upd

.gitignore

@@ -6,9 +6,9 @@ result*
 .direnv
 shell.nix
 .vscode
-**/*/*.py
 .envrc
 .DS_Store
 *.qcow2
 keys
-iso-*
+iso-*
+**/*/__pycache__

README.md

@@ -71,7 +71,7 @@ A powerful AMD-based desktop with gaming capabilities, featuring:
 ### NAS
 
 A home server with various self-hosted services:
-- Media management (Jellyfin, Jellyseerr)
+- Media management (Jellyfin, seerr)
 - Download automation (Sonarr, Radarr, etc.)
 - Document management (Paperless)
 - File sharing (Samba, Nextcloud)

WORKAROUNDS.md

@@ -348,7 +348,7 @@ These are not workarounds but known incomplete configurations:
 | `systems/x86_64-linux/jallen-nas/apps.nix` | 47 | Authentik environment secrets file not wired up |
 | `modules/nixos/services/sparky-fitness/default.nix` | — | ~~DB passwords not yet moved to SOPS~~ — resolved; secrets now via `mkSopsEnvFile`; run `sops secrets/nas-secrets.yaml` to add real values for `jallen-nas/sparky-fitness/{db-password,api-encryption-key,auth-secret}` |
 | `modules/nixos/services/your-spotify/default.nix` | 36 | Spotify API keys not yet moved to SOPS |
-| `modules/nixos/services/booklore/default.nix` | 25 | Database password not yet a SOPS secret |
+| `modules/nixos/services/booklore/default.nix` | 28 | Database password not yet a SOPS secret |
 | `packages/raspberrypi/udev-rules/default.nix` | 33 | `15-i2c-modprobe.rules` disabled; `i2cprobe` script not ported |
 | `modules/nixos/homeassistant/services/homeassistant/default.nix` | 214 | `roborock` integration marked broken |
 

checks/pre-commit-hooks/default.nix

@@ -28,12 +28,13 @@ pre-commit-hooks-nix.lib.${pkgs.stdenv.hostPlatform.system}.run {
       enable = true;
       package = pkgs.nixfmt;
     };
-    statix = {
+    # statix disabled - too many false positives (manual_inherit warnings)
-      enable = true;
+    # statix = {
-      args = [
+    #   enable = true;
-        "--config"
+    #   args = [
-        (lib.snowfall.fs.get-file "statix.toml")
+    #     "--config"
-      ];
+    #     (lib.snowfall.fs.get-file "statix.toml")
-    };
+    #   ];
+    # };
   };
 }

docs/modules/README.md

@@ -140,7 +140,7 @@ mjallen.services.jellyfin = {
 
 Available services:
 
-`actual`, `ai`, `appimage`, `arrs`, `attic`, `authentik`, `authentikRac`, `booklore`, `caddy`, `calibre`, `calibre-web`, `cockpit`, `code-server`, `collabora`, `coturn`, `crowdsec`, `dispatcharr`, `free-games-claimer`, `gitea`, `glance`, `glances`, `grafana`, `guacd`, `headscale`, `immich`, `jellyfin`, `jellyseerr`, `lubelogger`, `manyfold`, `matrix`, `minecraft`, `mongodb`, `nebula`, `netbootxyz`, `nextcloud`, `ntfy`, `onlyoffice`, `opencloud`, `orca`, `paperless`, `paperless-ai`, `protonmail-bridge`, `restic`, `samba`, `sparky-fitness`, `sparky-fitness-server`, `sunshine`, `tdarr`, `termix`, `tunarr`, `unmanic`, `uptime-kuma`, `wyoming`, `your-spotify`
+`actual`, `ai`, `appimage`, `arrs`, `attic`, `authentik`, `authentikRac`, `booklore`, `caddy`, `calibre`, `calibre-web`, `cockpit`, `code-server`, `collabora`, `coturn`, `crowdsec`, `dispatcharr`, `free-games-claimer`, `gitea`, `glance`, `glances`, `grafana`, `guacd`, `headscale`, `immich`, `jellyfin`, `seerr`, `lubelogger`, `manyfold`, `matrix`, `minecraft`, `mongodb`, `nebula`, `netbootxyz`, `nextcloud`, `ntfy`, `onlyoffice`, `opencloud`, `orca`, `paperless`, `paperless-ai`, `protonmail-bridge`, `restic`, `samba`, `sparky-fitness`, `sparky-fitness-server`, `sunshine`, `tdarr`, `termix`, `tunarr`, `unmanic`, `uptime-kuma`, `wyoming`, `your-spotify`
 
 #### Nebula VPN (`services/nebula/`)
 

docs/services.md

@@ -0,0 +1,90 @@
+# Services
+
+All services are derived from `lib.mjallen.network` (`lib/network/default.nix`).
+Domain: `mjallen.dev`
+
+Services are grouped by host. The **URL** column is only present when a reverse proxy
+is configured (i.e. `reverseProxy.enable = true`) or a well-known public URL exists.
+Services without a public URL are accessible only on the LAN or internally.
+
+---
+
+## NAS (`jallen-nas` — `10.0.1.3`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| actual | No | 3333 | https://actual.mjallen.dev |
+| ai (Ollama + llama.cpp + Open-WebUI) | Yes | 8127 / 11434 / various | https://chat.mjallen.dev |
+| arrs (Sonarr + Radarr + SABnzbd) | Yes | 8989 / 7878 / 8280 | — |
+| attic | Yes | 9012 | https://cache.mjallen.dev |
+| authentik | Yes | 9000 | https://authentik.mjallen.dev |
+| authentikRac | Yes | 4823 | — |
+| caddy | Yes | 80 / 443 | — |
+| calibre | No | 8084 | https://calibre.mjallen.dev |
+| calibre-web | No | 8083 | https://calibre-web.mjallen.dev |
+| cockpit | Yes | 9091 | — |
+| code-server | Yes | 4444 | https://code.mjallen.dev |
+| collabora | Yes | 9980 | https://office.mjallen.dev |
+| coturn | Yes | 3478 | — |
+| crowdsec | Yes | 8181 | — |
+| dispatcharr | No | 9191 | https://dispatcharr.mjallen.dev |
+| free-games-claimer | No | 6080 | — |
+| gitea | Yes | 3000 / SSH 2222 | https://gitea.mjallen.dev |
+| glance | Yes | 5555 | https://glance.mjallen.dev |
+| glances | Yes | 61208 | https://glances.mjallen.dev |
+| grafana | Yes | 9999 | https://grafana.mjallen.dev |
+| grimmory | No | 6066 | https://grimmory.mjallen.dev |
+| guacd | Yes | 4822 | — |
+| headscale | No | 2112 | https://headscale.mjallen.dev |
+| immich | Yes | 2283 | https://immich.mjallen.dev |
+| jellyfin | Yes | 8096 | https://jellyfin.mjallen.dev |
+| seerr | Yes | 5055 | https://seerr.mjallen.dev |
+| kavita | Yes | 5000 | — |
+| lemonade | No | 8001 | — |
+| lubelogger | Yes | 6754 | https://lubelogger.mjallen.dev |
+| manyfold | Yes | 3214 | — |
+| matrix | Yes | 8448 | https://matrix.mjallen.dev |
+| minecraft | No | 25565 | — |
+| mongodb | No | 27017 | — |
+| nebula | Yes | 4242 | — |
+| netbootxyz | No | 4000 | https://netbootxyz.mjallen.dev |
+| nextcloud | Yes | 9988 | https://cloud.mjallen.dev |
+| ntfy | Yes | 2586 | https://ntfy.mjallen.dev |
+| ocis | No | 9200 | — |
+| onlyoffice | No | 9943 | — |
+| opencloud | No | 9200 | — |
+| orca-slicer | No | 3100 | https://orca-slicer.mjallen.dev |
+| paperless | Yes | 28981 | — |
+| paperless-ai | Yes | 28982 | — |
+| protonmail-bridge | Yes | SMTP 1025 / IMAP 1143 | — |
+| restic-server | Yes | 8008 | — |
+| sparky-fitness (frontend) | Yes | 3004 | https://sparky.mjallen.dev |
+| sparky-fitness-server (backend) | Yes | 3010 | — |
+| sunshine | Yes | 47989 | — |
+| tdarr | No | 8265 / 8266 | https://tdarr.mjallen.dev |
+| termix | Yes | 7777 | https://termix.mjallen.dev |
+| tunarr | Yes | 8000 | https://tunarr.mjallen.dev |
+| unmanic | Yes | 8265 | https://unmanic.mjallen.dev |
+| uptime-kuma | Yes | 3001 | — |
+| wyoming (Whisper + Piper) | Yes | 10300 / 10200 | — |
+
+---
+
+## NUC (`nuc-nixos` — `10.0.1.4`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| home-assistant | Yes | 8123 | https://hass.mjallen.dev |
+| esphome | Yes | 6052 | — |
+| otbr (OpenThread Border Router) | Yes | 8880 / REST 8881 | — |
+| mosquitto (MQTT) | Yes | 1883 | — |
+
+---
+
+## Pi5 (`pi5` — `10.0.1.2`)
+
+| Service | Enabled | Port | URL |
+|---------|---------|------|-----|
+| adguard | Yes | 3000 | — |
+| nebula (lighthouse) | Yes | 4242 | — |
+| dns | Yes | 53 | — |

docs/systems/jallen-nas.md

@@ -54,7 +54,7 @@
 | Attic | 9012 | Nix binary cache (`cache.mjallen.dev`) |
 | Immich | 2283 | Photo management |
 | Jellyfin | 8096 | Media server |
-| Jellyseerr | 5055 | Media request manager |
+| Seerr | 5055 | Media request manager |
 | Nextcloud | 9988 | Cloud storage |
 | Paperless | 28981 | Document management |
 | Paperless AI | 28982 | AI-assisted document tagging |

docs/version.schema.json

@@ -76,6 +76,7 @@
         "repo":  { "type": "string", "description": "GitHub repository (github fetcher)." },
         "tag":   { "type": "string", "description": "Git tag (github fetcher). Mutually exclusive with 'rev'." },
         "rev":   { "type": "string", "description": "Commit revision (github/git fetchers)." },
+        "branch": { "type": "string", "description": "Branch to track for HEAD-commit updates (github/git fetchers). Stored alongside 'rev' to record which branch the pinned commit came from. Has no effect on the Nix fetcher itself — only used by the version management tooling." },
         "submodules": { "type": "boolean", "description": "Whether to fetch submodules (github/git fetchers)." },
 
         "url": { "type": "string", "description": "Final URL (url fetcher). May be templated." },
@@ -157,6 +158,7 @@
         "repo":  { "type": "string" },
         "tag":   { "type": "string" },
         "rev":   { "type": "string" },
+        "branch": { "type": "string" },
         "submodules": { "type": "boolean" },
 
         "url":         { "type": "string" },

flake.lock

@@ -25,7 +25,7 @@
         "flake-utils": "flake-utils",
         "napalm": "napalm",
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-stable"
         ],
         "pyproject-build-systems": "pyproject-build-systems",
         "pyproject-nix": "pyproject-nix",
@@ -33,11 +33,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1774079362,
+        "lastModified": 1776085803,
-        "narHash": "sha256-HkoEWTxU5gNigcnhIa3GXukHqC5xGmgVaLICGUKlpdo=",
+        "narHash": "sha256-JvvWVbXJYSY8qOReMbAOD4lxcN2cjKV6lg/jLz8CEuY=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "1f279763d8b4a9138c01f1021f53e09bc2c54eb9",
+        "rev": "4370b561c8bafb59773ce3a518506bcf1161dbdb",
         "type": "github"
       },
       "original": {
@@ -49,16 +49,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1772567399,
+        "lastModified": 1775573258,
-        "narHash": "sha256-0Vpf1hj9C8r+rhrCgwoNazpQ+mwgjdjDhuoKCxYQFWw=",
+        "narHash": "sha256-Xq7JGI/8ppIydIuWd9KRJKUrh7UpeniwvZ4NAtXbYJ4=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "0dccbd4193c45c581e9fb7cd89df0c1487510f1f",
+        "rev": "5249546862986202b901c2afd860992ec48c6ef6",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2026.2.1",
+        "ref": "version/2026.2.2",
         "repo": "authentik",
         "type": "github"
       }
@@ -134,16 +134,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1769363988,
+        "lastModified": 1774235677,
-        "narHash": "sha256-BiGPeulrDVetXP+tjxhMcGLUROZAtZIhU5m4MqawCfM=",
+        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "d01011cac6d72032c75fd2cd9489909e95d9faf2",
+        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.0.12",
+        "ref": "5.1.1",
         "repo": "brew",
         "type": "github"
       }
@@ -151,11 +151,11 @@
     "cachyos-kernel": {
       "flake": false,
       "locked": {
-        "lastModified": 1774160598,
+        "lastModified": 1776183001,
-        "narHash": "sha256-ArPoVPHpXauFDGsz7nGBiXljj7keGcp/O4Pf4ZU4/30=",
+        "narHash": "sha256-lvLKB5dTqjO1S/YonS9ZyWemEjO6QXtN4D76rYEYy4s=",
         "owner": "CachyOS",
         "repo": "linux-cachyos",
-        "rev": "1caa0b77871d4537f0d629a2ce30edb2f6178d19",
+        "rev": "4224303b6d7a50dd1cc3ffa78864050cc9536eec",
         "type": "github"
       },
       "original": {
@@ -167,11 +167,11 @@
     "cachyos-kernel-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1774023710,
+        "lastModified": 1776355454,
-        "narHash": "sha256-Oc+4K6edCv0fdvfe6UW+OpJiXYWkXRrOH9TDMNwi+J8=",
+        "narHash": "sha256-b9Hc0sTxjEzDbphzS9yQqxVha/7bsPIs2cQQQvaG45E=",
         "owner": "CachyOS",
         "repo": "kernel-patches",
-        "rev": "a4e26fa95257ac09bd42930334399b0eabd5b5b1",
+        "rev": "b5e029226df5cc30c103651072d49a7af2878202",
         "type": "github"
       },
       "original": {
@@ -223,11 +223,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1773000227,
+        "lastModified": 1775037210,
-        "narHash": "sha256-zm3ftUQw0MPumYi91HovoGhgyZBlM4o3Zy0LhPNwzXE=",
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "da529ac9e46f25ed5616fd634079a5f3c579135f",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -260,11 +260,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1764873433,
+        "lastModified": 1775176642,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -391,11 +391,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1730504689,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
         "type": "github"
       },
       "original": {
@@ -405,6 +405,24 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
+      "locked": {
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -412,11 +430,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767609335,
+        "lastModified": 1775087534,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -545,20 +563,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -568,11 +584,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774379316,
+        "lastModified": 1776454077,
-        "narHash": "sha256-0nGNxWDUH2Hzlj/R3Zf4FEK6fsFNB/dvewuboSRZqiI=",
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1eb0549a1ab3fe3f5acf86668249be15fa0e64f7",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
         "type": "github"
       },
       "original": {
@@ -588,11 +604,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774379316,
+        "lastModified": 1776454077,
-        "narHash": "sha256-0nGNxWDUH2Hzlj/R3Zf4FEK6fsFNB/dvewuboSRZqiI=",
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1eb0549a1ab3fe3f5acf86668249be15fa0e64f7",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
         "type": "github"
       },
       "original": {
@@ -642,11 +658,11 @@
     "homebrew-cask": {
       "flake": false,
       "locked": {
-        "lastModified": 1774473207,
+        "lastModified": 1776469040,
-        "narHash": "sha256-uzBowJgpnVUnIxItld3MUT6H9tUtKGDX6eGjFB9yFKE=",
+        "narHash": "sha256-IX5UflSmiXkJnRUCNjzBl4/HMw0NMLQqsfdwA4l0kyU=",
         "owner": "homebrew",
         "repo": "homebrew-cask",
-        "rev": "672d1652fd7d9c32058f3e3f5b4d6ab2aba3853a",
+        "rev": "906ff3d493d3e9f50ceb5041fcc14bcfe3d63ff1",
         "type": "github"
       },
       "original": {
@@ -658,11 +674,11 @@
     "homebrew-core": {
       "flake": false,
       "locked": {
-        "lastModified": 1774474683,
+        "lastModified": 1776461416,
-        "narHash": "sha256-3INbCL2xoj8j2VPSXsc6bcuc+YvlDremZg9RoEjrNcs=",
+        "narHash": "sha256-AqxPJs6cy7ZwsS2ovNuLxUJM+2kgnEi4ECXitf6nb18=",
         "owner": "homebrew",
         "repo": "homebrew-core",
-        "rev": "9da10921a2cb0751d8b7970cfea4c6e92c4e8f76",
+        "rev": "2aab2c98676928d65d72ce7fc2abd5c7f3634319",
         "type": "github"
       },
       "original": {
@@ -698,11 +714,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774333446,
+        "lastModified": 1776428236,
-        "narHash": "sha256-jeAUd4mfLle7Zw8F3lDdXvw2cmeP3FgVphHq2XuEKbs=",
+        "narHash": "sha256-+0SyQglnT2xUiyY07155G+O7aUWISELwqtTnfURufRU=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "79b45622eff2ae0437d7a712610044bbc7b87fa2",
+        "rev": "eac78fc379ca47f7e21be8539c405e5fb489a857",
         "type": "github"
       },
       "original": {
@@ -733,6 +749,27 @@
         "type": "github"
       }
     },
+    "llama-cpp": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776442631,
+        "narHash": "sha256-8AXOo0Yhbi3jpQFe4Ql+0HZDz/p708GdrbZVepNjITo=",
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "rev": "45cac7ca703fb9085eae62b9121fca01d20177f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ggml-org",
+        "repo": "llama.cpp",
+        "type": "github"
+      }
+    },
     "lsfg-vk": {
       "inputs": {
         "nixpkgs": [
@@ -784,15 +821,15 @@
         "cachyos-kernel": "cachyos-kernel",
         "cachyos-kernel-patches": "cachyos-kernel-patches",
         "flake-compat": "flake-compat_4",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1774290535,
+        "lastModified": 1776386586,
-        "narHash": "sha256-dnFbucSiAjjWmPENgyIiK/ocCuYSp4sM6Sq4WCVjG+8=",
+        "narHash": "sha256-eVAUaL/6n8mnmBiPpEVW1NDNVSKLWhYVfycG+P0SvWU=",
         "owner": "xddxdd",
         "repo": "nix-cachyos-kernel",
-        "rev": "c0fcdf5cab21b7e3157e84046b57407a60934415",
+        "rev": "c65c3faf90ae07bae101c15ef502f0bcb06c5d74",
         "type": "github"
       },
       "original": {
@@ -829,11 +866,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1769437432,
+        "lastModified": 1774720267,
-        "narHash": "sha256-8d7KnCpT2LweRvSzZYEGd9IM3eFX+A78opcnDM0+ndk=",
+        "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "a5409abd0d5013d79775d3419bcac10eacb9d8c5",
+        "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
         "type": "github"
       },
       "original": {
@@ -849,11 +886,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774156144,
+        "lastModified": 1775970782,
-        "narHash": "sha256-gdYe9wTPl4ignDyXUl1LlICWj41+S0GB5lG1fKP17+A=",
+        "narHash": "sha256-7jt9Vpm48Yy5yAWigYpde+HxtYEpEuyzIQJF4VYehhk=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "55b588747fa3d7fc351a11831c4b874dab992862",
+        "rev": "bedba5989b04614fc598af9633033b95a937933f",
         "type": "github"
       },
       "original": {
@@ -906,11 +943,11 @@
         "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1774406959,
+        "lastModified": 1776396489,
-        "narHash": "sha256-LvsvRER3uhSMPFXm3d51j1HKtNvT5uaxeU2GiGhTx2Y=",
+        "narHash": "sha256-lF3GX4VvQzff/5gpu5WytHKd2GQXJDrWChmK+JNNRO4=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "8e7124f1592e7f2cc8f76ce2639255f478d58838",
+        "rev": "64839596bff67e8280a2fcd829a858d88530aa6f",
         "type": "github"
       },
       "original": {
@@ -925,11 +962,11 @@
         "nixpkgs": "nixpkgs_8"
       },
       "locked": {
-        "lastModified": 1774264319,
+        "lastModified": 1776370524,
-        "narHash": "sha256-aAsO35YtqIdvBhCIKZ0a+OcC8wB0H1+mAoPKBY0jxeQ=",
+        "narHash": "sha256-0Gt5qnjNkIZJdOBfu2u47zgyhYL3WmgUrguUhGSxUdk=",
         "owner": "nix-community",
         "repo": "nixos-apple-silicon",
-        "rev": "9fe29a63b23005acfcd1324a9e78b6241226cdb1",
+        "rev": "f9f0650b45e31b3f6c3e2a0405fa198a286e2741",
         "type": "github"
       },
       "original": {
@@ -940,11 +977,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1774465523,
+        "lastModified": 1775490113,
-        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
         "type": "github"
       },
       "original": {
@@ -987,32 +1024,28 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1772328832,
+        "lastModified": 1730504152,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
-        "owner": "nix-community",
+        "type": "tarball",
-        "repo": "nixpkgs.lib",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
-        "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "type": "tarball",
-        "repo": "nixpkgs.lib",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
-        "type": "github"
       }
     },
-    "nixpkgs-otbr": {
+    "nixpkgs-lib_3": {
       "locked": {
-        "lastModified": 1766776257,
+        "lastModified": 1774748309,
-        "narHash": "sha256-MG9DnzBn6TdAztaMPVhW9sjYj2bi9Jcux0F0fJ6LeO4=",
+        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
-        "owner": "mrene",
+        "owner": "nix-community",
-        "repo": "nixpkgs",
+        "repo": "nixpkgs.lib",
-        "rev": "0c4c97066d555b7d27a0a56ee400130ec51f02ee",
+        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
         "type": "github"
       },
       "original": {
-        "owner": "mrene",
+        "owner": "nix-community",
-        "ref": "openthread-border-router",
+        "repo": "nixpkgs.lib",
-        "repo": "nixpkgs",
         "type": "github"
       }
     },
@@ -1034,11 +1067,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1774244481,
+        "lastModified": 1776221942,
-        "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
+        "narHash": "sha256-FbQAeVNi7G4v3QCSThrSAAvzQTmrmyDLiHNPvTF2qFM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4590696c8693fea477850fe379a01544293ca4e2",
+        "rev": "1766437c5509f444c1b15331e82b8b6a9b967000",
         "type": "github"
       },
       "original": {
@@ -1050,27 +1083,27 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1774106199,
+        "lastModified": 1776447299,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "narHash": "sha256-fhkbQptSg6w3CG4TCxalK6UZkj4+Afsi+6p0PuofJ48=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "2c1b4e855f7cded41541747173c697b53c63de9b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_10": {
       "locked": {
-        "lastModified": 1773840656,
+        "lastModified": 1775888245,
-        "narHash": "sha256-9tpvMGFteZnd3gRQZFlRCohVpqooygFuy9yjuyRL2C0=",
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9cf7092bdd603554bd8b63c216e8943cf9b12512",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "github"
       },
       "original": {
@@ -1114,11 +1147,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1774235121,
+        "lastModified": 1776311487,
-        "narHash": "sha256-CzpSER+YKq4yD+RPom6Su9c/4FutF+sD4rEnls+4MyM=",
+        "narHash": "sha256-9U8bL9X/0R9cZD3Uc/mN37AWvv5dB4WQqqjLRAxQfas=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1116aed2cee959f7d054a462458513ad323b710a",
+        "rev": "cc1e0e027707ad53dddae39d3b3e992262c7d8c7",
         "type": "github"
       },
       "original": {
@@ -1194,16 +1227,16 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1774106199,
+        "lastModified": 1776447299,
-        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
+        "narHash": "sha256-fhkbQptSg6w3CG4TCxalK6UZkj4+Afsi+6p0PuofJ48=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
+        "rev": "2c1b4e855f7cded41541747173c697b53c63de9b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1220,11 +1253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767810917,
+        "lastModified": 1775228139,
-        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -1243,11 +1276,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772361940,
+        "lastModified": 1775856943,
-        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
+        "narHash": "sha256-b7Mp7P+q2Md5AGt4rjHfMcBykzMumFTen10ST++AuTU=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
+        "rev": "a524a6160e6df89f7673ba293cf7d78b559eb1a5",
         "type": "github"
       },
       "original": {
@@ -1288,11 +1321,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774104215,
+        "lastModified": 1775585728,
-        "narHash": "sha256-EAtviqz0sEAxdHS4crqu7JGR5oI3BwaqG0mw7CmXkO8=",
+        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "f799ae951fde0627157f40aec28dec27b22076d0",
+        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
         "type": "github"
       },
       "original": {
@@ -1364,6 +1397,7 @@
         "impermanence": "impermanence",
         "jovian": "jovian",
         "lanzaboote": "lanzaboote",
+        "llama-cpp": "llama-cpp",
         "lsfg-vk": "lsfg-vk",
         "nix-cachyos-kernel": "nix-cachyos-kernel",
         "nix-homebrew": "nix-homebrew",
@@ -1374,7 +1408,6 @@
         "nixos-apple-silicon": "nixos-apple-silicon",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_9",
-        "nixpkgs-otbr": "nixpkgs-otbr",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "plasma-manager": "plasma-manager",
@@ -1455,11 +1488,11 @@
         "nixpkgs": "nixpkgs_10"
       },
       "locked": {
-        "lastModified": 1774303811,
+        "lastModified": 1776119890,
-        "narHash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=",
+        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "614e256310e0a4f8a9ccae3fa80c11844fba7042",
+        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
         "type": "github"
       },
       "original": {
@@ -1498,25 +1531,24 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur",
         "systems": "systems_3",
-        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1774124764,
+        "lastModified": 1776170745,
-        "narHash": "sha256-Poz9WTjiRlqZIf197CrMMJfTifZhrZpbHFv0eU1Nhtg=",
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "e31c79f571c5595a155f84b9d77ce53a84745494",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
         "type": "github"
       },
       "original": {
@@ -1570,23 +1602,6 @@
         "type": "github"
       }
     },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -1606,11 +1621,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1767710407,
+        "lastModified": 1772661346,
-        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -1622,11 +1637,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1767489635,
+        "lastModified": 1772934010,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -1638,11 +1653,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1767488740,
+        "lastModified": 1772909925,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {
@@ -1680,11 +1695,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773297127,
+        "lastModified": 1775636079,
-        "narHash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk=",
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,12 +1,8 @@
 {
   inputs = rec {
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
     nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.11";
 
-    # Fork required: openthread-border-router is not yet in nixpkgs-unstable.
-    # Used by modules/nixos/homeassistant/services/thread/default.nix
-    nixpkgs-otbr.url = "github:mrene/nixpkgs/openthread-border-router";
-
     home-manager-unstable = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -47,7 +43,7 @@
 
     authentik-nix = {
       url = "github:nix-community/authentik-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-stable";
     };
 
     disko = {
@@ -112,6 +108,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    llama-cpp = {
+      url = "github:ggml-org/llama.cpp";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     plasma-manager = {
       url = "github:nix-community/plasma-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -134,43 +135,59 @@
       overlays = with inputs; [
         nix-vscode-extensions.overlays.default
         nix-cachyos-kernel.overlays.default
+        # writeShellApplication uses lib.toShellVar which generates unquoted
+        # variable assignments for simple strings (e.g. username=admin).
+        # shellcheck SC2209 flags this as a warning, breaking the build when
+        # the value matches a command name. Exclude SC2209 globally.
+        (_final: prev: {
+          writeShellApplication =
+            args:
+            prev.writeShellApplication (
+              args
+              // {
+                excludeShellChecks = (args.excludeShellChecks or [ ]) ++ [ "SC2209" ];
+              }
+            );
+        })
       ];
 
       # Add a module to a specific host.
       systems = {
         # common modules
-        modules.nixos = with inputs; [
+        modules = {
-          authentik-nix.nixosModules.default
+          nixos = with inputs; [
-          disko.nixosModules.disko
+            authentik-nix.nixosModules.default
-          impermanence.nixosModules.impermanence
+            disko.nixosModules.disko
-          lanzaboote.nixosModules.lanzaboote
+            impermanence.nixosModules.impermanence
-          sops-nix.nixosModules.sops
+            lanzaboote.nixosModules.lanzaboote
-          home-manager.nixosModules.home-manager
+            sops-nix.nixosModules.sops
-          nix-index-database.nixosModules.nix-index
+            home-manager.nixosModules.home-manager
-          stylix.nixosModules.stylix
+            nix-index-database.nixosModules.nix-index
-        ];
+            stylix.nixosModules.stylix
+          ];
 
-        # External HM modules injected into ALL homes — both standalone
+          # External HM modules injected into ALL homes — both standalone
-        # homeConfigurations and homes embedded in nixosConfigurations.
+          # homeConfigurations and homes embedded in nixosConfigurations.
-        # The snowfall-lib fork patches create-systems to pass systems.modules.home
+          # The snowfall-lib fork patches create-systems to pass systems.modules.home
-        # into create-home-system-modules so both paths are covered from here.
+          # into create-home-system-modules so both paths are covered from here.
-        # The ARM guard for steam-rom-manager is handled by that module itself.
+          # The ARM guard for steam-rom-manager is handled by that module itself.
-        modules.home = with inputs; [
+          home = with inputs; [
-          nix-index-database.homeModules.nix-index
+            nix-index-database.homeModules.nix-index
-          steam-rom-manager.homeManagerModules.default
+            steam-rom-manager.homeManagerModules.default
-          sops-nix.homeManagerModules.sops
+            sops-nix.homeManagerModules.sops
-          stylix.homeModules.stylix
+            stylix.homeModules.stylix
-          plasma-manager.homeModules.plasma-manager
+            plasma-manager.homeModules.plasma-manager
-        ];
+          ];
 
-        modules.darwin = with inputs; [
+          darwin = with inputs; [
-          nix-homebrew.darwinModules.nix-homebrew
+            nix-homebrew.darwinModules.nix-homebrew
-          home-manager.darwinModules.home-manager
+            home-manager.darwinModules.home-manager
-          nix-plist-manager.darwinModules.default
+            nix-plist-manager.darwinModules.default
-          nix-rosetta-builder.darwinModules.default
+            nix-rosetta-builder.darwinModules.default
-          nix-index-database.darwinModules.nix-index
+            nix-index-database.darwinModules.nix-index
-          stylix.darwinModules.stylix
+            stylix.darwinModules.stylix
-        ];
+          ];
+        };
 
         # Host config
         hosts = {
@@ -269,6 +286,10 @@
           # ...
           # "libsoup-2.74.3"
           # "mbedtls-2.28.10"
+          # ecdsa is pulled in by srp → ha-icloud3 custom component.
+          # CVE-2024-23342 applies to timing-sensitive cryptographic use cases,
+          # not the SRP authentication usage here.
+          "python3.14-ecdsa-0.19.1"
         ];
       };
 

homes/aarch64-darwin/mattjallen@macbook-pro/default.nix

@@ -18,7 +18,7 @@ let
     iproute2mac
     nebula
     nixfmt
-    nodePackages.nodejs
+    nodejs_25
     uv
     sops
     tree

homes/aarch64-linux/matt@macbook-pro-nixos/default.nix

@@ -15,9 +15,11 @@ let
 in
 {
 
-  home.username = "matt";
+  home = {
-  home.homeDirectory = "/home/matt";
+    username = "matt";
-  home.stateVersion = "23.11";
+    homeDirectory = "/home/matt";
+    stateVersion = "23.11";
+  };
 
   ${namespace} = {
     desktop.plasma = lib.mkForce enabled;
@@ -78,6 +80,7 @@ in
     };
     programs = {
       btop = enabled;
+      calibre = enabled;
       kitty = disabled;
       mako = disabled;
       nwg-dock = disabled;
@@ -85,6 +88,7 @@ in
       nwg-panel = disabled;
       opencode = enabled;
       thunderbird = enabled;
+      vesktop = enabled;
       waybar = {
         enable = false;
 
@@ -132,7 +136,7 @@ in
   sops = {
     secrets = {
       "protonmail-password" = {
-        sopsFile = (lib.snowfall.fs.get-file "secrets/mac-secrets.yaml");
+        sopsFile = lib.snowfall.fs.get-file "secrets/mac-secrets.yaml";
       };
     };
   };
@@ -145,9 +149,11 @@ in
     ]
     ++ (with pkgs; [
       bolt-launcher
+      bottles
       iw
       iwd
       orca-slicer
+      rpi-imager
       vscodium
 
     ]);

homes/x86_64-linux/admin@jallen-nas/default.nix

@@ -30,6 +30,7 @@ in
         jq
       ]
       ++ (with pkgs.${namespace}; [
+        hueforge
         moondeck-buddy
       ]);
   };
@@ -37,7 +38,7 @@ in
   ${namespace} = {
     sops.enable = true;
     programs.opencode = enabled;
-    #    desktop.plasma = enabled;
+    desktop.plasma = enabled;
   };
 
   sops.secrets = {
@@ -83,11 +84,14 @@ in
       viAlias = true;
       vimAlias = true;
       defaultEditor = true;
+      withRuby = false;
+      withPython3 = true;
       plugins = [
         pkgs.vimPlugins.nvim-tree-lua
         {
           plugin = pkgs.vimPlugins.vim-startify;
           config = "let g:startify_change_to_vcs_root = 0";
+          type = "lua";
         }
       ];
     };

homes/x86_64-linux/matt@allyx/default.nix

@@ -13,6 +13,9 @@ in
   ${namespace} = {
     desktop.gnome = enabled;
     sops.enable = true;
+    programs = {
+      vesktop = enabled;
+    };
   };
 
   sops.secrets = {
@@ -51,7 +54,7 @@ in
         ryujinx.enable = true; # Switch  (ryubing fork)
         yuzu.enable = true; # Switch  (eden fork)
         dolphin-emu.enable = true; # GameCube / Wii
-        cemu.enable = true; # Wii U
+        cemu.enable = false; # Wii U
         melonDS.enable = true; # DS
         citra.enable = true; # 3DS  (azahar fork)
         mgba.enable = true; # Game Boy / GBC

homes/x86_64-linux/matt@matt-nixos/default.nix

@@ -31,6 +31,8 @@ in
     desktop.plasma = enabled;
 
     programs = {
+      vesktop = enabled;
+      opencode = enabled;
       thunderbird = enabled;
       hyprland = {
         enable = false;
@@ -180,14 +182,13 @@ in
       piper
       prismlauncher
       protontricks
-      protonvpn-gui
       runelite
       smile
       via
       virt-manager
       vorta
       waydroid-helper
-      # winboat
+      winboat
     ]
     ++ (with pkgs.${namespace}; [
       discord-krisp

lib/default.nix

@@ -3,8 +3,9 @@
   mjallen-lib = {
     module = import ./module { inherit inputs; };
     file = import ./file { inherit inputs; };
+    inherit (inputs.nixpkgs) lib;
     versioning = import ./versioning {
-      lib = inputs.nixpkgs.lib;
+      inherit (inputs.nixpkgs) lib;
       inherit inputs;
     };
   };

lib/file/default.nix

@@ -1,7 +1,7 @@
 { inputs, ... }@args:
 let
   # Get self from args or default to ../.. (the flake root)
-  self = if args ? self then args.self else ../..;
+  self = args.self or ../..;
 
   inherit (inputs.nixpkgs.lib)
     genAttrs

lib/module/default.nix

@@ -91,8 +91,7 @@ rec {
             ];
           };
           redis.servers.${name} = lib.mkIf cfg.redis.enable {
-            enable = true;
+            inherit (cfg.redis) enable port;
-            port = cfg.redis.port;
           };
         };
       };
@@ -147,6 +146,22 @@ rec {
                 "Extra environment variables passed to the service";
 
             reverseProxy = mkReverseProxyOpt name;
+
+            hostedService = {
+              enable =
+                mkOpt types.bool cfg.reverseProxy.enable
+                  "Expose this service in Glance dashboard (auto-enabled when reverseProxy is on)";
+              title = mkOpt types.str name "Display title in Glance";
+              icon = mkOpt types.str "si:glance" "Icon identifier for Glance (e.g. si:actualbudget)";
+              group = mkOpt types.str "Services" "Glance group/category for this service";
+              url = mkOpt types.str (
+                if cfg.reverseProxy.enable then
+                  "https://${cfg.reverseProxy.subdomain}.${cfg.reverseProxy.domain}"
+                else
+                  "http://127.0.0.1:${toString cfg.port}"
+              ) "Service URL for Glance (auto-derived from reverseProxy if enabled)";
+              basicAuth = mkOpt types.bool false "Require basic auth for this service in Glance";
+            };
           }
           // options;
         };
@@ -239,7 +254,7 @@ rec {
       owner ? "nix-apps",
       group ? "jallen-nas",
       mode ? "660",
-      sopsFile ? (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"),
+      sopsFile ? lib.snowfall.fs.get-file "secrets/nas-secrets.yaml",
     }:
     {
       sops.secrets = mapAttrs (_key: extra: { inherit sopsFile; } // extra) secrets;
@@ -298,6 +313,8 @@ rec {
   # ---------------------------------------------------------------------------
   # Option creation helpers
   # ---------------------------------------------------------------------------
+  # Option creation helpers
+  # ---------------------------------------------------------------------------
 
   mkOpt =
     type: default: description:

lib/network/default.nix

@@ -0,0 +1,185 @@
+# Central network topology registry.
+#
+# Exposed as lib.<namespace>.network.*  (Snowfall Lib merges lib/ sub-directories
+# automatically, so this file is reachable as lib.mjallen.network inside any
+# NixOS module, home-manager module, or package that receives `lib`).
+#
+# Usage examples:
+#
+#   let net = lib.mjallen.network; in
+#   net.hosts.nas.lan          # "10.0.1.3"
+#   net.hosts.nas.lan4         # "10.0.1.3/24"  (CIDR notation)
+#   net.hosts.nuc.lan          # "10.0.1.4"
+#   net.hosts.pi5.nebula       # "10.1.1.1"
+#   net.subnet.lan             # "10.0.1.0/24"
+#   net.subnet.nebula          # "10.1.1.0/24"
+#   net.ports.nas.nextcloud    # 9988
+#   net.domain                 # "mjallen.dev"
+#
+# All attributes intentionally use plain strings / ints so they can be
+# interpolated with `toString` or used directly in any context.
+{
+  network = {
+    # -----------------------------------------------------------------------
+    # Global domain
+    # -----------------------------------------------------------------------
+    domain = "mjallen.dev";
+
+    # -----------------------------------------------------------------------
+    # Subnets
+    # -----------------------------------------------------------------------
+    subnet = {
+      lan = "10.0.1.0/24";
+      nebula = "10.1.1.0/24";
+      # Docker / container bridge used by Home Assistant
+      docker = "172.30.33.0/24";
+    };
+
+    # -----------------------------------------------------------------------
+    # Hosts
+    # Each host exposes:
+    #   lan    — bare IPv4 address (no prefix length)
+    #   lan4   — IPv4 address with /24 CIDR suffix  (for static IP config)
+    #   nebula — Nebula overlay IP (where applicable)
+    # -----------------------------------------------------------------------
+    hosts = {
+      # ---- Raspberry Pi 5 (pi5) — DNS / Nebula lighthouse ----------------
+      pi5 = {
+        hostname = "pi5";
+        lan = "10.0.1.2";
+        lan4 = "10.0.1.2/24";
+        nebula = "10.1.1.1";
+        gateway = "10.0.1.1";
+      };
+
+      # ---- NAS (jallen-nas) — primary server -----------------------------
+      nas = {
+        hostname = "jallen-nas";
+        lan = "10.0.1.3";
+        lan4 = "10.0.1.3/24";
+        nebula = "10.1.1.3";
+        gateway = "10.0.1.1";
+      };
+
+      # ---- Intel NUC (nuc-nixos) — Home Assistant host -------------------
+      nuc = {
+        hostname = "nuc-nixos";
+        lan = "10.0.1.4";
+        lan4 = "10.0.1.4/24";
+        nebula = "10.1.1.4";
+        gateway = "10.0.1.1";
+      };
+
+      # ---- MacBook Pro (macbook-pro-nixos) — Apple Silicon laptop --------
+      macbook = {
+        hostname = "macbook-pro-nixos";
+        nebula = "10.1.1.8";
+      };
+
+      # ---- ASUS ROG Ally X (allyx) ----------------------------------------
+      allyx = {
+        hostname = "allyx";
+        nebula = "10.1.1.10";
+      };
+
+      # ---- Router / gateway / AdGuard upstream ---------------------------
+      router = {
+        hostname = "router";
+        lan = "10.0.1.1";
+        lan4 = "10.0.1.1/24";
+      };
+    };
+
+    # -----------------------------------------------------------------------
+    # Service ports
+    # Grouped by host.  Every entry matches the port set in apps.nix / the
+    # corresponding mkModule option so there is a single source of truth.
+    # -----------------------------------------------------------------------
+    ports = {
+      # ---- pi5 services --------------------------------------------------
+      pi5 = {
+        adguard = 3000;
+        attic = 9012;
+        nebula = 4242;
+        dns = 53;
+      };
+
+      # ---- NAS services --------------------------------------------------
+      nas = {
+        actual = 3333;
+        attic = 9012;
+        authentik = 9000;
+        authentikRac = 4823;
+        calibre = 8084;
+        calibreWeb = 8083;
+        codeServer = 4444;
+        cockpit = 9091;
+        collabora = 9980;
+        coturn = 3478;
+        crowdsec = 8181;
+        dispatcharr = 9191;
+        elasticsearch = 9200;
+        gitea = 3000;
+        giteaSsh = 2222;
+        glance = 5555;
+        glances = 61208;
+        grafana = 9999;
+        grimmory = 6066;
+        guacd = 4822;
+        headscale = 2112;
+        immich = 2283;
+        jellyfin = 8096;
+        seerr = 5055;
+        kavita = 5000;
+        llamaCpp = 8127;
+        lubelogger = 6754;
+        manyfold = 3214;
+        mariadb = 3306;
+        matrix = 8448;
+        mongodb = 27017;
+        nebula = 4242;
+        netbootxyz = 4000;
+        netbootxyzWeb = 4080;
+        nextcloud = 9988;
+        ntfy = 2586;
+        nutUpsd = 3493;
+        ocis = 9200;
+        onlyoffice = 9943;
+        opencloud = 9200;
+        orcaSlicer = 3100;
+        paperless = 28981;
+        paperlessAi = 28982;
+        postgresql = 5432;
+        protonmailSmtp = 1025;
+        protonmailImap = 1143;
+        redisCcache = 6363;
+        redisManyfold = 6380;
+        redisOnlyoffice = 6381;
+        resticServer = 8008;
+        sabnzbd = 8280;
+        sonarr = 8989;
+        radarr = 7878;
+        sparkyFitnessFe = 3004;
+        sparkyFitnessBe = 3010;
+        sunshine = 47989;
+        tdarr = 8265;
+        tdarrServer = 8266;
+        termix = 7777;
+        tunarr = 8000;
+        unmanic = 8265;
+        uptimeKuma = 3001;
+        wyomingPiper = 10200;
+        wyomingWhisper = 10300;
+      };
+
+      # ---- NUC services --------------------------------------------------
+      nuc = {
+        homeAssistant = 8123;
+        mqtt = 1883;
+        otbr = 8880;
+        otbrRest = 8881;
+        esphome = 6052;
+      };
+    };
+  };
+}

lib/nix-settings/default.nix

@@ -11,7 +11,6 @@
 {
   nixSettings = {
     commonSubstituters = [
-      "http://10.0.1.3:9012/nas-cache"
       "https://nixos-apple-silicon.cachix.org"
       "https://nixos-raspberrypi.cachix.org"
       "https://nix-community.cachix.org"
@@ -19,7 +18,6 @@
     ];
 
     commonTrustedPublicKeys = [
-      "nas-cache:eK0eRVAt9QNwbkLIyOo9N5Z5+zi6ukI4mSlL196C7Yg="
       "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
       "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="

lib/versioning/default.nix

@@ -9,12 +9,9 @@ let
     hasAttr
     getAttr
     attrNames
-    toString
     replaceStrings
     ;
-
+  inherit (lib) mapAttrs recursiveUpdate;
-  mapAttrs = lib.mapAttrs;
-  recursiveUpdate = lib.recursiveUpdate;
 
   # Deep-merge attrsets (right-biased).
   deepMerge = a: b: recursiveUpdate a b;
@@ -31,8 +28,8 @@ let
   applyVariantOnce =
     selected: variant:
     let
-      vVars = if variant ? variables then variant.variables else { };
+      vVars = variant.variables or { };
-      vSrcs = if variant ? sources then variant.sources else { };
+      vSrcs = variant.sources or { };
     in
     {
       variables = selected.variables // vVars;
@@ -47,8 +44,8 @@ let
     else
       let
         p = variant.platforms.${system};
-        pVars = if p ? variables then p.variables else { };
+        pVars = p.variables or { };
-        pSrcs = if p ? sources then p.sources else { };
+        pSrcs = p.sources or { };
       in
       {
         variables = selected.variables // pVars;
@@ -93,49 +90,44 @@ let
   mkSrcFromRendered' =
     pkgs': comp:
     let
-      fetcher = if comp ? fetcher then comp.fetcher else "none";
+      fetcher = comp.fetcher or "none";
     in
     if fetcher == "github" then
       pkgs'.fetchFromGitHub (
         {
-          owner = comp.owner;
+          inherit (comp) owner repo hash;
-          repo = comp.repo;
           # Allow tag as rev (ignore null/empty tag)
           rev = if comp ? tag && comp.tag != null && comp.tag != "" then comp.tag else comp.rev;
-          fetchSubmodules = if comp ? submodules then comp.submodules else false;
+          fetchSubmodules = comp.submodules or false;
-          hash = comp.hash;
         }
-        // lib.optionalAttrs (comp ? name) { name = comp.name; }
+        // lib.optionalAttrs (comp ? name) { inherit (comp) name; }
       )
     else if fetcher == "git" then
       pkgs'.fetchgit {
-        url = comp.url;
+        inherit (comp) url rev hash;
-        rev = comp.rev;
+        fetchSubmodules = comp.submodules or false;
-        fetchSubmodules = if comp ? submodules then comp.submodules else false;
-        hash = comp.hash;
       }
     else if fetcher == "url" then
       let
-        url = if comp ? url then comp.url else comp.urlTemplate;
+        url = comp.url or comp.urlTemplate;
       in
       if useFetchZip comp then
         pkgs'.fetchzip (
           {
+            inherit (comp) hash;
             inherit url;
-            hash = comp.hash;
           }
-          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { stripRoot = comp.extra.stripRoot; }
+          // lib.optionalAttrs (comp ? extra && comp.extra ? stripRoot) { inherit (comp.extra) stripRoot; }
         )
       else
         pkgs'.fetchurl {
+          inherit (comp) hash;
           inherit url;
-          hash = comp.hash;
         }
     else if fetcher == "pypi" then
       pkgs'.python3Packages.fetchPypi {
+        inherit (comp) version hash;
         pname = comp.name;
-        version = comp.version;
-        hash = comp.hash;
       }
     else
       # fetcher == "none": pass-through (e.g., linux version/hash consumed by custom logic)
@@ -155,14 +147,10 @@ rec {
   selectVariant =
     spec: variantName: system:
     let
-      chosen =
+      chosen = if variantName != null then variantName else (spec.defaultVariant or null);
-        if variantName != null then
-          variantName
-        else
-          (if spec ? defaultVariant then spec.defaultVariant else null);
       baseSelected = {
-        variables = if spec ? variables then spec.variables else { };
+        variables = spec.variables or { };
-        sources = if spec ? sources then spec.sources else { };
+        sources = spec.sources or { };
       };
     in
     resolveVariant spec baseSelected chosen system;

modules/darwin/home/default.nix

@@ -38,12 +38,12 @@
       };
 
       # Make ALL external HM modules available globally
+      # Note: sops-nix, nix-index-database, and stylix are already injected
+      # globally via systems.modules.home in flake.nix; only darwin-specific
+      # modules that aren't in the global list should go here.
       sharedModules = with inputs; [
-        sops-nix.homeManagerModules.sops
         nix-plist-manager.homeManagerModules.default
-        nix-index-database.homeModules.nix-index
+        # Add any other darwin-specific external HM modules here
-        stylix.homeModules.stylix
-        # Add any other external HM modules here
       ];
 
       users."mattjallen" = lib.mkAliasDefinitions options.${namespace}.home.extraOptions;

modules/darwin/nix/default.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  nixSettings = lib.${namespace}.nixSettings;
+  inherit (lib.${namespace}) nixSettings;
 in
 {
   nix = {

modules/home/desktop/plasma/default.nix

@@ -25,6 +25,10 @@ in
     programs.plasma = {
       enable = true;
 
+      configFile.kded5rc = {
+        "Module-gtkconfig"."autoload" = false;
+      };
+
       # workspace = {
       #   colorScheme = "BreezeDark";
       #   cursor = {
@@ -41,8 +45,8 @@ in
       #   widgetStyle = "Breeze";
       # };
 
-      # input.mice and input.touchpads require device-specific vendorId/productId
+      # # input.mice and input.touchpads require device-specific vendorId/productId
-      # identifiers — configure those per-host in the home config instead.
+      # # identifiers — configure those per-host in the home config instead.
 
       kscreenlocker = {
         autoLock = true;
@@ -67,20 +71,20 @@ in
         };
       };
 
-      panels = [
+      # panels = [
-        {
+      #   {
-          location = "bottom";
+      #     location = "bottom";
-          floating = true;
+      #     floating = true;
-          height = 44;
+      #     height = 44;
-          widgets = [
+      #     widgets = [
-            "org.kde.plasma.kickoff"
+      #       "org.kde.plasma.kickoff"
-            "org.kde.plasma.icontasks"
+      #       "org.kde.plasma.icontasks"
-            "org.kde.plasma.marginsseparator"
+      #       "org.kde.plasma.marginsseparator"
-            "org.kde.plasma.systemtray"
+      #       "org.kde.plasma.systemtray"
-            "org.kde.plasma.digitalclock"
+      #       "org.kde.plasma.digitalclock"
-          ];
+      #     ];
-        }
+      #   }
-      ];
+      # ];
 
       shortcuts = {
         kwin = {

modules/home/home/default.nix

@@ -4,10 +4,12 @@
   pkgs,
   namespace,
   hasDestopEnvironment ? true,
+  system,
   ...
 }:
 let
   inherit (lib.${namespace}) enabled;
+  isArm = ("aarch64-linux" == system) || ("aarch64-darwin" == system);
   # Non-login / system accounts (root, nixos installer, etc.) should not get
   # desktop packages, tmux, nh, kdeconnect, nextcloud-client, etc.
   # Detect them by username so individual host home files are not needed.
@@ -40,10 +42,9 @@ in
             nix-prefetch-scripts
             nixfmt
             pciutils
-            proton-pass
             proton-pass-cli
             proton-vpn-cli
-            protonvpn-gui
+            proton-vpn
             protonup-ng
             rsync
             smartmontools
@@ -56,9 +57,10 @@ in
             wget
           ]
           ++ (
-            if (hasDestopEnvironment) then
+            if hasDestopEnvironment then
               [
                 boxbuddy
+                cider-2
                 stable.chromium
                 firefox
                 gamescope
@@ -68,6 +70,14 @@ in
                 parted
                 vesktop
               ]
+              ++ (
+                if isArm then
+                  [ ]
+                else
+                  [
+                    proton-pass
+                  ]
+              )
             else
               [ ]
           )

modules/home/programs/calibre/default.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
+{
+  imports = [
+    (lib.${namespace}.mkHomeModule {
+      inherit config;
+      domain = "programs";
+      name = "calibre";
+      moduleConfig = {
+        programs.calibre = {
+          enable = true;
+          plugins = with pkgs.${namespace}; [
+            dedrm
+          ];
+        };
+      };
+    })
+  ];
+}

modules/home/programs/code/default.nix

@@ -14,7 +14,7 @@ let
 in
 {
   home.packages = with pkgs; [
-    nodePackages.nodejs
+    nodejs_25
     uv
   ];
 

modules/home/programs/git/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 let
   gitAliases = {
     co = "checkout";

modules/home/programs/hyprland/default.nix

@@ -313,6 +313,7 @@ in
           secondMonitor = if builtins.length names > 1 then builtins.elemAt names 1 else firstMonitor;
         in
         {
+          inherit (cfg) workspace;
           "$mod" = cfg.modKey;
 
           # Mouse
@@ -513,8 +514,6 @@ in
             preserve_split = "yes";
           };
 
-          workspace = cfg.workspace;
-
           windowrule = [
             "match:title file_progress, float 1"
             "match:title .*[Cc]onfirm.*, float 1"

modules/home/programs/librewolf/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 {
   programs.librewolf = {
     enable = false;

modules/home/programs/opencode/default.nix

@@ -7,6 +7,7 @@
 }:
 let
   cfg = config.${namespace}.programs.opencode;
+  net = lib.${namespace}.network;
 in
 {
   options.${namespace}.programs.opencode = {
@@ -19,7 +20,7 @@ in
     sops.templates."hass-mcp.env" = {
       mode = "0600";
       content = ''
-        HA_URL=http://nuc-nixos.local:8123
+        HA_URL=http://${net.hosts.nuc.lan}:${toString net.ports.nuc.homeAssistant}
         HA_TOKEN=${config.sops.placeholder."hass-mcp/token"}
       '';
     };
@@ -33,11 +34,11 @@ in
             npm = "@ai-sdk/openai-compatible";
             name = "llama-server (local)";
             options = {
-              baseURL = "http://10.0.1.3:8127/v1";
+              baseURL = "http://${net.hosts.nas.lan}:${toString net.ports.nas.llamaCpp}/v1";
             };
             models = {
-              Qwen3-Coder-Next-Q4_0 = {
+              "gemma-4-26B-A4B-it-UD-Q8_K_XL" = {
-                name = "Qwen3 Coder (local)";
+                name = "Gemma 4 26B-A4B (local)";
                 modalities = {
                   input = [
                     "image"
@@ -46,8 +47,8 @@ in
                   output = [ "text" ];
                 };
                 limit = {
-                  context = 131072;
+                  context = 32768;
-                  output = 32768;
+                  output = 8192;
                 };
               };
             };

modules/home/programs/password-store/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 {
   # The default value of `programs.password-store.settings` has changed from `{ PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store"; }` to `{ }`.
   #                   You are currently using the legacy default (`{ PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store"; }`) because `home.stateVersion` is less than "25.11".

modules/home/programs/vencord/default.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+let
+  cfg = config.${namespace}.programs.vesktop;
+in
+{
+  options.${namespace}.programs.vesktop = {
+    enable = lib.mkEnableOption "vesktop";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.vesktop = {
+      enable = true;
+      settings = {
+        appBadge = false;
+        arRPC = true;
+        checkUpdates = false;
+        customTitleBar = false;
+        disableMinSize = true;
+        minimizeToTray = true;
+        tray = true;
+        splashBackground = "#000000";
+        splashColor = "#ffffff";
+        splashTheming = true;
+        staticTitle = true;
+        hardwareAcceleration = true;
+        discordBranch = "stable";
+      };
+      vencord = {
+        settings = {
+          autoUpdate = false;
+          autoUpdateNotification = false;
+          notifyAboutUpdates = false;
+          useQuickCss = true;
+          disableMinSize = true;
+          plugins = {
+            MessageLogger = {
+              enabled = false;
+              ignoreSelf = true;
+            };
+            FakeNitro.enabled = false;
+          };
+        };
+      };
+    };
+  };
+}

modules/home/programs/waybar/default.nix

@@ -294,10 +294,10 @@ in
       systemd.enable = true;
 
       settings = {
-        mainBar = (
+        mainBar =
           (mkMerge [
             {
-              layer = cfg.layer;
+              inherit (cfg) layer;
               position = "top";
               mod = "dock";
               exclusive = true;
@@ -342,7 +342,7 @@ in
               };
 
               network = {
-                interface = cfg.network.interface;
+                inherit (cfg.network) interface;
                 on-click = "nm-connection-editor";
                 format = "{icon}";
                 tooltip-format = "{ifname} via {gwaddr} 󰊗";
@@ -589,8 +589,7 @@ in
               };
             })
           ])
-          // cfg.extra.settings
+          // cfg.extra.settings;
-        );
       }
       // cfg.extraModules; # keep legacy top-level extra modules for compatibility
 

modules/home/programs/zsh/default.nix

@@ -1,4 +1,3 @@
-{ ... }:
 let
   defaultShellAliases = {
     l = "ls -alh";

modules/home/services/pass/default.nix

@@ -1,6 +1,3 @@
-{
-  ...
-}:
 {
   #services.gnome-keyring.enable = false;
   #home.packages = [ pkgs.gcr ];

modules/home/shell-aliases/default.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.${namespace}.shell-aliases;
+  net = lib.${namespace}.network;
 in
 {
   options.${namespace}.shell-aliases = {
@@ -13,7 +14,7 @@ in
 
     buildHost = lib.mkOption {
       type = lib.types.str;
-      default = "admin@10.0.1.3";
+      default = "admin@${net.hosts.nas.lan}";
       description = "Build host for nixos-rebuild commands";
     };
 
@@ -50,8 +51,8 @@ in
       ) "nix flake update ${lib.concatStringsSep " " cfg.flakeInputs} --flake /etc/nixos";
 
       # NAS management
-      update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
+      update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@${net.hosts.nas.lan} --build-host admin@${net.hosts.nas.lan} --flake ~/nix-config#jallen-nas";
-      nas-ssh = "kitten ssh admin@10.0.1.3";
+      nas-ssh = "kitten ssh admin@${net.hosts.nas.lan}";
     }
     // cfg.extraAliases;
   };

modules/home/stylix/default.nix

@@ -77,8 +77,8 @@ in
         enable = false;
         useWallpaper = false;
       };
-      kde.enable = true;
+      kde.enable = false;
-      qt.enable = true;
+      qt.enable = false;
       firefox = {
         enable = false;
         profileNames = [

modules/home/user/default.nix

@@ -35,17 +35,17 @@ in
       description = "The full name of the user.";
     };
     home = mkOption {
-      type = (types.nullOr types.str);
+      type = types.nullOr types.str;
       default = home-directory;
       description = "The user's home directory.";
     };
     icon = mkOption {
-      type = (types.nullOr types.package);
+      type = types.nullOr types.package;
       default = null;
       description = "The profile picture to use for the user. Set to a package whose output is the icon file (e.g. a derivation producing a PNG).";
     };
     name = mkOption {
-      type = (types.nullOr types.str);
+      type = types.nullOr types.str;
       default = "matt";
       description = "The user account.";
     };

modules/nixos/boot/common/default.nix

@@ -62,7 +62,7 @@ in
       bcachefs.package = lib.mkOverride 90 pkgs.${namespace}.bcachefs;
 
       consoleLogLevel = lib.mkDefault 0;
-      bootspec.enable = (!isArm);
+      bootspec.enable = !isArm;
 
       initrd = {
         verbose = lib.mkDefault false;

modules/nixos/boot/lanzaboote/default.nix

@@ -32,7 +32,7 @@ in
         };
       };
       lanzaboote = {
-        enable = cfg.enable;
+        enable = true;
         pkiBundle = "/etc/secureboot";
         settings = {
           console-mode = "max";

modules/nixos/desktop/hyprland/wallpapers/default.nix

@@ -15,11 +15,11 @@ in
   # and provide the hyprctl hot-reload command so hyprpaper picks up the new image.
   config = lib.mkIf cfg.enable {
     ${namespace}.wallpaper = {
+      inherit (cfg) defaultWallpaper;
       enable = true;
       source = cfg.wallpaperSource;
       path = cfg.wallpaper;
       dir = cfg.wallpaperDir;
-      defaultWallpaper = cfg.defaultWallpaper;
       reloadCommand = "${lib.getExe' pkgs.hyprland "hyprctl"} hyprpaper wallpaper ,${cfg.wallpaper},";
     };
   };

modules/nixos/desktop/plasma/default.nix

@@ -35,6 +35,10 @@ in
             enable = true;
             wayland.enable = cfg.wayland.enable;
           };
+
+          # Required for Bluetooth D-Bus policy (allows WirePlumber/PipeWire
+          # to communicate with bluetoothd on the system bus).
+          blueman.enable = true;
         };
 
         xdg.portal.extraPortals = [ ];

modules/nixos/gaming/default.nix

@@ -92,7 +92,7 @@ in
     # Hardware configs
     hardware = {
       # Xbox controllers
-      xpadneo.enable = false;
+      xone.enable = true;
 
       # Steam udev rules for remote play
       steam-hardware.enable = true;

modules/nixos/hardware/amd/default.nix

@@ -16,9 +16,11 @@ in
 
     coolercontrol.enable = mkBoolOpt false "Enable CoolerControl fan/cooling control";
 
-    corectrl.enable = mkBoolOpt false "Enable CoreCtrl GPU control";
+    corectrl = {
-    corectrl.enablePolkit = mkBoolOpt false "Enable CoreCtrl polkit rules";
+      enable = mkBoolOpt false "Enable CoreCtrl GPU control";
-    corectrl.polkitGroup = mkOpt types.str "wheel" "Group allowed to use CoreCtrl without password";
+      enablePolkit = mkBoolOpt false "Enable CoreCtrl polkit rules";
+      polkitGroup = mkOpt types.str "wheel" "Group allowed to use CoreCtrl without password";
+    };
 
     lact.enable = mkBoolOpt false "Enable LACT daemon (AMD GPU control)";
   };
@@ -44,7 +46,7 @@ in
     };
 
     programs.corectrl = {
-      enable = cfg.corectrl.enable;
+      inherit (cfg.corectrl) enable;
       package = pkgs.corectrl;
     };