Bump ntfy attachment expiry time

StartLimitBurst counts all starts (including successes), so the timer
was getting blocked after ~15 min. Replace with a JSON counter file
that resets on success and daily, only triggering OnFailure alerts for
the first 3 failures per day.

common/network/pia-vpn/service-container.nix

@@ -11,7 +11,6 @@ with lib;
 
 let
   cfg = config.pia-vpn;
-  hostName = config.networking.hostName;
 
   mkContainer = name: ctr: {
     autoStart = true;
@@ -29,9 +28,6 @@ let
     config = { config, pkgs, lib, ... }: {
       imports = allModules ++ [ ctr.config ];
 
-      ntfy-alerts.ignoredUnits = [ "logrotate" ];
-      ntfy-alerts.hostLabel = "${hostName}/${name}";
-
       # Static IP with gateway pointing to VPN container
       networking.useNetworkd = true;
       systemd.network.enable = true;

common/network/pia-vpn/vpn-container.nix

@@ -6,7 +6,6 @@ with lib;
 
 let
   cfg = config.pia-vpn;
-  hostName = config.networking.hostName;
   scripts = import ./scripts.nix;
 
   # Port forwarding derived state
@@ -99,8 +98,6 @@ in
 
           # Route ntfy alerts through the host proxy (VPN container has no gateway on eth0)
           ntfy-alerts.curlExtraArgs = "--proxy http://${cfg.hostAddress}:${toString cfg.proxyPort}";
-          ntfy-alerts.ignoredUnits = [ "logrotate" ];
-          ntfy-alerts.hostLabel = "${hostName}/pia-vpn";
 
           # Enable forwarding so bridge traffic can go through WG
           boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -273,17 +270,10 @@ in
                 return 0
               }
 
-              MAX_RETRIES=4
-              for attempt in $(seq 1 $MAX_RETRIES); do
               if check_vpn; then
                 rm -f "$COUNTER_FILE"
                 exit 0
               fi
-                if [ "$attempt" -lt "$MAX_RETRIES" ]; then
-                  echo "Attempt $attempt/$MAX_RETRIES failed, retrying in 5 minutes..." >&2
-                  sleep 300
-                fi
-              done
 
               # Failed — read and update counter (reset if from a previous day)
               today=$(date +%Y-%m-%d)
@@ -312,7 +302,7 @@ in
             description = "Periodic PIA VPN connectivity check";
             wantedBy = [ "timers.target" ];
             timerConfig = {
-              OnCalendar = "*:0/30";
+              OnCalendar = "*:0/5";
               RandomizedDelaySec = "30s";
             };
           };

common/ntfy/default.nix

@@ -26,12 +26,6 @@
       default = [ ];
       description = "Unit names to skip failure notifications for.";
     };
-
-    hostLabel = lib.mkOption {
-      type = lib.types.str;
-      default = config.networking.hostName;
-      description = "Label used in ntfy alert titles to identify this host/container.";
-    };
   };
 
   config = lib.mkIf config.thisMachine.hasRole."ntfy" {

common/ntfy/service-failure.nix

@@ -32,7 +32,7 @@ in
             --max-time 30 --retry 3 \
             ${cfg.curlExtraArgs} \
             -H "Authorization: Bearer $NTFY_TOKEN" \
-            -H "Title: Service failure on ${cfg.hostLabel}" \
+            -H "Title: Service failure on ${config.networking.hostName}" \
             -H "Priority: high" \
             -H "Tags: rotating_light" \
             -H "Message: Unit $unit failed at $(date +%c)" \

common/pc/kde.nix

@@ -9,14 +9,6 @@ in
     services.displayManager.sddm.wayland.enable = true;
     services.desktopManager.plasma6.enable = true;
 
-    services.displayManager.sessionPackages = [
-      pkgs.plasma-bigscreen
-    ];
-
-    # Bigscreen binaries must be on PATH for autostart services, KCMs, and
-    # internal plasmashell launches (settings, input handler, envmanager, etc.)
-    environment.systemPackages = [ pkgs.plasma-bigscreen ];
-
     # kde apps
     users.users.googlebot.packages = with pkgs; [
       # akonadi

common/pc/steam.nix

@@ -8,29 +8,6 @@ in
     programs.steam.enable = true;
     hardware.steam-hardware.enable = true; # steam controller
 
-    # Login DE Option: Steam Gamescope (Steam Deck-like session)
-    programs.gamescope = {
-      enable = true;
-    };
-    programs.steam.gamescopeSession = {
-      enable = true;
-      args = [
-        "--hdr-enabled"
-        "--hdr-itm-enabled"
-        "--adaptive-sync"
-      ];
-      steamArgs = [
-        "-steamos3"
-        "-gamepadui"
-        "-pipewire-dmabuf"
-      ];
-      env = {
-        STEAM_ENABLE_VOLUME_HANDLER = "1";
-        STEAM_DISABLE_AUDIO_DEVICE_SWITCHING = "1";
-      };
-    };
-    environment.systemPackages = [ pkgs.gamescope-wsi ];
-
     users.users.googlebot.packages = [
       pkgs.steam
     ];

common/server/gitea-actions-runner.nix

@@ -1,4 +1,4 @@
-{ config, lib, allModules, ... }:
+{ config, lib, ... }:
 
 # Gitea Actions Runner inside a NixOS container.
 # The container shares the host's /nix/store (read-only) and nix-daemon socket,
@@ -8,7 +8,7 @@
 
 let
   thisMachineIsARunner = config.thisMachine.hasRole."gitea-actions-runner";
-  hostName = config.networking.hostName;
+  hostOverlays = config.nixpkgs.overlays;
   containerName = "gitea-runner";
   giteaRunnerUid = 991;
   giteaRunnerGid = 989;
@@ -32,10 +32,8 @@ in
       };
 
       config = { config, lib, pkgs, ... }: {
-        imports = allModules;
+        system.stateVersion = "25.11";
-
+        nixpkgs.overlays = hostOverlays;
-        ntfy-alerts.ignoredUnits = [ "logrotate" ];
-        ntfy-alerts.hostLabel = "${hostName}/${containerName}";
 
         services.gitea-actions-runner.instances.inst = {
           enable = true;

flake.lock

@@ -53,11 +53,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775848625,
+        "lastModified": 1772587858,
-        "narHash": "sha256-y2/PYZu+yAeG+ueAuhjeeAWHOSvZMJfPiNs7pQJ/Wbc=",
+        "narHash": "sha256-w0/XBU20BdBeEIJ9i3ecr9Lc6c8uQaXUn/ri+aOsyJk=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "2a665ed3a46cb363630df50150ecf47f45a1d893",
+        "rev": "0a5fc14be38fabfcfff18db749b63c9c15726765",
         "type": "github"
       },
       "original": {
@@ -186,11 +186,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774959120,
+        "lastModified": 1769939035,
-        "narHash": "sha256-Pzk6UbueeWy9WFiDY6iA1aHid+2AMzkS6gg2x2cSkz4=",
+        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "c06f90f1eb6569bdaf6a4a10cb7e66db4454ac2a",
+        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775781825,
+        "lastModified": 1772569491,
-        "narHash": "sha256-L5yKTpR+alrZU2XYYvIxCeCP4LBHU5jhwSj7H1VAavg=",
+        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e35c39fca04fee829cecdf839a50eb9b54d8a701",
+        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
         "type": "github"
       },
       "original": {
@@ -250,11 +250,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1775847073,
+        "lastModified": 1772338235,
-        "narHash": "sha256-OyRZOIQZZQNrIDN40jrhY1SFTzTNYURT5MPhZZchSbY=",
+        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "239045c84aa62c2ce1349fa4c1ceae9eb6ce9e85",
+        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775365369,
+        "lastModified": 1772341813,
-        "narHash": "sha256-DgH5mveLoau20CuTnaU5RXZWgFQWn56onQ4Du2CqYoI=",
+        "narHash": "sha256-/PQ0ubBCMj/MVCWEI/XMStn55a8dIKsvztj4ZVLvUrQ=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "cef5cf82671e749ac87d69aadecbb75967e6f6c3",
+        "rev": "a2051ff239ce2e8a0148fa7a152903d9a78e854f",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1775490113,
+        "lastModified": 1771969195,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
         "type": "github"
       },
       "original": {
@@ -301,11 +301,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775710090,
+        "lastModified": 1772542754,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
         "type": "github"
       },
       "original": {
@@ -344,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775244324,
+        "lastModified": 1772064816,
-        "narHash": "sha256-TSAozmLyWCRbUJu6tXQvhTjsDKNj9q1CsEqwhhh9kMU=",
+        "narHash": "sha256-ks1D9Rtmopd5F/8ENjEUJpSYYMxv603/v6TRen9Hq54=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "c45a1e4385e81b937b353ee4ce97f5cfd60ceff2",
+        "rev": "ea4dc17f4bc0f65eed082fa394509e4543072b56",
         "type": "gitlab"
       },
       "original": {
@@ -361,11 +361,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1772189877,
+        "lastModified": 1759482047,
-        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
         "ref": "refs/heads/main",
-        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 1255,
+        "revCount": 996,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

machines/zoidberg/default.nix

@@ -5,6 +5,10 @@
     ./hardware-configuration.nix
   ];
 
+  # Login DE Option: Steam
+  programs.steam.gamescopeSession.enable = true;
+  # programs.gamescope.capSysNice = true;
+
   # Login DE Option: Kodi
   services.xserver.desktopManager.kodi.enable = true;
   services.xserver.desktopManager.kodi.package =
@@ -31,7 +35,7 @@
     "L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
   ];
 
-  services.displayManager.defaultSession = "plasma-bigscreen-wayland";
+  services.displayManager.defaultSession = "plasma";
 
   users.users.cris = {
     isNormalUser = true;
@@ -50,10 +54,10 @@
     uid = 1002;
   };
 
-  # Auto login into Plasma Bigscreen in john zoidberg account
+  # Auto login into Plasma in john zoidberg account
   services.displayManager.sddm.settings = {
     Autologin = {
-      Session = "plasma-bigscreen-wayland";
+      Session = "plasma";
       User = "john";
     };
   };

overlays/default.nix

@@ -31,12 +31,4 @@ in
       ../patches/music-assistant-zeroconf-port.patch
     ];
   });
-
-  # Plasma Bigscreen: TV-optimized KDE shell (not yet packaged in nixpkgs)
-  plasma-bigscreen = import ./plasma-bigscreen.nix {
-    inherit (prev.kdePackages)
-      mkKdeDerivation plasma-workspace plasma-wayland-protocols
-      qtmultimedia qtwayland qtwebengine qcoro;
-    inherit (prev) lib fetchFromGitLab pkg-config sdl3 libcec wayland;
-  };
 }

overlays/plasma-bigscreen.nix

@@ -1,79 +0,0 @@
-{
-  mkKdeDerivation,
-  lib,
-  fetchFromGitLab,
-  pkg-config,
-  plasma-workspace,
-  qtmultimedia,
-  qtwayland,
-  qtwebengine,
-  qcoro,
-  plasma-wayland-protocols,
-  wayland,
-  sdl3,
-  libcec,
-}:
-mkKdeDerivation {
-  pname = "plasma-bigscreen";
-  version = "unstable-2026-03-07";
-
-  src = fetchFromGitLab {
-    domain = "invent.kde.org";
-    owner = "plasma";
-    repo = "plasma-bigscreen";
-    rev = "bd143fea7e386bac1652b8150a3ed3d5ef7cf93c";
-    hash = "sha256-y439IX7e0+XqxqFj/4+P5le0hA7DiwA+smDsD0UH/fI=";
-  };
-
-  patches = [
-    ../patches/plasma-bigscreen-input-handler-app-id.patch
-  ];
-
-  extraNativeBuildInputs = [ pkg-config ];
-
-  extraBuildInputs = [
-    qtmultimedia
-    qtwayland
-    qtwebengine
-    qcoro
-    plasma-wayland-protocols
-    wayland
-    sdl3
-    libcec
-  ];
-
-  # Match project version to installed Plasma release so cmake version checks pass
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'set(PROJECT_VERSION "6.5.80")' \
-                     'set(PROJECT_VERSION "${plasma-workspace.version}")'
-
-    # Upstream references a nonexistent startplasma-waylandsession binary.
-    # Fix this in the cmake template (before @KDE_INSTALL_FULL_LIBEXECDIR@ is substituted).
-    substituteInPlace bin/plasma-bigscreen-wayland.in \
-      --replace-fail \
-        'startplasma-wayland --xwayland --libinput --exit-with-session=@KDE_INSTALL_FULL_LIBEXECDIR@/startplasma-waylandsession' \
-        'startplasma-wayland'
-  '';
-
-  # FIXME: work around Qt 6.10 cmake API changes
-  cmakeFlags = [ "-DQT_FIND_PRIVATE_MODULES=1" ];
-
-  # QML lint fails on missing runtime-only imports (org.kde.private.biglauncher)
-  # that are only available inside a running Plasma session
-  dontQmlLint = true;
-
-  postFixup = ''
-    # Session .desktop references $out/libexec/plasma-dbus-run-session-if-needed
-    # but the binary lives in plasma-workspace
-    substituteInPlace "$out/share/wayland-sessions/plasma-bigscreen-wayland.desktop" \
-      --replace-fail \
-        "$out/libexec/plasma-dbus-run-session-if-needed" \
-        "${plasma-workspace}/libexec/plasma-dbus-run-session-if-needed"
-
-  '';
-
-  passthru.providedSessions = [ "plasma-bigscreen-wayland" ];
-
-  meta.license = with lib.licenses; [ gpl2Plus ];
-}

patches/plasma-bigscreen-input-handler-app-id.patch

@@ -1,19 +0,0 @@
-Use the correct app_id when pre-authorizing remote-desktop portal access.
-
-The portal's isAppMegaAuthorized() looks up the caller's specific app_id in
-the PermissionStore.  An empty string only matches apps the portal cannot
-identify; it is not a wildcard.  Since the input handler is launched via
-KIO::CommandLauncherJob with a desktopName, the portal resolves it to the
-desktop file ID, so the empty-string entry never matches.
-
---- a/inputhandler/xdgremotedesktopsystem.cpp
-+++ b/inputhandler/xdgremotedesktopsystem.cpp
-@@ -66,7 +67,7 @@
-     QDBusReply<void> reply = permissionStore.call(QStringLiteral("SetPermission"),
-                                                   QStringLiteral("kde-authorized"), // table
-                                                   true, // create table if not exists
-                                                   QStringLiteral("remote-desktop"), // id
--                                                  QLatin1String(""), // app (empty for host applications)
-+                                                  QStringLiteral("org.kde.plasma.bigscreen.inputhandler"),
-                                                   QStringList{QStringLiteral("yes")}); // permissions
-