upd

.gitignore

@@ -6,9 +6,9 @@ result*
 .direnv
 shell.nix
 .vscode
-**/*/*.py
 .envrc
 .DS_Store
 *.qcow2
 keys
-iso-*
+iso-*
+**/*/__pycache__

README.md

@@ -71,7 +71,7 @@ A powerful AMD-based desktop with gaming capabilities, featuring:
 ### NAS
 
 A home server with various self-hosted services:
-- Media management (Jellyfin, Jellyseerr)
+- Media management (Jellyfin, seerr)
 - Download automation (Sonarr, Radarr, etc.)
 - Document management (Paperless)
 - File sharing (Samba, Nextcloud)

checks/pre-commit-hooks/default.nix

@@ -28,12 +28,13 @@ pre-commit-hooks-nix.lib.${pkgs.stdenv.hostPlatform.system}.run {
       enable = true;
       package = pkgs.nixfmt;
     };
-    statix = {
-      enable = true;
-      args = [
-        "--config"
-        (lib.snowfall.fs.get-file "statix.toml")
-      ];
-    };
+    # statix disabled - too many false positives (manual_inherit warnings)
+    # statix = {
+    #   enable = true;
+    #   args = [
+    #     "--config"
+    #     (lib.snowfall.fs.get-file "statix.toml")
+    #   ];
+    # };
   };
 }

docs/modules/README.md

@@ -140,7 +140,7 @@ mjallen.services.jellyfin = {
 
 Available services:
 
-`actual`, `ai`, `appimage`, `arrs`, `attic`, `authentik`, `authentikRac`, `booklore`, `caddy`, `calibre`, `calibre-web`, `cockpit`, `code-server`, `collabora`, `coturn`, `crowdsec`, `dispatcharr`, `free-games-claimer`, `gitea`, `glance`, `glances`, `grafana`, `guacd`, `headscale`, `immich`, `jellyfin`, `jellyseerr`, `lubelogger`, `manyfold`, `matrix`, `minecraft`, `mongodb`, `nebula`, `netbootxyz`, `nextcloud`, `ntfy`, `onlyoffice`, `opencloud`, `orca`, `paperless`, `paperless-ai`, `protonmail-bridge`, `restic`, `samba`, `sparky-fitness`, `sparky-fitness-server`, `sunshine`, `tdarr`, `termix`, `tunarr`, `unmanic`, `uptime-kuma`, `wyoming`, `your-spotify`
+`actual`, `ai`, `appimage`, `arrs`, `attic`, `authentik`, `authentikRac`, `booklore`, `caddy`, `calibre`, `calibre-web`, `cockpit`, `code-server`, `collabora`, `coturn`, `crowdsec`, `dispatcharr`, `free-games-claimer`, `gitea`, `glance`, `glances`, `grafana`, `guacd`, `headscale`, `immich`, `jellyfin`, `seerr`, `lubelogger`, `manyfold`, `matrix`, `minecraft`, `mongodb`, `nebula`, `netbootxyz`, `nextcloud`, `ntfy`, `onlyoffice`, `opencloud`, `orca`, `paperless`, `paperless-ai`, `protonmail-bridge`, `restic`, `samba`, `sparky-fitness`, `sparky-fitness-server`, `sunshine`, `tdarr`, `termix`, `tunarr`, `unmanic`, `uptime-kuma`, `wyoming`, `your-spotify`
 
 #### Nebula VPN (`services/nebula/`)
 

docs/services.md

@@ -0,0 +1,90 @@
+# Services
+
+All services are derived from `lib.mjallen.network` (`lib/network/default.nix`).
+Domain: `mjallen.dev`
+
+Services are grouped by host. The **URL** column is only present when a reverse proxy
+is configured (i.e. `reverseProxy.enable = true`) or a well-known public URL exists.
+Services without a public URL are accessible only on the LAN or internally.
+
+---
+
+## NAS (`jallen-nas` — `10.0.1.3`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| actual | No | 3333 | https://actual.mjallen.dev |
+| ai (Ollama + llama.cpp + Open-WebUI) | Yes | 8127 / 11434 / various | https://chat.mjallen.dev |
+| arrs (Sonarr + Radarr + SABnzbd) | Yes | 8989 / 7878 / 8280 | — |
+| attic | Yes | 9012 | https://cache.mjallen.dev |
+| authentik | Yes | 9000 | https://authentik.mjallen.dev |
+| authentikRac | Yes | 4823 | — |
+| caddy | Yes | 80 / 443 | — |
+| calibre | No | 8084 | https://calibre.mjallen.dev |
+| calibre-web | No | 8083 | https://calibre-web.mjallen.dev |
+| cockpit | Yes | 9091 | — |
+| code-server | Yes | 4444 | https://code.mjallen.dev |
+| collabora | Yes | 9980 | https://office.mjallen.dev |
+| coturn | Yes | 3478 | — |
+| crowdsec | Yes | 8181 | — |
+| dispatcharr | No | 9191 | https://dispatcharr.mjallen.dev |
+| free-games-claimer | No | 6080 | — |
+| gitea | Yes | 3000 / SSH 2222 | https://gitea.mjallen.dev |
+| glance | Yes | 5555 | https://glance.mjallen.dev |
+| glances | Yes | 61208 | https://glances.mjallen.dev |
+| grafana | Yes | 9999 | https://grafana.mjallen.dev |
+| grimmory | No | 6066 | https://grimmory.mjallen.dev |
+| guacd | Yes | 4822 | — |
+| headscale | No | 2112 | https://headscale.mjallen.dev |
+| immich | Yes | 2283 | https://immich.mjallen.dev |
+| jellyfin | Yes | 8096 | https://jellyfin.mjallen.dev |
+| seerr | Yes | 5055 | https://seerr.mjallen.dev |
+| kavita | Yes | 5000 | — |
+| lemonade | No | 8001 | — |
+| lubelogger | Yes | 6754 | https://lubelogger.mjallen.dev |
+| manyfold | Yes | 3214 | — |
+| matrix | Yes | 8448 | https://matrix.mjallen.dev |
+| minecraft | No | 25565 | — |
+| mongodb | No | 27017 | — |
+| nebula | Yes | 4242 | — |
+| netbootxyz | No | 4000 | https://netbootxyz.mjallen.dev |
+| nextcloud | Yes | 9988 | https://cloud.mjallen.dev |
+| ntfy | Yes | 2586 | https://ntfy.mjallen.dev |
+| ocis | No | 9200 | — |
+| onlyoffice | No | 9943 | — |
+| opencloud | No | 9200 | — |
+| orca-slicer | No | 3100 | https://orca-slicer.mjallen.dev |
+| paperless | Yes | 28981 | — |
+| paperless-ai | Yes | 28982 | — |
+| protonmail-bridge | Yes | SMTP 1025 / IMAP 1143 | — |
+| restic-server | Yes | 8008 | — |
+| sparky-fitness (frontend) | Yes | 3004 | https://sparky.mjallen.dev |
+| sparky-fitness-server (backend) | Yes | 3010 | — |
+| sunshine | Yes | 47989 | — |
+| tdarr | No | 8265 / 8266 | https://tdarr.mjallen.dev |
+| termix | Yes | 7777 | https://termix.mjallen.dev |
+| tunarr | Yes | 8000 | https://tunarr.mjallen.dev |
+| unmanic | Yes | 8265 | https://unmanic.mjallen.dev |
+| uptime-kuma | Yes | 3001 | — |
+| wyoming (Whisper + Piper) | Yes | 10300 / 10200 | — |
+
+---
+
+## NUC (`nuc-nixos` — `10.0.1.4`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| home-assistant | Yes | 8123 | https://hass.mjallen.dev |
+| esphome | Yes | 6052 | — |
+| otbr (OpenThread Border Router) | Yes | 8880 / REST 8881 | — |
+| mosquitto (MQTT) | Yes | 1883 | — |
+
+---
+
+## Pi5 (`pi5` — `10.0.1.2`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| adguard | Yes | 3000 | — |
+| nebula (lighthouse) | Yes | 4242 | — |
+| dns | Yes | 53 | — |

docs/systems/jallen-nas.md

@@ -54,7 +54,7 @@
 | Attic | 9012 | Nix binary cache (`cache.mjallen.dev`) |
 | Immich | 2283 | Photo management |
 | Jellyfin | 8096 | Media server |
-| Jellyseerr | 5055 | Media request manager |
+| Seerr | 5055 | Media request manager |
 | Nextcloud | 9988 | Cloud storage |
 | Paperless | 28981 | Document management |
 | Paperless AI | 28982 | AI-assisted document tagging |

docs/version.schema.json

@@ -76,6 +76,7 @@
         "repo":  { "type": "string", "description": "GitHub repository (github fetcher)." },
         "tag":   { "type": "string", "description": "Git tag (github fetcher). Mutually exclusive with 'rev'." },
         "rev":   { "type": "string", "description": "Commit revision (github/git fetchers)." },
+        "branch": { "type": "string", "description": "Branch to track for HEAD-commit updates (github/git fetchers). Stored alongside 'rev' to record which branch the pinned commit came from. Has no effect on the Nix fetcher itself — only used by the version management tooling." },
         "submodules": { "type": "boolean", "description": "Whether to fetch submodules (github/git fetchers)." },
 
         "url": { "type": "string", "description": "Final URL (url fetcher). May be templated." },
@@ -157,6 +158,7 @@
         "repo":  { "type": "string" },
         "tag":   { "type": "string" },
         "rev":   { "type": "string" },
+        "branch": { "type": "string" },
         "submodules": { "type": "boolean" },
 
         "url":         { "type": "string" },

flake.lock

@@ -25,7 +25,7 @@
         "flake-utils": "flake-utils",
         "napalm": "napalm",
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-stable"
         ],
         "pyproject-build-systems": "pyproject-build-systems",
         "pyproject-nix": "pyproject-nix",
@@ -33,11 +33,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1774079362,
-        "narHash": "sha256-HkoEWTxU5gNigcnhIa3GXukHqC5xGmgVaLICGUKlpdo=",
+        "lastModified": 1776085803,
+        "narHash": "sha256-JvvWVbXJYSY8qOReMbAOD4lxcN2cjKV6lg/jLz8CEuY=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "1f279763d8b4a9138c01f1021f53e09bc2c54eb9",
+        "rev": "4370b561c8bafb59773ce3a518506bcf1161dbdb",
         "type": "github"
       },
       "original": {
@@ -49,16 +49,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1772567399,
-        "narHash": "sha256-0Vpf1hj9C8r+rhrCgwoNazpQ+mwgjdjDhuoKCxYQFWw=",
+        "lastModified": 1775573258,
+        "narHash": "sha256-Xq7JGI/8ppIydIuWd9KRJKUrh7UpeniwvZ4NAtXbYJ4=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "0dccbd4193c45c581e9fb7cd89df0c1487510f1f",
+        "rev": "5249546862986202b901c2afd860992ec48c6ef6",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2026.2.1",
+        "ref": "version/2026.2.2",
         "repo": "authentik",
         "type": "github"
       }
@@ -134,16 +134,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1769363988,
-        "narHash": "sha256-BiGPeulrDVetXP+tjxhMcGLUROZAtZIhU5m4MqawCfM=",
+        "lastModified": 1774235677,
+        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "d01011cac6d72032c75fd2cd9489909e95d9faf2",
+        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.0.12",
+        "ref": "5.1.1",
         "repo": "brew",
         "type": "github"
       }
@@ -151,11 +151,11 @@
     "cachyos-kernel": {
       "flake": false,
       "locked": {
-        "lastModified": 1774160598,
-        "narHash": "sha256-ArPoVPHpXauFDGsz7nGBiXljj7keGcp/O4Pf4ZU4/30=",
+        "lastModified": 1776183001,
+        "narHash": "sha256-lvLKB5dTqjO1S/YonS9ZyWemEjO6QXtN4D76rYEYy4s=",
         "owner": "CachyOS",
         "repo": "linux-cachyos",
-        "rev": "1caa0b77871d4537f0d629a2ce30edb2f6178d19",
+        "rev": "4224303b6d7a50dd1cc3ffa78864050cc9536eec",
         "type": "github"
       },
       "original": {
@@ -167,11 +167,11 @@
     "cachyos-kernel-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1774023710,
-        "narHash": "sha256-Oc+4K6edCv0fdvfe6UW+OpJiXYWkXRrOH9TDMNwi+J8=",
+        "lastModified": 1776355454,
+        "narHash": "sha256-b9Hc0sTxjEzDbphzS9yQqxVha/7bsPIs2cQQQvaG45E=",
         "owner": "CachyOS",
         "repo": "kernel-patches",
-        "rev": "a4e26fa95257ac09bd42930334399b0eabd5b5b1",
+        "rev": "b5e029226df5cc30c103651072d49a7af2878202",
         "type": "github"
       },
       "original": {
@@ -223,11 +223,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1773000227,
-        "narHash": "sha256-zm3ftUQw0MPumYi91HovoGhgyZBlM4o3Zy0LhPNwzXE=",
+        "lastModified": 1775037210,
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "da529ac9e46f25ed5616fd634079a5f3c579135f",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "lastModified": 1775176642,
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -391,11 +391,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1772408722,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
         "type": "github"
       },
       "original": {
@@ -405,6 +405,24 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
+      "locked": {
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -412,11 +430,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -545,20 +563,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -568,11 +584,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774379316,
-        "narHash": "sha256-0nGNxWDUH2Hzlj/R3Zf4FEK6fsFNB/dvewuboSRZqiI=",
+        "lastModified": 1776454077,
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1eb0549a1ab3fe3f5acf86668249be15fa0e64f7",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
         "type": "github"
       },
       "original": {
@@ -588,11 +604,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774379316,
-        "narHash": "sha256-0nGNxWDUH2Hzlj/R3Zf4FEK6fsFNB/dvewuboSRZqiI=",
+        "lastModified": 1776454077,
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1eb0549a1ab3fe3f5acf86668249be15fa0e64f7",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
         "type": "github"
       },
       "original": {
@@ -642,11 +658,11 @@
     "homebrew-cask": {
       "flake": false,
       "locked": {
-        "lastModified": 1774473207,
-        "narHash": "sha256-uzBowJgpnVUnIxItld3MUT6H9tUtKGDX6eGjFB9yFKE=",
+        "lastModified": 1776469040,
+        "narHash": "sha256-IX5UflSmiXkJnRUCNjzBl4/HMw0NMLQqsfdwA4l0kyU=",
         "owner": "homebrew",
         "repo": "homebrew-cask",
-        "rev": "672d1652fd7d9c32058f3e3f5b4d6ab2aba3853a",
+        "rev": "906ff3d493d3e9f50ceb5041fcc14bcfe3d63ff1",
         "type": "github"
       },
       "original": {
@@ -658,11 +674,11 @@
     "homebrew-core": {
       "flake": false,
       "locked": {
-        "lastModified": 1774474683,
-        "narHash": "sha256-3INbCL2xoj8j2VPSXsc6bcuc+YvlDremZg9RoEjrNcs=",
+        "lastModified": 1776461416,
+        "narHash": "sha256-AqxPJs6cy7ZwsS2ovNuLxUJM+2kgnEi4ECXitf6nb18=",
         "owner": "homebrew",
         "repo": "homebrew-core",
-        "rev": "9da10921a2cb0751d8b7970cfea4c6e92c4e8f76",
+        "rev": "2aab2c98676928d65d72ce7fc2abd5c7f3634319",
         "type": "github"
       },
       "original": {
@@ -698,11 +714,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774333446,
-        "narHash": "sha256-jeAUd4mfLle7Zw8F3lDdXvw2cmeP3FgVphHq2XuEKbs=",
+        "lastModified": 1776428236,
+        "narHash": "sha256-+0SyQglnT2xUiyY07155G+O7aUWISELwqtTnfURufRU=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "79b45622eff2ae0437d7a712610044bbc7b87fa2",
+        "rev": "eac78fc379ca47f7e21be8539c405e5fb489a857",
         "type": "github"
       },
       "original": {
@@ -733,6 +749,27 @@
         "type": "github"
       }
     },
+    "llama-cpp": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776442631,
+        "narHash": "sha256-8AXOo0Yhbi3jpQFe4Ql+0HZDz/p708GdrbZVepNjITo=",
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "rev": "45cac7ca703fb9085eae62b9121fca01d20177f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "type": "github"
+      }
+    },
     "lsfg-vk": {
       "inputs": {
         "nixpkgs": [
@@ -784,15 +821,15 @@
         "cachyos-kernel": "cachyos-kernel",
         "cachyos-kernel-patches": "cachyos-kernel-patches",
         "flake-compat": "flake-compat_4",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1774290535,
-        "narHash": "sha256-dnFbucSiAjjWmPENgyIiK/ocCuYSp4sM6Sq4WCVjG+8=",
+        "lastModified": 1776386586,
+        "narHash": "sha256-eVAUaL/6n8mnmBiPpEVW1NDNVSKLWhYVfycG+P0SvWU=",
         "owner": "xddxdd",
         "repo": "nix-cachyos-kernel",
-        "rev": "c0fcdf5cab21b7e3157e84046b57407a60934415",
+        "rev": "c65c3faf90ae07bae101c15ef502f0bcb06c5d74",
         "type": "github"
       },
       "original": {
@@ -829,11 +866,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1769437432,
-        "narHash": "sha256-8d7KnCpT2LweRvSzZYEGd9IM3eFX+A78opcnDM0+ndk=",
+        "lastModified": 1774720267,
+        "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "a5409abd0d5013d79775d3419bcac10eacb9d8c5",
+        "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
         "type": "github"
       },
       "original": {
@@ -849,11 +886,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774156144,
-        "narHash": "sha256-gdYe9wTPl4ignDyXUl1LlICWj41+S0GB5lG1fKP17+A=",
+        "lastModified": 1775970782,
+        "narHash": "sha256-7jt9Vpm48Yy5yAWigYpde+HxtYEpEuyzIQJF4VYehhk=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "55b588747fa3d7fc351a11831c4b874dab992862",
+        "rev": "bedba5989b04614fc598af9633033b95a937933f",
         "type": "github"
       },
       "original": {
@@ -906,11 +943,11 @@
         "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1774406959,
-        "narHash": "sha256-LvsvRER3uhSMPFXm3d51j1HKtNvT5uaxeU2GiGhTx2Y=",
+        "lastModified": 1776396489,
+        "narHash": "sha256-lF3GX4VvQzff/5gpu5WytHKd2GQXJDrWChmK+JNNRO4=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "8e7124f1592e7f2cc8f76ce2639255f478d58838",
+        "rev": "64839596bff67e8280a2fcd829a858d88530aa6f",
         "type": "github"
       },
       "original": {
@@ -925,11 +962,11 @@
         "nixpkgs": "nixpkgs_8"
       },
       "locked": {
-        "lastModified": 1774264319,
-        "narHash": "sha256-aAsO35YtqIdvBhCIKZ0a+OcC8wB0H1+mAoPKBY0jxeQ=",
+        "lastModified": 1776370524,
+        "narHash": "sha256-0Gt5qnjNkIZJdOBfu2u47zgyhYL3WmgUrguUhGSxUdk=",
         "owner": "nix-community",
         "repo": "nixos-apple-silicon",
-        "rev": "9fe29a63b23005acfcd1324a9e78b6241226cdb1",
+        "rev": "f9f0650b45e31b3f6c3e2a0405fa198a286e2741",
         "type": "github"
       },
       "original": {
@@ -940,11 +977,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774465523,
-        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -987,32 +1024,28 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1772328832,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
-        "type": "github"
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
       },
       "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
       }
     },
-    "nixpkgs-otbr": {
+    "nixpkgs-lib_3": {
       "locked": {
-        "lastModified": 1766776257,
-        "narHash": "sha256-MG9DnzBn6TdAztaMPVhW9sjYj2bi9Jcux0F0fJ6LeO4=",
-        "owner": "mrene",
-        "repo": "nixpkgs",
-        "rev": "0c4c97066d555b7d27a0a56ee400130ec51f02ee",
+        "lastModified": 1774748309,
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
         "type": "github"
       },
       "original": {
-        "owner": "mrene",
-        "ref": "openthread-border-router",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
         "type": "github"
       }
     },
@@ -1034,11 +1067,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1774244481,
-        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
+        "lastModified": 1776221942,
+        "narHash": "sha256-FbQAeVNi7G4v3QCSThrSAAvzQTmrmyDLiHNPvTF2qFM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
+        "rev": "1766437c5509f444c1b15331e82b8b6a9b967000",
         "type": "github"
       },
       "original": {
@@ -1050,27 +1083,27 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1774106199,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "lastModified": 1776447299,
+        "narHash": "sha256-fhkbQptSg6w3CG4TCxalK6UZkj4+Afsi+6p0PuofJ48=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "2c1b4e855f7cded41541747173c697b53c63de9b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_10": {
       "locked": {
-        "lastModified": 1773840656,
-        "narHash": "sha256-9tpvMGFteZnd3gRQZFlRCohVpqooygFuy9yjuyRL2C0=",
+        "lastModified": 1775888245,
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9cf7092bdd603554bd8b63c216e8943cf9b12512",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "github"
       },
       "original": {
@@ -1114,11 +1147,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1774235121,
-        "narHash": "sha256-CzpSER+YKq4yD+RPom6Su9c/4FutF+sD4rEnls+4MyM=",
+        "lastModified": 1776311487,
+        "narHash": "sha256-9U8bL9X/0R9cZD3Uc/mN37AWvv5dB4WQqqjLRAxQfas=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1116aed2cee959f7d054a462458513ad323b710a",
+        "rev": "cc1e0e027707ad53dddae39d3b3e992262c7d8c7",
         "type": "github"
       },
       "original": {
@@ -1194,16 +1227,16 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1774106199,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "lastModified": 1776447299,
+        "narHash": "sha256-fhkbQptSg6w3CG4TCxalK6UZkj4+Afsi+6p0PuofJ48=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "2c1b4e855f7cded41541747173c697b53c63de9b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1220,11 +1253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767810917,
-        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "lastModified": 1775228139,
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -1243,11 +1276,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772361940,
-        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
+        "lastModified": 1775856943,
+        "narHash": "sha256-b7Mp7P+q2Md5AGt4rjHfMcBykzMumFTen10ST++AuTU=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
+        "rev": "a524a6160e6df89f7673ba293cf7d78b559eb1a5",
         "type": "github"
       },
       "original": {
@@ -1288,11 +1321,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774104215,
-        "narHash": "sha256-EAtviqz0sEAxdHS4crqu7JGR5oI3BwaqG0mw7CmXkO8=",
+        "lastModified": 1775585728,
+        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "f799ae951fde0627157f40aec28dec27b22076d0",
+        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
         "type": "github"
       },
       "original": {
@@ -1364,6 +1397,7 @@
         "impermanence": "impermanence",
         "jovian": "jovian",
         "lanzaboote": "lanzaboote",
+        "llama-cpp": "llama-cpp",
         "lsfg-vk": "lsfg-vk",
         "nix-cachyos-kernel": "nix-cachyos-kernel",
         "nix-homebrew": "nix-homebrew",
@@ -1374,7 +1408,6 @@
         "nixos-apple-silicon": "nixos-apple-silicon",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_9",
-        "nixpkgs-otbr": "nixpkgs-otbr",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "plasma-manager": "plasma-manager",
@@ -1455,11 +1488,11 @@
         "nixpkgs": "nixpkgs_10"
       },
       "locked": {
-        "lastModified": 1774303811,
-        "narHash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=",
+        "lastModified": 1776119890,
+        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "614e256310e0a4f8a9ccae3fa80c11844fba7042",
+        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
         "type": "github"
       },
       "original": {
@@ -1498,25 +1531,24 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur",
         "systems": "systems_3",
-        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1774124764,
-        "narHash": "sha256-Poz9WTjiRlqZIf197CrMMJfTifZhrZpbHFv0eU1Nhtg=",
+        "lastModified": 1776170745,
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "e31c79f571c5595a155f84b9d77ce53a84745494",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
         "type": "github"
       },
       "original": {
@@ -1570,23 +1602,6 @@
         "type": "github"
       }
     },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -1606,11 +1621,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1767710407,
-        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "lastModified": 1772661346,
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -1622,11 +1637,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "lastModified": 1772934010,
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -1638,11 +1653,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "lastModified": 1772909925,
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {
@@ -1680,11 +1695,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773297127,
-        "narHash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk=",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,12 +1,8 @@
 {
   inputs = rec {
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
     nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
 
-    # Fork required: openthread-border-router is not yet in nixpkgs-unstable.
-    # Used by modules/nixos/homeassistant/services/thread/default.nix
-    nixpkgs-otbr.url = "github:mrene/nixpkgs/openthread-border-router";
-
     home-manager-unstable = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -47,7 +43,7 @@
 
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-stable";
     };
 
     disko = {
@@ -112,6 +108,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    llama-cpp = {
+      url = "github:ggml-org/llama.cpp";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     plasma-manager = {
       url = "github:nix-community/plasma-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -153,38 +154,40 @@
       # Add a module to a specific host.
       systems = {
         # common modules
-        modules.nixos = with inputs; [
-          authentik-nix.nixosModules.default
-          disko.nixosModules.disko
-          impermanence.nixosModules.impermanence
-          lanzaboote.nixosModules.lanzaboote
-          sops-nix.nixosModules.sops
-          home-manager.nixosModules.home-manager
-          nix-index-database.nixosModules.nix-index
-          stylix.nixosModules.stylix
-        ];
+        modules = {
+          nixos = with inputs; [
+            authentik-nix.nixosModules.default
+            disko.nixosModules.disko
+            impermanence.nixosModules.impermanence
+            lanzaboote.nixosModules.lanzaboote
+            sops-nix.nixosModules.sops
+            home-manager.nixosModules.home-manager
+            nix-index-database.nixosModules.nix-index
+            stylix.nixosModules.stylix
+          ];
 
-        # External HM modules injected into ALL homes — both standalone
-        # homeConfigurations and homes embedded in nixosConfigurations.
-        # The snowfall-lib fork patches create-systems to pass systems.modules.home
-        # into create-home-system-modules so both paths are covered from here.
-        # The ARM guard for steam-rom-manager is handled by that module itself.
-        modules.home = with inputs; [
-          nix-index-database.homeModules.nix-index
-          steam-rom-manager.homeManagerModules.default
-          sops-nix.homeManagerModules.sops
-          stylix.homeModules.stylix
-          plasma-manager.homeModules.plasma-manager
-        ];
+          # External HM modules injected into ALL homes — both standalone
+          # homeConfigurations and homes embedded in nixosConfigurations.
+          # The snowfall-lib fork patches create-systems to pass systems.modules.home
+          # into create-home-system-modules so both paths are covered from here.
+          # The ARM guard for steam-rom-manager is handled by that module itself.
+          home = with inputs; [
+            nix-index-database.homeModules.nix-index
+            steam-rom-manager.homeManagerModules.default
+            sops-nix.homeManagerModules.sops
+            stylix.homeModules.stylix
+            plasma-manager.homeModules.plasma-manager
+          ];
 
-        modules.darwin = with inputs; [
-          nix-homebrew.darwinModules.nix-homebrew
-          home-manager.darwinModules.home-manager
-          nix-plist-manager.darwinModules.default
-          nix-rosetta-builder.darwinModules.default
-          nix-index-database.darwinModules.nix-index
-          stylix.darwinModules.stylix
-        ];
+          darwin = with inputs; [
+            nix-homebrew.darwinModules.nix-homebrew
+            home-manager.darwinModules.home-manager
+            nix-plist-manager.darwinModules.default
+            nix-rosetta-builder.darwinModules.default
+            nix-index-database.darwinModules.nix-index
+            stylix.darwinModules.stylix
+          ];
+        };
 
         # Host config
         hosts = {
@@ -283,6 +286,10 @@
           # ...
           # "libsoup-2.74.3"
           # "mbedtls-2.28.10"
+          # ecdsa is pulled in by srp → ha-icloud3 custom component.
+          # CVE-2024-23342 applies to timing-sensitive cryptographic use cases,
+          # not the SRP authentication usage here.
+          "python3.14-ecdsa-0.19.1"
         ];
       };
 

homes/aarch64-darwin/mattjallen@macbook-pro/default.nix

@@ -18,7 +18,7 @@ let
     iproute2mac
     nebula
     nixfmt
-    nodePackages.nodejs
+    nodejs_25
     uv
     sops
     tree

homes/aarch64-linux/matt@macbook-pro-nixos/default.nix

@@ -15,9 +15,11 @@ let
 in
 {
 
-  home.username = "matt";
-  home.homeDirectory = "/home/matt";
-  home.stateVersion = "23.11";
+  home = {
+    username = "matt";
+    homeDirectory = "/home/matt";
+    stateVersion = "23.11";
+  };
 
   ${namespace} = {
     desktop.plasma = lib.mkForce enabled;
@@ -78,6 +80,7 @@ in
     };
     programs = {
       btop = enabled;
+      calibre = enabled;
       kitty = disabled;
       mako = disabled;
       nwg-dock = disabled;
@@ -85,6 +88,7 @@ in
       nwg-panel = disabled;
       opencode = enabled;
       thunderbird = enabled;
+      vesktop = enabled;
       waybar = {
         enable = false;
 
@@ -132,7 +136,7 @@ in
   sops = {
     secrets = {
       "protonmail-password" = {
-        sopsFile = (lib.snowfall.fs.get-file "secrets/mac-secrets.yaml");
+        sopsFile = lib.snowfall.fs.get-file "secrets/mac-secrets.yaml";
       };
     };
   };
@@ -145,9 +149,11 @@ in
     ]
     ++ (with pkgs; [
       bolt-launcher
+      bottles
       iw
       iwd
       orca-slicer
+      rpi-imager
       vscodium
 
     ]);

homes/x86_64-linux/admin@jallen-nas/default.nix

@@ -30,6 +30,7 @@ in
         jq
       ]
       ++ (with pkgs.${namespace}; [
+        hueforge
         moondeck-buddy
       ]);
   };
@@ -37,7 +38,7 @@ in
   ${namespace} = {
     sops.enable = true;
     programs.opencode = enabled;
-    #    desktop.plasma = enabled;
+    desktop.plasma = enabled;
   };
 
   sops.secrets = {
@@ -83,11 +84,14 @@ in
       viAlias = true;
       vimAlias = true;
       defaultEditor = true;
+      withRuby = false;
+      withPython3 = true;
       plugins = [
         pkgs.vimPlugins.nvim-tree-lua
         {
           plugin = pkgs.vimPlugins.vim-startify;
           config = "let g:startify_change_to_vcs_root = 0";
+          type = "lua";
         }
       ];
     };

homes/x86_64-linux/matt@allyx/default.nix

@@ -13,6 +13,9 @@ in
   ${namespace} = {
     desktop.gnome = enabled;
     sops.enable = true;
+    programs = {
+      vesktop = enabled;
+    };
   };
 
   sops.secrets = {
@@ -51,7 +54,7 @@ in
         ryujinx.enable = true; # Switch  (ryubing fork)
         yuzu.enable = true; # Switch  (eden fork)
         dolphin-emu.enable = true; # GameCube / Wii
-        cemu.enable = true; # Wii U
+        cemu.enable = false; # Wii U
         melonDS.enable = true; # DS
         citra.enable = true; # 3DS  (azahar fork)
         mgba.enable = true; # Game Boy / GBC

homes/x86_64-linux/matt@matt-nixos/default.nix

@@ -31,6 +31,7 @@ in
     desktop.plasma = enabled;
 
     programs = {
+      vesktop = enabled;
       opencode = enabled;
       thunderbird = enabled;
       hyprland = {
@@ -181,14 +182,13 @@ in
       piper
       prismlauncher
       protontricks
-      protonvpn-gui
       runelite
       smile
       via
       virt-manager
       vorta
       waydroid-helper
-      # winboat
+      winboat
     ]
     ++ (with pkgs.${namespace}; [
       discord-krisp

lib/default.nix

@@ -3,8 +3,9 @@
   mjallen-lib = {
     module = import ./module { inherit inputs; };
     file = import ./file { inherit inputs; };
+    inherit (inputs.nixpkgs) lib;
     versioning = import ./versioning {
-      lib = inputs.nixpkgs.lib;
+      inherit (inputs.nixpkgs) lib;
       inherit inputs;
     };
   };

lib/file/default.nix

@@ -1,7 +1,7 @@
 { inputs, ... }@args:
 let
   # Get self from args or default to ../.. (the flake root)
-  self = if args ? self then args.self else ../..;
+  self = args.self or ../..;
 
   inherit (inputs.nixpkgs.lib)
     genAttrs

lib/module/default.nix

@@ -91,8 +91,7 @@ rec {
             ];
           };
           redis.servers.${name} = lib.mkIf cfg.redis.enable {
-            enable = true;
-            port = cfg.redis.port;
+            inherit (cfg.redis) enable port;
           };
         };
       };
@@ -149,8 +148,9 @@ rec {
             reverseProxy = mkReverseProxyOpt name;
 
             hostedService = {
-              enable = mkOpt types.bool (cfg.reverseProxy.enable
-              ) "Expose this service in Glance dashboard (auto-enabled when reverseProxy is on)";
+              enable =
+                mkOpt types.bool cfg.reverseProxy.enable
+                  "Expose this service in Glance dashboard (auto-enabled when reverseProxy is on)";
               title = mkOpt types.str name "Display title in Glance";
               icon = mkOpt types.str "si:glance" "Icon identifier for Glance (e.g. si:actualbudget)";
               group = mkOpt types.str "Services" "Glance group/category for this service";
@@ -254,7 +254,7 @@ rec {
       owner ? "nix-apps",
       group ? "jallen-nas",
       mode ? "660",
-      sopsFile ? (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"),
+      sopsFile ? lib.snowfall.fs.get-file "secrets/nas-secrets.yaml",
     }:
     {
       sops.secrets = mapAttrs (_key: extra: { inherit sopsFile; } // extra) secrets;

lib/network/default.nix

@@ -18,7 +18,6 @@
 #
 # All attributes intentionally use plain strings / ints so they can be
 # interpolated with `toString` or used directly in any context.
-{ ... }:
 {
   network = {
     # -----------------------------------------------------------------------
@@ -100,6 +99,7 @@
       # ---- pi5 services --------------------------------------------------
       pi5 = {
         adguard = 3000;
+        attic = 9012;
         nebula = 4242;
         dns = 53;
       };
@@ -129,7 +129,7 @@
         headscale = 2112;
         immich = 2283;
         jellyfin = 8096;
-        jellyseerr = 5055;
+        seerr = 5055;
         kavita = 5000;
         llamaCpp = 8127;
         lubelogger = 6754;

lib/nix-settings/default.nix

@@ -8,13 +8,9 @@
 #   lib.${namespace}.nixSettings.commonSettings
 #   lib.${namespace}.nixSettings.commonGc
 { lib, ... }:
-let
-  net = lib.mjallen.network;
-in
 {
   nixSettings = {
     commonSubstituters = [
-      "http://${net.hosts.nas.lan}:${toString net.ports.nas.attic}/nas-cache"
       "https://nixos-apple-silicon.cachix.org"
       "https://nixos-raspberrypi.cachix.org"
       "https://nix-community.cachix.org"
@@ -22,7 +18,6 @@ in
     ];
 
     commonTrustedPublicKeys = [
-      "nas-cache:eK0eRVAt9QNwbkLIyOo9N5Z5+zi6ukI4mSlL196C7Yg="
       "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
       "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="

lib/versioning/default.nix

@@ -9,12 +9,9 @@ let
     hasAttr
     getAttr
     attrNames
-    toString
     replaceStrings
     ;
-
-  mapAttrs = lib.mapAttrs;
-  recursiveUpdate = lib.recursiveUpdate;
+  inherit (lib) mapAttrs recursiveUpdate;
 
   # Deep-merge attrsets (right-biased).
   deepMerge = a: b: recursiveUpdate a b;
@@ -31,8 +28,8 @@ let
   applyVariantOnce =
     selected: variant:
     let
-      vVars = if variant ? variables then variant.variables else { };
-      vSrcs = if variant ? sources then variant.sources else { };
+      vVars = variant.variables or { };
+      vSrcs = variant.sources or { };
     in
     {
       variables = selected.variables // vVars;
@@ -47,8 +44,8 @@ let
     else
       let
         p = variant.platforms.${system};
-        pVars = if p ? variables then p.variables else { };
-        pSrcs = if p ? sources then p.sources else { };
+        pVars = p.variables or { };
+        pSrcs = p.sources or { };
       in
       {
         variables = selected.variables // pVars;
@@ -93,49 +90,44 @@ let
   mkSrcFromRendered' =
     pkgs': comp:
     let
-      fetcher = if comp ? fetcher then comp.fetcher else "none";
+      fetcher = comp.fetcher or "none";
     in
     if fetcher == "github" then
       pkgs'.fetchFromGitHub (
         {
-          owner = comp.owner;
-          repo = comp.repo;
+          inherit (comp) owner repo hash;
           # Allow tag as rev (ignore null/empty tag)
           rev = if comp ? tag && comp.tag != null && comp.tag != "" then comp.tag else comp.rev;
-          fetchSubmodules = if comp ? submodules then comp.submodules else false;
-          hash = comp.hash;
+          fetchSubmodules = comp.submodules or false;
         }
-        // lib.optionalAttrs (comp ? name) { name = comp.name; }
+        // lib.optionalAttrs (comp ? name) { inherit (comp) name; }
       )
     else if fetcher == "git" then
       pkgs'.fetchgit {
-        url = comp.url;
-        rev = comp.rev;
-        fetchSubmodules = if comp ? submodules then comp.submodules else false;
-        hash = comp.hash;
+        inherit (comp) url rev hash;
+        fetchSubmodules = comp.submodules or false;
       }
     else if fetcher == "url" then
       let
-        url = if comp ? url then comp.url else comp.urlTemplate;
+        url = comp.url or comp.urlTemplate;
       in
       if useFetchZip comp then
         pkgs'.fetchzip (
           {
+            inherit (comp) hash;
             inherit url;
-            hash = comp.hash;
           }
-          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { stripRoot = comp.extra.stripRoot; }
+          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { inherit (comp.extra) stripRoot; }
         )
       else
         pkgs'.fetchurl {
+          inherit (comp) hash;
           inherit url;
-          hash = comp.hash;
         }
     else if fetcher == "pypi" then
       pkgs'.python3Packages.fetchPypi {
+        inherit (comp) version hash;
         pname = comp.name;
-        version = comp.version;
-        hash = comp.hash;
       }
     else
       # fetcher == "none": pass-through (e.g., linux version/hash consumed by custom logic)
@@ -155,14 +147,10 @@ rec {
   selectVariant =
     spec: variantName: system:
     let
-      chosen =
-        if variantName != null then
-          variantName
-        else
-          (if spec ? defaultVariant then spec.defaultVariant else null);
+      chosen = if variantName != null then variantName else (spec.defaultVariant or null);
       baseSelected = {
-        variables = if spec ? variables then spec.variables else { };
-        sources = if spec ? sources then spec.sources else { };
+        variables = spec.variables or { };
+        sources = spec.sources or { };
       };
     in
     resolveVariant spec baseSelected chosen system;

modules/darwin/home/default.nix

@@ -38,12 +38,12 @@
       };
 
       # Make ALL external HM modules available globally
+      # Note: sops-nix, nix-index-database, and stylix are already injected
+      # globally via systems.modules.home in flake.nix; only darwin-specific
+      # modules that aren't in the global list should go here.
       sharedModules = with inputs; [
-        sops-nix.homeManagerModules.sops
         nix-plist-manager.homeManagerModules.default
-        nix-index-database.homeModules.nix-index
-        stylix.homeModules.stylix
-        # Add any other external HM modules here
+        # Add any other darwin-specific external HM modules here
       ];
 
       users."mattjallen" = lib.mkAliasDefinitions options.${namespace}.home.extraOptions;

modules/darwin/nix/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {

modules/home/desktop/plasma/default.nix

@@ -25,24 +25,28 @@ in
     programs.plasma = {
       enable = true;
 
-      workspace = {
-        colorScheme = "BreezeDark";
-        cursor = {
-          theme = "breeze_cursors";
-          size = 24;
-        };
-        iconTheme = "breeze-dark";
-        theme = "breeze-dark";
-        lookAndFeel = "org.kde.breezedark.desktop";
-        # Explicitly set Breeze to prevent QT_STYLE_OVERRIDE=kvantum (set by
-        # Stylix's qt6ct target) from being picked up by KWin/plasmashell, which
-        # would cause a fatal "module kvantum is not installed" QML error and
-        # leave the desktop blank.
-        widgetStyle = "Breeze";
+      configFile.kded5rc = {
+        "Module-gtkconfig"."autoload" = false;
       };
 
-      # input.mice and input.touchpads require device-specific vendorId/productId
-      # identifiers — configure those per-host in the home config instead.
+      # workspace = {
+      #   colorScheme = "BreezeDark";
+      #   cursor = {
+      #     theme = "breeze_cursors";
+      #     size = 24;
+      #   };
+      #   iconTheme = "breeze-dark";
+      #   theme = "breeze-dark";
+      #   lookAndFeel = "org.kde.breezedark.desktop";
+      #   # Explicitly set Breeze to prevent QT_STYLE_OVERRIDE=kvantum (set by
+      #   # Stylix's qt6ct target) from being picked up by KWin/plasmashell, which
+      #   # would cause a fatal "module kvantum is not installed" QML error and
+      #   # leave the desktop blank.
+      #   widgetStyle = "Breeze";
+      # };
+
+      # # input.mice and input.touchpads require device-specific vendorId/productId
+      # # identifiers — configure those per-host in the home config instead.
 
       kscreenlocker = {
         autoLock = true;
@@ -67,20 +71,20 @@ in
         };
       };
 
-      panels = [
-        {
-          location = "bottom";
-          floating = true;
-          height = 44;
-          widgets = [
-            "org.kde.plasma.kickoff"
-            "org.kde.plasma.icontasks"
-            "org.kde.plasma.marginsseparator"
-            "org.kde.plasma.systemtray"
-            "org.kde.plasma.digitalclock"
-          ];
-        }
-      ];
+      # panels = [
+      #   {
+      #     location = "bottom";
+      #     floating = true;
+      #     height = 44;
+      #     widgets = [
+      #       "org.kde.plasma.kickoff"
+      #       "org.kde.plasma.icontasks"
+      #       "org.kde.plasma.marginsseparator"
+      #       "org.kde.plasma.systemtray"
+      #       "org.kde.plasma.digitalclock"
+      #     ];
+      #   }
+      # ];
 
       shortcuts = {
         kwin = {

modules/home/home/default.nix

@@ -44,7 +44,7 @@ in
             pciutils
             proton-pass-cli
             proton-vpn-cli
-            protonvpn-gui
+            proton-vpn
             protonup-ng
             rsync
             smartmontools
@@ -57,7 +57,7 @@ in
             wget
           ]
           ++ (
-            if (hasDestopEnvironment) then
+            if hasDestopEnvironment then
               [
                 boxbuddy
                 cider-2

modules/home/programs/calibre/default.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+{
+  imports = [
+    (lib.${namespace}.mkHomeModule {
+      inherit config;
+      domain = "programs";
+      name = "calibre";
+      moduleConfig = {
+        programs.calibre = {
+          enable = true;
+          plugins = with pkgs.${namespace}; [
+            dedrm
+          ];
+        };
+      };
+    })
+  ];
+}

modules/home/programs/code/default.nix

@@ -14,7 +14,7 @@ let
 in
 {
   home.packages = with pkgs; [
-    nodePackages.nodejs
+    nodejs_25
     uv
   ];
 

modules/home/programs/git/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 let
   gitAliases = {
     co = "checkout";

modules/home/programs/hyprland/default.nix

@@ -313,6 +313,7 @@ in
           secondMonitor = if builtins.length names > 1 then builtins.elemAt names 1 else firstMonitor;
         in
         {
+          inherit (cfg) workspace;
           "$mod" = cfg.modKey;
 
           # Mouse
@@ -513,8 +514,6 @@ in
             preserve_split = "yes";
           };
 
-          workspace = cfg.workspace;
-
           windowrule = [
             "match:title file_progress, float 1"
             "match:title .*[Cc]onfirm.*, float 1"

modules/home/programs/librewolf/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 {
   programs.librewolf = {
     enable = false;

modules/home/programs/opencode/default.nix

@@ -37,8 +37,8 @@ in
               baseURL = "http://${net.hosts.nas.lan}:${toString net.ports.nas.llamaCpp}/v1";
             };
             models = {
-              Qwen3-Coder-Next-Q4_0 = {
-                name = "Qwen3 Coder (local)";
+              "gemma-4-26B-A4B-it-UD-Q8_K_XL" = {
+                name = "Gemma 4 26B-A4B (local)";
                 modalities = {
                   input = [
                     "image"
@@ -47,8 +47,8 @@ in
                   output = [ "text" ];
                 };
                 limit = {
-                  context = 131072;
-                  output = 32768;
+                  context = 32768;
+                  output = 8192;
                 };
               };
             };

modules/home/programs/password-store/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 {
   # The default value of `programs.password-store.settings` has changed from `{ PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store"; }` to `{ }`.
   #                   You are currently using the legacy default (`{ PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store"; }`) because `home.stateVersion` is less than "25.11".

modules/home/programs/vencord/default.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.programs.vesktop;
+in
+{
+  options.${namespace}.programs.vesktop = {
+    enable = lib.mkEnableOption "vesktop";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.vesktop = {
+      enable = true;
+      settings = {
+        appBadge = false;
+        arRPC = true;
+        checkUpdates = false;
+        customTitleBar = false;
+        disableMinSize = true;
+        minimizeToTray = true;
+        tray = true;
+        splashBackground = "#000000";
+        splashColor = "#ffffff";
+        splashTheming = true;
+        staticTitle = true;
+        hardwareAcceleration = true;
+        discordBranch = "stable";
+      };
+      vencord = {
+        settings = {
+          autoUpdate = false;
+          autoUpdateNotification = false;
+          notifyAboutUpdates = false;
+          useQuickCss = true;
+          disableMinSize = true;
+          plugins = {
+            MessageLogger = {
+              enabled = false;
+              ignoreSelf = true;
+            };
+            FakeNitro.enabled = false;
+          };
+        };
+      };
+    };
+  };
+}

modules/home/programs/waybar/default.nix

@@ -294,10 +294,10 @@ in
       systemd.enable = true;
 
       settings = {
-        mainBar = (
+        mainBar =
           (mkMerge [
             {
-              layer = cfg.layer;
+              inherit (cfg) layer;
               position = "top";
               mod = "dock";
               exclusive = true;
@@ -342,7 +342,7 @@ in
               };
 
               network = {
-                interface = cfg.network.interface;
+                inherit (cfg.network) interface;
                 on-click = "nm-connection-editor";
                 format = "{icon}";
                 tooltip-format = "{ifname} via {gwaddr} 󰊗";
@@ -589,8 +589,7 @@ in
               };
             })
           ])
-          // cfg.extra.settings
-        );
+          // cfg.extra.settings;
       }
       // cfg.extraModules; # keep legacy top-level extra modules for compatibility
 

modules/home/programs/zsh/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 let
   defaultShellAliases = {
     l = "ls -alh";

modules/home/services/pass/default.nix

@@ -1,6 +1,3 @@
-{
-  ...
-}:
 {
   #services.gnome-keyring.enable = false;
   #home.packages = [ pkgs.gcr ];

modules/home/user/default.nix

@@ -35,17 +35,17 @@ in
       description = "The full name of the user.";
     };
     home = mkOption {
-      type = (types.nullOr types.str);
+      type = types.nullOr types.str;
       default = home-directory;
       description = "The user's home directory.";
     };
     icon = mkOption {
-      type = (types.nullOr types.package);
+      type = types.nullOr types.package;
       default = null;
       description = "The profile picture to use for the user. Set to a package whose output is the icon file (e.g. a derivation producing a PNG).";
     };
     name = mkOption {
-      type = (types.nullOr types.str);
+      type = types.nullOr types.str;
       default = "matt";
       description = "The user account.";
     };

modules/nixos/boot/common/default.nix

@@ -62,7 +62,7 @@ in
       bcachefs.package = lib.mkOverride 90 pkgs.${namespace}.bcachefs;
 
       consoleLogLevel = lib.mkDefault 0;
-      bootspec.enable = (!isArm);
+      bootspec.enable = !isArm;
 
       initrd = {
         verbose = lib.mkDefault false;

modules/nixos/boot/lanzaboote/default.nix

@@ -32,7 +32,7 @@ in
         };
       };
       lanzaboote = {
-        enable = cfg.enable;
+        enable = true;
         pkiBundle = "/etc/secureboot";
         settings = {
           console-mode = "max";

modules/nixos/desktop/hyprland/wallpapers/default.nix

@@ -15,11 +15,11 @@ in
   # and provide the hyprctl hot-reload command so hyprpaper picks up the new image.
   config = lib.mkIf cfg.enable {
     ${namespace}.wallpaper = {
+      inherit (cfg) defaultWallpaper;
       enable = true;
       source = cfg.wallpaperSource;
       path = cfg.wallpaper;
       dir = cfg.wallpaperDir;
-      defaultWallpaper = cfg.defaultWallpaper;
       reloadCommand = "${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper wallpaper ,${cfg.wallpaper},";
     };
   };

modules/nixos/desktop/plasma/default.nix

@@ -35,6 +35,10 @@ in
             enable = true;
             wayland.enable = cfg.wayland.enable;
           };
+
+          # Required for Bluetooth D-Bus policy (allows WirePlumber/PipeWire
+          # to communicate with bluetoothd on the system bus).
+          blueman.enable = true;
         };
 
         xdg.portal.extraPortals = [ ];

modules/nixos/hardware/amd/default.nix

@@ -16,9 +16,11 @@ in
 
     coolercontrol.enable = mkBoolOpt false "Enable CoolerControl fan/cooling control";
 
-    corectrl.enable = mkBoolOpt false "Enable CoreCtrl GPU control";
-    corectrl.enablePolkit = mkBoolOpt false "Enable CoreCtrl polkit rules";
-    corectrl.polkitGroup = mkOpt types.str "wheel" "Group allowed to use CoreCtrl without password";
+    corectrl = {
+      enable = mkBoolOpt false "Enable CoreCtrl GPU control";
+      enablePolkit = mkBoolOpt false "Enable CoreCtrl polkit rules";
+      polkitGroup = mkOpt types.str "wheel" "Group allowed to use CoreCtrl without password";
+    };
 
     lact.enable = mkBoolOpt false "Enable LACT daemon (AMD GPU control)";
   };
@@ -44,7 +46,7 @@ in
     };
 
     programs.corectrl = {
-      enable = cfg.corectrl.enable;
+      inherit (cfg.corectrl) enable;
       package = pkgs.corectrl;
     };
 

modules/nixos/hardware/nvidia/default.nix

@@ -53,7 +53,7 @@ in
 
         # Enable the Nvidia settings menu,
         # accessible via `nvidia-settings`.
-        nvidiaSettings = cfg.nvidiaSettings;
+        inherit (cfg) nvidiaSettings;
       };
     };