fix(m3-hermes): stable Matrix device + DNS pin for homeserver

Root cause chain of recurring Matrix outages (2026-08-16):

1. DNS on m3-hermes resolves exclusively via the Netbird-managed
   resolver. When the Netbird nameserver group is unreachable
   (observed 14:03-15:24), matrix.m3ta.dev fails to resolve.
2. A gateway restart during that window fails the Matrix login, and
   without MATRIX_ACCESS_TOKEN the gateway drops Matrix permanently
   from its reconnect queue ('no bot credential on queued config').
   Recovery happens only on the next restart - with working DNS.
3. The stable-token setup from 2026-08-14 was wiped because it was
   only written to the regenerated .env, not to the agenix secret.

Changes:
- Pin matrix.m3ta.dev to the m3-atlas public IP (TLS termination)
  so the Matrix connection survives Netbird DNS outages.
- Declare MATRIX_DEVICE_ID=HERMES01 in the module environment so the
  device id survives .env regeneration. The matching
  MATRIX_ACCESS_TOKEN must be added to secrets/hermes-env.age
  (separate manual step: agenix edit + re-encrypt).

flake.lock

@@ -56,11 +56,11 @@
         "rev": "75a2ed2533b4d6d8e4a34acd37e83d98d81a5fb0",
         "revCount": 30,
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       },
       "original": {
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       }
     },
     "agents": {
@@ -154,16 +154,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785979955,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.9.0",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -176,16 +176,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785979955,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.9.0",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -223,6 +223,53 @@
         "type": "github"
       }
     },
+    "buzz": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1785934673,
+        "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "type": "github"
+      }
+    },
+    "buzz_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2",
+        "treefmt-nix": "treefmt-nix_3"
+      },
+      "locked": {
+        "lastModified": 1785934673,
+        "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -377,11 +424,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -534,11 +581,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785306346,
+        "lastModified": 1786031233,
-        "narHash": "sha256-DScBkW0fOgpGPK2trNoX3ryLTlaC14+gglFo/BhGJ4g=",
+        "narHash": "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e705714e918c3b11affcdd15db2cbe3a070420a0",
+        "rev": "7834e82588860aaf780cec1366524456a70898d7",
         "type": "github"
       },
       "original": {
@@ -621,11 +668,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785380302,
+        "lastModified": 1786014936,
-        "narHash": "sha256-U7x7jYEBE3kFpmZI3CGP7fLC/uz/KxS3uTtg36AoEok=",
+        "narHash": "sha256-ToQkMfyiH/Af/AMpkJi5zR0fVb1QO1lg9jiyzhLVyjc=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "e23b9c324dd5a79189d97e5603067517ac629c0d",
+        "rev": "5028d4667177f2593ceac30f9c8395afaf6a54d9",
         "type": "github"
       },
       "original": {
@@ -651,11 +698,11 @@
         "nur": "nur"
       },
       "locked": {
-        "lastModified": 1785414133,
+        "lastModified": 1786261845,
-        "narHash": "sha256-dsHTEE3un56y9i9hXD54pZ5e8qzAUmySbXYQOj8VSQg=",
+        "narHash": "sha256-377VD83YnIhJtkLbbDDGlp/pfeuP/EqV2Y1TY8ULS64=",
         "ref": "refs/heads/master",
-        "rev": "4dec87ebc786b387c930c64115bd3790d46545d1",
+        "rev": "f2cc6b59ef08efc785097571fe2c4b2b7200ef71",
-        "revCount": 101,
+        "revCount": 114,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
       },
@@ -668,6 +715,7 @@
       "inputs": {
         "agents": "agents_2",
         "basecamp": "basecamp",
+        "buzz": "buzz",
         "nixpkgs": [
           "m3ta-home",
           "nixpkgs"
@@ -677,11 +725,11 @@
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1785395945,
+        "lastModified": 1786203962,
-        "narHash": "sha256-/J1bkZi7tb+DxUN3G9bJBCxaJpG4373L+AjxF8SoX9M=",
+        "narHash": "sha256-gvweVFd0Za5AZN6srXAhYK10NYLSfSVG2Xnl/Z73iZU=",
         "ref": "refs/heads/master",
-        "rev": "e3ebb76b1c26ecc3311d65b25fa38d70313b6804",
+        "rev": "6962de7e076ab68e1ead87770982a7d2e676fc02",
-        "revCount": 371,
+        "revCount": 377,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -694,17 +742,18 @@
       "inputs": {
         "agents": "agents_3",
         "basecamp": "basecamp_2",
+        "buzz": "buzz_2",
         "nixpkgs": "nixpkgs_8",
         "nixpkgs-master": "nixpkgs-master_2",
         "opencode": "opencode_2",
         "openspec": "openspec_2"
       },
       "locked": {
-        "lastModified": 1785397255,
+        "lastModified": 1786203962,
-        "narHash": "sha256-eKgjP0pRJbdGLzGhP7QCdcugUr4/0WGhxKwieJNNodk=",
+        "narHash": "sha256-gvweVFd0Za5AZN6srXAhYK10NYLSfSVG2Xnl/Z73iZU=",
         "ref": "refs/heads/master",
-        "rev": "1cbde05767dacdbb5e2c07a4b45fa72f8d9307ed",
+        "rev": "6962de7e076ab68e1ead87770982a7d2e676fc02",
-        "revCount": 372,
+        "revCount": 377,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -865,11 +914,11 @@
     },
     "nixpkgs-master_3": {
       "locked": {
-        "lastModified": 1785392119,
+        "lastModified": 1786029745,
-        "narHash": "sha256-ZsCNayQNeYU9Ej3+5eWEQPVPuO/tqzhJZplhFvUqqG8=",
+        "narHash": "sha256-rZw0LOnTRyyfgpjz70KYSI4cIA5cHY2Mlqey19xQmIc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "38225e394d6332f77ba809996c81f5e31d59ee24",
+        "rev": "b5a1961b9c902670dc7fb9beced49f2e64ace761",
         "type": "github"
       },
       "original": {
@@ -913,11 +962,11 @@
     },
     "nixpkgs_11": {
       "locked": {
-        "lastModified": 1785301185,
+        "lastModified": 1785747939,
-        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -961,11 +1010,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1785301185,
+        "lastModified": 1785747939,
-        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -1141,11 +1190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785391787,
+        "lastModified": 1786032888,
-        "narHash": "sha256-h+eDCc7/ipd399jvupDPSFBIl7958CJ5n9XfvpW41IE=",
+        "narHash": "sha256-6hYYaIo4ODwadrtYLvDKX1ehezDAUJwLuH2g5OkkWt4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "baf5d9e909898e47688c43cec760b8dbcc9f1fa5",
+        "rev": "366ac747ddcbc2f9243cf0f39ebf33c37c355cba",
         "type": "github"
       },
       "original": {
@@ -1415,6 +1464,51 @@
         "type": "github"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785820796,
+        "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785820796,
+        "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -1497,6 +1591,51 @@
           "nixpkgs"
         ]
       },
+      "locked": {
+        "lastModified": 1785945821,
+        "narHash": "sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "ae7910970dddc408fe6ab1c8e4b277bb21d72dc0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785360170,
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "buzz",
+          "nixpkgs"
+        ]
+      },
       "locked": {
         "lastModified": 1785360170,
         "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",

hosts/common/default.nix

@@ -32,7 +32,7 @@
     overlays = [
       # Add overlays your own flake exports (from overlays and pkgs dir):
       #outputs.overlays.additions
-      #outputs.overlays.modifications
+      outputs.overlays.modifications
       outputs.overlays.stable-packages
       # outputs.overlays.locked-packages
       # outputs.overlays.pinned-packages

hosts/m3-ares/home.nix

@@ -7,7 +7,20 @@
   lib,
   ...
 }:
-with lib; {
+with lib; let
+  lua = lib.generators.mkLuaInline;
+
+  startupCommand = command: {
+    _args = [
+      "hyprland.start"
+      (lua ''
+        function()
+          hl.exec_cmd(${builtins.toJSON command})
+        end
+      '')
+    ];
+  };
+in {
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
@@ -41,28 +54,87 @@ with lib; {
       wayland.windowManager.hyprland = {
         enable = true;
         settings = {
-          exec-once = ["tuxedo-backlight"];
+          on = [
+            (startupCommand "tuxedo-backlight")
+          ];
           monitor = [
-            "eDP-1,preferred,0x0,1.25"
+            {
-            "HDMI-A-1,1920x1080@120,2560x0,1"
+              output = "eDP-1";
+              mode = "preferred";
+              position = "0x0";
+              scale = 1.25;
+            }
+            {
+              output = "HDMI-A-1";
+              mode = "1920x1080@120";
+              position = "2560x0";
+              scale = 1;
+            }
           ];
-          workspace = [
+          workspace_rule = [
-            "1, monitor:eDP-1, default:true"
+            {
-            "2, monitor:eDP-1"
+              workspace = "1";
-            "3, monitor:eDP-1"
+              monitor = "eDP-1";
-            "4, monitor:HDMI-A-1"
+              default = true;
-            "5, monitor:HDMI-A-1,border:false,rounding:false"
+            }
-            "6, monitor:HDMI-A-1"
+            {
+              workspace = "2";
+              monitor = "eDP-1";
+            }
+            {
+              workspace = "3";
+              monitor = "eDP-1";
+            }
+            {
+              workspace = "4";
+              monitor = "HDMI-A-1";
+            }
+            {
+              workspace = "5";
+              monitor = "HDMI-A-1";
+              no_border = true;
+              no_rounding = true;
+            }
+            {
+              workspace = "6";
+              monitor = "HDMI-A-1";
+            }
           ];
-          windowrule = [
+          window_rule = [
-            "match:class dev.zed.Zed, workspace 1"
+            {
-            "match:class Msty, workspace 1"
+              match.class = "dev.zed.Zed";
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
+              workspace = "1";
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+            }
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+            {
-            "match:class ^steam_app_\\d+$, fullscreen on"
+              match.class = "Msty";
-            "match:class ^steam_app_\\d+$, workspace 5"
+              workspace = "1";
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            }
+            {
+              match.class = "^(com.obsproject.Studio)$";
+              workspace = "2";
+            }
+            {
+              match.class = "^(brave-browser)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.class = "^(vivaldi-stable)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.class = "^steam_app_\\d+$";
+              fullscreen = true;
+            }
+            {
+              match.class = "^steam_app_\\d+$";
+              workspace = "5";
+            }
+            {
+              match.class = "^steam_app_\\d+$";
+              idle_inhibit = "focus";
+            }
           ];
         };
       };

hosts/m3-hermes/configuration.nix

@@ -13,6 +13,18 @@
   networking.hostName = "m3-hermes";
   networking.hostId = "a1b2c3d4"; # TODO: Generate unique hostId
   networking.networkmanager.enable = true;
+
+  # Matrix homeserver pin: DNS on this host resolves exclusively via the
+  # Netbird-managed resolver (see /etc/resolv.conf → wt0). When the Netbird
+  # nameserver group is unreachable, matrix.m3ta.dev fails to resolve and the
+  # gateway cannot log in (observed 2026-08-16). Pinning the public IP of
+  # m3-atlas (TLS termination for matrix.m3ta.dev) makes the Matrix connection
+  # independent of Netbird DNS health. Update here if the m3-atlas public IP
+  # ever changes.
+  networking.hosts = {
+    "152.53.85.162" = ["matrix.m3ta.dev"];
+  };
+
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
 

hosts/m3-hermes/services/hermes-agent.nix

@@ -104,6 +104,15 @@ in {
       GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
       GIT_INIT_DEFAULT_BRANCH = "master";
 
+      # ── Matrix: stable device (Fix 0, root cause of ghost-device churn) ──
+      # Every gateway restart with password login creates a NEW device on the
+      # homeserver when MATRIX_DEVICE_ID is unset. The matching secret
+      # MATRIX_ACCESS_TOKEN lives in agenix (secrets/hermes-env.age). The token
+      # also keeps Matrix in the gateway's reconnect queue: without it, a
+      # failed startup (e.g. transient DNS outage) permanently drops the
+      # platform ("no bot credential on queued config").
+      MATRIX_DEVICE_ID = "HERMES01";
+
       # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
       # Accessible via Netbird mesh VPN — not exposed to the public internet.
       # Bind to 0.0.0.0 so the Netbird interface can reach it.

hosts/m3-kratos/home.nix

@@ -7,7 +7,14 @@
   lib,
   ...
 }:
-with lib; {
+with lib; let
+  mkEnvVar = name: value: {
+    _args = [
+      name
+      value
+    ];
+  };
+in {
   imports = [
   ];
 
@@ -47,40 +54,89 @@ with lib; {
         enable = true;
         settings = {
           monitor = [
-            "DP-1,2560x1440@144,0x0,1"
+            {
-            "DP-2,2560x1440@144,2560x0,1"
+              output = "DP-1";
+              mode = "2560x1440@144";
+              position = "0x0";
+              scale = 1;
+            }
+            {
+              output = "DP-2";
+              mode = "2560x1440@144";
+              position = "2560x0";
+              scale = 1;
+            }
           ];
-          workspace = [
+          workspace_rule = [
-            "1, monitor:DP-1, default:true"
+            {
-            "2, monitor:DP-1"
+              workspace = "1";
-            "3, monitor:DP-1"
+              monitor = "DP-1";
-            "4, monitor:DP-2"
+              default = true;
-            "5, monitor:DP-2"
+            }
-            "6, monitor:DP-2"
+            {
-            "7, monitor:DP-2"
+              workspace = "2";
+              monitor = "DP-1";
+            }
+            {
+              workspace = "3";
+              monitor = "DP-1";
+            }
+            {
+              workspace = "4";
+              monitor = "DP-2";
+            }
+            {
+              workspace = "5";
+              monitor = "DP-2";
+            }
+            {
+              workspace = "6";
+              monitor = "DP-2";
+            }
+            {
+              workspace = "7";
+              monitor = "DP-2";
+            }
           ];
-          # m3ta-home sets QT_QPA_PLATFORMTHEME=gtk3 globally for Hyprland.
+          # m3ta-home sets QT_QPA_PLATFORMTHEME to gtk3 globally for Hyprland.
           # ksnip crashes with duplicate GDK type registration under that Qt GTK
           # platform theme, so use qtct for Qt apps on this host instead.
-          env = mkForce [
+          "env" = mkForce [
-            "XCURSOR_SIZE,32"
+            (mkEnvVar "XCURSOR_SIZE" "32")
-            "HYPRCURSOR_THEME,Bibata-Modern-Ice"
+            (mkEnvVar "HYPRCURSOR_THEME" "Bibata-Modern-Ice")
-            "WLR_NO_HARDWARE_CURSORS,1"
+            (mkEnvVar "WLR_NO_HARDWARE_CURSORS" "1")
-            "XDG_CURRENT_DESKTOP,Hyprland"
+            (mkEnvVar "XDG_CURRENT_DESKTOP" "Hyprland")
-            "XDG_SESSION_TYPE,wayland"
+            (mkEnvVar "XDG_SESSION_TYPE" "wayland")
-            "XDG_SESSION_DESKTOP,Hyprland"
+            (mkEnvVar "XDG_SESSION_DESKTOP" "Hyprland")
-            "XKB_DEFAULT_LAYOUT,de"
+            (mkEnvVar "XKB_DEFAULT_LAYOUT" "de")
-            "NIXOS_OZONE_WL,1"
+            (mkEnvVar "NIXOS_OZONE_WL" "1")
-            "QT_QPA_PLATFORM,wayland;xcb"
+            (mkEnvVar "QT_QPA_PLATFORM" "wayland;xcb")
-            "QT_QPA_PLATFORMTHEME,qt5ct"
+            (mkEnvVar "QT_QPA_PLATFORMTHEME" "qt5ct")
-            "QT_QPA_PLATFORMTHEME_QT6,qt6ct"
+            (mkEnvVar "QT_QPA_PLATFORMTHEME_QT6" "qt6ct")
           ];
-          windowrule = [
+          window_rule = [
-            "match:class dev.zed.Zed, workspace 1"
+            {
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
+              match.class = "dev.zed.Zed";
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              workspace = "1";
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+            }
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            {
+              match.class = "^(com.obsproject.Studio)$";
+              workspace = "2";
+            }
+            {
+              match.class = "^(brave-browser)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.class = "^(vivaldi-stable)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.class = "^steam_app_\\d+$";
+              idle_inhibit = "focus";
+            }
           ];
         };
       };

overlays/default.nix

@@ -7,22 +7,10 @@
   # This one contains whatever you want to overlay
   # You can change versions, add patches, set compilation flags, anything really.
   # https://nixos.wiki/wiki/Overlays
-  modifications = final: prev: {
+  modifications = final: _prev: {
-    #   n8n = import ./mods/n8n.nix {inherit prev;};
+    # aardvark-dns 2.x has a DNS forwarding bug breaking external name
-
+    # resolution in podman networks — pin to last 1.x from nixpkgs-stable.
-    #   brave = prev.brave.override {
+    aardvark-dns = import ./mods/aardvark-dns.nix {inherit (final) stable;};
-    #     commandLineArgs = "--password-store=gnome-libsecret";
-    #     };
-
-    # hyprpanel = inputs.hyprpanel.packages.${prev.system}.default.overrideAttrs (prev: {
-    #   version = "latest"; # or whatever version you want
-    #   src = final.fetchFromGitHub {
-    #     owner = "Jas-SinghFSU";
-    #     repo = "HyprPanel";
-    #     rev = "master"; # or a specific commit hash
-    #     hash = "sha256-l623fIVhVCU/ylbBmohAtQNbK0YrWlEny0sC/vBJ+dU=";
-    #   };
-    # });
   };
 
   # temp-packages = final: _prev: {
@@ -64,15 +52,36 @@
   # recursion that occurs when accessing final/prev.system while the fixed-point
   # is still being computed.  Exposed via outputs.lib, not outputs.overlays.
   #
-  # Filters out the 16 internal helpers (marked `passthru.hideFromDocs = true`
+  # Use llm-agents' shared-nixpkgs overlay so packages with optional GPU support
+  # (notably qmd) are built against this system's pkgs/config. Using the flake's
+  # pre-built `packages.${system}` set pins them to llm-agents' own nixpkgs,
+  # where allowUnfree is false; qmd.override { cudaSupport = true; } then fails
+  # on CUDA EULA packages during the m3-ares NVIDIA specialisation build.
+  #
+  # Keep the exposed top-level package names aligned with llm-agents' filtered
+  # flake packages, but take the package values from the shared package set.
+  # Filters out internal helpers (marked `passthru.hideFromDocs = true`
   # upstream) that would otherwise clobber nixpkgs attributes. Most critically
   # this excludes `buildNpmPackage` — llm-agents' buildNpmPackage is a guarded
   # re-export whose `__functor`/`override` interaction with makeOverridable
   # breaks any package (e.g. nixpkgs' webcord) that calls
   # `buildNpmPackage.override { nodejs = ...; }`. See numtide/llm-agents.nix
   # commit 40490259 and the wrapper at packages/buildNpmPackage/package.nix.
-  mkLlmAgentsOverlay = system: _final: _prev:
+  mkLlmAgentsOverlay = system: final: prev: let
-    builtins.removeAttrs (inputs.llm-agents.packages.${system} or {}) [
+    sharedPackages = (inputs.llm-agents.overlays.shared-nixpkgs final prev).llm-agents or {};
+    exposedPackageNames =
+      builtins.filter
+      (name: inputs.nixpkgs.lib.hasAttrByPath [name] sharedPackages)
+      (builtins.attrNames (inputs.llm-agents.packages.${system} or {}));
+    exposedPackages =
+      builtins.listToAttrs
+      (map (name: {
+          inherit name;
+          value = sharedPackages.${name};
+        })
+        exposedPackageNames);
+  in
+    builtins.removeAttrs exposedPackages [
       # Internal helpers from packages/* marked hideFromDocs upstream:
       "antigravity"
       "auto-claude"

overlays/mods/aardvark-dns.nix

@@ -0,0 +1,12 @@
+# aardvark-dns pinned to the 1.x series.
+#
+# aardvark-dns 2.x has a DNS forwarding bug that breaks resolution of
+# external hostnames in podman networks.  1.17.1 is the last 1.x release
+# and is taken from nixpkgs-stable (nixos-26.05), which ships it together
+# with netavark 1.17.2 — the same netavark version as our unstable input,
+# so this is the exact upstream-tested combination.
+#
+# No further wiring needed: the nixpkgs podman package pulls aardvark-dns
+# in via callPackage and symlinks it into libexec/podman (helpersBin), so
+# overriding the top-level attribute propagates to podman automatically.
+{stable}: stable.aardvark-dns