Add gamescope (steam) login option

common/network/pia-vpn/vpn-container.nix

@@ -270,10 +270,17 @@ in
                 return 0
               }
 
-              if check_vpn; then
-                rm -f "$COUNTER_FILE"
-                exit 0
-              fi
+              MAX_RETRIES=4
+              for attempt in $(seq 1 $MAX_RETRIES); do
+                if check_vpn; then
+                  rm -f "$COUNTER_FILE"
+                  exit 0
+                fi
+                if [ "$attempt" -lt "$MAX_RETRIES" ]; then
+                  echo "Attempt $attempt/$MAX_RETRIES failed, retrying in 5 minutes..." >&2
+                  sleep 300
+                fi
+              done
 
               # Failed — read and update counter (reset if from a previous day)
               today=$(date +%Y-%m-%d)
@@ -302,7 +309,7 @@ in
             description = "Periodic PIA VPN connectivity check";
             wantedBy = [ "timers.target" ];
             timerConfig = {
-              OnCalendar = "*:0/5";
+              OnCalendar = "*:0/30";
               RandomizedDelaySec = "30s";
             };
           };

common/pc/kde.nix

@@ -9,6 +9,14 @@ in
     services.displayManager.sddm.wayland.enable = true;
     services.desktopManager.plasma6.enable = true;
 
+    services.displayManager.sessionPackages = [
+      pkgs.plasma-bigscreen
+    ];
+
+    # Bigscreen binaries must be on PATH for autostart services, KCMs, and
+    # internal plasmashell launches (settings, input handler, envmanager, etc.)
+    environment.systemPackages = [ pkgs.plasma-bigscreen ];
+
     # kde apps
     users.users.googlebot.packages = with pkgs; [
       # akonadi

common/pc/steam.nix

@@ -8,6 +8,20 @@ in
     programs.steam.enable = true;
     hardware.steam-hardware.enable = true; # steam controller
 
+    # Login DE Option: Steam Gamescope (Steam Deck-like session)
+    programs.gamescope = {
+      enable = true;
+    };
+    programs.steam.gamescopeSession = {
+      enable = true;
+      args = [
+        "--hdr-enabled"
+        "--hdr-itm-enabled"
+        "--adaptive-sync"
+      ];
+    };
+    environment.systemPackages = [ pkgs.gamescope-wsi ];
+
     users.users.googlebot.packages = [
       pkgs.steam
     ];

common/server/ntfy.nix

@@ -18,6 +18,7 @@ in
       auth-default-access = "deny-all";
       behind-proxy = true;
       enable-login = true;
+      attachment-expiry-duration = "48h";
     };
 
     # backups

machines/fry/hardware-configuration.nix

@@ -18,7 +18,7 @@
   boot.extraModulePackages = [ ];
 
   # thunderbolt
-  services.hardware.bolt.enable = true;
+  services.hardware.bolt.enable = false;
 
   # firmware
   firmware.x86_64.enable = true;

machines/howl/hardware-configuration.nix

@@ -22,7 +22,7 @@
   boot.extraModulePackages = [ ];
 
   # thunderbolt
-  services.hardware.bolt.enable = true;
+  services.hardware.bolt.enable = false;
 
   # firmware
   firmware.x86_64.enable = true;

machines/zoidberg/default.nix

@@ -5,10 +5,6 @@
     ./hardware-configuration.nix
   ];
 
-  # Login DE Option: Steam
-  programs.steam.gamescopeSession.enable = true;
-  # programs.gamescope.capSysNice = true;
-
   # Login DE Option: Kodi
   services.xserver.desktopManager.kodi.enable = true;
   services.xserver.desktopManager.kodi.package =
@@ -35,7 +31,7 @@
     "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
   ];
 
-  services.displayManager.defaultSession = "plasma";
+  services.displayManager.defaultSession = "plasma-bigscreen-wayland";
 
   users.users.cris = {
     isNormalUser = true;
@@ -54,10 +50,10 @@
     uid = 1002;
   };
 
-  # Auto login into Plasma in john zoidberg account
+  # Auto login into Plasma Bigscreen in john zoidberg account
   services.displayManager.sddm.settings = {
     Autologin = {
-      Session = "plasma";
+      Session = "plasma-bigscreen-wayland";
       User = "john";
     };
   };

overlays/default.nix

@@ -31,4 +31,12 @@ in
       ../patches/music-assistant-zeroconf-port.patch
     ];
   });
+
+  # Plasma Bigscreen: TV-optimized KDE shell (not yet packaged in nixpkgs)
+  plasma-bigscreen = import ./plasma-bigscreen.nix {
+    inherit (prev.kdePackages)
+      mkKdeDerivation plasma-workspace plasma-wayland-protocols
+      qtmultimedia qtwayland qtwebengine qcoro;
+    inherit (prev) lib fetchFromGitLab pkg-config sdl3 libcec wayland;
+  };
 }

overlays/plasma-bigscreen.nix

@@ -0,0 +1,79 @@
+{
+  mkKdeDerivation,
+  lib,
+  fetchFromGitLab,
+  pkg-config,
+  plasma-workspace,
+  qtmultimedia,
+  qtwayland,
+  qtwebengine,
+  qcoro,
+  plasma-wayland-protocols,
+  wayland,
+  sdl3,
+  libcec,
+}:
+mkKdeDerivation {
+  pname = "plasma-bigscreen";
+  version = "unstable-2026-03-07";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "plasma";
+    repo = "plasma-bigscreen";
+    rev = "bd143fea7e386bac1652b8150a3ed3d5ef7cf93c";
+    hash = "sha256-y439IX7e0+XqxqFj/4+P5le0hA7DiwA+smDsD0UH/fI=";
+  };
+
+  patches = [
+    ../patches/plasma-bigscreen-input-handler-app-id.patch
+  ];
+
+  extraNativeBuildInputs = [ pkg-config ];
+
+  extraBuildInputs = [
+    qtmultimedia
+    qtwayland
+    qtwebengine
+    qcoro
+    plasma-wayland-protocols
+    wayland
+    sdl3
+    libcec
+  ];
+
+  # Match project version to installed Plasma release so cmake version checks pass
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(PROJECT_VERSION "6.5.80")' \
+                     'set(PROJECT_VERSION "${plasma-workspace.version}")'
+
+    # Upstream references a nonexistent startplasma-waylandsession binary.
+    # Fix this in the cmake template (before @KDE_INSTALL_FULL_LIBEXECDIR@ is substituted).
+    substituteInPlace bin/plasma-bigscreen-wayland.in \
+      --replace-fail \
+        'startplasma-wayland --xwayland --libinput --exit-with-session=@KDE_INSTALL_FULL_LIBEXECDIR@/startplasma-waylandsession' \
+        'startplasma-wayland'
+  '';
+
+  # FIXME: work around Qt 6.10 cmake API changes
+  cmakeFlags = [ "-DQT_FIND_PRIVATE_MODULES=1" ];
+
+  # QML lint fails on missing runtime-only imports (org.kde.private.biglauncher)
+  # that are only available inside a running Plasma session
+  dontQmlLint = true;
+
+  postFixup = ''
+    # Session .desktop references $out/libexec/plasma-dbus-run-session-if-needed
+    # but the binary lives in plasma-workspace
+    substituteInPlace "$out/share/wayland-sessions/plasma-bigscreen-wayland.desktop" \
+      --replace-fail \
+        "$out/libexec/plasma-dbus-run-session-if-needed" \
+        "${plasma-workspace}/libexec/plasma-dbus-run-session-if-needed"
+
+  '';
+
+  passthru.providedSessions = [ "plasma-bigscreen-wayland" ];
+
+  meta.license = with lib.licenses; [ gpl2Plus ];
+}

patches/plasma-bigscreen-input-handler-app-id.patch

@@ -0,0 +1,19 @@
+Use the correct app_id when pre-authorizing remote-desktop portal access.
+
+The portal's isAppMegaAuthorized() looks up the caller's specific app_id in
+the PermissionStore.  An empty string only matches apps the portal cannot
+identify; it is not a wildcard.  Since the input handler is launched via
+KIO::CommandLauncherJob with a desktopName, the portal resolves it to the
+desktop file ID, so the empty-string entry never matches.
+
+--- a/inputhandler/xdgremotedesktopsystem.cpp
++++ b/inputhandler/xdgremotedesktopsystem.cpp
+@@ -66,7 +67,7 @@
+     QDBusReply<void> reply = permissionStore.call(QStringLiteral("SetPermission"),
+                                                   QStringLiteral("kde-authorized"), // table
+                                                   true, // create table if not exists
+                                                   QStringLiteral("remote-desktop"), // id
+-                                                  QLatin1String(""), // app (empty for host applications)
++                                                  QStringLiteral("org.kde.plasma.bigscreen.inputhandler"),
+                                                   QStringList{QStringLiteral("yes")}); // permissions
+