try out hyprland

StartLimitBurst counts all starts (including successes), so the timer
was getting blocked after ~15 min. Replace with a JSON counter file
that resets on success and daily, only triggering OnFailure alerts for
the first 3 failures per day.

common/network/pia-vpn/vpn-container.nix

@@ -228,44 +228,73 @@ in
           };
 
           # Periodic VPN connectivity check — fails if VPN or internet is down,
-          # triggering ntfy alert via the OnFailure drop-in
+          # triggering ntfy alert via the OnFailure drop-in.
+          # Tracks failures with a counter file so only the first 3 failures per
+          # day trigger an alert (subsequent failures exit 0 to suppress noise).
           systemd.services.pia-vpn-check = {
             description = "Check PIA VPN connectivity";
             after = [ "pia-vpn-setup.service" ];
             requires = [ "pia-vpn-setup.service" ];
 
-            path = with pkgs; [ wireguard-tools iputils coreutils gawk ];
+            path = with pkgs; [ wireguard-tools iputils coreutils gawk jq ];
-
-            unitConfig = {
-              StartLimitBurst = 3;
-              StartLimitIntervalSec = "1d";
-            };
 
             serviceConfig.Type = "oneshot";
 
             script = ''
               set -euo pipefail
 
+              COUNTER_FILE="/var/lib/pia-vpn/check-fail-count.json"
+              MAX_ALERTS=3
+
+              check_vpn() {
                 # Check that WireGuard has a peer with a recent handshake (within 3 minutes)
                 handshake=$(wg show ${cfg.interfaceName} latest-handshakes | awk '{print $2}')
                 if [ -z "$handshake" ] || [ "$handshake" -eq 0 ]; then
                   echo "No WireGuard handshake recorded" >&2
-                exit 1
+                  return 1
                 fi
                 now=$(date +%s)
                 age=$((now - handshake))
                 if [ "$age" -gt 180 ]; then
                   echo "WireGuard handshake is stale (''${age}s ago)" >&2
-                exit 1
+                  return 1
                 fi
 
                 # Verify internet connectivity through VPN tunnel
                 if ! ping -c1 -W10 1.1.1.1 >/dev/null 2>&1; then
                   echo "Cannot reach internet through VPN" >&2
-                exit 1
+                  return 1
                 fi
 
                 echo "PIA VPN connectivity OK (handshake ''${age}s ago)"
+                return 0
+              }
+
+              if check_vpn; then
+                rm -f "$COUNTER_FILE"
+                exit 0
+              fi
+
+              # Failed — read and update counter (reset if from a previous day)
+              today=$(date +%Y-%m-%d)
+              count=0
+              if [ -f "$COUNTER_FILE" ]; then
+                stored=$(jq -r '.date // ""' "$COUNTER_FILE")
+                if [ "$stored" = "$today" ]; then
+                  count=$(jq -r '.count // 0' "$COUNTER_FILE")
+                fi
+              fi
+              count=$((count + 1))
+              jq -n --arg date "$today" --argjson count "$count" \
+                '{"date": $date, "count": $count}' > "$COUNTER_FILE"
+
+              if [ "$count" -le "$MAX_ALERTS" ]; then
+                echo "Failure $count/$MAX_ALERTS today — alerting" >&2
+                exit 1
+              else
+                echo "Failure $count today — suppressing alert (already sent $MAX_ALERTS)" >&2
+                exit 0
+              fi
             '';
           };
 

common/ntfy/dimm-temp.nix

@@ -9,6 +9,7 @@ let
 
     threshold=55
     hot=""
+    summary=""
 
     while IFS= read -r line; do
       case "$line" in
@@ -18,6 +19,7 @@ let
         *temp1_input:*)
           temp="''${line##*: }"
           whole="''${temp%%.*}"
+          summary="''${summary:+$summary, }$chip: ''${temp}°C"
           if [ "$whole" -ge "$threshold" ]; then
             hot="$hot"$'\n'"  $chip: ''${temp}°C"
           fi
@@ -25,6 +27,8 @@ let
       esac
     done < <(sensors -u 'spd5118-*' 2>/dev/null)
 
+    echo "$summary"
+
     if [ -n "$hot" ]; then
       message="DIMM temperature above ''${threshold}°C on ${config.networking.hostName}:$hot"
 

common/pc/default.nix

@@ -6,6 +6,7 @@ in
 {
   imports = [
     ./kde.nix
+    ./hyprland.nix
     ./yubikey.nix
     ./chromium.nix
     ./firefox.nix

common/pc/hyprland.nix

@@ -0,0 +1,49 @@
+{ lib, config, pkgs, ... }:
+
+let
+  cfg = config.de;
+in
+{
+  config = lib.mkIf cfg.enable {
+    programs.hyprland.enable = true;
+    programs.hyprland.withUWSM = true;
+    programs.hyprland.xwayland.enable = true;
+
+    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
+
+    environment.systemPackages = with pkgs; [
+      # Bar
+      waybar
+
+      # Launcher
+      wofi
+
+      # Notifications
+      mako
+
+      # Lock/idle
+      hyprlock
+      hypridle
+
+      # Wallpaper
+      hyprpaper
+
+      # Polkit
+      hyprpolkitagent
+
+      # Screenshots
+      grim
+      slurp
+
+      # Clipboard
+      wl-clipboard
+      cliphist
+
+      # Color picker
+      hyprpicker
+
+      # Brightness (laptop keybinds)
+      brightnessctl
+    ];
+  };
+}

home/googlebot.nix

@@ -8,6 +8,7 @@ let
   thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
 in
 {
+  imports = [ ./hyprland.nix ];
   home.username = "googlebot";
   home.homeDirectory = "/home/googlebot";
 

home/hyprland.nix

@@ -0,0 +1,276 @@
+{ lib, osConfig, pkgs, ... }:
+
+let
+  thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
+in
+{
+  config = lib.mkIf thisMachineIsPersonal {
+    wayland.windowManager.hyprland = {
+      enable = true;
+      systemd.enable = false; # Required when using UWSM
+
+      settings = {
+        "$mod" = "SUPER";
+        "$terminal" = "ghostty";
+        "$menu" = "wofi --show drun";
+
+        general = {
+          gaps_in = 5;
+          gaps_out = 10;
+          border_size = 2;
+          "col.active_border" = "rgba(33ccffee) rgba(00ff99ee) 45deg";
+          "col.inactive_border" = "rgba(595959aa)";
+          layout = "dwindle";
+        };
+
+        decoration = {
+          rounding = 10;
+
+          blur = {
+            enabled = true;
+            size = 3;
+            passes = 1;
+          };
+
+          shadow = {
+            enabled = true;
+            range = 4;
+            render_power = 3;
+            color = "rgba(1a1a1aee)";
+          };
+        };
+
+        animations = {
+          enabled = true;
+          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
+          animation = [
+            "windows, 1, 7, myBezier"
+            "windowsOut, 1, 7, default, popin 80%"
+            "border, 1, 10, default"
+            "borderangle, 1, 8, default"
+            "fade, 1, 7, default"
+            "workspaces, 1, 6, default"
+          ];
+        };
+
+        dwindle = {
+          pseudotile = true;
+          preserve_split = true;
+        };
+
+        input = {
+          follow_mouse = 1;
+          touchpad = {
+            natural_scroll = true;
+          };
+        };
+
+        misc = {
+          force_default_wallpaper = 0;
+        };
+
+        bind = [
+          # Applications
+          "$mod, Return, exec, $terminal"
+          "$mod, D, exec, $menu"
+          "$mod, L, exec, hyprlock"
+
+          # Window management
+          "$mod, Q, killactive"
+          "$mod, F, fullscreen"
+          "$mod, V, togglefloating"
+          "$mod, P, pseudo"
+          "$mod, J, togglesplit"
+
+          # Move focus
+          "$mod, left, movefocus, l"
+          "$mod, right, movefocus, r"
+          "$mod, up, movefocus, u"
+          "$mod, down, movefocus, d"
+
+          # Switch workspaces
+          "$mod, 1, workspace, 1"
+          "$mod, 2, workspace, 2"
+          "$mod, 3, workspace, 3"
+          "$mod, 4, workspace, 4"
+          "$mod, 5, workspace, 5"
+          "$mod, 6, workspace, 6"
+          "$mod, 7, workspace, 7"
+          "$mod, 8, workspace, 8"
+          "$mod, 9, workspace, 9"
+          "$mod, 0, workspace, 10"
+
+          # Move active window to workspace
+          "$mod SHIFT, 1, movetoworkspace, 1"
+          "$mod SHIFT, 2, movetoworkspace, 2"
+          "$mod SHIFT, 3, movetoworkspace, 3"
+          "$mod SHIFT, 4, movetoworkspace, 4"
+          "$mod SHIFT, 5, movetoworkspace, 5"
+          "$mod SHIFT, 6, movetoworkspace, 6"
+          "$mod SHIFT, 7, movetoworkspace, 7"
+          "$mod SHIFT, 8, movetoworkspace, 8"
+          "$mod SHIFT, 9, movetoworkspace, 9"
+          "$mod SHIFT, 0, movetoworkspace, 10"
+
+          # Scroll through workspaces
+          "$mod, mouse_down, workspace, e+1"
+          "$mod, mouse_up, workspace, e-1"
+
+          # Screenshots
+          ", Print, exec, grim -g \"$(slurp)\" - | wl-copy"
+          "SHIFT, Print, exec, grim - | wl-copy"
+
+          # Clipboard history
+          "$mod SHIFT, V, exec, cliphist list | wofi --dmenu | cliphist decode | wl-copy"
+        ];
+
+        bindm = [
+          # Move/resize with mouse
+          "$mod, mouse:272, movewindow"
+          "$mod, mouse:273, resizewindow"
+        ];
+
+        bindel = [
+          # Volume
+          ", XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
+          ", XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
+
+          # Brightness
+          ", XF86MonBrightnessUp, exec, brightnessctl s 10%+"
+          ", XF86MonBrightnessDown, exec, brightnessctl s 10%-"
+        ];
+
+        bindl = [
+          ", XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
+        ];
+
+        exec-once = [
+          "waybar"
+          "mako"
+          "hyprpaper"
+          "wl-paste --type text --watch cliphist store"
+          "wl-paste --type image --watch cliphist store"
+        ];
+      };
+    };
+
+    # Waybar
+    programs.waybar = {
+      enable = true;
+      settings = {
+        mainBar = {
+          layer = "top";
+          position = "top";
+          height = 30;
+          modules-left = [ "hyprland/workspaces" ];
+          modules-center = [ "clock" ];
+          modules-right = [ "network" "pulseaudio" "battery" "tray" ];
+
+          clock = {
+            format = "{:%H:%M  %Y-%m-%d}";
+          };
+
+          battery = {
+            format = "{capacity}% {icon}";
+            format-icons = [ "" "" "" "" "" ];
+          };
+
+          network = {
+            format-wifi = "{essid} ({signalStrength}%) ";
+            format-ethernet = "{ipaddr}/{cidr} ";
+            format-disconnected = "Disconnected ";
+          };
+
+          pulseaudio = {
+            format = "{volume}% {icon}";
+            format-muted = "";
+            format-icons = {
+              default = [ "" "" "" ];
+            };
+            on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+          };
+
+          tray = {
+            spacing = 10;
+          };
+        };
+      };
+    };
+
+    # Notifications
+    services.mako = {
+      enable = true;
+      settings = {
+        default-timeout = 5000;
+        border-radius = 5;
+      };
+    };
+
+    # Idle daemon
+    services.hypridle = {
+      enable = true;
+      settings = {
+        general = {
+          lock_cmd = "pidof hyprlock || hyprlock";
+          before_sleep_cmd = "loginctl lock-session";
+          after_sleep_cmd = "hyprctl dispatch dpms on";
+        };
+
+        listener = [
+          {
+            timeout = 300;
+            on-timeout = "loginctl lock-session";
+          }
+          {
+            timeout = 330;
+            on-timeout = "hyprctl dispatch dpms off";
+            on-resume = "hyprctl dispatch dpms on";
+          }
+          {
+            timeout = 1800;
+            on-timeout = "systemctl suspend";
+          }
+        ];
+      };
+    };
+
+    # Lock screen
+    programs.hyprlock = {
+      enable = true;
+      settings = {
+        general = {
+          hide_cursor = true;
+          grace = 5;
+        };
+
+        background = [
+          {
+            monitor = "";
+            color = "rgba(25, 20, 20, 1.0)";
+            blur_passes = 2;
+            blur_size = 7;
+          }
+        ];
+
+        input-field = [
+          {
+            monitor = "";
+            size = "200, 50";
+            outline_thickness = 3;
+            dots_size = 0.33;
+            dots_spacing = 0.15;
+            outer_color = "rgb(151515)";
+            inner_color = "rgb(200, 200, 200)";
+            font_color = "rgb(10, 10, 10)";
+            fade_on_empty = true;
+            placeholder_text = "<i>Password...</i>";
+            hide_input = false;
+            position = "0, -20";
+            halign = "center";
+            valign = "center";
+          }
+        ];
+      };
+    };
+  };
+}

machines/storage/s0/default.nix

@@ -143,30 +143,6 @@
         services.lidarr.enable = true;
         services.lidarr.user = "public_data";
         services.lidarr.group = "public_data";
-        services.recyclarr = {
-          enable = true;
-          configuration = {
-            radarr.radarr_main = {
-              api_key = {
-                _secret = "/run/credentials/recyclarr.service/radarr-api-key";
-              };
-              base_url = "http://localhost:7878";
-              quality_definition.type = "movie";
-            };
-            sonarr.sonarr_main = {
-              api_key = {
-                _secret = "/run/credentials/recyclarr.service/sonarr-api-key";
-              };
-              base_url = "http://localhost:8989";
-              quality_definition.type = "series";
-            };
-          };
-        };
-
-        systemd.services.recyclarr.serviceConfig.LoadCredential = [
-          "radarr-api-key:/run/agenix/radarr-api-key"
-          "sonarr-api-key:/run/agenix/sonarr-api-key"
-        ];
 
         users.groups.public_data.gid = 994;
         users.users.public_data = {
@@ -177,8 +153,6 @@
       };
     };
   };
-  age.secrets.radarr-api-key.file = ../../../secrets/radarr-api-key.age;
-  age.secrets.sonarr-api-key.file = ../../../secrets/sonarr-api-key.age;
 
   # jellyfin
   # jellyfin cannot run in the vpn container and use hardware encoding

secrets/radarr-api-key.age

@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 hPp1nw gfVRDt7ReEnz10WvPa8UfBBnsRsiw7sxxXQMuXRnCVs
-slBNX9Yc1qSu1P5ioNDNLPd97NGE/LWPS/A+u9QGo4E
--> ssh-ed25519 ZDy34A e5MSY5qDP6WuEgbiK0p5esMQJBb3ScVpb15Ff8sTQgQ
-9nsimoUQncnbfiu13AnFWZXcpaiySUYdS1eH5O/3Fgg
--> ssh-ed25519 w3nu8g op1KSUhJgM6w/nlaUssQDiraQpVzgnWd//JMu2vFgms
-KvEaJfsB7Qkf+PnzFJdZ3wAxm2qj23IS8RRxyuGN2G4
--> ssh-ed25519 evqvfg 9L6pFuqkcChZq/W4zkATXm1Y76SEK+S4SyaiSlJd+C4
-j/UWJvo4Cr/UDfaN2milpJ6rU0w1EWdTAzV3SlrCcW8
---- bdG4zC5dx6cSPetH3DNeHEk6EYCJ5TXGrn8OhUMknNU
-/¶ø+ÏpñR[¤àJ-*‚@ÌÿŸx0Ú©ò-ä.*&T·™~-i	2€eƒ¡`@ëQ8š<l™àQK0AÕ§

secrets/secrets.nix

@@ -63,8 +63,4 @@ with roles;
 
   # zigbee2mqtt secrets
   "zigbee2mqtt.yaml.age".publicKeys = zigbee;
-
-  # Sonarr and Radarr secrets
-  "radarr-api-key.age".publicKeys = media-server;
-  "sonarr-api-key.age".publicKeys = media-server;
 }