update nixpkgs and add pi

Flake lock file updates:

• Updated input 'darwin':
    'github:lnl7/nix-darwin/da529ac9e46f25ed5616fd634079a5f3c579135f' (2026-03-08)
  → 'github:lnl7/nix-darwin/06648f4902343228ce2de79f291dd5a58ee12146' (2026-04-01)
• Updated input 'home-manager':
    'github:nix-community/home-manager/02371c05a04a2876cf92e2d67a259e8f87399068' (2026-03-27)
  → 'github:nix-community/home-manager/9dc93220c1c9a410ef6277d6dc55c571d9e592d0' (2026-04-04)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9' (2026-03-24)
  → 'github:nixos/nixpkgs/6201e203d09599479a3b3450ed24fa81537ebc4e' (2026-04-01)
• Updated input 'nur':
    'github:nix-community/nur/6298c3410e4000a9e91c344ac5f163b043534e03' (2026-03-28)
  → 'github:nix-community/nur/274b289253048dec21259c12a16508fb1e30e0f6' (2026-04-04)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/98caaa8cd1fbcc45913d1bb2b7fbabcf3e8d967a' (2026-03-28)
  → 'github:oxalica/rust-overlay/740fb0203b2852917b909a72b948d34d0b171ec0' (2026-04-04)
• Updated input 'wsl':
    'github:nix-community/NixOS-WSL/fd0eae98d1ecee31024271f8d64676250a386ee7' (2026-03-19)
  → 'github:nix-community/NixOS-WSL/d97e078f4788cddb8d11c3c99f72a4bb9ddec221' (2026-03-31)

.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)"
+    ]
+  }
+}

flake.lock

@@ -4,7 +4,7 @@
       "inputs": {
         "flake-parts": "flake-parts",
         "nixpkgs": "nixpkgs",
-        "systems": "systems",
+        "systems": "systems_2",
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771520882,
+        "lastModified": 1775037210,
-        "narHash": "sha256-9SeTZ4Pwr730YfT7V8Azb8GFbwk1ZwiQDAwft3qAD+o=",
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "6a7fdcd5839ec8b135821179eea3b58092171bcf",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -49,11 +49,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771469470,
+        "lastModified": 1773889306,
-        "narHash": "sha256-GnqdqhrguKNN3HtVfl6z+zbV9R9jhHFm3Z8nu7R6ml0=",
+        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4707eec8d1d2db5182ea06ed48c820a86a42dc13",
+        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
         "type": "github"
       },
       "original": {
@@ -135,6 +135,24 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": [
           "mac-app-util",
@@ -154,9 +172,9 @@
         "type": "indirect"
       }
     },
-    "flake-utils_2": {
+    "flake-utils_3": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -179,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771647911,
+        "lastModified": 1775622785,
-        "narHash": "sha256-18liNHHwOmcaKCpOptE3wLW97fm5v7RTLiZBecX7km0=",
+        "narHash": "sha256-/yFxO+7oS1SymDfJ2iVO7K5vJKcYfe9XGIJ+quLqz0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "436b27742c996b75e2baf8e835e3b3eae0c9fbd4",
+        "rev": "527e47b78fe67213072f706bf933a9705a8c4974",
         "type": "github"
       },
       "original": {
@@ -193,13 +211,34 @@
         "type": "github"
       }
     },
+    "jj-starship": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769370163,
+        "narHash": "sha256-YfcFlJsPCRfqhN+3JUWE77c+eHIp5RAu2rq/JhSxCec=",
+        "owner": "dmmulroy",
+        "repo": "jj-starship",
+        "rev": "76cf00619b0cce5bd08a1b9a49b310ed928794d5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "dmmulroy",
+        "repo": "jj-starship",
+        "type": "github"
+      }
+    },
     "mac-app-util": {
       "inputs": {
         "cl-nix-lite": "cl-nix-lite",
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_3",
-        "systems": "systems_2",
+        "systems": "systems_3",
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
@@ -218,17 +257,17 @@
     },
     "nix2vim": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1755344765,
+        "lastModified": 1772905551,
-        "narHash": "sha256-k/Cvh/mzb5lSvilKdgwNBCyAyYmD8YPr1nc0sTSgwxI=",
+        "narHash": "sha256-TZaHyWUJRhmVY9sRe4p2/wlC+p+O02LLeutjTwlZdLU=",
         "owner": "gytis-ivaskevicius",
         "repo": "nix2vim",
-        "rev": "78467c8de07719f92397179844bf75cdf2e58b83",
+        "rev": "71acbf5f97545b01778df03a8f2194e918103eba",
         "type": "github"
       },
       "original": {
@@ -370,11 +409,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1771369470,
+        "lastModified": 1775423009,
-        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
+        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0182a361324364ae3f436a63005877674cf45efb",
+        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
         "type": "github"
       },
       "original": {
@@ -408,11 +447,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771648529,
+        "lastModified": 1775654726,
-        "narHash": "sha256-hXZsRqfiO2Q/xVpjb/ETUhiPssYdPpC/ZIT2PWMbSn0=",
+        "narHash": "sha256-4R6Bc5EIQ+HxVte1Mo1B3OkyYFVmehywOPiH3Z9CAIU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "1bedc7cb7cfbb0c29970ce26f61718c9b2dac4c3",
+        "rev": "c73a8885bd1bb5d329e16a4512e2c2708c5981a7",
         "type": "github"
       },
       "original": {
@@ -426,6 +465,7 @@
         "darwin": "darwin",
         "disko": "disko",
         "home-manager": "home-manager",
+        "jj-starship": "jj-starship",
         "mac-app-util": "mac-app-util",
         "nix2vim": "nix2vim",
         "nixos-generators": "nixos-generators",
@@ -443,11 +483,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1771642886,
+        "lastModified": 1775617983,
-        "narHash": "sha256-4zOvSi0WkS2WAaoJtM28wECtS9S+L38CPYbhF+wINDA=",
+        "narHash": "sha256-2NWGA/I4j/qlx6qbg86QvJiK1/GyH9gnf0hFiARWVwE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "85078369717bdbe1f266c9eaad5e66956fb6feea",
+        "rev": "d98b91b1feae7ef07fa2ccb3aa3f83f11abfae54",
         "type": "github"
       },
       "original": {
@@ -472,6 +512,21 @@
       }
     },
     "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
       "locked": {
         "lastModified": 1689347925,
         "narHash": "sha256-ozenz5bFe1UUqOn7f60HRmgc01BgTGIKZ4Xl+HbocGQ=",
@@ -486,7 +541,7 @@
         "type": "github"
       }
     },
-    "systems_3": {
+    "systems_4": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -501,7 +556,7 @@
         "type": "github"
       }
     },
-    "systems_4": {
+    "systems_5": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -560,11 +615,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771563879,
+        "lastModified": 1774972752,
-        "narHash": "sha256-vA5hocvdGhr+jfBN7A7ogeZqIz2qx01EixXwdVsQcnE=",
+        "narHash": "sha256-DnLIpFxznohpLkIFs390uZ0gxwkVyhtknhKNu+lQJK8=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "379d20c55f552e91fb9f3f0382e4a97d3f452943",
+        "rev": "d97e078f4788cddb8d11c3c99f72a4bb9ddec221",
         "type": "github"
       },
       "original": {
@@ -581,7 +636,7 @@
         "rust-overlay": [
           "rust-overlay"
         ],
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1742588229,

flake.nix

@@ -75,6 +75,11 @@
       inputs.rust-overlay.follows = "rust-overlay";
     };
 
+    jj-starship = {
+      url = "github:dmmulroy/jj-starship";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # # Text editor
     # helix = {
     #   url = "github:helix-editor/helix";

lib/default.nix

@@ -67,6 +67,7 @@ lib
     inputs.nur.overlays.default
     inputs.nix2vim.overlay
     inputs.zellij-switch.overlays.default
+    inputs.jj-starship.overlays.default
     # inputs.helix.overlays.default
   ]
   ++ (importOverlays ../overlays);

modules/darwin/homebrew.nix

@@ -34,7 +34,6 @@
       };
       global = {
         brewfile = true; # Run brew bundle from anywhere
-        lockfiles = false; # Don't save lockfile (since running from anywhere)
       };
       brews = [
         "trash" # Delete files and folders to trash instead of rm

platforms/home-manager/modules/nmasur/presets/fonts.nix

@@ -17,23 +17,27 @@ in
     home.packages = [
       pkgs.nerd-fonts.victor-mono # Used for Vim and Terminal
       pkgs.nerd-fonts.hack # For Polybar, Rofi
+
+      # Maple Mono NF (Ligature unhinted)
+      pkgs.maple-mono.NF-unhinted
     ];
     fonts.fontconfig = {
       enable = true;
-      defaultFonts.monospace = [ "Victor Mono" ];
+      defaultFonts.monospace = [ "Maple Mono NF" ];
     };
 
     xsession.windowManager.i3.config.fonts = {
-      names = [ "pango:Victor Mono" ];
+      # names = [ "pango:Victor Mono" ];
+      names = [ "pango:Maple Mono" ];
       # style = "Regular";
       # size = 11.0;
     };
     services.polybar.config."bar/main".font-0 = "Hack Nerd Font:size=10;2";
     programs.rofi.font = "Hack Nerd Font 14";
-    programs.alacritty.settings.font.normal.family = "VictorMono";
+    programs.alacritty.settings.font.normal.family = "Maple Mono NF";
-    programs.kitty.font.name = "VictorMono Nerd Font Mono";
+    programs.kitty.font.name = "Maple Mono NF";
-    nmasur.presets.programs.wezterm.font = "VictorMono Nerd Font Mono";
+    nmasur.presets.programs.wezterm.font = "Maple Mono NF";
-    programs.ghostty.settings.font-family = "VictorMono Nerd Font Mono";
+    programs.ghostty.settings.font-family = "Maple Mono NF";
     services.dunst.settings.global.font = "Hack Nerd Font 14";
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/firefox.nix

@@ -46,7 +46,7 @@ in
           ublacklist
           vimium
           wappalyzer # TODO: only for work profile
-          pkgs.nmasur.firefox-history-exporter
+          # pkgs.nmasur.firefox-history-exporter
           # copy-as-markdown
           # saml-tracer
           # text-fragment

platforms/home-manager/modules/nmasur/presets/programs/ripgrep.nix

@@ -24,6 +24,7 @@ in
         .terraform/
         .target/
         /Library/
+        .jj/
       '';
     };
   };

platforms/home-manager/modules/nmasur/presets/programs/starship.nix

@@ -15,6 +15,8 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    home.packages = [ pkgs.jj-starship ];
+
     programs.starship = {
       enable = true;
       enableFishIntegration = true;
@@ -27,6 +29,7 @@ in
           "$git_branch"
           "$git_commit"
           "$git_status"
+          "\${custom.jj}"
           "$hostname"
           "$cmd_duration"
           "$character"
@@ -38,23 +41,37 @@ in
           vicmd_symbol = "[❮](bold green)";
         };
         cmd_duration = {
-          min_time = 5000;
+          min_time = 5001;
           show_notifications = if pkgs.stdenv.isLinux then false else true;
           min_time_to_notify = 30000;
           format = "[$duration]($style) ";
         };
+        custom = {
+          jj = {
+            when = "jj-starship detect";
+            shell = [
+              "jj-starship"
+              "--no-jj-prefix"
+              "--no-git-prefix"
+            ];
+            format = "$output ";
+          };
+        };
         directory = {
           truncate_to_repo = true;
           truncation_length = 100;
         };
         git_branch = {
+          disabled = true;
           format = "[$symbol$branch]($style)";
         };
         git_commit = {
+          disabled = true;
           format = "( @ [$hash]($style) )";
           only_detached = false;
         };
         git_status = {
+          disabled = true;
           format = "([$all_status$ahead_behind]($style) )";
           conflicted = "=";
           ahead = "⇡";

platforms/home-manager/modules/nmasur/presets/programs/zellij.nix

@@ -15,7 +15,7 @@ let
       return 1
     fi
     echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-    zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--session $TARGET_SESSION"
+    ${lib.getExe pkgs.zellij} action switch-session $TARGET_SESSION
   '';
 in
 
@@ -42,13 +42,13 @@ in
                 return 1
               end
               echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-              zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--cwd $TARGET_DIR --layout default --session $(basename $TARGET_DIR)"
+              ${lib.getExe pkgs.zellij} action switch-session $(basename $TARGET_DIR) --cwd $TARGET_DIR --layout default
             '';
         };
         gh-run = {
           body = # fish
             ''
-              zellij action new-pane --start-suspended -- gh run watch
+              ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- gh run watch
             '';
         };
       };
@@ -101,7 +101,7 @@ in
         show_startup_tips = false;
 
         keybinds = {
-          locked = {
+          locked = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
             # For servers that I SSH into, use c-a-G to unlock
             "bind \"Ctrl Alt G\"" = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
               SwitchToMode = {
@@ -109,7 +109,7 @@ in
               };
             };
           };
-          normal = {
+          normal = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
             # For servers that I SSH into, use c-a-G to lock
             "bind \"Ctrl Alt G\"" = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
               SwitchToMode = {
@@ -143,8 +143,8 @@ in
                 _args =
                   if pkgs.stdenv.isDarwin then
                     [
-                      "env"
+                      # "env"
-                      "PATH=/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
+                      # "PATH=/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
                       (lib.getExe zellij-switch-to-last)
                     ]
                   else

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/Spoons/HideZoomWindow.spoon/init.lua

@@ -0,0 +1,45 @@
+--- === Hide Zoom Window ===
+-- Credit: https://news.ycombinator.com/item?id=47369091
+
+local obj = {}
+obj.__index = obj
+
+-- Metadata
+obj.name = "HideZoomWindow"
+obj.version = "0.1"
+
+function obj:init()
+    -- Hide Zoom's "share" windows so it doesn't come back on ESC keypress
+    local zoomWindow = nil
+    local originalFrame = nil
+
+    hs.hotkey.bind({"cmd", "ctrl", "alt"}, "H", function()
+      print("> trying to hide zoom")
+      if not zoomWindow then
+        print(">  looking for window")
+        zoomWindow = hs.window.find("zoom share statusbar window")
+      end
+
+      if zoomWindow then
+        print(">  found window")
+        if originalFrame then
+          print(">    restoring")
+          zoomWindow:setFrame(originalFrame)
+          originalFrame = nil
+          zoomWindow = nil
+        else
+          print(">    hiding")
+          originalFrame = zoomWindow:frame()
+          local screen = zoomWindow:screen()
+          local frame = zoomWindow:frame()
+          frame.x = screen:frame().w + 99000
+          frame.y = screen:frame().h + 99000
+          zoomWindow:setFrame(frame)
+        end
+      else
+        print(">  window not found")
+      end
+    end)
+end
+
+return obj

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/default.nix

@@ -29,6 +29,7 @@ in
           zed = "${config.programs.zed-editor.package}/Applications/Zed.app";
         };
     xdg.configFile."hammerspoon/Spoons/MoveWindow.spoon".source = ./Spoons/MoveWindow.spoon;
+    xdg.configFile."hammerspoon/Spoons/HideZoomWindow.spoon".source = ./Spoons/HideZoomWindow.spoon;
 
     home.activation.reloadHammerspoon = config.lib.dag.entryAfter [ "writeBoundary" ] ''
       $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.reload()"

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/init.lua

@@ -3,3 +3,4 @@ hs.loadSpoon("ControlEscape"):start() -- Load Hammerspoon bits from https://gith
 hs.loadSpoon("Launcher"):init()
 hs.loadSpoon("DismissAlerts"):init()
 hs.loadSpoon("MoveWindow"):init()
+hs.loadSpoon("HideZoomWindow"):init()

platforms/home-manager/modules/nmasur/profiles/experimental.nix

@@ -31,8 +31,9 @@ in
       pkgs.comma # Nix-index auto-launch
       pkgs.nix-inspect # TUI for browsing Nix configs
 
-      pkgs.crush # AI LLM Agent
+      # pkgs.crush # AI LLM Agent
       pkgs.gemini-cli # AI LLM Agent
+      pkgs.pi-coding-agent # AI LLM Agent
 
     ];
 

platforms/home-manager/modules/nmasur/profiles/work.nix

@@ -21,6 +21,8 @@ in
     ];
 
     home.packages = [
+      pkgs.actionlint # Lint for GitHub Actions Workflows
+      pkgs.claude-code # AI LLM Agent
       pkgs.stable.visidata # CSV inspector
       pkgs.dos2unix # Convert Windows text files
       pkgs.inetutils # Includes telnet
@@ -38,6 +40,7 @@ in
       pkgs.nmasur.ocr # Converts images to text
       pkgs.nmasur.aws-ec2 # Browse EC2 instances
       pkgs.nmasur.terraform-init # Quick shortcut for initializing Terraform backend
+      pkgs.uv # Python packaging
     ];
 
     programs.fish.shellAliases.ec2 = "aws-ec2";

platforms/nix-darwin/modules/nmasur/presets/programs/homebrew.nix

@@ -33,7 +33,6 @@ in
       };
       global = {
         brewfile = true; # Run brew bundle from anywhere
-        lockfiles = false; # Don't save lockfile (since running from anywhere)
       };
     };
 

platforms/nixos/modules/nmasur/presets/services/grafana/grafana-secret-key.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBxUDhh
+SkpvdDNNS04yNk0yNGtqRlRXT2V2QVVScUpVd3RrMWUvYnVyRlJFCktoZUw1VnJI
+SnJ4dDBZK1ROUDRhWm1EaExKZUJmM1NrcUZ0elRtZXZFSTQKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RICtHZGEyUm1lelBEWVFIaCsxSmx0S2V3Yk5qREVRaDdtSkp6ckcz
+UDB5aWcKUFNoeU1YQjhaTG1zTEZBZElkUUpUcXVXdzgrUENUajNqRytMMFZVTzNm
+NAotPiBzc2gtZWQyNTUxOSBuanZYNUEgNjNoM0U0ZnE5dzNCenRWZmVkRVdXOGFa
+cmFjSWtFOUVXSUdzTFNlWGhUSQpvNnk3NXdGZkhtaGRJRmd3czFNUHh3OUlTSGpG
+YUJjT1Baa3dRdzF4V2EwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBXcnNQcnY5MnJ3
+b3hLM01PYXNwa2tPTFVRMC96QmZZTkdDNktWZFRHOVE4Ck1PZUlLcXN6Rnh3UnlS
+dVkwODJ2QjBXWUZOUTdBU01DYjFSemJxY1haVVUKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IEQwZTA3WFkwMWJjbXhMRDlFaEJjMVhuZFpTVTFsaktqWHFXN0J1ajJHMmMK
+bXRTdTI2N1o4ZXhYcG9kWCtMNjJCMG0zeUpqMS95SC9VdTRNdUY3ZFVVSQotLS0g
+OXJFMUkvOXkvdStrU1dBSEhhNnE0NU56SHE0UkUvbXhwcWRCdkdxdXN3SQpXUnGQ
+XJT+KXvM80eW2z/je+0kq9Yh+DkgcWtUpq2k2WyzIue9AifKco9CQ4AsBtKKoxO9
+SxjY/7b0HRwoXS578gwTxJD0j9sBRsz4s64IeiepKn01KcMTgo1TxYzB7JgM
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/grafana/grafana.nix

@@ -28,9 +28,22 @@ in
       before = [ "grafana.service" ];
     };
 
+    secrets.grafana-secret-key = {
+             source = ./grafana-secret-key.age;
+      dest = "${config.secretsDirectory}/grafana-secret-key";
+      owner = "grafana";
+      group = "grafana";
+      permissions = "0440";
+    };
+    systemd.services.grafana-secret-key  = {
+      requiredBy = [ "grafana.service" ];
+      before = [ "grafana.service" ];
+    };
+
     services.grafana = {
       enable = true;
       settings = {
+        security.secret_key = "$__file{${config.secrets.grafana-secret-key.dest}}";
         server = {
           domain = hostnames.metrics;
           http_addr = "127.0.0.1";