starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-27 13:33:57 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,269 Commits 5 Branches 35 Tags
f9cf99dadbe366182061b67ba16e9dd49947eb21
Commit Graph
2269 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Yin f9cf99dadb security: add conservative systemd hardening to aquamarine services 2026-08-26 18:14:43 +08:00
Ryan Yin 65ee1a001f security: disable SSH X11 forwarding on servers, keep on desktops 2026-08-26 18:14:43 +08:00
Ryan Yin 212f45e2ca security: restrict k3s kubeconfig file mode to 600 2026-08-26 18:14:43 +08:00
Ryan Yin be6e2b4110 security: bind aquamarine metrics exporters to loopback 2026-08-26 18:14:43 +08:00
Ryan Yin 36c29a8371 security: enable AppArmor (complain) on all Linux hosts 2026-08-26 18:14:43 +08:00
Ryan Yin b46bb471d8 test: fix security-firewall eval test to scalar per-host values 2026-08-26 18:14:43 +08:00
Ryan Yin 72a6e95cab security: make firewall secure-by-default, disable explicitly on servers 
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
 2026-08-26 18:14:43 +08:00
Ryan Yin 7364d5aa1b feat(home): add pyclipsync clipboard sync service for niri 
xwayland-satellite has no compositor-level clipboard bridging, so X11
clients (WeChat/QQ) and Wayland clients cannot see each other's clipboard.
Add the pyclipsync flake input and enable its home-manager module, which
installs the daemon as a systemd user service bound to the graphical session.
 2026-08-25 17:31:03 +08:00
Ryan Yin 166376676b docs(agents): clarify command waiting and environment rules 2026-08-25 17:17:31 +08:00
Ryan Yin d91b861cd6 feat(bwraps): update wechat to 4.1.1.8 2026-08-25 13:41:34 +08:00
Ryan Yin cd539925f0 fix(flake): update rust-overlay to silence stdenv.is* deprecation warnings 
Lanzaboote's nested rust-overlay input (2026-06-21) used the now-deprecated
stdenv.isLinux/stdenv.isDarwin aliases in mk-aggregated.nix, triggering two
evaluation warnings on nixpkgs 26.11 (where these aliases gained lib.warn).

rust-overlay fixed this treewide in 892c035d (2026-08-13); update the nested
input to master (f60c1b57, 2026-08-23).
 2026-08-24 10:01:15 +08:00
Ryan Yin 6e32a3ef27 fix(Justfile): fmt via external find to not follow result symlink 2026-08-24 00:33:36 +08:00
Ryan Yin c33b68c7bb fix(home): let atuin own Ctrl-R, disable fzf history widget 2026-08-24 00:33:30 +08:00
Ryan Yin b2e19840d0 fix(home): disable catppuccin theme for removed gemini-cli 2026-08-24 00:33:24 +08:00
Ryan Yin 7cba098b07 fix(home): replace deprecated stdenv.is* with hostPlatform.is* 2026-08-24 00:33:22 +08:00
Ryan Yin 3c361f316f fix(home): explicitly enable home.pointerCursor 2026-08-24 00:33:02 +08:00
ryan4yin | 二花 6e0d44c50d feat(nixos): manage scattered trash dirs with trash-cli retention timer (#265) 
* feat(nushell): add trash command using the home trash can

On a tmpfs root with persistent dirs bind-mounted in, `rm --trash`
scatters items into per-mount .Trash-$uid dirs that file managers never
show, and gio refuses to trash on those internal mounts.

Add a `trash` command implementing the freedesktop trash spec
'failsafe' mode: items are moved to ~/.local/share/Trash with
spec-compliant .trashinfo entries, so Thunar can list and restore them.

Also preserve ~/.local/share/Trash on idols-ai so the trash survives
reboots.

* feat(nixos): manage scattered trash dirs with trash-cli retention timer

Replace the hand-written nushell trash command with the established
trash-cli tooling. On a tmpfs root with persistent dirs bind-mounted
in, the trash crate (nushell rm --trash) scatters items into per-mount
.Trash-$uid dirs that file managers never show and nothing cleans up.

- add trash-cli to system packages: trash-list scans/trash-restore
  handles every mount point's trash dir
- daily systemd timer runs 'trash-empty 30 -f', purging items older
  than 30 days across the home trash and all mount points
- drop the hand-written trash.nu module
- note in preservation.nix: do NOT persist ~/.local/share/Trash; a
  bind-mounted trash dir breaks the trash crate's home-topdir match
  for files straight under $HOME (it would try /.Trash-$uid, EACCES)

* fix(nixos): order trash-empty after preservation.target

The scattered .Trash-$uid dirs live inside the preservation bind
mounts, which use DefaultDependencies=no and are therefore NOT ordered
after local-fs.target. Add preservation.target to After= so trash-empty
only runs once all those mounts are up.
 2026-08-23 23:40:53 +08:00
Ryan Yin 9df14d8c39 chore(obs): comment out unused plugins 
Keep only the plugins actually in use (screen capture, gstreamer,
input-overlay, multi-rtmp, source-clone, pipewire audio, vaapi);
disable the rest (teleport, droidcam, vkcapture, shaderfilter,
record, livesplit, looking-glass, vintage-filter, command-source,
move-transition, backgroundremoval, 3d-effect).
 2026-08-23 20:06:33 +08:00
Ryan Yin 598bb470db fix(nushell): import argx & lg with prefix to avoid shadowing builtins 
`use modules/argx *` glob-imports argx's `parse` command into the global
scope, shadowing nushell's builtin `parse`. Any script sourced afterwards
that relies on the builtin (e.g. fzf's nushell integration, which uses
`parse --regex`) then fails to parse with `unknown flag`.

Use prefixed imports for `argx` and `lg` instead of `*`: both modules are
still registered for the kubernetes module's submodules (which call
`argx parse` / `lg level`), there are no bare `parse`/`main`/`level` call
sites, and the builtin `parse` stays available.
 2026-08-23 20:06:33 +08:00
Ryan Yin 5498988ef9 flake.lock: Update 
Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/7d8127d308c3fb9664f7e643eec944be74ebb37d?narHash=sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ%3D' (2026-05-30)
  → 'github:nix-community/home-manager/ec1a8fdf74ed3f276148ee106299a2ba0e65d51f?narHash=sha256-XL2qfqmocfsvuEGyomZg4nOZfkuSe8vZtrOX99I%2Bb6I%3D' (2026-08-22)
• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/76f2e1f07e0435873d08e7f8a07dbe18f237ec5c?narHash=sha256-IiNvo9rlL9ncnLOp70Mo1toobC2t9xHzsZIZayEv7dg%3D' (2026-08-10)
  → 'github:numtide/llm-agents.nix/5fae6955fa522382e640b65876fb2f456059f4c2?narHash=sha256-JzRwvboh8r37Coj6UhtnDiL0LIdPyz3%2B0zknDqS1zi0%3D' (2026-08-23)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/70ce234312134a463ba7728e94da2486a1d237ac?narHash=sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU%3D' (2026-08-06)
  → 'github:NixOS/nixpkgs/391b592eb44808b3bd0cb80bb71b63a5a118b8bb?narHash=sha256-WvvHR4kSQLAbtouMC/ruZ5UpLwlUcY3K4FAllMN%2ByGk%3D' (2026-08-20)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/ae7910970dddc408fe6ab1c8e4b277bb21d72dc0?narHash=sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw%3D' (2026-08-05)
  → 'github:numtide/treefmt-nix/27b3b12a8e6375f28ebe122f07d230ca5459bbfa?narHash=sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE%3D' (2026-08-16)
• Updated input 'nix-darwin':
    'github:lnl7/nix-darwin/56c666e108467d87d13508936aade6d567f2a501?narHash=sha256-zXcwYQGCT6pzinK%2B1dBB2ekTVtfxGZAapb3Evdcu4fY%3D' (2026-05-17)
  → 'github:lnl7/nix-darwin/4cff07de74b50e64bdd68cd4e722ab5b6b35ee48?narHash=sha256-oQFip%2Bv0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ%3D' (2026-08-16)
• Updated input 'nix-gaming':
    'github:fufexan/nix-gaming/ec11c77819f9736dc9f5fd17b979df24f9bd3e94?narHash=sha256-YdfiXMkJki1hghjaPmK2epJQYUjsbvDFiecaqTUx09U%3D' (2026-05-31)
  → 'github:fufexan/nix-gaming/daa997a8979f01a0defcc2065ba824c65bb461f6?narHash=sha256-BXGiZoNdYzfs5ZqsSlSvNvMgcL4%2Bje67BRUoyXY%2Bfjw%3D' (2026-08-23)
• Added input 'nix-gaming/flake-compat':
    'github:NixOS/flake-compat/5edf11c44bc78a0d334f6334cdaf7d60d732daab?narHash=sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns%3D' (2025-12-29)
• Updated input 'nix-gaming/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'nix-gaming/flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/f5901329dade4a6ea039af1433fb087bd9c1fe14?narHash=sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ%3D' (2026-04-26)
  → 'github:nix-community/nixpkgs.lib/0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c?narHash=sha256-OmshNvn2vupOFpYinLUu%2B1Dnpu4n7Q5N3ggGVNHpkUI%3D' (2026-07-26)
• Updated input 'nix-gaming/git-hooks':
    'github:cachix/git-hooks.nix/61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a?narHash=sha256-kTwur1wV%2B01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs%3D' (2026-05-11)
  → 'github:cachix/git-hooks.nix/809414f0cdadf82cf11b06c2b29ba9b3168b3297?narHash=sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh%2B7CBnbCYsk%3D' (2026-08-22)
• Updated input 'nix-gaming/git-hooks/flake-compat':
    'github:NixOS/flake-compat/5edf11c44bc78a0d334f6334cdaf7d60d732daab?narHash=sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns%3D' (2025-12-29)
  → follows 'nix-gaming/flake-compat'
• Removed input 'nix-gaming/git-hooks/gitignore'
• Removed input 'nix-gaming/git-hooks/gitignore/nixpkgs'
• Updated input 'nixos-apple-silicon':
    'github:nix-community/nixos-apple-silicon/5723dd7b3d7132144287513a398442ae5b57397b?narHash=sha256-Qrgy2wSZ%2BOJ/qf7CKV5wfwFrgSXqBT5MR%2BBFQpyxCLM%3D' (2026-05-30)
  → 'github:nix-community/nixos-apple-silicon/53798a0eb0fa4c8cfaeca7bdc5b4ad22ed210c95?narHash=sha256-zRPYCn5RJWxr9uyUwNIQjPsTFcIFRwuRnI91dqvGA0k%3D' (2026-08-16)
• Updated input 'nixpak':
    'github:nixpak/nixpak/fea2dec31d7405cccbd6b4ce35bb30348108bd04?narHash=sha256-xY%2Bv%2BEnRMvROziet7d/qIC6rd/y219HsSoUZrRHhF%2B0%3D' (2026-05-31)
  → 'github:nixpak/nixpak/333bd8c7ca0c014e61be1933b3c131c9dfa20218?narHash=sha256-eh6isB4Gt3Wry1fPqRI1qKWySjDbalvaBwToG82jcR4%3D' (2026-07-26)
• Updated input 'nixpak/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
• Updated input 'nixpak/hercules-ci-effects':
    'github:hercules-ci/hercules-ci-effects/af4331c44f13977b6964745454eadcfee2d244d1?narHash=sha256-OOEWyt8ma7QAysDbiP65J7li7KIdtZfnbA11gFnwyEI%3D' (2026-05-16)
  → 'github:hercules-ci/hercules-ci-effects/86c7c78a840b44b1a0a5cbc7e9baa0154c0d0f3f?narHash=sha256-vy0EiuiLRKWbXYOqdEKoy5ImlbHcdMC52x9BcC/MwQ8%3D' (2026-06-15)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/8e2eeb9477c9d40009a5bd51cd3eef2f5abb26f1?narHash=sha256-JTbODJPDcd3d8U7lO4MVUU3Yo0jz2KQSAHXka%2BIWBEo%3D' (2026-08-11)
  → 'github:nixos/nixpkgs/2c423e03bbafcff28bfadc6781a4a8257f205cb5?narHash=sha256-dt4WdcvsA8/RCe%2BVZZwqU0X%2BXMM3wBbGCWA0/sFWzGo%3D' (2026-08-22)
• Updated input 'nixpkgs-blender':
    'github:nixos/nixpkgs/596a0d7dc02bb847b5f4cb44a20a15ff12275bb3?narHash=sha256-bf8Gay/Vopie4kGiw1qg1PQBKL4MNU7Li9ThI80JE1c%3D' (2026-07-24)
  → 'github:nixos/nixpkgs/c2c93465e2871183025a30c52d19b6804311526f?narHash=sha256-8cgQR83UlOCuSkmKvOQcHTiRrSknUqTUbnRM7ai4obI%3D' (2026-08-23)
• Updated input 'nixpkgs-darwin':
    'github:nixos/nixpkgs/e9a7635a57597d9754eccebdfc7045e6c8600e6b?narHash=sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL%2BWNQD0rJfJZQ%3D' (2026-05-29)
  → 'github:nixos/nixpkgs/a831408e6378bc02ebf8cc09b52c96ca86f6bab4?narHash=sha256-NcYt9QJfpJiF1lAyN8BDPB4EeScbPU%2BEwQqPiBElrpU%3D' (2026-08-22)
• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/38feebd13bb995c67c97133f7303924e3242dd8c?narHash=sha256-N6ZarU/L7Jk%2BOZvo%2Bs%2B8TfcW1ToxGhsZ3AW9pB/XISI%3D' (2026-08-18)
  → 'github:nixos/nixpkgs/c2c93465e2871183025a30c52d19b6804311526f?narHash=sha256-8cgQR83UlOCuSkmKvOQcHTiRrSknUqTUbnRM7ai4obI%3D' (2026-08-23)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/b51242d7d43689db2f3be91bd05d5b24fbb469c4?narHash=sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1%2BN6cArVE%3D' (2026-05-31)
  → 'github:nixos/nixpkgs/5880666fd9eb563038431edb35c2d0aa595884e6?narHash=sha256-OURZPknrTjQrlNyxPdqzyqmU/81Wes1CUP/Ft1Rv/YI%3D' (2026-08-20)
• Updated input 'nixvim':
    'github:nix-community/nixvim/167da56c3ab1e51751a6ae4a997ed66587f9edae?narHash=sha256-Bfq9y0X6Vs4UPb67u7hN3jt7fJKHtl3%2Bg0lBSDebRNg%3D' (2026-05-31)
  → 'github:nix-community/nixvim/b397fb9f6950d57355d62bb92457d223464e0115?narHash=sha256-Hj/nkhKDv0aJly1PAUstrhrgEYn1mVSkLIYMh90r/Pc%3D' (2026-08-16)
• Updated input 'nixvim/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'nur-ryan4yin':
    'github:ryan4yin/nur-packages/ab573501bbbe38f38818afb5b2d0e1f58ba61f29?narHash=sha256-PKkRUkMgpvqAPmGBCSNL1R0MfoaaoQpvH1ffiNwJkQ8%3D' (2026-04-08)
  → 'github:ryan4yin/nur-packages/c3207ff6d6bed0a35511b0fb7133d07d4b00e118?narHash=sha256-1gIhdoBDzKv0T%2BNsqYFkjEDiwAeI%2BdDab1Dfg4bavO0%3D' (2026-06-23)
• Updated input 'pre-commit-hooks':
    'github:cachix/git-hooks.nix/61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a?narHash=sha256-kTwur1wV%2B01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs%3D' (2026-05-11)
  → 'github:cachix/git-hooks.nix/809414f0cdadf82cf11b06c2b29ba9b3168b3297?narHash=sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh%2B7CBnbCYsk%3D' (2026-08-22)
• Removed input 'pre-commit-hooks/gitignore'
• Removed input 'pre-commit-hooks/gitignore/nixpkgs'
 2026-08-23 17:54:25 +08:00
Ryan Yin 95088c4ff8 fix(nixpaks): route qq via pkgs-master for 3.2.32-2026-08-12 2026-08-18 09:59:45 +08:00
Ryan Yin 9670cb065e flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a3d21f34e0fd3284dc9a7484c53d6b9ffc4cb41b?narHash=sha256-7RfqWnitmg%2BII4IxlFteaJijrlGmYNVyXtxouavxuX0%3D' (2026-08-15)
  → 'github:nixos/nixpkgs/38feebd13bb995c67c97133f7303924e3242dd8c?narHash=sha256-N6ZarU/L7Jk%2BOZvo%2Bs%2B8TfcW1ToxGhsZ3AW9pB/XISI%3D' (2026-08-18)
 2026-08-18 09:51:16 +08:00
Ryan Yin 334e53a187 flake.lock: Update 
Flake lock file updates:

• Updated input 'nu_scripts':
    'github:ryan4yin/nu_scripts/ff8092707054ad091d67bd408374a39977e33c1b?narHash=sha256-oxnXzxQkNccCs36j%2BaMzg4QGHDcX7niJruqxCkeg0LM%3D' (2025-11-11)
  → 'github:ryan4yin/nu_scripts/381eb7577705b00bea437da7c0439c39ff05f06b?narHash=sha256-b4/JOcpUa2BittwZz/w3IPUik4QPlpqcgc2dgDDbb1E%3D' (2026-07-19)
 2026-08-16 16:26:45 +08:00
Ryan Yin 78fc64e136 fix(neovim): disable nixvim manpage on broken nixpkgs pin 2026-08-16 15:40:12 +08:00
Ryan Yin bb13a43ff9 fix(nixpaks): route qq via pkgs-patched for 3.2.32-2026-07-30 2026-08-16 15:40:11 +08:00
Ryan Yin fd4f61f710 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-patched':
    'github:ryan4yin/nixpkgs/4425024452e93ce3d10e11bcd9b47f1dfa78593b?narHash=sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4%3D' (2026-06-03)
  → 'github:ryan4yin/nixpkgs/5d9f7ea174a0cb08dcc36eba9b8f67615962ece9?narHash=sha256-zd5dQC9Y6Q8FtfqAbNJTFmbwpyqaeFuZ9Ww5YjpIsaQ%3D' (2026-08-16)
 2026-08-16 14:41:58 +08:00
Ryan Yin 663df05ce7 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)
  → 'github:NixOS/nixpkgs/8e2eeb9477c9d40009a5bd51cd3eef2f5abb26f1?narHash=sha256-JTbODJPDcd3d8U7lO4MVUU3Yo0jz2KQSAHXka%2BIWBEo%3D' (2026-08-11)
 2026-08-16 14:36:17 +08:00
Ryan Yin 21c76cf9cc fix(nixpaks): route qq via nixpkgs-master for 3.2.32-2026-07-30 2026-08-15 20:53:50 +08:00
Ryan Yin 5537790829 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a3eff1e98209f4c27139b231521a886df64fcaab?narHash=sha256-3ZsD71dKOmllzulAwsWXUgnzQzUZt8n91kDPTKxKebY%3D' (2026-07-22)
  → 'github:nixos/nixpkgs/a3d21f34e0fd3284dc9a7484c53d6b9ffc4cb41b?narHash=sha256-7RfqWnitmg%2BII4IxlFteaJijrlGmYNVyXtxouavxuX0%3D' (2026-08-15)
 2026-08-15 20:47:05 +08:00
Ryan Yin 9842a8a17f feat(nushell): add lsa & dus wrappers to prevent column truncation 
`lsa` (ls -al) and `dus` (du) render the table at a fixed width of 350 so
columns like size/apparent/physical are never dropped to "..." when the
natural table is wider than the terminal.
 2026-08-15 20:35:15 +08:00
Ryan Yin 495c366938 fix(xdg): order autostart apps after xdg-desktop-portal 
At login the xdg-autostart-generator starts apps at
graphical-session.target, racing the portal user services. Sandboxed
apps (nixpak firefox/telegram) end up with broken FileChooser/OpenURI
until manually restarted.

Add a template drop-in on app-@autostart.service that makes every
autostart app wait for the portal stack.
 2026-08-15 00:47:59 +08:00
Ryan Yin 88e916b63e flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/6c650f7597e3f212395e4fdba754bf6537cc2298?narHash=sha256-cS5Rv01brbs95/a5NrNCxKLqMZWkFnRRZXdmz2NZnQs%3D' (2026-07-22)
  → 'github:numtide/llm-agents.nix/76f2e1f07e0435873d08e7f8a07dbe18f237ec5c?narHash=sha256-IiNvo9rlL9ncnLOp70Mo1toobC2t9xHzsZIZayEv7dg%3D' (2026-08-10)
• Updated input 'llm-agents/bun2nix':
    'github:nix-community/bun2nix/5a39d717029e94163ac223aee8d5c9946cafed1c?narHash=sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM%3D' (2026-06-29)
  → 'github:nix-community/bun2nix/0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729?narHash=sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep%2BwpUzquA29VU%3D' (2026-07-21)
• Updated input 'llm-agents/flake-parts':
    'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/421eebfd0ec7bccd4abe826ce62d7e6e83129493?narHash=sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl%2BHHZ%2BDrtM%3D' (2026-07-20)
  → 'github:NixOS/nixpkgs/70ce234312134a463ba7728e94da2486a1d237ac?narHash=sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU%3D' (2026-08-06)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/df3c0640565d04a0261253cdd89fce78ec50168a?narHash=sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0%3D' (2026-07-18)
  → 'github:numtide/treefmt-nix/ae7910970dddc408fe6ab1c8e4b277bb21d72dc0?narHash=sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw%3D' (2026-08-05)
 2026-08-10 09:58:22 +08:00
Ryan Yin a804c56263 chore: add qrtool & herdr 2026-08-07 14:15:26 +08:00
Ryan Yin 58e056486d docs(agents): allow scoped secret authentication 2026-08-05 10:13:16 +08:00
Ryan Yin 6f837b8718 docs(agents): clarify cleanup safety boundaries 2026-08-05 10:06:04 +08:00
Ryan Yin c0f50a7d4a fix(bambu-studio): adjust HiDPI text scaling 2026-08-05 09:14:33 +08:00
Ryan Yin 6f100d94a9 feat(gh): persist user-managed configuration 2026-08-04 17:45:24 +08:00
Ryan Yin cce15300d6 feat(niri): reorganize workspaces 2026-08-03 22:42:37 +08:00
Ryan Yin 20dac3bb84 docs(zoom-us): screen capture mode 2026-08-01 10:28:01 +08:00
Ryan Yin 6264190c49 fix(idols-ai): reset camera after resume 2026-08-01 10:04:22 +08:00
Ryan Yin 7826934b23 fix(nixpak): allow document portal saves 2026-08-01 09:37:43 +08:00
Ryan Yin 3aadd65a36 fix(telegram): preserve Wayland app ID in nixpak 2026-07-31 17:35:31 +08:00
Ryan Yin 41512097e5 feat(grafana): add kubernetes service and storage dashboards 2026-07-31 17:34:52 +08:00
Ryan Yin 071212e40f feat(niri): reorganize workspace layout 2026-07-31 12:06:27 +08:00
Ryan Yin ac96c62cbe fix(niri): position Zoom toolbar at bottom 2026-07-31 11:07:07 +08:00
Ryan Yin e43ae1625c fix(niri): handle Zoom auxiliary windows 2026-07-31 11:01:38 +08:00
Ryan Yin 5c5bbe3210 docs: agents - add secres access policy 2026-07-28 18:28:12 +08:00
Ryan Yin 64ecc1cf66 fix(grafana): scope hwmon joins to selected node 2026-07-27 20:57:10 +08:00
Ryan Yin 095dc5dee8 feat(desktop): enable the firewall on desktop machines 
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:26:01 +08:00
Ryan Yin 74598b6f6b chore(monitoring): stop scraping offline hosts, mute noisy alert levels 
- Add an offlineHosts list to VictoriaMetrics scrape generation: SBCs
  and the whole k3s-prod-1 cluster are powered off, shoukei's exporter
  is disabled on the machine; also comment out the dnsmasq-exporter
  job (runs on suzi).
- Disable node-exporter on shoukei: a laptop on untrusted networks
  should not expose :9100 (the firewall is off repo-wide).
- Route severity none|info alerts to the null receiver; meta alerts
  and info noise should never page.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:19:56 +08:00