fix discord and 1pass dock link

Flake lock file updates:

• Updated input 'darwin':
    'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15)
  → 'github:lnl7/nix-darwin/57a3171f94705599a2499248ca5758d5eb47c0e0' (2026-07-19)
• Updated input 'home-manager':
    'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18)
  → 'github:nix-community/home-manager/079a3b5d1aa6a719920a51316253b7d6dd22738d' (2026-07-24)
• Updated input 'nix-caddy-withplugins':
    'github:MichailiK/nix-caddy-withplugins/79db67d97207b6e32eaba69d5c3e6d7e63144154' (2026-06-14)
  → 'github:MichailiK/nix-caddy-withplugins/70307cfc568e5434cf42067d797b27c38ea69944' (2026-07-24)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15)
  → 'github:nixos/nixpkgs/e2587caef70cea85dd97d7daab492899902dbf5d' (2026-07-23)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17)
  → 'github:nixos/nixpkgs/b3fe9581c9061c749abef42b6d4ee7b7c05c33fa' (2026-07-22)
• Updated input 'nur':
    'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18)
  → 'github:nix-community/nur/1166a294990afd245fd72b8d2896075222408399' (2026-07-25)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18)
  → 'github:oxalica/rust-overlay/a163bd01a6e11ac58d4f8d11669da550b5afbbc6' (2026-07-25)
• Updated input 'wsl':
    'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14)
  → 'github:nix-community/NixOS-WSL/eaeb18da90024448a60eb1ec7132eafa4003404e' (2026-07-21)

docs/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-07-20
+
+- Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based
+  test suite. Its `checkPhase` hangs in the Nix sandbox and times out with a
+  `KeyboardInterrupt` after ~150s, which was breaking the `flame` rebuild
+  (paho-mqtt is pulled in transitively, e.g. via mealie). The override is
+  applied through `pythonPackagesExtensions` so it covers every Python
+  package set.

flake.lock

@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783395956,
+        "lastModified": 1784500460,
-        "narHash": "sha256-AAbexQvDoK+6GFJdhY6kqjA+6ECKRkidgWxkn4gMwAA=",
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "d5bd9cd77aea4c0a8f49e7fd85545671a208ed15",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
         "type": "github"
       },
       "original": {
@@ -80,6 +80,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -179,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783744526,
+        "lastModified": 1784913159,
-        "narHash": "sha256-yYVxW+uIbCx0Nt870fbErQbz+b2+3Gwpppe+JbIU+Co=",
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2afec152df4e284d264f8489d16004c264aebf4c",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
         "type": "github"
       },
       "original": {
@@ -216,6 +232,26 @@
         "type": "github"
       }
     },
+    "nix-caddy-withplugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1784936738,
+        "narHash": "sha256-X4w9BrFkisfzla3m1WwDJUicUbI7JRdhzq5aS7rrB0k=",
+        "owner": "MichailiK",
+        "repo": "nix-caddy-withplugins",
+        "rev": "70307cfc568e5434cf42067d797b27c38ea69944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MichailiK",
+        "ref": "nixos-unstable",
+        "repo": "nix-caddy-withplugins",
+        "type": "github"
+      }
+    },
     "nix2vim": {
       "inputs": {
         "flake-utils": "flake-utils_2",
@@ -306,11 +342,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1783703440,
+        "lastModified": 1784707089,
-        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "narHash": "sha256-2V/6imsUgB7mPZlHY54oeVBRDoZbPKnvzwkAHUSSufk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
         "type": "github"
       },
       "original": {
@@ -370,11 +406,27 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1783522502,
+        "lastModified": 1781074563,
-        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -384,7 +436,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1744536153,
         "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -408,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783781396,
+        "lastModified": 1784959021,
-        "narHash": "sha256-aksKD/uLLuu17Sqaz4Ae2zbExheI5v/U9j9778eCD5U=",
+        "narHash": "sha256-Atc5ydxAmAAD5o8e6F8VVxVCOQb82bqi5TRNRUSBvZU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "29c4c5612e67bce09ee3f2f988bebe51ff9e6b81",
+        "rev": "1166a294990afd245fd72b8d2896075222408399",
         "type": "github"
       },
       "original": {
@@ -427,9 +479,10 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "mac-app-util": "mac-app-util",
+        "nix-caddy-withplugins": "nix-caddy-withplugins",
         "nix2vim": "nix2vim",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur",
         "rust-overlay": "rust-overlay",
@@ -440,14 +493,14 @@
     },
     "rust-overlay": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1783747106,
+        "lastModified": 1784956772,
-        "narHash": "sha256-KlepQu/O5m11lAjcJ4ER5bc6bIzyX2UMPDARzMzQfIw=",
+        "narHash": "sha256-5polVWDhgATIQj+RUV2ZlOd5nE6cGJo+C4tOEs5vp6U=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "e598b37857b895b81020a65a802ef55f5bbed72f",
+        "rev": "a163bd01a6e11ac58d4f8d11669da550b5afbbc6",
         "type": "github"
       },
       "original": {
@@ -554,17 +607,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1783336371,
+        "lastModified": 1784642409,
-        "narHash": "sha256-ZisTtweyb7JUwPP54HAXE9TypT8m89dIxDI36Ak0hAs=",
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "a9620cfa43f0c1c30a46c31ae3c6e58cdb124a14",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -40,6 +40,12 @@
       # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
     };
 
+    # Caddy with decoupled plugin hashes
+    nix-caddy-withplugins = {
+      url = "github:MichailiK/nix-caddy-withplugins/nixos-unstable";
+      # Important: Do not follow nixpkgs here, per the README
+    };
+
     # Manage disk format and partitioning
     disko = {
       url = "github:nix-community/disko";

hosts/aarch64-darwin/lookingglass/default.nix

@@ -27,6 +27,7 @@ rec {
       common.enable = true;
       darwin-base.enable = true;
       darwin-gaming.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
       work.enable = true;
       experimental.enable = true;

hosts/aarch64-linux/flame/default.nix

@@ -28,6 +28,7 @@ rec {
     nmasur.profiles = {
       common.enable = true;
       linux-base.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
     };
     nmasur.presets.programs.helix.enable = true;

hosts/x86_64-linux/swan/default.nix

@@ -26,6 +26,7 @@ rec {
     nmasur.profiles = {
       common.enable = true;
       linux-base.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
     };
     home.stateVersion = "23.05";

hosts/x86_64-linux/tempest/default.nix

@@ -30,6 +30,7 @@ rec {
       linux-base.enable = true;
       linux-gui.enable = true;
       linux-gaming.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
       developer.enable = true;
       experimental.enable = true;

lib/default.nix

@@ -179,22 +179,20 @@ lib
     inputs.darwin.lib.darwinSystem {
       inherit system specialArgs;
       modules = [
-        inputs.home-manager.darwinModules.home-manager
         inputs.mac-app-util.darwinModules.default
         {
           imports = (nixFiles ../platforms/nix-darwin);
           nixpkgs.pkgs = pkgsBySystem.${system};
         }
-        module
+        # Home Manager is intentionally NOT activated here. It is managed
-        {
+        # standalone via `nh home switch` (see homeConfigurations, extracted
-          home-manager = {
+        # from the host module's `home-manager.users`). Strip that attr so
-            extraSpecialArgs = {
+        # darwin-rebuild doesn't also activate a second, divergent HM
-              inherit colorscheme;
+        # generation with different store paths (useUserPackages puts packages
-            }
+        # in /etc/profiles/per-user vs. ~/.nix-profile standalone) -- that
-            // specialArgs;
+        # mismatch broke the prompt after every darwin-rebuild until the next
-          }
+        # `nh home switch`.
-          // homeModule.home-manager;
+        (builtins.removeAttrs module [ "home-manager" ])
-        }
       ];
     };
 

overlays/nix-caddy-withplugins.nix

@@ -0,0 +1 @@
+inputs: inputs.nix-caddy-withplugins.overlays.default

overlays/paho-mqtt.nix

@@ -0,0 +1,20 @@
+# Disable paho-mqtt's flaky test suite.
+#
+# paho-mqtt's checkPhase runs socket-based integration tests that hang in
+# the Nix sandbox (they eventually time out with a KeyboardInterrupt after
+# ~150s, reporting errors and failing the build). This breaks the flame
+# rebuild, where paho-mqtt is pulled in transitively (e.g. via mealie).
+#
+# Applied through pythonPackagesExtensions so it covers every Python
+# package set (python3Packages, python314Packages, ...).
+
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      paho-mqtt = pyprev.paho-mqtt.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
+    })
+  ];
+}

pkgs/caddy/package.nix

@@ -2,21 +2,10 @@
 
 {
   pkgs,
-  fetchFromGitHub,
   ...
 }:
 
-# Maintain a static version so that the plugin hash doesn't keep breaking
+pkgs.caddy.withPlugins {
-(pkgs.caddy.overrideAttrs rec {
+  plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-  version = "2.10.2";
+  hash = "sha256-HuVBmiT3kD6RrDejQ6SnjCN8f7pFdZlGtZFbEf47bks=";
-  src = fetchFromGitHub {
+}
-    owner = "caddyserver";
-    repo = "caddy";
-    tag = "v${version}";
-    hash = "sha256-KvikafRYPFZ0xCXqDdji1rxlkThEDEOHycK8GP5e8vk=";
-  };
-}).withPlugins
-  {
-    plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-xz43pXTsnYmXZDAAUT+vTapoq3O/8br7igGwqZbjFdk=";
-  }

pkgs/mathesar/package.nix

@@ -89,6 +89,13 @@ let
         drf-access-policy
         # psycopg-binary
         ;
+      # clevercsv's test_encoding_chardet is nondeterministic (chardet
+      # returns None instead of ISO-8859-1/KOI8-R on some platforms),
+      # breaking the build. Skip its test suite.
+      clevercsv = pyprev.clevercsv.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
     };
   };
 

platforms/home-manager/modules/nmasur/presets/programs/cargo.nix

@@ -18,16 +18,16 @@ in
       ca = "cargo";
     };
 
-    home.packages = with pkgs; [
+    home.packages = [
-      gcc
+      pkgs.gcc
-      rustc
+      pkgs.rustc
-      cargo
+      pkgs.cargo
-      cargo-watch
+      pkgs.stable.cargo-watch
-      clippy
+      pkgs.clippy
-      rustfmt
+      pkgs.rustfmt
-      pkg-config
+      pkgs.pkg-config
-      openssl
+      pkgs.openssl
-      rust-analyzer
+      pkgs.rust-analyzer
     ];
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/homebrew.nix

@@ -27,6 +27,7 @@ in
       cask "notunes" # Don't launch Apple Music with the play button
       cask "topnotch" # Darkens the menu bar to complete black
       cask "ghostty" # Terminal application (not buildable on Nix on macOS)
+      cask "discord" # nixpkgs bundle breaks its notarization seal on macOS 26+
 
       # Mac App Store apps (requires 'mas' CLI, optional)
       # mas "Tailscale", id: 1475387142

platforms/home-manager/modules/nmasur/presets/programs/noti.nix

@@ -15,10 +15,21 @@ in
 
   config = lib.mkIf (cfg.enable && (pkgs.stdenv.isDarwin || config.services.dunst.enable)) {
     home.packages = [ pkgs.noti ];
-    programs.fish.shellAbbrs = {
+    programs.fish = {
-      # Add noti for ghpr in Darwin
+      shellAbbrs = {
-      ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
+        # Add noti for ghpr in Darwin
-      grw = lib.mkForce "noti gh run watch";
+        ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
+        grw = lib.mkForce "noti gh run watch";
+      };
+      functions = {
+        gh-run = {
+          body =
+            lib.mkForce # fish
+              ''
+                ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- noti gh run watch
+              '';
+        };
+      };
     };
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/zellij.nix

@@ -109,6 +109,10 @@ in
 
       settings = {
         default_mode = "locked";
+        # Spawn fish directly instead of trusting $SHELL, which inherits the
+        # macOS login shell. On darwin that login shell is no longer managed by
+        # nix-darwin, so $SHELL can point at a stale /run/current-system path.
+        default_shell = lib.getExe pkgs.fish;
         # default_layout = "compact-top";
         # Remove border
         pane_frames = false;

platforms/home-manager/modules/nmasur/presets/services/dock.nix

@@ -48,7 +48,7 @@ in
         tilesize = 44;
 
         persistent-apps = map mkDockApp [
-          "${pkgs._1password-gui}/Applications/1Password.app"
+          "/Applications/1Password.app"
           "${pkgs.slack}/Applications/Slack.app"
           "/System/Applications/Calendar.app"
           "${pkgs.firefox-unwrapped}/Applications/Firefox.app"
@@ -56,7 +56,10 @@ in
           "/System/Applications/Mail.app"
           "/Applications/zoom.us.app"
           "${config.programs.ghostty.package}/Applications/Ghostty.app"
-          "${pkgs.discord}/Applications/Discord.app"
+          # Discord comes from Homebrew on macOS: the nixpkgs bundle is
+          # modified in place, breaking its notarization seal, so macOS 26+
+          # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
+          "/Applications/Discord.app"
           "${pkgs.obsidian}/Applications/Obsidian.app"
           "${pkgs.thunderbird}/Applications/Thunderbird.app"
         ];

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/default.nix

@@ -33,7 +33,7 @@ in
     xdg.configFile."hammerspoon/Spoons/Launcher.spoon/init.lua".source =
       pkgs.replaceVars ./Spoons/Launcher.spoon/init.lua
         {
-          discord = "${pkgs.discord}/Applications/Discord.app";
+          discord = "Discord.app";
           firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
           ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
           obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";

platforms/home-manager/modules/nmasur/profiles/llm-development.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.llm-development;
+in
+
+{
+
+  options.nmasur.profiles.llm-development.enable = lib.mkEnableOption "LLM coding tools";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+
+      pkgs.pi-coding-agent # AI LLM Agent
+
+    ];
+
+  };
+
+}

platforms/nix-darwin/modules/nmasur/presets/programs/_1password.nix

@@ -12,12 +12,9 @@ in
   options.nmasur.presets.programs._1password.enable = lib.mkEnableOption "1Password password manager";
 
   config = lib.mkIf cfg.enable {
-    allowUnfreePackages = [
+    # Unfree packages are already permitted via the shared nixpkgs instance
-      "1password"
+    # created in lib/default.nix (config.allowUnfree = true). Setting
-      "_1password-gui"
+    # nixpkgs.config here would conflict with nixpkgs.pkgs being set externally.
-      "1password-cli"
-    ];
-
     programs._1password.enable = true;
     programs._1password-gui = {
       enable = true;

platforms/nix-darwin/modules/nmasur/presets/services/dock.nix

@@ -50,7 +50,10 @@ in
         "/System/Applications/Mail.app"
         "/Applications/zoom.us.app"
         "/Applications/Ghostty.app"
-        "${pkgs.discord}/Applications/Discord.app"
+        # Discord comes from Homebrew on macOS: the nixpkgs bundle is modified
+        # in place, breaking its notarization seal, so macOS 26+ refuses to
+        # launch it ("damaged").
+        "/Applications/Discord.app"
         "${pkgs.obsidian}/Applications/Obsidian.app"
         "${pkgs.thunderbird}/Applications/Thunderbird.app"
       ];

platforms/nix-darwin/modules/nmasur/profiles/base.nix

@@ -19,7 +19,7 @@ in
     nmasur.presets = {
       programs = {
         _1password.enable = lib.mkDefault true;
-        # fish.enable = lib.mkDefault true;
+        fish.enable = lib.mkDefault true;
         # homebrew.enable = lib.mkDefault true;
       };
       services = {

platforms/nixos/modules/nmasur/presets/services/mealie.nix

@@ -20,6 +20,9 @@ in
       };
     };
 
+    # Fix BASE_URL for downloading backups
+    systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";
+
     nmasur.presets.services.caddy.routes = [
       {
         match = [ { host = [ hostnames.recipes ]; } ];