Add default settings file support for Dank Material Shell (DMS)

- Introduced a new option `defaultSettingsFile` in the DMS configuration to allow host-specific first-run settings.
- Updated the home-manager module to read from the specified settings file if provided, otherwise falling back to the bundled defaults.
- Enhanced the documentation in the default settings file to clarify its purpose and usage.

.sops.yaml

@@ -17,6 +17,14 @@ creation_rules:
           - *host_ideapad
           - *host_nix-server
           - *host_r5500
+  - path_regex: secrets/gitcrypt-personal-docs-key$
+    key_groups:
+      - age:
+          - *primary
+          - *host_14900k
+          - *host_uConsole
+          - *host_t2mbp
+          - *host_ideapad
   # Host secrets at modules/hosts/nix-server/secrets.yaml (see configuration imports),
   # or optional extra files under _secrets/.
   - path_regex: modules/hosts/nix-server/(secrets\.(yaml|json|env|ini)|_secrets/.*\.(yaml|json|env|ini))$

modules/desktop/gui.nix

@@ -49,6 +49,10 @@
         (lib.mkIf guiEnabled {
           services.xserver.enable = true;
 
+          # Trash, MTP, network mounts, etc. for GTK file managers (Nemo). Without gvfs the Delete
+          # key silently fails (move-to-trash) while Shift+Delete still works (permanent delete).
+          services.gvfs.enable = lib.mkDefault true;
+
           # Chromium/Electron (Edge, Vesktop, etc.) only add native Wayland + IME flags when this is
           # set; nixpkgs wrappers gate on NIXOS_OZONE_WL and WAYLAND_DISPLAY. Helps PipeWire/desktop
           # portal screen capture on wlroots-like sessions. Harmless on X11 (flags stay off).

modules/desktop/hyprland/default.nix

@@ -103,7 +103,7 @@
                 "ControlSuper,T,exec,konsole"
                 "SUPER,D,exec,rofi -show drun"
                 "ControlSuper,D,exec,rofi -show window"
-                "SUPER,E,exec,dolphin"
+                "SUPER,E,exec,nemo"
                 "Super, Q, killactive"
                 "ControlSuper, Q, exec, hyprctl kill"
                 "Super, F, fullscreen, 0"

modules/desktop/niri/default.nix

@@ -14,6 +14,7 @@ let
       };
       input."warp-mouse-to-focus" = _: { };
       layout.gaps = 5;
+      prefer-no-csd = true;
 
       window-rules = [
         {
@@ -26,6 +27,29 @@ let
           open-floating = true;
           open-focused = false;
         }
+        {
+          matches = [
+            { title = "^(Picture-in-Picture|Picture in picture)$"; }
+          ];
+          open-floating = true;
+          open-focused = false;
+          default-column-width = { fixed = 640; };
+          default-window-height = { fixed = 360; };
+          default-floating-position = _: {
+            props = {
+              x = 32;
+              y = 32;
+              relative-to = "bottom-right";
+            };
+          };
+        }
+        {
+          matches = [
+            { app-id = "^Minecraft\\*"; }
+            { app-id = "^Minecraft$"; }
+          ];
+          tiled-state = true;
+        }
       ];
 #TODO[epic=Binds] Go over binds again
       binds = {
@@ -33,12 +57,14 @@ let
         "Mod+Control+T"."spawn-sh" = "konsole"; #TODO[epic=Binds] This should only be set if having konsole
         "Mod+D"."spawn-sh" = "rofi -show drun"; #TODO[epic=Binds] This should only be set if having rofi
         "Mod+Space"."spawn-sh" = "dms ipc call spotlight toggle"; #TODO[epic=Binds] This should only be set if having dms
-        "Mod+E"."spawn-sh" = "dolphin"; #TODO[epic=Binds] This should only be set if having dolphin
+        "Mod+E"."spawn-sh" = "nemo"; #TODO[epic=Binds] This should only be set if having nemo
         "Mod+Control+O"."spawn-sh" = "rofi -show window"; #TODO[epic=Binds] This should only be set if having rofi
 "Mod+V"."spawn-sh" = "dms ipc call clipboard toggle"; #TODO[epic=Binds] This should only be set if having dms
 "Mod+N"."spawn-sh" = "dms ipc call notepad toggle"; #TODO[epic=Binds] This should only be set if having dms
 "Mod+Shift+N"."spawn-sh" = "dms ipc call notifications toggle"; #TODO[epic=Binds] This should only be set if having dms
 "Mod+M"."spawn-sh" = "dms ipc call processlist toggle"; #TODO[epic=Binds] This should only be set if having dms
+"Mod+B"."spawn-sh" = "dms ipc call bar toggle name \"Main Bar\"; dms ipc call bar toggle name \"Bar 2\""; #TODO[epic=Binds] This should only be set if having dms
+"Mod+Shift+B"."spawn-sh" = "dms ipc call bar toggle name \"Bar 2\""; #TODO[epic=Binds] This should only be set if having dms
 "Mod+L"."spawn-sh" = "dms ipc call lock lock"; #TODO[epic=Binds] This should only be set if having dms
 
         "Mod+Q"."close-window" = _: { };
@@ -153,28 +179,55 @@ let
       // lib.optionalAttrs (windowRules != [ ]) {
         window-rules = windowRules;
       }
-      // lib.optionalAttrs (rpi5Extra != "" || (userExtra.extraConfig or "") != "") {
+      // lib.optionalAttrs (extraConfigMerged != "") {
         extraConfig = extraConfigMerged;
       }
     );
 in
 {
   flake.homeManagerModules.desktopNiri =
-    { lib, pkgs, osConfig ? { }, ... }:
+    { config, lib, pkgs, osConfig ? { }, ... }:
     let
+      home = config.home.homeDirectory;
       niriOs = osConfig.chiasson.desktop.niri or { };
       niriEnabled = osConfig.chiasson.desktop.niri.enable or false;
       keyringEnabled = osConfig.chiasson.desktop.keyring.enable or false;
-      mergedSettings = mergeNiriSettings pkgs niriOs keyringEnabled;
+      dmsEnabled = (osConfig.chiasson.desktop.shell or null) == "dms";
+      dmsWindowRulesPath = "${home}/.config/niri/dms/windowrules.kdl";
+      # wrapper-modules emits quoted KDL (`"include" "…"`) which DMS's parser ignores.
+      # config.kdl is a store symlink, so a relative include would not resolve to the real
+      # ~/.config/niri/dms/windowrules.kdl that DMS writes at runtime.
+      dmsWindowRulesInclude = lib.optionalString dmsEnabled ''
+        include "${dmsWindowRulesPath}"
+      '';
+      baseMergedSettings = mergeNiriSettings pkgs niriOs keyringEnabled;
+      mergedSettings = lib.recursiveUpdate baseMergedSettings {
+        extraConfig = dmsWindowRulesInclude + (baseMergedSettings.extraConfig or "");
+      };
       niriConfigPkg = inputs.wrapper-modules.wrappers.niri.wrap {
         inherit pkgs;
         settings = mergedSettings;
+        # User-owned rules path is not available during the Nix build.
+        disableConfigValidation = dmsEnabled;
       };
     in
     {
-      config = lib.mkIf niriEnabled {
+      config = lib.mkIf niriEnabled (lib.mkMerge [
+        {
           xdg.configFile."niri/config.kdl".source = "${niriConfigPkg}/niri-config.kdl";
-      };
+        }
+        (lib.mkIf dmsEnabled {
+          # Seed empty rules file so niri can load the include before DMS first deploy.
+          home.activation.dmsNiriWindowRulesSeed = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+            rulesDir="$HOME/.config/niri/dms"
+            rulesFile="$rulesDir/windowrules.kdl"
+            mkdir -p "$rulesDir"
+            if [ ! -e "$rulesFile" ]; then
+              ${pkgs.coreutils}/bin/touch "$rulesFile"
+            fi
+          '';
+        })
+      ]);
     };
 
   flake.nixosModules.desktopNiri =

modules/desktop/shells/dms/_private/default-settings.nix

@@ -0,0 +1,109 @@
+# Generic defaults written once to ~/.config/DankMaterialShell/settings.json on first login.
+# Hosts can override via `chiasson.desktop.shells.dms.defaultSettingsFile` (see 14900k).
+# After seeding, DMS settings are owned by the UI — rebuilds do not overwrite them.
+{
+  lib,
+  gpuTempEnabled ? true,
+  extraRightBarWidgets ? [ ],
+}:
+let
+  gpuTempBarWidget = {
+    id = "gpuTemp";
+    enabled = true;
+    selectedGpuIndex = 0;
+    pciId = "10de:1f07";
+  };
+in
+{
+  theme = "dark";
+  dynamicTheming = true;
+  currentThemeName = "dynamic";
+  matugenScheme = "scheme-tonal-spot";
+  runUserMatugenTemplates = true;
+  matugenTemplateVesktop = false;
+  showDock = false;
+  gtkThemingEnabled = true;
+  qtThemingEnabled = true;
+  terminalsAlwaysDark = true;
+  syncModeWithPortal = true;
+  configVersion = 5;
+
+  barConfigs = [
+    {
+      id = "default";
+      name = "Main Bar";
+      enabled = true;
+      position = 0;
+      screenPreferences = [ "all" ];
+      showOnLastDisplay = true;
+
+      leftWidgets =
+        [
+          {
+            id = "launcherButton";
+            enabled = true;
+          }
+          {
+            id = "nixMonitor";
+            enabled = true;
+          }
+          {
+            id = "cpuUsage";
+            enabled = true;
+          }
+          {
+            id = "cpuTemp";
+            enabled = true;
+          }
+        ]
+        ++ lib.optionals gpuTempEnabled [ gpuTempBarWidget ]
+        ++ [
+          {
+            id = "memUsage";
+            enabled = true;
+          }
+        ];
+
+      centerWidgets = [
+        {
+          id = "workspaceSwitcher";
+          enabled = true;
+        }
+      ];
+
+      rightWidgets = extraRightBarWidgets
+        ++ [
+          {
+            id = "systemTray";
+            enabled = true;
+          }
+          {
+            id = "notificationButton";
+            enabled = true;
+          }
+          {
+            id = "battery";
+            enabled = true;
+          }
+          {
+            id = "controlCenterButton";
+            enabled = true;
+          }
+          {
+            id = "clock";
+            enabled = true;
+            clockCompactMode = false;
+          }
+        ];
+
+      spacing = 0;
+      innerPadding = 4;
+      bottomGap = 0;
+      transparency = 1;
+      widgetTransparency = 0.45;
+      squareCorners = true;
+      maximizeDetection = true;
+      visible = true;
+    }
+  ];
+}

modules/desktop/shells/dms/default.nix

@@ -24,7 +24,7 @@
       extraRightBarWidgets = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
         default = [ ];
-        description = "Extra right-bar widgets (prepended).";
+        description = "Extra right-bar widgets merged into the first-run DMS settings seed.";
       };
       enableWvkbdToggle = lib.mkEnableOption ''
         wvkbd DMS plugin + bar toggle (touch / uConsole).
@@ -38,6 +38,15 @@
         example = [ "sudo" "nixos-rebuild" "switch" "--flake" ".#14900k" ];
         description = "Command used by DMS nix-monitor widget for rebuild actions.";
       };
+      defaultSettingsFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = ./dms-default-settings.json;
+        description = ''
+          Host-specific first-run `settings.json` seed. When set, replaces the bundled
+          `default-settings.nix` template on fresh profiles.
+        '';
+      };
     };
   };
 
@@ -85,6 +94,7 @@
         ])
         ++ (cfg.extraRightBarWidgets or [ ]);
       programs.nix-monitor.rebuildCommand = rebuildCommand;
+      dms.defaultSettingsFile = cfg.defaultSettingsFile or null;
     };
   };
 }

modules/desktop/shells/dms/home-manager/default.nix

@@ -15,7 +15,11 @@
   matugenOutputDirs =
     lib.optionals hyprlandEnabled [ "${home}/.config/hypr" ]
     ++ lib.optionals ohMyPoshEnabled [ "${home}/.config/oh-my-posh" ]
-    ++ lib.optionals discordEnabled [ "${home}/.config/vesktop/themes" ];
+    ++ lib.optionals discordEnabled [ "${home}/.config/vesktop/themes" ]
+    ++ [
+      "${home}/.config/qt6ct/colors"
+      "${home}/.config/qt5ct/colors"
+    ];
   ensureMatugenOutputDirsScript = pkgs.writeShellScript "dms-ensure-matugen-output-dirs" ''
     set -euo pipefail
     ${lib.concatStringsSep "\n" (map (dir: "mkdir -p ${lib.escapeShellArg dir}") matugenOutputDirs)}
@@ -54,6 +58,18 @@
     ${pkgs.systemd}/bin/systemctl --user try-restart dms.service 2>/dev/null || true
   '';
 
+  jsonFormat = pkgs.formats.json { };
+  dmsSeedSettings =
+    if cfg.defaultSettingsFile != null then
+      builtins.fromJSON (builtins.readFile cfg.defaultSettingsFile)
+    else
+      import ../_private/default-settings.nix {
+        inherit lib gpuTempEnabled;
+        extraRightBarWidgets = cfg.extraRightBarWidgets;
+      };
+  dmsSeedFile = jsonFormat.generate "dms-settings-seed.json" dmsSeedSettings;
+  dmsSettingsPath = "${config.xdg.configHome}/DankMaterialShell/settings.json";
+
 in {
   options = {
     dms.enable = lib.mkOption {
@@ -104,7 +120,7 @@ in {
         { id = "wvkbdToggle"; enabled = true; }
         { id = "rbwLockToggle"; enabled = true; }
       ];
-      description = "Extra `{ id, enabled, … }` widgets, merged before defaults.";
+      description = "Extra `{ id, enabled, … }` widgets merged into the first-run settings seed.";
     };
 
     dms.enableWvkbdToggle = lib.mkEnableOption ''
@@ -114,6 +130,15 @@ in {
     dms.enableRbwLockToggle = lib.mkEnableOption ''
       Ship rbw-lock-toggle into `~/.config/DankMaterialShell/plugins/rbwLockToggle/` (directory name matches plugin id; Bitwarden vault lock/unlock in the bar).
     '';
+
+    dms.defaultSettingsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Host-specific first-run `settings.json` seed. When set, replaces the bundled
+        `default-settings.nix` template on fresh profiles.
+      '';
+    };
   };
 
   imports = [
@@ -167,6 +192,11 @@ in {
   programs.dank-material-shell = {
     enable = true;
 
+    # homeAssistantMonitor plugin (QtWebSockets) needs QML on DMS's import path, not just home.packages.
+    package = inputs.dms.packages.${pkgs.stdenv.hostPlatform.system}.dms-shell.override {
+      extraQtPackages = with pkgs.kdePackages; [ qtwebsockets ];
+    };
+
     systemd = {
       enable = true; # Systemd service for auto-start
       restartIfChanged = true; # Auto-restart dms.service when dankMaterialShell changes
@@ -181,390 +211,28 @@ in {
     enableCalendarEvents = false; # Disable calendar integration (khal/ikhal)
 
     # Leave `session` at {} — non-empty makes HM rewrite session.json every switch and nukes wallpaper/session state.
-    settings = {
+    # Leave `settings` at {} — UI-owned settings.json is seeded once on first run (see home.activation below).
-      theme = "dark";
+    settings = { };
-      dynamicTheming = true;
+    session = { };
-
-      currentThemeName = "dynamic";
-      customThemeFile = "";
-      matugenScheme = "scheme-tonal-spot";
-      runUserMatugenTemplates = true;
-      # Stock DMS vesktop matugen output conflicts with our `templates/dank-discord.css` + config.toml entry.
-      matugenTemplateVesktop = false;
-      matugenTargetMonitor = "";
-      popupTransparency = 1;
-      dockTransparency = 0.85;
-      widgetBackgroundColor = "sch";
-      widgetColorMode = "default";
-      cornerRadius = 10;
-      use24HourClock = false;
-      showSeconds = true;
-      useFahrenheit = false;
-      nightModeEnabled = false;
-      animationSpeed = 1;
-      customAnimationDuration = 500;
-      wallpaperFillMode = "Fill";
-      blurredWallpaperLayer = false;
-      blurWallpaperOnOverview = false;
-
-      showLauncherButton = true;
-      showWorkspaceSwitcher = true;
-      showFocusedWindow = true;
-      showWeather = true;
-      showMusic = true;
-      showClipboard = true;
-      showCpuUsage = true;
-      showMemUsage = true;
-      showCpuTemp = true;
-      showGpuTemp = gpuTempEnabled;
-      showSystemTray = true;
-    }
-    // lib.optionalAttrs gpuTempEnabled {
-      selectedGpuIndex = 0;
-      enabledGpuPciIds = [];
-    }
-    // {
-      showClock = true;
-      showNotificationButton = true;
-      showBattery = true;
-      showControlCenterButton = true;
-      showCapsLockIndicator = true;
-
-      controlCenterShowNetworkIcon = true;
-      controlCenterShowBluetoothIcon = true;
-      controlCenterShowAudioIcon = true;
-      controlCenterShowVpnIcon = true;
-      controlCenterShowBrightnessIcon = false;
-      controlCenterShowMicIcon = false;
-      controlCenterShowBatteryIcon = false;
-      controlCenterShowPrinterIcon = false;
-
-      showPrivacyButton = true;
-      privacyShowMicIcon = false;
-      privacyShowCameraIcon = false;
-      privacyShowScreenShareIcon = false;
-
-      controlCenterWidgets = [
-        {
-          id = "volumeSlider";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "brightnessSlider";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "wifi";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "bluetooth";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "audioOutput";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "audioInput";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "nightMode";
-          enabled = true;
-          width = 50;
-        }
-        {
-          id = "darkMode";
-          enabled = true;
-          width = 50;
-        }
-      ];
-
-      showWorkspaceIndex = true;
-      showWorkspacePadding = false;
-      workspaceScrolling = false;
-      showWorkspaceApps = true;
-      maxWorkspaceIcons = 10;
-      workspaceAppIconSizeOffset = 1;
-      workspacesPerMonitor = true;
-      showOccupiedWorkspacesOnly = false;
-      dwlShowAllTags = false;
-      workspaceNameIcons = {};
-
-      waveProgressEnabled = true;
-      scrollTitleEnabled = true;
-      clockCompactMode = false;
-      focusedWindowCompactMode = false;
-      runningAppsCompactMode = true;
-      keyboardLayoutNameCompactMode = false;
-      runningAppsCurrentWorkspace = false;
-      runningAppsGroupByApp = true;
-      centeringMode = "geometric";
-
-      clockDateFormat = "yyyy-MM-dd";
-      lockDateFormat = "";
-      mediaSize = 1;
-
-      appLauncherViewMode = "list";
-      spotlightModalViewMode = "list";
-      sortAppsAlphabetically = false;
-      appLauncherGridColumns = 4;
-      spotlightCloseNiriOverview = true;
-      niriOverviewOverlayEnabled = true;
-      useAutoLocation = true;
-      weatherEnabled = true;
-
-      networkPreference = "auto";
-      vpnLastConnected = "";
-      iconTheme = "System Default";
-
-      launcherLogoMode = "os";
-      launcherLogoCustomPath = "";
-      launcherLogoColorOverride = "";
-      launcherLogoColorInvertOnMode = false;
-      launcherLogoBrightness = 0.5;
-      launcherLogoContrast = 1;
-      launcherLogoSizeOffset = 0;
-
-      fontFamily = "Inter Variable";
-      monoFontFamily = "Fira Code";
-      fontWeight = 400;
-      fontScale = 1;
-
-      notepadUseMonospace = true;
-      notepadFontFamily = "";
-      notepadFontSize = 14;
-      notepadShowLineNumbers = false;
-      notepadTransparencyOverride = -1;
-      notepadLastCustomTransparency = 0.7;
-
-      soundsEnabled = true;
-      useSystemSoundTheme = false;
-      soundNewNotification = true;
-      soundVolumeChanged = true;
-      soundPluggedIn = true;
-
-      acMonitorTimeout = 0;
-      acLockTimeout = 0;
-      acSuspendTimeout = 0;
-      acSuspendBehavior = 0;
-      acProfileName = "";
-
-      batteryMonitorTimeout = 0;
-      batteryLockTimeout = 0;
-      batterySuspendTimeout = 0;
-      batterySuspendBehavior = 0;
-      batteryProfileName = "";
-
-      lockBeforeSuspend = false;
-      loginctlLockIntegration = true;
-      fadeToLockEnabled = false;
-      fadeToLockGracePeriod = 5;
-      launchPrefix = "";
-
-      brightnessDevicePins = {};
-      wifiNetworkPins = {};
-      bluetoothDevicePins = {};
-      audioInputDevicePins = {};
-      audioOutputDevicePins = {};
-
-      gtkThemingEnabled = false;
-      qtThemingEnabled = false;
-      syncModeWithPortal = true;
-      terminalsAlwaysDark = true;
-
-      showDock = false;
-      dockAutoHide = true;
-      dockGroupByApp = true;
-      dockOpenOnOverview = false;
-      dockPosition = 1;
-      dockSpacing = 3;
-      dockBottomGap = -16;
-      dockMargin = 2;
-      dockIconSize = 45;
-      dockIndicatorStyle = "circle";
-      dockBorderEnabled = true;
-      dockBorderColor = "primary";
-      dockBorderOpacity = 0.2;
-      dockBorderThickness = 2;
-
-      notificationOverlayEnabled = false;
-      modalDarkenBackground = true;
-      lockScreenShowPowerActions = true;
-      enableFprint = false;
-      maxFprintTries = 15;
-      lockScreenActiveMonitor = "all";
-      lockScreenInactiveColor = "#000000";
-      hideBrightnessSlider = false;
-
-      notificationTimeoutLow = 5000;
-      notificationTimeoutNormal = 5000;
-      notificationTimeoutCritical = 0;
-      notificationPopupPosition = 0;
-
-      osdAlwaysShowValue = false;
-      osdPosition = 5;
-      osdVolumeEnabled = true;
-      osdMediaVolumeEnabled = true;
-      osdBrightnessEnabled = true;
-      osdIdleInhibitorEnabled = true;
-      osdMicMuteEnabled = true;
-      osdCapsLockEnabled = true;
-      osdPowerProfileEnabled = false;
-      osdAudioOutputEnabled = true;
-
-      powerActionConfirm = true;
-      powerActionHoldDuration = 0.5;
-      powerMenuActions = ["reboot" "logout" "poweroff" "lock" "suspend" "restart"];
-      powerMenuDefaultAction = "logout";
-      powerMenuGridLayout = false;
-
-      customPowerActionLock = "";
-      customPowerActionLogout = "";
-      customPowerActionSuspend = "";
-      customPowerActionHibernate = "";
-      customPowerActionReboot = "";
-      customPowerActionPowerOff = "";
-
-      updaterUseCustomCommand = false;
-      updaterCustomCommand = "";
-      updaterTerminalAdditionalParams = "";
-
-      displayNameMode = "model";
-
-      showOnLastDisplay = {
-        dock = true;
   };
 
-      barConfigs = [
+  # Detach store symlink so UI edits survive rebuilds; seed defaults only on a fresh profile.
-        {
+  home.activation.dmsMaterializeSettings = lib.hm.dag.entryBefore [ "writeBoundary" ] ''
-          id = "default";
+    settingsFile=${lib.escapeShellArg dmsSettingsPath}
-          name = "Main Bar";
+    if [ -L "$settingsFile" ]; then
-          enabled = true;
+      mkdir -p "$(dirname "$settingsFile")"
-          position = 0;
+      ${pkgs.coreutils}/bin/cp --remove-destination -L "$settingsFile" "$settingsFile"
-          screenPreferences = ["all"];
+    fi
-          showOnLastDisplay = true;
+  '';
 
-          leftWidgets = [
+  home.activation.dmsSeedSettings = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-            {
+    settingsFile=${lib.escapeShellArg dmsSettingsPath}
-              id = "launcherButton";
+    mkdir -p "$(dirname "$settingsFile")"
-              enabled = true;
+    if [ ! -e "$settingsFile" ]; then
-            }
+      ${pkgs.coreutils}/bin/cp ${lib.escapeShellArg dmsSeedFile} "$settingsFile"
-            {
+      chmod u+w "$settingsFile"
-              id = "nixMonitor";
+    fi
-              enabled = true;
+  '';
-            }
-            {
-              id = "cpuUsage";
-              enabled = true;
-            }
-            {
-              id = "cpuTemp";
-              enabled = true;
-            }
-          ]
-          ++ lib.optionals gpuTempEnabled [
-            {
-              id = "gpuTemp";
-              enabled = true;
-              selectedGpuIndex = 0;
-              pciId = "10de:1f07";
-            }
-          ]
-          ++ [
-            {
-              id = "memUsage";
-              enabled = true;
-            }
-            {
-              id = "music";
-              enabled = false;
-            }
-            {
-              id = "focusedWindow";
-              enabled = false;
-            }
-          ];
-
-          centerWidgets = [
-            {
-              id = "privacyIndicator";
-              enabled = false;
-            }
-            {
-              id = "workspaceSwitcher";
-              enabled = true;
-            }
-            {
-              id = "privacyIndicator";
-              enabled = true;
-            }
-          ];
-
-          rightWidgets = cfg.extraRightBarWidgets
-          ++ [
-            {
-              id = "systemTray";
-              enabled = true;
-            }
-            {
-              id = "notificationButton";
-              enabled = true;
-            }
-            {
-              id = "battery";
-              enabled = true;
-            }
-            {
-              id = "controlCenterButton";
-              enabled = true;
-            }
-            {
-              id = "clock";
-              enabled = true;
-              clockCompactMode = false;
-            }
-          ];
-
-          spacing = 0;
-          innerPadding = 4;
-          bottomGap = -4;
-          transparency = 0;
-          widgetTransparency = 0.45;
-          squareCorners = true;
-          noBackground = false;
-          gothCornersEnabled = true;
-          gothCornerRadiusOverride = false;
-          gothCornerRadiusValue = 12;
-          borderEnabled = false;
-          borderColor = "primary";
-          borderOpacity = 1;
-          borderThickness = 1;
-          widgetOutlineEnabled = true;
-          widgetOutlineColor = "secondary";
-          widgetOutlineOpacity = 0.25;
-          widgetOutlineThickness = 2;
-          fontScale = 1;
-          autoHide = false;
-          autoHideDelay = 250;
-          openOnOverview = false;
-          visible = true;
-          popupGapsAuto = true;
-          popupGapsManual = 22;
-          maximizeDetection = true;
-        }
-      ];
-
-      configVersion = 2;
-    };
-  };
 
   # matugen won't create missing output_path parents; run before DMS theme generation.
   systemd.user.services.dms.serviceConfig.ExecStartPre =
@@ -582,12 +250,6 @@ in {
     input_path = '${home}/.config/matugen/templates/hyprland-colors.conf'
     output_path = '${home}/.config/hypr/colors.conf'
     ''
-    + ''
-
-    [templates.kdeglobals]
-    input_path = '${home}/.config/matugen/templates/kdeglobals.conf'
-    output_path = '${home}/.config/kdeglobals'
-    ''
     + lib.optionalString ohMyPoshEnabled ''
 
     [templates.ohmyposh]
@@ -612,10 +274,6 @@ in {
     )
     ;
 
-  home.activation.dmsEnsureMatugenOutputDirs = lib.hm.dag.entryAfter ["writeBoundary"] ''
-    ${ensureMatugenOutputDirsScript}
-  '';
-
   # Obsidian snippet dirs for matugen: mkdir here instead of tmpfiles (no chmod fights on weird mounts).
   home.activation.dmsEnsureObsidianSnippetDirs = lib.hm.dag.entryAfter ["writeBoundary"] (
     let
@@ -669,97 +327,6 @@ in {
     }
   '';
 
-  # matugen template → KDE globals file used by KDE/Qt apps (e.g. Dolphin).
-  # Uses DMS-provided matugen color variables; keep `.default` for mode-aware colors.
-  xdg.configFile."matugen/templates/kdeglobals.conf".text = ''
-    [General]
-    ColorScheme=DMSDynamic
-    TerminalApplication=kitty
-    TerminalService=kitty.desktop
-
-    # Keep Qt/KDE app icons on WhiteSur (this is what Dolphin reads via KDE config)
-    [Icons]
-    Theme=WhiteSur-dark
-
-    [Colors:Window]
-    BackgroundNormal=#{{colors.background.default.hex_stripped}}
-    BackgroundAlternate=#{{colors.surface.default.hex_stripped}}
-    DecorationFocus=#{{colors.primary.default.hex_stripped}}
-    DecorationHover=#{{colors.secondary.default.hex_stripped}}
-    ForegroundNormal=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundInactive=#{{colors.on_surface_variant.default.hex_stripped}}
-    ForegroundActive=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundLink=#{{colors.primary.default.hex_stripped}}
-    ForegroundVisited=#{{colors.tertiary.default.hex_stripped}}
-    ForegroundNegative=#{{colors.error.default.hex_stripped}}
-    ForegroundNeutral=#{{colors.secondary.default.hex_stripped}}
-    ForegroundPositive=#{{colors.primary.default.hex_stripped}}
-
-    [Colors:View]
-    BackgroundNormal=#{{colors.background.default.hex_stripped}}
-    BackgroundAlternate=#{{colors.surface.default.hex_stripped}}
-    DecorationFocus=#{{colors.primary.default.hex_stripped}}
-    DecorationHover=#{{colors.secondary.default.hex_stripped}}
-    ForegroundNormal=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundInactive=#{{colors.on_surface_variant.default.hex_stripped}}
-    ForegroundActive=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundLink=#{{colors.primary.default.hex_stripped}}
-    ForegroundVisited=#{{colors.tertiary.default.hex_stripped}}
-    ForegroundNegative=#{{colors.error.default.hex_stripped}}
-    ForegroundNeutral=#{{colors.secondary.default.hex_stripped}}
-    ForegroundPositive=#{{colors.primary.default.hex_stripped}}
-
-    [Colors:Button]
-    BackgroundNormal=#{{colors.surface.default.hex_stripped}}
-    BackgroundAlternate=#{{colors.surface_variant.default.hex_stripped}}
-    DecorationFocus=#{{colors.primary.default.hex_stripped}}
-    DecorationHover=#{{colors.secondary.default.hex_stripped}}
-    ForegroundNormal=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundInactive=#{{colors.on_surface_variant.default.hex_stripped}}
-    ForegroundActive=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundLink=#{{colors.primary.default.hex_stripped}}
-    ForegroundVisited=#{{colors.tertiary.default.hex_stripped}}
-    ForegroundNegative=#{{colors.error.default.hex_stripped}}
-    ForegroundNeutral=#{{colors.secondary.default.hex_stripped}}
-    ForegroundPositive=#{{colors.primary.default.hex_stripped}}
-
-    [Colors:Selection]
-    BackgroundNormal=#{{colors.primary.default.hex_stripped}}
-    BackgroundAlternate=#{{colors.primary_container.default.hex_stripped}}
-    DecorationFocus=#{{colors.primary.default.hex_stripped}}
-    DecorationHover=#{{colors.secondary.default.hex_stripped}}
-    ForegroundNormal=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundInactive=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundActive=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundLink=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundVisited=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundNegative=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundNeutral=#{{colors.on_primary.default.hex_stripped}}
-    ForegroundPositive=#{{colors.on_primary.default.hex_stripped}}
-
-    [Colors:Tooltip]
-    BackgroundNormal=#{{colors.surface_variant.default.hex_stripped}}
-    BackgroundAlternate=#{{colors.surface.default.hex_stripped}}
-    DecorationFocus=#{{colors.primary.default.hex_stripped}}
-    DecorationHover=#{{colors.secondary.default.hex_stripped}}
-    ForegroundNormal=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundInactive=#{{colors.on_surface_variant.default.hex_stripped}}
-    ForegroundActive=#{{colors.on_surface.default.hex_stripped}}
-    ForegroundLink=#{{colors.primary.default.hex_stripped}}
-    ForegroundVisited=#{{colors.tertiary.default.hex_stripped}}
-    ForegroundNegative=#{{colors.error.default.hex_stripped}}
-    ForegroundNeutral=#{{colors.secondary.default.hex_stripped}}
-    ForegroundPositive=#{{colors.primary.default.hex_stripped}}
-
-    [WM]
-    activeBackground=#{{colors.background.default.hex_stripped}}
-    activeBlend=#{{colors.background.default.hex_stripped}}
-    activeForeground=#{{colors.on_surface.default.hex_stripped}}
-    inactiveBackground=#{{colors.background.default.hex_stripped}}
-    inactiveBlend=#{{colors.background.default.hex_stripped}}
-    inactiveForeground=#{{colors.on_surface_variant.default.hex_stripped}}
-  '';
-
   # matugen → Oh My Posh JSON; hex in the base theme swapped for matugen tokens.
   xdg.configFile."matugen/templates/ohmyposh-theme.omp.json".text = ''
     {

modules/hosts/14900k/_private/dms-default-settings.json

@@ -0,0 +1,678 @@
+{
+  "currentThemeName": "dynamic",
+  "currentThemeCategory": "generic",
+  "customThemeFile": "",
+  "registryThemeVariants": {},
+  "matugenScheme": "scheme-tonal-spot",
+  "runUserMatugenTemplates": true,
+  "matugenTargetMonitor": "",
+  "popupTransparency": 1,
+  "dockTransparency": 1,
+  "widgetBackgroundColor": "sch",
+  "widgetColorMode": "default",
+  "controlCenterTileColorMode": "primary",
+  "buttonColorMode": "primary",
+  "cornerRadius": 12,
+  "niriLayoutGapsOverride": -1,
+  "niriLayoutRadiusOverride": -1,
+  "niriLayoutBorderSize": -1,
+  "hyprlandLayoutGapsOverride": -1,
+  "hyprlandLayoutRadiusOverride": -1,
+  "hyprlandLayoutBorderSize": -1,
+  "mangoLayoutGapsOverride": -1,
+  "mangoLayoutRadiusOverride": -1,
+  "mangoLayoutBorderSize": -1,
+  "use24HourClock": false,
+  "showSeconds": true,
+  "padHours12Hour": false,
+  "useFahrenheit": false,
+  "windSpeedUnit": "kmh",
+  "nightModeEnabled": false,
+  "animationSpeed": 1,
+  "customAnimationDuration": 500,
+  "syncComponentAnimationSpeeds": true,
+  "popoutAnimationSpeed": 1,
+  "popoutCustomAnimationDuration": 150,
+  "modalAnimationSpeed": 1,
+  "modalCustomAnimationDuration": 150,
+  "enableRippleEffects": true,
+  "blurEnabled": false,
+  "blurForegroundLayers": true,
+  "blurLayerOutlineOpacity": 0.12,
+  "blurBorderColor": "outline",
+  "blurBorderCustomColor": "#ffffff",
+  "blurBorderOpacity": 0.35,
+  "wallpaperFillMode": "Fill",
+  "blurredWallpaperLayer": false,
+  "blurWallpaperOnOverview": false,
+  "showLauncherButton": true,
+  "showWorkspaceSwitcher": true,
+  "showFocusedWindow": true,
+  "showWeather": true,
+  "showMusic": true,
+  "showClipboard": true,
+  "showCpuUsage": true,
+  "showMemUsage": true,
+  "showCpuTemp": true,
+  "showGpuTemp": true,
+  "selectedGpuIndex": 0,
+  "enabledGpuPciIds": [],
+  "showSystemTray": true,
+  "systemTrayIconTintMode": "none",
+  "systemTrayIconTintSaturation": 50,
+  "systemTrayIconTintStrength": 135,
+  "showClock": true,
+  "showNotificationButton": true,
+  "showBattery": true,
+  "showControlCenterButton": true,
+  "showCapsLockIndicator": true,
+  "controlCenterShowNetworkIcon": true,
+  "controlCenterShowBluetoothIcon": true,
+  "controlCenterShowAudioIcon": true,
+  "controlCenterShowAudioPercent": false,
+  "controlCenterShowVpnIcon": true,
+  "controlCenterShowBrightnessIcon": false,
+  "controlCenterShowBrightnessPercent": false,
+  "controlCenterShowMicIcon": false,
+  "controlCenterShowMicPercent": false,
+  "controlCenterShowBatteryIcon": false,
+  "controlCenterShowPrinterIcon": false,
+  "controlCenterShowScreenSharingIcon": true,
+  "showPrivacyButton": true,
+  "privacyShowMicIcon": false,
+  "privacyShowCameraIcon": false,
+  "privacyShowScreenShareIcon": false,
+  "controlCenterWidgets": [
+    {
+      "id": "volumeSlider",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "brightnessSlider",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "wifi",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "bluetooth",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "audioOutput",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "audioInput",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "nightMode",
+      "enabled": true,
+      "width": 50
+    },
+    {
+      "id": "darkMode",
+      "enabled": true,
+      "width": 50
+    }
+  ],
+  "showWorkspaceIndex": true,
+  "showWorkspaceName": false,
+  "showWorkspacePadding": false,
+  "workspaceScrolling": false,
+  "showWorkspaceApps": true,
+  "workspaceDragReorder": true,
+  "maxWorkspaceIcons": 9,
+  "workspaceAppIconSizeOffset": 1,
+  "groupWorkspaceApps": true,
+  "workspaceFollowFocus": false,
+  "showOccupiedWorkspacesOnly": true,
+  "reverseScrolling": false,
+  "dwlShowAllTags": false,
+  "workspaceColorMode": "default",
+  "workspaceOccupiedColorMode": "none",
+  "workspaceUnfocusedColorMode": "default",
+  "workspaceUrgentColorMode": "default",
+  "workspaceFocusedBorderEnabled": false,
+  "workspaceFocusedBorderColor": "primary",
+  "workspaceFocusedBorderThickness": 2,
+  "workspaceNameIcons": {},
+  "waveProgressEnabled": true,
+  "scrollTitleEnabled": true,
+  "audioVisualizerEnabled": true,
+  "audioScrollMode": "volume",
+  "audioWheelScrollAmount": 5,
+  "clockCompactMode": false,
+  "focusedWindowCompactMode": false,
+  "runningAppsCompactMode": true,
+  "barMaxVisibleApps": 0,
+  "barMaxVisibleRunningApps": 0,
+  "barShowOverflowBadge": true,
+  "appsDockHideIndicators": false,
+  "appsDockColorizeActive": false,
+  "appsDockActiveColorMode": "primary",
+  "appsDockEnlargeOnHover": false,
+  "appsDockEnlargePercentage": 125,
+  "appsDockIconSizePercentage": 100,
+  "keyboardLayoutNameCompactMode": false,
+  "runningAppsCurrentWorkspace": true,
+  "runningAppsGroupByApp": false,
+  "runningAppsCurrentMonitor": false,
+  "appIdSubstitutions": [
+    {
+      "pattern": "Spotify",
+      "replacement": "spotify",
+      "type": "exact"
+    },
+    {
+      "pattern": "beepertexts",
+      "replacement": "beeper",
+      "type": "exact"
+    },
+    {
+      "pattern": "home assistant desktop",
+      "replacement": "homeassistant-desktop",
+      "type": "exact"
+    },
+    {
+      "pattern": "com.transmissionbt.transmission",
+      "replacement": "transmission-gtk",
+      "type": "contains"
+    },
+    {
+      "pattern": "^steam_app_(\\d+)$",
+      "replacement": "steam_icon_$1",
+      "type": "regex"
+    }
+  ],
+  "centeringMode": "index",
+  "clockDateFormat": "dddd, MMMM d",
+  "lockDateFormat": "dddd, MMMM d",
+  "greeterRememberLastSession": true,
+  "greeterRememberLastUser": true,
+  "greeterEnableFprint": false,
+  "greeterEnableU2f": false,
+  "greeterWallpaperPath": "",
+  "mediaSize": 1,
+  "appLauncherViewMode": "list",
+  "spotlightModalViewMode": "list",
+  "browserPickerViewMode": "grid",
+  "browserUsageHistory": {},
+  "appPickerViewMode": "grid",
+  "filePickerUsageHistory": {},
+  "sortAppsAlphabetically": false,
+  "appLauncherGridColumns": 4,
+  "spotlightCloseNiriOverview": true,
+  "spotlightSectionViewModes": {},
+  "appDrawerSectionViewModes": {},
+  "niriOverviewOverlayEnabled": true,
+  "dankLauncherV2Size": "compact",
+  "dankLauncherV2BorderEnabled": false,
+  "dankLauncherV2BorderThickness": 2,
+  "dankLauncherV2BorderColor": "primary",
+  "dankLauncherV2ShowFooter": true,
+  "dankLauncherV2UnloadOnClose": false,
+  "useAutoLocation": false,
+  "weatherEnabled": true,
+  "networkPreference": "auto",
+  "iconTheme": "WhiteSur-dark",
+  "cursorSettings": {
+    "theme": "System Default",
+    "size": 24,
+    "niri": {
+      "hideWhenTyping": false,
+      "hideAfterInactiveMs": 0
+    },
+    "hyprland": {
+      "hideOnKeyPress": false,
+      "hideOnTouch": false,
+      "inactiveTimeout": 0
+    },
+    "dwl": {
+      "cursorHideTimeout": 0
+    }
+  },
+  "launcherLogoMode": "apps",
+  "launcherLogoCustomPath": "",
+  "launcherLogoColorOverride": "",
+  "launcherLogoColorInvertOnMode": false,
+  "launcherLogoBrightness": 0.5,
+  "launcherLogoContrast": 1,
+  "launcherLogoSizeOffset": 0,
+  "fontFamily": "Inter Variable",
+  "monoFontFamily": "Fira Code",
+  "fontWeight": 400,
+  "fontScale": 1,
+  "notepadUseMonospace": true,
+  "notepadFontFamily": "",
+  "notepadFontSize": 14,
+  "notepadShowLineNumbers": false,
+  "notepadTransparencyOverride": -1,
+  "notepadLastCustomTransparency": 0.7,
+  "soundsEnabled": true,
+  "useSystemSoundTheme": false,
+  "soundNewNotification": true,
+  "soundVolumeChanged": true,
+  "soundPluggedIn": true,
+  "acMonitorTimeout": 0,
+  "acLockTimeout": 0,
+  "acSuspendTimeout": 0,
+  "acSuspendBehavior": 0,
+  "acProfileName": "",
+  "batteryMonitorTimeout": 0,
+  "batteryLockTimeout": 0,
+  "batterySuspendTimeout": 0,
+  "batterySuspendBehavior": 0,
+  "batteryProfileName": "",
+  "batteryChargeLimit": 100,
+  "lockBeforeSuspend": false,
+  "loginctlLockIntegration": true,
+  "fadeToLockEnabled": true,
+  "fadeToLockGracePeriod": 5,
+  "fadeToDpmsEnabled": true,
+  "fadeToDpmsGracePeriod": 5,
+  "launchPrefix": "",
+  "brightnessDevicePins": {},
+  "wifiNetworkPins": {},
+  "bluetoothDevicePins": {},
+  "audioInputDevicePins": {},
+  "audioOutputDevicePins": {},
+  "gtkThemingEnabled": true,
+  "qtThemingEnabled": true,
+  "syncModeWithPortal": true,
+  "terminalsAlwaysDark": true,
+  "muxType": "tmux",
+  "muxUseCustomCommand": false,
+  "muxCustomCommand": "",
+  "muxSessionFilter": "",
+  "runDmsMatugenTemplates": true,
+  "matugenTemplateGtk": true,
+  "matugenTemplateNiri": true,
+  "matugenTemplateHyprland": true,
+  "matugenTemplateMangowc": true,
+  "matugenTemplateQt5ct": true,
+  "matugenTemplateQt6ct": true,
+  "matugenTemplateFirefox": true,
+  "matugenTemplatePywalfox": true,
+  "matugenTemplateZenBrowser": true,
+  "matugenTemplateVesktop": false,
+  "matugenTemplateEquibop": true,
+  "matugenTemplateGhostty": true,
+  "matugenTemplateKitty": true,
+  "matugenTemplateFoot": true,
+  "matugenTemplateAlacritty": true,
+  "matugenTemplateNeovim": false,
+  "matugenTemplateWezterm": true,
+  "matugenTemplateDgop": true,
+  "matugenTemplateKcolorscheme": true,
+  "matugenTemplateVscode": true,
+  "matugenTemplateEmacs": true,
+  "matugenTemplateZed": true,
+  "showDock": false,
+  "dockAutoHide": false,
+  "dockSmartAutoHide": false,
+  "dockGroupByApp": false,
+  "dockOpenOnOverview": false,
+  "dockPosition": 1,
+  "dockSpacing": 4,
+  "dockBottomGap": 0,
+  "dockMargin": 0,
+  "dockIconSize": 40,
+  "dockIndicatorStyle": "circle",
+  "dockBorderEnabled": false,
+  "dockBorderColor": "surfaceText",
+  "dockBorderOpacity": 1,
+  "dockBorderThickness": 1,
+  "dockIsolateDisplays": false,
+  "dockLauncherEnabled": false,
+  "dockLauncherLogoMode": "apps",
+  "dockLauncherLogoCustomPath": "",
+  "dockLauncherLogoColorOverride": "",
+  "dockLauncherLogoSizeOffset": 0,
+  "dockLauncherLogoBrightness": 0.5,
+  "dockLauncherLogoContrast": 1,
+  "dockMaxVisibleApps": 0,
+  "dockMaxVisibleRunningApps": 0,
+  "dockShowOverflowBadge": true,
+  "notificationOverlayEnabled": false,
+  "notificationPopupShadowEnabled": true,
+  "notificationPopupPrivacyMode": false,
+  "modalDarkenBackground": true,
+  "lockScreenShowPowerActions": true,
+  "lockScreenShowSystemIcons": true,
+  "lockScreenShowTime": true,
+  "lockScreenShowDate": true,
+  "lockScreenShowProfileImage": true,
+  "lockScreenShowPasswordField": true,
+  "lockScreenShowMediaPlayer": true,
+  "lockScreenPowerOffMonitorsOnLock": false,
+  "lockAtStartup": false,
+  "enableFprint": false,
+  "maxFprintTries": 15,
+  "enableU2f": false,
+  "u2fMode": "or",
+  "lockScreenActiveMonitor": "all",
+  "lockScreenInactiveColor": "#000000",
+  "lockScreenNotificationMode": 0,
+  "hideBrightnessSlider": false,
+  "notificationTimeoutLow": 5000,
+  "notificationTimeoutNormal": 5000,
+  "notificationTimeoutCritical": 0,
+  "notificationCompactMode": false,
+  "notificationPopupPosition": 0,
+  "notificationAnimationSpeed": 1,
+  "notificationCustomAnimationDuration": 400,
+  "notificationHistoryEnabled": true,
+  "notificationHistoryMaxCount": 50,
+  "notificationHistoryMaxAgeDays": 7,
+  "notificationHistorySaveLow": true,
+  "notificationHistorySaveNormal": true,
+  "notificationHistorySaveCritical": true,
+  "notificationRules": [],
+  "osdAlwaysShowValue": false,
+  "osdPosition": 5,
+  "osdVolumeEnabled": true,
+  "osdMediaVolumeEnabled": true,
+  "osdMediaPlaybackEnabled": false,
+  "osdBrightnessEnabled": true,
+  "osdIdleInhibitorEnabled": true,
+  "osdMicMuteEnabled": true,
+  "osdCapsLockEnabled": true,
+  "osdPowerProfileEnabled": false,
+  "osdAudioOutputEnabled": true,
+  "powerActionConfirm": true,
+  "powerActionHoldDuration": 0.5,
+  "powerMenuActions": [
+    "reboot",
+    "logout",
+    "poweroff",
+    "lock",
+    "suspend",
+    "restart"
+  ],
+  "powerMenuDefaultAction": "logout",
+  "powerMenuGridLayout": false,
+  "customPowerActionLock": "",
+  "customPowerActionLogout": "",
+  "customPowerActionSuspend": "",
+  "customPowerActionHibernate": "",
+  "customPowerActionReboot": "",
+  "customPowerActionPowerOff": "",
+  "updaterHideWidget": false,
+  "updaterUseCustomCommand": false,
+  "updaterCustomCommand": "",
+  "updaterTerminalAdditionalParams": "",
+  "displayNameMode": "system",
+  "screenPreferences": {},
+  "showOnLastDisplay": {},
+  "niriOutputSettings": {},
+  "hyprlandOutputSettings": {},
+  "displayProfiles": {},
+  "activeDisplayProfile": {},
+  "displayProfileAutoSelect": false,
+  "displayShowDisconnected": false,
+  "displaySnapToEdge": true,
+  "barConfigs": [
+    {
+      "bottomGap": 0,
+      "centerWidgets": [
+        {
+          "id": "unifiedTaskbar",
+          "enabled": true
+        }
+      ],
+      "enabled": true,
+      "id": "default",
+      "innerPadding": 4,
+      "leftWidgets": [
+        {
+          "id": "launcherButton",
+          "enabled": true
+        }
+      ],
+      "maximizeDetection": true,
+      "name": "Main Bar",
+      "position": 1,
+      "rightWidgets": [
+        {
+          "id": "clock",
+          "enabled": true
+        }
+      ],
+      "screenPreferences": [
+        "all"
+      ],
+      "showOnLastDisplay": true,
+      "spacing": 0,
+      "squareCorners": true,
+      "transparency": 1,
+      "visible": true,
+      "widgetTransparency": 0.45,
+      "gothCornersEnabled": true,
+      "borderEnabled": false,
+      "widgetOutlineEnabled": true,
+      "widgetOutlineOpacity": 0.4,
+      "widgetOutlineThickness": 2,
+      "fontScale": 1.1,
+      "iconScale": 1.1,
+      "autoHide": false,
+      "clickThrough": false,
+      "openOnOverview": false,
+      "widgetPadding": 12,
+      "popupGapsAuto": true,
+      "popupGapsManual": 4,
+      "noBackground": false,
+      "maximizeWidgetIcons": false,
+      "maximizeWidgetText": false,
+      "removeWidgetPadding": false,
+      "gothCornerRadiusOverride": false,
+      "widgetOutlineColor": "primary",
+      "shadowIntensity": 0
+    },
+    {
+      "id": "bar1781999813733",
+      "name": "Bar 2",
+      "enabled": true,
+      "position": 3,
+      "screenPreferences": [
+        {
+          "name": "DP-3",
+          "model": "34GL750"
+        }
+      ],
+      "showOnLastDisplay": false,
+      "leftWidgets": [
+        {
+          "id": "rbwLockToggle",
+          "enabled": true
+        },
+        {
+          "id": "cpuUsage",
+          "enabled": true,
+          "minimumWidth": true
+        },
+        {
+          "id": "cpuTemp",
+          "enabled": true,
+          "minimumWidth": true
+        },
+        {
+          "id": "memUsage",
+          "enabled": true,
+          "minimumWidth": true
+        },
+        {
+          "id": "gpuTemp",
+          "enabled": true,
+          "selectedGpuIndex": 0,
+          "pciId": "",
+          "minimumWidth": true
+        },
+        {
+          "id": "diskUsage",
+          "enabled": true,
+          "mountPath": "/"
+        }
+      ],
+      "centerWidgets": [
+        {
+          "id": "privacyIndicator",
+          "enabled": true
+        }
+      ],
+      "rightWidgets": [
+        {
+          "id": "homeAssistantMonitor",
+          "enabled": true
+        },
+        {
+          "id": "notificationButton",
+          "enabled": true
+        },
+        {
+          "id": "systemTray",
+          "enabled": true
+        },
+        {
+          "id": "controlCenterButton",
+          "enabled": true,
+          "showNetworkIcon": true,
+          "showBluetoothIcon": true,
+          "showAudioIcon": true,
+          "showAudioPercent": false,
+          "showVpnIcon": true,
+          "showBrightnessIcon": false,
+          "showBrightnessPercent": false,
+          "showMicIcon": false,
+          "showMicPercent": false,
+          "showBatteryIcon": false,
+          "showPrinterIcon": false,
+          "showScreenSharingIcon": true
+        }
+      ],
+      "spacing": 0,
+      "innerPadding": 4,
+      "bottomGap": 0,
+      "transparency": 1,
+      "widgetTransparency": 0.45,
+      "squareCorners": true,
+      "noBackground": false,
+      "gothCornersEnabled": true,
+      "gothCornerRadiusOverride": false,
+      "gothCornerRadiusValue": 12,
+      "borderEnabled": false,
+      "borderColor": "surfaceText",
+      "borderOpacity": 1,
+      "borderThickness": 1,
+      "widgetOutlineEnabled": true,
+      "widgetOutlineColor": "primary",
+      "widgetOutlineOpacity": 0.4,
+      "widgetOutlineThickness": 2,
+      "widgetPadding": 12,
+      "maximizeWidgetIcons": false,
+      "maximizeWidgetText": false,
+      "removeWidgetPadding": false,
+      "fontScale": 1.1,
+      "iconScale": 1.1,
+      "autoHide": false,
+      "autoHideDelay": 250,
+      "showOnWindowsOpen": false,
+      "openOnOverview": false,
+      "visible": false,
+      "popupGapsAuto": true,
+      "popupGapsManual": 4,
+      "maximizeDetection": true,
+      "scrollEnabled": true,
+      "scrollXBehavior": "column",
+      "scrollYBehavior": "workspace",
+      "shadowIntensity": 0,
+      "shadowOpacity": 60,
+      "shadowColorMode": "text",
+      "shadowCustomColor": "#000000"
+    }
+  ],
+  "desktopClockEnabled": false,
+  "desktopClockStyle": "analog",
+  "desktopClockTransparency": 0.8,
+  "desktopClockColorMode": "primary",
+  "desktopClockCustomColor": {
+    "r": 1,
+    "g": 1,
+    "b": 1,
+    "a": 1,
+    "hsvHue": -1,
+    "hsvSaturation": 0,
+    "hsvValue": 1,
+    "hslHue": -1,
+    "hslSaturation": 0,
+    "hslLightness": 1,
+    "valid": true
+  },
+  "desktopClockShowDate": true,
+  "desktopClockShowAnalogNumbers": false,
+  "desktopClockShowAnalogSeconds": true,
+  "desktopClockX": -1,
+  "desktopClockY": -1,
+  "desktopClockWidth": 280,
+  "desktopClockHeight": 180,
+  "desktopClockDisplayPreferences": [
+    "all"
+  ],
+  "systemMonitorEnabled": false,
+  "systemMonitorShowHeader": true,
+  "systemMonitorTransparency": 0.8,
+  "systemMonitorColorMode": "primary",
+  "systemMonitorCustomColor": {
+    "r": 1,
+    "g": 1,
+    "b": 1,
+    "a": 1,
+    "hsvHue": -1,
+    "hsvSaturation": 0,
+    "hsvValue": 1,
+    "hslHue": -1,
+    "hslSaturation": 0,
+    "hslLightness": 1,
+    "valid": true
+  },
+  "systemMonitorShowCpu": true,
+  "systemMonitorShowCpuGraph": true,
+  "systemMonitorShowCpuTemp": true,
+  "systemMonitorShowGpuTemp": false,
+  "systemMonitorGpuPciId": "",
+  "systemMonitorShowMemory": true,
+  "systemMonitorShowMemoryGraph": true,
+  "systemMonitorShowNetwork": true,
+  "systemMonitorShowNetworkGraph": true,
+  "systemMonitorShowDisk": true,
+  "systemMonitorShowTopProcesses": false,
+  "systemMonitorTopProcessCount": 3,
+  "systemMonitorTopProcessSortBy": "cpu",
+  "systemMonitorGraphInterval": 60,
+  "systemMonitorLayoutMode": "auto",
+  "systemMonitorX": -1,
+  "systemMonitorY": -1,
+  "systemMonitorWidth": 320,
+  "systemMonitorHeight": 480,
+  "systemMonitorDisplayPreferences": [
+    "all"
+  ],
+  "systemMonitorVariants": [],
+  "desktopWidgetPositions": {},
+  "desktopWidgetGridSettings": {},
+  "desktopWidgetInstances": [],
+  "desktopWidgetGroups": [],
+  "builtInPluginSettings": {},
+  "clipboardEnterToPaste": false,
+  "launcherPluginVisibility": {},
+  "launcherPluginOrder": [],
+  "configVersion": 5
+}

modules/hosts/14900k/configuration.nix

@@ -24,26 +24,11 @@
         ./_private/moonfin-flatpak.nix
       ];
 
-      sops = {
-        defaultSopsFile = ../../../secrets/secrets.yaml;
-        defaultSopsFormat = "yaml";
-        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-
-      sops.secrets."caching/attic/token" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-
-      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
-      sops.secrets."swiftshare/API_KEY" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
      services.cloudflare-warp.enable = true;
 
+      boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
+      boot.kernel.sysctl."fs.inotify.max_user_instances" = 2048;
+
       # Intel iGPU video acceleration (VA-API / QSV via oneVPL).
       # This fixes common NixOS issues like `vaInitialize failed` and missing QSV encoders in apps.
       hardware.graphics = {
@@ -85,6 +70,7 @@ services.cloudflare-warp.enable = true;
             ".#14900k"
           ];
           enableRbwLockToggle = true;
+          defaultSettingsFile = ./_private/dms-default-settings.json;
         };
       };
 

modules/hosts/client-services.nix

@@ -23,5 +23,37 @@
     services.printing.enable = true;
     security.polkit.enable = true;
     services.udisks2.enable = true;
+
+    sops = {
+      defaultSopsFile = ../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    };
+
+    sops.secrets."caching/attic/token" = {
+      owner = "olivier";
+      group = "users";
+      mode = "0400";
+    };
+
+    sops.secrets."swiftshare/API_KEY" = {
+      owner = "olivier";
+      group = "users";
+      mode = "0400";
+    };
+
+    sops.secrets."home-assistant/auth-token" = {
+      owner = "olivier";
+      group = "users";
+      mode = "0400";
+    };
+
+    sops.secrets."gitcrypt/personal-docs-key" = {
+      sopsFile = ../../secrets/gitcrypt-personal-docs-key;
+      format = "binary";
+      owner = "olivier";
+      group = "users";
+      mode = "0400";
+    };
   };
 }

modules/hosts/desktop-home-base.nix

@@ -24,6 +24,9 @@
                 };
               };
 
+              #TODO[epic=Moderate] Check if git-crypt should belong in desktop-home-base.
+              home.packages = [ pkgs.git-crypt ];
+
               chiasson.home = {
                 # Catalog of `chiasson.home.*` toggles — host `home.nix` sets `enable = true` to override `mkDefault false`.
                 shell = {
@@ -34,7 +37,7 @@
 
                 terminals.kitty.enable = lib.mkDefault true;
 
-                filebrowsers.dolphin.enable = lib.mkDefault true;
+                filebrowsers.nemo.enable = lib.mkDefault true;
 
                 browsers = {
                   chrome.enable = lib.mkDefault false;
@@ -77,7 +80,7 @@
                     enable = lib.mkDefault true;
                     swiftshareApiKeyFile = "/run/secrets/swiftshare/API_KEY"; #TODO[epic=sops] redo this by passing sops file output directly
                   };
-                  # WhiteSur GTK/icons, Phinger cursor, Qt via KDE platform theme; imports DMS matugen `dank-colors.css`.
+                  # WhiteSur GTK/icons, Phinger cursor, DMS matugen for GTK (+ qt6ct for Qt apps).
                   theming.enable = lib.mkDefault true;
                 };
 

modules/hosts/ideapad/configuration.nix

@@ -37,26 +37,6 @@
         ./_private/platform.nix
       ];
 
-      # ─────────────────────── Sops ───────────────────────
-      # `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash).
-      sops = {
-        defaultSopsFile = ../../../secrets/secrets.yaml;
-        defaultSopsFormat = "yaml";
-        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-
-      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
-      sops.secrets."caching/attic/token" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-      sops.secrets."swiftshare/API_KEY" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-
       # ─────────────────────── Mobile NixOS / firmware ───────────────────────
       # mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and
       # rebuilds Mobile NixOS' script-loader against the patched mruby.

modules/hosts/t2mbp/configuration.nix

@@ -19,25 +19,6 @@
         ./_private/firmware.nix
       ];
 
-      # ───────────────────────────── Sops (see repo secrets/.sops.yaml) ───────────
-      sops = {
-        defaultSopsFile = ../../../secrets/secrets.yaml;
-        defaultSopsFormat = "yaml";
-        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-
-      sops.secrets."caching/attic/token" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-
-      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
-      sops.secrets."swiftshare/API_KEY" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
       sops.secrets."tailscale/auth-key" = {
         mode = "0400";
       };

modules/hosts/uConsole/configuration.nix

@@ -42,24 +42,6 @@
         require-sigs = false;
       };
 
-      sops = {
-        defaultSopsFile = ../../../secrets/secrets.yaml;
-        defaultSopsFormat = "yaml";
-        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-
-      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
-      sops.secrets."caching/attic/token" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-      sops.secrets."swiftshare/API_KEY" = {
-        owner = "olivier";
-        group = "users";
-        mode = "0400";
-      };
-
       chiasson.system.librepods.enable = true;
       chiasson.system.palera1n.enable = true;
 

modules/ssh/home-manager/default.nix

@@ -55,7 +55,7 @@
         ];
       }
       {
-        home.packages = [ pkgs.rbw pkgs.pinentry-qt ];
+        home.packages = with pkgs; [ rbw pinentry-gtk2 ];
         home.sessionVariables.SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/rbw/ssh-agent-socket";
         home.file = inventory.mkIdentityFiles selectedHosts;
 
@@ -88,7 +88,7 @@ EOF
         };
 
         home.activation.rbwPinentryConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-          ${pkgs.rbw}/bin/rbw config set pinentry "${pkgs.pinentry-qt}/bin/pinentry-qt" >/dev/null 2>&1 || true
+          ${pkgs.rbw}/bin/rbw config set pinentry "${pkgs.pinentry-gtk2}/bin/pinentry-gtk-2" >/dev/null 2>&1 || true
         '';
       }
     ]);

modules/system/users/catalog-default.nix

@@ -2,8 +2,15 @@
 # Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc.
 { ... }: {
   flake.nixosModules.usersCatalogDefaults =
-    { config, ... }:
+    { config, lib, ... }:
+    let
+      olivierEnabled = lib.elem "olivier" config.chiasson.users.enabled;
+    in
     {
+      config.sops.secrets."users/olivier/hashedPassword" = lib.mkIf olivierEnabled {
+        neededForUsers = true;
+      };
+
       config.chiasson.users.catalog = {
         olivier = {
           isNormalUser = true;
@@ -24,9 +31,11 @@
             "input"
           ];
 
-          # Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.
+          # Declared in this module when olivier is in `chiasson.users.enabled`.
-          # With that, `.path` is under /run/secrets-for-users/… (sops-nix README).
+          # With `neededForUsers`, `.path` is under /run/secrets-for-users/… (sops-nix README).
-          hashedPasswordFile = config.sops.secrets."users/olivier/hashedPassword".path;
+          hashedPasswordFile = lib.mkIf olivierEnabled (
+            config.sops.secrets."users/olivier/hashedPassword".path
+          );
 
           homeManager = {
             enable = true;

modules/wisdom/desktop/gtk-qt-theming.nix

@@ -1,25 +1,24 @@
 { ... }: {
   flake.homeManagerModules.wisdomDesktopGtkQtTheming =
-    { config, lib, pkgs, ... }:
+    { config, lib, pkgs, osConfig ? { }, ... }:
     let
       root = config.chiasson.home;
       cfg = config.chiasson.home.desktop.theming;
+      dmsShell = (lib.attrByPath [ "chiasson" "desktop" "shell" ] null osConfig) == "dms";
+      qtPlatformTheme = if dmsShell then "qt6ct" else cfg.qt.platformTheme;
     in
     {
       options.chiasson.home.desktop.theming = {
         enable = lib.mkEnableOption ''
-          WhiteSur GTK + icon themes, Phinger cursor, and Qt via the KDE platform theme — same idea as
+          WhiteSur GTK + icon themes, Phinger cursor, and Qt via qt6ct (DMS) or KDE platform theme.
-          the old `home-shared.nix` stack for Hyprland/Niri (no full Plasma session required). Optional
+          Matugen accent colors load via gtk3/gtk4 extraCss when matugenGtkColors is enabled.
-          `dank-colors.css` import for DMS/matugen GTK accents.
         '';
 
         matugenGtkColors = lib.mkOption {
           type = lib.types.bool;
           default = true;
           description = ''
-            Add `@import url("dank-colors.css");` to gtk3/gtk4 extraCss. DMS/matugen writes
+            Add `@import url("dank-colors.css");` to gtk3/gtk4 extraCss (DMS matugen writes the file).
-            `~/.config/gtk-3.0` / `gtk-4.0` `dank-colors.css` when dynamic theming is on — disable if
-            you use this module without DMS.
           '';
         };
 
@@ -65,23 +64,30 @@
             type = lib.types.str;
             default = "kde";
             description = ''
-              `QT_QPA_PLATFORMTHEME` (e.g. `kde` for Qt/KDE integration, matches previous flake).
+              `QT_QPA_PLATFORMTHEME` when not using DMS shell. DMS hosts use qt6ct automatically.
             '';
           };
           extraPackages = lib.mkOption {
             type = lib.types.listOf lib.types.package;
-            default = [ pkgs.whitesur-kde pkgs.qt6Packages.qt6ct ];
+            default = [ pkgs.kdePackages.qt6ct ];
-            description = "Extra packages (KDE look-and-feel + qt6ct GUI).";
+            description = "Qt platform integration packages.";
           };
         };
       };
 
       config = lib.mkIf (root.enable && cfg.enable) (lib.mkMerge [
         {
-          home.packages = cfg.qt.extraPackages;
+          home.packages =
+            if dmsShell then
+              [ pkgs.kdePackages.qt6ct ]
+            else
+              cfg.qt.extraPackages;
 
           home.sessionVariables = {
-            QT_QPA_PLATFORMTHEME = cfg.qt.platformTheme;
+            QT_QPA_PLATFORMTHEME = qtPlatformTheme;
+          }
+          // lib.optionalAttrs (qtPlatformTheme == "qt6ct") {
+            QT_QPA_PLATFORMTHEME_QT6 = "qt6ct";
           };
 
           home.pointerCursor = {

modules/wisdom/filebrowsers/dolphin.nix

@@ -1,76 +0,0 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomFilebrowsersDolphin =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = root.filebrowsers.dolphin;
-    in
-    {
-      options.chiasson.home.filebrowsers.dolphin.enable = lib.mkEnableOption "Dolphin + declarative dolphinrc.";
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ pkgs.kdePackages.dolphin ];
-
-        xdg.configFile."dolphinrc".text = ''
-          [ContentDisplay]
-          UsePermissionsFormat=CombinedFormat
-
-          [General]
-          StartupPath=~
-          DoubleClickViewAction=show_hidden_files
-          ShowFullPath=true
-          ShowFullPathInTitlebar=true
-          ShowStatusBar=FullWidth
-          UseTabForSwitchingSplitView=true
-          Version=202
-          ViewPropsTimestamp=2025,11,17,23,21,57.762
-
-          [KFileDialog Settings]
-          Places Icons Auto-resize=false
-          Places Icons Static Size=22
-
-          [MainWindow]
-          MenuBar=Disabled
-          ToolBarsMovable=Disabled
-
-          [PreviewSettings]
-          Plugins=appimagethumbnail,audiothumbnail,blenderthumbnail,comicbookthumbnail,cursorthumbnail,djvuthumbnail,ebookthumbnail,exrthumbnail,directorythumbnail,fontthumbnail,imagethumbnail,jpegthumbnail,kraorathumbnail,windowsexethumbnail,windowsimagethumbnail,mobithumbnail,opendocumentthumbnail,gsthumbnail,rawthumbnail,svgthumbnail,ffmpegthumbs
-
-          [IconsMode]
-          IconSize=48
-          PreviewSize=48
-          TextLines=2
-          UseThumbnails=true
-
-          [DetailsMode]
-          FontWeight=50
-          HighlightEntireRow=true
-
-          [ViewProperties]
-          Mode=1
-          ColumnWidths=50,50,50,50,50,50,50,50,50,50
-          SortColumn=0
-          SortOrder=0
-          SortFoldersFirst=true
-          SortHiddenLast=false
-          SortCaseSensitively=false
-          ShowPreviews=true
-          ShowInGroups=false
-          ShowFoldersFirst=true
-          ShowHiddenFilesLast=false
-          NaturalSorting=true
-
-          [ContextMenu]
-          ShowCopyToMenu=true
-          ShowMoveToMenu=true
-
-          [Search]
-          Location=Everywhere
-
-          [SettingsWindow]
-          SidebarWidth=180
-          SplitterState=AAAA/wAAAAD9AAAAAAAAAAAAAAABAAAAAQAAAAEAAAAAQAAAAEAAAAA=
-        '';
-      };
-    };
-}

modules/wisdom/filebrowsers/nemo.nix

@@ -0,0 +1,24 @@
+{ ... }: {
+  flake.homeManagerModules.wisdomFilebrowsersNemo =
+    { config, lib, pkgs, ... }:
+    let
+      root = config.chiasson.home;
+      cfg = root.filebrowsers.nemo;
+    in
+    {
+      options.chiasson.home.filebrowsers.nemo.enable = lib.mkEnableOption ''
+        Nemo file manager (GTK). Colors come from DMS matugen via GTK settings — no KDE/Qt bridge needed.
+      '';
+
+      config = lib.mkIf (root.enable && cfg.enable) {
+        home.packages = [pkgs.nemo];
+
+        xdg.mimeApps = {
+          enable = lib.mkDefault true;
+          defaultApplications = {
+            "inode/directory" = lib.mkDefault "nemo.desktop";
+          };
+        };
+      };
+    };
+}

secrets/gitcrypt-personal-docs-key

@@ -0,0 +1,31 @@
+{
+	"data": "ENC[AES256_GCM,data:Oz/nHP+4sv9NlVkZYorufEjlSwLWRtZdpHNXRz2+yBQmtRKUPdK+MHpgwdp350kWBX36Id7DztcY3uTYXPp+NSOQ+NYjngg8pkSK7JI3Avs89S5tmaFwj3L8ouDJpOpDX8djPmnYuoF9xp/ekAVGHJvQOfSeDlJkOb3wEDIEgmO+osYckb+FvWqyQiUWbbus13hkaqGSNFelu20OU1Y6F645NJ3oNUwgHg==,iv:izq1awBfohJNzRVuk5cyMAadAShxp8BmmYmS+QrdDkg=,tag:7+WHz+R4rabPlz4VQae97A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOREM4bldDTWlEd2VjZ3BS\nVFFURFQrYnlBWVN6c0sxWSs4cWI3ampkV2hnCmNuSm44WlFqOXcvdTZvcC9TSks0\nZGhmMkU5OTVZM1VGUlJBRTM5OEEzVkkKLS0tIFZhRitla3NLRHI1YmdnQ2o4ZHNN\nenRMdXJ4YTNNQWxZa2NYMmhRRGlZQVkKA9e88DRGxR7l+ppj72IGh/2KPzUVNkNT\nNuvDN7MAmKmc5zEe2njasINGvgtnnthwF6paLrp0YvJbyk/Ek9NfOQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yyzgmazjxkvwtfcv9re3lqmt2ru5dcrfu3sauysm0wzfwzvyap8qkjkq32"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYXk5eHhnK3k1ZmRYNDlv\nSmdZbXd0TjdXSnJTbnA5Ukw2R29vSWJ4REhZCmVVNWh2UWRrZUtQeDNtTTJiZEpE\nYi93TlVWWFhLRVJzNTNoajhKNVp3V2MKLS0tIGpsOExhSkFtL1VUeEdpYTNhNktp\nTWdTMHRhb21PRGVJYWg3WVpZd0RWU0kKPif0ZmG4gYPmGeFWczEDZcQJnHlSS7gJ\njX7GdkRGtu/of6JCHUhGHwSsrEvmjzAObPjF23RzFxpXp0jXfwFH0Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1elk6zwmcylwfk7gd4pjda7g29upftjvxys8py42s8d42jklnyv7s7dm9z2"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQUNsRE90NU9rR3VzMlh0\neExvaEZYQlZwZlNYdHEyb3RKbW40ZmIzdkJnCmE2eXFndExac2hKT0w5R250MEJ5\nZ1dpd1NHMzJ0K29aRFExZFFMMGRxc2sKLS0tIG5rSzhGNUttZ05Ddlk2SGh2azJ5\nL0pTSjhsUmMvK1lEdW8wZFlLSittN0EKCw7RzjJIks/0ND3lJH0w1x/CC0tCghij\nH+LUSvdArr04xG7MoNtVytmd7nxQueg+jRVdnenVwBOtmFQLOXfCEA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age193gw802ytal7h5p5q37kpd9079k2vsflzmnvupcwfxh2kjdrwqtsk3g6rm"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdlkxWElrYXBzb2dncjNp\nSjVWWnk2bjJhTDFuemdBaVhwcUVjbytxQjI0ClRUZHRmcisxRjExYVJHc1FtYjM2\naHR4TWpRbTdYcUtPckNibmluR2ZuNXcKLS0tIDZlVlZZZzRSMHQxdVRwbDhHQjdz\na2tvdFd0RXVKM1EySXR5UE9ocFRtaU0KRn1/A7TXpk8vF+xSsT6Zuk2dfiksiUd3\nzDoX84Fkmuh5t5ke0gkrn5o/O+kl2TnedueTUQrflzcVl9N8AQ7qzQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yr7vurfxc3w8ewfw9djfm54atw6ayze69qglamecuft5q0n9gu2sadsa2m"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa3M4cVJrOXl6Z2RxK3hZ\nTDQvWjY1MHJLaG1SVFJudytNMm5zVzdPaFJrCldvLytraVdZSjVCeE90N1lsUGJM\ndG9Pb0xBRWJ3QTNXeHhhbSt2QjZibkEKLS0tIEVFM0k1bUdPSUZuQ0UxTXMwL3ZS\nMThYQVFKZURROHRwRk8wYThHdkNJY28KWfUiwpne23NSmNKhR46lGHi1Jwy1H+4+\nFaiS3iCk4rNb0rBG+IOJ+BdVGKwKgpzTfsSsZzKupihJ9Nxd5YjLEg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hya7pgpe8zal52w3pjf036tpapmehedatfm4r84h30t4wuh079ssedfd37"
+			}
+		],
+		"lastmodified": "2026-06-20T08:39:02Z",
+		"mac": "ENC[AES256_GCM,data:KgRW3x6fcGtE4AVjl6kxyf0o4LhC/a8CanALLIR8CiXWfpiQ3pY8nja2y0hEThXRHGjxy53TdGBp/yanDd9gd45c0RYuUgD5zzMnebL4LgMw/7I1Ezw1BYnWp+rXm2he/40lb7rfxX3D9jdtzlrOlMR+Uv1Ib4EzIABbcyF9WS8=,iv:4ifFSJ8MrG4Lh0nng7YhyJLeZ9zNn7GX8ju6Ulkj/so=,tag:FNP5grMpYo4uhVK85RTIKA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.13.1"
+	}
+}

secrets/secrets.yaml

@@ -12,6 +12,8 @@ caching:
         token: ENC[AES256_GCM,data:8omssG3GwCFIegfz+8IAGGhFGj01RB3dqqHeFpmZOzMJUshIDvSRuTTpGFhUBC7Xue8h09hAhpirIHmqzyG3I+e2Se/VZZoByXmpyIKesl3+NqOXDkJvgImqhvFVkTiSe5p/vSN3slWDylfkThQ0hZYw5mB9J13M5965iUnWcRbg+1fYFdTuSgrHY8Rxt4da0287A0YGnsN63k7j32XOJndxsRoOLoo+IQ+X+hiPOJkfGYxY0MglnxaxhPwH8SP1V+p78N75Z2npOtMdEikdHmj/NmKbqUXN2P0+IXthxV17WePCulZVsKC1Jw+clgbyAvHcQeVG/yyrcb1CRRQpszHtq1Pz7DHvfAG+gxyPNyP7D6oQNT8foX4C6CwuHgYQtM1x0D6oAL+lppQWJ0kEV/GDlJSXQnp/aBbVAqDmqS0TCx40nVmQ0PvMcjtsiZJigkRJRNLCg6n+qmhc5Rh9RhslPN5JXU0orWs9QYAoLXzdDDGP/R9tlEhwQBxwGrFAp016iilqPavMdI8txrWWdvezQuAh//eeW5LQSa6t363VCjX8phnXeJltOgXYlyuKnCCmv0a6XwhmT0PA+32/F0BxTf9lcZConpurlvOHdznaVeUXcFOEwKouDC7smPIZZqcRU8OIbWs7YXqMgatgb/bJVtB0P0Avsj9t9Uz8Dv8xBV+90U5qwM7HV16FIERorDquzgKFcvtb8/QfjTINoswpHZKNCbmQPxfJYPheJFwMQGFn+b+ecv+Z7qng9JEujJSNtEPv2CIuVmSxZJaU5g2CMu3rFGIA3qF81Bf1Ri8n+KYWgOKpQt11nClouv2XePO8JKI6fslF411zJ8zD4E/6Qg95UWhLh0RG2cXzYSXXvrpXDlIe9spc4OLuj4tFtXkiZZvfM5MgRTtoh93soypUpEbswTji2UprC3OPikjIIW49YysGVsH2100/67HbtinRoazM1M+DjaD2pMryx7kW/oVpyaW61wiqtHk9nq8vqROLWBhQxzGSh9157z/46AT+8PN89gFh5uNdFuhFz8e8/HIV3HtIrzrtR+flJfHJ1ZT5dhTDicSMiC/DhG/hupX4GHGX6zlaMgBqB8bKxxvs+v0iHfSkDIkuenZ+nTD72DP5yuIQVIwGV16CZA6rusjb1zLn6QYpvQtCuqlih+epsGNEYP6B3rvNMc/N7JcwY4YMTK+C46EC9mXhpfPn0a5OdD4kQ6s=,iv:+g9W5MzgtLppD1K3dZ/tCuaMxaa194W3Lf23/jUmDvk=,tag:5uVwIOkB2+MRHPGlKGQtGg==,type:str]
 tailscale:
     auth-key: ENC[AES256_GCM,data:ffBLc/LIm67P/DUSvDUek/qWHLfQbmSE3jQL1/TLHrZEEGk+HqEO4Prlj5bGGAU37tiHaD7Ksj1wqX3U+Q==,iv:Uw1tnuxMPZVwqvrRkZZusJM/a7QeoggR047+CKx9fnY=,tag:kS1IixpXYm1QVBIAmmgQ6Q==,type:str]
+home-assistant:
+    auth-token: ENC[AES256_GCM,data:QCcoPqCwZ9f3AIYjDYG1etyguvAk2jehwQVImLL9nuoNGOtW38hQgGD3blaJymWgUx3u4aYVzC7iCcZ2k1xJghzBenIgVExP1ocFUhZCLHtOJj4qdC7fz0i1VM5UcGx4JVyOYOYiqj5uk7uBguOmQSOKmsnon8nYhUiWXoss2o7qHC0/Ymt/HTLRgO7WlRXOxJtJ6MSxFgUb6ln1hJzdihmAhvKOx0mtMOCfEyQTrIhUxQ7lUxRs,iv:N26PE7//zqKNugrsPOCLjxeAC/OoIN4E968jgSfpu8Y=,tag:1ot2S7OKrk8flO/5PVahLA==,type:str]
 sops:
     age:
         - enc: |
@@ -77,7 +79,7 @@ sops:
             6POXxpxjGhlWJaV47jqeN+7mQY2oTHE/x4raoX/KA2ouXL29K8QpmA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1pewusvlcgzcnk0kpskgc9qr6jlq8s2yzwnqrnh84p7v5z0kj3qhsya8h2x
-    lastmodified: "2026-06-10T03:00:15Z"
+    lastmodified: "2026-06-20T22:46:59Z"
-    mac: ENC[AES256_GCM,data:F1DU7Sj9lsTOHWlyuY4L4N+urrBXv2GLKhlzohMA9iF6/bphRABa9we3WZX9MFNIc2Te+2SCh3f6Rv5eHwWSsZVdD4iwN/6HTabdNPTEOZyk/OVsap/F374MLu8ys3OVZ5vzg2PYCGmhlf4PQMrjvaz+CV3t8UezB6E4U0N3RuU=,iv:wT2ieUON5VInJhDtZFLENzyaty5TqcisLmYePnCHGM4=,tag:z9CYpCWa/XdSqPKMG3M41A==,type:str]
+    mac: ENC[AES256_GCM,data:ZOp8v3TdrI0l2PKTKnneAxBVoCaw48qA936OvFWbuHxVSuoEaq0S4v86pQQ8zpExoRXmyX1l9NUjwE2Ekwb0TIeUYBTf0TSU7aHmdMP+8kW/85LVRQcqXqHO1o5taUcs0o01nUMPHFwxKEHod44rdH1ipYRciSZdVpQIl8RDp/8=,iv:5xiVBUu/fZpeJTAhazbX/zPYiNliDLMZuc9Zn7vLNzE=,tag:z+k8lBouOLzI2ZrIa/X3Kg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1