Hosts now accept only the two CanoKeys' resident SSH keys for ryan, plus the romantic recovery key for root; per-host user keys stop working. Darwin builds work again: the shared base no longer sets nixpkgs.config next to nix-darwin's nixpkgs.pkgs.
Assisted-by: DeepSeek Harness (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)
Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.
- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
authfile built from myvars.canokeyU2fKeys; the primary key is
registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
recovery; deduplicate the FIDO notes left by #515.
Assisted-by: Claude Code (claude-opus-5-5)
Vinput's streaming Zipformer models have unbounded dynamic shapes, so
OpenVINO cannot compile them for the GPU or the NPU; the `openvino`
provider and ai's Intel NPU enablement could never run on the NPU (noted
as unverified in WORKAROUNDS WA-017). Remove the backend option, the
daemon's OpenVINO library path, and the intel-npu module enable, and
update the eval test, README and WORKAROUNDS (drop WA-016 and WA-017).
Keep Vinput's stock package and its bundled sherpa-onnx (1.13.4): the
fork-based and nixpkgs-master sherpa overrides existed only to provide the
`openvino` provider, so drop package.nix with them.
Assisted-by: opencode (DeepSeek V4.1 Flash)
Replace the static hypridle.conf with services.hypridle.settings and add required timeout options so each host tunes its own values:
- idols-ai (PC): 15 min keyboard, 20 min screen-off, 30 min lock.
- 12kingdoms-shoukei (laptop): 3 / 6 / 20 min (previous values).
The options have no defaults because the right values depend on the machine. Update the home-manager eval test to inspect the settings option instead of the old config file text.
Desktop speakers on idols-ai use the EBU R128 broadcast standard (-23 dB), while the quiet built-in laptop speakers on 12kingdoms-shoukei keep -12 dB. Move the target out of the shared preset so each host sets its own value.
- render Niri on the Intel iGPU while retaining NVIDIA-connected physical outputs
- encode Sunshine streams with Intel VAAPI and wait for a Niri output before startup
- load VKMS persistently for headless sessions and configure `Virtual-1` at 2560x1600@60
- let Moonlight request the stream bitrate instead of enforcing a 20 Mbps host cap
- remove unsupported Dynamic Boost and global NVIDIA session overrides
- grant Sunshine access to virtual input devices
- add a Nushell recovery helper that starts a temporary greetd/Niri session from SSH
- identify and safely replace normal, standalone, or previous transient Niri sessions
- launch the transient service in the background and verify greetd, Niri, and Sunshine before returning
- ignore local `.worktrees` directories and keep eval regression coverage focused on structural behavior
Explicitly set programs.nixvim.nixpkgs.source to suppress the follows
warning, and migrate all programs.ssh.matchBlocks to programs.ssh.settings
using upstream PascalCase directive names.
ryan4yin | 二花
Ryan Yin