Aquamarine's services now run directly on kubevirt-youko, so the guest
definition is no longer needed:
- move its service modules to hosts/k8s/kubevirt-youko/aquamarine/ and
drop the explicit import list, leaving aquamarine-services.nix with
just its IP and secret groups
- delete the guest base, journald override, output entry and home config
- repoint the eval tests that read the guest's config to kubevirt-youko
- drop the now-dead 'aqua' colmena recipe and its image upload
The aqua KubeVirt VM itself is deleted separately; the name is kept in
the docs for a possible later test microvm/qemu-vm on idols-ai.
shoukei is a laptop using DHCP and never consumes hostsAddr.shoukei.
Its 192.168.5.108 collided with k3s-prod-1-master-1 and produced a wrong
ssh Host shoukei entry.
The Settings UI stored `theme.mode` in ~/.local/state/noctalia/settings.toml, so it was not versioned. Pin it in the config baseline; the [location] sunrise/sunset schedule still drives light/dark.
At background_opacity 0.2 the light-mode surface disappears into dark wallpapers, so the dark light-mode text sits on a dark bar. Raise it to 0.61 to keep contrast while staying slightly translucent.
`programs.noctalia.settings` deploys the TOML as a store symlink, so every edit needs a `home-manager switch`. Deploy the baseline from the config layer with `mkOutOfStoreSymlink` instead: Noctalia hot-reloads config-layer files and never rewrites them, so edits apply live while Settings UI changes stay in ~/.local/state/noctalia/settings.toml (which loads last) and out of the repo.
Update the docs and host-specific comments to match the two-layer model.
The sandbox remaps XDG_DATA_HOME/XDG_CONFIG_HOME, so paths Firefox exposes to
or shares with the host ended up isolated. Bind the MPRIS artwork dir and the
real trash rw, and mimeapps.list, user-dirs.dirs and the shared NSS cert store
ro.
recently-used.xbel stays isolated: GTK writes it atomically, which a
single-file rw bind would break.
Add cpu, ram, disk and network up/down sysmon widgets to the bar start lane,
matching the old v4 SystemMonitor. Set the clock to ISO date, full English
weekday and 24h time (e.g. "2026-09-19 Saturday 16:06").
English stays the default (LANG=en_US.UTF-8). Drop the Chinese overrides for
LC_TIME, LC_NUMERIC, LC_ADDRESS, LC_NAME, LC_TELEPHONE and LC_IDENTIFICATION:
LC_NUMERIC matches en_US, the others are effectively unused, and LC_TIME forced
Chinese date and weekday names.
Keep zh_CN only where the en_US default is wrong for China: metric units, A4
paper and CNY.
Refresh the repository overview after the move to Noctalia v5:
- fix the component table: Noctalia as the desktop shell, native screenshots, systemd-networkd/NetworkManager, Zed & VS Code as GUI editors, Zellij as a multiplexer
- correct the deploy instructions (niri hosts use 'just niri'; 'just local' matches the bare hostname) and the Nvidia link
- update the NixOS badge to 26.11 and add a short validation section
- root README: VS Code config moved from home/linux/gui/base/editors.nix to vscode.nix
- READMEs now list both GUI editors (Zed, the primary one, plus VS Code)
- base README: xdg is a directory now, nvidia.nix no longer exists, editors.nix -> vscode.nix
- idols-ai README: disko-fs-media.nix -> disko-fs-data.nix (/persistent/data)
- secrets README: password-store moved from home/base/desktop to home/base/tui
- drop unused link definitions (AstroNvim, wl-clipboard, Catppuccin)
- fix a pre-existing typo flagged by the typos hook (keeped -> kept)
Noctalia v5 is the native C++/Wayland rewrite; the Quickshell-based v4 line (pkgs.noctalia-shell) is EOL and its JSON config is not migrated upstream.
- use the upstream home-manager programs.noctalia module (present at our pinned HM revision) instead of the hand-rolled package + symlink module: it installs pkgs.noctalia, validates config.toml at build time via checkConfig, and supports customPalettes; drop the v4 Qt/Qt6ct session setup
- replace the v4 settings.json/plugins.json with a minimal shared config.toml (font, Catppuccin shell palette, templates off, screenshot annotation, accessibility/bar scale, night light, wallpaper, location/weather); host-specific bits live in per-host files (shoukei's eDP-1 backlight in noctalia/host-shoukei.toml), which merge after config.toml. Application theming stays with catppuccin/nix
- treat config.toml as the single source of truth: do NOT persist ~/.local/state/noctalia and set setup_wizard_enabled = false, so UI tweaks are promoted back into the repo instead of accumulating in app-owned state
- port niri keybinds to 'noctalia msg ...', update spawn-at-startup and the backdrop layer namespace, fix the broken 'octalia-shell' media-previous bind, and replace the grim/slurp/satty screenshot stack with Noctalia's native region/fullscreen/annotate commands (drop the unused packages)
- drop the now-redundant swaybg and swaylock (Noctalia owns the wallpaper and lock screen, the latter authenticating against the PAM 'login' service) and its PAM entry; keep wlogout as an emergency fallback
- update hypridle's lock commands and the matching eval test
- refresh the noctalia docs
networkd enables systemd-resolved by default, and resolved's own mDNS responder conflicts with avahi (duplicate answers, avahi logs 'Detected another mDNS stack running on this host'). Keep avahi for DNS-SD (cups-browsed depends on it) and turn resolved's mDNS off.
home.sessionVariables writes export NAME="value" without escaping embedded double quotes, so the JSON {"share":"disabled"} reached opencode as the shell word {share:disabled} and failed config parsing. Emit the export with sessionVariablesExtra instead.
The 2026-09 nixpkgs update changed DRM probe order, renaming the Intel connectors DP-1 -> DP-4 and HDMI-A-2 -> HDMI-A-3. The connector-name based output and open-on-output rules stopped matching, which dropped monitor scale/mode/position and sent every named workspace to the first output. Match by make/model/serial instead, which is stable across connector renumbering.
Tencent replaced the file behind the versionless CDN URLs, so the pinned hashes stopped matching. Refresh the x86_64 and aarch64 hashes with nix store prefetch-file.
trash-empty lacked Persistent=true, so a host that was off or suspended at the scheduled time never ran the purge and trash retention silently stopped.
Guix was enabled on every desktop host, but shoukei had no /gnu mount (store and state lived on the tmpfs root) and it was not used. Drop the module, the modules.guix option, the @guix subvolume and the /var/guix preservation entry.
The restic job needs three agenix secrets that do not exist yet (restic-password, ssh-key-for-restic-backup and an rclone config for the smb-downloads remote). Comment it out until they are provisioned so it does not fail silently every night.
Load both *.yml and *.yaml alert rule files: the Loki rules were named .yaml while only *.yml was loaded, so they silently never ran. Fix the Grafana domain typo (writefo.fun -> writefor.fun). Comment out the postgres-playground datasource, which used the Grafana admin password for a role that has no password and could never authenticate.
checks.<system>.eval-tests returned a boolean, so nix flake check failed with "not a derivation". Wrap the evalTests result in a runCommand so flake check actually evaluates it.
RTK compresses only shell output and independent evaluations show little to no end-to-end cost reduction. Drop the package and its install snippets; runtime artifacts were uninstalled separately.
Use one wording per gating family: exact target and scope, recovery path or safety guard, and explicit authorization. Remove the home-directory instance from workspace access and the repeated approval gate from the breaking-change bullet. Sync the high-impact eval scenario wording.
State the destructive-and-high-impact section as a principle: irreversible operations need explicit authorization, destructive or force operations form a separate categorical gate, and unpublished history rewrites are exempt at section level. Generalize infrastructure preview invalidation to any input change, and add an irreversible-action eval scenario.
Generalize the revert rule to protect any content the user changed or removed, and require confirmation before touching it. Replace the mock ban with a scope rule: checks must not be faked or weakened, and test doubles may replace only what a check does not verify. Sync the matching eval scenario.
Install microsoft-edge on x86_64 Linux via Home Manager and on macOS via
a brew cask. Enable the chromium and brave-origin Home Manager options
alongside google-chrome, dropping the google-chrome aarch64 fallback to
chromium since google-chrome supports aarch64-linux.
Persist the Brave Origin and microsoft-edge profile directories on the
ephemeral-root hosts.
- limit POSIX shell to a single command with arguments
- route pipes, chaining, substitution, redirection, and ShellCheck/BashPitfalls cases to Nushell or Python
- remove the Request handling and Scope and precedence sections
- keep the non-weakening guarantee under Safety and authorization
- remove the now-stale eval scenarios
- merge verification rules and split infrastructure guidance
- shorten Tools, Shell/scripts, and Communication
- apply script validation to any script file, including temporary ones
- sync evals
- allow file-path secret references and require approval for breaking changes
- relax the commit subject limit and allow rewriting unpublished local history
- refine tooling plus shell and script selection/validation guidance
The r8169 NIC drops carrier on S3 resume, and systemd-networkd reacts by reconfiguring enp130s0: it dropped the static address/default route and deleted foreign routing policy rules (mihomo's 9000-9010 and Tailscale's 5210-5270). clash's TUN then lost its outbound interface and networking stayed broken until clash was restarted.
- IgnoreCarrierLoss=10s keeps the static address/route across the short carrier loss.
- ManageForeignRoutingPolicyRules=false stops networkd from deleting the TUN/VPN ip rules during the reconfiguration.
The lock listener ignores inhibitors but had no playback condition, so it locked the screen at its timeout even during active media playback (screen-off already skipped via playerctl). Add the same playerctl condition to the lock listener.
niri already owns the org.freedesktop.ScreenSaver interface and feeds its inhibitors into the compositor idle notifier, so hypridle's own registration always fails with 'Another service is already providing...'. Set ignore_dbus_inhibit = true so hypridle no longer tries to claim it; D-Bus inhibits are still handled by niri.
Replace the static hypridle.conf with services.hypridle.settings and add required timeout options so each host tunes its own values:
- idols-ai (PC): 15 min keyboard, 20 min screen-off, 30 min lock.
- 12kingdoms-shoukei (laptop): 3 / 6 / 20 min (previous values).
The options have no defaults because the right values depend on the machine. Update the home-manager eval test to inspect the settings option instead of the old config file text.
Desktop speakers on idols-ai use the EBU R128 broadcast standard (-23 dB), while the quiet built-in laptop speakers on 12kingdoms-shoukei keep -12 dB. Move the target out of the shared preset so each host sets its own value.
Declare the output chain via services.easyeffects.extraPresets and load it with preset.output, replacing the GUI-only configuration that did not survive the tmpfs root.
autogain target is set to -12 dB (EasyEffects defaults to -23, which is too quiet for playback); the limiter acts as a transparent -1 dB safety net via threshold=-1 and gain-boost=false.
Emphasize safety precedence in the intro, and replace the narrow Bash pipeline ban with a trigger-based rule: keep POSIX shell as glue and move to Nushell or Python once quoting, error handling, parsing, types, retries, or portability are involved.
- read Asahi aop-sensors ALS via iio and drive eDP-1 backlight
- drop PrivateUsers for wluma so it can reach the real user D-Bus session
- remove hypridle 10min screen-dim listener: its brightnessctl writes fight
wluma and get learned as manual adjustments
Enable gnomeKeyring for the passwd PAM service so pam_gnome_keyring
updates the login keyring password when the login password changes.
Fixes 'Unlock Login Keyring' prompt desync after changing the password
via passwd (greetd session unlock alone does not update the keyring).
The running clash-verge-rev reports app_id "clash-verge" (lowercase), so the
anchored ^Clash-verge$ pattern never matched and the window opened on whatever
workspace was focused (1terminal). Match case-insensitively.
Change-Id: Iddabdbd66597a7325bdb08cb31434c1ee710dc3e
Ryan Yin