feat: migrate host Hyprland configs to Lua (Hyprland 0.55+)

- m3-kratos/home.nix: use hl.monitor({}), hl.workspace_rule({}),
  hl.window_rule({}) table-based Lua API
- m3-ares/home.nix: same Lua API + tuxedo-backlight via hl.on()
- Update flake.lock: home-manager -> 74f170c6 (2026-05-18)

.beads/hooks/post-checkout

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.2 ---
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/post-merge

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.2 ---
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/pre-commit

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.2 ---
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/pre-push

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.2 ---
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/hooks/prepare-commit-msg

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# --- BEGIN BEADS INTEGRATION v1.0.3 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.2 ---
+# --- END BEADS INTEGRATION v1.0.3 ---

.beads/issues.jsonl

@@ -1,3 +1,3 @@
-{"id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
-{"id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}

.gitignore

@@ -26,6 +26,7 @@ Thumbs.db
 opencode.json
 
 # AI agent state
+.claude/
 .sidecar/
 .sidecar-*
 .sisyphus/
@@ -39,6 +40,7 @@ opencode.json
 .pi*
 .worktrees/
 docs/plans/
+CLAUDE.md
 
 # Beads / Dolt files (added by bd init)
 .dolt/

AGENTS.md

@@ -186,6 +186,8 @@ _(Note to Pi: Your file write/edit tools run in a different directory by default
 | ---------------- | --------------------------------- |
 | **Nixpkgs**      | nixos-unstable + 25.05 stable     |
 | **Home Manager** | github:nix-community/home-manager |
+| **m3ta-home**    | code.m3ta.dev/m3tam3re/m3ta-home  |
+| **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs    |
 | **Agenix**       | github:ryantm/agenix              |
 | **Disko**        | github:nix-community/disko        |
 | **NUR**          | github:nix-community/NUR          |
@@ -201,32 +203,33 @@ _(Note to Pi: Your file write/edit tools run in a different directory by default
 
 ```
 nixos-config/
-├── flake.nix                    # Entry point: hosts, overlays, dev shells
+├── flake.nix                    # Entry point: hosts, overlays, dev shells, m3ta-home input
 ├── coding-rules.json            # Opencode rules configuration
 │
 ├── hosts/                        # Per-host NixOS configurations
 │   ├── common/                   # Shared across all hosts
-│   │   ├── users/                # User definitions
+│   │   ├── users/
+│   │   │   └── m3tam3re.nix     # ← Central user + m3ta-home integration
+│   │   ├── default.nix          # Shared NixOS settings, overlays, home-manager setup
 │   │   ├── ports.nix            # Network ports config
 │   │   └── extraServices/       # Common service toggles
-│   ├── m3-ares/                  # Main desktop
+│   ├── m3-ares/                  # TUXEDO laptop (desktop)
-│   ├── m3-atlas/                 # Desktop with disko
+│   │   └── home.nix             # Hyprland: eDP-1 + HDMI, XDG/MIME
-│   ├── m3-helios/                # Desktop with disko
+│   ├── m3-kratos/                # AMD desktop (desktop)
-│   ├── m3-hermes/                # Desktop with disko + hermes-agent
+│   │   └── home.nix             # Hyprland: dual DP, XDG/MIME
-│   └── m3-kratos/                # Server with NUR
+│   ├── m3-daedalus/              # Portable laptop (desktop, no Hyprland)
+│   │   └── home.nix             # XDG/MIME only
+│   ├── m3-atlas/                 # Primary server (server + coding)
+│   ├── m3-helios/                # AdGuard DNS server (minimal server)
+│   ├── m3-hermes/                # Secondary server (minimal server)
+│   └── m3-aether/                # Cloud VM (minimal server)
 │
-├── modules/                      # Reusable NixOS/home-manager modules
+├── modules/                      # Reusable NixOS modules
-│   ├── nixos/                    # NixOS-specific modules
+│   └── nixos/                    # NixOS-specific modules
-│   │   └── default.nix           # Imports common + service configs
-│   └── home-manager/            # Home-manager configurations
 │
-├── home/                         # Per-user, per-host home configs
+├── overlays/                    # Package overlays (stable/locked/master/pinned)
-│   └── m3tam3re/
+│   ├── default.nix
-│       └── m3-daedalus.nix
+│   └── mods/
-│
-├── overlays/                    # Package overlays
-│   ├── default.nix              # Stable/locked/master branches
-│   └── mods/                    # Package modifications
 │
 ├── pkgs/                        # Custom packages
 │
@@ -234,13 +237,64 @@ nixos-config/
 │   └── secrets.nix
 │
 ├── .opencode-rules/             # Opencode AI rules
-│   ├── concerns/                 # Coding style rules
+│   ├── concerns/
-│   ├── languages/nix.md         # Nix conventions
+│   ├── languages/nix.md
 │   └── USAGE.md
 │
 └── .pi/                         # Agent configuration
 ```
 
+### Home-Manager Integration
+
+Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
+- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
+- **Docs**: See m3ta-home README for full documentation
+
+What lives where:
+
+| Concern | Location | Why |
+|---------|----------|-----|
+| Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
+| User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
+| Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
+| Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
+| XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
+| NixOS overlays | `nixos-config/overlays/` | System-level package management |
+
+#### Host → Profile Mapping
+
+Defined in `hosts/common/users/m3tam3re.nix`:
+
+```nix
+hostProfiles = {
+  # Desktop hosts
+  m3-ares     = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-kratos   = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
+  # Server hosts
+  m3-atlas    = { context = "server";  sets = ["coding"]; };
+  m3-helios   = { context = "server";  sets = []; };
+  m3-hermes   = { context = "server";  sets = []; };
+  m3-aether   = { context = "server";  sets = []; };
+};
+```
+
+#### Work Identity Use Case
+
+The same `m3ta-home` repo supports a **work identity** for company machines:
+
+```nix
+# On a work NixOS machine:
+(m3ta-lib.mkHome {
+  user = "m3tam3re";
+  identity = "work";       # ← switches git to sascha.koenig, SSH to AZ hosts
+  context = "desktop";
+  sets = ["coding"];
+})
+```
+
+This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.
+
 ---
 
 ## Commands
@@ -311,6 +365,14 @@ config = lib.mkMerge [
 - Never commit plaintext secrets
 - Use `.nix` extension for secret files
 
+### Flake Input URLs
+
+All `code.m3ta.dev` inputs use **SSH** URLs:
+```nix
+url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
+```
+Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
+
 ---
 
 ## Key Files
@@ -318,12 +380,9 @@ config = lib.mkMerge [
 | File                               | Purpose                                                                                    |
 | ---------------------------------- | ------------------------------------------------------------------------------------------ |
 | `flake.nix`                        | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
-| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager integration, user defaults             |
+| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`)         |
-| `hosts/m3-ares/default.nix`        | Main desktop host configuration, imports common + service modules                          |
+| `hosts/common/users/m3tam3re.nix`  | User definition + m3ta-home mkHome integration + per-host feature flags                    |
-| `hosts/m3-ares/configuration.nix`  | Desktop environment config (Hyprland, display, audio, etc.)                                |
+| `hosts/<name>/home.nix`            | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME                      |
-| `hosts/m3-ares/programs.nix`       | CLI tools, dev tools, shell configs                                                        |
-| `hosts/m3-ares/services/`          | Service-specific configs (firewall, printing, etc.)                                        |
-| `modules/nixos/default.nix`        | Orchestrates common + configuration imports                                                |
 | `overlays/default.nix`             | Package version overrides (stable/locked/master branches)                                  |
 | `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns                                                      |
 
@@ -352,7 +411,10 @@ config = lib.mkMerge [
    - `configuration.nix` — host-specific system config
    - `hardware-configuration.nix` — from `nixos-generate-config`
    - `programs.nix`, `services/`, `secrets.nix` as needed
-3. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
+3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
+4. Add feature flags in the `hostFlags` section
+5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
+6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
 
 ### Adding a New Package
 
@@ -360,6 +422,12 @@ config = lib.mkMerge [
 2. For complex packages: create in `pkgs/` directory
 3. For upstream packages: use NUR or add as flake input
 
+### Adding a New Home-Manager Feature
+
+1. Create the module in `m3ta-home` under the appropriate profile directory
+2. Add the import to the parent `default.nix` in m3ta-home
+3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
+
 ### Development Workflow
 
 1. Edit config files
@@ -375,9 +443,3 @@ config = lib.mkMerge [
 nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
 ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
 ```
-
-### Home Manager
-
-- Home configs live in `home/m3tam3re/`
-- Use `home-manager.users.m3tam3re` in host config
-- Access via `config.home-manager.users.m3tam3re`

flake.lock

@@ -21,10 +21,47 @@
         "type": "github"
       }
     },
+    "agenix_2": {
+      "inputs": {
+        "darwin": "darwin_2",
+        "home-manager": "home-manager_4",
+        "nixpkgs": "nixpkgs_6",
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "agents": {
       "inputs": {
         "nixpkgs": "nixpkgs_2"
       },
+      "locked": {
+        "lastModified": 1778518220,
+        "narHash": "sha256-6AQs9VZ0/DuD4njPbYHRE4v+SgJc6SBrGwemTWxikVc=",
+        "ref": "refs/heads/master",
+        "rev": "b6e1aaa6261c5056d024d8d4785659eaa4e675e6",
+        "revCount": 87,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS"
+      }
+    },
+    "agents_2": {
+      "flake": false,
       "locked": {
         "lastModified": 1777399938,
         "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
@@ -39,7 +76,7 @@
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       }
     },
-    "agents_2": {
+    "agents_3": {
       "flake": false,
       "locked": {
         "lastModified": 1777399938,
@@ -71,7 +108,46 @@
         "type": "github"
       }
     },
+    "base16-schemes_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696158499,
+        "narHash": "sha256-5yIHgDTPjoX/3oDEfLSQ0eJZdFL1SaCfb9d6M0RmOTM=",
+        "owner": "tinted-theming",
+        "repo": "base16-schemes",
+        "rev": "a9112eaae86d9dd8ee6bb9445b664fba2f94037a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-schemes",
+        "type": "github"
+      }
+    },
     "basecamp": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774505501,
+        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "owner": "basecamp",
+        "repo": "basecamp-cli",
+        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "basecamp",
+        "ref": "v0.7.2",
+        "repo": "basecamp-cli",
+        "type": "github"
+      }
+    },
+    "basecamp_2": {
       "inputs": {
         "nixpkgs": [
           "m3ta-nixpkgs",
@@ -174,6 +250,29 @@
         "type": "github"
       }
     },
+    "darwin_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -181,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776613567,
+        "lastModified": 1777713215,
-        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
+        "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
+        "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
         "type": "github"
       },
       "original": {
@@ -223,11 +322,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1777988971,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
         "type": "github"
       },
       "original": {
@@ -237,6 +336,28 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "m3ta-home",
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -285,16 +406,16 @@
         "uv2nix": "uv2nix_2"
       },
       "locked": {
-        "lastModified": 1777573861,
+        "lastModified": 1778170968,
-        "narHash": "sha256-whY/1WL2fQUhPqDp7CGm3MSwOOo7FB1eADhNVnHeCRU=",
+        "narHash": "sha256-YQQUEDUim2CiYpL3uG7Wi1fWPsT2wtIqoBeJuAj9hUk=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "73bf3ab1b22314ed9dfecbb59242c03742fe72af",
+        "rev": "498bfc7bc12a937621b4215312049b1000726df3",
         "type": "github"
       },
       "original": {
         "owner": "NousResearch",
-        "ref": "v2026.4.30",
+        "ref": "v2026.5.7",
         "repo": "hermes-agent",
         "type": "github"
       }
@@ -327,11 +448,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777476904,
+        "lastModified": 1779113444,
-        "narHash": "sha256-EeLoE8n4+QCbteyAsYXxhfr97RFfWL1ga0xwfL6lpKw=",
+        "narHash": "sha256-/L61sT1PIKmGWIQpIh0uJGH/ANvcsf6y4alxtb9kelg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8c8e5389e75a36bee53920de8ee24f017b3ae03e",
+        "rev": "74f170c62d57f90e656841f1f699e6bdf40f0a24",
         "type": "github"
       },
       "original": {
@@ -361,13 +482,56 @@
         "type": "github"
       }
     },
+    "home-manager_4": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_5": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778503501,
+        "narHash": "sha256-08L/X4/do7nET4rzidJ76eV/1r+mB7DchVpdPypsghc=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "85ba629c79449badf4338117c27f0ee92b4b9f1a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "hyprlang": {
       "inputs": {
         "nixpkgs": [
           "rose-pine-hyprcursor",
           "nixpkgs"
         ],
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1709914708,
@@ -413,11 +577,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1777439951,
+        "lastModified": 1778304612,
-        "narHash": "sha256-1Bs4ZbBayXWicrOrQQn3/BnnqhEy+tQjdFn40wHu1dw=",
+        "narHash": "sha256-7FkBnR56KZ8RwY5kPd3ans8f68IYjF1J66gOUlLsiLA=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "2641c18f5bb9d0b95e81beca1b0415e174d7e650",
+        "rev": "c741913095c4815f6651aa0a2c24b3ce15e414e4",
         "type": "github"
       },
       "original": {
@@ -426,26 +590,76 @@
         "type": "github"
       }
     },
+    "m3ta-home": {
+      "inputs": {
+        "agenix": "agenix_2",
+        "home-manager": "home-manager_5",
+        "m3ta-nixpkgs": "m3ta-nixpkgs",
+        "nix-colors": "nix-colors",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur"
+      },
+      "locked": {
+        "lastModified": 1778520138,
+        "narHash": "sha256-X58c8BUIshyUnp6XEKumFUYXqMFnrDTj+aGuGIbKwxg=",
+        "ref": "refs/heads/master",
+        "rev": "a87d9510bd84f51bf93970730b8688ab7221bbdd",
+        "revCount": 30,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
+      }
+    },
     "m3ta-nixpkgs": {
       "inputs": {
         "agents": "agents_2",
         "basecamp": "basecamp",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": [
+          "m3ta-home",
+          "nixpkgs"
+        ],
         "nixpkgs-master": "nixpkgs-master",
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1777486032,
+        "lastModified": 1778508052,
-        "narHash": "sha256-UStORUF67vzXQ1jtORzR2cTv8GCvrxweF7HFHJgPpqw=",
+        "narHash": "sha256-kxzZvJv757TGfHReR21aX6N/jkGMWzGSy9GQEclYD4Y=",
         "ref": "refs/heads/master",
-        "rev": "1da8c96447eb74a316861f6242421ef0309c29a8",
+        "rev": "8113723a48c4afa016881ccd5bc4be3fad2c7d5f",
-        "revCount": 267,
+        "revCount": 294,
         "type": "git",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
       "original": {
         "type": "git",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
+      }
+    },
+    "m3ta-nixpkgs_2": {
+      "inputs": {
+        "agents": "agents_3",
+        "basecamp": "basecamp_2",
+        "nixpkgs": "nixpkgs_8",
+        "nixpkgs-master": "nixpkgs-master_2",
+        "openspec": "openspec_2"
+      },
+      "locked": {
+        "lastModified": 1778518789,
+        "narHash": "sha256-9WZvO2BBofC2Wp4dvP4/aQ6Jhmcxh9lEGTYj09hLXrI=",
+        "ref": "refs/heads/master",
+        "rev": "d64c581516c02702ec28e5d2304330d7b035235d",
+        "revCount": 295,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       }
     },
     "nix-colors": {
@@ -467,6 +681,25 @@
         "type": "github"
       }
     },
+    "nix-colors_2": {
+      "inputs": {
+        "base16-schemes": "base16-schemes_2",
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
+      "locked": {
+        "lastModified": 1707825078,
+        "narHash": "sha256-hTfge2J2W+42SZ7VHXkf4kjU+qzFqPeC9k66jAUBMHk=",
+        "owner": "misterio77",
+        "repo": "nix-colors",
+        "rev": "b01f024090d2c4fc3152cd0cf12027a7b8453ba1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "misterio77",
+        "repo": "nix-colors",
+        "type": "github"
+      }
+    },
     "nixlib": {
       "locked": {
         "lastModified": 1736643958,
@@ -485,7 +718,7 @@
     "nixos-generators": {
       "inputs": {
         "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_9"
       },
       "locked": {
         "lastModified": 1769813415,
@@ -564,6 +797,21 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1697935651,
+        "narHash": "sha256-qOfWjQ2JQSQL15KLh6D7xQhx0qgZlYZTYlcEiRuAMMw=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e1e11fdbb01113d85c7f41cada9d2847660e3902",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-locked": {
       "locked": {
         "lastModified": 1739661218,
@@ -582,11 +830,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1777470666,
+        "lastModified": 1778507606,
-        "narHash": "sha256-uAi+pTjKLturTz3XqTwnsU0fJnqf8xx8orfPpRbdaKQ=",
+        "narHash": "sha256-6Yc2dIhijc8G+dbMNocyclxF19dUrjaT+EeXGrXmXlg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "053b9fa5f0fbdac0bd9d248cea58a11223eb495d",
+        "rev": "39a7b8d815fcc8b689d56fc4a3fa8de4ef93d169",
         "type": "github"
       },
       "original": {
@@ -598,11 +846,27 @@
     },
     "nixpkgs-master_2": {
       "locked": {
-        "lastModified": 1777483759,
+        "lastModified": 1778507606,
-        "narHash": "sha256-luE+pNcTx3gz109lEC/xUxPHrx1aEZsp5X4OEBcnGaw=",
+        "narHash": "sha256-6Yc2dIhijc8G+dbMNocyclxF19dUrjaT+EeXGrXmXlg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "39a7b8d815fcc8b689d56fc4a3fa8de4ef93d169",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-master_3": {
+      "locked": {
+        "lastModified": 1778307931,
+        "narHash": "sha256-GkUOqeH6tb2/K1tv3t0F/xROIAh5/zEGutzEUIrQ+u8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b540331d6f1e343b6812b5aa1d97c707a0de0da2",
+        "rev": "8f689324e32c31a3d2c24490a19e266c3fb6508b",
         "type": "github"
       },
       "original": {
@@ -614,11 +878,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1777077449,
+        "lastModified": 1778003029,
-        "narHash": "sha256-AIiMJiqvGrN4HyLEbKAoCSRRYn0rnlW5VbKNIMIYqm4=",
+        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a4bf06618f0b5ee50f14ed8f0da77d34ecc19160",
+        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
         "type": "github"
       },
       "original": {
@@ -628,6 +892,38 @@
         "type": "github"
       }
     },
+    "nixpkgs_10": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_11": {
+      "locked": {
+        "lastModified": 1710272261,
+        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1772479524,
@@ -678,11 +974,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1776949667,
+        "lastModified": 1778124196,
-        "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=",
+        "narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30",
+        "rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
         "type": "github"
       },
       "original": {
@@ -694,11 +990,43 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1777268161,
+        "lastModified": 1754028485,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
         "type": "github"
       },
       "original": {
@@ -708,7 +1036,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_9": {
       "locked": {
         "lastModified": 1736657626,
         "narHash": "sha256-FWlPMUzp0lkQBdhKlPqtQdqmp+/C+1MBiEytaYfrCTY=",
@@ -724,38 +1052,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
-      "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_9": {
-      "locked": {
-        "lastModified": 1710272261,
-        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "npm-lockfile-fix": {
       "inputs": {
         "nixpkgs": [
@@ -780,16 +1076,35 @@
     "nur": {
       "inputs": {
         "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1778506944,
+        "narHash": "sha256-lU0Bleh0reE+WU7j8Uiqsu6ekPav50L8sXsgOvEQS+0=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "0166493cfe4e0e9927435c1cfbf5505cfb0d10d1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
+    "nur_2": {
+      "inputs": {
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1777486007,
+        "lastModified": 1778308643,
-        "narHash": "sha256-5R0q8ESHux3Le76n4IuNUThkAo4o2M+Kj1Loj2J7ahI=",
+        "narHash": "sha256-MpJyLyJWAwOy7rVs7pWqRwH2b8/rj+B524VzdonvXBs=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "6f5d55cfd726ff4cd68d006bddbdf459d0dc471b",
+        "rev": "98d908741ed91101cd0649961f12d2427bdba7d3",
         "type": "github"
       },
       "original": {
@@ -801,16 +1116,38 @@
     "openspec": {
       "inputs": {
         "nixpkgs": [
+          "m3ta-home",
           "m3ta-nixpkgs",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1776788052,
+        "lastModified": 1778120451,
-        "narHash": "sha256-L4LBHVVtgMhSJm+IzZSYOR0UXPbvIRg4xiEV5urYxdI=",
+        "narHash": "sha256-MUSPD16+hoFBfQWYahtNLN2BIFEAlFFo2KNofrc947g=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "3c7a05c5dc88b2397c478805890b55ed392b19e8",
+        "rev": "053d8a59d587f3c027a06ad80503a6b43d4f2a92",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Fission-AI",
+        "repo": "OpenSpec",
+        "type": "github"
+      }
+    },
+    "openspec_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778120451,
+        "narHash": "sha256-MUSPD16+hoFBfQWYahtNLN2BIFEAlFFo2KNofrc947g=",
+        "owner": "Fission-AI",
+        "repo": "OpenSpec",
+        "rev": "053d8a59d587f3c027a06ad80503a6b43d4f2a92",
         "type": "github"
       },
       "original": {
@@ -916,17 +1253,19 @@
         "home-manager": "home-manager_2",
         "hyprpanel": "hyprpanel",
         "llm-agents": "llm-agents",
-        "m3ta-nixpkgs": "m3ta-nixpkgs",
+        "m3ta-home": "m3ta-home",
-        "nix-colors": "nix-colors",
+        "m3ta-nixpkgs": "m3ta-nixpkgs_2",
+        "nix-colors": "nix-colors_2",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_10",
         "nixpkgs-45570c2": "nixpkgs-45570c2",
         "nixpkgs-9e58ed7": "nixpkgs-9e58ed7",
         "nixpkgs-locked": "nixpkgs-locked",
-        "nixpkgs-master": "nixpkgs-master_2",
+        "nixpkgs-master": "nixpkgs-master_3",
         "nixpkgs-stable": "nixpkgs-stable",
-        "nur": "nur",
+        "nur": "nur_2",
         "rose-pine-hyprcursor": "rose-pine-hyprcursor",
+        "rustfs": "rustfs",
         "skills-anthropic": "skills-anthropic",
         "skills-basecamp": "skills-basecamp",
         "skills-kestra": "skills-kestra",
@@ -937,7 +1276,7 @@
     "rose-pine-hyprcursor": {
       "inputs": {
         "hyprlang": "hyprlang",
-        "nixpkgs": "nixpkgs_9",
+        "nixpkgs": "nixpkgs_11",
         "utils": "utils"
       },
       "locked": {
@@ -954,14 +1293,34 @@
         "type": "github"
       }
     },
+    "rustfs": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777635550,
+        "narHash": "sha256-QHknn6JYNb4+8ztMl7Ngk3Px3r2FRUPwbbrswYuHSpA=",
+        "owner": "rustfs",
+        "repo": "rustfs-flake",
+        "rev": "efaad834053c41ac618804fb4e7612cea455848e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rustfs",
+        "repo": "rustfs-flake",
+        "type": "github"
+      }
+    },
     "skills-anthropic": {
       "flake": false,
       "locked": {
-        "lastModified": 1776964038,
+        "lastModified": 1778286877,
-        "narHash": "sha256-xFsg66TCtKzSgRIW6Ab771FWEIhei3jPgfE4byMiB44=",
+        "narHash": "sha256-jKNYFom6R+Qw7LQ8vFPBe51JpqIP0tTSY8LM4aPlnT4=",
         "owner": "anthropics",
         "repo": "skills",
-        "rev": "5128e1865d670f5d6c9cef000e6dfc4e951fb5b9",
+        "rev": "f458cee31a7577a47ba0c9a101976fa599385174",
         "type": "github"
       },
       "original": {
@@ -973,11 +1332,11 @@
     "skills-basecamp": {
       "flake": false,
       "locked": {
-        "lastModified": 1777481361,
+        "lastModified": 1777902228,
-        "narHash": "sha256-GJ94Y1n+zR6zpOWjAGFYFWFIFpT1royFJOy2TaQXpzU=",
+        "narHash": "sha256-XDsWpUhFb/gxatRFla07nwoc2y3WwaBLsiDdtCnqx38=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "59d59b66974d442190b0762129b4f1749adcedf0",
+        "rev": "b56ada1b3d42b42a9422ba39b30a223f9f960231",
         "type": "github"
       },
       "original": {
@@ -1005,11 +1364,11 @@
     "skills-superpowers": {
       "flake": false,
       "locked": {
-        "lastModified": 1776996157,
+        "lastModified": 1777932301,
-        "narHash": "sha256-0WupTacT1jIwVBloj1i0RF7wIllVtP8eMPRl7VrXdbE=",
+        "narHash": "sha256-3E3rO6hR87JUfS3XV1Eaoz6SDWOftleWvN9UPNFEMjw=",
         "owner": "obra",
         "repo": "superpowers",
-        "rev": "6efe32c9e2dd002d0c394e861e0529675d1ab32e",
+        "rev": "f2cbfbefebbfef77321e4c9abc9e949826bea9d7",
         "type": "github"
       },
       "original": {
@@ -1021,11 +1380,11 @@
     "skills-vercel": {
       "flake": false,
       "locked": {
-        "lastModified": 1777394685,
+        "lastModified": 1778275952,
-        "narHash": "sha256-YxCMuTl+pVJ7dXhaL7l9vDw9k2orlG31j7/0pgllMJk=",
+        "narHash": "sha256-RYwgUf173N4lGalTta4HkBR7sdZwuzRoAY6M8JsT+RY=",
         "owner": "vercel-labs",
         "repo": "skills",
-        "rev": "7c0a9af3f8738965b71341712710ac7371089b34",
+        "rev": "c99a72b371b5b4da865f5afa87c5a686f3a46766",
         "type": "github"
       },
       "original": {
@@ -1080,6 +1439,21 @@
       }
     },
     "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -1094,7 +1468,7 @@
         "type": "github"
       }
     },
-    "systems_5": {
+    "systems_6": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1132,7 +1506,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1710146030,

flake.nix

@@ -22,7 +22,7 @@
     nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
+    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
     llm-agents.url = "github:numtide/llm-agents.nix";
 
     #
@@ -43,9 +43,14 @@
     rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
     nix-colors.url = "github:misterio77/nix-colors";
 
+    m3ta-home = {
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     agents = {
       # url = "path:/home/m3tam3re/p/AI/AGENTS";
-      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS";
     };
     ## Skills
     skills-basecamp = {
@@ -68,7 +73,12 @@
       url = "github:vercel-labs/skills";
       flake = false;
     };
-    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.4.30";
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.7";
+
+    rustfs = {
+      url = "github:rustfs/rustfs-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {
@@ -94,7 +104,7 @@
   in {
     packages =
       forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = builtins.removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
     lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
     homeManagerModules = import ./modules/home-manager;
 
@@ -122,6 +132,7 @@
           inputs.disko.nixosModules.disko
           agenix.nixosModules.default
           m3ta-nixpkgs.nixosModules.default
+          inputs.rustfs.nixosModules.rustfs
         ];
       };
       m3-kratos = nixpkgs.lib.nixosSystem {

home/base/cli-tools/bat.nix

@@ -1,145 +0,0 @@
-# Bat — cat replacement with nix-colors syntax highlighting theme.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.bat;
-  palette = config.colorScheme.palette;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.bat.enable = (mkEnableOption "enable bat with nix-colors theme") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.bat = {
-      enable = true;
-      config = {theme = "universal";};
-      themes = {
-        universal = {
-          src = pkgs.writeText "universal.tmTheme" ''
-            <?xml version="1.0" encoding="UTF-8"?>
-            <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-            <plist version="1.0">
-            <dict>
-              <key>name</key>
-              <string>Universal (nix-colors)</string>
-              <key>settings</key>
-              <array>
-                <dict>
-                  <key>settings</key>
-                  <dict>
-                    <key>background</key>
-                    <string>#${palette.base00}</string>
-                    <key>foreground</key>
-                    <string>#${palette.base05}</string>
-                    <key>caret</key>
-                    <string>#${palette.base05}</string>
-                    <key>selection</key>
-                    <string>#${palette.base02}</string>
-                    <key>selectionForeground</key>
-                    <string>#${palette.base05}</string>
-                    <key>lineHighlight</key>
-                    <string>#${palette.base01}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Comment</string>
-                  <key>scope</key>
-                  <string>comment</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base03}</string>
-                    <key>fontStyle</key>
-                    <string>italic</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>String</string>
-                  <key>scope</key>
-                  <string>string</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base0A}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Number</string>
-                  <key>scope</key>
-                  <string>constant.numeric</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base0E}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Keyword</string>
-                  <key>scope</key>
-                  <string>keyword</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base08}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Function</string>
-                  <key>scope</key>
-                  <string>entity.name.function</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base0B}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Type</string>
-                  <key>scope</key>
-                  <string>entity.name.type, storage.type</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base0D}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Variable</string>
-                  <key>scope</key>
-                  <string>variable</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base05}</string>
-                  </dict>
-                </dict>
-                <dict>
-                  <key>name</key>
-                  <string>Constant</string>
-                  <key>scope</key>
-                  <string>constant</string>
-                  <key>settings</key>
-                  <dict>
-                    <key>foreground</key>
-                    <string>#${palette.base0E}</string>
-                  </dict>
-                </dict>
-              </array>
-            </dict>
-            </plist>
-          '';
-        };
-      };
-    };
-  };
-}

home/base/cli-tools/carapace.nix

@@ -1,21 +0,0 @@
-# Carapace — multi-shell completion engine with Fish, Nushell, and Bash integration.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.carapace;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.carapace.enable = (mkEnableOption "enable carapace completion engine") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.carapace = {
-      enable = true;
-      enableFishIntegration = true;
-      enableNushellIntegration = true;
-      enableBashIntegration = true;
-    };
-  };
-}

home/base/cli-tools/default.nix

@@ -1,17 +0,0 @@
-# CLI tools aggregator — imports all base command-line utilities.
-{...}: {
-  imports = [
-    ./bat.nix
-    ./carapace.nix
-    ./direnv.nix
-    ./eza.nix
-    ./fzf.nix
-    ./lf.nix
-    ./nitch.nix
-    ./packages.nix
-    ./television.nix
-    ./zellij.nix
-    ./zellij-ps.nix
-    ./zoxide.nix
-  ];
-}

home/base/cli-tools/direnv.nix

@@ -1,20 +0,0 @@
-# Direnv — automatic environment loading with nix-direnv integration.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.direnv;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.direnv.enable = (mkEnableOption "enable direnv with nix-direnv") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.direnv = {
-      enable = true;
-      enableNushellIntegration = true;
-      nix-direnv.enable = true;
-    };
-  };
-}

home/base/cli-tools/eza.nix

@@ -1,21 +0,0 @@
-# Eza — modern ls replacement with icons, git status, and long format by default.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.eza;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.eza.enable = (mkEnableOption "enable eza modern ls replacement") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.eza = {
-      enable = true;
-      enableFishIntegration = true;
-      enableBashIntegration = true;
-      extraOptions = ["-l" "--icons" "--git" "-a"];
-    };
-  };
-}

home/base/cli-tools/fzf.nix

@@ -1,41 +0,0 @@
-# Fuzzy finder with nix-colors palette and Wayland clipboard integration.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.fzf;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.fzf.enable = (mkEnableOption "enable fuzzy finder") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.fzf = {
-      enable = true;
-      enableFishIntegration = true;
-      colors = {
-        "fg" = "#${config.colorScheme.palette.base05}";
-        "bg" = "#${config.colorScheme.palette.base00}";
-        "hl" = "#${config.colorScheme.palette.base0E}";
-        "fg+" = "#${config.colorScheme.palette.base05}";
-        "bg+" = "#${config.colorScheme.palette.base02}";
-        "hl+" = "#${config.colorScheme.palette.base0E}";
-        "info" = "#${config.colorScheme.palette.base09}";
-        "prompt" = "#${config.colorScheme.palette.base0B}";
-        "pointer" = "#${config.colorScheme.palette.base08}";
-        "marker" = "#${config.colorScheme.palette.base08}";
-        "spinner" = "#${config.colorScheme.palette.base09}";
-        "header" = "#${config.colorScheme.palette.base03}";
-      };
-      defaultOptions = [
-        "--preview='bat --color=always -n {}'"
-        "--bind 'ctrl-/:toggle-preview'"
-        "--header 'Press CTRL-Y to copy command into clipboard'"
-        "--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
-      ];
-      defaultCommand = "fd --type f --exclude .git --follow --hidden";
-      changeDirWidgetCommand = "fd --type d --exclude .git --follow --hidden";
-    };
-  };
-}

home/base/cli-tools/lf.nix

@@ -1,28 +0,0 @@
-# Lf — terminal file manager with bat preview and Dracula theme.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.lf;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.lf.enable = (mkEnableOption "enable lf terminal file manager") // {default = true;};
-
-  config = mkIf cfg.enable {
-    home.packages = [pkgs.lf];
-
-    programs.lf = {
-      enable = true;
-      settings = {
-        preview = true;
-        drawbox = true;
-        hidden = true;
-        icons = true;
-        previewer = "bat";
-      };
-    };
-  };
-}

home/base/cli-tools/nitch.nix

@@ -1,17 +0,0 @@
-# Nitch — minimal system information display tool.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.nitch;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.nitch.enable = (mkEnableOption "enable nitch") // {default = true;};
-
-  config = mkIf cfg.enable {
-    home.packages = [pkgs.nitch];
-  };
-}

home/base/cli-tools/packages.nix

@@ -1,62 +0,0 @@
-# Essential CLI packages — core utilities always available on every host.
-# NOTE: `lazylib` does not exist in nixpkgs. `lazygit` is the correct package
-# (Git TUI) and is intentionally used here instead.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.essentials;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.essentials.enable = (mkEnableOption "enable essential CLI packages") // {default = true;};
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      # Core utilities
-      coreutils
-      fd
-      htop
-      jq
-      ripgrep
-
-      # Nix
-      alejandra
-      comma
-      nixd
-      nix-diff
-      nix-index
-      nix-update
-
-      # Dev tools
-      bc
-      cmake
-      devenv
-      gcc
-      gnumake
-      go
-      httpie
-      just
-      lazygit
-      progress
-      sqlite
-      sqlite-vec
-      tldr
-
-      # AI tools
-      fabric-ai
-      llm
-
-      # Misc
-      basecamp
-      hyprpaper-random
-      libnotify
-      trash-cli
-      unzip
-      yazi
-      zip
-    ];
-  };
-}

home/base/cli-tools/television.nix

@@ -1,60 +0,0 @@
-# Television — fuzzy finder with custom channels for tldr, git-diff, and git-log.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.television;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.television.enable = (mkEnableOption "enable television") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.television = {
-      enable = true;
-      channels = {
-        tldr = {
-          metadata = {
-            description = "Browse TLDR pages";
-            name = "tldr";
-            requirements = ["tldr"];
-          };
-          preview = {
-            command = "tldr '{}'";
-          };
-          source = {
-            command = "tldr --list";
-          };
-        };
-        git-diff = {
-          metadata = {
-            description = "A channel to select files from git diff commands";
-            name = "git-diff";
-            requirements = ["git"];
-          };
-          preview = {
-            command = "git diff HEAD --color=always -- '{}'";
-          };
-          source = {
-            command = "git diff --name-only HEAD";
-          };
-        };
-        git-log = {
-          metadata = {
-            description = "A channel to select from git log entries";
-            name = "git-log";
-            requirements = ["git"];
-          };
-          preview = {
-            command = "git show -p --stat --pretty=fuller --color=always '{0}'";
-          };
-          source = {
-            command = "git log --oneline --date=short --pretty=\"format:%h %s %an %cd\" \"$@\"";
-            output = "{split: :0}";
-          };
-        };
-      };
-    };
-  };
-}

home/base/cli-tools/zellij-ps.nix

@@ -1,30 +0,0 @@
-# Zellij-ps — project-aware Zellij session manager from m3ta-nixpkgs.
-# Delegates to `cli.zellij-ps` — the home-manager module namespace provided by
-# m3ta-nixpkgs (inputs.m3ta-nixpkgs.nixosModules.default). This is intentional;
-# `cli.*` is the convention used by m3ta-nixpkgs home-manager modules.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.zellijPs;
-in {
-  options.base.cliTools.zellijPs = {
-    # Enabled by default — base modules are always-on.
-    enable = (mkEnableOption "enable zellij-ps project session manager") // {default = true;};
-
-    projectFolders = mkOption {
-      type = types.listOf types.path;
-      description = "Project root folders scanned by zellij-ps.";
-      default = ["${config.home.homeDirectory}/p"];
-    };
-  };
-
-  config = mkIf cfg.enable {
-    cli.zellij-ps = {
-      enable = true;
-      projectFolders = cfg.projectFolders;
-    };
-  };
-}

home/base/cli-tools/zellij.nix

@@ -1,34 +0,0 @@
-# Zellij terminal multiplexer with nix-colors theming.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.zellij;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.zellij.enable = (mkEnableOption "enable zellij multiplexer") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.zellij = {
-      enable = true;
-      settings = {
-        theme = "universal";
-        themes.universal = {
-          bg = "#${config.colorScheme.palette.base00}";
-          fg = "#${config.colorScheme.palette.base05}";
-          black = "#${config.colorScheme.palette.base01}";
-          red = "#${config.colorScheme.palette.base08}";
-          green = "#${config.colorScheme.palette.base0B}";
-          yellow = "#${config.colorScheme.palette.base0A}";
-          blue = "#${config.colorScheme.palette.base0D}";
-          magenta = "#${config.colorScheme.palette.base0E}";
-          cyan = "#${config.colorScheme.palette.base0C}";
-          white = "#${config.colorScheme.palette.base07}";
-          orange = "#${config.colorScheme.palette.base09}";
-        };
-      };
-    };
-  };
-}

home/base/cli-tools/zoxide.nix

@@ -1,20 +0,0 @@
-# Zoxide — smarter cd with Fish and Nushell integration.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.cliTools.zoxide;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.cliTools.zoxide.enable = (mkEnableOption "enable zoxide smarter cd") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.zoxide = {
-      enable = true;
-      enableFishIntegration = true;
-      enableNushellIntegration = true;
-    };
-  };
-}

home/base/default.nix

@@ -1,9 +0,0 @@
-# Base home-manager configuration — always loaded on every host.
-# Includes shell, CLI tools, and secrets modules.
-{...}: {
-  imports = [
-    ./shell
-    ./cli-tools
-    ./secrets/secrets.nix
-  ];
-}

home/base/secrets/secrets.nix

@@ -1,24 +0,0 @@
-# Password store and secrets management via pass-wayland with OTP and import extensions.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.base.secrets;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.secrets.enable = (mkEnableOption "enable secrets management") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.password-store = {
-      enable = true;
-      package =
-        pkgs.pass-wayland.withExtensions
-        (exts: [exts.pass-otp exts.pass-import]);
-      settings = {PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store";};
-    };
-    home.packages = [pkgs.pinentry-gnome3];
-  };
-}

home/base/shell/default.nix

@@ -1,8 +0,0 @@
-# Shell aggregator — imports Nushell (primary), Fish, and Starship prompt.
-{...}: {
-  imports = [
-    ./nushell.nix
-    ./fish.nix
-    ./starship.nix
-  ];
-}

home/base/shell/fish.nix

@@ -1,118 +0,0 @@
-# Fish shell configuration exposed under the new base namespace.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.shell.fish;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.shell.fish.enable = (mkEnableOption "enable fish shell") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.fish = {
-      enable = true;
-      interactiveShellInit = ''
-        # Fish colors using universal nix-colors palette
-        # Text colors
-        set -g fish_color_normal ${config.colorScheme.palette.base05}      # text
-        set -g fish_color_param ${config.colorScheme.palette.base05}       # text
-        set -g fish_color_comment ${config.colorScheme.palette.base03}     # muted
-        set -g fish_color_autosuggestion ${config.colorScheme.palette.base03} # muted
-
-        # Command colors
-        set -g fish_color_command ${config.colorScheme.palette.base0D}     # accent6 (blue)
-        set -g fish_color_quote ${config.colorScheme.palette.base0A}       # accent3 (yellow)
-        set -g fish_color_redirection ${config.colorScheme.palette.base0E} # accent7 (purple)
-        set -g fish_color_end ${config.colorScheme.palette.base08}         # accent1 (red)
-        set -g fish_color_error ${config.colorScheme.palette.base08}       # accent1 (red)
-        set -g fish_color_operator ${config.colorScheme.palette.base0C}    # accent5 (cyan)
-        set -g fish_color_escape ${config.colorScheme.palette.base09}      # accent2 (orange)
-
-        # Path colors
-        set -g fish_color_cwd ${config.colorScheme.palette.base0B}         # accent4 (green)
-        set -g fish_color_cwd_root ${config.colorScheme.palette.base08}    # accent1 (red)
-        set -g fish_color_valid_path --underline
-
-        # Interactive colors
-        set -g fish_color_match ${config.colorScheme.palette.base0B}       # accent4 (green)
-        set -g fish_color_selection --background=${config.colorScheme.palette.base02} # overlay
-        set -g fish_color_search_match --background=${config.colorScheme.palette.base02} # overlay
-        set -g fish_color_history_current --bold
-        set -g fish_color_user ${config.colorScheme.palette.base0B}        # accent4 (green)
-        set -g fish_color_host ${config.colorScheme.palette.base0D}        # accent6 (blue)
-        set -g fish_color_cancel -r
-
-        # Pager colors
-        set -g fish_pager_color_completion normal
-        set -g fish_pager_color_description ${config.colorScheme.palette.base03} # muted
-        set -g fish_pager_color_prefix ${config.colorScheme.palette.base0E}      # accent7 (purple)
-        set -g fish_pager_color_progress ${config.colorScheme.palette.base0B}    # accent4 (green)
-      '';
-      loginShellInit = ''
-        set -x NIX_PATH nixpkgs=channel:nixos-unstable
-        set -x NIX_LOG info
-        set -x WEBKIT_DISABLE_COMPOSITING_MODE 1
-        set -x TERMINAL ghostty
-        set -x EDITOR nvim
-        set -x VISUAL zed
-        set -x XDG_DATA_HOME $HOME/.local/share
-        set -x FZF_CTRL_R_OPTS "
-        --preview='bat --color=always -n {}'
-        --preview-window up:3:hidden:wrap
-        --bind 'ctrl-/:toggle-preview'
-        --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'
-        --color header:bold
-        --header 'Press CTRL-Y to copy command into clipboard'"
-        set -x FZF_DEFAULT_COMMAND fd --type f --exclude .git --follow --hidden
-        set -x FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
-        set -x FLAKE $HOME/p/nixos/nixos-config
-        source /run/agenix/${config.home.username}-secrets
-
-        if test (tty) = "/dev/tty1"
-          exec uwsm start -F /run/current-system/sw/bin/Hyprland
-        end
-        if test (tty) = "/dev/tty2"
-          exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
-        end
-      '';
-      shellAbbrs = {
-        ".." = "cd ..";
-        "..." = "cd ../..";
-        b = "yazi";
-        ls = "eza";
-        l = "eza -l --icons --git -a";
-        lt = "eza --tree --level=2 --long --icons --git";
-        grep = "rg";
-        ps = "procs";
-        just = "just --unstable";
-        node = "bun";
-        npx = "bunx";
-        fs = "du -ah . | sort -hr | head -n 10";
-
-        n = "nix";
-        nd = "nix develop -c $SHELL";
-        ns = "nix shell";
-        nsn = "nix shell nixpkgs#";
-        nb = "nix build";
-        nbn = "nix build nixpkgs#";
-        nf = "nix flake";
-
-        nr = "sudo nixos-rebuild --flake .";
-        nrs = "sudo nixos-rebuild switch --flake .#(uname -n)";
-        snr = "sudo nixos-rebuild --flake .";
-        snrs = "sudo nixos-rebuild --flake . switch";
-        hm = "home-manager --flake .";
-        hms = "home-manager --flake . switch";
-        hmr = "cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch";
-
-        tsu = "sudo tailscale up";
-        tsd = "sudo tailscale down";
-
-        vi = "nvim";
-        vim = "nvim";
-      };
-    };
-  };
-}

home/base/shell/nushell.nix

@@ -1,86 +0,0 @@
-# Primary shell configuration — Nushell with environment, aliases, and integrations.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.shell.nushell;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.nushell = {
-      enable = true;
-      envFile.text = ''
-        $env.config.show_banner = false
-        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
-        $env.NIX_LOG = "iunfo"
-        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
-        $env.TERMINAL = "ghostty"
-        $env.EDITOR = "nvim"
-        $env.VISUAL = "zeditor"
-        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
-        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always -n {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy command into clipboard' --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort' --color bg:#282a36,bg+:#44475a,fg:#f8f8f2,fg+:#f8f8f2,header:#6272a4,hl:#bd93f9,hl+:#bd93f9,info:#ffb86c,marker:#ff79c6,pointer:#ff79c6,prompt:#50fa7b,spinner:#ffb86c"
-        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
-        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
-        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
-        $env.NPM_CONFIG_PREFIX = $"($env.HOME)/.npm-global"
-        $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
-
-        # Load kestractl-env from agenix
-        if ("/run/agenix/kestractl-env" | path exists) {
-          open /run/agenix/kestractl-env
-            | lines
-            | where {($in | str trim | str length) > 0}
-            | parse "{key}={value}"
-            | update value {str trim -c '"'}
-            | transpose -r -d
-            | load-env
-        }
-      '';
-
-      configFile.text = ''
-        # Aliases
-        alias .. = cd ..
-        alias ... = cd ...
-        alias h = cd $env.HOME
-        alias b = yazi
-        alias lt = eza --tree --level=2 --long --icons --git
-        alias grep = rg
-        alias just = just --unstable
-
-        alias node = bun
-        alias npx = bunx
-
-        alias n = nix
-        alias nd = nix develop -c $nu.current-shell
-        alias ns = nix shell
-        alias nsn = nix shell nixpkgs#
-        alias nb = nix build
-        alias nbn = nix build nixpkgs#
-        alias nf = nix flake
-
-        alias nr = sudo nixos-rebuild --flake .
-        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
-        alias snr = sudo nixos-rebuild --flake .
-        alias snrs = sudo nixos-rebuild --flake . switch
-        alias hm = home-manager --flake .
-        alias hms = home-manager --flake . switch
-        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
-
-        alias tsu = sudo tailscale up
-        alias tsd = sudo tailscale down
-
-        alias vi = nvim
-        alias vim = nvim
-
-        if (which tv | is-not-empty) {
-          mkdir ($nu.data-dir | path join "vendor/autoload")
-          tv init nu | save -f ($nu.data-dir | path join "vendor/autoload/tv.nu")
-        }
-      '';
-    };
-  };
-}

home/base/shell/starship.nix

@@ -1,70 +0,0 @@
-# Starship cross-shell prompt with nix-colors theming.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.base.shell.starship;
-in {
-  # Enabled by default — base modules are always-on.
-  options.base.shell.starship.enable = (mkEnableOption "enable starship prompt") // {default = true;};
-
-  config = mkIf cfg.enable {
-    programs.starship = {
-      enable = true;
-      enableFishIntegration = true;
-      enableNushellIntegration = true;
-      settings = {
-        format = "$all$character";
-        palette = "universal";
-
-        palettes.universal = {
-          background = "#${config.colorScheme.palette.base00}";
-          surface = "#${config.colorScheme.palette.base01}";
-          muted = "#${config.colorScheme.palette.base03}";
-          text = "#${config.colorScheme.palette.base05}";
-          bright = "#${config.colorScheme.palette.base07}";
-          accent1 = "#${config.colorScheme.palette.base08}";
-          accent2 = "#${config.colorScheme.palette.base09}";
-          accent3 = "#${config.colorScheme.palette.base0A}";
-          accent4 = "#${config.colorScheme.palette.base0B}";
-          accent5 = "#${config.colorScheme.palette.base0C}";
-          accent6 = "#${config.colorScheme.palette.base0D}";
-          accent7 = "#${config.colorScheme.palette.base0E}";
-        };
-
-        character = {
-          success_symbol = "[❯](accent7)";
-          error_symbol = "[❯](accent1)";
-        };
-
-        directory = {
-          style = "accent6";
-          truncation_length = 3;
-          truncate_to_repo = false;
-        };
-
-        git_branch = {
-          style = "accent7";
-        };
-
-        git_status = {
-          style = "accent5";
-        };
-
-        cmd_duration = {
-          style = "accent3";
-        };
-
-        hostname = {
-          style = "accent4";
-        };
-
-        username = {
-          style_user = "accent2";
-        };
-      };
-    };
-  };
-}

home/coding/agents/agents.nix

@@ -1,85 +0,0 @@
-# AI agent system — OpenCode, Pi, and MCP server configuration.
-# Relies on coding.agents options provided by home/common/default.nix
-# (inputs.m3ta-nixpkgs.homeManagerModules.default).
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  videoDrivers ? [],
-  ...
-}: {
-  # Agent Git Identity configuration
-  # Note: Uses existing gitea SSH key (m3tam3re identity) for push auth
-  coding.agents.gitIdentity = {
-    enable = true;
-    name = "m3ta-chiron";
-    email = "m3ta-chiron@agentmail.to";
-    sshKey = "/home/m3tam3re/.ssh/gitea";
-  };
-
-  imports = [
-    # OpenCode and Pi agent configurations
-    ./opencode.nix
-    ./pi.nix
-  ];
-
-  coding.agents.skills = {
-    agentsInput = inputs.agents;
-    externalSkills = [
-      {
-        src = inputs.skills-anthropic;
-        selectSkills = ["pdf" "docx" "frontend-design"];
-      }
-      {src = inputs.skills-superpowers;}
-      {src = inputs.skills-vercel;}
-      {src = inputs.skills-basecamp;}
-      {src = inputs.skills-kestra;}
-    ];
-  };
-
-  programs.mcp = {
-    enable = true;
-    servers = {
-      DeepWiki = {
-        url = "https://mcp.deepwiki.com/mcp";
-      };
-      Ref = {
-        command = "bash";
-        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
-      };
-      Exa = {
-        command = "bash";
-        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
-      };
-      Outline = {
-        url = "https://wiki.az-gruppe.com/mcp";
-      };
-      ContextMode = {
-        command = "bash";
-        args = ["-c" "exec bunx context-mode@latest"];
-      };
-      Honcho = {
-        command = "bash";
-        args = [
-          "-c"
-          ''exec bunx mcp-remote@latest https://mcp.honcho.dev --header "Authorization:Bearer $(cat /run/agenix/honcho-key)" --header "X-Honcho-User-Name:m3tam3re"''
-        ];
-      };
-    };
-  };
-
-  home.packages = with pkgs; [
-    agenix-cli
-    agent-browser
-    beads
-    pi
-    (qmd.override {
-      vulkanSupport = videoDrivers == ["amdgpu"];
-      cudaSupport = videoDrivers == ["nvidia"];
-    })
-    # opencode-desktop
-    openshell
-    openspec
-  ];
-}

home/coding/agents/opencode.nix

@@ -1,260 +0,0 @@
-{
-  inputs,
-  lib,
-  ...
-}: {
-  coding.agents.opencode = {
-    enable = true;
-    agentsInput = inputs.agents;
-  };
-
-  coding.opencode = {
-    enable = true;
-
-    ohMyOpencodeSettings = {
-      agents = {
-        sisyphus.model = "litellm/claude-opus-4-6";
-        oracle.model = "litellm/claude-sonnet-4-6";
-        librarian.model = "litellm/claude-sonnet-4-6";
-        explore.model = "litellm/claude-haiku-4-5";
-        multimodal-looker.model = "litellm/gpt-5.3-codex";
-        prometheus.model = "litellm/claude-opus-4-6";
-        metis.model = "litellm/claude-opus-4-6";
-        momus.model = "litellm/claude-opus-4-6";
-        atlas.model = "litellm/claude-sonnet-4-6";
-      };
-      categories = {
-        visual-engineering.model = "zai-coding-plan/glm-5.1";
-        ultrabrain.model = "litellm/claude-opus-4-6";
-        deep.model = "litellm/claude-sonnet-4-6";
-        artistry.model = "zai-coding-plan/glm-5.1";
-        quick.model = "litellm/claude-haiku-4-5";
-        unspecified-low.model = "litellm/claude-sonnet-4-6";
-        unspecified-high.model = "litellm/claude-opus-4-6";
-        writing.model = "zai-coding-plan/glm-5.1";
-      };
-    };
-  };
-
-  # Keep TUI settings in programs.opencode.tui to satisfy OpenCode v1.2.15+.
-  programs.opencode.tui.theme = "opencode";
-
-  # Override legacy default settings to avoid deprecated TUI keys in settings.
-  programs.opencode.settings = lib.mkForce {
-    plugin = ["oh-my-openagent"];
-    formatter = {
-      alejandra = {
-        command = ["alejandra" "-q" "-"];
-        extensions = [".nix"];
-      };
-    };
-
-    # Security: permission hardening for OpenCode
-    # Last matching rule wins. Glob patterns: * = any chars, ? = single char.
-    # ~ and $HOME are expanded to the user's home directory.
-    # external_directory gates paths outside the working directory.
-    permission = {
-      # External directory access: ask by default, allow safe paths
-      "external_directory" = {
-        "*" = "ask";
-        "/nix/store/**" = "allow";
-        "/tmp/**" = "allow";
-      };
-
-      # Read access: allow by default, deny sensitive paths
-      "read" = {
-        "*" = "allow";
-        "~/.ssh/**" = "deny";
-        "~/.gnupg/**" = "deny";
-        "~/.aws/**" = "deny";
-        "~/.kube/**" = "deny";
-        "~/.config/gh/**" = "deny";
-        "~/.config/gcloud/**" = "deny";
-        "~/.config/op/**" = "deny";
-        "~/.config/sops/**" = "deny";
-        "/run/agenix/**" = "deny";
-        "~/.pi/agent/auth.json" = "deny";
-        "~/.pi/agent/sessions/**" = "deny";
-        "*.env" = "deny";
-        "*.env.*" = "deny";
-        "*.pem" = "deny";
-        "*.key" = "deny";
-        "*.p12" = "deny";
-        "*.pfx" = "deny";
-        "*id_rsa*" = "deny";
-        "*id_ed25519*" = "deny";
-        "*id_ecdsa*" = "deny";
-        "*.example.env" = "allow";
-        "*.sample.env" = "allow";
-        "*.test.env" = "allow";
-        ".env.example" = "allow";
-        ".env.sample" = "allow";
-        ".env.test" = "allow";
-        "~/.ssh/*.pub" = "allow";
-        "*.pub" = "allow";
-        "*.csr" = "allow";
-      };
-
-      # Edit access: ask by default, deny sensitive paths
-      "edit" = {
-        "*" = "ask";
-        "~/.ssh/**" = "deny";
-        "~/.gnupg/**" = "deny";
-        "~/.aws/**" = "deny";
-        "~/.kube/**" = "deny";
-        "~/.config/gh/**" = "deny";
-        "~/.config/gcloud/**" = "deny";
-        "~/.config/op/**" = "deny";
-        "~/.config/sops/**" = "deny";
-        "/run/agenix/**" = "deny";
-        "~/.pi/agent/auth.json" = "deny";
-        "~/.pi/agent/sessions/**" = "deny";
-        "*.env" = "deny";
-        "*.env.*" = "deny";
-        "*.pem" = "deny";
-        "*.key" = "deny";
-        "*.p12" = "deny";
-        "*.pfx" = "deny";
-        "*id_rsa*" = "deny";
-        "*id_ed25519*" = "deny";
-        "*id_ecdsa*" = "deny";
-        "~/.ssh/*.pub" = "allow";
-        "*.pub" = "allow";
-        "*.csr" = "allow";
-      };
-
-      # Glob patterns: same rules as read for file matching
-      "glob" = {
-        "*" = "allow";
-        "~/.ssh/**" = "deny";
-        "~/.gnupg/**" = "deny";
-        "/run/agenix/**" = "deny";
-        "*.env" = "deny";
-        "*.env.*" = "deny";
-        "*.pem" = "deny";
-        "*.key" = "deny";
-        "*.p12" = "deny";
-        "*.pfx" = "deny";
-      };
-
-      # Grep: allow search, but deny searching for secrets
-      "grep" = {
-        "*" = "allow";
-        "~/.ssh/**" = "deny";
-        "~/.gnupg/**" = "deny";
-        "/run/agenix/**" = "deny";
-        "*PASSWORD*" = "ask";
-        "*SECRET*" = "ask";
-        "*API_KEY*" = "ask";
-        "*PRIVATE_KEY*" = "ask";
-      };
-
-      # Bash: ask by default, deny dangerous and env-leak commands
-      "bash" = {
-        "*" = "ask";
-        "git status*" = "allow";
-        "git diff*" = "allow";
-        "git log*" = "allow";
-        "git branch*" = "allow";
-        "git show*" = "allow";
-        "git remote*" = "allow";
-        "nix --version" = "allow";
-        "nix eval*" = "allow";
-        "nix build*" = "allow";
-        "nix develop*" = "allow";
-        "nix shell*" = "allow";
-        "nix search*" = "allow";
-        "alejandra*" = "allow";
-        "git add*" = "allow";
-        "git commit*" = "allow";
-        "git push*" = "ask";
-        "git pull*" = "allow";
-        "rm *" = "ask";
-        "rm -rf *" = "deny";
-        "sudo *" = "ask";
-        "env" = "deny";
-        "printenv" = "deny";
-        "cat /proc/*/environ" = "deny";
-        "gpg *--export-secret*" = "deny";
-        "ssh-add -D" = "deny";
-        "docker run --privileged*" = "deny";
-        "curl *| *sh" = "deny";
-        "wget *| *sh" = "deny";
-      };
-
-      # Web fetch: ask for sensitive URLs
-      "webfetch" = {
-        "*" = "ask";
-        "https://api.github.com*" = "allow";
-        "https://search.nixos.org*" = "allow";
-      };
-
-      # Doom loop guard
-      "doom_loop" = "ask";
-    };
-
-    # AZ-Gruppe LiteLLM endpoint + available models
-    provider = {
-      litellm = {
-        npm = "@ai-sdk/openai-compatible";
-        name = "LiteLLM (AZ-Gruppe)";
-        options.baseURL = "https://llm.az-gruppe.com/v1";
-        models = {
-          "gpt-5.2" = {
-            name = "GPT-5.2";
-            limit = {
-              context = 400000;
-              output = 128000;
-            };
-          };
-          "gpt-5.3-codex" = {
-            name = "GPT-5.3 Codex";
-            limit = {
-              context = 400000;
-              output = 128000;
-            };
-          };
-          "claude-haiku-4-5" = {
-            name = "Claude Haiku 4.5";
-            options = {
-              thinking = {
-                type = "enabled";
-                budget_tokens = 16000;
-              };
-            };
-            limit = {
-              context = 200000;
-              output = 64000;
-            };
-          };
-          "claude-sonnet-4-6" = {
-            name = "Claude Sonnet 4.6";
-            options = {
-              thinking = {
-                type = "enabled";
-                budget_tokens = 16000;
-              };
-            };
-            limit = {
-              context = 200000;
-              output = 64000;
-            };
-          };
-          "claude-opus-4-6" = {
-            name = "Claude Opus 4.6";
-            options = {
-              thinking = {
-                type = "enabled";
-                budget_tokens = 16000;
-              };
-            };
-            limit = {
-              context = 200000;
-              output = 128000;
-            };
-          };
-        };
-      };
-    };
-  };
-}

home/coding/agents/pi.nix

@@ -1,269 +0,0 @@
-{inputs, ...}: {
-  coding.agents.pi = {
-    enable = true;
-    agentsInput = inputs.agents;
-
-    modelOverrides = {
-      chiron = "minimax/MiniMax-M2.7";
-      chiron-forge = "minimax/MiniMax-M2.7";
-    };
-
-    # Coding rules for Pi agent
-    # Rules sourced from AGENTS repo
-    codingRules = {
-      # Language-specific rules
-      languages = [
-        "nix" # Nix language conventions
-      ];
-
-      # Standard concerns from AGENTS repo
-      concerns = [
-        "coding-style" # General coding principles
-        "naming" # Naming conventions (camelCase, snake_case, etc.)
-        "documentation" # Documentation standards
-        "testing" # Testing guidelines (Arrange-Act-Assert)
-        "git-workflow" # Conventional commits, branch naming
-        "git-identity" # Git identity configuration for agents
-        "project-structure" # Project layout conventions
-      ];
-
-      # No framework-specific rules for NixOS config
-      frameworks = [];
-    };
-
-    settings = {
-      packages = [
-        "npm:@dreadedzombie/pi-init"
-        "npm:@plannotator/pi-extension"
-        "npm:@thesethrose/pi-zai-provider"
-        "npm:pi-agent-browser-native"
-        "npm:pi-beads-extension"
-        "npm:pi-lens"
-        "npm:pi-markdown-preview"
-        "npm:pi-mcp-adapter"
-        "npm:pi-powerline-footer"
-        "npm:pi-prompt-template-model"
-        "npm:pi-subagents"
-        "npm:pi-tool-display"
-        "npm:pi-web-access"
-        "git:github.com/hk-vk/pi-connect"
-      ];
-
-      defaultProvider = "minimax";
-      defaultModel = "MiniMax-M2.7";
-      defaultThinkingLevel = "high";
-    };
-
-    # pi-guardrails: strict security config
-    # NOTE: Path access checks are lexical (not symlink-safe).
-    # NOTE: Local project .pi/extensions/guardrails.json can override same rule IDs.
-    #       For immutable global policies, consider a wrapper or upstream patch.
-    guardrails = {
-      enable = true;
-      config = {
-        enabled = true;
-        applyBuiltinDefaults = true;
-
-        onboarding = {
-          completed = true;
-        };
-
-        features = {
-          policies = true;
-          permissionGate = true;
-          pathAccess = true;
-        };
-
-        pathAccess = {
-          mode = "ask";
-          allowedPaths = [
-            "/nix/store/"
-            "/tmp/"
-          ];
-        };
-
-        policies = {
-          rules = [
-            # ── SSH keys ───────────────────────────────────────────
-            {
-              id = "home-ssh";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.ssh/**";}
-                {pattern = "~/.ssh/*_rsa";}
-                {pattern = "~/.ssh/*_ed25519";}
-                {pattern = "~/.ssh/*.pem";}
-              ];
-              allowedPatterns = [
-                {pattern = "~/.ssh/*.pub";}
-              ];
-            }
-
-            # ── GPG keys ─────────────────────────────────────────
-            {
-              id = "home-gpg";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.gnupg/**";}
-                {pattern = "~/*.gpg";}
-                {pattern = "~/.gpg-agent.conf";}
-              ];
-            }
-
-            # ── AWS credentials ────────────────────────────────────
-            {
-              id = "home-aws";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.aws/**";}
-                {pattern = "~/.aws/credentials";}
-                {pattern = "~/.aws/config";}
-              ];
-            }
-
-            # ── Kubernetes configs ────────────────────────────────
-            {
-              id = "home-kube";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.kube/**";}
-                {pattern = "*kubeconfig*";}
-              ];
-            }
-
-            # ── Cloud CLI configs ────────────────────────────────
-            {
-              id = "home-config";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.config/gh/**";}
-                {pattern = "~/.config/gcloud/**";}
-                {pattern = "~/.config/op/**";}
-                {pattern = "~/.config/sops/**";}
-              ];
-            }
-
-            # ── agenix secrets ───────────────────────────────────
-            {
-              id = "agenix-secrets";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "/run/agenix/**";}
-              ];
-            }
-
-            # ── Pi auth and sessions ────────────────────────────
-            {
-              id = "pi-auth-sessions";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "~/.pi/agent/auth.json";}
-                {pattern = "~/.pi/agent/sessions/**";}
-              ];
-            }
-
-            # ── Environment files ─────────────────────────────────
-            {
-              id = "secret-files";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = true;
-              patterns = [
-                {pattern = ".env";}
-                {pattern = ".env.*";}
-                {pattern = ".dev.vars";}
-              ];
-              allowedPatterns = [
-                {pattern = "*.example.env";}
-                {pattern = "*.sample.env";}
-                {pattern = "*.test.env";}
-                {pattern = ".env.example";}
-                {pattern = ".env.sample";}
-                {pattern = ".env.test";}
-              ];
-            }
-
-            # ── Private keys and certificates ───────────────────
-            {
-              id = "private-keys";
-              enabled = true;
-              protection = "noAccess";
-              onlyIfExists = false;
-              patterns = [
-                {pattern = "*.pem";}
-                {pattern = "*.key";}
-                {pattern = "*.p12";}
-                {pattern = "*.pfx";}
-                {pattern = "*id_rsa*";}
-                {pattern = "*id_ed25519*";}
-                {pattern = "*id_ecdsa*";}
-              ];
-              allowedPatterns = [
-                {pattern = "*.pub";}
-                {pattern = "*.csr";}
-              ];
-            }
-          ];
-        };
-
-        permissionGate = {
-          explainCommands = false;
-          # Auto-deny patterns: env leakage and credential dumping
-          autoDenyPatterns = [
-            {
-              pattern = "\\benv\\b";
-              regex = true;
-              description = "env command (may dump environment)";
-            }
-            {
-              pattern = "\\bprintenv\\b";
-              regex = true;
-              description = "printenv command (dumps environment variables)";
-            }
-            {
-              pattern = "/proc/[0-9]+/environ";
-              regex = true;
-              description = "reading process environment files";
-            }
-            {
-              pattern = "gpg\\s+--export-secret-keys";
-              regex = true;
-              description = "GPG secret key export";
-            }
-            {
-              pattern = "gpg\\s+--export-secret-subkeys";
-              regex = true;
-              description = "GPG secret subkey export";
-            }
-            {
-              pattern = "ssh-add\\s+-D";
-              regex = true;
-              description = "delete all SSH identities";
-            }
-            {
-              pattern = "\\b(op|pass)\\s+(read|show|get)";
-              regex = true;
-              description = "password manager read operations";
-            }
-          ];
-        };
-      };
-    };
-
-    # MCP servers auto-inherited from programs.mcp in default.nix
-  };
-}

home/coding/default.nix

@@ -1,12 +0,0 @@
-# Coding environment aggregator — profile-independent development tooling.
-# Imports editors, LSP servers, git configuration, the agent system, language runtimes, and optional packages.
-{...}: {
-  imports = [
-    ./editor
-    ./lsp
-    ./git/git.nix
-    ./agents/agents.nix
-    ./languages
-    ./packages.nix
-  ];
-}

home/coding/editor/default.nix

@@ -1,6 +0,0 @@
-# Editor aggregator — delegates to m3ta-nixpkgs editor modules.
-{...}: {
-  imports = [
-    ./neovim.nix
-  ];
-}

home/coding/editor/neovim.nix

@@ -1,7 +0,0 @@
-# NeoVim base configuration via m3ta-nixpkgs coding.editors module.
-# The option `coding.editors.neovim.enable` is declared by
-# inputs.m3ta-nixpkgs.homeManagerModules.default — no re-declaration here.
-{...}: {
-  # Placeholder for host-agnostic NeoVim overrides.
-  # Set coding.editors.neovim.enable = true in per-host files to activate.
-}

home/coding/git/git.nix

@@ -1,41 +0,0 @@
-# Git configuration with signing, aliases, and global ignore.
-# Identity and host-specific SSH keys are set per-host in home/m3tam3re/.
-{
-  lib,
-  pkgs,
-  ...
-}:
-with lib; {
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        name = lib.mkDefault "m3tam3re";
-        email = lib.mkDefault "p@m3ta.dev";
-      };
-      core.excludesfile = "~/.gitignore_global";
-      init.defaultBranch = "master";
-      alias = {
-        st = "status";
-        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-      };
-    };
-  };
-
-  programs.difftastic.enable = true;
-
-  programs.jujutsu = {
-    enable = true;
-    settings = {
-      user = {
-        email = "m@m3tam3re.com";
-        name = "Sascha Koenig";
-      };
-    };
-  };
-
-  home.packages = with pkgs; [
-    lazygit
-  ];
-}

home/coding/languages/default.nix

@@ -1,10 +0,0 @@
-# Language runtimes — Python, JavaScript, Rust, Go, TypeScript.
-{...}: {
-  imports = [
-    ./python.nix
-    ./javascript.nix
-    ./rust-toolchain.nix
-    ./go.nix
-    ./typescript.nix
-  ];
-}

home/coding/languages/go.nix

@@ -1,19 +0,0 @@
-# Go toolchain — compiler and language server.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.languages.go;
-in {
-  options.coding.languages.go.enable = mkEnableOption "Go toolchain";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      go
-      gopls
-    ];
-  };
-}

home/coding/languages/javascript.nix

@@ -1,25 +0,0 @@
-# JavaScript/TypeScript runtime — Node.js and Bun.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.languages.javascript;
-  npmGlobalPrefix = "${config.home.homeDirectory}/.npm-global";
-in {
-  options.coding.languages.javascript.enable = mkEnableOption "JavaScript runtime (Node.js + Bun)";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      nodejs
-      bun
-    ];
-
-    home.file.".npmrc".text = ''
-      prefix=${npmGlobalPrefix}
-    '';
-    home.sessionVariables.NPM_CONFIG_PREFIX = npmGlobalPrefix;
-  };
-}

home/coding/languages/python.nix

@@ -1,35 +0,0 @@
-# Python runtime with pip and uv.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.languages.python;
-in {
-  options.coding.languages.python = {
-    enable = mkEnableOption "Python runtime with pip and uv";
-    extraPackages = mkOption {
-      type = types.listOf types.package;
-      default = [];
-      example = literalExpression "[ pkgs.python3Packages.numpy ]";
-      description = "Additional Python packages to include";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      (pkgs.python3.withPackages (ps:
-        with ps;
-          [
-            uv
-          ]
-          ++ cfg.extraPackages))
-      (writeShellScriptBin "pip" "exec uv pip $@")
-      (writeShellScriptBin "pip3" "exec uv pip $@")
-      pyrefly
-      ruff
-    ];
-  };
-}

home/coding/languages/rust-toolchain.nix

@@ -1,20 +0,0 @@
-# Rust toolchain — compiler, package manager, and language server.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.languages.rustToolchain;
-in {
-  options.coding.languages.rustToolchain.enable = mkEnableOption "Rust toolchain";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      rustc
-      cargo
-      rust-analyzer
-    ];
-  };
-}

home/coding/languages/typescript.nix

@@ -1,19 +0,0 @@
-# TypeScript support — language server and type checking tools.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.languages.typescript;
-in {
-  options.coding.languages.typescript.enable = mkEnableOption "TypeScript support";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      typescript
-      typescript-language-server
-    ];
-  };
-}

home/coding/lsp/default.nix

@@ -1,6 +0,0 @@
-# LSP aggregator — language server protocol tooling.
-{...}: {
-  imports = [
-    ./servers.nix
-  ];
-}

home/coding/lsp/servers.nix

@@ -1,23 +0,0 @@
-# LSP server configuration — language servers for the development environment.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.lsp;
-in {
-  options.coding.lsp.enable = mkEnableOption "enable LSP servers";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      # Nix
-      nixd
-      # General
-      typescript-language-server
-      tailwindcss-language-server
-      pyrefly
-    ];
-  };
-}

home/coding/packages.nix

@@ -1,20 +0,0 @@
-# Additional coding packages — API clients and GUI development tools.
-# Opt-in since not all coding hosts need these desktop-oriented tools.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.coding.packages;
-in {
-  options.coding.packages.enable = mkEnableOption "additional coding packages (bruno, insomnia)";
-
-  config = mkIf cfg.enable {
-    home.packages = [
-      pkgs.bruno
-      pkgs.insomnia
-    ];
-  };
-}

home/common/default.nix

@@ -1,56 +0,0 @@
-{
-  inputs,
-  lib,
-  outputs,
-  pkgs,
-  system,
-  ...
-}: {
-  imports = [
-    inputs.nix-colors.homeManagerModules.default
-    inputs.m3ta-nixpkgs.homeManagerModules.default
-  ]; #imports = builtins.attrValues outputs.homeManagerModules;
-  nixpkgs = {
-    # You can add overlays here
-    overlays = [
-      # Add overlays your own flake exports (from overlays and pkgs dir):
-      #outputs.overlays.additions
-      #outputs.overlays.modifications
-      outputs.overlays.temp-packages
-      outputs.overlays.stable-packages
-      outputs.overlays.locked-packages
-      outputs.overlays.pinned-packages
-      outputs.overlays.master-packages
-
-      inputs.nur.overlays.default
-      inputs.m3ta-nixpkgs.overlays.default
-      inputs.m3ta-nixpkgs.overlays.modifications
-      (outputs.lib.mkLlmAgentsOverlay system)
-      # You can also add overlays exported from other flakes:
-      # neovim-nightly-overlay.overlays.default
-
-      # Or define it inline, for example:
-      # (final: prev: {
-      #   hi = final.hello.overrideAttrs (oldAttrs: {
-      #     patches = [ ./change-hello-to-hi.patch ];
-      #   });
-      # })
-    ];
-    # Configure your nixpkgs instance
-    config = {
-      # Disable if you don't want unfree packages
-      allowUnfree = true;
-      # Workaround for https://github.com/nix-community/home-manager/issues/2942
-      allowUnfreePredicate = _: true;
-    };
-  };
-
-  nix = {
-    package = lib.mkDefault pkgs.nix;
-    settings = {
-      experimental-features = ["nix-command" "flakes"];
-      warn-dirty = false;
-    };
-  };
-  colorScheme = inputs.nix-colors.colorSchemes.dracula;
-}

home/desktop/apps/crypto.nix

@@ -1,16 +0,0 @@
-# Cryptocurrency applications — Bisq, Monero GUI, and Trezor Suite.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.apps.crypto;
-in {
-  options.desktop.apps.crypto.enable = mkEnableOption "enable crypto applications";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
-  };
-}

home/desktop/apps/default.nix

@@ -1,10 +0,0 @@
-# Desktop apps aggregator — Obsidian, Office, web apps, crypto tools, and productivity.
-{...}: {
-  imports = [
-    ./obsidian.nix
-    ./office.nix
-    ./webapps.nix
-    ./crypto.nix
-    ./productivity.nix
-  ];
-}

home/desktop/apps/obsidian.nix

@@ -1,25 +0,0 @@
-# Obsidian knowledge base with markdown MIME association.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.apps.obsidian;
-in {
-  options.desktop.apps.obsidian.enable = mkEnableOption "enable Obsidian knowledge base";
-
-  config = mkIf cfg.enable {
-    programs.obsidian.enable = true;
-
-    xdg.mimeApps = {
-      enable = true;
-      associations.added = {
-        "text/markdown" = ["obsidian.desktop"];
-      };
-      defaultApplications = {
-        "text/markdown" = ["obsidian.desktop"];
-      };
-    };
-  };
-}

home/desktop/apps/office.nix

@@ -1,16 +0,0 @@
-# Office and productivity applications — LibreOffice and document tools.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.apps.office;
-in {
-  options.desktop.apps.office.enable = mkEnableOption "install office and paperwork apps";
-
-  config = mkIf cfg.enable {
-    home.packages = [pkgs.libreoffice-fresh];
-  };
-}

home/desktop/apps/productivity.nix

@@ -1,18 +0,0 @@
-# Productivity tools — Pomodoro timer and focus utilities.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.apps.productivity;
-in {
-  options.desktop.apps.productivity.enable = mkEnableOption "enable productivity tools";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      pomodoro-timer
-    ];
-  };
-}

home/desktop/apps/webapps.nix

@@ -1,56 +0,0 @@
-# Web application desktop entries — Teams, Outlook, Basecamp, and OpenCode launchers.
-{
-  config,
-  pkgs,
-  ...
-}: let
-  icons = {
-    teams = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-teams.svg";
-      sha256 = "sha256-Pr9QS8nnXJq97r4/G3c6JXi34zxHl0ps9gcyI8cN/s8=";
-    };
-    outlook = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-outlook.svg";
-      sha256 = "sha256-3u8t5QNHFZvrAegxBiGicO4PjtMWhEaQSCv7MSSfLLc=";
-    };
-    opencode = pkgs.fetchurl {
-      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opencode-dark.svg";
-      sha256 = "1lms4f8habamvdh2qqqz9psx4py9wx23mmlkkds44pvrbq3bkj3n";
-    };
-  };
-in {
-  xdg.desktopEntries = {
-    teams = {
-      name = "Microsoft Teams";
-      exec = "launch-webapp https://teams.microsoft.com";
-      comment = "Open Microsoft Teams as a Desktop App";
-      categories = ["Application" "Network" "Chat"];
-      terminal = false;
-      icon = icons.teams;
-    };
-    outlook = {
-      name = "Microsoft Outlook";
-      exec = "launch-webapp https://outlook.office.com/mail/";
-      comment = "Open Microsoft Outlook as a Desktop App";
-      categories = ["Application" "Network"];
-      terminal = false;
-      icon = icons.outlook;
-    };
-    basecamp = {
-      name = "Basecamp";
-      exec = "launch-webapp https://3.basecamp.com/5996442/";
-      comment = "Open Basecamp as a Desktop App";
-      categories = ["Application" "Network"];
-      terminal = false;
-      icon = "${config.home.homeDirectory}/.local/share/icons/basecamp-logo.png";
-    };
-    opencode = {
-      name = "Opencode";
-      exec = "rofi-project-opener";
-      comment = "Open Opencode Terminal App";
-      categories = ["Application" "Development"];
-      terminal = false;
-      icon = icons.opencode;
-    };
-  };
-}

home/desktop/default.nix

@@ -1,125 +0,0 @@
-# Desktop environment aggregator — only loaded when context=desktop.
-# Includes window manager, applications, theming, and desktop session config.
-{
-  config,
-  pkgs,
-  ...
-}: {
-  imports = [
-    ./wm
-    ./apps
-    ./theme
-  ];
-
-  xdg = {
-    enable = true;
-    configFile."mimeapps.list".force = true;
-    mimeApps = {
-      enable = true;
-      associations.added = {
-        "application/zip" = ["org.gnome.FileRoller.desktop"];
-        "application/csv" = ["calc.desktop"];
-        "application/pdf" = ["okularApplication_pdf.desktop"];
-      };
-      defaultApplications = {
-        "application/zip" = ["org.gnome.FileRoller.desktop"];
-        "application/csv" = ["calc.desktop"];
-        "application/pdf" = ["okularApplication_pdf.desktop"];
-        "application/md" = ["nvim.desktop"];
-        "application/text" = ["nvim.desktop"];
-        "x-scheme-handler/http" = ["io.github.zen_browser.zen"];
-        "x-scheme-handler/https" = ["io.github.zen_browser.zen"];
-      };
-    };
-    userDirs = {
-      enable = true;
-      createDirectories = true;
-      setSessionVariables = true;
-    };
-  };
-
-  home.sessionVariables = {
-    WEBKIT_DISABLE_COMPOSITING_MODE = "1";
-    NIXOS_OZONE_WL = "1";
-    TERMINAL = "ghostty";
-    QT_QPA_PLATFORM = "wayland";
-    XDG_CURRENT_DESKTOP = "Hyprland";
-    XDG_SESSION_TYPE = "wayland";
-    XDG_SESSION_DESKTOP = "Hyprland";
-  };
-
-  home.sessionPath = [
-    "\${XDG_BIN_HOME}"
-    "\${HOME}/.cargo/bin"
-    "$HOME/.npm-global/bin"
-    "$HOME/.cache/.bun/bin"
-  ];
-
-  fonts.fontconfig.enable = true;
-
-  programs.ghostty = {
-    enable = true;
-    enableFishIntegration = true;
-    enableBashIntegration = true;
-    settings = {
-      font-family = "Fira Code";
-      copy-on-select = true;
-      foreground = "#${config.colorScheme.palette.base05}";
-      background = "#${config.colorScheme.palette.base00}";
-      selection-foreground = "#${config.colorScheme.palette.base07}";
-      selection-background = "#${config.colorScheme.palette.base02}";
-      cursor-color = "#${config.colorScheme.palette.base05}";
-      palette = [
-        "0=#${config.colorScheme.palette.base01}"
-        "1=#${config.colorScheme.palette.base08}"
-        "2=#${config.colorScheme.palette.base0B}"
-        "3=#${config.colorScheme.palette.base0A}"
-        "4=#${config.colorScheme.palette.base0D}"
-        "5=#${config.colorScheme.palette.base0E}"
-        "6=#${config.colorScheme.palette.base0C}"
-        "7=#${config.colorScheme.palette.base05}"
-        "8=#${config.colorScheme.palette.base03}"
-        "9=#${config.colorScheme.palette.base08}"
-        "10=#${config.colorScheme.palette.base0B}"
-        "11=#${config.colorScheme.palette.base0A}"
-        "12=#${config.colorScheme.palette.base0D}"
-        "13=#${config.colorScheme.palette.base0E}"
-        "14=#${config.colorScheme.palette.base0C}"
-        "15=#${config.colorScheme.palette.base07}"
-      ];
-    };
-  };
-
-  home.pointerCursor = {
-    gtk.enable = true;
-    package = pkgs.bibata-cursors;
-    name = "Bibata-Modern-Ice";
-    size = 20;
-  };
-
-  home.packages = with pkgs; [
-    appimage-run
-    bemoji
-    brave
-    distrobox
-    eigent
-    (element-desktop.override {
-      commandLineArgs = "--password-store=gnome-libsecret";
-    })
-    launch-webapp
-    file-roller
-    hyprpanel
-    seahorse
-    sushi
-    ksnip
-    msty-studio
-    nwg-look
-    rose-pine-hyprcursor
-    remmina
-    slack
-    telegram-desktop
-    vivaldi
-    vivaldi-ffmpeg-codecs
-    vibetyper
-  ];
-}

home/desktop/theme/default.nix

@@ -1,8 +0,0 @@
-# Theme aggregator — fonts, GTK/Qt theming, and wallpapers.
-{...}: {
-  imports = [
-    ./fonts.nix
-    ./theme.nix
-    ./wallpapers.nix
-  ];
-}

home/desktop/theme/fonts.nix

@@ -1,24 +0,0 @@
-# Font packages — Fira Code, JetBrains Mono Nerd Font, and supporting icon fonts.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.theme.fonts;
-in {
-  options.desktop.theme.fonts.enable = mkEnableOption "install desktop fonts";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      fira-code
-      fira-code-symbols
-      nerd-fonts.fira-code
-      nerd-fonts.jetbrains-mono
-      font-manager
-      font-awesome_5
-      noto-fonts
-    ];
-  };
-}

home/desktop/theme/theme.nix

@@ -1,24 +0,0 @@
-# GTK and Qt theming — Dracula theme with matching icons and cursor.
-{
-  pkgs,
-  config,
-  ...
-}: {
-  qt = {
-    enable = true;
-    platformTheme.name = "gtk";
-  };
-
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Dracula";
-      package = pkgs.dracula-theme;
-    };
-    iconTheme = {
-      name = "Dracula";
-      package = pkgs.dracula-icon-theme;
-    };
-    gtk4.theme = config.gtk.theme;
-  };
-}

home/desktop/theme/wallpapers.nix

@@ -1,19 +0,0 @@
-# Wallpaper collection — copies wallpapers to Hyprland config directory.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.theme.wallpapers.enable;
-in {
-  options.desktop.theme.wallpapers.enable = mkEnableOption "wallpapers for Hyprland";
-
-  config = mkIf cfg {
-    xdg.configFile."hypr/wallpapers" = {
-      # Wallpapers are stored relative to the home/m3tam3re directory.
-      source = ../../m3tam3re/wallpapers;
-      recursive = true;
-    };
-  };
-}

home/desktop/wm/default.nix

@@ -1,8 +0,0 @@
-# Window manager aggregator — Hyprland, Wayland tools, and Rofi launcher.
-{...}: {
-  imports = [
-    ./hyprland.nix
-    ./wayland.nix
-    ./rofi.nix
-  ];
-}

home/desktop/wm/hyprland.nix

@@ -1,318 +0,0 @@
-# Hyprland window manager with keybindings, window rules, idle/lock, and hyprpaper.
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.wm.hyprland;
-in {
-  options.desktop.wm.hyprland.enable = mkEnableOption "Hyprland window manager";
-
-  config = mkIf cfg.enable {
-    wayland.windowManager.hyprland = {
-      settings = {
-        xwayland = {
-          force_zero_scaling = true;
-        };
-
-        exec-once = [
-          "hyprpanel"
-          "while ! hyprpaper-random; do sleep 0.5; done"
-          "wl-paste --type text --watch cliphist store"
-          "wl-paste --type image --watch cliphist store"
-          "vibetyper"
-        ];
-
-        env = [
-          "XCURSOR_SIZE,32"
-          "HYPRCURSOR_THEME,Bibata-Modern-Ice"
-          "WLR_NO_HARDWARE_CURSORS,1"
-          "GTK_THEME,Dracula"
-          "XDG_CURRENT_DESKTOP,Hyprland"
-          "XDG_SESSION_TYPE,wayland"
-          "XDG_SESSION_DESKTOP,Hyprland"
-          "XKB_DEFAULT_LAYOUT,de"
-          "NIXOS_OZONE_WL,1"
-        ];
-
-        input = {
-          kb_layout = "de,us";
-          kb_variant = "";
-          kb_model = "";
-          kb_rules = "";
-          kb_options = "ctrl:nocaps";
-          follow_mouse = 1;
-        };
-
-        general = {
-          gaps_in = 5;
-          gaps_out = 5;
-          border_size = 1;
-          "col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
-          "col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
-          layout = "dwindle";
-        };
-
-        decoration = {
-          shadow = {
-            enabled = true;
-            range = 60;
-            render_power = 3;
-            color = "rgba(${config.colorScheme.palette.base00}66)";
-            offset = "1 2";
-            scale = 0.97;
-          };
-          rounding = 8;
-          blur = {
-            enabled = true;
-            size = 3;
-            passes = 3;
-          };
-          active_opacity = 0.9;
-          inactive_opacity = 0.5;
-        };
-
-        animations = {
-          enabled = true;
-          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
-          animation = [
-            "windows, 1, 7, myBezier"
-            "windowsOut, 1, 7, default, popin 80%"
-            "border, 1, 10, default"
-            "borderangle, 1, 8, default"
-            "fade, 1, 7, default"
-            "workspaces, 1, 6, default"
-          ];
-        };
-
-        dwindle = {
-          pseudotile = true;
-          preserve_split = true;
-        };
-
-        master = {
-          new_status = "master";
-        };
-
-        device = [
-          {
-            name = "epic-mouse-v1";
-            sensitivity = -0.5;
-          }
-          {
-            name = "zsa-technology-labs-moonlander-mark-i";
-            kb_layout = "us";
-          }
-          {
-            name = "keychron-keychron-k7";
-            kb_layout = "us";
-          }
-        ];
-
-        windowrule = [
-          "match:class file_progress, float on"
-          "match:class confirm, float on"
-          "match:class dialog, float on"
-          "match:class download, float on"
-          "match:class notification, float on"
-          "match:class error, float on"
-          "match:class splash, float on"
-          "match:class confirmreset, float on"
-          "match:title Open File, float on"
-          "match:title branchdialog, float on"
-          "match:class pavucontrol-qt, float on"
-          "match:class pavucontrol, float on"
-          "match:class class:^(espanso)$, float on"
-          "match:class wlogout, fullscreen on"
-          "match:title wlogout, float on"
-          "match:title wlogout, fullscreen on"
-          "match:class mpv, float on"
-          "match:class mpv, idle_inhibit focus"
-          "match:class mpv, opacity 1.0 override"
-          "match:title ^(Media viewer)$, float on"
-          "match:title ^(Volume Control)$, float on"
-          "match:title ^(Picture-in-Picture)$, float on"
-          "match:title ^(floating-pomodoro)$, float on"
-          "match:title ^(floating-pomodoro)$, size 250 50"
-          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
-          "match:title ^(floating-pomodoro)$, pin on"
-          "match:initial_title .*streamlabs.com.*, float on"
-          "match:initial_title .*streamlabs.com.*, pin on"
-          "match:initial_title .*streamlabs.com.*, size 800 400"
-          "match:initial_title .*alert-box.*, move 100%-820 102"
-          "match:initial_title .*chat-box.*, move 100%-820 512"
-          "match:initial_title .*streamlabs.com.*, opacity 0.5 override"
-          "match:initial_title .*streamlabs.com.*, idle_inhibit focus"
-          "match:initial_title .*streamlabs.com.*, no_anim on"
-          "match:initial_title .*streamlabs.com.*, decorate off"
-          "match:initial_title .*streamlabs.com.*, no_shadow on"
-          "match:initial_title .*streamlabs.com.*, no_blur on"
-          "match:class ^vibe-typer$, match:title ^Recording Indicator$, no_blur on"
-          "border_color rgb(ffffff), match:xwayland 1"
-        ];
-
-        "$mainMod" = "SUPER";
-        "$terminal" = "ghostty";
-
-        bind = [
-          "$mainMod, return, exec, $terminal nu -c zellij-ps"
-          "$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
-          "$mainMod SHIFT, t, exec, launch-timer"
-          "$mainMod, n, exec, $terminal -e nvim"
-          "$mainMod, z, exec, uwsm app -- zeditor"
-          "$mainMod, o, exec, hyprctl dispatch setprop activewindow opaque toggle"
-          "$mainMod, r, exec, hyprctl dispatch focuswindow \"initialtitle:.*alert-box.*\" && hyprctl dispatch moveactive exact 4300 102 && hyprctl dispatch focuswindow \"initialtitle:.*chat-box.*\" && hyprctl dispatch moveactive exact 4300 512"
-          "$mainMod, b, exec, uwsm app -- thunar"
-          "$mainMod SHIFT, B, exec, uwsm app -- vivaldi"
-          "$mainMod, Escape, exec, uwsm app -- wlogout -p layer-shell"
-          "$mainMod, Space, togglefloating"
-          "$mainMod, q, killactive"
-          "$mainMod, M, exit"
-          "$mainMod, F, fullscreen"
-          "$mainMod SHIFT, V, togglefloating"
-          "$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
-          "$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
-          "$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
-          "$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
-          "$mainMod, P, exec, uwsm app -- rofi-pass"
-          "$mainMod SHIFT, P, pseudo"
-          "$mainMod, R, exec, stt-ptt start"
-          "$mainMod, S, exec, stt-ptt start"
-          "$mainMod, J, togglesplit"
-          "$mainMod, h, movefocus, l"
-          "$mainMod, l, movefocus, r"
-          "$mainMod, k, movefocus, u"
-          "$mainMod, j, movefocus, d"
-          "$mainMod, 1, workspace, 1"
-          "$mainMod, 2, workspace, 2"
-          "$mainMod, 3, workspace, 3"
-          "$mainMod, 4, workspace, 4"
-          "$mainMod, 5, workspace, 5"
-          "$mainMod, 6, workspace, 6"
-          "$mainMod, 7, workspace, 7"
-          "$mainMod, 8, workspace, 8"
-          "$mainMod, 9, workspace, 9"
-          "$mainMod, 0, workspace, 10"
-          "$mainMod SHIFT, 1, movetoworkspace, 1"
-          "$mainMod SHIFT, 2, movetoworkspace, 2"
-          "$mainMod SHIFT, 3, movetoworkspace, 3"
-          "$mainMod SHIFT, 4, movetoworkspace, 4"
-          "$mainMod SHIFT, 5, movetoworkspace, 5"
-          "$mainMod SHIFT, 6, movetoworkspace, 6"
-          "$mainMod SHIFT, 7, movetoworkspace, 7"
-          "$mainMod SHIFT, 8, movetoworkspace, 8"
-          "$mainMod SHIFT, 9, movetoworkspace, 9"
-          "$mainMod SHIFT, 0, movetoworkspace, 10"
-          "$mainMod, mouse_down, workspace, e+1"
-          "$mainMod, mouse_up, workspace, e-1"
-        ];
-
-        bindr = [
-          "$mainMod, R, exec, stt-ptt stop"
-          "$mainMod, S, exec, stt-ptt format-stop"
-        ];
-
-        bindm = [
-          "$mainMod, mouse:272, movewindow"
-          "$mainMod, mouse:273, resizewindow"
-        ];
-      };
-    };
-
-    services.hypridle = {
-      enable = true;
-      settings = {
-        general = {
-          before_sleep_cmd = "hyprlock";
-          after_sleep_cmd = "hyprctl dispatch dpms on";
-          inhibit_sleep = 3;
-        };
-        listener = [
-          {
-            timeout = 300;
-            on-timeout = "hyprlock";
-          }
-          {
-            timeout = 420;
-            on-timeout = "hyprctl dispatch dpms off";
-            on-resume = "hyprctl dispatch dpms on";
-          }
-        ];
-      };
-    };
-
-    services.hyprpaper.enable = true;
-
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        "$font" = "JetBrainsMono Nerd Font";
-        "$base" = "rgb(${config.colorScheme.palette.base00})";
-        "$text" = "rgb(${config.colorScheme.palette.base05})";
-        "$textAlpha" = "${config.colorScheme.palette.base05}";
-        "$accentAlpha" = "${config.colorScheme.palette.base0D}";
-        "$red" = "rgb(${config.colorScheme.palette.base08})";
-        "$yellow" = "rgb(${config.colorScheme.palette.base0A})";
-
-        general = {
-          hide_cursor = true;
-        };
-
-        background = {
-          monitor = "";
-          path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
-          blur_passes = 0;
-          color = "rgb(${config.colorScheme.palette.base00})";
-        };
-
-        label = [
-          {
-            monitor = "";
-            text = "$TIME";
-            color = "$text";
-            font_size = 90;
-            font_family = "$font";
-            position = "30, 0";
-            halign = "left";
-            valign = "top";
-          }
-          {
-            monitor = "";
-            text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
-            color = "$text";
-            font_size = 25;
-            font_family = "$font";
-            position = "30, -150";
-            halign = "left";
-            valign = "top";
-          }
-        ];
-
-        input-field = [
-          {
-            monitor = "";
-            size = "300, 60";
-            outline_thickness = 4;
-            dots_size = 0.2;
-            dots_spacing = 0.2;
-            dots_center = true;
-            outer_color = "rgb(${config.colorScheme.palette.base0D})";
-            inner_color = "rgb(${config.colorScheme.palette.base00})";
-            font_color = "rgb(${config.colorScheme.palette.base05})";
-            fade_on_empty = false;
-            placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}">󰌾  Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
-            hide_input = false;
-            check_color = "rgb(${config.colorScheme.palette.base0D})";
-            fail_color = "rgb(${config.colorScheme.palette.base08})";
-            fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
-            capslock_color = "rgb(${config.colorScheme.palette.base0A})";
-            position = "0, -35";
-            halign = "center";
-            valign = "center";
-          }
-        ];
-      };
-    };
-  };
-}

home/desktop/wm/rofi.nix

@@ -1,207 +0,0 @@
-# Rofi application launcher with nix-colors theme, pass integration, and project opener.
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.wm.rofi;
-in {
-  options.desktop.wm.rofi.enable = mkEnableOption "enable rofi";
-
-  config = mkIf cfg.enable {
-    programs.rofi = {
-      enable = true;
-      package = pkgs.rofi.override {
-        plugins = [
-          pkgs.rofi-calc
-          pkgs.rofi-emoji
-          pkgs.stable.rofi-file-browser
-        ];
-      };
-      pass = {
-        enable = true;
-        package = pkgs.rofi-pass-wayland;
-      };
-      terminal = "${pkgs.ghostty}/bin/ghostty";
-      font = "Fira Code";
-      extraConfig = {
-        show-icons = true;
-        disable-history = false;
-        modi = "drun,calc,emoji,filebrowser";
-        kb-primary-paste = "Control+V,Shift+Insert";
-        kb-secondary-paste = "Control+v,Insert";
-      };
-      theme = let
-        inherit (config.colorScheme) palette;
-      in
-        builtins.toString (pkgs.writeText "rofi-universal-theme.rasi" ''
-          * {
-            /* Universal theme colors from nix-colors */
-            background:  #${palette.base00};
-            surface:     #${palette.base01};
-            overlay:     #${palette.base02};
-            muted:       #${palette.base03};
-            subtle:      #${palette.base04};
-            text:        #${palette.base05};
-            bright-text: #${palette.base06};
-            highlight:   #${palette.base07};
-            accent1:     #${palette.base08};
-            accent2:     #${palette.base09};
-            accent3:     #${palette.base0A};
-            accent4:     #${palette.base0B};
-            accent5:     #${palette.base0C};
-            accent6:     #${palette.base0D};
-            accent7:     #${palette.base0E};
-            accent8:     #${palette.base0F};
-
-            /* Global properties */
-            background-color: @background;
-            text-color: @text;
-            font: "Fira Code 12";
-            border: 0;
-            margin: 0;
-            padding: 0;
-            spacing: 0;
-          }
-
-          window {
-            background-color: @background;
-            border: 1px;
-            border-color: @accent7;
-            border-radius: 6px;
-            width: 40%;
-            padding: 16px;
-          }
-
-          inputbar {
-            children: [ prompt, entry ];
-            spacing: 12px;
-            padding: 8px;
-            border-radius: 4px;
-            background-color: @surface;
-          }
-
-          prompt {
-            text-color: @accent7;
-            background-color: transparent;
-          }
-
-          entry {
-            placeholder: "Search...";
-            placeholder-color: @subtle;
-            text-color: @text;
-            background-color: transparent;
-            cursor-color: @accent7;
-          }
-
-          message {
-            background-color: @surface;
-            border-radius: 4px;
-            padding: 8px;
-            margin: 8px 0;
-          }
-
-          textbox {
-            text-color: @text;
-            background-color: transparent;
-          }
-
-          listview {
-            background-color: transparent;
-            margin: 8px 0 0;
-            lines: 10;
-            columns: 1;
-            fixed-height: true;
-            scrollbar: false;
-          }
-
-          element {
-            background-color: transparent;
-            text-color: @text;
-            padding: 8px;
-            border-radius: 4px;
-            spacing: 8px;
-          }
-
-          element normal.normal {
-            background-color: transparent;
-            text-color: @text;
-          }
-
-          element selected.normal {
-            background-color: @accent7;
-            text-color: @background;
-          }
-
-          element alternate.normal {
-            background-color: transparent;
-            text-color: @text;
-          }
-
-          element-icon {
-            background-color: transparent;
-            size: 24px;
-          }
-
-          element-text {
-            background-color: transparent;
-            text-color: inherit;
-            vertical-align: 0.5;
-          }
-
-          mode-switcher {
-            spacing: 0;
-            background-color: @surface;
-            border-radius: 4px;
-            margin: 8px 0 0;
-          }
-
-          button {
-            padding: 8px 16px;
-            background-color: transparent;
-            text-color: @text;
-            border-radius: 4px;
-          }
-
-          button selected {
-            background-color: @accent7;
-            text-color: @background;
-          }
-
-          scrollbar {
-            width: 4px;
-            border: 0;
-            handle-color: @accent7;
-            handle-width: 4px;
-            padding: 0;
-          }
-        '');
-    };
-
-    cli.rofi-project-opener = {
-      enable = true;
-      projectDirs = {
-        AI = {
-          path = "~/p/AI";
-          args = "";
-        };
-        CHAT = {
-          path = "~/p/CHAT";
-          args = "--agent chiron";
-        };
-        MISC = {
-          path = "~/p/MISC";
-          args = "--agent chiron-forge";
-        };
-        NIX = {
-          path = "~/p/NIX";
-          args = "";
-        };
-      };
-      terminal = pkgs.ghostty;
-      terminalCommand = "opencode %a";
-    };
-  };
-}

home/desktop/wm/wayland.nix

@@ -1,30 +0,0 @@
-# Wayland extra tooling — screenshot, clipboard, cursor, and display utilities.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.desktop.wm.wayland;
-in {
-  options.desktop.wm.wayland.enable = mkEnableOption "wayland extra tools and config";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      grim
-      hyprcursor
-      hyprlock
-      hyprpaper
-      qt6.qtwayland
-      slurp
-      waypipe
-      wl-clipboard
-      wf-recorder
-      wl-mirror
-      wlogout
-      wtype
-      ydotool
-    ];
-  };
-}

home/lib/default.nix

@@ -1,95 +0,0 @@
-# home/lib/default.nix
-# Profile loading utilities for home-manager configurations.
-#
-# Usage:
-#   let homeLib = import ../lib { inherit lib; };
-#   in {
-#     imports = [
-#       (homeLib.mkHomeConfig { profiles = ["coding" "gaming"]; context = "desktop"; })
-#     ];
-#   }
-{lib}: let
-  # Infrastructure layer — nixpkgs overlays, nix-colors, m3ta-nixpkgs modules.
-  # Always loaded on every host.
-  commonModule = ../common;
-
-  # Base user environment — shell (nushell, starship), CLI tools, secrets.
-  # Always loaded on every host.
-  baseModule = ../base;
-
-  # Context-specific modules — desktop and server are mutually exclusive.
-  contextModuleMap = {
-    desktop = ../desktop;
-    server = ../server;
-  };
-
-  # Profile modules — freely combinable additions on top of base + context.
-  profileModuleMap = {
-    coding = ../coding;
-    gaming = ../profiles/gaming;
-    media = ../profiles/media;
-  };
-in {
-  # Generate a home-manager module with imports based on profiles and context.
-  #
-  # Args:
-  #   profiles: list of profile names (e.g. ["coding" "gaming" "media"])
-  #   context: host context, one of "desktop" | "server" | null
-  #
-  # Returns: a home-manager module attrset with imports and assertions.
-  #   Desktop and server contexts are mutually exclusive by design — passing
-  #   any value other than "desktop", "server", or null causes an assertion
-  #   failure at evaluation time.
-  mkHomeConfig = {
-    profiles ? [],
-    context ? null,
-  }: let
-    contextImport =
-      if context == "desktop"
-      then [contextModuleMap.desktop]
-      else if context == "server"
-      then [contextModuleMap.server]
-      else [];
-
-    # Partition profiles into known and unknown for assertion + safe import.
-    unknownProfiles =
-      builtins.filter
-      (profileName: ! builtins.hasAttr profileName profileModuleMap)
-      profiles;
-
-    # Only import known profiles; the assertion below catches unknowns.
-    activeProfiles =
-      builtins.filter
-      (profileName: builtins.hasAttr profileName profileModuleMap)
-      profiles;
-
-    profileImports = map (profileName: profileModuleMap.${profileName}) activeProfiles;
-
-    contextStr =
-      if context == null
-      then "null"
-      else context;
-  in {
-    imports =
-      [commonModule baseModule]
-      ++ contextImport
-      ++ profileImports;
-
-    assertions = [
-      {
-        assertion = builtins.elem context ["desktop" "server" null];
-        message =
-          "m3ta home: context must be 'desktop', 'server', or null"
-          + " (got: '${contextStr}')";
-      }
-      {
-        assertion = unknownProfiles == [];
-        message =
-          "m3ta home: unknown profiles requested:"
-          + " [ ${builtins.concatStringsSep " " unknownProfiles} ]."
-          + " Valid profiles are:"
-          + " [ ${builtins.concatStringsSep " " (builtins.attrNames profileModuleMap)} ]";
-      }
-    ];
-  };
-}

home/m3tam3re/home-server.nix

@@ -1,121 +0,0 @@
-# This is a default home.nix generated by the follwing hone-manager command
-#
-# home-manager init ./
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  # Home Manager needs a bit of information about you and the paths it should
-  # manage.
-  home.username = lib.mkDefault "your-name";
-  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
-
-  # This value determines the Home Manager release that your configuration is
-  # compatible with. This helps avoid breakage when a new Home Manager release
-  # introduces backwards incompatible changes.
-  #
-  # You should not change this value, even if you update Home Manager. If you do
-  # want to update the value, then make sure to first check the Home Manager
-  # release notes.
-  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
-
-  # The home.packages option allows you to install Nix packages into your
-  # environment.
-  home.packages = with pkgs; [
-    # # Adds the 'hello' command to your environment. It prints a friendly
-    # # "Hello, world!" when run.
-    # pkgs.hello
-
-    # # It is sometimes useful to fine-tune packages, for example, by applying
-    # # overrides. You can do that directly here, just don't forget the
-    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
-    # # fonts?
-    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
-
-    # # You can also create simple shell scripts directly inside your
-    # # configuration. For example, this adds a command 'my-hello' to your
-    # # environment:
-    # (pkgs.writeShellScriptBin "my-hello" ''
-    #   echo "Hello, ${config.home.username}!"
-    # '')
-  ];
-
-  # Home Manager is pretty good at managing dotfiles. The primary way to manage
-  # plain files is through 'home.file'.
-  home.file = {
-    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
-    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
-    # # symlink to the Nix store copy.
-    # ".screenrc".source = dotfiles/screenrc;
-
-    # # You can also set the file content immediately.
-    # ".gradle/gradle.properties".text = ''
-    #   org.gradle.console=verbose
-    #   org.gradle.daemon.idletimeout=3600000
-    # '';
-  };
-
-  # Home Manager can also manage your environment variables through
-  # 'home.sessionVariables'. If you don't want to manage your shell through Home
-  # Manager then you have to manually source 'hm-session-vars.sh' located at
-  # either
-  #
-  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
-  #
-  home.sessionVariables = {
-    # EDITOR = "emacs";
-  };
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
-
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        name = "m3tm3re";
-        email = "p@m3ta.dev";
-      };
-      core.excludesfile = "~/.gitignore_global";
-      init.defaultBranch = "master";
-      alias = {
-        st = "status";
-        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-      };
-    };
-  };
-  # programs.zellij-ps = {
-  #   enable = true;
-  #   projectFolders = [
-  #     "${config.home.homeDirectory}/p/c"
-  #     "${config.home.homeDirectory}/p"
-  #     "${config.home.homeDirectory}/.config"
-  #   ];
-  #   layout = ''
-  #     layout {
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:tab-bar"
-  #         }
-  #         pane size="70%" command="nvim"
-  #         pane split_direction="vertical" {
-  #             pane
-  #             pane command="unimatrix"
-  #         }
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:status-bar"
-  #         }
-  #     }
-  #   '';
-  # };
-}

home/m3tam3re/home.nix

@@ -1,262 +0,0 @@
-# This is a default home.nix generated by the follwing hone-manager command
-#
-# home-manager init ./
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  # Home Manager needs a bit of information about you and the paths it should
-  # manage.
-  home.username = lib.mkDefault "your-name";
-  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
-
-  # This value determines the Home Manager release that your configuration is
-  # compatible with. This helps avoid breakage when a new Home Manager release
-  # introduces backwards incompatible changes.
-  #
-  # You should not change this value, even if you update Home Manager. If you do
-  # want to update the value, then make sure to first check the Home Manager
-  # release notes.
-  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
-
-  # The home.packages option allows you to install Nix packages into your
-  # environment.
-  home.packages = with pkgs; [
-    libgtop
-    # # Adds the 'hello' command to your environment. It prints a friendly
-    # # "Hello, world!" when run.
-    # pkgs.hello
-
-    # # It is sometimes useful to fine-tune packages, for example, by applying
-    # # overrides. You can do that directly here, just don't forget the
-    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
-    # # fonts?
-    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
-
-    # # You can also create simple shell scripts directly inside your
-    # # configuration. For example, this adds a command 'my-hello' to your
-    # # environment:
-    # (pkgs.writeShellScriptBin "my-hello" ''
-    #   echo "Hello, ${config.home.username}!"
-    # '')
-  ];
-
-  # Home Manager is pretty good at managing dotfiles. The primary way to manage
-  # plain files is through 'home.file'.
-  home.file = {
-    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
-    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
-    # # symlink to the Nix store copy.
-    # ".screenrc".source = dotfiles/screenrc;
-
-    # # You can also set the file content immediately.
-    # ".gradle/gradle.properties".text = ''
-    #   org.gradle.console=verbose
-    #   org.gradle.daemon.idletimeout=3600000
-    # '';
-  };
-
-  # Home Manager can also manage your environment variables through
-  # 'home.sessionVariables'. If you don't want to manage your shell through Home
-  # Manager then you have to manually source 'hm-session-vars.sh' located at
-  # either
-  #
-  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
-  #
-  # or
-  #
-  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
-  #
-  home.sessionVariables = {
-    # EDITOR = "emacs";
-  };
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
-
-  services.cliphist = {
-    enable = true;
-    allowImages = true;
-  };
-
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        name = "m3tm3re";
-        email = "p@m3ta.dev";
-      };
-      core.excludesfile = "~/.gitignore_global";
-      init.defaultBranch = "master";
-      alias = {
-        st = "status";
-        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-      };
-    };
-  };
-
-  programs.difftastic.enable = true;
-
-  programs.jujutsu = {
-    enable = true;
-    settings = {
-      user = {
-        email = "m@m3tam3re.com";
-        name = "Sascha Koenig";
-      };
-    };
-  };
-
-  programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
-    matchBlocks = {
-      "AZ-CLD-1" = {
-        hostname = "152.53.186.119";
-        user = "sascha.koenig";
-        port = 2022;
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "AZ-PRM-1" = {
-        hostname = "192.168.152.76";
-        user = "sascha.koenig";
-        port = 2022;
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "github.com" = {
-        hostname = "github.com";
-        user = "m3tam3re";
-        port = 22;
-        identityFile = "~/.ssh/github";
-      };
-      "nikhil" = {
-        hostname = "91.99.176.80";
-        user = "nikhilmaddirala";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "code.m3ta.dev" = {
-        hostname = "code.m3ta.dev";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/gitea";
-      };
-      "git.az-gruppe.com" = {
-        hostname = "git.az-gruppe.com";
-        port = 2022;
-        user = "sascha.koenig";
-        identityFile = "~/.ssh/sascha.koenig";
-      };
-      "lkk-nix-1" = {
-        hostname = "89.58.10.189";
-        user = "lkk-admin";
-        identityFile = "~/.ssh/lkk-admin";
-      };
-      "m3-r1" = {
-        hostname = "202.61.226.110";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-test" = {
-        hostname = "192.168.122.215";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-1" = {
-        hostname = "192.168.0.24";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "lkk-prod-2" = {
-        hostname = "192.168.0.20";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-deck" = {
-        hostname = "192.168.178.193";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-kratos-vm" = {
-        hostname = "192.168.122.43";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-helios" = {
-        hostname = "192.168.178.210";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-ares" = {
-        hostname = "192.168.1.30";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-atlas" = {
-        hostname = "152.53.85.162";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-hermes" = {
-        hostname = "204.168.229.93";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-zelda" = {
-        hostname = "95.217.189.186";
-        user = "m3tam3re";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-skynet" = {
-        hostname = "m3-skynet";
-        user = "admin";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "m3-prox-1" = {
-        hostname = "192.168.1.110";
-        user = "root";
-        identityFile = "~/.ssh/m3tam3re";
-      };
-      "shp-old" = {
-        hostname = "95.217.3.250";
-        port = 2222;
-        user = "m3tam3re";
-        identityFile = "~/.ssh/self-host-playbook";
-      };
-      "shp-1" = {
-        hostname = "95.217.189.186";
-        port = 2222;
-        user = "m3tam3re";
-        identityFile = "~/.ssh/self-host-playbook";
-      };
-    };
-  };
-  # programs.zellij-ps = {
-  #   enable = true;
-  #   projectFolders = [
-  #     "${config.home.homeDirectory}/p/c"
-  #     "${config.home.homeDirectory}/p"
-  #     "${config.home.homeDirectory}/.config"
-  #   ];
-  #   layout = ''
-  #     layout {
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:tab-bar"
-  #         }
-  #         pane size="70%" command="nvim"
-  #         pane split_direction="vertical" {
-  #             pane
-  #             pane command="unimatrix"
-  #         }
-  #         pane size=1 borderless=true {
-  #             plugin location="zellij:status-bar"
-  #         }
-  #     }
-  #   '';
-  # };
-}

home/m3tam3re/m3-aether.nix

@@ -1,25 +0,0 @@
-# m3-aether — cloud VM.
-# Context: server | Profiles: (none)
-{lib, ...}: let
-  homeLib = import ../lib {inherit lib;};
-in {
-  imports = [
-    (homeLib.mkHomeConfig {
-      profiles = [];
-      context = "server";
-    })
-    ./home-server.nix
-  ];
-
-  # Base CLI tools (new namespace)
-  base = {
-    shell = {
-      fish.enable = true;
-      starship.enable = true;
-    };
-    cliTools = {
-      fzf.enable = true;
-      nitch.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-ares.nix

@@ -1,142 +0,0 @@
-# m3-ares — TUXEDO laptop desktop workstation.
-# Context: desktop | Profiles: coding, gaming, media
-{
-  config,
-  lib,
-  ...
-}: let
-  homeLib = import ../lib {inherit lib;};
-in
-  with lib; {
-    imports = [
-      (homeLib.mkHomeConfig {
-        profiles = ["coding" "gaming" "media"];
-        context = "desktop";
-      })
-      ./home.nix
-    ];
-
-    config = mkMerge [
-      {
-        # Base CLI tools (new namespace)
-        base = {
-          shell = {
-            fish.enable = true;
-            nushell.enable = true;
-            starship.enable = true;
-          };
-          cliTools = {
-            fzf.enable = true;
-            nitch.enable = true;
-            television.enable = true;
-          };
-          secrets.enable = true;
-        };
-
-        # Desktop features (new namespace)
-        desktop = {
-          wm = {
-            hyprland.enable = true;
-            rofi.enable = true;
-            wayland.enable = true;
-          };
-          apps = {
-            crypto.enable = true;
-            obsidian.enable = true;
-            office.enable = true;
-          };
-          theme = {
-            fonts.enable = true;
-            wallpapers.enable = true;
-          };
-        };
-
-        # Coding environment
-        coding = {
-          editors = {
-            neovim.enable = true;
-            zed.enable = true;
-          };
-          lsp.enable = true;
-          packages.enable = true;
-          languages = {
-            python.enable = true;
-            javascript.enable = true;
-            rustToolchain.enable = true;
-            go.enable = true;
-            typescript.enable = true;
-          };
-        };
-
-        # Gaming profile features
-        profiles.gaming = {
-          steam.enable = true;
-          gamescope.enable = true;
-        };
-
-        # Media profile features
-        profiles.media = {
-          obs.enable = true;
-          ffmpeg.enable = true;
-          kdenlive.enable = true;
-          ytDlp.enable = true;
-        };
-
-        xdg = {
-          enable = true;
-          configFile."mimeapps.list".force = true;
-          mimeApps = {
-            enable = true;
-            associations.added = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-            defaultApplications = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "application/md" = ["dev.zed.Zed.desktop"];
-              "application/text" = ["dev.zed.Zed.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-          };
-        };
-      }
-
-      # Host-specific Hyprland monitor and workspace layout
-      (mkIf config.desktop.wm.hyprland.enable {
-        wayland.windowManager.hyprland = {
-          enable = true;
-          settings = {
-            exec-once = ["tuxedo-backlight"];
-            monitor = [
-              "eDP-1,preferred,0x0,1.25"
-              "HDMI-A-1,1920x1080@120,2560x0,1"
-            ];
-            workspace = [
-              "1, monitor:eDP-1, default:true"
-              "2, monitor:eDP-1"
-              "3, monitor:eDP-1"
-              "4, monitor:HDMI-A-1,"
-              "5, monitor:HDMI-A-1,border:false,rounding:false"
-              "6, monitor:HDMI-A-1"
-            ];
-            windowrule = [
-              "match:class dev.zed.Zed, workspace 1"
-              "match:class Msty, workspace 1"
-              "match:class ^(com.obsproject.Studio)$, workspace 2"
-              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-              "match:class ^steam_app_\\d+$, fullscreen on"
-              "match:class ^steam_app_\\d+$, workspace 5"
-              "match:class ^steam_app_\\d+$, idle_inhibit focus"
-            ];
-          };
-        };
-      })
-    ];
-  }

home/m3tam3re/m3-atlas.nix

@@ -1,29 +0,0 @@
-# m3-atlas — primary server, Traefik hub and container host.
-# Context: server | Profiles: coding
-{lib, ...}: let
-  homeLib = import ../lib {inherit lib;};
-in {
-  imports = [
-    (homeLib.mkHomeConfig {
-      profiles = ["coding"];
-      context = "server";
-    })
-    ./home-server.nix
-  ];
-
-  # Base CLI tools (new namespace)
-  base = {
-    shell = {
-      nushell.enable = true;
-      starship.enable = true;
-    };
-    cliTools = {
-      fzf.enable = true;
-      nitch.enable = true;
-      zellij.enable = true;
-    };
-  };
-
-  # Coding environment
-  coding.editors.neovim.enable = true;
-}

home/m3tam3re/m3-daedalus.nix

@@ -1,127 +0,0 @@
-# m3-daedalus — portable laptop (standalone home-manager).
-# Context: desktop | Profiles: coding, media
-{
-  config,
-  lib,
-  ...
-}: let
-  homeLib = import ../lib {inherit lib;};
-in
-  with lib; {
-    imports = [
-      (homeLib.mkHomeConfig {
-        profiles = ["coding" "media"];
-        context = "desktop";
-      })
-      ./home.nix
-    ];
-
-    config = mkMerge [
-      {
-        # Base CLI tools (new namespace)
-        base = {
-          shell = {
-            fish.enable = true;
-            nushell.enable = true;
-            starship.enable = true;
-          };
-          cliTools = {
-            fzf.enable = true;
-            nitch.enable = true;
-            television.enable = true;
-          };
-          secrets.enable = true;
-        };
-
-        # Desktop features (new namespace)
-        desktop = {
-          wm = {
-            hyprland.enable = false;
-            rofi.enable = true;
-            wayland.enable = false;
-          };
-          apps = {
-            obsidian.enable = true;
-            office.enable = false;
-            crypto.enable = false;
-          };
-          theme = {
-            fonts.enable = true;
-            wallpapers.enable = false;
-          };
-        };
-
-        # Coding environment
-        coding = {
-          editors = {
-            neovim.enable = true;
-            zed.enable = true;
-          };
-          lsp.enable = true;
-        };
-
-        # Media profile features
-        profiles.media = {
-          obs.enable = false;
-          ffmpeg.enable = false;
-          kdenlive.enable = false;
-          ytDlp.enable = true;
-        };
-
-        xdg = {
-          enable = true;
-          configFile."mimeapps.list".force = true;
-          mimeApps = {
-            enable = true;
-            associations.added = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-            defaultApplications = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "application/md" = ["dev.zed.Zed.desktop"];
-              "application/text" = ["dev.zed.Zed.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-          };
-        };
-      }
-
-      # Host-specific Hyprland layout — only applies when hyprland is enabled
-      (mkIf config.desktop.wm.hyprland.enable {
-        wayland.windowManager.hyprland = {
-          enable = true;
-          settings = {
-            monitor = [
-              "eDP-1,preferred,0x0,1.25"
-              "HDMI-A-1,preferred,2560x0,1"
-            ];
-            workspace = [
-              "1, monitor:eDP-1, default:true"
-              "2, monitor:eDP-1"
-              "3, monitor:eDP-1"
-              "4, monitor:HDMI-A-1"
-              "5, monitor:HDMI-A-1,border:false,rounding:false"
-              "6, monitor:HDMI-A-1"
-            ];
-            windowrule = [
-              "match:class dev.zed.Zed, workspace 1"
-              "match:class Msty, workspace 1"
-              "match:class ^(com.obsproject.Studio)$, workspace 2"
-              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-              "match:class ^steam_app_\\d+$, fullscreen on"
-              "match:class ^steam_app_\\d+$, workspace 5"
-              "match:class ^steam_app_\\d+$, idle_inhibit focus"
-            ];
-          };
-        };
-      })
-    ];
-  }

home/m3tam3re/m3-helios.nix

@@ -1,25 +0,0 @@
-# m3-helios — AdGuard DNS and internal routing server.
-# Context: server | Profiles: (none)
-{lib, ...}: let
-  homeLib = import ../lib {inherit lib;};
-in {
-  imports = [
-    (homeLib.mkHomeConfig {
-      profiles = [];
-      context = "server";
-    })
-    ./home-server.nix
-  ];
-
-  # Base CLI tools (new namespace)
-  base = {
-    shell = {
-      fish.enable = true;
-      starship.enable = true;
-    };
-    cliTools = {
-      fzf.enable = true;
-      nitch.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-hermes.nix

@@ -1,25 +0,0 @@
-# m3-hermes — secondary server.
-# Context: server | Profiles: (none)
-{lib, ...}: let
-  homeLib = import ../lib {inherit lib;};
-in {
-  imports = [
-    (homeLib.mkHomeConfig {
-      profiles = [];
-      context = "server";
-    })
-    ./home-server.nix
-  ];
-
-  # Base CLI tools (new namespace)
-  base = {
-    shell = {
-      fish.enable = true;
-      starship.enable = true;
-    };
-    cliTools = {
-      fzf.enable = true;
-      nitch.enable = true;
-    };
-  };
-}

home/m3tam3re/m3-kratos.nix

@@ -1,138 +0,0 @@
-# m3-kratos — AMD desktop workstation.
-# Context: desktop | Profiles: coding, gaming, media
-{
-  config,
-  lib,
-  ...
-}: let
-  homeLib = import ../lib {inherit lib;};
-in
-  with lib; {
-    imports = [
-      (homeLib.mkHomeConfig {
-        profiles = ["coding" "gaming" "media"];
-        context = "desktop";
-      })
-      ./home.nix
-    ];
-
-    config = mkMerge [
-      {
-        # Base CLI tools (new namespace)
-        base = {
-          shell = {
-            nushell.enable = true;
-            starship.enable = true;
-          };
-          cliTools = {
-            fzf.enable = true;
-            nitch.enable = true;
-            television.enable = true;
-          };
-          secrets.enable = true;
-        };
-
-        # Desktop features (new namespace)
-        desktop = {
-          wm = {
-            hyprland.enable = true;
-            rofi.enable = true;
-            wayland.enable = true;
-          };
-          apps = {
-            crypto.enable = true;
-            obsidian.enable = true;
-            office.enable = true;
-          };
-          theme = {
-            fonts.enable = true;
-            wallpapers.enable = true;
-          };
-        };
-
-        # Coding environment
-        coding = {
-          editors = {
-            neovim.enable = true;
-            zed.enable = true;
-          };
-          lsp.enable = true;
-          languages = {
-            python.enable = true;
-            javascript.enable = true;
-            rustToolchain.enable = true;
-            go.enable = true;
-            typescript.enable = true;
-          };
-        };
-
-        # Gaming profile features
-        profiles.gaming = {
-          steam.enable = true;
-          gamescope.enable = true;
-        };
-
-        # Media profile features
-        profiles.media = {
-          obs.enable = true;
-          ffmpeg.enable = true;
-          kdenlive.enable = true;
-          ytDlp.enable = true;
-        };
-
-        xdg = {
-          enable = true;
-          configFile."mimeapps.list".force = true;
-          mimeApps = {
-            enable = true;
-            associations.added = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-            defaultApplications = {
-              "application/zip" = ["org.gnome.FileRoller.desktop"];
-              "application/csv" = ["calc.desktop"];
-              "application/pdf" = ["vivaldi-stable.desktop"];
-              "application/md" = ["dev.zed.Zed.desktop"];
-              "application/text" = ["dev.zed.Zed.desktop"];
-              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
-            };
-          };
-        };
-      }
-
-      # Host-specific Hyprland monitor and workspace layout (dual 1440p monitors)
-      (mkIf config.desktop.wm.hyprland.enable {
-        wayland.windowManager.hyprland = {
-          enable = true;
-          settings = {
-            monitor = [
-              "DP-1,2560x1440@144,0x0,1"
-              "DP-2,2560x1440@144,2560x0,1"
-            ];
-            workspace = [
-              "1, monitor:DP-1, default:true"
-              "2, monitor:DP-1"
-              "3, monitor:DP-1"
-              "4, monitor:DP-2"
-              "5, monitor:DP-2"
-              "6, monitor:DP-2"
-              "7, monitor:DP-2"
-            ];
-            windowrule = [
-              "match:class dev.zed.Zed, workspace 1"
-              "match:class Msty, workspace 1"
-              "match:class ^(com.obsproject.Studio)$, workspace 2"
-              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-              "match:class ^steam_app_\\d+$, idle_inhibit focus"
-            ];
-          };
-        };
-      })
-    ];
-  }

home/profiles/gaming/default.nix

@@ -1,8 +0,0 @@
-# Gaming profile aggregator — Steam platform, Gamescope session, and AMD GPU tools.
-{...}: {
-  imports = [
-    ./steam.nix
-    ./gamescope.nix
-    ./gpu.nix
-  ];
-}

home/profiles/gaming/gamescope.nix

@@ -1,16 +0,0 @@
-# Gamescope — Valve's micro-compositor for Steam gaming sessions.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.gaming.gamescope;
-in {
-  options.profiles.gaming.gamescope.enable = mkEnableOption "enable Gamescope session";
-
-  config = mkIf cfg.enable {
-    home.packages = [pkgs.gamescope];
-  };
-}

home/profiles/gaming/gpu.nix

@@ -1,21 +0,0 @@
-# AMD GPU tools — ROCm runtime, monitoring, and Vulkan utilities for gaming.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.gaming.gpu;
-in {
-  options.profiles.gaming.gpu.enable = mkEnableOption "enable AMD GPU tools";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      rocmPackages.rocm-runtime
-      rocmPackages.rocm-smi
-      rocmPackages.rocminfo
-      vulkan-tools
-    ];
-  };
-}

home/profiles/gaming/steam.nix

@@ -1,21 +0,0 @@
-# Steam gaming platform with Steam Deck compatibility tools and gaming utilities.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.gaming.steam;
-in {
-  options.profiles.gaming.steam.enable = mkEnableOption "enable Steam gaming";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      gamemode
-      goverlay
-      mangohud
-      protonplus
-    ];
-  };
-}

home/profiles/media/default.nix

@@ -1,10 +0,0 @@
-# Media profile aggregator — OBS, FFmpeg, yt-dlp, Kdenlive, and HandBrake.
-{...}: {
-  imports = [
-    ./obs.nix
-    ./ffmpeg.nix
-    ./yt-dlp.nix
-    ./kdenlive.nix
-    ./handbrake.nix
-  ];
-}

home/profiles/media/ffmpeg.nix

@@ -1,24 +0,0 @@
-# FFmpeg — full-featured multimedia processing toolchain.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.media.ffmpeg;
-in {
-  options.profiles.media.ffmpeg.enable = mkEnableOption "enable FFmpeg tools";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      amf
-      ffmpeg_6-full
-      gst_all_1.gstreamer
-      gst_all_1.gst-vaapi
-      pamixer
-      pavucontrol
-      qpwgraph
-    ];
-  };
-}

home/profiles/media/handbrake.nix

@@ -1,21 +0,0 @@
-# HandBrake — open-source video transcoder.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.media.handbrake;
-in {
-  options.profiles.media.handbrake.enable = mkEnableOption "enable HandBrake transcoder";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      handbrake
-      gimp
-      inkscape
-      libation
-    ];
-  };
-}

home/profiles/media/kdenlive.nix

@@ -1,16 +0,0 @@
-# Kdenlive — KDE non-linear video editor.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.media.kdenlive;
-in {
-  options.profiles.media.kdenlive.enable = mkEnableOption "enable Kdenlive video editor";
-
-  config = mkIf cfg.enable {
-    home.packages = [pkgs.kdePackages.kdenlive];
-  };
-}

home/profiles/media/obs.nix

@@ -1,21 +0,0 @@
-# OBS Studio — open broadcaster software for streaming and recording.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.media.obs;
-in {
-  options.profiles.media.obs.enable = mkEnableOption "enable OBS Studio";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      v4l-utils
-    ];
-
-    # OBS is managed via NixOS programs.obs-studio at the system level.
-    # Home-manager only installs supporting tools.
-  };
-}

home/profiles/media/yt-dlp.nix

@@ -1,32 +0,0 @@
-# yt-dlp and media playback — YouTube downloader with MPV integration.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.profiles.media.ytDlp;
-in {
-  options.profiles.media.ytDlp.enable = mkEnableOption "enable yt-dlp and media playback";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      plexamp
-      unimatrix
-      webcord
-    ];
-
-    programs.mpv = {
-      enable = true;
-      bindings = {
-        WHEEL_UP = "seek 10";
-        WHEEL_DOWN = "seek -10";
-      };
-      config = {
-        profile = "gpu-hq";
-        ytdl-format = "bestvideo+bestaudio";
-      };
-    };
-  };
-}

home/server/default.nix

@@ -1,6 +0,0 @@
-# Server context home-manager configuration — minimal headless setup.
-# Loaded on server hosts: m3-atlas, m3-helios, m3-aether.
-{...}: {
-  # Server hosts use the base and coding modules directly.
-  # No desktop environment or GUI applications.
-}

hosts/common/default.nix

@@ -18,6 +18,7 @@
   environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
 
   home-manager = {
+    useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {
       inherit inputs outputs system;

hosts/common/users/m3tam3re.nix

@@ -1,11 +1,214 @@
+# hosts/common/users/m3tam3re.nix — Central user definition with m3ta-home integration.
+#
+# This module:
+#   1. Creates the m3tam3re NixOS user
+#   2. Loads the m3ta-home profile system via mkHome
+#   3. Sets per-host feature flags based on a host profile mapping
+#   4. Imports per-host home.nix overrides (monitors, HW-specific config)
+#
+# To add a new host:
+#   1. Add entry to hostProfiles below
+#   2. Add feature flags in the hostFlags section
+#   3. Create hosts/<hostname>/home.nix if the host needs overrides (monitors, etc.)
 {
   config,
   pkgs,
   inputs,
   ...
-}: {
+}: let
+  hostname = config.networking.hostName;
+
+  # ── Per-host profile mapping ──
+  # Determines which m3ta-home context and sets each host gets.
+  hostProfiles = {
+    # ── Desktop hosts ──
+    m3-ares = {
+      context = "desktop";
+      sets = ["coding" "gaming" "media"];
+    };
+    m3-kratos = {
+      context = "desktop";
+      sets = ["coding" "gaming" "media"];
+    };
+    m3-daedalus = {
+      context = "desktop";
+      sets = ["coding" "media"];
+    };
+    # ── Server hosts ──
+    m3-atlas = {
+      context = "server";
+      sets = [];
+    };
+    m3-helios = {
+      context = "server";
+      sets = [];
+    };
+    m3-hermes = {
+      context = "server";
+      sets = [];
+    };
+    m3-aether = {
+      context = "server";
+      sets = [];
+    };
+  };
+
+  profile =
+    hostProfiles.${
+      hostname
+    } or {
+      context = "server";
+      sets = [];
+    };
+  m3ta-lib = inputs.m3ta-home.lib;
+
+  # Check if a per-host home.nix exists
+  hostHomeFile = ./../../${hostname}/home.nix;
+  hostHomeExists = builtins.pathExists hostHomeFile;
+
+  # ── Per-host feature flags ──
+  # These enable/disable specific m3ta-home modules per host.
+  hostFlags =
+    if hostname == "m3-ares" || hostname == "m3-kratos"
+    then {
+      # Full desktop workstation
+      base = {
+        shell = {
+          fish.enable = true;
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          television.enable = true;
+        };
+        secrets.enable = true;
+      };
+      desktop = {
+        wm = {
+          hyprland.enable = true;
+          rofi.enable = true;
+          wayland.enable = true;
+        };
+        apps = {
+          crypto.enable = true;
+          obsidian.enable = true;
+          office.enable = true;
+        };
+        theme = {
+          fonts.enable = true;
+          wallpapers.enable = true;
+        };
+      };
+      coding = {
+        editors = {
+          neovim.enable = true;
+          zed.enable = true;
+        };
+        lsp.enable = true;
+        packages.enable = true;
+        languages = {
+          python.enable = true;
+          javascript.enable = true;
+          rustToolchain.enable = true;
+          go.enable = true;
+          typescript.enable = true;
+        };
+      };
+      profiles.gaming = {
+        steam.enable = true;
+        gamescope.enable = true;
+      };
+      profiles.media = {
+        obs.enable = true;
+        ffmpeg.enable = true;
+        kdenlive.enable = true;
+        ytDlp.enable = true;
+      };
+    }
+    else if hostname == "m3-daedalus"
+    then {
+      # Portable laptop — desktop without gaming, no Hyprland
+      base = {
+        shell = {
+          fish.enable = true;
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          television.enable = true;
+        };
+        secrets.enable = true;
+      };
+      desktop = {
+        wm = {
+          hyprland.enable = false;
+          wayland.enable = false;
+        };
+        apps = {
+          crypto.enable = false;
+          obsidian.enable = true;
+          office.enable = false;
+        };
+        theme = {
+          fonts.enable = true;
+          wallpapers.enable = false;
+        };
+      };
+      coding = {
+        editors = {
+          neovim.enable = true;
+          zed.enable = true;
+        };
+        lsp.enable = true;
+        packages.enable = true;
+        languages = {
+          python.enable = true;
+          javascript.enable = true;
+          rustToolchain.enable = true;
+          go.enable = true;
+          typescript.enable = true;
+        };
+      };
+      profiles.media = {
+        ytDlp.enable = true;
+      };
+    }
+    else if hostname == "m3-atlas"
+    then {
+      # Primary server — coding capable
+      base = {
+        shell = {
+          nushell.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+          zellij.enable = true;
+        };
+      };
+      coding.editors.neovim.enable = true;
+    }
+    else {
+      # m3-helios, m3-hermes, m3-aether — minimal server
+      base = {
+        shell = {
+          fish.enable = true;
+          starship.enable = true;
+        };
+        cliTools = {
+          fzf.enable = true;
+          nitch.enable = true;
+        };
+      };
+    };
+in {
+  # ── NixOS user definition ──
   users.users.m3tam3re = {
-    #initialHashedPassword = "$y$j9T$IoChbWGYRh.rKfmm0G86X0$bYgsWqDRkvX.EBzJTX.Z0RsTlwspADpvEF3QErNyCMC";
     password = "12345";
     isNormalUser = true;
     description = "m3tam3re";
@@ -29,6 +232,25 @@
     ];
     packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
   };
-  home-manager.users.m3tam3re =
+
-    import ../../../home/m3tam3re/${config.networking.hostName}.nix;
+  # ── Home-Manager configuration via m3ta-home ──
+  home-manager.users.m3tam3re = {
+    imports =
+      [
+        # Load m3ta-home composition engine
+        (m3ta-lib.mkHome {
+          user = "m3tam3re";
+          identity = "private";
+          inherit (profile) context sets;
+        })
+        # Per-host feature flags
+        hostFlags
+      ]
+      # Per-host home.nix (Hyprland monitors, XDG/MIME, HW-specific overrides)
+      ++ (
+        if hostHomeExists
+        then [hostHomeFile]
+        else []
+      );
+  };
 }

hosts/m3-ares/home.nix

@@ -0,0 +1,75 @@
+# hosts/m3-ares/home.nix — Host-specific home-manager overrides.
+# TUXEDO laptop: eDP-1 + HDMI-A-1 external monitor.
+# Everything else (shell, editors, gaming, media, theme, etc.) comes from
+# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = mkMerge [
+    # ── XDG / MIME defaults ──
+    {
+      xdg = {
+        enable = true;
+        configFile."mimeapps.list".force = true;
+        mimeApps = {
+          enable = true;
+          associations.added = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+          defaultApplications = {
+            "application/zip" = ["org.gnome.FileRoller.desktop"];
+            "application/csv" = ["calc.desktop"];
+            "application/pdf" = ["vivaldi-stable.desktop"];
+            "application/md" = ["dev.zed.Zed.desktop"];
+            "application/text" = ["dev.zed.Zed.desktop"];
+            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          };
+        };
+      };
+    }
+
+    # ── Hyprland monitor layout & host-specific rules ──
+    (mkIf config.desktop.wm.hyprland.enable {
+      wayland.windowManager.hyprland = {
+        enable = true;
+        settings = {
+          # Laptop internal + external HDMI
+          monitor = [
+            { output = "eDP-1";     mode = "preferred";       position = "0x0";     scale = 1.25; }
+            { output = "HDMI-A-1";  mode = "1920x1080@120";   position = "2560x0";  scale = 1; }
+          ];
+          workspace_rule = [
+            { workspace = 1; monitor = "eDP-1";    default = true; }
+            { workspace = 2; monitor = "eDP-1"; }
+            { workspace = 3; monitor = "eDP-1"; }
+            { workspace = 4; monitor = "HDMI-A-1"; }
+            { workspace = 5; monitor = "HDMI-A-1"; border = false; rounding = false; }
+            { workspace = 6; monitor = "HDMI-A-1"; }
+          ];
+          window_rule = [
+            { match = { class = "dev.zed.Zed" };            workspace = "1"; }
+            { match = { class = "Msty" };                    workspace = "1"; }
+            { match = { class = "^com.obsproject.Studio$" }; workspace = "2"; }
+            { match = { class = "^(brave-browser)$" };      workspace = "4"; opacity = 1.0; }
+            { match = { class = "^(vivaldi-stable)$" };     workspace = "4"; opacity = 1.0; }
+            { match = { class = "^steam_app_\\d+$" };       fullscreen = true; workspace = "5"; idle_inhibit = "focus"; }
+          ];
+        };
+        extraConfig = mkAfter ''
+          -- Host startup: TUXEDO backlight
+          hl.on("hyprland.start", function()
+            hl.exec_cmd("tuxedo-backlight")
+          end)
+        '';
+      };
+    })
+  ];
+}

hosts/m3-atlas/secrets.nix

@@ -10,6 +10,8 @@
       kestra-env = {file = ../../secrets/kestra-env.age;};
       littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
       minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
+      rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
+      rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
       n8n-env = {file = ../../secrets/n8n-env.age;};
       netbird-auth-secret = {
         file = ../../secrets/netbird-auth-secret.age;

hosts/m3-atlas/services/default.nix

@@ -4,7 +4,7 @@
     ./containers
     ./gitea.nix
     ./gitea-actions-runner.nix
-    ./minio.nix
+    ./rustfs.nix
     ./mysql.nix
     ./netbird.nix
     ./n8n.nix

hosts/m3-atlas/services/hermes-agent.nix

@@ -1,191 +0,0 @@
-{config, ...}: let
-  # Default ElevenLabs voice: Bella (German-capable female)
-  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
-in {
-  services.hermes-agent = {
-    enable = true;
-    addToSystemPackages = true;
-
-    # Secrets via agenix
-    environmentFiles = [config.age.secrets."hermes-env".path];
-
-    # Non-secret environment variables
-    environment = {
-      #
-    };
-
-    # ── Container mode (podman) ──────────────────────────────────────────
-    container = {
-      enable = true;
-      backend = "podman";
-    };
-
-    settings = {
-      # ── Model ──────────────────────────────────────────────────────────
-      model = {
-        default = "glm-5.1";
-        provider = "zai";
-        base_url = "https://api.z.ai/api/coding/paas/v4/";
-      };
-
-      credential_pool_strategies = {
-        zai = "fill_first";
-      };
-
-      toolsets = ["all"];
-
-      # ── Agent ──────────────────────────────────────────────────────────
-      agent = {
-        max_turns = 90;
-        gateway_timeout = 1800;
-        tool_use_enforcement = "auto";
-      };
-
-      # ── Terminal ───────────────────────────────────────────────────────
-      terminal = {
-        backend = "local";
-        modal_mode = "auto";
-        cwd = ".";
-        timeout = 180;
-        persistent_shell = true;
-      };
-
-      # ── Browser ────────────────────────────────────────────────────────
-      browser = {
-        inactivity_timeout = 120;
-        command_timeout = 30;
-        cloud_provider = "local";
-      };
-
-      # ── Checkpoints / Compression ──────────────────────────────────────
-      checkpoints = {
-        enabled = true;
-        max_snapshots = 50;
-      };
-
-      file_read_max_chars = 100000;
-
-      compression = {
-        enabled = true;
-        threshold = 0.5;
-        target_ratio = 0.2;
-        protect_last_n = 20;
-      };
-
-      # ── Display ────────────────────────────────────────────────────────
-      display = {
-        compact = false;
-        personality = "kawaii";
-        resume_display = "full";
-        busy_input_mode = "interrupt";
-        inline_diffs = true;
-        skin = "default";
-        tool_progress = "all";
-      };
-
-      # ── TTS / STT / Voice ──────────────────────────────────────────────
-      tts = {
-        provider = "elevenlabs";
-        elevenlabs = {
-          voice_id = elevenlabsVoiceId;
-          model_id = "eleven_multilingual_v2";
-        };
-      };
-
-      stt = {
-        enabled = true;
-        provider = "local";
-        local = {model = "base";};
-      };
-
-      voice = {
-        record_key = "ctrl+b";
-        max_recording_seconds = 120;
-        silence_threshold = 200;
-        silence_duration = 3.0;
-      };
-
-      # ── Memory ─────────────────────────────────────────────────────────
-      memory = {
-        memory_enabled = true;
-        user_profile_enabled = true;
-        memory_char_limit = 2200;
-        user_char_limit = 1375;
-      };
-
-      # ── Delegation ─────────────────────────────────────────────────────
-      delegation = {
-        max_iterations = 50;
-      };
-
-      # ── Discord ────────────────────────────────────────────────────────
-      discord = {
-        require_mention = true;
-        auto_thread = true;
-        reactions = true;
-      };
-
-      # ── Approvals / Security ───────────────────────────────────────────
-      approvals = {
-        mode = "manual";
-        timeout = 60;
-      };
-
-      security = {
-        redact_secrets = true;
-        tirith_enabled = true;
-        tirith_fail_open = true;
-      };
-
-      # ── Cron / Session ─────────────────────────────────────────────────
-      cron = {wrap_response = true;};
-
-      session_reset = {
-        mode = "both";
-        idle_minutes = 1440;
-        at_hour = 4;
-      };
-
-      # ── Web ────────────────────────────────────────────────────────────
-      web = {backend = "exa";};
-
-      # ── Platform Toolsets ──────────────────────────────────────────────
-      platform_toolsets = {
-        cli = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-        telegram = [
-          "browser"
-          "clarify"
-          "code_execution"
-          "cronjob"
-          "delegation"
-          "file"
-          "image_gen"
-          "memory"
-          "session_search"
-          "skills"
-          "terminal"
-          "todo"
-          "tts"
-          "vision"
-          "web"
-        ];
-      };
-    };
-  };
-}

hosts/m3-atlas/services/rustfs.nix

@@ -1,14 +1,29 @@
-{config, ...}: {
+{
-  services.minio = {
+  config,
+  inputs,
+  pkgs,
+  ...
+}: {
+  services.rustfs = {
     enable = true;
-    region = "eu-central-1";
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    # Reuse existing MinIO data directory
+    volumes = "/var/storage/s3";
+
+    # Keep same ports as MinIO to avoid changing Traefik and client configs
+    address = ":3008";
+    consoleEnable = true;
     consoleAddress = ":3007";
-    listenAddress = ":3008";
+
-    browser = true;
+    # Credentials via agenix
-    rootCredentialsFile = config.age.secrets.minio-root-cred.path;
+    accessKeyFile = config.age.secrets.rustfs-access-key.path;
-    dataDir = ["/var/storage/s3"];
+    secretKeyFile = config.age.secrets.rustfs-secret-key.path;
+
+    logLevel = "info";
   };
-  # Traefik configuration specific to minio
+
+  # Traefik configuration — same routes as before
   services.traefik.dynamicConfigOptions.http = {
     services.minio-console.loadBalancer.servers = [
       {

hosts/m3-atlas/services/traefik.nix

@@ -43,6 +43,12 @@
     dynamicConfigOptions = {
       http = {
         services = {
+          # ── Hermes Dashboard (m3-hermes over Netbird) ────────────────
+          hermes-dashboard = {
+            loadBalancer.servers = [
+              {url = "http://100.81.231.152:9119";}
+            ];
+          };
           dummy = {
             loadBalancer.servers = [
               {url = "http://192.168.0.1";} # Diese URL wird nie verwendet
@@ -79,6 +85,15 @@
         };
 
         routers = {
+          # ── Hermes Dashboard — Netbird mesh only ─────────────────────
+          hermes-dashboard = {
+            rule = "Host(`dash.m3ta.dev`)";
+            service = "hermes-dashboard";
+            entrypoints = ["websecure"];
+            tls = {
+              certResolver = "godaddy";
+            };
+          };
           api = {
             rule = "Host(`r.m3tam3re.com`)";
             service = "api@internal";

hosts/m3-daedalus/home.nix

@@ -0,0 +1,37 @@
+# hosts/m3-daedalus/home.nix — Host-specific home-manager overrides.
+# Portable laptop: no Hyprland, no external monitors.
+# Everything else (shell, editors, media, theme, etc.) comes from
+# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  config = {
+    # ── XDG / MIME defaults ──
+    xdg = {
+      enable = true;
+      configFile."mimeapps.list".force = true;
+      mimeApps = {
+        enable = true;
+        associations.added = {
+          "application/zip" = ["org.gnome.FileRoller.desktop"];
+          "application/csv" = ["calc.desktop"];
+          "application/pdf" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+        };
+        defaultApplications = {
+          "application/zip" = ["org.gnome.FileRoller.desktop"];
+          "application/csv" = ["calc.desktop"];
+          "application/pdf" = ["vivaldi-stable.desktop"];
+          "application/md" = ["dev.zed.Zed.desktop"];
+          "application/text" = ["dev.zed.Zed.desktop"];
+          "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+          "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+        };
+      };
+    };
+  };
+}

hosts/m3-hermes/secrets.nix

@@ -7,6 +7,9 @@
       hermes-cloud-env = {
         file = ../../secrets/hermes-cloud-env.age;
       };
+      hermes-api-server-key = {
+        file = ../../secrets/hermes-api-server-key.age;
+      };
     };
   };
 }

hosts/m3-hermes/services/default.nix

@@ -1,5 +1,7 @@
 {
   imports = [
     ./hermes-agent.nix
+    ./hermes-dashboard.nix
+    ./netbird.nix
   ];
 }

hosts/m3-hermes/services/hermes-agent.nix

@@ -4,18 +4,19 @@
   inputs,
   ...
 }: let
-  # Edge TTS: Katja — warm, friendly German female voice (free, no API key)
+  # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
-  edgeVoice = "de-DE-KatjaNeural";
+  edgeVoice = "de-DE-SeraphinaMultilingualNeural";
 
   # Extra Python packages from the container's writable venv layer.
   # matrix-nio is installed via pip in /home/hermes/.venv but the hermes
   # process uses the read-only Nix store Python, so we inject the venv's
   # site-packages via PYTHONPATH and provide libstdc++ for libolm (e2e).
-  venvSitePackages = "/home/hermes/.venv/lib/python3.11/site-packages";
+  # NOTE: v0.13.0 upgraded to Python 3.12 — path updated accordingly.
+  venvSitePackages = "/home/hermes/.venv/lib/python3.12/site-packages";
   gccLibPath = "${pkgs.stdenv.cc.cc.lib}/lib";
 
   # Build skills using agents flake lib for hermes user
-  hermesSkills = inputs.agents.lib.mkOpencodeSkills {
+  hermesSkills = inputs.agents.lib.mkSkills {
     inherit pkgs;
     customSkills = "${inputs.agents}/skills";
     externalSkills = [
@@ -48,13 +49,6 @@ in {
           user: m3ta-chiron
           default: true
     ''}"
-    "f /home/hermes/.gitconfig 0644 hermes hermes - ${pkgs.writeText "gitconfig" ''
-      [user]
-        name = m3ta-chiron
-        email = m3ta-chiron@agentmail.to
-      [init]
-        defaultBranch = main
-    ''}"
   ];
 
   systemd.services.copy-hermes-skills = {
@@ -78,21 +72,40 @@ in {
     enable = true;
     addToSystemPackages = true;
 
-    extraPackages = with pkgs; [docker git tea];
+    extraPackages = with pkgs; [
+      docker
+      git
+      tea
+      nix
+      zellij
+    ];
 
     # Secrets via agenix
     environmentFiles = [
       config.age.secrets."hermes-env".path
       config.age.secrets."hermes-cloud-env".path
+      config.age.secrets."hermes-api-server-key".path
     ];
 
     # Non-secret environment variables
+    # Git identity is set entirely via env vars (GIT_AUTHOR_*, GIT_COMMITTER_*,
+    # GIT_INIT_DEFAULT_BRANCH) — no .gitconfig file needed. Env vars take
+    # precedence over any gitconfig, and the hermes gateway injects them into
+    # all terminal sessions via .env.
     environment = {
       GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
       GIT_AUTHOR_NAME = "m3ta-chiron";
       GIT_AUTHOR_EMAIL = "m3ta-chiron@agentmail.to";
       GIT_COMMITTER_NAME = "m3ta-chiron";
       GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
+      GIT_INIT_DEFAULT_BRANCH = "master";
+
+      # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
+      # Accessible via Netbird mesh VPN — not exposed to the public internet.
+      # Bind to 0.0.0.0 so the Netbird interface can reach it.
+      API_SERVER_ENABLED = "true";
+      API_SERVER_HOST = "0.0.0.0";
+      API_SERVER_PORT = "8642";
     };
 
     # ── Container mode (podman) ──────────────────────────────────────────
@@ -152,7 +165,8 @@ in {
         cloud_provider = "local";
       };
 
-      # ── Checkpoints / Compression ──────────────────────────────────────
+      # ── Checkpoints v2 ─────────────────────────────────────────────────
+      # v0.13.0: Single-store rewrite with real pruning + disk guardrails.
       checkpoints = {
         enabled = true;
         max_snapshots = 50;
@@ -215,12 +229,24 @@ in {
         max_spawn_depth = 2;
       };
 
+      # ── Kanban (v0.13.0 — Multi-Agent Board) ──────────────────────────
+      # Durable task board with embedded dispatcher in gateway process.
+      # Workers are full OS processes with identity, heartbeat, reclaim,
+      # zombie detection, and hallucination gate.
+      kanban = {
+        dispatch_in_gateway = true;
+        dispatch_interval_seconds = 60;
+      };
+
       # ── Matrix ────────────────────────────────────────────────────────
       matrix = {
         homeserver = "https://matrix.m3ta.dev";
         user_id = "@chiron:m3ta.dev";
         allowed_users = ["@m3tam3re:m3ta.dev"];
         encryption = true;
+        group_sessions_per_user = true;
+        auto_thread = true;
+        dm_mention_threads = true;
       };
 
       # ── Approvals / Security ───────────────────────────────────────────

hosts/m3-hermes/services/hermes-dashboard.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
+  # Netbird mesh VPN range — dashboard only accessible from mesh peers.
+  # m3-atlas Traefik proxies to this port over Netbird.
+  netbirdRange = "100.64.0.0/16";
+
+  # Reference the hermes-agent package from the running service config
+  hermesPkg = config.services.hermes-agent.package or (inputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default or pkgs.hermes-agent);
+in {
+  # ── Hermes Dashboard systemd service ───────────────────────────────────
+  # Web UI for managing Hermes Agent — sessions, config, kanban, cron, etc.
+  #
+  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :9119
+  #
+  # --insecure is required to bind 0.0.0.0 (hermes refuses non-localhost otherwise).
+  # Safe because firewall restricts port 9119 to Netbird mesh only.
+  systemd.services.hermes-dashboard = {
+    description = "Hermes Agent Web Dashboard";
+    after = ["network.target" "hermes-agent.service"];
+    wants = ["hermes-agent.service"];
+    wantedBy = ["multi-user.target"];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "hermes";
+      Group = "hermes";
+
+      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
+
+      # Environment matching the hermes-agent service
+      Environment = [
+        "HERMES_HOME=/var/lib/hermes/.hermes"
+        "HERMES_MANAGED=true"
+        "HOME=/var/lib/hermes"
+      ];
+
+      # Security hardening (matching hermes-agent service pattern)
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = "read-only";
+      ReadWritePaths = ["/var/lib/hermes" "/tmp"];
+      PrivateTmp = true;
+
+      # Restart policy
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+  };
+
+  # ── Firewall: Dashboard only from Netbird mesh ─────────────────────────
+  networking.firewall = {
+    extraCommands = ''
+      # Allow Hermes Dashboard (9119/tcp) only from Netbird mesh VPN
+      ip46tables -A nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept
+    '';
+
+    extraStopCommands = ''
+      ip46tables -D nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
+    '';
+  };
+}