    programs.starship = {
      enable = true;
      enableFishIntegration = true;
      enableNushellIntegration = true;
      settings = {
        format = "$all$character";
        palette = "universal";
        palettes.universal = {
          background = "#${config.colorScheme.palette.base00}";
          surface = "#${config.colorScheme.palette.base01}";
          muted = "#${config.colorScheme.palette.base03}";
          text = "#${config.colorScheme.palette.base05}";
          bright = "#${config.colorScheme.palette.base07}";
          accent1 = "#${config.colorScheme.palette.base08}";
          accent2 = "#${config.colorScheme.palette.base09}";
          accent3 = "#${config.colorScheme.palette.base0A}";
          accent4 = "#${config.colorScheme.palette.base0B}";
          accent5 = "#${config.colorScheme.palette.base0C}";
          accent6 = "#${config.colorScheme.palette.base0D}";
          accent7 = "#${config.colorScheme.palette.base0E}";
        };
        character = {
          success_symbol = "[❯](accent7)";
          error_symbol = "[❯](accent1)";
        };
        directory = {
          style = "accent6";
          truncation_length = 3;
          truncate_to_repo = false;
        };
        git_branch = {
          style = "accent7";
        };
        git_status = {
          style = "accent5";
        };
        cmd_duration = {
          style = "accent3";
        };
        hostname = {
          style = "accent4";
        };
        username = {
          style_user = "accent2";
        };
      };
    };
  };
 }
@@ -1,64 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.television;
 in {
  options.features.cli.television.enable = mkEnableOption "enable nitch";
  config = mkIf cfg.enable {
    programs.television = {
      enable = true;
      channels = {
        tldr = {
          metadata = {
            description = "Browse TLDR pages";
            name = "tldr";
            requirements = [
              "tldr"
            ];
          };
          preview = {
            command = "tldr '{}'";
          };
          source = {
            command = "tldr --list";
          };
        };
        git-diff = {
          metadata = {
            description = "A channel to select files from git diff commands";
            name = "git-diff";
            requirements = [
              "git"
            ];
          };
          preview = {
            command = "git diff HEAD --color=always -- '{}'";
          };
          source = {
            command = "git diff --name-only HEAD";
          };
        };
        git-log = {
          metadata = {
            description = "A channel to select from git log entries";
            name = "git-log";
            requirements = [
              "git"
            ];
          };
          preview = {
            command = "git show -p --stat --pretty=fuller --color=always '{0}'";
          };
          source = {
            command = "git log --oneline --date=short --pretty=\"format:%h %s %an %cd\" \"$@\"";
            output = "{split: :0}";
          };
        };
      };
    };
  };
 }
@@ -1,32 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.cli.zellij;
 in {
  options.features.cli.zellij.enable = mkEnableOption "enable tmux";
  config = mkIf cfg.enable {
    programs.zellij = {
      enable = true;
      settings = {
        theme = "universal";
        themes.universal = {
          bg = "#${config.colorScheme.palette.base00}";
          fg = "#${config.colorScheme.palette.base05}";
          black = "#${config.colorScheme.palette.base01}";
          red = "#${config.colorScheme.palette.base08}";
          green = "#${config.colorScheme.palette.base0B}";
          yellow = "#${config.colorScheme.palette.base0A}";
          blue = "#${config.colorScheme.palette.base0D}";
          magenta = "#${config.colorScheme.palette.base0E}";
          cyan = "#${config.colorScheme.palette.base0C}";
          white = "#${config.colorScheme.palette.base07}";
          orange = "#${config.colorScheme.palette.base09}";
        };
      };
    };
  };
 }
@@ -1,101 +0,0 @@
 {
  config,
  inputs,
  pkgs,
  videoDrivers,
  ...
 }: let
  npmGlobalPrefix = "${config.home.homeDirectory}/.npm-global";
 in {
  home.file.".npmrc".text = ''
    prefix=${npmGlobalPrefix}
  '';
  home.sessionVariables.NPM_CONFIG_PREFIX = npmGlobalPrefix;
  imports = [
    ./opencode.nix
    ./pi.nix
  ];
  coding.agents.skills = {
    agentsInput = inputs.agents;
    externalSkills = [
      {
        src = inputs.skills-anthropic;
        selectSkills = ["pdf" "docx" "frontend-design"];
      }
      {src = inputs.skills-vercel;}
      {src = inputs.skills-basecamp;}
      {src = inputs.skills-kestra;}
    ];
  };
  programs.mcp = {
    enable = true;
    servers = {
      DeepWiki = {
        url = "https://mcp.deepwiki.com/mcp";
      };
      Ref = {
        command = "bash";
        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
      };
      Exa = {
        command = "bash";
        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
      };
      Outline = {
        url = "https://wiki.az-gruppe.com/mcp";
      };
      ContextMode = {
        command = "bash";
        args = ["-c" "exec bunx context-mode@latest"];
      };
      Honcho = {
        command = "bash";
        args = [
          "-c"
          ''exec bunx mcp-remote@latest https://mcp.honcho.dev --header "Authorization:Bearer $(cat /run/agenix/honcho-key)" --header "X-Honcho-User-Name:m3tam3re"''
        ];
      };
    };
  };
  home.packages = with pkgs; [
    agenix-cli
    agent-browser
    alejandra
    bc
    bun
    devpod
    #devpod-desktop
    gnumake
    cmake
    (python3.withPackages (ps:
      with ps; [
        pip
        uv
        # Scientific packages
        numba
        numpy
        torch
        srt
      ]))
    pyrefly
    nixd
    nix-update
    nodejs
    # opencode-desktop
    (qmd.override {
      vulkanSupport = videoDrivers == ["amdgpu"];
      cudaSupport = videoDrivers == ["nvidia"];
    })
    openshell
    openspec
    pi-coding-agent
    alejandra
    sidecar
    tailwindcss
    tailwindcss-language-server
    td
  ];
 }
@@ -1,116 +0,0 @@
 {
  inputs,
  lib,
  ...
 }: {
  coding.agents.opencode = {
    enable = true;
    agentsInput = inputs.agents;
  };
  coding.opencode = {
    enable = true;
    ohMyOpencodeSettings = {
      agents = {
        sisyphus.model = "litellm/claude-opus-4-6";
        oracle.model = "litellm/claude-sonnet-4-6";
        librarian.model = "litellm/claude-sonnet-4-6";
        explore.model = "litellm/claude-haiku-4-5";
        multimodal-looker.model = "litellm/gpt-5.3-codex";
        prometheus.model = "litellm/claude-opus-4-6";
        metis.model = "litellm/claude-opus-4-6";
        momus.model = "litellm/claude-opus-4-6";
        atlas.model = "litellm/claude-sonnet-4-6";
      };
      categories = {
        visual-engineering.model = "zai-coding-plan/glm-5.1";
        ultrabrain.model = "litellm/claude-opus-4-6";
        deep.model = "litellm/claude-sonnet-4-6";
        artistry.model = "zai-coding-plan/glm-5.1";
        quick.model = "litellm/claude-haiku-4-5";
        unspecified-low.model = "litellm/claude-sonnet-4-6";
        unspecified-high.model = "litellm/claude-opus-4-6";
        writing.model = "zai-coding-plan/glm-5.1";
      };
    };
  };
  # Keep TUI settings in programs.opencode.tui to satisfy OpenCode v1.2.15+.
  programs.opencode.tui.theme = "opencode";
  # Override legacy default settings to avoid deprecated TUI keys in settings.
  programs.opencode.settings = lib.mkForce {
    plugin = ["oh-my-openagent"];
    formatter = {
      alejandra = {
        command = ["alejandra" "-q" "-"];
        extensions = [".nix"];
      };
    };
    # AZ-Gruppe LiteLLM endpoint + available models
    provider = {
      litellm = {
        npm = "@ai-sdk/openai-compatible";
        name = "LiteLLM (AZ-Gruppe)";
        options.baseURL = "https://llm.az-gruppe.com/v1";
        models = {
          "gpt-5.2" = {
            name = "GPT-5.2";
            limit = {
              context = 400000;
              output = 128000;
            };
          };
          "gpt-5.3-codex" = {
            name = "GPT-5.3 Codex";
            limit = {
              context = 400000;
              output = 128000;
            };
          };
          "claude-haiku-4-5" = {
            name = "Claude Haiku 4.5";
            options = {
              thinking = {
                type = "enabled";
                budget_tokens = 16000;
              };
            };
            limit = {
              context = 200000;
              output = 64000;
            };
          };
          "claude-sonnet-4-6" = {
            name = "Claude Sonnet 4.6";
            options = {
              thinking = {
                type = "enabled";
                budget_tokens = 16000;
              };
            };
            limit = {
              context = 200000;
              output = 64000;
            };
          };
          "claude-opus-4-6" = {
            name = "Claude Opus 4.6";
            options = {
              thinking = {
                type = "enabled";
                budget_tokens = 16000;
              };
            };
            limit = {
              context = 200000;
              output = 128000;
            };
          };
        };
      };
    };
  };
 }
@@ -1,57 +0,0 @@
 {inputs, ...}: {
  coding.agents.pi = {
    enable = true;
    agentsInput = inputs.agents;
    modelOverrides = {
      chiron = "minimax/MiniMax-M2.7";
      chiron-forge = "minimax/MiniMax-M2.7";
    };
    # Coding rules for Pi agent
    # Rules sourced from AGENTS repo
    codingRules = {
      # Language-specific rules
      languages = [
        "nix" # Nix language conventions
      ];
      # Standard concerns from AGENTS repo
      concerns = [
        "coding-style" # General coding principles
        "naming" # Naming conventions (camelCase, snake_case, etc.)
        "documentation" # Documentation standards
        "testing" # Testing guidelines (Arrange-Act-Assert)
        "git-workflow" # Conventional commits, branch naming
        "project-structure" # Project layout conventions
      ];
      # No framework-specific rules for NixOS config
      frameworks = [];
    };
    settings = {
      packages = [
        "npm:@thesethrose/pi-zai-provider"
        "npm:pi-mcp-adapter"
        "npm:pi-subagents"
        "npm:pi-lens"
        "npm:pi-web-access"
        "npm:pi-prompt-template-model"
        "npm:@plannotator/pi-extension"
        "npm:pi-powerline-footer"
        "npm:pi-markdown-preview"
        "npm:pi-gsd"
        "npm:pi-tool-display"
        "npm:pi-agent-browser-native"
        "git:github.com/hk-vk/pi-connect"
      ];
      defaultProvider = "minimax";
      defaultModel = "MiniMax-M2.7";
      defaultThinkingLevel = "high";
    };
    # MCP servers auto-inherited from programs.mcp in default.nix
  };
 }
@@ -1,79 +0,0 @@
 # DESKTOP FEATURES (home-manager)
 **Wayland/Hyprland environment with color-coordinated tooling**
 ## OVERVIEW
 12 modular desktop features with nix-colors (Dracula) integration across all components.
 ## STRUCTURE
 ```
 desktop/
 ├── default.nix       # Imports + XDG + Kitty config
 ├── coding.nix        # Development tools (VSCode, etc.)
 ├── crypto.nix        # Crypto wallets/tools
 ├── fonts.nix         # Font packages
 ├── gaming.nix        # Gaming tools/Steam
 ├── hyprland.nix      # Hyprland WM configuration
 ├── media.nix         # Media players/editors
 ├── office.nix        # LibreOffice, document tools
 ├── rofi.nix          # Application launcher
 ├── theme.nix         # GTK/Qt theming
 ├── wayland.nix       # Wayland utilities
 └── webapps.nix       # Browser-based apps
 ```
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
 | Add desktop app | Relevant feature .nix | Update home.packages |
 | Configure Hyprland | hyprland.nix | Window manager settings |
 | Fix colors | Check colorScheme references | Uses config.colorScheme.palette.base* |
 | Add font | fonts.nix | Increases system closure size |
 ## CONVENTIONS
 ### Color Scheme Integration
 All color-aware tools reference `config.colorScheme.palette.base00` through `base0F`:
 - **base00-07**: Grayscale (dark to light)
 - **base08**: Red/errors
 - **base09**: Orange
 - **base0A**: Yellow/strings
 - **base0B**: Green/functions
 - **base0C**: Cyan
 - **base0D**: Blue/types
 - **base0E**: Purple/constants
 - **base0F**: Brown
 Template:
 ```nix
 foreground = "#${config.colorScheme.palette.base05}";
 background = "#${config.colorScheme.palette.base00}";
 ```
 ### Session Variables
 Set in default.nix for Wayland/Hyprland:
 ```nix
 NIXOS_OZONE_WL = "1";
 QT_QPA_PLATFORM = "wayland";
 XDG_CURRENT_DESKTOP = "Hyprland";
 ```
 ### XDG Defaults
 - **PDF**: okular
 - **Text**: nvim
 - **Browser**: Zen (io.github.zen_browser.zen)
 - **Archive**: file-roller
 ## ANTI-PATTERNS
 - **DON'T** hardcode hex colors - use colorScheme palette
 - **DON'T** install fonts globally - keep in user packages
 - **DON'T** bypass XDG defaults - set in mimeApps
 ## NOTES
 - Kitty terminal configured in default.nix (not separate file)
 - Bibata-Modern-Ice cursor theme hardcoded
 - Session path includes cargo, npm-global, bun
 - Desktop features are always-enabled (no feature flags in this dir)
@@ -1,23 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.coding;
 in {
  options.features.desktop.coding.enable =
    mkEnableOption "install coding related stuff";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      bruno
      insomnia
    ];
    coding.editors = {
      neovim.enable = true;
      zed.enable = true;
    };
  };
 }
@@ -1,15 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.crypto;
 in {
  options.features.desktop.crypto.enable = mkEnableOption "Enable Crypto";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
  };
 }
@@ -1,162 +0,0 @@
 {
  config,
  pkgs,
  ...
 }: {
  imports = [
    ./coding.nix
    ./crypto.nix
    ./fonts.nix
    ./gaming.nix
    ./hyprland.nix
    ./media.nix
    ./obsidian.nix
    ./office.nix
    ./rofi.nix
    ./theme.nix
    ./wallpapers.nix
    ./wayland.nix
    ./webapps.nix
  ];
  xdg = {
    enable = true;
    configFile."mimeapps.list".force = true;
    mimeApps = {
      enable = true;
      associations.added = {
        "application/zip" = ["org.gnome.FileRoller.desktop"];
        "application/csv" = ["calc.desktop"];
        "application/pdf" = ["okularApplication_pdf.desktop"];
      };
      defaultApplications = {
        "application/zip" = ["org.gnome.FileRoller.desktop"];
        "application/csv" = ["calc.desktop"];
        "application/pdf" = ["okularApplication_pdf.desktop"];
        "application/md" = ["nvim.desktop"];
        "application/text" = ["nvim.desktop"];
        "x-scheme-handler/http" = ["io.github.zen_browser.zen"];
        "x-scheme-handler/https" = ["io.github.zen_browser.zen"];
      };
    };
    userDirs = {
      enable = true;
      createDirectories = true;
      setSessionVariables = true;
    };
  };
  home.sessionVariables = {
    WEBKIT_DISABLE_COMPOSITING_MODE = "1";
    NIXOS_OZONE_WL = "1";
    TERMINAL = "ghostty";
    QT_QPA_PLATFORM = "wayland";
    XDG_CURRENT_DESKTOP = "Hyprland";
    XDG_SESSION_TYPE = "wayland";
    XDG_SESSION_DESKTOP = "Hyprland";
  };
  home.sessionPath = ["\${XDG_BIN_HOME}" "\${HOME}/.cargo/bin" "$HOME/.npm-global/bin" "$HOME/.cache/.bun/bin"];
  fonts.fontconfig.enable = true;
  programs.ghostty = {
    enable = true;
    enableFishIntegration = true;
    enableBashIntegration = true;
    settings = {
      font-family = "Fira Code";
      copy-on-select = true;
      # Base colors from nix-colors
      foreground = "#${config.colorScheme.palette.base05}";
      background = "#${config.colorScheme.palette.base00}";
      selection-foreground = "#${config.colorScheme.palette.base07}";
      selection-background = "#${config.colorScheme.palette.base02}";
      # Cursor
      cursor-color = "#${config.colorScheme.palette.base05}";
      # Palette (16 colors)
      palette = [
        "0=#${config.colorScheme.palette.base01}"
        "1=#${config.colorScheme.palette.base08}"
        "2=#${config.colorScheme.palette.base0B}"
        "3=#${config.colorScheme.palette.base0A}"
        "4=#${config.colorScheme.palette.base0D}"
        "5=#${config.colorScheme.palette.base0E}"
        "6=#${config.colorScheme.palette.base0C}"
        "7=#${config.colorScheme.palette.base05}"
        "8=#${config.colorScheme.palette.base03}"
        "9=#${config.colorScheme.palette.base08}"
        "10=#${config.colorScheme.palette.base0B}"
        "11=#${config.colorScheme.palette.base0A}"
        "12=#${config.colorScheme.palette.base0D}"
        "13=#${config.colorScheme.palette.base0E}"
        "14=#${config.colorScheme.palette.base0C}"
        "15=#${config.colorScheme.palette.base07}"
      ];
    };
  };
  home.pointerCursor = {
    gtk.enable = true;
    package = pkgs.bibata-cursors;
    name = "Bibata-Modern-Ice";
    size = 20;
  };
  home.packages = with pkgs; [
    appimage-run
    # blueberry
    bemoji
    brave
    # brightnessctl
    # clipman
    distrobox
    eigent
    (element-desktop.override {
      commandLineArgs = "--password-store=gnome-libsecret";
    })
    launch-webapp
    # eww
    # firefox-devedition
    file-roller
    hyprpanel
    seahorse
    sushi
    # glib
    # google-chrome
    # gsettings-desktop-schemas
    # graphviz
    ksnip
    msty-studio
    nwg-look
    # opencode-desktop
    # pamixer
    # pavucontrol
    # libsForQt5.qtstyleplugins
    # stable.nyxt
    # pcmanfm
    rose-pine-hyprcursor
    # qt5ct
    # qt6.qtwayland
    #rustdesk
    # socat
    # unrar
    # unzip
    # usbutils
    # v4l-utils
    remmina
    slack
    telegram-desktop
    vivaldi
    vivaldi-ffmpeg-codecs
    vibetyper
    # wl-clipboard
    # wlogout
    # wtype
    # xdg-utils
    # ydotool
    # zip
  ];
 }
@@ -1,24 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.fonts;
 in {
  options.features.desktop.fonts.enable =
    mkEnableOption "install additional fonts for desktop apps";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      fira-code
      fira-code-symbols
      nerd-fonts.fira-code
      nerd-fonts.jetbrains-mono
      font-manager
      font-awesome_5
      noto-fonts
    ];
  };
 }
@@ -1,22 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.gaming;
 in {
  options.features.desktop.gaming.enable =
    mkEnableOption "install gaming related stuff";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      gamescope
      gamemode
      goverlay
      mangohud
      protonplus
    ];
  };
 }
@@ -1,323 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.hyprland;
 in {
  options.features.desktop.hyprland.enable =
    mkEnableOption "Hyprland related stuff";
  config = mkIf cfg.enable {
    wayland.windowManager.hyprland = {
      settings = {
        xwayland = {
          force_zero_scaling = true;
        };
        exec-once = [
          "hyprpanel"
          "while ! hyprpaper-random; do sleep 0.5; done"
          "wl-paste --type text --watch cliphist store" # Stores only text data
          "wl-paste --type image --watch cliphist store" # Stores only image data "wl-paste -p -t text --watch clipman store -P --histpath=\"~/.local/share/clipman-primary.json\""
          "vibetyper"
        ];
        env = [
          "XCURSOR_SIZE,32"
          "HYPRCURSOR_THEME,Bibata-Modern-Ice"
          "WLR_NO_HARDWARE_CURSORS,1"
          "GTK_THEME,Dracula"
          "XDG_CURRENT_DESKTOP,Hyprland"
          "XDG_SESSION_TYPE,wayland"
          "XDG_SESSION_DESKTOP,Hyprland"
          "XKB_DEFAULT_LAYOUT,de"
          "NIXOS_OZONE_WL,1"
        ];
        input = {
          kb_layout = "de,us";
          kb_variant = "";
          kb_model = "";
          kb_rules = "";
          kb_options = "ctrl:nocaps";
          follow_mouse = 1;
        };
        general = {
          gaps_in = 5;
          gaps_out = 5;
          border_size = 1;
          # Keeping the existing active border as requested
          "col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
          "col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
          layout = "dwindle";
        };
        decoration = {
          shadow = {
            enabled = true;
            range = 60;
            render_power = 3;
            color = "rgba(${config.colorScheme.palette.base00}66)";
            offset = "1 2";
            scale = 0.97;
          };
          rounding = 8;
          blur = {
            enabled = true;
            size = 3;
            passes = 3;
          };
          active_opacity = 0.9;
          inactive_opacity = 0.5;
        };
        animations = {
          enabled = true;
          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
          animation = [
            "windows, 1, 7, myBezier"
            "windowsOut, 1, 7, default, popin 80%"
            "border, 1, 10, default"
            "borderangle, 1, 8, default"
            "fade, 1, 7, default"
            "workspaces, 1, 6, default"
          ];
        };
        dwindle = {
          pseudotile = true;
          preserve_split = true;
        };
        master = {
          new_status = "master";
        };
        device = [
          {
            name = "epic-mouse-v1";
            sensitivity = -0.5;
          }
          {
            name = "zsa-technology-labs-moonlander-mark-i";
            kb_layout = "us";
          }
          {
            name = "keychron-keychron-k7";
            kb_layout = "us";
          }
        ];
        windowrule = [
          # Floating dialogs
          "match:class file_progress, float on"
          "match:class confirm, float on"
          "match:class dialog, float on"
          "match:class download, float on"
          "match:class notification, float on"
          "match:class error, float on"
          "match:class splash, float on"
          "match:class confirmreset, float on"
          "match:title Open File, float on"
          "match:title branchdialog, float on"
          "match:class pavucontrol-qt, float on"
          "match:class pavucontrol, float on"
          "match:class class:^(espanso)$, float on"
          # wlogout
          "match:class wlogout, fullscreen on"
          "match:title wlogout, float on"
          "match:title wlogout, fullscreen on"
          # mpv
          "match:class mpv, float on"
          "match:class mpv, idle_inhibit focus"
          "match:class mpv, opacity 1.0 override"
          # Media/Volume/PiP
          "match:title ^(Media viewer)$, float on"
          "match:title ^(Volume Control)$, float on"
          "match:title ^(Picture-in-Picture)$, float on"
          # Pomodoro timer
          "match:title ^(floating-pomodoro)$, float on"
          "match:title ^(floating-pomodoro)$, size 250 50"
          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
          "match:title ^(floating-pomodoro)$, pin on"
          # Streamlabs overlays
          "match:initial_title .*streamlabs.com.*, float on"
          "match:initial_title .*streamlabs.com.*, pin on"
          "match:initial_title .*streamlabs.com.*, size 800 400"
          "match:initial_title .*alert-box.*, move 100%-820 102"
          "match:initial_title .*chat-box.*, move 100%-820 512"
          "match:initial_title .*streamlabs.com.*, opacity 0.5 override"
          "match:initial_title .*streamlabs.com.*, idle_inhibit focus"
          "match:initial_title .*streamlabs.com.*, no_anim on"
          "match:initial_title .*streamlabs.com.*, decorate off"
          "match:initial_title .*streamlabs.com.*, no_shadow on"
          "match:initial_title .*streamlabs.com.*, no_blur on"
          # Vibetyper recording indicator
          "match:class ^vibe-typer$, match:title ^Recording Indicator$, no_blur on"
          "border_color rgb(ffffff), match:xwayland 1"
        ];
        "$mainMod" = "SUPER";
        "$terminal" = "ghostty";
        bind = [
          "$mainMod, return, exec, $terminal nu -c zellij-ps"
          # "$mainMod, t, exec, warp-terminal"
          "$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
          "$mainMod SHIFT, t, exec, launch-timer"
          "$mainMod, n, exec, $terminal -e nvim"
          "$mainMod, z, exec, uwsm app -- zeditor"
          "$mainMod, o, exec, hyprctl dispatch setprop activewindow opaque toggle"
          "$mainMod, r, exec, hyprctl dispatch focuswindow \"initialtitle:.*alert-box.*\" && hyprctl dispatch moveactive exact 4300 102 && hyprctl dispatch focuswindow \"initialtitle:.*chat-box.*\" && hyprctl dispatch moveactive exact 4300 512"
          "$mainMod, b, exec, uwsm app -- thunar"
          "$mainMod SHIFT, B, exec, uwsm app -- vivaldi"
          "$mainMod, Escape, exec, uwsm app -- wlogout -p layer-shell"
          "$mainMod, Space, togglefloating"
          "$mainMod, q, killactive"
          "$mainMod, M, exit"
          "$mainMod, F, fullscreen"
          "$mainMod SHIFT, V, togglefloating"
          "$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
          "$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
          "$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
          "$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
          "$mainMod, P, exec, uwsm app -- rofi-pass"
          "$mainMod SHIFT, P, pseudo"
          "$mainMod, R, exec, stt-ptt start"
          "$mainMod, S, exec, stt-ptt start"
          "$mainMod, J, togglesplit"
          "$mainMod, h, movefocus, l"
          "$mainMod, l, movefocus, r"
          "$mainMod, k, movefocus, u"
          "$mainMod, j, movefocus, d"
          "$mainMod, 1, workspace, 1"
          "$mainMod, 2, workspace, 2"
          "$mainMod, 3, workspace, 3"
          "$mainMod, 4, workspace, 4"
          "$mainMod, 5, workspace, 5"
          "$mainMod, 6, workspace, 6"
          "$mainMod, 7, workspace, 7"
          "$mainMod, 8, workspace, 8"
          "$mainMod, 9, workspace, 9"
          "$mainMod, 0, workspace, 10"
          "$mainMod SHIFT, 1, movetoworkspace, 1"
          "$mainMod SHIFT, 2, movetoworkspace, 2"
          "$mainMod SHIFT, 3, movetoworkspace, 3"
          "$mainMod SHIFT, 4, movetoworkspace, 4"
          "$mainMod SHIFT, 5, movetoworkspace, 5"
          "$mainMod SHIFT, 6, movetoworkspace, 6"
          "$mainMod SHIFT, 7, movetoworkspace, 7"
          "$mainMod SHIFT, 8, movetoworkspace, 8"
          "$mainMod SHIFT, 9, movetoworkspace, 9"
          "$mainMod SHIFT, 0, movetoworkspace, 10"
          "$mainMod, mouse_down, workspace, e+1"
          "$mainMod, mouse_up, workspace, e-1"
        ];
        bindr = [
          "$mainMod, R, exec, stt-ptt stop"
          "$mainMod, S, exec, stt-ptt format-stop"
        ];
        bindm = [
          "$mainMod, mouse:272, movewindow"
          "$mainMod, mouse:273, resizewindow"
        ];
      };
    };
    services.hypridle = {
      enable = true;
      settings = {
        general = {
          before_sleep_cmd = "hyprlock";
          after_sleep_cmd = "hyprctl dispatch dpms on";
          inhibit_sleep = 3;
        };
        listener = [
          {
            timeout = 300; # 5 min
            on-timeout = "hyprlock";
          }
          {
            timeout = 420; # 5.5 min
            on-timeout = "hyprctl dispatch dpms off";
            on-resume = "hyprctl dispatch dpms on";
          }
        ];
      };
    };
    services.hyprpaper.enable = true;
    programs.hyprlock = {
      enable = true;
      settings = {
        "$font" = "JetBrainsMono Nerd Font";
        "$base" = "rgb(${config.colorScheme.palette.base00})";
        "$text" = "rgb(${config.colorScheme.palette.base05})";
        "$textAlpha" = "${config.colorScheme.palette.base05}";
        "$accentAlpha" = "${config.colorScheme.palette.base0D}";
        "$red" = "rgb(${config.colorScheme.palette.base08})";
        "$yellow" = "rgb(${config.colorScheme.palette.base0A})";
        general = {
          hide_cursor = true;
        };
        background = {
          monitor = "";
          path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
          blur_passes = 0;
          color = "rgb(${config.colorScheme.palette.base00})";
        };
        label = [
          {
            monitor = "";
            text = "$TIME";
            color = "$text";
            font_size = 90;
            font_family = "$font";
            position = "30, 0";
            halign = "left";
            valign = "top";
          }
          {
            monitor = "";
            text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
            color = "$text";
            font_size = 25;
            font_family = "$font";
            position = "30, -150";
            halign = "left";
            valign = "top";
          }
        ];
        input-field = [
          {
            monitor = "";
            size = "300, 60";
            outline_thickness = 4;
            dots_size = 0.2;
            dots_spacing = 0.2;
            dots_center = true;
            outer_color = "rgb(${config.colorScheme.palette.base0D})";
            inner_color = "rgb(${config.colorScheme.palette.base00})";
            font_color = "rgb(${config.colorScheme.palette.base05})";
            fade_on_empty = false;
            placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}">󰌾  Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
            hide_input = false;
            check_color = "rgb(${config.colorScheme.palette.base0D})";
            fail_color = "rgb(${config.colorScheme.palette.base08})";
            fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
            capslock_color = "rgb(${config.colorScheme.palette.base0A})";
            position = "0, -35";
            halign = "center";
            valign = "center";
          }
        ];
      };
    };
  };
 }
@@ -1,55 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.media;
 in {
  options.features.desktop.media.enable =
    mkEnableOption "enable media features";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      # handbrake
      # kdePackages.kdenlive
      # makemkv
      # mediainfo
      amf
      ffmpeg_6-full
      gimp
      gst_all_1.gstreamer
      gst_all_1.gst-vaapi
      handbrake
      inkscape
      kdePackages.kdenlive
      libation
      #makemkv
      pamixer
      pavucontrol
      qpwgraph
      v4l-utils
      plexamp
      # uxplay
      # vlc
      webcord
      # yt-dlp
      unimatrix
    ];
    programs = {
      mpv = {
        enable = true;
        bindings = {
          WHEEL_UP = "seek 10";
          WHEEL_DOWN = "seek -10";
        };
        config = {
          profile = "gpu-hq";
          ytdl-format = "bestvideo+bestaudio";
        };
      };
    };
  };
 }
@@ -1,25 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.obsidian;
 in {
  options.features.desktop.obsidian.enable =
    mkEnableOption "enable Obsidian knowledge base";
  config = mkIf cfg.enable {
    programs.obsidian.enable = true;
    xdg.mimeApps = {
      enable = true;
      associations.added = {
        "text/markdown" = ["obsidian.desktop"];
      };
      defaultApplications = {
        "text/markdown" = ["obsidian.desktop"];
      };
    };
  };
 }
@@ -1,18 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.office;
 in {
  options.features.desktop.office.enable =
    mkEnableOption "install office and paperwork stuff";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      libreoffice-fresh
    ];
  };
 }
@@ -1,206 +0,0 @@
 {
  config,
  pkgs,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.rofi;
 in {
  options.features.desktop.rofi.enable = mkEnableOption "enable rofi";
  config = mkIf cfg.enable {
    programs.rofi = with pkgs; {
      enable = true;
      package = rofi.override {
        plugins = [
          rofi-calc
          rofi-emoji
          stable.rofi-file-browser
        ];
      };
      pass = {
        enable = true;
        package = rofi-pass-wayland;
      };
      terminal = "${pkgs.ghostty}/bin/ghostty";
      font = "Fira Code";
      extraConfig = {
        show-icons = true;
        disable-history = false;
        modi = "drun,calc,emoji,filebrowser";
        kb-primary-paste = "Control+V,Shift+Insert";
        kb-secondary-paste = "Control+v,Insert";
      };
      theme = let
        inherit (config.colorScheme) palette;
      in
        builtins.toString (pkgs.writeText "rofi-universal-theme.rasi" ''
          * {
            /* Universal theme colors from nix-colors */
            background:  #${palette.base00};
            surface:     #${palette.base01};
            overlay:     #${palette.base02};
            muted:       #${palette.base03};
            subtle:      #${palette.base04};
            text:        #${palette.base05};
            bright-text: #${palette.base06};
            highlight:   #${palette.base07};
            accent1:     #${palette.base08};
            accent2:     #${palette.base09};
            accent3:     #${palette.base0A};
            accent4:     #${palette.base0B};
            accent5:     #${palette.base0C};
            accent6:     #${palette.base0D};
            accent7:     #${palette.base0E};
            accent8:     #${palette.base0F};
            /* Global properties */
            background-color: @background;
            text-color: @text;
            font: "Fira Code 12";
            border: 0;
            margin: 0;
            padding: 0;
            spacing: 0;
          }
          window {
            background-color: @background;
            border: 1px;
            border-color: @accent7;
            border-radius: 6px;
            width: 40%;
            padding: 16px;
          }
          inputbar {
            children: [ prompt, entry ];
            spacing: 12px;
            padding: 8px;
            border-radius: 4px;
            background-color: @surface;
          }
          prompt {
            text-color: @accent7;
            background-color: transparent;
          }
          entry {
            placeholder: "Search...";
            placeholder-color: @subtle;
            text-color: @text;
            background-color: transparent;
            cursor-color: @accent7;
          }
          message {
            background-color: @surface;
            border-radius: 4px;
            padding: 8px;
            margin: 8px 0;
          }
          textbox {
            text-color: @text;
            background-color: transparent;
          }
          listview {
            background-color: transparent;
            margin: 8px 0 0;
            lines: 10;
            columns: 1;
            fixed-height: true;
            scrollbar: false;
          }
          element {
            background-color: transparent;
            text-color: @text;
            padding: 8px;
            border-radius: 4px;
            spacing: 8px;
          }
          element normal.normal {
            background-color: transparent;
            text-color: @text;
          }
          element selected.normal {
            background-color: @accent7;
            text-color: @background;
          }
          element alternate.normal {
            background-color: transparent;
            text-color: @text;
          }
          element-icon {
            background-color: transparent;
            size: 24px;
          }
          element-text {
            background-color: transparent;
            text-color: inherit;
            vertical-align: 0.5;
          }
          mode-switcher {
            spacing: 0;
            background-color: @surface;
            border-radius: 4px;
            margin: 8px 0 0;
          }
          button {
            padding: 8px 16px;
            background-color: transparent;
            text-color: @text;
            border-radius: 4px;
          }
          button selected {
            background-color: @accent7;
            text-color: @background;
          }
          /* Scrollbar */
          scrollbar {
            width: 4px;
            border: 0;
            handle-color: @accent7;
            handle-width: 4px;
            padding: 0;
          }
        '');
    };
    cli.rofi-project-opener = {
      enable = true;
      projectDirs = {
        AI = {
          path = "~/p/AI";
          args = "";
        };
        CHAT = {
          path = "~/p/CHAT";
          args = "--agent chiron";
        };
        MISC = {
          path = "~/p/MISC";
          args = "--agent chiron-forge";
        };
        NIX = {
          path = "~/p/NIX";
          args = "";
        };
      };
      terminal = pkgs.ghostty;
      terminalCommand = "opencode %a";
    };
  };
 }
@@ -1,22 +0,0 @@
 {
  config,
  pkgs,
  ...
 }: {
  qt = {
    enable = true;
    platformTheme.name = "gtk";
  };
  gtk = {
    enable = true;
    theme = {
      name = "Dracula";
      package = pkgs.dracula-theme;
    };
    iconTheme = {
      name = "Dracula";
      package = pkgs.dracula-icon-theme;
    };
    gtk4.theme = config.gtk.theme;
  };
 }
@@ -1,18 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.wallpapers;
 in {
  options.features.desktop.wallpapers = mkEnableOption "Wallpapers for Hyprland";
  config = mkIf cfg {
    xdg.configFile."hypr/wallpapers" = {
      source = ../../m3tam3re/wallpapers;
      recursive = true;
    };
  };
 }
@@ -1,29 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.wayland;
 in {
  options.features.desktop.wayland.enable = mkEnableOption "wayland extra tools and config";
  config = mkIf cfg.enable {
    home.packages = with pkgs; [
      grim
      hyprcursor
      hyprlock
      hyprpaper
      qt6.qtwayland
      slurp
      waypipe
      wl-clipboard
      wf-recorder
      wl-mirror
      wlogout
      wtype
      ydotool
    ];
  };
 }
@@ -1,55 +0,0 @@
 {
  pkgs,
  lib,
  ...
 }: let
  icons = {
    teams = pkgs.fetchurl {
      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-teams.svg";
      sha256 = "sha256-Pr9QS8nnXJq97r4/G3c6JXi34zxHl0ps9gcyI8cN/s8=";
    };
    outlook = pkgs.fetchurl {
      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-outlook.svg";
      sha256 = "sha256-3u8t5QNHFZvrAegxBiGicO4PjtMWhEaQSCv7MSSfLLc=";
    };
    opencode = pkgs.fetchurl {
      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opencode-dark.svg";
      sha256 = "1lms4f8habamvdh2qqqz9psx4py9wx23mmlkkds44pvrbq3bkj3n";
    };
  };
 in {
  xdg.desktopEntries = {
    teams = {
      name = "Microsoft Teams";
      exec = "launch-webapp https://teams.microsoft.com";
      comment = "Open Microsoft Teams as a Desktop App";
      categories = ["Application" "Network" "Chat"];
      terminal = false;
      icon = icons.teams;
    };
    outlook = {
      name = "Microsoft Outlook";
      exec = "launch-webapp https://outlook.office.com/mail/";
      comment = "Open Microsoft Outlook as a Desktop App";
      categories = ["Application" "Network"];
      terminal = false;
      icon = icons.outlook;
    };
    basecamp = {
      name = "Basecamp";
      exec = "launch-webapp https://3.basecamp.com/5996442/";
      comment = "Open Basecamp as a Desktop App";
      categories = ["Application" "Network"];
      terminal = false;
      icon = "/home/sascha.koenig/.local/share/icons/basecamp-logo.png";
    };
    opencode = {
      name = "Opencode";
      exec = "rofi-project-opener";
      comment = "Open Opencode Terminal App";
      categories = ["Application" "Development"];
      terminal = false;
      icon = icons.opencode;
    };
  };
 }
@@ -1,121 +0,0 @@
 # This is a default home.nix generated by the follwing hone-manager command
 #
 # home-manager init ./
 {
  config,
  lib,
  pkgs,
  ...
 }: {
  # Home Manager needs a bit of information about you and the paths it should
  # manage.
  home.username = lib.mkDefault "your-name";
  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
  # This value determines the Home Manager release that your configuration is
  # compatible with. This helps avoid breakage when a new Home Manager release
  # introduces backwards incompatible changes.
  #
  # You should not change this value, even if you update Home Manager. If you do
  # want to update the value, then make sure to first check the Home Manager
  # release notes.
  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
  # The home.packages option allows you to install Nix packages into your
  # environment.
  home.packages = with pkgs; [
    # # Adds the 'hello' command to your environment. It prints a friendly
    # # "Hello, world!" when run.
    # pkgs.hello
    # # It is sometimes useful to fine-tune packages, for example, by applying
    # # overrides. You can do that directly here, just don't forget the
    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
    # # fonts?
    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
    # # You can also create simple shell scripts directly inside your
    # # configuration. For example, this adds a command 'my-hello' to your
    # # environment:
    # (pkgs.writeShellScriptBin "my-hello" ''
    #   echo "Hello, ${config.home.username}!"
    # '')
  ];
  # Home Manager is pretty good at managing dotfiles. The primary way to manage
  # plain files is through 'home.file'.
  home.file = {
    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
    # # symlink to the Nix store copy.
    # ".screenrc".source = dotfiles/screenrc;
    # # You can also set the file content immediately.
    # ".gradle/gradle.properties".text = ''
    #   org.gradle.console=verbose
    #   org.gradle.daemon.idletimeout=3600000
    # '';
  };
  # Home Manager can also manage your environment variables through
  # 'home.sessionVariables'. If you don't want to manage your shell through Home
  # Manager then you have to manually source 'hm-session-vars.sh' located at
  # either
  #
  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
  #
  # or
  #
  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
  #
  # or
  #
  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
  #
  home.sessionVariables = {
    # EDITOR = "emacs";
  };
  # Let Home Manager install and manage itself.
  programs.home-manager.enable = true;
  programs.git = {
    enable = true;
    signing.format = null;
    settings = {
      user = {
        name = "m3tm3re";
        email = "p@m3ta.dev";
      };
      core.excludesfile = "~/.gitignore_global";
      init.defaultBranch = "master";
      alias = {
        st = "status";
        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
      };
    };
  };
  # programs.zellij-ps = {
  #   enable = true;
  #   projectFolders = [
  #     "${config.home.homeDirectory}/p/c"
  #     "${config.home.homeDirectory}/p"
  #     "${config.home.homeDirectory}/.config"
  #   ];
  #   layout = ''
  #     layout {
  #         pane size=1 borderless=true {
  #             plugin location="zellij:tab-bar"
  #         }
  #         pane size="70%" command="nvim"
  #         pane split_direction="vertical" {
  #             pane
  #             pane command="unimatrix"
  #         }
  #         pane size=1 borderless=true {
  #             plugin location="zellij:status-bar"
  #         }
  #     }
  #   '';
  # };
 }
@@ -1,262 +0,0 @@
 # This is a default home.nix generated by the follwing hone-manager command
 #
 # home-manager init ./
 {
  config,
  lib,
  pkgs,
  ...
 }: {
  # Home Manager needs a bit of information about you and the paths it should
  # manage.
  home.username = lib.mkDefault "your-name";
  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
  # This value determines the Home Manager release that your configuration is
  # compatible with. This helps avoid breakage when a new Home Manager release
  # introduces backwards incompatible changes.
  #
  # You should not change this value, even if you update Home Manager. If you do
  # want to update the value, then make sure to first check the Home Manager
  # release notes.
  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
  # The home.packages option allows you to install Nix packages into your
  # environment.
  home.packages = with pkgs; [
    libgtop
    # # Adds the 'hello' command to your environment. It prints a friendly
    # # "Hello, world!" when run.
    # pkgs.hello
    # # It is sometimes useful to fine-tune packages, for example, by applying
    # # overrides. You can do that directly here, just don't forget the
    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
    # # fonts?
    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
    # # You can also create simple shell scripts directly inside your
    # # configuration. For example, this adds a command 'my-hello' to your
    # # environment:
    # (pkgs.writeShellScriptBin "my-hello" ''
    #   echo "Hello, ${config.home.username}!"
    # '')
  ];
  # Home Manager is pretty good at managing dotfiles. The primary way to manage
  # plain files is through 'home.file'.
  home.file = {
    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
    # # symlink to the Nix store copy.
    # ".screenrc".source = dotfiles/screenrc;
    # # You can also set the file content immediately.
    # ".gradle/gradle.properties".text = ''
    #   org.gradle.console=verbose
    #   org.gradle.daemon.idletimeout=3600000
    # '';
  };
  # Home Manager can also manage your environment variables through
  # 'home.sessionVariables'. If you don't want to manage your shell through Home
  # Manager then you have to manually source 'hm-session-vars.sh' located at
  # either
  #
  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
  #
  # or
  #
  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
  #
  # or
  #
  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
  #
  home.sessionVariables = {
    # EDITOR = "emacs";
  };
  # Let Home Manager install and manage itself.
  programs.home-manager.enable = true;
  services.cliphist = {
    enable = true;
    allowImages = true;
  };
  programs.git = {
    enable = true;
    signing.format = null;
    settings = {
      user = {
        name = "m3tm3re";
        email = "p@m3ta.dev";
      };
      core.excludesfile = "~/.gitignore_global";
      init.defaultBranch = "master";
      alias = {
        st = "status";
        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
      };
    };
  };
  programs.difftastic.enable = true;
  programs.jujutsu = {
    enable = true;
    settings = {
      user = {
        email = "m@m3tam3re.com";
        name = "Sascha Koenig";
      };
    };
  };
  programs.ssh = {
    enable = true;
    enableDefaultConfig = false;
    matchBlocks = {
      "AZ-CLD-1" = {
        hostname = "152.53.186.119";
        user = "sascha.koenig";
        port = 2022;
        identityFile = "~/.ssh/sascha.koenig";
      };
      "AZ-PRM-1" = {
        hostname = "192.168.152.76";
        user = "sascha.koenig";
        port = 2022;
        identityFile = "~/.ssh/sascha.koenig";
      };
      "github.com" = {
        hostname = "github.com";
        user = "m3tam3re";
        port = 22;
        identityFile = "~/.ssh/github";
      };
      "nikhil" = {
        hostname = "91.99.176.80";
        user = "nikhilmaddirala";
        identityFile = "~/.ssh/m3tam3re";
      };
      "code.m3ta.dev" = {
        hostname = "code.m3ta.dev";
        user = "m3tam3re";
        identityFile = "~/.ssh/gitea";
      };
      "git.az-gruppe.com" = {
        hostname = "git.az-gruppe.com";
        port = 2022;
        user = "sascha.koenig";
        identityFile = "~/.ssh/sascha.koenig";
      };
      "lkk-nix-1" = {
        hostname = "89.58.10.189";
        user = "lkk-admin";
        identityFile = "~/.ssh/lkk-admin";
      };
      "m3-r1" = {
        hostname = "202.61.226.110";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "lkk-prod-test" = {
        hostname = "192.168.122.215";
        user = "root";
        identityFile = "~/.ssh/m3tam3re";
      };
      "lkk-prod-1" = {
        hostname = "192.168.0.24";
        user = "root";
        identityFile = "~/.ssh/m3tam3re";
      };
      "lkk-prod-2" = {
        hostname = "192.168.0.20";
        user = "root";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-deck" = {
        hostname = "192.168.178.193";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-kratos-vm" = {
        hostname = "192.168.122.43";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-helios" = {
        hostname = "192.168.178.210";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-ares" = {
        hostname = "192.168.1.30";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-atlas" = {
        hostname = "152.53.85.162";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-hermes" = {
        hostname = "204.168.229.93";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-zelda" = {
        hostname = "95.217.189.186";
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-skynet" = {
        hostname = "m3-skynet";
        user = "admin";
        identityFile = "~/.ssh/m3tam3re";
      };
      "m3-prox-1" = {
        hostname = "192.168.1.110";
        user = "root";
        identityFile = "~/.ssh/m3tam3re";
      };
      "shp-old" = {
        hostname = "95.217.3.250";
        port = 2222;
        user = "m3tam3re";
        identityFile = "~/.ssh/self-host-playbook";
      };
      "shp-1" = {
        hostname = "95.217.189.186";
        port = 2222;
        user = "m3tam3re";
        identityFile = "~/.ssh/self-host-playbook";
      };
    };
  };
  # programs.zellij-ps = {
  #   enable = true;
  #   projectFolders = [
  #     "${config.home.homeDirectory}/p/c"
  #     "${config.home.homeDirectory}/p"
  #     "${config.home.homeDirectory}/.config"
  #   ];
  #   layout = ''
  #     layout {
  #         pane size=1 borderless=true {
  #             plugin location="zellij:tab-bar"
  #         }
  #         pane size="70%" command="nvim"
  #         pane split_direction="vertical" {
  #             pane
  #             pane command="unimatrix"
  #         }
  #         pane size=1 borderless=true {
  #             plugin location="zellij:status-bar"
  #         }
  #     }
  #   '';
  # };
 }
@@ -1,17 +0,0 @@
 {
  imports = [
    ../common
    ../features/cli
    ./home-server.nix
  ];
  features = {
    cli = {
      fish.enable = true;
      fzf.enable = true;
      nitch.enable = true;
      secrets.enable = false;
      starship.enable = true;
    };
  };
 }
@@ -1,19 +0,0 @@
 {
  imports = [
    ../common
    ../features/cli
    ../features/coding/opencode.nix
    ./home-server.nix
  ];
  coding.editors.neovim.enable = true;
  features = {
    cli = {
      nushell.enable = true;
      fzf.enable = true;
      nitch.enable = true;
      secrets.enable = false;
      starship.enable = true;
      zellij.enable = true;
    };
  };
 }
@@ -1,101 +0,0 @@
 {
  config,
  lib,
  ...
 }:
 with lib; let
  cfg = config.features.desktop.hyprland;
 in {
  imports = [
    ../common
    ./home.nix
    ../features/cli
    ../features/coding
    ../features/desktop
    #./services/librechat.nix
  ];
  options.features.desktop.hyprland.enable =
    mkEnableOption "enable Hyprland";
  config = mkMerge [
    # Base configuration
    {
      xdg = {
        # TODO: better structure
        enable = true;
        configFile."mimeapps.list".force = true;
        mimeApps = {
          enable = true;
          associations.added = {
            "application/zip" = ["org.gnome.FileRoller.desktop"];
            "application/csv" = ["calc.desktop"];
            "application/pdf" = ["vivaldi-stable.desktop"];
            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
          };
          defaultApplications = {
            "application/zip" = ["org.gnome.FileRoller.desktop"];
            "application/csv" = ["calc.desktop"];
            "application/pdf" = ["vivaldi-stable.desktop"];
            "application/md" = ["dev.zed.Zed.desktop"];
            "application/text" = ["dev.zed.Zed.desktop"];
            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
          };
        };
      };
      features = {
        cli = {
          fish.enable = true;
          nushell.enable = true;
          fzf.enable = true;
          nitch.enable = true;
          secrets.enable = true;
          starship.enable = true;
        };
        desktop = {
          coding.enable = true;
          crypto.enable = false;
          gaming.enable = false;
          hyprland.enable = false;
          media.enable = true;
          office.enable = false;
          rofi.enable = true;
          fonts.enable = true;
          wayland.enable = false;
        };
      };
    }
    (mkIf cfg.enable {
      wayland.windowManager.hyprland = {
        enable = true;
        settings = {
          monitor = [
            "eDP-1,preferred,0x0,1.25"
            "HDMI-A-1,preferred,2560x0,1"
          ];
          workspace = [
            "1, monitor:eDP-1, default:true"
            "2, monitor:eDP-1"
            "3, monitor:eDP-1"
            "4, monitor:HDMI-A-1"
            "5, monitor:HDMI-A-1,border:false,rounding:false"
            "6, monitor:HDMI-A-1"
          ];
          windowrule = [
            "match:class dev.zed.Zed, workspace 1"
            "match:class Msty, workspace 1"
            "match:class ^(com.obsproject.Studio)$, workspace 2"
            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
            "match:class ^steam_app_\\d+$, fullscreen on"
            "match:class ^steam_app_\\d+$, workspace 5"
            "match:class ^steam_app_\\d+$, idle_inhibit focus"
          ];
        };
      };
    })
  ];
 }
@@ -1,17 +0,0 @@
 {
  imports = [
    ../common
    ../features/cli
    ./home-server.nix
  ];
  features = {
    cli = {
      fish.enable = true;
      fzf.enable = true;
      nitch.enable = true;
      secrets.enable = false;
      starship.enable = true;
    };
  };
 }
@@ -1,17 +0,0 @@
 {
  imports = [
    ../common
    ../features/cli
    ./home-server.nix
  ];
  features = {
    cli = {
      fish.enable = true;
      fzf.enable = true;
      nitch.enable = true;
      secrets.enable = false;
      starship.enable = true;
    };
  };
 }
@@ -18,9 +18,11 @@
  environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
  home-manager = {
    useGlobalPkgs = true;
    useUserPackages = true;
    extraSpecialArgs = {
-      inherit inputs outputs system;
+      inputs = inputs // {agents = null;};
      inherit outputs system;
      videoDrivers = config.services.xserver.videoDrivers or [];
    };
  };
@@ -39,6 +39,11 @@
      outline = 3019;
      authentik = 3023;
      tuwunel = 3024;
      honcho = 3025;
      # Agent infrastructure
      hermes-api = 8642;
      hermes-dashboard = 9119;
      # Home automation
      homarr = 7575;
@@ -1,11 +1,215 @@
 # hosts/common/users/m3tam3re.nix — Central user definition with m3ta-home integration.
 #
 # This module:
 #   1. Creates the m3tam3re NixOS user
 #   2. Loads the m3ta-home profile system via mkHome
 #   3. Sets per-host feature flags based on a host profile mapping
 #   4. Imports per-host home.nix overrides (monitors, HW-specific config)
 #
 # To add a new host:
 #   1. Add entry to hostProfiles below
 #   2. Add feature flags in the hostFlags section
 #   3. Create hosts/<hostname>/home.nix if the host needs overrides (monitors, etc.)
 {
  config,
  pkgs,
  inputs,
  ...
-}: {
+}: let
  hostname = config.networking.hostName;
  # ── Per-host profile mapping ──
  # Determines which m3ta-home context and sets each host gets.
  hostProfiles = {
    # ── Desktop hosts ──
    m3-ares = {
      context = "desktop";
      sets = ["coding" "gaming" "media"];
    };
    m3-kratos = {
      context = "desktop";
      sets = ["coding" "gaming" "media"];
    };
    m3-daedalus = {
      context = "desktop";
      sets = ["coding" "media"];
    };
    # ── Server hosts ──
    m3-atlas = {
      context = "server";
      sets = [];
    };
    m3-helios = {
      context = "server";
      sets = [];
    };
    m3-hermes = {
      context = "server";
      sets = [];
    };
    m3-aether = {
      context = "server";
      sets = [];
    };
  };
  profile =
    hostProfiles.${
      hostname
    } or {
      context = "server";
      sets = [];
    };
  m3ta-lib = inputs.m3ta-home.lib;
  # Check if a per-host home.nix exists
  hostHomeFile = ./../../${hostname}/home.nix;
  hostHomeExists = builtins.pathExists hostHomeFile;
  # ── Per-host feature flags ──
  # These enable/disable specific m3ta-home modules per host.
  hostFlags =
    if hostname == "m3-ares" || hostname == "m3-kratos"
    then {
      # Full desktop workstation
      base = {
        shell = {
          fish.enable = true;
          nushell.enable = true;
          starship.enable = true;
        };
        cliTools = {
          fzf.enable = true;
          nitch.enable = true;
          television.enable = true;
        };
        secrets.enable = true;
      };
      desktop = {
        wm = {
          hyprland.enable = true;
          rofi.enable = true;
          wayland.enable = true;
          dms.enable = true;
        };
        apps = {
          crypto.enable = true;
          obsidian.enable = true;
          office.enable = true;
        };
        theme = {
          fonts.enable = true;
          wallpapers.enable = true;
        };
      };
      coding = {
        editors = {
          neovim.enable = true;
          zed.enable = true;
        };
        lsp.enable = true;
        packages.enable = true;
        languages = {
          python.enable = true;
          javascript.enable = true;
          rustToolchain.enable = true;
          go.enable = true;
          typescript.enable = true;
        };
      };
      profiles.gaming = {
        steam.enable = true;
        gamescope.enable = true;
      };
      profiles.media = {
        obs.enable = true;
        ffmpeg.enable = true;
        kdenlive.enable = true;
        ytDlp.enable = true;
      };
    }
    else if hostname == "m3-daedalus"
    then {
      # Portable laptop — desktop without gaming, no Hyprland
      base = {
        shell = {
          fish.enable = true;
          nushell.enable = true;
          starship.enable = true;
        };
        cliTools = {
          fzf.enable = true;
          nitch.enable = true;
          television.enable = true;
        };
        secrets.enable = true;
      };
      desktop = {
        wm = {
          hyprland.enable = false;
          wayland.enable = false;
        };
        apps = {
          crypto.enable = false;
          obsidian.enable = true;
          office.enable = false;
        };
        theme = {
          fonts.enable = true;
          wallpapers.enable = false;
        };
      };
      coding = {
        editors = {
          neovim.enable = true;
          zed.enable = true;
        };
        lsp.enable = true;
        packages.enable = true;
        languages = {
          python.enable = true;
          javascript.enable = true;
          rustToolchain.enable = true;
          go.enable = true;
          typescript.enable = true;
        };
      };
      profiles.media = {
        ytDlp.enable = true;
      };
    }
    else if hostname == "m3-atlas"
    then {
      # Primary server — coding capable
      base = {
        shell = {
          nushell.enable = true;
          starship.enable = true;
        };
        cliTools = {
          fzf.enable = true;
          nitch.enable = true;
          zellij.enable = true;
        };
      };
      coding.editors.neovim.enable = true;
    }
    else {
      # m3-helios, m3-hermes, m3-aether — minimal server
      base = {
        shell = {
          fish.enable = true;
          starship.enable = true;
        };
        cliTools = {
          fzf.enable = true;
          nitch.enable = true;
        };
      };
    };
 in {
  # ── NixOS user definition ──
  users.users.m3tam3re = {
    #initialHashedPassword = "$y$j9T$IoChbWGYRh.rKfmm0G86X0$bYgsWqDRkvX.EBzJTX.Z0RsTlwspADpvEF3QErNyCMC";
    password = "12345";
    isNormalUser = true;
    description = "m3tam3re";
@@ -29,6 +233,25 @@
    ];
    packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
  };
-  home-manager.users.m3tam3re =
+
-    import ../../../home/m3tam3re/${config.networking.hostName}.nix;
+  # ── Home-Manager configuration via m3ta-home ──
  home-manager.users.m3tam3re = {
    imports =
      [
        # Load m3ta-home composition engine
        (m3ta-lib.mkHome {
          user = "m3tam3re";
          identity = "private";
          inherit (profile) context sets;
        })
        # Per-host feature flags
        hostFlags
      ]
      # Per-host home.nix (Hyprland monitors, XDG/MIME, HW-specific overrides)
      ++ (
        if hostHomeExists
        then [hostHomeFile]
        else []
      );
  };
 }
@@ -1,11 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
-  imports =
+  config,
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  lib,
  pkgs,
  modulesPath,
  ...
 }: {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];
  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
@@ -1,21 +1,17 @@
 # hosts/m3-ares/home.nix — Host-specific home-manager overrides.
 # TUXEDO laptop: eDP-1 + HDMI-A-1 external monitor.
 # Everything else (shell, editors, gaming, media, theme, etc.) comes from
 # m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
 {
  config,
  lib,
  ...
 }:
 with lib; {
  imports = [
    ../common
    ./home.nix
    ../features/cli
    ../features/coding
    ../features/desktop
  ];
  config = mkMerge [
    # ── XDG / MIME defaults ──
    {
      xdg = {
        # TODO: better structure
        enable = true;
        configFile."mimeapps.list".force = true;
        mimeApps = {
@@ -38,33 +34,10 @@ with lib; {
          };
        };
      };
      features = {
        cli = {
          fish.enable = true;
          nushell.enable = true;
          fzf.enable = true;
          nitch.enable = true;
          secrets.enable = true;
          starship.enable = true;
          television.enable = true;
        };
        desktop = {
          coding.enable = true;
          crypto.enable = true;
          gaming.enable = true;
          hyprland.enable = true;
          media.enable = true;
          obsidian.enable = true;
          office.enable = true;
          rofi.enable = true;
          fonts.enable = true;
          wayland.enable = true;
          wallpapers = true;
        };
      };
    }
-    (mkIf config.features.desktop.hyprland.enable {
+    # ── Hyprland monitor layout ──
    (mkIf config.desktop.wm.hyprland.enable {
      wayland.windowManager.hyprland = {
        enable = true;
        settings = {
@@ -77,7 +50,7 @@ with lib; {
            "1, monitor:eDP-1, default:true"
            "2, monitor:eDP-1"
            "3, monitor:eDP-1"
-            "4, monitor:HDMI-A-1,"
+            "4, monitor:HDMI-A-1"
            "5, monitor:HDMI-A-1,border:false,rounding:false"
            "6, monitor:HDMI-A-1"
          ];
@@ -1,6 +1,7 @@
 {pkgs, ...}: {
  imports = [
    ./containers
    ./greetd.nix
    ./hermes-agent.nix
    ./netbird.nix
    #./n8n.nix
@@ -0,0 +1,38 @@
 # greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
 # Uses tuigreet as the greeter, launching Hyprland after authentication.
 {
  pkgs,
  config,
  lib,
  ...
 }: let
  tuigreet = "${lib.getExe pkgs.tuigreet}";
  # Use start-hyprland wrapper to avoid Hyprland startup warnings
  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
 in {
  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        user = "greeter";
        # Minimal config: verified supported flags only
        # The --time and --remember are tested; power commands omitted
        # to avoid potential quoting/parsing issues
        command = builtins.concatStringsSep " " [
          tuigreet
          "--time"
          "--remember"
          "--asterisks"
          "--cmd ${hyprlandCmd}"
        ];
      };
    };
  };
  # Required for --remember to persist username between logins
  systemd.tmpfiles.rules = [
    "d /var/cache/tuigreet 0755 greeter greeter - -"
  ];
 }
@@ -17,10 +17,21 @@ in {
    settings = {
      # ── Model ──────────────────────────────────────────────────────────
      model = {
-        default = "glm-5.1";
+        default = "gpt-5.5";
-        provider = "zai";
+        provider = "openai-codex";
      };
      fallback_providers = [
        {
          provider = "zai";
          model = "glm-5.1";
        }
        {
          provider = "minimax";
          model = "MiniMax-M2.7";
        }
      ];
      credential_pool_strategies = {
        zai = "fill_first";
      };
@@ -1,7 +1,4 @@
-{
+{pkgs, ...}: {
  pkgs,
  ...
 }: {
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_17;
@@ -3,6 +3,14 @@
    secrets = {
      baserow-env = {file = ../../secrets/baserow-env.age;};
      ghost-env = {file = ../../secrets/ghost-env.age;};
      honcho-selfhost-db-password = {
        file = ../../secrets/honcho-selfhost-db-password.age;
        owner = "postgres";
        group = "postgres";
        mode = "400";
      };
      honcho-selfhost-env = {file = ../../secrets/honcho-selfhost-env.age;};
      honcho-selfhost-jwt-secret = {file = ../../secrets/honcho-selfhost-jwt-secret.age;};
      kestra-config = {
        file = ../../secrets/kestra-config.age;
        mode = "644";
@@ -10,6 +18,8 @@
      kestra-env = {file = ../../secrets/kestra-env.age;};
      littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
      minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
      rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
      rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
      n8n-env = {file = ../../secrets/n8n-env.age;};
      netbird-auth-secret = {
        file = ../../secrets/netbird-auth-secret.age;
@@ -2,6 +2,7 @@
  imports = [
    ./baserow.nix
    ./ghost.nix
    ./honcho.nix
    ./kestra.nix
    ./littlelink.nix
    ./matomo.nix
@@ -0,0 +1,209 @@
 {
  config,
  lib,
  pkgs,
  ...
 }: let
  serviceName = "honcho";
  image = "ghcr.io/plastic-labs/honcho:v3.0.6";
  apiIp = "10.89.0.24";
  deriverIp = "10.89.0.25";
  redisIp = "10.89.0.26";
  postgresHost = "10.89.0.1";
  postgresPort = config.m3ta.ports.get "postgres";
  honchoPort = config.m3ta.ports.get "honcho";
  # m3-atlas Netbird mesh address, discovered from `netbird status -d`.
  # Binding the host port here keeps self-hosted Honcho off public interfaces.
  netbirdBindAddress = "100.81.142.56";
  netbirdRange = "100.64.0.0/16";
  dbName = "honcho";
  dbUser = "honcho";
  redisName = "${serviceName}-redis";
  runtimeDirectory = "/run/${serviceName}";
  runtimeEnvFile = "${runtimeDirectory}/env";
  # Keep auth disabled for the first deployment because Honcho clients need
  # generated JWTs. The JWT secret is still provisioned so enabling auth later is
  # a one-line change here plus client token generation.
  authUseAuth = false;
  sharedEnvironment = {
    CACHE_ENABLED = "true";
    CACHE_URL = "redis://${redisName}:6379/0?suppress=true";
    LOG_LEVEL = "INFO";
    TELEMETRY_ENABLED = "false";
    VECTOR_STORE_MIGRATED = "false";
    VECTOR_STORE_TYPE = "pgvector";
    AUTH_USE_AUTH = lib.boolToString authUseAuth;
  };
  sharedEnvironmentFiles = [
    runtimeEnvFile
    config.age.secrets."${serviceName}-selfhost-env".path
  ];
  webNetwork = ip: [
    "--add-host=postgres:${postgresHost}"
    "--network=web:ip=${ip}"
  ];
  # The shared web network is intentionally internal. API and deriver also join
  # this egress-only network so LLM provider calls can leave the host without
  # exposing any extra inbound ports.
  networksWithEgress = ip:
    (webNetwork ip)
    ++ [
      "--network=${serviceName}-egress"
    ];
  apiHealthCmd = ''/app/.venv/bin/python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=2).read()"'';
 in {
  system.activationScripts.createPodmanNetworkHonchoEgress = lib.mkAfter ''
    if ! /run/current-system/sw/bin/podman network exists ${serviceName}-egress; then
      /run/current-system/sw/bin/podman network create ${serviceName}-egress
    fi
  '';
  virtualisation.oci-containers.containers = {
    "${serviceName}-redis" = {
      image = "docker.io/redis:8.2";
      autoStart = true;
      volumes = ["${serviceName}_redis_data:/data"];
      extraOptions =
        (webNetwork redisIp)
        ++ [
          "--health-cmd=redis-cli ping"
          "--health-interval=5s"
          "--health-timeout=5s"
          "--health-retries=5"
        ];
    };
    "${serviceName}-api" = {
      inherit image;
      autoStart = true;
      entrypoint = "sh";
      cmd = ["docker/entrypoint.sh"];
      environment = sharedEnvironment;
      environmentFiles = sharedEnvironmentFiles;
      ports = ["${netbirdBindAddress}:${toString honchoPort}:8000"];
      dependsOn = [redisName];
      extraOptions =
        (networksWithEgress apiIp)
        ++ [
          "--health-cmd=${apiHealthCmd}"
          "--health-interval=5s"
          "--health-timeout=5s"
          "--health-retries=5"
          "--health-start-period=10s"
        ];
    };
    "${serviceName}-deriver" = {
      inherit image;
      autoStart = true;
      entrypoint = "/app/.venv/bin/python";
      cmd = ["-m" "src.deriver"];
      environment = sharedEnvironment;
      environmentFiles = sharedEnvironmentFiles;
      dependsOn = ["${serviceName}-api" redisName];
      extraOptions = networksWithEgress deriverIp;
    };
  };
  systemd.services = {
    "${serviceName}-postgres-bootstrap" = {
      description = "Bootstrap Honcho PostgreSQL role, database, password, and pgvector";
      after = ["postgresql.service" "agenix.service"];
      requires = ["postgresql.service" "agenix.service"];
      before = ["${serviceName}-env.service" "podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
      requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
      path = [
        config.services.postgresql.package
        pkgs.coreutils
      ];
      serviceConfig = {
        Type = "oneshot";
        User = "postgres";
        Group = "postgres";
      };
      script = ''
        set -euo pipefail
        test -s ${config.age.secrets."${serviceName}-selfhost-db-password".path}
        psql -v ON_ERROR_STOP=1 --dbname=postgres <<'SQL'
        DO $$
        BEGIN
          CREATE ROLE ${dbUser} LOGIN;
        EXCEPTION WHEN duplicate_object THEN
          NULL;
        END
        $$;
        SELECT 'CREATE DATABASE ${dbName} OWNER ${dbUser}'
        WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${dbName}')\gexec
        ALTER DATABASE ${dbName} OWNER TO ${dbUser};
        \set honcho_password `cat ${config.age.secrets."${serviceName}-selfhost-db-password".path}`
        ALTER ROLE ${dbUser} WITH LOGIN PASSWORD :'honcho_password';
        SQL
        psql -v ON_ERROR_STOP=1 --dbname=${dbName} <<'SQL'
        CREATE EXTENSION IF NOT EXISTS vector;
        GRANT ALL PRIVILEGES ON DATABASE ${dbName} TO ${dbUser};
        SQL
      '';
    };
    "${serviceName}-env" = {
      description = "Generate Honcho runtime environment file with agenix secrets";
      after = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
      requires = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
      before = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
      requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
      path = [
        pkgs.coreutils
        pkgs.python3
      ];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
      script = ''
        set -euo pipefail
        install -d -m 0750 ${runtimeDirectory}
        db_password_encoded=$(
          python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=""))' \
            < ${config.age.secrets."${serviceName}-selfhost-db-password".path}
        )
        jwt_secret=$(tr -d '\r\n' < ${config.age.secrets."${serviceName}-selfhost-jwt-secret".path})
        umask 077
        cat > ${runtimeEnvFile} <<ENV
        DB_CONNECTION_URI=postgresql+psycopg://${dbUser}:$db_password_encoded@postgres:${toString postgresPort}/${dbName}
        AUTH_JWT_SECRET=$jwt_secret
        ENV
      '';
    };
    "podman-${serviceName}-api" = {
      after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
      requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
    };
    "podman-${serviceName}-deriver" = {
      after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
      requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
    };
  };
  networking.firewall.extraCommands = ''
    # Self-hosted Honcho API: only Netbird mesh peers may reach ${netbirdBindAddress}:${toString honchoPort}.
    ip46tables -A nixos-fw -p tcp --dport ${toString honchoPort} -s ${netbirdRange} -j nixos-fw-accept
  '';
 }
@@ -11,8 +11,7 @@
      "kestra_data:/app/storage"
      "/tmp/kestra-wd:/tmp/kestra-wd"
    ];
-    extraOptions =
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web"];
      [ "--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web" ];
  };
  systemd.tmpfiles.rules = [
@@ -21,8 +20,7 @@
  # Traefik configuration specific to littlelink
  services.traefik.dynamicConfigOptions.http = {
-    services.kestra.loadBalancer.servers =
+    services.kestra.loadBalancer.servers = [{url = "http://localhost:3018/";}];
      [{ url = "http://localhost:3018/"; }];
    routers.kestra = {
      rule = "Host(`k.m3ta.dev`)";
@@ -4,7 +4,7 @@
    ./containers
    ./gitea.nix
    ./gitea-actions-runner.nix
-    ./minio.nix
+    ./rustfs.nix
    ./mysql.nix
    ./netbird.nix
    ./n8n.nix
@@ -1,191 +0,0 @@
 {config, ...}: let
  # Default ElevenLabs voice: Bella (German-capable female)
  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
 in {
  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    # Secrets via agenix
    environmentFiles = [config.age.secrets."hermes-env".path];
    # Non-secret environment variables
    environment = {
      #
    };
    # ── Container mode (podman) ──────────────────────────────────────────
    container = {
      enable = true;
      backend = "podman";
    };
    settings = {
      # ── Model ──────────────────────────────────────────────────────────
      model = {
        default = "glm-5.1";
        provider = "zai";
        base_url = "https://api.z.ai/api/coding/paas/v4/";
      };
      credential_pool_strategies = {
        zai = "fill_first";
      };
      toolsets = ["all"];
      # ── Agent ──────────────────────────────────────────────────────────
      agent = {
        max_turns = 90;
        gateway_timeout = 1800;
        tool_use_enforcement = "auto";
      };
      # ── Terminal ───────────────────────────────────────────────────────
      terminal = {
        backend = "local";
        modal_mode = "auto";
        cwd = ".";
        timeout = 180;
        persistent_shell = true;
      };
      # ── Browser ────────────────────────────────────────────────────────
      browser = {
        inactivity_timeout = 120;
        command_timeout = 30;
        cloud_provider = "local";
      };
      # ── Checkpoints / Compression ──────────────────────────────────────
      checkpoints = {
        enabled = true;
        max_snapshots = 50;
      };
      file_read_max_chars = 100000;
      compression = {
        enabled = true;
        threshold = 0.5;
        target_ratio = 0.2;
        protect_last_n = 20;
      };
      # ── Display ────────────────────────────────────────────────────────
      display = {
        compact = false;
        personality = "kawaii";
        resume_display = "full";
        busy_input_mode = "interrupt";
        inline_diffs = true;
        skin = "default";
        tool_progress = "all";
      };
      # ── TTS / STT / Voice ──────────────────────────────────────────────
      tts = {
        provider = "elevenlabs";
        elevenlabs = {
          voice_id = elevenlabsVoiceId;
          model_id = "eleven_multilingual_v2";
        };
      };
      stt = {
        enabled = true;
        provider = "local";
        local = {model = "base";};
      };
      voice = {
        record_key = "ctrl+b";
        max_recording_seconds = 120;
        silence_threshold = 200;
        silence_duration = 3.0;
      };
      # ── Memory ─────────────────────────────────────────────────────────
      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
        memory_char_limit = 2200;
        user_char_limit = 1375;
      };
      # ── Delegation ─────────────────────────────────────────────────────
      delegation = {
        max_iterations = 50;
      };
      # ── Discord ────────────────────────────────────────────────────────
      discord = {
        require_mention = true;
        auto_thread = true;
        reactions = true;
      };
      # ── Approvals / Security ───────────────────────────────────────────
      approvals = {
        mode = "manual";
        timeout = 60;
      };
      security = {
        redact_secrets = true;
        tirith_enabled = true;
        tirith_fail_open = true;
      };
      # ── Cron / Session ─────────────────────────────────────────────────
      cron = {wrap_response = true;};
      session_reset = {
        mode = "both";
        idle_minutes = 1440;
        at_hour = 4;
      };
      # ── Web ────────────────────────────────────────────────────────────
      web = {backend = "exa";};
      # ── Platform Toolsets ──────────────────────────────────────────────
      platform_toolsets = {
        cli = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
        telegram = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
      };
    };
  };
 }
@@ -28,6 +28,7 @@
      host    kestra       kestra       10.89.0.0/24    scram-sha-256
      host    netbird      netbird      10.89.0.0/24    scram-sha-256
      host    authentik    authentik    10.89.0.0/24    scram-sha-256
      host    honcho       honcho       10.89.0.0/24    scram-sha-256
      # Deny all other connections
      local   all       all       reject
@@ -38,7 +39,7 @@
  services.postgresqlBackup = {
    enable = true;
    startAt = "03:10:00";
-    databases = ["baserow" "paperless" "kestra" "authentik" "netbird"];
+    databases = ["baserow" "paperless" "kestra" "authentik" "netbird" "honcho"];
  };
  networking.firewall = {
    extraCommands = ''
@@ -1,14 +1,29 @@
-{config, ...}: {
+{
-  services.minio = {
+  config,
  inputs,
  pkgs,
  ...
 }: {
  services.rustfs = {
    enable = true;
-    region = "eu-central-1";
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
    # Reuse existing MinIO data directory
    volumes = "/var/storage/s3";
    # Keep same ports as MinIO to avoid changing Traefik and client configs
    address = ":3008";
    consoleEnable = true;
    consoleAddress = ":3007";
-    listenAddress = ":3008";
+
-    browser = true;
+    # Credentials via agenix
-    rootCredentialsFile = config.age.secrets.minio-root-cred.path;
+    accessKeyFile = config.age.secrets.rustfs-access-key.path;
-    dataDir = ["/var/storage/s3"];
+    secretKeyFile = config.age.secrets.rustfs-secret-key.path;
    logLevel = "info";
  };
-  # Traefik configuration specific to minio
+
  # Traefik configuration — same routes as before
  services.traefik.dynamicConfigOptions.http = {
    services.minio-console.loadBalancer.servers = [
      {
@@ -43,6 +43,12 @@
    dynamicConfigOptions = {
      http = {
        services = {
          # ── Hermes Dashboard (m3-hermes over Netbird) ────────────────
          hermes-dashboard = {
            loadBalancer.servers = [
              {url = "http://100.81.231.152:9119";}
            ];
          };
          dummy = {
            loadBalancer.servers = [
              {url = "http://192.168.0.1";} # Diese URL wird nie verwendet
@@ -79,6 +85,15 @@
        };
        routers = {
          # ── Hermes Dashboard — Netbird mesh only ─────────────────────
          hermes-dashboard = {
            rule = "Host(`dash.m3ta.dev`)";
            service = "hermes-dashboard";
            entrypoints = ["websecure"];
            tls = {
              certResolver = "godaddy";
            };
          };
          api = {
            rule = "Host(`r.m3tam3re.com`)";
            service = "api@internal";
@@ -0,0 +1,37 @@
 # hosts/m3-daedalus/home.nix — Host-specific home-manager overrides.
 # Portable laptop: no Hyprland, no external monitors.
 # Everything else (shell, editors, media, theme, etc.) comes from
 # m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
 {
  config,
  lib,
  ...
 }:
 with lib; {
  config = {
    # ── XDG / MIME defaults ──
    xdg = {
      enable = true;
      configFile."mimeapps.list".force = true;
      mimeApps = {
        enable = true;
        associations.added = {
          "application/zip" = ["org.gnome.FileRoller.desktop"];
          "application/csv" = ["calc.desktop"];
          "application/pdf" = ["vivaldi-stable.desktop"];
          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
        };
        defaultApplications = {
          "application/zip" = ["org.gnome.FileRoller.desktop"];
          "application/csv" = ["calc.desktop"];
          "application/pdf" = ["vivaldi-stable.desktop"];
          "application/md" = ["dev.zed.Zed.desktop"];
          "application/text" = ["dev.zed.Zed.desktop"];
          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
        };
      };
    };
  };
 }
@@ -1,11 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 {
-  imports =
+  config,
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  lib,
  pkgs,
  modulesPath,
  ...
 }: {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];
  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
@@ -19,7 +19,9 @@
  environment.systemPackages = with pkgs; [
    neovim
    git
    tea
    ghostty.terminfo
    uv
  ];
  services.openssh = {
@@ -10,7 +10,7 @@
  extraServices = {
    flatpak.enable = false;
    ollama.enable = false;
-    podman.enable = true;
+    podman.enable = false;
    virtualisation.enable = false;
  };
 }
@@ -1,7 +1,13 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to configuration.nix instead.
-{config, lib, pkgs, modulesPath, ...}: {
+{
  config,
  lib,
  pkgs,
  modulesPath,
  ...
 }: {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];
@@ -7,6 +7,9 @@
      hermes-cloud-env = {
        file = ../../secrets/hermes-cloud-env.age;
      };
      hermes-api-server-key = {
        file = ../../secrets/hermes-api-server-key.age;
      };
    };
  };
 }
@@ -1,5 +1,7 @@
 {
  imports = [
    ./hermes-agent.nix
    ./hermes-dashboard.nix
    ./netbird.nix
  ];
 }
@@ -1,53 +1,162 @@
 {
  config,
  lib,
  pkgs,
  inputs,
  ...
 }: let
-  # Default ElevenLabs voice: Bella (German-capable female)
+  # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
-  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
+  edgeVoice = "de-DE-SeraphinaMultilingualNeural";
-  # Extra Python packages from the container's writable venv layer.
+  agentLock = builtins.fromJSON (builtins.readFile ../../../agent-sources.lock.json);
-  # matrix-nio is installed via pip in /home/hermes/.venv but the hermes
+
-  # process uses the read-only Nix store Python, so we inject the venv's
+  agentSkillSelections = {
-  # site-packages via PYTHONPATH and provide libstdc++ for libolm (e2e).
+    m3ta-agents.exclude = [];
-  venvSitePackages = "/home/hermes/.venv/lib/python3.11/site-packages";
+    anthropic.exclude = ["pdf" "skill-creator" "xlsx"];
-  gccLibPath = "${pkgs.stdenv.cc.cc.lib}/lib";
+    basecamp.exclude = [];
    kestra.exclude = [];
    mattpocock.exclude = ["grill-me" "caveman"];
    superpowers.exclude = ["brainstorming" "systematic-debugging"];
    vercel.exclude = [];
  };
  sourceRoot = source:
    builtins.fetchGit {
      inherit (source) url rev;
    };
  selectedSkillNames = sourceName: let
    source = agentLock.sources.${sourceName};
    excluded = agentSkillSelections.${sourceName}.exclude;
  in
    lib.subtractLists excluded (builtins.attrNames source.items.skills);
  copySkill = sourceName: skillName: let
    source = agentLock.sources.${sourceName};
    item = source.items.skills.${skillName};
  in ''
    cp -R ${sourceRoot source}/${source.root}/${item.path} $out/${skillName}
  '';
  copySourceSkills = sourceName:
    lib.concatMapStringsSep "\n" (copySkill sourceName) (selectedSkillNames sourceName);
  # Build skills from the agent-lib lockfile instead of the legacy AGENTS flake.
  hermesSkills = pkgs.runCommand "hermes-agent-lib-skills" {} ''
    mkdir -p $out
    ${lib.concatMapStringsSep "\n" copySourceSkills (builtins.attrNames agentSkillSelections)}
  '';
 in {
  virtualisation.docker.enable = true;
  systemd.tmpfiles.rules = [
    "d /var/lib/hermes/.config 0755 hermes hermes -"
    "d /var/lib/hermes/.config/tea 0755 hermes hermes -"
    "L+ /var/lib/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
      logins:
        - name: m3ta
          url: https://code.m3ta.dev
          token:
          ssh_host: code.m3ta.dev
          user: m3ta-chiron
          default: true
    ''}"
  ];
  systemd.services.copy-hermes-skills = {
    description = "Copy agent skills to hermes home directory";
    wantedBy = ["hermes-agent.service"];
    before = ["hermes-agent.service"];
    serviceConfig.Type = "oneshot";
    serviceConfig.RemainAfterExit = true;
    script = ''
      mkdir -p /var/lib/hermes/.agents
      cp -rT ${hermesSkills} /var/lib/hermes/.agents/skills
      chown -R hermes:hermes /var/lib/hermes/.agents
    '';
  };
  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    # v0.14 lazy-installs heavy optional backends by default. In the sealed
    # Nix package, include the backends this host config actively uses so the
    # gateway, Matrix bridge, memory, web search, TTS, and local STT work
    # without runtime pip/uv mutation.
    extraDependencyGroups = [
      "matrix"
      "honcho"
      "exa"
      "edge-tts"
      "voice"
    ];
    extraPackages = with pkgs; [
      docker
      git
      curl
      jq
      tea
      nix
      python3Minimal
      uv
      zellij
    ];
    # Secrets via agenix
    environmentFiles = [
      config.age.secrets."hermes-env".path
      config.age.secrets."hermes-cloud-env".path
      config.age.secrets."hermes-api-server-key".path
    ];
    # Non-secret environment variables
    # Git identity is set entirely via env vars (GIT_AUTHOR_*, GIT_COMMITTER_*,
    # GIT_INIT_DEFAULT_BRANCH) — no .gitconfig file needed. Env vars take
    # precedence over any gitconfig, and the hermes gateway injects them into
    # all terminal sessions via .env.
    environment = {
      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
      GIT_AUTHOR_NAME = "m3ta-chiron";
      GIT_AUTHOR_EMAIL = "m3ta-chiron@agentmail.to";
      GIT_COMMITTER_NAME = "m3ta-chiron";
      GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
      GIT_INIT_DEFAULT_BRANCH = "master";
      # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
      # Accessible via Netbird mesh VPN — not exposed to the public internet.
      # Bind to 0.0.0.0 so the Netbird interface can reach it.
      API_SERVER_ENABLED = "true";
      API_SERVER_HOST = "0.0.0.0";
      API_SERVER_PORT = toString (config.m3ta.ports.get "hermes-api");
    };
    # ── Container mode (podman) ──────────────────────────────────────────
    container = {
-      enable = true;
+      enable = false;
      backend = "podman";
      extraVolumes = ["/home/m3tam3re/p:/projects:rw"];
-      extraOptions = [
+      extraOptions = [];
        "--env"
        "PYTHONPATH=${venvSitePackages}"
        "--env"
        "LD_LIBRARY_PATH=${gccLibPath}"
      ];
    };
    settings = {
      # ── Model ──────────────────────────────────────────────────────────
      model = {
-        default = "glm-5.1";
+        default = "gpt-5.5";
-        provider = "zai";
+        provider = "openai-codex";
      };
      fallback_providers = [
        {
          provider = "zai";
          model = "glm-5.1";
        }
        {
          provider = "minimax";
          model = "MiniMax-M2.7";
        }
      ];
      credential_pool_strategies = {
        zai = "fill_first";
      };
@@ -59,11 +168,20 @@ in {
        max_turns = 90;
        gateway_timeout = 1800;
        tool_use_enforcement = "auto";
        reasoning_effort = "high";
      };
      # ── Skills ─────────────────────────────────────────────────────────
      skills = {
        external_dirs = [
          "/var/lib/hermes/.agents/skills"
        ];
      };
      # ── Terminal ───────────────────────────────────────────────────────
      terminal = {
-        backend = "docker";
+        backend = "local";
        modal_mode = "auto";
        cwd = ".";
        timeout = 180;
@@ -77,7 +195,8 @@ in {
        cloud_provider = "local";
      };
-      # ── Checkpoints / Compression ──────────────────────────────────────
+      # ── Checkpoints v2 ─────────────────────────────────────────────────
      # v0.13.0: Single-store rewrite with real pruning + disk guardrails.
      checkpoints = {
        enabled = true;
        max_snapshots = 50;
@@ -105,10 +224,9 @@ in {
      # ── TTS / STT / Voice ──────────────────────────────────────────────
      tts = {
-        provider = "elevenlabs";
+        provider = "edge";
-        elevenlabs = {
+        edge = {
-          voice_id = elevenlabsVoiceId;
+          voice = edgeVoice;
          model_id = "eleven_multilingual_v2";
        };
      };
@@ -127,15 +245,27 @@ in {
      # ── Memory ─────────────────────────────────────────────────────────
      memory = {
        provider = "honcho";
        memory_enabled = true;
        user_profile_enabled = true;
        memory_char_limit = 2200;
        user_char_limit = 1375;
      };
-      # ── Delegation ─────────────────────────────────────────────────────
+      # ── Delegation / Orchestrator ────────────────────────────────────────
      delegation = {
        max_iterations = 50;
        orchestrator_enabled = true;
        max_spawn_depth = 2;
      };
      # ── Kanban (v0.13.0 — Multi-Agent Board) ──────────────────────────
      # Durable task board with embedded dispatcher in gateway process.
      # Workers are full OS processes with identity, heartbeat, reclaim,
      # zombie detection, and hallucination gate.
      kanban = {
        dispatch_in_gateway = true;
        dispatch_interval_seconds = 60;
      };
      # ── Matrix ────────────────────────────────────────────────────────
@@ -144,6 +274,9 @@ in {
        user_id = "@chiron:m3ta.dev";
        allowed_users = ["@m3tam3re:m3ta.dev"];
        encryption = true;
        group_sessions_per_user = true;
        auto_thread = true;
        dm_mention_threads = true;
      };
      # ── Approvals / Security ───────────────────────────────────────────
@@ -169,44 +302,6 @@ in {
      # ── Web ────────────────────────────────────────────────────────────
      web = {backend = "exa";};
      # ── Platform Toolsets ──────────────────────────────────────────────
      platform_toolsets = {
        cli = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
        telegram = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
      };
    };
  };
@@ -0,0 +1,69 @@
 {
  config,
  pkgs,
  inputs,
  ...
 }: let
  # Netbird mesh VPN range — dashboard only accessible from mesh peers.
  # m3-atlas Traefik proxies to this port over Netbird.
  netbirdRange = "100.64.0.0/16";
  apiPort = config.m3ta.ports.get "hermes-api";
  dashboardPort = config.m3ta.ports.get "hermes-dashboard";
  # Reference the hermes-agent package from the running service config
  hermesPkg = config.services.hermes-agent.package or (inputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default or pkgs.hermes-agent);
 in {
  # ── Hermes Dashboard systemd service ───────────────────────────────────
  # Web UI for managing Hermes Agent — sessions, config, kanban, cron, etc.
  #
  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :${toString dashboardPort}
  #
  # --insecure is required to bind 0.0.0.0 (hermes refuses non-localhost otherwise).
  # Safe because firewall restricts the dashboard/API ports to Netbird mesh only.
  systemd.services.hermes-dashboard = {
    description = "Hermes Agent Web Dashboard";
    after = ["network.target" "hermes-agent.service"];
    wants = ["hermes-agent.service"];
    wantedBy = ["multi-user.target"];
    serviceConfig = {
      Type = "simple";
      User = "hermes";
      Group = "hermes";
      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port ${toString dashboardPort} --no-open --insecure";
      # Environment matching the hermes-agent service
      Environment = [
        "HERMES_HOME=/var/lib/hermes/.hermes"
        "HERMES_MANAGED=true"
        "HOME=/var/lib/hermes"
      ];
      # Security hardening (matching hermes-agent service pattern)
      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = "read-only";
      ReadWritePaths = ["/var/lib/hermes" "/tmp"];
      PrivateTmp = true;
      # Restart policy
      Restart = "on-failure";
      RestartSec = 5;
    };
  };
  # ── Firewall: Hermes network endpoints only from Netbird mesh ──────────
  networking.firewall = {
    extraCommands = ''
      # Allow Hermes Dashboard and OpenAI-compatible API only from Netbird mesh VPN
      ip46tables -A nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept
      ip46tables -A nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept
    '';
    extraStopCommands = ''
      ip46tables -D nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
      ip46tables -D nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
    '';
  };
 }
@@ -0,0 +1,29 @@
 {pkgs, ...}: {
  services.netbird.enable = true;
  systemd.services.netbird = {
    environment = {
      NB_DISABLE_SSH_CONFIG = "true";
      NB_USE_LEGACY_ROUTING = "true";
    };
    path = [
      pkgs.shadow
      pkgs.util-linux
    ];
  };
  programs.ssh.extraConfig = ''
    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
        PreferredAuthentications password,publickey,keyboard-interactive
        PasswordAuthentication yes
        PubkeyAuthentication yes
        BatchMode no
        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
        StrictHostKeyChecking no
        UserKnownHostsFile /dev/null
        CheckHostIP no
        LogLevel ERROR
  '';
  networking.firewall.checkReversePath = "loose";
 }
@@ -10,11 +10,12 @@
  # Use the systemd-boot EFI boot loader.
  boot.supportedFilesystems = ["zfs"];
  boot.zfs.package = pkgs.zfs_unstable;
-  boot.zfs.forceImportAll = true;
+  boot.zfs.forceImportAll = false;
  boot.zfs.forceImportRoot = false;
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.initrd.kernelModules = ["amdgpu"];
-  boot.kernelPackages = pkgs.linuxPackages_6_18;
+  boot.kernelPackages = pkgs.linuxPackages_7_0;
  services.xserver.videoDrivers = ["amdgpu"];
  security.polkit.enable = true;
  security.pam.services.gdm.enableGnomeKeyring = true;
@@ -48,6 +48,7 @@
    podman.enable = true;
    virtualisation.enable = true;
  };
  services.power-profiles-daemon.enable = true;
  services.ollama = {
    environmentVariables = {
      # HCC_AMDGPU_TARGET = "gfx1103";
@@ -1,21 +1,21 @@
 # hosts/m3-kratos/home.nix — Host-specific home-manager overrides.
 # AMD desktop: dual 2560x1440@144 via DisplayPort.
 # Everything else (shell, editors, gaming, media, theme, etc.) comes from
 # m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
 {
  config,
  inputs,
  lib,
  ...
 }:
 with lib; {
  imports = [
    ../common
    ./home.nix
    ../features/cli
    ../features/coding
    ../features/desktop
  ];
  config = mkMerge [
    # ── XDG / MIME defaults ──
    {
      xdg = {
        # TODO: better structure
        enable = true;
        configFile."mimeapps.list".force = true;
        mimeApps = {
@@ -38,32 +38,10 @@ with lib; {
          };
        };
      };
      features = {
        cli = {
          nushell.enable = true;
          fzf.enable = true;
          nitch.enable = true;
          secrets.enable = true;
          starship.enable = true;
          television.enable = true;
        };
        desktop = {
          crypto.enable = true;
          coding.enable = true;
          gaming.enable = true;
          hyprland.enable = true;
          media.enable = true;
          obsidian.enable = true;
          office.enable = true;
          rofi.enable = true;
          fonts.enable = true;
          wayland.enable = true;
          wallpapers = true;
        };
      };
    }
-    (mkIf config.features.desktop.hyprland.enable {
+    # ── Hyprland monitor layout ──
    (mkIf config.desktop.wm.hyprland.enable {
      wayland.windowManager.hyprland = {
        enable = true;
        settings = {
@@ -80,10 +58,8 @@ with lib; {
            "6, monitor:DP-2"
            "7, monitor:DP-2"
          ];
          windowrule = [
            "match:class dev.zed.Zed, workspace 1"
            "match:class Msty, workspace 1"
            "match:class ^(com.obsproject.Studio)$, workspace 2"
            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
@@ -1,7 +1,7 @@
 {pkgs, ...}: {
  imports = [
    ./containers
-    ./hermes-agent.nix
+    ./greetd.nix
    ./mem0.nix
    # ./n8n.nix
    ./netbird.nix
@@ -30,6 +30,6 @@
        userServices = true;
      };
    };
-    displayManager.gdm.enable = true;
+    # displayManager.gdm.enable = true;
  };
 }
@@ -0,0 +1,38 @@
 # greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
 # Uses tuigreet as the greeter, launching Hyprland after authentication.
 {
  pkgs,
  config,
  lib,
  ...
 }: let
  tuigreet = "${lib.getExe pkgs.tuigreet}";
  # Use start-hyprland wrapper to avoid Hyprland startup warnings
  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
 in {
  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        user = "greeter";
        # Minimal config: verified supported flags only
        # The --time and --remember are tested; power commands omitted
        # to avoid potential quoting/parsing issues
        command = builtins.concatStringsSep " " [
          tuigreet
          "--time"
          "--remember"
          "--asterisks"
          "--cmd ${hyprlandCmd}"
        ];
      };
    };
  };
  # Required for --remember to persist username between logins
  systemd.tmpfiles.rules = [
    "d /var/cache/tuigreet 0755 greeter greeter - -"
  ];
 }
@@ -1,184 +0,0 @@
 {config, ...}: let
  # Default ElevenLabs voice: Bella (German-capable female)
  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
 in {
  services.hermes-agent = {
    enable = true;
    addToSystemPackages = true;
    # Secrets via agenix
    environmentFiles = [config.age.secrets."hermes-env".path];
    # Non-secret environment variables
    environment = {
      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
    };
    settings = {
      # ── Model ──────────────────────────────────────────────────────────
      model = {
        default = "glm-5.1";
        provider = "zai";
      };
      credential_pool_strategies = {
        zai = "fill_first";
      };
      toolsets = ["all"];
      # ── Agent ──────────────────────────────────────────────────────────
      agent = {
        max_turns = 90;
        gateway_timeout = 1800;
        tool_use_enforcement = "auto";
      };
      # ── Terminal ───────────────────────────────────────────────────────
      terminal = {
        backend = "ssh";
        modal_mode = "auto";
        cwd = ".";
        timeout = 180;
        persistent_shell = true;
      };
      # ── Browser ────────────────────────────────────────────────────────
      browser = {
        inactivity_timeout = 120;
        command_timeout = 30;
        cloud_provider = "local";
      };
      # ── Checkpoints / Compression ──────────────────────────────────────
      checkpoints = {
        enabled = true;
        max_snapshots = 50;
      };
      file_read_max_chars = 100000;
      compression = {
        enabled = true;
        threshold = 0.5;
        target_ratio = 0.2;
        protect_last_n = 20;
      };
      # ── Display ────────────────────────────────────────────────────────
      display = {
        compact = false;
        personality = "kawaii";
        resume_display = "full";
        busy_input_mode = "interrupt";
        inline_diffs = true;
        skin = "default";
        tool_progress = "all";
      };
      # ── TTS / STT / Voice ──────────────────────────────────────────────
      tts = {
        provider = "elevenlabs";
        elevenlabs = {
          voice_id = elevenlabsVoiceId;
          model_id = "eleven_multilingual_v2";
        };
      };
      stt = {
        enabled = true;
        provider = "local";
        local = {model = "base";};
      };
      voice = {
        record_key = "ctrl+b";
        max_recording_seconds = 120;
        silence_threshold = 200;
        silence_duration = 3.0;
      };
      # ── Memory ─────────────────────────────────────────────────────────
      memory = {
        memory_enabled = true;
        user_profile_enabled = true;
        memory_char_limit = 2200;
        user_char_limit = 1375;
      };
      # ── Delegation ─────────────────────────────────────────────────────
      delegation = {
        max_iterations = 50;
      };
      # ── Discord ────────────────────────────────────────────────────────
      discord = {
        require_mention = true;
        auto_thread = true;
        reactions = true;
      };
      # ── Approvals / Security ───────────────────────────────────────────
      approvals = {
        mode = "manual";
        timeout = 60;
      };
      security = {
        redact_secrets = true;
        tirith_enabled = true;
        tirith_fail_open = true;
      };
      # ── Cron / Session ─────────────────────────────────────────────────
      cron = {wrap_response = true;};
      session_reset = {
        mode = "both";
        idle_minutes = 1440;
        at_hour = 4;
      };
      # ── Web ────────────────────────────────────────────────────────────
      web = {backend = "exa";};
      # ── Platform Toolsets ──────────────────────────────────────────────
      platform_toolsets = {
        cli = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
        telegram = [
          "browser"
          "clarify"
          "code_execution"
          "cronjob"
          "delegation"
          "file"
          "image_gen"
          "memory"
          "session_search"
          "skills"
          "terminal"
          "todo"
          "tts"
          "vision"
          "web"
        ];
      };
    };
  };
 }
@@ -0,0 +1,3 @@
 {"id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
 {"id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
 {"id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
@@ -23,6 +23,8 @@ in {
  "secrets/kestra-config.age".publicKeys = systems ++ users;
  "secrets/kestra-env.age".publicKeys = systems ++ users;
  "secrets/minio-root-cred.age".publicKeys = systems ++ users;
  "secrets/rustfs-access-key.age".publicKeys = systems ++ users;
  "secrets/rustfs-secret-key.age".publicKeys = systems ++ users;
  "secrets/n8n-env.age".publicKeys = systems ++ users;
  "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
  "secrets/netbird-db-password.age".publicKeys = systems ++ users;
@@ -36,6 +38,9 @@ in {
  "secrets/basecamp-client-id.age".publicKeys = systems ++ users;
  "secrets/basecamp-client-secret.age".publicKeys = systems ++ users;
  "secrets/gitea-runner-token.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-db-password.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-env.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-jwt-secret.age".publicKeys = systems ++ users;
  "secrets/outline-key.age".publicKeys = systems ++ users;
  "secrets/restreamer-env.age".publicKeys = systems ++ users;
  "secrets/searx.age".publicKeys = systems ++ users;
@@ -50,5 +55,7 @@ in {
  "secrets/honcho-key.age".publicKeys = systems ++ users;
  "secrets/hermes-env.age".publicKeys = systems ++ users;
  "secrets/hermes-cloud-env.age".publicKeys = systems ++ users;
  "secrets/hermes-api-server-key.age".publicKeys = systems ++ users;
  "secrets/hermes-gitea-token.age".publicKeys = systems ++ users;
  "secrets/tuwunel-registration-token.age".publicKeys = systems ++ users;
 }
--- a/Show More
+++ b/Show More