feat: migrate host Hyprland configs to Lua (Hyprland 0.55+)

- m3-kratos/home.nix: use hl.monitor({}), hl.workspace_rule({}),
  hl.window_rule({}) table-based Lua API
- m3-ares/home.nix: same Lua API + tuxedo-backlight via hl.on()
- Update flake.lock: home-manager -> 74f170c6 (2026-05-18)

.beads/.gitignore

@@ -0,0 +1,73 @@
+# Dolt database (managed by Dolt, not git)
+dolt/
+embeddeddolt/
+
+# Runtime files
+bd.sock
+bd.sock.startlock
+sync-state.json
+last-touched
+.exclusive-lock
+
+# Daemon runtime (lock, log, pid)
+daemon.*
+
+# Interactions log (runtime, not versioned)
+interactions.jsonl
+
+# Push state (runtime, per-machine)
+push-state.json
+
+# Lock files (various runtime locks)
+*.lock
+
+# Credential key (encryption key for federation peer auth — never commit)
+.beads-credential-key
+
+# Local version tracking (prevents upgrade notification spam after git ops)
+.local_version
+
+# Worktree redirect file (contains relative path to main repo's .beads/)
+# Must not be committed as paths would be wrong in other clones
+redirect
+
+# Sync state (local-only, per-machine)
+# These files are machine-specific and should not be shared across clones
+.sync.lock
+export-state/
+export-state.json
+
+# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
+ephemeral.sqlite3
+ephemeral.sqlite3-journal
+ephemeral.sqlite3-wal
+ephemeral.sqlite3-shm
+
+# Dolt server management (auto-started by bd)
+dolt-server.pid
+dolt-server.log
+dolt-server.lock
+dolt-server.port
+dolt-server.activity
+
+# Corrupt backup directories (created by bd doctor --fix recovery)
+*.corrupt.backup/
+
+# Backup data (auto-exported JSONL, local-only)
+backup/
+
+# Per-project environment file (Dolt connection config, GH#2520)
+.env
+
+# Legacy files (from pre-Dolt versions)
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+db.sqlite
+bd.db
+# NOTE: Do NOT add negation patterns here.
+# They would override fork protection in .git/info/exclude.
+# Config files (metadata.json, config.yaml) are tracked by git by default
+# since no pattern above ignores them.

.beads/README.md

@@ -0,0 +1,81 @@
+# Beads - AI-Native Issue Tracking
+
+Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
+
+## What is Beads?
+
+Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
+
+**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
+
+## Quick Start
+
+### Essential Commands
+
+```bash
+# Create new issues
+bd create "Add user authentication"
+
+# View all issues
+bd list
+
+# View issue details
+bd show <issue-id>
+
+# Update issue status
+bd update <issue-id> --claim
+bd update <issue-id> --status done
+
+# Sync with Dolt remote
+bd dolt push
+```
+
+### Working with Issues
+
+Issues in Beads are:
+- **Git-native**: Stored in Dolt database with version control and branching
+- **AI-friendly**: CLI-first design works perfectly with AI coding agents
+- **Branch-aware**: Issues can follow your branch workflow
+- **Always in sync**: Auto-syncs with your commits
+
+## Why Beads?
+
+✨ **AI-Native Design**
+- Built specifically for AI-assisted development workflows
+- CLI-first interface works seamlessly with AI coding agents
+- No context switching to web UIs
+
+🚀 **Developer Focused**
+- Issues live in your repo, right next to your code
+- Works offline, syncs when you push
+- Fast, lightweight, and stays out of your way
+
+🔧 **Git Integration**
+- Automatic sync with git commits
+- Branch-aware issue tracking
+- Dolt-native three-way merge resolution
+
+## Get Started with Beads
+
+Try Beads in your own projects:
+
+```bash
+# Install Beads
+curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
+
+# Initialize in your repo
+bd init
+
+# Create your first issue
+bd create "Try out Beads"
+```
+
+## Learn More
+
+- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
+- **Quick Start Guide**: Run `bd quickstart`
+- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
+
+---
+
+*Beads: Issue tracking that moves at the speed of thought* ⚡

.beads/config.yaml

@@ -0,0 +1,56 @@
+# Beads Configuration File
+# This file configures default behavior for all bd commands in this repository
+# All settings can also be set via environment variables (BD_* prefix)
+# or overridden with command-line flags
+
+# Issue prefix for this repository (used by bd init)
+# If not set, bd init will auto-detect from directory name
+# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
+# issue-prefix: ""
+
+# Use no-db mode: JSONL-only, no Dolt database
+# When true, bd will use .beads/issues.jsonl as the source of truth
+# no-db: false
+
+# Enable JSON output by default
+# json: false
+
+# Feedback title formatting for mutating commands (create/update/close/dep/edit)
+# 0 = hide titles, N > 0 = truncate to N characters
+# output:
+#   title-length: 255
+
+# Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
+# actor: ""
+
+# Export events (audit trail) to .beads/events.jsonl on each flush/sync
+# When enabled, new events are appended incrementally using a high-water mark.
+# Use 'bd export --events' to trigger manually regardless of this setting.
+# events-export: false
+
+# Multi-repo configuration (experimental - bd-307)
+# Allows hydrating from multiple repositories and routing writes to the correct database
+# repos:
+#   primary: "."  # Primary repo (where this database lives)
+#   additional:   # Additional repos to hydrate from (read-only)
+#     - ~/beads-planning  # Personal planning repo
+#     - ~/work-planning   # Work planning repo
+
+# JSONL backup (periodic export for off-machine recovery)
+# Auto-enabled when a git remote exists. Override explicitly:
+# backup:
+#   enabled: false     # Disable auto-backup entirely
+#   interval: 15m      # Minimum time between auto-exports
+#   git-push: false    # Disable git push (export locally only)
+#   git-repo: ""       # Separate git repo for backups (default: project repo)
+
+# Integration settings (access with 'bd config get/set')
+# These are stored in the database, not in this file:
+# - jira.url
+# - jira.project
+# - linear.url
+# - linear.api-key
+# - github.org
+# - github.repo
+
+sync.remote: "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixos-config.git"

.beads/hooks/post-checkout

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run post-checkout "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'post-checkout' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run post-checkout "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'post-checkout'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/post-merge

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run post-merge "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'post-merge' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run post-merge "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'post-merge'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/pre-commit

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run pre-commit "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'pre-commit' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run pre-commit "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'pre-commit'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/pre-push

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run pre-push "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'pre-push' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run pre-push "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'pre-push'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/prepare-commit-msg

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run prepare-commit-msg "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'prepare-commit-msg' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run prepare-commit-msg "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'prepare-commit-msg'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/issues.jsonl

@@ -0,0 +1,3 @@
+{"_type":"issue","id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}

.beads/metadata.json

@@ -0,0 +1,7 @@
+{
+  "database": "dolt",
+  "backend": "dolt",
+  "dolt_mode": "embedded",
+  "dolt_database": "home_profile_restructuring",
+  "project_id": "664fc7e3-94eb-4874-aab6-e47835abe9d8"
+}

.gitignore

@@ -25,18 +25,24 @@ Thumbs.db
 .opencode-rules
 opencode.json
 
-# Taskplane runtime artifacts (machine-specific, do not commit)
-.pi/batch-state.json
-.pi/batch-history.json
-.pi/lane-state-*
-.pi/merge-result-*
-.pi/merge-request-*
-.pi/worker-conversation-*
-.pi/orch-logs/
-.pi/orch-abort-signal
-.pi/settings.json
+# AI agent state
+.claude/
+.sidecar/
+.sidecar-*
+.sisyphus/
+.sidecar-agent
+.sidecar-task
+.sidecar-pr
+.sidecar-start.sh
+.sidecar-base
+.td-root
+.cache
+.pi*
 .worktrees/
-.taskplane-tasks/
+docs/plans/
+CLAUDE.md
 
-# Pi project-local packages (if using pi install -l)
-.pi/npm/
+# Beads / Dolt files (added by bd init)
+.dolt/
+*.db
+.beads-credential-key

AGENTS.md

@@ -1,157 +1,445 @@
-# NIXOS CONFIGURATION KNOWLEDGE BASE
+# Agent Instructions
 
-**Generated:** 2025-12-31 16:13:40 UTC  
-**Commit:** ebc8291  
-**Branch:** HEAD
+This project uses **bd** (beads) for issue tracking. Run `bd prime` for full workflow context.
 
-## OVERVIEW
-Personal NixOS configuration managing 6 hosts (4 servers, 2 desktops) using flakes, agenix secrets, and feature-based home-manager setup.
+## Quick Reference
 
-## STRUCTURE
-```
-./
-├── flake.nix              # Main entry: host definitions, inputs, outputs
-├── secrets.nix            # Agenix public key mappings
-├── hosts/
-│   ├── common/            # Shared: base config, users, extraServices, ports
-│   ├── m3-atlas/          # Server: 20+ containerized services with Traefik
-│   ├── m3-helios/         # Server: AdGuard, internal routing
-│   ├── m3-ares/           # Desktop: NVIDIA GPU, Btrfs
-│   ├── m3-kratos/         # Desktop: AMD GPU, ZFS
-│   └── m3-aether/         # Cloud VM
-├── home/
-│   ├── common/            # Home-manager base config
-│   ├── features/          # Modular feature toggles (cli, desktop, coding)
-│   └── m3tam3re/          # Per-host user configs
-├── modules/               # Custom NixOS/home-manager modules
-├── overlays/              # Package overlays (stable, locked, pinned, master)
-├── pkgs/                  # Custom package definitions
-└── secrets/               # Agenix encrypted .age files (19 secrets)
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add new host | `flake.nix` + `hosts/<name>/` | Copy template from m3-atlas (server) or m3-ares (desktop) |
-| Add service to m3-atlas | `hosts/m3-atlas/services/` | See containers/ for Podman + Traefik pattern |
-| Configure desktop features | `home/features/desktop/` | Feature toggles with mkEnableOption |
-| Add CLI tool | `home/features/cli/` | Fish + Nushell integration expected |
-| Manage secrets | `secrets.nix` + `agenix -e` | SSH keys defined in secrets.nix |
-| Define ports | `hosts/common/ports.nix` | Centralized port registry |
-| Add user | `hosts/common/users/` | Shared across all hosts |
-| Custom packages | `pkgs/default.nix` | Exposed via flake outputs |
-
-## CONVENTIONS
-
-### Secrets (agenix)
-- **Create**: `agenix -e secrets/<name>.age` after adding keys to `secrets.nix`
-- **Reference**: `config.age.secrets.<name>.path` in service configs
-- **Pattern**: Service env files use `environmentFiles = [config.age.secrets.<service>-env.path]`
-
-### Service Organization
-- **Native services**: `hosts/<host>/services/<service>.nix`
-- **Containers**: `hosts/<host>/services/containers/<service>.nix`
-- **Traefik integration**: All m3-atlas services include dynamic config for SSL + routing
-- **Networking**: Containers use dedicated `web` network (10.89.0.0/24) with static IPs
-
-### Port Management
-- **Registry**: All ports defined in `hosts/common/ports.nix`
-- **Access**: `config.m3ta.ports.get "service-name"`
-- **Convention**: Internal services use 3000-3020 range
-
-### Home-Manager Features
-- **Enable**: `features.<category>.<feature>.enable = true` in user config
-- **Categories**: `cli`, `desktop`, `coding`
-- **Pattern**: Features are opt-in modules with default.nix aggregators
-
-### Multiple nixpkgs Inputs
-- **stable**: 25.11 release
-- **locked/pinned**: Specific commits for compatibility
-- **master**: Bleeding edge
-- **m3ta-nixpkgs**: Custom local overlay at `path:/home/m3tam3re/p/nix/nixpkgs`
-
-## COMMANDS
 ```bash
-# Build/deploy specific host
-sudo nixos-rebuild switch --flake .#m3-ares
-
-# Build/deploy current host
-sudo nixos-rebuild switch --flake .#$(uname -n)
-
-# Home-manager update
-home-manager --flake . switch
-
-# Update all flake inputs
-nix flake update
-
-# Add/edit secret
-agenix -e secrets/<name>.age
-
-# Infrastructure shell (OpenTofu)
-nix develop .#infraShell
-
-# Check configuration (no activation)
-nixos-rebuild dry-build --flake .#<hostname>
+bd ready              # Find available work
+bd show <id>          # View issue details
+bd update <id> --claim  # Claim work atomically
+bd close <id>         # Complete work
+bd dolt push          # Push beads data to remote
 ```
 
-## TRAEFIK PATTERNS (m3-atlas only)
+## Non-Interactive Shell Commands
 
-### SSL Termination
-- **Provider**: Godaddy DNS challenge
-- **Cert storage**: `/var/lib/traefik/acme.json`
-- **Config**: `hosts/m3-atlas/services/traefik.nix`
+**ALWAYS use non-interactive flags** with file operations to avoid hanging on confirmation prompts.
+
+Shell commands like `cp`, `mv`, and `rm` may be aliased to include `-i` (interactive) mode on some systems, causing the agent to hang indefinitely waiting for y/n input.
+
+**Use these forms instead:**
+
+```bash
+# Force overwrite without prompting
+cp -f source dest           # NOT: cp source dest
+mv -f source dest           # NOT: mv source dest
+rm -f file                  # NOT: rm file
+
+# For recursive operations
+rm -rf directory            # NOT: rm -r directory
+cp -rf source dest          # NOT: cp -r source dest
+```
+
+**Other commands that may prompt:**
+
+- `scp` - use `-o BatchMode=yes` for non-interactive
+- `ssh` - use `-o BatchMode=yes` to fail instead of prompting
+- `apt-get` - use `-y` flag
+- `brew` - use `HOMEBREW_NO_AUTO_UPDATE=1` env var
+
+<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
+
+## Beads Issue Tracker
+
+This project uses **bd (beads)** for persistent task tracking. Run `bd prime` for full workflow context.
+
+### Why Beads?
+
+- **Prefer Beads over ad-hoc markdown TODO lists** — Beads provides structured, queryable, shareable issue tracking with dependency management
+- **Never use `bd edit`** — it opens an interactive editor which blocks agent workflows
+- **Use flags and stdin instead** — `bd update <id> --claim`, `bd create --title "..." --estimate 2`
+
+### Slash Commands (Agent Workflow)
+
+| Command | Purpose |
+|---------|---------|
+| `/beads:ready` | Find unblocked issues |
+| `/beads:create` | Create a new issue |
+| `/beads:update` | Update an issue (claim, status) |
+| `/beads:close` | Close completed work |
+| `/beads:stats` | Project-level snapshot |
+
+### Core Workflow (6 Steps)
+
+#### 1. Find Unblocked Work
+```bash
+bd ready --json
+```
+Lists issues with no blocking dependencies that are ready to work on.
+
+#### 2. Claim Work
+```bash
+bd update <id> --claim
+```
+Atomically assigns the issue to you (sets status to "in-progress").
+
+#### 3. Inspect Details
+```bash
+bd show <id>
+```
+View full issue details including:
+- Description and acceptance criteria
+- Blocking/blocked-by dependencies
+- Time estimates
+- Status history
+
+#### 4. Create Newly Discovered Work
+```bash
+# Create a new issue
+bd create \
+  --title "Fix audio on m3-helios" \
+  --estimate 2 \
+  --priority high \
+  --labels nixos,audio
+
+# Link dependencies
+bd dep <id> --blocks <blocked-id>      # This issue blocks another
+bd dep <id> --after <after-id>         # This issue after another completes
+bd dep <id> --requires <requires-id>  # This issue requires another
+```
+
+#### 5. Complete Work
+```bash
+bd close <id> --reason "Added PulseAudio fallback to configuration.nix"
+```
+Provide a concise summary of what was done. The `--reason` is mandatory.
+
+#### 6. Project Snapshot
+```bash
+bd status --json    # Current state of all issues
+bd stats            # Metrics: velocity, cycle time, bottlenecks
+```
+
+### Example Complete Workflow
+
+```bash
+# Start session - find work
+bd ready --json
+
+# Claim available issue
+bd update 42 --claim
+
+# Do the work...
+
+# Discover something else needed
+bd create --title "Document hermes-agent setup" --estimate 1
+# Link as related
+bd dep 43 --after 42
+
+# Complete original
+bd close 42 --reason "Added Hyprland idle timeout config"
+
+# Close related
+bd close 43 --reason "Added setup docs to AGENTS.md"
+
+# Push state to remote
+bd dolt push
+```
+
+### Rules
+
+- Use `bd` for ALL task tracking — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
+- Run `bd prime` for detailed command reference and session close protocol
+- Use `bd remember` for persistent knowledge — do NOT use MEMORY.md files
+
+## Session Completion
+
+**When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
+
+**MANDATORY WORKFLOW:**
+
+1. **File issues for remaining work** - Create issues for anything that needs follow-up
+2. **Run quality gates** (if code changed) - Tests, linters, builds
+3. **Update issue status** - Close finished work, update in-progress items
+4. **PUSH TO REMOTE** - This is MANDATORY:
+   ```bash
+   git pull --rebase
+   bd dolt push
+   git push
+   git status  # MUST show "up to date with origin"
+   ```
+5. **Clean up** - Clear stashes, prune remote branches
+6. **Verify** - All changes committed AND pushed
+7. **Hand off** - Provide context for next session
+
+**CRITICAL RULES:**
+
+- Work is NOT complete until `git push` succeeds
+- NEVER stop before pushing - that leaves work stranded locally
+- NEVER say "ready to push when you are" - YOU must push
+- If push fails, resolve and retry until it succeeds
+<!-- END BEADS INTEGRATION -->
+
+# Project Agent
+
+**Workspace Path:** `/home/m3tam3re/p/NIX/nixos-config`
+_(Note to Pi: Your file write/edit tools run in a different directory by default. You MUST use absolute paths starting with the Workspace Path above for ALL file operations!)_
+
+**Generated:** 2026-04-26
+
+---
+
+## Stack
+
+| Component        | Version/Source                    |
+| ---------------- | --------------------------------- |
+| **Nixpkgs**      | nixos-unstable + 25.05 stable     |
+| **Home Manager** | github:nix-community/home-manager |
+| **m3ta-home**    | code.m3ta.dev/m3tam3re/m3ta-home  |
+| **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs    |
+| **Agenix**       | github:ryantm/agenix              |
+| **Disko**        | github:nix-community/disko        |
+| **NUR**          | github:nix-community/NUR          |
+| **Formatter**    | alejandra                         |
+| **Linters**      | statix, deadnix                   |
+| **IDE**          | nixd                              |
+| **Hermes Agent** | NousResearch/hermes-agent         |
+| **LLM Agents**   | numtide/llm-agents.nix            |
+
+---
+
+## Structure
+
+```
+nixos-config/
+├── flake.nix                    # Entry point: hosts, overlays, dev shells, m3ta-home input
+├── coding-rules.json            # Opencode rules configuration
+│
+├── hosts/                        # Per-host NixOS configurations
+│   ├── common/                   # Shared across all hosts
+│   │   ├── users/
+│   │   │   └── m3tam3re.nix     # ← Central user + m3ta-home integration
+│   │   ├── default.nix          # Shared NixOS settings, overlays, home-manager setup
+│   │   ├── ports.nix            # Network ports config
+│   │   └── extraServices/       # Common service toggles
+│   ├── m3-ares/                  # TUXEDO laptop (desktop)
+│   │   └── home.nix             # Hyprland: eDP-1 + HDMI, XDG/MIME
+│   ├── m3-kratos/                # AMD desktop (desktop)
+│   │   └── home.nix             # Hyprland: dual DP, XDG/MIME
+│   ├── m3-daedalus/              # Portable laptop (desktop, no Hyprland)
+│   │   └── home.nix             # XDG/MIME only
+│   ├── m3-atlas/                 # Primary server (server + coding)
+│   ├── m3-helios/                # AdGuard DNS server (minimal server)
+│   ├── m3-hermes/                # Secondary server (minimal server)
+│   └── m3-aether/                # Cloud VM (minimal server)
+│
+├── modules/                      # Reusable NixOS modules
+│   └── nixos/                    # NixOS-specific modules
+│
+├── overlays/                    # Package overlays (stable/locked/master/pinned)
+│   ├── default.nix
+│   └── mods/
+│
+├── pkgs/                        # Custom packages
+│
+├── secrets/                     # Encrypted secrets (agenix)
+│   └── secrets.nix
+│
+├── .opencode-rules/             # Opencode AI rules
+│   ├── concerns/
+│   ├── languages/nix.md
+│   └── USAGE.md
+│
+└── .pi/                         # Agent configuration
+```
+
+### Home-Manager Integration
+
+Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
+- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
+- **Docs**: See m3ta-home README for full documentation
+
+What lives where:
+
+| Concern | Location | Why |
+|---------|----------|-----|
+| Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
+| User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
+| Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
+| Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
+| XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
+| NixOS overlays | `nixos-config/overlays/` | System-level package management |
+
+#### Host → Profile Mapping
+
+Defined in `hosts/common/users/m3tam3re.nix`:
 
-### Service Integration Template
 ```nix
-services.traefik.dynamicConfigOptions.http = {
-  services.<name>.loadBalancer.servers = [{ url = "http://127.0.0.1:<port>"; }];
-  routers.<name> = {
-    rule = "Host(`<subdomain>.m3ta.dev`)";
-    service = "<name>";
-    tls.certResolver = "godaddy";
-  };
+hostProfiles = {
+  # Desktop hosts
+  m3-ares     = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-kratos   = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
+  # Server hosts
+  m3-atlas    = { context = "server";  sets = ["coding"]; };
+  m3-helios   = { context = "server";  sets = []; };
+  m3-hermes   = { context = "server";  sets = []; };
+  m3-aether   = { context = "server";  sets = []; };
 };
 ```
 
-### Container Pattern
-- **Network**: `--network=web --ip=10.89.0.<sequential>`
-- **Ports**: Bind localhost only (`127.0.0.1:<external>:<internal>`)
-- **Database access**: `--add-host=mysql:10.89.0.1` (gateway IP)
+#### Work Identity Use Case
 
-## HOST ROLES
+The same `m3ta-home` repo supports a **work identity** for company machines:
 
-| Host | Type | Hardware | Purpose |
-|------|------|----------|---------|
-| m3-atlas | Server | x86_64, disko | 20+ services, Traefik hub, PostgreSQL, MySQL |
-| m3-helios | Server | x86_64, disko | AdGuard DNS, internal routing |
-| m3-ares | Desktop | NVIDIA, Btrfs | Personal workstation, n8n, PostgreSQL |
-| m3-kratos | Desktop | AMD, ZFS | Workstation, mem0, PostgreSQL |
-| m3-aether | Cloud | QEMU | General purpose VM |
-| m3-daedalus | Laptop | home-only | Portable (no full NixOS config) |
+```nix
+# On a work NixOS machine:
+(m3ta-lib.mkHome {
+  user = "m3tam3re";
+  identity = "work";       # ← switches git to sascha.koenig, SSH to AZ hosts
+  context = "desktop";
+  sets = ["coding"];
+})
+```
 
-## ANTI-PATTERNS (THIS PROJECT)
+This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.
 
-- **DON'T** add secrets to `secrets/` without updating `secrets.nix` public keys
-- **DON'T** hardcode ports - use `config.m3ta.ports.get` or add to registry
-- **DON'T** create containers outside the `web` network on m3-atlas
-- **DON'T** skip Traefik config for public-facing services on m3-atlas
-- **DON'T** bypass extraServices flags - use `hosts/common/extraServices/` pattern
-- **DON'T** commit unencrypted secrets or test with real credentials
+---
 
-## UNIQUE TO THIS CONFIG
+## Commands
 
-- **Custom m3ta-nixpkgs**: Local overlay for unreleased/patched packages
-- **extraServices abstraction**: Boolean flags to toggle Podman, Ollama, virtualisation per host
-- **Mythological naming**: All hosts named after Greek mythology
-- **Dual domain strategy**: New services on `m3ta.dev`, legacy redirects from `m3tam3re.com`
-- **Per-host nixpkgs versions**: Different hosts can use different nixpkgs commits via specialArgs
-- **Container IP registry**: Static IP assignments in 10.89.0.0/24 subnet for predictable networking
+| Action               | Command                                                                | Notes                                             |
+| -------------------- | ---------------------------------------------------------------------- | ------------------------------------------------- |
+| **Enter dev shell**  | `nix develop`                                                          | Includes alejandra, nixd, agenix, statix, deadnix |
+| **Build host**       | `sudo nixos-rebuild switch --flake .#m3-ares`                          | Replace hostname as needed                        |
+| **Dry run build**    | `sudo nixos-rebuild dry-run --flake .#m3-ares`                         | Validate without applying                         |
+| **List hosts**       | `nix flake show`                                                       | Shows all NixOS configurations                    |
+| **Update flake**     | `sudo nixos-rebuild switch --flake .#m3-ares --update-input nixpkgs`   | Update specific input                             |
+| **Format code**      | `alejandra .`                                                          | Run before committing                             |
+| **Check lint**       | `statix check .`                                                       | Run statix for antipatterns                       |
+| **Remove dead code** | `deadnix -w .`                                                         | Clean up unused let bindings                      |
+| **Build ISO**        | `nix build .#nixosConfigurations.m3-ares.config.system.build.isoImage` | Generate install ISO                              |
 
-## NOTES
+---
 
-- m3-atlas is the service hub - most complex configuration
-- Secrets require host SSH keys defined in `secrets.nix` before `agenix -e` works
-- Fish and Nushell both configured - choose per-user with shell aliases
-- Color scheme (Dracula) applied via nix-colors across all visual tools
-- See subdirectory AGENTS.md for deep dives on containers, desktop features, CLI tools
+## Conventions
+
+### Formatting & Style
+
+- **Formatter:** `alejandra` (mandatory, run before commits)
+- **Indentation:** 2 spaces (alejandra default)
+- **Variables:** camelCase (e.g., `maxRetryAttempts`)
+- **Types/Modules:** PascalCase (e.g., `MyService`)
+- **Constants:** UPPER_SNAKE_CASE (e.g., `MAX_RETRIES`)
+- **Files:** hyphen-case (e.g., `my-file.nix`)
+
+### Nix Module Patterns
+
+```nix
+{ config, lib, pkgs, ... }:
+{
+  options.myService.enable = lib.mkEnableOption "my service";
+  config = lib.mkIf config.myService.enable {
+    services.myService.enable = true;
+  };
+}
+```
+
+### Conditionals
+
+```nix
+config = lib.mkMerge [
+  (lib.mkIf cfg.enable { ... })
+  (lib.mkIf cfg.extraConfig { ... })
+];
+```
+
+### Anti-Patterns (AVOID)
+
+- **Never use `with pkgs;`** — always use explicit package references
+- **Never use `builtins.fetchTarball`** — use flake inputs instead
+- **Never use `import <nixpkgs>`** — always use inputs
+- **Never use `builtins.getAttr/hasAttr`** — use `lib.attrByPath` or `lib.optionalAttrs`
+- **Avoid anonymous functions in config** — extract to named lets
+
+### Imports
+
+- Use flake inputs for dependencies (e.g., `inputs.home-manager.nixosModules.home-manager`)
+- Import relative paths with `./` or `../`
+- Never use absolute paths in imports
+
+### Secrets
+
+- Secrets managed via **agenix** in `secrets/` directory
+- Never commit plaintext secrets
+- Use `.nix` extension for secret files
+
+### Flake Input URLs
+
+All `code.m3ta.dev` inputs use **SSH** URLs:
+```nix
+url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
+```
+Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
+
+---
+
+## Key Files
+
+| File                               | Purpose                                                                                    |
+| ---------------------------------- | ------------------------------------------------------------------------------------------ |
+| `flake.nix`                        | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
+| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`)         |
+| `hosts/common/users/m3tam3re.nix`  | User definition + m3ta-home mkHome integration + per-host feature flags                    |
+| `hosts/<name>/home.nix`            | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME                      |
+| `overlays/default.nix`             | Package version overrides (stable/locked/master branches)                                  |
+| `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns                                                      |
+
+---
+
+## What to Avoid
+
+1. **Don't modify `flake.lock`** directly — use `nix flake update`
+2. **Don't use impure operations** — this is a pure flake-based config
+3. **Don't commit without formatting** — always run `alejandra .` first
+4. **Don't add packages to hosts directly** — prefer adding to overlays or using NUR
+5. **Don't hardcode paths** — use `inputs` and relative imports
+6. **Don't create monolithic modules** — keep functions under 20 lines
+7. **Don't skip the dry-run** — always test with `--dry-run` before switching
+8. **Don't use lib.mkDefault lightly** — understand the precedence implications
+
+---
+
+## Notes
+
+### Adding a New Host
+
+1. Add entry to `flake.nix` → `nixosConfigurations`
+2. Create directory in `hosts/` with:
+   - `default.nix` — imports common + specific configs
+   - `configuration.nix` — host-specific system config
+   - `hardware-configuration.nix` — from `nixos-generate-config`
+   - `programs.nix`, `services/`, `secrets.nix` as needed
+3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
+4. Add feature flags in the `hostFlags` section
+5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
+6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
+
+### Adding a New Package
+
+1. For simple packages: add to appropriate overlay in `overlays/default.nix`
+2. For complex packages: create in `pkgs/` directory
+3. For upstream packages: use NUR or add as flake input
+
+### Adding a New Home-Manager Feature
+
+1. Create the module in `m3ta-home` under the appropriate profile directory
+2. Add the import to the parent `default.nix` in m3ta-home
+3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
+
+### Development Workflow
+
+1. Edit config files
+2. Run `alejandra .` to format
+3. Run `statix check .` for linting
+4. Run `sudo nixos-rebuild dry-run --flake .#m3-ares`
+5. If successful: `sudo nixos-rebuild switch --flake .#m3-ares`
+
+### Remote Building
+
+```bash
+# Build on remote machine
+nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
+ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
+```

coding-rules.json

@@ -0,0 +1 @@
+{"$schema":"https://opencode.ai/config.json","instructions":[".opencode-rules/concerns/coding-style.md",".opencode-rules/concerns/naming.md",".opencode-rules/concerns/documentation.md",".opencode-rules/concerns/testing.md",".opencode-rules/concerns/git-workflow.md",".opencode-rules/concerns/project-structure.md",".opencode-rules/languages/nix.md"]}

flake.nix

@@ -22,8 +22,7 @@
     nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
-    # m3ta-nixpkgs.url = "path:/home/m3tam3re/p/NIX/nixpkgs";
+    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
     llm-agents.url = "github:numtide/llm-agents.nix";
 
     #
@@ -44,9 +43,14 @@
     rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
     nix-colors.url = "github:misterio77/nix-colors";
 
+    m3ta-home = {
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     agents = {
       # url = "path:/home/m3tam3re/p/AI/AGENTS";
-      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS";
     };
     ## Skills
     skills-basecamp = {
@@ -61,11 +65,20 @@
       url = "github:kestra-io/agent-skills";
       flake = false;
     };
+    skills-superpowers = {
+      url = "github:obra/superpowers";
+      flake = false;
+    };
     skills-vercel = {
       url = "github:vercel-labs/skills";
       flake = false;
     };
-    hermes-agent.url = "github:NousResearch/hermes-agent";
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.7";
+
+    rustfs = {
+      url = "github:rustfs/rustfs-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {
@@ -91,7 +104,7 @@
   in {
     packages =
       forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = builtins.removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
     lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
     homeManagerModules = import ./modules/home-manager;
 
@@ -119,6 +132,7 @@
           inputs.disko.nixosModules.disko
           agenix.nixosModules.default
           m3ta-nixpkgs.nixosModules.default
+          inputs.rustfs.nixosModules.rustfs
         ];
       };
       m3-kratos = nixpkgs.lib.nixosSystem {
@@ -178,7 +192,7 @@
         config.allowUnfree = true; # Allow unfree packages in devShell
       };
       m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
-      rules = m3taLib.opencode-rules.mkOpencodeRules {
+      rules = m3taLib.coding-rules.mkCodingRules {
         inherit agents;
         languages = ["nix"];
       };
@@ -189,37 +203,10 @@
           nixd
           openssh
           agenix.packages.${system}.default
+          statix
+          deadnix
         ];
-        inherit (rules) instructions;
-        shellHook = ''
-          ${rules.shellHook}
-          echo "======================================"
-          echo "🧑‍🚀 Nix Development Shell with Opencode Rules"
-          echo "======================================"
-          echo ""
-          echo "Active rules:"
-          echo "  - Nix language conventions"
-          echo "  - Coding-style best practices"
-          echo "  - Naming conventions"
-          echo "  - Documentation standards"
-          echo "  - Testing guidelines"
-          echo "  - Git workflow patterns"
-          echo "  - Project structure guidelines"
-          echo ""
-          echo "Generated files:"
-          echo "  - .opencode-rules/ (symlink to AGENTS repo)"
-          echo "  - opencode.json (configuration file)"
-          echo ""
-          echo "Useful commands:"
-          echo "  - cat opencode.json        View rules configuration"
-          echo "  - ls .opencode-rules/      Browse available rules"
-          echo "  - nix develop              Re-enter this shell"
-          echo ""
-          echo "Remember to add to .gitignore:"
-          echo "  .opencode-rules"
-          echo "  opencode.json"
-          echo "======================================"
-        '';
+        inherit (rules) instructions shellHook;
       };
     });
   };

home/common/default.nix

@@ -1,56 +0,0 @@
-{
-  inputs,
-  lib,
-  outputs,
-  pkgs,
-  system,
-  ...
-}: {
-  imports = [
-    inputs.nix-colors.homeManagerModules.default
-    inputs.m3ta-nixpkgs.homeManagerModules.default
-  ]; #imports = builtins.attrValues outputs.homeManagerModules;
-  nixpkgs = {
-    # You can add overlays here
-    overlays = [
-      # Add overlays your own flake exports (from overlays and pkgs dir):
-      #outputs.overlays.additions
-      #outputs.overlays.modifications
-      outputs.overlays.temp-packages
-      outputs.overlays.stable-packages
-      outputs.overlays.locked-packages
-      outputs.overlays.pinned-packages
-      outputs.overlays.master-packages
-
-      inputs.nur.overlays.default
-      inputs.m3ta-nixpkgs.overlays.default
-      inputs.m3ta-nixpkgs.overlays.modifications
-      (outputs.lib.mkLlmAgentsOverlay system)
-      # You can also add overlays exported from other flakes:
-      # neovim-nightly-overlay.overlays.default
-
-      # Or define it inline, for example:
-      # (final: prev: {
-      #   hi = final.hello.overrideAttrs (oldAttrs: {
-      #     patches = [ ./change-hello-to-hi.patch ];
-      #   });
-      # })
-    ];
-    # Configure your nixpkgs instance
-    config = {
-      # Disable if you don't want unfree packages
-      allowUnfree = true;
-      # Workaround for https://github.com/nix-community/home-manager/issues/2942
-      allowUnfreePredicate = _: true;
-    };
-  };
-
-  nix = {
-    package = lib.mkDefault pkgs.nix;
-    settings = {
-      experimental-features = ["nix-command" "flakes"];
-      warn-dirty = false;
-    };
-  };
-  colorScheme = inputs.nix-colors.colorSchemes.dracula;
-}

home/features/cli/AGENTS.md

@@ -1,65 +0,0 @@
-# CLI FEATURES (home-manager)
-
-**Shell and terminal tooling with Fish + Nushell dual configuration**
-
-## OVERVIEW
-8 CLI modules with integrated tooling across Fish and Nushell shells.
-
-## STRUCTURE
-```
-cli/
-├── default.nix      # Imports + shared tools (bat, eza, direnv)
-├── fish.nix         # Fish shell + aliases
-├── fzf.nix          # Fuzzy finder
-├── nitch.nix        # System info tool
-├── nushell.nix      # Nushell + aliases
-├── secrets.nix      # Password-store integration
-├── starship.nix     # Shell prompt
-└── zellij.nix       # Terminal multiplexer
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add CLI tool | default.nix home.packages | Check if shell integration needed |
-| Shell aliases | fish.nix or nushell.nix | Kept in sync between shells |
-| Prompt config | starship.nix | Uses nerd-fonts symbols |
-| Secret access | secrets.nix | Agenix integration |
-
-## CONVENTIONS
-
-### Shell Integration Pattern
-Tools with shell hooks enabled in both Fish and Nushell:
-- **carapace**: Completions
-- **zoxide**: Smart cd
-- **eza**: ls replacement
-- **direnv**: Directory environments
-- **fzf**: Fuzzy finding
-
-### NixOS Rebuild Aliases (both shells)
-```
-nr/nrs    - nixos-rebuild [switch]
-snr/snrs  - sudo nixos-rebuild [switch]
-hms       - home-manager switch
-```
-
-### Bat Theme
-Custom `universal` theme generated from nix-colors palette in default.nix (lines 34-157).
-
-### Secrets Integration
-Fish/Nushell source `$HOME/.secrets` if `secrets.enable = true` (CLI secrets feature).
-
-## ANTI-PATTERNS
-
-- **DON'T** add aliases to only one shell - keep Fish/Nushell in sync
-- **DON'T** use `programs.bash` - Nushell is default shell
-- **DON'T** bypass carapace for completions - integrated by default
-
-## NOTES
-
-- zellij-ps custom package for project session management
-- Default shell set to Nushell in hosts/common/default.nix
-- Bat theme dynamically generated (no external theme files)
-- lf file manager uses bat for previews
-- Agenix CLI (agenix-cli) included for secret management

home/features/cli/default.nix

@@ -1,230 +0,0 @@
-{
-  config,
-  pkgs,
-  videoDrivers,
-  ...
-}: {
-  imports = [
-    ./fish.nix
-    ./fzf.nix
-    ./nitch.nix
-    ./nushell.nix
-    ./secrets.nix
-    ./starship.nix
-    ./television.nix
-    ./zellij.nix
-  ];
-
-  programs.carapace = {
-    enable = true;
-    enableFishIntegration = true;
-    enableNushellIntegration = true;
-    enableBashIntegration = true;
-  };
-
-  programs.zoxide = {
-    enable = true;
-    enableFishIntegration = true;
-    enableNushellIntegration = true;
-  };
-
-  programs.bat = {
-    enable = true;
-    config = {theme = "universal";};
-    themes = {
-      universal = {
-        src = pkgs.writeText "universal.tmTheme" ''
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-            <key>name</key>
-            <string>Universal (nix-colors)</string>
-            <key>settings</key>
-            <array>
-              <dict>
-                <key>settings</key>
-                <dict>
-                  <key>background</key>
-                  <string>#${config.colorScheme.palette.base00}</string>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>caret</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>selection</key>
-                  <string>#${config.colorScheme.palette.base02}</string>
-                  <key>selectionForeground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>lineHighlight</key>
-                  <string>#${config.colorScheme.palette.base01}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Comment</string>
-                <key>scope</key>
-                <string>comment</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base03}</string>
-                  <key>fontStyle</key>
-                  <string>italic</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>String</string>
-                <key>scope</key>
-                <string>string</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0A}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Number</string>
-                <key>scope</key>
-                <string>constant.numeric</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0E}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Keyword</string>
-                <key>scope</key>
-                <string>keyword</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base08}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Function</string>
-                <key>scope</key>
-                <string>entity.name.function</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0B}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Type</string>
-                <key>scope</key>
-                <string>entity.name.type, storage.type</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0D}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Variable</string>
-                <key>scope</key>
-                <string>variable</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Constant</string>
-                <key>scope</key>
-                <string>constant</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0E}</string>
-                </dict>
-              </dict>
-            </array>
-          </dict>
-          </plist>
-        '';
-      };
-    };
-  };
-
-  programs.direnv = {
-    enable = true;
-    enableNushellIntegration = true;
-    nix-direnv.enable = true;
-  };
-
-  programs.eza = {
-    enable = true;
-    enableFishIntegration = true;
-    enableBashIntegration = true;
-    extraOptions = ["-l" "--icons" "--git" "-a"];
-  };
-
-  programs.lf = {
-    enable = true;
-    settings = {
-      preview = true;
-      drawbox = true;
-      hidden = true;
-      icons = true;
-      theme = "Dracula";
-      previewer = "bat";
-    };
-  };
-
-  cli.zellij-ps = {
-    enable = true;
-    projectFolders = ["/home/m3tam3re/p"];
-  };
-
-  home.packages = with pkgs; [
-    basecamp
-    comma
-    coreutils
-    devenv
-    fabric-ai
-    fd
-    gcc
-    go
-    htop
-    httpie
-    hyprpaper-random
-    jq
-    just
-    lazygit
-    llm
-    lf
-    nix-index
-    nix-update
-    libnotify
-    nushellPlugins.skim
-    progress
-    ripgrep
-    rocmPackages.rocm-smi
-    rocmPackages.rocminfo
-    rocmPackages.rocm-runtime
-    sqlite
-    sqlite-vec
-    tldr
-    pomodoro-timer
-    trash-cli
-    unimatrix
-    unzip
-    vulkan-tools
-    wttrbar
-    wireguard-tools
-    yazi
-    zellij-ps
-    zip
-  ];
-}

home/features/cli/fish.nix

@@ -1,116 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.fish;
-in {
-  options.features.cli.fish.enable = mkEnableOption "enable fish shell";
-
-  config = mkIf cfg.enable {
-    programs.fish = {
-      enable = true;
-      interactiveShellInit = ''
-        # Fish colors using universal nix-colors palette
-        # Text colors
-        set -g fish_color_normal ${config.colorScheme.palette.base05}      # text
-        set -g fish_color_param ${config.colorScheme.palette.base05}       # text
-        set -g fish_color_comment ${config.colorScheme.palette.base03}     # muted
-        set -g fish_color_autosuggestion ${config.colorScheme.palette.base03} # muted
-
-        # Command colors
-        set -g fish_color_command ${config.colorScheme.palette.base0D}     # accent6 (blue)
-        set -g fish_color_quote ${config.colorScheme.palette.base0A}       # accent3 (yellow)
-        set -g fish_color_redirection ${config.colorScheme.palette.base0E} # accent7 (purple)
-        set -g fish_color_end ${config.colorScheme.palette.base08}         # accent1 (red)
-        set -g fish_color_error ${config.colorScheme.palette.base08}       # accent1 (red)
-        set -g fish_color_operator ${config.colorScheme.palette.base0C}    # accent5 (cyan)
-        set -g fish_color_escape ${config.colorScheme.palette.base09}      # accent2 (orange)
-
-        # Path colors
-        set -g fish_color_cwd ${config.colorScheme.palette.base0B}         # accent4 (green)
-        set -g fish_color_cwd_root ${config.colorScheme.palette.base08}    # accent1 (red)
-        set -g fish_color_valid_path --underline
-
-        # Interactive colors
-        set -g fish_color_match ${config.colorScheme.palette.base0B}       # accent4 (green)
-        set -g fish_color_selection --background=${config.colorScheme.palette.base02} # overlay
-        set -g fish_color_search_match --background=${config.colorScheme.palette.base02} # overlay
-        set -g fish_color_history_current --bold
-        set -g fish_color_user ${config.colorScheme.palette.base0B}        # accent4 (green)
-        set -g fish_color_host ${config.colorScheme.palette.base0D}        # accent6 (blue)
-        set -g fish_color_cancel -r
-
-        # Pager colors
-        set -g fish_pager_color_completion normal
-        set -g fish_pager_color_description ${config.colorScheme.palette.base03} # muted
-        set -g fish_pager_color_prefix ${config.colorScheme.palette.base0E}      # accent7 (purple)
-        set -g fish_pager_color_progress ${config.colorScheme.palette.base0B}    # accent4 (green)
-      '';
-      loginShellInit = ''
-        set -x NIX_PATH nixpkgs=channel:nixos-unstable
-        set -x NIX_LOG info
-        set -x WEBKIT_DISABLE_COMPOSITING_MODE 1
-        set -x TERMINAL ghostty
-        set -x EDITOR nvim
-        set -x VISUAL zed
-        set -x XDG_DATA_HOME $HOME/.local/share
-        set -x FZF_CTRL_R_OPTS "
-        --preview='bat --color=always -n {}'
-        --preview-window up:3:hidden:wrap
-        --bind 'ctrl-/:toggle-preview'
-        --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'
-        --color header:bold
-        --header 'Press CTRL-Y to copy command into clipboard'"
-        set -x FZF_DEFAULT_COMMAND fd --type f --exclude .git --follow --hidden
-        set -x FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
-        set -x FLAKE $HOME/p/nixos/nixos-config
-        source /run/agenix/${config.home.username}-secrets
-
-        if test (tty) = "/dev/tty1"
-          exec uwsm start -F /run/current-system/sw/bin/Hyprland
-        end
-        if test (tty) = "/dev/tty2"
-          exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
-        end
-      '';
-      shellAbbrs = {
-        ".." = "cd ..";
-        "..." = "cd ../..";
-        b = "yazi";
-        ls = "eza";
-        l = "eza -l --icons --git -a";
-        lt = "eza --tree --level=2 --long --icons --git";
-        grep = "rg";
-        ps = "procs";
-        just = "just --unstable";
-        node = "bun";
-        npx = "bunx";
-        fs = "du -ah . | sort -hr | head -n 10";
-
-        n = "nix";
-        nd = "nix develop -c $SHELL";
-        ns = "nix shell";
-        nsn = "nix shell nixpkgs#";
-        nb = "nix build";
-        nbn = "nix build nixpkgs#";
-        nf = "nix flake";
-
-        nr = "sudo nixos-rebuild --flake .";
-        nrs = "sudo nixos-rebuild switch --flake .#(uname -n)";
-        snr = "sudo nixos-rebuild --flake .";
-        snrs = "sudo nixos-rebuild --flake . switch";
-        hm = "home-manager --flake .";
-        hms = "home-manager --flake . switch";
-        hmr = "cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch";
-
-        tsu = "sudo tailscale up";
-        tsd = "sudo tailscale down";
-
-        vi = "nvim";
-        vim = "nvim";
-      };
-    };
-  };
-}

home/features/cli/fzf.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.fzf;
-in {
-  options.features.cli.fzf.enable = mkEnableOption "enable fuzzy finder";
-
-  config = mkIf cfg.enable {
-    programs.fzf = {
-      enable = true;
-      enableFishIntegration = true;
-      colors = {
-        "fg" = "#${config.colorScheme.palette.base05}";
-        "bg" = "#${config.colorScheme.palette.base00}";
-        "hl" = "#${config.colorScheme.palette.base0E}";
-        "fg+" = "#${config.colorScheme.palette.base05}";
-        "bg+" = "#${config.colorScheme.palette.base02}";
-        "hl+" = "#${config.colorScheme.palette.base0E}";
-        "info" = "#${config.colorScheme.palette.base09}";
-        "prompt" = "#${config.colorScheme.palette.base0B}";
-        "pointer" = "#${config.colorScheme.palette.base08}";
-        "marker" = "#${config.colorScheme.palette.base08}";
-        "spinner" = "#${config.colorScheme.palette.base09}";
-        "header" = "#${config.colorScheme.palette.base03}";
-      };
-      defaultOptions = [
-        "--preview='bat --color=always -n {}'"
-        "--bind 'ctrl-/:toggle-preview'"
-        "--header 'Press CTRL-Y to copy command into clipboard'"
-        "--bind 'ctrl-/:toggle-preview'"
-        "--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
-      ];
-      defaultCommand = "fd --type f --exclude .git --follow --hidden";
-      changeDirWidgetCommand = "fd --type d --exclude .git --follow --hidden";
-    };
-  };
-}

home/features/cli/nitch.nix

@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.nitch;
-in {
-  options.features.cli.nitch.enable = mkEnableOption "enable nitch";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [nitch];
-  };
-}

home/features/cli/nushell.nix

@@ -1,90 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.nushell;
-in {
-  options.features.cli.nushell.enable = mkEnableOption "enable nushell";
-
-  config = mkIf cfg.enable {
-    programs.nushell = {
-      enable = true;
-      envFile.text = ''
-        $env.config.show_banner = false
-        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
-        $env.NIX_LOG = "iunfo"
-        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
-        $env.TERMINAL = "ghostty"
-        $env.EDITOR = "nvim"
-        $env.VISUAL = "zeditor"
-        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
-        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always -n {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy command into clipboard' --bind 'ctrl-/:toggle-preview' --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort' --color bg:#282a36,bg+:#44475a,fg:#f8f8f2,fg+:#f8f8f2,header:#6272a4,hl:#bd93f9,hl+:#bd93f9,info:#ffb86c,marker:#ff79c6,pointer:#ff79c6,prompt:#50fa7b,spinner:#ffb86c"
-        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
-        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
-        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
-        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
-        $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
-
-        # Load kestractl-env from agenix
-        if ("/run/agenix/kestractl-env" | path exists) {
-          open /run/agenix/kestractl-env
-            | lines
-            | where {($in | str trim | str length) > 0}
-            | parse "{key}={value}"
-            | update value {str trim -c '"'}
-            | transpose -r -d
-            | load-env
-        }
-      '';
-
-      # if (tty) == "/dev/tty1" {
-      #   exec uwsm start -S -F /run/current-system/sw/bin/Hyprland
-      # }
-      # if (tty) == "/dev/tty2" {
-      #   exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
-      # }
-      configFile.text = ''
-        # Aliases
-        alias .. = cd ..
-        alias ... = cd ...
-        alias h = cd $env.HOME
-        alias b = yazi
-        alias lt = eza --tree --level=2 --long --icons --git
-        alias grep = rg
-        alias just = just --unstable
-
-        alias node = bun
-        alias npx = bunx
-
-        alias n = nix
-        alias nd = nix develop -c $nu.current-shell
-        alias ns = nix shell
-        alias nsn = nix shell nixpkgs#
-        alias nb = nix build
-        alias nbn = nix build nixpkgs#
-        alias nf = nix flake
-
-        alias nr = sudo nixos-rebuild --flake .
-        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
-        alias snr = sudo nixos-rebuild --flake .
-        alias snrs = sudo nixos-rebuild --flake . switch
-        alias hm = home-manager --flake .
-        alias hms = home-manager --flake . switch
-        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
-
-        alias tsu = sudo tailscale up
-        alias tsd = sudo tailscale down
-
-        alias vi = nvim
-        alias vim = nvim
-
-        if (which tv | is-not-empty) {
-          mkdir ($nu.data-dir | path join "vendor/autoload")
-          tv init nu | save -f ($nu.data-dir | path join "vendor/autoload/tv.nu")
-        }
-      '';
-    };
-  };
-}

home/features/cli/secrets.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.secrets;
-in {
-  options.features.cli.secrets.enable = mkEnableOption "enable secrets";
-
-  config = mkIf cfg.enable {
-    programs.password-store = {
-      enable = true;
-      package =
-        pkgs.pass-wayland.withExtensions
-        (exts: [exts.pass-otp exts.pass-import]);
-      settings = {PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store";};
-    };
-    home.packages = with pkgs; [pinentry-gnome3];
-  };
-}

home/features/cli/starship.nix

@@ -1,68 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.starship;
-in {
-  options.features.cli.starship.enable = mkEnableOption "enable starship prompt";
-
-  config = mkIf cfg.enable {
-    programs.starship = {
-      enable = true;
-      enableFishIntegration = true;
-      enableNushellIntegration = true;
-      settings = {
-        format = "$all$character";
-        palette = "universal";
-
-        palettes.universal = {
-          background = "#${config.colorScheme.palette.base00}";
-          surface = "#${config.colorScheme.palette.base01}";
-          muted = "#${config.colorScheme.palette.base03}";
-          text = "#${config.colorScheme.palette.base05}";
-          bright = "#${config.colorScheme.palette.base07}";
-          accent1 = "#${config.colorScheme.palette.base08}";
-          accent2 = "#${config.colorScheme.palette.base09}";
-          accent3 = "#${config.colorScheme.palette.base0A}";
-          accent4 = "#${config.colorScheme.palette.base0B}";
-          accent5 = "#${config.colorScheme.palette.base0C}";
-          accent6 = "#${config.colorScheme.palette.base0D}";
-          accent7 = "#${config.colorScheme.palette.base0E}";
-        };
-
-        character = {
-          success_symbol = "[❯](accent7)";
-          error_symbol = "[❯](accent1)";
-        };
-
-        directory = {
-          style = "accent6";
-          truncation_length = 3;
-          truncate_to_repo = false;
-        };
-
-        git_branch = {
-          style = "accent7";
-        };
-
-        git_status = {
-          style = "accent5";
-        };
-
-        cmd_duration = {
-          style = "accent3";
-        };
-
-        hostname = {
-          style = "accent4";
-        };
-
-        username = {
-          style_user = "accent2";
-        };
-      };
-    };
-  };
-}

home/features/cli/television.nix

@@ -1,64 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.television;
-in {
-  options.features.cli.television.enable = mkEnableOption "enable nitch";
-
-  config = mkIf cfg.enable {
-    programs.television = {
-      enable = true;
-      channels = {
-        tldr = {
-          metadata = {
-            description = "Browse TLDR pages";
-            name = "tldr";
-            requirements = [
-              "tldr"
-            ];
-          };
-          preview = {
-            command = "tldr '{}'";
-          };
-          source = {
-            command = "tldr --list";
-          };
-        };
-        git-diff = {
-          metadata = {
-            description = "A channel to select files from git diff commands";
-            name = "git-diff";
-            requirements = [
-              "git"
-            ];
-          };
-          preview = {
-            command = "git diff HEAD --color=always -- '{}'";
-          };
-          source = {
-            command = "git diff --name-only HEAD";
-          };
-        };
-        git-log = {
-          metadata = {
-            description = "A channel to select from git log entries";
-            name = "git-log";
-            requirements = [
-              "git"
-            ];
-          };
-          preview = {
-            command = "git show -p --stat --pretty=fuller --color=always '{0}'";
-          };
-          source = {
-            command = "git log --oneline --date=short --pretty=\"format:%h %s %an %cd\" \"$@\"";
-            output = "{split: :0}";
-          };
-        };
-      };
-    };
-  };
-}

home/features/cli/zellij.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.zellij;
-in {
-  options.features.cli.zellij.enable = mkEnableOption "enable tmux";
-
-  config = mkIf cfg.enable {
-    programs.zellij = {
-      enable = true;
-      settings = {
-        theme = "universal";
-        themes.universal = {
-          bg = "#${config.colorScheme.palette.base00}";
-          fg = "#${config.colorScheme.palette.base05}";
-          black = "#${config.colorScheme.palette.base01}";
-          red = "#${config.colorScheme.palette.base08}";
-          green = "#${config.colorScheme.palette.base0B}";
-          yellow = "#${config.colorScheme.palette.base0A}";
-          blue = "#${config.colorScheme.palette.base0D}";
-          magenta = "#${config.colorScheme.palette.base0E}";
-          cyan = "#${config.colorScheme.palette.base0C}";
-          white = "#${config.colorScheme.palette.base07}";
-          orange = "#${config.colorScheme.palette.base09}";
-        };
-      };
-    };
-  };
-}

home/features/coding/default.nix

@@ -1,78 +0,0 @@
-{
-  pkgs,
-  videoDrivers,
-  ...
-}: {
-  imports = [
-    ./opencode.nix
-  ];
-  programs.mcp = {
-    enable = true;
-    servers = {
-      DeepWiki = {
-        url = "https://mcp.deepwiki.com/mcp";
-      };
-      Ref = {
-        command = "sh";
-        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
-      };
-      Exa = {
-        command = "sh";
-        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
-      };
-      Outline = {
-        url = "https://wiki.az-gruppe.com/mcp";
-      };
-      ContextMode = {
-        command = "sh";
-        args = ["-c" "exec bunx context-mode@latest"];
-      };
-      Honcho = {
-        command = "sh";
-        args = [
-          "-c"
-          ''exec bunx mcp-remote@latest https://mcp.honcho.dev --header "Authorization:Bearer $(cat /run/agenix/honcho-key)" --header "X-Honcho-User-Name:m3tam3re"''
-        ];
-      };
-    };
-  };
-
-  home.packages = with pkgs; [
-    agenix-cli
-    alejandra
-    bc
-    bun
-    devpod
-    #devpod-desktop
-    claude-code
-    code2prompt
-    gnumake
-    cmake
-    (python3.withPackages (ps:
-      with ps; [
-        pip
-        uv
-        # Scientific packages
-        numba
-        numpy
-        torch
-        srt
-      ]))
-    pyrefly
-    nixd
-    nodejs
-    # opencode-desktop
-    (qmd.override {
-      vulkanSupport = videoDrivers == ["amdgpu"];
-      cudaSupport = videoDrivers == ["nvidia"];
-    })
-    openshell
-    openspec
-    pi
-    alejandra
-    sidecar
-    tailwindcss
-    tailwindcss-language-server
-    td
-  ];
-}

home/features/coding/opencode.nix

@@ -1,106 +0,0 @@
-{inputs, ...}: {
-  coding.opencode = {
-    enable = true;
-    agentsInput = inputs.agents;
-
-    externalSkills = [
-      {
-        src = inputs.skills-anthropic;
-        selectSkills = ["pdf" "docx" "frontend-design"];
-      }
-      {src = inputs.skills-vercel;}
-      {src = inputs.skills-basecamp;}
-      {src = inputs.skills-kestra;}
-    ];
-
-    # AZ-Gruppe LiteLLM endpoint + available models
-    extraSettings = {
-      provider = {
-        litellm = {
-          npm = "@ai-sdk/openai-compatible";
-          name = "LiteLLM (AZ-Gruppe)";
-          options.baseURL = "https://llm.az-gruppe.com/v1";
-          models = {
-            "gpt-5.2" = {
-              name = "GPT-5.2";
-              limit = {
-                context = 400000;
-                output = 128000;
-              };
-            };
-            "gpt-5.3-codex" = {
-              name = "GPT-5.3 Codex";
-              limit = {
-                context = 400000;
-                output = 128000;
-              };
-            };
-            "claude-haiku-4-5" = {
-              name = "Claude Haiku 4.5";
-              options = {
-                thinking = {
-                  type = "enabled";
-                  budget_tokens = 16000;
-                };
-              };
-              limit = {
-                context = 200000;
-                output = 64000;
-              };
-            };
-            "claude-sonnet-4-6" = {
-              name = "Claude Sonnet 4.6";
-              options = {
-                thinking = {
-                  type = "enabled";
-                  budget_tokens = 16000;
-                };
-              };
-              limit = {
-                context = 200000;
-                output = 64000;
-              };
-            };
-            "claude-opus-4-6" = {
-              name = "Claude Opus 4.6";
-              options = {
-                thinking = {
-                  type = "enabled";
-                  budget_tokens = 16000;
-                };
-              };
-              limit = {
-                context = 200000;
-                output = 128000;
-              };
-            };
-          };
-        };
-      };
-    };
-
-    ohMyOpencodeSettings = {
-      agents = {
-        sisyphus.model = "litellm/claude-opus-4-6";
-        oracle.model = "litellm/claude-sonnet-4-6";
-        librarian.model = "litellm/claude-sonnet-4-6";
-        explore.model = "litellm/claude-haiku-4-5";
-        multimodal-looker.model = "litellm/gpt-5.3-codex";
-        prometheus.model = "litellm/claude-opus-4-6";
-        metis.model = "litellm/claude-opus-4-6";
-        momus.model = "litellm/claude-opus-4-6";
-        atlas.model = "litellm/claude-sonnet-4-6";
-      };
-      categories = {
-        visual-engineering.model = "zai-coding-plan/glm-5.1";
-        ultrabrain.model = "litellm/claude-opus-4-6";
-        deep.model = "litellm/claude-sonnet-4-6";
-        artistry.model = "zai-coding-plan/glm-5.1";
-        quick.model = "litellm/claude-haiku-4-5";
-        unspecified-low.model = "litellm/claude-sonnet-4-6";
-        unspecified-high.model = "litellm/claude-opus-4-6";
-        writing.model = "zai-coding-plan/glm-5.1";
-      };
-    };
-  };
-}

home/features/desktop/AGENTS.md

@@ -1,79 +0,0 @@
-# DESKTOP FEATURES (home-manager)
-
-**Wayland/Hyprland environment with color-coordinated tooling**
-
-## OVERVIEW
-12 modular desktop features with nix-colors (Dracula) integration across all components.
-
-## STRUCTURE
-```
-desktop/
-├── default.nix       # Imports + XDG + Kitty config
-├── coding.nix        # Development tools (VSCode, etc.)
-├── crypto.nix        # Crypto wallets/tools
-├── fonts.nix         # Font packages
-├── gaming.nix        # Gaming tools/Steam
-├── hyprland.nix      # Hyprland WM configuration
-├── media.nix         # Media players/editors
-├── office.nix        # LibreOffice, document tools
-├── rofi.nix          # Application launcher
-├── theme.nix         # GTK/Qt theming
-├── wayland.nix       # Wayland utilities
-└── webapps.nix       # Browser-based apps
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add desktop app | Relevant feature .nix | Update home.packages |
-| Configure Hyprland | hyprland.nix | Window manager settings |
-| Fix colors | Check colorScheme references | Uses config.colorScheme.palette.base* |
-| Add font | fonts.nix | Increases system closure size |
-
-## CONVENTIONS
-
-### Color Scheme Integration
-All color-aware tools reference `config.colorScheme.palette.base00` through `base0F`:
-- **base00-07**: Grayscale (dark to light)
-- **base08**: Red/errors
-- **base09**: Orange
-- **base0A**: Yellow/strings
-- **base0B**: Green/functions
-- **base0C**: Cyan
-- **base0D**: Blue/types
-- **base0E**: Purple/constants
-- **base0F**: Brown
-
-Template:
-```nix
-foreground = "#${config.colorScheme.palette.base05}";
-background = "#${config.colorScheme.palette.base00}";
-```
-
-### Session Variables
-Set in default.nix for Wayland/Hyprland:
-```nix
-NIXOS_OZONE_WL = "1";
-QT_QPA_PLATFORM = "wayland";
-XDG_CURRENT_DESKTOP = "Hyprland";
-```
-
-### XDG Defaults
-- **PDF**: okular
-- **Text**: nvim
-- **Browser**: Zen (io.github.zen_browser.zen)
-- **Archive**: file-roller
-
-## ANTI-PATTERNS
-
-- **DON'T** hardcode hex colors - use colorScheme palette
-- **DON'T** install fonts globally - keep in user packages
-- **DON'T** bypass XDG defaults - set in mimeApps
-
-## NOTES
-
-- Kitty terminal configured in default.nix (not separate file)
-- Bibata-Modern-Ice cursor theme hardcoded
-- Session path includes cargo, npm-global, bun
-- Desktop features are always-enabled (no feature flags in this dir)

home/features/desktop/coding.nix

@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.coding;
-in {
-  options.features.desktop.coding.enable =
-    mkEnableOption "install coding related stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      bruno
-      insomnia
-    ];
-    coding.editors = {
-      neovim.enable = true;
-      zed.enable = true;
-    };
-  };
-}

home/features/desktop/crypto.nix

@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.crypto;
-in {
-  options.features.desktop.crypto.enable = mkEnableOption "Enable Crypto";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
-  };
-}

home/features/desktop/default.nix

@@ -1,162 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  imports = [
-    ./coding.nix
-    ./crypto.nix
-    ./fonts.nix
-    ./gaming.nix
-    ./hyprland.nix
-    ./media.nix
-    ./obsidian.nix
-    ./office.nix
-    ./rofi.nix
-    ./theme.nix
-    ./wallpapers.nix
-    ./wayland.nix
-    ./webapps.nix
-  ];
-
-  xdg = {
-    enable = true;
-    configFile."mimeapps.list".force = true;
-    mimeApps = {
-      enable = true;
-      associations.added = {
-        "application/zip" = ["org.gnome.FileRoller.desktop"];
-        "application/csv" = ["calc.desktop"];
-        "application/pdf" = ["okularApplication_pdf.desktop"];
-      };
-      defaultApplications = {
-        "application/zip" = ["org.gnome.FileRoller.desktop"];
-        "application/csv" = ["calc.desktop"];
-        "application/pdf" = ["okularApplication_pdf.desktop"];
-        "application/md" = ["nvim.desktop"];
-        "application/text" = ["nvim.desktop"];
-        "x-scheme-handler/http" = ["io.github.zen_browser.zen"];
-        "x-scheme-handler/https" = ["io.github.zen_browser.zen"];
-      };
-    };
-    userDirs = {
-      enable = true;
-      createDirectories = true;
-      setSessionVariables = true;
-    };
-  };
-
-  home.sessionVariables = {
-    WEBKIT_DISABLE_COMPOSITING_MODE = "1";
-    NIXOS_OZONE_WL = "1";
-    TERMINAL = "ghostty";
-    QT_QPA_PLATFORM = "wayland";
-    XDG_CURRENT_DESKTOP = "Hyprland";
-    XDG_SESSION_TYPE = "wayland";
-    XDG_SESSION_DESKTOP = "Hyprland";
-  };
-  home.sessionPath = ["\${XDG_BIN_HOME}" "\${HOME}/.cargo/bin" "$HOME/.npm-global/bin" "$HOME/.cache/.bun/bin"];
-
-  fonts.fontconfig.enable = true;
-
-  programs.ghostty = {
-    enable = true;
-    enableFishIntegration = true;
-    enableBashIntegration = true;
-    settings = {
-      font-family = "Fira Code";
-      copy-on-select = true;
-
-      # Base colors from nix-colors
-      foreground = "#${config.colorScheme.palette.base05}";
-      background = "#${config.colorScheme.palette.base00}";
-      selection-foreground = "#${config.colorScheme.palette.base07}";
-      selection-background = "#${config.colorScheme.palette.base02}";
-
-      # Cursor
-      cursor-color = "#${config.colorScheme.palette.base05}";
-
-      # Palette (16 colors)
-      palette = [
-        "0=#${config.colorScheme.palette.base01}"
-        "1=#${config.colorScheme.palette.base08}"
-        "2=#${config.colorScheme.palette.base0B}"
-        "3=#${config.colorScheme.palette.base0A}"
-        "4=#${config.colorScheme.palette.base0D}"
-        "5=#${config.colorScheme.palette.base0E}"
-        "6=#${config.colorScheme.palette.base0C}"
-        "7=#${config.colorScheme.palette.base05}"
-        "8=#${config.colorScheme.palette.base03}"
-        "9=#${config.colorScheme.palette.base08}"
-        "10=#${config.colorScheme.palette.base0B}"
-        "11=#${config.colorScheme.palette.base0A}"
-        "12=#${config.colorScheme.palette.base0D}"
-        "13=#${config.colorScheme.palette.base0E}"
-        "14=#${config.colorScheme.palette.base0C}"
-        "15=#${config.colorScheme.palette.base07}"
-      ];
-    };
-  };
-
-  home.pointerCursor = {
-    gtk.enable = true;
-    package = pkgs.bibata-cursors;
-    name = "Bibata-Modern-Ice";
-    size = 20;
-  };
-
-  home.packages = with pkgs; [
-    appimage-run
-    # blueberry
-    bemoji
-    brave
-    # brightnessctl
-    # clipman
-    distrobox
-    eigent
-    (element-desktop.override {
-      commandLineArgs = "--password-store=gnome-libsecret";
-    })
-    launch-webapp
-    # eww
-    # firefox-devedition
-    file-roller
-    hyprpanel
-    seahorse
-    sushi
-    # glib
-    # google-chrome
-    # gsettings-desktop-schemas
-    # graphviz
-    ksnip
-    msty-studio
-    nwg-look
-    # opencode-desktop
-    # pamixer
-    # pavucontrol
-    # libsForQt5.qtstyleplugins
-    # stable.nyxt
-    # pcmanfm
-    rose-pine-hyprcursor
-    # qt5ct
-    # qt6.qtwayland
-    #rustdesk
-    # socat
-    # unrar
-    # unzip
-    # usbutils
-    # v4l-utils
-    remmina
-    slack
-    telegram-desktop
-    vivaldi
-    vivaldi-ffmpeg-codecs
-    vibetyper
-    # wl-clipboard
-    # wlogout
-    # wtype
-    # xdg-utils
-    # ydotool
-    # zip
-  ];
-}

home/features/desktop/fonts.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.fonts;
-in {
-  options.features.desktop.fonts.enable =
-    mkEnableOption "install additional fonts for desktop apps";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      fira-code
-      fira-code-symbols
-      nerd-fonts.fira-code
-      nerd-fonts.jetbrains-mono
-      font-manager
-      font-awesome_5
-      noto-fonts
-    ];
-  };
-}

home/features/desktop/gaming.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.gaming;
-in {
-  options.features.desktop.gaming.enable =
-    mkEnableOption "install gaming related stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      gamescope
-      gamemode
-      goverlay
-      mangohud
-      protonplus
-    ];
-  };
-}

home/features/desktop/hyprland.nix

@@ -1,323 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.hyprland;
-in {
-  options.features.desktop.hyprland.enable =
-    mkEnableOption "Hyprland related stuff";
-
-  config = mkIf cfg.enable {
-    wayland.windowManager.hyprland = {
-      settings = {
-        xwayland = {
-          force_zero_scaling = true;
-        };
-
-        exec-once = [
-          "hyprpanel"
-          "while ! hyprpaper-random; do sleep 0.5; done"
-          "wl-paste --type text --watch cliphist store" # Stores only text data
-          "wl-paste --type image --watch cliphist store" # Stores only image data "wl-paste -p -t text --watch clipman store -P --histpath=\"~/.local/share/clipman-primary.json\""
-          "vibetyper"
-        ];
-
-        env = [
-          "XCURSOR_SIZE,32"
-          "HYPRCURSOR_THEME,Bibata-Modern-Ice"
-          "WLR_NO_HARDWARE_CURSORS,1"
-          "GTK_THEME,Dracula"
-          "XDG_CURRENT_DESKTOP,Hyprland"
-          "XDG_SESSION_TYPE,wayland"
-          "XDG_SESSION_DESKTOP,Hyprland"
-          "XKB_DEFAULT_LAYOUT,de"
-          "NIXOS_OZONE_WL,1"
-        ];
-
-        input = {
-          kb_layout = "de,us";
-          kb_variant = "";
-          kb_model = "";
-          kb_rules = "";
-          kb_options = "ctrl:nocaps";
-          follow_mouse = 1;
-        };
-
-        general = {
-          gaps_in = 5;
-          gaps_out = 5;
-          border_size = 1;
-          # Keeping the existing active border as requested
-          "col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
-          "col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
-          layout = "dwindle";
-        };
-
-        decoration = {
-          shadow = {
-            enabled = true;
-            range = 60;
-            render_power = 3;
-            color = "rgba(${config.colorScheme.palette.base00}66)";
-            offset = "1 2";
-            scale = 0.97;
-          };
-          rounding = 8;
-          blur = {
-            enabled = true;
-            size = 3;
-            passes = 3;
-          };
-          active_opacity = 0.9;
-          inactive_opacity = 0.5;
-        };
-
-        animations = {
-          enabled = true;
-          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
-          animation = [
-            "windows, 1, 7, myBezier"
-            "windowsOut, 1, 7, default, popin 80%"
-            "border, 1, 10, default"
-            "borderangle, 1, 8, default"
-            "fade, 1, 7, default"
-            "workspaces, 1, 6, default"
-          ];
-        };
-
-        dwindle = {
-          pseudotile = true;
-          preserve_split = true;
-        };
-
-        master = {
-          new_status = "master";
-        };
-
-        device = [
-          {
-            name = "epic-mouse-v1";
-            sensitivity = -0.5;
-          }
-          {
-            name = "zsa-technology-labs-moonlander-mark-i";
-            kb_layout = "us";
-          }
-          {
-            name = "keychron-keychron-k7";
-            kb_layout = "us";
-          }
-        ];
-        windowrule = [
-          # Floating dialogs
-          "match:class file_progress, float on"
-          "match:class confirm, float on"
-          "match:class dialog, float on"
-          "match:class download, float on"
-          "match:class notification, float on"
-          "match:class error, float on"
-          "match:class splash, float on"
-          "match:class confirmreset, float on"
-          "match:title Open File, float on"
-          "match:title branchdialog, float on"
-          "match:class pavucontrol-qt, float on"
-          "match:class pavucontrol, float on"
-          "match:class class:^(espanso)$, float on"
-          # wlogout
-          "match:class wlogout, fullscreen on"
-          "match:title wlogout, float on"
-          "match:title wlogout, fullscreen on"
-          # mpv
-          "match:class mpv, float on"
-          "match:class mpv, idle_inhibit focus"
-          "match:class mpv, opacity 1.0 override"
-          # Media/Volume/PiP
-          "match:title ^(Media viewer)$, float on"
-          "match:title ^(Volume Control)$, float on"
-          "match:title ^(Picture-in-Picture)$, float on"
-          # Pomodoro timer
-          "match:title ^(floating-pomodoro)$, float on"
-          "match:title ^(floating-pomodoro)$, size 250 50"
-          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
-          "match:title ^(floating-pomodoro)$, pin on"
-          # Streamlabs overlays
-          "match:initial_title .*streamlabs.com.*, float on"
-          "match:initial_title .*streamlabs.com.*, pin on"
-          "match:initial_title .*streamlabs.com.*, size 800 400"
-          "match:initial_title .*alert-box.*, move 100%-820 102"
-          "match:initial_title .*chat-box.*, move 100%-820 512"
-          "match:initial_title .*streamlabs.com.*, opacity 0.5 override"
-          "match:initial_title .*streamlabs.com.*, idle_inhibit focus"
-          "match:initial_title .*streamlabs.com.*, no_anim on"
-          "match:initial_title .*streamlabs.com.*, decorate off"
-          "match:initial_title .*streamlabs.com.*, no_shadow on"
-          "match:initial_title .*streamlabs.com.*, no_blur on"
-          # Vibetyper recording indicator
-          "match:class ^vibe-typer$, match:title ^Recording Indicator$, no_blur on"
-          "border_color rgb(ffffff), match:xwayland 1"
-        ];
-        "$mainMod" = "SUPER";
-        "$terminal" = "ghostty";
-
-        bind = [
-          "$mainMod, return, exec, $terminal nu -c zellij-ps"
-          # "$mainMod, t, exec, warp-terminal"
-          "$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
-          "$mainMod SHIFT, t, exec, launch-timer"
-          "$mainMod, n, exec, $terminal -e nvim"
-          "$mainMod, z, exec, uwsm app -- zeditor"
-          "$mainMod, o, exec, hyprctl dispatch setprop activewindow opaque toggle"
-          "$mainMod, r, exec, hyprctl dispatch focuswindow \"initialtitle:.*alert-box.*\" && hyprctl dispatch moveactive exact 4300 102 && hyprctl dispatch focuswindow \"initialtitle:.*chat-box.*\" && hyprctl dispatch moveactive exact 4300 512"
-          "$mainMod, b, exec, uwsm app -- thunar"
-          "$mainMod SHIFT, B, exec, uwsm app -- vivaldi"
-          "$mainMod, Escape, exec, uwsm app -- wlogout -p layer-shell"
-          "$mainMod, Space, togglefloating"
-          "$mainMod, q, killactive"
-          "$mainMod, M, exit"
-          "$mainMod, F, fullscreen"
-          "$mainMod SHIFT, V, togglefloating"
-          "$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
-          "$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
-          "$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
-          "$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
-          "$mainMod, P, exec, uwsm app -- rofi-pass"
-          "$mainMod SHIFT, P, pseudo"
-          "$mainMod, R, exec, stt-ptt start"
-          "$mainMod, S, exec, stt-ptt start"
-          "$mainMod, J, togglesplit"
-          "$mainMod, h, movefocus, l"
-          "$mainMod, l, movefocus, r"
-          "$mainMod, k, movefocus, u"
-          "$mainMod, j, movefocus, d"
-          "$mainMod, 1, workspace, 1"
-          "$mainMod, 2, workspace, 2"
-          "$mainMod, 3, workspace, 3"
-          "$mainMod, 4, workspace, 4"
-          "$mainMod, 5, workspace, 5"
-          "$mainMod, 6, workspace, 6"
-          "$mainMod, 7, workspace, 7"
-          "$mainMod, 8, workspace, 8"
-          "$mainMod, 9, workspace, 9"
-          "$mainMod, 0, workspace, 10"
-          "$mainMod SHIFT, 1, movetoworkspace, 1"
-          "$mainMod SHIFT, 2, movetoworkspace, 2"
-          "$mainMod SHIFT, 3, movetoworkspace, 3"
-          "$mainMod SHIFT, 4, movetoworkspace, 4"
-          "$mainMod SHIFT, 5, movetoworkspace, 5"
-          "$mainMod SHIFT, 6, movetoworkspace, 6"
-          "$mainMod SHIFT, 7, movetoworkspace, 7"
-          "$mainMod SHIFT, 8, movetoworkspace, 8"
-          "$mainMod SHIFT, 9, movetoworkspace, 9"
-          "$mainMod SHIFT, 0, movetoworkspace, 10"
-          "$mainMod, mouse_down, workspace, e+1"
-          "$mainMod, mouse_up, workspace, e-1"
-        ];
-        bindr = [
-          "$mainMod, R, exec, stt-ptt stop"
-          "$mainMod, S, exec, stt-ptt format-stop"
-        ];
-        bindm = [
-          "$mainMod, mouse:272, movewindow"
-          "$mainMod, mouse:273, resizewindow"
-        ];
-      };
-    };
-    services.hypridle = {
-      enable = true;
-      settings = {
-        general = {
-          before_sleep_cmd = "hyprlock";
-          after_sleep_cmd = "hyprctl dispatch dpms on";
-          inhibit_sleep = 3;
-        };
-
-        listener = [
-          {
-            timeout = 300; # 5 min
-            on-timeout = "hyprlock";
-          }
-          {
-            timeout = 420; # 5.5 min
-            on-timeout = "hyprctl dispatch dpms off";
-            on-resume = "hyprctl dispatch dpms on";
-          }
-        ];
-      };
-    };
-
-    services.hyprpaper.enable = true;
-
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        "$font" = "JetBrainsMono Nerd Font";
-        "$base" = "rgb(${config.colorScheme.palette.base00})";
-        "$text" = "rgb(${config.colorScheme.palette.base05})";
-        "$textAlpha" = "${config.colorScheme.palette.base05}";
-        "$accentAlpha" = "${config.colorScheme.palette.base0D}";
-        "$red" = "rgb(${config.colorScheme.palette.base08})";
-        "$yellow" = "rgb(${config.colorScheme.palette.base0A})";
-
-        general = {
-          hide_cursor = true;
-        };
-
-        background = {
-          monitor = "";
-          path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
-          blur_passes = 0;
-          color = "rgb(${config.colorScheme.palette.base00})";
-        };
-
-        label = [
-          {
-            monitor = "";
-            text = "$TIME";
-            color = "$text";
-            font_size = 90;
-            font_family = "$font";
-            position = "30, 0";
-            halign = "left";
-            valign = "top";
-          }
-          {
-            monitor = "";
-            text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
-            color = "$text";
-            font_size = 25;
-            font_family = "$font";
-            position = "30, -150";
-            halign = "left";
-            valign = "top";
-          }
-        ];
-
-        input-field = [
-          {
-            monitor = "";
-            size = "300, 60";
-            outline_thickness = 4;
-            dots_size = 0.2;
-            dots_spacing = 0.2;
-            dots_center = true;
-            outer_color = "rgb(${config.colorScheme.palette.base0D})";
-            inner_color = "rgb(${config.colorScheme.palette.base00})";
-            font_color = "rgb(${config.colorScheme.palette.base05})";
-            fade_on_empty = false;
-            placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}">󰌾  Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
-            hide_input = false;
-            check_color = "rgb(${config.colorScheme.palette.base0D})";
-            fail_color = "rgb(${config.colorScheme.palette.base08})";
-            fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
-            capslock_color = "rgb(${config.colorScheme.palette.base0A})";
-            position = "0, -35";
-            halign = "center";
-            valign = "center";
-          }
-        ];
-      };
-    };
-  };
-}

home/features/desktop/media.nix

@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.media;
-in {
-  options.features.desktop.media.enable =
-    mkEnableOption "enable media features";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      # handbrake
-      # kdePackages.kdenlive
-      # makemkv
-      # mediainfo
-      amf
-      ffmpeg_6-full
-      gimp
-      gst_all_1.gstreamer
-      gst_all_1.gst-vaapi
-      handbrake
-      inkscape
-      kdePackages.kdenlive
-      libation
-      #makemkv
-      pamixer
-      pavucontrol
-      qpwgraph
-      v4l-utils
-      plexamp
-      # uxplay
-      # vlc
-      webcord
-      # yt-dlp
-      unimatrix
-    ];
-
-    programs = {
-      mpv = {
-        enable = true;
-        bindings = {
-          WHEEL_UP = "seek 10";
-          WHEEL_DOWN = "seek -10";
-        };
-        config = {
-          profile = "gpu-hq";
-          ytdl-format = "bestvideo+bestaudio";
-        };
-      };
-    };
-  };
-}

home/features/desktop/obsidian.nix

@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.obsidian;
-in {
-  options.features.desktop.obsidian.enable =
-    mkEnableOption "enable Obsidian knowledge base";
-
-  config = mkIf cfg.enable {
-    programs.obsidian.enable = true;
-
-    xdg.mimeApps = {
-      enable = true;
-      associations.added = {
-        "text/markdown" = ["obsidian.desktop"];
-      };
-      defaultApplications = {
-        "text/markdown" = ["obsidian.desktop"];
-      };
-    };
-  };
-}

home/features/desktop/office.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.office;
-in {
-  options.features.desktop.office.enable =
-    mkEnableOption "install office and paperwork stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      libreoffice-fresh
-    ];
-  };
-}

home/features/desktop/rofi.nix

@@ -1,206 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.rofi;
-in {
-  options.features.desktop.rofi.enable = mkEnableOption "enable rofi";
-
-  config = mkIf cfg.enable {
-    programs.rofi = with pkgs; {
-      enable = true;
-      package = rofi.override {
-        plugins = [
-          rofi-calc
-          rofi-emoji
-          stable.rofi-file-browser
-        ];
-      };
-      pass = {
-        enable = true;
-        package = rofi-pass-wayland;
-      };
-      terminal = "${pkgs.ghostty}/bin/ghostty";
-      font = "Fira Code";
-      extraConfig = {
-        show-icons = true;
-        disable-history = false;
-        modi = "drun,calc,emoji,filebrowser";
-        kb-primary-paste = "Control+V,Shift+Insert";
-        kb-secondary-paste = "Control+v,Insert";
-      };
-      theme = let
-        inherit (config.colorScheme) palette;
-      in
-        builtins.toString (pkgs.writeText "rofi-universal-theme.rasi" ''
-          * {
-            /* Universal theme colors from nix-colors */
-            background:  #${palette.base00};
-            surface:     #${palette.base01};
-            overlay:     #${palette.base02};
-            muted:       #${palette.base03};
-            subtle:      #${palette.base04};
-            text:        #${palette.base05};
-            bright-text: #${palette.base06};
-            highlight:   #${palette.base07};
-            accent1:     #${palette.base08};
-            accent2:     #${palette.base09};
-            accent3:     #${palette.base0A};
-            accent4:     #${palette.base0B};
-            accent5:     #${palette.base0C};
-            accent6:     #${palette.base0D};
-            accent7:     #${palette.base0E};
-            accent8:     #${palette.base0F};
-
-            /* Global properties */
-            background-color: @background;
-            text-color: @text;
-            font: "Fira Code 12";
-            border: 0;
-            margin: 0;
-            padding: 0;
-            spacing: 0;
-          }
-
-          window {
-            background-color: @background;
-            border: 1px;
-            border-color: @accent7;
-            border-radius: 6px;
-            width: 40%;
-            padding: 16px;
-          }
-
-          inputbar {
-            children: [ prompt, entry ];
-            spacing: 12px;
-            padding: 8px;
-            border-radius: 4px;
-            background-color: @surface;
-          }
-
-          prompt {
-            text-color: @accent7;
-            background-color: transparent;
-          }
-
-          entry {
-            placeholder: "Search...";
-            placeholder-color: @subtle;
-            text-color: @text;
-            background-color: transparent;
-            cursor-color: @accent7;
-          }
-
-          message {
-            background-color: @surface;
-            border-radius: 4px;
-            padding: 8px;
-            margin: 8px 0;
-          }
-
-          textbox {
-            text-color: @text;
-            background-color: transparent;
-          }
-
-          listview {
-            background-color: transparent;
-            margin: 8px 0 0;
-            lines: 10;
-            columns: 1;
-            fixed-height: true;
-            scrollbar: false;
-          }
-
-          element {
-            background-color: transparent;
-            text-color: @text;
-            padding: 8px;
-            border-radius: 4px;
-            spacing: 8px;
-          }
-
-          element normal.normal {
-            background-color: transparent;
-            text-color: @text;
-          }
-
-          element selected.normal {
-            background-color: @accent7;
-            text-color: @background;
-          }
-
-          element alternate.normal {
-            background-color: transparent;
-            text-color: @text;
-          }
-
-          element-icon {
-            background-color: transparent;
-            size: 24px;
-          }
-
-          element-text {
-            background-color: transparent;
-            text-color: inherit;
-            vertical-align: 0.5;
-          }
-
-          mode-switcher {
-            spacing: 0;
-            background-color: @surface;
-            border-radius: 4px;
-            margin: 8px 0 0;
-          }
-
-          button {
-            padding: 8px 16px;
-            background-color: transparent;
-            text-color: @text;
-            border-radius: 4px;
-          }
-
-          button selected {
-            background-color: @accent7;
-            text-color: @background;
-          }
-
-          /* Scrollbar */
-          scrollbar {
-            width: 4px;
-            border: 0;
-            handle-color: @accent7;
-            handle-width: 4px;
-            padding: 0;
-          }
-        '');
-    };
-    cli.rofi-project-opener = {
-      enable = true;
-      projectDirs = {
-        AI = {
-          path = "~/p/AI";
-          args = "";
-        };
-        CHAT = {
-          path = "~/p/CHAT";
-          args = "--agent chiron";
-        };
-        MISC = {
-          path = "~/p/MISC";
-          args = "--agent chiron-forge";
-        };
-        NIX = {
-          path = "~/p/NIX";
-          args = "";
-        };
-      };
-      terminal = pkgs.ghostty;
-      terminalCommand = "opencode %a";
-    };
-  };
-}

home/features/desktop/theme.nix

@@ -1,22 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  qt = {
-    enable = true;
-    platformTheme.name = "gtk";
-  };
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Dracula";
-      package = pkgs.dracula-theme;
-    };
-    iconTheme = {
-      name = "Dracula";
-      package = pkgs.dracula-icon-theme;
-    };
-    gtk4.theme = config.gtk.theme;
-  };
-}

home/features/desktop/wallpapers.nix

@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.wallpapers;
-in {
-  options.features.desktop.wallpapers = mkEnableOption "Wallpapers for Hyprland";
-
-  config = mkIf cfg {
-    xdg.configFile."hypr/wallpapers" = {
-      source = ../../m3tam3re/wallpapers;
-      recursive = true;
-    };
-  };
-}

home/features/desktop/wayland.nix

@@ -1,29 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.wayland;
-in {
-  options.features.desktop.wayland.enable = mkEnableOption "wayland extra tools and config";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      grim
-      hyprcursor
-      hyprlock
-      hyprpaper
-      qt6.qtwayland
-      slurp
-      waypipe
-      wl-clipboard
-      wf-recorder
-      wl-mirror
-      wlogout
-      wtype
-      ydotool
-    ];
-  };
-}

home/features/desktop/webapps.nix

@@ -1,55 +0,0 @@
-{
-  pkgs,
-  lib,
-  ...
-}: let
-  icons = {
-    teams = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-teams.svg";
-      sha256 = "sha256-Pr9QS8nnXJq97r4/G3c6JXi34zxHl0ps9gcyI8cN/s8=";
-    };
-    outlook = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-outlook.svg";
-      sha256 = "sha256-3u8t5QNHFZvrAegxBiGicO4PjtMWhEaQSCv7MSSfLLc=";
-    };
-    opencode = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opencode-dark.svg";
-      sha256 = "1lms4f8habamvdh2qqqz9psx4py9wx23mmlkkds44pvrbq3bkj3n";
-    };
-  };
-in {
-  xdg.desktopEntries = {
-    teams = {
-      name = "Microsoft Teams";
-      exec = "launch-webapp https://teams.microsoft.com";
-      comment = "Open Microsoft Teams as a Desktop App";
-      categories = ["Application" "Network" "Chat"];
-      terminal = false;
-      icon = icons.teams;
-    };
-    outlook = {
-      name = "Microsoft Outlook";
-      exec = "launch-webapp https://outlook.office.com/mail/";
-      comment = "Open Microsoft Outlook as a Desktop App";
-      categories = ["Application" "Network"];
-      terminal = false;
-      icon = icons.outlook;
-    };
-    basecamp = {
-      name = "Basecamp";
-      exec = "launch-webapp https://3.basecamp.com/5996442/";
-      comment = "Open Basecamp as a Desktop App";
-      categories = ["Application" "Network"];
-      terminal = false;
-      icon = "/home/sascha.koenig/.local/share/icons/basecamp-logo.png";
-    };
-    opencode = {
-      name = "Opencode";
-      exec = "rofi-project-opener";
-      comment = "Open Opencode Terminal App";
-      categories = ["Application" "Development"];
-      terminal = false;
-      icon = icons.opencode;
-    };
-  };
-}

home/m3tam3re/home-server.nix

@@ -1,121 +0,0 @@
-# This is a default home.nix generated by the follwing hone-manager command
-#
-# home-manager init ./
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  # Home Manager needs a bit of information about you and the paths it should
-  # manage.
-  home.username = lib.mkDefault "your-name";
-  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
-
-  # This value determines the Home Manager release that your configuration is
-  # compatible with. This helps avoid breakage when a new Home Manager release
-  # introduces backwards incompatible changes.
-  #
-  # You should not change this value, even if you update Home Manager. If you do
-  # want to update the value, then make sure to first check the Home Manager
-  # release notes.
-  home.stateVersion = "24.11"; # Please read the comment before changing.
-
-  # The home.packages option allows you to install Nix packages into your
-  # environment.
-  home.packages = with pkgs; [
-    # # Adds the 'hello' command to your environment. It prints a friendly
-    # # "Hello, world!" when run.
-    # pkgs.hello
-
-    # # It is sometimes useful to fine-tune packages, for example, by applying
-    # # overrides. You can do that directly here, just don't forget the
-    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
-    # # fonts?
-    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
-
-    # # You can also create simple shell scripts directly inside your
-    # # configuration. For example, this adds a command 'my-hello' to your
-    # # environment:
-    # (pkgs.writeShellScriptBin "my-hello" ''
-    #   echo "Hello, ${config.home.username}!"
-    # '')
-  ];
-
-  # Home Manager is pretty good at managing dotfiles. The primary way to manage
-  # plain files is through 'home.file'.
-  home.file = {
-    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
-    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
-    # # symlink to the Nix store copy.
-    # ".screenrc".source = dotfiles/screenrc;
-
-    # # You can also set the file content immediately.
-    # ".gradle/gradle.properties".text = ''
-    #   org.gradle.console=verbose
-    #   org.gradle.daemon.idletimeout=3600000
-    # '';
-  };
-
-  # Home Manager can also manage your environment variables through
-  # 'home.sessionVariables'. If you don't want to manage your shell through Home
-  # Manager then you have to manually source 'hm-session-vars.sh' located at
-  # either
-  #
-  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
-  #
-  home.sessionVariables = {
-    # EDITOR = "emacs";
-  };
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
-
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        name = "m3tm3re";
-        email = "p@m3ta.dev";
-      };
-      core.excludesfile = "~/.gitignore_global";
-      init.defaultBranch = "master";
-      alias = {
-        st = "status";
-        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-      };
-    };
-  };
-  # programs.zellij-ps = {
-  #   enable = true;
-  #   projectFolders = [
-  #     "${config.home.homeDirectory}/p/c"
-  #     "${config.home.homeDirectory}/p"
-  #     "${config.home.homeDirectory}/.config"
-  #   ];
-  #   layout = ''
-  #     layout {
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:tab-bar"
-  #         }
-  #         pane size="70%" command="nvim"
-  #         pane split_direction="vertical" {
-  #             pane
-  #             pane command="unimatrix"
-  #         }
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:status-bar"
-  #         }
-  #     }
-  #   '';
-  # };
-}

home/m3tam3re/home.nix

@@ -1,262 +0,0 @@
-# This is a default home.nix generated by the follwing hone-manager command
-#
-# home-manager init ./
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  # Home Manager needs a bit of information about you and the paths it should
-  # manage.
-  home.username = lib.mkDefault "your-name";
-  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
-
-  # This value determines the Home Manager release that your configuration is
-  # compatible with. This helps avoid breakage when a new Home Manager release
-  # introduces backwards incompatible changes.
-  #
-  # You should not change this value, even if you update Home Manager. If you do
-  # want to update the value, then make sure to first check the Home Manager
-  # release notes.
-  home.stateVersion = "24.11"; # Please read the comment before changing.
-
-  # The home.packages option allows you to install Nix packages into your
-  # environment.
-  home.packages = with pkgs; [
-    libgtop
-    # # Adds the 'hello' command to your environment. It prints a friendly
-    # # "Hello, world!" when run.
-    # pkgs.hello
-
-    # # It is sometimes useful to fine-tune packages, for example, by applying
-    # # overrides. You can do that directly here, just don't forget the
-    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
-    # # fonts?
-    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
-
-    # # You can also create simple shell scripts directly inside your
-    # # configuration. For example, this adds a command 'my-hello' to your
-    # # environment:
-    # (pkgs.writeShellScriptBin "my-hello" ''
-    #   echo "Hello, ${config.home.username}!"
-    # '')
-  ];
-
-  # Home Manager is pretty good at managing dotfiles. The primary way to manage
-  # plain files is through 'home.file'.
-  home.file = {
-    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
-    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
-    # # symlink to the Nix store copy.
-    # ".screenrc".source = dotfiles/screenrc;
-
-    # # You can also set the file content immediately.
-    # ".gradle/gradle.properties".text = ''
-    #   org.gradle.console=verbose
-    #   org.gradle.daemon.idletimeout=3600000
-    # '';
-  };
-
-  # Home Manager can also manage your environment variables through
-  # 'home.sessionVariables'. If you don't want to manage your shell through Home
-  # Manager then you have to manually source 'hm-session-vars.sh' located at
-  # either
-  #
-  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
-  #
-  home.sessionVariables = {
-    # EDITOR = "emacs";
-  };
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
-
-  services.cliphist = {
-    enable = true;
-    allowImages = true;
-  };
-
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        name = "m3tm3re";
-        email = "p@m3ta.dev";
-      };
-      core.excludesfile = "~/.gitignore_global";
-      init.defaultBranch = "master";
-      alias = {
-        st = "status";
-        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-      };
-    };
-  };
-
-  programs.difftastic.enable = true;
-
-  programs.jujutsu = {
-    enable = true;
-    settings = {
-      user = {
-        email = "m@m3tam3re.com";
-        name = "Sascha Koenig";
-      };
-    };
-  };
-
-  programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
-    matchBlocks = {
-      "AZ-CLD-1" = {
-        hostname = "152.53.186.119";
-        user = "sascha.koenig";
-        port = 2022;
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "AZ-PRM-1" = {
-        hostname = "192.168.152.76";
-        user = "sascha.koenig";
-        port = 2022;
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "github.com" = {
-        hostname = "github.com";
-        user = "m3tam3re";
-        port = 22;
-        identityFile = "~/.ssh/github";
-      };
-      "nikhil" = {
-        hostname = "91.99.176.80";
-        user = "nikhilmaddirala";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "code.m3ta.dev" = {
-        hostname = "code.m3ta.dev";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/gitea";
-      };
-      "git.az-gruppe.com" = {
-        hostname = "git.az-gruppe.com";
-        port = 2022;
-        user = "sascha.koenig";
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "lkk-nix-1" = {
-        hostname = "89.58.10.189";
-        user = "lkk-admin";
-        identityFile = "~/.ssh/lkk-admin";
-      };
-      "m3-r1" = {
-        hostname = "202.61.226.110";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-test" = {
-        hostname = "192.168.122.215";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-1" = {
-        hostname = "192.168.0.24";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-2" = {
-        hostname = "192.168.0.20";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-deck" = {
-        hostname = "192.168.178.193";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-kratos-vm" = {
-        hostname = "192.168.122.43";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-helios" = {
-        hostname = "192.168.178.210";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-ares" = {
-        hostname = "192.168.1.30";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-atlas" = {
-        hostname = "152.53.85.162";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-hermes" = {
-        hostname = "204.168.229.93";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-zelda" = {
-        hostname = "95.217.189.186";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-skynet" = {
-        hostname = "m3-skynet";
-        user = "admin";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-prox-1" = {
-        hostname = "192.168.1.110";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "shp-old" = {
-        hostname = "95.217.3.250";
-        port = 2222;
-        user = "m3tam3re";
-        identityFile = "~/.ssh/self-host-playbook";
-      };
-      "shp-1" = {
-        hostname = "95.217.189.186";
-        port = 2222;
-        user = "m3tam3re";
-        identityFile = "~/.ssh/self-host-playbook";
-      };
-    };
-  };
-  # programs.zellij-ps = {
-  #   enable = true;
-  #   projectFolders = [
-  #     "${config.home.homeDirectory}/p/c"
-  #     "${config.home.homeDirectory}/p"
-  #     "${config.home.homeDirectory}/.config"
-  #   ];
-  #   layout = ''
-  #     layout {
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:tab-bar"
-  #         }
-  #         pane size="70%" command="nvim"
-  #         pane split_direction="vertical" {
-  #             pane
-  #             pane command="unimatrix"
-  #         }
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:status-bar"
-  #         }
-  #     }
-  #   '';
-  # };
-}

home/m3tam3re/m3-aether.nix

@@ -1,17 +0,0 @@
-{
-  imports = [
-    ../common
-    ../features/cli
-    ./home-server.nix
-  ];
-
-  features = {
-    cli = {
-      fish.enable = true;
-      fzf.enable = true;
-      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-ares.nix

@@ -1,98 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-  ];
-
-  config = mkMerge [
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-        };
-      };
-      features = {
-        cli = {
-          fish.enable = true;
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
-          secrets.enable = true;
-          starship.enable = true;
-          television.enable = true;
-        };
-        desktop = {
-          coding.enable = true;
-          crypto.enable = true;
-          gaming.enable = true;
-          hyprland.enable = true;
-          media.enable = true;
-          obsidian.enable = true;
-          office.enable = true;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = true;
-          wallpapers = true;
-        };
-      };
-    }
-
-    (mkIf config.features.desktop.hyprland.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          exec-once = ["tuxedo-backlight"];
-          monitor = [
-            "eDP-1,preferred,0x0,1.25"
-            "HDMI-A-1,1920x1080@120,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:eDP-1, default:true"
-            "2, monitor:eDP-1"
-            "3, monitor:eDP-1"
-            "4, monitor:HDMI-A-1,"
-            "5, monitor:HDMI-A-1,border:false,rounding:false"
-            "6, monitor:HDMI-A-1"
-          ];
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, fullscreen on"
-            "match:class ^steam_app_\\d+$, workspace 5"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
-        };
-      };
-    })
-  ];
-}

home/m3tam3re/m3-atlas.nix

@@ -1,19 +0,0 @@
-{
-  imports = [
-    ../common
-    ../features/cli
-    ../features/coding/opencode.nix
-    ./home-server.nix
-  ];
-  coding.editors.neovim.enable = true;
-  features = {
-    cli = {
-      nushell.enable = true;
-      fzf.enable = true;
-      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
-      zellij.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-daedalus.nix

@@ -1,101 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.hyprland;
-in {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-    #./services/librechat.nix
-  ];
-
-  options.features.desktop.hyprland.enable =
-    mkEnableOption "enable Hyprland";
-
-  config = mkMerge [
-    # Base configuration
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-        };
-      };
-      features = {
-        cli = {
-          fish.enable = true;
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
-          secrets.enable = true;
-          starship.enable = true;
-        };
-        desktop = {
-          coding.enable = true;
-          crypto.enable = false;
-          gaming.enable = false;
-          hyprland.enable = false;
-          media.enable = true;
-          office.enable = false;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = false;
-        };
-      };
-    }
-
-    (mkIf cfg.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          monitor = [
-            "eDP-1,preferred,0x0,1.25"
-            "HDMI-A-1,preferred,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:eDP-1, default:true"
-            "2, monitor:eDP-1"
-            "3, monitor:eDP-1"
-            "4, monitor:HDMI-A-1"
-            "5, monitor:HDMI-A-1,border:false,rounding:false"
-            "6, monitor:HDMI-A-1"
-          ];
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, fullscreen on"
-            "match:class ^steam_app_\\d+$, workspace 5"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
-        };
-      };
-    })
-  ];
-}

home/m3tam3re/m3-helios.nix

@@ -1,17 +0,0 @@
-{
-  imports = [
-    ../common
-    ../features/cli
-    ./home-server.nix
-  ];
-
-  features = {
-    cli = {
-      fish.enable = true;
-      fzf.enable = true;
-      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-hermes.nix

@@ -1,17 +0,0 @@
-{
-  imports = [
-    ../common
-    ../features/cli
-    ./home-server.nix
-  ];
-
-  features = {
-    cli = {
-      fish.enable = true;
-      fzf.enable = true;
-      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-kratos.nix

@@ -1,96 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-  ];
-
-  config = mkMerge [
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-          };
-        };
-      };
-      features = {
-        cli = {
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
-          secrets.enable = true;
-          starship.enable = true;
-          television.enable = true;
-        };
-        desktop = {
-          crypto.enable = true;
-          coding.enable = true;
-          gaming.enable = true;
-          hyprland.enable = true;
-          media.enable = true;
-          obsidian.enable = true;
-          office.enable = true;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = true;
-          wallpapers = true;
-        };
-      };
-    }
-
-    (mkIf config.features.desktop.hyprland.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          monitor = [
-            "DP-1,2560x1440@144,0x0,1"
-            "DP-2,2560x1440@144,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:DP-1, default:true"
-            "2, monitor:DP-1"
-            "3, monitor:DP-1"
-            "4, monitor:DP-2"
-            "5, monitor:DP-2"
-            "6, monitor:DP-2"
-            "7, monitor:DP-2"
-          ];
-
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
-        };
-      };
-    })
-  ];
-}

hosts/common/default.nix

@@ -18,6 +18,7 @@
   environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
 
   home-manager = {
+    useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {
       inherit inputs outputs system;
@@ -78,11 +79,4 @@
     nixPath = ["/etc/nix/path"];
   };
   users.defaultUserShell = pkgs.nushell;
-
-  # Compatibility shim: the hermes-agent nixos module references the legacy
-  # agenix activation script name "setupSecrets" (renamed to "agenixInstall"
-  # in current agenix). This empty passthrough satisfies the dependency so
-  # any host importing hermes-agent.nixosModules.default can build.
-  # Remove once upstream fixes: github:NousResearch/hermes-agent nix/nixosModules.nix:564
-  system.activationScripts.setupSecrets = lib.stringAfter [ "agenixInstall" ] "";
 }

hosts/common/ports.nix

@@ -38,7 +38,7 @@
       kestra = 3018;
       outline = 3019;
       authentik = 3023;
-      conduit = 3024;
+      tuwunel = 3024;
 
       # Home automation
       homarr = 7575;

hosts/common/users/m3tam3re.nix

@@ -1,11 +1,214 @@
+# hosts/common/users/m3tam3re.nix — Central user definition with m3ta-home integration.
+#
+# This module:
+#   1. Creates the m3tam3re NixOS user
+#   2. Loads the m3ta-home profile system via mkHome
+#   3. Sets per-host feature flags based on a host profile mapping
+#   4. Imports per-host home.nix overrides (monitors, HW-specific config)
+#
+# To add a new host:
+#   1. Add entry to hostProfiles below
+#   2. Add feature flags in the hostFlags section
+#   3. Create hosts/<hostname>/home.nix if the host needs overrides (monitors, etc.)
 {
   config,
   pkgs,
   inputs,
   ...
-}: {
+}: let
+  hostname = config.networking.hostName;
+
+  # ── Per-host profile mapping ──
+  # Determines which m3ta-home context and sets each host gets.
+  hostProfiles = {
+    # ── Desktop hosts ──
+    m3-ares = {
+      context = "desktop";
+      sets = ["coding" "gaming" "media"];
+    };
+    m3-kratos = {
+      context = "desktop";
+      sets = ["coding" "gaming" "media"];
+    };
+    m3-daedalus = {
+      context = "desktop";
+      sets = ["coding" "media"];
+    };
+    # ── Server hosts ──
+    m3-atlas = {
+      context = "server";
+      sets = [];
+    };
+    m3-helios = {
+      context = "server";
+      sets = [];
+    };
+    m3-hermes = {
+      context = "server";
+      sets = [];
+    };
+    m3-aether = {
+      context = "server";
+      sets = [];
+    };
+  };
+
+  profile =
+    hostProfiles.${
+      hostname
+    } or {
+      context = "server";
+      sets = [];
+    };
+  m3ta-lib = inputs.m3ta-home.lib;
+
+  # Check if a per-host home.nix exists
+  hostHomeFile = ./../../${hostname}/home.nix;
+  hostHomeExists = builtins.pathExists hostHomeFile;
+
+  # ── Per-host feature flags ──
+  # These enable/disable specific m3ta-home modules per host.
+  hostFlags =
+    if hostname == "m3-ares" || hostname == "m3-kratos"
+    then {
+      # Full desktop workstation
+      base = {
+        shell = {
+          fish.enable = true;
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          television.enable = true;
+        };
+        secrets.enable = true;
+      };
+      desktop = {
+        wm = {
+          hyprland.enable = true;
+          rofi.enable = true;
+          wayland.enable = true;
+        };
+        apps = {
+          crypto.enable = true;
+          obsidian.enable = true;
+          office.enable = true;
+        };
+        theme = {
+          fonts.enable = true;
+          wallpapers.enable = true;
+        };
+      };
+      coding = {
+        editors = {
+          neovim.enable = true;
+          zed.enable = true;
+        };
+        lsp.enable = true;
+        packages.enable = true;
+        languages = {
+          python.enable = true;
+          javascript.enable = true;
+          rustToolchain.enable = true;
+          go.enable = true;
+          typescript.enable = true;
+        };
+      };
+      profiles.gaming = {
+        steam.enable = true;
+        gamescope.enable = true;
+      };
+      profiles.media = {
+        obs.enable = true;
+        ffmpeg.enable = true;
+        kdenlive.enable = true;
+        ytDlp.enable = true;
+      };
+    }
+    else if hostname == "m3-daedalus"
+    then {
+      # Portable laptop — desktop without gaming, no Hyprland
+      base = {
+        shell = {
+          fish.enable = true;
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          television.enable = true;
+        };
+        secrets.enable = true;
+      };
+      desktop = {
+        wm = {
+          hyprland.enable = false;
+          wayland.enable = false;
+        };
+        apps = {
+          crypto.enable = false;
+          obsidian.enable = true;
+          office.enable = false;
+        };
+        theme = {
+          fonts.enable = true;
+          wallpapers.enable = false;
+        };
+      };
+      coding = {
+        editors = {
+          neovim.enable = true;
+          zed.enable = true;
+        };
+        lsp.enable = true;
+        packages.enable = true;
+        languages = {
+          python.enable = true;
+          javascript.enable = true;
+          rustToolchain.enable = true;
+          go.enable = true;
+          typescript.enable = true;
+        };
+      };
+      profiles.media = {
+        ytDlp.enable = true;
+      };
+    }
+    else if hostname == "m3-atlas"
+    then {
+      # Primary server — coding capable
+      base = {
+        shell = {
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          zellij.enable = true;
+        };
+      };
+      coding.editors.neovim.enable = true;
+    }
+    else {
+      # m3-helios, m3-hermes, m3-aether — minimal server
+      base = {
+        shell = {
+          fish.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+        };
+      };
+    };
+in {
+  # ── NixOS user definition ──
   users.users.m3tam3re = {
-    #initialHashedPassword = "$y$j9T$IoChbWGYRh.rKfmm0G86X0$bYgsWqDRkvX.EBzJTX.Z0RsTlwspADpvEF3QErNyCMC";
     password = "12345";
     isNormalUser = true;
     description = "m3tam3re";
@@ -25,9 +228,29 @@
     openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@m3-nix"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp razr"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml sascha.koenig@azintec.com"
     ];
     packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
   };
-  home-manager.users.m3tam3re =
-    import ../../../home/m3tam3re/${config.networking.hostName}.nix;
+
+  # ── Home-Manager configuration via m3ta-home ──
+  home-manager.users.m3tam3re = {
+    imports =
+      [
+        # Load m3ta-home composition engine
+        (m3ta-lib.mkHome {
+          user = "m3tam3re";
+          identity = "private";
+          inherit (profile) context sets;
+        })
+        # Per-host feature flags
+        hostFlags
+      ]
+      # Per-host home.nix (Hyprland monitors, XDG/MIME, HW-specific overrides)
+      ++ (
+        if hostHomeExists
+        then [hostHomeFile]
+        else []
+      );
+  };
 }

hosts/m3-aether/hardware-configuration.nix

@@ -1,11 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
   boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];

hosts/m3-ares/default.nix

@@ -44,7 +44,7 @@
 
   extraServices = {
     flatpak.enable = true;
-    ollama.enable = true;
+    ollama.enable = false;
     podman.enable = true;
     virtualisation.enable = true;
   };

hosts/m3-ares/home.nix

@@ -0,0 +1,75 @@
+# hosts/m3-ares/home.nix — Host-specific home-manager overrides.
+# TUXEDO laptop: eDP-1 + HDMI-A-1 external monitor.
+# Everything else (shell, editors, gaming, media, theme, etc.) comes from
+# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = mkMerge [
+    # ── XDG / MIME defaults ──
+    {
+      xdg = {
+        enable = true;
+        configFile."mimeapps.list".force = true;
+        mimeApps = {
+          enable = true;
+          associations.added = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+          defaultApplications = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "application/md" = ["dev.zed.Zed.desktop"];
+            "application/text" = ["dev.zed.Zed.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+        };
+      };
+    }
+
+    # ── Hyprland monitor layout & host-specific rules ──
+    (mkIf config.desktop.wm.hyprland.enable {
+      wayland.windowManager.hyprland = {
+        enable = true;
+        settings = {
+          # Laptop internal + external HDMI
+          monitor = [
+            { output = "eDP-1";     mode = "preferred";       position = "0x0";     scale = 1.25; }
+            { output = "HDMI-A-1";  mode = "1920x1080@120";   position = "2560x0";  scale = 1; }
+          ];
+          workspace_rule = [
+            { workspace = 1; monitor = "eDP-1";    default = true; }
+            { workspace = 2; monitor = "eDP-1"; }
+            { workspace = 3; monitor = "eDP-1"; }
+            { workspace = 4; monitor = "HDMI-A-1"; }
+            { workspace = 5; monitor = "HDMI-A-1"; border = false; rounding = false; }
+            { workspace = 6; monitor = "HDMI-A-1"; }
+          ];
+          window_rule = [
+            { match = { class = "dev.zed.Zed" };            workspace = "1"; }
+            { match = { class = "Msty" };                    workspace = "1"; }
+            { match = { class = "^com.obsproject.Studio$" }; workspace = "2"; }
+            { match = { class = "^(brave-browser)$" };      workspace = "4"; opacity = 1.0; }
+            { match = { class = "^(vivaldi-stable)$" };     workspace = "4"; opacity = 1.0; }
+            { match = { class = "^steam_app_\\d+$" };       fullscreen = true; workspace = "5"; idle_inhibit = "focus"; }
+          ];
+        };
+        extraConfig = mkAfter ''
+          -- Host startup: TUXEDO backlight
+          hl.on("hyprland.start", function()
+            hl.exec_cmd("tuxedo-backlight")
+          end)
+        '';
+      };
+    })
+  ];
+}

hosts/m3-ares/services/postgres.nix

@@ -1,7 +1,4 @@
-{
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_17;

hosts/m3-atlas/secrets.nix

@@ -10,6 +10,8 @@
       kestra-env = {file = ../../secrets/kestra-env.age;};
       littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
       minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
+      rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
+      rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
       n8n-env = {file = ../../secrets/n8n-env.age;};
       netbird-auth-secret = {
         file = ../../secrets/netbird-auth-secret.age;
@@ -33,6 +35,10 @@
       restreamer-env = {file = ../../secrets/restreamer-env.age;};
       searx = {file = ../../secrets/searx.age;};
       tailscale-key = {file = ../../secrets/tailscale-key.age;};
+      tuwunel-registration-token = {
+        file = ../../secrets/tuwunel-registration-token.age;
+        owner = "tuwunel";
+      };
       traefik = {
         file = ../../secrets/traefik.age;
         owner = "traefik";
@@ -65,7 +71,6 @@
         owner = "m3tam3re";
       };
       authentik-env = {file = ../../secrets/authentik-env.age;};
-      conduit-env = {file = ../../secrets/conduit-env.age;};
     };
   };
 }

hosts/m3-atlas/services/containers/kestra.nix

@@ -11,8 +11,7 @@
       "kestra_data:/app/storage"
       "/tmp/kestra-wd:/tmp/kestra-wd"
     ];
-    extraOptions =
-      [ "--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web" ];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web"];
   };
 
   systemd.tmpfiles.rules = [
@@ -21,8 +20,7 @@
 
   # Traefik configuration specific to littlelink
   services.traefik.dynamicConfigOptions.http = {
-    services.kestra.loadBalancer.servers =
-      [{ url = "http://localhost:3018/"; }];
+    services.kestra.loadBalancer.servers = [{url = "http://localhost:3018/";}];
 
     routers.kestra = {
       rule = "Host(`k.m3ta.dev`)";

hosts/m3-atlas/services/default.nix

@@ -1,10 +1,10 @@
 {
   imports = [
-    ./conduit.nix
+    ./tuwunel.nix
     ./containers
     ./gitea.nix
     ./gitea-actions-runner.nix
-    ./minio.nix
+    ./rustfs.nix
     ./mysql.nix
     ./netbird.nix
     ./n8n.nix

hosts/m3-atlas/services/hermes-agent.nix

@@ -1,191 +0,0 @@
-{config, ...}: let
-  # Default ElevenLabs voice: Bella (German-capable female)
-  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
-in {
-  services.hermes-agent = {
-    enable = true;
-    addToSystemPackages = true;
-
-    # Secrets via agenix
-    environmentFiles = [config.age.secrets."hermes-env".path];
-
-    # Non-secret environment variables
-    environment = {
-      #
-    };
-
-    # ── Container mode (podman) ──────────────────────────────────────────
-    container = {
-      enable = true;
-      backend = "podman";
-    };
-
-    settings = {
-      # ── Model ──────────────────────────────────────────────────────────
-      model = {
-        default = "glm-5.1";
-        provider = "zai";
-        base_url = "https://api.z.ai/api/coding/paas/v4/";
-      };
-
-      credential_pool_strategies = {
-        zai = "fill_first";
-      };
-
-      toolsets = ["all"];
-
-      # ── Agent ──────────────────────────────────────────────────────────
-      agent = {
-        max_turns = 90;
-        gateway_timeout = 1800;
-        tool_use_enforcement = "auto";
-      };
-
-      # ── Terminal ───────────────────────────────────────────────────────
-      terminal = {
-        backend = "local";
-        modal_mode = "auto";
-        cwd = ".";
-        timeout = 180;
-        persistent_shell = true;
-      };
-
-      # ── Browser ────────────────────────────────────────────────────────
-      browser = {
-        inactivity_timeout = 120;
-        command_timeout = 30;
-        cloud_provider = "local";
-      };
-
-      # ── Checkpoints / Compression ──────────────────────────────────────
-      checkpoints = {
-        enabled = true;
-        max_snapshots = 50;
-      };
-
-      file_read_max_chars = 100000;
-
-      compression = {
-        enabled = true;
-        threshold = 0.5;
-        target_ratio = 0.2;
-        protect_last_n = 20;
-      };
-
-      # ── Display ────────────────────────────────────────────────────────
-      display = {
-        compact = false;
-        personality = "kawaii";
-        resume_display = "full";
-        busy_input_mode = "interrupt";
-        inline_diffs = true;
-        skin = "default";
-        tool_progress = "all";
-      };
-
-      # ── TTS / STT / Voice ──────────────────────────────────────────────
-      tts = {
-        provider = "elevenlabs";
-        elevenlabs = {
-          voice_id = elevenlabsVoiceId;
-          model_id = "eleven_multilingual_v2";
-        };
-      };
-
-      stt = {
-        enabled = true;
-        provider = "local";
-        local = {model = "base";};
-      };
-
-      voice = {
-        record_key = "ctrl+b";
-        max_recording_seconds = 120;
-        silence_threshold = 200;
-        silence_duration = 3.0;
-      };
-
-      # ── Memory ─────────────────────────────────────────────────────────
-      memory = {
-        memory_enabled = true;
-        user_profile_enabled = true;
-        memory_char_limit = 2200;
-        user_char_limit = 1375;
-      };
-
-      # ── Delegation ─────────────────────────────────────────────────────
-      delegation = {
-        max_iterations = 50;
-      };
-
-      # ── Discord ────────────────────────────────────────────────────────
-      discord = {
-        require_mention = true;
-        auto_thread = true;
-        reactions = true;
-      };
-
-      # ── Approvals / Security ───────────────────────────────────────────
-      approvals = {
-        mode = "manual";
-        timeout = 60;
-      };
-
-      security = {
-        redact_secrets = true;
-        tirith_enabled = true;
-        tirith_fail_open = true;
-      };
-
-      # ── Cron / Session ─────────────────────────────────────────────────
-      cron = {wrap_response = true;};
-
-      session_reset = {
-        mode = "both";
-        idle_minutes = 1440;
-        at_hour = 4;
-      };
-
-      # ── Web ────────────────────────────────────────────────────────────
-      web = {backend = "exa";};
-
-      # ── Platform Toolsets ──────────────────────────────────────────────
-      platform_toolsets = {
-        cli = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-        telegram = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-      };
-    };
-  };
-}

hosts/m3-atlas/services/rustfs.nix

@@ -1,14 +1,29 @@
-{config, ...}: {
-  services.minio = {
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}: {
+  services.rustfs = {
     enable = true;
-    region = "eu-central-1";
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    # Reuse existing MinIO data directory
+    volumes = "/var/storage/s3";
+
+    # Keep same ports as MinIO to avoid changing Traefik and client configs
+    address = ":3008";
+    consoleEnable = true;
     consoleAddress = ":3007";
-    listenAddress = ":3008";
-    browser = true;
-    rootCredentialsFile = config.age.secrets.minio-root-cred.path;
-    dataDir = ["/var/storage/s3"];
+
+    # Credentials via agenix
+    accessKeyFile = config.age.secrets.rustfs-access-key.path;
+    secretKeyFile = config.age.secrets.rustfs-secret-key.path;
+
+    logLevel = "info";
   };
-  # Traefik configuration specific to minio
+
+  # Traefik configuration — same routes as before
   services.traefik.dynamicConfigOptions.http = {
     services.minio-console.loadBalancer.servers = [
       {

hosts/m3-atlas/services/traefik.nix

@@ -43,6 +43,12 @@
     dynamicConfigOptions = {
       http = {
         services = {
+          # ── Hermes Dashboard (m3-hermes over Netbird) ────────────────
+          hermes-dashboard = {
+            loadBalancer.servers = [
+              {url = "http://100.81.231.152:9119";}
+            ];
+          };
           dummy = {
             loadBalancer.servers = [
               {url = "http://192.168.0.1";} # Diese URL wird nie verwendet
@@ -79,6 +85,15 @@
         };
 
         routers = {
+          # ── Hermes Dashboard — Netbird mesh only ─────────────────────
+          hermes-dashboard = {
+            rule = "Host(`dash.m3ta.dev`)";
+            service = "hermes-dashboard";
+            entrypoints = ["websecure"];
+            tls = {
+              certResolver = "godaddy";
+            };
+          };
           api = {
             rule = "Host(`r.m3tam3re.com`)";
             service = "api@internal";

hosts/m3-atlas/services/tuwunel.nix

@@ -1,44 +1,46 @@
-{config, ...}: {
-  services.matrix-conduit = {
+{config, ...}: let
+  # Tuwunel uses a list for ports
+  tuwunel-port = config.m3ta.ports.get "tuwunel";
+in {
+  services.matrix-tuwunel = {
     enable = true;
     settings.global = {
       server_name = "m3ta.dev";
-      address = "127.0.0.1";
-      port = config.m3ta.ports.get "conduit";
+      address = ["127.0.0.1"];
+      port = [tuwunel-port];
       max_request_size = 20000000;
-      allow_registration = false;
+      allow_registration = true;
+      registration_token_file = config.age.secrets."tuwunel-registration-token".path;
       allow_encryption = true;
       allow_federation = true;
       trusted_servers = ["matrix.org"];
-      database_backend = "rocksdb";
     };
-    secretFile = config.age.secrets.conduit-env.path;
   };
 
-  # Traefik configuration for Conduit
+  # Traefik configuration for Tuwunel
   services.traefik.dynamicConfigOptions.http = {
-    services.conduit.loadBalancer.servers = [
+    services.tuwunel.loadBalancer.servers = [
       {
-        url = "http://localhost:${toString (config.m3ta.ports.get "conduit")}/";
+        url = "http://localhost:${toString tuwunel-port}/";
       }
     ];
 
-    routers.conduit = {
+    routers.tuwunel = {
       rule = "Host(`matrix.m3ta.dev`)";
       tls = {
         certResolver = "godaddy";
       };
-      service = "conduit";
+      service = "tuwunel";
       entrypoints = "websecure";
     };
 
     # Federation endpoint on base domain
-    routers.conduit-federation = {
+    routers.tuwunel-federation = {
       rule = "Host(`m3ta.dev`) && PathPrefix(`/_matrix`)";
       tls = {
         certResolver = "godaddy";
       };
-      service = "conduit";
+      service = "tuwunel";
       entrypoints = "websecure";
     };
   };

hosts/m3-daedalus/home.nix

@@ -0,0 +1,37 @@
+# hosts/m3-daedalus/home.nix — Host-specific home-manager overrides.
+# Portable laptop: no Hyprland, no external monitors.
+# Everything else (shell, editors, media, theme, etc.) comes from
+# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = {
+    # ── XDG / MIME defaults ──
+    xdg = {
+      enable = true;
+      configFile."mimeapps.list".force = true;
+      mimeApps = {
+        enable = true;
+        associations.added = {
+          "application/zip" = ["org.gnome.FileRoller.desktop"];
+          "application/csv" = ["calc.desktop"];
+          "application/pdf" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+        };
+        defaultApplications = {
+          "application/zip" = ["org.gnome.FileRoller.desktop"];
+          "application/csv" = ["calc.desktop"];
+          "application/pdf" = ["vivaldi-stable.desktop"];
+          "application/md" = ["dev.zed.Zed.desktop"];
+          "application/text" = ["dev.zed.Zed.desktop"];
+          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+        };
+      };
+    };
+  };
+}

hosts/m3-helios/hardware-configuration.nix

@@ -1,11 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
   boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];

hosts/m3-hermes/configuration.nix

@@ -19,7 +19,9 @@
   environment.systemPackages = with pkgs; [
     neovim
     git
+    tea
     ghostty.terminfo
+    uv
   ];
 
   services.openssh = {
@@ -30,6 +32,18 @@
     };
   };
 
+  security.sudo.extraRules = [
+    {
+      users = ["hermes"];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/podman";
+          options = ["NOPASSWD"];
+        }
+      ];
+    }
+  ];
+
   services.fstrim = {
     enable = true;
     interval = "weekly";

hosts/m3-hermes/default.nix

@@ -10,7 +10,7 @@
   extraServices = {
     flatpak.enable = false;
     ollama.enable = false;
-    podman.enable = true;
+    podman.enable = false;
     virtualisation.enable = false;
   };
 }

hosts/m3-hermes/hardware-configuration.nix

@@ -1,7 +1,13 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to configuration.nix instead.
-{config, lib, pkgs, modulesPath, ...}: {
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
   ];

hosts/m3-hermes/secrets.nix

@@ -7,6 +7,9 @@
       hermes-cloud-env = {
         file = ../../secrets/hermes-cloud-env.age;
       };
+      hermes-api-server-key = {
+        file = ../../secrets/hermes-api-server-key.age;
+      };
     };
   };
 }

hosts/m3-hermes/services/default.nix

@@ -1,5 +1,7 @@
 {
   imports = [
     ./hermes-agent.nix
+    ./hermes-dashboard.nix
+    ./netbird.nix
   ];
 }

hosts/m3-hermes/services/hermes-agent.nix

@@ -1,31 +1,124 @@
 {
   config,
   pkgs,
+  inputs,
   ...
 }: let
-  # Default ElevenLabs voice: Bella (German-capable female)
-  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
+  # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
+  edgeVoice = "de-DE-SeraphinaMultilingualNeural";
+
+  # Extra Python packages from the container's writable venv layer.
+  # matrix-nio is installed via pip in /home/hermes/.venv but the hermes
+  # process uses the read-only Nix store Python, so we inject the venv's
+  # site-packages via PYTHONPATH and provide libstdc++ for libolm (e2e).
+  # NOTE: v0.13.0 upgraded to Python 3.12 — path updated accordingly.
+  venvSitePackages = "/home/hermes/.venv/lib/python3.12/site-packages";
+  gccLibPath = "${pkgs.stdenv.cc.cc.lib}/lib";
+
+  # Build skills using agents flake lib for hermes user
+  hermesSkills = inputs.agents.lib.mkSkills {
+    inherit pkgs;
+    customSkills = "${inputs.agents}/skills";
+    externalSkills = [
+      {
+        src = inputs.skills-basecamp;
+        skillsDir = "skills";
+      }
+      {
+        src = inputs.skills-anthropic;
+        skillsDir = "skills";
+      }
+      {
+        src = inputs.skills-kestra;
+        skillsDir = "skills";
+      }
+    ];
+  };
 in {
+  virtualisation.docker.enable = true;
+
+  systemd.tmpfiles.rules = [
+    "d /home/hermes/.config 0755 hermes hermes -"
+    "d /home/hermes/.config/tea 0755 hermes hermes -"
+    "L+ /home/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
+      logins:
+        - name: m3ta
+          url: https://code.m3ta.dev
+          token:
+          ssh_host: code.m3ta.dev
+          user: m3ta-chiron
+          default: true
+    ''}"
+  ];
+
+  systemd.services.copy-hermes-skills = {
+    description = "Copy agent skills to hermes home directory";
+    wantedBy = ["hermes-agent.service"];
+    before = ["hermes-agent.service"];
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    script = ''
+      mkdir -p /var/lib/hermes/.agents
+      cp -rT ${hermesSkills} /var/lib/hermes/.agents/skills
+      chown -R hermes:hermes /var/lib/hermes/.agents
+    '';
+  };
+
+  # Ensure 'uv' is in the hermes-agent service PATH so CronJobs and terminal
+  # sessions can use 'uv run' for PEP 723 scripts (e.g. garmin-daily.py).
+  systemd.services.hermes-agent.path = [pkgs.uv];
+
   services.hermes-agent = {
     enable = true;
     addToSystemPackages = true;
 
+    extraPackages = with pkgs; [
+      docker
+      git
+      tea
+      nix
+      zellij
+    ];
+
     # Secrets via agenix
     environmentFiles = [
       config.age.secrets."hermes-env".path
       config.age.secrets."hermes-cloud-env".path
+      config.age.secrets."hermes-api-server-key".path
     ];
 
     # Non-secret environment variables
+    # Git identity is set entirely via env vars (GIT_AUTHOR_*, GIT_COMMITTER_*,
+    # GIT_INIT_DEFAULT_BRANCH) — no .gitconfig file needed. Env vars take
+    # precedence over any gitconfig, and the hermes gateway injects them into
+    # all terminal sessions via .env.
     environment = {
       GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
+      GIT_AUTHOR_NAME = "m3ta-chiron";
+      GIT_AUTHOR_EMAIL = "m3ta-chiron@agentmail.to";
+      GIT_COMMITTER_NAME = "m3ta-chiron";
+      GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
+      GIT_INIT_DEFAULT_BRANCH = "master";
+
+      # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
+      # Accessible via Netbird mesh VPN — not exposed to the public internet.
+      # Bind to 0.0.0.0 so the Netbird interface can reach it.
+      API_SERVER_ENABLED = "true";
+      API_SERVER_HOST = "0.0.0.0";
+      API_SERVER_PORT = "8642";
     };
 
     # ── Container mode (podman) ──────────────────────────────────────────
     container = {
-      enable = true;
+      enable = false;
       backend = "podman";
       extraVolumes = ["/home/m3tam3re/p:/projects:rw"];
+      extraOptions = [
+        "--env"
+        "PYTHONPATH=${venvSitePackages}"
+        "--env"
+        "LD_LIBRARY_PATH=${gccLibPath}"
+      ];
     };
 
     settings = {
@@ -48,6 +141,14 @@ in {
         tool_use_enforcement = "auto";
       };
 
+      # ── Skills ─────────────────────────────────────────────────────────
+
+      skills = {
+        external_dirs = [
+          "/var/lib/hermes/.agents/skills"
+        ];
+      };
+
       # ── Terminal ───────────────────────────────────────────────────────
       terminal = {
         backend = "local";
@@ -64,7 +165,8 @@ in {
         cloud_provider = "local";
       };
 
-      # ── Checkpoints / Compression ──────────────────────────────────────
+      # ── Checkpoints v2 ─────────────────────────────────────────────────
+      # v0.13.0: Single-store rewrite with real pruning + disk guardrails.
       checkpoints = {
         enabled = true;
         max_snapshots = 50;
@@ -92,10 +194,9 @@ in {
 
       # ── TTS / STT / Voice ──────────────────────────────────────────────
       tts = {
-        provider = "elevenlabs";
-        elevenlabs = {
-          voice_id = elevenlabsVoiceId;
-          model_id = "eleven_multilingual_v2";
+        provider = "edge";
+        edge = {
+          voice = edgeVoice;
         };
       };
 
@@ -114,22 +215,38 @@ in {
 
       # ── Memory ─────────────────────────────────────────────────────────
       memory = {
+        provider = "honcho";
         memory_enabled = true;
         user_profile_enabled = true;
         memory_char_limit = 2200;
         user_char_limit = 1375;
       };
 
-      # ── Delegation ─────────────────────────────────────────────────────
+      # ── Delegation / Orchestrator ────────────────────────────────────────
       delegation = {
         max_iterations = 50;
+        orchestrator_enabled = true;
+        max_spawn_depth = 2;
       };
 
-      # ── Discord ────────────────────────────────────────────────────────
-      discord = {
-        require_mention = true;
+      # ── Kanban (v0.13.0 — Multi-Agent Board) ──────────────────────────
+      # Durable task board with embedded dispatcher in gateway process.
+      # Workers are full OS processes with identity, heartbeat, reclaim,
+      # zombie detection, and hallucination gate.
+      kanban = {
+        dispatch_in_gateway = true;
+        dispatch_interval_seconds = 60;
+      };
+
+      # ── Matrix ────────────────────────────────────────────────────────
+      matrix = {
+        homeserver = "https://matrix.m3ta.dev";
+        user_id = "@chiron:m3ta.dev";
+        allowed_users = ["@m3tam3re:m3ta.dev"];
+        encryption = true;
+        group_sessions_per_user = true;
         auto_thread = true;
-        reactions = true;
+        dm_mention_threads = true;
       };
 
       # ── Approvals / Security ───────────────────────────────────────────
@@ -155,44 +272,6 @@ in {
 
       # ── Web ────────────────────────────────────────────────────────────
       web = {backend = "exa";};
-
-      # ── Platform Toolsets ──────────────────────────────────────────────
-      platform_toolsets = {
-        cli = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-        telegram = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-      };
     };
   };
 

hosts/m3-hermes/services/hermes-dashboard.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
+  # Netbird mesh VPN range — dashboard only accessible from mesh peers.
+  # m3-atlas Traefik proxies to this port over Netbird.
+  netbirdRange = "100.64.0.0/16";
+
+  # Reference the hermes-agent package from the running service config
+  hermesPkg = config.services.hermes-agent.package or (inputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default or pkgs.hermes-agent);
+in {
+  # ── Hermes Dashboard systemd service ───────────────────────────────────
+  # Web UI for managing Hermes Agent — sessions, config, kanban, cron, etc.
+  #
+  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :9119
+  #
+  # --insecure is required to bind 0.0.0.0 (hermes refuses non-localhost otherwise).
+  # Safe because firewall restricts port 9119 to Netbird mesh only.
+  systemd.services.hermes-dashboard = {
+    description = "Hermes Agent Web Dashboard";
+    after = ["network.target" "hermes-agent.service"];
+    wants = ["hermes-agent.service"];
+    wantedBy = ["multi-user.target"];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "hermes";
+      Group = "hermes";
+
+      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
+
+      # Environment matching the hermes-agent service
+      Environment = [
+        "HERMES_HOME=/var/lib/hermes/.hermes"
+        "HERMES_MANAGED=true"
+        "HOME=/var/lib/hermes"
+      ];
+
+      # Security hardening (matching hermes-agent service pattern)
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = "read-only";
+      ReadWritePaths = ["/var/lib/hermes" "/tmp"];
+      PrivateTmp = true;
+
+      # Restart policy
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+  };
+
+  # ── Firewall: Dashboard only from Netbird mesh ─────────────────────────
+  networking.firewall = {
+    extraCommands = ''
+      # Allow Hermes Dashboard (9119/tcp) only from Netbird mesh VPN
+      ip46tables -A nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept
+    '';
+
+    extraStopCommands = ''
+      ip46tables -D nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
+    '';
+  };
+}

hosts/m3-hermes/services/netbird.nix

@@ -0,0 +1,29 @@
+{pkgs, ...}: {
+  services.netbird.enable = true;
+
+  systemd.services.netbird = {
+    environment = {
+      NB_DISABLE_SSH_CONFIG = "true";
+      NB_USE_LEGACY_ROUTING = "true";
+    };
+    path = [
+      pkgs.shadow
+      pkgs.util-linux
+    ];
+  };
+
+  programs.ssh.extraConfig = ''
+    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
+        PreferredAuthentications password,publickey,keyboard-interactive
+        PasswordAuthentication yes
+        PubkeyAuthentication yes
+        BatchMode no
+        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
+        StrictHostKeyChecking no
+        UserKnownHostsFile /dev/null
+        CheckHostIP no
+        LogLevel ERROR
+  '';
+
+  networking.firewall.checkReversePath = "loose";
+}

hosts/m3-kratos/configuration.nix

@@ -10,7 +10,7 @@
   # Use the systemd-boot EFI boot loader.
   boot.supportedFilesystems = ["zfs"];
   boot.zfs.package = pkgs.zfs_unstable;
-  boot.zfs.forceImportAll = true;
+  boot.zfs.forceImportAll = false;
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.initrd.kernelModules = ["amdgpu"];
@@ -68,7 +68,7 @@
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
-  environment.systemPackages = with pkgs; [neovim git n8n];
+  environment.systemPackages = with pkgs; [neovim git];
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.

hosts/m3-kratos/home.nix

@@ -0,0 +1,70 @@
+# hosts/m3-kratos/home.nix — Host-specific home-manager overrides.
+# AMD desktop: dual 2560x1440@144 via DisplayPort.
+# Everything else (shell, editors, gaming, media, theme, etc.) comes from
+# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = mkMerge [
+    # ── XDG / MIME defaults ──
+    {
+      xdg = {
+        enable = true;
+        configFile."mimeapps.list".force = true;
+        mimeApps = {
+          enable = true;
+          associations.added = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+          defaultApplications = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "application/md" = ["dev.zed.Zed.desktop"];
+            "application/text" = ["dev.zed.Zed.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+        };
+      };
+    }
+
+    # ── Hyprland monitor layout & host-specific rules ──
+    (mkIf config.desktop.wm.hyprland.enable {
+      wayland.windowManager.hyprland = {
+        enable = true;
+        settings = {
+          # Dual monitor: DP-1 left, DP-2 right
+          monitor = [
+            { output = "DP-1"; mode = "2560x1440@144"; position = "0x0";     scale = 1; }
+            { output = "DP-2"; mode = "2560x1440@144"; position = "2560x0";  scale = 1; }
+          ];
+          workspace_rule = [
+            { workspace = 1; monitor = "DP-1"; default = true; }
+            { workspace = 2; monitor = "DP-1"; }
+            { workspace = 3; monitor = "DP-1"; }
+            { workspace = 4; monitor = "DP-2"; }
+            { workspace = 5; monitor = "DP-2"; }
+            { workspace = 6; monitor = "DP-2"; }
+            { workspace = 7; monitor = "DP-2"; }
+          ];
+          window_rule = [
+            { match = { class = "dev.zed.Zed" };            workspace = "1"; }
+            { match = { class = "Msty" };                    workspace = "1"; }
+            { match = { class = "^com.obsproject.Studio$" }; workspace = "2"; }
+            { match = { class = "^(brave-browser)$" };      workspace = "4"; opacity = 1.0; }
+            { match = { class = "^(vivaldi-stable)$" };     workspace = "4"; opacity = 1.0; }
+            { match = { class = "^steam_app_\\d+$" };       idle_inhibit = "focus"; }
+          ];
+        };
+      };
+    })
+  ];
+}

hosts/m3-kratos/services/default.nix

@@ -1,9 +1,8 @@
 {pkgs, ...}: {
   imports = [
     ./containers
-    ./hermes-agent.nix
     ./mem0.nix
-    ./n8n.nix
+    # ./n8n.nix
     ./netbird.nix
     ./postgres.nix
     ./sound.nix

hosts/m3-kratos/services/hermes-agent.nix

@@ -1,184 +0,0 @@
-{config, ...}: let
-  # Default ElevenLabs voice: Bella (German-capable female)
-  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
-in {
-  services.hermes-agent = {
-    enable = true;
-    addToSystemPackages = true;
-
-    # Secrets via agenix
-    environmentFiles = [config.age.secrets."hermes-env".path];
-
-    # Non-secret environment variables
-    environment = {
-      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
-    };
-
-    settings = {
-      # ── Model ──────────────────────────────────────────────────────────
-      model = {
-        default = "glm-5.1";
-        provider = "zai";
-      };
-
-      credential_pool_strategies = {
-        zai = "fill_first";
-      };
-
-      toolsets = ["all"];
-
-      # ── Agent ──────────────────────────────────────────────────────────
-      agent = {
-        max_turns = 90;
-        gateway_timeout = 1800;
-        tool_use_enforcement = "auto";
-      };
-
-      # ── Terminal ───────────────────────────────────────────────────────
-      terminal = {
-        backend = "ssh";
-        modal_mode = "auto";
-        cwd = ".";
-        timeout = 180;
-        persistent_shell = true;
-      };
-
-      # ── Browser ────────────────────────────────────────────────────────
-      browser = {
-        inactivity_timeout = 120;
-        command_timeout = 30;
-        cloud_provider = "local";
-      };
-
-      # ── Checkpoints / Compression ──────────────────────────────────────
-      checkpoints = {
-        enabled = true;
-        max_snapshots = 50;
-      };
-
-      file_read_max_chars = 100000;
-
-      compression = {
-        enabled = true;
-        threshold = 0.5;
-        target_ratio = 0.2;
-        protect_last_n = 20;
-      };
-
-      # ── Display ────────────────────────────────────────────────────────
-      display = {
-        compact = false;
-        personality = "kawaii";
-        resume_display = "full";
-        busy_input_mode = "interrupt";
-        inline_diffs = true;
-        skin = "default";
-        tool_progress = "all";
-      };
-
-      # ── TTS / STT / Voice ──────────────────────────────────────────────
-      tts = {
-        provider = "elevenlabs";
-        elevenlabs = {
-          voice_id = elevenlabsVoiceId;
-          model_id = "eleven_multilingual_v2";
-        };
-      };
-
-      stt = {
-        enabled = true;
-        provider = "local";
-        local = {model = "base";};
-      };
-
-      voice = {
-        record_key = "ctrl+b";
-        max_recording_seconds = 120;
-        silence_threshold = 200;
-        silence_duration = 3.0;
-      };
-
-      # ── Memory ─────────────────────────────────────────────────────────
-      memory = {
-        memory_enabled = true;
-        user_profile_enabled = true;
-        memory_char_limit = 2200;
-        user_char_limit = 1375;
-      };
-
-      # ── Delegation ─────────────────────────────────────────────────────
-      delegation = {
-        max_iterations = 50;
-      };
-
-      # ── Discord ────────────────────────────────────────────────────────
-      discord = {
-        require_mention = true;
-        auto_thread = true;
-        reactions = true;
-      };
-
-      # ── Approvals / Security ───────────────────────────────────────────
-      approvals = {
-        mode = "manual";
-        timeout = 60;
-      };
-
-      security = {
-        redact_secrets = true;
-        tirith_enabled = true;
-        tirith_fail_open = true;
-      };
-
-      # ── Cron / Session ─────────────────────────────────────────────────
-      cron = {wrap_response = true;};
-
-      session_reset = {
-        mode = "both";
-        idle_minutes = 1440;
-        at_hour = 4;
-      };
-
-      # ── Web ────────────────────────────────────────────────────────────
-      web = {backend = "exa";};
-
-      # ── Platform Toolsets ──────────────────────────────────────────────
-      platform_toolsets = {
-        cli = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-        telegram = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-      };
-    };
-  };
-}

hosts/m3-kratos/services/n8n.nix

@@ -1,6 +1,6 @@
 {lib, ...}: {
   services.n8n = {
-    enable = true;
+    enable = false;
     openFirewall = true;
     environment = {
       N8N_SECURE_COOKIE = "false";

issues.jsonl

@@ -0,0 +1,3 @@
+{"id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}

overlays/default.nix

@@ -27,7 +27,7 @@
 
   temp-packages = final: _prev: {
     temp = import inputs.nixpkgs-9e9486b {
-      system = final.system;
+      system = final.stdenv.hostPlatform.system;
       config.allowUnfree = true;
     };
   };

secrets.nix

@@ -16,7 +16,6 @@ in {
   "secrets/anytype-key.age".publicKeys = systems ++ users;
   "secrets/anytype-key-ares.age".publicKeys = systems ++ users;
   "secrets/authentik-env.age".publicKeys = systems ++ users;
-  "secrets/conduit-env.age".publicKeys = systems ++ users;
   "secrets/baserow-env.age".publicKeys = systems ++ users;
   "secrets/ghost-env.age".publicKeys = systems ++ users;
   "secrets/littlelink-m3tam3re.age".publicKeys = systems ++ users;
@@ -24,6 +23,8 @@ in {
   "secrets/kestra-config.age".publicKeys = systems ++ users;
   "secrets/kestra-env.age".publicKeys = systems ++ users;
   "secrets/minio-root-cred.age".publicKeys = systems ++ users;
+  "secrets/rustfs-access-key.age".publicKeys = systems ++ users;
+  "secrets/rustfs-secret-key.age".publicKeys = systems ++ users;
   "secrets/n8n-env.age".publicKeys = systems ++ users;
   "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
   "secrets/netbird-db-password.age".publicKeys = systems ++ users;
@@ -51,4 +52,7 @@ in {
   "secrets/honcho-key.age".publicKeys = systems ++ users;
   "secrets/hermes-env.age".publicKeys = systems ++ users;
   "secrets/hermes-cloud-env.age".publicKeys = systems ++ users;
+  "secrets/hermes-api-server-key.age".publicKeys = systems ++ users;
+  "secrets/hermes-gitea-token.age".publicKeys = systems ++ users;
+  "secrets/tuwunel-registration-token.age".publicKeys = systems ++ users;
 }

secrets/hermes-api-server-key.age

@@ -0,0 +1,26 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw 2TwbZwX9SwWg4SVC0A2ICmyRjSfO+xtfBcBOK1lh3T4
+DSf4DrOAvW7L49lh6cq5IqrMM7gqXv2+67rR3ttn+CE
+-> ssh-ed25519 5kwcsA K1hqFOAxq2T+oLp3bQjLYpXtlQVkA7RHCM/8ETMGbwU
+xIE4xz50LB5vbDTTLKVcx9vC2iXIsRLThHYYxGjcJyY
+-> ssh-ed25519 9d4YIQ bXYb62OM/N+EXpMOZZ6zEbpfaH10Vz62PuUdGODXolw
+j64kKzOn8CmSnykEuWnXHZ0nfqwOfOxX4FPR4GSouR0
+-> ssh-ed25519 3Bcr1w C4alN6ud7q0K4I7NHuBgC77D6zeTfZVGjNS3EKpvL00
+NpjOsg3eJ5LvX0lV7NYuVHLeqeYylHdmw60H+KeG1GY
+-> ssh-ed25519 c4NQlA In5wsg4+LTIEbP75B83GMXPCItSPGwKWUW8QO+QjXyY
+oK1kikhr4RMq6QMv9kjNjiKrf5srlGh7hGbU2qns2rM
+-> ssh-rsa DQlE7w
+tcP4yPgGWqHYeE1gw/KD6cswik+9WU2s2f7hg5mK78085sQ7npXRsBVAz2OCRn07
+foeAAmnY4YmKriBh421JOVNBDOXHR5dfaIKY9b663L+rYj99ic0rfW26C+dqKitF
+SnvveL3Zf16nqg6duSVA7LIcIFgkIlA+RXnHPVho+P4GwEH7W8nCf/4kUquuhB7B
+F4Hx1qOknmGyNBJBFi27D04ZDDk/ZVxioYsO6P6TUu7MuaGmQCoVKREDl5RRh4zO
+XD8/TFDRsJLqqcbCKIlU+6CN1+L0r4FN4K0UaTjwPNzGvn5EEjBKw9RpOhdvI28I
+WlAQ+w6gdQiz9Ju4e5p7Doz2MbNb6894DimawHjzl968Xy5ifX2XA+FBdcW5hU9A
+u+7VXKZmbfMyvRA7lmKRoi4SurJAyQd6iXBrVKfTwFc53V/tJi48bsKcE3yXxHH+
+lKGuZFNGDDkqCruycjvz94WaIHy3fv5hhmBdgwoCZK1VGSLAnwdm1rG4B9m3t/K8
+
+-> ssh-ed25519 CSMyhg FNYYdEIJYcxkjMuM5lnIs9gIilvgD44uazZE8CjNeho
+QHeghlsOOlYNMwhMHT4o7DeuyxGP/3wyqm94HUHjn44
+--- zRG6aCTS+X18VpeN+tz38kaUoilk1kN5KrWTWYZ6pV4
+ræX_qÔÁ’Ð껿H#p¯f™”}(žA(ã|»?ë0ªyJk¥SD‡\Jm&uõÃ&Ô9€ýÄ5Ù+çÊ…!v%Y˜ù~ãÁ$û“šZÇÓ°j„z–Â\ßá1,Vf˜
+£’æ1zª»#Ó

secrets/hermes-gitea-token.age

@@ -0,0 +1,25 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw j+zQu+BGTMVhIEzhqECFLMqs8tK7P8zDF/0fumWTrSY
+RqemJfrS6bf6r/Owh38FNV14JNqTP2ZtN8diUqJ0NTU
+-> ssh-ed25519 5kwcsA gYZEiF1oFwd7kddSzmmvFC7umpaD0y4DL2LAOHmmkkI
+KcOSW/aExT0wJl2Fs97mVSj64CYGL8DsHbKZca3BdTo
+-> ssh-ed25519 9d4YIQ 41Mx+hpizRKeW4lu1gMcHVI4p5PqN202F/dJl0n9oTw
+G9zr0kdbswSifyHzqlWNyYB1TEaQjxFyxs7mz9XM7Ko
+-> ssh-ed25519 3Bcr1w 3FnDPnyWym3Pv70DBEg+tewH6GNM3S/mbbYPGjb1LiY
+TOpFTHq5XDoJoqfsDnProGUlXKwuGJQhYJf/f23bgKE
+-> ssh-ed25519 c4NQlA mpZuWGlXdmhqkta3SxcDcm/4dw017Zn9KS29WBznnzg
+3LjR5O5uezXy3toWAEAEPU4nVx69GYpbYQwQygoIwf4
+-> ssh-rsa DQlE7w
+iK5n9EFFD3apn6eJJiAB6dom/llqgneXeSYWNN44Xm0Qez5H3slpn4779BiQwMrI
+863iJj91E7KSgANfm3yP3JP8veuuwATk1lRjnk/Xx5AbIQjhlANK7SoNB938unKc
+Syd5sA4NX/SRy5rlJUXmc1ZtJex1sc880xj9xEOrclhd1pMD7zPE647SUDz8FcEU
+BsHckU3+dKvlLcUVbFJCVfH9LBQezVRE2ajRQRy6FygwTkgrXpD9peTCXLBOacye
+IOzPCJUsDB0Ats5osq/xdYb23Qz5RaiztBhNuurI6gWkAim17f8sGIdlWirjQOvH
+NwTIArMT8vexBJsLtiYW0ZbLYPX+byidLRpuk2RXT1pfUMkeVWA2g1CgKCHKJbQG
+ef4EMFRPhRZ5Knd6279dXalbE2FTbt1uWpxhvjOF8E5O4lM6+3ApWf5d7c0qM6on
+jP4+Bn/sOIkVsiB1fjd6YqcXdyORNLqlwOsaCtvfLJ5t0EfebpP5Rigk13f2xddf
+
+-> ssh-ed25519 CSMyhg M6Nc06Maem8c92oFktCHl/FeNdevn8fazYJjxLygxSc
+h6E9GHEO8l9cKVEO6RlpzVJovuo7aOmKYXVDYHVBs1s
+--- RlUihZA7p0luD4sv9EY73wq9qIFWMHNnoNmxxVMO8OI
+¸å¿Ür	

secrets/rustfs-access-key.age

@@ -0,0 +1,31 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBnRjhF
+SHhTS2YrOHF1OWM1Zm04elkzVWpST0hhN0RhOWZBZGpBYmNTVnk4Cm9SMm5NcWdV
+Rnh0TVpqTlFSaGtaMnBrSGorUEhDd1RibWs1VUt5RGtqaVEKLT4gc3NoLWVkMjU1
+MTkgNWt3Y3NBIFV5OWhMU204L25nR3ZLOWl1a1ppZkUvcTNJTDhlNmE3eXpJMjRL
+NWdsWDQKNGhVYUhwRWRndjFYVEVIT3N2WE1WVncyV1Q1Q1BoNkhraVU5Q2s4UmtB
+OAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgVkRwdGtHVTlTMUVMOFZrdUNHZHc5UWo3
+WWtRaXJPY0p2QWZOUEtjWDVCYwpYQmh3ejdLOWdmM3dZbWJuRU1EYlRYZ2tJL3VY
+OURUKzhRY2dtcVRQZnBnCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyAyOFI4YllyWlox
+V09BbERmRm4yd1Y5dlh0UGphK05DMGpsWXJQTmwrVlRVCjdqNE4yVHFKWFV3NXlr
+bm40M1BpNGNNNDdJOXMyak5EUWdMa0hrb3lJY3cKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBICsxb3poQit6VGRtWmZXUWUxMmRGWUN6RGVOeUxEZjdvZldTTE5XSFpDRVkK
+bFNWLzFpazJLM0Q2R0NKU2FaS25ldEQ1RUZQM2RpektaT1NhRnJtS0JFcwotPiBz
+c2gtcnNhIERRbEU3dwpFMVdKYnhiTWF4MCtJMFNHVGtOZGNBdlVDYWRRR252dVd6
+NW1vNFRtbENLbHB2cHo1aE43M3RiZGh1QkVQVzBECjlvRnhYbjlpWWFFTEFFc1cw
+NjFVSENsVWJHdWdGV3ZEY2tOcXkvUm9SSFE4VWw5eHVUSnV6SmxCRU9TNUdpRjMK
+aGNhdHcvay85N0ZQNksydEhkcXNkc0h6dkRMRXlzUCtNNGM1V2tXb28wQ05valBH
+TUdJa3V1bEdYRUZveFNwbwpIbWRnZmtQMDREd08rRkx3OERwRVZZNVlnSXlNNlFH
+SkFoQWVEN1NzL0lqeVkvZllPdUkvbWZkU2NxNjQyYTIvCnJ4QmZ1SlpGNkp3UXFD
+SUdFMFY5RWVadTd5QmM1U2tIZ3dLQ2ZZKzF0WTE3K09aN3FYWUVBYkErVlNpblNU
+QzgKNENEZStFeitaYmE5Q1MyQ0lWSFlZb2hJdlBVNkhUUjBFWkxsWmZqdHNYb3Fk
+VVJMMzg2V2xWdnNCNndGSWdpbAoyUHZ1WXR5UG04ZmZOdVluU2J6VUhKZ0xMZ0lS
+R3YrY3RIRHJCby8yVWxIMWpGNWlJK1h4eXdRUXExT3pleWc3CnRmQVl1Yk1IUUFJ
+blNoUGxVUUlVOG9FSE5CMDVidmZhSWJmWTFsY0lFcWpZU213cmcxNzFvb29XaklC
+MnhpSkwKCi0+IHNzaC1lZDI1NTE5IENTTXloZyBOMDNYdGlvL3Y5QUp2YlNlUDZu
+RXFyTkFWbFFsN1oweEErSS9Ccmh0WmwwClpzTWw1aXNqVXdaTVFrTTJ6Y0FWbVpR
+TXk4cTNUUElkeGF1VUZ0U3RWcEEKLT4gTyUkcSZASGstZ3JlYXNlCnYwSGdsbE5h
+d2JLOAotLS0gcjB3WU1rNDhBY1VxalpBNVJRSTJFZ0NhWEZlSW15UHphMnRHTjBj
+aGptRQpiZ/2f41GnSHdg+EXeRwxHOHc/RNfEwlKhEB/Weq8tQ2Xf/jJ21WiWsTIm
+g7Sq9EO6JyYMTJ/qlccpytfkU/qkouyR+z3prQcP7NWTcg==
+-----END AGE ENCRYPTED FILE-----

secrets/rustfs-secret-key.age

@@ -0,0 +1,32 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBQd3FZ
+dUFYOFhoUGdBejZKYjRnVmNvYU85LzdJS1lVZFNRS3pTeS9hT0c4Cndwc3pHdStQ
+N1QvU0NSbGJhNEJCOE83eThhSFBrbDJPU0tDbmhIM3lwcjQKLT4gc3NoLWVkMjU1
+MTkgNWt3Y3NBIHdaS3UvRUdFb3pITmZGdTNEaUtXdnlUMWFuNk5ZcFV0VVIwNllN
+S2c5Rm8KV0x3Z2NjcUdLWmFEUExDT2EwbjFhQ2Y2TXNoaUc1d052RnJmM3VOSDVr
+VQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgOG1URGlNekltV0YyQ2Y2NFdPL2tSWDlG
+UnNLc2wrSllNWFd6aU9LWGN3YwpXUEthT3NNVHZJMUJndiswUVNFNWZjZnBDS3ZH
+dXBJV1FSNEpPRGxQd0JrCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyAvSTlFMitYZFVQ
+ZER6ZDI5OEorTE5TRTdlcllPSmpkUjU5SkV2N0xQY1JBCmJPNFN5NEovdHBVVDRl
+T0czS0g2dEgyTXhIMmtJVFRONDQ3enpLbFhJT3MKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBIDBUV2RYajBTMkZ4WnV4ZUVCeHFZay9vRGR2dkcxaXBPOWxsZ05IZm1KVDAK
+am56blp1ajlzc0NSYjY5NFdGNlNzQ0NNQzZPeVRtWTc1Z0lEYzc2TGNFMAotPiBz
+c2gtcnNhIERRbEU3dwpOMGowMWFoRzhsTGp0U0RqeHUyckZvQU9EVkQxUXE1b0U0
+N2hPU2NZY2huNm5kREg5SExCZGYzaTUwdWs4MjlsCjhONjVOWnZDZjFRU2k2K2Uz
+dnVmWVd5MCt6bFk4UVU3UEdsWXZMOHlZMktzWWR4SFJ6Vzh4dDFpYWNYRVQ2UmsK
+aW5iODV0WDYyQWN4K1ROZUVjdE40MGlxZDlXdnZVRVZBc04zdVRaOE9RTUJPUWxa
+YnJjZEg3OGcxNHVEVkR0MgpGUWh6NHV4WTcxUEZwUU52QkdsOE5hZy9XWFpjQUFP
+bDZzUjd3ZXFTTmpDN3ViZ0dpL3BOTFpBL3k2aUs3Qm9HCkVDeXZ2M0dQcWJwaXdm
+N2E1R2pjcWY2V1dYaEFNMVc3MG9ndDRLd0tVdkxHSUxwL2REazE2Unc1Z3JjUHJh
+NDgKamVqZjdkU0hCTVhqcjRsL1NtYkxxd3BId0lsRTRRUTNrZ05mcE1ZRkFSUlBW
+VVdkd2VSNzJMQVJEM2QyVkMzSQoxRGVOOUtzdGVOMTBLVk8zN2xjT3lvYm0vSXpQ
+VElTaS84SUxIekVybGYxV0ttZldVWHhyVVEvdzRFK3RibVFGCjV3bzltRjFTb0pu
+bGJQaTJ1Mlgxd0hNN2VvS0p3eDd4WHNkaTkwV3MwWTdLWUxnNzJjLzBBZzZsck5h
+Zk1UUDcKCi0+IHNzaC1lZDI1NTE5IENTTXloZyByQ1cwWm50UTY1bkp2NWZFeFVU
+T0htZDFWUUFsdlBSOVVNY3RTZnNwdjE0CjBySlExb1dnTGJKZy9MT25Oa2hZdDJZ
+Um9PZWlpOVA5bTBRM2wvVHJJaG8KLT4gWS1ncmVhc2UgWydtCnF4dzJjR2luMHBS
+S2p3bUE2bVl2R2FaQ2hRK3greGMKLS0tIDhSdFFGaGlGRVV2VFZKcTNWYnNtbUQr
+blprSjUyMjJwQkhBbVBCTmVhQ0kKUITtRYOYPDGGQlKrEp/JVUP8jTcptZxVaVcd
+AmxviaG76EuXQeK/VgrGKoi+bZwHbpCbXBT2H8DBuSPgXdG3aQDQn2QgZylMnhmM
+wzU=
+-----END AGE ENCRYPTED FILE-----

secrets/tuwunel-registration-token.age

@@ -0,0 +1,25 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw u9nwBPCI+zx7fYqOzv/63Y4mBK/n5GWhWGaPuWeFhEg
+3yCRXT+yzXNj+1VKxVu5N2+Ny0Q+AMS6t/zpZxSgONk
+-> ssh-ed25519 5kwcsA v7wY7U6E/We+1jWZEfLDkktdYf+ghngJWv96R4TPtxw
+kGoyKE32eqonVlE1Ur47t3kpwUtcQcdmSxBh8YFM2Ms
+-> ssh-ed25519 9d4YIQ 0PH2mtTx4EmwrRh9+QxEmYgVpGzQ2vlsh1SzaBwHGGE
+Um0pazZRjpfJFG11kib7fLV494OOyVXxrMAzoZ9JDD0
+-> ssh-ed25519 3Bcr1w /ikZTn/m+w7LlUx5iLbmLvH4gVAzLwR1qj97aJ5/CCc
+bVQT83BVrousaRnAaOgw0w9cCOulCslT6WpLpAGWz1c
+-> ssh-ed25519 c4NQlA slStbXPWuslSQftcqBE7qdQ+wF+rADcbyqUe7sC8ZxM
+rJw7+fA8kncbBdbYWAhS+TlGVJK4l7dOaxLuUigRHuM
+-> ssh-rsa DQlE7w
+nk4lSYyM1mom5GJva11LGS8FnZX7OVk0tpC+H2mYqKgfmJm3yyFrZNUOKZHT/EtN
+WpH5oHKWMhveBCPBB20JNNMg4hfJv4E3MfivXp2dABH/Y1vitG9pZKlp8KKsC6nC
+K/OR6y50L57KcC3M0WJ1fVTfaITdzugBGr3UYEUERG+6lw9EJmnlef+6OLafPyJM
+HslKUP54oSuMeI1Gdqne94nGjj8K/MFzOOxgIYVAGUayIK1RMiajKTfDo6E+irFn
+FJnZn4sVpsvD5FXZbmXWOORKz3APA9NbwvmjEgT9TZz+aZKHgS2qyyE8VrPr8vHO
+wBdlmKuV9U2DLSdFAIjwVXg1olarh4ZuC1+i/x6l7je6MYCwAMJwaUBnTNlBcXCg
+4REScinoz9Cx+Rjuk9OjYFrrpjCXJEfKwaHXNHW04VxnMb7mQ2I3/EQ5/NnJ2PaC
+vf8JdGaenSnRmTCj7977SmuN9dFIDnwvNkLxE3wAa8ziWbJeC4jeaIhE4uUp36gF
+
+-> ssh-ed25519 CSMyhg KpY+UDROmpjQSXrerSVADQlj/9rWWc4iD90vRM5aX3k
+TBhiMdnx4WpH6t6TgVXfTQayyIrOCFabii96hFK0FY8
+--- gAkvzBVNmd7e5uSyyg4vS5cnObeZ2t2xgOiWrP55KK8
+?Žë0žÎ¦›òxp¸a¡{ă9¦'Å¿e<ÕK„—“´¥¼¸SôÕøÅJ²?ö°~§0?�:öðct$òØåJ�RËåì