Home/Nixinator: Update opencode permissions

Services/Jellyfin: Update to v12.1
Home/Nixinator: Disable opencode-dcp
2026-09-16 11:05:18 +02:00 · 2026-09-15 21:38:16 +02:00 · 2026-09-15 16:31:34 +02:00 · 2026-09-14 23:19:04 +02:00 · 2026-09-14 23:18:51 +02:00 · 2026-09-14 23:18:40 +02:00
17 changed files with 528 additions and 184 deletions
@@ -0,0 +1,128 @@
+# AGENTS.md
+
+## Common Commands
+
+```bash
+# Enter the dev shell (provides helper utilities)
+nix develop
+
+# Preferred shorthand (nh must be enabled in config)
+nh os switch   # rebuild and switch
+nh os boot     # new boot entry without switching
+
+# Direct nixos-rebuild (fallback)
+sudo nixos-rebuild switch --flake .#nixinator
+sudo nixos-rebuild switch --flake .#nixtop
+sudo nixos-rebuild switch --flake .#servenix
+sudo nixos-rebuild switch --flake .#thinknix
+sudo darwin-rebuild switch --flake .#darwinix
+
+# Validate flake without building
+nix flake check
+
+# Dev shell helpers (run inside `nix develop`)
+list-system-packages   # show installed system packages
+list-user-packages     # show installed user packages
+store-optimise         # nix store --optimise
+store-verify           # nix store --verify --repair
+```
+
+## MCP Tools
+
+The **nixos** MCP server is available and should be used for any Nix-related lookups instead of `nix search` or manual web searches. It queries live APIs (search.nixos.org, NixHub, FlakeHub) and is more current than training data.
+
+```
+# Common intents
+nix {"action":"info","query":"<pkg>","channel":"unstable"}      # package info
+nix {"action":"search","query":"<term>","type":"options"}       # NixOS options
+nix {"action":"search","source":"home-manager","query":"<term>"} # HM options
+nix {"action":"cache","query":"<pkg>"}                          # binary cache status
+nix_versions {"package":"<attr>","version":"<ver>"}             # commit that shipped a version
+```
+
+## Architecture
+
+This is a multi-host NixOS/nix-darwin flake. Home-manager runs **as a NixOS module** — not standalone. A single `nixos-rebuild switch` rebuilds system and user config together. The HM config can access the system config via the `nixosConfig` special arg.
+
+### Hosts
+
+| Host | Type | Notes |
+|------|------|-------|
+| `nixinator` | Desktop (x86_64) | Primary machine; disko, lanzaboote, impermanence |
+| `nixtop` | Laptop (x86_64) | Intel GPU, NetworkManager |
+| `servenix` | Server (x86_64) | Headless; runs OCI container services |
+| `thinknix` | Headless (x86_64) | Generic headless config |
+| `darwinix` | macOS (aarch64) | Darwin-specific configuration |
+
+### Config Layering (resolved in this order)
+
+1. **Global defaults** — `system/default.nix` / `home/christoph/default.nix`
+2. **Host overrides** — `system/<hostname>/default.nix` / `home/christoph/<hostname>/default.nix`
+3. **Hardware** — `system/<hostname>/hardware-configuration.nix` (auto-generated, **do not hand-edit**)
+
+The builder (`lib/nixos.nix`: `mkNixosConfigWithHomeManagerModule`) wires these together.
+
+### Special Args
+
+Injected into **all system and HM modules**:
+`inputs` `system` `hostname` `mylib` `username` `publicKeys` `headless`
+
+Use `headless` (boolean) to gate anything graphical. Use `mylib.<fn>` instead of reimplementing helpers.
+
+### Module System
+
+Two parallel hierarchies, identical pattern:
+
+| Scope | Path | Option prefix |
+|-------|------|---------------|
+| System | `system/systemmodules/<name>/` | `systemmodules.<name>.*` |
+| Home-manager | `home/homemodules/<name>/` | `homemodules.<name>.*` |
+
+**System modules** — `system/systemmodules/<name>/`
+- `options.nix` — declares `systemmodules.<name>.*` options
+- `default.nix` — imports `./options.nix`, implements `lib.mkIf <name>.enable { ... }`
+
+**Home-manager modules** — `home/homemodules/<name>/`
+- `options.nix` — declares `homemodules.<name>.*` options
+- `default.nix` — same pattern under `homemodules.*`
+
+When adding a new module, copy from `0_template/` in either hierarchy. Modules under `1_deprecated/` are kept for reference only — not imported anywhere.
+
+HM modules are placed in `home-manager.sharedModules` (not `users.<user>.imports`) — this enables proper nixd completions.
+
+### Custom Library (`lib/`)
+
+Always available as `mylib`. Key files:
+- `nixos.nix` — host config builders, `mkNixosConfigWithHomeManagerModule`, `mkDarwinConfigWithHomeManagerModule`
+- `modules.nix` — `mkBoolOption`, `mkElse`, `attrName`, `attrValue`, `contains`
+- `networking.nix` — `mkSystemdNetwork`, `mkStaticSystemdNetwork`
+- `generators.nix` — `toLuaObject`, `toLuaKeymap` (used by Neovim module)
+- `containers.nix` — OCI container helpers for services
+- `color.nix` — theming
+
+Always use `mylib.<fn>` (available as a special arg) rather than reimplementing these utilities.
+
+### Services
+
+Server services are OCI containers (podman/docker) defined in `system/services/`. Each file defines one or more containers. These are only enabled on `servenix`. Use the template at `system/services/0_TEMPLATE.nix`.
+
+### Secrets
+
+Managed via **sops-nix**. Age keys stored in `flake.nix` under `publicKeys.christoph`. Encrypted `.yaml`/`.json` files live alongside the module that uses them, referenced as `sops.secrets.<name>`.
+
+### Overlays and Custom Derivations
+
+- `overlays/default.nix` — package overrides (e.g., patched JetBrains CLion version)
+- `derivations/default.nix` — custom packages: `monolisa`, `msty`, `unityhub`, `tidal-dl-ng`, `tiddl`
+- `derivations/1_deprecated/` — kept for reference, not imported
+
+### Sub-projects
+
+`config/flake.nix` is a separate, reusable development-project template — **not part of the main NixOS flake**. It uses `flake-utils` for multi-system shells.
+
+## Constraints
+
+- No CI, no tests, no linting — this is a configuration repo
+- `nix flake check` is the only validation available
+- `documentation.enable = false` by default (slow); toggle it if you need man pages
+- Hardware config files are auto-generated — never edit them by hand
@@ -20,11 +20,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788016784,
-        "narHash": "sha256-RO90Fk+Rn2Yy+I8oL4ePTLLKLgOAr8hrTx7tlpwdLaA=",
+        "lastModified": 1788444081,
+        "narHash": "sha256-I8i97p9WBQaZQyyBaHFMt8e01VfgfFZSaO+vAUd0u0A=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "783bfd9ae441d1d0519b979ac68b73ddd6e81df0",
+        "rev": "36b66db4ddd708ad19f5db850af6a478d8a19b2a",
        "type": "github"
      },
      "original": {
@@ -109,11 +109,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788165233,
-        "narHash": "sha256-iABT8jOczQ8gvSo2TgyCQNDtXjh7MSx3myiAAzaYTa8=",
+        "lastModified": 1789175900,
+        "narHash": "sha256-kvERUjjzkawZwg27P8+DVNULBUl6tb/RaXrFpSJnHX4=",
        "owner": "aaddrick",
        "repo": "claude-desktop-debian",
-        "rev": "249a33390a58278a7ace07145d50aa3336bdab99",
+        "rev": "4c2bfbf9577f873df99757bed171c76633ab22a6",
        "type": "github"
      },
      "original": {
@@ -122,6 +122,27 @@
        "type": "github"
      }
    },
+    "codex-desktop-linux": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789285506,
+        "narHash": "sha256-f7R2NvLwKBAzhwg5hxu+NJhTAn4+i4VuZxe3VIa+aCA=",
+        "owner": "ilysenko",
+        "repo": "codex-desktop-linux",
+        "rev": "f445a448d2f95766e5e0b9563618964a5250704f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ilysenko",
+        "repo": "codex-desktop-linux",
+        "type": "github"
+      }
+    },
    "crane": {
      "locked": {
        "lastModified": 1781825982,
@@ -142,11 +163,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1768818222,
-        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
+        "lastModified": 1788342953,
+        "narHash": "sha256-EWkNM4JzBhZ/Yn1PG6lP4/QJuFAFeHYlY5gVxXu940Y=",
        "owner": "numtide",
        "repo": "devshell",
-        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
+        "rev": "a67c0f87b63bcbdbdcb56785bec0205a2e3d6026",
        "type": "github"
      },
      "original": {
@@ -179,7 +200,7 @@
    "elephant": {
      "inputs": {
        "nixpkgs": "nixpkgs_2",
-        "systems": "systems"
+        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1784365424,
@@ -316,11 +337,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -334,11 +355,11 @@
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
      "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -355,11 +376,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
        "type": "github"
      },
      "original": {
@@ -412,7 +433,7 @@
    },
    "flake-utils": {
      "inputs": {
-        "systems": "systems_3"
+        "systems": "systems"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -430,7 +451,25 @@
    },
    "flake-utils_2": {
      "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_6"
      },
      "locked": {
        "lastModified": 1731533236,
@@ -474,11 +513,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787424939,
-        "narHash": "sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh+7CBnbCYsk=",
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "809414f0cdadf82cf11b06c2b29ba9b3168b3297",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
        "type": "github"
      },
      "original": {
@@ -533,11 +572,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1788044418,
-        "narHash": "sha256-cmOd3iGoE140M2GidgQMQbyxHZ4dT7C0QZq2+CrXQyA=",
+        "lastModified": 1789127271,
+        "narHash": "sha256-vL/Fpo7Zxa7wvO8V5FAToUBvP+K3XsMB1wUglTtd/J0=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "dc3f0cfde2050172abf6c3cdb684f735c15a57c5",
+        "rev": "24cfdc1f9344b90a1eee329a3906e2f39f4d0f1e",
        "type": "github"
      },
      "original": {
@@ -553,11 +592,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788146656,
-        "narHash": "sha256-XmJmvk9rytTb7dCotO/aqR+YysB8HOqnprlOdv+LAF4=",
+        "lastModified": 1789320570,
+        "narHash": "sha256-1Js4AJiWLV7U1SF3ok0J2tKbBEJYE5YpElGU+7fMbfo=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "82c265faf4e3161d6015db07c9b0f1ee36a9029b",
+        "rev": "87b3c74df02a2b2e691a24f3c82774f48a70c1bd",
        "type": "github"
      },
      "original": {
@@ -658,15 +697,15 @@
        "hyprwire": "hyprwire",
        "nixpkgs": "nixpkgs_4",
        "pre-commit-hooks": "pre-commit-hooks",
-        "systems": "systems_2",
+        "systems": "systems_3",
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1788187241,
-        "narHash": "sha256-LtXqt/xbyR/FyKtuLTXJN5pxJoMAHzI/uWTw/ZxUxwA=",
+        "lastModified": 1789313241,
+        "narHash": "sha256-b59oP/YeH0kug0tBpPThWjOzIvcMB646rE9HySEyz24=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "3b2dadd987fd9da19006a4969036777f44c98f61",
+        "rev": "1b85c7aa1b5c41d906880f0f495bcd0749a23175",
        "type": "github"
      },
      "original": {
@@ -738,11 +777,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788037253,
-        "narHash": "sha256-QSGOM0IFpp45DwmtIwcih8+kKuSgAoQal9QkVVSRNew=",
+        "lastModified": 1788563182,
+        "narHash": "sha256-e2Q7i5T+iQY0o/uxFNnXxWpXZ1e5f6VV4eHdKk7l6kc=",
        "owner": "hyprwm",
        "repo": "hyprland-plugins",
-        "rev": "67c3a4c019f223c27b5bdc6bb656ce891a60861a",
+        "rev": "722f15a77768eab13f01f5e5dce024bd2f61f270",
        "type": "github"
      },
      "original": {
@@ -941,11 +980,11 @@
        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1787965620,
-        "narHash": "sha256-CIDEB9jOZwDB6AM0bsKeTe0AEm12XJqDVLHOIg86be0=",
+        "lastModified": 1789070605,
+        "narHash": "sha256-QIo1r169N/jP71+YUXci6+fdD1WqKLE/FfWE8SLAqRI=",
        "owner": "JPyke3",
        "repo": "hytale-launcher-nix",
-        "rev": "606cb7cdc218b8ddab2c478aca3e12fd0555375c",
+        "rev": "9c26eaaef7e7b362dafa106e0de9567618e1698e",
        "type": "github"
      },
      "original": {
@@ -999,7 +1038,7 @@
    },
    "masssprings": {
      "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": [
          "nixpkgs"
        ]
@@ -1049,11 +1088,11 @@
        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
      },
      "locked": {
-        "lastModified": 1788119116,
-        "narHash": "sha256-LvuLRFljwbOpaQ+X6sWAD/penYTCqHEVf6AxQcBHDlo=",
+        "lastModified": 1789315465,
+        "narHash": "sha256-tCEkCbcSkAIreekMHErF3SnnawmRq8Qjnl18RKq5eVQ=",
        "owner": "epireyn",
        "repo": "niri-flake",
-        "rev": "8c4cf2a8d3e42ca2db41b884eef333e674ecc09f",
+        "rev": "cacbfbfbcf11df02583aa5d60a8e004d3e5b9fd7",
        "type": "github"
      },
      "original": {
@@ -1082,11 +1121,11 @@
    "niri-unstable": {
      "flake": false,
      "locked": {
-        "lastModified": 1787337984,
-        "narHash": "sha256-BNZUEVR2H96hCKENNKoLSSTFT8W4smp7v94hJc4Ehfc=",
+        "lastModified": 1789308908,
+        "narHash": "sha256-rKf+kiqygvn1DjpNRlHVkbXnABLGpd/N6Gg+t2POEQM=",
        "owner": "niri-wm",
        "repo": "niri",
-        "rev": "dd75865f547f0eac0e9b6c4d86d2cd00c0744252",
+        "rev": "66d04a7d72e25a6c74307bab33a91924d124755d",
        "type": "github"
      },
      "original": {
@@ -1162,11 +1201,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788064340,
-        "narHash": "sha256-QehJP4PYmGoibbmFKYUA19wvdESywXNC+9DHxcuos48=",
+        "lastModified": 1789271913,
+        "narHash": "sha256-9cNioGJJ/2wH/153TefIRv33H98+Y5q2sGOdMWBtdN4=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "51de0cca39be715df8e02218421cc7f91388228e",
+        "rev": "04d8ba4c959ed2e1735ed1a2bc2bea8184065d1e",
        "type": "github"
      },
      "original": {
@@ -1214,11 +1253,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1785031560,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
        "type": "github"
      },
      "original": {
@@ -1229,11 +1268,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1785031560,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
        "type": "github"
      },
      "original": {
@@ -1244,11 +1283,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1787962033,
-        "narHash": "sha256-u6z9VTZA4Kf3RkHQo9sQI7NI4Ei/uiU9vrMqOiwWP1Y=",
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c5c4a43b0e8056328ec4529f735cabdb8f1942bb",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
        "type": "github"
      },
      "original": {
@@ -1337,11 +1376,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1787736819,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "lastModified": 1788404924,
+        "narHash": "sha256-lhEhY8X5EgkQ/eg6IFz4cc8jRuSYSvnxx1al7d1dvZ0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "0968519e14f7aa7d3e9b389682bd74d2b51c8ce8",
        "type": "github"
      },
      "original": {
@@ -1353,11 +1392,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1787736819,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "lastModified": 1789006805,
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
        "type": "github"
      },
      "original": {
@@ -1401,11 +1440,11 @@
    },
    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1788039129,
-        "narHash": "sha256-pa4Q0qErvCvzCaaUph7Sm37RhR4xvPrYI8Lgz6k85+A=",
+        "lastModified": 1789149629,
+        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d2f67949798825fe853f7c5d0492b8bf016d3f88",
+        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
        "type": "github"
      },
      "original": {
@@ -1417,11 +1456,11 @@
    },
    "nixpkgs_9": {
      "locked": {
-        "lastModified": 1787631388,
-        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
+        "lastModified": 1789073787,
+        "narHash": "sha256-xfX/toC2QV707s06GbP4II/TxYF0fNQj7s5/LClNDKc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
+        "rev": "aff8a0b28396750446e5537a96461bc4facdb287",
        "type": "github"
      },
      "original": {
@@ -1435,14 +1474,14 @@
      "inputs": {
        "flake-parts": "flake-parts_3",
        "nixpkgs": "nixpkgs_9",
-        "systems": "systems_4"
+        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1788190018,
-        "narHash": "sha256-59BAfH0txPAZrPBF4QJqwvUWppD+ICrcjA1LZAmPnrQ=",
+        "lastModified": 1789311313,
+        "narHash": "sha256-79l448oCbWZAuqewBd7hWby4+PLjI1Bnyrb/py8C2HA=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "41844750e55f17b1385d5b09ca7ade5f11f49506",
+        "rev": "31e5c6a0937e2554aa5279719ff794655bfb0365",
        "type": "github"
      },
      "original": {
@@ -1454,7 +1493,7 @@
    "nps": {
      "inputs": {
        "flake-compat": "flake-compat_5",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_3",
        "naersk": "naersk",
        "nixpkgs": [
          "nixpkgs"
@@ -1482,11 +1521,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788194662,
-        "narHash": "sha256-sKyIwEuzXbGDIxS/ZNBwIqLKDaPMHWD7p82kl19Xf3Q=",
+        "lastModified": 1789323837,
+        "narHash": "sha256-FCXzuwbIN6qyEGPn/Be+FkCPE683SHOCJ3mRlKipqvE=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "b532e223e8c3372fbd2a5c4df1cffc3fb7cdf1d4",
+        "rev": "02e124fc8de26c30e3116c67792ed309ad68c83f",
        "type": "github"
      },
      "original": {
@@ -1552,11 +1591,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787424939,
-        "narHash": "sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh+7CBnbCYsk=",
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "809414f0cdadf82cf11b06c2b29ba9b3168b3297",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
        "type": "github"
      },
      "original": {
@@ -1568,6 +1607,7 @@
    "root": {
      "inputs": {
        "claude-desktop": "claude-desktop",
+        "codex-desktop-linux": "codex-desktop-linux",
        "devshell": "devshell",
        "disko": "disko",
        "elephant": "elephant",
@@ -1640,11 +1680,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786629091,
-        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
+        "lastModified": 1788914643,
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
        "type": "github"
      },
      "original": {
@@ -1666,7 +1706,7 @@
          "nixpkgs"
        ],
        "nur": "nur_2",
-        "systems": "systems_6",
+        "systems": "systems_7",
        "tinted-kitty": "tinted-kitty",
        "tinted-schemes": "tinted-schemes",
        "tinted-tmux": "tinted-tmux",
@@ -1688,16 +1728,16 @@
    },
    "systems": {
      "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
        "type": "github"
      }
    },
@@ -1717,6 +1757,21 @@
      }
    },
    "systems_3": {
+      "locked": {
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "type": "github"
+      }
+    },
+    "systems_4": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1731,7 +1786,7 @@
        "type": "github"
      }
    },
-    "systems_4": {
+    "systems_5": {
      "flake": false,
      "locked": {
        "lastModified": 1774449309,
@@ -1748,7 +1803,7 @@
        "type": "github"
      }
    },
-    "systems_5": {
+    "systems_6": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1763,7 +1818,7 @@
        "type": "github"
      }
    },
-    "systems_6": {
+    "systems_7": {
      "locked": {
        "lastModified": 1774449309,
        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
@@ -1779,7 +1834,7 @@
        "type": "github"
      }
    },
-    "systems_7": {
+    "systems_8": {
      "locked": {
        "lastModified": 1689347949,
        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -1801,11 +1856,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780405768,
-        "narHash": "sha256-WhPHaupeq5yWP53anFH6vr/ZMQQtAYGtpgUhzqWx9Ws=",
+        "lastModified": 1789070158,
+        "narHash": "sha256-JN2RfhhOnitwWCKWfcpDq+elOpAA9PBX4AhxQsNU+UA=",
        "owner": "adriankarlen",
        "repo": "textfox",
-        "rev": "d6895da75f10fa17f1b637759aec3d84818b20e2",
+        "rev": "60a2700bc884f1c6de1d9100def058f2650acbd9",
        "type": "github"
      },
      "original": {
@@ -1884,7 +1939,7 @@
          "elephant"
        ],
        "nixpkgs": "nixpkgs_11",
-        "systems": "systems_7"
+        "systems": "systems_8"
      },
      "locked": {
        "lastModified": 1784217994,
@@ -1928,11 +1983,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786988229,
-        "narHash": "sha256-frEFLVRj8xXvBBDs44IRiqHo6R2PxsRpluygL7abjjI=",
+        "lastModified": 1788025068,
+        "narHash": "sha256-TBqronrrc/F2Ry/E37d/1TLldDLJDFNSwvJjgk+cXzU=",
        "owner": "hyprwm",
        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "59d429bf45aed4e2209043c0c36565ad8e2859a5",
+        "rev": "ba31964ee42b56bcb0d3b78a64ead5d8a1c3c6f6",
        "type": "github"
      },
      "original": {
@@ -1961,11 +2016,11 @@
    "xwayland-satellite-unstable": {
      "flake": false,
      "locked": {
-        "lastModified": 1788035239,
-        "narHash": "sha256-ML+LVzuzFZPlCPzM/YEfDA2P9bEJJB8XlVKKYJbUPeU=",
+        "lastModified": 1788991189,
+        "narHash": "sha256-0TxfMgqW0/BLD4M942c5DCKYrtPvzsPJwvdcco4LQUM=",
        "owner": "Supreeeme",
        "repo": "xwayland-satellite",
-        "rev": "6d0de1cedde9dc02abb8877d1b04b90a8c22c3d0",
+        "rev": "add2795134593faafce60e404a0a75df68e9ee0c",
        "type": "github"
      },
      "original": {
@@ -100,6 +100,10 @@
    claude-desktop.url = "github:aaddrick/claude-desktop-debian";
    claude-desktop.inputs.nixpkgs.follows = "nixpkgs";

+    # Unofficial
+    codex-desktop-linux.url = "github:ilysenko/codex-desktop-linux";
+    codex-desktop-linux.inputs.nixpkgs.follows = "nixpkgs";
+
    stylix.url = "github:nix-community/stylix";
    stylix.inputs.nixpkgs.follows = "nixpkgs";

@@ -273,6 +277,7 @@
            inputs.disko.nixosModules.disko
            inputs.stylix.nixosModules.stylix
            inputs.nix-gaming.nixosModules.platformOptimizations
+            inputs.codex-desktop-linux.nixosModules.default
          ]
          ++ commonModules;
      };
@@ -78,6 +78,17 @@
        enableMcpIntegration = true;
      };

+      codexDesktopLinux = {
+        enable = true;
+        linuxFeatures = [
+          "frameless-titlebar"
+          "global-dictation"
+          "read-aloud"
+          "tray-usage"
+          "ui-tweaks"
+        ];
+      };
+
      # NOTE: Starts extremely slow
      ghostty = {
        enable = true;
@@ -131,10 +142,37 @@
      mcp = {
        enable = true;
        servers = {
+          context7 = {
+            command = "npx";
+            args = ["-y" "@upstash/context7-mcp"];
+            env = {
+              CONTEXT7_API_KEY.file = nixosConfig.sops.secrets.context7-api-key.path;
+            };
+          };
+          # deepwiki = {
+          #   # https://mcpservers.org/servers/devin/deepwiki
+          #   url = "https://mcp.deepwiki.com/mcp";
+          # };
+          # github = {
+          #   # https://mcpservers.org/servers/github-mcp-server
+          #   url = "https://api.githubcopilot.com/mcp/";
+          #   headers = {
+          #     Authorization = "Bearer ${input:github_mcp_pat}";
+          #   };
+          # };
          nixos = {
            command = "uvx";
            args = ["mcp-nixos"];
          };
+          obsidian = {
+            command = "uvx";
+            args = ["mcp-obsidian"];
+            env = {
+              OBSIDIAN_API_KEY.file = nixosConfig.sops.secrets.obsidian-rest-api-key.path;
+              OBSIDIAN_HOST = "127.0.0.1";
+              OBSIDIAN_PORT = "27124";
+            };
+          };
          svelte = {
            # claude mcp add -t stdio -s [scope] svelte -- npx -y @sveltejs/mcp
            command = "npx";
@@ -146,6 +184,10 @@
            command = "npx";
            args = ["-y" "shadcn@latest" "mcp"];
          };
+          zotero = {
+            command = "uvx";
+            args = ["zotero-mcp-server"];
+          };
        };
      };

@@ -239,19 +281,37 @@
            "*" = "ask";
            "bash" = {
              "*" = "ask";
-              "ls *" = "allow";
-              "find *" = "ask"; # Don't want find -exec
-              "file *" = "allow";
-              "wc *" = "allow";
-              "grep *" = "allow";
-              "rg *" = "allow";
-              "test *" = "allow";
-              "echo *" = "allow";
-              "which *" = "allow";
-              "pwd *" = "allow";
-              "dirname *" = "allow";
+              "awk *" = "ask"; # Can modify files
              "basename *" = "allow";
+              "cmp *" = "allow";
+              "cut *" = "allow";
+              "df *" = "allow";
+              "dirname *" = "allow";
+              "du *" = "allow";
+              "echo *" = "allow";
+              "fd *" = "ask"; # Can execute commands
+              "file *" = "allow";
+              "find *" = "ask"; # Can execute commands
+              "grep *" = "allow";
+              "head *" = "allow";
+              "ls *" = "allow";
+              "nl *" = "allow";
+              "od *" = "allow";
+              "pwd *" = "allow";
              "readlink *" = "allow";
+              "rg *" = "ask"; # Can execute commands
+              "sed *" = "ask"; # Can modify files
+              "sha256sum *" = "allow";
+              "sha512sum *" = "allow";
+              "sort *" = "ask"; # Can modify files
+              "stat *" = "allow";
+              "tail *" = "allow";
+              "test *" = "allow";
+              "tr *" = "allow";
+              "uniq *" = "ask"; # Can modify files
+              "wc *" = "allow";
+              "which *" = "allow";
+              "xargs *" = "ask"; # Can modify files

              "cat *.env" = "deny";
              "cat *.env.*" = "deny";
@@ -266,11 +326,19 @@
              "nix why-depends *" = "allow";
              "nix derivation show *" = "allow";
              "nix store ping *" = "allow";
-              "nix stire diff-closures *" = "allow";
+              "nix store diff-closures *" = "allow";

-              "git status *" = "allow";
-              "git log *" = "allow";
+              "git branch *" = "ask";
+              "git check-ignore *" = "allow";
              "git diff *" = "allow";
+              "git log *" = "allow";
+              "git ls-files *" = "allow";
+              "git ls-tree *" = "allow";
+              "git remote *" = "ask";
+              "git rev-list *" = "allow";
+              "git rev-parse *" = "allow";
+              "git stash *" = "ask";
+              "git status *" = "allow";
            };
            "external_directory" = {
              "/nix/store/**" = "allow";
@@ -294,8 +362,8 @@
            "question" = "allow";
          };
          plugin = [
-            "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
-            "@tarquinen/opencode-dcp@latest" # better compacting
+            # "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
+            # "@tarquinen/opencode-dcp@latest" # better compacting
            # "opencode-lmstudio@0.3.1"
            # "@slkiser/opencode-quota"
          ];
@@ -401,15 +469,11 @@
        kdePackages.kdenlive
        # davinci-resolve
        krita
-        # makemkv # TODO: Broken on 2026-08-31
+        makemkv
        lrcget
        # msty
-        # jellyfin-media-player # CVE, can't install
        jellyfin-desktop
        jellyfin-mpv-shim
-        # tidal-hifi
-        # tidal-dl-ng # TODO: Borked
-        # spotdl
        tiddl
        picard
        handbrake
@@ -44,6 +44,7 @@
    inputs.nixvim.homeModules.nixvim
    inputs.textfox.homeManagerModules.default
    inputs.walker.homeManagerModules.default
+    inputs.codex-desktop-linux.homeManagerModules.default
    # inputs.stylix.homeModules.stylix
    # inputs.direnv-instant.homeModules.direnv-instant
    # inputs.niri.homeModules.niri # Imported by system module
@@ -124,6 +124,7 @@ in {
                matplotlib
                requests
                pygments
+                pyyaml
              ]))

            (rWrapper.override {
@@ -44,7 +44,7 @@ in {
          nix-search-tv # Search nixpkgs, nur, nixos options and homemanager options
          nix-tree # Browse the nix store sorted by size (gdu for closures)

-          # TODO: Broken on 2026-08-31 (also re-enable services after fixing!)
+          # TODO: Still broken on 2026-09-09
          # inputs.nps.packages.${pkgs.stdenv.hostPlatform.system}.default # Search nixpkgs

          # Video/Image/Audio utils
@@ -161,7 +161,7 @@ in {
          vlc
          audacity
          # ferdium
-          # feishin # electron :(
+          feishin # electron :(
          playerctl # Media player control
          czkawka-full # file deduplicator
          binaryninja-free # reverse engineering
@@ -169,7 +169,9 @@ in {
          # opencode-desktop
          lmstudio # TODO: Ollama
          claude-desktop
+          opencode-desktop
          upscayl
+          calibre

          # Office
          kdePackages.wacomtablet # For xournalpp/krita
@@ -184,7 +186,7 @@ in {
          # helvum # unmaintained
          crosspipe
          # nautilus # This is the worst file manager I've ever used
-          # font-manager # Previews fonts, but doesn't set them # TODO: Broken on 2026-08-31
+          font-manager # Previews fonts, but doesn't set them
          gparted
          resources
          # celluloid
@@ -65,9 +65,10 @@ in {
      '';

      # https://yazi-rs.github.io/docs/configuration/yazi
-      # "$n": The n-th selected file (1...n)
-      # "$@": All selected files
-      # "$0": The hovered file
+      # %sN: The N-th selected file (1...n)
+      # %s: All selected files
+      # %h: The hovered file (shell keybindings)
+      # File placeholders are shell-escaped by Yazi; do not quote them.
      settings = {
        mgr = {
          show_hidden = false;
@@ -80,41 +81,43 @@ in {
        opener = {
          play = [
            {
-              run = ''mpv "$@"'';
+              run = ''mpv %s'';
              orphan = true;
              desc = "Play selection with mpv";
            }
            {
-              run = ''vlc "$@"'';
+              run = ''vlc %s'';
              orphan = true;
              desc = "Play selection with vlc";
            }
          ];
          edit = [
            {
-              run = ''$EDITOR "$@"'';
+              run = ''$EDITOR %s'';
              block = true;
              desc = "Edit selection";
            }
          ];
          open = [
            {
-              run = ''xdg-open "$@"'';
-              desc = "Open selection with xdg-open";
+              run = ''xdg-open %s1'';
+              orphan = true;
+              desc = "Open first selected file with xdg-open";
            }
            {
-              run = ''imv "$@"'';
+              run = ''imv %s'';
+              orphan = true;
              desc = "Open selection with imv";
            }
            {
-              # TODO: For some reason, junction does not exit after choosing an application...
-              run = ''junction "$@"'';
+              run = ''junction %s'';
+              orphan = true;
              desc = "Open selection with junction";
            }
          ];
          extract = [
            {
-              run = ''ouch decompress -y "$@"'';
+              run = ''ouch decompress -y %s'';
              desc = "Extract selection";
            }
          ];
@@ -219,7 +222,7 @@ in {
              "<C-p>"
              "d"
            ];
-            run = ''shell -- ripdrag -a -n "$@"'';
+            run = ''shell --orphan -- ripdrag -a -n %s'';
            desc = "Drag & drop selection";
          }
          {
@@ -243,7 +246,7 @@ in {
              "<C-p>"
              "w"
            ];
-            run = ''wl-copy < "$0"'';
+            run = ''shell -- wl-copy < %h'';
            desc = "Copy hovered file contents using wl-copy";
          }

@@ -255,7 +258,7 @@ in {
          {
            on = "y";
            run = [
-              ''shell -- for path in "$@"; do echo "file://$path"; done | wl-copy -t text/uri-list''
+              ''shell -- for path in %s; do echo "file://$path"; done | wl-copy -t text/uri-list''
              "yank"
            ];
            desc = "Copy files to system clipboard on yank";
@@ -29,36 +29,36 @@
    # Remove this after jetbrains.jdk builds again (nixpkgs issue 425328)
    # jetbrains.rider = pkgs-stable.jetbrains.rider;

-    jetbrains =
-      prev.jetbrains
-      // {
-        clion = prev.jetbrains.clion.overrideAttrs (oldAttrs: rec {
-          version = "261.22158.47"; # March 6, 2026
-
-          src = prev.fetchurl {
-            url = "https://download-cdn.jetbrains.com/cpp/CLion-${version}.tar.gz";
-
-            # hash = "sha256-h6tnemVnV1YEsvIndwrq2sMsRZYuvTWMU5oqj/hkjdY="; # 261.21849.6
-            hash = "sha256-FUHNRioJvjwOWN+FkXEr3+NWR+QVxaZUOkJ0egQkcCQ="; # 261.22158.47
-          };
-
-          # autoPatchelfIgnoreMissingDeps = [
-          #   "libcrypto.so.1.1"
-          #   "libssl.so.1.1"
-          # ];
-
-          postFixup = ''
-            # Patch python3.12 shared libs that the upstream glob (python3.8) misses
-            find $out -path '*/python3.*/lib-dynload/*.so' -exec patchelf \
-              --replace-needed libssl.so.1.1 libssl.so \
-              --replace-needed libcrypto.so.1.1 libcrypto.so \
-              --replace-needed libcrypt.so.1 libcrypt.so \
-              {} +
-
-            ${oldAttrs.postFixup or ""}
-          '';
-        });
-      };
+    # jetbrains =
+    #   prev.jetbrains
+    #   // {
+    #     clion = prev.jetbrains.clion.overrideAttrs (oldAttrs: rec {
+    #       version = "261.22158.47"; # March 6, 2026
+    #
+    #       src = prev.fetchurl {
+    #         url = "https://download-cdn.jetbrains.com/cpp/CLion-${version}.tar.gz";
+    #
+    #         # hash = "sha256-h6tnemVnV1YEsvIndwrq2sMsRZYuvTWMU5oqj/hkjdY="; # 261.21849.6
+    #         hash = "sha256-FUHNRioJvjwOWN+FkXEr3+NWR+QVxaZUOkJ0egQkcCQ="; # 261.22158.47
+    #       };
+    #
+    #       # autoPatchelfIgnoreMissingDeps = [
+    #       #   "libcrypto.so.1.1"
+    #       #   "libssl.so.1.1"
+    #       # ];
+    #
+    #       postFixup = ''
+    #         # Patch python3.12 shared libs that the upstream glob (python3.8) misses
+    #         find $out -path '*/python3.*/lib-dynload/*.so' -exec patchelf \
+    #           --replace-needed libssl.so.1.1 libssl.so \
+    #           --replace-needed libcrypto.so.1.1 libcrypto.so \
+    #           --replace-needed libcrypt.so.1 libcrypt.so \
+    #           {} +
+    #
+    #         ${oldAttrs.postFixup or ""}
+    #       '';
+    #     });
+    #   };

    # Now in Nixpkgs
    # neovide = prev.neovide.overrideAttrs (finalAttrs: prevAttrs: {
@@ -94,4 +94,10 @@
  };
 in
  # Composes a list of overlays and returns a single overlay function that combines them.
-  nixpkgs.lib.composeManyExtensions [additions modifications]
+  nixpkgs.lib.composeManyExtensions [
+    additions
+    modifications
+
+    # This is already a complete overlay with final: prev:, so it must be composed directly
+    (import ./latexminted.nix)
+  ]
@@ -0,0 +1,67 @@
+# Workaround for a broken `minted` in nixpkgs.
+#
+# The TeX Live snapshot in nixpkgs (2026-03-01) predates minted 3.8.0
+# (2026-03-04) and still ships 3.7.0 together with a bundled `latexminted`
+# 0.6.0 that does not run. Two independent replacements are needed:
+#
+#   - the run container: minted.sty from the upstream 3.8.0 release, which
+#     requires `latexminted` >= 0.7.0;
+#   - the bin container: `pkgs.latexminted` (0.7.1), which works.
+#
+# The LaTeX package and the Python executable are versioned separately, hence
+# the two unrelated version numbers.
+#
+# Delete this file once nixpkgs ships minted >= 3.8.0.
+final: prev: let
+  version = "3.8.0";
+
+  # Byte-identical to the CTAN 3.8.0 release, but pinned and already unpacked
+  # (CTAN only ships minted.dtx, which would have to be run through docstrip).
+  src = prev.fetchFromGitHub {
+    owner = "gpoore";
+    repo = "minted";
+    rev = "631f7e8e93f37d4f6e7767ff45692d53e7c7360d"; # "[latex] minted v3.8.0"
+    hash = "sha256-xUWScWRR62ikRxxz/YEauWLirvhsQPCcyE1O6cpWZRw=";
+  };
+
+  minted = prev.texlive.pkgs.minted;
+
+  # texlive.withPackages reads pname/tlType/tlDeps/... off the containers, so
+  # reuse the original metadata instead of reconstructing it.
+  container = name: container: script:
+    prev.runCommand "minted-${version}${name}" {
+      inherit (container) meta;
+      passthru =
+        container.passthru
+        // {
+          inherit version;
+        };
+    }
+    script;
+in {
+  texlive =
+    prev.texlive
+    // {
+      pkgs =
+        prev.texlive.pkgs
+        // {
+          minted =
+            minted
+            // {
+              tex = container "-tex" minted.tex ''
+                install -Dm444 -t "$out"/tex/latex/minted \
+                  ${src}/latex/minted/minted.sty \
+                  ${src}/latex/minted/minted1.sty \
+                  ${src}/latex/minted/minted2.sty
+              '';
+
+              # A bare symlink is enough: texlive.withPackages resolves and wraps
+              # everything under bin/ itself.
+              out = container "" minted.out ''
+                mkdir -p "$out"/bin
+                ln -s ${prev.lib.getExe prev.latexminted} "$out"/bin/latexminted
+              '';
+            };
+        };
+    };
+}
@@ -394,9 +394,9 @@ with mylib.networking; {
    };

    # Trims the journal if too large
-    journald.extraConfig = ''
-      SystemMaxUse=50M
-    '';
+    journald.settings.Journal = {
+      SystemMaxUse = "50M";
+    };

    acpid.enable = true;
    dbus.enable = true;
@@ -139,6 +139,8 @@
    sops-nix.secrets.${username} = [
      "makemkv-app-key"
      "restic-repo-key"
+      "context7-api-key"
+      "obsidian-rest-api-key"
    ];
  };

@@ -7,7 +7,7 @@
 }: let
  vectorchordVersion = "0.4.2";
  pgvectorsVersion = "0.2.0";
-  immichVersion = "3.0.1-cuda";
+  immichVersion = "3.2.0-cuda";
 in {
  virtualisation.oci-containers.containers = {
    immich-database = {
@@ -5,7 +5,7 @@
  pkgs,
  ...
 }: let
-  jellyfinVersion = "10.11.2";
+  jellyfinVersion = "version-12.1ubu2604";
 in {
  virtualisation.oci-containers.containers = {
    jellyfin = {
@@ -122,6 +122,7 @@ in {
            # The shit some applications add to ~/ without asking
            # (mkUDir ".android" m755) # Unity
            (mkUDir ".claude" m755)
+            (mkUDir ".codex" m755)
            # (mkUDir ".comfy" m755)
            (mkUDir ".docker" m755)
            # (mkUDir ".gradle" m755) # Unity
@@ -157,12 +158,14 @@ in {

            # Config
            # (mkUDir ".config/.android" m755) # Unity
+            (mkUDir ".config/ai.opencode.desktop" m755)
            # (mkUDir ".config/beekeeper-studio" m755)
            (mkUDir ".config/beets" m755)
            (mkUDir ".config/blender" m755)
            (mkUDir ".config/chromium" m755)
            (mkUDir ".config/Claude" m755) # Claude desktop
            (mkUDir ".config/Code" m755)
+            (mkUDir ".config/Codex" m755)
            (mkUDir ".config/Ferdium" m755)
            (mkUDir ".config/feishin" m755)
            (mkUDir ".config/fish/completions" m755)
@@ -21,7 +21,7 @@ in {
              ${mime.defaultTextEditor} = mime.textTypes;
              ${mime.defaultFileBrowser} = ["inode/directory"];
              ${mime.defaultWebBrowser} = mime.webTypes;
-              ${mime.defaultPdfViewer} = ["application/pdf"];
+              ${mime.defaultPdfViewer} = ["application/pdf" "application/epub+zip"];
              ${mime.defaultImageViewer} = mime.imageTypes;

              # If audio and video player are equal, we assign all types to the audio player,
@@ -75,6 +75,11 @@ in {
                "chromium-browser.desktop"
                "com.google.Chrome.desktop"
                "firefox.desktop"
+                "org.onlyoffice.desktopeditors.desktop"
+                "calibre-ebook-edit.desktop"
+                "calibre-ebook-viewer.desktop"
+                "calibre-gui.desktop"
+                "calibre-lrfviewer.desktop"
              ];
              "text/plain" = [
                "firefox.desktop"
@@ -11,6 +11,8 @@ jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSo
 #
 makemkv-app-key: ENC[AES256_GCM,data:/pTxr4q4ucJLx5VI8ySzOgd4g1s+6lcZNe4crxRmidTYrhJ0I6V3CIhm4wLC105W+Xka6HIZTqPn8SbqcMC4Dt3wSus=,iv:aYsGobD+Vl/VUNAHcAxQb7HEmLT8aXyKNOELgzvKDH4=,tag:xhnVb/ns6VZEnTuoUv9w5A==,type:str]
 restic-repo-key: ENC[AES256_GCM,data:lSFuhjbhdQq4cabAVFGQ4kuaJxb7EhXgBDlgoEQWJhs=,iv:7IhGDBYEwY1TwLvc/4DOkUBQ3eqSszZcKwnT7Lllfps=,tag:yJVlMi9X0W+Kh3zMkb0QuA==,type:str]
+context7-api-key: ENC[AES256_GCM,data:lZfrz5pBDybBkswgZM3jKLM9bdXOXeFUI9wFB8BJ5aLYqmf2oRHIJi/85w==,iv:MQYZKsTG++CYfpJret1WSv7+q2ZmONCDl4OwdRo+YUk=,tag:MrWBn3CKDUDZLLIFZWV0tA==,type:str]
+obsidian-rest-api-key: ENC[AES256_GCM,data:+CmQAX0AoSmCPMF9QL3NkWVArt7N0Ci9obHKpwQUPolcdsTnAsPMWu6GAWVvqs8Qmjz5Hk3gwM0YP2JdLEF0cw==,iv:U1SsPdiJIT7q+md1Q61Ro530s7vrl+XBgu+6/ffcrEQ=,tag:xrTRPve9DcumQjlr+aKsLg==,type:str]
 #
 #ENC[AES256_GCM,data:Raagjz1qPvXC,iv:OSWTKaIlmo1paU2ZZn20XMeZ2gdM52pHmVZ3m2ngCdI=,tag:bPCdvjOFjpxxkrwA7Mhl5Q==,type:comment]
 #
@@ -39,7 +41,7 @@ sops:
            FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-    lastmodified: "2026-07-02T19:27:51Z"
-    mac: ENC[AES256_GCM,data:IkpzDK4F1pEoGx1WyG8ksgMFuEa2h9KeF3m3PzM8KQkWo9iVt3jJn80jHEzWAm8riWIbo7fRkxyRetlSFTZf+MrByotgkWVVx6dMIVNYAOcg2IOK3s4NnX0L65MjbfWGQp/d27QzzEbd14WyklMWm2UO3ei82tF+UKYUEFJ2BWk=,iv:8LimsncylU+HhvVKNnjfyqZskZA72FQe92C4VrNWyQ0=,tag:L6CEno9m3ZncOskjZibq+Q==,type:str]
+    lastmodified: "2026-09-14T21:08:40Z"
+    mac: ENC[AES256_GCM,data:tfkmsJfWYV11ruw8fCUkJ2gWQAvQJ4Gmsz72LnmiCdlvzeo4x9iM268ZJnuaPRuv6BXLp2XGGA4CbqhfZbO6cRxAawVfbxY2IRSo1JWITIY8qxKLb07jDMpQu/JjJz7J5T556UEvOsW6HrK3d0xvNlJ4yQIuVCBjttKTdRu5g9Y=,iv:mV5i0xJGu6fnSNPLm9J3NDDgN+sB6iadue917UjR+oU=,tag:h/vaeQ02wK/qKANerWIywQ==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3
Author	SHA1	Message	Date
christoph	6519ae6625	Home/Nixinator: Update opencode permissions	2026-09-16 11:05:18 +02:00
christoph	2229f79617	Services/Jellyfin: Update to v12.1	2026-09-15 21:38:16 +02:00
christoph	44d832fdda	Home/Nixinator: Disable opencode-dcp	2026-09-15 16:31:34 +02:00
christoph	5d1791914e	Home/Nixinator: Configure context7, zotero and obsidian MCP servers	2026-09-14 23:19:04 +02:00
christoph	5fe5c81916	System/Nixinator: Update mounted sops secrets	2026-09-14 23:18:51 +02:00
christoph	fbec41ba10	Modules/SopsNix: Add context7 + local obsidian API keys	2026-09-14 23:18:40 +02:00
christoph	ebd306ee98	Services/Immich: Update to v3.2.0-cuda	2026-09-13 22:38:52 +02:00
christoph	d240aac403	Add AGENTS.md	2026-09-13 21:59:47 +02:00
christoph	258119c5c8	Flake: Update lock	2026-09-13 21:59:22 +02:00
christoph	1d04dc984f	Modules/Impermanence: Persist opencode-desktop state	2026-09-13 21:59:16 +02:00
christoph	a2b5cfaed3	Modules/Packages: Add opencode-desktop	2026-09-13 21:59:07 +02:00
christoph	82dfa98c07	Home/Nixinator: Add deepwiki mcp server	2026-09-13 21:58:57 +02:00
christoph	1dcc27f378	Modules/Neovim: Add pyyaml	2026-09-13 18:47:21 +02:00
christoph	e97bfb6262	Modules/Mime: Update epub associations	2026-09-13 17:59:29 +02:00
christoph	bf5778476e	Modules/Yazi: Update to new selected files syntax	2026-09-13 17:41:05 +02:00
christoph	f2b1bedcf0	Modules/Packages: Add calibre	2026-09-13 17:39:26 +02:00
christoph	5f6ca72f6c	Overlays/LatexMinted: Fix latexminted package	2026-09-10 20:47:18 +02:00
christoph	ea39c929ae	Modules/Impermanence: Persist codex-desktop-unofficial state	2026-09-10 20:46:27 +02:00
christoph	06e1c4390c	System: Update to new journald settings schema	2026-09-10 20:46:13 +02:00
christoph	01ec6d15db	Overlays: Disable clion overlay (outdated)	2026-09-10 20:45:56 +02:00
christoph	e2267e8978	Modules/Packages: Re-enable feishing + font-manager	2026-09-10 20:45:42 +02:00
christoph	044d2742ed	Home/Nixinator: Re-enable makemkv	2026-09-10 20:45:23 +02:00
christoph	3f92349857	Flake: Update lock	2026-09-10 20:45:07 +02:00
christoph	39eb99e021	Home/Nixinator: Enable unofficial codex desktop app	2026-09-08 11:03:29 +02:00