fix(noctalia): split taskbar overview hook patch

AGENTS.md

@@ -357,7 +357,6 @@ modules/profiles/
 │   ├── labwc/
 │   └── niri/
 ├── networking/
-│   ├── homelab-cache-client/
 │   ├── tailscale-client/
 │   └── tailscale-subnet-router/
 ├── platform/
@@ -368,11 +367,7 @@ modules/profiles/
 │   ├── desktop/
 │   └── vm/
 ├── workload/
-│   ├── camera/
 │   ├── development/
-│   ├── game/
-│   ├── machine-learning/
-│   ├── nix-builder/
 │   ├── personal/
 │   ├── server/
 │   └── remote-access/
@@ -607,7 +602,6 @@ A host registry may use a specification like this:
       "security.secrets"
       "security.secure-boot"
       "security.tpm-storage"
-      "workload.camera"
       "workload.development"
       "workload.personal"
     ];
@@ -630,7 +624,6 @@ A host registry may use a specification like this:
       "security.tpm-storage"
       "workload.development"
       "workload.game"
-      "workload.machine-learning"
       "workload.personal"
     ];
   };

docs/ios-simulator.md

@@ -1,119 +0,0 @@
-# iOS Simulator 初期セットアップ
-
-この手順は `m2` の macOS 環境で、stable Xcode と最新の stable iOS Simulator Runtime を使える状態にするためのもの。
-
-## 前提
-
-- `m2` が `workload.development` profile を有効にしていること
-- Mac App Store に Apple Account でサインイン済みであること
-- dotfiles を最新化していること
-
-Xcode 本体は `applications.xcode` が Mac App Store 版を管理する。Simulator Runtime は Apple が管理する mutable state のため、Nix store には入れず専用 dev shell から導入する。
-
-## 1. macOS 設定を反映する
-
-リポジトリ直下で nix-darwin の設定を反映する。
-
-```bash
-sudo darwin-rebuild switch --flake .#m2
-```
-
-これにより `/Applications/Xcode.app` に stable Xcode がインストールされる。
-
-Xcode のインストールで Mac App Store の認証エラーになる場合は、App Store を一度開いてサインイン状態を確認してから再実行する。
-
-## 2. iOS Simulator Runtime を導入する
-
-初回セットアップは次の1コマンドで行う。
-
-```bash
-nix develop .#ios -c ios-simulator-install
-```
-
-`ios-simulator-install` は次を順に実行する。
-
-1. `/Applications/Xcode.app` が存在することを確認
-2. `xcode-select` の Developer Directory を stable Xcode に切り替え
-3. Xcode の first-launch components を導入
-4. 利用可能な新しい hardware support components を確認
-5. 選択中の Xcode に対応する最新の iOS Simulator Runtime をダウンロードしてインストール
-6. Xcode のバージョンとインストール済み Simulator Runtime を表示
-
-途中で `sudo` の認証を求められる場合がある。
-
-## 3. インストールを確認する
-
-```bash
-xcodebuild -version
-xcode-select -p
-xcrun simctl list runtimes
-xcrun simctl list devices available
-```
-
-`xcode-select -p` は次を指していること。
-
-```text
-/Applications/Xcode.app/Contents/Developer
-```
-
-`xcrun simctl list runtimes` に iOS runtime が表示されればセットアップ完了。
-
-## 4. Simulator を起動する
-
-```bash
-open -a Simulator
-```
-
-Simulator の Device メニューから、インストール済み runtime で利用可能な iPhone を選択する。
-
-## Runtime の更新
-
-Xcode を stable の新しいバージョンへ更新した後は、同じコマンドを再実行する。
-
-```bash
-nix develop .#ios -c ios-simulator-install
-```
-
-Xcode の選択、first-launch components、hardware support、iOS Simulator Runtime の状態をまとめて更新できる。
-
-## トラブルシューティング
-
-### Xcode が見つからない
-
-次のエラーが出る場合、先に nix-darwin の設定を反映する。
-
-```text
-Xcode is not installed at /Applications/Xcode.app.
-```
-
-```bash
-sudo darwin-rebuild switch --flake .#m2
-```
-
-### Simulator Runtime が見えない
-
-まず runtime 一覧を確認する。
-
-```bash
-xcrun simctl list runtimes
-```
-
-iOS runtime がない場合は再度インストーラーを実行する。
-
-```bash
-nix develop .#ios -c ios-simulator-install
-```
-
-### Command Line Tools 側を参照している
-
-```bash
-xcode-select -p
-```
-
-が `/Library/Developer/CommandLineTools` を指している場合でも、`ios-simulator-install` が `/Applications/Xcode.app/Contents/Developer` へ切り替える。
-
-手動で直す場合は次を実行する。
-
-```bash
-sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
-```

flake.nix

@@ -38,6 +38,12 @@
       url = "github:ghostty-org/ghostty";
     };
 
+    # Speech to text
+    handy = {
+      url = "github:cjpais/Handy";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Shell / Launcher
     vicinae.url = "github:vicinaehq/vicinae";
 
@@ -60,11 +66,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    deploy-rs = {
-      url = "github:serokell/deploy-rs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # Disk management
     disko = {
       url = "github:nix-community/disko";
@@ -96,13 +97,6 @@
       url = "github:ilysenko/codex-desktop-linux";
     };
 
-    codex-session-usage.url = "github:moons-14/codex-session-usage";
-
-    skills = {
-      url = "github:mattpocock/skills";
-      flake = false;
-    };
-
     # Index / Search
     nix-index-database = {
       url = "github:nix-community/nix-index-database";

flake/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./deploy.nix
     ./formatter.nix
     ./git-hooks.nix
     ./registry.nix

flake/deploy.nix

@@ -1,28 +0,0 @@
-{
-  inputs,
-  self,
-  ...
-}:
-{
-  flake.deploy = {
-    nodes.nix-builder = {
-      hostname = "nix-builder";
-      sshUser = "moons";
-      user = "root";
-
-      interactiveSudo = true;
-      remoteBuild = true;
-      autoRollback = true;
-      magicRollback = true;
-
-      profiles.system.path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.nix-builder;
-    };
-  };
-
-  perSystem =
-    { system, ... }:
-    {
-      apps.deploy = inputs.deploy-rs.apps.${system}.default;
-      checks = inputs.deploy-rs.lib.${system}.deployChecks self.deploy;
-    };
-}

hosts/default.nix

@@ -1,20 +1,47 @@
 {
-  nix-builder = {
+  nix-example = {
     system = "x86_64-linux";
     stateVersion = "26.05";
     user = "moons";
-    path = ./nix-builder;
+    path = ./nix-example;
 
     profiles = [
       "base"
       "interface.cli"
-      "networking.tailscale-client"
       "platform.vm"
-      "workload.nix-builder"
+      "workload.development"
       "workload.remote-access"
     ];
   };
 
+  ops = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./ops;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.remote-access"
+    ];
+  };
+
+  internal-app-01 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./internal-app-01;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.server"
+    ];
+  };
+
   installer = {
     system = "x86_64-linux";
     stateVersion = "26.05";
@@ -64,7 +91,6 @@
       "workload.game"
       "workload.personal"
     ];
-
   };
 
   galleria = {
@@ -78,7 +104,6 @@
       "interface.cli"
       "interface.labwc"
       "interface.niri"
-      "networking.tailscale-client"
       "platform.intel-nvidia-desktop"
       "security.secrets"
       "security.secure-boot"
@@ -86,9 +111,7 @@
       "security.fingerprint"
       "workload.development"
       "workload.game"
-      "workload.machine-learning"
       "workload.personal"
-      "workload.camera"
     ];
   };
 

hosts/galleria/home.nix

@@ -4,11 +4,6 @@
   ...
 }:
 {
-  # This desktop is permanently connected to AC power.
-  systemd.user.services.swayidle.Service.Environment = [
-    "SWAYIDLE_ASSUME_AC=1"
-  ];
-
   services.kanshi = {
     enable = true;
 

hosts/galleria/nixos.nix

@@ -8,13 +8,6 @@
   boot.initrd.luks.devices.cryptroot.device =
     "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
 
-  # Keep Windows data and recovery partitions out of UDisks-based file
-  # managers. The shared EFI System Partition stays available as /boot.
-  services.udev.extraRules = ''
-    ENV{ID_PART_ENTRY_UUID}=="0480f887-d1f9-489d-b8fe-78549ced1938", ENV{UDISKS_IGNORE}="1"
-    ENV{ID_PART_ENTRY_UUID}=="6c70041b-3f65-4eb1-8b08-18ed20001877", ENV{UDISKS_IGNORE}="1"
-  '';
-
   environment.systemPackages = with inputs.browser-previews.packages.${pkgs.system}; [
     google-chrome-beta
   ];

hosts/installer/nixos.nix

@@ -31,7 +31,6 @@
   users.users.root.openssh.authorizedKeys.keys = [
     "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKhxDkucmeCor6CKoXAua7DgDSzuXrZOtpdkyzQxz5+aAAAABHNzaDo= moons@moons14.com"
     "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN6hZJyng/5LgFKPjR6uZAd/00UkO0vN0uQOoIvfSELdAAAABHNzaDo= moons@moons14.com"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq"
   ];
 
   environment.systemPackages = with pkgs; [

hosts/internal-app-01/hardware-configuration.nix

@@ -1,12 +1,8 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# Do not modify this file! It was generated by `nixos-generate-config` and may
-# and may be overwritten by future invocations.  Please make changes
+# be overwritten by future invocations.
-# to /etc/nixos/configuration.nix instead.
 { lib, modulesPath, ... }:
-
 {
-  imports = [
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
 
   boot.initrd.availableKernelModules = [
     "ata_piix"
@@ -21,12 +17,12 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/49fc2e1c-7909-41cc-ac78-55b4d9a01e62";
+    device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/40D4-ABBE";
+    device = "/dev/disk/by-uuid/8365-C778";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/internal-app-01/nixos.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/nix-builder/README.md

@@ -1,101 +0,0 @@
-# nix-builder bootstrap
-
-The host configuration can be built before its cache signing secret exists.
-Harmonia's socket remains stopped until SOPS installs the signing key at
-`/run/secrets/harmonia/signing-key`.
-
-## Proxmox storage layout
-
-The host configuration expects three filesystems. Keep the build scratch space
-separate from the store so a large build cannot fill the root filesystem.
-
-| Mount point          | Suggested size | Contents                        |
-| -------------------- | -------------- | ------------------------------- |
-| `/`                  | 48 GiB         | NixOS and mutable system state  |
-| `/var/lib/nix-build` | 192 GiB        | Disposable build scratch space  |
-| `/nix/store`         | 1 TiB          | Fleet closures and binary cache |
-
-The build-server policy starts emergency store GC below 64 GiB free and aims
-for 128 GiB free. Persistent roots under `/var/lib/nix-fleet/roots` protect the
-latest fleet builds from that GC. It also limits Nix to two concurrent
-derivations while allowing each derivation to use every vCPU assigned to the
-VM.
-
-For the two dedicated ext4 data filesystems, remove the default root-reserved
-blocks once after formatting; keep the root filesystem's reserve intact:
-
-```bash
-sudo tune2fs -m 0 /dev/disk/by-label/nix-build
-sudo tune2fs -m 0 /dev/disk/by-label/nix-store
-```
-
-## Initial deployment
-
-Once the VM is reachable as `moons@nix-builder`, deploy it from the repository:
-
-```bash
-nix run .#deploy -- .#nix-builder
-```
-
-deploy-rs uses the target's `ssh-ng` store, so the system closure is built on
-the builder rather than copied from the laptop. Automatic and magic rollback
-remain enabled.
-
-## Add the host SOPS recipient
-
-After the VM has a stable SSH host key, derive its age recipient:
-
-```bash
-ssh-keyscan -t ed25519 nix-builder 2>/dev/null | ssh-to-age
-```
-
-Add the recipient to `.sops.yaml` and add a creation rule for
-`secrets/hosts/nix-builder/*.yaml`. The admin YubiKey recipient should remain in
-the same key group for recovery.
-
-## Generate the cache signing key
-
-Run this on a trusted Nix machine, preferably with the temporary files on a
-tmpfs:
-
-```bash
-nix-store --generate-binary-cache-key \
-  cache.app.homelabs.run-1 \
-  harmonia.private \
-  harmonia.public
-```
-
-Create `secrets/hosts/nix-builder/system.yaml` with SOPS and store the complete
-contents of `harmonia.private` at `harmonia.signing-key`:
-
-```yaml
-harmonia:
-  signing-key: cache.app.homelabs.run-1:REDACTED
-```
-
-Copy the complete contents of `harmonia.public` to
-`modules/systems/nix/homelab-cache/public-key`. The private plaintext file must
-not be committed or retained.
-
-After committing both encrypted/public files, select
-`networking.homelab-cache-client` on each client host.
-
-Redeploy the builder and verify the cache after installing the secret:
-
-```bash
-nix run .#deploy -- .#nix-builder
-curl --fail http://nix-builder:5000/nix-cache-info
-```
-
-## Normal operation
-
-Run `fleet-build` on the builder to build and root every NixOS host, or pass a
-list of host names to build only those hosts. Run `fleet-deploy` with the normal
-deploy-rs target syntax when additional fleet nodes have been added to
-`flake/deploy.nix`:
-
-```bash
-fleet-build
-fleet-build x1g13 galleria
-fleet-deploy .#nix-builder
-```

hosts/nix-builder/filesystem.nix

@@ -1,25 +0,0 @@
-{
-  fileSystems."/nix/store" = {
-    device = "/dev/disk/by-label/nix-store";
-    fsType = "ext4";
-
-    options = [
-      "noatime"
-    ];
-
-    neededForBoot = true;
-  };
-
-  fileSystems."/var/lib/nix-build" = {
-    device = "/dev/disk/by-label/nix-build";
-    fsType = "ext4";
-
-    options = [
-      "noatime"
-    ];
-  };
-
-  nix.settings.build-dir = "/var/lib/nix-build";
-
-  services.fstrim.enable = true;
-}

hosts/nix-builder/nixos.nix

@@ -1,19 +0,0 @@
-{ lib, ... }:
-let
-  hostSecrets = ../../secrets/hosts/nix-builder/system.yaml;
-in
-{
-  imports = [
-    ./filesystem.nix
-    ./hardware-configuration.nix
-  ];
-
-  sops.secrets = lib.mkIf (builtins.pathExists hostSecrets) {
-    "harmonia/signing-key" = {
-      sopsFile = hostSecrets;
-      restartUnits = [ "harmonia.service" ];
-    };
-  };
-
-  networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 5000 ];
-}

hosts/ops/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/69fa2193-1e4f-438a-8898-5de8a3f36e5b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D09B-4277";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/ops/nixos.nix

@@ -0,0 +1,51 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  networking = {
+    useDHCP = false;
+
+    interfaces = {
+      ens18 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.128.20";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens19 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.7.101";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens20 = {
+        useDHCP = false;
+        ipv4.routes = [
+          {
+            address = "10.50.64.0";
+            prefixLength = 24;
+            via = "10.50.82.1";
+          }
+        ];
+        ipv4.addresses = [
+          {
+            address = "10.50.82.10";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+
+    defaultGateway = {
+      address = "10.50.128.1";
+      interface = "ens18";
+    };
+  };
+}

modules/applications/chrome/home/nixos.nix

@@ -1,37 +1,9 @@
-{
+_: {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  chrome = pkgs.google-chrome.overrideAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-
-    postFixup = (old.postFixup or "") + ''
-      wrapProgram $out/bin/google-chrome-stable \
-        --set LIBVA_DRIVER_NAME nvidia \
-        --set NVD_BACKEND direct
-    '';
-  });
-
-  features = [
-    "MiddleClickAutoscroll"
-    "AcceleratedVideoDecoder"
-    "AcceleratedVideoDecodeLinuxGL"
-    "PlatformHEVCDecoderSupport"
-  ]
-  ++ lib.optional config.my.hardwares.nvidia.enable "VaapiOnNvidiaGPUs";
-in
-{
   programs.google-chrome = {
     enable = true;
-    package = if config.my.hardwares.nvidia.enable then chrome else pkgs.google-chrome;
 
     commandLineArgs = [
-      "--enable-features=${lib.concatStringsSep "," features}"
+      "--enable-features=MiddleClickAutoscroll"
-      "--use-gl=angle"
-      "--use-angle=gl"
     ];
   };
 

modules/applications/codex-desktop/meta.nix

@@ -1,5 +1,10 @@
-_: {
+{ inputs, ... }:
+{
   description = "Codex Desktop for Linux";
 
   includes = [ "applications.codex" ];
+
+  imports.nixos = [
+    inputs.codex-desktop-linux.nixosModules.default
+  ];
 }

modules/applications/codex-desktop/nixos.nix

@@ -4,7 +4,15 @@
   ...
 }:
 {
-  environment.systemPackages = [
+  programs.codexDesktopLinux = {
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.chatgpt
+    enable = true;
+    cliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
+    remoteControl.enable = true;
+    remoteMobileControl.enable = true;
+    computerUseUi.enable = false;
+    linuxFeatures = [
+      "appshots"
+      "open-target-discovery"
     ];
+  };
 }

modules/applications/codex-session-usage/home.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  codexSessionUsage = inputs.codex-session-usage.packages.${pkgs.stdenv.hostPlatform.system}.default;
-in
-{
-  home.packages = [ codexSessionUsage ];
-
-  xdg.dataFile = {
-    "vicinae/scripts/codex-session-usage/start" = {
-      executable = true;
-      text = ''
-        #!${lib.getExe pkgs.bash}
-        # @vicinae.schemaVersion 1
-        # @vicinae.title Start Codex Session Usage
-        # @vicinae.description Start the local Codex session usage dashboard
-        # @vicinae.mode compact
-        # @vicinae.icon 📊
-        # @vicinae.argument1 { "type": "text", "placeholder": "Port (optional)", "optional": true }
-
-        if [[ -z "$1" ]]; then
-          exec ${lib.getExe codexSessionUsage} start
-        fi
-
-        if [[ "$1" =~ ^[0-9]+$ ]] && (( 10#$1 >= 1 && 10#$1 <= 65535 )); then
-          exec ${lib.getExe codexSessionUsage} start --port "$1"
-        fi
-
-        printf '%s\n' 'Port must be an integer between 1 and 65535.' >&2
-        exit 2
-      '';
-    };
-
-    "vicinae/scripts/codex-session-usage/stop" = {
-      executable = true;
-      text = ''
-        #!${lib.getExe pkgs.bash}
-        # @vicinae.schemaVersion 1
-        # @vicinae.title Stop Codex Session Usage
-        # @vicinae.description Stop the local Codex session usage dashboard
-        # @vicinae.mode compact
-        # @vicinae.icon 📊
-
-        exec ${lib.getExe codexSessionUsage} stop
-      '';
-    };
-  };
-}

modules/applications/codex/config.toml

@@ -1,13 +0,0 @@
-model = "gpt-5.6-sol"
-model_reasoning_effort = "medium"
-
-approval_policy = "on-request"
-approvals_reviewer = "auto_review"
-sandbox_mode = "workspace-write"
-web_search = "cached"
-
-[sandbox_workspace_write]
-network_access = false
-
-[projects."/home/moons/dotfiles"]
-trust_level = "trusted"

modules/applications/codex/home.nix

@@ -1,36 +1,6 @@
+{ inputs, pkgs, ... }:
 {
-  config,
+  home.packages = [
-  inputs,
+    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex
-  lib,
+  ];
-  pkgs,
-  ...
-}:
-let
-  configDirectory =
-    if config.home.preferXdgDirectories then
-      "${config.xdg.configHome}/codex"
-    else
-      "${config.home.homeDirectory}/.codex";
-  configFile = "${configDirectory}/config.toml";
-in
-{
-  programs.codex = {
-    enable = true;
-    package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-
-    skills = {
-      grilling = inputs.skills + "/skills/productivity/grilling";
-    };
-  };
-
-  # Keep the repository copy as an initial value. Codex may mutate the live
-  # file between activations; each Home Manager switch resets it from here.
-  home.activation.resetCodexConfig = {
-    after = [ "writeBoundary" ];
-    before = [ ];
-    data = ''
-      ${pkgs.coreutils}/bin/mkdir -p ${lib.escapeShellArg configDirectory}
-      ${pkgs.coreutils}/bin/install -m 0600 ${./config.toml} ${lib.escapeShellArg configFile}
-    '';
-  };
 }

modules/applications/discord/home.nix

@@ -1,15 +1,6 @@
-{
+_: {
-  inputs,
-  pkgs,
-  ...
-}:
-let
-  unstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
-in
-{
   programs.vesktop = {
     enable = true;
-    package = unstable.vesktop;
 
     settings = {
       discordBranch = "stable";
@@ -25,10 +16,6 @@ in
 
       openLinksWithElectron = false;
 
-      # Keep WebRTC on the public interface selected by the default route.
-      # Secondary private interfaces can otherwise stall voice at DTLS.
-      webRTCIPHandlingPolicy = "default_public_interface_only";
-
       spellCheckLanguages = [
         "ja-JP"
         "en-US"

modules/applications/ffmpeg/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.ffmpeg ];
-}

modules/applications/ghostty/home/nixos.nix

@@ -1,12 +1,6 @@
 { inputs, system, ... }: {
   programs.ghostty = {
-    # Labwc's Close action correctly targets one xdg-toplevel, but Ghostty's
+    systemd.enable = true;
-    # systemd service runs every window in one GTK single-instance process.
-    # If that process exits while handling the request, every Ghostty window
-    # disappears together. Keep each launcher invocation independent instead.
-    systemd.enable = false;
     package = inputs.ghostty.packages.${system}.default;
-
-    settings.gtk-single-instance = false;
   };
 }

modules/applications/handy/darwin.nix

@@ -0,0 +1,8 @@
+{
+  homebrew.casks = [ "handy" ];
+
+  launchd.agents.handy = {
+    command = "/usr/bin/open -gja Handy --args --start-hidden";
+    serviceConfig.RunAtLoad = true;
+  };
+}

modules/applications/handy/home/nixos.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  handy = inputs.handy.packages.${pkgs.stdenv.hostPlatform.system}.handy;
+  settingsFile = "${config.xdg.configHome}/com.pais.handy/settings_store.json";
+in
+{
+  home.packages = [
+    handy
+    pkgs.wtype
+  ];
+
+  # Handy has no disabled-shortcut setting. Empty bindings are rejected before
+  # registration, leaving niri and labwc as the sole owners of Ctrl+Space.
+  home.activation.disableHandyGlobalShortcuts = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      settingsFile=${lib.escapeShellArg settingsFile}
+      mkdir -p "$(dirname "$settingsFile")"
+
+      if [ -f "$settingsFile" ]; then
+        ${lib.getExe pkgs.jq} \
+          '.settings.bindings.transcribe.current_binding = ""
+          | .settings.bindings.transcribe_with_post_process.current_binding = ""' \
+          "$settingsFile" > "$settingsFile.tmp"
+      else
+        ${lib.getExe pkgs.jq} -n '
+          {
+            settings: {
+              bindings: {
+                transcribe: {
+                  id: "transcribe",
+                  name: "Transcribe",
+                  description: "Converts your speech into text.",
+                  default_binding: "ctrl+space",
+                  current_binding: ""
+                },
+                transcribe_with_post_process: {
+                  id: "transcribe_with_post_process",
+                  name: "Transcribe with Post-Processing",
+                  description: "Converts your speech into text and applies AI post-processing.",
+                  default_binding: "ctrl+shift+space",
+                  current_binding: ""
+                }
+              }
+            }
+          }
+        ' > "$settingsFile.tmp"
+      fi
+
+      mv "$settingsFile.tmp" "$settingsFile"
+    '';
+  };
+
+  systemd.user.services.handy = {
+    Unit = {
+      Description = "Handy speech-to-text";
+      After = [ "graphical-session.target" ];
+      PartOf = [ "graphical-session.target" ];
+    };
+    Service = {
+      ExecStart = "${lib.getExe handy} --start-hidden";
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+    Install.WantedBy = [ "graphical-session.target" ];
+  };
+}

modules/applications/handy/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Handy offline speech-to-text";
+}

modules/applications/huggingface-cli/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.python314Packages.huggingface-hub ];
-}

modules/applications/labwc/home.nix

@@ -102,6 +102,8 @@ in
           (action "W-q" "Close")
           (action "W-f" "ToggleMaximize")
           (action "W-c" "Iconify")
+          (action "W-Tab" "NextWindow")
+          (action "W-S-Tab" "PreviousWindow")
           (action "W-Up" "Lower")
           (action "W-Down" "Raise")
           (action "W-Left" "NextWindow")
@@ -121,13 +123,14 @@ in
           (execute "W-s" "noctalia msg panel-toggle launcher")
           (execute "W-e" "nautilus --new-window")
           (execute "W-l" "loginctl lock-session")
-          (execute "W-v" "vicinae vicinae://launch/clipboard/history")
+          (execute "W-v" "vicinae vicinae://launch/clipboard/history?toggle=true")
           (execute "W-j" "nani-translate-primary")
-          (execute "W-S-j" "nani-translate-ocr")
+          (execute "W-S-j" "normcap-translate")
           (execute "W-C-j" "${lib.getExe' pkgs.xdg-utils "xdg-open"} naniapp://translate")
           (execute "W-space" "ghostty +toggle-quick-terminal")
           (execute "W-p" "wdisplays")
           (execute "W-z" "wl-find-cursor -c 0xCCFF453A -s 160 -d 1200")
+          (execute "C-space" "handy --toggle-transcription")
 
           # Function keys (sync with niri modules/applications/niri/home.nix)
           (execute "XF86AudioRaiseVolume" "noctalia msg volume-up")

modules/applications/labwc/nixos.nix

@@ -6,11 +6,16 @@
 }:
 let
   unstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
+  labwc = unstable.labwc.overrideAttrs (oldAttrs: {
+    patches = (oldAttrs.patches or [ ]) ++ [
+      ./patches/remove-ext-workspace-output-on-destroy.patch
+    ];
+  });
 in
 {
   programs.labwc = {
     enable = true;
-    package = unstable.labwc;
+    package = labwc;
   };
 
   xdg.portal.config.labwc.default = [

modules/applications/labwc/patches/remove-ext-workspace-output-on-destroy.patch

@@ -0,0 +1,28 @@
+From: Codex <[email protected]>
+Subject: [PATCH] output: remove destroyed output from ext-workspace group
+
+The DRM backend destroys and recreates outputs when a session is paused and
+resumed. Remove the output from the ext-workspace group before wlroots
+finishes it, otherwise the group's output_bind listener remains attached and
+wlr_output_finish() aborts.
+
+---
+ src/output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/output.c b/src/output.c
+index 2eab8ec..f19c3ff 100644
+--- a/src/output.c
++++ b/src/output.c
+@@ -277,6 +277,9 @@ handle_output_destroy(struct wl_listener *listener, void *data)
+ 	struct seat *seat = &server.seat;
+ 	regions_evacuate_output(output);
+ 	regions_destroy(seat, &output->regions);
++	wlr_ext_workspace_group_handle_v1_output_leave(
++		server.workspaces.ext_group, output->wlr_output);
++
+ 	if (seat->overlay.active.output == output) {
+ 		overlay_finish(seat);
+ 	}
+-- 
+2.51.0

modules/applications/linux-wallpaperengine/home/controller.sh

@@ -0,0 +1,167 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+shift 3
+
+state_dir="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine"
+state_file="$state_dir/current"
+
+usage() {
+  printf '%s\n' \
+    'Usage: wallpaperengine-wallpaper COMMAND [ID]' \
+    '' \
+    'Commands:' \
+    '  select ID Select a declaratively configured ID for this session' \
+    '  next      Select the next configured ID' \
+    '  previous  Select the previous configured ID' \
+    '  list      List configured IDs and mark the selected one' \
+    '  current   Print the selected ID' \
+    '  restart   Restart the selected wallpaper' \
+    '  stop      Stop Wallpaper Engine for this session'
+}
+
+load_playlist() {
+  mapfile -t wallpaper_ids < <(awk '/^[0-9]+$/ && !seen[$0]++' "$playlist_file")
+  if [ "${#wallpaper_ids[@]}" -eq 0 ]; then
+    echo "wallpaperengine-wallpaper: no wallpaper IDs are configured in settings.nix" >&2
+    exit 1
+  fi
+}
+
+contains_id() {
+  local candidate="$1"
+  local id
+
+  for id in "${wallpaper_ids[@]}"; do
+    [ "$id" = "$candidate" ] && return 0
+  done
+  return 1
+}
+
+current_id() {
+  local saved_configuration=""
+  local saved_id=""
+  local -a saved_state=()
+
+  if [ -s "$state_file" ]; then
+    mapfile -t saved_state <"$state_file"
+    saved_configuration="${saved_state[0]:-}"
+    saved_id="${saved_state[1]:-}"
+  fi
+
+  if [ "$saved_configuration" = "$configuration_id" ] && contains_id "$saved_id"; then
+    printf '%s\n' "$saved_id"
+  else
+    printf '%s\n' "$default_id"
+  fi
+}
+
+select_id() {
+  local id="$1"
+
+  if ! contains_id "$id"; then
+    echo "wallpaperengine-wallpaper: ID is not declared in settings.nix: $id" >&2
+    exit 2
+  fi
+
+  mkdir -p "$state_dir"
+  printf '%s\n%s\n' "$configuration_id" "$id" >"$state_file"
+  systemctl --user restart linux-wallpaperengine.service
+}
+
+cycle() {
+  local step="$1"
+  local current
+  local index=0
+  local next_index
+
+  current=$(current_id)
+  for i in "${!wallpaper_ids[@]}"; do
+    if [ "${wallpaper_ids[$i]}" = "$current" ]; then
+      index="$i"
+      break
+    fi
+  done
+
+  next_index=$(((index + step + ${#wallpaper_ids[@]}) % ${#wallpaper_ids[@]}))
+  select_id "${wallpaper_ids[$next_index]}"
+}
+
+load_playlist
+
+command="${1:-}"
+if [ -z "$command" ]; then
+  usage
+  exit 2
+fi
+shift
+
+case "$command" in
+select)
+  [ "$#" -eq 1 ] || {
+    usage >&2
+    exit 2
+  }
+  select_id "$1"
+  ;;
+next)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle 1
+  ;;
+previous)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle -1
+  ;;
+list)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current=$(current_id)
+  for id in "${wallpaper_ids[@]}"; do
+    if [ "$id" = "$current" ]; then
+      printf '* %s\n' "$id"
+    else
+      printf '  %s\n' "$id"
+    fi
+  done
+  ;;
+current)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current_id
+  ;;
+restart)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user restart linux-wallpaperengine.service
+  ;;
+stop)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user stop linux-wallpaperengine.service
+  ;;
+help | -h | --help)
+  usage
+  ;;
+*)
+  usage >&2
+  exit 2
+  ;;
+esac

modules/applications/linux-wallpaperengine/home/launcher.sh

@@ -0,0 +1,57 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+assets_dir="$4"
+workshop_dir="$5"
+scaling="$6"
+shift 6
+
+state_file="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine/current"
+wallpaper_id="$default_id"
+saved_configuration=""
+saved_id=""
+saved_state=()
+outputs=()
+
+if [ -s "$state_file" ]; then
+  mapfile -t saved_state <"$state_file"
+  saved_configuration="${saved_state[0]:-}"
+  saved_id="${saved_state[1]:-}"
+
+  if [ "$saved_configuration" = "$configuration_id" ] &&
+    awk -v id="$saved_id" '$0 == id { found = 1 } END { exit !found }' "$playlist_file"; then
+    wallpaper_id="$saved_id"
+  fi
+fi
+
+wallpaper_path="$workshop_dir/$wallpaper_id"
+if [ ! -d "$wallpaper_path" ]; then
+  echo "linux-wallpaperengine: missing declared wallpaper: $wallpaper_path" >&2
+  exit 1
+fi
+
+if [ ! -d "$assets_dir" ]; then
+  echo "linux-wallpaperengine: missing Wallpaper Engine assets: $assets_dir" >&2
+  exit 1
+fi
+
+mapfile -t outputs < <(wlr-randr --json | jq -r '.[] | select(.enabled == true) | .name')
+if [ "${#outputs[@]}" -eq 0 ]; then
+  echo "linux-wallpaperengine: no enabled Wayland outputs were detected" >&2
+  exit 1
+fi
+
+engine_args=("$@" --assets-dir "$assets_dir")
+for output in "${outputs[@]}"; do
+  engine_args+=(
+    --screen-root "$output"
+    --bg "$wallpaper_path"
+    --scaling "$scaling"
+  )
+done
+
+exec linux-wallpaperengine "${engine_args[@]}"

modules/applications/linux-wallpaperengine/home/nixos.nix

@@ -0,0 +1,158 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  settings = import ../settings.nix;
+  inherit (settings)
+    assetsDirectory
+    fps
+    mute
+    scaling
+    selectedWallpaperId
+    switchIntervalSeconds
+    wallpaperIds
+    workshopDirectory
+    ;
+
+  resolveHomePath =
+    path:
+    if lib.hasPrefix "~/" path then
+      "${config.home.homeDirectory}/${lib.removePrefix "~/" path}"
+    else if lib.hasPrefix "/" path then
+      path
+    else
+      "${config.home.homeDirectory}/${path}";
+
+  hasWallpapers = wallpaperIds != [ ];
+  defaultWallpaperId =
+    if selectedWallpaperId != null then
+      selectedWallpaperId
+    else if hasWallpapers then
+      lib.head wallpaperIds
+    else
+      "";
+  configurationId = builtins.hashString "sha256" (builtins.toJSON settings);
+  resolvedAssetsDirectory = resolveHomePath assetsDirectory;
+  resolvedWorkshopDirectory = resolveHomePath workshopDirectory;
+  playlist = pkgs.writeText "linux-wallpaperengine-playlist" (
+    lib.concatMapStringsSep "\n" (id: id) wallpaperIds + "\n"
+  );
+  engineArguments = lib.optional mute "--silent" ++ [
+    "--fps"
+    (toString fps)
+  ];
+
+  controller = pkgs.writeShellApplication {
+    name = "wallpaperengine-wallpaper";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.systemd
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./controller.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        "$@"
+    '';
+  };
+
+  launcher = pkgs.writeShellApplication {
+    name = "linux-wallpaperengine-launcher";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.jq
+      pkgs.linux-wallpaperengine
+      pkgs.wlr-randr
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./launcher.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        ${lib.escapeShellArg resolvedAssetsDirectory} \
+        ${lib.escapeShellArg resolvedWorkshopDirectory} \
+        ${lib.escapeShellArg scaling} \
+        ${lib.escapeShellArgs engineArguments}
+    '';
+  };
+in
+assert lib.assertMsg (lib.all (
+  id: builtins.isString id && builtins.match "[0-9]+" id != null
+) wallpaperIds) "linux-wallpaperengine: wallpaperIds must contain only numeric strings";
+assert lib.assertMsg (
+  lib.unique wallpaperIds == wallpaperIds
+) "linux-wallpaperengine: wallpaperIds must not contain duplicates";
+assert lib.assertMsg (
+  selectedWallpaperId == null || builtins.elem selectedWallpaperId wallpaperIds
+) "linux-wallpaperengine: selectedWallpaperId must be null or a member of wallpaperIds";
+assert lib.assertMsg (
+  switchIntervalSeconds == null || (builtins.isInt switchIntervalSeconds && switchIntervalSeconds > 0)
+) "linux-wallpaperengine: switchIntervalSeconds must be null or a positive integer";
+assert lib.assertMsg (
+  builtins.isInt fps && fps > 0
+) "linux-wallpaperengine: fps must be a positive integer";
+assert lib.assertMsg (
+  builtins.isString assetsDirectory && assetsDirectory != ""
+) "linux-wallpaperengine: assetsDirectory must be a non-empty string";
+assert lib.assertMsg (
+  builtins.isString workshopDirectory && workshopDirectory != ""
+) "linux-wallpaperengine: workshopDirectory must be a non-empty string";
+assert lib.assertMsg (builtins.elem scaling [
+  "default"
+  "fill"
+  "fit"
+  "stretch"
+]) "linux-wallpaperengine: scaling must be default, fill, fit, or stretch";
+{
+  home.packages = [
+    controller
+    pkgs.linux-wallpaperengine
+  ];
+
+  systemd.user.services = lib.optionalAttrs hasWallpapers {
+    linux-wallpaperengine = {
+      Unit = {
+        Description = "Linux Wallpaper Engine";
+        After = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
+      };
+      Service = {
+        ExecStart = lib.getExe launcher;
+        Restart = "on-abnormal";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+
+    linux-wallpaperengine-switch = {
+      Unit.Description = "Switch Linux Wallpaper Engine wallpaper";
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe controller} next";
+      };
+    };
+  };
+
+  systemd.user.timers =
+    lib.optionalAttrs
+      (hasWallpapers && builtins.length wallpaperIds > 1 && switchIntervalSeconds != null)
+      {
+        linux-wallpaperengine-switch = {
+          Unit = {
+            Description = "Periodically switch Linux Wallpaper Engine wallpaper";
+            PartOf = [ "graphical-session.target" ];
+          };
+          Timer = {
+            OnActiveSec = "${toString switchIntervalSeconds}s";
+            OnUnitActiveSec = "${toString switchIntervalSeconds}s";
+            Unit = "linux-wallpaperengine-switch.service";
+          };
+          Install.WantedBy = [ "graphical-session.target" ];
+        };
+      };
+}

modules/applications/linux-wallpaperengine/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Wallpaper Engine backgrounds for Linux";
+}

modules/applications/linux-wallpaperengine/settings.nix

@@ -0,0 +1,23 @@
+{
+  assetsDirectory = "~/.local/share/Steam/steamapps/common/wallpaper_engine/assets";
+  workshopDirectory = "~/.local/share/Steam/steamapps/workshop/content/431960";
+
+  wallpaperIds = [
+    "2833810156"
+    "2834355367"
+    "2836628501"
+    "2845095254"
+    "2859848175"
+    "2861661119"
+    "2982896307"
+  ];
+
+  # null selects the first ID above.
+  selectedWallpaperId = null;
+  # Set a number such as 300 to rotate through multiple IDs.
+  switchIntervalSeconds = 300;
+
+  fps = 30;
+  mute = true;
+  scaling = "fill";
+}

modules/applications/nani/home/nixos.nix

@@ -1,78 +1,5 @@
-{ pkgs, ... }:
+_: {
-let
-  tessdataBest = pkgs.runCommand "tessdata-best-jpn-eng-chi-sim" { } ''
-    mkdir -p "$out"
-    ln -s ${
-      pkgs.fetchurl {
-        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/jpn.traineddata";
-        hash = "sha256-Nr35rII/WRHmJMMNBVPokLirx8MaZbPvFNqUNljEC3k=";
-      }
-    } "$out/jpn.traineddata"
-    ln -s ${
-      pkgs.fetchurl {
-        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/eng.traineddata";
-        hash = "sha256-goCu0Hgv4nJXpo6hD+fvMkyg+Nhb0v0UXRwrVgvLZro=";
-      }
-    } "$out/eng.traineddata"
-    ln -s ${
-      pkgs.fetchurl {
-        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/chi_sim.traineddata";
-        hash = "sha256-T+8tEwbI6HYW1NPkxsZ/r11EvjNCKQz48vD246p+c1s=";
-      }
-    } "$out/chi_sim.traineddata"
-  '';
-
-  tesseract = pkgs.tesseract5.override {
-    tessdata = tessdataBest;
-  };
-
-  naniTranslatePrimary = pkgs.writeShellApplication {
-    name = "nani-translate-primary";
-
-    runtimeInputs = with pkgs; [
-      jq
-      wl-clipboard
-      xdg-utils
-    ];
-
-    text = ''
-      selected_text="$(wl-paste --primary --no-newline)" || exit 0
-      [ -n "$selected_text" ] || exit 0
-      encoded_text="$(printf '%s' "$selected_text" | jq -sRr @uri)"
-      exec xdg-open "naniapp://translate?source=$encoded_text"
-    '';
-  };
-
-  naniTranslateOcr = pkgs.writeShellApplication {
-    name = "nani-translate-ocr";
-
-    runtimeInputs = with pkgs; [
-      grim
-      jq
-      slurp
-      tesseract
-      xdg-utils
-    ];
-
-    text = ''
-      geometry="$(slurp)" || exit 0
-      captured_text="$(
-        grim -g "$geometry" - \
-          | tesseract stdin stdout -l jpn+eng+chi_sim --oem 1 --psm 6
-      )"
-      [ -n "$captured_text" ] || exit 0
-      encoded_text="$(printf '%s' "$captured_text" | jq -sRr @uri)"
-      exec xdg-open "naniapp://translate?source=$encoded_text"
-    '';
-  };
-in
-{
   programs.naniTranslateLinux.enable = true;
 
   xdg.mimeApps.defaultApplications."x-scheme-handler/naniapp" = "nani.desktop";
-
-  home.packages = [
-    naniTranslatePrimary
-    naniTranslateOcr
-  ];
 }

modules/applications/nautilus/home/nixos.nix

@@ -162,6 +162,14 @@ in
     "file://${config.home.homeDirectory}/Desktop Desktop"
     "file://${config.home.homeDirectory}/Pictures Pictures"
     "file://${config.home.homeDirectory}/Downloads Downloads"
-    "file://${config.home.homeDirectory}/Projects Projects"
+    "file://${config.home.homeDirectory}/projects projects"
   ];
+
+  home.activation.createProjectsDirectory = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      $DRY_RUN_CMD mkdir -p "$HOME/projects"
+    '';
+  };
 }

modules/applications/niri/home/nixos.nix

@@ -1,14 +1,28 @@
 { lib, pkgs, ... }:
 let
   keybindings = import ./keybindings.nix;
+  naniTranslatePrimary = pkgs.writeShellApplication {
+    name = "nani-translate-primary";
+    runtimeInputs = with pkgs; [
+      jq
+      wl-clipboard
+      xdg-utils
+    ];
+    text = ''
+      selected_text="$(wl-paste --primary --no-newline)" || exit 0
+      [ -n "$selected_text" ] || exit 0
+      encoded_text="$(printf '%s' "$selected_text" | jq -sRr @uri)"
+      exec xdg-open "naniapp://translate?source=$encoded_text"
+    '';
+  };
 in
 {
+  home.packages = [ naniTranslatePrimary ];
+
   programs.niri.settings = {
 
     binds = keybindings // {
       # niri window or focus move
-      "Mod+MouseMiddle".action.toggle-window-floating = [ ];
-
       "Mod+Shift+Left" = {
         action.focus-monitor-left = [ ];
         hotkey-overlay.title = "Focus Monitor Left";
@@ -26,18 +40,6 @@ in
         hotkey-overlay.title = "Focus Monitor Down";
       };
 
-      # Use the modifier combinations in the opposite direction from Niri's defaults.
-      "Mod+WheelScrollDown".action.focus-column-right = [ ];
-      "Mod+WheelScrollUp".action.focus-column-left = [ ];
-      "Mod+Shift+WheelScrollDown" = {
-        cooldown-ms = 150;
-        action.focus-workspace-down = [ ];
-      };
-      "Mod+Shift+WheelScrollUp" = {
-        cooldown-ms = 150;
-        action.focus-workspace-up = [ ];
-      };
-
       "Mod+Shift+Ctrl+Left" = {
         action.move-window-to-monitor-left = [ ];
         hotkey-overlay.title = "Move Window to Monitor Left";
@@ -106,7 +108,7 @@ in
       "Mod+V" = {
         action.spawn = [
           "vicinae"
-          "vicinae://launch/clipboard/history"
+          "vicinae://launch/clipboard/history?toggle=true"
         ];
         hotkey-overlay.title = "Clipboard History";
       };
@@ -117,7 +119,7 @@ in
       };
       "Mod+Shift+J" = {
         repeat = false;
-        action.spawn = [ "nani-translate-ocr" ];
+        action.spawn = [ "normcap-translate" ];
         hotkey-overlay.title = "OCR and Translate with Nani";
       };
       "Mod+Ctrl+J" = {
@@ -151,6 +153,13 @@ in
         ];
         hotkey-overlay.title = "Find Cursor";
       };
+      "Ctrl+Space" = {
+        action.spawn = [
+          "handy"
+          "--toggle-transcription"
+        ];
+        hotkey-overlay.title = "Toggle Handy Transcription";
+      };
 
       # Function keys (sync with labwc modules/applications/labwc/home.nix)
       "XF86AudioRaiseVolume".action.spawn = [

modules/applications/nix-fleet/meta.nix

@@ -1,3 +0,0 @@
-{
-  description = "Fleet build and deploy command-line tools";
-}

modules/applications/nix-fleet/nixos.nix

@@ -1,63 +0,0 @@
-{
-  inputs,
-  pkgs,
-  primaryUser,
-  ...
-}:
-let
-  system = pkgs.stdenv.hostPlatform.system;
-  deployRs = inputs.deploy-rs.packages.${system}.default;
-
-  fleetBuild = pkgs.writeShellApplication {
-    name = "fleet-build";
-    runtimeInputs = [
-      pkgs.jq
-      pkgs.nix
-    ];
-    text = ''
-      flake_ref="''${FLAKE:-/home/${primaryUser}/dotfiles}"
-
-      if (( $# == 0 )); then
-        # Keep this pipeline inside command substitution so pipefail and
-        # writeShellApplication's errexit propagate evaluation failures.
-        host_lines="$(
-          nix eval --json "$flake_ref#nixosConfigurations" \
-            --apply 'configs: builtins.attrNames configs' |
-            jq -r '.[] | select(. != "installer")'
-        )"
-        if [[ -z "$host_lines" ]]; then
-          echo "No deployable NixOS hosts found in $flake_ref" >&2
-          exit 1
-        fi
-        mapfile -t hosts <<< "$host_lines"
-      else
-        hosts=("$@")
-      fi
-
-      for host in "''${hosts[@]}"; do
-        nix build \
-          --out-link "/var/lib/nix-fleet/roots/build/$host" \
-          "$flake_ref#nixosConfigurations.$host.config.system.build.toplevel"
-      done
-    '';
-  };
-
-  fleetDeploy = pkgs.writeShellApplication {
-    name = "fleet-deploy";
-    runtimeInputs = [ deployRs ];
-    text = ''
-      cd "''${FLAKE:-/home/${primaryUser}/dotfiles}" || exit 1
-
-      exec deploy \
-        --keep-result \
-        --result-path /var/lib/nix-fleet/roots/deploy \
-        "$@"
-    '';
-  };
-in
-{
-  environment.systemPackages = [
-    fleetBuild
-    fleetDeploy
-  ];
-}

modules/applications/noctalia/codexbar.nix

@@ -1,6 +1,6 @@
 { lib, pkgs }:
 let
-  version = "0.56.0";
+  version = "0.46.0";
   architecture =
     if pkgs.stdenv.hostPlatform.isx86_64 then
       "x86_64"
@@ -10,8 +10,8 @@ let
       throw "CodexBar CLI is only packaged for x86_64-linux and aarch64-linux";
   hash =
     {
-      x86_64 = "sha256-hzCnAyiizm8ZDfE1ONEP6S2Pdnskclm+XdDBBhEYVqE=";
+      x86_64 = "sha256-yMrOpu1WIv2sGVgvY9qf2XCoX2AXMSqR2b8bQDRU6os=";
-      aarch64 = "sha256-vfcgDEFpORPymcRYmlqvsjhV4pU7lNC8Vd9FDPI9UjM=";
+      aarch64 = "sha256-pCp3NOlxFN6zeH67W04WGSPbUae+ktzR5vEunWqu00g=";
     }
     .${architecture};
 in

modules/applications/noctalia/home.nix

@@ -13,6 +13,14 @@ let
       --replace-fail "@codexbarPath@" "${lib.getExe codexbar}"
   '';
 
+  noctaliaPatched =
+    inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default.overrideAttrs
+      (oldAttrs: {
+        patches = (oldAttrs.patches or [ ]) ++ [
+          ./patches/window-switcher-labwc.patch
+        ];
+      });
+
   wallpapers = pkgs.fetchFromGitHub {
     owner = "moons-14";
     repo = "wallpapers";
@@ -42,7 +50,7 @@ in
   programs.noctalia = {
     enable = true;
 
-    package = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default;
+    package = noctaliaPatched;
 
     systemd.enable = true;
 
@@ -157,7 +165,7 @@ in
         network-connection = {
           type = "custom_button";
           glyph = "access-point";
-          actions.left = "exec nm-connection-editor";
+          actions.left = "nm-connection-editor";
         };
         tray = {
           type = "tray";
@@ -178,7 +186,7 @@ in
             "google-chrome"
             "code"
             "dev.zed.Zed"
-            "chatgpt"
+            "codex-desktop"
             "vesktop"
           ];
           show_all_outputs = true;

modules/applications/noctalia/patches/taskbar-overview-hook.patch

@@ -0,0 +1,43 @@
+diff --git a/src/shell/bar/widgets/taskbar_widget.cpp b/src/shell/bar/widgets/taskbar_widget.cpp
+--- a/src/shell/bar/widgets/taskbar_widget.cpp
++++ b/src/shell/bar/widgets/taskbar_widget.cpp
+@@ -5,6 +5,7 @@
+ #include "compositors/workspace_backend.h"
+ #include "config/config_service.h"
+ #include "core/deferred_call.h"
++#include "core/process/process.h"
+ #include "i18n/i18n.h"
+ #include "render/core/color.h"
+ #include "render/core/renderer.h"
+@@ -36,6 +37,18 @@
+ 
+ namespace {
+ 
++  [[nodiscard]] bool launchTaskbarOverview(const std::string& appId) {
++    constexpr const char* command = "noctalia-taskbar-overview";
++    if (appId.empty() || !process::commandExists(command)) {
++      return false;
++    }
++    return process::runAsync({
++        command,
++        "--app-id",
++        appId.c_str(),
++    });
++  }
++
+   // Integer centering; optional odd spare pixel on the end side (right/bottom).
+   [[nodiscard]] float centeredOffset(float extent, float content, float inset = 0.0F, bool oddSpareOnEnd = true) {
+     const float inner = std::max(0.0F, extent - inset * 2.0F);
+@@ -373,6 +386,12 @@ void TaskbarWidget::activateOrLaunchPinned(const TaskModel& task) {
+     return;
+   }
+ 
++  const std::string overviewAppId =
++      !task.appId.empty() ? task.appId : (!task.desktopEntryId.empty() ? task.desktopEntryId : task.idLower);
++  if (launchTaskbarOverview(overviewAppId)) {
++    return;
++  }
++
+   const std::string cycleKey = !task.desktopEntryId.empty() ? task.desktopEntryId : task.idLower;
+   std::size_t& cursor = m_groupedAppCycleCursor[cycleKey];
+   if (cursor >= windows.size()) {

modules/applications/noctalia/patches/window-switcher-labwc.patch

@@ -0,0 +1,26 @@
+diff --git a/src/shell/switcher/window_switcher.cpp b/src/shell/switcher/window_switcher.cpp
+--- a/src/shell/switcher/window_switcher.cpp
++++ b/src/shell/switcher/window_switcher.cpp
+@@ -286,12 +286,19 @@ indexLiveToplevelsByWindowId(const CompositorPlatform& platform, std::unordered_
+           continue;
+         }
+ 
+-        const auto mappedId = platform.compositorWindowIdForToplevelInfo(info);
+-        if (!mappedId.has_value() || mappedId->empty()) {
+-          continue;
++        std::string key;
++        if (const auto mappedId = platform.compositorWindowIdForToplevelInfo(info);
++            mappedId.has_value() && !mappedId->empty()) {
++          key = canonicalWindowId(*mappedId);
+         }
+-        const std::string key = canonicalWindowId(*mappedId);
++
++        // Generic wlroots compositors such as labwc do not provide a
++        // compositor-specific window ID. The wlr toplevel handle is stable
++        // for the lifetime of the window and is sufficient for switcher identity.
++        if (key.empty() && wlrHandle != 0) {
++          key = "toplevel:" + std::to_string(wlrHandle);
++        }
+         if (key.empty()) {
+           continue;
+         }

modules/applications/normcap/home/nixos.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+let
+  normcap = pkgs.normcap.override {
+    tesseract4 = pkgs.tesseract4.override {
+      enableLanguages = [
+        "chi_sim"
+        "jpn"
+        "eng"
+      ];
+    };
+  };
+
+  normcapTranslate = pkgs.writeShellApplication {
+    name = "normcap-translate";
+
+    runtimeInputs = [
+      normcap
+      pkgs.jq
+      pkgs.xdg-utils
+    ];
+
+    text = ''
+      captured_text="$(
+        normcap \
+          --cli-mode \
+          --screenshot-handler grim \
+          --show-introduction False \
+          --update False \
+          --detect-codes False \
+          --notification False \
+          -l jpn eng chi_sim
+      )" || exit 0
+      [ -n "$captured_text" ] || exit 0
+      encoded_text="$(printf '%s' "$captured_text" | jq -sRr @uri)"
+      exec xdg-open "naniapp://translate?source=$encoded_text"
+    '';
+  };
+in
+{
+  home.packages = [
+    normcap
+    normcapTranslate
+  ];
+}

modules/applications/normcap/meta.nix

@@ -0,0 +1,7 @@
+{
+  description = "NormCap OCR screen capture";
+
+  includes = [
+    "applications.nani"
+  ];
+}

modules/applications/opencode/home.nix

@@ -2,19 +2,5 @@
 {
   home.packages = [
     inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.oh-my-opencode
   ];
-
-  home.file.".omo/omo.jsonc".text = builtins.toJSON {
-    agents = {
-      sisyphus.model = "openai/gpt-5.6-sol";
-      hephaestus.model = "openai/gpt-5.6-terra";
-      prometheus.model = "openai/gpt-5.6-terra";
-      oracle.model = "openai/gpt-5.6-terra";
-      momus.model = "openai/gpt-5.6-terra";
-      librarian.model = "openai/gpt-5.6-luna";
-      explore.model = "openai/gpt-5.6-luna";
-      atlas.model = "openai/gpt-5.6-luna";
-    };
-  };
 }

modules/applications/ssh/home/common.nix

@@ -24,9 +24,6 @@ lib.mkMerge [
       };
 
       extraConfig = ''
-        Match exec "test -n \"$SSH_AUTH_SOCK\" && test -S \"$SSH_AUTH_SOCK\""
-          IdentityAgent $SSH_AUTH_SOCK
-
         Match exec "test -S %d/.1password/agent.sock"
           IdentityAgent %d/.1password/agent.sock
       '';

modules/applications/vicinae/home/common.nix

@@ -10,8 +10,6 @@ in
   programs.vicinae = {
     enable = true;
 
-    enableChromeIntegration = false;
-
     settings = {
       font.size = 11;
       close_on_focus_loss = true;

modules/applications/vicinae/home/nixos.nix

@@ -8,6 +8,9 @@ let
 in
 {
   programs.vicinae = {
+
+    package = pkgs.vicinae;
+
     systemd = {
       enable = true;
       autoStart = true;

modules/applications/xcode/darwin.nix

@@ -1,8 +0,0 @@
-{
-  homebrew = {
-    enable = true;
-    masApps = {
-      Xcode = 497799835;
-    };
-  };
-}

modules/applications/yt-dlp/home.nix

@@ -1,4 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [ pkgs.yt-dlp ];
-}

modules/applications/zed/home.nix

@@ -4,11 +4,8 @@
     extensions = [
       "catppuccin"
       "nix"
-      "dockerfile"
     ];
     mutableUserSettings = false;
-    mutableUserKeymaps = false;
-    userKeymaps = import ./keymaps.nix;
 
     userSettings = {
       agent = {
@@ -39,9 +36,6 @@
         light = "Catppuccin Latte";
         dark = "Catppuccin Mocha";
       };
-      edit_predictions = {
-        provider = "copilot";
-      };
     };
   };
 }

modules/applications/zed/keymaps.nix

@@ -1,38 +0,0 @@
-[
-  {
-    context = "Editor && vim_mode == normal";
-    bindings = {
-      # This selected native-equivalent subset preserves Zed's Vim defaults for
-      # K, gd, grr, gri, gra, gO, ]d, [d, zM, zR, [b, and ]b.
-      "g r t" = "editor::GoToTypeDefinition";
-      "space space" = "pane::AlternateFile";
-      "space r n" = "editor::Rename";
-      "space c a" = "editor::ToggleCodeActions";
-      "space c f" = "editor::Format";
-      "space d l" = "editor::Hover";
-      "space e" = "project_panel::Toggle";
-      "space t t" = "terminal_panel::Toggle";
-      "space b c" = "pane::CloseActiveItem";
-      "space f f" = "file_finder::Toggle";
-      "space f g" = "pane::DeploySearch";
-      "space f b" = "tab_switcher::ToggleAll";
-      "space f s" = "outline::Toggle";
-      "space f shift-s" = "project_symbols::Toggle";
-      "space x x" = "diagnostics::Deploy";
-    };
-  }
-  {
-    # Keep normal-mode editor navigation out of terminals and other panels.
-    context = "Editor && vim_mode == normal && !menu";
-    bindings = {
-      "ctrl-h" = "workspace::ActivatePaneLeft";
-      "ctrl-j" = "workspace::ActivatePaneDown";
-      "ctrl-k" = "workspace::ActivatePaneUp";
-      "ctrl-l" = "workspace::ActivatePaneRight";
-      "ctrl-left" = "workspace::ActivatePaneLeft";
-      "ctrl-down" = "workspace::ActivatePaneDown";
-      "ctrl-up" = "workspace::ActivatePaneUp";
-      "ctrl-right" = "workspace::ActivatePaneRight";
-    };
-  }
-]

modules/hardwares/nvidia/nixos.nix

@@ -5,7 +5,10 @@
     modesetting.enable = true;
     open = true;
 
-    powerManagement.enable = true;
+    powerManagement = {
+      enable = true;
+      kernelSuspendNotifier = true;
+    };
 
     moduleParams.nvidia.NVreg_TemporaryFilePath = "/var/tmp";
 

modules/profiles/README.md

@@ -38,13 +38,9 @@ required on every supported host.
 | `platform.vm`                        | UEFI QEMU NixOS guest with NFS client support |
 | `workload.development`               | NixOS, macOS with Home Manager                |
 | `workload.game`                      | NixOS, macOS                                  |
-| `workload.machine-learning`          | NixOS with Home Manager                       |
-| `workload.nix-builder`               | NixOS central build and binary-cache VM       |
 | `workload.personal`                  | NixOS, macOS with Home Manager                |
 | `workload.remote-access`             | NixOS, macOS                                  |
-| `workload.camera`                    | NixOS                                         |
 | `workload.server`                    | NixOS, macOS with Home Manager                |
-| `networking.homelab-cache-client`    | NixOS, macOS with access to nix-builder       |
 | `networking.tailscale-client`        | NixOS, macOS                                  |
 | `networking.tailscale-subnet-router` | NixOS                                         |
 | `security.fingerprint`               | NixOS, macOS                                  |
@@ -62,22 +58,18 @@ selects labwc. A daily-use macOS development machine can combine
 `interface.macos`, `workload.development`, and `workload.personal`. Hardware
 support does not implicitly select an interface or workload.
 
-`workload.machine-learning` provides the Hugging Face Hub CLI for hosts used
-to download and publish machine learning models and datasets.
-
-`workload.nix-builder` provides the central build policy, persistent fleet GC
-roots, deploy-rs tooling, SOPS integration, and Harmonia binary cache. Network
-reachability and remote shell access remain independent host selections.
-
-`networking.homelab-cache-client` adds the internal Harmonia substituter and
-its trusted public key. It requires the public key generated during
-`hosts/nix-builder/README.md` bootstrap.
-
 `workload.personal` provides Pear Desktop on both NixOS and macOS. Home Manager
 enables performance improvements, synced lyrics, tracker blocking, the album
 color theme, and custom output-device selection while preserving user-owned
 settings such as the selected device.
 
+`workload.personal` also provides Handy for offline speech-to-text. It starts
+hidden when the graphical session begins. On niri and labwc, `Ctrl+Space` is
+owned by the compositor and invokes Handy's `--toggle-transcription` command;
+Handy's own shortcut bindings are disabled on NixOS so it does not monitor
+keyboard events under Wayland. Handy uses the Homebrew cask and starts at login
+on macOS.
+
 `workload.personal` provides ActivityWatch for local activity tracking. On
 NixOS, its server and Wayland-compatible watcher run as Home Manager user
 services. On macOS, the Homebrew cask starts at login.

modules/profiles/interface/linux-desktop/home.nix

@@ -4,6 +4,8 @@
     pkgs.playerctl
   ];
 
+  programs.noctalia.settings.wallpaper.enabled = false;
+
   xdg.userDirs = {
     enable = true;
     createDirectories = true;
@@ -15,6 +17,5 @@
     publicShare = "$HOME/Public";
     templates = "$HOME/Templates";
     videos = "$HOME/Videos";
-    projects = "$HOME/Projects";
   };
 }

modules/profiles/interface/linux-desktop/meta.nix

@@ -11,15 +11,15 @@
     "applications.ghostty"
     "applications.gtk"
     "applications.loupe"
+    "applications.linux-wallpaperengine"
     "applications.nautilus"
-    "applications.nani"
+    "applications.normcap"
     "applications.papers"
     "applications.qalculate-gtk"
     "applications.resources"
     "applications.vlc"
     "hardwares.graphics"
     "services.gvfs"
-    "services.evremap"
     "services.polkit-gnome"
     "systems.audio"
     "systems.fonts"

modules/profiles/networking/homelab-cache-client/meta.nix

@@ -1,5 +0,0 @@
-{
-  description = "Use the homelab Harmonia binary cache";
-
-  includes = [ "systems.nix.homelab-cache" ];
-}

modules/profiles/platform/desktop/nixos.nix

@@ -3,7 +3,6 @@
   # every system sleep path; screen blanking while locked is handled by
   # services.swayidle in the graphical session.
   systemd.sleep.settings.Sleep = {
-    AllowSuspend = true;
     AllowHibernation = false;
     AllowHybridSleep = false;
     AllowSuspendThenHibernate = false;

modules/profiles/security/secrets/nixos.nix

@@ -1,6 +0,0 @@
-{
-  sops.secrets."users/moons/hashedPassword" = {
-    sopsFile = ../../../secrets/common/system.yaml;
-    neededForUsers = true;
-  };
-}

modules/profiles/workload/camera/meta.nix

@@ -1,5 +0,0 @@
-{
-  description = "Camera capture and virtual camera tools";
-
-  includes = [ "systems.boot.v4l2loopback" ];
-}

modules/profiles/workload/camera/nixos.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    gphoto2
-    ffmpeg
-    v4l-utils
-  ];
-}

modules/profiles/workload/development/home.nix

@@ -4,7 +4,7 @@
     bind
     bun
     nil
-    python314
+    python312
     uv
   ];
 }

modules/profiles/workload/development/meta.nix

@@ -6,7 +6,6 @@
     "applications.claude"
     "applications.codex"
     "applications.codex-desktop"
-    "applications.codex-session-usage"
     "applications.docker"
     "applications.drawio"
     "applications.ghostty"
@@ -14,7 +13,6 @@
     "applications.java"
     "applications.opencode"
     "applications.vscode"
-    "applications.xcode"
     "applications.zed"
   ];
 }

modules/profiles/workload/machine-learning/meta.nix

@@ -1,5 +0,0 @@
-{
-  description = "Machine learning tools";
-
-  includes = [ "applications.huggingface-cli" ];
-}

modules/profiles/workload/nix-builder/meta.nix

@@ -1,10 +0,0 @@
-{
-  description = "Central Nix builder, deploy controller, and binary cache";
-
-  includes = [
-    "applications.nix-fleet"
-    "services.harmonia"
-    "systems.nix.build-server"
-    "systems.sops"
-  ];
-}

modules/profiles/workload/personal/meta.nix

@@ -6,8 +6,8 @@
     "applications.activitywatch"
     "applications.chrome"
     "applications.discord"
-    "applications.ffmpeg"
     "applications.gnome-text-editor"
+    "applications.handy"
     "applications.kde"
     "applications.moonlight"
     "applications.slack"
@@ -15,6 +15,5 @@
     "applications.obs"
     "applications.nani"
     "applications.thunderbird"
-    "applications.yt-dlp"
   ];
 }

modules/services/evremap/nixos.nix

@@ -1,20 +0,0 @@
-{
-  services.evremap = {
-    enable = true;
-
-    settings = {
-      device_name = "VXE VXE Mouse 1K Dongle Mouse";
-
-      remap = [
-        {
-          input = [ "BTN_SIDE" ];
-          output = [ "KEY_LEFTMETA" ];
-        }
-        {
-          input = [ "BTN_EXTRA" ];
-          output = [ "BTN_SIDE" ];
-        }
-      ];
-    };
-  };
-}

modules/services/harmonia/meta.nix

@@ -1,3 +0,0 @@
-{
-  description = "Harmonia binary cache backed by the local Nix store";
-}

modules/services/harmonia/nixos.nix

@@ -1,19 +0,0 @@
-let
-  signingKeyPath = "/run/secrets/harmonia/signing-key";
-in
-{
-  services.harmonia.cache = {
-    enable = true;
-    signKeyPaths = [ signingKeyPath ];
-
-    settings = {
-      bind = "0.0.0.0:5000";
-      priority = 30;
-    };
-  };
-
-  # Keep activation usable while the host-specific SOPS secret is bootstrapped.
-  # Once the secret exists, starting the socket also starts Harmonia on demand.
-  systemd.sockets.harmonia.unitConfig.ConditionPathExists = signingKeyPath;
-  systemd.services.harmonia.unitConfig.ConditionPathExists = signingKeyPath;
-}

modules/services/swayidle/home/nixos.nix

@@ -10,8 +10,6 @@ let
   brightnessState = "$XDG_RUNTIME_DIR/swayidle-brightness";
 
   onBattery = pkgs.writeShellScript "swayidle-on-battery" ''
-    [ "''${SWAYIDLE_ASSUME_AC:-0}" = 1 ] && exit 1
-
     for supply in /sys/class/power_supply/*; do
       [ -f "$supply/type" ] || continue
       [ "$(< "$supply/type")" = "Battery" ] || continue

modules/systems/audio/nixos.nix

@@ -21,5 +21,29 @@ in
     pulse.enable = true;
     jack.enable = true;
     wireplumber.enable = true;
+
+    extraConfig.pipewire."90-echo-cancel.conf" = {
+      "context.modules" = [
+        {
+          name = "libpipewire-module-echo-cancel";
+
+          args = {
+            "library.name" = "aec/libspa-aec-webrtc";
+
+            "monitor.mode" = true;
+
+            "capture.props" = {
+              "node.name" = "echo_cancel_capture";
+              "node.description" = "Echo Cancel Capture";
+            };
+
+            "source.props" = {
+              "node.name" = "echo_cancel_source";
+              "node.description" = "Echo Cancelled Microphone";
+            };
+          };
+        }
+      ];
+    };
   };
 }

modules/systems/boot/base/nixos.nix

@@ -1,6 +1,6 @@
 { pkgs, lib, ... }:
 {
   boot.loader.systemd-boot.configurationLimit = lib.mkDefault 8;
-  boot.kernelPackages = pkgs.linuxPackages;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
   programs.nix-ld.enable = true;
 }

modules/systems/boot/v4l2loopback/nixos.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-{
-  boot = {
-    extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-    kernelModules = [ "v4l2loopback" ];
-    extraModprobeConfig = ''
-      options v4l2loopback devices=1 video_nr=42 card_label="LUMIX S9" exclusive_caps=1
-    '';
-  };
-}

modules/systems/nix/build-server/meta.nix

@@ -1,3 +0,0 @@
-{
-  description = "Central Nix build server policy and persistent fleet roots";
-}

modules/systems/nix/build-server/nixos.nix

@@ -1,33 +0,0 @@
-{ primaryUser, ... }:
-let
-  GiB = 1024 * 1024 * 1024;
-in
-{
-  nix = {
-    nrBuildUsers = 64;
-
-    settings = {
-      # Limit concurrent derivations so build scratch and memory usage remain
-      # bounded. Each derivation may still use every vCPU exposed to the VM.
-      max-jobs = 2;
-      cores = 0;
-
-      # Keep enough room for large desktop, browser, and CUDA closures.
-      min-free = 64 * GiB;
-      max-free = 128 * GiB;
-    };
-  };
-
-  systemd.services.nix-daemon.serviceConfig = {
-    MemoryAccounting = true;
-    MemoryMax = "90%";
-    OOMScoreAdjust = 500;
-  };
-
-  systemd.tmpfiles.rules = [
-    "d /var/lib/nix-fleet 0750 ${primaryUser} users - -"
-    "d /var/lib/nix-fleet/roots 0750 ${primaryUser} users - -"
-    "d /var/lib/nix-fleet/roots/build 0750 ${primaryUser} users - -"
-    "d /var/lib/nix-fleet/roots/deploy 0750 ${primaryUser} users - -"
-  ];
-}

modules/systems/nix/common.nix

@@ -7,18 +7,14 @@
       "flakes"
     ];
 
-    connect-timeout = 10;
-
     extra-substituters = [
       "https://cache.nixos.org"
       "https://nix-community.cachix.org"
       "https://moons-dotfiles.cachix.org"
       "https://noctalia.cachix.org"
       "https://vicinae.cachix.org"
-      "https://ghostty.cachix.org"
       "https://cache.numtide.com"
       "https://codex-desktop-linux.cachix.org"
-      "https://cuda-maintainers.cachix.org"
     ];
 
     extra-trusted-public-keys = [
@@ -27,10 +23,8 @@
       "moons-dotfiles.cachix.org-1:WHoroKiNScG2/dpxHHL1I0qVmvuQhJbEAP+DS2j9Rr0="
       "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
       "vicinae.cachix.org-1:1kDrfienkGHPYbkpNj1mWTr7Fm1+zcenzgTizIcI3oc="
-      "ghostty.cachix.org-1:QB389yTa6gTyneehvqG58y0WnHjQOqgnA+wBnpWWxns="
       "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
       "codex-desktop-linux.cachix.org-1:nX/xy6AdK9hQE24A8ALGjkCKj2ObFmcnemiL5Cid4nk="
-      "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
     ];
   };
 }

modules/systems/nix/homelab-cache/common.nix

@@ -1,22 +0,0 @@
-{ lib, ... }:
-let
-  publicKeyFile = ./public-key;
-  hasPublicKey = builtins.pathExists publicKeyFile;
-  publicKey = if hasPublicKey then lib.removeSuffix "\n" (builtins.readFile publicKeyFile) else "";
-in
-{
-  assertions = [
-    {
-      assertion = hasPublicKey;
-      message = ''
-        systems.nix.homelab-cache requires
-        modules/systems/nix/homelab-cache/public-key
-      '';
-    }
-  ];
-
-  nix.settings = lib.mkIf hasPublicKey {
-    extra-substituters = [ "http://nix-builder:5000" ];
-    extra-trusted-public-keys = [ publicKey ];
-  };
-}

modules/systems/nix/homelab-cache/meta.nix

@@ -1,3 +0,0 @@
-{
-  description = "Homelab Harmonia binary-cache client settings";
-}

modules/systems/sops/nixos.nix

@@ -1,3 +1,8 @@
 {
   services.pcscd.enable = true;
+
+  sops.secrets."users/moons/hashedPassword" = {
+    sopsFile = ../../../secrets/common/system.yaml;
+    neededForUsers = true;
+  };
 }

shells/default.nix

@@ -2,6 +2,5 @@
   imports = [
     ./dotnix.nix
     ./android.nix
-    ./ios.nix
   ];
 }

shells/ios.nix

@@ -1,48 +0,0 @@
-_: {
-  perSystem =
-    { pkgs, ... }:
-    let
-      installIosSimulator = pkgs.writeShellApplication {
-        name = "ios-simulator-install";
-        text = ''
-          if [[ "$(/usr/bin/uname -s)" != "Darwin" ]]; then
-            echo "ios-simulator-install is only supported on macOS." >&2
-            exit 1
-          fi
-
-          xcode_app="/Applications/Xcode.app"
-          developer_dir="$xcode_app/Contents/Developer"
-
-          if [[ ! -d "$developer_dir" ]]; then
-            echo "Xcode is not installed at $xcode_app." >&2
-            echo "Apply the m2 nix-darwin configuration first." >&2
-            exit 1
-          fi
-
-          current_developer_dir="$(/usr/bin/xcode-select -p 2>/dev/null || true)"
-          if [[ "$current_developer_dir" != "$developer_dir" ]]; then
-            echo "Selecting stable Xcode..."
-            /usr/bin/sudo /usr/bin/xcode-select --switch "$developer_dir"
-          fi
-
-          echo "Installing Xcode first-launch components..."
-          /usr/bin/sudo /usr/bin/xcodebuild -runFirstLaunch
-
-          echo "Checking for newer hardware support..."
-          /usr/bin/xcodebuild -runFirstLaunch -checkForNewerComponents
-
-          echo "Downloading and installing the latest iOS Simulator runtime..."
-          /usr/bin/xcodebuild -downloadPlatform iOS
-
-          echo
-          /usr/bin/xcodebuild -version
-          /usr/bin/xcrun simctl list runtimes
-        '';
-      };
-    in
-    {
-      devShells.ios = pkgs.mkShell {
-        packages = [ installIosSimulator ];
-      };
-    };
-}