Improve gamescope session

Don't ntfy for logrotate failures and add container names to ntfy alerts
Add gamescope (steam) login option
2026-03-14 18:58:29 -07:00 · 2026-03-14 18:58:29 -07:00 · 2026-03-14 18:58:29 -07:00 · 2026-03-14 18:58:29 -07:00 · 2026-03-14 18:58:29 -07:00 · 2026-03-14 18:58:29 -07:00
12 changed files with 200 additions and 45 deletions
--- a/common/network/pia-vpn/service-container.nix
+++ b/common/network/pia-vpn/service-container.nix
@@ -11,6 +11,7 @@ with lib;

 let
  cfg = config.pia-vpn;
+  hostName = config.networking.hostName;

  mkContainer = name: ctr: {
    autoStart = true;
@@ -28,6 +29,9 @@ let
    config = { config, pkgs, lib, ... }: {
      imports = allModules ++ [ ctr.config ];

+      ntfy-alerts.ignoredUnits = [ "logrotate" ];
+      ntfy-alerts.hostLabel = "${hostName}/${name}";
+
      # Static IP with gateway pointing to VPN container
      networking.useNetworkd = true;
      systemd.network.enable = true;
--- a/common/network/pia-vpn/vpn-container.nix
+++ b/common/network/pia-vpn/vpn-container.nix
@@ -6,6 +6,7 @@ with lib;

 let
  cfg = config.pia-vpn;
+  hostName = config.networking.hostName;
  scripts = import ./scripts.nix;

  # Port forwarding derived state
@@ -98,6 +99,8 @@ in

          # Route ntfy alerts through the host proxy (VPN container has no gateway on eth0)
          ntfy-alerts.curlExtraArgs = "--proxy http://${cfg.hostAddress}:${toString cfg.proxyPort}";
+          ntfy-alerts.ignoredUnits = [ "logrotate" ];
+          ntfy-alerts.hostLabel = "${hostName}/pia-vpn";

          # Enable forwarding so bridge traffic can go through WG
          boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -270,10 +273,17 @@ in
                return 0
              }

-              if check_vpn; then
-                rm -f "$COUNTER_FILE"
-                exit 0
-              fi
+              MAX_RETRIES=4
+              for attempt in $(seq 1 $MAX_RETRIES); do
+                if check_vpn; then
+                  rm -f "$COUNTER_FILE"
+                  exit 0
+                fi
+                if [ "$attempt" -lt "$MAX_RETRIES" ]; then
+                  echo "Attempt $attempt/$MAX_RETRIES failed, retrying in 5 minutes..." >&2
+                  sleep 300
+                fi
+              done

              # Failed — read and update counter (reset if from a previous day)
              today=$(date +%Y-%m-%d)
@@ -302,7 +312,7 @@ in
            description = "Periodic PIA VPN connectivity check";
            wantedBy = [ "timers.target" ];
            timerConfig = {
-              OnCalendar = "*:0/5";
+              OnCalendar = "*:0/30";
              RandomizedDelaySec = "30s";
            };
          };
--- a/common/ntfy/default.nix
+++ b/common/ntfy/default.nix
@@ -26,6 +26,12 @@
      default = [ ];
      description = "Unit names to skip failure notifications for.";
    };
+
+    hostLabel = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+      description = "Label used in ntfy alert titles to identify this host/container.";
+    };
  };

  config = lib.mkIf config.thisMachine.hasRole."ntfy" {
--- a/common/ntfy/service-failure.nix
+++ b/common/ntfy/service-failure.nix
@@ -32,7 +32,7 @@ in
            --max-time 30 --retry 3 \
            ${cfg.curlExtraArgs} \
            -H "Authorization: Bearer $NTFY_TOKEN" \
-            -H "Title: Service failure on ${config.networking.hostName}" \
+            -H "Title: Service failure on ${cfg.hostLabel}" \
            -H "Priority: high" \
            -H "Tags: rotating_light" \
            -H "Message: Unit $unit failed at $(date +%c)" \
--- a/common/pc/kde.nix
+++ b/common/pc/kde.nix
@@ -9,6 +9,14 @@ in
    services.displayManager.sddm.wayland.enable = true;
    services.desktopManager.plasma6.enable = true;

+    services.displayManager.sessionPackages = [
+      pkgs.plasma-bigscreen
+    ];
+
+    # Bigscreen binaries must be on PATH for autostart services, KCMs, and
+    # internal plasmashell launches (settings, input handler, envmanager, etc.)
+    environment.systemPackages = [ pkgs.plasma-bigscreen ];
+
    # kde apps
    users.users.googlebot.packages = with pkgs; [
      # akonadi
--- a/common/pc/steam.nix
+++ b/common/pc/steam.nix
@@ -8,6 +8,29 @@ in
    programs.steam.enable = true;
    hardware.steam-hardware.enable = true; # steam controller

+    # Login DE Option: Steam Gamescope (Steam Deck-like session)
+    programs.gamescope = {
+      enable = true;
+    };
+    programs.steam.gamescopeSession = {
+      enable = true;
+      args = [
+        "--hdr-enabled"
+        "--hdr-itm-enabled"
+        "--adaptive-sync"
+      ];
+      steamArgs = [
+        "-steamos3"
+        "-gamepadui"
+        "-pipewire-dmabuf"
+      ];
+      env = {
+        STEAM_ENABLE_VOLUME_HANDLER = "1";
+        STEAM_DISABLE_AUDIO_DEVICE_SWITCHING = "1";
+      };
+    };
+    environment.systemPackages = [ pkgs.gamescope-wsi ];
+
    users.users.googlebot.packages = [
      pkgs.steam
    ];
--- a/common/server/gitea-actions-runner.nix
+++ b/common/server/gitea-actions-runner.nix
@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, allModules, ... }:

 # Gitea Actions Runner inside a NixOS container.
 # The container shares the host's /nix/store (read-only) and nix-daemon socket,
@@ -8,7 +8,7 @@

 let
  thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
-  hostOverlays = config.nixpkgs.overlays;
+  hostName = config.networking.hostName;
  containerName = "gitea-runner";
  giteaRunnerUid = 991;
  giteaRunnerGid = 989;
@@ -32,8 +32,10 @@ in
      };

      config = { config, lib, pkgs, ... }: {
-        system.stateVersion = "25.11";
-        nixpkgs.overlays = hostOverlays;
+        imports = allModules;
+
+        ntfy-alerts.ignoredUnits = [ "logrotate" ];
+        ntfy-alerts.hostLabel = "${hostName}/${containerName}";

        services.gitea-actions-runner.instances.inst = {
          enable = true;
--- a/flake.lock
+++ b/flake.lock
@@ -53,11 +53,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772587858,
-        "narHash": "sha256-w0/XBU20BdBeEIJ9i3ecr9Lc6c8uQaXUn/ri+aOsyJk=",
+        "lastModified": 1773106230,
+        "narHash": "sha256-ob/uMOU6CyRES+/SIxnMDhDAZUQr228JdBPKkGu8m/c=",
        "owner": "sadjow",
        "repo": "claude-code-nix",
-        "rev": "0a5fc14be38fabfcfff18db749b63c9c15726765",
+        "rev": "5cbf0a4eba950cdc7d7982774a9bc189ab21cb99",
        "type": "github"
      },
      "original": {
@@ -186,11 +186,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769939035,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "lastModified": 1772893680,
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
        "type": "github"
      },
      "original": {
@@ -228,11 +228,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772569491,
-        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
+        "lastModified": 1773179137,
+        "narHash": "sha256-EdW2bwzlfme0vbMOcStnNmKlOAA05Bp6su2O8VLGT0k=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
+        "rev": "3f98e2bbc661ec0aaf558d8a283d6955f05f1d09",
        "type": "github"
      },
      "original": {
@@ -250,11 +250,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1772338235,
-        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
+        "lastModified": 1773018425,
+        "narHash": "sha256-fpgZBmZpKoEXEowBK/6m8g9FcOLWQ4UxhXHqCw2CpSM=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
+        "rev": "25ebda3c558e923720c965832dc9a04f559a055c",
        "type": "github"
      },
      "original": {
@@ -270,11 +270,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772341813,
-        "narHash": "sha256-/PQ0ubBCMj/MVCWEI/XMStn55a8dIKsvztj4ZVLvUrQ=",
+        "lastModified": 1772945408,
+        "narHash": "sha256-PMt48sEQ8cgCeljQ9I/32uoBq/8t8y+7W/nAZhf72TQ=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "a2051ff239ce2e8a0148fa7a152903d9a78e854f",
+        "rev": "1c1d8ea87b047788fd7567adf531418c5da321ec",
        "type": "github"
      },
      "original": {
@@ -285,11 +285,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1771969195,
-        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
+        "lastModified": 1772972630,
+        "narHash": "sha256-mUJxsNOrBMNOUJzN0pfdVJ1r2pxeqm9gI/yIKXzVVbk=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
+        "rev": "3966ce987e1a9a164205ac8259a5fe8a64528f72",
        "type": "github"
      },
      "original": {
@@ -301,11 +301,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1772542754,
-        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
+        "lastModified": 1772963539,
+        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
        "type": "github"
      },
      "original": {
@@ -344,11 +344,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772064816,
-        "narHash": "sha256-ks1D9Rtmopd5F/8ENjEUJpSYYMxv603/v6TRen9Hq54=",
+        "lastModified": 1773194666,
+        "narHash": "sha256-YbsbqtTB3q0JjP7/G7GO58ea49cps1+8sb95/Bt7oVs=",
        "owner": "simple-nixos-mailserver",
        "repo": "nixos-mailserver",
-        "rev": "ea4dc17f4bc0f65eed082fa394509e4543072b56",
+        "rev": "489fbc4e0ef987cfdce700476abafe3269ebf3e5",
        "type": "gitlab"
      },
      "original": {
@@ -361,11 +361,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1772189877,
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
        "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
+        "revCount": 1255,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
--- a/machines/zoidberg/default.nix
+++ b/machines/zoidberg/default.nix
@@ -5,10 +5,6 @@
    ./hardware-configuration.nix
  ];

-  # Login DE Option: Steam
-  programs.steam.gamescopeSession.enable = true;
-  # programs.gamescope.capSysNice = true;
-
  # Login DE Option: Kodi
  services.xserver.desktopManager.kodi.enable = true;
  services.xserver.desktopManager.kodi.package =
@@ -35,7 +31,7 @@
    "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
  ];

-  services.displayManager.defaultSession = "plasma";
+  services.displayManager.defaultSession = "plasma-bigscreen-wayland";

  users.users.cris = {
    isNormalUser = true;
@@ -54,10 +50,10 @@
    uid = 1002;
  };

-  # Auto login into Plasma in john zoidberg account
+  # Auto login into Plasma Bigscreen in john zoidberg account
  services.displayManager.sddm.settings = {
    Autologin = {
-      Session = "plasma";
+      Session = "plasma-bigscreen-wayland";
      User = "john";
    };
  };
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -31,4 +31,12 @@ in
      ../patches/music-assistant-zeroconf-port.patch
    ];
  });
+
+  # Plasma Bigscreen: TV-optimized KDE shell (not yet packaged in nixpkgs)
+  plasma-bigscreen = import ./plasma-bigscreen.nix {
+    inherit (prev.kdePackages)
+      mkKdeDerivation plasma-workspace plasma-wayland-protocols
+      qtmultimedia qtwayland qtwebengine qcoro;
+    inherit (prev) lib fetchFromGitLab pkg-config sdl3 libcec wayland;
+  };
 }
--- a/overlays/plasma-bigscreen.nix
+++ b/overlays/plasma-bigscreen.nix
@@ -0,0 +1,79 @@
+{
+  mkKdeDerivation,
+  lib,
+  fetchFromGitLab,
+  pkg-config,
+  plasma-workspace,
+  qtmultimedia,
+  qtwayland,
+  qtwebengine,
+  qcoro,
+  plasma-wayland-protocols,
+  wayland,
+  sdl3,
+  libcec,
+}:
+mkKdeDerivation {
+  pname = "plasma-bigscreen";
+  version = "unstable-2026-03-07";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "plasma";
+    repo = "plasma-bigscreen";
+    rev = "bd143fea7e386bac1652b8150a3ed3d5ef7cf93c";
+    hash = "sha256-y439IX7e0+XqxqFj/4+P5le0hA7DiwA+smDsD0UH/fI=";
+  };
+
+  patches = [
+    ../patches/plasma-bigscreen-input-handler-app-id.patch
+  ];
+
+  extraNativeBuildInputs = [ pkg-config ];
+
+  extraBuildInputs = [
+    qtmultimedia
+    qtwayland
+    qtwebengine
+    qcoro
+    plasma-wayland-protocols
+    wayland
+    sdl3
+    libcec
+  ];
+
+  # Match project version to installed Plasma release so cmake version checks pass
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(PROJECT_VERSION "6.5.80")' \
+                     'set(PROJECT_VERSION "${plasma-workspace.version}")'
+
+    # Upstream references a nonexistent startplasma-waylandsession binary.
+    # Fix this in the cmake template (before @KDE_INSTALL_FULL_LIBEXECDIR@ is substituted).
+    substituteInPlace bin/plasma-bigscreen-wayland.in \
+      --replace-fail \
+        'startplasma-wayland --xwayland --libinput --exit-with-session=@KDE_INSTALL_FULL_LIBEXECDIR@/startplasma-waylandsession' \
+        'startplasma-wayland'
+  '';
+
+  # FIXME: work around Qt 6.10 cmake API changes
+  cmakeFlags = [ "-DQT_FIND_PRIVATE_MODULES=1" ];
+
+  # QML lint fails on missing runtime-only imports (org.kde.private.biglauncher)
+  # that are only available inside a running Plasma session
+  dontQmlLint = true;
+
+  postFixup = ''
+    # Session .desktop references $out/libexec/plasma-dbus-run-session-if-needed
+    # but the binary lives in plasma-workspace
+    substituteInPlace "$out/share/wayland-sessions/plasma-bigscreen-wayland.desktop" \
+      --replace-fail \
+        "$out/libexec/plasma-dbus-run-session-if-needed" \
+        "${plasma-workspace}/libexec/plasma-dbus-run-session-if-needed"
+
+  '';
+
+  passthru.providedSessions = [ "plasma-bigscreen-wayland" ];
+
+  meta.license = with lib.licenses; [ gpl2Plus ];
+}
--- a/patches/plasma-bigscreen-input-handler-app-id.patch
+++ b/patches/plasma-bigscreen-input-handler-app-id.patch
@@ -0,0 +1,19 @@
+Use the correct app_id when pre-authorizing remote-desktop portal access.
+
+The portal's isAppMegaAuthorized() looks up the caller's specific app_id in
+the PermissionStore.  An empty string only matches apps the portal cannot
+identify; it is not a wildcard.  Since the input handler is launched via
+KIO::CommandLauncherJob with a desktopName, the portal resolves it to the
+desktop file ID, so the empty-string entry never matches.
+
+--- a/inputhandler/xdgremotedesktopsystem.cpp
+++ b/inputhandler/xdgremotedesktopsystem.cpp
+@@ -66,7 +67,7 @@
+     QDBusReply<void> reply = permissionStore.call(QStringLiteral("SetPermission"),
+                                                   QStringLiteral("kde-authorized"), // table
+                                                   true, // create table if not exists
+                                                   QStringLiteral("remote-desktop"), // id
+-                                                  QLatin1String(""), // app (empty for host applications)
+                                                  QStringLiteral("org.kde.plasma.bigscreen.inputhandler"),
+                                                   QStringList{QStringLiteral("yes")}); // permissions
+
Author	SHA1	Message	Date
Zuckerberg	2762c323e9	Improve gamescope session All checks were successful Check Flake / check-flake (push) Successful in 2m16s Details Auto Update Flake / auto-update (push) Successful in 1h13m13s Details	2026-03-14 18:58:29 -07:00
Zuckerberg	bd71d6e2f5	Don't ntfy for logrotate failures and add container names to ntfy alerts	2026-03-14 18:58:29 -07:00
Zuckerberg	4899a37a82	Add gamescope (steam) login option	2026-03-14 18:58:29 -07:00
Zuckerberg	99200dc201	Initial KDE Plasma Bigscreen mode	2026-03-14 18:58:29 -07:00
Zuckerberg	4fb1c8957a	Make PIA connection check more tollerant to hiccups	2026-03-14 18:58:29 -07:00
Zuckerberg	d2c274fca5	Bump ntfy attachment expiry time	2026-03-14 18:58:29 -07:00
Zuckerberg	eac627765a	Disable bolt for now since I don't use it and it sometimes randomly hangs	2026-03-14 18:58:29 -07:00
Zuckerberg	63de76572b	Log DIMM temperatures on each check run	2026-03-14 18:58:29 -07:00
Zuckerberg	cbb94d9f4e	Fix VPN check alert limiting to only count failures StartLimitBurst counts all starts (including successes), so the timer was getting blocked after ~15 min. Replace with a JSON counter file that resets on success and daily, only triggering OnFailure alerts for the first 3 failures per day.	2026-03-14 18:58:29 -07:00
Zuckerberg	84745a3dc7	Remove recyclarr, I'm not using it currently	2026-03-14 18:58:29 -07:00
Zuckerberg	1d3a931fd0	Add periodic PIA VPN connectivity check Oneshot service + timer (every 5 min) inside the VPN container that verifies WireGuard handshake freshness and internet reachability. Fails on VPN or internet outage, triggering ntfy alert via OnFailure. Capped at 3 failures per day via StartLimitBurst.	2026-03-14 18:58:29 -07:00
Zuckerberg	23b0695cf2	Add DDR5 DIMM temperature monitoring with ntfy alerts Monitors spd5118 sensors every 5 minutes and sends an ntfy notification if any DIMM exceeds 55°C. Opt-in via ntfy-alerts.dimmTempCheck.enable, enabled on s0.	2026-03-14 18:58:29 -07:00
Zuckerberg	b1a26b681f	Add Music Assistant to Dashy and Gatus	2026-03-14 18:58:29 -07:00
Zuckerberg	401ab250f1	Update README	2026-03-14 18:58:29 -07:00
Zuckerberg	cd864b4061	Remove LanguageTool service	2026-03-14 18:58:29 -07:00
gitea-runner	6d2c5267a4	flake.lock: update inputs Some checks failed Check Flake / check-flake (push) Successful in 2m13s Details Auto Update Flake / auto-update (push) Failing after 47s Details	2026-03-10 23:00:31 -07:00
gitea-runner	76bcc114a1	flake.lock: update inputs All checks were successful Check Flake / check-flake (push) Successful in 2m24s Details Auto Update Flake / auto-update (push) Successful in 12m54s Details	2026-03-09 23:00:48 -07:00
gitea-runner	f2a482a46f	flake.lock: update inputs All checks were successful Check Flake / check-flake (push) Successful in 2m14s Details Auto Update Flake / auto-update (push) Successful in 1h42m53s Details	2026-03-07 22:00:55 -08:00
gitea-runner	969d8d8d5e	flake.lock: update inputs All checks were successful Check Flake / check-flake (push) Successful in 2m13s Details Auto Update Flake / auto-update (push) Successful in 12m50s Details	2026-03-06 22:00:31 -08:00
gitea-runner	518a7d0ffb	flake.lock: update inputs All checks were successful Check Flake / check-flake (push) Successful in 2m14s Details Auto Update Flake / auto-update (push) Successful in 17m40s Details	2026-03-05 22:00:37 -08:00
gitea-runner	2d6ad9f090	flake.lock: update inputs All checks were successful Check Flake / check-flake (push) Successful in 2m12s Details Auto Update Flake / auto-update (push) Successful in 8m19s Details	2026-03-04 22:00:30 -08:00