disable flaky paho-mqtt test suite breaking flame rebuild

fix mathesar has a flaky test
fix Discord on macOS: use Homebrew cask instead of broken nixpkgs bundle
2026-07-26 06:48:35 +00:00 · 2026-07-20 18:28:57 -04:00 · 2026-07-20 17:50:56 -04:00 · 2026-07-20 17:50:54 -04:00 · 2026-07-20 14:33:48 -04:00 · 2026-07-20 14:25:58 -04:00
104 changed files with 2358 additions and 696 deletions
@@ -0,0 +1,13 @@
+{
+  "permissions": {
+    "allow": [
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "Bash(gh run *)",
+      "Bash(jj status *)",
+      "Bash(jj new *)",
+      "Bash(jj describe *)",
+      "Bash(nix flake *)"
+    ]
+  }
+}
@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-07-20
+
+- Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based
+  test suite. Its `checkPhase` hangs in the Nix sandbox and times out with a
+  `KeyboardInterrupt` after ~150s, which was breaking the `flame` rebuild
+  (paho-mqtt is pulled in transitively, e.g. via mealie). The override is
+  applied through `pythonPackagesExtensions` so it covers every Python
+  package set.
@@ -1,12 +1,18 @@
 {
  "nodes": {
    "cl-nix-lite": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems",
+        "treefmt-nix": "treefmt-nix"
+      },
      "locked": {
-        "lastModified": 1728174978,
-        "narHash": "sha256-Grqqg+xuicANB85j0gNEXxi9SBKY7bzGeTuyi95eGcY=",
+        "lastModified": 1782994178,
+        "narHash": "sha256-VGc3/2fe6hnOmNSLlOygEAbeS69v7A7rjKDKRzAgE2Q=",
        "owner": "hraban",
        "repo": "cl-nix-lite",
-        "rev": "31cfe6275c341eb3120a99f4b1c8516c49a29d87",
+        "rev": "eb584721e5e799bafe0c6210a8a1a398f90e8ac0",
        "type": "github"
      },
      "original": {
@@ -22,11 +28,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1755825449,
-        "narHash": "sha256-XkiN4NM9Xdy59h69Pc+Vg4PxkSm9EWl6u7k6D5FZ5cM=",
+        "lastModified": 1784123936,
+        "narHash": "sha256-IOWwQMJhUxcojm0MRvuKs1fKLH727u4+hHeEOPhdUyA=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "8df64f819698c1fee0c2969696f54a843b2231e8",
+        "rev": "a4cf1d10853b0d2be19b9eca35d749e201d70b55",
        "type": "github"
      },
      "original": {
@@ -43,11 +49,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756115622,
-        "narHash": "sha256-iv8xVtmLMNLWFcDM/HcAPLRGONyTRpzL9NS09RnryRM=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "bafad29f89e83b2d861b493aa23034ea16595560",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
        "type": "github"
      },
      "original": {
@@ -59,11 +65,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1730663653,
-        "narHash": "sha256-kFCUWettiFHDIqxCWWQ9qY8pVh+Lj+XL0Giyy/kdomg=",
+        "lastModified": 1766808011,
+        "narHash": "sha256-s83BS0abtIj7vzUf8JE0209KphfHA6qRw/92D9k/F+0=",
        "owner": "hraban",
        "repo": "flake-compat",
-        "rev": "e5b16676185cb7548581c852f51ce7f3a49bba5e",
+        "rev": "6e0aafdc4c4c2043c66f756d5045374b42184fc5",
        "type": "github"
      },
      "original": {
@@ -76,11 +82,11 @@
    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
@@ -90,6 +96,24 @@
      }
    },
    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
      "inputs": {
        "nixpkgs-lib": [
          "nur",
@@ -132,7 +156,7 @@
    },
    "flake-utils_2": {
      "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -148,27 +172,6 @@
        "type": "github"
      }
    },
-    "helix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1756477005,
-        "narHash": "sha256-e/FNNIT/LPuoruzRQZf5z5L5GApq1G2y2PShy+Lakhs=",
-        "owner": "helix-editor",
-        "repo": "helix",
-        "rev": "77ff51caa440b1066e0a1920007ab5e148dd4856",
-        "type": "github"
-      },
-      "original": {
-        "owner": "helix-editor",
-        "repo": "helix",
-        "type": "github"
-      }
-    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -176,11 +179,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1756496801,
-        "narHash": "sha256-IYIsnPy+cJxe8RbDHBrCtfJY0ry2bG2H7WvMcewiGS8=",
+        "lastModified": 1784351324,
+        "narHash": "sha256-By+kuRJZRqs2TuXgtR8vJ8cTKWXw33YG/Yollu5cO1U=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "77a71380c38fb2a440b4b5881bbc839f6230e1cb",
+        "rev": "460108009ca1ff69ca2ff19079ca2c838d6e3080",
        "type": "github"
      },
      "original": {
@@ -195,18 +198,16 @@
        "cl-nix-lite": "cl-nix-lite",
        "flake-compat": "flake-compat",
        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems",
-        "treefmt-nix": "treefmt-nix"
+        "nixpkgs": "nixpkgs_3",
+        "systems": "systems_2",
+        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1756057867,
-        "narHash": "sha256-ziR5eQGqRWhW8tf8r0TIplaqNt+HXu1G1X41LUr4IYo=",
+        "lastModified": 1783182903,
+        "narHash": "sha256-7IteXipJZfFepi5zakxe0jQ5i3vRBQguk0+Gtte1Fu4=",
        "owner": "hraban",
        "repo": "mac-app-util",
-        "rev": "8414fa1e2cb775b17793104a9095aabeeada63ef",
+        "rev": "039f33deef21782d4db97087f426504951239887",
        "type": "github"
      },
      "original": {
@@ -223,11 +224,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1755344765,
-        "narHash": "sha256-k/Cvh/mzb5lSvilKdgwNBCyAyYmD8YPr1nc0sTSgwxI=",
+        "lastModified": 1779563638,
+        "narHash": "sha256-9CQKxDKDqVYdDhJW+A955AZwpwZjKUgvu0LbfsL6uyI=",
        "owner": "gytis-ivaskevicius",
        "repo": "nix2vim",
-        "rev": "78467c8de07719f92397179844bf75cdf2e58b83",
+        "rev": "6927414f0de10a18fb6bc9977717088777d50d0d",
        "type": "github"
      },
      "original": {
@@ -259,11 +260,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751903740,
-        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
        "type": "github"
      },
      "original": {
@@ -274,11 +275,58 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1754340878,
-        "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=",
+        "lastModified": 1779796641,
+        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "cab778239e705082fe97bb4990e0d24c50924c04",
+        "rev": "25f538306313eae3927264466c70d7001dcea1df",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1784280462,
+        "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1761236834,
+        "narHash": "sha256-+pthv6hrL5VLW2UqPdISGuLiUZ6SnAXdd2DdUE+fV2Q=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d5faa84122bc0a1fd5d378492efce4e289f8eac1",
        "type": "github"
      },
      "original": {
@@ -288,29 +336,45 @@
        "type": "github"
      }
    },
-    "nixpkgs-stable": {
+    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1735563628,
-        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
-        "owner": "nixos",
+        "lastModified": 1782999065,
+        "narHash": "sha256-5Dgj5+pIQYZKrXUGaLCk7CKfN3MmpwIhO94++WVxvng=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
+        "rev": "80d591ed473cfc46329932c2aadac9b435342c7c",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs_2": {
+    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1756386758,
-        "narHash": "sha256-1wxxznpW2CKvI9VdniaUnTT2Os6rdRJcRUf65ZK9OtE=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "dfb2f12e899db4876308eba6d93455ab7da304cd",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
        "type": "github"
      },
      "original": {
@@ -320,13 +384,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1728538411,
-        "narHash": "sha256-f0SBJz1eZ2yOuKUr5CA9BHULGXVSn6miBuUWdTyhUhU=",
+        "lastModified": 1744536153,
+        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b69de56fac8c2b6f8fd27f2eca01dcda8e0a4221",
+        "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
        "type": "github"
      },
      "original": {
@@ -338,17 +402,17 @@
    },
    "nur": {
      "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1756524478,
-        "narHash": "sha256-2oSBlcYCgwrVxUZwM8MV6hBFsfsWFbeN5ErQiCA+38s=",
+        "lastModified": 1784353280,
+        "narHash": "sha256-MV8bFWGuoJCELexhGWWhv0GiWnDY9hpgGXgxB81mr9g=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "e82a8b0095f54edb6bbbb1d862f3da502dca1396",
+        "rev": "697f13fd230047493989b03576419792273c3a9e",
        "type": "github"
      },
      "original": {
@@ -361,14 +425,14 @@
      "inputs": {
        "darwin": "darwin",
        "disko": "disko",
-        "helix": "helix",
        "home-manager": "home-manager",
        "mac-app-util": "mac-app-util",
        "nix2vim": "nix2vim",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_5",
        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
+        "rust-overlay": "rust-overlay",
        "wsl": "wsl",
        "zellij-switch": "zellij-switch",
        "zenyd-mpv-scripts": "zenyd-mpv-scripts"
@@ -376,35 +440,14 @@
    },
    "rust-overlay": {
      "inputs": {
-        "nixpkgs": [
-          "helix",
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
-        "lastModified": 1740623427,
-        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
+        "lastModified": 1784350408,
+        "narHash": "sha256-OstzLWL5t7Xe14xEC6GIMJCp0PrYNTSA0El7GG2av88=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1736476219,
-        "narHash": "sha256-+qyv3QqdZCdZ3cSO/cbpEY6tntyYjfe1bB12mdpNFaY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "de30cc5963da22e9742bbbbb9a3344570ed237b9",
+        "rev": "3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0",
        "type": "github"
      },
      "original": {
@@ -414,21 +457,6 @@
      }
    },
    "systems": {
-      "locked": {
-        "lastModified": 1689347925,
-        "narHash": "sha256-ozenz5bFe1UUqOn7f60HRmgc01BgTGIKZ4Xl+HbocGQ=",
-        "owner": "nix-systems",
-        "repo": "default-darwin",
-        "rev": "2235d7e6cc29ae99878133c95e9fe5e157661ffb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default-darwin",
-        "type": "github"
-      }
-    },
-    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -443,6 +471,21 @@
        "type": "github"
      }
    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1689347925,
+        "narHash": "sha256-ozenz5bFe1UUqOn7f60HRmgc01BgTGIKZ4Xl+HbocGQ=",
+        "owner": "nix-systems",
+        "repo": "default-darwin",
+        "rev": "2235d7e6cc29ae99878133c95e9fe5e157661ffb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default-darwin",
+        "type": "github"
+      }
+    },
    "systems_3": {
      "locked": {
        "lastModified": 1681028828,
@@ -458,16 +501,49 @@
        "type": "github"
      }
    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
    "treefmt-nix": {
      "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1755934250,
-        "narHash": "sha256-CsDojnMgYsfshQw3t4zjRUkmMmUdZGthl16bXVWgRYU=",
+        "lastModified": 1766000401,
+        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "74e1a52d5bd9430312f8d1b8b0354c92c17453e5",
+        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -484,11 +560,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1755261305,
-        "narHash": "sha256-EOqCupB5X5WoGVHVcfOZcqy0SbKWNuY3kq+lj1wHdu8=",
+        "lastModified": 1784058842,
+        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "203a7b463f307c60026136dd1191d9001c43457f",
+        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
        "type": "github"
      },
      "original": {
@@ -502,15 +578,17 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_2",
-        "systems": "systems_3"
+        "rust-overlay": [
+          "rust-overlay"
+        ],
+        "systems": "systems_4"
      },
      "locked": {
-        "lastModified": 1742588229,
-        "narHash": "sha256-IPg0pBw0ciF+xl6viq3nK+dvZoDZrfBDui7dkPLz258=",
+        "lastModified": 1781873766,
+        "narHash": "sha256-V8baEgRBa2SqtCLbQ4EaphIMKsnAogY2oMdttWYhkEs=",
        "owner": "mostafaqanbaryan",
        "repo": "zellij-switch",
-        "rev": "0e3c303c19890ccb03589230ac5a7c4307e573e4",
+        "rev": "ced3c681afe40785b2853e3a976908466786ee79",
        "type": "github"
      },
      "original": {
@@ -522,11 +600,11 @@
    "zenyd-mpv-scripts": {
      "flake": false,
      "locked": {
-        "lastModified": 1707704915,
-        "narHash": "sha256-9P/8q/OZXfaJMS08acQP4h3/zUA5mKRQee0JmkXcz1w=",
+        "lastModified": 1765050776,
+        "narHash": "sha256-9gO+GkNoGsxAbMRrBWu0FfXEQtyTmHivlaxlYLpV2YM=",
        "owner": "zenyd",
        "repo": "mpv-scripts",
-        "rev": "9bdce0050144cb24f92475f7bdd77180e0e4c26b",
+        "rev": "62f4bb313c6cb6366672e78dea940e9da8fec84a",
        "type": "github"
      },
      "original": {
@@ -8,7 +8,7 @@
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    # Used for specific stable packages
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";

    # Used for MacOS system config
    darwin = {
@@ -37,7 +37,7 @@
    # Better App install management in macOS
    mac-app-util = {
      url = "github:hraban/mac-app-util";
-      inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
+      # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
    };

    # Manage disk format and partitioning
@@ -64,17 +64,23 @@
      flake = false;
    };

+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+    };
+
    # Zellij Switcher
    zellij-switch = {
      url = "github:mostafaqanbaryan/zellij-switch";
      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.rust-overlay.follows = "rust-overlay";
    };

-    # Text editor
-    helix = {
-      url = "github:helix-editor/helix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    # # Text editor
+    # helix = {
+    #   url = "github:helix-editor/helix";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    #   inputs.rust-overlay.follows = "rust-overlay";
+    # };

    # # Nextcloud Apps
    # nextcloud-news = {
@@ -126,6 +132,7 @@
          mathesar = "mathesar.${baseName}";
          metrics = "metrics.${baseName}";
          minecraft = "minecraft.${baseName}";
+          mumble = "mumble.${baseName}";
          n8n = "n8n.${baseName}";
          navidrome = "music.${baseName}";
          notifications = "ntfy.${baseName}";
@@ -133,6 +140,7 @@
          photos = "photos.${baseName}";
          postgresql = "pg.${baseName}";
          prometheus = "prom.${baseName}";
+          recipes = "cooking.${baseName}";
          secrets = "vault.${baseName}";
          smtp = "smtp.purelymail.com";
          status = "status.${baseName}";
@@ -280,7 +288,7 @@
            inherit (lib) overlays;
          };
        in
-        pkgs.nixfmt-rfc-style
+        pkgs.nixfmt
      );

      # Templates for starting other projects quickly
@@ -12,9 +12,9 @@ rec {

  nmasur.profiles = {
    base.enable = true;
-    work.enable = true;
-    extra.enable = true;
-    gaming.enable = true;
+    # work.enable = true;
+    # extra.enable = true;
+    # gaming.enable = true;
  };

  home-manager.users."Noah.Masur" = {
@@ -26,10 +26,13 @@ rec {
    nmasur.profiles = {
      common.enable = true;
      darwin-base.enable = true;
+      darwin-gaming.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
      work.enable = true;
      experimental.enable = true;
    };
+    nmasur.presets.services.mbsync.user = "noah";
    nmasur.presets.programs.git-work.work = {
      name = "Noah-Masur_1701";
      email = "${nmasur.settings.username}@take2games.com";
@@ -28,6 +28,7 @@ rec {
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
    };
    nmasur.presets.programs.helix.enable = true;
@@ -26,6 +26,7 @@ rec {
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
    };
    home.stateVersion = "23.05";
@@ -33,6 +34,9 @@ rec {

  system.stateVersion = "23.05";

+  # Temp: disable while this isn't working
+  services.automatic-timezoned.enable = false;
+
  # Not sure what's necessary but too afraid to remove anything
  boot.initrd.availableKernelModules = [
    "xhci_pci"
@@ -30,6 +30,7 @@ rec {
      linux-base.enable = true;
      linux-gui.enable = true;
      linux-gaming.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
      developer.enable = true;
      experimental.enable = true;
@@ -66,9 +66,12 @@ lib
  overlays = [
    inputs.nur.overlays.default
    inputs.nix2vim.overlay
-    inputs.zellij-switch.overlays.default
-    inputs.helix.overlays.default
-  ] ++ (importOverlays ../overlays);
+    (final: prev: {
+      zellij-switch = inputs.zellij-switch.packages.${prev.stdenv.hostPlatform.system}.default;
+    })
+    # inputs.helix.overlays.default
+  ]
+  ++ (importOverlays ../overlays);

  # System types to support.
  supportedSystems = [
@@ -97,7 +100,13 @@ lib
    system:
    import inputs.nixpkgs {
      inherit system overlays;
-      config.permittedInsecurePackages = [ "litestream-0.3.13" ];
+      config.permittedInsecurePackages = [
+        "litestream-0.3.13"
+        "electron-36.9.5"
+        # Build-time-only dep of karakeep's frontend; CVEs don't reach
+        # the runtime closure. Remove once nixpkgs bumps it.
+        "pnpm-9.15.9"
+      ];
      config.allowUnfree = true;
    }
  );
@@ -130,7 +139,8 @@ lib
      ];
      extraSpecialArgs = {
        inherit colorscheme;
-      } // specialArgs;
+      }
+      // specialArgs;
    };

  buildNixos =
@@ -152,8 +162,10 @@ lib
          home-manager = {
            extraSpecialArgs = {
              inherit colorscheme;
-            } // specialArgs;
-          } // homeModule.home-manager;
+            }
+            // specialArgs;
+          }
+          // homeModule.home-manager;
        }
      ];
    };
@@ -167,20 +179,20 @@ lib
    inputs.darwin.lib.darwinSystem {
      inherit system specialArgs;
      modules = [
-        inputs.home-manager.darwinModules.home-manager
        inputs.mac-app-util.darwinModules.default
        {
          imports = (nixFiles ../platforms/nix-darwin);
          nixpkgs.pkgs = pkgsBySystem.${system};
        }
-        module
-        {
-          home-manager = {
-            extraSpecialArgs = {
-              inherit colorscheme;
-            } // specialArgs;
-          } // homeModule.home-manager;
-        }
+        # Home Manager is intentionally NOT activated here. It is managed
+        # standalone via `nh home switch` (see homeConfigurations, extracted
+        # from the host module's `home-manager.users`). Strip that attr so
+        # darwin-rebuild doesn't also activate a second, divergent HM
+        # generation with different store paths (useUserPackages puts packages
+        # in /etc/profiles/per-user vs. ~/.nix-profile standalone) -- that
+        # mismatch broke the prompt after every darwin-rebuild until the next
+        # `nh home switch`.
+        (builtins.removeAttrs module [ "home-manager" ])
      ];
    };

@@ -222,12 +234,15 @@ lib
          home-manager = {
            extraSpecialArgs = {
              inherit colorscheme;
-            } // specialArgs;
-          } // homeModule.home-manager;
+            }
+            // specialArgs;
+          }
+          // homeModule.home-manager;
        }
      ];
      specialArgs = {
-      } // specialArgs;
+      }
+      // specialArgs;
    };

 }
@@ -1,67 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-{
-
-  home-manager.users.${config.user} = lib.mkIf pkgs.stdenv.isDarwin {
-
-    home.packages =
-      let
-        ldap_scheme = "ldaps";
-        magic_prefix = "take";
-        ldap_port = 3269;
-        jq_parse = pkgs.writeShellScriptBin "ljq" ''
-          jq --slurp \
-            --raw-input 'split("\n\n")|map(split("\n")|map(select(.[0:1]!="#" and length>0)) |select(length > 0)|map(capture("^(?<key>[^:]*:?): *(?<value>.*)") |if .key[-1:.key|length] == ":" then .key=.key[0:-1]|.value=(.value|@base64d) else . end)| group_by(.key) | map({key:.[0].key,value:(if .|length > 1 then [.[].value] else .[].value end)}) | from_entries)' | jq -r 'del(.[].thumbnailPhoto)'
-        '';
-        ldap_script = pkgs.writeShellScriptBin "ldap" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          SEARCH_FILTER="$@"
-          ldapsearch -LLL \
-              -B -o ldif-wrap=no \
-              -E pr=5000/prompt \
-              -H "${ldap_scheme}://''${LDAP_HOST}:${builtins.toString ldap_port}" \
-              -D "${pkgs.lib.toUpper magic_prefix}2\\${pkgs.lib.toLower config.user}" \
-              -w "$(${pkgs._1password-cli}/bin/op item get T2 --fields label=password --reveal)" \
-              -b "dc=''${LDAP_HOST//./,dc=}" \
-              -s "sub" -x "(cn=''${SEARCH_FILTER})" \
-              | ${jq_parse}/bin/ljq
-        '';
-        ldapm_script = pkgs.writeShellScriptBin "ldapm" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].memberOf] | add'
-        '';
-        ldapg_script = pkgs.writeShellScriptBin "ldapg" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].member] | add'
-        '';
-        ldapl_script = pkgs.writeShellScriptBin "ldapl" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "*$@*" | jq -r '.[].name'
-        '';
-      in
-      [
-        ldap_script
-        ldapm_script
-        ldapg_script
-        ldapl_script
-        jq_parse
-      ];
-  };
-}
@@ -1,56 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  # Homebrew - Mac-specific packages that aren't in Nix
-  config = lib.mkIf pkgs.stdenv.isDarwin {
-
-    # # Requires Homebrew to be installed
-    system.activationScripts.preActivation.text = ''
-      if ! xcode-select --version 2>/dev/null; then
-        $DRY_RUN_CMD xcode-select --install
-      fi
-      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
-        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-      fi
-    '';
-
-    # Add homebrew paths to CLI path
-    home-manager.users.${config.user}.home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin/"
-    ];
-
-    homebrew = {
-      enable = true;
-      onActivation = {
-        autoUpdate = false; # Don't update during rebuild
-        cleanup = "zap"; # Uninstall all programs not declared
-        upgrade = true;
-      };
-      global = {
-        brewfile = true; # Run brew bundle from anywhere
-        lockfiles = false; # Don't save lockfile (since running from anywhere)
-      };
-      brews = [
-        "trash" # Delete files and folders to trash instead of rm
-      ];
-      casks = [
-        "1password" # 1Password will not launch from Nix on macOS
-        # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-        "keybase" # GUI on Nix not available for macOS
-        # "logitech-g-hub" # Mouse and keyboard management
-        "logitune" # Logitech webcam firmware
-        "meetingbar" # Show meetings in menu bar
-        "scroll-reverser" # Different scroll style for mouse vs. trackpad
-        "notunes" # Don't launch Apple Music with the play button
-        "steam" # Not packaged for Nixon macOS
-        "epic-games" # Not packaged for Nix
-      ];
-    };
-  };
-}
@@ -0,0 +1,5 @@
+inputs: final: prev: {
+
+  firefox-unwrapped = final.stable.firefox-unwrapped;
+
+}
@@ -0,0 +1,7 @@
+_inputs: _final: prev: {
+
+  kubernetes-helm = prev.kubernetes-helm.overrideAttrs (_old: {
+    doCheck = false;
+  });
+
+}
@@ -0,0 +1,20 @@
+# Disable paho-mqtt's flaky test suite.
+#
+# paho-mqtt's checkPhase runs socket-based integration tests that hang in
+# the Nix sandbox (they eventually time out with a KeyboardInterrupt after
+# ~150s, reporting errors and failing the build). This breaks the flame
+# rebuild, where paho-mqtt is pulled in transitively (e.g. via mealie).
+#
+# Applied through pythonPackagesExtensions so it covers every Python
+# package set (python3Packages, python314Packages, ...).
+
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      paho-mqtt = pyprev.paho-mqtt.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
+    })
+  ];
+}
@@ -21,6 +21,9 @@ let
    # [ package1.drv package2.drv ]
    (builtins.map (name: prev.callPackage name { }))

+    # Filter out packages that return null (e.g. platform-specific packages)
+    (builtins.filter (v: v != null))
+
    # Convert the list to an attrset
    # { package1 = package1.drv, package2 = package2.drv }
    listToAttrsByPnameOrName
@@ -4,7 +4,8 @@
 inputs: _final: prev: {
  # Provides `pkgs.stable`.
  stable = import inputs.nixpkgs-stable {
-    inherit (prev) system config;
+    system = prev.stdenv.hostPlatform.system;
+    config = { };
    overlays = [
      # inputs.self.overlays.vim-plugins
    ];
@@ -4,7 +4,8 @@
 inputs: _final: prev: {
  # Provides `pkgs.unstable`.
  unstable = import inputs.nixpkgs {
-    inherit (prev) system config;
+    system = prev.stdenv.hostPlatform.system;
+    inherit (prev) config;
    overlays = [
      # inputs.self.overlays.vim-plugins
    ];
@@ -100,7 +100,7 @@
        lua.command = "${pkgs.stylua}/bin/stylua";
        black.command = "${pkgs.black}/bin/black";
        fish_indent.command = "${pkgs.fish}/bin/fish_indent";
-        nixfmt.command = "${pkgs.nixfmt-rfc-style}/bin/nixfmt";
+        nixfmt.command = "${pkgs.nixfmt}/bin/nixfmt";
        rustfmt.command = "${pkgs.rustfmt}/bin/rustfmt";
        shfmt = {
          command = "${pkgs.shfmt}/bin/shfmt";
@@ -3,10 +3,10 @@

  plugins = [
    (pkgs.vimPlugins.nvim-treesitter.withPlugins (_plugins: [
-      pkgs.nmasur.ini-grammar
-      pkgs.nmasur.puppet-grammar
-      pkgs.nmasur.rasi-grammar
-      pkgs.nmasur.vimdoc-grammar
+      pkgs.nmasur.tree-sitter-ini
+      pkgs.nmasur.tree-sitter-puppet
+      pkgs.nmasur.tree-sitter-rasi
+      pkgs.nmasur.tree-sitter-vimdoc
      pkgs.tree-sitter-grammars.tree-sitter-bash
      pkgs.tree-sitter-grammars.tree-sitter-c
      pkgs.tree-sitter-grammars.tree-sitter-fish
@@ -21,7 +21,6 @@
      pkgs.tree-sitter-grammars.tree-sitter-yaml
    ]))
    pkgs.vimPlugins.vim-matchup # Better % jumping in languages
-    pkgs.vimPlugins.playground # Tree-sitter experimenting
    pkgs.vimPlugins.nginx-vim
    pkgs.vimPlugins.vim-helm
    # pkgs.vimPlugins.hmts-nvim # Tree-sitter injections for home-manager
@@ -1,6 +1,9 @@
 # Fix: Volnoti error: 'volnoti' has been removed due to lack of maintenance upstream.

 { pkgs, lib, ... }:
+if !pkgs.stdenv.isLinux then
+  null
+else
 pkgs.stdenv.mkDerivation {
  pname = "volnoti";
  version = "2013-09-23";
@@ -18,5 +18,5 @@
 }).withPlugins
  {
    plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-AcWko5513hO8I0lvbCLqVbM1eWegAhoM0J0qXoWL/vI=";
+    hash = "sha256-xz43pXTsnYmXZDAAUT+vTapoq3O/8br7igGwqZbjFdk=";
  }
@@ -0,0 +1,41 @@
+
+function exportHistory() {
+  const now = new Date();
+  const startTime = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 0, 0, 0, 0); // Beginning of today
+
+  browser.history.search({
+    text: '',
+    startTime: startTime,
+    endTime: now,
+    maxResults: 10000
+  }).then(historyItems => {
+    const historyData = JSON.stringify(historyItems, null, 2);
+    const blob = new Blob([historyData], {type: 'application/json'});
+    const url = URL.createObjectURL(blob);
+    const date = now.toISOString().slice(0, 10); // YYYY-MM-DD
+    const filename = `firefox-history/history-${date}.json`;
+
+    browser.downloads.download({
+      url: url,
+      filename: filename,
+      conflictAction: 'overwrite',
+      saveAs: false
+    });
+  });
+}
+
+browser.alarms.create('daily-export', {
+  periodInMinutes: 60 // every 1 hour
+});
+
+browser.alarms.onAlarm.addListener(alarm => {
+  if (alarm.name === 'daily-export') {
+    exportHistory();
+  }
+});
+
+browser.runtime.onMessage.addListener((message, sender, sendResponse) => {
+  if (message.command === "exportHistory") {
+    exportHistory();
+  }
+});
@@ -0,0 +1,25 @@
+{
+  "manifest_version": 3,
+  "name": "History Exporter",
+  "version": "1.1",
+  "description": "Automatically exports today's browsing history.",
+  "permissions": [
+    "history",
+    "downloads",
+    "alarms"
+  ],
+  "background": {
+    "scripts": ["background.js"]
+  },
+  "action": {
+    "default_popup": "popup.html"
+  },
+  "browser_specific_settings": {
+    "gecko": {
+      "id": "[email protected]",
+      "data_collection_permissions": {
+        "required": ["none"]
+      }
+    }
+  }
+}
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+pkgs.stdenv.mkDerivation rec {
+  pname = "firefox-history-exporter";
+  version = "1.1";
+  src = ./.;
+
+  nativeBuildInputs = [ pkgs.zip ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    dst="$out/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
+    mkdir -p "$dst"
+    zip -j "$dst/firefox-history-exporter@nmasur.com.xpi" \
+      "${src}/manifest.json" \
+      "${src}/background.js" \
+      "${src}/popup.html" \
+      "${src}/popup.js"
+  '';
+
+  meta = with pkgs.lib; {
+    description = "Automatically exports today's browsing history.";
+    license = licenses.mit;
+  };
+}
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>History Exporter</title>
+  <style>
+    body {
+      width: 200px;
+      text-align: center;
+      font-family: sans-serif;
+    }
+    button {
+      margin-top: 10px;
+      padding: 10px;
+      font-size: 16px;
+      cursor: pointer;
+    }
+  </style>
+</head>
+<body>
+  <h1>History Exporter</h1>
+  <button id="export-button">Export Now</button>
+  <p id="status"></p>
+  <script src="popup.js"></script>
+</body>
+</html>
@@ -0,0 +1,9 @@
+document.getElementById('export-button').addEventListener('click', () => {
+  browser.runtime.sendMessage({command: "exportHistory"});
+  
+  const statusElement = document.getElementById('status');
+  statusElement.textContent = 'Exporting...';
+  setTimeout(() => {
+    statusElement.textContent = 'Export complete!';
+  }, 2000);
+});
@@ -89,6 +89,13 @@ let
        drf-access-policy
        # psycopg-binary
        ;
+      # clevercsv's test_encoding_chardet is nondeterministic (chardet
+      # returns None instead of ISO-8859-1/KOI8-R on some platforms),
+      # breaking the build. Skip its test suite.
+      clevercsv = pyprev.clevercsv.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
    };
  };

@@ -1,9 +1,10 @@
 {
  lib,
  fetchFromGitHub,
-  nodejs_20,
+  nodejs_22,
  buildNpmPackage,
-  nodePackages,
+  typescript,
+  node-gyp,
  python3,
  gcc,
  gnumake,
@@ -29,10 +30,10 @@ buildNpmPackage (finalAttrs: rec {
  npmDepsHash = "sha256-N8xqRYFelolNGTEhG22M7KJ7B5U/uW7o+/XfLF8rHMg=";

  nativeBuildInputs = [
-    nodejs_20
-    nodePackages.typescript
+    nodejs_22
+    typescript
    python3
-    nodePackages.node-gyp
+    node-gyp
    gcc
    gnumake
  ];
@@ -53,8 +54,8 @@ buildNpmPackage (finalAttrs: rec {
    # export npm_config_build_from_source=true
    # export npm_config_unsafe_perm=true
    # export BINARY_SITE=none
-    # export PATH=${nodePackages.node-gyp}/bin:$PATH
-    # export npm_config_node_gyp=${nodePackages.node-gyp}/bin/node-gyp
+    # export PATH=${node-gyp}/bin:$PATH
+    # export npm_config_node_gyp=${node-gyp}/bin/node-gyp

    # npm rebuild better-sqlite3 --build-from-source --verbose

@@ -64,7 +65,7 @@ buildNpmPackage (finalAttrs: rec {
  installPhase = ''
    mkdir -p $out/{bin,lib}
    cp -r . $out/lib/prometheus-actual-exporter
-    makeWrapper ${lib.getExe nodejs_20} $out/bin/prometheus-actual-exporter \
+    makeWrapper ${lib.getExe nodejs_22} $out/bin/prometheus-actual-exporter \
      --add-flags "$out/lib/prometheus-actual-exporter/dist/app.js"
  '';

@@ -74,8 +75,8 @@ buildNpmPackage (finalAttrs: rec {
    export npm_config_build_from_source=true
    export npm_config_unsafe_perm=true
    export BINARY_SITE=none
-    export PATH=${nodePackages.node-gyp}/bin:$PATH
-    export npm_config_node_gyp=${nodePackages.node-gyp}/bin/node-gyp
+    export PATH=${node-gyp}/bin:$PATH
+    export npm_config_node_gyp=${node-gyp}/bin/node-gyp

    sed -i '/"install"/d' node_modules/better-sqlite3/package.json
    rm -f node_modules/better-sqlite3/build/Release/better_sqlite3.node || true
@@ -1,39 +1,42 @@
 {
  lib,
+  stdenv,
  buildDotnetModule,
  fetchFromGitHub,
  dotnetCorePackages,
 }:

-buildDotnetModule rec {
-  pname = "slsk-batchdl";
-  version = "2.4.7";
+if !stdenv.isLinux then
+  null
+else
+  buildDotnetModule rec {
+    pname = "slsk-batchdl";
+    version = "2.4.7";

-  src = fetchFromGitHub {
-    owner = "fiso64";
-    repo = "slsk-batchdl";
-    rev = "v${version}";
-    sha256 = "sha256-P7V7YJUA1bkfp13Glb1Q+NJ7iTya/xgO1TM88z1Nddc=";
-  };
+    src = fetchFromGitHub {
+      owner = "fiso64";
+      repo = "slsk-batchdl";
+      rev = "v${version}";
+      sha256 = "sha256-P7V7YJUA1bkfp13Glb1Q+NJ7iTya/xgO1TM88z1Nddc=";
+    };

-  projectFile = "slsk-batchdl/slsk-batchdl.csproj";
-  nugetDeps = ./nuget-deps.nix;
+    projectFile = "slsk-batchdl/slsk-batchdl.csproj";
+    nugetDeps = ./nuget-deps.nix;

-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+    dotnet-sdk = dotnetCorePackages.sdk_8_0;
+    dotnet-runtime = dotnetCorePackages.runtime_8_0;

-  # Patch the project file to use .NET 8
-  postPatch = ''
-    substituteInPlace slsk-batchdl/slsk-batchdl.csproj \
-      --replace-fail "net6.0" "net8.0"
-  '';
+    postPatch = ''
+      substituteInPlace slsk-batchdl/slsk-batchdl.csproj \
+        --replace-fail "net6.0" "net8.0"
+    '';

-  doCheck = false;
+    doCheck = false;

-  meta = with lib; {
-    description = "A batch downloader for Soulseek";
-    homepage = "https://github.com/fiso64/slsk-batchdl";
-    platforms = platforms.linux;
-    mainProgram = "slsk-batchdl";
-  };
-}
+    meta = with lib; {
+      description = "A batch downloader for Soulseek";
+      homepage = "https://github.com/fiso64/slsk-batchdl";
+      platforms = platforms.linux;
+      mainProgram = "slsk-batchdl";
+    };
+  }
@@ -6,17 +6,17 @@
 # Specify AWS_PROFILE and AWS_REGION before running this script

 aws ec2 describe-instances \
-    --filters "Name=instance-state-name,Values=running" |
-    jq -r \
-        '.Reservations[]
+  --filters "Name=instance-state-name,Values=running" |
+  jq -r \
+    '.Reservations[]
        | .Instances[]
        | .InstanceId + " - " +
        (.PrivateIpAddress // "n/a") + " - " +
        (.PublicIpAddress // "n/a") + " - " +
        (.Tags // [] | from_entries | .Name // "n/a")' |
-    fzf \
-        --height 100% \
-        --layout reverse \
-        --header $'Press Enter to start SSM session\nInstance ID - Private IP - Public IP - Name' \
-        --preview "aws ec2 describe-instances --instance-ids \"\$(echo {} | cut -d' ' -f1)\" | jq -r '.Reservations[].Instances[0]'" \
-        --bind "enter:become(aws ssm start-session --target \$(echo {} | cut -d' ' -f1))"
+  fzf \
+    --height 100% \
+    --layout reverse \
+    --header $'Press Enter to start SSM session\nInstance ID - Private IP - Public IP - Name' \
+    --preview "aws ec2 describe-instances --instance-ids \"\$(echo {} | cut -d' ' -f1)\" | jq -r '.Reservations[].Instances[0]'" \
+    --bind "enter:become(aws ssm start-session --document-name 'AWS-StartInteractiveCommand' --parameters '{\"command\": [\"bash\"]}' --target \$(echo {} | cut -d' ' -f1))"
@@ -5,7 +5,7 @@ pkgs.mkShell {
  buildInputs = with pkgs; [
    git
    stylua
-    nixfmt-rfc-style
+    nixfmt
    shfmt
    shellcheck
  ];
@@ -1,44 +1,47 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:

 # Inspired by https://github.com/cleverca22/nix-tests/blob/master/kexec/justdoit.nix
 # This script will partition and format drives; use at your own risk!

-pkgs.writeShellScriptBin "installer" ''
-  set -e
+if !pkgs.stdenv.isLinux then
+  null
+else
+  pkgs.writeShellScriptBin "installer" ''
+    set -e

-  DISK=$1
-  FLAKE=$2
-  PARTITION_PREFIX=""
+    DISK=$1
+    FLAKE=$2
+    PARTITION_PREFIX=""

-  if [ -z "$DISK" ] || [ -z "$FLAKE" ]; then
-      ${pkgs.gum}/bin/gum style --width 50 --margin "1 2" --padding "2 4" \
-          --foreground "#fb4934" \
-          "Missing required parameter." \
-          "Usage: installer -- <disk> <host>" \
-          "Example: installer -- nvme0n1 tempest" \
-          "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 tempest"
-      echo "(exiting)"
-      exit 1
-  fi
+    if [ -z "$DISK" ] || [ -z "$FLAKE" ]; then
+        ${pkgs.gum}/bin/gum style --width 50 --margin "1 2" --padding "2 4" \
+            --foreground "#fb4934" \
+            "Missing required parameter." \
+            "Usage: installer -- <disk> <host>" \
+            "Example: installer -- nvme0n1 tempest" \
+            "Flake example: nix run github:nmasur/dotfiles#installer -- nvme0n1 tempest"
+        echo "(exiting)"
+        exit 1
+    fi

-  case "$DISK" in nvme*)
-      PARTITION_PREFIX="p"
-  esac
+    case "$DISK" in nvme*)
+        PARTITION_PREFIX="p"
+    esac

-  ${pkgs.gum}/bin/gum confirm \
-      "This will ERASE ALL DATA on the disk /dev/''${DISK}. Are you sure you want to continue?" \
-      --default=false
+    ${pkgs.gum}/bin/gum confirm \
+        "This will ERASE ALL DATA on the disk /dev/''${DISK}. Are you sure you want to continue?" \
+        --default=false

-  ${pkgs.parted}/bin/parted /dev/''${DISK} -- mklabel gpt
-  ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart primary 512MiB 100%
-  ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
-  ${pkgs.parted}/bin/parted /dev/''${DISK} -- set 3 esp on
-  mkfs.ext4 -L nixos /dev/''${DISK}''${PARTITION_PREFIX}1
-  mkfs.fat -F 32 -n boot /dev/''${DISK}''${PARTITION_PREFIX}2
+    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mklabel gpt
+    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart primary 512MiB 100%
+    ${pkgs.parted}/bin/parted /dev/''${DISK} -- mkpart ESP fat32 1MiB 512MiB
+    ${pkgs.parted}/bin/parted /dev/''${DISK} -- set 3 esp on
+    mkfs.ext4 -L nixos /dev/''${DISK}''${PARTITION_PREFIX}1
+    mkfs.fat -F 32 -n boot /dev/''${DISK}''${PARTITION_PREFIX}2

-  mount /dev/disk/by-label/nixos /mnt
-  mkdir --parents /mnt/boot
-  mount /dev/disk/by-label/boot /mnt/boot
+    mount /dev/disk/by-label/nixos /mnt
+    mkdir --parents /mnt/boot
+    mount /dev/disk/by-label/boot /mnt/boot

-  ${pkgs.nixos-install-tools}/bin/nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
-''
+    ${pkgs.nixos-install-tools}/bin/nixos-install --flake github:nmasur/dotfiles#''${FLAKE}
+  ''
@@ -1,7 +1,7 @@
 { pkgs, ... }:

 pkgs.writeShellScriptBin "rebuild" ''
-  echo ${pkgs.system}
+  echo ${pkgs.stdenv.hostPlatform.system}
  SYSTEM=${if pkgs.stdenv.isDarwin then "darwin" else "linux"}
  if [ "$SYSTEM" == "darwin" ]; then
      sudo darwin-rebuild switch --flake ${builtins.toString ../../../../.}
@@ -17,23 +17,27 @@ in
    home.packages = [
      pkgs.nerd-fonts.victor-mono # Used for Vim and Terminal
      pkgs.nerd-fonts.hack # For Polybar, Rofi
+
+      # Maple Mono NF (Ligature unhinted)
+      pkgs.maple-mono.NF-unhinted
    ];
    fonts.fontconfig = {
      enable = true;
-      defaultFonts.monospace = [ "Victor Mono" ];
+      defaultFonts.monospace = [ "Maple Mono NF" ];
    };

    xsession.windowManager.i3.config.fonts = {
-      names = [ "pango:Victor Mono" ];
+      # names = [ "pango:Victor Mono" ];
+      names = [ "pango:Maple Mono" ];
      # style = "Regular";
      # size = 11.0;
    };
    services.polybar.config."bar/main".font-0 = "Hack Nerd Font:size=10;2";
    programs.rofi.font = "Hack Nerd Font 14";
-    programs.alacritty.settings.font.normal.family = "VictorMono";
-    programs.kitty.font.name = "VictorMono Nerd Font Mono";
-    nmasur.presets.programs.wezterm.font = "VictorMono Nerd Font Mono";
-    programs.ghostty.settings.font-family = "VictorMono Nerd Font Mono";
+    programs.alacritty.settings.font.normal.family = "Maple Mono NF";
+    programs.kitty.font.name = "Maple Mono NF";
+    nmasur.presets.programs.wezterm.font = "Maple Mono NF";
+    programs.ghostty.settings.font-family = "Maple Mono NF";
    services.dunst.settings.global.font = "Hack Nerd Font 14";
  };
 }
@@ -18,16 +18,17 @@ in
      "1password"
      "_1password-gui"
      "1password-cli"
-      "onepassword-password-manager" # Firefox extension
+      # "onepassword-password-manager" # Firefox extension
    ];
    home.packages = [
      pkgs._1password-cli
-    ] ++ (if pkgs.stdenv.isLinux then [ pkgs._1password-gui ] else [ ]);
+    ]
+    ++ (if pkgs.stdenv.isLinux then [ pkgs._1password-gui ] else [ ]);

-    # Firefox extension
-    programs.firefox.profiles.default.extensions.packages = [
-      pkgs.nur.repos.rycee.firefox-addons.onepassword-password-manager
-    ];
+    # # Firefox extension
+    # programs.firefox.profiles.default.extensions.packages = [
+    #   pkgs.nur.repos.rycee.firefox-addons.onepassword-password-manager
+    # ];
  };

  # # https://1password.community/discussion/135462/firefox-extension-does-not-connect-to-linux-app
@@ -174,8 +174,10 @@ in
        filters = {
          "text/plain" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
          "text/calendar" = "${pkgs.gawk}/bin/awk -f ${pkgs.aerc}/libexec/aerc/filters/calendar";
+          # "text/html" =
+          #   "${pkgs.aerc}/libexec/aerc/filters/html | ${pkgs.aerc}/libexec/aerc/filters/colorize"; # Requires w3m, dante
          "text/html" =
-            "${pkgs.aerc}/libexec/aerc/filters/html | ${pkgs.aerc}/libexec/aerc/filters/colorize"; # Requires w3m, dante
+            "!${pkgs.chawan}/bin/cha --type text/html --opt display.image-mode=kitty --opt display.columns=100 --opt display.force-columns=true";
          # "text/*" =
          #   ''${pkgs.bat}/bin/bat -fP --file-name="$AERC_FILENAME "'';
          "message/delivery-status" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
@@ -200,9 +202,12 @@ in
      };
    };

+    # Used for macOS
+    xdg.enable = lib.mkDefault pkgs.stdenv.isDarwin;
+
    xdg.desktopEntries.aerc = lib.mkIf (pkgs.stdenv.isLinux) {
      name = "aerc";
-      exec = "${lib.getExe config.nmasur.presets.services.i3.terminal} aerc %u";
+      exec = "${lib.getExe config.nmasur.presets.services.i3.terminal} -e aerc %u";
    };
    xsession.windowManager.i3.config.keybindings = lib.mkIf pkgs.stdenv.isLinux {
      "${config.xsession.windowManager.i3.config.modifier}+Shift+e" =
@@ -212,7 +217,7 @@ in
            if terminal == pkgs.wezterm then
              "start --class com.noah.aerc -- aerc"
            else
-              "--class=com.noah.aerc --command=aerc";
+              "--class=com.noah.aerc -e aerc";
        in
        "exec ${
          # Don't name the script `aerc` or it will affect grep
@@ -32,7 +32,6 @@ in
  config = lib.mkIf cfg.enable {

    accounts.calendar.accounts.default = {
-      basePath = "other/calendars"; # Where to save calendars in ~ directory
      name = "personal";
      local.type = "filesystem";
      primary = true;
@@ -18,15 +18,16 @@ in
      ca = "cargo";
    };

-    home.packages = with pkgs; [
-      gcc
-      rustc
-      cargo
-      cargo-watch
-      clippy
-      rustfmt
-      pkg-config
-      openssl
+    home.packages = [
+      pkgs.gcc
+      pkgs.rustc
+      pkgs.cargo
+      pkgs.stable.cargo-watch
+      pkgs.clippy
+      pkgs.rustfmt
+      pkgs.pkg-config
+      pkgs.openssl
+      pkgs.rust-analyzer
    ];
  };
 }
@@ -0,0 +1,34 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs.chawan;
+in
+
+{
+
+  options.nmasur.presets.programs.chawan.enable = lib.mkEnableOption "chawan TUI web browser";
+
+  config = lib.mkIf cfg.enable {
+
+    programs.chawan = {
+      enable = true;
+      settings = {
+        external.copy-cmd = if pkgs.stdenv.isLinux then "xclip -selection clipboard -in" else "pbcopy";
+      };
+    };
+
+    # Set Chawan as the default app for manual pages
+    home.sessionVariables = {
+      MANPAGER = "${lib.getExe pkgs.chawan} -T text/x-ansi";
+    };
+
+    programs.fish.shellAbbrs.man = "mancha";
+
+  };
+
+}
@@ -29,7 +29,7 @@ in
  config = lib.mkIf cfg.enable {

    # Always make the dotfiles directory considered safe for git and direnv
-    programs.git.extraConfig.safe.directory = cfg.path;
+    programs.git.settings.safe.directory = cfg.path;
    programs.direnv.config.whitelist.prefix = [ cfg.path ];

    home.activation = {
@@ -46,6 +46,8 @@ in
          ublacklist
          vimium
          wappalyzer # TODO: only for work profile
+          # pkgs.nmasur.firefox-history-exporter
+          # copy-as-markdown
          # saml-tracer
          # text-fragment
        ];
@@ -61,6 +63,7 @@ in
          "trailhead.firstrun.didSeeAboutWelcome" = true; # Disable welcome splash
          "dom.forms.autocomplete.formautofill" = false; # Disable autofill
          "extensions.formautofill.creditCards.enabled" = false; # Disable credit cards
+          "extensions.autoDisableScopes" = false; # Enable extensions automatically
          "dom.payments.defaults.saveAddress" = false; # Disable address save
          "general.autoScroll" = true; # Drag middle-mouse to scroll
          "services.sync.prefs.sync.general.autoScroll" = false; # Prevent disabling autoscroll
@@ -187,7 +190,7 @@ in
    xsession.windowManager.i3.config.keybindings = lib.mkIf pkgs.stdenv.isLinux {
      "${config.xsession.windowManager.i3.config.modifier}+Shift+b" = "exec ${
        # Don't name the script `firefox` or it will affect grep
-        builtins.toString (
+        toString (
          pkgs.writeShellScript "focus-ff.sh" ''
            count=$(ps aux | grep -c firefox)
            if [ "$count" -eq 1 ]; then
@@ -13,13 +13,35 @@ in

  options.nmasur.presets.programs.fish-darwin.enable = lib.mkEnableOption {
    description = "Fish macOS options";
-    default = config.nmasur.presets.programs.fish && pkgs.stdenv.isDarwin;
  };

  config = lib.mkIf cfg.enable {
-    programs.fish.shellAbbrs = {
-      # Shortcut to edit hosts file
-      hosts = "sudo nvim /etc/hosts";
+    # Default shell setting doesn't work
+    home.sessionVariables = {
+      SHELL = "${pkgs.fish}/bin/fish";
+    };
+
+    programs.fish = {
+      shellAbbrs = {
+        # Shortcut to edit hosts file
+        hosts = "sudo hx /etc/hosts";
+      };
+      shellInit = ''
+        set -g __nixos_path_original $PATH
+        function __nixos_path_fix -d "fix PATH value"
+          set -l result (string split ":" $__nixos_path_original)
+          for elt in $PATH
+            if not contains -- $elt $result
+              set -a result $elt
+            end
+          end
+          set -g PATH $result
+        end
+        __nixos_path_fix
+      '';
+
+      # # Speeds up fish launch time on macOS
+      # useBabelfish = true;
    };
  };
 }
@@ -21,7 +21,7 @@ in
    programs.ghostty = {
      enable = true;

-      package = if pkgs.stdenv.isDarwin then null else pkgs.ghostty;
+      package = if pkgs.stdenv.isDarwin then pkgs.ghostty-bin else pkgs.ghostty;

      enableFishIntegration = true;
      enableBashIntegration = true;
@@ -37,8 +37,8 @@ in
        fullscreen = if pkgs.stdenv.isDarwin then true else false;
        keybind = [
          "super+t=unbind" # Pass super-t to underlying tool (e.g. zellij tabs)
-          "super+shift+bracket_right=unbind"
-          "super+shift+bracket_left=unbind"
+          "super+shift+]=unbind"
+          "super+shift+[=unbind"
          "ctrl+tab=unbind"
          "ctrl+shift+tab=unbind"
          "ctrl+tab=text:\\x1b[9;5u"
@@ -39,8 +39,19 @@ in
  config = lib.mkIf cfg.enable {

    programs.git = {
-      userName = lib.mkForce cfg.work.name;
-      userEmail = lib.mkForce cfg.work.email;
+      settings = {
+        user = {
+          name = lib.mkForce cfg.work.name;
+          email = lib.mkForce cfg.work.email;
+          signingKey = "~/.ssh/work_github";
+        };
+        commit = {
+          gpgsign = true;
+        };
+        tag = {
+          gpgsign = true;
+        };
+      };
      includes = [
        {
          path = "${config.home.homeDirectory}/${config.xdg.configFile."git/personal".target}";
@@ -50,6 +61,11 @@ in

    };

+    # Add work to signers file
+    xdg.configFile."git/allowed-signers".text = ''
+      ${cfg.work.email} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIP7aXbmKHmWUZgwG5HPtwx+nREVeMIRplpAAzxPOFXL
+    '';
+
    # Personal git config
    xdg.configFile."git/personal".text = lib.generators.toGitINI {
      user = {
@@ -57,12 +73,6 @@ in
        email = cfg.personal.email;
        signingkey = "~/.ssh/id_ed25519";
      };
-      commit = {
-        gpgsign = true;
-      };
-      tag = {
-        gpgsign = true;
-      };
    };

    # Personal jj config
@@ -29,9 +29,11 @@ in

    programs.git = {
      enable = true;
-      userName = cfg.name;
-      userEmail = cfg.email;
-      extraConfig = {
+      settings = {
+        user = {
+          name = cfg.name;
+          email = cfg.email;
+        };
        core.pager = "${pkgs.git}/share/git/contrib/diff-highlight/diff-highlight | less --no-init";
        interactive.difffilter = "${pkgs.git}/share/git/contrib/diff-highlight/diff-highlight";
        pager = {
@@ -63,7 +65,7 @@ in
    };

    xdg.configFile."git/allowed-signers".text = ''
-      7386960+nmasur@users.noreply.github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s
+      ${config.nmasur.presets.programs.git.email} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s
    '';

    programs.fish.shellAbbrs = {
@@ -22,7 +22,6 @@ in
      extensions = [
        pkgs.nmasur.gh-collaborators
        pkgs.gh-dash
-        pkgs.gh-copilot
      ];
    };

@@ -7,6 +7,62 @@

 let
  cfg = config.nmasur.presets.programs.helix;
+
+  blame_file_pretty = pkgs.writeShellScriptBin "blame_file_pretty" ''
+    # Source: https://gist.github.com/gloaysa/828707f067e3bb20da18d72fa5d4963a
+    # Utility for Helix: open the patch for the commit that last touched the current line.
+    # If the line isn’t committed yet, it shows the working-tree diff for THIS file only.
+    # The script writes the diff to /tmp and prints the absolute path to stdout
+    # Adjust `context` to see more/fewer unchanged lines around the change (default: 3).
+    #
+    # usage: git-file_pretty.sh <file> <line> [context_lines]
+    # Helix mapping example:
+    # B = ':open %sh{ ~/.config/helix/utils/git-blame-commit.sh "%{buffer_name}" %{cursor_line} 3 }'
+    file="$1"
+    line="$2"
+    ctx="''${3:-3}"
+
+    # blame the exact line
+    porc="$(git blame -L "$line",+1 --porcelain -- "$file")" || exit 1
+    sha="$(printf '%s\n' "$porc" | awk 'NR==1{print $1}')"
+    commit_path="$(printf '%s\n' "$porc" | awk '/^filename /{print substr($0,10); exit}')"
+
+    out="/tmp/hx-blame_$(basename "$file")_''${sha:-wt}.diff"
+
+    if [ -z "$sha" ] || [ "$sha" = 0000000000000000000000000000000000000000 ] || [ "$sha" = "^" ]; then
+      # uncommitted line → working tree diff for this file
+      git --no-pager diff --no-color -U"$ctx" -- "$file" > "$out"
+    else
+      # committed line → only this file’s patch in that commit
+      git --no-pager show --no-color -M -C -U"$ctx" "$sha" -- "''${commit_path:-$file}" > "$out"
+    fi
+
+    # "return" the path for :open %sh{…}
+    printf '%s' "$out"
+  '';
+
+  blame_line_pretty = pkgs.writeShellScriptBin "blame_line_pretty" ''
+    # Source: https://gist.github.com/gloaysa/828707f067e3bb20da18d72fa5d4963a
+    # Utility for Helix: pretty-print blame info for the line under the cursor.
+    # Quite basic.
+    #
+    # usage: blame_line_pretty <file> <line>
+    # Helix mapping example:
+    # b = ":run-shell-command ~/.config/helix/utils/blame_line_pretty.sh %{buffer_name} %{cursor_line}"
+      file="$1"; line="$2"
+      out="$(git blame -L "$line",+1 --porcelain -- "$file")" || return 1
+
+      sha="$(printf '%s\n' "$out" | awk 'NR==1{print $1}')"
+      author="$(printf '%s\n' "$out" | awk -F'author ' '/^author /{print $2; exit}')"
+      epoch="$(printf '%s\n' "$out" | awk '/^author-time /{print $2; exit}')"
+      # dd-mm-yyyy (macOS `date -r`; fallback to gdate if present)
+      date="$( (date -r "$epoch" +%d-%m-%Y\ %H:%M 2>/dev/null) || (gdate -d "@$epoch" +%d-%m-%Y\ %H:%M 2>/dev/null) || printf '%s' "$epoch")"
+      summary="$(printf '%s\n' "$out" | awk -F'summary ' '/^summary /{print $2; exit}')"
+      change="$(printf '%s\n' "$out" | tail -n 1)"
+
+      printf "%s\n%s\n%s\n%s\n%s\n" "$sha" "$author" "$date" "$summary" "$change"
+  '';
+
 in

 {
@@ -16,13 +72,13 @@ in
  config = lib.mkIf cfg.enable {

    # Use Neovim as the editor for git commit messages
-    programs.git.extraConfig.core.editor = lib.mkForce "${lib.getExe pkgs.helix}";
+    programs.git.settings.core.editor = lib.mkForce "${lib.getExe pkgs.helix}";
    programs.jujutsu.settings.ui.editor = lib.mkForce "${lib.getExe pkgs.helix}";

    # Set Neovim as the default app for text editing and manual pages
    home.sessionVariables = {
      EDITOR = lib.mkForce "${lib.getExe pkgs.helix}";
-      MANPAGER = lib.mkForce "sh -c 'col -bx | ${lib.getExe pkgs.helix}'";
+      # MANPAGER = lib.mkForce "sh -c 'col -bx | ${lib.getExe pkgs.helix}'";
      MANWIDTH = 87;
      MANROFFOPT = "-c";
    };
@@ -62,6 +118,11 @@ in
          command = lib.getExe pkgs.marksman;
        };

+        language-server.rumdl = {
+          command = lib.getExe pkgs.rumdl;
+          args = [ "server" ];
+        };
+
        language-server.terraform-ls = {
          command = "${lib.getExe pkgs.terraform-ls}";
          args = [ "serve" ];
@@ -87,10 +148,16 @@ in
          {
            name = "markdown";
            auto-format = false;
-            language-servers = [ "marksman" ];
+            language-servers = [
+              "marksman"
+              "rumdl"
+            ];
            formatter = {
-              command = lib.getExe pkgs.mdformat;
-              args = [ "-" ];
+              command = lib.getExe pkgs.rumdl;
+              args = [
+                "fmt"
+                "-"
+              ];
            };
            # Allows return key to continue the token on the next line
            comment-tokens = [
@@ -102,9 +169,18 @@ in
            ];
          }
          {
-            name = "tfvars";
+            name = "hcl";
+            scope = "source.hcl";
+            # injection-regex = "terraform";
            auto-format = true;
            language-servers = [ "terraform-ls" ];
+            language-id = "terraform";
+            file-types = [
+              "tf"
+              "tfvars"
+              "terraform"
+              { glob = "*.auto.tfvars"; }
+            ];
            formatter = {
              command = lib.getExe pkgs.terraform;
              args = [
@@ -114,11 +190,15 @@ in
            };
          }
          {
-            name = "hcl";
+            name = "hcl-packer";
+            scope = "source.hcl-packer";
            auto-format = true;
-            language-servers = [ "terraform-ls" ];
+            file-types = [
+              "hcl"
+              "pkr.hcl"
+            ];
            formatter = {
-              command = lib.getExe pkgs.terraform;
+              command = "${pkgs.packer}/bin/packer";
              args = [
                "fmt"
                "-"
@@ -179,18 +259,9 @@ in
          ];

          # Commandline git blame
-          space.B = ":echo %sh{git log -n1 --date=short --pretty=format:'%%h %%ad %%s' $(git blame -L %{cursor_line},+1 \"%{buffer_name}\" | cut -d' ' -f1)}";
-
-          # Open yazi
-          # https://github.com/sxyazi/yazi/pull/2461
-          # Won't work until next Helix release
-          C-y = [
-            ":sh rm -f /tmp/unique-file"
-            ":insert-output ${lib.getExe pkgs.yazi} %{buffer_name} --chooser-file=/tmp/unique-file"
-            ":insert-output echo \\x1b[?1049h\\x1b[?2004h > /dev/tty"
-            ":open %sh{cat /tmp/unique-file}"
-            ":redraw"
-          ];
+          # space.B = ":echo %sh{git log -n1 --date=short --pretty=format:'%%h %%ad %%s' $(git blame -L %{cursor_line},+1 \"%{buffer_name}\" | cut -d' ' -f1)}";
+          space.B = '':open %sh{ ${blame_line_pretty}/bin/blame_line_pretty "%{buffer_name}" %{cursor_line} 3 }'';
+          space.i = '':open %sh{ ${blame_file_pretty}/bin/blame_file_pretty "%{buffer_name}" %{cursor_line} 3 }'';

          # Extend selection above
          X = "select_line_above";
@@ -256,6 +327,10 @@ in
            git-exclude = true; # Skip excluded files
          };

+          completion-replace = true; # Replace whole word with completion
+          trim-trailing-whitespace = true;
+          # rainbow-brackets = true; # Make it easier to match parentheses
+
          # Show whitespace visible to the user
          # Waiting for trailing whitespace option ideally
          whitespace = {
@@ -272,7 +347,7 @@ in

      };

-      themes."${config.programs.helix.settings.theme}" = {
+      themes.base16 = {
        "attributes" = config.theme.colors.base09;
        "comment" = {
          fg = config.theme.colors.base03;
@@ -452,8 +527,220 @@ in
        };
      };

+      themes.alabaster-style = {
+        "attribute" = config.theme.colors.base05;
+        "comment" = {
+          fg = config.theme.colors.base0A;
+          # modifiers = [ "italic" ];
+        };
+        "constant" = config.theme.colors.base0E;
+        "constant.numeric" = config.theme.colors.base0E;
+        "constant.builtin" = config.theme.colors.base0E;
+        "constant.character" = config.theme.colors.base0E;
+        "constant.character.escape" = config.theme.colors.base0C;
+        "constructor" = config.theme.colors.base0D;
+        "debug" = config.theme.colors.base03;
+        "diagnostic" = {
+          modifiers = [ "underlined" ];
+        };
+        "diff.delta" = config.theme.colors.base09;
+        "diff.minus" = config.theme.colors.base08;
+        "diff.plus" = config.theme.colors.base0B;
+        "error" = config.theme.colors.base08;
+        "function" = config.theme.colors.base0D;
+        "hint" = config.theme.colors.base03;
+        "info" = config.theme.colors.base0D;
+        "keyword" = config.theme.colors.base05;
+        "keyword.control" = config.theme.colors.base05;
+        "keyword.operator" = config.theme.colors.base05;
+        "label" = config.theme.colors.base0E;
+        "namespace" = config.theme.colors.base0E;
+        "operator" = config.theme.colors.base05;
+        "punctuation" = config.theme.colors.base04;
+        "punctuation.bracket" = config.theme.colors.base04;
+        "punctuation.delimiter" = config.theme.colors.base04;
+        "special" = config.theme.colors.base0D;
+        "string" = config.theme.colors.base0B;
+        "string.regexp" = config.theme.colors.base0B;
+        "string.special" = config.theme.colors.base0C;
+        "type" = config.theme.colors.base0A;
+        "variable" = config.theme.colors.base05;
+        "variable.parameter" = config.theme.colors.base05;
+        "variable.builtin" = config.theme.colors.base05;
+        "variable.other.member" = config.theme.colors.base05;
+        "warning" = config.theme.colors.base09;
+        "markup.bold" = {
+          fg = config.theme.colors.base0A;
+          modifiers = [ "bold" ];
+        };
+        "markup.heading" = config.theme.colors.base0D;
+        "markup.italic" = {
+          fg = config.theme.colors.base0E;
+          modifiers = [ "italic" ];
+        };
+        "markup.link.text" = config.theme.colors.base08;
+        "markup.link.url" = {
+          fg = config.theme.colors.base09;
+          modifiers = [ "underlined" ];
+        };
+        "markup.list" = config.theme.colors.base08;
+        "markup.quote" = config.theme.colors.base0C;
+        "markup.raw" = config.theme.colors.base0B;
+        "markup.strikethrough" = {
+          modifiers = [ "crossed_out" ];
+        };
+        "diagnostic.hint" = {
+          underline = {
+            style = "curl";
+          };
+        };
+        "diagnostic.info" = {
+          underline = {
+            style = "curl";
+          };
+        };
+        "diagnostic.warning" = {
+          underline = {
+            style = "curl";
+          };
+        };
+        "diagnostic.error" = {
+          underline = {
+            style = "curl";
+          };
+        };
+        "ui.background" = {
+          bg = config.theme.colors.base00;
+        };
+        "ui.bufferline.active" = {
+          fg = config.theme.colors.base00;
+          bg = config.theme.colors.base03;
+          modifiers = [ "bold" ];
+        };
+        "ui.bufferline" = {
+          fg = config.theme.colors.base04;
+          bg = config.theme.colors.base00;
+        };
+        "ui.cursor" = {
+          fg = config.theme.colors.base04;
+          modifiers = [ "reversed" ];
+        };
+        "ui.cursor.insert" = {
+          fg = config.theme.colors.base0A;
+          modifiers = [ "reversed" ];
+        };
+        "ui.cursorline.primary" = {
+          fg = config.theme.colors.base05;
+          bg = config.theme.colors.base01;
+        };
+        "ui.cursor.match" = {
+          fg = config.theme.colors.base03;
+          modifiers = [ "reversed" ];
+        };
+        "ui.cursor.select" = {
+          fg = config.theme.colors.base04;
+          modifiers = [ "reversed" ];
+        };
+        "ui.gutter" = {
+          bg = config.theme.colors.base00;
+        };
+        "ui.help" = {
+          fg = config.theme.colors.base06;
+          bg = config.theme.colors.base01;
+        };
+        "ui.linenr" = {
+          fg = config.theme.colors.base03;
+          bg = config.theme.colors.base00;
+        };
+        "ui.linenr.selected" = {
+          fg = config.theme.colors.base04;
+          bg = config.theme.colors.base01;
+          modifiers = [ "bold" ];
+        };
+        "ui.menu" = {
+          fg = config.theme.colors.base05;
+          bg = config.theme.colors.base01;
+        };
+        "ui.menu.scroll" = {
+          fg = config.theme.colors.base03;
+          bg = config.theme.colors.base01;
+        };
+        "ui.menu.selected" = {
+          fg = config.theme.colors.base01;
+          bg = config.theme.colors.base04;
+        };
+        "ui.popup" = {
+          bg = config.theme.colors.base01;
+        };
+        "ui.selection" = {
+          bg = config.theme.colors.base01;
+        };
+        "ui.selection.primary" = {
+          bg = config.theme.colors.base02;
+        };
+        "ui.statusline" = {
+          fg = config.theme.colors.base04;
+          bg = config.theme.colors.base01;
+        };
+        "ui.statusline.inactive" = {
+          bg = config.theme.colors.base01;
+          fg = config.theme.colors.base03;
+        };
+        "ui.statusline.insert" = {
+          fg = config.theme.colors.base00;
+          bg = config.theme.colors.base0B;
+        };
+        "ui.statusline.normal" = {
+          fg = config.theme.colors.base00;
+          bg = config.theme.colors.base03;
+        };
+        "ui.statusline.select" = {
+          fg = config.theme.colors.base00;
+          bg = config.theme.colors.base0F;
+        };
+        "ui.text" = config.theme.colors.base05;
+        "ui.text.focus" = config.theme.colors.base05;
+        "ui.virtual.indent-guide" = {
+          fg = config.theme.colors.base03;
+        };
+        "ui.virtual.inlay-hint" = {
+          fg = config.theme.colors.base03;
+        };
+        "ui.virtual.ruler" = {
+          bg = config.theme.colors.base01;
+        };
+        "ui.virtual.jump-label" = {
+          fg = config.theme.colors.base0A;
+          modifiers = [ "bold" ];
+        };
+        "ui.window" = {
+          bg = config.theme.colors.base01;
+        };
+      };
+
    };

+    # Create a desktop option for launching Helix from a file manager
+    # (Requires launching the terminal and then executing Helix)
+    xdg.desktopEntries.helix =
+      lib.mkIf (pkgs.stdenv.isLinux && config.nmasur.presets.services.i3.enable)
+        {
+          name = "Helix wrapper";
+          exec = ''sh -c "${lib.getExe config.nmasur.presets.services.i3.terminal} --command='hx \$1'" _ %F ''; # TODO: change to work for any terminal
+          mimeType = [
+            "text/plain"
+            "text/markdown"
+          ];
+        };
+    xdg.mimeApps.defaultApplications = {
+      "text/plain" = lib.mkBefore [ "Helix.desktop" ];
+      "text/markdown" = lib.mkBefore [ "Helix.desktop" ];
+    };
+
+    home.packages = [
+      (pkgs.writers.writeDashBin "xterm" ''${lib.getExe config.nmasur.presets.services.i3.terminal} +new-window --command"$@" '')
+    ];
+
  };

 }
@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs.homebrew;
+in
+
+{
+
+  options.nmasur.presets.programs.homebrew.enable =
+    lib.mkEnableOption "Homebrew macOS package manager";
+
+  config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      # Taps
+      # tap "homebrew/bundle"
+
+      # Brews (CLI Apps)
+      brew "trash" # Delete files and folders to trash instead of rm
+
+      # Casks (GUI Apps)
+      cask "scroll-reverser" # Different scroll style for mouse vs. trackpad
+      cask "notunes" # Don't launch Apple Music with the play button
+      cask "topnotch" # Darkens the menu bar to complete black
+      cask "ghostty" # Terminal application (not buildable on Nix on macOS)
+      cask "discord" # nixpkgs bundle breaks its notarization seal on macOS 26+
+
+      # Mac App Store apps (requires 'mas' CLI, optional)
+      # mas "Tailscale", id: 1475387142
+    '';
+
+    # Add homebrew paths to CLI path
+    home.sessionPath = [
+      "/opt/homebrew/bin/"
+      "/opt/homebrew/opt/trash/bin"
+    ];
+
+    programs.fish.shellAbbrs.t = "trash";
+
+    home.activation.backendBrewBundle = /* bash */ ''
+      # Requires Homebrew to be installed
+      if ! /usr/bin/xcode-select --version 2>/dev/null; then
+        $DRY_RUN_CMD /usr/bin/xcode-select --install
+      fi
+      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
+        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+      fi
+
+      verboseEcho "Syncing Homebrew dependencies via Brewfile..."
+
+      # Ensure Homebrew is in the PATH for the script (Apple Silicon path)
+      export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+      # Keep activation deterministic and non-interactive. Without this, brew
+      # auto-updates (git-fetches its taps) which can hang forever when there
+      # is no TTY (network stall, credential prompt, or a leftover brew lock).
+      export HOMEBREW_NO_AUTO_UPDATE=1
+      export HOMEBREW_NO_ENV_HINTS=1
+
+      # Point brew at the generated Brewfile in the Nix store directly. This
+      # avoids depending on the ~/.Brewfile symlink being linked first, and
+      # sidesteps the --global vs. inherited HOMEBREW_BUNDLE_FILE conflict.
+      unset HOMEBREW_BUNDLE_FILE
+      brewfile="${config.home.file.".Brewfile".source}"
+
+      if command -v brew &> /dev/null; then
+        # Install/upgrade everything declared in the Brewfile...
+        $DRY_RUN_CMD brew bundle install --file="$brewfile"
+        # ...then uninstall anything NOT listed (replaces deprecated --cleanup).
+        $DRY_RUN_CMD brew bundle cleanup --file="$brewfile" --force
+      else
+        verboseEcho "Warning: Homebrew not found. Actions skipped."
+      fi
+
+
+    '';
+
+  };
+}
@@ -20,8 +20,8 @@ in
      # https://github.com/martinvonz/jj/blob/main/docs/config.md
      settings = {
        user = {
-          name = config.programs.git.userName;
-          email = config.programs.git.userEmail;
+          name = config.programs.git.settings.user.name;
+          email = config.programs.git.settings.user.email;
        };
        ui.paginate = "never";

@@ -33,7 +33,10 @@ in

    home.packages = [
      # Required for the fsmonitor to auto-snapshot
-      pkgs.watchman
+      pkgs.stable.watchman
+
+      # Required to be on path to work in Zellij
+      pkgs.jjui
    ];

  };
@@ -38,13 +38,13 @@ in
    );

    # Use Neovim as the editor for git commit messages
-    programs.git.extraConfig.core.editor = "${lib.getExe cfg.package}";
+    programs.git.settings.core.editor = "${lib.getExe cfg.package}";
    programs.jujutsu.settings.ui.editor = "${lib.getExe cfg.package}";

    # Set Neovim as the default app for text editing and manual pages
    home.sessionVariables = {
      EDITOR = "${lib.getExe cfg.package}";
-      MANPAGER = "${lib.getExe cfg.package} +Man!";
+      # MANPAGER = "${lib.getExe cfg.package} +Man!";
    };

    # Create quick aliases for launching Neovim
@@ -66,7 +66,7 @@ in
      lib.mkIf (pkgs.stdenv.isLinux && config.nmasur.presets.services.i3.enable)
        {
          name = "Neovim wrapper";
-          exec = "${lib.getExe config.nmasur.presets.services.i3.terminal} nvim %F"; # TODO: change to generic
+          exec = ''${lib.getExe config.nmasur.presets.services.i3.terminal} --command="nvim %F"''; # TODO: change to generic
          mimeType = [
            "text/plain"
            "text/markdown"
@@ -29,6 +29,18 @@ in
          doas nixos-rebuild switch --flake ${config.nmasur.presets.programs.dotfiles.path}
        '';
      };
+      rebuildNixosAndPause = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.writeShellScriptBin "rebuild-nixos-pause" ''
+          ${lib.getExe cfg.commands.rebuildNixos} || read
+        '';
+      };
+      rebuildHomeAndPause = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.writeShellScriptBin "rebuild-home-pause" ''
+          ${lib.getExe cfg.commands.rebuildHome} || read
+        '';
+      };
    };
  };

@@ -15,10 +15,21 @@ in

  config = lib.mkIf (cfg.enable && (pkgs.stdenv.isDarwin || config.services.dunst.enable)) {
    home.packages = [ pkgs.noti ];
-    programs.fish.shellAbbrs = {
-      # Add noti for ghpr in Darwin
-      ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
-      grw = lib.mkForce "noti gh run watch";
+    programs.fish = {
+      shellAbbrs = {
+        # Add noti for ghpr in Darwin
+        ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
+        grw = lib.mkForce "noti gh run watch";
+      };
+      functions = {
+        gh-run = {
+          body =
+            lib.mkForce # fish
+              ''
+                ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- noti gh run watch
+              '';
+        };
+      };
    };
  };
 }
@@ -22,6 +22,6 @@ in

    # Broken on 2023-12-11
    # https://forum.obsidian.md/t/electron-25-is-now-eol-please-upgrade-to-a-newer-version/72878/8
-    # insecurePackages = [ "electron-25.9.0" ];
+    # allowInsecurePackages = [ "electron-36.9.5" ];
  };
 }
@@ -24,6 +24,7 @@ in
        .terraform/
        .target/
        /Library/
+        .jj/
      '';
    };
  };
@@ -15,6 +15,8 @@ in

  config = lib.mkIf cfg.enable {

+    home.packages = [ pkgs.jj-starship ];
+
    programs.starship = {
      enable = true;
      enableFishIntegration = true;
@@ -27,6 +29,7 @@ in
          "$git_branch"
          "$git_commit"
          "$git_status"
+          "\${custom.jj}"
          "$hostname"
          "$cmd_duration"
          "$character"
@@ -38,23 +41,37 @@ in
          vicmd_symbol = "[❮](bold green)";
        };
        cmd_duration = {
-          min_time = 5000;
+          min_time = 5001;
          show_notifications = if pkgs.stdenv.isLinux then false else true;
          min_time_to_notify = 30000;
          format = "[$duration]($style) ";
        };
+        custom = {
+          jj = {
+            when = "jj-starship detect";
+            shell = [
+              "jj-starship"
+              "--no-jj-prefix"
+              "--no-git-prefix"
+            ];
+            format = "$output ";
+          };
+        };
        directory = {
          truncate_to_repo = true;
          truncation_length = 100;
        };
        git_branch = {
+          disabled = true;
          format = "[$symbol$branch]($style)";
        };
        git_commit = {
+          disabled = true;
          format = "( @ [$hash]($style) )";
          only_detached = false;
        };
        git_status = {
+          disabled = true;
          format = "([$all_status$ahead_behind]($style) )";
          conflicted = "=";
          ahead = "⇡";
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBTYTRy
+elYzTGpSNDQ3UEcwTXlVeGJleUJmWWhaeDdDQTFRcGpmNlNrQlNVCjA5L2JrS3Vx
+Q0cyRkk5dTBLOHJXa0xJSG9MTDFnNjV1M0F5L3F5RUlVbW8KLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIG5vNm1Xem9lN2pkS25WRi9xSlpZUjhuYmdUVDUvc2o4M0xqYURR
+UmY0VGcKWVVQc2wyV0Jqbk9JR3N4bW5HOXFTZHpCa25EMC85eThQY05MdHdaeXZy
+VQotPiBzc2gtZWQyNTUxOSBuanZYNUEgWXRVa3c4STZ3WmFaNThSdE1QdVpiMVR1
+cm5hYXJsckZiRGtXLzN5RzJEawpkVHBscFd2c0R1SGxnZ3lKUnNnMEZtTUxoQlB4
+dVBEbTkvUzBJSVRiV1hBCi0+IHNzaC1lZDI1NTE5IENxSU9VQSAvQjhVam1heHNU
+elVrVGtvaUx1elFCeTdNTkRnN3c5NEc5MWg4dDU3NUhzCm5sUlhHclJrNldnVDhF
+MTV2cGd3ZFhFdm1rM2ExWVFXbkNJYWlWY0VnUmsKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGc1QUdkZEp0Z0xEekFjcHd4WVFVam9BZTBEQm9NR3QzQmxNS09VVXpHV2sK
+c2tYSElVK2prRlF3VlFqKzlVUFRHUWU3TmFXcEdsV2FKWVhKT3pWZkxVNAotLS0g
+c1cxdk5sL1c3dDZuVGp5VWJrTlBGZTByNjRxMGxTdHd0NFNHV1pyN2k5Ywr7SW9q
+/FaTTUHB5QiCihA+385sNogq7Q1RvgT2Dwn9NdmMRd/ObESbokJXVSiDDEt6d39s
+D/uoDY20p3PCk4julNn1
+-----END AGE ENCRYPTED FILE-----
@@ -0,0 +1,106 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.programs.thunderbird;
+in
+
+{
+
+  options.nmasur.presets.programs.thunderbird = {
+    enable = lib.mkEnableOption "Thunderbird email client";
+    calendar = {
+      username = lib.mkOption {
+        type = lib.types.str;
+        description = "Username for the calendar service backend";
+        default = config.nmasur.settings.username;
+      };
+      passwordCommand = lib.mkOption {
+        type = lib.types.str;
+        description = "Password for the calendar service backend";
+        default = config.accounts.email.accounts.home.passwordCommand;
+      };
+      hostname = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for the calendar service backend";
+        default = hostnames.content;
+      };
+      url = lib.mkOption {
+        type = lib.types.str;
+        description = "URL for the calendar service backend";
+        default = "https://${cfg.calendar.hostname}/remote.php/dav";
+      };
+    };
+    tasks = {
+      username = lib.mkOption {
+        type = lib.types.str;
+        description = "Username for the tasks service backend";
+        default = config.nmasur.settings.username;
+      };
+      passwordCommand = lib.mkOption {
+        type = lib.types.str;
+        description = "Password for the tasks service backend";
+        default = "${lib.getExe pkgs.age} --decrypt --identity ~/.ssh/id_ed25519 ${pkgs.writeText "taskspass.age" (builtins.readFile ./taskspass.age)}";
+      };
+      hostname = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for the tasks service backend";
+        default = hostnames.content;
+      };
+      url = lib.mkOption {
+        type = lib.types.str;
+        description = "URL for the tasks service backend";
+        default = "https://${cfg.tasks.hostname}/remote.php/dav";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    programs.thunderbird = {
+      enable = true;
+      profiles.default = {
+        isDefault = true;
+      };
+    };
+    accounts.email.accounts.home.thunderbird = {
+      enable = true;
+      profiles = [ "default" ];
+    };
+    accounts.calendar.basePath = "other/calendars"; # Where to save calendars in ~ directory
+    # accounts.calendar.accounts.home = {
+    #   local.type = "filesystem";
+    #   primary = true;
+    #   remote = {
+    #     passwordCommand = [ cfg.calendar.passwordCommand ];
+    #     type = "caldav";
+    #     url = cfg.calendar.url;
+    #     userName = cfg.calendar.username;
+    #   };
+    #   thunderbird = {
+    #     enable = true;
+    #     profiles = [ "default" ];
+    #   };
+    # };
+    # accounts.calendar.accounts.tasks = {
+    #   local.type = "filesystem";
+    #   primary = false;
+    #   remote = {
+    #     passwordCommand = [ cfg.tasks.passwordCommand ];
+    #     type = "caldav";
+    #     url = cfg.tasks.url;
+    #     userName = cfg.tasks.username;
+    #   };
+    #   thunderbird = {
+    #     enable = true;
+    #     profiles = [ "default" ];
+    #   };
+    # };
+
+  };
+}
@@ -16,6 +16,7 @@ in
  config = lib.mkIf cfg.enable {
    programs.zed-editor = {
      enable = true;
+      package = pkgs.stable.zed-editor;

      extensions = [
        "nix"
@@ -6,6 +6,7 @@
 }:

 let
+  inherit (config.nmasur.settings) username;
  cfg = config.nmasur.presets.programs.zellij;

  zellij-switch-to-last = pkgs.writeShellScriptBin "zellij-switch-to-last" ''
@@ -14,7 +15,7 @@ let
      return 1
    fi
    echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-    zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--session $TARGET_SESSION"
+    ${lib.getExe pkgs.zellij} action switch-session $TARGET_SESSION
  '';
 in

@@ -33,7 +34,24 @@ in
          # description = "Open a session in Zellij";
          body = # fish
            ''
-              set TARGET_DIR $(zoxide query --interactive)
+              set TARGET_DIR $( \
+                zoxide query --list --score | \
+                fzf --filter="$query" --no-sort | \
+                fzf \
+                  --prompt="zoxide > " \
+                  --nth=2.. \
+                  --ansi \
+                  --height=60% \
+                  --info=inline \
+                  --border=rounded \
+                  --layout=reverse \
+                  --preview-window=down:40%:wrap \
+                  --preview='ls -F -C --color=always {2..}' \
+                  --bind 'ctrl-z:ignore,btab:up,tab:down,enter:become:echo {2..}' \
+                  --cycle \
+                  --keep-right \
+                  --tabstop=1 \
+              )
              if test -z $TARGET_DIR
                return 0
              end
@@ -41,18 +59,20 @@ in
                return 1
              end
              echo "$ZELLIJ_SESSION_NAME" > ~/.local/state/zellij-last-session
-              zellij pipe --plugin file:$(which zellij-switch.wasm) -- "--cwd $TARGET_DIR --layout default --session $(basename $TARGET_DIR)"
+              ${lib.getExe pkgs.zellij} action switch-session $(basename $TARGET_DIR) --cwd $TARGET_DIR --layout default
            '';
        };
        gh-run = {
          body = # fish
            ''
-              zellij action new-pane --start-suspended -- gh run watch
+              ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- gh run watch
            '';
        };
      };
    };

+    programs.ghostty.settings.initial-command = lib.getExe pkgs.zellij;
+
    xdg.configFile."zellij/layouts/compact-top.kdl".text = # kdl
      ''
        layout {
@@ -85,10 +105,14 @@ in
      enableFishIntegration = true;
      enableZshIntegration = true;
      attachExistingSession = true;
-      exitShellOnExit = false;
+      exitShellOnExit = true;

      settings = {
        default_mode = "locked";
+        # Spawn fish directly instead of trusting $SHELL, which inherits the
+        # macOS login shell. On darwin that login shell is no longer managed by
+        # nix-darwin, so $SHELL can point at a stale /run/current-system path.
+        default_shell = lib.getExe pkgs.fish;
        # default_layout = "compact-top";
        # Remove border
        pane_frames = false;
@@ -98,6 +122,22 @@ in
        show_startup_tips = false;

        keybinds = {
+          locked = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
+            # For servers that I SSH into, use c-a-G to unlock
+            "bind \"Ctrl Alt G\"" = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
+              SwitchToMode = {
+                _args = [ "normal" ];
+              };
+            };
+          };
+          normal = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
+            # For servers that I SSH into, use c-a-G to lock
+            "bind \"Ctrl Alt G\"" = lib.mkIf (pkgs.stdenv.isLinux && !config.programs.ghostty.enable) {
+              SwitchToMode = {
+                _args = [ "locked" ];
+              };
+            };
+          };
          session = {
            "bind \"w\"" = {
              LaunchOrFocusPlugin = {
@@ -121,9 +161,15 @@ in
          shared = {
            "bind \"Alt Shift s\"" = {
              Run = {
-                _args = [
-                  (lib.getExe zellij-switch-to-last)
-                ];
+                _args =
+                  if pkgs.stdenv.isDarwin then
+                    [
+                      # "env"
+                      # "PATH=/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"
+                      (lib.getExe zellij-switch-to-last)
+                    ]
+                  else
+                    [ (lib.getExe zellij-switch-to-last) ];
                close_on_exit = true;
              };
            };
@@ -186,9 +232,28 @@ in
              };
            };
            "bind \"Alt Shift j\"" = {
+              Run = {
+                _args =
+                  if pkgs.stdenv.isDarwin then
+                    [
+                      "env"
+                      "PATH=${config.home.homeDirectory}/.nix-profile/bin:/etc/profiles/per-user/${username}/bin:/usr/bin"
+                      (lib.getExe pkgs.jjui)
+                    ]
+                  else
+                    [ (lib.getExe pkgs.jjui) ];
+                close_on_exit = true;
+                floating = true;
+                x = "1%";
+                y = "1%";
+                width = "99%";
+                height = "99%";
+              };
+            };
+            "bind \"Alt Shift y\"" = {
              Run = {
                _args = [
-                  (lib.getExe pkgs.lazyjj)
+                  (lib.getExe pkgs.yazi)
                ];
                close_on_exit = true;
                floating = true;
@@ -243,6 +308,16 @@ in
                _args = [ "Left" ];
              };
            };
+            "bind \"Alt j\"" = {
+              MoveFocus = {
+                _args = [ "Down" ];
+              };
+            };
+            "bind \"Alt k\"" = {
+              MoveFocus = {
+                _args = [ "Up" ];
+              };
+            };
          };

        };
@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.darwin-settings;
+in
+
+{
+
+  options.nmasur.presets.services.darwin-settings.enable = lib.mkEnableOption "macOS settings";
+
+  config = lib.mkIf cfg.enable {
+
+    targets.darwin.defaults = {
+      NSGlobalDomain = {
+
+        # Set to dark mode
+        AppleInterfaceStyle = "Dark";
+
+        # Don't change from dark to light automatically
+        # AppleInterfaceSwitchesAutomatically = false;
+
+        # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
+        AppleKeyboardUIMode = 3;
+
+        # Expand save panel by default
+        NSNavPanelExpandedStateForSaveMode = true;
+
+        # Expand print panel by default
+        PMPrintingExpandedStateForPrint = true;
+
+        # Replace press-and-hold with key repeat
+        ApplePressAndHoldEnabled = false;
+
+        # Set a fast key repeat rate
+        KeyRepeat = 2;
+
+        # Shorten delay before key repeat begins
+        InitialKeyRepeat = 12;
+
+        # Disable autocorrect capitalization
+        NSAutomaticCapitalizationEnabled = false;
+
+        # Disable autocorrect smart dashes
+        NSAutomaticDashSubstitutionEnabled = false;
+
+        # Disable autocorrect adding periods
+        NSAutomaticPeriodSubstitutionEnabled = false;
+
+        # Disable autocorrect smart quotation marks
+        NSAutomaticQuoteSubstitutionEnabled = false;
+
+        # Disable autocorrect spellcheck
+        NSAutomaticSpellingCorrectionEnabled = false;
+      };
+
+      "com.apple.LaunchServices" = {
+        # Disable "Are you sure you want to open" dialog
+        LSQuarantine = false;
+      };
+
+      # Where to save screenshots
+      "com.apple.screencapture" = {
+        location = "~/Downloads";
+      };
+
+      # Disable disk image verification
+      "com.apple.frameworks.diskimages" = {
+        skip-verify = true;
+        skip-verify-locked = true;
+        skip-verify-remote = true;
+      };
+      # Require password immediately after screen saver begins
+      "com.apple.screensaver" = {
+        askForPassword = 1;
+        askForPasswordDelay = 0;
+      };
+
+    };
+
+    targets.darwin.currentHostDefaults = {
+      "com.apple.mouse.tapBehavior" = {
+        # Disable trackpad tap to click
+        Clicking = false;
+      };
+
+    };
+
+  };
+}
@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.dock;
+
+  # macOS stores persistent-apps as an array of dicts, not strings.
+  # nix-darwin's dock module did this transform for us; targets.darwin.defaults
+  # writes values verbatim, so we build the tile dicts ourselves.
+  mkDockApp = path: {
+    tile-data.file-data = {
+      _CFURLString = path;
+      _CFURLStringType = 0;
+    };
+  };
+in
+
+{
+
+  options.nmasur.presets.services.dock.enable = lib.mkEnableOption "macOS Dock";
+
+  config = lib.mkIf cfg.enable {
+
+    targets.darwin.defaults = {
+      "com.apple.dock" = {
+        magnification = true;
+        largesize = 48;
+
+        # Automatically show and hide the dock
+        autohide = true;
+
+        # Add translucency in dock for hidden applications
+        showhidden = true;
+
+        # Enable spring loading on all dock items
+        enable-spring-load-actions-on-all-items = true;
+
+        # Highlight hover effect in dock stack grid view
+        mouse-over-hilite-stack = true;
+
+        mineffect = "genie";
+        orientation = "bottom";
+        show-recents = false;
+        tilesize = 44;
+
+        persistent-apps = map mkDockApp [
+          "${pkgs._1password-gui}/Applications/1Password.app"
+          "${pkgs.slack}/Applications/Slack.app"
+          "/System/Applications/Calendar.app"
+          "${pkgs.firefox-unwrapped}/Applications/Firefox.app"
+          "/System/Applications/Messages.app"
+          "/System/Applications/Mail.app"
+          "/Applications/zoom.us.app"
+          "${config.programs.ghostty.package}/Applications/Ghostty.app"
+          # Discord comes from Homebrew on macOS: the nixpkgs bundle is
+          # modified in place, breaking its notarization seal, so macOS 26+
+          # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
+          "/Applications/Discord.app"
+          "${pkgs.obsidian}/Applications/Obsidian.app"
+          "${pkgs.thunderbird}/Applications/Thunderbird.app"
+        ];
+      };
+    };
+
+    # Automatically reload the Dock and Finder when Home Manager switches
+    home.activation = {
+      reloadMacSettings = config.lib.dag.entryAfter [ "writeBoundary" ] ''
+        verboseEcho "Restarting macOS desktop services..."
+        run /usr/bin/killall Dock Finder || true
+      '';
+    };
+
+  };
+}
@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.finder;
+in
+
+{
+
+  options.nmasur.presets.services.finder.enable = lib.mkEnableOption "macOS Finder options";
+
+  config = lib.mkIf cfg.enable {
+    targets.darwin.defaults = {
+      "com.apple.finder" = {
+        # Default Finder window set to column view
+        FXPreferredViewStyle = "clmv";
+
+        # Finder search in current folder by default
+        FXDefaultSearchScope = "SCcf";
+
+        # Disable warning when changing file extension
+        FXEnableExtensionChangeWarning = false;
+
+        # Allow quitting of Finder application
+        QuitMenuItem = true;
+
+        # Disable the warning before emptying the Trash
+        WarnOnEmptyTrash = false;
+
+      };
+
+      NSGlobalDomain = {
+
+        # Save to local disk by default, not iCloud
+        NSDocumentSaveNewDocumentsToCloud = false;
+
+      };
+
+      # Avoid creating .DS_Store files on network or USB volumes
+      "com.apple.desktopservices" = {
+        DSDontWriteNetworkStores = true;
+        DSDontWriteUSBStores = true;
+      };
+    };
+
+  };
+}
@@ -0,0 +1,45 @@
+--- === Hide Zoom Window ===
+-- Credit: https://news.ycombinator.com/item?id=47369091
+
+local obj = {}
+obj.__index = obj
+
+-- Metadata
+obj.name = "HideZoomWindow"
+obj.version = "0.1"
+
+function obj:init()
+    -- Hide Zoom's "share" windows so it doesn't come back on ESC keypress
+    local zoomWindow = nil
+    local originalFrame = nil
+
+    hs.hotkey.bind({"cmd", "ctrl", "alt"}, "H", function()
+      print("> trying to hide zoom")
+      if not zoomWindow then
+        print(">  looking for window")
+        zoomWindow = hs.window.find("zoom share statusbar window")
+      end
+
+      if zoomWindow then
+        print(">  found window")
+        if originalFrame then
+          print(">    restoring")
+          zoomWindow:setFrame(originalFrame)
+          originalFrame = nil
+          zoomWindow = nil
+        else
+          print(">    hiding")
+          originalFrame = zoomWindow:frame()
+          local screen = zoomWindow:screen()
+          local frame = zoomWindow:frame()
+          frame.x = screen:frame().w + 99000
+          frame.y = screen:frame().h + 99000
+          zoomWindow:setFrame(frame)
+        end
+      else
+        print(">  window not found")
+      end
+    end)
+end
+
+return obj
@@ -57,7 +57,7 @@ function obj:init()
    self.launcher:bind("ctrl", "space", function() end)
    self.launcher:bind("", "return", function()
        -- self:switch("@wezterm@")
-        self:switch("/Applications/Ghostty.app")
+        self:switch("@ghostty@")
    end)
    self.launcher:bind("", "C", function()
        self:switch("Calendar.app")
@@ -7,6 +7,7 @@

 let
  cfg = config.nmasur.presets.services.hammerspoon;
+  # inherit (config.nmasur.settings) username;
 in

 {
@@ -15,6 +16,17 @@ in
    lib.mkEnableOption "Hammerspoon macOS automation";

  config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      cask "hammerspoon" # Different scroll style for mouse vs. trackpad
+    '';
+
+    targets.darwin.defaults = {
+      "org.hammerspoon.Hammerspoon" = {
+        MJConfigFile = "${config.xdg.configHome}/hammerspoon/init.lua";
+      };
+    };
+
    xdg.configFile."hammerspoon/init.lua".source = ./init.lua;
    xdg.configFile."hammerspoon/Spoons/ControlEscape.spoon".source = ./Spoons/ControlEscape.spoon;
    xdg.configFile."hammerspoon/Spoons/DismissAlerts.spoon".source = ./Spoons/DismissAlerts.spoon;
@@ -23,17 +35,28 @@ in
        {
          discord = "${pkgs.discord}/Applications/Discord.app";
          firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
+          ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
          obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";
          slack = "${pkgs.slack}/Applications/Slack.app";
          wezterm = "${pkgs.wezterm}/Applications/WezTerm.app";
-          zed = "${pkgs.zed-editor}/Applications/Zed.app";
+          zed = "${config.programs.zed-editor.package}/Applications/Zed.app";
        };
    xdg.configFile."hammerspoon/Spoons/MoveWindow.spoon".source = ./Spoons/MoveWindow.spoon;
+    xdg.configFile."hammerspoon/Spoons/HideZoomWindow.spoon".source = ./Spoons/HideZoomWindow.spoon;

    home.activation.reloadHammerspoon = config.lib.dag.entryAfter [ "writeBoundary" ] ''
-      $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.reload()"
-      $DRY_RUN_CMD sleep 1
-      $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.console.clearConsole()"
+      # The `hs` CLI blocks forever on Hammerspoon's IPC message port when the
+      # app isn't running (|| true can't help — it never returns). Only reload
+      # when the app is actually up, and wrap each call in `timeout` as a hard
+      # backstop so activation can never hang even if IPC is unresponsive.
+      hs=/Applications/Hammerspoon.app/Contents/Frameworks/hs/hs
+      if /usr/bin/pgrep -x Hammerspoon > /dev/null 2>&1; then
+        $DRY_RUN_CMD ${pkgs.coreutils}/bin/timeout 10 "$hs" -c "hs.reload()" || true
+        $DRY_RUN_CMD sleep 1
+        $DRY_RUN_CMD ${pkgs.coreutils}/bin/timeout 10 "$hs" -c "hs.console.clearConsole()" || true
+      else
+        verboseEcho "Hammerspoon not running; skipping reload."
+      fi
    '';
  };

@@ -3,3 +3,4 @@ hs.loadSpoon("ControlEscape"):start() -- Load Hammerspoon bits from https://gith
 hs.loadSpoon("Launcher"):init()
 hs.loadSpoon("DismissAlerts"):init()
 hs.loadSpoon("MoveWindow"):init()
+hs.loadSpoon("HideZoomWindow"):init()
@@ -214,9 +214,9 @@ in
              cfg.commands.lockScreen != null
            ) "exec ${cfg.commands.lockScreen}";
            "${modifier}+Mod1+h" =
-              ''exec --no-startup-id ${lib.getExe cfg.terminal} --command="${pkgs.home-manager}/bin/home-manager switch --flake ${config.nmasur.presets.programs.dotfiles.path}#''${hostname} || read" '';
+              ''exec --no-startup-id ${lib.getExe cfg.terminal} -e "${lib.getExe config.nmasur.presets.programs.nixpkgs.commands.rebuildHome} '';
            "${modifier}+Mod1+r" =
-              "exec --no-startup-id ${lib.getExe cfg.terminal} --command='doas nixos-rebuild switch --flake ${config.nmasur.presets.programs.dotfiles.path} || read'";
+              "exec --no-startup-id ${lib.getExe cfg.terminal} -e ${lib.getExe config.nmasur.presets.programs.nixpkgs.commands.rebuildNixos}";

            # Window options
            "${modifier}+q" = "kill";
@@ -0,0 +1,53 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.menubar;
+in
+
+{
+
+  options.nmasur.presets.services.menubar.enable = lib.mkEnableOption "macOS menubar settings";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+      pkgs.ice-bar # Menu bar hiding
+    ];
+
+    targets.darwin.defaults = {
+      NSGlobalDomain = {
+
+        # Only hide menu bar in fullscreen
+        _HIHideMenuBar = false;
+
+        NSStatusItemSelectionPadding = 6;
+        NSStatusItemSpacing = 6;
+
+      };
+
+      "com.apple.menuextra.clock" = {
+        # Show seconds on the clock
+        ShowSeconds = true;
+
+        FlashDateSeparator = false;
+      };
+
+      "leits.MeetingBar" = {
+        eventTimeFormat = ''"show"'';
+        eventTitleFormat = ''"none"'';
+        eventTitleIconFormat = ''"iconCalendar"'';
+        slackBrowser = ''{"deletable":true,"arguments":"","name":"Slack","path":""}'';
+        zoomBrowser = ''{"deletable":true,"arguments":"","name":"Zoom","path":""}'';
+        teamsBrowser = ''{"deletable":true,"arguments":"","name":"Teams","path":""}'';
+        KeyboardShortcuts_joinEventShortcut = ''{"carbonModifiers":6400,"carbonKeyCode":38}'';
+        timeFormat = ''"12-hour"'';
+      };
+    };
+
+  };
+}
@@ -33,6 +33,7 @@ in
    nmasur.presets = {
      programs = {
        bat.enable = lib.mkDefault true;
+        chawan.enable = lib.mkDefault true;
        fd.enable = lib.mkDefault true;
        ripgrep.enable = lib.mkDefault true;
        starship.enable = lib.mkDefault true;
@@ -17,33 +17,23 @@ in

    nmasur.presets = {
      fonts.enable = lib.mkDefault true;
-      services.hammerspoon.enable = lib.mkDefault true;
-      programs.nixpkgs-darwin.enable = lib.mkDefault true;
-      programs.mpv.enable = lib.mkDefault true;
+      services = {
+        darwin-settings.enable = lib.mkDefault true;
+        dock.enable = lib.mkDefault true;
+        finder.enable = lib.mkDefault true;
+        hammerspoon.enable = lib.mkDefault true;
+        menubar.enable = lib.mkDefault true;
+      };
+      programs = {
+        fish-darwin.enable = lib.mkDefault true;
+        homebrew.enable = lib.mkDefault true;
+        nixpkgs-darwin.enable = lib.mkDefault true;
+        mpv.enable = lib.mkDefault true;
+        noti.enable = lib.mkDefault true;
+      };
    };

    home.homeDirectory = lib.mkForce "/Users/${config.home.username}";
-
-    # Default shell setting doesn't work
-    home.sessionVariables = {
-      SHELL = "${pkgs.fish}/bin/fish";
-    };
-
-    # Used for aerc
-    xdg.enable = lib.mkDefault pkgs.stdenv.isDarwin;
-
-    programs.fish.shellAbbrs.t = "trash";
-
-    # Add homebrew paths to CLI path
-    home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin"
-    ];
-
-    home.packages = [
-      pkgs.noti # Create notifications programmatically
-      pkgs.ice-bar # Menu bar hiding
-    ];
  };

  # Fix for: 'Error: HOME is set to "/var/root" but we expect "/var/empty"'
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.darwin-gaming;
+in
+
+{
+
+  options.nmasur.profiles.darwin-gaming.enable = lib.mkEnableOption "gaming config for macOS";
+
+  config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      # Casks (GUI Apps)
+      cask "steam" # Not packaged for Nix on macOS
+      cask "epic-games" # Not packaged for Nix
+    '';
+
+  };
+}
@@ -19,6 +19,10 @@ in
      pkgs.pgcli # Postgres client with autocomplete
    ];

+    nmasur.presets = {
+      programs.cargo.enable = lib.mkDefault true;
+    };
+
  };

 }
@@ -17,7 +17,6 @@ in

    nmasur.presets.programs = {
      zed-editor.enable = lib.mkDefault true;
-      jujutsu.enable = lib.mkDefault true;
    };

    home.packages = [
@@ -28,8 +27,14 @@ in
      pkgs.skate # Key-value store
      pkgs.charm # Manage account and filesystem
      pkgs.pop # Send emails from a TUI
+      pkgs.snitch # Network
+      pkgs.comma # Nix-index auto-launch
+      pkgs.nix-inspect # TUI for browsing Nix configs

-      pkgs.chawan # Browser TUI
+      # pkgs.crush # AI LLM Agent
+      pkgs.gemini-cli # AI LLM Agent
+      pkgs.antigravity-cli # AI LLM Agent
+      pkgs.pi-coding-agent # AI LLM Agent

    ];

@@ -32,6 +32,7 @@ in
        nsxiv.enable = lib.mkDefault true;
        obsidian.enable = lib.mkDefault true;
        rofi.enable = lib.mkDefault true;
+        thunderbird.enable = lib.mkDefault true;
        xclip.enable = lib.mkDefault true;
        zathura.enable = lib.mkDefault true;
      };
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.llm-development;
+in
+
+{
+
+  options.nmasur.profiles.llm-development.enable = lib.mkEnableOption "LLM coding tools";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+
+      pkgs.pi-coding-agent # AI LLM Agent
+
+    ];
+
+  };
+
+}
@@ -16,16 +16,17 @@ in
      pkgs.age # Encryption
      pkgs.bc # Calculator
      pkgs.bottom # System monitor (top)
+      pkgs.csvlens # CSV viewer (easier than visidata)
      pkgs.delta # Fancy diffs
      pkgs.difftastic # Other fancy diffs
      pkgs.doggo # DNS client (dig)
-      pkgs.du-dust # Disk usage tree (ncdu)
+      pkgs.dust # Disk usage tree (ncdu)
      pkgs.dua # File sizes (du)
      pkgs.duf # Basic disk information (df)
      pkgs.jless # JSON viewer
      pkgs.jo # JSON output
-      pkgs.mpd # TUI slideshows
-      pkgs.nixfmt-rfc-style # Format Nix code
+      pkgs.stable.mpd # TUI slideshows
+      pkgs.nixfmt # Format Nix code
      pkgs.nmasur.jqr # FZF fq JSON tool
      pkgs.nmasur.osc # Clipboard over SSH
      pkgs.nmasur.ren-find # Rename files
@@ -33,7 +34,7 @@ in
      pkgs.pandoc # Convert text documents
      pkgs.qrencode # Generate qr codes
      pkgs.spacer # Output lines in terminal
-      pkgs.tealdeer # Cheatsheets
+      pkgs.stable.tealdeer # Cheatsheets
      pkgs.tree # Print tree in terminal
      pkgs.vimv-rs # Batch rename files
      pkgs.yazi # TUI file explorer
@@ -42,7 +43,7 @@ in

    programs.fish.shellAliases = {
      "du" = lib.mkDefault (lib.getExe pkgs.dua);
-      "ncdu" = lib.mkDefault (lib.getExe pkgs.du-dust);
+      "ncdu" = lib.mkDefault (lib.getExe pkgs.dust);
      "df" = lib.mkDefault (lib.getExe pkgs.duf);

      # Use eza (exa) instead of ls for fancier output
@@ -63,8 +64,9 @@ in
      ghostty.enable = lib.mkDefault true;
      git.enable = lib.mkDefault true;
      helix.enable = lib.mkDefault true;
+      jujutsu.enable = lib.mkDefault true;
      lazygit.enable = lib.mkDefault true;
-      neovim.enable = lib.mkDefault true;
+      # neovim.enable = lib.mkDefault true;
      nix-index.enable = lib.mkDefault true;
      nixpkgs.enable = lib.mkDefault true;
      notes.enable = lib.mkDefault true;
@@ -21,7 +21,9 @@ in
    ];

    home.packages = [
-      pkgs.visidata # CSV inspector
+      pkgs.actionlint # Lint for GitHub Actions Workflows
+      pkgs.claude-code # AI LLM Agent
+      pkgs.stable.visidata # CSV inspector
      pkgs.dos2unix # Convert Windows text files
      pkgs.inetutils # Includes telnet
      pkgs.gnupg # Encryption
@@ -29,6 +31,7 @@ in
      pkgs.ssm-session-manager-plugin
      pkgs.awslogs
      pkgs.stu # TUI for AWS S3
+      pkgs.pre-commit
      pkgs.google-cloud-sdk
      pkgs.vault-bin
      pkgs.ipcalc # Make IP network calculations
@@ -37,18 +40,28 @@ in
      pkgs.nmasur.ocr # Converts images to text
      pkgs.nmasur.aws-ec2 # Browse EC2 instances
      pkgs.nmasur.terraform-init # Quick shortcut for initializing Terraform backend
+      pkgs.uv # Python packaging
    ];

+    home.file.".Brewfile".text = /* homebrew */ ''
+      # cask "1password" # 1Password will not launch from Nix on macOS
+      # cask "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
+      # cask "logitech-g-hub" # Mouse and keyboard management
+      cask "logitune" # Logitech webcam firmware
+      cask "meetingbar" # Show meetings in menu bar
+    '';
+
    programs.fish.shellAliases.ec2 = "aws-ec2";

    nmasur.presets = {
      fonts.enable = lib.mkDefault true;
      programs = {
-        _1password.enable = lib.mkDefault true;
+        # _1password.enable = lib.mkDefault true;
        atuin.enable = lib.mkDefault true;
        aws-ssh.enable = lib.mkDefault true;
        bash.enable = lib.mkDefault true;
        bat.enable = lib.mkDefault true;
+        cargo.enable = lib.mkDefault true;
        direnv.enable = lib.mkDefault true;
        dotfiles.enable = lib.mkDefault true;
        fd.enable = lib.mkDefault true;
@@ -67,8 +80,12 @@ in
        ripgrep.enable = lib.mkDefault true;
        starship.enable = lib.mkDefault true;
        terraform.enable = lib.mkDefault true;
+        thunderbird.enable = lib.mkDefault true;
        weather.enable = lib.mkDefault true;
      };
+      services = {
+        mbsync.enable = lib.mkDefault true;
+      };
    };

  };
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs._1password;
+in
+
+{
+  options.nmasur.presets.programs._1password.enable = lib.mkEnableOption "1Password password manager";
+
+  config = lib.mkIf cfg.enable {
+    # Unfree packages are already permitted via the shared nixpkgs instance
+    # created in lib/default.nix (config.allowUnfree = true). Setting
+    # nixpkgs.config here would conflict with nixpkgs.pkgs being set externally.
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      # Certain features, including CLI integration and system authentication support,
+      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+      # polkitPolicyOwners = [ "yourUsernameHere" ];
+    };
+  };
+}
@@ -23,5 +23,19 @@ in

    # Speeds up fish launch time on macOS
    programs.fish.useBabelfish = true;
+
+    programs.fish.shellInit = ''
+      set -g __nixos_path_original $PATH
+      function __nixos_path_fix -d "fix PATH value"
+        set -l result (string split ":" $__nixos_path_original)
+        for elt in $PATH
+          if not contains -- $elt $result
+            set -a result $elt
+          end
+        end
+        set -g PATH $result
+      end
+      __nixos_path_fix
+    '';
  };
 }
@@ -33,7 +33,6 @@ in
      };
      global = {
        brewfile = true; # Run brew bundle from anywhere
-        lockfiles = false; # Don't save lockfile (since running from anywhere)
      };
    };

@@ -0,0 +1,70 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (config.nmasur.settings) username;
+  cfg = config.nmasur.presets.services.daily-summary;
+
+  # Remove process urls in favor of using extention
+  # process_urls = pkgs.writers.writePython3Bin "process-urls" {
+  #   libraries = [
+  #     pkgs.python3Packages.requests
+  #     pkgs.python3Packages.beautifulsoup4
+  #   ];
+  # } (builtins.readFile ./process-urls.py);
+  # prompt = "Based on my browser usage for today from the markdown file located in /Users/${username}/Downloads/Sidebery/todays_urls.md, create or update a daily summary markdown file in the generated notes directory located in /Users/${username}/dev/personal/notes/generated/ with the filename format 'YYYY-MM-DD Daily Summary.md'. The resulting markdown file should use /Users/${username}/dev/personal/notes/templates/generated-summary.md as a format template, and it should summarize where I have spent my time today and highlight any notable links that I have visited. Please create markdown links to other relevant notes in /Users/${username}/dev/personal/notes/. If there is an existing markdown file for today, update it to include the newest information.";
+  prompt = "Based on my browser usage for today from the JSON file located in /Users/${username}/Downloads/firefox-history/history-YYYY-MM-DD.json, create or update a daily summary markdown file in the generated notes directory located in /Users/${username}/dev/personal/notes/generated/ with the filename format 'YYYY-MM-DD Daily Summary.md'. If the JSON file for today doesn't exist, exit. The resulting markdown file should use /Users/${username}/dev/personal/notes/templates/generated-summary.md as a format template, and it should summarize where I have spent my time today and highlight any notable pages that I have visited, using the titles of each URL in the JSON file for markdown links. Please create markdown links to other relevant notes in /Users/${username}/dev/personal/notes/ and explain why they are being referenced. If there is an existing markdown file for today, update it to include the newest information.";
+in
+
+{
+
+  options.nmasur.presets.services.daily-summary.enable = lib.mkEnableOption "Daily work summary";
+
+  config = lib.mkIf cfg.enable {
+    launchd.user.agents.daily-summary = {
+      # This replaces program and args entirely
+      # script = ''
+      #   ${process_urls}/bin/process-urls /Users/${username}/Downloads/Sidebery/
+      #   GEMINI_API_KEY=$(cat /Users/${username}/.config/gemini/.gemini_api_key) ${pkgs.gemini-cli}/bin/gemini --allowed-tools all --yolo --include-directories /Users/${username}/Downloads/Sidebery/ --include-directories /Users/${username}/dev/personal/notes/ "${prompt}"
+      # '';
+      script = ''
+        GEMINI_API_KEY=$(cat /Users/${username}/.config/gemini/.gemini_api_key) ${pkgs.gemini-cli}/bin/gemini --allowed-tools all --yolo --include-directories "/Users/${username}/Downloads/firefox-history/,/Users/${username}/dev/personal/notes/" "${prompt} | tee -a /Users/${username}/dev/personal/gemini-archive/daily-summary-logs/$(date +"%Y-%m-%d").log"
+      '';
+
+      path = [
+        pkgs.bash
+        pkgs.coreutils
+      ];
+
+      serviceConfig = {
+        Label = "com.example.daily-summary";
+        # Runs the script through /bin/sh automatically
+        # RunAtLoad = true;
+        StartCalendarInterval = [
+          {
+            Hour = 4;
+            Minute = 45;
+          }
+          {
+            Hour = 6;
+            Minute = 0;
+          }
+          {
+            Hour = 9;
+            Minute = 0;
+          }
+          {
+            Hour = 11;
+            Minute = 0;
+          }
+        ];
+      };
+
+    };
+  };
+
+}
@@ -0,0 +1,115 @@
+# Temporarily disabled in favor of using an extension to save history
+
+
+import requests
+from bs4 import BeautifulSoup
+import json
+import os
+import sys
+from datetime import datetime
+from urllib.parse import urlparse
+
+
+def find_urls(data):
+    urls = []
+    if isinstance(data, dict):
+        for key, value in data.items():
+            if key == 'url' and isinstance(value, str):
+                urls.append(value)
+            else:
+                urls.extend(find_urls(value))
+    elif isinstance(data, list):
+        for item in data:
+            urls.extend(find_urls(item))
+    return urls
+
+
+def main():
+    if len(sys.argv) > 1:
+        base_dir = sys.argv[1]
+        if not os.path.isdir(base_dir):
+            print(f"Error: Directory '{base_dir}' not found.")
+            sys.exit(1)
+    else:
+        base_dir = '.'
+
+    today = datetime.now().strftime('%Y.%m.%d')
+    output_filename = 'todays_urls.md'
+    output_filepath = os.path.join(base_dir, output_filename)
+    url_titles = {}
+
+    print(f"Searching for files in '{base_dir}' "
+          f"starting with 'snapshot-{today}-'")
+
+    with open(output_filepath, 'w') as md_file:
+        md_file.write(f'# URLs from Sidebery Snapshots for '
+                      f'{today.replace(".", "-")}\n\n')
+
+        files_processed = 0
+        for filename in sorted(os.listdir(base_dir)):
+            # Debugging print removed
+            if (filename.startswith(f'snapshot-{today}-')
+                    and filename.endswith('.json')):
+                files_processed += 1
+                print(f"Processing file: "
+                      f"{os.path.join(base_dir, filename)}")
+
+                # Extract and format date and time from filename
+                # Example: snapshot-2026.01.25-13.19.29.json
+                clean_filename = (filename.replace('snapshot-', '')
+                                  .replace('.json', ''))
+                date_time_parts = clean_filename.split('-', 1)
+
+                formatted_date = date_time_parts[0].replace('.', '-')
+                formatted_time = date_time_parts[1].replace('.', ':')
+
+                datetime_str = f"{formatted_date} {formatted_time}"
+
+                md_file.write(f'## {datetime_str}\n\n')
+
+                with open(os.path.join(base_dir, filename), 'r') as json_file:
+                    try:
+                        data = json.load(json_file)
+                        urls = find_urls(data)
+                        print(f"  Found {len(urls)} URLs")
+                        for url in urls:
+                            if url not in url_titles:
+                                try:
+                                    # Get title of URL
+                                    res = requests.get(
+                                       url,
+                                       timeout=10,
+                                       allow_redirects=True
+                                    )
+                                    soup = BeautifulSoup(
+                                        res.text,
+                                        'html.parser'
+                                    )
+                                    if soup.title and soup.title.string:
+                                        title = soup.title.string.strip()
+                                    else:
+                                        domain = urlparse(url).netloc
+                                        title = domain if domain else url
+                                    url_titles[url] = title
+                                except requests.exceptions.InvalidSchema:
+                                    continue
+                                except Exception:
+                                    domain = urlparse(url).netloc
+                                    title = domain if domain else url
+                                    url_titles[url] = title
+                            if url in url_titles:
+                                title = url_titles[url]
+                                md_file.write(f'- [{title}]({url})\n')
+                        md_file.write('\n')
+                    except json.JSONDecodeError:
+                        print(f"  Error decoding JSON in {filename}")
+                        md_file.write('- Error decoding JSON\n\n')
+
+        if files_processed == 0:
+            print("No files found for today.")
+
+    print(f"Processing complete. Output written to {output_filepath}")
+
+
+if __name__ == '__main__':
+    main()
@@ -50,8 +50,12 @@ in
        "/System/Applications/Mail.app"
        "/Applications/zoom.us.app"
        "/Applications/Ghostty.app"
-        "${pkgs.discord}/Applications/Discord.app"
+        # Discord comes from Homebrew on macOS: the nixpkgs bundle is modified
+        # in place, breaking its notarization seal, so macOS 26+ refuses to
+        # launch it ("damaged").
+        "/Applications/Discord.app"
        "${pkgs.obsidian}/Applications/Obsidian.app"
+        "${pkgs.thunderbird}/Applications/Thunderbird.app"
      ];
    };
  };
@@ -25,85 +25,85 @@ in
        enableKeyMapping = true; # Allows for skhd
      };

-      defaults = {
-        NSGlobalDomain = {
+      # defaults = {
+      #   NSGlobalDomain = {

-          # Set to dark mode
-          AppleInterfaceStyle = "Dark";
+      #     # Set to dark mode
+      #     AppleInterfaceStyle = "Dark";

-          # Don't change from dark to light automatically
-          # AppleInterfaceSwitchesAutomatically = false;
+      #     # Don't change from dark to light automatically
+      #     # AppleInterfaceSwitchesAutomatically = false;

-          # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
-          AppleKeyboardUIMode = 3;
+      #     # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
+      #     AppleKeyboardUIMode = 3;

-          # Expand save panel by default
-          NSNavPanelExpandedStateForSaveMode = true;
+      #     # Expand save panel by default
+      #     NSNavPanelExpandedStateForSaveMode = true;

-          # Expand print panel by default
-          PMPrintingExpandedStateForPrint = true;
+      #     # Expand print panel by default
+      #     PMPrintingExpandedStateForPrint = true;

-          # Replace press-and-hold with key repeat
-          ApplePressAndHoldEnabled = false;
+      #     # Replace press-and-hold with key repeat
+      #     ApplePressAndHoldEnabled = false;

-          # Set a fast key repeat rate
-          KeyRepeat = 2;
+      #     # Set a fast key repeat rate
+      #     KeyRepeat = 2;

-          # Shorten delay before key repeat begins
-          InitialKeyRepeat = 12;
+      #     # Shorten delay before key repeat begins
+      #     InitialKeyRepeat = 12;

-          # Disable autocorrect capitalization
-          NSAutomaticCapitalizationEnabled = false;
+      #     # Disable autocorrect capitalization
+      #     NSAutomaticCapitalizationEnabled = false;

-          # Disable autocorrect smart dashes
-          NSAutomaticDashSubstitutionEnabled = false;
+      #     # Disable autocorrect smart dashes
+      #     NSAutomaticDashSubstitutionEnabled = false;

-          # Disable autocorrect adding periods
-          NSAutomaticPeriodSubstitutionEnabled = false;
+      #     # Disable autocorrect adding periods
+      #     NSAutomaticPeriodSubstitutionEnabled = false;

-          # Disable autocorrect smart quotation marks
-          NSAutomaticQuoteSubstitutionEnabled = false;
+      #     # Disable autocorrect smart quotation marks
+      #     NSAutomaticQuoteSubstitutionEnabled = false;

-          # Disable autocorrect spellcheck
-          NSAutomaticSpellingCorrectionEnabled = false;
-        };
+      #     # Disable autocorrect spellcheck
+      #     NSAutomaticSpellingCorrectionEnabled = false;
+      #   };

-        # Disable "Are you sure you want to open" dialog
-        LaunchServices.LSQuarantine = false;
+      #   # Disable "Are you sure you want to open" dialog
+      #   LaunchServices.LSQuarantine = false;

-        # Disable trackpad tap to click
-        trackpad.Clicking = false;
+      #   # Disable trackpad tap to click
+      #   trackpad.Clicking = false;

-        # Where to save screenshots
-        screencapture.location = "~/Downloads";
+      #   # Where to save screenshots
+      #   screencapture.location = "~/Downloads";

-        CustomUserPreferences = {
-          # Disable disk image verification
-          "com.apple.frameworks.diskimages" = {
-            skip-verify = true;
-            skip-verify-locked = true;
-            skip-verify-remote = true;
-          };
-          # Require password immediately after screen saver begins
-          "com.apple.screensaver" = {
-            askForPassword = 1;
-            askForPasswordDelay = 0;
-          };
-        };
+      #   CustomUserPreferences = {
+      #     # Disable disk image verification
+      #     "com.apple.frameworks.diskimages" = {
+      #       skip-verify = true;
+      #       skip-verify-locked = true;
+      #       skip-verify-remote = true;
+      #     };
+      #     # Require password immediately after screen saver begins
+      #     "com.apple.screensaver" = {
+      #       askForPassword = 1;
+      #       askForPasswordDelay = 0;
+      #     };
+      #   };

-        CustomSystemPreferences = {
+      #   CustomSystemPreferences = {

-        };
-      };
+      #   };
+      # };

-      # Settings that don't have an option in nix-darwin
-      activationScripts.postActivation.text = ''
-        echo "Allow apps from anywhere"
-        SPCTL=$(spctl --status)
-        if ! [ "$SPCTL" = "assessments disabled" ]; then
-            sudo spctl --master-disable
-        fi
-      '';
+      # # Settings that don't have an option in nix-darwin
+      # activationScripts.postActivation.text = ''
+      #   echo "Allow apps from anywhere"
+      #   SPCTL=$(spctl --status)
+      #   if ! [ "$SPCTL" = "assessments disabled" ]; then
+      #       spctl --master-disable
+      #   fi
+      # '';

    };

@@ -18,29 +18,31 @@ in

    nmasur.presets = {
      programs = {
+        _1password.enable = lib.mkDefault true;
        fish.enable = lib.mkDefault true;
-        homebrew.enable = lib.mkDefault true;
+        # homebrew.enable = lib.mkDefault true;
      };
      services = {
-        dock.enable = lib.mkDefault true;
-        finder.enable = lib.mkDefault true;
-        hammerspoon.enable = lib.mkDefault true;
-        menubar.enable = lib.mkDefault true;
+        # daily-summary.enable = lib.mkDefault false;
+        # dock.enable = lib.mkDefault true;
+        # finder.enable = lib.mkDefault true;
+        # hammerspoon.enable = lib.mkDefault true;
+        # menubar.enable = lib.mkDefault true;
        nix.enable = lib.mkDefault true;
        settings.enable = lib.mkDefault true;
        user.enable = lib.mkDefault true;
      };
    };

-    homebrew.brews = [
-      "trash" # Delete files and folders to trash instead of rm
-    ];
-    homebrew.casks = [
-      "scroll-reverser" # Different scroll style for mouse vs. trackpad
-      "notunes" # Don't launch Apple Music with the play button
-      "topnotch" # Darkens the menu bar to complete black
-      "ghostty" # Terminal application (not buildable on Nix on macOS)
-    ];
+    # homebrew.brews = [
+    #   "trash" # Delete files and folders to trash instead of rm
+    # ];
+    # homebrew.casks = [
+    #   "scroll-reverser" # Different scroll style for mouse vs. trackpad
+    #   "notunes" # Don't launch Apple Music with the play button
+    #   "topnotch" # Darkens the menu bar to complete black
+    #   "ghostty" # Terminal application (not buildable on Nix on macOS)
+    # ];

  };
 }
@@ -16,12 +16,12 @@ in

    nmasur.profiles.base.enable = lib.mkDefault true;

-    homebrew.casks = [
-      "1password" # 1Password will not launch from Nix on macOS
-      # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-      # "logitech-g-hub" # Mouse and keyboard management
-      "logitune" # Logitech webcam firmware
-      "meetingbar" # Show meetings in menu bar
-    ];
+    # homebrew.casks = [
+    #   "1password" # 1Password will not launch from Nix on macOS
+    #   # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
+    #   # "logitech-g-hub" # Mouse and keyboard management
+    #   "logitune" # Logitech webcam firmware
+    #   "meetingbar" # Show meetings in menu bar
+    # ];
  };
 }
@@ -125,7 +125,7 @@ in
    services.cloudflare-dyndns.domains = [ hostnames.budget ];

    # Backups
-    services.restic.backups.default.paths = [ "/var/lib/actual" ];
+    services.restic.backups.default.paths = [ "/var/lib/private/actual" ];

  };

@@ -71,7 +71,7 @@ in
      bazarr = {
        enable = true;
      };
-      jellyseerr.enable = true;
+      seerr.enable = true;
      prowlarr.enable = true;
      sabnzbd = {
        enable = true;
@@ -244,7 +244,7 @@ in
        handle = [
          {
            handler = "reverse_proxy";
-            upstreams = [ { dial = "localhost:${builtins.toString config.services.jellyseerr.port}"; } ];
+            upstreams = [ { dial = "localhost:${builtins.toString config.services.seerr.port}"; } ];
          }
        ];
      }
@@ -58,6 +58,7 @@ in
          {
            handler = "static_response";
            status_code = "403";
+            body = "IP not allowed";
          }
        ];
      }
@@ -109,96 +110,95 @@ in
            apps.tls.automation.policies = cfg.tlsPolicies;

            # Setup logging to journal and files
-            logging.logs =
-              {
-                # System logs and catch-all
-                # Must be called `default` to override Caddy's built-in default logger
-                default = {
-                  level = "INFO";
-                  encoder.format = "console";
-                  writer = {
-                    output = "stderr";
-                  };
-                  exclude = (map (hostname: "http.log.access.${hostname}") (builtins.attrNames hostname_map)) ++ [
-                    "http.log.access.${default_logger_name}"
-                  ];
+            logging.logs = {
+              # System logs and catch-all
+              # Must be called `default` to override Caddy's built-in default logger
+              default = {
+                level = "INFO";
+                encoder.format = "console";
+                writer = {
+                  output = "stderr";
                };
-                # This is for the default access logs (anything not captured by hostname)
-                other = {
-                  level = "INFO";
-                  encoder.format = "json";
-                  writer = {
-                    output = "file";
-                    filename = "${config.services.caddy.logDir}/other.log";
-                    roll = true;
-                    inherit roll_size_mb;
-                  };
-                  include = [ "http.log.access.${default_logger_name}" ];
-                };
-                # This is for using the Caddy API, which will probably never happen
-                admin = {
-                  level = "INFO";
-                  encoder.format = "json";
-                  writer = {
-                    output = "file";
-                    filename = "${config.services.caddy.logDir}/admin.log";
-                    roll = true;
-                    inherit roll_size_mb;
-                  };
-                  include = [ "admin" ];
-                };
-                # This is for TLS cert management tracking
-                tls = {
-                  level = "INFO";
-                  encoder.format = "json";
-                  writer = {
-                    output = "file";
-                    filename = "${config.services.caddy.logDir}/tls.log";
-                    roll = true;
-                    inherit roll_size_mb;
-                  };
-                  include = [ "tls" ];
-                };
-                # This is for debugging
-                debug = {
-                  level = "DEBUG";
-                  encoder.format = "json";
-                  writer = {
-                    output = "file";
-                    filename = "${config.services.caddy.logDir}/debug.log";
-                    roll = true;
-                    roll_keep = 1;
-                    inherit roll_size_mb;
-                  };
-                };
-              }
-              # These are the access logs for individual hostnames
-              // (lib.mapAttrs (name: value: {
+                exclude = (map (hostname: "http.log.access.${hostname}") (builtins.attrNames hostname_map)) ++ [
+                  "http.log.access.${default_logger_name}"
+                ];
+              };
+              # This is for the default access logs (anything not captured by hostname)
+              other = {
                level = "INFO";
                encoder.format = "json";
                writer = {
                  output = "file";
-                  filename = "${config.services.caddy.logDir}/${name}-access.log";
+                  filename = "${config.services.caddy.logDir}/other.log";
+                  roll = true;
+                  inherit roll_size_mb;
+                };
+                include = [ "http.log.access.${default_logger_name}" ];
+              };
+              # This is for using the Caddy API, which will probably never happen
+              admin = {
+                level = "INFO";
+                encoder.format = "json";
+                writer = {
+                  output = "file";
+                  filename = "${config.services.caddy.logDir}/admin.log";
+                  roll = true;
+                  inherit roll_size_mb;
+                };
+                include = [ "admin" ];
+              };
+              # This is for TLS cert management tracking
+              tls = {
+                level = "INFO";
+                encoder.format = "json";
+                writer = {
+                  output = "file";
+                  filename = "${config.services.caddy.logDir}/tls.log";
+                  roll = true;
+                  inherit roll_size_mb;
+                };
+                include = [ "tls" ];
+              };
+              # This is for debugging
+              debug = {
+                level = "DEBUG";
+                encoder.format = "json";
+                writer = {
+                  output = "file";
+                  filename = "${config.services.caddy.logDir}/debug.log";
+                  roll = true;
+                  roll_keep = 1;
+                  inherit roll_size_mb;
+                };
+              };
+            }
+            # These are the access logs for individual hostnames
+            // (lib.mapAttrs (name: value: {
+              level = "INFO";
+              encoder.format = "json";
+              writer = {
+                output = "file";
+                filename = "${config.services.caddy.logDir}/${name}-access.log";
+                roll = true;
+                inherit roll_size_mb;
+              };
+              include = [ "http.log.access.${name}" ];
+            }) hostname_map)
+            # We also capture just the errors separately for easy debugging
+            // (lib.mapAttrs' (name: value: {
+              name = "${name}-error";
+              value = {
+                level = "ERROR";
+                encoder.format = "json";
+                writer = {
+                  output = "file";
+                  filename = "${config.services.caddy.logDir}/${name}-error.log";
                  roll = true;
                  inherit roll_size_mb;
                };
                include = [ "http.log.access.${name}" ];
-              }) hostname_map)
-              # We also capture just the errors separately for easy debugging
-              // (lib.mapAttrs' (name: value: {
-                name = "${name}-error";
-                value = {
-                  level = "ERROR";
-                  encoder.format = "json";
-                  writer = {
-                    output = "file";
-                    filename = "${config.services.caddy.logDir}/${name}-error.log";
-                    roll = true;
-                    inherit roll_size_mb;
-                  };
-                  include = [ "http.log.access.${name}" ];
-                };
-              }) hostname_map);
+              };
+            }) hostname_map);
          }
        );
      };
@@ -36,6 +36,11 @@ in
      };
    };

+    # metadata.db lives in /var/lib/calibre-web-db and is symlinked into the
+    # library dir; ProtectSystem=strict in the upstream module blocks writes
+    # through symlinks unless the real target path is also listed.
+    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [ "/var/lib/calibre-web-db" ];
+
    # Allow web traffic to Caddy
    nmasur.presets.services.caddy.routes = [
      {
@@ -173,5 +173,16 @@ in
    # Enable the home-made service that we created for non-proxied records
    services.cloudflare-dyndns-noproxy.enable = true;

+    # Create certs when not using proxy
+    secrets.cloudflare-dns-api-prefixed = {
+      source = ./cloudflare-api.age;
+      dest = "${config.secretsDirectory}/cloudflare-dns-api-prefixed";
+      prefix = "CLOUDFLARE_DNS_API_TOKEN=";
+    };
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "acme@${config.nmasur.presets.programs.msmtp.domain}";
+    };
+
  };
 }
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBxUDhh
+SkpvdDNNS04yNk0yNGtqRlRXT2V2QVVScUpVd3RrMWUvYnVyRlJFCktoZUw1VnJI
+SnJ4dDBZK1ROUDRhWm1EaExKZUJmM1NrcUZ0elRtZXZFSTQKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RICtHZGEyUm1lelBEWVFIaCsxSmx0S2V3Yk5qREVRaDdtSkp6ckcz
+UDB5aWcKUFNoeU1YQjhaTG1zTEZBZElkUUpUcXVXdzgrUENUajNqRytMMFZVTzNm
+NAotPiBzc2gtZWQyNTUxOSBuanZYNUEgNjNoM0U0ZnE5dzNCenRWZmVkRVdXOGFa
+cmFjSWtFOUVXSUdzTFNlWGhUSQpvNnk3NXdGZkhtaGRJRmd3czFNUHh3OUlTSGpG
+YUJjT1Baa3dRdzF4V2EwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBXcnNQcnY5MnJ3
+b3hLM01PYXNwa2tPTFVRMC96QmZZTkdDNktWZFRHOVE4Ck1PZUlLcXN6Rnh3UnlS
+dVkwODJ2QjBXWUZOUTdBU01DYjFSemJxY1haVVUKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IEQwZTA3WFkwMWJjbXhMRDlFaEJjMVhuZFpTVTFsaktqWHFXN0J1ajJHMmMK
+bXRTdTI2N1o4ZXhYcG9kWCtMNjJCMG0zeUpqMS95SC9VdTRNdUY3ZFVVSQotLS0g
+OXJFMUkvOXkvdStrU1dBSEhhNnE0NU56SHE0UkUvbXhwcWRCdkdxdXN3SQpXUnGQ
+XJT+KXvM80eW2z/je+0kq9Yh+DkgcWtUpq2k2WyzIue9AifKco9CQ4AsBtKKoxO9
+SxjY/7b0HRwoXS578gwTxJD0j9sBRsz4s64IeiepKn01KcMTgo1TxYzB7JgM
+-----END AGE ENCRYPTED FILE-----
@@ -28,9 +28,22 @@ in
      before = [ "grafana.service" ];
    };

+    secrets.grafana-secret-key = {
+             source = ./grafana-secret-key.age;
+      dest = "${config.secretsDirectory}/grafana-secret-key";
+      owner = "grafana";
+      group = "grafana";
+      permissions = "0440";
+    };
+    systemd.services.grafana-secret-key-secret  = {
+      requiredBy = [ "grafana.service" ];
+      before = [ "grafana.service" ];
+    };
+
    services.grafana = {
      enable = true;
      settings = {
+        security.secret_key = "$__file{${config.secrets.grafana-secret-key.dest}}";
        server = {
          domain = hostnames.metrics;
          http_addr = "127.0.0.1";
@@ -773,12 +786,12 @@ in
                          {
                            matcher = {
                              id = "byName";
-                              options = "localhost:${builtins.toString config.services.jellyseerr.port}";
+                              options = "localhost:${builtins.toString config.services.seerr.port}";
                            };
                            properties = [
                              {
                                id = "displayName";
-                                value = "Jellyseerr";
+                                value = "Seerr";
                              }
                              {
                                id = "links";
@@ -29,7 +29,7 @@ in
              caps
          )
          (defalias
-              escctrl (tap-hold-press 1000 1000 esc lctrl)
+              escctrl (tap-hold-press 200 200 esc lctrl)
          )
          (deflayer base
              @escctrl
@@ -0,0 +1,43 @@
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.mealie;
+in
+
+{
+
+  options.nmasur.presets.services.mealie.enable = lib.mkEnableOption "mealie recipe manager";
+  config = lib.mkIf cfg.enable {
+
+    services.mealie = {
+      enable = true;
+      port = 9099;
+      database.createLocally = true;
+      listenAddress = "127.0.0.1";
+      settings = {
+        TOKEN_TIME = 7200; # Hours for login to last (300 days)
+      };
+    };
+
+    nmasur.presets.services.caddy.routes = [
+      {
+        match = [ { host = [ hostnames.recipes ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [ { dial = "localhost:${toString config.services.mealie.port}"; } ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.recipes ];
+
+    # Point localhost to the local domain
+    networking.hosts."127.0.0.1" = [ hostnames.recipes ];
+
+  };
+
+}
@@ -0,0 +1,43 @@
+# murmur is a Mumble server for hosting voice chat
+
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.murmur;
+in
+
+{
+
+  options.nmasur.presets.services.murmur.enable =
+    lib.mkEnableOption "murmur (mumble) voice chat service";
+
+  config = lib.mkIf cfg.enable {
+
+    services.murmur = {
+      enable = true;
+      users = 50; # Max concurrent users
+      bonjour = false; # Auto-connect LAN
+      registerUrl = "https://${hostnames.mumble}";
+      registerName = "Mumble";
+      environmentFile = null;
+      sslKey = "${config.security.acme.certs."${hostnames.mumble}".directory}/key.pem";
+      sslCert = "${config.security.acme.certs."${hostnames.mumble}".directory}/fullchain.pem";
+      openFirewall = true;
+    };
+
+    # Configure Cloudflare DNS to point to this machine
+    nmasur.presets.services.cloudflare.noProxyDomains = [ hostnames.mumble ];
+
+    security.acme.certs."${hostnames.mumble}" = {
+      dnsProvider = "cloudflare";
+      credentialFiles = {
+        CLOUDFLARE_API_KEY_FILE = config.secrets.cloudflare-dns-api-prefixed.dest;
+      };
+      group = config.services.murmur.group;
+    };
+  };
+}
@@ -2,7 +2,6 @@
 # together with triggers.

 { config, lib, ... }:
-
 let
  inherit (config.nmasur.settings) hostnames;
  cfg = config.nmasur.presets.services.n8n;
@@ -18,18 +17,14 @@ in

    services.n8n = {
      enable = true;
-      webhookUrl = "https://${hostnames.n8n}";
-      settings = {
-        listen_address = "127.0.0.1";
-        port = 5678;
-
+      environment = {
+        N8N_LISTEN_ADDRESS = "127.0.0.1";
+        N8N_PORT = 5678;
+        N8N_EDITOR_BASE_URL = "https://${hostnames.n8n}";
+        N8N_RESTRICT_FILE_ACCESS_TO = "/var/lib/n8n";
      };
    };

-    systemd.services.n8n.environment = {
-      N8N_EDITOR_BASE_URL = config.services.n8n.webhookUrl;
-    };
-
    # Configure Cloudflare DNS to point to this machine
    services.cloudflare-dyndns.domains = [ hostnames.n8n ];

@@ -40,7 +35,9 @@ in
        handle = [
          {
            handler = "reverse_proxy";
-            upstreams = [ { dial = "localhost:${builtins.toString config.services.n8n.settings.port}"; } ];
+            upstreams = [
+              { dial = "localhost:${toString config.services.n8n.environment.N8N_PORT}"; }
+            ];
          }
        ];
      }
@@ -17,7 +17,7 @@ in

    services.nextcloud = {
      enable = true;
-      package = pkgs.nextcloud31; # Required to specify
+      package = pkgs.nextcloud33; # Required to specify
      configureRedis = true;
      datadir = "/data/nextcloud";
      database.createLocally = true;
@@ -3,6 +3,7 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:

@@ -46,6 +47,9 @@ in
    ) cfg.publicKeys;

    # Add terminfo for SSH from popular terminal emulators
-    environment.enableAllTerminfo = true;
+    environment.systemPackages = [
+      pkgs.ghostty.terminfo
+      pkgs.kitty.terminfo
+    ];
  };
 }
@@ -5,12 +5,12 @@

 let
  inherit (config.nmasur.settings) hostnames;
-  cfg = config.nmasur.presets.services.stalwart-mail;
+  cfg = config.nmasur.presets.services.stalwart;
 in

 {

-  options.nmasur.presets.services.stalwart-mail = {
+  options.nmasur.presets.services.stalwart = {
    enable = lib.mkEnableOption "Stalwart mail and contacts server";
    port = lib.mkOption {
      type = lib.types.port;
@@ -21,7 +21,7 @@ in

  config = lib.mkIf cfg.enable {

-    services.stalwart-mail = {
+    services.stalwart = {
      enable = true;
      settings = {
        server.listener.http = {
@@ -34,6 +34,7 @@ in
        };
      };
    };
+    services.stalwart.stateVersion = config.system.stateVersion;

    # Configure Cloudflare DNS to point to this machine
    services.cloudflare-dyndns.domains = [ hostnames.contacts ];
--- a/Show More
+++ b/Show More