chore: update dependencies, add basecamp secrets, improve desktop environment

- Update opencode to v1.1.34
- Add new opencode agents (Prometheus, Metis, Momus, Atlas) and categories
- Switch m3ta-nixpkgs back to local path
- Add basecamp client credentials for m3-ares and m3-kratos
- Set NIXOS_OZONE_WL=1 for better Wayland app support in Hyprland
- Remove redundant wrl.enable from flatpak portal config

.beads/.gitignore

@@ -0,0 +1,39 @@
+# SQLite databases
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+
+# Daemon runtime files
+daemon.lock
+daemon.log
+daemon.pid
+bd.sock
+sync-state.json
+last-touched
+
+# Local version tracking (prevents upgrade notification spam after git ops)
+.local_version
+
+# Legacy database files
+db.sqlite
+bd.db
+
+# Worktree redirect file (contains relative path to main repo's .beads/)
+# Must not be committed as paths would be wrong in other clones
+redirect
+
+# Merge artifacts (temporary files from 3-way merge)
+beads.base.jsonl
+beads.base.meta.json
+beads.left.jsonl
+beads.left.meta.json
+beads.right.jsonl
+beads.right.meta.json
+
+# NOTE: Do NOT add negation patterns (e.g., !issues.jsonl) here.
+# They would override fork protection in .git/info/exclude, allowing
+# contributors to accidentally commit upstream issue databases.
+# The JSONL files (issues.jsonl, interactions.jsonl) and config files
+# are tracked by git by default since no pattern above ignores them.

.beads/README.md

@@ -0,0 +1,81 @@
+# Beads - AI-Native Issue Tracking
+
+Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
+
+## What is Beads?
+
+Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
+
+**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
+
+## Quick Start
+
+### Essential Commands
+
+```bash
+# Create new issues
+bd create "Add user authentication"
+
+# View all issues
+bd list
+
+# View issue details
+bd show <issue-id>
+
+# Update issue status
+bd update <issue-id> --status in_progress
+bd update <issue-id> --status done
+
+# Sync with git remote
+bd sync
+```
+
+### Working with Issues
+
+Issues in Beads are:
+- **Git-native**: Stored in `.beads/issues.jsonl` and synced like code
+- **AI-friendly**: CLI-first design works perfectly with AI coding agents
+- **Branch-aware**: Issues can follow your branch workflow
+- **Always in sync**: Auto-syncs with your commits
+
+## Why Beads?
+
+✨ **AI-Native Design**
+- Built specifically for AI-assisted development workflows
+- CLI-first interface works seamlessly with AI coding agents
+- No context switching to web UIs
+
+🚀 **Developer Focused**
+- Issues live in your repo, right next to your code
+- Works offline, syncs when you push
+- Fast, lightweight, and stays out of your way
+
+🔧 **Git Integration**
+- Automatic sync with git commits
+- Branch-aware issue tracking
+- Intelligent JSONL merge resolution
+
+## Get Started with Beads
+
+Try Beads in your own projects:
+
+```bash
+# Install Beads
+curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
+
+# Initialize in your repo
+bd init
+
+# Create your first issue
+bd create "Try out Beads"
+```
+
+## Learn More
+
+- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
+- **Quick Start Guide**: Run `bd quickstart`
+- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
+
+---
+
+*Beads: Issue tracking that moves at the speed of thought* ⚡

.beads/issues.jsonl

@@ -0,0 +1,2 @@
+{"id":"nixos-config-gx2","title":"form","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-01-11T11:49:21.688289476+01:00","created_by":"m3tam3re","updated_at":"2026-01-11T11:51:36.426124223+01:00","deleted_at":"2026-01-11T11:51:36.426124223+01:00","deleted_by":"daemon","delete_reason":"delete","original_type":"task"}
+{"id":"nixos-config-n4l","title":"Create Gitea action for nix-update package updates","description":"Create a Gitea action to automatically update packages in this nixos-config repository using nix-update.\n\n**Context:**\n- Gitea instance is already running on m3-atlas at code.m3ta.dev (configured in hosts/m3-atlas/services/gitea.nix)\n- The repository is self-hosted on this Gitea instance\n- nix-update is already referenced in home/features/cli/default.nix\n- Currently no Gitea workflows exist (.gitea/ directory does not exist)\n\n**Goal:**\nAutomate package updates by creating a Gitea Actions workflow that:\n1. Runs nix-update periodically (e.g., weekly or on schedule)\n2. Updates package definitions in pkgs/ directory\n3. Creates pull requests with the updates\n4. Uses appropriate secrets/credentials for the Gitea instance\n\n**Requirements:**\n- Create .gitea/workflows/ directory structure\n- Define workflow file with nix-update command\n- Configure triggers (schedule, manual, or on repository events)\n- Set up proper permissions and secrets\n- Test the workflow execution\n\n**Current Repository State:**\n- pkgs/default.nix exists but is minimal (currently just a comment)\n- Multiple nixpkgs inputs are used (unstable, 25.11, locked, master)\n- Custom m3ta-nixpkgs overlay at code.m3ta.dev/m3tam3re/nixpkgs\n- Uses agenix for secrets management\n\n**Related Files:**\n- hosts/m3-atlas/services/gitea.nix (existing Gitea configuration)\n- hosts/common/ports.nix (port management)\n- home/features/cli/default.nix (nix-update reference)\n\n**Acceptance Criteria:**\n- [ ] Create .gitea/workflows directory\n- [ ] Implement nix-update workflow YAML\n- [ ] Configure appropriate triggers\n- [ ] Test workflow on the repository\n- [ ] Document setup and configuration","status":"closed","priority":2,"issue_type":"feature","owner":"p@m3ta.dev","created_at":"2026-01-13T20:39:49.838916335+01:00","created_by":"m3tm3re","updated_at":"2026-01-13T20:51:43.833041989+01:00","closed_at":"2026-01-13T20:51:43.833041989+01:00","close_reason":"Closed"}

.beads/metadata.json

@@ -0,0 +1,4 @@
+{
+  "database": "beads.db",
+  "jsonl_export": "issues.jsonl"
+}

.beads/sync_base.jsonl

@@ -0,0 +1,2 @@
+{"id":"nixos-config-gx2","title":"form","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-01-11T11:49:21.688289476+01:00","created_by":"m3tam3re","updated_at":"2026-01-11T11:51:36.426124223+01:00","deleted_at":"2026-01-11T11:51:36.426124223+01:00","deleted_by":"daemon","delete_reason":"delete","original_type":"task"}
+{"id":"nixos-config-n4l","title":"Create Gitea action for nix-update package updates","description":"Create a Gitea action to automatically update packages in this nixos-config repository using nix-update.\n\n**Context:**\n- Gitea instance is already running on m3-atlas at code.m3ta.dev (configured in hosts/m3-atlas/services/gitea.nix)\n- The repository is self-hosted on this Gitea instance\n- nix-update is already referenced in home/features/cli/default.nix\n- Currently no Gitea workflows exist (.gitea/ directory does not exist)\n\n**Goal:**\nAutomate package updates by creating a Gitea Actions workflow that:\n1. Runs nix-update periodically (e.g., weekly or on schedule)\n2. Updates package definitions in pkgs/ directory\n3. Creates pull requests with the updates\n4. Uses appropriate secrets/credentials for the Gitea instance\n\n**Requirements:**\n- Create .gitea/workflows/ directory structure\n- Define workflow file with nix-update command\n- Configure triggers (schedule, manual, or on repository events)\n- Set up proper permissions and secrets\n- Test the workflow execution\n\n**Current Repository State:**\n- pkgs/default.nix exists but is minimal (currently just a comment)\n- Multiple nixpkgs inputs are used (unstable, 25.11, locked, master)\n- Custom m3ta-nixpkgs overlay at code.m3ta.dev/m3tam3re/nixpkgs\n- Uses agenix for secrets management\n\n**Related Files:**\n- hosts/m3-atlas/services/gitea.nix (existing Gitea configuration)\n- hosts/common/ports.nix (port management)\n- home/features/cli/default.nix (nix-update reference)\n\n**Acceptance Criteria:**\n- [ ] Create .gitea/workflows directory\n- [ ] Implement nix-update workflow YAML\n- [ ] Configure appropriate triggers\n- [ ] Test workflow on the repository\n- [ ] Document setup and configuration","status":"closed","priority":2,"issue_type":"feature","owner":"p@m3ta.dev","created_at":"2026-01-13T20:39:49.838916335+01:00","created_by":"m3tm3re","updated_at":"2026-01-13T20:51:43.833041989+01:00","closed_at":"2026-01-13T20:51:43.833041989+01:00","close_reason":"Closed"}

.gitattributes

@@ -0,0 +1,3 @@
+
+# Use bd merge for beads JSONL files
+.beads/issues.jsonl merge=beads

flake.lock

@@ -21,6 +21,22 @@
         "type": "github"
       }
     },
+    "agents": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1768756367,
+        "narHash": "sha256-s6AVS1NHXtfc9m4ccSM1+VzC2pjE6dfx9RT7JmELZpo=",
+        "ref": "refs/heads/master",
+        "rev": "8ebb30fb2b50026034ba87e8c0aca63b09a993b3",
+        "revCount": 10,
+        "type": "git",
+        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
+      }
+    },
     "base16-schemes": {
       "flake": false,
       "locked": {
@@ -66,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
+        "lastModified": 1768727946,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "narHash": "sha256-le2GY+ZR6uRHMuOAc60sBR3gBD2BEk1qOZ3S5C/XFpU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "558e84658d0eafc812497542ad6ca0d9654b3b0f",
         "type": "github"
       },
       "original": {
@@ -146,11 +162,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766387499,
+        "lastModified": 1768836546,
-        "narHash": "sha256-AjK3/UKDzeXFeYNLVBaJ3+HLE9he1g5UrlNd4/BM3eA=",
+        "narHash": "sha256-nJZkTamcXXMW+SMYiGFB6lB8l0aJw0xjssfN8xYd/Fs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "527ad07e6625302b648ed3b28c34b62a79bd103e",
+        "rev": "b56c5ad14fcf8b5bc887463552483bf000ca562a",
         "type": "github"
       },
       "original": {
@@ -209,11 +225,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1762493267,
+        "lastModified": 1767767975,
-        "narHash": "sha256-W/eYgKKVqCh7SJLHk6Asc4LvU3YXvGtlL29yBMGymz4=",
+        "narHash": "sha256-yBejG3j6OLQYn87UozFAI3q9a1vH00u9xjIf2Q4V5j8=",
         "owner": "Jas-SinghFSU",
         "repo": "HyprPanel",
-        "rev": "f9a04192e8fb90a48e1756989f582dc0baec2351",
+        "rev": "0e73df1dfedf0f6fa21ed0ae5e031b0663c8f400",
         "type": "github"
       },
       "original": {
@@ -224,20 +240,18 @@
     },
     "m3ta-nixpkgs": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_3",
+        "opencode": "opencode"
       },
       "locked": {
-        "lastModified": 1767362052,
+        "lastModified": 1769186400,
-        "narHash": "sha256-NfrV9/JtD37WX7+H4UaFcTSnqmpSpr8f2Za+qo1duxM=",
+        "narHash": "sha256-9e9yvKJPufg0mTroH+vUUzxp+eX1tvy5QLSzKSw6uLI=",
-        "ref": "refs/heads/master",
+        "path": "/home/m3tam3re/p/NIX/nixpkgs",
-        "rev": "0b4c2efc8f4298168befc24d6a55cb732772caae",
+        "type": "path"
-        "revCount": 18,
-        "type": "git",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
       },
       "original": {
-        "type": "git",
+        "path": "/home/m3tam3re/p/NIX/nixpkgs",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
+        "type": "path"
       }
     },
     "nix-colors": {
@@ -277,7 +291,7 @@
     "nixos-generators": {
       "inputs": {
         "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
         "lastModified": 1764234087,
@@ -374,11 +388,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1766476350,
+        "lastModified": 1768844247,
-        "narHash": "sha256-JbSaOKi9jBGu1KG+BANYiocKsc+EI8Qb4MUKgtXnaTE=",
+        "narHash": "sha256-vAPadjf0C/6Xcb/5YO30S38lSV8/gNKRwWSfpS6SGNY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "48c44c67646d5a8c7c168e1ded8adf6fd8f3831b",
+        "rev": "ba686298c491728b8ee1774c8520665293517540",
         "type": "github"
       },
       "original": {
@@ -390,11 +404,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1767047869,
+        "lastModified": 1768621446,
-        "narHash": "sha256-tzYsEzXEVa7op1LTnrLSiPGrcCY6948iD0EcNLWcmzo=",
+        "narHash": "sha256-6YwHV1cjv6arXdF/PQc365h1j+Qje3Pydk501Rm4Q+4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "89dbf01df72eb5ebe3b24a86334b12c27d68016a",
+        "rev": "72ac591e737060deab2b86d6952babd1f896d7c5",
         "type": "github"
       },
       "original": {
@@ -422,11 +436,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1766309749,
+        "lastModified": 1768127708,
-        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "narHash": "sha256-1Sm77VfZh3mU0F5OqKABNLWxOuDeHIlcFjsXeeiPazs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
+        "rev": "ffbc9f8cbaacfb331b6017d5a5abb21a492c9a38",
         "type": "github"
       },
       "original": {
@@ -437,6 +451,22 @@
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1768393167,
+        "narHash": "sha256-n2063BRjHde6DqAz2zavhOOiLUwA3qXt7jQYHyETjX8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2f594d5af95d4fdac67fba60376ec11e482041cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1736657626,
         "narHash": "sha256-FWlPMUzp0lkQBdhKlPqtQdqmp+/C+1MBiEytaYfrCTY=",
@@ -452,13 +482,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1766309749,
+        "lastModified": 1768564909,
-        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
@@ -468,7 +498,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1710272261,
         "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
@@ -492,11 +522,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766476441,
+        "lastModified": 1768844638,
-        "narHash": "sha256-IUN09o1u22yEv3YaLUq5BE9xvVNsqHRrINUTrZxxnwM=",
+        "narHash": "sha256-d0kHY4VjvpkAtOJxcN9xM9UvYZIxWs9f/gybe2+wHzI=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "1a2c4782c53dccd364e404fc0eec7fddee46d815",
+        "rev": "5089b930f2ee6d34412f9d2c625bbe3926bb4bee",
         "type": "github"
       },
       "original": {
@@ -505,16 +535,36 @@
         "type": "github"
       }
     },
+    "opencode": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1769153255,
+        "narHash": "sha256-ardM8zEJWvTvsFMQZWivjGPB2uIqFw6QPAzrRjAHQKY=",
+        "owner": "anomalyco",
+        "repo": "opencode",
+        "rev": "c130dd425a32fe1c1cd3747ea6565b0e6bf50100",
+        "type": "github"
+      },
+      "original": {
+        "owner": "anomalyco",
+        "ref": "v1.1.34",
+        "repo": "opencode",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "agents": "agents",
         "disko": "disko",
         "home-manager": "home-manager_2",
         "hyprpanel": "hyprpanel",
         "m3ta-nixpkgs": "m3ta-nixpkgs",
         "nix-colors": "nix-colors",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-45570c2": "nixpkgs-45570c2",
         "nixpkgs-9e58ed7": "nixpkgs-9e58ed7",
         "nixpkgs-locked": "nixpkgs-locked",
@@ -527,7 +577,7 @@
     "rose-pine-hyprcursor": {
       "inputs": {
         "hyprlang": "hyprlang",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_7",
         "utils": "utils"
       },
       "locked": {

flake.nix

@@ -43,6 +43,12 @@
     hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
     rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
     nix-colors.url = "github:misterio77/nix-colors";
+
+    agents = {
+      # url = "path:/home/m3tam3re/p/MISC/AGENTS";
+      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
+      flake = false;
+    };
   };
 
   outputs = {

home/features/cli/default.nix

@@ -24,6 +24,7 @@
     model = "ggml-large-v3-turbo";
     notifyTimeout = 2000;
   };
+
   programs.carapace = {
     enable = true;
     enableFishIntegration = true;
@@ -197,11 +198,6 @@
   };
 
   home.packages = with pkgs; [
-    agenix-cli
-    alejandra
-    bc
-    bun
-    claude-code
     comma
     coreutils
     devenv
@@ -218,6 +214,7 @@
     llm
     lf
     nix-index
+    nix-update
     libnotify
     nushellPlugins.skim
     progress

home/features/cli/nushell.nix

@@ -68,6 +68,7 @@ in {
           ]
         }
 
+        # Aliases
         alias .. = cd ..
         alias ... = cd ...
         alias h = cd $env.HOME

home/features/coding/default.nix

@@ -1,5 +1,14 @@
 {pkgs, ...}: {
+  imports = [
+    ./opencode.nix
+  ];
   home.packages = with pkgs; [
+    agenix-cli
+    alejandra
+    beads
+    bc
+    bun
+    claude-code
     devpod
     #devpod-desktop
     code2prompt
@@ -7,12 +16,14 @@
     (python3.withPackages (ps:
       with ps; [
         pip
+        uv
         # Scientific packages
         numba
         numpy
         torch
         srt
       ]))
+    opencode-desktop
     pyrefly
     nixd
     alejandra

home/features/coding/opencode.nix

@@ -0,0 +1,376 @@
+{inputs, ...}: {
+  xdg.configFile = {
+    "opencode/command" = {
+      source = "${inputs.agents}/command";
+      recursive = true;
+    };
+    "opencode/context" = {
+      source = "${inputs.agents}/context";
+      recursive = true;
+    };
+    "opencode/prompts" = {
+      source = "${inputs.agents}/prompts";
+      recursive = true;
+    };
+    "opencode/skill" = {
+      source = "${inputs.agents}/skill";
+      recursive = true;
+    };
+  };
+
+  programs.opencode = {
+    enable = true;
+    settings = {
+      theme = "opencode";
+      plugin = ["oh-my-opencode" "opencode-beads" "opencode-antigravity-auth@beta"];
+      agent =
+        builtins.fromJSON
+        (builtins.readFile "${inputs.agents}/agent/agents.json");
+      formatter = {
+        alejandra = {
+          command = ["alejandra" "-q" "-"];
+          extensions = [".nix"];
+        };
+      };
+      mcp = {
+        Ref = {
+          type = "local";
+          command = [
+            "sh"
+            "-c"
+            "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"
+          ];
+          enabled = true;
+        };
+        Anytype = {
+          type = "local";
+          command = [
+            "sh"
+            "-c"
+            "OPENAPI_MCP_HEADERS=$(cat /run/agenix/anytype-key) exec bunx @anyproto/anytype-mcp"
+          ];
+          enabled = false;
+        };
+        Basecamp = {
+          type = "local";
+          command = [
+            "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server/venv/bin/python"
+            "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server/basecamp_fastmcp.py"
+          ];
+          environment = {
+            PYTHONPATH = "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server";
+            VIRTUAL_ENV = "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server/venv";
+            BASECAMP_ACCOUNT_ID = "5996442";
+          };
+          enabled = false;
+        };
+        Exa = {
+          type = "local";
+          command = [
+            "sh"
+            "-c"
+            "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"
+          ];
+          enabled = true;
+        };
+      };
+      provider = {
+        google = {
+          models = {
+            antigravity-gemini-3-pro = {
+              name = "Gemini 3 Pro (Antigravity)";
+              limit = {
+                context = 1048576;
+                output = 65535;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+              variants = {
+                low = {thinkingLevel = "low";};
+                high = {thinkingLevel = "high";};
+              };
+            };
+            antigravity-gemini-3-flash = {
+              name = "Gemini 3 Flash (Antigravity)";
+              limit = {
+                context = 1048576;
+                output = 65536;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+              variants = {
+                minimal = {thinkingLevel = "minimal";};
+                low = {thinkingLevel = "low";};
+                medium = {thinkingLevel = "medium";};
+                high = {thinkingLevel = "high";};
+              };
+            };
+            antigravity-claude-sonnet-4-5 = {
+              name = "Claude Sonnet 4.5 (Antigravity)";
+              limit = {
+                context = 200000;
+                output = 64000;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+            };
+            antigravity-claude-sonnet-4-5-thinking = {
+              name = "Claude Sonnet 4.5 Thinking (Antigravity)";
+              limit = {
+                context = 200000;
+                output = 64000;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+              variants = {
+                low = {thinkingConfig = {thinkingBudget = 8192;};};
+                max = {thinkingConfig = {thinkingBudget = 32768;};};
+              };
+            };
+            antigravity-claude-opus-4-5-thinking = {
+              name = "Claude Opus 4.5 Thinking (Antigravity)";
+              limit = {
+                context = 200000;
+                output = 64000;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+              variants = {
+                low = {thinkingConfig = {thinkingBudget = 8192;};};
+                max = {thinkingConfig = {thinkingBudget = 32768;};};
+              };
+            };
+            "gemini-2.5-flash" = {
+              name = "Gemini 2.5 Flash (Gemini CLI)";
+              limit = {
+                context = 1048576;
+                output = 65536;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+            };
+            "gemini-2.5-pro" = {
+              name = "Gemini 2.5 Pro (Gemini CLI)";
+              limit = {
+                context = 1048576;
+                output = 65536;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+            };
+            "gemini-3-flash-preview" = {
+              name = "Gemini 3 Flash Preview (Gemini CLI)";
+              limit = {
+                context = 1048576;
+                output = 65536;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+            };
+            "gemini-3-pro-preview" = {
+              name = "Gemini 3 Pro Preview (Gemini CLI)";
+              limit = {
+                context = 1048576;
+                output = 65535;
+              };
+              modalities = {
+                input = ["text" "image" "pdf"];
+                output = ["text"];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON {
+    "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";
+    google_auth = false;
+    agents = {
+      Sisyphus = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "allow";
+          bash = {
+            "*" = "allow";
+            "rm *" = "ask";
+            "rmdir *" = "ask";
+            "mv *" = "ask";
+            "chmod *" = "ask";
+            "chown *" = "ask";
+            "git *" = "ask";
+            "git status*" = "allow";
+            "git log*" = "allow";
+            "git diff*" = "allow";
+            "git branch*" = "allow";
+            "git show*" = "allow";
+            "git stash list*" = "allow";
+            "git remote -v" = "allow";
+            "git add *" = "allow";
+            "git commit *" = "allow";
+            "jj *" = "ask";
+            "jj status" = "allow";
+            "jj log*" = "allow";
+            "jj diff*" = "allow";
+            "jj show*" = "allow";
+            "npm *" = "ask";
+            "npx *" = "ask";
+            "bun *" = "ask";
+            "bunx *" = "ask";
+            "uv *" = "ask";
+            "pip *" = "ask";
+            "pip3 *" = "ask";
+            "yarn *" = "ask";
+            "pnpm *" = "ask";
+            "cargo *" = "ask";
+            "go *" = "ask";
+            "make *" = "ask";
+            "dd *" = "deny";
+            "mkfs*" = "deny";
+            "fdisk *" = "deny";
+            "parted *" = "deny";
+            "eval *" = "deny";
+            "source *" = "deny";
+            "curl *|*sh" = "deny";
+            "wget *|*sh" = "deny";
+            "sudo *" = "deny";
+            "su *" = "deny";
+            "systemctl *" = "deny";
+            "service *" = "deny";
+            "shutdown *" = "deny";
+            "reboot*" = "deny";
+            "init *" = "deny";
+            "> /dev/*" = "deny";
+            "cat * > /dev/*" = "deny";
+          };
+          external_directory = "ask";
+          doom_loop = "ask";
+        };
+      };
+      librarian = {
+        model = "opencode/glm-4.7-free";
+        permission = {
+          edit = "deny";
+          bash = "deny";
+        };
+      };
+      explore = {
+        model = "zai-coding-plan/glm-4.5-air";
+        permission = {
+          edit = "deny";
+          bash = "deny";
+        };
+      };
+      oracle = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "deny";
+        };
+      };
+      frontend-ui-ux-engineer = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "allow";
+          bash = {
+            "*" = "ask";
+            "npm *" = "ask";
+            "npx *" = "ask";
+            "bun *" = "ask";
+            "bunx *" = "ask";
+            "rm *" = "ask";
+            "mv *" = "ask";
+            "dd *" = "deny";
+            "mkfs*" = "deny";
+            "sudo *" = "deny";
+            "curl *|*sh" = "deny";
+            "wget *|*sh" = "deny";
+          };
+        };
+      };
+      document-writer = {
+        model = "zai-coding-plan/glm-4.5-air";
+        permission = {
+          edit = "allow";
+          bash = "deny";
+        };
+      };
+      multimodal-looker = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "deny";
+        };
+      };
+      "Prometheus (Planner)" = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "allow";
+        };
+      };
+      "Metis (Plan Consultant)" = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "allow";
+        };
+      };
+      "Momus (Plan Reviewer)" = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "allow";
+        };
+      };
+      "Atlas" = {
+        model = "zai-coding-plan/glm-4.7";
+        permission = {
+          edit = "deny";
+          bash = "allow";
+        };
+      };
+    };
+    "categories" = {
+      "visual-engineering" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+      "ultrabrain" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+      "artistry" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+      "quick" = {
+        "model" = "zai-coding-plan/glm-4.5-ai";
+      };
+      "unspecified-low" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+      "unspecified-high" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+      "writing" = {
+        "model" = "zai-coding-plan/glm-4.7";
+      };
+    };
+    disabled_mcps = ["context7" "websearch"];
+  };
+}

home/features/desktop/default.nix

@@ -13,6 +13,7 @@
     ./office.nix
     ./rofi.nix
     ./theme.nix
+    ./wallpapers.nix
     ./wayland.nix
     ./webapps.nix
   ];
@@ -144,7 +145,7 @@
     # google-chrome
     # gsettings-desktop-schemas
     # graphviz
-    # ksnip
+    ksnip
     msty-studio
     nwg-look
     # pamixer

home/features/desktop/hyprland.nix

@@ -18,9 +18,7 @@ in {
 
         exec-once = [
           "hyprpanel"
-          "hyprpaper"
+          "while ! hyprpaper-random; do sleep 0.5; done"
-          "hyprpaper-random"
-          "hypridle"
           "wl-paste --type text --watch cliphist store" # Stores only text data
           "wl-paste --type image --watch cliphist store" # Stores only image data "wl-paste -p -t text --watch clipman store -P --histpath=\"~/.local/share/clipman-primary.json\""
         ];
@@ -30,6 +28,10 @@ in {
           "HYPRCURSOR_THEME,Bibata-Modern-Ice"
           "WLR_NO_HARDWARE_CURSORS,1"
           "GTK_THEME,Dracula"
+          "XDG_CURRENT_DESKTOP,Hyprland"
+          "XDG_SESSION_TYPE,wayland"
+          "XDG_SESSION_DESKTOP,Hyprland"
+          "NIXOS_OZONE_WL,1"
         ];
 
         input = {
@@ -107,42 +109,49 @@ in {
           }
         ];
         windowrule = [
-          "float, class:file_progress"
+          # Floating dialogs
-          "float, class:confirm"
+          "match:class file_progress, float on"
-          "float, class:dialog"
+          "match:class confirm, float on"
-          "float, class:download"
+          "match:class dialog, float on"
-          "float, class:notification"
+          "match:class download, float on"
-          "float, class:error"
+          "match:class notification, float on"
-          "float, class:splash"
+          "match:class error, float on"
-          "float, class:confirmreset"
+          "match:class splash, float on"
-          "float, title:Open File"
+          "match:class confirmreset, float on"
-          "float, title:branchdialog"
+          "match:title Open File, float on"
-          "float, class:pavucontrol-qt"
+          "match:title branchdialog, float on"
-          "float, class:pavucontrol"
+          "match:class pavucontrol-qt, float on"
-          "fullscreen, class:wlogout"
+          "match:class pavucontrol, float on"
-          "float, title:wlogout"
+          # wlogout
-          "fullscreen, title:wlogout"
+          "match:class wlogout, fullscreen on"
-          "float, class:mpv"
+          "match:title wlogout, float on"
-          "idleinhibit focus, class:mpv"
+          "match:title wlogout, fullscreen on"
-          "opacity 1.0 override, class:mpv"
+          # mpv
-          "float, title:^(Media viewer)$"
+          "match:class mpv, float on"
-          "float, title:^(Volume Control)$"
+          "match:class mpv, idle_inhibit focus"
-          "float, title:^(Picture-in-Picture)$"
+          "match:class mpv, opacity 1.0 override"
-          "float,title:^(floating-pomodoro)$"
+          # Media/Volume/PiP
-          "size 250 50, title:^(floating-pomodoro)$"
+          "match:title ^(Media viewer)$, float on"
-          "move 12 100%-150,title:^(floating-pomodoro)$"
+          "match:title ^(Volume Control)$, float on"
-          "pin,title:^(floating-pomodoro)$"
+          "match:title ^(Picture-in-Picture)$, float on"
-          "float, initialTitle:.*streamlabs.com.*"
+          # Pomodoro timer
-          "pin, initialTitle:.*streamlabs.com.*"
+          "match:title ^(floating-pomodoro)$, float on"
-          "size 800 400, initialTitle:.*streamlabs.com.*"
+          "match:title ^(floating-pomodoro)$, size 250 50"
-          "move 100%-820 102, initialTitle:.*alert-box.*"
+          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
-          "move 100%-820 512, initialTitle:.*chat-box.*"
+          "match:title ^(floating-pomodoro)$, pin on"
-          "opacity 0.5 override, initialTitle:.*streamlabs.com.*"
+          # Streamlabs overlays
-          "idleinhibit focus, initialTitle:.*streamlabs.com.*"
+          "match:initial_title .*streamlabs.com.*, float on"
-          "noanim, initialTitle:.*streamlabs.com.*"
+          "match:initial_title .*streamlabs.com.*, pin on"
-          "noborder, initialTitle:.*streamlabs.com.*"
+          "match:initial_title .*streamlabs.com.*, size 800 400"
-          "noshadow, initialTitle:.*streamlabs.com.*"
+          "match:initial_title .*alert-box.*, move 100%-820 102"
-          "noblur, initialTitle:.*streamlabs.com.*"
+          "match:initial_title .*chat-box.*, move 100%-820 512"
+          "match:initial_title .*streamlabs.com.*, opacity 0.5 override"
+          "match:initial_title .*streamlabs.com.*, idle_inhibit focus"
+          "match:initial_title .*streamlabs.com.*, no_anim on"
+          "match:initial_title .*streamlabs.com.*, decorate off"
+          "match:initial_title .*streamlabs.com.*, no_shadow on"
+          "match:initial_title .*streamlabs.com.*, no_blur on"
+          "border_color rgb(ffffff), match:xwayland 1"
         ];
         "$mainMod" = "SUPER";
         "$terminal" = "kitty";
@@ -166,6 +175,7 @@ in {
           "$mainMod SHIFT, V, togglefloating"
           "$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
           "$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
+          "$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
           "$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
           "$mainMod, P, exec, uwsm app -- rofi-pass"
           "$mainMod SHIFT, P, pseudo"
@@ -207,5 +217,100 @@ in {
         ];
       };
     };
+    services.hypridle = {
+      enable = true;
+      settings = {
+        general = {
+          before_sleep_cmd = "hyprlock";
+          after_sleep_cmd = "hyprctl dispatch dpms on";
+          inhibit_sleep = 3;
+        };
+
+        listener = [
+          {
+            timeout = 300; # 5 min
+            on-timeout = "hyprlock";
+          }
+          {
+            timeout = 420; # 5.5 min
+            on-timeout = "hyprctl dispatch dpms off";
+            on-resume = "hyprctl dispatch dpms on";
+          }
+        ];
+      };
+    };
+
+    services.hyprpaper.enable = true;
+
+    programs.hyprlock = {
+      enable = true;
+      settings = {
+        "$font" = "JetBrainsMono Nerd Font";
+        "$base" = "rgb(${config.colorScheme.palette.base00})";
+        "$text" = "rgb(${config.colorScheme.palette.base05})";
+        "$textAlpha" = "${config.colorScheme.palette.base05}";
+        "$accentAlpha" = "${config.colorScheme.palette.base0D}";
+        "$red" = "rgb(${config.colorScheme.palette.base08})";
+        "$yellow" = "rgb(${config.colorScheme.palette.base0A})";
+
+        general = {
+          hide_cursor = true;
+        };
+
+        background = {
+          monitor = "";
+          path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
+          blur_passes = 0;
+          color = "rgb(${config.colorScheme.palette.base00})";
+        };
+
+        label = [
+          {
+            monitor = "";
+            text = "$TIME";
+            color = "$text";
+            font_size = 90;
+            font_family = "$font";
+            position = "30, 0";
+            halign = "left";
+            valign = "top";
+          }
+          {
+            monitor = "";
+            text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
+            color = "$text";
+            font_size = 25;
+            font_family = "$font";
+            position = "30, -150";
+            halign = "left";
+            valign = "top";
+          }
+        ];
+
+        input-field = [
+          {
+            monitor = "";
+            size = "300, 60";
+            outline_thickness = 4;
+            dots_size = 0.2;
+            dots_spacing = 0.2;
+            dots_center = true;
+            outer_color = "rgb(${config.colorScheme.palette.base0D})";
+            inner_color = "rgb(${config.colorScheme.palette.base00})";
+            font_color = "rgb(${config.colorScheme.palette.base05})";
+            fade_on_empty = false;
+            placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}">󰌾  Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
+            hide_input = false;
+            check_color = "rgb(${config.colorScheme.palette.base0D})";
+            fail_color = "rgb(${config.colorScheme.palette.base08})";
+            fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
+            capslock_color = "rgb(${config.colorScheme.palette.base0A})";
+            position = "0, -35";
+            halign = "center";
+            valign = "center";
+          }
+        ];
+      };
+    };
   };
 }

home/features/desktop/media.nix

@@ -32,7 +32,6 @@ in {
       qpwgraph
       v4l-utils
       #plexamp
-      webcord
       # uxplay
       # vlc
       # webcord

home/features/desktop/rofi.nix

@@ -181,11 +181,26 @@ in {
     };
     cli.rofi-project-opener = {
       enable = true;
-      projectDirs = [
+      projectDirs = {
-        "$HOME/p/NIX"
+        AI = {
-      ];
+          path = "~/p/AI";
+          args = "";
+        };
+        CHAT = {
+          path = "~/p/CHAT";
+          args = "--agent chiron";
+        };
+        MISC = {
+          path = "~/p/MISC";
+          args = "--agent chiron-forge";
+        };
+        NIX = {
+          path = "~/p/NIX";
+          args = "";
+        };
+      };
       terminal = pkgs.kitty;
-      terminalCommand = "opencode";
+      terminalCommand = "opencode %a";
     };
   };
 }

home/features/desktop/wallpapers.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.features.desktop.wallpapers;
+in {
+  options.features.desktop.wallpapers = mkEnableOption "Wallpapers for Hyprland";
+
+  config = mkIf cfg {
+    xdg.configFile."hypr/wallpapers" = {
+      source = ../../m3tam3re/wallpapers;
+      recursive = true;
+    };
+  };
+}

home/m3tam3re/m3-ares.nix

@@ -57,6 +57,7 @@ with lib; {
           rofi.enable = true;
           fonts.enable = true;
           wayland.enable = true;
+          wallpapers = true;
         };
       };
     }
@@ -79,14 +80,14 @@ with lib; {
             "6, monitor:HDMI-A-1"
           ];
           windowrule = [
-            "workspace 1,class:dev.zed.Zed"
+            "match:class dev.zed.Zed, workspace 1"
-            "workspace 1,class:Msty"
+            "match:class Msty, workspace 1"
-            "workspace 2,class:(com.obsproject.Studio)"
+            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "workspace 4,opacity 1.0, class:(brave-browser)"
+            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "workspace 4,opacity 1.0, class:(vivaldi-stable)"
+            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "fullscreen,class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, fullscreen on"
-            "workspace 5,class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, workspace 5"
-            "idleinhibit focus, class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, idle_inhibit focus"
           ];
         };
       };

home/m3tam3re/m3-daedalus.nix

@@ -85,14 +85,14 @@ in {
             "6, monitor:HDMI-A-1"
           ];
           windowrule = [
-            "workspace 1,class:dev.zed.Zed"
+            "match:class dev.zed.Zed, workspace 1"
-            "workspace 1,class:Msty"
+            "match:class Msty, workspace 1"
-            "workspace 2,class:(com.obsproject.Studio)"
+            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "workspace 4,opacity 1.0, class:(brave-browser)"
+            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "workspace 4,opacity 1.0, class:(vivaldi-stable)"
+            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "fullscreen,class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, fullscreen on"
-            "workspace 5,class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, workspace 5"
-            "idleinhibit focus, class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, idle_inhibit focus"
           ];
         };
       };

home/m3tam3re/m3-kratos.nix

@@ -56,6 +56,7 @@ with lib; {
           rofi.enable = true;
           fonts.enable = true;
           wayland.enable = true;
+          wallpapers = true;
         };
       };
     }
@@ -79,12 +80,12 @@ with lib; {
           ];
 
           windowrule = [
-            "workspace 1,class:dev.zed.Zed"
+            "match:class dev.zed.Zed, workspace 1"
-            "workspace 1,class:Msty"
+            "match:class Msty, workspace 1"
-            "workspace 2,class:(com.obsproject.Studio)"
+            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "workspace 4,opacity 1.0, class:(brave-browser)"
+            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "workspace 4,opacity 1.0, class:(vivaldi-stable)"
+            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "idleinhibit focus, class:^steam_app_\\d+$"
+            "match:class ^steam_app_\\d+$, idle_inhibit focus"
           ];
         };
       };

hosts/common/extraServices/flatpak.nix

@@ -14,7 +14,6 @@ in {
     xdg.portal = {
       # xdg desktop intergration (required for flatpak)
       enable = true;
-      wlr.enable = true;
       extraPortals = with pkgs; [
         xdg-desktop-portal-hyprland
       ];

hosts/m3-ares/hardware.nix

@@ -1,8 +1,10 @@
-{
+{ config, pkgs, inputs, ... }: {
-  config,
+  # Workaround for tuxedo-drivers module bug in unstable (nixpkgs#480391)
-  pkgs,
+  # The unstable module has a type error - use stable module until fix propagates
-  ...
+  disabledModules = [ "hardware/tuxedo-drivers.nix" ];
-}: {
+  imports =
+    [ "${inputs.nixpkgs-stable}/nixos/modules/hardware/tuxedo-drivers.nix" ];
+
   hardware.nvidia = {
     prime = {
       offload.enable = false;
@@ -36,18 +38,12 @@
     };
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ tuxedo-backlight ];
-    tuxedo-backlight
+  security.sudo.extraRules = [{
-  ];
-  security.sudo.extraRules = [
-    {
     users = [ "@wheel" ];
-      commands = [
+    commands = [{
-        {
       command = "/run/current-system/sw/bin/set-backlight";
       options = [ "NOPASSWD" ];
-        }
+    }];
-      ];
+  }];
-    }
-  ];
 }

hosts/m3-ares/programs.nix

@@ -28,7 +28,7 @@
   programs.fish.enable = true;
   programs.thunar = {
     enable = true;
-    plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
+    plugins = with pkgs; [thunar-archive-plugin thunar-volman];
   };
   programs.gnupg.agent = {
     enable = true;

hosts/m3-ares/secrets.nix

@@ -1,6 +1,10 @@
 {
   age = {
     secrets = {
+      anytype-key = {
+        file = ../../secrets/anytype-key-ares.age;
+        owner = "m3tam3re";
+      };
       wg-DE = {
         file = ../../secrets/wg-DE.age;
         path = "/etc/wireguard/DE.conf";
@@ -21,6 +25,22 @@
         file = ../../secrets/wg-BR.age;
         path = "/etc/wireguard/BR.conf";
       };
+      ref-key = {
+        file = ../../secrets/ref-key.age;
+        owner = "m3tam3re";
+      };
+      exa-key = {
+        file = ../../secrets/exa-key.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-id = {
+        file = ../../secrets/basecamp-client-id.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-secret = {
+        file = ../../secrets/basecamp-client-secret.age;
+        owner = "m3tam3re";
+      };
       tailscale-key.file = ../../secrets/tailscale-key.age;
       m3tam3re-secrets = {
         file = ../../secrets/m3tam3re-secrets.age;

hosts/m3-ares/services/default.nix

@@ -15,14 +15,14 @@
     gvfs.enable = true;
     trezord.enable = true;
     gnome.gnome-keyring.enable = true;
-    qdrant = {
+    # qdrant = {
-      enable = true;
+    #   enable = true;
-      settings = {
+    #   settings = {
-        service = {
+    #     service = {
-          host = "0.0.0.0";
+    #       host = "0.0.0.0";
-        };
+    #     };
-      };
+    #   };
-    };
+    # };
     upower.enable = true;
     avahi = {
       enable = true;

hosts/m3-atlas/secrets.nix

@@ -1,51 +1,35 @@
 {
   age = {
     secrets = {
-      baserow-env = {
+      baserow-env = { file = ../../secrets/baserow-env.age; };
-        file = ../../secrets/baserow-env.age;
+      ghost-env = { file = ../../secrets/ghost-env.age; };
-      };
-      ghost-env = {
-        file = ../../secrets/ghost-env.age;
-      };
       kestra-config = {
         file = ../../secrets/kestra-config.age;
         mode = "644";
       };
-      kestra-env = {
+      kestra-env = { file = ../../secrets/kestra-env.age; };
-        file = ../../secrets/kestra-env.age;
+      littlelink-m3tam3re = { file = ../../secrets/littlelink-m3tam3re.age; };
-      };
+      minio-root-cred = { file = ../../secrets/minio-root-cred.age; };
-      littlelink-m3tam3re = {
+      n8n-env = { file = ../../secrets/n8n-env.age; };
-        file = ../../secrets/littlelink-m3tam3re.age;
+      paperless-key = { file = ../../secrets/paperless-key.age; };
-      };
+      restreamer-env = { file = ../../secrets/restreamer-env.age; };
-      minio-root-cred = {
+      searx = { file = ../../secrets/searx.age; };
-        file = ../../secrets/minio-root-cred.age;
+      tailscale-key = { file = ../../secrets/tailscale-key.age; };
-      };
-      n8n-env = {
-        file = ../../secrets/n8n-env.age;
-      };
-      paperless-key = {
-        file = ../../secrets/paperless-key.age;
-      };
-      restreamer-env = {
-        file = ../../secrets/restreamer-env.age;
-      };
-      searx = {
-        file = ../../secrets/searx.age;
-      };
-      tailscale-key = {
-        file = ../../secrets/tailscale-key.age;
-      };
       traefik = {
         file = ../../secrets/traefik.age;
         owner = "traefik";
       };
-      vaultwarden-env = {
+      vaultwarden-env = { file = ../../secrets/vaultwarden-env.age; };
-        file = ../../secrets/vaultwarden-env.age;
-      };
       m3tam3re-secrets = {
         file = ../../secrets/m3tam3re-secrets.age;
         owner = "m3tam3re";
       };
+      gitea-runner-token = {
+        file = ../../secrets/gitea-runner-token.age;
+        mode = "600";
+        owner = "gitea-runner";
+        group = "gitea-runner";
+      };
     };
   };
 }

hosts/m3-atlas/services/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./containers
     ./gitea.nix
+    ./gitea-actions-runner.nix
     ./headscale.nix
     ./minio.nix
     ./mysql.nix

hosts/m3-atlas/services/gitea-actions-runner.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.gitea-actions-runner = {
+    instances.default = {
+      enable = true;
+      name = "${config.networking.hostName}-runner";
+      url = "https://code.m3ta.dev";
+      tokenFile = config.age.secrets.gitea-runner-token.path;
+
+      # nixos:host is primary, ubuntu is fallback
+      labels = [
+        "nixos:host"
+      ];
+
+      # Host execution packages
+      hostPackages = with pkgs; [
+        bash
+        curl
+        coreutils
+        git
+        jq
+        nix
+        nix-update
+        nodejs
+        # Add any other tools you need for nix-update workflows
+      ];
+
+      # Advanced settings
+      settings = {
+        runner = {
+          capacity = 4; # One job at a time (increase if you have resources)
+          timeout = "4h"; # Nix builds can take a while
+        };
+        cache = {enabled = true;};
+        container = {
+          enable_ipv6 = true;
+          privileged = false;
+        };
+      };
+    };
+  };
+
+  # User management (auto-created by module, but ensuring proper setup)
+  users.users.gitea-runner = {
+    home = "/var/lib/gitea-runner";
+    group = "gitea-runner";
+    isSystemUser = true;
+    createHome = true;
+  };
+  users.groups.gitea-runner = {};
+
+  # Firewall: Allow Podman bridge networks for cache actions
+  networking.firewall.trustedInterfaces = ["br-+"];
+}

hosts/m3-kratos/configuration.nix

@@ -14,7 +14,7 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.initrd.kernelModules = ["amdgpu"];
-  boot.kernelPackages = pkgs.linuxPackages_6_17;
+  boot.kernelPackages = pkgs.linuxPackages_6_18;
   services.xserver.videoDrivers = ["amdgpu"];
   security.polkit.enable = true;
   security.pam.services.gdm.enableGnomeKeyring = true;

hosts/m3-kratos/programs.nix

@@ -4,7 +4,6 @@
     # Add any missing dynamic libraries for unpackaged programs
     # here, NOT in environment.systemPackages
   ];
-  programs.adb.enable = true;
   programs.hyprland = {
     enable = true;
     xwayland.enable = true;
@@ -34,7 +33,7 @@
   programs.fish.enable = true;
   programs.thunar = {
     enable = true;
-    plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
+    plugins = with pkgs; [thunar-archive-plugin thunar-volman];
   };
   programs.gnupg.agent = {
     enable = true;

hosts/m3-kratos/secrets.nix

@@ -1,9 +1,11 @@
 {
   age = {
     secrets = {
-      tailscale-key = {
+      anytype-key = {
-        file = ../../secrets/tailscale-key.age;
+        file = ../../secrets/anytype-key.age;
+        owner = "m3tam3re";
       };
+      tailscale-key = { file = ../../secrets/tailscale-key.age; };
       wg-DE = {
         file = ../../secrets/wg-DE.age;
         path = "/etc/wireguard/DE.conf";
@@ -28,6 +30,22 @@
         file = ../../secrets/m3tam3re-secrets.age;
         owner = "m3tam3re";
       };
+      ref-key = {
+        file = ../../secrets/ref-key.age;
+        owner = "m3tam3re";
+      };
+      exa-key = {
+        file = ../../secrets/exa-key.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-id = {
+        file = ../../secrets/basecamp-client-id.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-secret = {
+        file = ../../secrets/basecamp-client-secret.age;
+        owner = "m3tam3re";
+      };
     };
   };
 }

overlays/default.nix

@@ -7,8 +7,7 @@
   # This one contains whatever you want to overlay
   # You can change versions, add patches, set compilation flags, anything really.
   # https://nixos.wiki/wiki/Overlays
-
+  modifications = final: prev: {
-  # modifications = final: prev: {
     #   n8n = import ./mods/n8n.nix {inherit prev;};
 
     #   brave = prev.brave.override {
@@ -24,7 +23,7 @@
     #     hash = "sha256-l623fIVhVCU/ylbBmohAtQNbK0YrWlEny0sC/vBJ+dU=";
     #   };
     # });
-  # };
+  };
 
   temp-packages = final: _prev: {
     temp = import inputs.nixpkgs-9e9486b {

secrets.nix

@@ -1,23 +1,23 @@
 let
   # SYSTEMS
-  m3-ares = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+M4CygEQ29eTmLqgyIAFCxy0rgfO23klNiARBEA+3s";
+  m3-ares =
-  m3-kratos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDl+LtFGsk/A7BvxwiUCyq5wjRzGtQSrBJzzLGxINF4O";
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+M4CygEQ29eTmLqgyIAFCxy0rgfO23klNiARBEA+3s";
-  m3-helios = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyHuLITpI+M45ZZem33wDusY2X988mBoWpD1HDeZNRJ";
+  m3-kratos =
-  m3-atlas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBYK1wsFkUPIb/lX1BH7+VyXmmGSbdEFHnvhAOcaC7H";
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDl+LtFGsk/A7BvxwiUCyq5wjRzGtQSrBJzzLGxINF4O";
+  m3-helios =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyHuLITpI+M45ZZem33wDusY2X988mBoWpD1HDeZNRJ";
+  m3-atlas =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBYK1wsFkUPIb/lX1BH7+VyXmmGSbdEFHnvhAOcaC7H";
 
   # USERS
-  m3tam3re = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU=";
+  m3tam3re =
-  users = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU=";
-    m3tam3re
+  users = [ m3tam3re ];
-  ];
 
-  systems = [
+  systems = [ m3-atlas m3-ares m3-helios m3-kratos ];
-    m3-atlas
-    m3-ares
-    m3-helios
-    m3-kratos
-  ];
 in {
+  "secrets/anytype-key.age".publicKeys = systems ++ users;
+  "secrets/anytype-key-ares.age".publicKeys = systems ++ users;
   "secrets/baserow-env.age".publicKeys = systems ++ users;
   "secrets/ghost-env.age".publicKeys = systems ++ users;
   "secrets/littlelink-m3tam3re.age".publicKeys = systems ++ users;
@@ -27,6 +27,11 @@ in {
   "secrets/minio-root-cred.age".publicKeys = systems ++ users;
   "secrets/n8n-env.age".publicKeys = systems ++ users;
   "secrets/paperless-key.age".publicKeys = systems ++ users;
+  "secrets/ref-key.age".publicKeys = systems ++ users;
+  "secrets/exa-key.age".publicKeys = systems ++ users;
+  "secrets/basecamp-client-id.age".publicKeys = systems ++ users;
+  "secrets/basecamp-client-secret.age".publicKeys = systems ++ users;
+  "secrets/gitea-runner-token.age".publicKeys = systems ++ users;
   "secrets/restreamer-env.age".publicKeys = systems ++ users;
   "secrets/searx.age".publicKeys = systems ++ users;
   "secrets/tailscale-key.age".publicKeys = systems ++ users;

secrets/basecamp-client-secret.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw eqiq6a9Ht012v9ryAt2uZwpCU5/DFbiMZIkH0A/ovhc
+c2ubOjYEc6RjhrZUCyKvB7chJwlCBv1KeIXdXlYcyNA
+-> ssh-ed25519 5kwcsA R+KKgXolqFgs3sPFKLWBj8CYMHvsE0vcoPYjqgaYSDc
+jdl1BcHDXY3lvAfFKeHl8lNgbjbxLPOL+5OaPBsJC5o
+-> ssh-ed25519 9d4YIQ KYeIi3u2JB3efI5pSlc4up2wgAvR+X1xsHuRSZmr5RY
+Qy6wagBuOXuy5b23stKEc/zfMpN53/56LKMgPFd5fwo
+-> ssh-ed25519 3Bcr1w yYclbDnxBkGQF+MmcqNDG2VHZDcXK01Orl2c0L4auy4
+wbC9r7P4hnJT+V0Ic3Pk9nQ5ZUoPL+/qR9Ab5OHv3d0
+-> ssh-rsa DQlE7w
+CQBYcl5SvyoDAm5n1QWE9o2er5GxYZvG2zrBtOPs+S7gnm6yHL2rtKDfxf+tpp/E
+8xJHSi6t9zTWYwZ+udU8gjmawe8GcaWGYOHqjCd4H6Ic5c1aMMfUQsPR2aWlJ7R5
+4B1D83pZ/PHp1Qqb/AJKoiw3DNo4KrvYS+nX4FXuDD8o9JRuY5KjbY+9E2UcHx0s
+8XGZq26TY8I2hVA8519bZeI4FTqoBx0yUBuE3VjTlrd/XtgpvNk0YswyMBiqpdhG
+PY+KZAnEPw3TbFtfmqbLk5QXrm4pn/TE/z4kzN9+3CkT2zbBBPGwaBAtQsOQ6yKL
+ZQRtnEm9FJzOBu3fFodeBfea8vEzEmuro+zbw/94tk0zjpMzfSehRfLE8tusgO+S
+/W/7yzlMVeutlWbzwpMZ4mALjz/PAYq8O3Kh88dbu9XEh0i/oWPBJiHlUdYND2YJ
+5WOSlXDnotRmwB8vGmyPWS72jBfgPZLVfA7y73RzOhc6vwo4jU5Nh6ee+3LPOjfW
+
+--- 6X7pxwraQpXikkDgLrY3ay7zcwdk9U9LHx/MP8jEgcw
+<3‘jÂ<6A>ö¼uWÙF“’DæÙŸ™$Hð¹Ç†s)àSÚˆ›/ïÂëº pí3üA‰Sö^ùïóïVß‹u@9‡»µ´rš+L2

secrets/exa-key.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw BJ2iDD2cLf/qP+VxEHz6Y+8GJ4s4I2wP92uBMG2ttQc
+Nea+eK5CELL0eBq8+xuT+qDEbPyRzUgjnhDY+Mk8bjA
+-> ssh-ed25519 5kwcsA kpzfRai9rtonBkKVpYkD5kSYTsxbpwAliLO6WnyAgx8
+BXG4c2yGwkaXPCkKAiOqrNJknz/tN1jOXmTuj6mJvzA
+-> ssh-ed25519 9d4YIQ fRuLFIYDaY7JdtZs9BP4xm7zwDdBYGrzuueuQgS+QWo
+YM65b3HG43cP7EvcbX+WIn76a9I427MaeI0kJm0ZjHA
+-> ssh-ed25519 3Bcr1w /zGBacmchTtDaaCykhuJkMatDzuo7Hi8iefvnqYDyEg
+bK+aCK8cN7gDqLo15z6BC7WaWA+xXXSjP/eoe3ch71M
+-> ssh-rsa DQlE7w
+JRj461Gh8JYOykv4J2ce6W+q0y4imNfJgAF8r/1FvIy1VYSpDPtPqX6zIldKZ4Fs
+dcTpL4AFyQHysrLlMeTuOf7+91vWxBAPqMUR4DtEqxrnYKDpDMy6Addonx7ZhmwZ
+gl1dnfx7W9OxGrYZm3YsV5q4lvK1rwzDIswFduOky/kH65SUzdLl5nm8AcSQbKjy
+k2jR57/0+z2wmHdxrjY4aEredqTXZNfWRbrX3RQc3xlzka4qajVKAuq4V6EsV3h0
+SjQfRgMTnqMyTxqbURl2L5juZrLSj3UAFvYLi7nLCfKjBeRmezG5zZ58eJPnq3co
+A5Dy884MXuciLhc8nDUcTCSJap50P9HlyETq6ptzBV8JAF9TSpxY/gzbMt77VZFb
+MKf+3gtUIOaXzmzkFp6u90XLN+0n6kM+eJw6PMAPHxHfRDHTtPXE7ZMxRt/TKv1D
+Pi/Aqmi5Q9t79TfcNsIT7DcspefCSf4NdTrggxOxo0jmKNw4mdN5SLVqnZ/Ij72R
+
+--- gwpY8yhU+VJSvw2xbmfKHrp8lJpb/0LuGaFDRIA7ORI
+¥.ÑÉ®ŸùL,rð’RjmÚê<ûo

secrets/gitea-runner-token.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw yQsk1NS2ujPzm4WJLl/CYi0EZRCIFvgJP2aLG09KJQE
+H2QT+huNTEpE2ndSeyL38e1JW1Z+UEHObqhZQ66E28M
+--- 1lhPBj02CB6BsouveThOL4pyTKXQhrUro59YXz0+fRk
+qœË=÷¼V<C2BC>wÃ×Ü®1A<31>½ß²uš!óI›(ÏÄ?¤CC"ßÞ‹’3.ëÎåŽãsŒô :"úÔº|¦ÑæÆçY2”þ\ï<>ýˆ›Í¨«

secrets/ref-key.age

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 4NLKrw ARySQU5NWBIxM1sICZMk/SU+kPMrvd3M9zs65v42hVo
+3/SeIH0CpIicYOjG3Swrpt/4Nplo4parVWt3qIoW7SI
+-> ssh-ed25519 5kwcsA M4GABkszkaU5TmeemgEp/iJ4myYL3fmZFrNP5wYq1iM
+rOyGrD1hAMzQVBJeDTDXZPyaIyoEvDisGe7Te491Wv4
+-> ssh-ed25519 9d4YIQ eyJigzNeLlC1YxambeZYE2bMzUUgMqJHtpPxlZheERg
+mZsYy9QTl6EnF//u2Agt/9cKxxMZw7nJDfJV/n+dVaA
+-> ssh-ed25519 3Bcr1w oEZnh+FPv7EqyKLcX5rmvTGRIZlSj1ycaFg/cTCIqiM
+AlOvpd+MAAe43hLfcROQ+QIkUOPmjc1SPu3NPIEhlyc
+-> ssh-rsa DQlE7w
+WgdDjMGNKWgxa2QxYh33HO8JrkNeYtTqMs5Ninb0+FzJYTD+zCYWUlFEPcytp8Dl
+gzGH5dwTG1Tvjig5a7IWcw8sO7AAklpU95oauq3Pi1rBq8IBBpmAjvCWb8Is9UsQ
+cazsOmFHYQfmCWfd1TugIOju4ovJMmUxx6acAN6McD723Q7Ns+WVmLGS/ot2LsKE
+WMXTVarDk++NhIHlwmHbVk7Nej8OwFt2xTJM3ihENtCLb46wDcBfEO4GaYHxY2dn
+AjuGFTgv5U8ZjdSuktw0gMV0Eldgwk04NfX1+Ey0dDSJ2/f4i4O1AqQZ3ylhBrhv
+aVS/XQxmJphSlSux5puquGtJIyI+vTUWPlQ0zIAGuKCmXQ9K5FKxdOmsl73/fBqj
+rpWUX6YQ9993fUpVvnCRjOThG6x8L90J5MfksgJKNP6QPDc7r2aV8p5vzY0ssE2B
+JYvhRYGp0esP/DyMSczExQRpAfhNwS6ONhDjcmTRJAeaxuyteTOyypGG5morzQq9
+
+--- 3dwuxoM7PjwyPI6fn5lRwxonntFxBNCREh0LipP7IRI
+V‚‡lÝžŽçU[`Û´Hxn~¹:
šŠzi\Ñ¥ƒWm«Åc_ÞÓfÍå->