Update flake

StartLimitBurst counts all starts (including successes), so the timer
was getting blocked after ~15 min. Replace with a JSON counter file
that resets on success and daily, only triggering OnFailure alerts for
the first 3 failures per day.

common/boot/remote-luks-unlock.nix

@@ -45,52 +45,57 @@ in
       authorizedKeys = cfg.sshAuthorizedKeys;
     };
 
-    boot.initrd.postDeviceCommands = ''
+    # Use systemd-tty-ask-password-agent for interactive LUKS passphrase entry over SSH
-      echo 'waiting for root device to be opened...'
+    boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent --watch";
-      mkfifo /crypt-ramfs/passphrase
-      echo /crypt-ramfs/passphrase >> /dev/null
-    '';
 
+    # Tor hidden service for remote unlock over onion
     boot.initrd.secrets = lib.mkIf cfg.enableTorUnlock {
       "/etc/tor/onion/bootup" = cfg.onionConfig;
     };
-    boot.initrd.extraUtilsCommands = lib.mkIf cfg.enableTorUnlock ''
-      copy_bin_and_libs ${pkgs.tor}/bin/tor
-      copy_bin_and_libs ${pkgs.haveged}/bin/haveged
-    '';
-    boot.initrd.network.postCommands = lib.mkMerge [
-      (
-        ''
-          # Add nice prompt for giving LUKS passphrase over ssh
-          echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
-        ''
-      )
 
-      (
+    boot.initrd.systemd.storePaths = lib.mkIf cfg.enableTorUnlock [
-        let torRc = (pkgs.writeText "tor.rc" ''
+      "${pkgs.tor}/bin/tor"
-          DataDirectory /etc/tor
+      "${pkgs.haveged}/bin/haveged"
-          SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+    ];
-          SOCKSPort 127.0.0.1:9063
+
-          HiddenServiceDir /etc/tor/onion/bootup
+    boot.initrd.systemd.services.tor-unlock = lib.mkIf cfg.enableTorUnlock {
-          HiddenServicePort 22 127.0.0.1:22
+      description = "Tor Hidden Service for Boot Unlock";
-        ''); in
+      wantedBy = [ "initrd.target" ];
-        lib.mkIf cfg.enableTorUnlock ''
+      after = [ "network.target" "sshd.service" ];
-          echo "tor: preparing onion folder"
+      wants = [ "network.target" ];
-          # have to do this otherwise tor does not want to start
+
+      unitConfig.DefaultDependencies = false;
+
+      serviceConfig = {
+        Type = "forking";
+        RemainAfterExit = true;
+      };
+
+      script =
+        let
+          torRc = pkgs.writeText "tor.rc" ''
+            DataDirectory /etc/tor
+            SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+            SOCKSPort 127.0.0.1:9063
+            HiddenServiceDir /etc/tor/onion/bootup
+            HiddenServicePort 22 127.0.0.1:22
+          '';
+        in
+        ''
+          # Fix permissions for tor
           chmod -R 700 /etc/tor
 
-          echo "make sure localhost is up"
+          # Ensure loopback is up
-          ip a a 127.0.0.1/8 dev lo
+          ip a a 127.0.0.1/8 dev lo 2>/dev/null || true
           ip link set lo up
 
-          echo "haveged: starting haveged"
+          # Start haveged for entropy
-          haveged -F &
+          ${pkgs.haveged}/bin/haveged -F &
 
-          echo "tor: starting tor"
+          # Verify and start tor
-          tor -f ${torRc} --verify-config
+          ${pkgs.tor}/bin/tor -f ${torRc} --verify-config
-          tor -f ${torRc} &
+          ${pkgs.tor}/bin/tor -f ${torRc} &
-        ''
+        '';
-      )
+    };
-    ];
   };
 }

common/network/pia-vpn/service-container.nix

@@ -11,6 +11,7 @@ with lib;
 
 let
   cfg = config.pia-vpn;
+  hostName = config.networking.hostName;
 
   mkContainer = name: ctr: {
     autoStart = true;
@@ -28,6 +29,9 @@ let
     config = { config, pkgs, lib, ... }: {
       imports = allModules ++ [ ctr.config ];
 
+      ntfy-alerts.ignoredUnits = [ "logrotate" ];
+      ntfy-alerts.hostLabel = "${hostName}/${name}";
+
       # Static IP with gateway pointing to VPN container
       networking.useNetworkd = true;
       systemd.network.enable = true;

common/network/pia-vpn/vpn-container.nix

@@ -6,6 +6,7 @@ with lib;
 
 let
   cfg = config.pia-vpn;
+  hostName = config.networking.hostName;
   scripts = import ./scripts.nix;
 
   # Port forwarding derived state
@@ -98,6 +99,8 @@ in
 
           # Route ntfy alerts through the host proxy (VPN container has no gateway on eth0)
           ntfy-alerts.curlExtraArgs = "--proxy http://${cfg.hostAddress}:${toString cfg.proxyPort}";
+          ntfy-alerts.ignoredUnits = [ "logrotate" ];
+          ntfy-alerts.hostLabel = "${hostName}/pia-vpn";
 
           # Enable forwarding so bridge traffic can go through WG
           boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -270,10 +273,17 @@ in
                 return 0
               }
 
-              if check_vpn; then
+              MAX_RETRIES=4
-                rm -f "$COUNTER_FILE"
+              for attempt in $(seq 1 $MAX_RETRIES); do
-                exit 0
+                if check_vpn; then
-              fi
+                  rm -f "$COUNTER_FILE"
+                  exit 0
+                fi
+                if [ "$attempt" -lt "$MAX_RETRIES" ]; then
+                  echo "Attempt $attempt/$MAX_RETRIES failed, retrying in 5 minutes..." >&2
+                  sleep 300
+                fi
+              done
 
               # Failed — read and update counter (reset if from a previous day)
               today=$(date +%Y-%m-%d)
@@ -302,7 +312,7 @@ in
             description = "Periodic PIA VPN connectivity check";
             wantedBy = [ "timers.target" ];
             timerConfig = {
-              OnCalendar = "*:0/5";
+              OnCalendar = "*:0/30";
               RandomizedDelaySec = "30s";
             };
           };

common/ntfy/default.nix

@@ -26,6 +26,12 @@
       default = [ ];
       description = "Unit names to skip failure notifications for.";
     };
+
+    hostLabel = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+      description = "Label used in ntfy alert titles to identify this host/container.";
+    };
   };
 
   config = lib.mkIf config.thisMachine.hasRole."ntfy" {

common/ntfy/service-failure.nix

@@ -32,7 +32,7 @@ in
             --max-time 30 --retry 3 \
             ${cfg.curlExtraArgs} \
             -H "Authorization: Bearer $NTFY_TOKEN" \
-            -H "Title: Service failure on ${config.networking.hostName}" \
+            -H "Title: Service failure on ${cfg.hostLabel}" \
             -H "Priority: high" \
             -H "Tags: rotating_light" \
             -H "Message: Unit $unit failed at $(date +%c)" \

common/pc/default.nix

@@ -6,7 +6,6 @@ in
 {
   imports = [
     ./kde.nix
-    ./hyprland.nix
     ./yubikey.nix
     ./chromium.nix
     ./firefox.nix

common/pc/hyprland.nix

@@ -1,49 +0,0 @@
-{ lib, config, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    programs.hyprland.enable = true;
-    programs.hyprland.withUWSM = true;
-    programs.hyprland.xwayland.enable = true;
-
-    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
-
-    environment.systemPackages = with pkgs; [
-      # Bar
-      waybar
-
-      # Launcher
-      wofi
-
-      # Notifications
-      mako
-
-      # Lock/idle
-      hyprlock
-      hypridle
-
-      # Wallpaper
-      hyprpaper
-
-      # Polkit
-      hyprpolkitagent
-
-      # Screenshots
-      grim
-      slurp
-
-      # Clipboard
-      wl-clipboard
-      cliphist
-
-      # Color picker
-      hyprpicker
-
-      # Brightness (laptop keybinds)
-      brightnessctl
-    ];
-  };
-}

common/pc/kde.nix

@@ -9,6 +9,14 @@ in
     services.displayManager.sddm.wayland.enable = true;
     services.desktopManager.plasma6.enable = true;
 
+    services.displayManager.sessionPackages = [
+      pkgs.plasma-bigscreen
+    ];
+
+    # Bigscreen binaries must be on PATH for autostart services, KCMs, and
+    # internal plasmashell launches (settings, input handler, envmanager, etc.)
+    environment.systemPackages = [ pkgs.plasma-bigscreen ];
+
     # kde apps
     users.users.googlebot.packages = with pkgs; [
       # akonadi

common/pc/steam.nix

@@ -8,6 +8,29 @@ in
     programs.steam.enable = true;
     hardware.steam-hardware.enable = true; # steam controller
 
+    # Login DE Option: Steam Gamescope (Steam Deck-like session)
+    programs.gamescope = {
+      enable = true;
+    };
+    programs.steam.gamescopeSession = {
+      enable = true;
+      args = [
+        "--hdr-enabled"
+        "--hdr-itm-enabled"
+        "--adaptive-sync"
+      ];
+      steamArgs = [
+        "-steamos3"
+        "-gamepadui"
+        "-pipewire-dmabuf"
+      ];
+      env = {
+        STEAM_ENABLE_VOLUME_HANDLER = "1";
+        STEAM_DISABLE_AUDIO_DEVICE_SWITCHING = "1";
+      };
+    };
+    environment.systemPackages = [ pkgs.gamescope-wsi ];
+
     users.users.googlebot.packages = [
       pkgs.steam
     ];

common/server/gitea-actions-runner.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, allModules, ... }:
 
 # Gitea Actions Runner inside a NixOS container.
 # The container shares the host's /nix/store (read-only) and nix-daemon socket,
@@ -8,7 +8,7 @@
 
 let
   thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
-  hostOverlays = config.nixpkgs.overlays;
+  hostName = config.networking.hostName;
   containerName = "gitea-runner";
   giteaRunnerUid = 991;
   giteaRunnerGid = 989;
@@ -32,8 +32,10 @@ in
       };
 
       config = { config, lib, pkgs, ... }: {
-        system.stateVersion = "25.11";
+        imports = allModules;
-        nixpkgs.overlays = hostOverlays;
+
+        ntfy-alerts.ignoredUnits = [ "logrotate" ];
+        ntfy-alerts.hostLabel = "${hostName}/${containerName}";
 
         services.gitea-actions-runner.instances.inst = {
           enable = true;

common/server/ntfy.nix

@@ -18,6 +18,7 @@ in
       auth-default-access = "deny-all";
       behind-proxy = true;
       enable-login = true;
+      attachment-expiry-duration = "48h";
     };
 
     # backups

flake.lock

@@ -53,11 +53,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772587858,
+        "lastModified": 1778800550,
-        "narHash": "sha256-w0/XBU20BdBeEIJ9i3ecr9Lc6c8uQaXUn/ri+aOsyJk=",
+        "narHash": "sha256-nLhQjocD45BwMS946dShAF6BnafpTTe10s8LAcIcLjo=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "0a5fc14be38fabfcfff18db749b63c9c15726765",
+        "rev": "1ba489d6e95f7bccf58250f7bdc5142122d53f2f",
         "type": "github"
       },
       "original": {
@@ -78,15 +78,15 @@
       "locked": {
         "lastModified": 1772394520,
         "narHash": "sha256-9c0sHyzoVtvufkSqVNGGydsgjpKv5Zf7062LmOm4Gsc=",
-        "ref": "refs/heads/master",
+        "owner": "GoogleBot42",
+        "repo": "dailybot",
         "rev": "d07483c17bf31d416de3642a2faec484ea1810ed",
-        "revCount": 21,
+        "type": "github"
-        "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
       },
       "original": {
-        "type": "git",
+        "owner": "GoogleBot42",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "repo": "dailybot",
+        "type": "github"
       }
     },
     "darwin": {
@@ -186,11 +186,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769939035,
+        "lastModified": 1775585728,
-        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
+        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
+        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772569491,
+        "lastModified": 1778853583,
-        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
+        "narHash": "sha256-0P4/nDOxxufeh5SD5vqpfFw0n4mq29WZISYAgfryD3Y=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
+        "rev": "1bedcc8740b9aa2f7d3e1312a6c88baf00909f54",
         "type": "github"
       },
       "original": {
@@ -250,11 +250,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1772338235,
+        "lastModified": 1778669912,
-        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
+        "narHash": "sha256-WT2iimtOBZM/6AcZeBoJU2EgUSaywtlItsEgNkZBda0=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
+        "rev": "a7a7009064cec75d9da652c6723412ce27b9bc44",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772341813,
+        "lastModified": 1778393439,
-        "narHash": "sha256-/PQ0ubBCMj/MVCWEI/XMStn55a8dIKsvztj4ZVLvUrQ=",
+        "narHash": "sha256-mOtQxUjtKaPHLeoLOY/YEDctmud1X9KwJr4kE1MJ3Wc=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "a2051ff239ce2e8a0148fa7a152903d9a78e854f",
+        "rev": "01466c414c7357ae2ce32be4a272a7c69e94ab5f",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1771969195,
+        "lastModified": 1778593042,
-        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
+        "narHash": "sha256-xYGrSg6354UK2K4WSQd4+TfyvfqmvFbSY+ZtGQUXK0c=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
+        "rev": "9bd7c80d43e258aaa607d83b43661df11444d808",
         "type": "github"
       },
       "original": {
@@ -301,11 +301,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772542754,
+        "lastModified": 1778443072,
-        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
+        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
         "type": "github"
       },
       "original": {
@@ -344,16 +344,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1772064816,
+        "lastModified": 1777287493,
-        "narHash": "sha256-ks1D9Rtmopd5F/8ENjEUJpSYYMxv603/v6TRen9Hq54=",
+        "narHash": "sha256-Fj7S91TuZm6+DG/v6SFme/p+sWrYMQICGX6yQ5KD43Q=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "ea4dc17f4bc0f65eed082fa394509e4543072b56",
+        "rev": "e33fbde199eaad513ef5d0746db19d5878150232",
         "type": "gitlab"
       },
       "original": {
         "owner": "simple-nixos-mailserver",
-        "ref": "master",
         "repo": "nixos-mailserver",
         "type": "gitlab"
       }
@@ -361,11 +360,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1759482047,
+        "lastModified": 1772189877,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
         "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
-        "revCount": 996,
+        "revCount": 1255,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

flake.nix

@@ -25,7 +25,7 @@
 
     # Mail Server
     simple-nixos-mailserver = {
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-compat.follows = "flake-compat";
@@ -44,7 +44,7 @@
 
     # Dailybot
     dailybot = {
-      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
+      url = "github:GoogleBot42/dailybot";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-utils.follows = "flake-utils";

home/googlebot.nix

@@ -8,7 +8,6 @@ let
   thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
 in
 {
-  imports = [ ./hyprland.nix ];
   home.username = "googlebot";
   home.homeDirectory = "/home/googlebot";
 
@@ -60,7 +59,7 @@ in
     enable = thisMachineIsPersonal;
   };
 
-  programs.vscode = {
+  programs.vscodium = {
     enable = thisMachineIsPersonal;
     # Must use fhs version for vscode-lldb
     package = pkgs.vscodium-fhs;

home/hyprland.nix

@@ -1,276 +0,0 @@
-{ lib, osConfig, pkgs, ... }:
-
-let
-  thisMachineIsPersonal = osConfig.thisMachine.hasRole."personal";
-in
-{
-  config = lib.mkIf thisMachineIsPersonal {
-    wayland.windowManager.hyprland = {
-      enable = true;
-      systemd.enable = false; # Required when using UWSM
-
-      settings = {
-        "$mod" = "SUPER";
-        "$terminal" = "ghostty";
-        "$menu" = "wofi --show drun";
-
-        general = {
-          gaps_in = 5;
-          gaps_out = 10;
-          border_size = 2;
-          "col.active_border" = "rgba(33ccffee) rgba(00ff99ee) 45deg";
-          "col.inactive_border" = "rgba(595959aa)";
-          layout = "dwindle";
-        };
-
-        decoration = {
-          rounding = 10;
-
-          blur = {
-            enabled = true;
-            size = 3;
-            passes = 1;
-          };
-
-          shadow = {
-            enabled = true;
-            range = 4;
-            render_power = 3;
-            color = "rgba(1a1a1aee)";
-          };
-        };
-
-        animations = {
-          enabled = true;
-          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
-          animation = [
-            "windows, 1, 7, myBezier"
-            "windowsOut, 1, 7, default, popin 80%"
-            "border, 1, 10, default"
-            "borderangle, 1, 8, default"
-            "fade, 1, 7, default"
-            "workspaces, 1, 6, default"
-          ];
-        };
-
-        dwindle = {
-          pseudotile = true;
-          preserve_split = true;
-        };
-
-        input = {
-          follow_mouse = 1;
-          touchpad = {
-            natural_scroll = true;
-          };
-        };
-
-        misc = {
-          force_default_wallpaper = 0;
-        };
-
-        bind = [
-          # Applications
-          "$mod, Return, exec, $terminal"
-          "$mod, D, exec, $menu"
-          "$mod, L, exec, hyprlock"
-
-          # Window management
-          "$mod, Q, killactive"
-          "$mod, F, fullscreen"
-          "$mod, V, togglefloating"
-          "$mod, P, pseudo"
-          "$mod, J, togglesplit"
-
-          # Move focus
-          "$mod, left, movefocus, l"
-          "$mod, right, movefocus, r"
-          "$mod, up, movefocus, u"
-          "$mod, down, movefocus, d"
-
-          # Switch workspaces
-          "$mod, 1, workspace, 1"
-          "$mod, 2, workspace, 2"
-          "$mod, 3, workspace, 3"
-          "$mod, 4, workspace, 4"
-          "$mod, 5, workspace, 5"
-          "$mod, 6, workspace, 6"
-          "$mod, 7, workspace, 7"
-          "$mod, 8, workspace, 8"
-          "$mod, 9, workspace, 9"
-          "$mod, 0, workspace, 10"
-
-          # Move active window to workspace
-          "$mod SHIFT, 1, movetoworkspace, 1"
-          "$mod SHIFT, 2, movetoworkspace, 2"
-          "$mod SHIFT, 3, movetoworkspace, 3"
-          "$mod SHIFT, 4, movetoworkspace, 4"
-          "$mod SHIFT, 5, movetoworkspace, 5"
-          "$mod SHIFT, 6, movetoworkspace, 6"
-          "$mod SHIFT, 7, movetoworkspace, 7"
-          "$mod SHIFT, 8, movetoworkspace, 8"
-          "$mod SHIFT, 9, movetoworkspace, 9"
-          "$mod SHIFT, 0, movetoworkspace, 10"
-
-          # Scroll through workspaces
-          "$mod, mouse_down, workspace, e+1"
-          "$mod, mouse_up, workspace, e-1"
-
-          # Screenshots
-          ", Print, exec, grim -g \"$(slurp)\" - | wl-copy"
-          "SHIFT, Print, exec, grim - | wl-copy"
-
-          # Clipboard history
-          "$mod SHIFT, V, exec, cliphist list | wofi --dmenu | cliphist decode | wl-copy"
-        ];
-
-        bindm = [
-          # Move/resize with mouse
-          "$mod, mouse:272, movewindow"
-          "$mod, mouse:273, resizewindow"
-        ];
-
-        bindel = [
-          # Volume
-          ", XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
-          ", XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
-
-          # Brightness
-          ", XF86MonBrightnessUp, exec, brightnessctl s 10%+"
-          ", XF86MonBrightnessDown, exec, brightnessctl s 10%-"
-        ];
-
-        bindl = [
-          ", XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
-        ];
-
-        exec-once = [
-          "waybar"
-          "mako"
-          "hyprpaper"
-          "wl-paste --type text --watch cliphist store"
-          "wl-paste --type image --watch cliphist store"
-        ];
-      };
-    };
-
-    # Waybar
-    programs.waybar = {
-      enable = true;
-      settings = {
-        mainBar = {
-          layer = "top";
-          position = "top";
-          height = 30;
-          modules-left = [ "hyprland/workspaces" ];
-          modules-center = [ "clock" ];
-          modules-right = [ "network" "pulseaudio" "battery" "tray" ];
-
-          clock = {
-            format = "{:%H:%M  %Y-%m-%d}";
-          };
-
-          battery = {
-            format = "{capacity}% {icon}";
-            format-icons = [ "" "" "" "" "" ];
-          };
-
-          network = {
-            format-wifi = "{essid} ({signalStrength}%) ";
-            format-ethernet = "{ipaddr}/{cidr} ";
-            format-disconnected = "Disconnected ";
-          };
-
-          pulseaudio = {
-            format = "{volume}% {icon}";
-            format-muted = "";
-            format-icons = {
-              default = [ "" "" "" ];
-            };
-            on-click = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-          };
-
-          tray = {
-            spacing = 10;
-          };
-        };
-      };
-    };
-
-    # Notifications
-    services.mako = {
-      enable = true;
-      settings = {
-        default-timeout = 5000;
-        border-radius = 5;
-      };
-    };
-
-    # Idle daemon
-    services.hypridle = {
-      enable = true;
-      settings = {
-        general = {
-          lock_cmd = "pidof hyprlock || hyprlock";
-          before_sleep_cmd = "loginctl lock-session";
-          after_sleep_cmd = "hyprctl dispatch dpms on";
-        };
-
-        listener = [
-          {
-            timeout = 300;
-            on-timeout = "loginctl lock-session";
-          }
-          {
-            timeout = 330;
-            on-timeout = "hyprctl dispatch dpms off";
-            on-resume = "hyprctl dispatch dpms on";
-          }
-          {
-            timeout = 1800;
-            on-timeout = "systemctl suspend";
-          }
-        ];
-      };
-    };
-
-    # Lock screen
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        general = {
-          hide_cursor = true;
-          grace = 5;
-        };
-
-        background = [
-          {
-            monitor = "";
-            color = "rgba(25, 20, 20, 1.0)";
-            blur_passes = 2;
-            blur_size = 7;
-          }
-        ];
-
-        input-field = [
-          {
-            monitor = "";
-            size = "200, 50";
-            outline_thickness = 3;
-            dots_size = 0.33;
-            dots_spacing = 0.15;
-            outer_color = "rgb(151515)";
-            inner_color = "rgb(200, 200, 200)";
-            font_color = "rgb(10, 10, 10)";
-            fade_on_empty = true;
-            placeholder_text = "<i>Password...</i>";
-            hide_input = false;
-            position = "0, -20";
-            halign = "center";
-            valign = "center";
-          }
-        ];
-      };
-    };
-  };
-}

machines/fry/default.nix

@@ -75,7 +75,7 @@
   # Get wildcard cert
   security.acme.certs."fry.neet.dev" = {
     dnsProvider = "digitalocean";
-    credentialsFile = "/run/agenix/digitalocean-dns-credentials";
+    environmentFile = "/run/agenix/digitalocean-dns-credentials";
     extraDomainNames = [ "*.fry.neet.dev" ];
     group = "nginx";
     dnsResolver = "1.1.1.1:53";

machines/fry/hardware-configuration.nix

@@ -18,7 +18,7 @@
   boot.extraModulePackages = [ ];
 
   # thunderbolt
-  services.hardware.bolt.enable = true;
+  services.hardware.bolt.enable = false;
 
   # firmware
   firmware.x86_64.enable = true;
@@ -43,7 +43,13 @@
     ];
 
   # Ensures that dhcp is active during initrd (Network Manager is used post boot)
-  boot.initrd.network.udhcpc.enable = true;
+  boot.initrd.systemd.network = {
+    enable = true;
+    networks."10-default" = {
+      matchConfig.Type = "ether";
+      networkConfig.DHCP = "yes";
+    };
+  };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

machines/howl/hardware-configuration.nix

@@ -22,7 +22,7 @@
   boot.extraModulePackages = [ ];
 
   # thunderbolt
-  services.hardware.bolt.enable = true;
+  services.hardware.bolt.enable = false;
 
   # firmware
   firmware.x86_64.enable = true;

machines/storage/s0/default.nix

@@ -259,7 +259,7 @@
   # Get wildcard cert
   security.acme.certs."s0.neet.dev" = {
     dnsProvider = "digitalocean";
-    credentialsFile = "/run/agenix/digitalocean-dns-credentials";
+    environmentFile = "/run/agenix/digitalocean-dns-credentials";
     extraDomainNames = [ "*.s0.neet.dev" ];
     group = "nginx";
     dnsResolver = "1.1.1.1:53";

machines/zoidberg/default.nix

@@ -5,10 +5,6 @@
     ./hardware-configuration.nix
   ];
 
-  # Login DE Option: Steam
-  programs.steam.gamescopeSession.enable = true;
-  # programs.gamescope.capSysNice = true;
-
   # Login DE Option: Kodi
   services.xserver.desktopManager.kodi.enable = true;
   services.xserver.desktopManager.kodi.package =
@@ -35,7 +31,7 @@
     "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
   ];
 
-  services.displayManager.defaultSession = "plasma";
+  services.displayManager.defaultSession = "plasma-bigscreen-wayland";
 
   users.users.cris = {
     isNormalUser = true;
@@ -54,10 +50,10 @@
     uid = 1002;
   };
 
-  # Auto login into Plasma in john zoidberg account
+  # Auto login into Plasma Bigscreen in john zoidberg account
   services.displayManager.sddm.settings = {
     Autologin = {
-      Session = "plasma";
+      Session = "plasma-bigscreen-wayland";
       User = "john";
     };
   };

overlays/default.nix

@@ -31,4 +31,12 @@ in
       ../patches/music-assistant-zeroconf-port.patch
     ];
   });
+
+  # Plasma Bigscreen: TV-optimized KDE shell (not yet packaged in nixpkgs)
+  plasma-bigscreen = import ./plasma-bigscreen.nix {
+    inherit (prev.kdePackages)
+      mkKdeDerivation plasma-workspace plasma-wayland-protocols
+      qtmultimedia qtwayland qtwebengine qcoro;
+    inherit (prev) lib fetchFromGitLab pkg-config sdl3 libcec wayland;
+  };
 }

overlays/plasma-bigscreen.nix

@@ -0,0 +1,79 @@
+{
+  mkKdeDerivation,
+  lib,
+  fetchFromGitLab,
+  pkg-config,
+  plasma-workspace,
+  qtmultimedia,
+  qtwayland,
+  qtwebengine,
+  qcoro,
+  plasma-wayland-protocols,
+  wayland,
+  sdl3,
+  libcec,
+}:
+mkKdeDerivation {
+  pname = "plasma-bigscreen";
+  version = "unstable-2026-03-07";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "plasma";
+    repo = "plasma-bigscreen";
+    rev = "bd143fea7e386bac1652b8150a3ed3d5ef7cf93c";
+    hash = "sha256-y439IX7e0+XqxqFj/4+P5le0hA7DiwA+smDsD0UH/fI=";
+  };
+
+  patches = [
+    ../patches/plasma-bigscreen-input-handler-app-id.patch
+  ];
+
+  extraNativeBuildInputs = [ pkg-config ];
+
+  extraBuildInputs = [
+    qtmultimedia
+    qtwayland
+    qtwebengine
+    qcoro
+    plasma-wayland-protocols
+    wayland
+    sdl3
+    libcec
+  ];
+
+  # Match project version to installed Plasma release so cmake version checks pass
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(PROJECT_VERSION "6.5.80")' \
+                     'set(PROJECT_VERSION "${plasma-workspace.version}")'
+
+    # Upstream references a nonexistent startplasma-waylandsession binary.
+    # Fix this in the cmake template (before @KDE_INSTALL_FULL_LIBEXECDIR@ is substituted).
+    substituteInPlace bin/plasma-bigscreen-wayland.in \
+      --replace-fail \
+        'startplasma-wayland --xwayland --libinput --exit-with-session=@KDE_INSTALL_FULL_LIBEXECDIR@/startplasma-waylandsession' \
+        'startplasma-wayland'
+  '';
+
+  # FIXME: work around Qt 6.10 cmake API changes
+  cmakeFlags = [ "-DQT_FIND_PRIVATE_MODULES=1" ];
+
+  # QML lint fails on missing runtime-only imports (org.kde.private.biglauncher)
+  # that are only available inside a running Plasma session
+  dontQmlLint = true;
+
+  postFixup = ''
+    # Session .desktop references $out/libexec/plasma-dbus-run-session-if-needed
+    # but the binary lives in plasma-workspace
+    substituteInPlace "$out/share/wayland-sessions/plasma-bigscreen-wayland.desktop" \
+      --replace-fail \
+        "$out/libexec/plasma-dbus-run-session-if-needed" \
+        "${plasma-workspace}/libexec/plasma-dbus-run-session-if-needed"
+
+  '';
+
+  passthru.providedSessions = [ "plasma-bigscreen-wayland" ];
+
+  meta.license = with lib.licenses; [ gpl2Plus ];
+}

patches/plasma-bigscreen-input-handler-app-id.patch

@@ -0,0 +1,19 @@
+Use the correct app_id when pre-authorizing remote-desktop portal access.
+
+The portal's isAppMegaAuthorized() looks up the caller's specific app_id in
+the PermissionStore.  An empty string only matches apps the portal cannot
+identify; it is not a wildcard.  Since the input handler is launched via
+KIO::CommandLauncherJob with a desktopName, the portal resolves it to the
+desktop file ID, so the empty-string entry never matches.
+
+--- a/inputhandler/xdgremotedesktopsystem.cpp
++++ b/inputhandler/xdgremotedesktopsystem.cpp
+@@ -66,7 +67,7 @@
+     QDBusReply<void> reply = permissionStore.call(QStringLiteral("SetPermission"),
+                                                   QStringLiteral("kde-authorized"), // table
+                                                   true, // create table if not exists
+                                                   QStringLiteral("remote-desktop"), // id
+-                                                  QLatin1String(""), // app (empty for host applications)
++                                                  QStringLiteral("org.kde.plasma.bigscreen.inputhandler"),
+                                                   QStringList{QStringLiteral("yes")}); // permissions
+