Improve gamescope session

StartLimitBurst counts all starts (including successes), so the timer
was getting blocked after ~15 min. Replace with a JSON counter file
that resets on success and daily, only triggering OnFailure alerts for
the first 3 failures per day.

common/boot/remote-luks-unlock.nix

@@ -45,57 +45,52 @@ in
       authorizedKeys = cfg.sshAuthorizedKeys;
     };
 
-    # Use systemd-tty-ask-password-agent for interactive LUKS passphrase entry over SSH
-    boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent --watch";
+    boot.initrd.postDeviceCommands = ''
+      echo 'waiting for root device to be opened...'
+      mkfifo /crypt-ramfs/passphrase
+      echo /crypt-ramfs/passphrase >> /dev/null
+    '';
 
-    # Tor hidden service for remote unlock over onion
     boot.initrd.secrets = lib.mkIf cfg.enableTorUnlock {
       "/etc/tor/onion/bootup" = cfg.onionConfig;
     };
-
-    boot.initrd.systemd.storePaths = lib.mkIf cfg.enableTorUnlock [
-      "${pkgs.tor}/bin/tor"
-      "${pkgs.haveged}/bin/haveged"
-    ];
-
-    boot.initrd.systemd.services.tor-unlock = lib.mkIf cfg.enableTorUnlock {
-      description = "Tor Hidden Service for Boot Unlock";
-      wantedBy = [ "initrd.target" ];
-      after = [ "network.target" "sshd.service" ];
-      wants = [ "network.target" ];
-
-      unitConfig.DefaultDependencies = false;
-
-      serviceConfig = {
-        Type = "forking";
-        RemainAfterExit = true;
-      };
-
-      script =
-        let
-          torRc = pkgs.writeText "tor.rc" ''
-            DataDirectory /etc/tor
-            SOCKSPort 127.0.0.1:9050 IsolateDestAddr
-            SOCKSPort 127.0.0.1:9063
-            HiddenServiceDir /etc/tor/onion/bootup
-            HiddenServicePort 22 127.0.0.1:22
-          '';
-        in
+    boot.initrd.extraUtilsCommands = lib.mkIf cfg.enableTorUnlock ''
+      copy_bin_and_libs ${pkgs.tor}/bin/tor
+      copy_bin_and_libs ${pkgs.haveged}/bin/haveged
+    '';
+    boot.initrd.network.postCommands = lib.mkMerge [
+      (
         ''
-          # Fix permissions for tor
+          # Add nice prompt for giving LUKS passphrase over ssh
+          echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
+        ''
+      )
+
+      (
+        let torRc = (pkgs.writeText "tor.rc" ''
+          DataDirectory /etc/tor
+          SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+          SOCKSPort 127.0.0.1:9063
+          HiddenServiceDir /etc/tor/onion/bootup
+          HiddenServicePort 22 127.0.0.1:22
+        ''); in
+        lib.mkIf cfg.enableTorUnlock ''
+          echo "tor: preparing onion folder"
+          # have to do this otherwise tor does not want to start
           chmod -R 700 /etc/tor
 
-          # Ensure loopback is up
-          ip a a 127.0.0.1/8 dev lo 2>/dev/null || true
+          echo "make sure localhost is up"
+          ip a a 127.0.0.1/8 dev lo
           ip link set lo up
 
-          # Start haveged for entropy
-          ${pkgs.haveged}/bin/haveged -F &
+          echo "haveged: starting haveged"
+          haveged -F &
 
-          # Verify and start tor
-          ${pkgs.tor}/bin/tor -f ${torRc} --verify-config
-          ${pkgs.tor}/bin/tor -f ${torRc} &
-        '';
-    };
+          echo "tor: starting tor"
+          tor -f ${torRc} --verify-config
+          tor -f ${torRc} &
+        ''
+      )
+    ];
   };
 }

common/network/default.nix

@@ -14,25 +14,8 @@ in
 
   options.networking.ip_forward = mkEnableOption "Enable ip forwarding";
 
-  config = mkMerge [
-    (mkIf cfg.ip_forward {
-      boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-      boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
-    })
-
-    # Keep dhcpcd away from container/virtual interfaces. dhcpcd runs as a single
-    # daemon over every interface not on its deny list, and the nixpkgs default
-    # omits these. When containers create/tear down podman0/veth*, dhcpcd reacts
-    # to the link events with a full reconfigure and can drop the primary
-    # interface's DHCP default route, leaving the host unreachable.
-    {
-      networking.dhcpcd.denyInterfaces = [
-        "podman*"
-        "veth*"
-        "cni*"
-        "docker*"
-        "br-*"
-      ];
-    }
-  ];
+  config = mkIf cfg.ip_forward {
+    boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
+  };
 }

flake.lock

@@ -53,11 +53,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778800550,
-        "narHash": "sha256-nLhQjocD45BwMS946dShAF6BnafpTTe10s8LAcIcLjo=",
+        "lastModified": 1772587858,
+        "narHash": "sha256-w0/XBU20BdBeEIJ9i3ecr9Lc6c8uQaXUn/ri+aOsyJk=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "1ba489d6e95f7bccf58250f7bdc5142122d53f2f",
+        "rev": "0a5fc14be38fabfcfff18db749b63c9c15726765",
         "type": "github"
       },
       "original": {
@@ -78,15 +78,15 @@
       "locked": {
         "lastModified": 1772394520,
         "narHash": "sha256-9c0sHyzoVtvufkSqVNGGydsgjpKv5Zf7062LmOm4Gsc=",
-        "owner": "GoogleBot42",
-        "repo": "dailybot",
+        "ref": "refs/heads/master",
         "rev": "d07483c17bf31d416de3642a2faec484ea1810ed",
-        "type": "github"
+        "revCount": 21,
+        "type": "git",
+        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
       },
       "original": {
-        "owner": "GoogleBot42",
-        "repo": "dailybot",
-        "type": "github"
+        "type": "git",
+        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
       }
     },
     "darwin": {
@@ -186,11 +186,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775585728,
-        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
+        "lastModified": 1769939035,
+        "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
+        "rev": "a8ca480175326551d6c4121498316261cbb5b260",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778853583,
-        "narHash": "sha256-0P4/nDOxxufeh5SD5vqpfFw0n4mq29WZISYAgfryD3Y=",
+        "lastModified": 1772569491,
+        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1bedcc8740b9aa2f7d3e1312a6c88baf00909f54",
+        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
         "type": "github"
       },
       "original": {
@@ -250,11 +250,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1778669912,
-        "narHash": "sha256-WT2iimtOBZM/6AcZeBoJU2EgUSaywtlItsEgNkZBda0=",
+        "lastModified": 1772338235,
+        "narHash": "sha256-9XcwtSIL/c+pkC3SBNuxCJuSktFOBV1TLvvkhekyB8I=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "a7a7009064cec75d9da652c6723412ce27b9bc44",
+        "rev": "9d1ff9b53532908a5eba7707931c9093508b6b92",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778393439,
-        "narHash": "sha256-mOtQxUjtKaPHLeoLOY/YEDctmud1X9KwJr4kE1MJ3Wc=",
+        "lastModified": 1772341813,
+        "narHash": "sha256-/PQ0ubBCMj/MVCWEI/XMStn55a8dIKsvztj4ZVLvUrQ=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "01466c414c7357ae2ce32be4a272a7c69e94ab5f",
+        "rev": "a2051ff239ce2e8a0148fa7a152903d9a78e854f",
         "type": "github"
       },
       "original": {
@@ -285,11 +285,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1778593042,
-        "narHash": "sha256-xYGrSg6354UK2K4WSQd4+TfyvfqmvFbSY+ZtGQUXK0c=",
+        "lastModified": 1771969195,
+        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9bd7c80d43e258aaa607d83b43661df11444d808",
+        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
         "type": "github"
       },
       "original": {
@@ -301,11 +301,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778443072,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "lastModified": 1772542754,
+        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
         "type": "github"
       },
       "original": {
@@ -344,15 +344,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1777287493,
-        "narHash": "sha256-Fj7S91TuZm6+DG/v6SFme/p+sWrYMQICGX6yQ5KD43Q=",
+        "lastModified": 1772064816,
+        "narHash": "sha256-ks1D9Rtmopd5F/8ENjEUJpSYYMxv603/v6TRen9Hq54=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "e33fbde199eaad513ef5d0746db19d5878150232",
+        "rev": "ea4dc17f4bc0f65eed082fa394509e4543072b56",
         "type": "gitlab"
       },
       "original": {
         "owner": "simple-nixos-mailserver",
+        "ref": "master",
         "repo": "nixos-mailserver",
         "type": "gitlab"
       }
@@ -360,11 +361,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1772189877,
-        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
+        "lastModified": 1759482047,
+        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
         "ref": "refs/heads/main",
-        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
-        "revCount": 1255,
+        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
+        "revCount": 996,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

flake.nix

@@ -25,7 +25,7 @@
 
     # Mail Server
     simple-nixos-mailserver = {
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-compat.follows = "flake-compat";
@@ -44,7 +44,7 @@
 
     # Dailybot
     dailybot = {
-      url = "github:GoogleBot42/dailybot";
+      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-utils.follows = "flake-utils";

home/googlebot.nix

@@ -59,7 +59,7 @@ in
     enable = thisMachineIsPersonal;
   };
 
-  programs.vscodium = {
+  programs.vscode = {
     enable = thisMachineIsPersonal;
     # Must use fhs version for vscode-lldb
     package = pkgs.vscodium-fhs;

machines/fry/default.nix

@@ -75,7 +75,7 @@
   # Get wildcard cert
   security.acme.certs."fry.neet.dev" = {
     dnsProvider = "digitalocean";
-    environmentFile = "/run/agenix/digitalocean-dns-credentials";
+    credentialsFile = "/run/agenix/digitalocean-dns-credentials";
     extraDomainNames = [ "*.fry.neet.dev" ];
     group = "nginx";
     dnsResolver = "1.1.1.1:53";

machines/fry/hardware-configuration.nix

@@ -43,13 +43,7 @@
     ];
 
   # Ensures that dhcp is active during initrd (Network Manager is used post boot)
-  boot.initrd.systemd.network = {
-    enable = true;
-    networks."10-default" = {
-      matchConfig.Type = "ether";
-      networkConfig.DHCP = "yes";
-    };
-  };
+  boot.initrd.network.udhcpc.enable = true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

machines/storage/s0/default.nix

@@ -259,7 +259,7 @@
   # Get wildcard cert
   security.acme.certs."s0.neet.dev" = {
     dnsProvider = "digitalocean";
-    environmentFile = "/run/agenix/digitalocean-dns-credentials";
+    credentialsFile = "/run/agenix/digitalocean-dns-credentials";
     extraDomainNames = [ "*.s0.neet.dev" ];
     group = "nginx";
     dnsResolver = "1.1.1.1:53";

overlays/default.nix

@@ -32,19 +32,6 @@ in
     ];
   });
 
-  # nginx 1.30.0 -> 1.30.1: critical security fix. Pulled forward from
-  # nixpkgs master (PR #519893, merged 2026-05-14) because the
-  # nixos-unstable channel branch we track does not have it yet.
-  # Remove once nixos-unstable advances past 2026-05-14.
-  nginxStable = prev.nginxStable.overrideAttrs (old: rec {
-    version = "1.30.1";
-    src = prev.fetchurl {
-      url = "https://nginx.org/download/nginx-${version}.tar.gz";
-      hash = "sha256-mXZQANl0iWsxyliC2MJ5zj/n729cb58Kln7X/TQH+cw=";
-    };
-  });
-  nginx = final.nginxStable;
-
   # Plasma Bigscreen: TV-optimized KDE shell (not yet packaged in nixpkgs)
   plasma-bigscreen = import ./plasma-bigscreen.nix {
     inherit (prev.kdePackages)