From 2ed60a227e7066e54201647d36b58ed8d6ffb75b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:49:19 +0000
Subject: [PATCH 01/82] modules: add common

This should define modules that are identical, or very similar.

The driving force is to be able to use `my.profiles` on home-manager and NixOS
without repeating myself.

In the future I might migrate other modules, such as `nixos/system/nix`...
---
 modules/common/default.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 modules/common/default.nix

diff --git a/modules/common/default.nix b/modules/common/default.nix
new file mode 100644
index 0000000..c170939
--- /dev/null
+++ b/modules/common/default.nix
@@ -0,0 +1,24 @@
+# Modules that are common to various module systems
+# Usually with very small differences, if any, between them.
+{ lib, _class, ... }:
+let
+  allowedClass = [
+    "darwin"
+    "homeManager"
+    "nixos"
+  ];
+
+  allowedClassString = lib.concatStringSep ", " (builtins.map lib.escapeNixString allowedClass);
+in
+{
+  config = {
+    assertions = [
+      {
+        assertion = builtins.elem _class allowedClass;
+        message = ''
+          `_class` specialArgs must be one of ${allowedClassString}.
+        '';
+      }
+    ];
+  };
+}

From 748e55f1a60583e4ac41e67d4b9007ce429b3b9c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:50:05 +0000
Subject: [PATCH 02/82] nixos: home: import common modules

---
 modules/nixos/home/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/home/default.nix b/modules/nixos/home/default.nix
index fe00704..fb120f2 100644
--- a/modules/nixos/home/default.nix
+++ b/modules/nixos/home/default.nix
@@ -13,8 +13,13 @@ in
 
   config = lib.mkIf cfg.enable {
     home-manager = {
-      # Not a fan of out-of-directory imports, but this is a good exception
-      users.${config.my.user.name} = import "${inputs.self}/modules/home";
+      users.${config.my.user.name} = {
+        # Not a fan of out-of-directory imports, but this is a good exception
+        imports = [
+          "${inputs.self}/modules/common"
+          "${inputs.self}/modules/home"
+        ];
+      };
 
       # Nix Flakes compatibility
       useGlobalPkgs = true;

From 5d706dd2dce548e66d49b88fe452075978b6df38 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:50:16 +0000
Subject: [PATCH 03/82] flake: home-manager: import common modules

---
 flake/home-manager.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 88a74e8..69cd484 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -19,6 +19,8 @@ let
       # Enable home-manager
       programs.home-manager.enable = true;
     }
+    # Import common modules
+    "${self}/modules/common"
   ];
 
   mkHome = name: system: inputs.home-manager.lib.homeManagerConfiguration {

From 27a486bf5c4b5b66a52752a6339fdc6c7d631527 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:50:22 +0000
Subject: [PATCH 04/82] flake: nixos: import common modules

---
 flake/nixos.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/flake/nixos.nix b/flake/nixos.nix
index 0fbd3a6..4777967 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -12,6 +12,8 @@ let
     }
     # Include generic settings
     "${self}/modules/nixos"
+    # Import common modules
+    "${self}/modules/common"
   ];
 
   buildHost = name: system: lib.nixosSystem {

From 033b0e8a5767e780ce56a672e514214567bddbeb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:51:34 +0000
Subject: [PATCH 05/82] common: add profiles

I will be migrating each sub-module one by one.
---
 modules/common/default.nix          | 4 ++++
 modules/common/profiles/default.nix | 7 +++++++
 2 files changed, 11 insertions(+)
 create mode 100644 modules/common/profiles/default.nix

diff --git a/modules/common/default.nix b/modules/common/default.nix
index c170939..fff2cf5 100644
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -11,6 +11,10 @@ let
   allowedClassString = lib.concatStringSep ", " (builtins.map lib.escapeNixString allowedClass);
 in
 {
+  imports = [
+    ./profiles
+  ];
+
   config = {
     assertions = [
       {
diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
new file mode 100644
index 0000000..bb0f12b
--- /dev/null
+++ b/modules/common/profiles/default.nix
@@ -0,0 +1,7 @@
+# Configuration that spans across system and home, or are almagations of modules
+{ ... }:
+{
+  imports = [
+    # FIXME: empty
+  ];
+}

From e01c8330d68eeaa6d3975e4e050278a74ba112de Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:51:34 +0000
Subject: [PATCH 06/82] common: profiles: migrate bluetooth

---
 modules/common/profiles/bluetooth/default.nix | 19 +++++++++++++++++++
 modules/common/profiles/default.nix           |  2 +-
 modules/nixos/profiles/bluetooth/default.nix  | 15 ---------------
 modules/nixos/profiles/default.nix            |  1 -
 4 files changed, 20 insertions(+), 17 deletions(-)
 create mode 100644 modules/common/profiles/bluetooth/default.nix
 delete mode 100644 modules/nixos/profiles/bluetooth/default.nix

diff --git a/modules/common/profiles/bluetooth/default.nix b/modules/common/profiles/bluetooth/default.nix
new file mode 100644
index 0000000..e687a4c
--- /dev/null
+++ b/modules/common/profiles/bluetooth/default.nix
@@ -0,0 +1,19 @@
+{ config, lib, _class, ... }:
+let
+  cfg = config.my.profiles.bluetooth;
+in
+{
+  options.my.profiles.bluetooth = with lib; {
+    enable = mkEnableOption "bluetooth profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (_class == "homeManager") {
+      my.home.bluetooth.enable = true;
+    })
+
+    (lib.optionalAttrs (_class == "nixos") {
+      my.hardware.bluetooth.enable = true;
+    })
+  ]);
+}
diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index bb0f12b..4d050e0 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -2,6 +2,6 @@
 { ... }:
 {
   imports = [
-    # FIXME: empty
+    ./bluetooth
   ];
 }
diff --git a/modules/nixos/profiles/bluetooth/default.nix b/modules/nixos/profiles/bluetooth/default.nix
deleted file mode 100644
index 292d0d1..0000000
--- a/modules/nixos/profiles/bluetooth/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.bluetooth;
-in
-{
-  options.my.profiles.bluetooth = with lib; {
-    enable = mkEnableOption "bluetooth profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.hardware.bluetooth.enable = true;
-
-    my.home.bluetooth.enable = true;
-  };
-}
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
index dbd4be3..112decd 100644
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@@ -2,7 +2,6 @@
 { ... }:
 {
   imports = [
-    ./bluetooth
     ./devices
     ./gtk
     ./laptop

From 9ee0cb3287f70048e0722729b24b6652ddb11c5a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:03:09 +0000
Subject: [PATCH 07/82] common: profiles: migrate devices

---
 modules/common/profiles/default.nix         |  1 +
 modules/common/profiles/devices/default.nix | 22 +++++++++++++++++++++
 modules/nixos/profiles/default.nix          |  1 -
 modules/nixos/profiles/devices/default.nix  | 20 -------------------
 4 files changed, 23 insertions(+), 21 deletions(-)
 create mode 100644 modules/common/profiles/devices/default.nix
 delete mode 100644 modules/nixos/profiles/devices/default.nix

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index 4d050e0..b47897b 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -3,5 +3,6 @@
 {
   imports = [
     ./bluetooth
+    ./devices
   ];
 }
diff --git a/modules/common/profiles/devices/default.nix b/modules/common/profiles/devices/default.nix
new file mode 100644
index 0000000..224004a
--- /dev/null
+++ b/modules/common/profiles/devices/default.nix
@@ -0,0 +1,22 @@
+{ config, lib, _class, ... }:
+let
+  cfg = config.my.profiles.devices;
+in
+{
+  options.my.profiles.devices = with lib; {
+    enable = mkEnableOption "devices profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (_class == "nixos") {
+      my.hardware = {
+        ergodox.enable = true;
+
+        trackball.enable = true;
+      };
+
+      # MTP devices auto-mount via file explorers
+      services.gvfs.enable = true;
+    })
+  ]);
+}
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
index 112decd..fc3a7f5 100644
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@@ -2,7 +2,6 @@
 { ... }:
 {
   imports = [
-    ./devices
     ./gtk
     ./laptop
     ./wm
diff --git a/modules/nixos/profiles/devices/default.nix b/modules/nixos/profiles/devices/default.nix
deleted file mode 100644
index 7a84bd2..0000000
--- a/modules/nixos/profiles/devices/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.devices;
-in
-{
-  options.my.profiles.devices = with lib; {
-    enable = mkEnableOption "devices profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.hardware = {
-      ergodox.enable = true;
-
-      trackball.enable = true;
-    };
-
-    # MTP devices auto-mount via file explorers
-    services.gvfs.enable = true;
-  };
-}

From a68c26c6ef90be871ecc46dfa16ea507c10d554d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:03:47 +0000
Subject: [PATCH 08/82] common: profiles: migrate gtk

---
 modules/common/profiles/default.nix     |  1 +
 modules/common/profiles/gtk/default.nix | 21 +++++++++++++++++++++
 modules/nixos/profiles/default.nix      |  1 -
 modules/nixos/profiles/gtk/default.nix  | 17 -----------------
 4 files changed, 22 insertions(+), 18 deletions(-)
 create mode 100644 modules/common/profiles/gtk/default.nix
 delete mode 100644 modules/nixos/profiles/gtk/default.nix

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index b47897b..2c8e7e1 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -4,5 +4,6 @@
   imports = [
     ./bluetooth
     ./devices
+    ./gtk
   ];
 }
diff --git a/modules/common/profiles/gtk/default.nix b/modules/common/profiles/gtk/default.nix
new file mode 100644
index 0000000..3d2a05f
--- /dev/null
+++ b/modules/common/profiles/gtk/default.nix
@@ -0,0 +1,21 @@
+{ config, lib, _class, ... }:
+let
+  cfg = config.my.profiles.gtk;
+in
+{
+  options.my.profiles.gtk = with lib; {
+    enable = mkEnableOption "gtk profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (_class == "homeManager") {
+      # GTK theme configuration
+      my.home.gtk.enable = true;
+    })
+
+    (lib.optionalAttrs (_class == "nixos") {
+      # Allow setting GTK configuration using home-manager
+      programs.dconf.enable = true;
+    })
+  ]);
+}
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
index fc3a7f5..c6c74a0 100644
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@@ -2,7 +2,6 @@
 { ... }:
 {
   imports = [
-    ./gtk
     ./laptop
     ./wm
     ./x
diff --git a/modules/nixos/profiles/gtk/default.nix b/modules/nixos/profiles/gtk/default.nix
deleted file mode 100644
index a8d6d9a..0000000
--- a/modules/nixos/profiles/gtk/default.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.gtk;
-in
-{
-  options.my.profiles.gtk = with lib; {
-    enable = mkEnableOption "gtk profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Allow setting GTK configuration using home-manager
-    programs.dconf.enable = true;
-
-    # GTK theme configuration
-    my.home.gtk.enable = true;
-  };
-}

From b1be9f20d9b0f2b5fafe16027549a203b6ea551d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:05:16 +0000
Subject: [PATCH 09/82] common: profiles: migrate laptop

---
 modules/common/profiles/default.nix        |  1 +
 modules/common/profiles/laptop/default.nix | 27 ++++++++++++++++++++++
 modules/nixos/profiles/default.nix         |  1 -
 modules/nixos/profiles/laptop/default.nix  | 23 ------------------
 4 files changed, 28 insertions(+), 24 deletions(-)
 create mode 100644 modules/common/profiles/laptop/default.nix
 delete mode 100644 modules/nixos/profiles/laptop/default.nix

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index 2c8e7e1..dafab3b 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -5,5 +5,6 @@
     ./bluetooth
     ./devices
     ./gtk
+    ./laptop
   ];
 }
diff --git a/modules/common/profiles/laptop/default.nix b/modules/common/profiles/laptop/default.nix
new file mode 100644
index 0000000..afced27
--- /dev/null
+++ b/modules/common/profiles/laptop/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, _class, ... }:
+let
+  cfg = config.my.profiles.laptop;
+in
+{
+  options.my.profiles.laptop = with lib; {
+    enable = mkEnableOption "laptop profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (_class == "homeManager") {
+      # Enable battery notifications
+      my.home.power-alert.enable = true;
+    })
+
+    (lib.optionalAttrs (_class == "nixos") {
+      # Enable touchpad support
+      services.libinput.enable = true;
+
+      # Enable TLP power management
+      my.services.tlp.enable = true;
+
+      # Enable upower power management
+      my.hardware.upower.enable = true;
+    })
+  ]);
+}
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
index c6c74a0..fc12361 100644
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@@ -2,7 +2,6 @@
 { ... }:
 {
   imports = [
-    ./laptop
     ./wm
     ./x
   ];
diff --git a/modules/nixos/profiles/laptop/default.nix b/modules/nixos/profiles/laptop/default.nix
deleted file mode 100644
index 68c65b8..0000000
--- a/modules/nixos/profiles/laptop/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.laptop;
-in
-{
-  options.my.profiles.laptop = with lib; {
-    enable = mkEnableOption "laptop profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Enable touchpad support
-    services.libinput.enable = true;
-
-    # Enable TLP power management
-    my.services.tlp.enable = true;
-
-    # Enable upower power management
-    my.hardware.upower.enable = true;
-
-    # Enable battery notifications
-    my.home.power-alert.enable = true;
-  };
-}

From 75f1776916f1877ffb3d3caa0c5e0d2a46a91f7d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:05:37 +0000
Subject: [PATCH 10/82] common: profiles: migrate wm

---
 modules/common/profiles/default.nix    |  1 +
 modules/common/profiles/wm/default.nix | 38 ++++++++++++++++++++++++++
 modules/nixos/profiles/default.nix     |  1 -
 modules/nixos/profiles/wm/default.nix  | 31 ---------------------
 4 files changed, 39 insertions(+), 32 deletions(-)
 create mode 100644 modules/common/profiles/wm/default.nix
 delete mode 100644 modules/nixos/profiles/wm/default.nix

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index dafab3b..2f12fb8 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -6,5 +6,6 @@
     ./devices
     ./gtk
     ./laptop
+    ./wm
   ];
 }
diff --git a/modules/common/profiles/wm/default.nix b/modules/common/profiles/wm/default.nix
new file mode 100644
index 0000000..6fb80b3
--- /dev/null
+++ b/modules/common/profiles/wm/default.nix
@@ -0,0 +1,38 @@
+{ config, lib, _class, ... }:
+let
+  cfg = config.my.profiles.wm;
+
+  applyWm = wm: configs: lib.mkIf (cfg.windowManager == wm) (lib.my.merge configs);
+in
+{
+  options.my.profiles.wm = with lib; {
+    windowManager = mkOption {
+      type = with types; nullOr (enum [ "i3" ]);
+      default = null;
+      example = "i3";
+      description = "Which window manager to use";
+    };
+  };
+
+  config = lib.mkMerge [
+    (applyWm "i3" [
+      (lib.optionalAttrs (_class == "homeManager") {
+        # i3 settings
+        my.home.wm.windowManager = "i3";
+        # Screenshot tool
+        my.home.flameshot.enable = true;
+        # Auto disk mounter
+        my.home.udiskie.enable = true;
+      })
+
+      (lib.optionalAttrs (_class == "nixos") {
+        # Enable i3
+        services.xserver.windowManager.i3.enable = true;
+        # udiskie fails if it can't find this dbus service
+        services.udisks2.enable = true;
+        # Ensure i3lock can actually unlock the session
+        security.pam.services.i3lock.enable = true;
+      })
+    ])
+  ];
+}
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
index fc12361..aec95b1 100644
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@@ -2,7 +2,6 @@
 { ... }:
 {
   imports = [
-    ./wm
     ./x
   ];
 }
diff --git a/modules/nixos/profiles/wm/default.nix b/modules/nixos/profiles/wm/default.nix
deleted file mode 100644
index bca4d70..0000000
--- a/modules/nixos/profiles/wm/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.wm;
-in
-{
-  options.my.profiles.wm = with lib; {
-    windowManager = mkOption {
-      type = with types; nullOr (enum [ "i3" ]);
-      default = null;
-      example = "i3";
-      description = "Which window manager to use";
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf (cfg.windowManager == "i3") {
-      # Enable i3
-      services.xserver.windowManager.i3.enable = true;
-      # i3 settings
-      my.home.wm.windowManager = "i3";
-      # Screenshot tool
-      my.home.flameshot.enable = true;
-      # Auto disk mounter
-      my.home.udiskie.enable = true;
-      # udiskie fails if it can't find this dbus service
-      services.udisks2.enable = true;
-      # Ensure i3lock can actually unlock the session
-      security.pam.services.i3lock.enable = true;
-    })
-  ];
-}

From 2a6696bafcb80a55dc614e01bc5884492c67e79b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:05:54 +0000
Subject: [PATCH 11/82] common: profiles: migrate X

---
 modules/common/profiles/default.nix   |  1 +
 modules/common/profiles/x/default.nix | 27 +++++++++++++++++++++++++++
 modules/nixos/default.nix             |  1 -
 modules/nixos/profiles/default.nix    |  7 -------
 modules/nixos/profiles/x/default.nix  | 23 -----------------------
 5 files changed, 28 insertions(+), 31 deletions(-)
 create mode 100644 modules/common/profiles/x/default.nix
 delete mode 100644 modules/nixos/profiles/default.nix
 delete mode 100644 modules/nixos/profiles/x/default.nix

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index 2f12fb8..dbd4be3 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -7,5 +7,6 @@
     ./gtk
     ./laptop
     ./wm
+    ./x
   ];
 }
diff --git a/modules/common/profiles/x/default.nix b/modules/common/profiles/x/default.nix
new file mode 100644
index 0000000..d70b1e6
--- /dev/null
+++ b/modules/common/profiles/x/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, _class, ... }:
+let
+  cfg = config.my.profiles.x;
+in
+{
+  options.my.profiles.x = with lib; {
+    enable = mkEnableOption "X profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (_class == "homeManager") {
+      # X configuration
+      my.home.x.enable = true;
+    })
+
+    (lib.optionalAttrs (_class == "nixos") {
+      # Enable the X11 windowing system.
+      services.xserver.enable = true;
+      # Nice wallpaper
+      services.xserver.displayManager.lightdm.background =
+        let
+          wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
+        in
+        "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
+    })
+  ]);
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 3648631..2eaa2e6 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -5,7 +5,6 @@
   imports = [
     ./hardware
     ./home
-    ./profiles
     ./programs
     ./secrets
     ./services
diff --git a/modules/nixos/profiles/default.nix b/modules/nixos/profiles/default.nix
deleted file mode 100644
index aec95b1..0000000
--- a/modules/nixos/profiles/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-# Configuration that spans across system and home, or are almagations of modules
-{ ... }:
-{
-  imports = [
-    ./x
-  ];
-}
diff --git a/modules/nixos/profiles/x/default.nix b/modules/nixos/profiles/x/default.nix
deleted file mode 100644
index ea77939..0000000
--- a/modules/nixos/profiles/x/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.my.profiles.x;
-in
-{
-  options.my.profiles.x = with lib; {
-    enable = mkEnableOption "X profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Enable the X11 windowing system.
-    services.xserver.enable = true;
-    # Nice wallpaper
-    services.xserver.displayManager.lightdm.background =
-      let
-        wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
-      in
-      "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
-
-    # X configuration
-    my.home.x.enable = true;
-  };
-}

From d181f3a71903c5bb5a8b0f89c3fe84023492e76e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 16:51:34 +0000
Subject: [PATCH 12/82] common: profiles: forward profiles to home-manager

We can only do this now that every profile has been migrated, otherwise
we would get errors about undeclared modules... It's not perfect, but
it's good enough.
---
 modules/common/profiles/default.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/modules/common/profiles/default.nix b/modules/common/profiles/default.nix
index dbd4be3..8ce5a3c 100644
--- a/modules/common/profiles/default.nix
+++ b/modules/common/profiles/default.nix
@@ -1,5 +1,5 @@
 # Configuration that spans across system and home, or are almagations of modules
-{ ... }:
+{ config, lib, _class, ... }:
 {
   imports = [
     ./bluetooth
@@ -9,4 +9,17 @@
     ./wm
     ./x
   ];
+
+  config = lib.mkMerge [
+    # Transparently enable home-manager profiles as well
+    (lib.optionalAttrs (_class != "homeManager") {
+      home-manager.users.${config.my.user.name} = {
+        config = {
+          my = {
+            inherit (config.my) profiles;
+          };
+        };
+      };
+    })
+  ];
 }

From 7ac78ca260a0d81ff51cc6f8f7cdc810243f1a42 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 3 Jan 2024 17:55:14 +0000
Subject: [PATCH 13/82] hosts: nixos: porthos: add profiles

---
 hosts/nixos/porthos/default.nix  | 1 +
 hosts/nixos/porthos/profiles.nix | 4 ++++
 2 files changed, 5 insertions(+)
 create mode 100644 hosts/nixos/porthos/profiles.nix

diff --git a/hosts/nixos/porthos/default.nix b/hosts/nixos/porthos/default.nix
index bd1bdb1..e69bccf 100644
--- a/hosts/nixos/porthos/default.nix
+++ b/hosts/nixos/porthos/default.nix
@@ -7,6 +7,7 @@
     ./hardware.nix
     ./home.nix
     ./networking.nix
+    ./profiles.nix
     ./secrets
     ./services.nix
     ./system.nix
diff --git a/hosts/nixos/porthos/profiles.nix b/hosts/nixos/porthos/profiles.nix
new file mode 100644
index 0000000..3ec736c
--- /dev/null
+++ b/hosts/nixos/porthos/profiles.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  # Nothing
+}

From 1c86c85c56e3fccde64a58b841fdc7132cca8492 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Dec 2023 21:31:46 +0000
Subject: [PATCH 14/82] flake: add hosts

This will allow other modules to cross-reference which hosts exist on
which system.

My main use-case is to automatically declare home-manager configuration
for the home configuration of NixOS hosts.

I also include Darwin in case I ever want to use that in the future,
though that is unlikely for the moment.
---
 flake/default.nix |  1 +
 flake/hosts.nix   | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 flake/hosts.nix

diff --git a/flake/default.nix b/flake/default.nix
index 5e52025..6f1d4ac 100644
--- a/flake/default.nix
+++ b/flake/default.nix
@@ -13,6 +13,7 @@ flake-parts.lib.mkFlake { inherit inputs; } {
     ./checks.nix
     ./dev-shells.nix
     ./home-manager.nix
+    ./hosts.nix
     ./lib.nix
     ./nixos.nix
     ./overlays.nix
diff --git a/flake/hosts.nix b/flake/hosts.nix
new file mode 100644
index 0000000..7d95fdc
--- /dev/null
+++ b/flake/hosts.nix
@@ -0,0 +1,21 @@
+# Define `hosts.{darwin,home,nixos}` options for consumption in other modules
+{ lib, ... }:
+let
+  mkHostsOption = description: lib.mkOption {
+    inherit description;
+    type = with lib.types; attrsOf str;
+    default = { };
+    example = { name = "x86_64-linux"; };
+  };
+in
+{
+  options = {
+    hosts = {
+      darwin = mkHostsOption "Darwin hosts";
+
+      homes = mkHostsOption "Home Manager hosts";
+
+      nixos = mkHostsOption "NixOS hosts";
+    };
+  };
+}

From 9e35764e0c270ae9e6826ea6c700d1d10efb5d40 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Dec 2023 21:33:10 +0000
Subject: [PATCH 15/82] flake: nixos: use 'hosts' option

---
 flake/nixos.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/flake/nixos.nix b/flake/nixos.nix
index 4777967..9a6d5bc 100644
--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@@ -1,4 +1,4 @@
-{ self, inputs, lib, ... }:
+{ self, config, inputs, lib, ... }:
 let
   defaultModules = [
     {
@@ -32,8 +32,12 @@ let
   };
 in
 {
-  flake.nixosConfigurations = lib.mapAttrs buildHost {
-    aramis = "x86_64-linux";
-    porthos = "x86_64-linux";
+  config = {
+    hosts.nixos = {
+      aramis = "x86_64-linux";
+      porthos = "x86_64-linux";
+    };
+
+    flake.nixosConfigurations = lib.mapAttrs buildHost config.hosts.nixos;
   };
 }

From 87ba726b18e277feabb81218f778c22fe8b184a7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Dec 2023 21:41:05 +0000
Subject: [PATCH 16/82] flake: home-manager: use 'hosts' option

---
 flake/home-manager.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 69cd484..4a42757 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -1,5 +1,7 @@
-{ self, inputs, lib, ... }:
+{ self, config, inputs, lib, ... }:
 let
+  inherit (config) hosts;
+
   defaultModules = [
     # Include generic settings
     "${self}/modules/home"
@@ -39,18 +41,19 @@ let
     };
   };
 
-  homes = {
+in
+{
+  hosts.homes = {
     "ambroisie@bazin" = "x86_64-linux";
     "ambroisie@mousqueton" = "x86_64-linux";
   };
-in
-{
+
   perSystem = { system, ... }: {
     # Work-around for https://github.com/nix-community/home-manager/issues/3075
     legacyPackages = {
       homeConfigurations =
         let
-          filteredHomes = lib.filterAttrs (_: v: v == system) homes;
+          filteredHomes = lib.filterAttrs (_: v: v == system) hosts.homes;
           allHomes = filteredHomes // {
             # Default configuration
             ambroisie = system;

From 31effae175c4558e38633639e5ca119416f0fdf5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Dec 2023 21:44:01 +0000
Subject: [PATCH 17/82] flake: home-manager: refactor 'mkHome'

This will allow making a similar function for NixOS homes.
---
 flake/home-manager.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 4a42757..25dab9b 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -25,12 +25,10 @@ let
     "${self}/modules/common"
   ];
 
-  mkHome = name: system: inputs.home-manager.lib.homeManagerConfiguration {
+  mkHomeCommon = mainModules: system: inputs.home-manager.lib.homeManagerConfiguration {
     pkgs = inputs.nixpkgs.legacyPackages.${system};
 
-    modules = defaultModules ++ [
-      "${self}/hosts/homes/${name}"
-    ];
+    modules = defaultModules ++ mainModules;
 
     # Use my extended lib in NixOS configuration
     inherit (self) lib;
@@ -41,6 +39,7 @@ let
     };
   };
 
+  mkHome = name: mkHomeCommon [ "${self}/hosts/homes/${name}" ];
 in
 {
   hosts.homes = {

From 2c0062bf51e0a55622944cab8169e4edd7d6d497 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 7 Dec 2023 21:56:25 +0000
Subject: [PATCH 18/82] flake: home-manager: export NixOS homes

And here is what the last few commits were building up to.

This is neat, but won't be useful *very* often.
---
 flake/home-manager.nix | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/flake/home-manager.nix b/flake/home-manager.nix
index 25dab9b..d4d14fc 100644
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@@ -40,6 +40,11 @@ let
   };
 
   mkHome = name: mkHomeCommon [ "${self}/hosts/homes/${name}" ];
+
+  mkNixosHome = name: mkHomeCommon [
+    "${self}/hosts/nixos/${name}/home.nix"
+    "${self}/hosts/nixos/${name}/profiles.nix"
+  ];
 in
 {
   hosts.homes = {
@@ -57,8 +62,18 @@ in
             # Default configuration
             ambroisie = system;
           };
+          homeManagerHomes = lib.mapAttrs mkHome allHomes;
+
+          filteredNixosHosts = lib.filterAttrs (_: v: v == system) hosts.nixos;
+          nixosHomes' = lib.mapAttrs mkNixosHome filteredNixosHosts;
+          nixosHomeUsername = (host: self.nixosConfigurations.${host}.config.my.user.name);
+          nixosHomes = lib.mapAttrs' (host: lib.nameValuePair "${nixosHomeUsername host}@${host}") nixosHomes';
         in
-        lib.mapAttrs mkHome allHomes;
+        lib.foldl' lib.mergeAttrs { }
+          [
+            homeManagerHomes
+            nixosHomes
+          ];
     };
   };
 }

From 8d809e3ac3c05eb9ca6de3279fee2a8c72cdd293 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:40:08 +0000
Subject: [PATCH 19/82] flake: bump inputs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a4da84d..dc32e95 100644
--- a/flake.lock
+++ b/flake.lock
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751271578,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "lastModified": 1751952840,
+        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
         "type": "github"
       },
       "original": {

From b093faf00d8066e19d144c34533a32602a4fb8f7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 8 Jul 2025 10:42:13 +0000
Subject: [PATCH 20/82] nixos: services: tandoor-recipes: use automatic DB

---
 .../services/tandoor-recipes/default.nix      | 25 +++----------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 169eec8..4b4ed1a 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -26,18 +26,16 @@ in
     services.tandoor-recipes = {
       enable = true;
 
+      database = {
+        createLocally = true;
+      };
+
       port = cfg.port;
       extraConfig =
         let
           tandoorRecipesDomain = "recipes.${config.networking.domain}";
         in
         {
-          # Use PostgreSQL
-          DB_ENGINE = "django.db.backends.postgresql";
-          POSTGRES_HOST = "/run/postgresql";
-          POSTGRES_USER = "tandoor_recipes";
-          POSTGRES_DB = "tandoor_recipes";
-
           # Security settings
           ALLOWED_HOSTS = tandoorRecipesDomain;
           CSRF_TRUSTED_ORIGINS = "https://${tandoorRecipesDomain}";
@@ -49,27 +47,12 @@ in
 
     systemd.services = {
       tandoor-recipes = {
-        after = [ "postgresql.target" ];
-        requires = [ "postgresql.target" ];
-
         serviceConfig = {
           EnvironmentFile = cfg.secretKeyFile;
         };
       };
     };
 
-    # Set-up database
-    services.postgresql = {
-      enable = true;
-      ensureDatabases = [ "tandoor_recipes" ];
-      ensureUsers = [
-        {
-          name = "tandoor_recipes";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
     my.services.nginx.virtualHosts = {
       recipes = {
         inherit (cfg) port;

From 2473bca1671ddaab0ce6de70d5471bf304133af6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 11 Jul 2025 14:24:23 +0000
Subject: [PATCH 21/82] home: vim: telescope: remove LSP handlers

The plug-in was broken with the update to 0.11, and I would like to try
using the built-in quickfixlist-based handlers for a while.

This reverts commit 8d4a1e61b4f26f7443f7c8b0b65643f0bd312e9f.
---
 modules/home/vim/default.nix                   | 1 -
 modules/home/vim/plugin/settings/telescope.lua | 1 -
 2 files changed, 2 deletions(-)

diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index 20a74ff..930a853 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -80,7 +80,6 @@ in
       nvim-surround # Deal with pairs, now in Lua
       oil-nvim # Better alternative to NetrW
       telescope-fzf-native-nvim # Use 'fzf' fuzzy matching algorithm
-      telescope-lsp-handlers-nvim # Use 'telescope' for various LSP actions
       telescope-nvim # Fuzzy finder interface
       which-key-nvim # Show available mappings
     ];
diff --git a/modules/home/vim/plugin/settings/telescope.lua b/modules/home/vim/plugin/settings/telescope.lua
index 1a23928..810d51c 100644
--- a/modules/home/vim/plugin/settings/telescope.lua
+++ b/modules/home/vim/plugin/settings/telescope.lua
@@ -23,7 +23,6 @@ telescope.setup({
 })
 
 telescope.load_extension("fzf")
-telescope.load_extension("lsp_handlers")
 
 local keys = {
     { "<leader>f", group = "Fuzzy finder" },

From 979ae901c4057308ce1da3bbf2388e2addd99d7f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:52:21 +0000
Subject: [PATCH 22/82] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index dc32e95..0f205ab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751429452,
-        "narHash": "sha256-4s5vRtaqdNhVBnbOWOzBNKrRa0ShQTLoEPjJp3joeNI=",
+        "lastModified": 1752467539,
+        "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "df12269039dcf752600b1bcc176bacf2786ec384",
+        "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751952840,
-        "narHash": "sha256-SIkjQb9PPGvR/EcZAU8UZEnO9dwY2Z/BrDWgtyZd7OA=",
+        "lastModified": 1752644555,
+        "narHash": "sha256-oeRcp4VEyZ/3ZgfRRoq60/08l2zy0K53l8MdfSIYd24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "27278798fe68d7f81131dd7ab62b8ea2b795cd56",
+        "rev": "9100a4f6bf446603b9575927c8585162f9ec9aa6",
         "type": "github"
       },
       "original": {

From 13b61346f5cca39d1ba2c66717e14a6d01b99acc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 15 Jul 2025 09:54:23 +0000
Subject: [PATCH 23/82] home: tmux: increase history scrollback

Even *longer*.
---
 modules/home/tmux/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 82ceb3a..3ea047a 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -48,7 +48,7 @@ in
     keyMode = "vi"; # Home-row keys and other niceties
     clock24 = true; # I'm one of those heathens
     escapeTime = 0; # Let vim do its thing instead
-    historyLimit = 100000; # Bigger buffer
+    historyLimit = 1000000; # Bigger buffer
     mouse = false; # I dislike mouse support
     focusEvents = true; # Report focus events
     terminal = "tmux-256color"; # I want accurate termcap info

From add796768567599e9d6b2a54c80baac84d7681b5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 27 Jul 2025 20:49:24 +0100
Subject: [PATCH 24/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0f205ab..e96a7a0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "lastModified": 1753121425,
+        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752467539,
-        "narHash": "sha256-4kaR+xmng9YPASckfvIgl5flF/1nAZOplM+Wp9I5SMI=",
+        "lastModified": 1753617834,
+        "narHash": "sha256-WEVfKrdIdu5CpppJ0Va3vzP0DKlS+ZTLbBjugMO2Drg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1e54837569e0b80797c47be4720fab19e0db1616",
+        "rev": "72cc1e3134a35005006f06640724319caa424737",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752644555,
-        "narHash": "sha256-oeRcp4VEyZ/3ZgfRRoq60/08l2zy0K53l8MdfSIYd24=",
+        "lastModified": 1753429684,
+        "narHash": "sha256-9h7+4/53cSfQ/uA3pSvCaBepmZaz/dLlLVJnbQ+SJjk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9100a4f6bf446603b9575927c8585162f9ec9aa6",
+        "rev": "7fd36ee82c0275fb545775cc5e4d30542899511d",
         "type": "github"
       },
       "original": {

From 2a515754a2c8bb87fe756d9862d3bb04c6be2bbb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 27 Jul 2025 20:48:06 +0100
Subject: [PATCH 25/82] home: zsh: use absolute path to 'XDG_CONFIG_HOME'

The path handling has been fixed upstream, which makes this module more
readable.
---
 modules/home/zsh/default.nix | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index f4092d8..08b4101 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -1,14 +1,6 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.zsh;
-
-  # Have a nice relative path for XDG_CONFIG_HOME, without leading `/`
-  relativeXdgConfig =
-    let
-      noHome = lib.removePrefix config.home.homeDirectory;
-      noSlash = lib.removePrefix "/";
-    in
-    noSlash (noHome config.xdg.configHome);
 in
 {
   options.my.home.zsh = with lib; {
@@ -57,7 +49,7 @@ in
 
       programs.zsh = {
         enable = true;
-        dotDir = "${relativeXdgConfig}/zsh"; # Don't clutter $HOME
+        dotDir = "${config.xdg.configHome}/zsh"; # Don't clutter $HOME
         enableCompletion = true;
 
         history = {

From 4b7c6c1f5eb7cbd7254a8f69050b17c9d4723837 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 29 Jul 2025 16:13:58 +0000
Subject: [PATCH 26/82] pkgs: comma: fix 'nix-locate' invocation

---
 pkgs/comma/comma | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/comma/comma b/pkgs/comma/comma
index 4367a26..857b9c9 100755
--- a/pkgs/comma/comma
+++ b/pkgs/comma/comma
@@ -12,7 +12,7 @@ usage() {
 
 find_program() {
     local CANDIDATE
-    CANDIDATE="$(nix-locate --top-level --minimal --at-root --whole-name "/bin/$1")"
+    CANDIDATE="$(nix-locate --minimal --at-root --whole-name "/bin/$1")"
     if [ "$(printf '%s\n' "$CANDIDATE" | wc -l)" -gt 1 ]; then
         CANDIDATE="$(printf '%s' "$CANDIDATE" | fzf-tmux)"
     fi

From 7786c591b5f1e5745eb73b3a60ebe5e0704669a9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 4 Aug 2025 11:13:52 +0000
Subject: [PATCH 27/82] pkgs: comma: add 'COMMA_PICKER'

---
 pkgs/comma/comma | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/comma/comma b/pkgs/comma/comma
index 857b9c9..b03a7f2 100755
--- a/pkgs/comma/comma
+++ b/pkgs/comma/comma
@@ -14,7 +14,7 @@ find_program() {
     local CANDIDATE
     CANDIDATE="$(nix-locate --minimal --at-root --whole-name "/bin/$1")"
     if [ "$(printf '%s\n' "$CANDIDATE" | wc -l)" -gt 1 ]; then
-        CANDIDATE="$(printf '%s' "$CANDIDATE" | fzf-tmux)"
+        CANDIDATE="$(printf '%s' "$CANDIDATE" | "${COMMA_PICKER:-fzf-tmux}")"
     fi
     printf '%s' "$CANDIDATE"
 }

From f94fc468aa3c3bed51611d083d01e5adbecf75dd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 4 Aug 2025 14:28:34 +0000
Subject: [PATCH 28/82] home: zsh: ignore more commands for notification

---
 modules/home/zsh/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 08b4101..1e85cce 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -14,10 +14,12 @@ in
       exclude = mkOption {
         type = with types; listOf str;
         default = [
+          "bat"
           "delta"
           "direnv reload"
           "fg"
           "git (?!push|pull|fetch)"
+          "home-manager (?!switch|build|news)"
           "htop"
           "less"
           "man"

From a10270f8e16b9e397782a8cd9297e516247b049e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 5 Aug 2025 11:00:26 +0000
Subject: [PATCH 29/82] flake: bump inputs

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index e96a7a0..080c212 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750173260,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
+        "lastModified": 1754337839,
+        "narHash": "sha256-fEc2/4YsJwtnLU7HCFMRckb0u9UNnDZmwGhXT5U5NTw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
+        "rev": "856df6f6922845abd4fd958ce21febc07ca2fa45",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753121425,
-        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
+        "lastModified": 1754091436,
+        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
+        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753617834,
-        "narHash": "sha256-WEVfKrdIdu5CpppJ0Va3vzP0DKlS+ZTLbBjugMO2Drg=",
+        "lastModified": 1754365350,
+        "narHash": "sha256-NLWIkn1qM0wxtZu/2NXRaujWJ4Y1PSZlc7h0y6pOzOQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "72cc1e3134a35005006f06640724319caa424737",
+        "rev": "c5d7e957397ecb7d48b99c928611c6e780db1b56",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753429684,
-        "narHash": "sha256-9h7+4/53cSfQ/uA3pSvCaBepmZaz/dLlLVJnbQ+SJjk=",
+        "lastModified": 1754372978,
+        "narHash": "sha256-ByII9p9ek0k9UADC/hT+i9ueM2mw0Zxiz+bOlydU6Oo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7fd36ee82c0275fb545775cc5e4d30542899511d",
+        "rev": "9ebe222ec7ef9de52478f76cba3f0324c1d1119f",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1741294988,
-        "narHash": "sha256-3408u6q615kVTb23WtDriHRmCBBpwX7iau6rvfipcu4=",
+        "lastModified": 1753980880,
+        "narHash": "sha256-aj1pbYxL6N+XFqBHjB4B1QP0bnKRcg1AfpgT5zUFsW8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b30c245e2c44c7352a27485bfd5bc483df660f0e",
+        "rev": "16db3e61da7606984a05b4dfc33cd1d26d22fb22",
         "type": "github"
       },
       "original": {

From dd7b6135315c51812e6928087b20235c9fb7638d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 5 Aug 2025 11:03:01 +0000
Subject: [PATCH 30/82] pkgs: lohr: remove 'useFetchCargoVendor'

It's now turned on by default.
---
 pkgs/lohr/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/lohr/default.nix b/pkgs/lohr/default.nix
index aeb13b1..d8545e0 100644
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@@ -10,7 +10,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
   };
 
-  useFetchCargoVendor = true;
   cargoHash = "sha256-R3/N/43+bGx6acE/rhBcrk6kS5zQu8NJ1sVvKJJkK9w=";
 
   meta = with lib; {

From f1d7da7fcb72aff435a975adfe710810ab064d93 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 00:11:26 +0200
Subject: [PATCH 31/82] nixos: services: matrix: refactor well-knowns

---
 modules/nixos/services/matrix/default.nix | 54 ++++++++++-------------
 1 file changed, 23 insertions(+), 31 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index f423834..b43dbcc 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -14,6 +14,26 @@ let
   clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
+
+  serverConfig = {
+    "m.server" = "${matrixDomain}:${toString federationPort.public}";
+  };
+  clientConfig = {
+    "m.homeserver" = {
+      "base_url" = "https://${matrixDomain}";
+      "server_name" = domain;
+    };
+    "m.identity_server" = {
+      "base_url" = "https://vector.im";
+    };
+  };
+
+  # ACAO required to allow element-web on any URL to request this json file
+  mkWellKnown = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
 in
 {
   options.my.services.matrix = with lib; {
@@ -96,15 +116,7 @@ in
       chat = {
         root = pkgs.element-web.override {
           conf = {
-            default_server_config = {
-              "m.homeserver" = {
-                "base_url" = "https://${matrixDomain}";
-                "server_name" = domain;
-              };
-              "m.identity_server" = {
-                "base_url" = "https://vector.im";
-              };
-            };
+            default_server_config = clientConfig;
             showLabsSettings = true;
             defaultCountryCode = "FR"; # cocorico
             roomDirectory = {
@@ -176,28 +188,8 @@ in
         forceSSL = true;
         useACMEHost = domain;
 
-        locations."= /.well-known/matrix/server".extraConfig =
-          let
-            server = { "m.server" = "${matrixDomain}:${toString federationPort.public}"; };
-          in
-          ''
-            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON server}';
-          '';
-
-        locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
-              "m.identity_server" = { "base_url" = "https://vector.im"; };
-            };
-            # ACAO required to allow element-web on any URL to request this json file
-          in
-          ''
-            add_header Content-Type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
+        locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+        locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
       };
     };
 

From 0792e8c7cb1b75e608372e44fb36a885f28a998e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 00:34:40 +0200
Subject: [PATCH 32/82] nixos: services: matrix: fix element-web config

---
 modules/nixos/services/matrix/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index b43dbcc..42f7b4e 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -117,10 +117,11 @@ in
         root = pkgs.element-web.override {
           conf = {
             default_server_config = clientConfig;
-            showLabsSettings = true;
-            defaultCountryCode = "FR"; # cocorico
-            roomDirectory = {
+            show_labs_settings = true;
+            default_country_code = "FR"; # cocorico
+            room_directory = {
               "servers" = [
+                domain
                 "matrix.org"
                 "mozilla.org"
               ];

From bd019258cb4f15e028bc4cb7a68353abe270e6ac Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 10:39:55 +0200
Subject: [PATCH 33/82] nixos: services: matrix: simplify listeners

---
 modules/nixos/services/matrix/default.nix | 93 ++++++++---------------
 1 file changed, 30 insertions(+), 63 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 42f7b4e..83dac7c 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -10,13 +10,11 @@
 let
   cfg = config.my.services.matrix;
 
-  federationPort = { public = 8448; private = 11338; };
-  clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
 
   serverConfig = {
-    "m.server" = "${matrixDomain}:${toString federationPort.public}";
+    "m.server" = "${matrixDomain}:443";
   };
   clientConfig = {
     "m.homeserver" = {
@@ -39,6 +37,13 @@ in
   options.my.services.matrix = with lib; {
     enable = mkEnableOption "Matrix Synapse";
 
+    port = mkOption {
+      type = types.port;
+      default = 8448;
+      example = 8008;
+      description = "Internal port for listeners";
+    };
+
     secretFile = mkOption {
       type = with types; nullOr str;
       default = null;
@@ -78,22 +83,22 @@ in
         enable_registration = false;
 
         listeners = [
-          # Federation
           {
+            inherit (cfg) port;
             bind_addresses = [ "::1" ];
-            port = federationPort.private;
-            tls = false; # Terminated by nginx.
+            type = "http";
+            tls = false;
             x_forwarded = true;
-            resources = [{ names = [ "federation" ]; compress = false; }];
-          }
-
-          # Client
-          {
-            bind_addresses = [ "::1" ];
-            port = clientPort.private;
-            tls = false; # Terminated by nginx.
-            x_forwarded = true;
-            resources = [{ names = [ "client" ]; compress = false; }];
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+              {
+                names = [ "federation" ];
+                compress = false;
+              }
+            ];
           }
         ];
 
@@ -130,11 +135,8 @@ in
         };
       };
       # Dummy VHosts for port collision detection
-      matrix-federation = {
-        port = federationPort.private;
-      };
-      matrix-client = {
-        port = clientPort.private;
+      matrix-dummy = {
+        inherit (cfg) port;
       };
     };
 
@@ -144,45 +146,15 @@ in
         onlySSL = true;
         useACMEHost = domain;
 
-        locations =
-          let
-            proxyToClientPort = {
-              proxyPass = "http://[::1]:${toString clientPort.private}";
-            };
-          in
-          {
-            # Or do a redirect instead of the 404, or whatever is appropriate
-            # for you. But do not put a Matrix Web client here! See the
-            # Element web section below.
-            "/".return = "404";
+        locations = {
+          # Or do a redirect instead of the 404, or whatever is appropriate
+          # for you. But do not put a Matrix Web client here! See the
+          # Element web section below.
+          "/".return = "404";
 
-            "/_matrix" = proxyToClientPort;
-            "/_synapse/client" = proxyToClientPort;
-          };
-
-        listen = [
-          { addr = "0.0.0.0"; port = clientPort.public; ssl = true; }
-          { addr = "[::]"; port = clientPort.public; ssl = true; }
-        ];
-
-      };
-
-      # same as above, but listening on the federation port
-      "${matrixDomain}_federation" = {
-        onlySSL = true;
-        serverName = matrixDomain;
-        useACMEHost = domain;
-
-        locations."/".return = "404";
-
-        locations."/_matrix" = {
-          proxyPass = "http://[::1]:${toString federationPort.private}";
+          "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
+          "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
         };
-
-        listen = [
-          { addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
-          { addr = "[::]"; port = federationPort.public; ssl = true; }
-        ];
       };
 
       "${domain}" = {
@@ -197,11 +169,6 @@ in
     # For administration tools.
     environment.systemPackages = [ pkgs.matrix-synapse ];
 
-    networking.firewall.allowedTCPPorts = [
-      clientPort.public
-      federationPort.public
-    ];
-
     my.services.backup = {
       paths = [
         config.services.matrix-synapse.dataDir

From 1e31b2dfea4e2161c371806b262b924349ab31f5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 10:42:23 +0200
Subject: [PATCH 34/82] nixos: services: matrix: simplify VHost

---
 modules/nixos/services/matrix/default.nix | 31 ++++++++++-------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 83dac7c..763d9b1 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -134,29 +134,26 @@ in
           };
         };
       };
-      # Dummy VHosts for port collision detection
-      matrix-dummy = {
+      matrix = {
+        # Somewhat unused, but necessary for port collision detection
         inherit (cfg) port;
+
+        extraConfig = {
+          locations = {
+            # Or do a redirect instead of the 404, or whatever is appropriate
+            # for you. But do not put a Matrix Web client here! See the
+            # Element web section below.
+            "/".return = "404";
+
+            "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
+            "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
+          };
+        };
       };
     };
 
     # Those are too complicated to use my wrapper...
     services.nginx.virtualHosts = {
-      ${matrixDomain} = {
-        onlySSL = true;
-        useACMEHost = domain;
-
-        locations = {
-          # Or do a redirect instead of the 404, or whatever is appropriate
-          # for you. But do not put a Matrix Web client here! See the
-          # Element web section below.
-          "/".return = "404";
-
-          "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
-          "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
-        };
-      };
-
       "${domain}" = {
         forceSSL = true;
         useACMEHost = domain;

From fa7b4910f5cac8bc1f50cc396174ecceae8b1fd5 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 11:06:04 +0200
Subject: [PATCH 35/82] nixos: services: matrix: fix proxy to synapse

I want to make use of the `/_synapse/matrix/` sub-path, so just proxy
the whole of `/_synapse/`.
---
 modules/nixos/services/matrix/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 763d9b1..dfd5b50 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -146,7 +146,7 @@ in
             "/".return = "404";
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
-            "/_synapse/client".proxyPass = "http://[::1]:${toString cfg.port}";
+            "/_synapse".proxyPass = "http://[::1]:${toString cfg.port}";
           };
         };
       };

From 9cadbe6256b8ea9db3c2acc3eeb0e02b903d7579 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 11:07:37 +0200
Subject: [PATCH 36/82] nixos: services: matrix: add admin interface

---
 modules/nixos/services/matrix/default.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index dfd5b50..837d150 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -10,6 +10,8 @@
 let
   cfg = config.my.services.matrix;
 
+  adminPkg = pkgs.synapse-admin-etkecc;
+
   domain = config.networking.domain;
   matrixDomain = "matrix.${domain}";
 
@@ -147,6 +149,22 @@ in
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
             "/_synapse".proxyPass = "http://[::1]:${toString cfg.port}";
+
+            "= /admin".return = "307 /admin/";
+            "/admin/" = {
+              alias = "${adminPkg}/";
+              priority = 500;
+              tryFiles = "$uri $uri/ /index.html";
+            };
+            "~ ^/admin/.*\\.(?:css|js|jpg|jpeg|gif|png|svg|ico|woff|woff2|ttf|eot|webp)$" = {
+              priority = 400;
+              root = adminPkg;
+              extraConfig = ''
+                rewrite ^/admin/(.*)$ /$1 break;
+                expires 30d;
+                more_set_headers "Cache-Control: public";
+              '';
+            };
           };
         };
       };

From 7a85a4440716f752c8f004330c9e2aa1a3c9886f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 20:06:40 +0200
Subject: [PATCH 37/82] nixos: services: matrix: remove obsolete comment

---
 modules/nixos/services/matrix/default.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 837d150..483a72a 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -1,10 +1,4 @@
-# Matrix homeserver setup, using different endpoints for federation and client
-# traffic. The main trick for this is defining two nginx servers endpoints for
-# matrix.domain.com, each listening on different ports.
-#
-# Configuration shamelessly stolen from [1]
-#
-# [1]: https://github.com/alarsyo/nixos-config/blob/main/services/matrix.nix
+# Matrix homeserver setup.
 { config, lib, pkgs, ... }:
 
 let

From 30348a1e193318b1d8bbb8f6d828226f49e8eaa7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 3 Aug 2025 22:28:22 +0200
Subject: [PATCH 38/82] nixos: services: matrix: add Facebook bridge

I probably won't actually use it, after test-driving it quickly.

But now that the effort has been expanded, might as well keep it if only
as a future reference.
---
 modules/nixos/services/matrix/bridges.nix | 143 ++++++++++++++++++++++
 modules/nixos/services/matrix/default.nix |   4 +
 2 files changed, 147 insertions(+)
 create mode 100644 modules/nixos/services/matrix/bridges.nix

diff --git a/modules/nixos/services/matrix/bridges.nix b/modules/nixos/services/matrix/bridges.nix
new file mode 100644
index 0000000..70f4118
--- /dev/null
+++ b/modules/nixos/services/matrix/bridges.nix
@@ -0,0 +1,143 @@
+# Matrix bridges for some services I use
+{ config, lib, ... }:
+let
+  cfg = config.my.services.matrix.bridges;
+  synapseCfg = config.services.matrix-synapse;
+
+  domain = config.networking.domain;
+  serverName = synapseCfg.settings.server_name;
+
+  mkBridgeOption = n: lib.mkEnableOption "${n} bridge" // { default = cfg.enable; };
+  mkPortOption = n: default: lib.mkOption {
+    type = lib.types.port;
+    inherit default;
+    example = 8080;
+    description = "${n} bridge port";
+  };
+  mkEnvironmentFileOption = n: lib.mkOption {
+    type = lib.types.str;
+    example = "/run/secret/matrix/${lib.toLower n}-bridge-secrets.env";
+    description = ''
+      Path to a file which should contain the secret values for ${n} bridge.
+
+      Using through the following format:
+
+      ```
+      MATRIX_APPSERVICE_AS_TOKEN=<the_as_value>
+      MATRIX_APPSERVICE_HS_TOKEN=<the_hs_value>
+      ```
+
+      Each bridge should use a different set of secrets, as they each register
+      their own independent double-puppetting appservice.
+    '';
+  };
+in
+{
+  options.my.services.matrix.bridges = with lib; {
+    enable = mkEnableOption "bridges configuration";
+
+    admin = mkOption {
+      type = types.str;
+      default = "ambroisie";
+      example = "admin";
+      description = "Local username for the admin";
+    };
+
+    facebook = {
+      enable = mkBridgeOption "Facebook";
+
+      port = mkPortOption "Facebook" 29321;
+
+      environmentFile = mkEnvironmentFileOption "Facebook";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.facebook.enable {
+      services.mautrix-meta.instances.facebook = {
+        enable = true;
+        # Automatically register the bridge with synapse
+        registerToSynapse = true;
+
+        # Provide `AS_TOKEN`, `HS_TOKEN`
+        inherit (cfg.facebook) environmentFile;
+
+        settings = {
+          homeserver = {
+            domain = serverName;
+            address = "http://localhost:${toString config.my.services.matrix.port}";
+          };
+
+          appservice = {
+            hostname = "localhost";
+            inherit (cfg.facebook) port;
+            address = "http://localhost:${toString cfg.facebook.port}";
+            public_address = "https://facebook-bridge.${domain}";
+
+            as_token = "$MATRIX_APPSERVICE_AS_TOKEN";
+            hs_token = "$MATRIX_APPSERVICE_HS_TOKEN";
+
+            bot = {
+              username = "fbbot";
+            };
+          };
+
+          backfill = {
+            enabled = true;
+          };
+
+          bridge = {
+            delivery_receipts = true;
+            permissions = {
+              "*" = "relay";
+              ${serverName} = "user";
+              "@${cfg.admin}:${serverName}" = "admin";
+            };
+          };
+
+          database = {
+            type = "postgres";
+            uri = "postgres:///mautrix-meta-facebook?host=/var/run/postgresql/";
+          };
+
+          double_puppet = {
+            secrets = {
+              ${serverName} = "as_token:$MATRIX_APPSERVICE_AS_TOKEN";
+            };
+          };
+
+          network = {
+            # Don't be picky on Facebook/Messenger
+            allow_messenger_com_on_fb = true;
+            displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FB)'';
+          };
+
+          provisioning = {
+            shared_secret = "disable";
+          };
+        };
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "mautrix-meta-facebook" ];
+        ensureUsers = [{
+          name = "mautrix-meta-facebook";
+          ensureDBOwnership = true;
+        }];
+      };
+
+      systemd.services.mautrix-meta-facebook = {
+        wants = [ "postgres.service" ];
+        after = [ "postgres.service" ];
+      };
+
+      my.services.nginx.virtualHosts = {
+        # Proxy to the bridge
+        "facebook-bridge" = {
+          inherit (cfg.facebook) port;
+        };
+      };
+    })
+  ];
+}
diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 483a72a..04d24a0 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -30,6 +30,10 @@ let
   '';
 in
 {
+  imports = [
+    ./bridges.nix
+  ];
+
   options.my.services.matrix = with lib; {
     enable = mkEnableOption "Matrix Synapse";
 

From b1c9279c637956d134793431e0760d71a0e8bd97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 2 Aug 2025 14:46:32 +0200
Subject: [PATCH 39/82] nixos: services: add thelounge

---
 modules/nixos/services/default.nix           |  1 +
 modules/nixos/services/thelounge/default.nix | 59 ++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 modules/nixos/services/thelounge/default.nix

diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 27f8765..e03eca1 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -38,6 +38,7 @@
     ./servarr
     ./ssh-server
     ./tandoor-recipes
+    ./thelounge
     ./tlp
     ./transmission
     ./vikunja
diff --git a/modules/nixos/services/thelounge/default.nix b/modules/nixos/services/thelounge/default.nix
new file mode 100644
index 0000000..e224839
--- /dev/null
+++ b/modules/nixos/services/thelounge/default.nix
@@ -0,0 +1,59 @@
+# Web IRC client
+{ config, lib, ... }:
+let
+  cfg = config.my.services.thelounge;
+in
+{
+  options.my.services.thelounge = with lib; {
+    enable = mkEnableOption "The Lounge, a self-hosted web IRC client";
+
+    port = mkOption {
+      type = types.port;
+      default = 9050;
+      example = 4242;
+      description = "The port on which The Lounge will listen for incoming HTTP traffic.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.thelounge = {
+      enable = true;
+      inherit (cfg) port;
+
+      extraConfig = {
+        reverseProxy = true;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      irc = {
+        inherit (cfg) port;
+        # Proxy websockets for RPC
+        websocketsLocations = [ "/" ];
+
+        extraConfig = {
+          locations."/".extraConfig = ''
+            proxy_read_timeout 1d;
+          '';
+        };
+      };
+    };
+
+    services.fail2ban.jails = {
+      thelounge = ''
+        enabled = true
+        filter = thelounge
+        port = http,https
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/thelounge.conf".text = ''
+        [Definition]
+        failregex = Authentication failed for user .* from <HOST>$
+                    Authentication for non existing user attempted from <HOST>$
+        journalmatch = _SYSTEMD_UNIT=thelounge.service
+      '';
+    };
+  };
+}

From 17ceaa5620c49c5445b99945475c477122637ce7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Wed, 6 Aug 2025 15:37:08 +0000
Subject: [PATCH 40/82] nixos: services: matrix: fix out-dated comments

---
 modules/nixos/services/matrix/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index 04d24a0..97dec2e 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -142,7 +142,7 @@ in
           locations = {
             # Or do a redirect instead of the 404, or whatever is appropriate
             # for you. But do not put a Matrix Web client here! See the
-            # Element web section below.
+            # Element web section above.
             "/".return = "404";
 
             "/_matrix".proxyPass = "http://[::1]:${toString cfg.port}";
@@ -168,7 +168,7 @@ in
       };
     };
 
-    # Those are too complicated to use my wrapper...
+    # Setup well-known locations
     services.nginx.virtualHosts = {
       "${domain}" = {
         forceSSL = true;

From 8688206ff530dc8fc6da6d2e6e68dcc56dc77622 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 11 Aug 2025 10:05:13 +0000
Subject: [PATCH 41/82] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index 080c212..7ee0f96 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754337839,
-        "narHash": "sha256-fEc2/4YsJwtnLU7HCFMRckb0u9UNnDZmwGhXT5U5NTw=",
+        "lastModified": 1754433428,
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "856df6f6922845abd4fd958ce21febc07ca2fa45",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
         "type": "github"
       },
       "original": {
@@ -53,11 +53,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754091436,
-        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
+        "lastModified": 1754487366,
+        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
+        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "lastModified": 1754416808,
+        "narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754365350,
-        "narHash": "sha256-NLWIkn1qM0wxtZu/2NXRaujWJ4Y1PSZlc7h0y6pOzOQ=",
+        "lastModified": 1754886238,
+        "narHash": "sha256-LTQomWOwG70lZR+78ZYSZ9sYELWNq3HJ7/tdHzfif/s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c5d7e957397ecb7d48b99c928611c6e780db1b56",
+        "rev": "0d492b89d1993579e63b9dbdaed17fd7824834da",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754372978,
-        "narHash": "sha256-ByII9p9ek0k9UADC/hT+i9ueM2mw0Zxiz+bOlydU6Oo=",
+        "lastModified": 1754725699,
+        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ebe222ec7ef9de52478f76cba3f0324c1d1119f",
+        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
         "type": "github"
       },
       "original": {

From 8c506ea03cfcbbc805eb5e9b26863fa5a0260400 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 8 Aug 2025 09:56:33 +0000
Subject: [PATCH 42/82] home: xdg: enable 'preferXdgDirectories'

At the moment this only makes a difference for `dircolors`.
---
 modules/home/xdg/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/home/xdg/default.nix b/modules/home/xdg/default.nix
index 803167f..7a0c517 100644
--- a/modules/home/xdg/default.nix
+++ b/modules/home/xdg/default.nix
@@ -56,4 +56,7 @@ in
     XCOMPOSECACHE = "${dataHome}/X11/xcompose";
     _JAVA_OPTIONS = "-Djava.util.prefs.userRoot=${configHome}/java";
   };
+
+  # Some modules *optionally* use `XDG_*_HOME` when told to
+  config.home.preferXdgDirectories = lib.mkIf cfg.enable true;
 }

From 5f073875e63aadc7ac925b4fd078248d94f565cd Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 11 Aug 2025 10:18:35 +0000
Subject: [PATCH 43/82] home: tmux: use consistent commenting style

---
 modules/home/tmux/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/home/tmux/default.nix b/modules/home/tmux/default.nix
index 3ea047a..e3e3daf 100644
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@@ -61,8 +61,8 @@ in
       pain-control
       # Better session management
       sessionist
+      # X clipboard integration
       {
-        # X clipboard integration
         plugin = yank;
         extraConfig = ''
           # Use 'clipboard' because of misbehaving apps (e.g: firefox)
@@ -71,8 +71,8 @@ in
           set -g @yank_action 'copy-pipe'
         '';
       }
+      # Show when prefix has been pressed
       {
-        # Show when prefix has been pressed
         plugin = prefix-highlight;
         extraConfig = ''
           # Also show when I'm in copy or sync mode

From e2ae3e02d91291327f883db2bf6fc6a14e269828 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 18 Aug 2025 11:00:38 +0000
Subject: [PATCH 44/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7ee0f96..f4d5f57 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754416808,
-        "narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
+        "lastModified": 1755446520,
+        "narHash": "sha256-I0Ok1OGDwc1jPd8cs2VvAYZsHriUVFGIUqW+7uSsOUM=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
+        "rev": "4b04db83821b819bbbe32ed0a025b31e7971f22e",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754886238,
-        "narHash": "sha256-LTQomWOwG70lZR+78ZYSZ9sYELWNq3HJ7/tdHzfif/s=",
+        "lastModified": 1755491080,
+        "narHash": "sha256-ib1Xi13NEalrFqQAHceRsb+6aIPANFuQq80SS/bY10M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d492b89d1993579e63b9dbdaed17fd7824834da",
+        "rev": "f8af2cbe386f9b96dd9efa57ab15a09377f38f4d",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1754725699,
-        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
         "type": "github"
       },
       "original": {

From f3af8f9ba8b0042875d9c856cb6ec5b37889ddcb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 21 Aug 2025 12:06:37 +0000
Subject: [PATCH 45/82] home: atuin: remove bad comment

Most likely a copy-paste error.
---
 modules/home/atuin/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/modules/home/atuin/default.nix b/modules/home/atuin/default.nix
index dbd9690..40d2b04 100644
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@@ -6,7 +6,6 @@ in
   options.my.home.atuin = with lib; {
     enable = my.mkDisableOption "atuin configuration";
 
-    # I want the full experience by default
     package = mkPackageOption pkgs "atuin" { };
 
     daemon = {

From 1a109b6b1f48919cc07a2a3c853858e5900eede4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 11:39:23 +0000
Subject: [PATCH 46/82] flake: bump inputs

And fix a renamed package.
---
 flake.lock                           | 18 +++++++++---------
 modules/nixos/profiles/x/default.nix |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/flake.lock b/flake.lock
index f4d5f57..ca1b422 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755446520,
-        "narHash": "sha256-I0Ok1OGDwc1jPd8cs2VvAYZsHriUVFGIUqW+7uSsOUM=",
+        "lastModified": 1755960406,
+        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "4b04db83821b819bbbe32ed0a025b31e7971f22e",
+        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755491080,
-        "narHash": "sha256-ib1Xi13NEalrFqQAHceRsb+6aIPANFuQq80SS/bY10M=",
+        "lastModified": 1756022458,
+        "narHash": "sha256-J1i35r4HfNDdPpwL0vOBaZopQudAUVtartEerc1Jryc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f8af2cbe386f9b96dd9efa57ab15a09377f38f4d",
+        "rev": "9e3a33c0bcbc25619e540b9dfea372282f8a9740",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1755186698,
-        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
+        "lastModified": 1756125398,
+        "narHash": "sha256-XexyKZpf46cMiO5Vbj+dWSAXOnr285GHsMch8FBoHbc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
+        "rev": "3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/profiles/x/default.nix b/modules/nixos/profiles/x/default.nix
index ea77939..874f36f 100644
--- a/modules/nixos/profiles/x/default.nix
+++ b/modules/nixos/profiles/x/default.nix
@@ -13,7 +13,7 @@ in
     # Nice wallpaper
     services.xserver.displayManager.lightdm.background =
       let
-        wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
+        wallpapers = "${pkgs.kdePackages.plasma-workspace-wallpapers}/share/wallpapers";
       in
       "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
 

From a889dfbb1a9ce76410e6655ba82616a4c20a3e71 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 11:40:40 +0000
Subject: [PATCH 47/82] home: nix: fix renamed option

---
 modules/home/nix/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/nix/default.nix b/modules/home/nix/default.nix
index c67cc6a..2f435a8 100644
--- a/modules/home/nix/default.nix
+++ b/modules/home/nix/default.nix
@@ -69,7 +69,7 @@ in
         automatic = true;
 
         # Every week, with some wiggle room
-        frequency = "weekly";
+        dates = "weekly";
         randomizedDelaySec = "10min";
 
         # Use a persistent timer for e.g: laptops

From 31147abd9176c9b8afbfa4924df0f589f041b3fc Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 13:07:41 +0000
Subject: [PATCH 48/82] home: add trgui

---
 modules/home/default.nix       |  1 +
 modules/home/trgui/default.nix | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 modules/home/trgui/default.nix

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 1c40377..ad3b979 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -38,6 +38,7 @@
     ./ssh
     ./terminal
     ./tmux
+    ./trgui
     ./udiskie
     ./vim
     ./wget
diff --git a/modules/home/trgui/default.nix b/modules/home/trgui/default.nix
new file mode 100644
index 0000000..ee545a9
--- /dev/null
+++ b/modules/home/trgui/default.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.home.trgui;
+in
+{
+  options.my.home.trgui = with lib; {
+    enable = mkEnableOption "Transmission GUI onfiguration";
+
+    package = mkPackageOption pkgs "TrguiNG" { default = "trgui-ng"; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      cfg.package
+    ];
+  };
+}

From 1800cb9daa62bf87d55b98baf84a0d2d9a70129c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 26 Aug 2025 13:08:58 +0000
Subject: [PATCH 49/82] hosts: nixos: aramis: use 'trgui' module

---
 hosts/nixos/aramis/home.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 221b1ea..7578582 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -20,7 +20,6 @@
       element-desktop # Matrix client
       jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
-      trgui-ng # Transmission remote
     ];
     # Minimal video player
     mpv.enable = true;
@@ -28,6 +27,8 @@
     nm-applet.enable = true;
     # Terminal
     terminal.program = "alacritty";
+    # Transmission remote
+    trgui.enable = true;
     # Zathura document viewer
     zathura.enable = true;
   };

From 3fa1664b5c574632c67848e44c167c77cf638ccb Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 21 Feb 2025 16:47:11 +0000
Subject: [PATCH 50/82] home: delta: use stand-alone configuration file

Ideally, I'd like for `delta` to just read a configuration file at
`$XDG_CONFIG_HOME/delta/config` by default, but upstream seems somewhat
reticent to the idea :-/.

So instead, let's keep relying on `git` being enabled, but rather than
inlining the configuration, let's store it where I think it should
belong and include it into `gitconfig`.
---
 modules/home/delta/default.nix | 59 ++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 24 deletions(-)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index 58ee031..16d3d59 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -1,6 +1,9 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.delta;
+
+  configFormat = pkgs.formats.gitIni { };
+  configPath = "${config.xdg.configHome}/delta/config";
 in
 {
   options.my.home.delta = with lib; {
@@ -34,35 +37,43 @@ in
 
     home.packages = [ cfg.package ];
 
+    xdg.configFile."delta/config".source = configFormat.generate "delta-config" {
+      delta = {
+        features = "diff-highlight decorations";
+
+        # Less jarring style for `diff-highlight` emulation
+        diff-highlight = {
+          minus-style = "red";
+          minus-non-emph-style = "red";
+          minus-emph-style = "bold red 52";
+
+          plus-style = "green";
+          plus-non-emph-style = "green";
+          plus-emph-style = "bold green 22";
+
+          whitespace-error-style = "reverse red";
+        };
+
+        # Personal preference for easier reading
+        decorations = {
+          commit-style = "raw"; # Do not recolor meta information
+          keep-plus-minus-markers = true;
+          paging = "always";
+        };
+      };
+    };
+
     programs.git = lib.mkIf cfg.git.enable {
       delta = {
         enable = true;
         inherit (cfg) package;
-
-        options = {
-          features = "diff-highlight decorations";
-
-          # Less jarring style for `diff-highlight` emulation
-          diff-highlight = {
-            minus-style = "red";
-            minus-non-emph-style = "red";
-            minus-emph-style = "bold red 52";
-
-            plus-style = "green";
-            plus-non-emph-style = "green";
-            plus-emph-style = "bold green 22";
-
-            whitespace-error-style = "reverse red";
-          };
-
-          # Personal preference for easier reading
-          decorations = {
-            commit-style = "raw"; # Do not recolor meta information
-            keep-plus-minus-markers = true;
-            paging = "always";
-          };
-        };
       };
+
+      includes = [
+        {
+          path = configPath;
+        }
+      ];
     };
   };
 }

From 3dd4f07609a8d8c9f15530745aa68ba458b943f3 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:35:39 +0000
Subject: [PATCH 51/82] hosts: nixos: aramis: home: drop
 'jellyfin-media-player'

It's about to be made broken due to using QtWebEngine 5, which is EOL
and marked insecure in new nixpkgs.
---
 hosts/nixos/aramis/home.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 7578582..e8c99e4 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -18,7 +18,6 @@
     # Machine specific packages
     packages.additionalPackages = with pkgs; [
       element-desktop # Matrix client
-      jellyfin-media-player # Wraps the webui and mpv together
       pavucontrol # Audio mixer GUI
     ];
     # Minimal video player

From b9bc37d365c607bdda473c9f2a0a992f0e8f6cc0 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:14:25 +0000
Subject: [PATCH 52/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index ca1b422..e86674e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754487366,
-        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
+        "lastModified": 1756770412,
+        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
+        "rev": "4524271976b625a4a605beefd893f270620fd751",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756022458,
-        "narHash": "sha256-J1i35r4HfNDdPpwL0vOBaZopQudAUVtartEerc1Jryc=",
+        "lastModified": 1756954499,
+        "narHash": "sha256-Pg4xBHzvzNY8l9x/rLWoJMnIR8ebG+xeU+IyqThIkqU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9e3a33c0bcbc25619e540b9dfea372282f8a9740",
+        "rev": "ed1a98c375450dfccf427adacd2bfd1a7b22eb25",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756125398,
-        "narHash": "sha256-XexyKZpf46cMiO5Vbj+dWSAXOnr285GHsMch8FBoHbc=",
+        "lastModified": 1756936398,
+        "narHash": "sha256-/o1TTpMIICpjrMHBilL9lYm/r69uhdK1L8j1pfY6tWU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5",
+        "rev": "47f28ad9378956563df9a884fd1b209b64336ba3",
         "type": "github"
       },
       "original": {

From e6c95245b27e5ac6fbac237d222c56a39ba401f9 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 4 Sep 2025 11:17:27 +0000
Subject: [PATCH 53/82] home: ssh: disable default config

It's been deprecated.

This also makes my `addKeysToAgent` configuration more explicit.
---
 modules/home/ssh/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/modules/home/ssh/default.nix b/modules/home/ssh/default.nix
index 748b195..b0b4167 100644
--- a/modules/home/ssh/default.nix
+++ b/modules/home/ssh/default.nix
@@ -17,6 +17,7 @@ in
     {
       programs.ssh = {
         enable = true;
+        enableDefaultConfig = false;
 
         includes = [
           # Local configuration, not-versioned
@@ -53,11 +54,12 @@ in
             identityFile = "~/.ssh/shared_rsa";
             user = "ambroisie";
           };
-        };
 
-        extraConfig = ''
-          AddKeysToAgent yes
-        '';
+          # `*` is automatically made the last match block by the module
+          "*" = {
+            addKeysToAgent = "yes";
+          };
+        };
       };
     }
 

From fa6bcabf95d8d1d860612880198271b6d31cbb0a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 11 Sep 2025 13:33:27 +0000
Subject: [PATCH 54/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index e86674e..d510422 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755960406,
-        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
+        "lastModified": 1757588530,
+        "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
+        "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756954499,
-        "narHash": "sha256-Pg4xBHzvzNY8l9x/rLWoJMnIR8ebG+xeU+IyqThIkqU=",
+        "lastModified": 1757578556,
+        "narHash": "sha256-w1PGkTGow5XzsjccV364No46rkuGxTqo7m/4cfhnkIk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ed1a98c375450dfccf427adacd2bfd1a7b22eb25",
+        "rev": "b7112b12ea5b8c3aa6af344498ed9ca27dd03ba3",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756936398,
-        "narHash": "sha256-/o1TTpMIICpjrMHBilL9lYm/r69uhdK1L8j1pfY6tWU=",
+        "lastModified": 1757487488,
+        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "47f28ad9378956563df9a884fd1b209b64336ba3",
+        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
         "type": "github"
       },
       "original": {

From 27da55519c74d63010d67153041aed789b9add97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 25 Jul 2025 17:57:07 +0200
Subject: [PATCH 55/82] hosts: nixos: porthos: secrets: update cross-seed

---
 .../servarr/cross-seed/configuration.json.age | Bin 1528 -> 2031 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age b/hosts/nixos/porthos/secrets/servarr/cross-seed/configuration.json.age
index e319f3a823c4eb4c84b15f6630ea5fbf42f9092b..94fdf975d6418d394c62c42e572374b24865a776 100644
GIT binary patch
delta 2009
zcmeyt{hoh<PJMcLre#oasYR)2SyphVrMA9_e|k}hWu;qyQ&CBpb69$SZ>edfX?k{`
z1y`7VVx&c?t9gk}QGTLxrkh!^t9em@esE}{g_)bXV|KY;V0m7Fd!m_FI+w1ULUD11
zZfc5=si~o*LRLV2d0x7Lc4U~PQL39qp1E1MdzE&0T786jgi(<}SWvRRr>}W=NOneY
zrcYjImWfk2S4vnwc0qtaN}6SkajCw(qj8|KuW4wYg<rmDmRW8{zJGF6MS6~>etwcC
zm#(g^f^l-HWw5zNc~GcZlw(O$j#rLXR7JXTSaMlrp{u)Zm9JTfp`lNNdw8ZVSDWh2
z#!s*K@6<=xMe<IuJ$3G7_6@FgA->C=_?o%thNw!FzUK4zk}9+{djIX+e!sW%u-<*K
zg`x6<({7nAg+QS)2}b2ZmsR#`cpQHtgw@qh{oS4Gr>yq1s#KP78(f|7M(2v?f%cFe
zdK+w(Zm`yo-MD;X``@U5HMtds3LFpZa5q1Cf75z}isUzQ>VLkt(ynF|81>FrXLCH$
z&Wg1ktsTOTJ1K~>PqjR-D6s8Rtp3~@hpFB>^wx-#gs$M}+jXGsy0-4(1ewXs50~V9
zigIN*cem<AkL`o0l9`=CTW4B09J%5&Ym&Ilo|Cc@m)D(QIeh;nbBU#fvHju5w&tsH
zf(Jt<JotOgSU4z(Pg%D9?7NkwoB;|8?%m%VX3um$c<1p>0SAT8vTwG@xF2&}V%g5S
zbvLK-3d;z?W9>pkOWr#(XkWXVVP|5$)ZhG+qZ8B2YbTa}`trR_>-1!U!(B7G11<l*
zGhd&tx$Ugj@%Gr3y<XNb;hskn*bc1;Je7HB-MTNYxS3a<N@4jaQM~+iy<C0p)2z+6
z9XoaweldD0dQnd4>l{bt?>D>|=Kub_=9QkS@T}J?SIitfI~6^tt!|Y)v2h;1n)1`V
z^%<7OY!&Qdwto1vAxZbHfJdh+7gNxYqZbm7g{+Ugy6ZIe(uq2;z6)gUTv&2mIwWs}
z`Jb6(eo-4|_i@JaeX8Aga9R4TNoQQjnCdU9=-tg%yWXYGos)OrL|50Lsa>f#I|Tn(
zm;8>rDZ-*VTesuU&gWORr%Bgeue7<G_q}&*(ah=p7keJn>R^~XAzs7N@4HA;{rsO9
z(lcKkSH8CF)vc%7PI{P}PhjU&yYZyV>r;N$oW#dc`PN(KH6K_c*=RX)jl4ik>7nF)
zi}y3+>-Q_2J1E(mqogFoT;R$fBa%KTE2z-p=sQbU3)SaQ8?7D|xwkx1+x=<HuDefz
zzPp`EDdUw~F}d);vXz(5p7&YwrRKU>Ulwobr`hivkGzlMSL?8Q-sbhbg}o$K$mIIH
zn0HrR$J-qIx@KYe{<}(PTLeqJn~Z~X9<@w9f4_O%`H!FKAJtY##bwWRs!*8z{MRC`
zI-BiZr>zmYS)<CDxZOT~miWQPp~cmy1<s3Ia&qE+Yt8Mw9GM+_MC!Z9v2)oUOBj>$
z*m*YGcj9~FFg0lr+tj)MjT`d&KJjcaDB}82=PS>xrn-*l#vVq~IgZkasoUcwy?*9n
zH#I<enor5TUb&tpCiNeGGKg@5cGRYq-->WykeL|GQm@(g<#EC39dVNl8!f#inVDF<
z$!ubHtf#Ue)$W-%d&^UW%1wOYr(Dfmq<ENKY|x25KgWu9+Kif&b9e2E<P$2Htp13<
z;fz#<NZ`qzX<?orhsug&-{l^N|2bpVkxzonPnpkt>(9@P%IEI)U~jA!nzX*@t#PvD
zDtUul9?IUFi#z5V4msEVsjKen0zdPe`3<|x6EvO#&f&HE_d~?})olj5HA3MR%BGr2
z_*Z=pntyD?-8F6pjf9_a2=2euvi3vMm(aqg=Y$zvh(BeT)V|(D)9IV@nu9!v*JR{n
z&M`7N^;$&l_*0NFLr7&|#!U16tojWXxUPF{dfv<5`Qu`Q$PKIfAJ1iO80l}nptO9+
z?i90~zY5O$PSC#n$>b|9fBch~(ckU}{JdRZUvsv-eaW*k$0Qn;-O6fSw@bnP-KruH
z#&1F$=Wd>1*mhZ}{V-cHgW<pJRUXF$cb(gjwa{7rG>hihiEFIvEw?Hz_}LitY2LL*
zt@Z1oj|R+tZ+Ggb>@tQY@q5qN3J5UR2b!JHXuRSz#rx+HDSvbIJ)7;%?4Q(sVDEgB
zDX|yxcpJEV-JA|Od%LWCbNvl}&yV&e`Toj}<<?I)|7~@C?XQi6PhOo}yJpI+d9u1c
zK1REhiEm8(^&|G;U1PJ;(`7hPcK7e^(p~e<JZZxdg?e$x86UodW%V0wd2s*1Z_T4q
z7h2mIRRvZvq)pZ7na^yujBj3A`o}LN0SpH<w)Edi<`X%bzWr*@BR6ga(XjNDv&FP|
z=IvIyp17d)`PJOJ_u5lu&fWfCo!zX8i)q>$%nuu`;S@J6{<D1ZJEc8$)fgTbzKHWk
zWq709X6Lr}^xZwd_3gcrUN=0Lz9?me@#WVgFO%+E_|>!d_~ppE)|WJbR<50BIXQa&
z+@HM~=S~$}b5jXYU(#)V<;K6#-sL<TB8mlC8|u8P)R@b^30}`BTv5^+QkZ;f*)CsG
z&Nnd|JtgL3@UoUMAH3qs=DR71wX$6xj_>^Wip$!Eo@>XN<vz)rHd`tvV2bm>quY$E
z7<db3?Dx68(^#34HLSe$q5pKDnivk<xtx)kXO%9r)bFlK%KR6W;q7&YD^Qea&kn`S
ep}SKJk4IMQyW>?Hu=vv9MR$YZ_<ho}z5xI`<Et_N

delta 1502
zcmaFQ|ATviPJM)-VR?CgkBPZawo9aGMoCdYRk>4OQGumFMo6W5x^rP=Mt)AETV`3V
z1(#E4QAJ@+N^qv5r>~)BvQubgdVynQWKwEazOiRuRf$n@d4RJ~l2Kr;1(&X!LUD11
zZfc5=si~o*LRLV2d0x7LTcA^FQMP_+ScYYkbCiF2Kz*uLx|y4Yvy+>npMhItskXmS
zqIsZaWtO7}muXf=R=J;Zl8HxhR8p98WpSjBN1#htPF{*xP+m@HvU6p4X<2GTMrw)$
zm#(g^f>}hNuTxT<rJrknPiDHQrITAksefgfzl%X`c#>JMdzPPBsB^Mmo>ycf*D2@n
z37;fCdeuv+?>w+R<0Yeo{}QfuMmN)!+&k=0a;^TSYwE4IY0U~Q?{9Yfw0X#~C0&SF
zX}+aS((K$VJ-bblR?1ZG`JdIke`#ik!jg~Af1G*t+V950$FnqoQUr|mohx^EF@65T
z!^>7rb@N!fc}v>LkM#>r%T@8aynXUz(Vrc1N_9sTE>E4Nw7mX$h0l{u+OqtM1bTj@
z{(q8F`{LD`c_O|u&izgQ`QeY>?OCTZ*t+M1PUGCN>2JW}-2Va(cQ3Qqb*%S#`^L*J
zG+q`LyViT9Zd*R-NA%IVo*yc{RKzX66}P)FtGzy)v4%Z9f!XkKo!$0ChYdC^i?TxQ
zn;!e4|M;`7(CJ-Ed03yy+^*NF)SaH%BJzKE^2OXKtanWAHZ%#J&b~Tv%d`CgUAeXM
zmqgG0v{sNa#44C8s9yZV?WjFxZhl>tDqUQvv?~1K4ePy1>-d}J>u|1KJ8x&IqfYo+
zv*Wuy^8DMJ_IAY~9#8ikC1JDBo^u^VY~lYmh;NKyxvQY*wpb@t-T7Qi$XnlQ^#W44
zZ`SP8{vYOUcPhZZFKDgXN`tTQ-^=Rxdu|@>URiWR^t<<$J0G5AKAz@imKnqS{_7*H
z#FFImH@qBwus*nwkZR2-_kL^j^KWZC&P&xjDY@4u!1R1$kMd!|Dd)3Oj?a-1@bQuJ
zGhz?e+$&-I#Jc~q!JT&{OXn-=ZTu><_0+@qFGA5bx1N1jc_%AC@a99t6+hbVFjPD*
zlbM&YU~#<HhQo6+o;?&u+xum^-K1^PgFjAe4B_1D@NSQ&{W90JbDsQpcYP0QQSZMp
zgHKZ~ZBxAO8zV90SM6^8ttTd_RIgWCCwhll*=`-<TfV6`&3|4}sE%lGiu#*h*6n^c
z+CuKeq1UGM^Vgc_zdMvJ_^x}`v~!CTZkZ(?NIe_&!1TJ^mAA#5@6T`KUObD{C%ao9
zsQB~7!<(6IU(H{#H9Dqx_vb*lm0fSPuw86^tHkj8n|=t}hjgx6>mT=C-yyD6{*CAU
zbAcA213k_z6ZG$z|4<gzztNDix8}QS@5kQvK89TL_b%#HTPs=LcBIEBULelv^W8&N
z3UUv6)c=&d^rzzFmB-iSRD8F!tv$bSuk>sdxvnDiormsueVi3I=hEAwk9|GFUKP*(
zmVCWq#*6=IN3OVUo_;VjW9z5BgI6P(MYo&%yc#j-Pdb0amK!C$A9UOt4%p@|(ERo=
zklTIkm2$WJ$%@ynyzZJ(QCwgD<iX4brkhtNe>r_KO<~sq1K!1b7eBA@YG1o_ZS9v8
z<^gMpl?pxQNNIoN50~D4D9GRL(1pc$?pxUA*sb!4%qx!Ga!2Fh)W#z7ZdRxIg}XfB
zp55k34$-Wbeo<fMjXQIsWI1P8O_Y-U&Tk=W418)C{k67PNq8RS$XLIIb8kt-z54j|
z8F^vPbc6T2QdN5Tnjw0@g`*Dlk^}bl-S~C==Zl}QeqwXOe8mja>Q+va{*q&I@m&wc
zd^er?vXJvLKbtK3YbrlQ;`sKm-4o}XlD+TIschDg_~GD{&rUZ^itg#_SzfzD;_Y=d
zZS&;ktru!-w(1*&1`97TayHfcbHvdhOU!CRc)|p!BKv182~T_$y*_L?x3<D%(x<;U
zwa=8wx2}p(n4MXm=J5G*WLemfRV#O2deXk`w~dnbt|g4MjmEM@N&hzMKJN<n$g*GV
UK&(_lF5l0Z#GsIGl7St<0JT!sg8%>k


From 4c3e3d471fa61dcd5de24f0338b36e3b29c83f1f Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 13 Sep 2025 19:10:39 +0200
Subject: [PATCH 56/82] modules: services: nginx: fix SSL renewal, again

I'd previously fixed this in 1e10c6630b2c46bd40c2b23fa6a4f7c8fa751823,
however NixOS has recently updated how the renewal units work [1], which
broke it.

[1]: https://github.com/NixOS/nixpkgs/pull/422076
---
 modules/nixos/services/nginx/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index 1e9e38a..ff530b0 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -444,7 +444,7 @@ in
         };
     };
 
-    systemd.services."acme-${domain}" = {
+    systemd.services."acme-order-renew-${domain}" = {
       serviceConfig = {
         Environment = [
           # Since I do a "weird" setup with a wildcard CNAME

From 445b3d1422651d1604eda311f74ff0260386f76e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 18 Sep 2025 10:03:06 +0000
Subject: [PATCH 57/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index d510422..b9c0fd5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757588530,
-        "narHash": "sha256-tJ7A8mID3ct69n9WCvZ3PzIIl3rXTdptn/lZmqSS95U=",
+        "lastModified": 1758108966,
+        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b084b2c2b6bc23e83bbfe583b03664eb0b18c411",
+        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757578556,
-        "narHash": "sha256-w1PGkTGow5XzsjccV364No46rkuGxTqo7m/4cfhnkIk=",
+        "lastModified": 1758184248,
+        "narHash": "sha256-TOazVsj8D1LTGQ6q8xdtfoPs9Z+PiqUS952WvZPssR0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b7112b12ea5b8c3aa6af344498ed9ca27dd03ba3",
+        "rev": "bf7056c6a2d893d80db18d06d7e730d6515aaae8",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757487488,
-        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
+        "lastModified": 1758035966,
+        "narHash": "sha256-qqIJ3yxPiB0ZQTT9//nFGQYn8X/PBoJbofA7hRKZnmE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
+        "rev": "8d4ddb19d03c65a36ad8d189d001dc32ffb0306b",
         "type": "github"
       },
       "original": {

From 9f9c1e571b7a871db4a19d9bfe7fc3ebf9b24875 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 15 Sep 2025 13:22:30 +0000
Subject: [PATCH 58/82] home: zsh: do not notify on 'home-manager news'

---
 modules/home/zsh/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 1e85cce..3c1e515 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -19,7 +19,7 @@ in
           "direnv reload"
           "fg"
           "git (?!push|pull|fetch)"
-          "home-manager (?!switch|build|news)"
+          "home-manager (?!switch|build)"
           "htop"
           "less"
           "man"

From 5b47fc63656b7583fb427386339c7adce3cc7e97 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:23:54 +0200
Subject: [PATCH 59/82] flake: bump inputs

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index b9c0fd5..1889e0c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758184248,
-        "narHash": "sha256-TOazVsj8D1LTGQ6q8xdtfoPs9Z+PiqUS952WvZPssR0=",
+        "lastModified": 1759337100,
+        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bf7056c6a2d893d80db18d06d7e730d6515aaae8",
+        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758035966,
-        "narHash": "sha256-qqIJ3yxPiB0ZQTT9//nFGQYn8X/PBoJbofA7hRKZnmE=",
+        "lastModified": 1759422813,
+        "narHash": "sha256-WNkZqscW/dPLK5NMKH/jCkYMaVm/3KWgPmKMq65IXxk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8d4ddb19d03c65a36ad8d189d001dc32ffb0306b",
+        "rev": "2a7c84e1e740f004e0fe5c2577a63d1e659a496c",
         "type": "github"
       },
       "original": {

From 62533d435b9d86cf0c1271cd0a14ed73a67584f2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:18:38 +0000
Subject: [PATCH 60/82] home: vim: lspconfig: use native configuration

The `nvim-lspconfig` "framework" is being deprecated to use the native
`vim.lsp.config` and `vim.lsp.enable` functionality.

I _could_ remove the `is_executable` checks, as native LSP handling does
_not_ loudly error out when enabling a server which isn't executable.
However I think `:LspInfo` is more readable if I don't.
---
 .../home/vim/plugin/settings/lspconfig.lua    | 57 ++++++-------------
 1 file changed, 17 insertions(+), 40 deletions(-)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 7817d4c..68158b2 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -1,4 +1,3 @@
-local lspconfig = require("lspconfig")
 local lsp = require("ambroisie.lsp")
 local utils = require("ambroisie.utils")
 
@@ -25,59 +24,45 @@ vim.diagnostic.config({
 -- Inform servers we are able to do completion, snippets, etc...
 local capabilities = require("cmp_nvim_lsp").default_capabilities()
 
+-- Shared configuration
+vim.lsp.config("*", {
+    capabilities = capabilities,
+    on_attach = lsp.on_attach,
+})
+
 -- C/C++
 if utils.is_executable("clangd") then
-    lspconfig.clangd.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("clangd")
 end
 
 -- Haskell
 if utils.is_executable("haskell-language-server-wrapper") then
-    lspconfig.hls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("hls")
 end
 
 -- Nix
 if utils.is_executable("nil") then
-    lspconfig.nil_ls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("nil_ls")
 end
 
 -- Python
 if utils.is_executable("pyright") then
-    lspconfig.pyright.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("pyright")
 end
 
 if utils.is_executable("ruff") then
-    lspconfig.ruff.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("ruff")
 end
 
 -- Rust
 if utils.is_executable("rust-analyzer") then
-    lspconfig.rust_analyzer.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("rust_analyzer")
 end
 
 -- Shell
 if utils.is_executable("bash-language-server") then
-    lspconfig.bashls.setup({
+    vim.lsp.config("bashls", {
         filetypes = { "bash", "sh", "zsh" },
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
         settings = {
             bashIde = {
                 shfmt = {
@@ -89,27 +74,19 @@ if utils.is_executable("bash-language-server") then
             },
         },
     })
+    vim.lsp.enable("bashls")
 end
 
 -- Starlark
 if utils.is_executable("starpls") then
-    lspconfig.starpls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("starpls")
 end
 
 -- Generic
 if utils.is_executable("harper-ls") then
-    lspconfig.harper_ls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("harper_ls")
 end
 
 if utils.is_executable("typos-lsp") then
-    lspconfig.typos_lsp.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
+    vim.lsp.enable("typos_lsp")
 end

From 6b1b5300cdc275422e1eab5cdc24b7f6f6798d1b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 3 Oct 2025 12:39:18 +0000
Subject: [PATCH 61/82] home: vim: lspconfig: simplify LSP config

Despite what I just said in the previous commit, I decided to remove the
`is_executable` checks and always enable all servers.

I figured out that NeoVim actually handles `PATH` modifications pretty
well in this scenario: making a previously unavailable server executable
will automatically enable it.
---
 .../home/vim/plugin/settings/lspconfig.lua    | 73 +++++++------------
 1 file changed, 26 insertions(+), 47 deletions(-)

diff --git a/modules/home/vim/plugin/settings/lspconfig.lua b/modules/home/vim/plugin/settings/lspconfig.lua
index 68158b2..1596e84 100644
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@@ -30,38 +30,20 @@ vim.lsp.config("*", {
     on_attach = lsp.on_attach,
 })
 
--- C/C++
-if utils.is_executable("clangd") then
-    vim.lsp.enable("clangd")
-end
-
--- Haskell
-if utils.is_executable("haskell-language-server-wrapper") then
-    vim.lsp.enable("hls")
-end
-
--- Nix
-if utils.is_executable("nil") then
-    vim.lsp.enable("nil_ls")
-end
-
--- Python
-if utils.is_executable("pyright") then
-    vim.lsp.enable("pyright")
-end
-
-if utils.is_executable("ruff") then
-    vim.lsp.enable("ruff")
-end
-
--- Rust
-if utils.is_executable("rust-analyzer") then
-    vim.lsp.enable("rust_analyzer")
-end
-
--- Shell
-if utils.is_executable("bash-language-server") then
-    vim.lsp.config("bashls", {
+local servers = {
+    -- C/C++
+    clangd = {},
+    -- Haskell
+    hls = {},
+    -- Nix
+    nil_ls = {},
+    -- Python
+    pyright = {},
+    ruff = {},
+    -- Rust
+    rust_analyzer = {},
+    -- Shell
+    bashls = {
         filetypes = { "bash", "sh", "zsh" },
         settings = {
             bashIde = {
@@ -73,20 +55,17 @@ if utils.is_executable("bash-language-server") then
                 },
             },
         },
-    })
-    vim.lsp.enable("bashls")
-end
+    },
+    -- Starlark
+    starpls = {},
+    -- Generic
+    harper_ls = {},
+    typos_lsp = {},
+}
 
--- Starlark
-if utils.is_executable("starpls") then
-    vim.lsp.enable("starpls")
-end
-
--- Generic
-if utils.is_executable("harper-ls") then
-    vim.lsp.enable("harper_ls")
-end
-
-if utils.is_executable("typos-lsp") then
-    vim.lsp.enable("typos_lsp")
+for server, config in pairs(servers) do
+    if not vim.tbl_isempty(config) then
+        vim.lsp.config(server, config)
+    end
+    vim.lsp.enable(server)
 end

From 2df05aaa1a2f85601df107f16bfec70b9239eab4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:33:49 +0000
Subject: [PATCH 62/82] flake: bump inputs

And fix a breaking change leading to an evaluation failure.
---
 flake.lock                                 | 36 +++++++++++-----------
 modules/nixos/services/homebox/default.nix |  2 +-
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1889e0c..1a8a934 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1760836749,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759362264,
-        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
+        "lastModified": 1760948891,
+        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
+        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758108966,
-        "narHash": "sha256-ytw7ROXaWZ7OfwHrQ9xvjpUWeGVm86pwnEd1QhzawIo=",
+        "lastModified": 1760663237,
+        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "54df955a695a84cd47d4a43e08e1feaf90b1fd9b",
+        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759337100,
-        "narHash": "sha256-CcT3QvZ74NGfM+lSOILcCEeU+SnqXRvl1XCRHenZ0Us=",
+        "lastModified": 1760969583,
+        "narHash": "sha256-vsf5mvR0xxK4GsfLx5bMJAQ4ysdrKymMIifNw+4TP7g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "004753ae6b04c4b18aa07192c1106800aaacf6c3",
+        "rev": "c9d758b500e53db5b74aa02d17dc45b65229e8e9",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759422813,
-        "narHash": "sha256-WNkZqscW/dPLK5NMKH/jCkYMaVm/3KWgPmKMq65IXxk=",
+        "lastModified": 1760878510,
+        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2a7c84e1e740f004e0fe5c2577a63d1e659a496c",
+        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
         "type": "github"
       },
       "original": {
@@ -200,11 +200,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1753980880,
-        "narHash": "sha256-aj1pbYxL6N+XFqBHjB4B1QP0bnKRcg1AfpgT5zUFsW8=",
+        "lastModified": 1759781536,
+        "narHash": "sha256-v/X5gKmgVoGtu5elYyUu2w037PyWVhrqnWzXkLJ9xnY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "16db3e61da7606984a05b4dfc33cd1d26d22fb22",
+        "rev": "c30a53a5947bcc874b3f8842e6fe5c34bc81d8dd",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
index 8ed5d77..524a6d7 100644
--- a/modules/nixos/services/homebox/default.nix
+++ b/modules/nixos/services/homebox/default.nix
@@ -39,7 +39,7 @@ in
 
     my.services.backup = {
       paths = [
-        config.services.homebox.settings.HBOX_STORAGE_DATA
+        (lib.removePrefix "file://" config.services.homebox.settings.HBOX_STORAGE_CONN_STRING)
       ];
     };
 

From 9ddc77958ab4c647df7173a3a5eee08ae88f926b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:35:02 +0000
Subject: [PATCH 63/82] home: git: fix deprecated config

---
 modules/home/git/default.nix | 38 +++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index ca59a5f..c3a51a0 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -21,29 +21,31 @@ in
   config.programs.git = lib.mkIf cfg.enable {
     enable = true;
 
-    # Who am I?
-    userEmail = mkMailAddress "bruno" "belanyi.fr";
-    userName = "Bruno BELANYI";
-
     inherit (cfg) package;
 
-    aliases = {
-      git = "!git";
-      lol = "log --graph --decorate --pretty=oneline --abbrev-commit --topo-order";
-      lola = "lol --all";
-      assume = "update-index --assume-unchanged";
-      unassume = "update-index --no-assume-unchanged";
-      assumed = "!git ls-files -v | grep ^h | cut -c 3-";
-      pick = "log -p -G";
-      push-new = "!git push -u origin "
-        + ''"$(git branch | grep '^* ' | cut -f2- -d' ')"'';
-      root = "git rev-parse --show-toplevel";
-    };
-
     lfs.enable = true;
 
     # There's more
-    extraConfig = {
+    settings = {
+      # Who am I?
+      user = {
+        email = mkMailAddress "bruno" "belanyi.fr";
+        name = "Bruno BELANYI";
+      };
+
+      alias = {
+        git = "!git";
+        lol = "log --graph --decorate --pretty=oneline --abbrev-commit --topo-order";
+        lola = "lol --all";
+        assume = "update-index --assume-unchanged";
+        unassume = "update-index --no-assume-unchanged";
+        assumed = "!git ls-files -v | grep ^h | cut -c 3-";
+        pick = "log -p -G";
+        push-new = "!git push -u origin "
+          + ''"$(git branch | grep '^* ' | cut -f2- -d' ')"'';
+        root = "git rev-parse --show-toplevel";
+      };
+
       # Makes it a bit more readable
       blame = {
         coloring = "repeatedLines";

From 4000a848ef21903b7d593160b509173c2fe81736 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 20 Oct 2025 09:39:19 +0000
Subject: [PATCH 64/82] home: delta: use upstream module

---
 modules/home/delta/default.nix | 42 +++++-----------------------------
 1 file changed, 6 insertions(+), 36 deletions(-)

diff --git a/modules/home/delta/default.nix b/modules/home/delta/default.nix
index 16d3d59..e76edc6 100644
--- a/modules/home/delta/default.nix
+++ b/modules/home/delta/default.nix
@@ -1,9 +1,6 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.my.home.delta;
-
-  configFormat = pkgs.formats.gitIni { };
-  configPath = "${config.xdg.configHome}/delta/config";
 in
 {
   options.my.home.delta = with lib; {
@@ -17,28 +14,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        # For its configuration
-        assertion = cfg.enable -> cfg.git.enable;
-        message = ''
-          `config.my.home.delta` must enable `config.my.home.delta.git` to be
-          properly configured.
-        '';
-      }
-      {
-        assertion = cfg.enable -> config.programs.git.enable;
-        message = ''
-          `config.my.home.delta` relies on `config.programs.git` to be
-          enabled.
-        '';
-      }
-    ];
+    programs.delta = {
+      enable = true;
 
-    home.packages = [ cfg.package ];
+      inherit (cfg) package;
 
-    xdg.configFile."delta/config".source = configFormat.generate "delta-config" {
-      delta = {
+      enableGitIntegration = cfg.git.enable;
+
+      options = {
         features = "diff-highlight decorations";
 
         # Less jarring style for `diff-highlight` emulation
@@ -62,18 +45,5 @@ in
         };
       };
     };
-
-    programs.git = lib.mkIf cfg.git.enable {
-      delta = {
-        enable = true;
-        inherit (cfg) package;
-      };
-
-      includes = [
-        {
-          path = configPath;
-        }
-      ];
-    };
   };
 }

From a20c8f820dcf77e0b0a75c67d2edf38d97488ba2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 27 Oct 2025 12:30:49 +0000
Subject: [PATCH 65/82] flake: bump inputs

---
 flake.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 1a8a934..f56e8f2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760969583,
-        "narHash": "sha256-vsf5mvR0xxK4GsfLx5bMJAQ4ysdrKymMIifNw+4TP7g=",
+        "lastModified": 1761530345,
+        "narHash": "sha256-+9+YCK9Lh6GThkXu/8JTxMFUnImIdZpb8ElUh6/F5Y8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c9d758b500e53db5b74aa02d17dc45b65229e8e9",
+        "rev": "bbaeb9f1c29e79bb1653b32c3d73244cdf4bd888",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760878510,
-        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
+        "lastModified": 1761373498,
+        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
+        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
         "type": "github"
       },
       "original": {

From c536ee0136969aa1715e07939dfac9b02342f60d Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 27 Oct 2025 12:31:12 +0000
Subject: [PATCH 66/82] home: zsh: add 'zsh-completion-sync'

It's gated behind `completionSync.enable`, as it does make
entering/leaving direnv-enabled projects slower (due to the calls to
`compinit`).

This might need a bit more work to avoid multiple `compinit`s at shell
startup, will refine in the future if necessary.
---
 modules/home/zsh/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 3c1e515..6c6a469 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -8,6 +8,10 @@ in
 
     launchTmux = mkEnableOption "auto launch tmux at shell start";
 
+    completionSync = {
+      enable = mkEnableOption "zsh-completion-sync plugin";
+    };
+
     notify = {
       enable = mkEnableOption "zsh-done notification";
 
@@ -118,6 +122,18 @@ in
       };
     }
 
+    (lib.mkIf cfg.completionSync.enable {
+      programs.zsh = {
+        plugins = [
+          {
+            name = "zsh-completion-sync";
+            file = "share/zsh-completion-sync/zsh-completion-sync.plugin.zsh";
+            src = pkgs.zsh-completion-sync;
+          }
+        ];
+      };
+    })
+
     (lib.mkIf cfg.notify.enable {
       programs.zsh = {
         plugins = [

From 983bf0f7646ea2ebdff895751eea7054b9140b3a Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 3 Nov 2025 17:22:29 +0100
Subject: [PATCH 67/82] nixos: services: nextcloud: bump to 32

---
 modules/nixos/services/nextcloud/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index d8d4fce..dd3b386 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -35,7 +35,7 @@ in
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       enable = true;
-      package = pkgs.nextcloud31;
+      package = pkgs.nextcloud32;
       hostName = "nextcloud.${config.networking.domain}";
       home = "/var/lib/nextcloud";
       maxUploadSize = cfg.maxSize;

From 41c506749ef389c9a2f11dd3f3d17493892820f2 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 14:39:11 +0000
Subject: [PATCH 68/82] flake: overlays: use 'lib'

It's a `lib` function, not _really_ a Nixpkgs one.

Also it's about to break after the next flake update :-).
---
 flake/overlays.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake/overlays.nix b/flake/overlays.nix
index 0c47989..c10afc3 100644
--- a/flake/overlays.nix
+++ b/flake/overlays.nix
@@ -1,4 +1,4 @@
-{ self, ... }:
+{ self, lib, ... }:
 let
   default-overlays = import "${self}/overlays";
 
@@ -8,7 +8,7 @@ let
 
     # Expose my custom packages
     pkgs = _final: prev: {
-      ambroisie = prev.recurseIntoAttrs (import "${self}/pkgs" { pkgs = prev; });
+      ambroisie = lib.recurseIntoAttrs (import "${self}/pkgs" { pkgs = prev; });
     };
   };
 in

From 44246b4ea146b1ca7b4687b35e0b833decb35b89 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 8 Nov 2025 11:56:25 +0000
Subject: [PATCH 69/82] flake: NUR has renamed its branch to 'main'

---
 flake.lock | 2 +-
 flake.nix  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.lock b/flake.lock
index f56e8f2..50f38e4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -209,7 +209,7 @@
       },
       "original": {
         "owner": "nix-community",
-        "ref": "master",
+        "ref": "main",
         "repo": "NUR",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 5076729..0bdd180 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,7 +54,7 @@
       type = "github";
       owner = "nix-community";
       repo = "NUR";
-      ref = "master";
+      ref = "main";
       inputs = {
         flake-parts.follows = "flake-parts";
         nixpkgs.follows = "nixpkgs";

From fe681d3f16eea4d87d55d02c1e8e915eaaf415e6 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 14:35:53 +0000
Subject: [PATCH 70/82] flake: bump inputs

---
 flake.lock | 54 ++++++++++++++++--------------------------------------
 1 file changed, 16 insertions(+), 38 deletions(-)

diff --git a/flake.lock b/flake.lock
index 50f38e4..d95de52 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760836749,
-        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "lastModified": 1761656077,
+        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",
+        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "lastModified": 1762040540,
+        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "0010412d62a25d959151790968765a70c436598b",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761530345,
-        "narHash": "sha256-+9+YCK9Lh6GThkXu/8JTxMFUnImIdZpb8ElUh6/F5Y8=",
+        "lastModified": 1762435363,
+        "narHash": "sha256-BTmHXtuuwVO1dRs6jPHcHCoO6+A7G3+GzrgeluiSkww=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bbaeb9f1c29e79bb1653b32c3d73244cdf4bd888",
+        "rev": "432bc8a5da66638b5f139588efd6c4bd327e4cdc",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1761373498,
-        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
+        "lastModified": 1762111121,
+        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
+        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
         "type": "github"
       },
       "original": {
@@ -196,15 +196,14 @@
         ],
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
+        ]
       },
       "locked": {
-        "lastModified": 1759781536,
-        "narHash": "sha256-v/X5gKmgVoGtu5elYyUu2w037PyWVhrqnWzXkLJ9xnY=",
+        "lastModified": 1762602346,
+        "narHash": "sha256-BVzjmS25ihrfnfpfLD6gzXqMp9vP0hOyjIWkV0LP6E0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c30a53a5947bcc874b3f8842e6fe5c34bc81d8dd",
+        "rev": "fe5118da8d7e09651e0362ff130d194bc1441185",
         "type": "github"
       },
       "original": {
@@ -241,27 +240,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

From 0ac983a71f8cec556babe577e65b513173143417 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 9 Oct 2025 10:47:23 +0000
Subject: [PATCH 71/82] home: vim: do not set 'background' explicitly

Rely on the new behaviour from v0.10 which detects it more
intelligently.
---
 modules/home/vim/init.vim | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/modules/home/vim/init.vim b/modules/home/vim/init.vim
index 39ef32e..1142925 100644
--- a/modules/home/vim/init.vim
+++ b/modules/home/vim/init.vim
@@ -81,9 +81,6 @@ set updatetime=250
 " Disable all mouse integrations
 set mouse=
 
-" Set dark mode by default
-set background=dark
-
 " Setup some overrides for gruvbox
 lua << EOF
 local gruvbox = require("gruvbox")

From bbdbc1e55cb8b2125b2ece2ff1c9d4c5922d821b Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Tue, 28 Oct 2025 12:43:53 +0000
Subject: [PATCH 72/82] home: vim: ftdetect: remove glsl

GLSL is now correctly detected starting with v0.11.

This reverts commit b8b64bed8e4b3d8d109e7dcf38f69a4242142ec3.
---
 modules/home/vim/ftdetect/glsl.lua | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 modules/home/vim/ftdetect/glsl.lua

diff --git a/modules/home/vim/ftdetect/glsl.lua b/modules/home/vim/ftdetect/glsl.lua
deleted file mode 100644
index 2f4f1dd..0000000
--- a/modules/home/vim/ftdetect/glsl.lua
+++ /dev/null
@@ -1,7 +0,0 @@
--- Use GLSL filetype for common shader file extensions
-vim.filetype.add({
-    extension = {
-        frag = "glsl",
-        vert = "glsl",
-    },
-})

From 6e73c936b09d46c8427963b5139588804aceddaa Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Fri, 7 Nov 2025 14:48:49 +0000
Subject: [PATCH 73/82] home: zsh: fix plug-in path

The upstream commit [1] said it was a non-breaking change, but didn't
actually setup the symlinks for this package...

[1]: 10f01ded353d5a76c6acbecaa0ac5e5063f60c13
---
 modules/home/zsh/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/home/zsh/default.nix b/modules/home/zsh/default.nix
index 6c6a469..9524262 100644
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@@ -72,7 +72,7 @@ in
         plugins = [
           {
             name = "fast-syntax-highlighting";
-            file = "share/zsh/site-functions/fast-syntax-highlighting.plugin.zsh";
+            file = "share/zsh/plugins/fast-syntax-highlighting/fast-syntax-highlighting.plugin.zsh";
             src = pkgs.zsh-fast-syntax-highlighting;
           }
           {

From 1b4111e28fc68d5b4592f3238854ba1164443c7e Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 8 Nov 2025 22:12:42 +0100
Subject: [PATCH 74/82] nixos: services: nextcloud: use declarative apps

Now that the `notify_push` module declaratively installs _its_ app [1],
I should declaratively install _all_ apps.

[1]: https://github.com/NixOS/nixpkgs/pull/451501
---
 modules/nixos/services/nextcloud/collabora.nix |  6 ++++++
 modules/nixos/services/nextcloud/default.nix   | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/modules/nixos/services/nextcloud/collabora.nix b/modules/nixos/services/nextcloud/collabora.nix
index f8f42a7..408b232 100644
--- a/modules/nixos/services/nextcloud/collabora.nix
+++ b/modules/nixos/services/nextcloud/collabora.nix
@@ -16,6 +16,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.nextcloud = {
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps) richdocuments;
+      };
+    };
+
     services.collabora-online = {
       enable = true;
       inherit (cfg) port;
diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index dd3b386..24515ff 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -62,6 +62,16 @@ in
         # Allow using the push service without hard-coding my IP in the configuration
         bendDomainToLocalhost = true;
       };
+
+      extraApps = {
+        inherit (config.services.nextcloud.package.packages.apps)
+          calendar
+          contacts
+          deck
+          tasks
+          ;
+        # notify_push is automatically installed by the module
+      };
     };
 
     # The service above configures the domain, no need for my wrapper

From 6124d07c1b846d316e03e78a3cb65a77ce2e9832 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:35:54 +0100
Subject: [PATCH 75/82] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index d95de52..b041409 100644
--- a/flake.lock
+++ b/flake.lock
@@ -14,11 +14,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761656077,
-        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762040540,
-        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
+        "lastModified": 1762980239,
+        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0010412d62a25d959151790968765a70c436598b",
+        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1760663237,
-        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "lastModified": 1763319842,
+        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762435363,
-        "narHash": "sha256-BTmHXtuuwVO1dRs6jPHcHCoO6+A7G3+GzrgeluiSkww=",
+        "lastModified": 1763313531,
+        "narHash": "sha256-yvdCYUL85zEDp2NzPUBmaNBXP6KnWEOhAk3j7PTfsKw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "432bc8a5da66638b5f139588efd6c4bd327e4cdc",
+        "rev": "3670a78eee49deebe4825fc8ecc46b172d1a8391",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762111121,
-        "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",
+        "lastModified": 1763283776,
+        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",
+        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762602346,
-        "narHash": "sha256-BVzjmS25ihrfnfpfLD6gzXqMp9vP0hOyjIWkV0LP6E0=",
+        "lastModified": 1763378400,
+        "narHash": "sha256-9eZj8GNTBYnI8PQf9n8m9XbFCA/ugQ5r7sylY9DEx9M=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "fe5118da8d7e09651e0362ff130d194bc1441185",
+        "rev": "6bd477535ba71aa22d2712c8735c92812a1c74dc",
         "type": "github"
       },
       "original": {

From ad6a0bf4d3e5c5914160b2f427ef153d534b1030 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Thu, 6 Nov 2025 22:36:18 +0100
Subject: [PATCH 76/82] nixos: services: mealie: extend session timeout

---
 modules/nixos/services/mealie/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 8c02398..837bff2 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -32,6 +32,7 @@ in
         BASE_URL = "https://mealie.${config.networking.domain}";
         TZ = config.time.timeZone;
         ALLOw_SIGNUP = "false";
+        TOKEN_TIME = 24 * 180; # 180 days
       };
 
       # Automatic PostgreSQL provisioning

From 127e26b259624c6a57bc839abdde4f245c3099b8 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:38:30 +0100
Subject: [PATCH 77/82] nixos: services: transmission: use high file limit

Seeding a lot of files means keeping them all open.

The actual limit was cargo-culted from an open issue.
---
 modules/nixos/services/transmission/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index ddd77d4..2ed01fd 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -71,10 +71,12 @@ in
       };
     };
 
-    # Transmission wants to eat *all* my RAM if left to its own devices
     systemd.services.transmission = {
       serviceConfig = {
+        # Transmission wants to eat *all* my RAM if left to its own devices
         MemoryMax = "33%";
+        # Avoid errors due to high number of open files.
+        LimitNOFILE = 1048576;
       };
     };
 

From b37bde6eaf150033149d0bbd5d924d0f9fb4b145 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 12:45:22 +0100
Subject: [PATCH 78/82] nixos: services: transmission: use longer timeout

It looks like Transmission takes time roughly proportional with the
number of open files to stop, so let's increase the timeout slightly.
---
 modules/nixos/services/transmission/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index 2ed01fd..6a7fbc7 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -77,6 +77,8 @@ in
         MemoryMax = "33%";
         # Avoid errors due to high number of open files.
         LimitNOFILE = 1048576;
+        # Longer stop timeout to finish all torrents
+        TimeoutStopSec = "5m";
       };
     };
 

From 29fb7c5066132e12b98a6cb7a7f9ba3c5460d8c1 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 17 Nov 2025 13:57:48 +0000
Subject: [PATCH 79/82] home: discord: use upstream module

---
 modules/home/discord/default.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/modules/home/discord/default.nix b/modules/home/discord/default.nix
index bfa5d40..f9892df 100644
--- a/modules/home/discord/default.nix
+++ b/modules/home/discord/default.nix
@@ -1,8 +1,6 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.my.home.discord;
-
-  jsonFormat = pkgs.formats.json { };
 in
 {
   options.my.home.discord = with lib; {
@@ -12,14 +10,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      cfg.package
-    ];
+    programs.discord = {
+      enable = true;
 
-    xdg.configFile."discord/settings.json".source =
-      jsonFormat.generate "discord.json" {
+      inherit (cfg) package;
+
+      settings = {
         # Do not keep me from using the app just to force an update
         SKIP_HOST_UPDATE = true;
       };
+    };
   };
 }

From 3020c6433b0056aa805cdabd8d4c30f82cfb47e4 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 30 Nov 2025 00:20:07 +0100
Subject: [PATCH 80/82] flake: bump inputs

---
 flake.lock | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/flake.lock b/flake.lock
index b041409..b84e16d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -53,11 +53,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762980239,
-        "narHash": "sha256-8oNVE8TrD19ulHinjaqONf9QWCKK+w4url56cdStMpM=",
+        "lastModified": 1763759067,
+        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "52a2caecc898d0b46b2b905f058ccc5081f842da",
+        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
         "type": "github"
       },
       "original": {
@@ -117,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763319842,
-        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763313531,
-        "narHash": "sha256-yvdCYUL85zEDp2NzPUBmaNBXP6KnWEOhAk3j7PTfsKw=",
+        "lastModified": 1764361670,
+        "narHash": "sha256-jgWzgpIaHbL3USIq0gihZeuy1lLf2YSfwvWEwnfAJUw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3670a78eee49deebe4825fc8ecc46b172d1a8391",
+        "rev": "780be8ef503a28939cf9dc7996b48ffb1a3e04c6",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763283776,
-        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
+        "lastModified": 1764242076,
+        "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
+        "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763378400,
-        "narHash": "sha256-9eZj8GNTBYnI8PQf9n8m9XbFCA/ugQ5r7sylY9DEx9M=",
+        "lastModified": 1764449851,
+        "narHash": "sha256-VnodC1+3KML8MYLLnK84E6U2Fz4ioNacOeQd1pMCSTw=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "6bd477535ba71aa22d2712c8735c92812a1c74dc",
+        "rev": "b1781c0aa8935d8d1f35d228bcc7127fcebcd363",
         "type": "github"
       },
       "original": {

From f546f85037bf23f105a721132f06ab3a562d38f7 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 22 Nov 2025 23:34:06 +0100
Subject: [PATCH 81/82] hosts: nixos: porthos: secrets: sso: remove owner

Now that the service uses `LoadCredential` [1], I can make the files
root-owned.

[1]: https://github.com/NixOS/nixpkgs/pull/460305
---
 hosts/nixos/porthos/secrets/secrets.nix | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix
index b3812b4..f1842b4 100644
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@@ -83,18 +83,9 @@ in
   "servarr/autobrr/session-secret.age".publicKeys = all;
   "servarr/cross-seed/configuration.json.age".publicKeys = all;
 
-  "sso/auth-key.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/password-hash.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/totp-secret.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
+  "sso/auth-key.age".publicKeys = all;
+  "sso/ambroisie/password-hash.age".publicKeys = all;
+  "sso/ambroisie/totp-secret.age".publicKeys = all;
 
   "tandoor-recipes/secret-key.age".publicKeys = all;
 

From 5cd9155a5838d54c3606f6b0851e54252ea0774c Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sun, 23 Nov 2025 17:08:35 +0100
Subject: [PATCH 82/82] nixos: services: mealie: backup state directory

Somehow forgot to do this when first writing the module.
---
 modules/nixos/services/mealie/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 837bff2..f3774e1 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -54,6 +54,12 @@ in
       };
     };
 
+    my.services.backup = {
+      paths = [
+        "/var/lib/mealie"
+      ];
+    };
+
     services.fail2ban.jails = {
       mealie = ''
         enabled = true