fix discord and 1pass dock link

flake.lock: Update
Flake lock file updates: • Updated input 'darwin': 'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15) → 'github:lnl7/nix-darwin/57a3171f94705599a2499248ca5758d5eb47c0e0' (2026-07-19) • Updated input 'home-manager': 'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18) → 'github:nix-community/home-manager/079a3b5d1aa6a719920a51316253b7d6dd22738d' (2026-07-24) • Updated input 'nix-caddy-withplugins': 'github:MichailiK/nix-caddy-withplugins/79db67d97207b6e32eaba69d5c3e6d7e63144154' (2026-06-14) → 'github:MichailiK/nix-caddy-withplugins/70307cfc568e5434cf42067d797b27c38ea69944' (2026-07-24) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15) → 'github:nixos/nixpkgs/e2587caef70cea85dd97d7daab492899902dbf5d' (2026-07-23) • Updated input 'nixpkgs-stable': 'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17) → 'github:nixos/nixpkgs/b3fe9581c9061c749abef42b6d4ee7b7c05c33fa' (2026-07-22) • Updated input 'nur': 'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18) → 'github:nix-community/nur/1166a294990afd245fd72b8d2896075222408399' (2026-07-25) • Updated input 'rust-overlay': 'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18) → 'github:oxalica/rust-overlay/a163bd01a6e11ac58d4f8d11669da550b5afbbc6' (2026-07-25) • Updated input 'wsl': 'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14) → 'github:nix-community/NixOS-WSL/eaeb18da90024448a60eb1ec7132eafa4003404e' (2026-07-21)
2026-07-26 13:48:34 +00:00 · 2026-07-25 09:29:58 -04:00 · 2026-07-25 06:05:57 +00:00 · 2026-07-21 15:08:29 +00:00 · 2026-07-20 23:12:23 +00:00 · 2026-07-20 22:32:03 +00:00
26 changed files with 265 additions and 219 deletions
@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-07-20
+
+- Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based
+  test suite. Its `checkPhase` hangs in the Nix sandbox and times out with a
+  `KeyboardInterrupt` after ~150s, which was breaking the `flame` rebuild
+  (paho-mqtt is pulled in transitively, e.g. via mealie). The override is
+  applied through `pythonPackagesExtensions` so it covers every Python
+  package set.
@@ -8,11 +8,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1766810506,
-        "narHash": "sha256-I4BxozsEu205tA7jazufztI8ZQ5p7hcCnjqrSKPz9nI=",
+        "lastModified": 1782994178,
+        "narHash": "sha256-VGc3/2fe6hnOmNSLlOygEAbeS69v7A7rjKDKRzAgE2Q=",
        "owner": "hraban",
        "repo": "cl-nix-lite",
-        "rev": "038e341cede255a83a8f04af114dc95717461d32",
+        "rev": "eb584721e5e799bafe0c6210a8a1a398f90e8ac0",
        "type": "github"
      },
      "original": {
@@ -28,11 +28,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781761792,
-        "narHash": "sha256-rCPytmKNjctLloB6UgK5CRrHSwV4b0ygxtJLPPp8R14=",
+        "lastModified": 1784500460,
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "a1fa429e945becaf60468600daf649be4ba0350c",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
        "type": "github"
      },
      "original": {
@@ -65,11 +65,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1730663653,
-        "narHash": "sha256-kFCUWettiFHDIqxCWWQ9qY8pVh+Lj+XL0Giyy/kdomg=",
+        "lastModified": 1766808011,
+        "narHash": "sha256-s83BS0abtIj7vzUf8JE0209KphfHA6qRw/92D9k/F+0=",
        "owner": "hraban",
        "repo": "flake-compat",
-        "rev": "e5b16676185cb7548581c852f51ce7f3a49bba5e",
+        "rev": "6e0aafdc4c4c2043c66f756d5045374b42184fc5",
        "type": "github"
      },
      "original": {
@@ -80,6 +80,22 @@
      }
    },
    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
      "flake": false,
      "locked": {
        "lastModified": 1767039857,
@@ -179,11 +195,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783134515,
-        "narHash": "sha256-qMoZazubXlXUD9k/syJ/aiWC4X4g73mwVmZ7Z4+rdpM=",
+        "lastModified": 1784913159,
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "b885baad531fa3d3beae2ba9a0712d22974d8016",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
        "type": "github"
      },
      "original": {
@@ -203,11 +219,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1766810876,
-        "narHash": "sha256-VPElWFQIiP31lXQXEom+L4sl85alZpZn33O4hewsP9k=",
+        "lastModified": 1783182903,
+        "narHash": "sha256-7IteXipJZfFepi5zakxe0jQ5i3vRBQguk0+Gtte1Fu4=",
        "owner": "hraban",
        "repo": "mac-app-util",
-        "rev": "4747968574ea58512c5385466400b2364c85d2d0",
+        "rev": "039f33deef21782d4db97087f426504951239887",
        "type": "github"
      },
      "original": {
@@ -216,6 +232,26 @@
        "type": "github"
      }
    },
+    "nix-caddy-withplugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1784936738,
+        "narHash": "sha256-X4w9BrFkisfzla3m1WwDJUicUbI7JRdhzq5aS7rrB0k=",
+        "owner": "MichailiK",
+        "repo": "nix-caddy-withplugins",
+        "rev": "70307cfc568e5434cf42067d797b27c38ea69944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MichailiK",
+        "ref": "nixos-unstable",
+        "repo": "nix-caddy-withplugins",
+        "type": "github"
+      }
+    },
    "nix2vim": {
      "inputs": {
        "flake-utils": "flake-utils_2",
@@ -275,11 +311,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1766736597,
-        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
+        "lastModified": 1779796641,
+        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
+        "rev": "25f538306313eae3927264466c70d7001dcea1df",
        "type": "github"
      },
      "original": {
@@ -306,11 +342,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1782847225,
-        "narHash": "sha256-JC9PjqKYG9ve5U8aDOLQipp3+KLANBHUvGdLZlxzdKI=",
+        "lastModified": 1784707089,
+        "narHash": "sha256-2V/6imsUgB7mPZlHY54oeVBRDoZbPKnvzwkAHUSSufk=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "95ca1e203c0750115fd4a6f17d5a245dfe6b1edd",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
        "type": "github"
      },
      "original": {
@@ -338,27 +374,27 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1732617236,
-        "narHash": "sha256-PYkz6U0bSEaEB1al7O1XsqVNeSNS+s3NVclJw7YC43w=",
+        "lastModified": 1782999065,
+        "narHash": "sha256-5Dgj5+pIQYZKrXUGaLCk7CKfN3MmpwIhO94++WVxvng=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
+        "rev": "80d591ed473cfc46329932c2aadac9b435342c7c",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
+        "ref": "nixos-26.05",
        "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
        "type": "github"
      }
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1761236834,
-        "narHash": "sha256-+pthv6hrL5VLW2UqPdISGuLiUZ6SnAXdd2DdUE+fV2Q=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d5faa84122bc0a1fd5d378492efce4e289f8eac1",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
        "type": "github"
      },
      "original": {
@@ -370,11 +406,27 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1782959384,
-        "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "65179426c83bb3f6bc14898b42ea1c6f01d374b0",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
        "type": "github"
      },
      "original": {
@@ -384,7 +436,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1744536153,
        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -408,11 +460,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783145257,
-        "narHash": "sha256-ToFI5ch+MRCsP82ghZMhkF/YbNmDWMmvvJadvKhDlb8=",
+        "lastModified": 1784959021,
+        "narHash": "sha256-Atc5ydxAmAAD5o8e6F8VVxVCOQb82bqi5TRNRUSBvZU=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "c50af1cc06115c76b81c0bbe079248193003e707",
+        "rev": "1166a294990afd245fd72b8d2896075222408399",
        "type": "github"
      },
      "original": {
@@ -427,9 +479,10 @@
        "disko": "disko",
        "home-manager": "home-manager",
        "mac-app-util": "mac-app-util",
+        "nix-caddy-withplugins": "nix-caddy-withplugins",
        "nix2vim": "nix2vim",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
        "rust-overlay": "rust-overlay",
@@ -440,14 +493,14 @@
    },
    "rust-overlay": {
      "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1783144302,
-        "narHash": "sha256-NQnzmXwpEAd5tjMBh2+P/y9NknF+WHv5+6yoXoN4h/Y=",
+        "lastModified": 1784956772,
+        "narHash": "sha256-5polVWDhgATIQj+RUV2ZlOd5nE6cGJo+C4tOEs5vp6U=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "fe5aee0952e8e1525533d61defd9e36513db811b",
+        "rev": "a163bd01a6e11ac58d4f8d11669da550b5afbbc6",
        "type": "github"
      },
      "original": {
@@ -539,11 +592,11 @@
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1766000401,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -554,17 +607,17 @@
    },
    "wsl": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1781182279,
-        "narHash": "sha256-V5EQQbDnmdiXGQXrEF1PEL7QYsFqfH8N1E89Z5ONwFk=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "5675822ba756e6e56f8f6a5a76e90e0da2ece94d",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
        "type": "github"
      },
      "original": {
@@ -40,6 +40,12 @@
      # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
    };

+    # Caddy with decoupled plugin hashes
+    nix-caddy-withplugins = {
+      url = "github:MichailiK/nix-caddy-withplugins/nixos-unstable";
+      # Important: Do not follow nixpkgs here, per the README
+    };
+
    # Manage disk format and partitioning
    disko = {
      url = "github:nix-community/disko";
@@ -27,6 +27,7 @@ rec {
      common.enable = true;
      darwin-base.enable = true;
      darwin-gaming.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
      work.enable = true;
      experimental.enable = true;
@@ -28,6 +28,7 @@ rec {
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
    };
    nmasur.presets.programs.helix.enable = true;
@@ -26,6 +26,7 @@ rec {
    nmasur.profiles = {
      common.enable = true;
      linux-base.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
    };
    home.stateVersion = "23.05";
@@ -30,6 +30,7 @@ rec {
      linux-base.enable = true;
      linux-gui.enable = true;
      linux-gaming.enable = true;
+      llm-development.enable = true;
      power-user.enable = true;
      developer.enable = true;
      experimental.enable = true;
@@ -103,6 +103,9 @@ lib
      config.permittedInsecurePackages = [
        "litestream-0.3.13"
        "electron-36.9.5"
+        # Build-time-only dep of karakeep's frontend; CVEs don't reach
+        # the runtime closure. Remove once nixpkgs bumps it.
+        "pnpm-9.15.9"
      ];
      config.allowUnfree = true;
    }
@@ -176,22 +179,20 @@ lib
    inputs.darwin.lib.darwinSystem {
      inherit system specialArgs;
      modules = [
-        inputs.home-manager.darwinModules.home-manager
        inputs.mac-app-util.darwinModules.default
        {
          imports = (nixFiles ../platforms/nix-darwin);
          nixpkgs.pkgs = pkgsBySystem.${system};
        }
-        module
-        {
-          home-manager = {
-            extraSpecialArgs = {
-              inherit colorscheme;
-            }
-            // specialArgs;
-          }
-          // homeModule.home-manager;
-        }
+        # Home Manager is intentionally NOT activated here. It is managed
+        # standalone via `nh home switch` (see homeConfigurations, extracted
+        # from the host module's `home-manager.users`). Strip that attr so
+        # darwin-rebuild doesn't also activate a second, divergent HM
+        # generation with different store paths (useUserPackages puts packages
+        # in /etc/profiles/per-user vs. ~/.nix-profile standalone) -- that
+        # mismatch broke the prompt after every darwin-rebuild until the next
+        # `nh home switch`.
+        (builtins.removeAttrs module [ "home-manager" ])
      ];
    };

@@ -1,67 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-{
-
-  home-manager.users.${config.user} = lib.mkIf pkgs.stdenv.isDarwin {
-
-    home.packages =
-      let
-        ldap_scheme = "ldaps";
-        magic_prefix = "take";
-        ldap_port = 3269;
-        jq_parse = pkgs.writeShellScriptBin "ljq" ''
-          jq --slurp \
-            --raw-input 'split("\n\n")|map(split("\n")|map(select(.[0:1]!="#" and length>0)) |select(length > 0)|map(capture("^(?<key>[^:]*:?): *(?<value>.*)") |if .key[-1:.key|length] == ":" then .key=.key[0:-1]|.value=(.value|@base64d) else . end)| group_by(.key) | map({key:.[0].key,value:(if .|length > 1 then [.[].value] else .[].value end)}) | from_entries)' | jq -r 'del(.[].thumbnailPhoto)'
-        '';
-        ldap_script = pkgs.writeShellScriptBin "ldap" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          SEARCH_FILTER="$@"
-          ldapsearch -LLL \
-              -B -o ldif-wrap=no \
-              -E pr=5000/prompt \
-              -H "${ldap_scheme}://''${LDAP_HOST}:${builtins.toString ldap_port}" \
-              -D "${pkgs.lib.toUpper magic_prefix}2\\${pkgs.lib.toLower config.user}" \
-              -w "$(${pkgs._1password-cli}/bin/op item get T2 --fields label=password --reveal)" \
-              -b "dc=''${LDAP_HOST//./,dc=}" \
-              -s "sub" -x "(cn=''${SEARCH_FILTER})" \
-              | ${jq_parse}/bin/ljq
-        '';
-        ldapm_script = pkgs.writeShellScriptBin "ldapm" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].memberOf] | add'
-        '';
-        ldapg_script = pkgs.writeShellScriptBin "ldapg" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].member] | add'
-        '';
-        ldapl_script = pkgs.writeShellScriptBin "ldapl" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "*$@*" | jq -r '.[].name'
-        '';
-      in
-      [
-        ldap_script
-        ldapm_script
-        ldapg_script
-        ldapl_script
-        jq_parse
-      ];
-  };
-}
@@ -1,56 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  # Homebrew - Mac-specific packages that aren't in Nix
-  config = lib.mkIf pkgs.stdenv.isDarwin {
-
-    # # Requires Homebrew to be installed
-    system.activationScripts.preActivation.text = ''
-      if ! xcode-select --version 2>/dev/null; then
-        $DRY_RUN_CMD xcode-select --install
-      fi
-      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
-        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-      fi
-    '';
-
-    # Add homebrew paths to CLI path
-    home-manager.users.${config.user}.home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin/"
-    ];
-
-    homebrew = {
-      enable = true;
-      onActivation = {
-        autoUpdate = false; # Don't update during rebuild
-        cleanup = "zap"; # Uninstall all programs not declared
-        upgrade = true;
-      };
-      global = {
-        brewfile = true; # Run brew bundle from anywhere
-      };
-      brews = [
-        "trash" # Delete files and folders to trash instead of rm
-        "jiratui" # Terminal program to manage Jira
-      ];
-      casks = [
-        "1password" # 1Password will not launch from Nix on macOS
-        # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-        "keybase" # GUI on Nix not available for macOS
-        # "logitech-g-hub" # Mouse and keyboard management
-        "logitune" # Logitech webcam firmware
-        "meetingbar" # Show meetings in menu bar
-        "scroll-reverser" # Different scroll style for mouse vs. trackpad
-        "notunes" # Don't launch Apple Music with the play button
-        "steam" # Not packaged for Nixon macOS
-        "epic-games" # Not packaged for Nix
-      ];
-    };
-  };
-}
@@ -0,0 +1 @@
+inputs: inputs.nix-caddy-withplugins.overlays.default
@@ -0,0 +1,20 @@
+# Disable paho-mqtt's flaky test suite.
+#
+# paho-mqtt's checkPhase runs socket-based integration tests that hang in
+# the Nix sandbox (they eventually time out with a KeyboardInterrupt after
+# ~150s, reporting errors and failing the build). This breaks the flame
+# rebuild, where paho-mqtt is pulled in transitively (e.g. via mealie).
+#
+# Applied through pythonPackagesExtensions so it covers every Python
+# package set (python3Packages, python314Packages, ...).
+
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      paho-mqtt = pyprev.paho-mqtt.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
+    })
+  ];
+}
@@ -2,21 +2,10 @@

 {
  pkgs,
-  fetchFromGitHub,
  ...
 }:

-# Maintain a static version so that the plugin hash doesn't keep breaking
-(pkgs.caddy.overrideAttrs rec {
-  version = "2.10.2";
-  src = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "caddy";
-    tag = "v${version}";
-    hash = "sha256-KvikafRYPFZ0xCXqDdji1rxlkThEDEOHycK8GP5e8vk=";
-  };
-}).withPlugins
-  {
+pkgs.caddy.withPlugins {
  plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-xz43pXTsnYmXZDAAUT+vTapoq3O/8br7igGwqZbjFdk=";
+  hash = "sha256-HuVBmiT3kD6RrDejQ6SnjCN8f7pFdZlGtZFbEf47bks=";
 }
@@ -89,6 +89,13 @@ let
        drf-access-policy
        # psycopg-binary
        ;
+      # clevercsv's test_encoding_chardet is nondeterministic (chardet
+      # returns None instead of ISO-8859-1/KOI8-R on some platforms),
+      # breaking the build. Skip its test suite.
+      clevercsv = pyprev.clevercsv.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
    };
  };

@@ -18,16 +18,16 @@ in
      ca = "cargo";
    };

-    home.packages = with pkgs; [
-      gcc
-      rustc
-      cargo
-      cargo-watch
-      clippy
-      rustfmt
-      pkg-config
-      openssl
-      rust-analyzer
+    home.packages = [
+      pkgs.gcc
+      pkgs.rustc
+      pkgs.cargo
+      pkgs.stable.cargo-watch
+      pkgs.clippy
+      pkgs.rustfmt
+      pkgs.pkg-config
+      pkgs.openssl
+      pkgs.rust-analyzer
    ];
  };
 }
@@ -27,6 +27,7 @@ in
      cask "notunes" # Don't launch Apple Music with the play button
      cask "topnotch" # Darkens the menu bar to complete black
      cask "ghostty" # Terminal application (not buildable on Nix on macOS)
+      cask "discord" # nixpkgs bundle breaks its notarization seal on macOS 26+

      # Mac App Store apps (requires 'mas' CLI, optional)
      # mas "Tailscale", id: 1475387142
@@ -15,10 +15,21 @@ in

  config = lib.mkIf (cfg.enable && (pkgs.stdenv.isDarwin || config.services.dunst.enable)) {
    home.packages = [ pkgs.noti ];
-    programs.fish.shellAbbrs = {
+    programs.fish = {
+      shellAbbrs = {
        # Add noti for ghpr in Darwin
        ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
        grw = lib.mkForce "noti gh run watch";
      };
+      functions = {
+        gh-run = {
+          body =
+            lib.mkForce # fish
+              ''
+                ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- noti gh run watch
+              '';
+        };
+      };
+    };
  };
 }
@@ -109,6 +109,10 @@ in

      settings = {
        default_mode = "locked";
+        # Spawn fish directly instead of trusting $SHELL, which inherits the
+        # macOS login shell. On darwin that login shell is no longer managed by
+        # nix-darwin, so $SHELL can point at a stale /run/current-system path.
+        default_shell = lib.getExe pkgs.fish;
        # default_layout = "compact-top";
        # Remove border
        pane_frames = false;
@@ -56,7 +56,10 @@ in
          "/System/Applications/Mail.app"
          "/Applications/zoom.us.app"
          "${config.programs.ghostty.package}/Applications/Ghostty.app"
-          "${pkgs.discord}/Applications/Discord.app"
+          # Discord comes from Homebrew on macOS: the nixpkgs bundle is
+          # modified in place, breaking its notarization seal, so macOS 26+
+          # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
+          "/Applications/Discord.app"
          "${pkgs.obsidian}/Applications/Obsidian.app"
          "${pkgs.thunderbird}/Applications/Thunderbird.app"
        ];
@@ -33,7 +33,7 @@ in
    xdg.configFile."hammerspoon/Spoons/Launcher.spoon/init.lua".source =
      pkgs.replaceVars ./Spoons/Launcher.spoon/init.lua
        {
-          discord = "${pkgs.discord}/Applications/Discord.app";
+          discord = "Discord.app";
          firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
          ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
          obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.llm-development;
+in
+
+{
+
+  options.nmasur.profiles.llm-development.enable = lib.mkEnableOption "LLM coding tools";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+
+      pkgs.pi-coding-agent # AI LLM Agent
+
+    ];
+
+  };
+
+}
@@ -44,7 +44,7 @@ in
    ];

    home.file.".Brewfile".text = /* homebrew */ ''
-      cask "1password" # 1Password will not launch from Nix on macOS
+      # cask "1password" # 1Password will not launch from Nix on macOS
      # cask "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
      # cask "logitech-g-hub" # Mouse and keyboard management
      cask "logitune" # Logitech webcam firmware
@@ -56,7 +56,7 @@ in
    nmasur.presets = {
      fonts.enable = lib.mkDefault true;
      programs = {
-        _1password.enable = lib.mkDefault true;
+        # _1password.enable = lib.mkDefault true;
        atuin.enable = lib.mkDefault true;
        aws-ssh.enable = lib.mkDefault true;
        bash.enable = lib.mkDefault true;
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs._1password;
+in
+
+{
+  options.nmasur.presets.programs._1password.enable = lib.mkEnableOption "1Password password manager";
+
+  config = lib.mkIf cfg.enable {
+    # Unfree packages are already permitted via the shared nixpkgs instance
+    # created in lib/default.nix (config.allowUnfree = true). Setting
+    # nixpkgs.config here would conflict with nixpkgs.pkgs being set externally.
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      # Certain features, including CLI integration and system authentication support,
+      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+      # polkitPolicyOwners = [ "yourUsernameHere" ];
+    };
+  };
+}
@@ -50,7 +50,10 @@ in
        "/System/Applications/Mail.app"
        "/Applications/zoom.us.app"
        "/Applications/Ghostty.app"
-        "${pkgs.discord}/Applications/Discord.app"
+        # Discord comes from Homebrew on macOS: the nixpkgs bundle is modified
+        # in place, breaking its notarization seal, so macOS 26+ refuses to
+        # launch it ("damaged").
+        "/Applications/Discord.app"
        "${pkgs.obsidian}/Applications/Obsidian.app"
        "${pkgs.thunderbird}/Applications/Thunderbird.app"
      ];
@@ -17,10 +17,11 @@ in
    system.primaryUser = config.nmasur.settings.username;

    nmasur.presets = {
-      # programs = {
-      # fish.enable = lib.mkDefault true;
+      programs = {
+        _1password.enable = lib.mkDefault true;
+        fish.enable = lib.mkDefault true;
        # homebrew.enable = lib.mkDefault true;
-      # };
+      };
      services = {
        # daily-summary.enable = lib.mkDefault false;
        # dock.enable = lib.mkDefault true;
@@ -20,6 +20,9 @@ in
      };
    };

+    # Fix BASE_URL for downloading backups
+    systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";
+
    nmasur.presets.services.caddy.routes = [
      {
        match = [ { host = [ hostnames.recipes ]; } ];
Author	SHA1	Message	Date
Noah Masur	671a17af76	fix discord and 1pass dock link	2026-07-25 09:29:58 -04:00
github-actions[bot]andgithub-actions[bot]	71709776f9	flake.lock: Update Flake lock file updates: • Updated input 'darwin': 'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15) → 'github:lnl7/nix-darwin/57a3171f94705599a2499248ca5758d5eb47c0e0' (2026-07-19) • Updated input 'home-manager': 'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18) → 'github:nix-community/home-manager/079a3b5d1aa6a719920a51316253b7d6dd22738d' (2026-07-24) • Updated input 'nix-caddy-withplugins': 'github:MichailiK/nix-caddy-withplugins/79db67d97207b6e32eaba69d5c3e6d7e63144154' (2026-06-14) → 'github:MichailiK/nix-caddy-withplugins/70307cfc568e5434cf42067d797b27c38ea69944' (2026-07-24) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15) → 'github:nixos/nixpkgs/e2587caef70cea85dd97d7daab492899902dbf5d' (2026-07-23) • Updated input 'nixpkgs-stable': 'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17) → 'github:nixos/nixpkgs/b3fe9581c9061c749abef42b6d4ee7b7c05c33fa' (2026-07-22) • Updated input 'nur': 'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18) → 'github:nix-community/nur/1166a294990afd245fd72b8d2896075222408399' (2026-07-25) • Updated input 'rust-overlay': 'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18) → 'github:oxalica/rust-overlay/a163bd01a6e11ac58d4f8d11669da550b5afbbc6' (2026-07-25) • Updated input 'wsl': 'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14) → 'github:nix-community/NixOS-WSL/eaeb18da90024448a60eb1ec7132eafa4003404e' (2026-07-21)	2026-07-25 06:05:57 +00:00
Noah Masur	829af86dd8	switch to nix caddy plugin module in order to prevent frequent need to re-hash	2026-07-21 15:08:29 +00:00
Noah Masur	e7fd5eb770	update caddy hash	2026-07-20 23:12:23 +00:00
Noah Masur	f0b400d134	set base url for mealie	2026-07-20 22:32:03 +00:00
Noah Masur	573c0acd33	disable flaky paho-mqtt test suite breaking flame rebuild	2026-07-20 18:28:57 -04:00
Noah Masur	eec777c0c1	fix mathesar has a flaky test	2026-07-20 17:50:56 -04:00
Noah Masur	638b112db9	fix Discord on macOS: use Homebrew cask instead of broken nixpkgs bundle	2026-07-20 17:50:54 -04:00
Noah Masur	27917ffede	remove home-manager module from nix-darwin this fixes the starship errors when rebuilding nix-darwin	2026-07-20 14:33:48 -04:00
Noah Masur	73b62e0907	fix broken rebuilds	2026-07-20 14:25:58 -04:00
Noah Masur	b25cfe6877	add llm-development profile	2026-07-20 14:25:58 -04:00
Noah Masur	d162df2515	use noti for gh run watch in zellij pane	2026-07-20 09:00:59 -04:00
github-actions[bot]andgithub-actions[bot]	396337f74d	flake.lock: Update Flake lock file updates: • Updated input 'darwin': 'github:lnl7/nix-darwin/d5bd9cd77aea4c0a8f49e7fd85545671a208ed15' (2026-07-07) → 'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15) • Updated input 'home-manager': 'github:nix-community/home-manager/2afec152df4e284d264f8489d16004c264aebf4c' (2026-07-11) → 'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/0bb7ec54c8483066ec9d7720e780a5caa71f8612' (2026-07-08) → 'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15) • Updated input 'nixpkgs-stable': 'github:nixos/nixpkgs/8f0500b9660505dc3cb647775fe9a978a74b5283' (2026-07-10) → 'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17) • Updated input 'nur': 'github:nix-community/nur/29c4c5612e67bce09ee3f2f988bebe51ff9e6b81' (2026-07-11) → 'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18) • Updated input 'rust-overlay': 'github:oxalica/rust-overlay/e598b37857b895b81020a65a802ef55f5bbed72f' (2026-07-11) → 'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18) • Updated input 'wsl': 'github:nix-community/NixOS-WSL/a9620cfa43f0c1c30a46c31ae3c6e58cdb124a14' (2026-07-06) → 'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14)	2026-07-18 05:53:01 +00:00
Noah Masur	76b50920de	update and fix karakeep transitive dependency error	2026-07-11 09:28:07 -06:00
Noah Masur	e04cdab409	switch 1password on darwin to nix module	2026-07-08 11:20:22 -06:00
Noah Masur	d238b7a81a	remove modules directory no longer used	2026-07-08 11:10:11 -06:00
				`@@ -0,0 +1 @@`
				`inputs: inputs.nix-caddy-withplugins.overlays.default`