docs: update README with feature overview and module structure

Add Java extension support and configure multiple JDK runtimes.
Introduce a wrapped VS Code package that includes JDK 25 in the PATH
to support the Red Hat Java language server.

Switch from using `programs.vscode.userSettings` to a manually managed
`settings.json` file via `home.file`. This allows the settings file to
be writable by external tools like `kilo-code` at runtime while
preserving them across Nix configuration switches by using `force = false`.

docs/README.md

@@ -17,16 +17,26 @@ How to work on it: [conventions.md](./conventions.md).
 
 Each machine: `modules/hosts/<name>/default.nix` → `nixosConfigurations.<name>`, real config in `*Configuration` + optional `_private/` and `_services/`.
 
+## Features at a glance
+
+- **Users catalog** — one catalog in `modules/system/users.nix`, pick who exists on a host with `chiasson.users.enabled = [ "example" ]`, override per host. Home Manager wires itself from the same list.
+- **SSH + Bitwarden (rbw) keys** — one ed25519 keypair per catalog user, private key in Bitwarden, public key in `modules/ssh/inventory.nix`. Outbound SSH uses a `.pub` filter against the rbw agent; inbound `authorized_keys` are generated from the same inventory. [Full wiring in conventions.md](./conventions.md#ssh-model).
+- **Wisdom modules** — Home Manager slices in `modules/wisdom/` auto-catalog via `lib.wisdomCatalogExtraModules` (defined in `modules/desktop/options.nix`). The baseline `wisdom` module handles git identity + shared tools; all other `wisdom*` exports are pulled in once per user through `desktopHomeBase` → `chiasson.users.extraModules.olivier`. Hosts only flip `chiasson.home.<category>.<slice>.enable` — no manual imports in `home.nix`. Categories include `apps` (spotify, discord, localsend), `browsers` (chrome, edge, zen, …), `editors` (cursor, vscode, obsidian, …), `shells` (bash, fish, oh-my-posh, yazi), `desktop` (gtk-qt-theming, screenshot), and `terminals` (kitty). Trivial single-package slices can be written with the `lib.wisdomSlice` helper instead of repeating the `root`/`cfg` + `mkIf` boilerplate.
+- **Wallpapers from a dedicated repo** — `modules/desktop/wallpapers.nix` pins `inputs.wallpapers` into the store and exposes it as `CHIASSON_NIX_WALLPAPERS` and `/etc/wallpapers`. Override `chiasson.desktop.wallpapers.source` if needed.
+- **Private host data** — import-tree skips `_private/` globally, so machine-only files (firmware quirks, display configs, service tweaks) live next to the host module without leaking elsewhere.
+
 ## Deploy / rebuild
 
-Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops).
+Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops/laptops/tablets).
 
 Fleet deploy is [Navi](https://github.com/cafkafk/navi) — config in `modules/deploy/navi.nix`, outputs `flake.navi` / `flake.naviHive`.
 
 ```bash
-nix develop          # devShell has navi + hints
+nix develop          # devShell has navi + just + hints
+just                  # list local helpers like `sync-dms`
 navi apply --on <host>
 navi apply-local --node 14900k --sudo   # this machine, if hostname matches
+navi tui                  # interactive fleet dashboard
 ```
 
 Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
@@ -37,11 +47,11 @@ Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
 modules/
   hosts/<host>/     # per-machine composition
   system/           # nixosModules.system aggregate
-  desktop/          # GUI stack
+  desktop/          # GUI stack (niri, hyprland, plasma, DMS)
   wisdom/           # HM modules (exports still named wisdom*)
   ssh/              # inbound NixOS + outbound HM
   deploy/           # navi hive
-  lib/              # pure helpers → flake.lib
+  patches/          # one-off patches (yt-dlp, t2fanrd, …)
 ```
 
 Machine-only stuff lives in `hosts/<host>/_private/` — import-tree skips `_private/` globally, so those files only get pulled in where you import them.

docs/conventions.md

@@ -47,7 +47,7 @@ Leave upstream `services.*`, `networking.*`, `home.*`, etc. alone.
 
 Aggregates: `nixosModules.system` and `nixosModules.desktop` import their leaves. Host configs import those stacks and set options — they shouldn't reimplement whole subsystems.
 
-**Home** — files under `modules/wisdom/`. Baseline is `homeManagerModules.wisdom` (`chiasson.home.enable`, wired via `chiasson.desktop.homeManager.bundleWisdom`). Other `wisdom*` slices auto-wire once per user via `lib.wisdomCatalogExtraModules self` (`modules/lib/wisdom-catalog.nix`); hosts only set matching `chiasson.home.*.enable` toggles — no re-import in `home.nix`.
+**Home** — files under `modules/wisdom/`. Baseline is `homeManagerModules.wisdom` (`chiasson.home.enable`, wired via `chiasson.desktop.homeManager.bundleWisdom`). Other `wisdom*` slices auto-wire once per user via `lib.wisdomCatalogExtraModules self` (`modules/desktop/options.nix`); hosts only set matching `chiasson.home.*.enable` toggles — no re-import in `home.nix`.
 
 User apps / dotfiles → wisdom. Daemons, firewall, kernel → NixOS. Sometimes both (LocalSend: HM installs, `systemLocalsend` opens the firewall).
 
@@ -63,13 +63,75 @@ User apps / dotfiles → wisdom. Daemons, firewall, kernel → NixOS. Sometimes
 - `desktopWallpapers` copies `inputs.wallpapers` into the store; override `chiasson.desktop.wallpapers.source` if needed.
 
 
-## Users
+## Users & SSH
 
-User definitions live in `usersCatalogDefaults` (`modules/system/users/catalog-default.nix`) — olivier, server, builder, etc. Pick who exists on a host with `chiasson.users.enabled`.
+User definitions live in the catalog defaults block inside `modules/system/users.nix` (was previously split across four files in `modules/system/users/`; **folded into one for cohesion**). olivier, server, builder, etc. Pick who exists on a host with `chiasson.users.enabled`.
+
+### SSH model — read this once
+
+SSH authentication has two independent sides:
+
+| Side | Holds | Decides |
+|------|-------|---------|
+| **Client** (connecting from) | identity private keys | "Here's proof I own key K" |
+| **Server** (connecting to)   | `authorized_keys`         | "Do I trust key K?" |
+
+A key is just a cryptographic identity — it's not bound to a host or a machine account name. The model is **one key per user account**: each catalog account (`olivier`, `server`, `builder`) has its own keypair in `modules/ssh/inventory.nix`, regardless of which machine that account runs on. Concretely: when `olivier@14900k` sshes to `server@r5500`, OpenSSH routes via a `Match user server` block (generated from `chiasson.ssh.outbound.rbw.extraIdentities`) → `IdentityFile ~/.ssh/id_ed25519_server.pub` (written from `users.server.publicKey`) to ask the rbw agent for the `server` private key; r5500's `server` `authorized_keys` holds the matching server pubkey. olivier's catalog default sets `extraIdentities = [ "server" "builder" ]` so `ssh <account>@<host>` Just Works for every catalog role. We also support `from="ip,cidr"` constraints per account to scope which source IPs may authenticate as it.
+
+This repo enforces "one key per user": every user has one ed25519 keypair, the private key in Bitwarden, the public key inline in `modules/ssh/inventory.nix`. On SSH connect:
+
+1. `~/.ssh/config` (managed by home-manager) sets `IdentityAgent SSH_AUTH_SOCK` and `IdentityFile ~/.ssh/id_ed25519_<user>.pub` for every host block.
+2. OpenSSH reads the `.pub` file as a **filter** against the agent (OpenSSH 7.3+ trick — `.pub` as IdentityFile tells the agent "give me the private key matching this pub"), so even with multiple keys loaded, only the matching one is tried. This is why the old "too many auth failures" symptom is gone by construction.
+3. rbw holds the private key; HM-managed shells + the desktop session expose `SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/rbw/…` declaratively (no activation scripts).
+
+### Bitwarden onboarding
+
+For each new user (run on the user's primary machine):
+
+```sh
+# 1. Generate a keypair with rbw (creates a Bitwarden item + prints the pubkey).
+rbw gen ssh-key olivier
+
+# 2. Paste the printed `ssh-ed25519 AAAA… olivier` line into
+#    modules/lib/ssh-inventory.nix under users.olivier.publicKey.
+
+# 3. Push the user to a host:
+ssh root@nix-server nixos-rebuild switch --flake .#nix-server
+
+# 4. Have the user ssh into the fleet from any client — their rbw key
+#    is the only thing offered, and every server already has it in
+#    authorized_keys.
+```
+
+### Adding a host
+
+Edit `modules/ssh/inventory.nix` and add:
+
+```nix
+hosts."newhost" = {
+  hostName = "192.168.2.X";        # IP — required for navi to deploy here
+  aliases = [ "newhost" ];         # what you type at the ssh prompt
+};
+```
+
+Then add `self.nixosModules.<host>Configuration` to `modules/deploy/navi.nix`.
+
+### Adding a catalog user
+
+1. Generate a keypair: `rbw gen ssh-key <name>`.
+2. Add a `users.<name> = { publicKey = "ssh-ed25519 …"; };` line under `users` in `modules/ssh/inventory.nix`.
+3. Add a `<name> = { isNormalUser = true; … ssh.inbound.enable = true; ssh.inbound.authorizedHosts = "all"; }` entry under `chiasson.users.catalog` in `modules/system/users.nix`.
+4. Enable on every host that needs that user, e.g.:
+
+```nix
+chiasson.users.enabled = [ "olivier" "<name>" ];
+```
+
+### Passwords
 
 Passwords aren't in the repo. They're in `secrets/secrets.yaml` (encrypted with sops). Each host that has `olivier` must declare that secret and set `neededForUsers = true`; sops-nix decrypts it at boot, and the catalog points `hashedPasswordFile` at that file. That's why the catalog is a proper module instead of a static list — it needs `config.sops.secrets.…` at eval time.
 
-On a host:
+### Host overrides
 
 ```nix
 # configuration.nix — machine policy
@@ -77,6 +139,8 @@ chiasson.users.enabled = [ "olivier" ];
 chiasson.users.hostOverrides.<name> = { /* optional */ };
 ```
 
+### Home-manager per-host slices (desktop/laptop hosts)
+
 Desktop hosts also have `home.nix` exporting `flake.nixosModules.<host>Home`, wired from `default.nix` alongside `*Configuration`:
 
 ```nix
@@ -86,7 +150,7 @@ modules = [
   self.nixosModules."14900kHome"
 ];
 
-# home.nix — flake fragment, per-host `chiasson.home.*` toggles
+# home.nix — flake fragment, per-host chiasson.home.* toggles
 { self, inputs, ... }: {
   flake.nixosModules."14900kHome" = { self, pkgs, ... }: {
     imports = [ self.nixosModules.desktopHomeBase ];
@@ -102,15 +166,15 @@ modules = [
 
 `flake.nixosModules.desktopHomeBase` expands `lib.wisdomCatalogExtraModules` plus shared desktop toggles. Host `*Home` modules append per-host `chiasson.home` overrides (and rare inline `home.packages` blocks). `chiasson.users.extraModules` concatenates lists from multiple modules (base + host), so both can set the same user key.
 
-`usersHomeIntegration` turns that into `users.users` + HM. Don't hand-roll catalog users unless you're changing the users module itself.
+The integration block at the bottom of `modules/system/users.nix` turns the catalog + overrides into `users.users` + HM + inbound SSH. Don't hand-roll catalog users unless you're changing this module.
-
-SSH: `sshInbound` on NixOS, outbound/rbw under `modules/ssh/home-manager/`.
 
 ## Adding things
 
 **New NixOS leaf:** export `flake.nixosModules.whatever`, wire from `system/default.nix` or `desktop/default.nix` if it's global, or only from a host `configuration.nix` if it's not. `nix flake check`. Git-add new paths if eval uses the git tree.
 
-**New HM slice:** add `modules/wisdom/.../foo.nix` exporting `flake.homeManagerModules.wisdomFoo` (import-tree picks it up; `wisdomCatalogExtraModules` includes every `wisdom*` export except `wisdom` / `wisdomShellBash`). Gate packages on `chiasson.home.*.enable`, set `mkDefault true` in `desktop-home-base.nix` if shared, or `enable = true` in a host `home.nix`. Upstream HM deps stay imported unconditionally — use `mkIf` on `cfg.enable` for config (never `config`-dependent `imports`; that recurses).
+**New HM slice:** add `modules/wisdom/.../foo.nix` exporting `flake.homeManagerModules.wisdomFoo` (import-tree picks it up; `wisdomCatalogExtraModules` includes every `wisdom*` export). Every `wisdom*` slice auto-catalogs — including the bash shell — so the root module no longer manually `imports` it. Gate packages on `chiasson.home.*.enable`, and set the slice's own `enable` default with `mkEnableOption "…" // { default = true/false }` in that same module — defaults live with the option that owns them, not in a shared defaults file. Hosts flip toggles in `home.nix`. Upstream HM deps stay imported unconditionally — use `mkIf` on `cfg.enable` for config (never `config`-dependent `imports`; that recurses).
+
+**Trivial single-package slice:** use `self.lib.wisdomSlice { path = "a.b"; default = true/false; description = "…"; packages = pkgs: [ … ]; }` instead of the `root`/`cfg` + `mkIf (root.enable && cfg.enable)` boilerplate. `packages` is a `pkgs -> [ drv ]` function responsible for its own `availableOn`/platform gating. Several such slices may share one `simple.nix` in their category dir (each still exporting its own `wisdom*` module), rather than one file per slice.
 
 **Derivations:** `let` inside a fragment, or `flake.packages` / `flake.lib` — not a bare `mkDerivation` file import-tree will try to load.
 

flake.lock

@@ -38,11 +38,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782389081,
+        "lastModified": 1783991957,
-        "narHash": "sha256-60aWPXGfLy3fVDTgwd1noQ2W+gryGy0EnNB0jLjfsUY=",
+        "narHash": "sha256-QekvkvkOF0iWAV680BcTZYWyW/jiokq7jfIm1wIKIY4=",
         "ref": "refs/heads/main",
-        "rev": "0feb09ad82ab1800ce5727bb94191deb500ad184",
+        "rev": "dff91dce874c9d517643331eac59bcd6ba29926e",
-        "revCount": 123,
+        "revCount": 132,
         "type": "git",
         "url": "https://git.chiasson.cloud/Olivier/cursor-nixos-flake"
       },
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782185186,
+        "lastModified": 1783265113,
-        "narHash": "sha256-URMC6ppMqe9WQOdH/oTeOqUcJggJGJaNOrhdzwSKyYo=",
+        "narHash": "sha256-Ra65IQsez9QqXcFLp0PJ2f2y4+4X4CAkzmH/x/OXkY8=",
         "owner": "AvengeMedia",
         "repo": "dgop",
-        "rev": "28558a7e79ab5c81b6d832fe48f40ea499866496",
+        "rev": "15d96577fd8950a39bbb40ee9c3ac266be23f5c3",
         "type": "github"
       },
       "original": {
@@ -117,17 +117,17 @@
     },
     "dms": {
       "inputs": {
+        "flake-compat": "flake-compat",
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "quickshell": "quickshell"
       },
       "locked": {
-        "lastModified": 1777431599,
+        "lastModified": 1783529634,
-        "narHash": "sha256-g6r/Gx8PTDzO3jCNzzySA+Ff1lmLF9nDlMCNyyoQjoE=",
+        "narHash": "sha256-zdHsPGPE5MVi/y+uIt548XScTfZjQzdF21dME7ISEJM=",
         "owner": "AvengeMedia",
         "repo": "DankMaterialShell",
-        "rev": "eb5afcdc40ea5446c27e18552ff4a19f9daf9484",
+        "rev": "bdfd565b72cbb416441a9ab828efcac4fd516c70",
         "type": "github"
       },
       "original": {
@@ -140,11 +140,11 @@
     "dms-plugin-ambient-sound": {
       "flake": false,
       "locked": {
-        "lastModified": 1781888428,
+        "lastModified": 1783948872,
-        "narHash": "sha256-uHPPeEYc5ix9EIBBsEHlle7QdGDZqv7aG/A/22Y+CSQ=",
+        "narHash": "sha256-C9IBE5k1dQzOVgGRdVpLIP6pvjjVys18CXjymh8PzFc=",
         "owner": "hthienloc",
         "repo": "dms-ambient-sound",
-        "rev": "5ddf16c151450029d352eedb70d811439c1d51d2",
+        "rev": "3d987f1a39e02e21d0bf9b33b42094367a69f771",
         "type": "github"
       },
       "original": {
@@ -236,11 +236,11 @@
     "dms-plugin-emoji-launcher": {
       "flake": false,
       "locked": {
-        "lastModified": 1776309741,
+        "lastModified": 1783139331,
-        "narHash": "sha256-NQ14YenDiNK2VqXQ3z7jAkatbSRtYJHhOhvv7AJlUD8=",
+        "narHash": "sha256-fmIddCvACwO8wbAtLBMtDnEXXQJjb7+o2s4jW3f8VIU=",
         "owner": "devnullvoid",
         "repo": "dms-emoji-launcher",
-        "rev": "1c0a7d337a52b48f9499060076703a35e8dd4f4f",
+        "rev": "8ff394e3ddfcb2fd755ed2e7b4c6f01f3e26e596",
         "type": "github"
       },
       "original": {
@@ -252,11 +252,11 @@
     "dms-plugin-ephemera": {
       "flake": false,
       "locked": {
-        "lastModified": 1777606672,
+        "lastModified": 1783707727,
-        "narHash": "sha256-G6oanR4zHbNSV+A94mNcB4EHK+S2ieo4dY8bwUEkv2I=",
+        "narHash": "sha256-+i7rbacYd7gfXcJtFuzV9GoIDSH8JFsf6H2FXPGMRpQ=",
         "owner": "nicolasgarcia214",
         "repo": "Ephemera",
-        "rev": "eaadf6d933a8449f36219935520a8e9f944b4aa0",
+        "rev": "172783fccb37e99756f999daa737ced42aeefe4e",
         "type": "github"
       },
       "original": {
@@ -268,11 +268,11 @@
     "dms-plugin-home-assistant": {
       "flake": false,
       "locked": {
-        "lastModified": 1780998572,
+        "lastModified": 1783907889,
-        "narHash": "sha256-YScGw1b4OHX3s7f+JUCoCuK+BcWGDLgpYxgSI+N3EPI=",
+        "narHash": "sha256-woLXMu5/t/mADIG1svWNifuo3ypZMJ94ee44+kBCXK4=",
         "owner": "xxyangyoulin",
         "repo": "dms-plugin-hass",
-        "rev": "0d3cd45f6a094582db5f9209b3dc1f72c1cfb067",
+        "rev": "3cef9b5a66f2d2010ee5e2fe49456b0aed32c003",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
     "dms-plugin-ocr-scanner": {
       "flake": false,
       "locked": {
-        "lastModified": 1781670158,
+        "lastModified": 1782019482,
-        "narHash": "sha256-n0oe+K1zUqCfEMyvtz+CYiZ+lBQv/Piqb19J/Cwqua4=",
+        "narHash": "sha256-9BNQl7oP5n3vJiBgdXaHsUewkJnJiiHCvSID1tWCeKk=",
         "owner": "hthienloc",
         "repo": "dms-ocr-scanner",
-        "rev": "dd94a72c2fc11fcca10bd8edb59803734c2154f5",
+        "rev": "268a7fca154edaf2f05ed12700fa968a0f8b75bc",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     "dms-plugin-official": {
       "flake": false,
       "locked": {
-        "lastModified": 1780332225,
+        "lastModified": 1783532508,
-        "narHash": "sha256-QkQPqP7Wmo5DLRyKNSY5NuOau4LSaSfz3DYdHDLxluA=",
+        "narHash": "sha256-17qZKvH0FDQEdX07HEfUjLLvOUEHGmXMVZ0zRtKoTZA=",
         "owner": "AvengeMedia",
         "repo": "dms-plugins",
-        "rev": "f4583449f12920e0a2f16808b00a860c27f0173d",
+        "rev": "5e4038806d8f4ca1fcfd1116c211cc9f1e36a074",
         "type": "github"
       },
       "original": {
@@ -364,11 +364,11 @@
     "dms-plugin-wallpaper-carousel": {
       "flake": false,
       "locked": {
-        "lastModified": 1779087303,
+        "lastModified": 1782824647,
-        "narHash": "sha256-/0t6ykbirNgSB2gY1wpq8jbntnuUgME+kLDfwjLhfRg=",
+        "narHash": "sha256-t70CBhiEBYHa9HvPpCZnfA8eCOWhUlXc6SUa9VprFNE=",
         "owner": "motor-dev",
         "repo": "wallpaperCarousel",
-        "rev": "bca1f457763d51c8001f8edcc89df3e619420163",
+        "rev": "c08fbb92c39d4d778bb08e520cfd96e395594440",
         "type": "github"
       },
       "original": {
@@ -380,11 +380,11 @@
     "dms-plugin-web-search": {
       "flake": false,
       "locked": {
-        "lastModified": 1773893074,
+        "lastModified": 1783139331,
-        "narHash": "sha256-c6mVBTlkJdfvMuMvPjXGeOEWBtb0mdmIcPNzgmMxGwE=",
+        "narHash": "sha256-UqFgAjW2A75dtlvOZkq4Vv/v/DROoc/ouCXBaVlksPI=",
         "owner": "devnullvoid",
         "repo": "dms-web-search",
-        "rev": "52f9ec482dc86d9c5ff0110a5d57401112191a38",
+        "rev": "821f5b437ea96739ce1cbc85ce324fb55e8884bb",
         "type": "github"
       },
       "original": {
@@ -396,11 +396,11 @@
     "dms-plugin-widget-group": {
       "flake": false,
       "locked": {
-        "lastModified": 1781887621,
+        "lastModified": 1782507283,
-        "narHash": "sha256-3uMtYcR4/drkAbjAopxWaNCeGv1PpwovPhq4OnU866s=",
+        "narHash": "sha256-+ApvThHcyP5Ivd+5nDrkZpKyoq9N1Aet+AJNKBPWfmY=",
         "owner": "rdannenbring",
         "repo": "widget-group",
-        "rev": "a82424ffdaddda90fcfe8d571d902c22fb894bb2",
+        "rev": "cd748fb105375629bf32378c7d05d10e50c51281",
         "type": "github"
       },
       "original": {
@@ -426,6 +426,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "locked": {
         "lastModified": 1733328505,
         "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
@@ -439,7 +455,7 @@
         "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
       }
     },
-    "flake-compat_2": {
+    "flake-compat_3": {
       "locked": {
         "lastModified": 1767039857,
         "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
@@ -459,11 +475,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -560,11 +576,11 @@
         "nixpkgs-lib": "nixpkgs-lib_3"
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -640,11 +656,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1783286111,
+        "lastModified": 1783989509,
-        "narHash": "sha256-t0NRlftLETETXef9nGI0wvD0YvouudXsKQMpyOpCSc4=",
+        "narHash": "sha256-UwiWbdWHCoHyvsqAdOmKMOfvkMwDAcVqmH7zJGPcJ3g=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "c9a150d6407b700b4fb2f693415ba143b56a40eb",
+        "rev": "b663d50a6a0101d5214112b24ffe20924af32beb",
         "type": "github"
       },
       "original": {
@@ -660,11 +676,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782423922,
+        "lastModified": 1783963347,
-        "narHash": "sha256-qPNd6lUohHP5gcJhqQ7rLV87RwIx0xYR2A4Frb9Zjc4=",
+        "narHash": "sha256-r376E2XpakiXwModDHIxlvB6qLq4iFVEq730vxOO4JY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5d320ab301cfaaca7d32514f13815d19d109f5f4",
+        "rev": "a45a7c451455a51ae740ec3bce4024b312809c29",
         "type": "github"
       },
       "original": {
@@ -681,11 +697,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781497404,
+        "lastModified": 1782839684,
-        "narHash": "sha256-9GAF8sSsnkyCVCWkomXR0T+zdSxyUlfPt6neQidimdg=",
+        "narHash": "sha256-vzs4SBgPsK4aNzlJR2PpFwtARazXMOxZonQnDz0YHxk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1285cd3d6882a9847f2d56ed5541b3350c8a6162",
+        "rev": "2a37d71bbe69e1522ddabf03a4cea0374958bdbe",
         "type": "github"
       },
       "original": {
@@ -709,14 +725,30 @@
         "type": "github"
       }
     },
+    "mediatek-mt7927-dkms": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783265495,
+        "narHash": "sha256-GXbwhZbvfWE+w9TgMReAsAFL/WkbCokzEiIChmX2d00=",
+        "owner": "jetm",
+        "repo": "mediatek-mt7927-dkms",
+        "rev": "ad1f3e4d19fe540aaa1f449ddba86c65db9bfc82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jetm",
+        "repo": "mediatek-mt7927-dkms",
+        "type": "github"
+      }
+    },
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1772289954,
+        "lastModified": 1783912271,
-        "narHash": "sha256-iDdtwk/dFb6AsXMtcOpZixxXl6C1HNUPe6cglxxHO7M=",
+        "narHash": "sha256-CzwmiKxuh1u+H8hDnrVeUl/fL59PvsgLbr2l0FhqWK0=",
         "owner": "mobile-nixos",
         "repo": "mobile-nixos",
-        "rev": "1a9e0af79dc7b5e29ed772f1a8a76fcbd9d45fdf",
+        "rev": "2c132754323fc1915e8d21dcfc0ef68ab084c6fb",
         "type": "github"
       },
       "original": {
@@ -725,22 +757,41 @@
         "type": "github"
       }
     },
+    "mt7927": {
+      "inputs": {
+        "mediatek-mt7927-dkms": "mediatek-mt7927-dkms",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1784045889,
+        "narHash": "sha256-ObYysms1WamPJPdVgrIdCLW/+YXHSewjPlhYmmPJJtM=",
+        "owner": "cmspam",
+        "repo": "mt7927-nixos",
+        "rev": "90d453fe6ee8166a83e924131a5da9962e751c03",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cmspam",
+        "repo": "mt7927-nixos",
+        "type": "github"
+      }
+    },
     "navi": {
       "inputs": {
         "crane": "crane",
         "flake-parts": "flake-parts_3",
         "nix-github-actions": "nix-github-actions",
         "nixos-anywhere": "nixos-anywhere",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "stable": "stable",
         "tofunix": "tofunix"
       },
       "locked": {
-        "lastModified": 1781964794,
+        "lastModified": 1783089845,
-        "narHash": "sha256-DpmkR7ifgSLj7890ayIsri3eioB7V8KhA6ys3ivXAPw=",
+        "narHash": "sha256-KwjncG/BgYouGBDyTSaIKc5Qs/81y6aCOb/uS6nWemw=",
         "owner": "cafkafk",
         "repo": "navi",
-        "rev": "f6e15457cebefb3a8aa6e30e1961288676c9c7f1",
+        "rev": "120d278511ea610b4e29c62a3e72673f90702d18",
         "type": "github"
       },
       "original": {
@@ -810,7 +861,7 @@
     },
     "nixcord": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_6",
         "nixpkgs": [
           "nixpkgs"
@@ -818,11 +869,11 @@
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1782436508,
+        "lastModified": 1783966657,
-        "narHash": "sha256-F91/VTVJmeERWwiJMHfEjkCEXWcNECSOiBsil3TlX9k=",
+        "narHash": "sha256-3UpTBZgZa/GhBALXqk5hfVsVhcFGERqjb3W2BuaD4sc=",
         "owner": "KaylorBen",
         "repo": "nixcord",
-        "rev": "9c530d99735c236db405f6a1ed58de0872ff9a19",
+        "rev": "0fd2e5db348f04e65447a773ddf55eb5b4e0b64d",
         "type": "github"
       },
       "original": {
@@ -915,18 +966,18 @@
     "nixos-raspberrypi": {
       "inputs": {
         "argononed": "argononed",
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixos-images": "nixos-images_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1779023229,
+        "lastModified": 1783459375,
-        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
+        "narHash": "sha256-S2pb+Mtv0qTeRr+6J5ESgelNjG2YKl4WqKjdPrJx5rM=",
         "owner": "nvmd",
         "repo": "nixos-raspberrypi",
-        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
+        "rev": "c845922f260b306d4529a4535bbb6e7f8cfe2887",
         "type": "github"
       },
       "original": {
@@ -970,11 +1021,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
+        "lastModified": 1782614948,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -1000,11 +1051,11 @@
     },
     "nixpkgs-lib_3": {
       "locked": {
-        "lastModified": 1777168982,
+        "lastModified": 1782614948,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -1015,11 +1066,11 @@
     },
     "nixpkgs-nixcord": {
       "locked": {
-        "lastModified": 1780453794,
+        "lastModified": 1782999065,
-        "narHash": "sha256-bXMRa9VTsHSPXL4Cw8R6JJLQeY3Y/IP4+YJCYVmQ7FY=",
+        "narHash": "sha256-5Dgj5+pIQYZKrXUGaLCk7CKfN3MmpwIhO94++WVxvng=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6b316287bae2ee04c9b93c8c858d930fd07d7338",
+        "rev": "80d591ed473cfc46329932c2aadac9b435342c7c",
         "type": "github"
       },
       "original": {
@@ -1030,6 +1081,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1784007870,
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1750134718,
         "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
@@ -1045,13 +1112,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1781577229,
+        "lastModified": 1784007870,
-        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
         "type": "github"
       },
       "original": {
@@ -1061,7 +1128,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1780336545,
         "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
@@ -1125,11 +1192,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782441318,
+        "lastModified": 1783991529,
-        "narHash": "sha256-e+EWubnfN/CqogQ3qFL7i5Yg8ST7hg/19WS+BAOYFb8=",
+        "narHash": "sha256-fHexrPkcBAX/4uFGF31MSBLglZqVFZkPXOn9M/ywoZ8=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "548388638a8f389437bc81e14122667244a36912",
+        "rev": "cc8dbe7122d71b860dc7e9e303d98dae5895e424",
         "type": "github"
       },
       "original": {
@@ -1233,28 +1300,6 @@
         "type": "github"
       }
     },
-    "quickshell": {
-      "inputs": {
-        "nixpkgs": [
-          "dms",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1776854048,
-        "narHash": "sha256-lLbV66V3RMNp1l8/UelmR4YzoJ5ONtgvEtiUMJATH/o=",
-        "ref": "refs/heads/master",
-        "rev": "783c953987dc56ff0601abe6845ed96f1d00495a",
-        "revCount": 806,
-        "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
-      },
-      "original": {
-        "rev": "783c953987dc56ff0601abe6845ed96f1d00495a",
-        "type": "git",
-        "url": "https://git.outfoxxed.me/quickshell/quickshell"
-      }
-    },
     "root": {
       "inputs": {
         "cursor": "cursor",
@@ -1284,11 +1329,12 @@
         "home-manager": "home-manager",
         "import-tree": "import-tree",
         "mobile-nixos": "mobile-nixos",
+        "mt7927": "mt7927",
         "navi": "navi",
         "nix-monitor": "nix-monitor",
         "nixcord": "nixcord",
         "nixos-raspberrypi": "nixos-raspberrypi",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "nixvirt": "nixvirt",
         "nur": "nur",
         "oom-hardware": "oom-hardware",
@@ -1310,11 +1356,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782165805,
+        "lastModified": 1783174389,
-        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {
@@ -1331,11 +1377,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1782031037,
+        "lastModified": 1783838433,
-        "narHash": "sha256-a7oWSyS7SN81UOqVt481yIEMDsMpaJ7GNdV6Eaz5Yqg=",
+        "narHash": "sha256-Zb8+v76qSPYDlUea1y30YzgdEoDjA97vRmeqfPAqwZs=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "9cb27462cfd20edac174353f1e95bc03aa888863",
+        "rev": "c6ab7371e40abd405313af9bddafd5f37cc94f83",
         "type": "github"
       },
       "original": {
@@ -1464,11 +1510,11 @@
     "t2linux-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1782419564,
+        "lastModified": 1783622056,
-        "narHash": "sha256-Rz6BsjpS9SETgcSkTz/QYuncR5CB0TM61SCzTiIcRI0=",
+        "narHash": "sha256-Sx0ZzYLDPs1DswThy8rWfNcS05ilHcP0DXz8nO6+FOc=",
         "owner": "t2linux",
         "repo": "linux-t2-patches",
-        "rev": "ff59395cc61769dc255b5eab6faac27e8ce441f7",
+        "rev": "b3fac289b2e46797c6e403078df1567214920324",
         "type": "github"
       },
       "original": {
@@ -1565,7 +1611,7 @@
     },
     "wrapper-modules": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
         "lastModified": 1782135443,
@@ -1589,11 +1635,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782144240,
+        "lastModified": 1783982026,
-        "narHash": "sha256-RgCWSv7AJZCwPhCzz+J0lvwp1WBz9ouvCnnlmvu0xfw=",
+        "narHash": "sha256-tFP35Y/BDWkDwFVoCab0gN00yKjGJU/IWpVxl68tGEI=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "d1693556428967f8b4eef128feb090421ddcaf15",
+        "rev": "8cbde27feab69507f13a41a01ee45c2b632a8f43",
         "type": "github"
       },
       "original": {

flake.nix

@@ -203,6 +203,9 @@
     hermes = {
       url = "github:NousResearch/hermes-agent";
     };
+    mt7927 = {
+      url = "github:cmspam/mt7927-nixos";
+    };
   };
 
   outputs = inputs:

modules/deploy/navi.nix

@@ -93,14 +93,45 @@ let
     // lib.optionalAttrs (name == "nix-server") {
       targetPort = 22;
     }
-  ) ssh.activeHosts;
+  ) ssh.activeHosts /* nix-deploy target list — IPs only */;
 
   metaNixpkgs = import inputs.nixpkgs {
     system = "x86_64-linux";
   };
+  # Build a raw Navi hive attrset from host specs + deployment targets.
+  # `inputs.navi.lib.makeHive` turns the result into `flake.naviHive`.
+  mkNaviHiveConfig =
+    {
+      metaNixpkgs,
+      hostSpecs,
+      deployments,
+    }:
+    let
+      deployNodes = lib.filterAttrs (name: _: deployments ? ${name}) hostSpecs;
+    in
+    {
+      meta = {
+        nixpkgs = metaNixpkgs;
+        nodeNixpkgs = lib.mapAttrs (
+          name: spec:
+          import inputs.nixpkgs {
+            system = spec.system;
+          }
+        ) deployNodes;
+        nodeSpecialArgs = lib.mapAttrs (_: spec: spec.specialArgs) deployNodes;
+        allowApplyAll = false;
+      };
+    }
+    // lib.mapAttrs (
+      name: spec:
+      {
+        imports = spec.modules or [ spec.configuration ];
+        deployment = deployments.${name};
+      }
+    ) deployNodes;
 in
 {
-  flake.navi = self.lib.mkNaviHiveConfig {
+  flake.navi = mkNaviHiveConfig {
     inherit metaNixpkgs hostSpecs deployments;
   };
 

modules/desktop/hyprland/binds.nix

@@ -1,6 +1,6 @@
 { ... }: {
   flake.lib.hyprlandBinds =
-    { lib, dmsEnabled ? false }:
+    { lib, dmsEnabled ? false, dmsIpcBinds }:
     let
       workspaceBinds =
         (builtins.map (i: "Super, ${toString i}, workspace, ${toString i}") (builtins.genList (n: n + 1) 9))
@@ -28,17 +28,15 @@
           "Super, Equal, splitratio, 0.1"
           "AltSuper, Space, togglefloating"
           "Super, P, pin"
-        ]
+        ]        ++ lib.optionals dmsEnabled [
-        ++ lib.optionals dmsEnabled [
+          "Super, Space, exec, ${dmsIpcBinds.spotlight}"
-          "Super, Space, exec, dms ipc call spotlight toggle"
+          "Super, I, exec, ${dmsIpcBinds.settingsFocus}"
-          "Super, I, exec, dms ipc call settings focusOrToggle"
+          "Super, N, exec, ${dmsIpcBinds.notepad}"
-          "Super, N, exec, dms ipc call notepad toggle"
+          "ShiftSuper, N, exec, ${dmsIpcBinds.notifications}"
-          "ShiftSuper, N, exec, dms ipc call notifications toggle"
+          "Super, M, exec, ${dmsIpcBinds.processlistFocus}"
-          "Super, M, exec, dms ipc call processlist focusOrToggle"
+          "Super, L, exec, ${dmsIpcBinds.lock}"
-          "Super, L, exec, dms ipc call lock lock"
+          "ShiftSuper, V, exec, ${dmsIpcBinds.clipboard}"
-          "ShiftSuper, V, exec, dms ipc call clipboard toggle"
+        ] ++ [
-        ]
-        ++ [
           "Super, Tab, cyclenext"
           "Super, Tab, bringactivetotop"
           "Super, left, movefocus, l"

modules/desktop/hyprland/default.nix

@@ -101,7 +101,10 @@
               "sleep 1 && hyprctl reload"
             ];
           }
-          (self.lib.hyprlandBinds { inherit lib dmsEnabled; })
+          (self.lib.hyprlandBinds {
+            inherit lib dmsEnabled;
+            dmsIpcBinds = self.lib.dmsIpcBinds;
+          })
           {
             decoration = {
               rounding = 10;

modules/desktop/niri/binds.nix

@@ -1,6 +1,6 @@
 { ... }: {
   flake.lib.niriBinds =
-    { pkgs, dmsEnabled ? false }:
+    { pkgs, dmsEnabled ? false, dmsIpcBinds }:
     let
       lib = pkgs.lib;
     in
@@ -12,16 +12,16 @@
       "Mod+E"."spawn-sh" = "nemo";
     }
     // lib.optionalAttrs dmsEnabled {
-      "Mod+Space"."spawn-sh" = "dms ipc call spotlight toggle";
+      "Mod+Space"."spawn-sh" = dmsIpcBinds.spotlight;
-      "Mod+V"."spawn-sh" = "dms ipc call clipboard toggle";
+      "Mod+V"."spawn-sh" = dmsIpcBinds.clipboard;
-      "Mod+N"."spawn-sh" = "dms ipc call notepad toggle";
+      "Mod+N"."spawn-sh" = dmsIpcBinds.notepad;
-      "Mod+Shift+N"."spawn-sh" = "dms ipc call notifications toggle";
+      "Mod+Shift+N"."spawn-sh" = dmsIpcBinds.notifications;
-      "Mod+M"."spawn-sh" = "dms ipc call processlist toggle";
+      "Mod+M"."spawn-sh" = dmsIpcBinds.processlist;
-      "Mod+B"."spawn-sh" = ''dms ipc call bar toggle name "Main Bar"; dms ipc call bar toggle name "Bar 2"'';
+      "Mod+B"."spawn-sh" = dmsIpcBinds.barToggle;
-      "Mod+Shift+B"."spawn-sh" = ''dms ipc call bar toggle name "Bar 2"'';
+      "Mod+Shift+B"."spawn-sh" = dmsIpcBinds.barToggleBar2;
-      "Mod+A"."spawn-sh" = "dms ipc call ephemera toggle";
+      "Mod+A"."spawn-sh" = dmsIpcBinds.ephemera;
-      "Mod+numbersign"."spawn-sh" = "dms ipc call wallpaperCarousel toggle";
+      "Mod+numbersign"."spawn-sh" = dmsIpcBinds.wallpaperCarousel;
-      "Mod+L"."spawn-sh" = "dms ipc call lock lock";
+      "Mod+L"."spawn-sh" = dmsIpcBinds.lock;
     }
     // {
       "Mod+Q"."close-window" = _: { };

modules/desktop/niri/default.nix

@@ -21,7 +21,10 @@
       niriBaseSettings =
         pkgs: dmsEnabled:
         self.lib.niriBaseSettings pkgs // {
-          binds = self.lib.niriBinds { inherit pkgs dmsEnabled; };
+          binds = self.lib.niriBinds {
+            inherit pkgs dmsEnabled;
+            dmsIpcBinds = self.lib.dmsIpcBinds;
+          };
         };
 
       mergeNiriSettings =

modules/desktop/options.nix

@@ -1,4 +1,38 @@
-{ ... }: {
+{ lib, ... }:
+{
+  flake.lib.wisdomCatalogExtraModules =
+    self:
+    let
+      names = lib.sort builtins.lessThan (
+        lib.filter (n: lib.hasPrefix "wisdom" n && n != "wisdom") (
+          builtins.attrNames self.homeManagerModules
+        )
+      );
+    in
+    map (name: self.homeManagerModules.${name}) names;
+
+  flake.lib.wisdomSlice =
+    { path, default, description, packages }:
+    { config, lib, pkgs, ... }:
+    let
+      segs = lib.splitString "." path;
+      optPath = [
+        "chiasson"
+        "home"
+      ]
+      ++ segs
+      ++ [ "enable" ];
+      root = config.chiasson.home;
+      cfg = lib.getAttrFromPath segs root;
+      enabled = lib.getAttrFromPath optPath config;
+    in
+    {
+      options = lib.setAttrByPath optPath (lib.mkEnableOption description // { inherit default; });
+      config = lib.mkIf (root.enable && enabled) {
+        home.packages = lib.filter (lib.meta.availableOn pkgs.stdenv.hostPlatform) (packages pkgs);
+      };
+    };
+
   flake.nixosModules.desktopOptions =
     { config, options, lib, pkgs, self, inputs, ... }:
     let
@@ -34,11 +68,13 @@
     {
       options.chiasson.desktop = {
         defaultSession = lib.mkOption {
-          type = lib.types.nullOr (lib.types.enum [
+          type = lib.types.nullOr (
-            "hyprland"
+            lib.types.enum [
-            "niri"
+              "hyprland"
-            "plasma"
+              "niri"
-          ]);
+              "plasma"
+            ]
+          );
           default = null;
           example = "niri";
           description = ''
@@ -56,10 +92,12 @@
 
         displayManager = {
           variant = lib.mkOption {
-            type = lib.types.nullOr (lib.types.enum [
+            type = lib.types.nullOr (
-              "sddm"
+              lib.types.enum [
-              "dankgreeter"
+                "sddm"
-            ]);
+                "dankgreeter"
+              ]
+            );
             default = null;
             description = ''
               SDDM vs DankGreeter (greetd + DMS — [docs](https://danklinux.com/docs/dankgreeter/nixos-flake)).
@@ -80,11 +118,13 @@
         };
 
         displayManager.sddm = {
-          wayland.enable = lib.mkEnableOption ''
+          wayland.enable =
-            SDDM greeter on Wayland (nicer on HiDPI; turn off if the greeter glitches on your GPU).
+            lib.mkEnableOption ''
-          '' // {
+              SDDM greeter on Wayland (nicer on HiDPI; turn off if the greeter glitches on your GPU).
-            default = true;
+            ''
-          };
+            // {
+              default = true;
+            };
 
           enableHidpi = lib.mkOption {
             type = lib.types.bool;
@@ -159,12 +199,14 @@
         };
 
         keyring = {
-          enable = lib.mkEnableOption ''
+          enable =
-            gnome-keyring + pam (login + sddm or greetd) + HM user service + `gcr` + `services.xserver.updateDbusEnvironment`.
+            lib.mkEnableOption ''
-            niri/hyprland: `dbus-update-activation-environment` at compositor start so libsecret/Electron see `WAYLAND_DISPLAY`.
+              gnome-keyring + pam (login + sddm or greetd) + HM user service + `gcr` + `services.xserver.updateDbusEnvironment`.
-          '' // {
+              niri/hyprland: `dbus-update-activation-environment` at compositor start so libsecret/Electron see `WAYLAND_DISPLAY`.
-            default = true;
+            ''
-          };
+            // {
+              default = true;
+            };
         };
       };
 
@@ -184,8 +226,7 @@
               message = "chiasson.desktop.defaultSession = \"plasma\" requires chiasson.desktop.plasma.enable = true.";
             }
             {
-              assertion =
+              assertion = cfg.displayManager.variant != "dankgreeter" || cfg.hyprland.enable || cfg.niri.enable;
-                cfg.displayManager.variant != "dankgreeter" || cfg.hyprland.enable || cfg.niri.enable;
               message = "chiasson.desktop.displayManager.variant = \"dankgreeter\" requires chiasson.desktop.hyprland or chiasson.desktop.niri.";
             }
             {
@@ -210,7 +251,7 @@
         (lib.mkIf (dmsEnabled && hmAvailable) {
           "home-manager".sharedModules = [ self.homeManagerModules.desktopShellDms ];
         })
-        (lib.mkIf (hmAvailable && (dmsEnabled || cfg.niri.enable)) {
+        (lib.mkIf hmAvailable {
           "home-manager".extraSpecialArgs = { inherit inputs; };
         })
       ];

modules/desktop/shells/dms/_private/hm.nix

@@ -124,33 +124,66 @@ let
       ;
   };
 
-  thirdPartyPlugins = {
+  # Plugin registry auto-derived from flake inputs matching `dms-plugin-*`.
-    dankVault = inputs.dms-plugin-dank-vault;
+  # Adding a plugin now requires editing only `flake.nix`. The on-disk
-    calculator = inputs.dms-plugin-calculator;
+  # plugin id (= path under ~/.config/DankMaterialShell/plugins/) is camelCase
-    homeAssistantMonitor = inputs.dms-plugin-home-assistant;
+  # per upstream convention; the kebab→camel transform matches it. The
-    dropdownMenu = inputs.dms-plugin-dropdown-menu;
+  # `idExceptions` map carries the one plugin whose manifest id does not
-    ocrScanner = inputs.dms-plugin-ocr-scanner;
+  # follow the default rule.
-    unifiedTaskbar = inputs.dms-plugin-unified-taskbar;
+  pluginInputs = lib.filterAttrs (n: _: lib.hasPrefix "dms-plugin-" n) inputs;
-    widgetGroup = inputs.dms-plugin-widget-group;
-    nixPackageRunner = inputs.dms-plugin-nix-package-runner;
-    ambientSound = inputs.dms-plugin-ambient-sound;
-    cavaVisualizer = inputs.dms-plugin-cava-visualizer;
-    emojiLauncher = inputs.dms-plugin-emoji-launcher;
-    dankDesktopWeather = inputs.dms-plugin-official + "/DankDesktopWeather";
-    webSearch = inputs.dms-plugin-web-search;
-    wallpaperCarousel = inputs.dms-plugin-wallpaper-carousel;
-    ephemera = inputs.dms-plugin-ephemera;
-    appShortcut = inputs.dms-plugin-app-shortcut;
-    wvkbdToggle = inputs.dms-plugin-wvkbd-toggle;
-    rbwLockToggle = inputs.dms-plugin-rbw-lock-toggle;
-  };
 
-  shipPlugin =
+  # `dank-vault` → `dankVault`. `lib.splitString` yields ≥ 1 element so
-    _id: src:
+  # `head parts` is safe; `map` runs over the tail only (no-op for
-    {
+  # single-word names like `calculator`). `builtins.substring 1 (-1) p`
-      source = src;
+  # returns the rest of `p` from index 1, dropping the first char
-      onChange = "${dmsRestartOnceScript}";
+  # (Nix treats a negative `len` as "rest of string from `start`").
+  toCamel = s:
+    let parts = lib.splitString "-" s; in
+      builtins.head parts
+      + lib.concatStrings (map (
+        p: if p == "" then ""
+          else lib.toUpper (builtins.substring 0 1 p)
+            + builtins.substring 1 (-1) p
+      ) (builtins.tail parts));
+
+  # The `home-assistant` plugin ships its manifest under id
+  # `homeAssistantMonitor` (not the default kebab→camel result).
+  idExceptions = { "home-assistant" = "homeAssistantMonitor"; };
+
+  # NB: don't rewrite as `idExceptions.${stripped} or toCamel stripped`.
+  # Nix grammar: `or` binds tighter than function application, so the
+  # `toCamel` and its arg parse as separate postfix args to the select.
+  # When the lookup succeeds the resolved string is then applied as a
+  # function, producing `attempt to call something which is not a function
+  # but a string: "homeAssistantMonitor"`. Explicit `if/hasAttr` sidesteps
+  # the parse entirely.
+  camelMap = lib.mapAttrs' (n: src:
+    let stripped = lib.removePrefix "dms-plugin-" n; in
+    lib.nameValuePair
+      (if builtins.hasAttr stripped idExceptions
+       then idExceptions.${stripped}
+       else toCamel stripped)
+      src
+  ) pluginInputs;
+
+  # The official plugin pack bundles multiple QML apps. Ship only the
+  # DankDesktopWeather subdir (verified by its manifest) to slim closure
+  # and avoid overlapping with future dedicated `dms-plugin-*` flakes.
+  thirdPartyPlugins =
+    builtins.removeAttrs camelMap [ "official" ] // {
+      dankDesktopWeather = inputs.dms-plugin-official + "/DankDesktopWeather";
     };
+
+  # DMS reads plugins from ~/.config/DankMaterialShell/plugins/<id>/, so
+  # we route each plugin source there via HM's `xdg.configFile.target`.
+  # The attrset name is scoped under `dms-plugin-${id}` (not the bare
+  # camelCase id) so unrelated HM modules can ship a same-named file
+  # (e.g. `xdg.configFile.calculator`) without colliding with us.
+  shipPlugin = id: src: {
+    source = src;
+    target = "DankMaterialShell/plugins/${id}";
+    onChange = "${dmsRestartOnceScript}";
+  };
 in
 {
   imports = [
@@ -160,7 +193,8 @@ in
 
   config = lib.mkIf dmsEnabled (lib.mkMerge [
     (lib.mkIf (dmsOs.bundleThirdPartyPlugins or true) {
-      xdg.configFile = lib.mapAttrs (_id: src: shipPlugin _id src) thirdPartyPlugins;
+      xdg.configFile = lib.mapAttrs' (id: src: lib.nameValuePair
+        "dms-plugin-${id}" (shipPlugin id src)) thirdPartyPlugins;
     })
     {
       programs.nix-monitor = {
@@ -203,10 +237,23 @@ in
         enableDynamicTheming = true;
         enableAudioWavelength = true;
         enableCalendarEvents = false;
+        # Empty on purpose: DMS owns ~/.config/DankMaterialShell/{settings,session}.json
+        # at runtime (seeded by `home.activation.dmsSeedConfig`). Setting these
+        # to non-empty here would clobber the runtime seed on every activation.
         settings = { };
         session = { };
       };
 
+      # Surface bad obsidianVaults paths at build time instead of at first matugen run.
+      # Each entry must point at the `<vault>/.obsidian` dir (matugen writes
+      # `<vault>/.obsidian/snippets/matugen.css` from there).
+      assertions = lib.mkIf ((dmsOs.obsidianVaults or [ ]) != [ ]) [
+        {
+          assertion = builtins.all (v: lib.hasSuffix "/.obsidian" v) (dmsOs.obsidianVaults or [ ]);
+          message = "chiasson.desktop.shells.dms.obsidianVaults entries must end in '/.obsidian' (matugen writes <vault>/.obsidian/snippets/matugen.css). Example: /home/olivier/Documents/HomeLab/.obsidian";
+        }
+      ];
+
       home.activation.dmsSeedConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] "${dmsSeedConfigScript}";
 
       systemd.user.services.dms.serviceConfig.ExecStartPre =

modules/desktop/shells/dms/default.nix

@@ -46,4 +46,25 @@
   };
 
   flake.homeManagerModules.desktopShellDms = import ./_private/hm.nix;
+
+  # DMS IPC commands shared between Niri and Hyprland keybind tables.
+  # Defines flake.lib.dmsIpcBinds so each compositor formats the same
+  # command string in its native shape — Niri attrs vs Hyprland string-list.
+  # Adding a new DMS keybind requires editing this file plus the
+  # per-compositor bind layout, not the command string.
+  flake.lib.dmsIpcBinds = {
+    spotlight         = "dms ipc call spotlight toggle";
+    clipboard         = "dms ipc call clipboard toggle";
+    notepad           = "dms ipc call notepad toggle";
+    notifications     = "dms ipc call notifications toggle";
+    processlist       = "dms ipc call processlist toggle";
+    # Hyprland prefers focusOrToggle (window-aware); niri subscribes to toggle.
+    processlistFocus  = "dms ipc call processlist focusOrToggle";
+    settingsFocus     = "dms ipc call settings focusOrToggle";
+    barToggle         = ''dms ipc call bar toggle name "Main Bar"; dms ipc call bar toggle name "Bar 2"'';
+    barToggleBar2     = ''dms ipc call bar toggle name "Bar 2"'';
+    ephemera          = "dms ipc call ephemera toggle";
+    wallpaperCarousel = "dms ipc call wallpaperCarousel toggle";
+    lock              = "dms ipc call lock lock";
+  };
 }

modules/hosts/14900k/_private/ai.nix

@@ -7,5 +7,5 @@
     # Replace the old acceleration line with this:
     package = pkgs.ollama-cuda; 
   };
-  chiasson.users.extraModules.olivier = [{chiasson.home.extraPackages = with pkgs; [ zed-editor windsurf];}];
+  chiasson.users.extraModules.olivier = [{chiasson.home.extraPackages = with pkgs; [ zed-editor devin-desktop];}];
 }

modules/hosts/14900k/_private/displays.nix

@@ -1,25 +1,15 @@
 # Monitor layout for 14900k.
-# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 side/top stack; DP-2 virtual 4K when streamingDisplay enabled.
+# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 stack; DP-2 virtual 4K when streamingDisplay is on.
-# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 Samsung to the left.
+# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 to the left.
-# Niri: `extraSettings` (KDL via `extraConfig`, other wrapper-modules keys) + `extraBinds` (merged keybinds).
+# Niri uses `extraSettings.extraConfig`; Hyprland uses `chiasson.desktop.hyprland.settings`.
-# Hyprland: `chiasson.desktop.hyprland.settings` (merged in HM when `chiasson.desktop.hyprland.enable`).
 
 #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
 { config, lib, ... }:
 let
+  streamingDisplay = config.chiasson.system.streamingDisplay;
   gpuPassthru = config.chiasson.system.gpuPassthru.enable;
-  streamingDisplay = config.chiasson.system.streamingDisplay.enable or false;
-  streamingCfg = config.chiasson.system.streamingDisplay or { };
-
-  virtualOutputNiri =
-    lib.optionalString streamingDisplay ''
-      output "${streamingCfg.connector}" {
-          mode "${streamingCfg.mode}"
-          scale ${toString (streamingCfg.niriScale or 1.0)}
-          position ${streamingCfg.niriPosition}
-      }
-    '';
 
+  # Niri outputs: a static block per GPU layout, plus the optional virtual 4K panel.
   niriOutputs =
     (if gpuPassthru then
       ''
@@ -54,48 +44,30 @@ let
             position x=0 y=-1080
         }
       '')
-    + virtualOutputNiri;
+    + lib.optionalString streamingDisplay.enable ''
-
+        output "${streamingDisplay.connector}" {
-  virtualOutputHyprland =
+            mode "${streamingDisplay.mode}"
-    lib.optionalString streamingDisplay
+            scale ${toString streamingDisplay.niriScale}
-      "${streamingCfg.connector}, ${streamingCfg.mode}, 7680x0, ${toString (streamingCfg.niriScale or 1.0)}";
+            position ${streamingDisplay.niriPosition}
+        }
+      '';
 
+  # Hyprland monitor strings, with the virtual panel appended when enabled.
   hyprlandMonitors =
     (if gpuPassthru then
-      [
+      [ "DP-1, 2560x1080@144, 0x0, 1" "HDMI-A-2, 1920x1080@60, -1920x0, 1" ]
-        "DP-1, 2560x1080@144, 0x0, 1"
-        "HDMI-A-2, 1920x1080@60, -1920x0, 1"
-      ]
     else
-      [
+      [ "DP-3, 2560x1080@144, 0x0, 1" "DP-4, 1920x1080@144, 0x-1080, 1" "HDMI-A-3, 1920x1080@60, -1920x0, 1" ])
-        "DP-3, 2560x1080@144, 0x0, 1"
+    ++ lib.optional streamingDisplay.enable "${streamingDisplay.connector}, ${streamingDisplay.mode}, 7680x0, ${toString streamingDisplay.niriScale}";
-        "DP-4, 1920x1080@144, 0x-1080, 1"
-        "HDMI-A-3, 1920x1080@60, -1920x0, 1"
-      ])
-    ++ lib.optional streamingDisplay virtualOutputHyprland;
 
   hyprlandWorkspaces =
     if gpuPassthru then
-      [
+      [ "1, monitor:DP-1, default:true" "2, monitor:DP-1" "3, monitor:DP-1"
-        "1, monitor:DP-1, default:true"
+        "4, monitor:HDMI-A-2, default:true" "5, monitor:HDMI-A-2" "6, monitor:HDMI-A-2" ]
-        "2, monitor:DP-1"
-        "3, monitor:DP-1"
-        "4, monitor:HDMI-A-2, default:true"
-        "5, monitor:HDMI-A-2"
-        "6, monitor:HDMI-A-2"
-      ]
     else
-      [
+      [ "1, monitor:DP-3, default:true" "2, monitor:DP-3" "3, monitor:DP-3"
-        "1, monitor:DP-3, default:true"
+        "4, monitor:HDMI-A-3, default:true" "5, monitor:HDMI-A-3" "6, monitor:HDMI-A-3"
-        "2, monitor:DP-3"
+        "7, monitor:DP-4" "8, monitor:DP-4" "9, monitor:DP-4" ];
-        "3, monitor:DP-3"
-        "4, monitor:HDMI-A-3, default:true"
-        "5, monitor:HDMI-A-3"
-        "6, monitor:HDMI-A-3"
-        "7, monitor:DP-4"
-        "8, monitor:DP-4"
-        "9, monitor:DP-4"
-      ];
 in
 {
   chiasson.desktop.niri.extraSettings = {
@@ -103,10 +75,7 @@ in
   };
 
   chiasson.desktop.niri.extraBinds."XF86Tools".spawn = [
-    "wpctl"
+    "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"
-    "set-mute"
-    "@DEFAULT_AUDIO_SOURCE@"
-    "toggle"
   ];
 
   chiasson.desktop.hyprland.settings = lib.mkIf config.chiasson.desktop.hyprland.enable {

modules/hosts/14900k/_private/dms-defaults/plugin_settings.json

@@ -39,7 +39,8 @@
     "hassUrl": "https://home.chiasson.cloud/",
     "hassTokenPath": "/run/secrets/home-assistant/auth-token",
     "showButtonsOnStatusBar": true,
-    "showAttributes": false
+    "showAttributes": false,
+    "haRefreshCounter": 1
   },
   "unifiedTaskbar": {
     "enabled": true,

modules/hosts/14900k/_private/dms-defaults/settings.json

@@ -4,11 +4,14 @@
   "customThemeFile": "",
   "registryThemeVariants": {},
   "matugenScheme": "scheme-tonal-spot",
+  "matugenContrast": 0,
   "runUserMatugenTemplates": true,
   "matugenTargetMonitor": "",
   "popupTransparency": 1,
   "dockTransparency": 1,
   "widgetBackgroundColor": "sch",
+  "widgetBackgroundCustomColor": "#6750A4",
+  "widgetBackgroundCustomStrength": 0.5,
   "widgetColorMode": "default",
   "controlCenterTileColorMode": "primary",
   "buttonColorMode": "primary",
@@ -17,11 +20,18 @@
   "niriLayoutRadiusOverride": -1,
   "niriLayoutBorderSize": -1,
   "hyprlandLayoutGapsOverride": -1,
+  "hyprlandLayoutGapsOutOverride": -1,
   "hyprlandLayoutRadiusOverride": -1,
   "hyprlandLayoutBorderSize": -1,
+  "hyprlandResizeOnBorder": false,
   "mangoLayoutGapsOverride": -1,
+  "mangoLayoutGapsOutOverride": -1,
   "mangoLayoutRadiusOverride": -1,
   "mangoLayoutBorderSize": -1,
+  "mangoTrackpadNaturalScrolling": true,
+  "firstDayOfWeek": -1,
+  "showWeekNumber": false,
+  "calendarBackend": "auto",
   "use24HourClock": false,
   "showSeconds": true,
   "padHours12Hour": false,
@@ -36,6 +46,17 @@
   "modalAnimationSpeed": 1,
   "modalCustomAnimationDuration": 150,
   "enableRippleEffects": true,
+  "animationVariant": 0,
+  "motionEffect": 0,
+  "m3ElevationEnabled": true,
+  "m3ElevationIntensity": 12,
+  "m3ElevationOpacity": 30,
+  "m3ElevationColorMode": "default",
+  "m3ElevationLightDirection": "top",
+  "m3ElevationCustomColor": "#000000",
+  "modalElevationEnabled": true,
+  "popoutElevationEnabled": true,
+  "barElevationEnabled": false,
   "blurEnabled": false,
   "blurForegroundLayers": true,
   "blurLayerOutlineOpacity": 0.12,
@@ -45,6 +66,8 @@
   "wallpaperFillMode": "Fill",
   "blurredWallpaperLayer": false,
   "blurWallpaperOnOverview": false,
+  "wallpaperBackgroundColorMode": "black",
+  "wallpaperBackgroundCustomColor": "#000000",
   "showLauncherButton": true,
   "showWorkspaceSwitcher": true,
   "showFocusedWindow": true,
@@ -64,6 +87,12 @@
   "showClock": true,
   "showNotificationButton": true,
   "showBattery": true,
+  "showBatteryPercent": true,
+  "showBatteryPercentOnlyOnBattery": false,
+  "showBatteryTime": false,
+  "showBatteryTimeOnlyOnBattery": false,
+  "batteryPillStyle": false,
+  "batteryPillPercentSign": false,
   "showControlCenterButton": true,
   "showCapsLockIndicator": true,
   "controlCenterShowNetworkIcon": true,
@@ -78,6 +107,8 @@
   "controlCenterShowBatteryIcon": false,
   "controlCenterShowPrinterIcon": false,
   "controlCenterShowScreenSharingIcon": true,
+  "controlCenterShowIdleInhibitorIcon": false,
+  "controlCenterShowDoNotDisturbIcon": false,
   "showPrivacyButton": true,
   "privacyShowMicIcon": false,
   "privacyShowCameraIcon": false,
@@ -133,29 +164,57 @@
   "maxWorkspaceIcons": 9,
   "workspaceAppIconSizeOffset": 1,
   "groupWorkspaceApps": true,
+  "groupActiveWorkspaceApps": false,
   "workspaceFollowFocus": false,
   "showOccupiedWorkspacesOnly": true,
   "reverseScrolling": false,
   "dwlShowAllTags": false,
+  "workspaceActiveAppHighlightEnabled": false,
   "workspaceColorMode": "default",
+  "workspaceFocusedCustomColor": "#6750A4",
   "workspaceOccupiedColorMode": "none",
+  "workspaceOccupiedCustomColor": "#625B71",
   "workspaceUnfocusedColorMode": "default",
+  "workspaceUnfocusedCustomColor": "#49454E",
   "workspaceUrgentColorMode": "default",
+  "workspaceUrgentCustomColor": "#B3261E",
   "workspaceFocusedBorderEnabled": false,
   "workspaceFocusedBorderColor": "primary",
+  "workspaceFocusedBorderCustomColor": "#6750A4",
   "workspaceFocusedBorderThickness": 2,
+  "workspaceUnfocusedMonitorSeparateAppearance": false,
+  "workspaceUnfocusedMonitorColorMode": "default",
+  "workspaceUnfocusedMonitorFocusedCustomColor": "#6750A4",
+  "workspaceUnfocusedMonitorOccupiedColorMode": "none",
+  "workspaceUnfocusedMonitorOccupiedCustomColor": "#625B71",
+  "workspaceUnfocusedMonitorUnfocusedColorMode": "default",
+  "workspaceUnfocusedMonitorUnfocusedCustomColor": "#49454E",
+  "workspaceUnfocusedMonitorUrgentColorMode": "default",
+  "workspaceUnfocusedMonitorUrgentCustomColor": "#B3261E",
+  "workspaceUnfocusedMonitorBorderEnabled": false,
+  "workspaceUnfocusedMonitorBorderColor": "primary",
+  "workspaceUnfocusedMonitorBorderCustomColor": "#6750A4",
+  "workspaceUnfocusedMonitorBorderThickness": 2,
   "workspaceNameIcons": {},
   "waveProgressEnabled": true,
   "scrollTitleEnabled": true,
+  "mediaAdaptiveWidthEnabled": true,
   "audioVisualizerEnabled": true,
   "audioScrollMode": "volume",
   "audioWheelScrollAmount": 5,
+  "audioDeviceScrollVolumeEnabled": false,
+  "mediaExcludePlayers": [],
   "clockCompactMode": false,
   "focusedWindowCompactMode": false,
+  "focusedWindowSize": 1,
+  "focusedWindowShowIcon": true,
   "runningAppsCompactMode": true,
   "barMaxVisibleApps": 0,
   "barMaxVisibleRunningApps": 0,
   "barShowOverflowBadge": true,
+  "trayAutoOverflow": true,
+  "trayPopupSingleLine": true,
+  "trayMaxVisibleItems": 0,
   "appsDockHideIndicators": false,
   "appsDockColorizeActive": false,
   "appsDockActiveColorMode": "primary",
@@ -163,6 +222,7 @@
   "appsDockEnlargePercentage": 125,
   "appsDockIconSizePercentage": 100,
   "keyboardLayoutNameCompactMode": false,
+  "keyboardLayoutNameShowIcon": false,
   "runningAppsCurrentWorkspace": true,
   "runningAppsGroupByApp": false,
   "runningAppsCurrentMonitor": false,
@@ -198,9 +258,18 @@
   "lockDateFormat": "dddd, MMMM d",
   "greeterRememberLastSession": true,
   "greeterRememberLastUser": true,
+  "greeterAutoLogin": false,
   "greeterEnableFprint": false,
   "greeterEnableU2f": false,
   "greeterWallpaperPath": "",
+  "greeterUse24HourClock": true,
+  "greeterShowSeconds": false,
+  "greeterPadHours12Hour": false,
+  "greeterLockDateFormat": "",
+  "greeterFontFamily": "",
+  "greeterWallpaperFillMode": "",
+  "greeterSyncPending": false,
+  "greeterSyncBaseline": {},
   "mediaSize": 1,
   "appLauncherViewMode": "list",
   "spotlightModalViewMode": "list",
@@ -211,19 +280,53 @@
   "sortAppsAlphabetically": false,
   "appLauncherGridColumns": 4,
   "spotlightCloseNiriOverview": true,
+  "rememberLastQuery": false,
+  "rememberLastMode": true,
   "spotlightSectionViewModes": {},
   "appDrawerSectionViewModes": {},
   "niriOverviewOverlayEnabled": true,
-  "dankLauncherV2Size": "compact",
+  "dankLauncherV2Size": "medium",
+  "dankLauncherV2ShowSourceBadges": true,
   "dankLauncherV2BorderEnabled": false,
   "dankLauncherV2BorderThickness": 2,
   "dankLauncherV2BorderColor": "primary",
   "dankLauncherV2ShowFooter": true,
-  "dankLauncherV2UnloadOnClose": false,
+  "dankLauncherV2UnloadOnClose": true,
+  "dankLauncherV2IncludeFilesInAll": false,
+  "dankLauncherV2IncludeFoldersInAll": false,
+  "launcherUseOverlayLayer": false,
+  "launcherStyle": "spotlight",
+  "spotlightBarShowModeChips": true,
+  "keybindsFloatingWindow": false,
   "useAutoLocation": false,
   "weatherEnabled": true,
-  "networkPreference": "auto",
+  "dashTabs": [
-  "iconTheme": "WhiteSur-dark",
+    {
+      "id": "overview",
+      "enabled": true
+    },
+    {
+      "id": "media",
+      "enabled": true
+    },
+    {
+      "id": "wallpaper",
+      "enabled": true
+    },
+    {
+      "id": "weather",
+      "enabled": true
+    },
+    {
+      "id": "settings",
+      "enabled": true
+    }
+  ],
+  "networkPreference": "ethernet",
+  "iconThemeDark": "System Default",
+  "iconThemeLight": "System Default",
+  "iconThemePerMode": false,
+  "lastAppliedIconTheme": "",
   "cursorSettings": {
     "theme": "System Default",
     "size": 24,
@@ -240,9 +343,9 @@
       "cursorHideTimeout": 0
     }
   },
-  "launcherLogoMode": "apps",
+  "launcherLogoMode": "os",
   "launcherLogoCustomPath": "",
-  "launcherLogoColorOverride": "",
+  "launcherLogoColorOverride": "primary",
   "launcherLogoColorInvertOnMode": false,
   "launcherLogoBrightness": 0.5,
   "launcherLogoContrast": 1,
@@ -251,28 +354,50 @@
   "monoFontFamily": "Fira Code",
   "fontWeight": 400,
   "fontScale": 1,
+  "textRenderType": 0,
+  "textRenderQuality": 0,
   "notepadUseMonospace": true,
   "notepadFontFamily": "",
   "notepadFontSize": 14,
+  "notificationSummaryFontSize": 0,
+  "notificationBodyFontSize": 0,
   "notepadShowLineNumbers": false,
+  "notepadAutoSave": false,
+  "notepadSlideoutSide": "right",
+  "notepadDefaultMode": "slideout",
   "notepadTransparencyOverride": -1,
   "notepadLastCustomTransparency": 0.7,
+  "notepadUseCompositorGap": false,
+  "notepadEdgeGap": 0,
   "soundsEnabled": true,
   "useSystemSoundTheme": false,
+  "soundLogin": false,
   "soundNewNotification": true,
   "soundVolumeChanged": true,
   "soundPluggedIn": true,
+  "muteSoundsWhenMediaPlaying": true,
   "acMonitorTimeout": 0,
   "acLockTimeout": 0,
   "acSuspendTimeout": 0,
   "acSuspendBehavior": 0,
   "acProfileName": "",
+  "acPostLockMonitorTimeout": 0,
   "batteryMonitorTimeout": 0,
   "batteryLockTimeout": 0,
   "batterySuspendTimeout": 0,
   "batterySuspendBehavior": 0,
   "batteryProfileName": "",
+  "batteryPostLockMonitorTimeout": 0,
   "batteryChargeLimit": 100,
+  "batteryNotifyChargeLimit": false,
+  "batteryCriticalThreshold": 10,
+  "batteryNotifyCritical": true,
+  "batteryLowThreshold": 20,
+  "batteryNotifyLow": false,
+  "batteryChargeLimitNotificationType": 0,
+  "batteryLowNotificationType": 0,
+  "batteryCriticalNotificationType": 1,
+  "batteryAutoPowerSaver": false,
   "lockBeforeSuspend": false,
   "loginctlLockIntegration": true,
   "fadeToLockEnabled": true,
@@ -304,6 +429,7 @@
   "matugenTemplatePywalfox": true,
   "matugenTemplateZenBrowser": true,
   "matugenTemplateVesktop": false,
+  "matugenTemplateVencord": true,
   "matugenTemplateEquibop": true,
   "matugenTemplateGhostty": true,
   "matugenTemplateKitty": true,
@@ -316,10 +442,23 @@
   "matugenTemplateVscode": true,
   "matugenTemplateEmacs": true,
   "matugenTemplateZed": true,
+  "matugenTemplateNeovimSettings": {
+    "dark": {
+      "baseTheme": "github_dark",
+      "harmony": 0.5
+    },
+    "light": {
+      "baseTheme": "github_light",
+      "harmony": 0.5
+    }
+  },
+  "matugenTemplateNeovimSetBackground": true,
   "showDock": false,
   "dockAutoHide": false,
   "dockSmartAutoHide": false,
+  "dockUseOverlayLayer": false,
   "dockGroupByApp": false,
+  "dockRestoreSpecialWorkspaceOnClick": false,
   "dockOpenOnOverview": false,
   "dockPosition": 1,
   "dockSpacing": 4,
@@ -342,6 +481,9 @@
   "dockMaxVisibleApps": 0,
   "dockMaxVisibleRunningApps": 0,
   "dockShowOverflowBadge": true,
+  "dockShowTrash": false,
+  "dockTrashFileManager": "default",
+  "dockTrashCustomCommand": "",
   "notificationOverlayEnabled": false,
   "notificationPopupShadowEnabled": true,
   "notificationPopupPrivacyMode": false,
@@ -359,14 +501,21 @@
   "maxFprintTries": 15,
   "enableU2f": false,
   "u2fMode": "or",
-  "lockScreenActiveMonitor": "all",
   "lockScreenInactiveColor": "#000000",
   "lockScreenNotificationMode": 0,
+  "lockScreenVideoEnabled": false,
+  "lockScreenVideoPath": "",
+  "lockScreenVideoCycling": false,
+  "lockScreenWallpaperPath": "",
+  "lockScreenWallpaperFillMode": "",
+  "lockScreenFontFamily": "",
   "hideBrightnessSlider": false,
   "notificationTimeoutLow": 5000,
   "notificationTimeoutNormal": 5000,
   "notificationTimeoutCritical": 0,
   "notificationCompactMode": false,
+  "notificationShowTimeoutBar": false,
+  "notificationDedupeEnabled": true,
   "notificationPopupPosition": 0,
   "notificationAnimationSpeed": 1,
   "notificationCustomAnimationDuration": 400,
@@ -377,6 +526,7 @@
   "notificationHistorySaveNormal": true,
   "notificationHistorySaveCritical": true,
   "notificationRules": [],
+  "notificationFocusedMonitor": false,
   "osdAlwaysShowValue": false,
   "osdPosition": 5,
   "osdVolumeEnabled": true,
@@ -407,9 +557,13 @@
   "customPowerActionReboot": "",
   "customPowerActionPowerOff": "",
   "updaterHideWidget": false,
+  "updaterCheckOnStart": false,
   "updaterUseCustomCommand": false,
   "updaterCustomCommand": "",
   "updaterTerminalAdditionalParams": "",
+  "updaterIntervalSeconds": 1800,
+  "updaterIncludeFlatpak": true,
+  "updaterAllowAUR": true,
   "displayNameMode": "system",
   "screenPreferences": {},
   "showOnLastDisplay": {},
@@ -420,6 +574,7 @@
   "displayProfileAutoSelect": false,
   "displayShowDisconnected": false,
   "displaySnapToEdge": true,
+  "connectedFrameBarStyleBackups": {},
   "barConfigs": [
     {
       "bottomGap": 0,
@@ -513,7 +668,7 @@
           "id": "gpuTemp",
           "enabled": true,
           "selectedGpuIndex": 0,
-          "pciId": "",
+          "pciId": "10de:1f07",
           "minimumWidth": true
         },
         {
@@ -681,6 +836,14 @@
   "desktopWidgetPositions": {},
   "desktopWidgetGridSettings": {
     "DP-3": {
+      "enabled": true,
+      "size": 40
+    },
+    "HDMI-A-3": {
+      "enabled": true,
+      "size": 50
+    },
+    "DP-4": {
       "enabled": true,
       "size": 50
     }
@@ -692,7 +855,7 @@
       "name": "Desktop Clock",
       "enabled": true,
       "config": {
-        "style": "analog",
+        "style": "digital",
         "transparency": 0.8,
         "colorMode": "primary",
         "customColor": "#ffffff",
@@ -700,347 +863,48 @@
         "showAnalogNumbers": false,
         "showAnalogSeconds": true,
         "displayPreferences": [
-          "all"
+          {
-        ]
+            "name": "DP-2",
+            "model": "SUN-4K"
+          },
+          {
+            "name": "DP-3",
+            "model": "34GL750"
+          },
+          {
+            "name": "DP-4",
+            "model": "ZOWIE XL LCD"
+          }
+        ],
+        "showDigitalSeconds": false,
+        "showOnOverlay": false,
+        "showOnOverviewOnly": false,
+        "showOnOverview": false
       },
       "positions": {
         "DP-3": {
-          "width": 300,
+          "width": 240,
-          "height": 300,
+          "height": 240,
-          "x": 1550,
+          "x": 2240,
-          "y": 50
+          "y": 40
         },
         "DP-4": {
-          "width": 200,
+          "width": 240.484375,
-          "height": 200,
+          "height": 240.484375,
-          "x": 860,
+          "x": 1350,
-          "y": 440
+          "y": 50
         },
         "HDMI-A-3": {
-          "width": 200,
+          "width": 250,
-          "height": 200,
-          "x": 1708.3671875,
-          "y": 4.84765625
-        }
-      }
-    },
-    {
-      "id": "dw_1782021988600_vdg97np4g",
-      "widgetType": "systemMonitor",
-      "name": "System Monitor",
-      "enabled": true,
-      "config": {
-        "showHeader": true,
-        "transparency": 0.8,
-        "colorMode": "primary",
-        "customColor": "#ffffff",
-        "showCpu": true,
-        "showCpuGraph": true,
-        "showCpuTemp": true,
-        "showGpuTemp": false,
-        "gpuPciId": "",
-        "showMemory": true,
-        "showMemoryGraph": true,
-        "showNetwork": true,
-        "showNetworkGraph": true,
-        "showDisk": true,
-        "showTopProcesses": false,
-        "topProcessCount": 3,
-        "topProcessSortBy": "cpu",
-        "layoutMode": "auto",
-        "graphInterval": 60,
-        "displayPreferences": [
-          "all"
-        ]
-      },
-      "positions": {
-        "DP-3": {
-          "width": 500,
           "height": 250,
-          "x": 2000,
+          "x": 1650,
           "y": 50
         },
-        "DP-4": {
+        "DP-2": {
-          "width": 320,
-          "height": 480,
-          "x": 800,
-          "y": 300
-        },
-        "HDMI-A-3": {
-          "width": 320,
-          "height": 480,
-          "x": 1595.0546875,
-          "y": 556.515625
-        }
-      }
-    },
-    {
-      "id": "dw_1782022081429_08ufxr98h",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: Obsidian",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "obsidian",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 100,
-          "height": 100,
-          "x": 150,
-          "y": 200
-        },
-        "DP-4": {
           "width": 200,
           "height": 200,
-          "x": 860,
+          "x": 412,
-          "y": 440
+          "y": 284
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.05859375,
-          "y": 0.18518518518518517,
-          "width": 100,
-          "height": 100
-        }
-      }
-    },
-    {
-      "id": "dw_1782022155947_1a4381zan",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: Steam",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "steam",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 100,
-          "height": 100,
-          "x": 50,
-          "y": 900
-        },
-        "DP-4": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.01953125,
-          "y": 0.8333333333333334,
-          "width": 100,
-          "height": 100
-        }
-      }
-    },
-    {
-      "id": "dw_1782022159047_a0w7xwkkz",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: Vesktop",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "vesktop",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 100,
-          "height": 100,
-          "x": 50,
-          "y": 200
-        },
-        "DP-4": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.01953125,
-          "y": 0.18518518518518517,
-          "width": 100,
-          "height": 100
-        }
-      }
-    },
-    {
-      "id": "dw_1782022160265_i4vr22k1v",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: PrismLauncher",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "org.prismlauncher.PrismLauncher",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 100,
-          "height": 100,
-          "x": 250,
-          "y": 900
-        },
-        "DP-4": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.09765625,
-          "y": 0.8333333333333334,
-          "width": 100,
-          "height": 100
-        }
-      }
-    },
-    {
-      "id": "dw_1782022161442_3vfjq50gk",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: Pokeclicker",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "pokeclicker-desktop-with-scripts",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 100,
-          "height": 100,
-          "x": 150,
-          "y": 900
-        },
-        "DP-4": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.05859375,
-          "y": 0.8333333333333334,
-          "width": 100,
-          "height": 100
-        }
-      }
-    },
-    {
-      "id": "dw_1782022229421_fuo32iz2s",
-      "widgetType": "appShortcut",
-      "name": "Application Shortcut: Edge",
-      "enabled": true,
-      "config": {
-        "displayPreferences": [
-          "all"
-        ],
-        "showOnOverlay": false,
-        "showOnOverview": false,
-        "showOnOverviewOnly": false,
-        "clickThrough": false,
-        "shortcutApp": "microsoft-edge",
-        "followTheme": false,
-        "drawOutlines": false,
-        "syncPositionAcrossScreens": true
-      },
-      "positions": {
-        "DP-3": {
-          "width": 150,
-          "height": 150,
-          "x": 50,
-          "y": 50
-        },
-        "DP-4": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "HDMI-A-3": {
-          "width": 200,
-          "height": 200,
-          "x": 860,
-          "y": 440
-        },
-        "_synced": {
-          "x": 0.01953125,
-          "y": 0.046296296296296294,
-          "width": 150,
-          "height": 150
         }
       }
     },
@@ -1048,7 +912,7 @@
       "id": "dw_1782022922490_aiumfxf49",
       "widgetType": "cavaVisualizer",
       "name": "Cava Visualizer",
-      "enabled": true,
+      "enabled": false,
       "config": {
         "displayPreferences": [
           "all"
@@ -1083,8 +947,8 @@
           "y": 440
         },
         "_synced": {
-          "x": 0.2734375,
+          "x": 0.27313639322916666,
-          "y": 0.5092592592592593,
+          "y": 0.5089156539351852,
           "width": 1100,
           "height": 500
         }
@@ -1097,16 +961,19 @@
       "enabled": true,
       "config": {
         "displayPreferences": [
-          "all"
+          {
+            "name": "DP-4",
+            "model": "ZOWIE XL LCD"
+          }
         ],
         "syncPositionAcrossScreens": true,
-        "viewMode": "detailed",
+        "viewMode": "compact",
         "colorMode": "primary",
         "backgroundOpacity": 80,
         "showPressure": true,
         "forecastDays": 7,
-        "showHourlyForecast": true,
+        "showHourlyForecast": false,
-        "hourlyCount": 6,
+        "hourlyCount": 12,
         "showLocation": false,
         "showCondition": true,
         "showFeelsLike": true
@@ -1131,17 +998,95 @@
           "y": 440
         },
         "_synced": {
-          "x": 0.78125,
+          "x": 0.859375,
-          "y": 0.32407407407407407,
+          "y": 0.046296296296296294,
-          "width": 500,
+          "width": 250,
-          "height": 650
+          "height": 250
+        }
+      }
+    },
+    {
+      "id": "dw_1782021988600_vdg97np4g",
+      "widgetType": "systemMonitor",
+      "name": "System Monitor",
+      "enabled": true,
+      "config": {
+        "showHeader": true,
+        "transparency": 0.8,
+        "colorMode": "primary",
+        "customColor": "#ffffff",
+        "showCpu": true,
+        "showCpuGraph": true,
+        "showCpuTemp": true,
+        "showGpuTemp": false,
+        "gpuPciId": "",
+        "showMemory": true,
+        "showMemoryGraph": true,
+        "showNetwork": true,
+        "showNetworkGraph": true,
+        "showDisk": true,
+        "showTopProcesses": false,
+        "topProcessCount": 3,
+        "topProcessSortBy": "cpu",
+        "layoutMode": "auto",
+        "graphInterval": 300,
+        "displayPreferences": [
+          {
+            "name": "DP-2",
+            "model": "SUN-4K"
+          },
+          {
+            "name": "DP-4",
+            "model": "ZOWIE XL LCD"
+          }
+        ]
+      },
+      "positions": {
+        "DP-3": {
+          "width": 800,
+          "height": 350,
+          "x": 1650,
+          "y": 650
+        },
+        "DP-4": {
+          "width": 800,
+          "height": 350,
+          "x": 1100,
+          "y": 650
+        },
+        "HDMI-A-3": {
+          "width": 700,
+          "height": 350,
+          "x": 1200,
+          "y": 650
+        },
+        "DP-2": {
+          "width": 320,
+          "height": 480,
+          "x": 352,
+          "y": 144
         }
       }
     }
   ],
   "desktopWidgetGroups": [],
-  "builtInPluginSettings": {},
+  "builtInPluginSettings": {
+    "dms_settings_search": {
+      "trigger": "?"
+    },
+    "dms_clipboard_search": {
+      "trigger": "cb"
+    }
+  },
+  "clipboardClickToPaste": false,
   "clipboardEnterToPaste": false,
+  "clipboardRememberTypeFilter": false,
+  "clipboardTypeFilter": "all",
+  "clipboardVisibleEntryActions": [
+    "pin",
+    "edit",
+    "delete"
+  ],
   "launcherPluginVisibility": {
     "obsidianSearch": {
       "allowWithoutTrigger": false
@@ -1151,5 +1096,24 @@
     }
   },
   "launcherPluginOrder": [],
-  "configVersion": 5
+  "frameEnabled": false,
+  "frameThickness": 100,
+  "frameRounding": 100,
+  "frameColor": "surface",
+  "frameOpacity": 0.69,
+  "frameScreenPreferences": [
+    "all"
+  ],
+  "frameBarSize": 100,
+  "frameShowOnOverview": false,
+  "frameBlurEnabled": true,
+  "frameCloseGaps": false,
+  "frameLauncherEmergeSide": "bottom",
+  "frameLauncherArcExtender": true,
+  "frameLauncherEdgeHover": true,
+  "frameMode": "connected",
+  "barInsetPaddingShared": -1,
+  "barInsetPaddingSyncAll": false,
+  "frameBarInsetPadding": 26,
+  "configVersion": 12
 }

modules/hosts/14900k/_private/media-disk.nix

@@ -1,9 +1,5 @@
 # Extra local disks. Declared here, not in hardware.nix (hardware.nix is generated).
 { config, lib, ... }:
-let
-  # Stable UID so NTFS `uid=` matches `users.users.olivier` (override if your account is not 1000).
-  olivierUid = config.users.users.olivier.uid or 1000;
-in
 {
   users.users.olivier.uid = lib.mkDefault 1000;
   # LABEL="MediaLibrary" (btrfs on sda1 by UUID). No subvol=@ — this disk has no @ subvolume.
@@ -33,15 +29,4 @@ in
   # LABEL="Deep Storage Unit". Owner olivier, group nfsmedia (990) so:
   # - local logins write as user 1000 (owner rwx);
   # - NFS (all_squash → uid/gid 990) matches group 990 → rwx (see jellyfin-nfs-export).
-  #fileSystems."/mnt/test" = {
-  #  device = "/dev/disk/by-uuid/BC12E55E12E51DE0";
-  #  fsType = "ntfs-3g";
-  #  options = [
-  #    "rw"
-  #    "force"
-  #    "uid=${toString olivierUid}"
-  #    "gid=990"
-  #    "umask=0002"
-  #  ];
-  #};
 }

modules/hosts/14900k/_private/mediatek-mt7927.nix

@@ -0,0 +1,107 @@
+{ pkgs, inputs, ... }:
+# All MediaTek MT7927 / MT6639 (Filogic 380) WiFi 7 + Bluetooth support for this
+# host in one place: the upstream flake module, the hardware enablement, and the
+# workarounds needed to actually make it function on nixos-unstable.
+#
+# Workaround background: on current nixos-unstable, `boot.extraModulePackages`
+# modules placed in `extra/` are NOT indexed by `depmod` (modules.dep /
+# modules.alias contain zero `extra/` entries). As a result `modprobe`/udev
+# resolve mt7925e / btusb to the stock in-tree drivers, which do not support the
+# MediaTek MT7927 (14c3:7927). We therefore force the patched out-of-tree modules
+# to load by explicit path, blacklist the in-tree collisions so udev cannot bind
+# them first, and fix the BT firmware path the driver expects.
+let
+  # The upstream mt7927 flake installs the BT firmware under
+  # `mediatek/mt6639/`, but the patched btmtk driver requests it from
+  # `mediatek/mt7927/`. Provide it at the expected path.
+  mt7927BtFirmwareFix = pkgs.runCommand "mt7927-bt-firmware-fix" { } ''
+    src="${inputs.mt7927.packages.${pkgs.system}.firmware}/lib/firmware/mediatek/mt6639/BT_RAM_CODE_MT6639_2_1_hdr.bin"
+    install -Dm644 "$src" \
+      "$out/lib/firmware/mediatek/mt7927/BT_RAM_CODE_MT6639_2_1_hdr.bin"
+  '';
+in
+{
+  imports = [
+    inputs.mt7927.nixosModules.default
+  ];
+
+  hardware.mediatek-mt7927 = {
+    enable = true;
+    enableWifi = true;
+    enableBluetooth = true;
+    disableAspm = true; # Highly recommended to fix upload speeds
+  };
+
+  hardware.firmware = [ mt7927BtFirmwareFix ];
+
+  boot.blacklistedKernelModules = [
+    # Whole mt76 stack (patched extra/ copy replaces it entirely).
+    "mt76"
+    "mt76_connac_lib"
+    "mt792x_lib"
+    "mt7921_common"
+    "mt7921e"
+    "mt7925_common"
+    "mt7925e"
+    # Patched bluetooth.
+    "btusb"
+    "btmtk"
+  ];
+
+  systemd.services.mt7927-force = {
+    description = "Force-load patched MediaTek MT7927 (Filogic 380) kernel modules";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "network.target" "NetworkManager.service" ];
+    path = [ pkgs.kmod ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      KVER="$(uname -r)"
+      EXTRA="/run/booted-system/kernel-modules/lib/modules/$KVER/extra"
+
+      # Load in-tree core dependencies (these ARE indexed, so modprobe works).
+      modprobe mac80211 cfg80211 rfkill led-class bluetooth || true
+
+      # Defensive: drop any in-tree mt76 modules that may have been pulled in
+      # (e.g. via boot.kernelModules) so the patched copies can bind instead.
+      rmmod mt7925e mt7921e mt7925_common mt7921_common mt792x_lib mt76_connac_lib mt76 2>/dev/null || true
+
+      insmod_x() {
+        local mod="$1"
+        local name
+        name="''${mod##*/}"; name="''${name%.ko}"
+        if lsmod | grep -q "^$name "; then
+          echo "mt7927-force: $name already loaded, skipping"
+        else
+          echo "mt7927-force: insmod $mod"
+          insmod "$mod" || echo "mt7927-force: FAILED to insmod $mod"
+        fi
+      }
+
+      # Patched mt76 stack (full replacement, dependency order).
+      insmod_x "$EXTRA/mt76/mt76.ko"
+      insmod_x "$EXTRA/mt76/mt76-connac-lib.ko"
+      insmod_x "$EXTRA/mt76/mt792x-lib.ko"
+      insmod_x "$EXTRA/mt76/mt7921/mt7921-common.ko"
+      insmod_x "$EXTRA/mt76/mt7925/mt7925-common.ko"
+      insmod_x "$EXTRA/mt76/mt7921/mt7921e.ko"
+      insmod_x "$EXTRA/mt76/mt7925/mt7925e.ko"
+
+      # Patched bluetooth. The patched btmtk/btusb need symbols from the
+      # in-tree bluetooth core (bluetooth.ko) and the btrtl/btintel/btbcm
+      # helpers, so load those first (they are indexed and modprobe-able).
+      for m in bluetooth btrtl btintel btbcm rfkill ecdh_generic ecc crc16; do
+        if modprobe "$m" 2>/dev/null; then
+          echo "mt7927-force: modprobe $m ok"
+        else
+          echo "mt7927-force: modprobe $m FAILED (continuing)"
+        fi
+      done
+
+      insmod_x "$EXTRA/bluetooth/btmtk.ko"
+      insmod_x "$EXTRA/bluetooth/btusb.ko"
+    '';
+  };
+}

modules/hosts/14900k/_private/streaming-display.nix

@@ -1,14 +1,12 @@
 # Headless 4K virtual output for Sunshine → Moonlight on a client TV.
 #
-# NVIDIA proprietary driver: both kernel params are required —
+# NVIDIA: force-enable a spare DRM connector with a custom EDID via kernel params:
 #   video=<connector>:e              force-enables the connector
 #   drm.edid_firmware=<connector>:…  loads modes from the EDID blob
 #
-# Pick a connector that is disconnected on the host (check after boot):
+# Capture is pinned to the connector by name (Sunshine `output_name`), which is
-#   grep -H . /sys/class/drm/card*-*/status
+# stable across reboots/hotplug — unlike a numeric monitor index.
-#
+# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070.
-# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070;
-# 4K@120 on a sink-less connector needs driver patches (see NVIDIA issue #1184).
 { config, lib, pkgs, ... }:
 let
   cfg = config.chiasson.system.streamingDisplay;
@@ -16,14 +14,13 @@ let
   edidFirmware = pkgs.runCommand "sunshine-virtual-4k-edid" {
     nativeBuildInputs = [ pkgs.python3 ];
   } ''
-    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $TMPDIR/${cfg.edidFileName}
     mkdir -p $out/lib/firmware/edid
-    cp $TMPDIR/${cfg.edidFileName} $out/lib/firmware/edid/${cfg.edidFileName}
+    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $out/lib/firmware/edid/${cfg.edidFileName}
   '';
 
-  # Sunshine 2025.924 wlr capture only accepts a numeric monitor index (not "DP-2").
+  # On stream start: scale + focus the virtual 4K output so streamed windows
-  # If the index drifts after hotplug, check:
+  # land there. Capture is pinned to the connector via Sunshine `output_name`,
-  #   journalctl --user -u sunshine -b | rg 'Monitor [0-9]+ is'
+  # so no fragile numeric-index detection is needed.
   streamDisplayUp = pkgs.writeShellScriptBin "stream-display-up" ''
     ${pkgs.niri}/bin/niri msg output ${cfg.connector} scale ${toString cfg.niriScale}
     ${pkgs.niri}/bin/niri msg action focus-monitor ${cfg.connector}
@@ -87,18 +84,6 @@ in
       default = "DP-3";
       description = "Niri monitor to refocus when a Moonlight session ends.";
     };
-
-    sunshineOutputIndex = lib.mkOption {
-      type = lib.types.str;
-      default = "3";
-      example = "3";
-      description = ''
-        Wayland/wlr monitor index for Sunshine `output_name`. Sunshine 2025.924 ignores
-        connector strings like `DP-2` and falls back to monitor 0 (your primary).
-        Find the index with:
-        `journalctl --user -u sunshine -b | rg "Monitor [0-9]+ is ${cfg.connector}"`
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
@@ -118,7 +103,11 @@ in
     (lib.mkIf config.chiasson.system.gaming.sunshine.enable {
       services.sunshine.settings = {
         capture = "wlr";
-        output_name = cfg.sunshineOutputIndex;
+        # Pin capture to the virtual display by connector name (stable across
+        # reboots/hotplug). A numeric index drifted to the ultrawide before.
+        output_name = cfg.connector;
+        # RTX 2070 has no AV1 NVENC; avoid probing av1_nvenc.
+        encoder = "hevc_nvenc,h264_nvenc";
         global_prep_cmd = "[{\"do\":\"${streamDisplayUp}/bin/stream-display-up\",\"undo\":\"${streamDisplayDown}/bin/stream-display-down\"}]";
       };
     })

modules/hosts/14900k/configuration.nix

@@ -23,6 +23,7 @@
         ./_private/streaming-display.nix
         ./_private/ai.nix
         ./_private/media-disk.nix
+        ./_private/mediatek-mt7927.nix
         ./_private/jellyfin-nfs-export.nix
         ./_private/moonfin-flatpak.nix
       ];
@@ -44,7 +45,6 @@
           libvdpau-va-gl
         ];
       };
-
       environment.sessionVariables = {
         LIBVA_DRIVER_NAME = "iHD";
         # Force VA-API to use the Intel iGPU render node (otherwise libva may pick NVIDIA and iHD fails).
@@ -100,7 +100,9 @@
           yt-dlp
 
           # Native install (avoid flatpak sandbox issues for QSV/VAAPI).
-          handbrake
+          # handbrake  # TEMP removed 2026-07-13 — depends on broken ffmpeg-full-8.1.2
+          #            # (A01-mov-read patch fails against 8.1.2 source). Re-enable
+          #            # when nixpkgs regenerates the patch or when switching to stable.
 
           qbittorrent
 

modules/hosts/14900k/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "14900k";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules."14900kConfiguration"

modules/hosts/14900k/home.nix

@@ -23,6 +23,13 @@
               pokeclicker.enable = true;
             };
 
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];

modules/hosts/desktop-home-base.nix

@@ -17,10 +17,6 @@
         userCli.enable = true;
       };
 
-      chiasson.users.extraModules.olivier =
+      chiasson.users.extraModules.olivier = self.lib.wisdomCatalogExtraModules self;
-        self.lib.wisdomCatalogExtraModules self
-        ++ [
-          self.homeManagerModules.desktopHomeDefaults
-        ];
     };
 }

modules/hosts/desktop-home-defaults.nix

@@ -1,77 +0,0 @@
-# Shared HM defaults for desktop hosts (git identity, wisdom catalog toggles).
-{ ... }: {
-  flake.homeManagerModules.desktopHomeDefaults =
-    { lib, pkgs, ... }:
-    let
-      aarch64 = pkgs.stdenv.hostPlatform.isAarch64;
-    in
-    {
-      programs.git = {
-        enable = lib.mkDefault true;
-        settings.user = {
-          name = "OlivierChiasson";
-          email = "olivierchiasson@hotmail.fr";
-        };
-      };
-
-      #TODO[epic=Moderate] Check if git-crypt should belong in desktop-home-base.
-      home.packages = [ pkgs.git-crypt pkgs.feishin ];
-
-      chiasson.home = {
-        shell = {
-          fish.enable = lib.mkDefault true;
-          ohMyPosh.enable = lib.mkDefault true;
-          yazi.enable = lib.mkDefault true;
-        };
-
-        terminals.kitty.enable = lib.mkDefault true;
-
-        filebrowsers.nemo.enable = lib.mkDefault true;
-
-        browsers = {
-          chrome.enable = lib.mkDefault false;
-          chromiumHevc = {
-            enable = lib.mkDefault true;
-            packages = lib.mkDefault (
-              if aarch64 then
-                [ "chromium" ]
-              else
-                [ "google-chrome" ]
-            );
-          } // lib.optionalAttrs (!aarch64) {
-            vaapi.gpu = lib.mkDefault "intel";
-          };
-          edge.enable = lib.mkDefault false;
-          flow.enable = lib.mkDefault false;
-          orion.enable = lib.mkDefault false;
-          zen.enable = lib.mkDefault false;
-        };
-
-        editors = {
-          cursor.enable = lib.mkDefault true;
-          kate.enable = lib.mkDefault false;
-          obsidian.enable = lib.mkDefault true;
-        };
-
-        apps = {
-          discord.enable = lib.mkDefault false;
-          localsend.enable = lib.mkDefault true;
-          pokeclicker.enable = lib.mkDefault false;
-          spotify = {
-            enable = lib.mkDefault false;
-            openDiscoveryFirewall = lib.mkDefault false;
-          };
-        };
-
-        desktop = {
-          screenshot = {
-            enable = lib.mkDefault true;
-            swiftshareApiKeyFile = "/run/secrets/swiftshare/API_KEY"; #TODO[epic=sops] redo this by passing sops file output directly
-          };
-          theming.enable = lib.mkDefault true;
-        };
-
-        hardware.uconsoleGamepad.enable = lib.mkDefault false;
-      };
-    };
-}

modules/hosts/ideapad/configuration.nix

@@ -42,12 +42,7 @@
       # rebuilds Mobile NixOS' script-loader against the patched mruby.
       chiasson.system.ideapadMrubyOverlay.enable = true;
 
-      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs.
+      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs
-      nixpkgs.config.allowUnfreePredicate =
-        pkg: builtins.elem (lib.getName pkg) [
-          "chromeos-sc7180-unredistributable-firmware"
-          "chromeos-sc7180-unredistributable-firmware-zstd"
-        ];
       hardware.firmware = [ pkgs.chromeos-sc7180-unredistributable-firmware ];
       hardware.enableRedistributableFirmware = true;
 

modules/hosts/ideapad/default.nix

@@ -4,8 +4,6 @@
     system = "aarch64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "ideapad";
-      system = "aarch64-linux";
     };
     modules = [
       self.nixosModules.ideapadConfiguration

modules/hosts/ideapad/home.nix

@@ -4,18 +4,5 @@
     { self, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
-
-      # Host-only HM overrides (tablet apps, toggles off from desktop-home-base, …).
-      chiasson.users.extraModules.olivier = [
-        # {
-        #   chiasson.home = {
-        #     # editors.kate.enable = true;
-        #   };
-        # }
-        # (
-        #   { pkgs, ... }:
-        #   { home.packages = with pkgs; [ ]; }
-        # )
-      ];
     };
 }

modules/hosts/nix-server/_services/nixdesk-nfs-client.nix

@@ -1,35 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for nix-server. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths (see also services/jellyfin.nix):
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-#
-# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
-# old client mount and let automount reattach, e.g.:
-#   sudo umount -l /mnt/nixdesk-jellyfin
-#   ls /mnt/nixdesk-jellyfin
-# (or reboot nix-server.)
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/nix-server/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "nix-server";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.nix-serverConfiguration

modules/hosts/r5500/_services/nixdesk-nfs-client.nix

@@ -1,28 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for r5500. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths:
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/r5500/configuration.nix

@@ -17,7 +17,7 @@
         ./_private/media-disk.nix
         ./_private/media-paths.nix
         ./_services/docker-media.nix
-        ./_services/nixdesk-nfs-client.nix
+        self.nixosModules.nixdeskJellyfin
         ./_services/jellyfin.nix
         ./_services/sonarr.nix
         ./_services/radarr.nix

modules/hosts/r5500/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "r5500";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.r5500Configuration

modules/hosts/t2mbp/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "t2mbp";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.t2mbpConfiguration

modules/hosts/t2mbp/home.nix

@@ -1,28 +1,29 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.t2mbpHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
       chiasson.users.extraModules.olivier = [
         {
           chiasson.home = {
-            browsers = {
+            browsers.edge.enable = true;
-              edge.enable = true;
-            };
 
             apps = {
               discord.enable = true;
               pokeclicker.enable = true;
             };
+
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];
-
-      programs.npm = {
-        enable = true;
-        globalPackages = ["freebuff"];
-      };
     };
 }

modules/hosts/uConsole/default.nix

@@ -4,8 +4,6 @@
     specialArgs = inputs // {
       inherit self;
       inputs = inputs;
-      host = "uConsole";
-      system = "aarch64-linux";
     };
     trustCaches = false;
     modules = [

modules/hosts/uConsole/home.nix

@@ -1,14 +1,20 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.uConsoleHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
       chiasson.users.extraModules.olivier = [
         {
-          chiasson.home = {
+          chiasson.home.hardware.uconsoleGamepad.enable = true;
-            hardware.uconsoleGamepad.enable = true;
+
+          chiasson.home.editors.vscode = {
+            enable = true;
+            extensions = with pkgs.vscode-extensions; [
+              alefragnani.project-manager
+              johnpapa.vscode-peacock
+            ];
           };
         }
       ];

modules/lib/navi-hive.nix

@@ -1,33 +0,0 @@
-# Build a raw Navi hive attrset from host specs + deployment targets.
-# Call `inputs.navi.lib.makeHive` on the result to produce `flake.naviHive`.
-{ lib, inputs, ... }: {
-  flake.lib.mkNaviHiveConfig =
-    {
-      metaNixpkgs,
-      hostSpecs,
-      deployments,
-    }:
-    let
-      deployNodes = lib.filterAttrs (name: _: deployments ? ${name}) hostSpecs;
-    in
-    {
-      meta = {
-        nixpkgs = metaNixpkgs;
-        nodeNixpkgs = lib.mapAttrs (
-          name: spec:
-          import inputs.nixpkgs {
-            system = spec.system;
-          }
-        ) deployNodes;
-        nodeSpecialArgs = lib.mapAttrs (_: spec: spec.specialArgs) deployNodes;
-        allowApplyAll = false;
-      };
-    }
-    //     lib.mapAttrs (
-      name: spec:
-      {
-        imports = spec.modules or [ spec.configuration ];
-        deployment = deployments.${name};
-      }
-    ) deployNodes;
-}

modules/lib/rbw-ssh-socket.nix

@@ -1,30 +0,0 @@
-{ ... }: {
-  flake.lib.rbwSshSocket =
-    let
-      bashSnippet = ''
-        if [ -z "''${SSH_AUTH_SOCK:-}" ]; then
-          if [ -n "''${XDG_RUNTIME_DIR:-}" ]; then
-            export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/rbw/ssh-agent-socket"
-          else
-            export SSH_AUTH_SOCK="/run/user/$(id -u)/rbw/ssh-agent-socket"
-          fi
-        fi
-      '';
-      fishSnippet =
-        pkgs: ''
-          if test -z "$SSH_AUTH_SOCK"
-            if test -n "$XDG_RUNTIME_DIR"
-              set -gx SSH_AUTH_SOCK "$XDG_RUNTIME_DIR/rbw/ssh-agent-socket"
-            else
-              set -l _hm_uid (${pkgs.coreutils}/bin/id -u)
-              set -gx SSH_AUTH_SOCK "/run/user/$_hm_uid/rbw/ssh-agent-socket"
-            end
-          end
-        '';
-    in
-    {
-      inherit bashSnippet fishSnippet;
-      sessionVariable = "$XDG_RUNTIME_DIR/rbw/ssh-agent-socket";
-      activationPath = "/run/user/$(id -u)/rbw/ssh-agent-socket";
-    };
-}

modules/lib/ssh-inventory.nix

@@ -1,131 +0,0 @@
-{ lib, ... }: {
-  flake.lib.sshInventory =
-    let
-      hosts = {
-        "14900k" = {
-          hostName = "192.168.2.25";
-          aliases = [ "14900k" "nixdesk" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILwUevBGnf+Y/sL1ZsB4bt0c50a89iqwPRoYUGP4UHsL 14900k";
-        };
-
-        ideapad = {
-          hostName = "192.168.2.229";
-          aliases = [ "ideapad" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQwaaI90xIMjZ46EcMyO8kBwGCxf7qVL75IYhw8Ssze ideapad";
-        };
-
-        t2mbp = {
-          hostName = "192.168.2.15";
-          aliases = [ "t2mbp" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhVWB9YXl/FuQvufle4VWUas/QM8qCKoRd5a83Tt3S6 t2mbp";
-        };
-
-        uConsole = {
-          hostName = "192.168.2.99";
-          aliases = [ "uConsole" "uconsole" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAVPR0lRAcywPR7iTchM3+eO7NCdXAR6NPzYXxalr+dP uConsole";
-        };
-
-        test = {
-          hostName = "test";
-          aliases = [ "test" ];
-          publicKey = null;
-        };
-
-        nix-server = {
-          hostName = "192.168.2.238";
-          aliases = [ "nix-server" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3KDicMjtOFR6LfZrFzfAD1gdYUdwv6ZM4PSgtmIuzd nix-server";
-        };
-
-        r5500 = {
-          hostName = "192.168.2.100";
-          aliases = [ "r5500" ];
-          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7iWCEtkYDLZFRF3w1gzyAok5VCAGUOwu4iWZdMjf3D r5500";
-        };
-      };
-
-      mkIdentityFileName = hostName: ".ssh/id_ed25519_${lib.strings.toLower hostName}.pub";
-      activeHosts = builtins.removeAttrs hosts (
-        builtins.filter (name: hosts.${name}.publicKey == null) (builtins.attrNames hosts)
-      );
-
-      mkIdentityFiles = selectedHosts:
-        builtins.listToAttrs (
-          builtins.map
-            (hostName: {
-              name = mkIdentityFileName hostName;
-              value.text = "${selectedHosts.${hostName}.publicKey}\n";
-            })
-            (builtins.attrNames selectedHosts)
-        );
-
-      # Gitea git-over-SSH listens on port 222. System SSH (nix deploy, server@…) uses port 22
-      # via the catalog `nix-server` Host block — never list nix-server or 192.168.2.238 here.
-      giteaSshBlock = identityAgent: ''
-        Host git.chiasson.cloud gitea
-          HostName 192.168.2.238
-          Port 222
-          User git
-          IdentityAgent ${identityAgent}
-          IdentitiesOnly no
-
-        Match host nix-server,192.168.2.238 user git
-          HostName 192.168.2.238
-          Port 222
-          User git
-          IdentityAgent ${identityAgent}
-          IdentitiesOnly no
-      '';
-
-      mkSshConfigTemplate =
-        {
-          selectedHosts ? activeHosts,
-          user ? null,
-          identityAgent ? "__RBW_SSH_SOCK__",
-        }:
-        let
-          hostBlocks = builtins.map
-            (hostName:
-              let
-                entry = selectedHosts.${hostName};
-                hostPatterns = builtins.concatStringsSep " " (entry.aliases ++ [ entry.hostName ]);
-                userLine = if user == null then "" else "  User ${user}\n";
-                portLine =
-                  if hostName == "nix-server" then
-                    "  Port 22\n"
-                  else
-                    "";
-              in
-              ''
-                Host ${hostPatterns}
-                  HostName ${entry.hostName}
-${userLine}${portLine}                  IdentityFile ~/${mkIdentityFileName hostName}
-                  IdentityAgent ${identityAgent}
-                  IdentitiesOnly yes
-              '')
-            (builtins.attrNames selectedHosts);
-        in
-        builtins.concatStringsSep "\n" (
-          [
-            (giteaSshBlock identityAgent)
-          ]
-          ++ hostBlocks
-          ++ [
-            ''
-              Host *
-                IdentitiesOnly yes
-                IdentityAgent none
-            ''
-          ]
-        );
-    in
-    {
-      inherit hosts activeHosts mkIdentityFiles mkSshConfigTemplate;
-      authorizedKeys = lib.unique (
-        builtins.map (entry: entry.publicKey) (builtins.attrValues activeHosts)
-      );
-      identityFiles = mkIdentityFiles activeHosts;
-      sshConfigTemplate = mkSshConfigTemplate { };
-    };
-}

modules/lib/users-merge.nix

@@ -1,99 +0,0 @@
-# Pure helpers: catalog → NixOS/HM/SSH shapes (`self.lib.usersMerge lib`).
-{ ... }: {
-  flake.lib.usersMerge =
-    lib:
-    let
-      userHm = user: user.homeManager or { };
-      userSsh = user: user.ssh or { };
-    in
-    rec {
-      resolveHomeManagerModule =
-        moduleSpec:
-        let
-          t = builtins.typeOf moduleSpec;
-        in
-        if t == "path" || t == "string" then import moduleSpec else moduleSpec;
-
-      selectedUsersAttr =
-        { catalog, enabled, hostOverrides }:
-        lib.listToAttrs (
-          map (name: {
-            inherit name;
-            value = lib.recursiveUpdate catalog.${name} (hostOverrides.${name} or { });
-          }) enabled
-        );
-
-      missingEnabledNames = catalog: enabled: builtins.filter (name: !(builtins.hasAttr name catalog)) enabled;
-
-      strayHomeUserKeys = homeUsers: enabled:
-        builtins.filter (k: !(builtins.elem k enabled)) (builtins.attrNames homeUsers);
-
-      mkNixosUser =
-        name: user:
-        {
-          isNormalUser = user.isNormalUser or true;
-          description = user.description or name;
-          extraGroups = user.extraGroups or [ ];
-        }
-        // lib.optionalAttrs (user ? hashedPasswordFile && user.hashedPasswordFile != null) {
-          hashedPasswordFile = user.hashedPasswordFile;
-        };
-
-      hmWiredNames =
-        selectedUsers:
-        lib.attrNames (
-          lib.filterAttrs (_: user:
-            let
-              hm = userHm user;
-            in
-            (hm.enable or false) && (hm.module or null) != null
-          ) selectedUsers
-        );
-
-      rbwOutboundSnippet =
-        name: user:
-        let
-          outboundCfg = ((userSsh user).outbound or { }).rbw or { };
-        in
-        lib.mkIf (outboundCfg.enable or false) {
-          chiasson.ssh.outbound.rbw.enable = true;
-          chiasson.ssh.outbound.rbw.user = name;
-          chiasson.ssh.outbound.rbw.hosts =
-            if (outboundCfg.hosts or "all") == "all" then [ "all" ] else outboundCfg.hosts;
-        };
-
-      mkHmUserModule =
-        { name, user, hostExtraModules }:
-        let
-          hm = userHm user;
-          hmModule = resolveHomeManagerModule hm.module;
-        in
-        lib.mkMerge (
-          [
-            hmModule
-            (rbwOutboundSnippet name user)
-          ]
-          ++ (hm.extraModules or [ ])
-          ++ hostExtraModules
-        );
-
-      inboundAuthorizedOrNull =
-        user:
-        let
-          inboundCfg = (userSsh user).inbound or { };
-        in
-        if !(inboundCfg.enable or false) then
-          null
-        else if (inboundCfg.authorizedHosts or "all") == "all" then
-          "all"
-        else
-          inboundCfg.authorizedHosts;
-
-      inboundHostsAttr =
-        selectedUsers:
-        lib.pipe selectedUsers [
-          (lib.mapAttrs (_: inboundAuthorizedOrNull))
-          (lib.filterAttrs (_: v: v != null))
-        ];
-    };
-}

modules/lib/wisdom-catalog.nix

@@ -1,17 +0,0 @@
-# Resolve `wisdom*` HM slices for NixOS `extraModules` (`self` is not an HM specialArg).
-# Slices are gated by `chiasson.home.*.enable`; hosts only flip toggles in `home.nix`.
-{ lib, ... }: {
-  flake.lib.wisdomCatalogExtraModules =
-    self:
-    let
-      names = lib.sort builtins.lessThan (
-        lib.filter (
-          n:
-          lib.hasPrefix "wisdom" n
-          && n != "wisdom"
-          && n != "wisdomShellBash"
-        ) (builtins.attrNames self.homeManagerModules)
-      );
-    in
-    map (name: self.homeManagerModules.${name}) names;
-}

modules/ssh/home-manager/default.nix

@@ -1,96 +1,154 @@
 { self, ... }: {
-  flake.homeManagerModules.sshOutboundRbw = {
+  flake.homeManagerModules.sshOutboundRbw =
-    config,
+    { config, lib, pkgs, ... }:
-    lib,
+    let
-    pkgs,
+      cfg = config.chiasson.ssh.outbound.rbw;
-    ...
+      inventory = self.lib.sshInventory;
-  }:
+      # Resolve which hosts to emit blocks for, and which user identity to
-  let
+      # use as the IdentityFile filter against the rbw agent.
-    cfg = config.chiasson.ssh.outbound.rbw;
+      selectedHostNames =
-    inventory = self.lib.sshInventory;
+        if cfg.hosts == [ "all" ] then builtins.attrNames inventory.activeHosts else cfg.hosts;
-    selectedHostNames =
+      missingHosts = builtins.filter (name: !(builtins.hasAttr name inventory.hosts)) selectedHostNames;
-      if cfg.hosts == [ "all" ] then
+      # Resolve to the actual host attrs for the template. The "all" case
-        builtins.attrNames inventory.activeHosts
+      # reuses `activeHosts` directly instead of rebuilding the same attrset.
-      else
+      selectedHosts =
-        cfg.hosts;
+        if cfg.hosts == [ "all" ] then
-    missing = builtins.filter (name: !(builtins.hasAttr name inventory.hosts)) selectedHostNames;
+          inventory.activeHosts
-    selectedHosts = builtins.listToAttrs (
+        else
-      builtins.map (name: {
+          builtins.listToAttrs (
-        inherit name;
+            map (n: {
-        value = inventory.hosts.${name};
+              name = n;
-      }) selectedHostNames
+              value = inventory.hosts.${n};
-    );
+            }) selectedHostNames
-    sshConfigTemplate = inventory.mkSshConfigTemplate {
+          );
-      selectedHosts = selectedHosts;
+      # All identities this HM user may authenticate AS: cfg.user ∪
-      user = cfg.user;
+      # extraIdentities. `cfg.user` can be null (e.g. user not in inventory
-    };
+      # yet) — in that case the Host-block IdentityFile line is suppressed
-  in
+      # and cross-account SSH is wired from extraIdentities alone.
-  {
+      effectiveIdentities = lib.filter (n: n != null) ([ cfg.user ] ++ cfg.extraIdentities);
-    options.chiasson.ssh.outbound.rbw = {
+      defaultUserHasKey = cfg.user == null || (inventory.users.${cfg.user}.publicKey or "") != "";
-      enable = lib.mkEnableOption "Generated `~/.ssh/config` + rbw agent socket.";
+      # Each extra identity must have a pubkey in the inventory. Dropping
-      user = lib.mkOption {
+      # it silently would produce a dead Match block — fail the build.
-        type = lib.types.str;
+      missingExtraKeys = lib.filter (n: (inventory.users.${n}.publicKey or "") == "") cfg.extraIdentities;
-        default = config.home.username;
+    in
-        description = "`User` in generated `Host` blocks.";
+    {
-      };
+      options.chiasson.ssh.outbound.rbw = {
-      hosts = lib.mkOption {
+        enable = lib.mkEnableOption "Generated `~/.ssh/config` + rbw agent socket.";
-        type = lib.types.listOf lib.types.str;
+        user = lib.mkOption {
-        default = [ "all" ];
+          type = lib.types.nullOr lib.types.str;
-        description = "Inventory hosts to emit (or `[ \"all\" ]`).";
+          default = config.home.username;
-      };
+          description = ''
-      manageSshConfig = lib.mkOption {
+            Inventory user whose public key is written to `~/.ssh/id_ed25519_<user>.pub`
-        type = lib.types.bool;
+            and used as `IdentityFile` to filter the rbw agent. Set `null`
-        default = true;
+            to disable the per-user .pub file / IdentityFile line (e.g.
-        description = "Write `~/.ssh/config` from the template.";
+            when the user isn't in the inventory yet).
-      };
+          '';
-    };
-
-    config = lib.mkIf cfg.enable (lib.mkMerge [
-      {
-        assertions = [
-          {
-            assertion = missing == [ ];
-            message = "ssh.outbound.rbw: unknown host keys: ${builtins.concatStringsSep ", " missing}";
-          }
-        ];
-      }
-      {
-        home.packages = with pkgs; [ rbw pinentry-gtk2 ];
-        home.sessionVariables.SSH_AUTH_SOCK = self.lib.rbwSshSocket.sessionVariable;
-        home.file = inventory.mkIdentityFiles selectedHosts;
-
-        programs.ssh.enable = lib.mkIf cfg.manageSshConfig false;
-        home.activation.rbwSshConfig = lib.mkIf cfg.manageSshConfig (lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-          mkdir -p "$HOME/.ssh"
-          chmod 700 "$HOME/.ssh"
-          RBW_SSH_SOCK="${self.lib.rbwSshSocket.activationPath}"
-          cat > "$HOME/.ssh/config" <<'EOF'
-${sshConfigTemplate}
-EOF
-          sed -i "s|__RBW_SSH_SOCK__|$RBW_SSH_SOCK|g" "$HOME/.ssh/config"
-          chmod 600 "$HOME/.ssh/config"
-        '');
-
-        systemd.user.services.rbw-agent-bootstrap = {
-          Unit = {
-            Description = "Bootstrap rbw SSH agent";
-            PartOf = [ "graphical-session.target" ];
-            After = [ "graphical-session.target" ];
-          };
-          Service = {
-            Type = "oneshot";
-            ExecStart = "${pkgs.bash}/bin/bash -lc '${pkgs.rbw}/bin/rbw unlocked >/dev/null 2>&1 || true'";
-            RemainAfterExit = true;
-          };
-          Install = {
-            WantedBy = [ "graphical-session.target" ];
-          };
         };
+        hosts = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "all" ];
+          description = "Inventory hosts to emit (or `[ \"all\" ]`).";
+        };
+        manageSshConfig = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Write `~/.ssh/config` (disable for manual management).";
+        };
+        # Cross-account SSH on the operator's laptop/desktop. Each entry
+        # adds a `~/.ssh/id_ed25519_<account>.pub` filter file and a
+        # `Match user <account>` block in `~/.ssh/config` so
+        # `ssh <account>@<host>` picks the right key from the rbw agent.
+        # `cfg.user` is already wired by the Host blocks — don't list it here.
+        extraIdentities = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          example = [
+            "server"
+            "builder"
+          ];
+          description = ''
+            Catalog accounts this HM user may authenticate AS, in addition
+            to `cfg.user`. Each entry must have a publicKey pasted into
+            `modules/ssh/inventory.nix`. Typical for the operator's
+            primary laptop: `[ "server" "builder" ]` so fleet/ops commands
+            like `ssh server@r5500` or `ssh builder@nix-server` work
+            without touching `/etc/passwd` on each host.
+          '';
+        };
+      };
 
-        home.activation.rbwPinentryConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+      config = lib.mkIf cfg.enable (
-          ${pkgs.rbw}/bin/rbw config set pinentry "${pkgs.pinentry-gtk2}/bin/pinentry-gtk-2" >/dev/null 2>&1 || true
+        lib.mkMerge [
-        '';
+          {
-      }
+            assertions = [
-    ]);
+              {
-  };
+                assertion = missingHosts == [ ];
+                message = "ssh.outbound.rbw: unknown host keys: ${builtins.concatStringsSep ", " missingHosts}";
+              }
+              {
+                assertion = defaultUserHasKey;
+                message = "ssh.outbound.rbw: no publicKey for inventory user `${cfg.user}` in `modules/ssh/inventory.nix`.";
+              }
+              {
+                assertion = missingExtraKeys == [ ];
+                message = "ssh.outbound.rbw: extraIdentities has entries with no publicKey in `modules/ssh/inventory.nix`: ${builtins.concatStringsSep ", " missingExtraKeys}";
+              }
+              # `enable=true` with neither a default user nor any extras gives the
+              # agent no IdentityFile at all; with IdentitiesOnly yes the user
+              # would silently be unable to authenticate as any catalog user.
+              {
+                assertion = effectiveIdentities != [ ];
+                message = "ssh.outbound.rbw: enabled but no identities wired. Set `chiasson.ssh.outbound.rbw.user` (defaults to `home.username`) or list catalog accounts under `extraIdentities`.";
+              }
+            ];
+          }
+          (lib.mkMerge [
+            {
+              home.packages = with pkgs; [
+                rbw
+                pinentry-gtk2
+              ];
+              home.sessionVariables.SSH_AUTH_SOCK = self.lib.rbwSshSocket.sessionVariable;
+              # Write a `.pub` file per identity this HM user may act as
+              # (cfg.user ∪ extraIdentities). OpenSSH reads each one via
+              # IdentityFile/Match to filter agent keys — they never hold
+              # private key material, so 0644 (HM's default) is fine.
+              # OpenSSH's StrictModes only rejects group/other-writable files.
+              home.file = lib.listToAttrs (
+                map (n: {
+                  name = inventory.mkIdentityFileName n;
+                  value.text = "${inventory.users.${n}.publicKey}\n";
+                }) effectiveIdentities
+              );
+              programs.ssh.enable = lib.mkIf cfg.manageSshConfig false;
+            }
+            (lib.mkIf cfg.manageSshConfig {
+              home.file.".ssh/config".text = inventory.mkSshConfigTemplate {
+                inherit selectedHosts;
+                user = cfg.user;
+                inherit (cfg) extraIdentities;
+              };
+            })
+            {
+              systemd.user.services.rbw-agent-bootstrap = {
+                Unit = {
+                  Description = "Bootstrap rbw SSH agent";
+                  PartOf = [ "graphical-session.target" ];
+                  After = [ "graphical-session.target" ];
+                };
+                Service = {
+                  Type = "oneshot";
+                  ExecStart = "${pkgs.bash}/bin/bash -lc '${pkgs.rbw}/bin/rbw unlocked >/dev/null 2>&1 || true'";
+                  RemainAfterExit = true;
+                };
+                Install.WantedBy = [ "graphical-session.target" ];
+              };
+              home.activation.rbwPinentryConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+                ${pkgs.rbw}/bin/rbw config set pinentry "${pkgs.pinentry-gtk2}/bin/pinentry-gtk-2" >/dev/null 2>&1 || true
+              '';
+            }
+          ])
+        ]
+      );
+    };
 }

modules/ssh/inventory.nix

@@ -0,0 +1,159 @@
+{ lib, ... }: {
+  flake.lib.sshInventory =
+    let
+      # Hosts: pure network endpoints. No public keys live here anymore —
+      # keys are per USER (see `users` below), one key per person.
+      hosts = {
+        "14900k" = {
+          hostName = "192.168.2.25";
+          aliases = [ "14900k" "nixdesk" ];
+        };
+        ideapad = {
+          hostName = "192.168.2.229";
+          aliases = [ "ideapad" ];
+        };
+        t2mbp = {
+          hostName = "192.168.2.15";
+          aliases = [ "t2mbp" ];
+        };
+        "uConsole" = {
+          hostName = "192.168.2.99";
+          aliases = [ "uConsole" "uconsole" ];
+        };
+        # Scratchpad / recovery target — hostName isn't an IP, so `activeHosts`
+        # excludes it from navi deployments. Leave it in `hosts` for inventory
+        # visibility while recovery is in progress.
+        test = {
+          hostName = "test";
+          aliases = [ "test" ];
+        };
+        "nix-server" = {
+          hostName = "192.168.2.238";
+          aliases = [ "nix-server" ];
+        };
+        r5500 = {
+          hostName = "192.168.2.100";
+          aliases = [ "r5500" ];
+        };
+      };
+
+      # Per-user public keys. One keypair per person, generated once with
+      # `ssh-keygen -t ed25519 -C <comment>` (or `rbw gen ssh-key <user>`),
+      # private key stored in Bitwarden under the same name. Paste the
+      # `ssh-ed25519 AAAA… <comment>` line here.
+      users = {
+        olivier = {
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpORzDw8kEOobjywl7bQaEp6Tez1c/ZP+7VBDsTcM8I olivier";
+        };
+        server = {
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICsksvNGOt/ebJtpRi9ocLBjwyl16VSaf+BsL2Hz5PRy server";
+        };
+        builder = {
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIILBtfW1cq9mG6uAjAfpZuVa1EWDSTPSCThapDXXlLgV builder";
+        };
+      };
+
+      # Hosts SSH is actually safe to deploy/scan to: anything whose hostName
+      # parses as an IPv4 dotted-quad. Filters out scratchpad/non-routable
+      # entries (e.g. `hostName = "test"`).
+      activeHosts = lib.filterAttrs
+        (_: h: lib.match "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$" h.hostName != null)
+        hosts;
+
+      # .pub filename convention. OpenSSH 7.3+ accepts a `.pub` file as
+      # IdentityFile to filter `IdentityAgent` (rbw) keys without storing the
+      # private key on disk — keep this trick.
+      mkIdentityFileName = userName: ".ssh/id_ed25519_${lib.strings.toLower userName}.pub";
+
+      mkSshConfigTemplate =
+        {
+          selectedHosts ? activeHosts,
+          user ? null,
+          # Catalog accounts the operator may authenticate AS via
+          # `ssh <account>@<host>`. Each entry gets a `Match user <account>`
+          # block that overrides IdentityFile so OpenSSH asks the rbw agent
+          # for that account's private key. `cfg.user` is already covered
+          # by the Host blocks, so don't list it here.
+          extraIdentities ? [ ],
+          identityAgent ? "SSH_AUTH_SOCK",
+        }:
+        let
+          # Shared `IdentityFile` filter line (when `user` is set). Used by
+          # both the per-host and gitea blocks so the two can't drift apart.
+          idLine = lib.optionalString (user != null) "  IdentityFile ~/${mkIdentityFileName user}\n";
+
+          # Match blocks for cross-account SSH. Filter out cfg.user since
+          # the matching pub is already loaded via the Host block's
+          # IdentityFile line — re-emitting it would just duplicate.
+          matchBlocks = lib.concatStringsSep "\n" (map
+            (n: ''
+              Match user ${n}
+                IdentityFile ~/${mkIdentityFileName n}
+                IdentitiesOnly yes
+            '')
+            (builtins.filter (n: n != user) extraIdentities));
+
+          # Per-host block. `IdentityFile` (when `user` is set) is a .pub file
+          # pointing at the agent's matching private key. With IdentitiesOnly
+          # yes, only agent keys matching that pub are tried — fixes the old
+          # "too many auth failures" symptom by design.
+          hostBlock = hostName:
+            let
+              e = selectedHosts.${hostName};
+              hostPatterns = lib.concatStringsSep " " (e.aliases ++ [ e.hostName ]);
+            in ''
+              Host ${hostPatterns}
+                HostName ${e.hostName}
+              ${idLine}  IdentityAgent ${identityAgent}
+                IdentitiesOnly yes
+            '';
+
+          # Gitea block: always emitted. `User git`, port 222. olivier's
+          # public key (passed via `IdentityFile`) is what gitea accepts
+          # because it gets pushed into gitea's authorized_keys through
+          # gitea's own UI for that account.
+          giteaBlock = ''
+            Host git.chiasson.cloud gitea
+              HostName 192.168.2.238
+              Port 222
+              User git
+            ${idLine}  IdentityAgent ${identityAgent}
+              IdentitiesOnly yes
+          '';
+
+          hostBlocks = lib.concatStringsSep "\n" (map hostBlock (lib.attrNames selectedHosts));
+        in
+        # Filter empty sections so an absent Match block (no extraIdentities)
+        # doesn't add leading whitespace to the rendered config.
+        lib.concatStringsSep "\n" (lib.filter (s: s != "") [
+          matchBlocks
+          giteaBlock
+          hostBlocks
+          ''
+            Host *
+              IdentitiesOnly yes
+              IdentityAgent none
+          ''
+        ]);
+
+      # Per-user line for `users.users.<u>.openssh.authorizedKeys.keys`.
+      # `selection` is either "all" or a list of source identifiers for
+      # sshd's `from=` constraint (IP, CIDR, or hostname if reverse-DNS works).
+      # Returns null if inventory is missing the user's pubkey — caller is
+      # expected to assert and fail the build rather than silently lock out.
+      mkAuthorizedKeyLine = userName: selection:
+        let
+          entry = users.${userName} or null;
+        in
+        if entry == null then null
+        else if (entry.publicKey or "") == "" then null
+        else if selection == "all" then entry.publicKey
+        else ''from="${lib.concatStringsSep "," selection}" ${entry.publicKey}'';
+    in
+    {
+      inherit hosts users activeHosts;
+      mkSshConfigTemplate = mkSshConfigTemplate;
+      mkAuthorizedKeyLine = mkAuthorizedKeyLine;
+      mkIdentityFileName = mkIdentityFileName;
+    };
+}

modules/ssh/nixos/default.nix

@@ -1,35 +1,51 @@
 { self, ... }: {
-  flake.nixosModules.sshInbound = {
+  flake.nixosModules.sshInbound =
-    config,
+    { config, lib, ... }:
-    lib,
+    let
-    ...
+      cfg = config.chiasson.ssh.inbound;
-  }:
+      inventory = self.lib.sshInventory;
-  let
+      # Every inbound-enabled user must have a publicKey pasted into the
-    cfg = config.chiasson.ssh.inbound;
+      # inventory — silently dropping the key would lock the user out.
-    inventory = self.lib.sshInventory;
+      missingKeys = lib.filter
-  in
+        (name:
-  {
+          let line = inventory.mkAuthorizedKeyLine name (cfg.userAuthorizedHosts.${name} or "all");
-    options.chiasson.ssh.inbound = {
+          in line == null)
-      enable = lib.mkEnableOption "Apply SSH inventory public keys to `authorized_keys`.";
+        (lib.attrNames cfg.userAuthorizedHosts);
-      userAuthorizedHosts = lib.mkOption {
+    in
-        type = lib.types.attrsOf (lib.types.either (lib.types.enum [ "all" ]) (lib.types.listOf lib.types.str));
+    {
-        default = { };
+      options.chiasson.ssh.inbound = {
-        example = {
+        enable = lib.mkEnableOption "Write user-specific SSH inventory public keys into `authorized_keys`.";
-          olivier = "all";
+        userAuthorizedHosts = lib.mkOption {
-          admin = [ "14900k" "t2mbp" ];
+          type = lib.types.attrsOf (lib.types.either (lib.types.enum [ "all" ]) (lib.types.listOf lib.types.str));
+          default = { };
+          example = {
+            olivier = "all";
+            server = [ "192.168.2.25" "192.168.2.15" ];
+          };
+          description = ''
+            Catalog users whose inventory public key is installed in
+            `authorized_keys`. The value is either `"all"` (no `from=`
+            restriction) or a list of source identifiers appended to
+            sshd's `from=` constraint. List entries should be IPs or CIDRs;
+            hostnames require reverse-DNS to resolve cleanly on the target.
+          '';
         };
-        description = ''
-          Catalog users that receive the SSH inventory public keys in `authorized_keys`.
-        '';
       };
-    };
 
-    config = lib.mkIf cfg.enable {
+      config = lib.mkMerge [
-      users.users = lib.mapAttrs
+        {
-        (_user: _selection: {
+          assertions = [{
-          openssh.authorizedKeys.keys = inventory.authorizedKeys;
+            assertion = cfg.enable -> missingKeys == [ ];
+            message = "chiasson.ssh.inbound: users enabled but missing public key in `modules/ssh/inventory.nix`: ${lib.concatStringsSep ", " missingKeys}";
+          }];
+        }
+        (lib.mkIf cfg.enable {
+          users.users = lib.mapAttrs
+            (name: selection: {
+              openssh.authorizedKeys.keys = [ (inventory.mkAuthorizedKeyLine name selection) ];
+            })
+            cfg.userAuthorizedHosts;
         })
-        cfg.userAuthorizedHosts;
+      ];
     };
-  };
 }

modules/ssh/rbw.nix

@@ -0,0 +1,39 @@
+# rbw (Bitwarden) SSH-agent socket wiring, shared across shells and the
+# outbound-rbw Home Manager module. Exposed as `flake.lib.rbwSshSocket`.
+{ ... }: {
+  flake.lib.rbwSshSocket =
+    let
+      socketPath = "$XDG_RUNTIME_DIR/rbw/ssh-agent-socket";
+
+      # Bash init snippet — used by wisdom/shells/bash.nix (profile + interactive).
+      bashSnippet = ''
+        if [ -z "''${SSH_AUTH_SOCK:-}" ]; then
+          if [ -n "''${XDG_RUNTIME_DIR:-}" ]; then
+            export SSH_AUTH_SOCK="${socketPath}"
+          else
+            export SSH_AUTH_SOCK="/run/user/$(id -u)/rbw/ssh-agent-socket"
+          fi
+        fi
+      '';
+
+      # Fish init snippet — used by wisdom/shells/fish.nix.
+      fishSnippet = pkgs: ''
+        if test -z "$SSH_AUTH_SOCK"
+          if test -n "$XDG_RUNTIME_DIR"
+            set -gx SSH_AUTH_SOCK "${socketPath}"
+          else
+            set -l _hm_uid (${pkgs.coreutils}/bin/id -u)
+            set -gx SSH_AUTH_SOCK "/run/user/$_hm_uid/rbw/ssh-agent-socket"
+          end
+        end
+      '';
+    in
+    {
+      inherit bashSnippet fishSnippet;
+      # Used by home-manager modules to expose SSH_AUTH_SOCK to GUI apps
+      # and HM-managed shells declaratively (no activation script needed).
+      sessionVariable = socketPath;
+    };
+}
+
+

modules/system/gaming.nix

@@ -17,10 +17,9 @@
         ++ lib.optionals pkgs.stdenv.isx86_64 [ heroic ];
 
       steamExtraPkgs =
-        if !cfg.steam.steamTinkerLaunch.enable then
+        lib.optional (cfg.steam.steamTinkerLaunch.enable && lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
-          [ ]
+
-        else
+      launcherSet = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
-          lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
     in
     {
       options.chiasson.system.gaming = {
@@ -194,11 +193,11 @@
           ];
         }
         (lib.mkIf (cfg.launchers.forUsers == null) {
-          environment.systemPackages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+          environment.systemPackages = launcherSet;
         })
         (lib.mkIf (cfg.launchers.forUsers != null) {
           users.users = lib.genAttrs cfg.launchers.forUsers (_: {
-            packages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+            packages = launcherSet;
           });
         })
       ]);

modules/system/nfs/default.nix

@@ -0,0 +1,38 @@
+# NFS mount of nixdesk (14900k) bulk storage for clients. Exports live in
+#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
+#
+# Jellyfin library paths (see also jellyfin.nix):
+#   Movies → /mnt/nixdesk-jellyfin/movies
+#   Shows  → /mnt/nixdesk-jellyfin/tv
+#
+# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
+# old client mount and let automount reattach, e.g.:
+#   sudo umount -l /mnt/nixdesk-jellyfin
+#   ls /mnt/nixdesk-jellyfin
+{ ... }:
+{
+  flake.nixosModules.nixdeskJellyfin =
+    { lib, ... }:
+    let
+      nfsExportHost = "192.168.2.25";
+      # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
+      nfsClientOpts = [
+        "rw"
+        "noatime"
+        "nofail"
+        "_netdev"
+        "nfsvers=3"
+        "tcp"
+        "lookupcache=none"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=3600"
+      ];
+    in
+    {
+      fileSystems."/mnt/nixdesk-jellyfin" = {
+        device = "${nfsExportHost}:/mnt/deep/jellyfin";
+        fsType = "nfs";
+        options = nfsClientOpts;
+      };
+    };
+}

modules/system/users.nix

@@ -0,0 +1,339 @@
+# Users & SSH inbound: options + catalog defaults + integration. Single module
+# that used to be split across `modules/system/users/{default,catalog-options,
+# catalog-default,home-integration}.nix`. Per-host overrides / extra HM modules
+# work the same way they always have; only the file structure changed.
+{ self, ... }:
+{
+  flake.nixosModules.users =
+    { config, options, lib, ... }:
+    let
+      cfg = config.chiasson.users;
+      usersLib =
+        let
+          userHm = user: user.homeManager or { };
+          userSsh = user: user.ssh or { };
+        in
+        rec {
+          resolveHomeManagerModule =
+            moduleSpec:
+            let
+              t = builtins.typeOf moduleSpec;
+            in
+            if t == "path" || t == "string" then import moduleSpec else moduleSpec;
+
+          selectedUsersAttr =
+          { catalog, enabled, hostOverrides }:
+            lib.listToAttrs (
+              map (name: {
+                inherit name;
+                value = lib.recursiveUpdate catalog.${name} (hostOverrides.${name} or { });
+              }) enabled
+            );
+
+          missingEnabledNames =
+            catalog: enabled: builtins.filter (name: !(builtins.hasAttr name catalog)) enabled;
+
+          strayHomeUserKeys =
+            homeUsers: enabled: builtins.filter (k: !(builtins.elem k enabled)) (builtins.attrNames homeUsers);
+
+          mkNixosUser =
+            name: user:
+            {
+              isNormalUser = user.isNormalUser or true;
+              description = user.description or name;
+              extraGroups = user.extraGroups or [ ];
+            }
+            // lib.optionalAttrs (user ? hashedPasswordFile && user.hashedPasswordFile != null) {
+              hashedPasswordFile = user.hashedPasswordFile;
+            };
+
+          hmWiredNames =
+            selectedUsers:
+            lib.attrNames (
+              lib.filterAttrs (
+                _: user:
+                let
+                  hm = userHm user;
+                in
+                (hm.enable or false) && (hm.module or null) != null
+              ) selectedUsers
+            );
+
+          rbwOutboundSnippet =
+            name: user:
+            let
+              outboundCfg = ((userSsh user).outbound or { }).rbw or { };
+            in
+            lib.mkIf (outboundCfg.enable or false) {
+              chiasson.ssh.outbound.rbw.enable = true;
+              chiasson.ssh.outbound.rbw.user = name;
+              chiasson.ssh.outbound.rbw.hosts =
+                if (outboundCfg.hosts or "all") == "all" then [ "all" ] else outboundCfg.hosts;
+              chiasson.ssh.outbound.rbw.extraIdentities = outboundCfg.extraIdentities or [ ];
+            };
+
+          mkHmUserModule =
+          { name, user, hostExtraModules }:
+            let
+              hm = userHm user;
+              hmModule = resolveHomeManagerModule hm.module;
+            in
+            lib.mkMerge (
+              [
+                hmModule
+                (rbwOutboundSnippet name user)
+              ]
+              ++ (hm.extraModules or [ ])
+              ++ hostExtraModules
+            );
+
+          inboundAuthorizedOrNull =
+            user:
+            let
+              inboundCfg = (userSsh user).inbound or { };
+            in
+            if !(inboundCfg.enable or false) then
+              null
+            else if (inboundCfg.authorizedHosts or "all") == "all" then
+              "all"
+            else
+              inboundCfg.authorizedHosts;
+
+          inboundHostsAttr =
+            selectedUsers:
+            lib.pipe selectedUsers [
+              (lib.mapAttrs (_: inboundAuthorizedOrNull))
+              (lib.filterAttrs (_: v: v != null))
+            ];
+        };
+      inventory = self.lib.sshInventory;
+
+      olivierEnabled = lib.elem "olivier" cfg.enabled;
+
+      # Merge catalog + per-host overrides into the final user attrs.
+      selectedUsers = lib.listToAttrs (
+        map (name: {
+          inherit name;
+          value = lib.recursiveUpdate cfg.catalog.${name} (cfg.hostOverrides.${name} or { });
+        }) cfg.enabled
+      );
+
+      names = usersLib.hmWiredNames selectedUsers;
+      missing = usersLib.missingEnabledNames cfg.catalog cfg.enabled;
+      stray = usersLib.strayHomeUserKeys cfg.extraModules cfg.enabled;
+      hmAvailable = lib.hasAttrByPath [ "home-manager" "users" ] options;
+      inboundUsersAttr = usersLib.inboundHostsAttr selectedUsers;
+
+      hmUsersAttr = lib.listToAttrs (
+        map (name: {
+          inherit name;
+          value = usersLib.mkHmUserModule {
+            inherit name;
+            user = selectedUsers.${name};
+            hostExtraModules = cfg.extraModules.${name} or [ ];
+          };
+        }) names
+      );
+
+      # Fish shell wiring: HM's fish module declares its package, but
+      # /etc/passwd + /etc/shells need updating so login shells work.
+      # Only fires for HM users that actually enable fish.
+      hmFishUsers =
+        if !hmAvailable then
+          { }
+        else
+          lib.filterAttrs (
+            name: hmUser: (hmUser.programs.fish.enable or false) && builtins.elem name names
+          ) config.home-manager.users;
+    in
+    {
+      imports = [
+        self.nixosModules.sshInbound
+        { _module.args = { inherit self usersLib; }; }
+      ];
+
+      ####################
+      # Options
+      ####################
+      options.chiasson.users = {
+        catalog = lib.mkOption {
+          type = lib.types.attrs;
+          default = { };
+          description = "User records; defaults below. Override with `hostOverrides` or `mkForce`.";
+        };
+        enabled = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+          description = "Catalog names to materialize as `users.users` on this machine.";
+        };
+        hostOverrides = lib.mkOption {
+          type = lib.types.attrs;
+          default = { };
+          description = "`recursiveUpdate`'d onto catalog users on this host.";
+        };
+        # Standard `attrsOf (listOf …)` already concatenates lists across
+        # module definitions; no custom merge function needed.
+        extraModules = lib.mkOption {
+          type = lib.types.attrsOf (lib.types.listOf lib.types.unspecified);
+          default = { };
+          description = ''
+            Per-user Home Manager extraModules keyed by catalog name. Lists
+            from multiple modules (desktopHomeBase + this host's home.nix)
+            are concatenated.
+          '';
+        };
+        homeManager.autoWire = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Auto-create Home Manager users from the catalog.";
+        };
+      };
+
+      ####################
+      # Catalog defaults + integration
+      ####################
+      # Nix won't accept both `config.X = …` and `config = …` in the same
+      # attrset (the path-attr partially defines `config`, then the explicit
+      # `config = …` is a redefinition error). All `config.` writes must
+      # therefore live INSIDE the single mkMerge block below.
+      config = lib.mkMerge [
+        ####################
+        # Catalog defaults
+        ####################
+        {
+          chiasson.users.catalog = {
+            olivier = {
+              isNormalUser = true;
+              description = "Olivier";
+              extraGroups = [
+                "networkmanager"
+                "wheel"
+                "docker"
+                "fuse"
+                "uinput"
+                "kvm"
+                # `video` lets brightnessctl/light udev rules own /sys/backlight without sudo.
+                # Harmless on headless hosts (no devices).
+                "video"
+                # DRI render + input for gamescope / Steam on Wayland, no sudo.
+                "render"
+                "input"
+              ];
+              hashedPasswordFile = lib.mkIf olivierEnabled (
+                config.sops.secrets."users/olivier/hashedPassword".path
+              );
+              homeManager = {
+                enable = true;
+                module = { pkgs, ... }: {
+                  home.username = "olivier";
+                  home.homeDirectory = "/home/olivier";
+                  home.stateVersion = "25.11";
+                  programs.home-manager.enable = true;
+
+                  # Declarative rbw config — replaces per-host
+                  # `rbw config set email|base_url`. Neither value is a
+                  # secret (URL + login email), so plaintext is fine, same
+                  # as the public keys committed in ssh-inventory.nix.
+                  programs.rbw = {
+                    enable = true;
+                    settings = {
+                      email = "olivierchiasson@hotmail.fr";
+                      base_url = "https://bitwarden.chiasson.cloud";
+                    };
+                  };
+                };
+              };
+              ssh.inbound.enable = true;
+              ssh.inbound.authorizedHosts = "all";
+              ssh.outbound.rbw.enable = true;
+              ssh.outbound.rbw.hosts = [ "all" ];
+              # olivier's laptop: the HM SSH module writes the matching
+              # `.pub` filter for each of these and emits a `Match user`
+              # block, so `ssh server@r5500` / `ssh builder@nix-server`
+              # route the right private key from the rbw agent.
+              ssh.outbound.rbw.extraIdentities = [
+                "server"
+                "builder"
+              ];
+            };
+
+            server = {
+              isNormalUser = true;
+              description = "Server user";
+              extraGroups = [ "wheel" ];
+              homeManager = {
+                enable = false;
+                module = null;
+              };
+              ssh.inbound.enable = true;
+              ssh.inbound.authorizedHosts = "all";
+              ssh.outbound.rbw.enable = false;
+              ssh.outbound.rbw.hosts = [ "all" ];
+            };
+
+            builder = {
+              isNormalUser = true;
+              description = "Navi fleet deploy (push + activate only)";
+              extraGroups = [ ];
+              createHome = false;
+              homeManager = {
+                enable = false;
+                module = null;
+              };
+              ssh.inbound.enable = true;
+              ssh.inbound.authorizedHosts = "all";
+            };
+          };
+
+          # Pull in olivier's hashed password from sops; `neededForUsers`
+          # makes nixos decrypt it at boot so the user record can read it.
+          sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled {
+            neededForUsers = true;
+          };
+        }
+
+        ####################
+        # Integration
+        ####################
+        {
+          assertions = [
+            {
+              assertion = missing == [ ];
+              message = "chiasson.users.enabled references unknown catalog names: ${lib.concatStringsSep ", " missing}";
+            }
+            {
+              assertion = stray == [ ];
+              message = "chiasson.users.extraModules has keys not in chiasson.users.enabled: ${lib.concatStringsSep ", " stray}";
+            }
+          ];
+
+          # NixOS user accounts (no HM, raw).
+          users.users = lib.mapAttrs (name: user: usersLib.mkNixosUser name user) selectedUsers;
+        }
+        (lib.optionalAttrs hmAvailable {
+          "home-manager".useGlobalPkgs = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) true;
+          "home-manager".sharedModules = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) [
+            self.homeManagerModules.sshOutboundRbw
+          ];
+          "home-manager".users = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) hmUsersAttr;
+        })
+        # Wire user-specific ACLs into the inbound module — fail the build
+        # if a user has no matching pubkey.
+        (lib.mkIf (inboundUsersAttr != { }) {
+          chiasson.ssh.inbound.enable = true;
+          chiasson.ssh.inbound.userAuthorizedHosts = inboundUsersAttr;
+        })
+        # Fish-shell wiring: HM knows the package; we sync /etc/passwd +
+        # /etc/shells with `mkForce`. `mkNixosUser` doesn't emit `shell`, so
+        # the force is uncontested.
+        (lib.mkIf (hmFishUsers != { }) {
+          environment.shells = lib.mkAfter (
+            lib.mapAttrsToList (_: hmUser: lib.getExe hmUser.programs.fish.package) hmFishUsers
+          );
+          users.users = lib.mapAttrs (name: hmUser: {
+            shell = lib.mkForce (lib.getExe hmUser.programs.fish.package);
+          }) hmFishUsers;
+        })
+      ];
+    };
+}

modules/system/users/catalog-default.nix

@@ -1,105 +0,0 @@
-# Shared user definitions for all hosts that import `nixosModules.users`.
-# Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc.
-{ ... }: {
-  flake.nixosModules.usersCatalogDefaults =
-    { config, lib, ... }:
-    let
-      olivierEnabled = lib.elem "olivier" config.chiasson.users.enabled;
-    in
-    {
-      config.sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled {
-        neededForUsers = true;
-      };
-
-      config.chiasson.users.catalog = {
-        olivier = {
-          isNormalUser = true;
-          description = "Olivier";
-          extraGroups = [
-            "networkmanager"
-            "wheel"
-            "docker"
-            "fuse"
-            "uinput"
-            "kvm"
-            # `video` is required for the brightnessctl/light udev rules to grant write access
-            # to /sys/class/backlight/*/brightness without sudo. Harmless on hosts without a
-            # backlight (servers, desktop towers): the group simply has no devices to own.
-            "video"
-            # DRI render nodes and input devices for gamescope / Steam on Wayland (no sudo).
-            "render"
-            "input"
-          ];
-
-          # Declared in this module when olivier is in `chiasson.users.enabled`.
-          # With `neededForUsers`, `.path` is under /run/secrets-for-users/… (sops-nix README).
-          hashedPasswordFile = lib.mkIf olivierEnabled (
-            config.sops.secrets."users/olivier/hashedPassword".path
-          );
-
-          homeManager = {
-            enable = true;
-            module =
-              { ... }:
-              {
-                home.username = "olivier";
-                home.homeDirectory = "/home/olivier";
-                home.stateVersion = "25.11";
-                programs.home-manager.enable = true;
-              };
-          };
-
-          ssh = {
-            inbound = {
-              enable = true;
-              authorizedHosts = "all";
-            };
-            outbound = {
-              rbw = {
-                enable = true;
-                hosts = "all";
-              };
-            };
-          };
-        };
-
-        server = {
-          isNormalUser = true;
-          description = "Server user";
-          extraGroups = [ "wheel" ];
-
-          homeManager = {
-            enable = false;
-            module = null;
-          };
-
-          ssh = {
-            inbound = {
-              enable = true;
-              authorizedHosts = "all";
-            };
-            outbound = {
-              rbw = {
-                enable = false;
-                hosts = "all";
-              };
-            };
-          };
-        };
-
-        builder = {
-          isNormalUser = true;
-          description = "Navi fleet deploy (push + activate only)";
-          extraGroups = [ ];
-          createHome = false;
-
-          homeManager = {
-            enable = false;
-            module = null;
-          };
-
-          ssh.inbound.enable = true;
-        };
-      };
-    };
-}

modules/system/users/catalog-options.nix

@@ -1,55 +0,0 @@
-{ ... }: {
-  flake.nixosModules.usersCatalogOptions =
-    { lib, ... }:
-    {
-      options.chiasson.users = {
-        catalog = lib.mkOption {
-          type = lib.types.attrs;
-          default = { };
-          description = ''
-            User records merged from `usersCatalogDefaults`; override with `hostOverrides` or `mkForce`.
-          '';
-        };
-        enabled = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = "Catalog names to materialize as `users.users` on this machine.";
-        };
-        hostOverrides = lib.mkOption {
-          type = lib.types.attrs;
-          default = { };
-          description = ''
-            `recursiveUpdate`d onto catalog users.
-          '';
-        };
-        extraModules = lib.mkOption {
-          type =
-            (lib.types.attrsOf (lib.types.listOf lib.types.unspecified))
-            // {
-              merge =
-                loc: defs:
-                let
-                  values = map (d: d.value) defs;
-                  names = lib.unique (lib.concatLists (map builtins.attrNames values));
-                in
-                lib.genAttrs names (
-                  name: lib.concatLists (map (v: v.${name} or [ ]) values)
-                );
-            };
-          default = { };
-          description = ''
-            Per-user Home Manager `extraModules` keyed by catalog user name.
-            Keys must match `chiasson.users.enabled`. Lists from multiple modules
-            are concatenated (e.g. `desktop-home-base.nix` + host `home.nix`).
-          '';
-        };
-        homeManager = {
-          autoWire = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = "Create HM users from the catalog when true.";
-          };
-        };
-      };
-    };
-}

modules/system/users/default.nix

@@ -1,27 +0,0 @@
-# Catalog → NixOS `users.users` + Home Manager + SSH inbound.
-{ self, ... }: {
-  flake.nixosModules.users =
-    { config, lib, ... }:
-    let
-      usersLib = self.lib.usersMerge lib;
-      selectUsers =
-        c:
-        let
-          uc = c.chiasson.users;
-        in
-        usersLib.selectedUsersAttr {
-          catalog = uc.catalog;
-          enabled = uc.enabled;
-          hostOverrides = uc.hostOverrides;
-        };
-    in
-    {
-      imports = [
-        self.nixosModules.sshInbound
-        self.nixosModules.usersCatalogOptions
-        self.nixosModules.usersCatalogDefaults
-        { _module.args = { inherit self usersLib selectUsers; }; }
-        self.nixosModules.usersHomeIntegration
-      ];
-    };
-}

modules/system/users/home-integration.nix

@@ -1,71 +0,0 @@
-{ ... }: {
-  flake.nixosModules.usersHomeIntegration =
-    { config, options, lib, self, usersLib, selectUsers, ... }:
-    let
-      cfg = config.chiasson.users;
-      selected = selectUsers config;
-      missing = usersLib.missingEnabledNames cfg.catalog cfg.enabled;
-      stray = usersLib.strayHomeUserKeys cfg.extraModules cfg.enabled;
-      names = usersLib.hmWiredNames selected;
-      hmAvailable = lib.hasAttrByPath [ "home-manager" "users" ] options;
-      hmUsersAttr = lib.listToAttrs (
-        map (name: {
-          inherit name;
-          value = usersLib.mkHmUserModule {
-            inherit name;
-            user = selected.${name};
-            hostExtraModules = cfg.extraModules.${name} or [ ];
-          };
-        }) names
-      );
-      inboundUsersAttr = usersLib.inboundHostsAttr selected;
-
-      # HM configures fish in ~/.config/fish but no longer sets /etc/passwd or /etc/shells.
-      hmFishUsers =
-        if !hmAvailable then { }
-        else
-          lib.filterAttrs (
-            name: hmUser: (hmUser.programs.fish.enable or false) && builtins.elem name names
-          ) config.home-manager.users;
-    in
-    {
-      config = lib.mkMerge [
-        {
-          assertions = [
-            {
-              assertion = missing == [ ];
-              message = "chiasson.users.enabled references unknown catalog users: ${builtins.concatStringsSep ", " missing}";
-            }
-            {
-              assertion = stray == [ ];
-              message = "chiasson.users.extraModules has keys not in chiasson.users.enabled: ${builtins.concatStringsSep ", " stray}";
-            }
-          ];
-        }
-        {
-          users.users = lib.mapAttrs (name: user: usersLib.mkNixosUser name user) selected;
-        }
-        (lib.optionalAttrs hmAvailable {
-          "home-manager".useGlobalPkgs = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) true;
-          "home-manager".sharedModules = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) [ self.homeManagerModules.sshOutboundRbw ];
-          "home-manager".users = lib.mkIf (cfg.homeManager.autoWire && names != [ ]) hmUsersAttr;
-        })
-        (lib.mkIf (inboundUsersAttr != { }) {
-          chiasson.ssh.inbound.enable = true;
-          chiasson.ssh.inbound.userAuthorizedHosts = inboundUsersAttr;
-        })
-        (lib.mkIf (hmFishUsers != { }) {
-          environment.shells = lib.mkAfter (
-            lib.mapAttrsToList (
-              _: hmUser: lib.getExe hmUser.programs.fish.package
-            ) hmFishUsers
-          );
-          users.users = lib.mapAttrs (
-            name: hmUser: {
-              shell = lib.mkForce (lib.getExe hmUser.programs.fish.package);
-            }
-          ) hmFishUsers;
-        })
-      ];
-    };
-}

modules/wisdom/apps/discord.nix

@@ -12,7 +12,9 @@
 
       options.chiasson.home.apps.discord.enable = lib.mkEnableOption ''
         Vesktop (nixcord). Needs nixpkgs `discord` — breaks on e.g. aarch64-linux.
-      '';
+      '' // {
+        default = false;
+      };
 
       config = lib.mkIf root.enable (lib.mkMerge [
         {

modules/wisdom/apps/localsend.nix

@@ -1,4 +1,4 @@
-{ ... }: {
+{ self, ... }: {
   flake.nixosModules.systemLocalsend =
     { config, lib, ... }:
     let
@@ -19,23 +19,10 @@
       };
     };
 
-  flake.homeManagerModules.wisdomAppsLocalsend =
+  flake.homeManagerModules.wisdomAppsLocalsend = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "apps.localsend";
-    let
+    default = true;
-      root = config.chiasson.home;
+    description = "LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.";
-      cfg = config.chiasson.home.apps.localsend;
+    packages = pkgs: [ pkgs.localsend ];
-    in
+  };
-    {
-      options.chiasson.home.apps.localsend = {
-        enable = lib.mkEnableOption ''
-          LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.
-        '';
-
-        package = lib.mkPackageOption pkgs "localsend" { };
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ cfg.package ];
-      };
-    };
 }

modules/wisdom/apps/pokeclicker/default.nix

@@ -1,16 +1,8 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomAppsPokeclicker =
+  flake.homeManagerModules.wisdomAppsPokeclicker = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "apps.pokeclicker";
-    let
+    default = false;
-      root = config.chiasson.home;
+    description = "PokéClicker desktop (Farigh fork .deb → nix).";
-      cfg = config.chiasson.home.apps.pokeclicker;
+    packages = pkgs: [ (pkgs.callPackage ./package { }) ];
-      pokeclickerPkg = pkgs.callPackage ./package { };
+  };
-    in
-    {
-      options.chiasson.home.apps.pokeclicker.enable = lib.mkEnableOption "PokéClicker desktop (Farigh fork .deb → nix).";
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ pokeclickerPkg ];
-      };
-    };
 }

modules/wisdom/browsers/chrome.nix

@@ -1,19 +1,8 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomBrowsersChrome =
+  flake.homeManagerModules.wisdomBrowsersChrome = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "browsers.chrome";
-    let
+    default = false;
-      root = config.chiasson.home;
+    description = "Chrome (unfree, needs `allowUnfree`); skipped if nixpkgs has no build for this platform.";
-      cfg = config.chiasson.home.browsers.chrome;
+    packages = pkgs: [ pkgs.google-chrome ];
-    in
+  };
-    {
-      options.chiasson.home.browsers.chrome.enable = lib.mkEnableOption ''
-        Chrome (unfree, needs `allowUnfree`); skipped if nixpkgs has no build for this platform.
-      '';
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.google-chrome
-        ) pkgs.google-chrome;
-      };
-    };
 }

modules/wisdom/browsers/chromium-hevc.nix

@@ -5,25 +5,43 @@
       cfg = config.chiasson.system.chromiumHevc;
     in
     {
-      options.chiasson.system.chromiumHevc.enable = lib.mkEnableOption ''
+      options.chiasson.system.chromiumHevc = {
-        VA-API packages for Chromium HEVC (Intel iHD + optional NVIDIA nvidia-vaapi-driver).
+        enable = lib.mkEnableOption ''
-        Pair with `wisdomBrowsersChromiumHevc` on the user side.
+          VA-API packages for Chromium HEVC (Intel iHD + optional NVIDIA nvidia-vaapi-driver).
-      '';
+          Pair with `wisdomBrowsersChromiumHevc` on the user side.
+        '';
+
+        gpu = lib.mkOption {
+          type = lib.types.enum [
+            "intel"
+            "nvidia"
+          ];
+          default = "intel";
+          description = ''
+            VA-API stack for the `*-hevc` browser launchers. Use **intel** for Jellyfin
+            (Chromium + nvidia-vaapi-driver is unsupported upstream and fails with
+            `failed Initialize()ing the frame pool` in Jellyfin). **nvidia** adds the
+            nvidia-vaapi-driver and keep renderD129 + VaapiOnNvidiaGPUs for experiments only.
+          '';
+        };
+      };
 
       config = lib.mkIf cfg.enable {
         hardware.graphics.enable = lib.mkDefault true;
         hardware.graphics.extraPackages = lib.mkAfter (
-          with pkgs;
+          lib.optionals (cfg.gpu == "nvidia") [
-          [ nvidia-vaapi-driver ]
+            pkgs.nvidia-vaapi-driver
+          ]
         );
       };
     };
 
   flake.homeManagerModules.wisdomBrowsersChromiumHevc =
-    { config, lib, pkgs, ... }:
+    { config, lib, pkgs, osConfig ? { }, ... }:
     let
       root = config.chiasson.home;
       cfg = config.chiasson.home.browsers.chromiumHevc;
+      gpu = lib.attrByPath [ "chiasson" "system" "chromiumHevc" "gpu" ] "intel" osConfig;
 
       browserCatalog = {
         "google-chrome" = {
@@ -53,7 +71,6 @@
         intel = {
           driver = "iHD";
           drmDevice = "/dev/dri/renderD128";
-          nvdBackend = "direct";
           enableFeatures = [
             "VaapiVideoDecodeLinuxGL"
             "VaapiVideoDecoder"
@@ -69,7 +86,6 @@
         nvidia = {
           driver = "nvidia";
           drmDevice = "/dev/dri/renderD129";
-          nvdBackend = "direct";
           enableFeatures = [
             "VaapiVideoDecoder"
             "VaapiIgnoreDriverChecks"
@@ -85,7 +101,30 @@
         };
       };
 
-      activeGpu = gpuProfiles.${cfg.vaapi.gpu};
+      activeGpu = gpuProfiles.${gpu};
+      enableFeatures = lib.concatStringsSep "," activeGpu.enableFeatures;
+      disableFeatures = lib.concatStringsSep "," activeGpu.disableFeatures;
+
+      mkDesktopItem =
+        spec:
+        pkgs.makeDesktopItem {
+          name = spec.launcher;
+          desktopName = spec.desktopName;
+          genericName = "Web Browser";
+          exec = "${spec.launcher} %U";
+          icon = spec.icon;
+          categories = [
+            "Network"
+            "WebBrowser"
+          ];
+          mimeTypes = [
+            "text/html"
+            "text/xml"
+            "application/xhtml+xml"
+            "x-scheme-handler/http"
+            "x-scheme-handler/https"
+          ];
+        };
 
       mkChromiumHevc =
         packageName:
@@ -93,26 +132,7 @@
           spec = browserCatalog.${packageName};
           browser = spec.package;
           launcherName = spec.launcher;
-          enableFeatures = lib.concatStringsSep "," activeGpu.enableFeatures;
+          desktopItem = mkDesktopItem spec;
-          disableFeatures = lib.concatStringsSep "," activeGpu.disableFeatures;
-          desktopItem = pkgs.makeDesktopItem {
-            name = launcherName;
-            desktopName = spec.desktopName;
-            genericName = "Web Browser";
-            exec = "${launcherName} %U";
-            icon = spec.icon;
-            categories = [
-              "Network"
-              "WebBrowser"
-            ];
-            mimeTypes = [
-              "text/html"
-              "text/xml"
-              "application/xhtml+xml"
-              "x-scheme-handler/http"
-              "x-scheme-handler/https"
-            ];
-          };
         in
         pkgs.runCommand launcherName
           {
@@ -126,7 +146,7 @@
             makeWrapper ${browser}/bin/${spec.binary} $out/bin/${launcherName} \
               --set LIBVA_DRIVER_NAME ${lib.escapeShellArg activeGpu.driver} \
               --set LIBVA_DRM_DEVICE ${lib.escapeShellArg activeGpu.drmDevice} \
-              --set NVD_BACKEND ${lib.escapeShellArg activeGpu.nvdBackend} \
+              --set NVD_BACKEND direct \
               --add-flags "--enable-features=${enableFeatures}" \
               --add-flags "--disable-features=${disableFeatures}" \
               ${lib.concatMapStringsSep " " (a: "--add-flags ${lib.escapeShellArg a}") cfg.extraCommandLineArgs}
@@ -136,48 +156,30 @@
           '';
 
       selectedPackages = lib.filter (
-        name:
+        name: lib.meta.availableOn pkgs.stdenv.hostPlatform browserCatalog.${name}.package
-        let
-          spec = browserCatalog.${name};
-        in
-        lib.meta.availableOn pkgs.stdenv.hostPlatform spec.package
       ) cfg.packages;
 
       wrappers = map mkChromiumHevc selectedPackages;
     in
     {
       options.chiasson.home.browsers.chromiumHevc = {
-        enable = lib.mkEnableOption ''
+        enable =
-          `google-chrome-hevc`: Chromium with VA-API HEVC for Jellyfin / MSE playback.
+          lib.mkEnableOption ''
+            `google-chrome-hevc`: Chromium with VA-API HEVC for Jellyfin / MSE playback.
 
-          Default GPU is **Intel** (`vaapi.gpu = "intel"`): Chromium + NVIDIA VA-API is
+            GPU stack comes from `chiasson.system.chromiumHevc.gpu` (default **intel**).
-          unsupported upstream (`nvidia-vaapi-driver` README) and fails with
+            Requires `chiasson.system.chromiumHevc.enable` on NixOS.
-          `failed Initialize()ing the frame pool` in Jellyfin.
+          ''
-
+          // {
-          Requires `chiasson.system.chromiumHevc.enable` on NixOS.
+            default = true;
-        '';
+          };
 
         packages = lib.mkOption {
-          type = lib.types.listOf (
+          type = lib.types.listOf (lib.types.enum (lib.attrNames browserCatalog));
-            lib.types.enum (lib.attrNames browserCatalog)
+          default = if pkgs.stdenv.hostPlatform.isAarch64 then [ "chromium" ] else [ "google-chrome" ];
-          );
-          default = [ "google-chrome" ];
           description = "Chromium-based browsers to wrap.";
         };
 
-        vaapi.gpu = lib.mkOption {
-          type = lib.types.enum [
-            "intel"
-            "nvidia"
-          ];
-          default = "intel";
-          description = ''
-            VA-API stack for `google-chrome-hevc`. Use **intel** for Jellyfin (Chromium +
-            nvidia-vaapi-driver is unsupported and hits frame-pool init errors). **nvidia**
-            keeps renderD129 + VaapiOnNvidiaGPUs for experiments only.
-          '';
-        };
-
         extraCommandLineArgs = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           default = [ ];

modules/wisdom/browsers/edge.nix

@@ -1,17 +1,8 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomBrowsersEdge =
+  flake.homeManagerModules.wisdomBrowsersEdge = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "browsers.edge";
-    let
+    default = false;
-      root = config.chiasson.home;
+    description = "Edge (unfree); skipped if unavailable on this platform.";
-      cfg = config.chiasson.home.browsers.edge;
+    packages = pkgs: [ pkgs.microsoft-edge ];
-    in
+  };
-    {
-      options.chiasson.home.browsers.edge.enable = lib.mkEnableOption "Edge (unfree); skipped if unavailable on this platform.";
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.microsoft-edge
-        ) pkgs.microsoft-edge;
-      };
-    };
 }

modules/wisdom/browsers/flow.nix

@@ -1,31 +1,31 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomBrowsersFlow =
+  flake.homeManagerModules.wisdomBrowsersFlow = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "browsers.flow";
-    let
+    default = false;
-      root = config.chiasson.home;
+    description = "[Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.";
-      cfg = config.chiasson.home.browsers.flow;
+    packages =
+      pkgs:
+      let
+        pname = "flow-browser";
+        version = "0.11.0";
 
-      flow-browser =
+        suffix = if pkgs.stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
-        let
-          pname = "flow-browser";
-          version = "0.11.0";
 
-          suffix = if pkgs.stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
+        hash =
+          if pkgs.stdenv.hostPlatform.isAarch64 then
+            "sha256-rTRKbNyVRJAw7ZyDR6kx+XJ4rWmErZqA0b6LP9t5eOA="
+          else
+            "sha256-/Tca4uUBfgbZQEeXdYkCz6CWxqvCl40CQpACFry1k9s=";
 
-          hash =
+        src = pkgs.fetchurl {
-            if pkgs.stdenv.hostPlatform.isAarch64 then
+          url = "https://github.com/MultiboxLabs/flow-browser/releases/download/v${version}/flow-browser-${version}-${suffix}.AppImage";
-              "sha256-rTRKbNyVRJAw7ZyDR6kx+XJ4rWmErZqA0b6LP9t5eOA="
+          inherit hash;
-            else
+        };
-              "sha256-/Tca4uUBfgbZQEeXdYkCz6CWxqvCl40CQpACFry1k9s=";
 
-          src = pkgs.fetchurl {
+        appimageContents = pkgs.appimageTools.extractType2 { inherit pname version src; };
-            url = "https://github.com/MultiboxLabs/flow-browser/releases/download/v${version}/flow-browser-${version}-${suffix}.AppImage";
+      in
-            inherit hash;
+      [
-          };
+        (pkgs.appimageTools.wrapType2 {
-
-          appimageContents = pkgs.appimageTools.extractType2 { inherit pname version src; };
-        in
-        pkgs.appimageTools.wrapType2 {
           inherit pname version src;
 
           nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -45,23 +45,13 @@
           meta = {
             description = "Chromium-based browser (upstream AppImage)";
             homepage = "https://github.com/MultiboxLabs/flow-browser";
-            license = lib.licenses.gpl3Plus;
+            license = pkgs.lib.licenses.gpl3Plus;
-            sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+            sourceProvenance = with pkgs.lib.sourceTypes; [ binaryNativeCode ];
             platforms = [ "x86_64-linux" "aarch64-linux" ];
             mainProgram = pname;
             maintainers = [ ];
           };
-        };
+        })
-    in
+      ];
-    {
+  };
-      options.chiasson.home.browsers.flow.enable = lib.mkEnableOption ''
-        [Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.
-      '';
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform flow-browser
-        ) flow-browser;
-      };
-    };
 }

modules/wisdom/browsers/orion.nix

@@ -31,7 +31,9 @@
     {
       options.chiasson.home.browsers.orion.enable = lib.mkEnableOption ''
         [Orion](https://orionbrowser.com/) (Kagi) — installs the upstream Flatpak bundle and provides `oriongtk`.
-      '';
+      '' // {
+        default = false;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) {
         home.packages = [ oriongtk ];

modules/wisdom/browsers/zen.nix

@@ -8,7 +8,9 @@
     {
       imports = [ inputs.zen-browser.homeModules.beta ];
 
-      options.chiasson.home.browsers.zen.enable = lib.mkEnableOption "Zen Browser + locked-down policies / extensions.";
+      options.chiasson.home.browsers.zen.enable = lib.mkEnableOption "Zen Browser + locked-down policies / extensions." // {
+        default = false;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) {
         programs.zen-browser = {

modules/wisdom/default.nix

@@ -1,24 +1,23 @@
 # HM side of the flake; option tree is `chiasson.home.*` (docs/conventions.md).
 { self, inputs, ... }: {
-  # Root module: chiasson.home.enable + bash. Other `wisdom*` slices auto-wire via
+  # Root module: chiasson.home.enable + git identity. Other `wisdom*` slices (including
-  # `lib.wisdomCatalogExtraModules`; hosts flip `chiasson.home.*.enable` rather than re-importing.
+  # the bash shell) auto-wire via `lib.wisdomCatalogExtraModules`; hosts flip
+  # `chiasson.home.*.enable` rather than re-importing.
   flake.homeManagerModules.wisdom =
-    { config, lib, ... }:
+    { config, lib, pkgs, ... }:
     let
       cfg = config.chiasson.home;
     in
     {
-      imports = [
-        self.homeManagerModules.wisdomShellBash
-      ];
-
       options.chiasson.home = {
-        enable = lib.mkEnableOption ''
+        enable =
-          HM profile root for this flake (bash on by default). Desktop hosts use
+          lib.mkEnableOption ''
-          `lib.wisdomCatalogExtraModules` once per user and flip `chiasson.home.*.enable` on the host.
+            HM profile root for this flake (bash on by default). Desktop hosts use
-        '' // {
+            `lib.wisdomCatalogExtraModules` once per user and flip `chiasson.home.*.enable` on the host.
-          default = true;
+          ''
-        };
+          // {
+            default = true;
+          };
 
         extraPackages = lib.mkOption {
           type = lib.types.listOf lib.types.package;
@@ -29,6 +28,25 @@
         };
       };
 
-      config = lib.mkIf cfg.enable { home.packages = cfg.extraPackages; };
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          { home.packages = cfg.extraPackages; }
+
+          # Base git identity + encryption/player tools shared by every HM user.
+          {
+            programs.git = {
+              enable = true;
+              settings.user = {
+                name = "OlivierChiasson";
+                email = "olivierchiasson@hotmail.fr";
+              };
+            };
+            home.packages = [
+              pkgs.git-crypt
+              pkgs.feishin
+            ];
+          }
+        ]
+      );
     };
 }

modules/wisdom/desktop/gtk-qt-theming.nix

@@ -12,7 +12,9 @@
         enable = lib.mkEnableOption ''
           WhiteSur GTK + icon themes, Phinger cursor, and Qt via qt6ct (DMS) or KDE platform theme.
           Matugen accent colors load via gtk3/gtk4 extraCss when matugenGtkColors is enabled.
-        '';
+        '' // {
+          default = true;
+        };
 
         matugenGtkColors = lib.mkOption {
           type = lib.types.bool;

modules/wisdom/desktop/screenshot.nix

@@ -13,11 +13,13 @@
     {
       options.chiasson.home.desktop.screenshot.enable = lib.mkEnableOption ''
         grim/slurp/swappy + SwiftShare helpers; Hyprland binds if HM Hyprland is on.
-      '';
+      '' // {
+        default = true;
+      };
 
       options.chiasson.home.desktop.screenshot.swiftshareApiKeyFile = lib.mkOption {
         type = lib.types.nullOr lib.types.str;
-        default = null;
+        default = "/run/secrets/swiftshare/API_KEY";
         description = ''
           File with SwiftShare API key (sops path is fine). Required when screenshot module is on.
         '';

modules/wisdom/editors/cursor.nix

@@ -33,7 +33,9 @@
     in
     {
       options.chiasson.home.editors.cursor = {
-        enable = lib.mkEnableOption "Cursor editor from the `cursor` flake input.";
+        enable = lib.mkEnableOption "Cursor editor from the `cursor` flake input." // {
+          default = true;
+        };
         setAsDefaultEditor = lib.mkOption {
           type = lib.types.bool;
           default = true;

modules/wisdom/editors/kate.nix

@@ -1,17 +1,8 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomEditorsKate =
+  flake.homeManagerModules.wisdomEditorsKate = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "editors.kate";
-    let
+    default = false;
-      root = config.chiasson.home;
+    description = "Kate.";
-      cfg = config.chiasson.home.editors.kate;
+    packages = pkgs: [ pkgs.kdePackages.kate ];
-    in
+  };
-    {
-      options.chiasson.home.editors.kate.enable = lib.mkEnableOption "Kate.";
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.kdePackages.kate
-        ) pkgs.kdePackages.kate;
-      };
-    };
 }

modules/wisdom/editors/obsidian.nix

@@ -1,19 +1,8 @@
-{ ... }: {
+{ self, ... }: {
-  flake.homeManagerModules.wisdomEditorsObsidian =
+  flake.homeManagerModules.wisdomEditorsObsidian = self.lib.wisdomSlice {
-    { config, lib, pkgs, ... }:
+    path = "editors.obsidian";
-    let
+    default = true;
-      root = config.chiasson.home;
+    description = "Obsidian (unfree); skipped if unavailable here.";
-      cfg = config.chiasson.home.editors.obsidian;
+    packages = pkgs: [ pkgs.obsidian ];
-    in
+  };
-    {
-      options.chiasson.home.editors.obsidian.enable = lib.mkEnableOption ''
-        Obsidian (unfree); skipped if unavailable here.
-      '';
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.obsidian
-        ) pkgs.obsidian;
-      };
-    };
 }

modules/wisdom/editors/vscode.nix

@@ -0,0 +1,100 @@
+# Visual Studio Code (Microsoft build, unfree). Default extensions + settings shared by all
+# hosts; per-host extras (peacock, comment-anchors, project-manager) go via
+# `chiasson.home.editors.vscode.extensions`.
+{ self, ... }: {
+  flake.homeManagerModules.wisdomEditorsVscode =
+    { config, lib, pkgs, ... }:
+    let
+      root = config.chiasson.home;
+      cfg = config.chiasson.home.editors.vscode;
+
+      defaultExtensions = with pkgs.vscode-extensions; [
+        jnoortheen.nix-ide
+        yzhang.markdown-all-in-one
+        esbenp.prettier-vscode
+        vscjava.vscode-java-pack
+        redhat.java
+      ];
+
+      # Wrap VS Code so a JDK is on PATH — the Red Hat Java language server (and
+      # other extension-bundled JVMs) need `java` to run, independent of the
+      # per-project `java.configuration.runtimes` setting.
+      vscodeWithJdk = pkgs.symlinkJoin {
+        name = "vscode-with-jdk";
+        paths = [ pkgs.vscode ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        postBuild = ''
+          wrapProgram "$out/bin/code" \
+            --prefix PATH : "${pkgs.jdk25}/bin"
+        '';
+      };
+
+      coreSettings = {
+        "nix.enableLanguageServer" = true;
+        "nix.serverPath" = "nixd";
+        "nix.serverSettings" = {
+          nixd = {
+            formatting = {
+              command = "nixfmt";
+            };
+          };
+        };
+        "diffEditor.ignoreTrimWhitespace" = false;
+        "chat.disableAIFeatures" = true;
+
+        "java.configuration.runtimes" = [
+          {
+            name = "JavaSE-21";
+            path = "${pkgs.jdk21}/lib/openjdk";
+          }
+          {
+            name = "JavaSE-25";
+            path = "${pkgs.jdk25}/lib/openjdk";
+            default = true;
+          }
+        ];
+      };
+
+      # Seed a *writable* settings.json (not a store symlink) so extensions like
+      # kilo-code can edit it at runtime. `force = false` in the config means HM
+      # only writes it when absent, preserving kilo's later edits across `switch`.
+      settingsJson = pkgs.writeText "vscode-user-settings" (
+        builtins.toJSON coreSettings
+      );
+    in
+    {
+      options.chiasson.home.editors.vscode = {
+        enable = lib.mkEnableOption ''
+          Visual Studio Code (Microsoft build; needs `nixpkgs.config.allowUnfree`). Core
+          extensions (nix-ide, markdown-all-in-one, prettier) + nixd/nixfmt settings are included.
+        '' // {
+          default = false;
+        };
+
+        extensions = lib.mkOption {
+          type = lib.types.listOf lib.types.package;
+          default = [ ];
+          description = ''
+            Extra extensions not wanted on every host (e.g. peacock, comment-anchors,
+            project-manager). Per-host via `chiasson.users.extraModules`.
+          '';
+        };
+      };
+
+      config = lib.mkIf (root.enable && cfg.enable) {
+        home.packages = [ ];
+
+        # Writable, seed-once user settings (kilo-code can append to it).
+        home.file.".config/Code/User/settings.json" = {
+          source = settingsJson;
+          force = false;
+        };
+
+        programs.vscode = {
+          enable = true;
+          package = vscodeWithJdk;
+          extensions = defaultExtensions ++ cfg.extensions;
+        };
+      };
+    };
+  }

modules/wisdom/filebrowsers/nemo.nix

@@ -8,10 +8,12 @@
     {
       options.chiasson.home.filebrowsers.nemo.enable = lib.mkEnableOption ''
         Nemo file manager (GTK). Colors come from DMS matugen via GTK settings — no KDE/Qt bridge needed.
-      '';
+      '' // {
+        default = true;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [pkgs.nemo];
+        home.packages = [ pkgs.nemo ];
 
         xdg.mimeApps = {
           enable = lib.mkDefault true;

modules/wisdom/hardware/uconsole-gamepad.nix

@@ -8,7 +8,9 @@
     {
       options.chiasson.home.hardware.uconsoleGamepad.enable = lib.mkEnableOption ''
         uConsole gamepad antimicrox profile + Hyprland exec-once when HM Hyprland is on.
-      '';
+      '' // {
+        default = false;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) (lib.mkMerge [
         {

modules/wisdom/shells/fish.nix

@@ -8,7 +8,9 @@
     in
     {
       options.chiasson.home.shell.fish = {
-        enable = lib.mkEnableOption "Fish + grc, quiet greeting, rbw SSH socket defaults.";
+        enable = lib.mkEnableOption "Fish + grc, quiet greeting, rbw SSH socket defaults." // {
+          default = true;
+        };
 
         nixYourShell = {
           enable = lib.mkEnableOption ''

modules/wisdom/shells/oh-my-posh.nix

@@ -7,7 +7,9 @@
     in
     {
       options.chiasson.home.shell.ohMyPosh = {
-        enable = lib.mkEnableOption "[Oh My Posh](https://ohmyposh.dev/) prompt.";
+        enable = lib.mkEnableOption "[Oh My Posh](https://ohmyposh.dev/) prompt." // {
+          default = true;
+        };
 
         builtinTheme = lib.mkOption {
           type = lib.types.str;

modules/wisdom/shells/yazi.nix

@@ -7,7 +7,9 @@
       cfg = config.chiasson.home.shell.yazi;
     in
     {
-      options.chiasson.home.shell.yazi.enable = lib.mkEnableOption "Yazi as `y` + 7zz with rar.";
+      options.chiasson.home.shell.yazi.enable = lib.mkEnableOption "Yazi as `y` + 7zz with rar." // {
+        default = true;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) {
         programs.yazi = {

modules/wisdom/terminals/kitty.nix

@@ -15,7 +15,9 @@
     {
       options.chiasson.home.terminals.kitty.enable = lib.mkEnableOption ''
         Kitty + DMS includes; activation strips `*-theme.auto.conf` so matugen colors stick.
-      '';
+      '' // {
+        default = true;
+      };
 
       config = lib.mkIf (root.enable && cfg.enable) {
         programs.kitty = {