Home/Nixinator: Update opencode permissions

AGENTS.md

@@ -0,0 +1,128 @@
+# AGENTS.md
+
+## Common Commands
+
+```bash
+# Enter the dev shell (provides helper utilities)
+nix develop
+
+# Preferred shorthand (nh must be enabled in config)
+nh os switch   # rebuild and switch
+nh os boot     # new boot entry without switching
+
+# Direct nixos-rebuild (fallback)
+sudo nixos-rebuild switch --flake .#nixinator
+sudo nixos-rebuild switch --flake .#nixtop
+sudo nixos-rebuild switch --flake .#servenix
+sudo nixos-rebuild switch --flake .#thinknix
+sudo darwin-rebuild switch --flake .#darwinix
+
+# Validate flake without building
+nix flake check
+
+# Dev shell helpers (run inside `nix develop`)
+list-system-packages   # show installed system packages
+list-user-packages     # show installed user packages
+store-optimise         # nix store --optimise
+store-verify           # nix store --verify --repair
+```
+
+## MCP Tools
+
+The **nixos** MCP server is available and should be used for any Nix-related lookups instead of `nix search` or manual web searches. It queries live APIs (search.nixos.org, NixHub, FlakeHub) and is more current than training data.
+
+```
+# Common intents
+nix {"action":"info","query":"<pkg>","channel":"unstable"}      # package info
+nix {"action":"search","query":"<term>","type":"options"}       # NixOS options
+nix {"action":"search","source":"home-manager","query":"<term>"} # HM options
+nix {"action":"cache","query":"<pkg>"}                          # binary cache status
+nix_versions {"package":"<attr>","version":"<ver>"}             # commit that shipped a version
+```
+
+## Architecture
+
+This is a multi-host NixOS/nix-darwin flake. Home-manager runs **as a NixOS module** — not standalone. A single `nixos-rebuild switch` rebuilds system and user config together. The HM config can access the system config via the `nixosConfig` special arg.
+
+### Hosts
+
+| Host | Type | Notes |
+|------|------|-------|
+| `nixinator` | Desktop (x86_64) | Primary machine; disko, lanzaboote, impermanence |
+| `nixtop` | Laptop (x86_64) | Intel GPU, NetworkManager |
+| `servenix` | Server (x86_64) | Headless; runs OCI container services |
+| `thinknix` | Headless (x86_64) | Generic headless config |
+| `darwinix` | macOS (aarch64) | Darwin-specific configuration |
+
+### Config Layering (resolved in this order)
+
+1. **Global defaults** — `system/default.nix` / `home/christoph/default.nix`
+2. **Host overrides** — `system/<hostname>/default.nix` / `home/christoph/<hostname>/default.nix`
+3. **Hardware** — `system/<hostname>/hardware-configuration.nix` (auto-generated, **do not hand-edit**)
+
+The builder (`lib/nixos.nix`: `mkNixosConfigWithHomeManagerModule`) wires these together.
+
+### Special Args
+
+Injected into **all system and HM modules**:
+`inputs` `system` `hostname` `mylib` `username` `publicKeys` `headless`
+
+Use `headless` (boolean) to gate anything graphical. Use `mylib.<fn>` instead of reimplementing helpers.
+
+### Module System
+
+Two parallel hierarchies, identical pattern:
+
+| Scope | Path | Option prefix |
+|-------|------|---------------|
+| System | `system/systemmodules/<name>/` | `systemmodules.<name>.*` |
+| Home-manager | `home/homemodules/<name>/` | `homemodules.<name>.*` |
+
+**System modules** — `system/systemmodules/<name>/`
+- `options.nix` — declares `systemmodules.<name>.*` options
+- `default.nix` — imports `./options.nix`, implements `lib.mkIf <name>.enable { ... }`
+
+**Home-manager modules** — `home/homemodules/<name>/`
+- `options.nix` — declares `homemodules.<name>.*` options
+- `default.nix` — same pattern under `homemodules.*`
+
+When adding a new module, copy from `0_template/` in either hierarchy. Modules under `1_deprecated/` are kept for reference only — not imported anywhere.
+
+HM modules are placed in `home-manager.sharedModules` (not `users.<user>.imports`) — this enables proper nixd completions.
+
+### Custom Library (`lib/`)
+
+Always available as `mylib`. Key files:
+- `nixos.nix` — host config builders, `mkNixosConfigWithHomeManagerModule`, `mkDarwinConfigWithHomeManagerModule`
+- `modules.nix` — `mkBoolOption`, `mkElse`, `attrName`, `attrValue`, `contains`
+- `networking.nix` — `mkSystemdNetwork`, `mkStaticSystemdNetwork`
+- `generators.nix` — `toLuaObject`, `toLuaKeymap` (used by Neovim module)
+- `containers.nix` — OCI container helpers for services
+- `color.nix` — theming
+
+Always use `mylib.<fn>` (available as a special arg) rather than reimplementing these utilities.
+
+### Services
+
+Server services are OCI containers (podman/docker) defined in `system/services/`. Each file defines one or more containers. These are only enabled on `servenix`. Use the template at `system/services/0_TEMPLATE.nix`.
+
+### Secrets
+
+Managed via **sops-nix**. Age keys stored in `flake.nix` under `publicKeys.christoph`. Encrypted `.yaml`/`.json` files live alongside the module that uses them, referenced as `sops.secrets.<name>`.
+
+### Overlays and Custom Derivations
+
+- `overlays/default.nix` — package overrides (e.g., patched JetBrains CLion version)
+- `derivations/default.nix` — custom packages: `monolisa`, `msty`, `unityhub`, `tidal-dl-ng`, `tiddl`
+- `derivations/1_deprecated/` — kept for reference, not imported
+
+### Sub-projects
+
+`config/flake.nix` is a separate, reusable development-project template — **not part of the main NixOS flake**. It uses `flake-utils` for multi-system shells.
+
+## Constraints
+
+- No CI, no tests, no linting — this is a configuration repo
+- `nix flake check` is the only validation available
+- `documentation.enable = false` by default (slow); toggle it if you need man pages
+- Hardware config files are auto-generated — never edit them by hand

flake.lock

@@ -109,11 +109,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788932684,
-        "narHash": "sha256-ZzAmEk75k/hi0ngHb7+tZG5NvzQ2UtrKWduYykX45G4=",
+        "lastModified": 1789175900,
+        "narHash": "sha256-kvERUjjzkawZwg27P8+DVNULBUl6tb/RaXrFpSJnHX4=",
         "owner": "aaddrick",
         "repo": "claude-desktop-debian",
-        "rev": "4706384e2e83003fc364d956de0b34154d6e22fa",
+        "rev": "4c2bfbf9577f873df99757bed171c76633ab22a6",
         "type": "github"
       },
       "original": {
@@ -130,11 +130,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788953062,
-        "narHash": "sha256-7EP4t8nXyIShBzqujEMw9HNB/4DBQkmc5d/AqCWUfLw=",
+        "lastModified": 1789285506,
+        "narHash": "sha256-f7R2NvLwKBAzhwg5hxu+NJhTAn4+i4VuZxe3VIa+aCA=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "4aa6ada09b12e13037ace8a61594f7ea5e1c7881",
+        "rev": "f445a448d2f95766e5e0b9563618964a5250704f",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -572,11 +572,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1788942796,
-        "narHash": "sha256-CLoJCCRi9sogsyGXYn8rOCWBLKAntfKUB9Rli/YXgEY=",
+        "lastModified": 1789127271,
+        "narHash": "sha256-vL/Fpo7Zxa7wvO8V5FAToUBvP+K3XsMB1wUglTtd/J0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "83bbc895120516d6e86885a188c04beced6535d9",
+        "rev": "24cfdc1f9344b90a1eee329a3906e2f39f4d0f1e",
         "type": "github"
       },
       "original": {
@@ -592,11 +592,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788921139,
-        "narHash": "sha256-2wRuvf9UDw1SYWtBcxNmxLeAtNU1i/hc1c0AKQHdvlM=",
+        "lastModified": 1789320570,
+        "narHash": "sha256-1Js4AJiWLV7U1SF3ok0J2tKbBEJYE5YpElGU+7fMbfo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a2dbe7c2c9333e8234ae8114c7f731784201d108",
+        "rev": "87b3c74df02a2b2e691a24f3c82774f48a70c1bd",
         "type": "github"
       },
       "original": {
@@ -701,11 +701,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1788962709,
-        "narHash": "sha256-yCT/nVwI/tj7Nbk0r3vNXOC1BSnZ5yUebE3Ao7Vaw70=",
+        "lastModified": 1789313241,
+        "narHash": "sha256-b59oP/YeH0kug0tBpPThWjOzIvcMB646rE9HySEyz24=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "599ff9042c866dcad4bb458979f7be68a6d2ffef",
+        "rev": "1b85c7aa1b5c41d906880f0f495bcd0749a23175",
         "type": "github"
       },
       "original": {
@@ -980,11 +980,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1788890661,
-        "narHash": "sha256-yH0nf7/BPVBcx3x2/6obgr4mQncHvI8KdYdEGgl4khU=",
+        "lastModified": 1789070605,
+        "narHash": "sha256-QIo1r169N/jP71+YUXci6+fdD1WqKLE/FfWE8SLAqRI=",
         "owner": "JPyke3",
         "repo": "hytale-launcher-nix",
-        "rev": "0ba98a12d86d019005eb4fa1f4b1a89d710bf56d",
+        "rev": "9c26eaaef7e7b362dafa106e0de9567618e1698e",
         "type": "github"
       },
       "original": {
@@ -1088,11 +1088,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1788946453,
-        "narHash": "sha256-jsU+rm0m5ALoVTDq8XaDxSkxZz09vPe+g3A86X93XZw=",
+        "lastModified": 1789315465,
+        "narHash": "sha256-tCEkCbcSkAIreekMHErF3SnnawmRq8Qjnl18RKq5eVQ=",
         "owner": "epireyn",
         "repo": "niri-flake",
-        "rev": "db2615fc6b3f75539ec681a984e3311b8d79ede0",
+        "rev": "cacbfbfbcf11df02583aa5d60a8e004d3e5b9fd7",
         "type": "github"
       },
       "original": {
@@ -1121,11 +1121,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1787337984,
-        "narHash": "sha256-BNZUEVR2H96hCKENNKoLSSTFT8W4smp7v94hJc4Ehfc=",
+        "lastModified": 1789308908,
+        "narHash": "sha256-rKf+kiqygvn1DjpNRlHVkbXnABLGpd/N6Gg+t2POEQM=",
         "owner": "niri-wm",
         "repo": "niri",
-        "rev": "dd75865f547f0eac0e9b6c4d86d2cd00c0744252",
+        "rev": "66d04a7d72e25a6c74307bab33a91924d124755d",
         "type": "github"
       },
       "original": {
@@ -1201,11 +1201,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788839872,
-        "narHash": "sha256-JrJkREqNWmXhTgiXqZQkl6tusimI7fR+a9tu5npmNM0=",
+        "lastModified": 1789271913,
+        "narHash": "sha256-9cNioGJJ/2wH/153TefIRv33H98+Y5q2sGOdMWBtdN4=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "7b9ddc7b9dc0283e45f616311384b84239a33060",
+        "rev": "04d8ba4c959ed2e1735ed1a2bc2bea8184065d1e",
         "type": "github"
       },
       "original": {
@@ -1283,11 +1283,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1788921488,
-        "narHash": "sha256-8+xWRxEkD6l217cIUdRxfeUGS9lQX0hVtUuNVsBaDzk=",
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6aefcda9401be8acc2b74244fb3b37520ea1f0a8",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "github"
       },
       "original": {
@@ -1392,11 +1392,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1788752844,
-        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
+        "lastModified": 1789006805,
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
         "type": "github"
       },
       "original": {
@@ -1440,11 +1440,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1788881743,
-        "narHash": "sha256-2V9GZGvPfrNzxFozhI9dcqV+c3QdA8YZrvAAzqEB+dI=",
+        "lastModified": 1789149629,
+        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d6524aaca2ff07876657ae2b323f24be4874944b",
+        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
         "type": "github"
       },
       "original": {
@@ -1456,11 +1456,11 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1787631388,
-        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
+        "lastModified": 1789073787,
+        "narHash": "sha256-xfX/toC2QV707s06GbP4II/TxYF0fNQj7s5/LClNDKc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
+        "rev": "aff8a0b28396750446e5537a96461bc4facdb287",
         "type": "github"
       },
       "original": {
@@ -1477,11 +1477,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1788190018,
-        "narHash": "sha256-59BAfH0txPAZrPBF4QJqwvUWppD+ICrcjA1LZAmPnrQ=",
+        "lastModified": 1789311313,
+        "narHash": "sha256-79l448oCbWZAuqewBd7hWby4+PLjI1Bnyrb/py8C2HA=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "41844750e55f17b1385d5b09ca7ade5f11f49506",
+        "rev": "31e5c6a0937e2554aa5279719ff794655bfb0365",
         "type": "github"
       },
       "original": {
@@ -1521,11 +1521,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788968525,
-        "narHash": "sha256-nb8H0gnLaAI64j5tihC03gwTJ71O3pBtYrXWKdAfMSM=",
+        "lastModified": 1789323837,
+        "narHash": "sha256-FCXzuwbIN6qyEGPn/Be+FkCPE683SHOCJ3mRlKipqvE=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "e535158b12037c2671524aa69723d8707641c462",
+        "rev": "02e124fc8de26c30e3116c67792ed309ad68c83f",
         "type": "github"
       },
       "original": {
@@ -1856,11 +1856,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780405768,
-        "narHash": "sha256-WhPHaupeq5yWP53anFH6vr/ZMQQtAYGtpgUhzqWx9Ws=",
+        "lastModified": 1789070158,
+        "narHash": "sha256-JN2RfhhOnitwWCKWfcpDq+elOpAA9PBX4AhxQsNU+UA=",
         "owner": "adriankarlen",
         "repo": "textfox",
-        "rev": "d6895da75f10fa17f1b637759aec3d84818b20e2",
+        "rev": "60a2700bc884f1c6de1d9100def058f2650acbd9",
         "type": "github"
       },
       "original": {
@@ -2016,11 +2016,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1788903080,
-        "narHash": "sha256-6D/uKYWiHCxIAz0+iIvR0AZayEdY1gUlGD+GiEP8kNI=",
+        "lastModified": 1788991189,
+        "narHash": "sha256-0TxfMgqW0/BLD4M942c5DCKYrtPvzsPJwvdcco4LQUM=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "324ef5d1865a4b389cf8ea5c0a77b5ec7f419c52",
+        "rev": "add2795134593faafce60e404a0a75df68e9ee0c",
         "type": "github"
       },
       "original": {

home/christoph/nixinator/default.nix

@@ -142,10 +142,37 @@
       mcp = {
         enable = true;
         servers = {
+          context7 = {
+            command = "npx";
+            args = ["-y" "@upstash/context7-mcp"];
+            env = {
+              CONTEXT7_API_KEY.file = nixosConfig.sops.secrets.context7-api-key.path;
+            };
+          };
+          # deepwiki = {
+          #   # https://mcpservers.org/servers/devin/deepwiki
+          #   url = "https://mcp.deepwiki.com/mcp";
+          # };
+          # github = {
+          #   # https://mcpservers.org/servers/github-mcp-server
+          #   url = "https://api.githubcopilot.com/mcp/";
+          #   headers = {
+          #     Authorization = "Bearer ${input:github_mcp_pat}";
+          #   };
+          # };
           nixos = {
             command = "uvx";
             args = ["mcp-nixos"];
           };
+          obsidian = {
+            command = "uvx";
+            args = ["mcp-obsidian"];
+            env = {
+              OBSIDIAN_API_KEY.file = nixosConfig.sops.secrets.obsidian-rest-api-key.path;
+              OBSIDIAN_HOST = "127.0.0.1";
+              OBSIDIAN_PORT = "27124";
+            };
+          };
           svelte = {
             # claude mcp add -t stdio -s [scope] svelte -- npx -y @sveltejs/mcp
             command = "npx";
@@ -157,6 +184,10 @@
             command = "npx";
             args = ["-y" "shadcn@latest" "mcp"];
           };
+          zotero = {
+            command = "uvx";
+            args = ["zotero-mcp-server"];
+          };
         };
       };
 
@@ -250,19 +281,37 @@
             "*" = "ask";
             "bash" = {
               "*" = "ask";
-              "ls *" = "allow";
-              "find *" = "ask"; # Don't want find -exec
-              "file *" = "allow";
-              "wc *" = "allow";
-              "grep *" = "allow";
-              "rg *" = "allow";
-              "test *" = "allow";
-              "echo *" = "allow";
-              "which *" = "allow";
-              "pwd *" = "allow";
-              "dirname *" = "allow";
+              "awk *" = "ask"; # Can modify files
               "basename *" = "allow";
+              "cmp *" = "allow";
+              "cut *" = "allow";
+              "df *" = "allow";
+              "dirname *" = "allow";
+              "du *" = "allow";
+              "echo *" = "allow";
+              "fd *" = "ask"; # Can execute commands
+              "file *" = "allow";
+              "find *" = "ask"; # Can execute commands
+              "grep *" = "allow";
+              "head *" = "allow";
+              "ls *" = "allow";
+              "nl *" = "allow";
+              "od *" = "allow";
+              "pwd *" = "allow";
               "readlink *" = "allow";
+              "rg *" = "ask"; # Can execute commands
+              "sed *" = "ask"; # Can modify files
+              "sha256sum *" = "allow";
+              "sha512sum *" = "allow";
+              "sort *" = "ask"; # Can modify files
+              "stat *" = "allow";
+              "tail *" = "allow";
+              "test *" = "allow";
+              "tr *" = "allow";
+              "uniq *" = "ask"; # Can modify files
+              "wc *" = "allow";
+              "which *" = "allow";
+              "xargs *" = "ask"; # Can modify files
 
               "cat *.env" = "deny";
               "cat *.env.*" = "deny";
@@ -277,11 +326,19 @@
               "nix why-depends *" = "allow";
               "nix derivation show *" = "allow";
               "nix store ping *" = "allow";
-              "nix stire diff-closures *" = "allow";
+              "nix store diff-closures *" = "allow";
 
-              "git status *" = "allow";
-              "git log *" = "allow";
+              "git branch *" = "ask";
+              "git check-ignore *" = "allow";
               "git diff *" = "allow";
+              "git log *" = "allow";
+              "git ls-files *" = "allow";
+              "git ls-tree *" = "allow";
+              "git remote *" = "ask";
+              "git rev-list *" = "allow";
+              "git rev-parse *" = "allow";
+              "git stash *" = "ask";
+              "git status *" = "allow";
             };
             "external_directory" = {
               "/nix/store/**" = "allow";
@@ -305,8 +362,8 @@
             "question" = "allow";
           };
           plugin = [
-            "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
-            "@tarquinen/opencode-dcp@latest" # better compacting
+            # "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
+            # "@tarquinen/opencode-dcp@latest" # better compacting
             # "opencode-lmstudio@0.3.1"
             # "@slkiser/opencode-quota"
           ];

home/homemodules/neovim/default.nix

@@ -124,6 +124,7 @@ in {
                 matplotlib
                 requests
                 pygments
+                pyyaml
               ]))
 
             (rWrapper.override {

home/homemodules/packages/default.nix

@@ -169,6 +169,7 @@ in {
           # opencode-desktop
           lmstudio # TODO: Ollama
           claude-desktop
+          opencode-desktop
           upscayl
           calibre
 

system/nixinator/default.nix

@@ -139,6 +139,8 @@
     sops-nix.secrets.${username} = [
       "makemkv-app-key"
       "restic-repo-key"
+      "context7-api-key"
+      "obsidian-rest-api-key"
     ];
   };
 

system/services/immich.nix

@@ -7,7 +7,7 @@
 }: let
   vectorchordVersion = "0.4.2";
   pgvectorsVersion = "0.2.0";
-  immichVersion = "3.0.1-cuda";
+  immichVersion = "3.2.0-cuda";
 in {
   virtualisation.oci-containers.containers = {
     immich-database = {

system/services/jellyfin.nix

@@ -5,7 +5,7 @@
   pkgs,
   ...
 }: let
-  jellyfinVersion = "10.11.2";
+  jellyfinVersion = "version-12.1ubu2604";
 in {
   virtualisation.oci-containers.containers = {
     jellyfin = {

system/systemmodules/impermanence/default.nix

@@ -158,6 +158,7 @@ in {
 
             # Config
             # (mkUDir ".config/.android" m755) # Unity
+            (mkUDir ".config/ai.opencode.desktop" m755)
             # (mkUDir ".config/beekeeper-studio" m755)
             (mkUDir ".config/beets" m755)
             (mkUDir ".config/blender" m755)

system/systemmodules/sops-nix/secrets.yaml

@@ -11,6 +11,8 @@ jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSo
 #
 makemkv-app-key: ENC[AES256_GCM,data:/pTxr4q4ucJLx5VI8ySzOgd4g1s+6lcZNe4crxRmidTYrhJ0I6V3CIhm4wLC105W+Xka6HIZTqPn8SbqcMC4Dt3wSus=,iv:aYsGobD+Vl/VUNAHcAxQb7HEmLT8aXyKNOELgzvKDH4=,tag:xhnVb/ns6VZEnTuoUv9w5A==,type:str]
 restic-repo-key: ENC[AES256_GCM,data:lSFuhjbhdQq4cabAVFGQ4kuaJxb7EhXgBDlgoEQWJhs=,iv:7IhGDBYEwY1TwLvc/4DOkUBQ3eqSszZcKwnT7Lllfps=,tag:yJVlMi9X0W+Kh3zMkb0QuA==,type:str]
+context7-api-key: ENC[AES256_GCM,data:lZfrz5pBDybBkswgZM3jKLM9bdXOXeFUI9wFB8BJ5aLYqmf2oRHIJi/85w==,iv:MQYZKsTG++CYfpJret1WSv7+q2ZmONCDl4OwdRo+YUk=,tag:MrWBn3CKDUDZLLIFZWV0tA==,type:str]
+obsidian-rest-api-key: ENC[AES256_GCM,data:+CmQAX0AoSmCPMF9QL3NkWVArt7N0Ci9obHKpwQUPolcdsTnAsPMWu6GAWVvqs8Qmjz5Hk3gwM0YP2JdLEF0cw==,iv:U1SsPdiJIT7q+md1Q61Ro530s7vrl+XBgu+6/ffcrEQ=,tag:xrTRPve9DcumQjlr+aKsLg==,type:str]
 #
 #ENC[AES256_GCM,data:Raagjz1qPvXC,iv:OSWTKaIlmo1paU2ZZn20XMeZ2gdM52pHmVZ3m2ngCdI=,tag:bPCdvjOFjpxxkrwA7Mhl5Q==,type:comment]
 #
@@ -39,7 +41,7 @@ sops:
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-    lastmodified: "2026-07-02T19:27:51Z"
-    mac: ENC[AES256_GCM,data:IkpzDK4F1pEoGx1WyG8ksgMFuEa2h9KeF3m3PzM8KQkWo9iVt3jJn80jHEzWAm8riWIbo7fRkxyRetlSFTZf+MrByotgkWVVx6dMIVNYAOcg2IOK3s4NnX0L65MjbfWGQp/d27QzzEbd14WyklMWm2UO3ei82tF+UKYUEFJ2BWk=,iv:8LimsncylU+HhvVKNnjfyqZskZA72FQe92C4VrNWyQ0=,tag:L6CEno9m3ZncOskjZibq+Q==,type:str]
+    lastmodified: "2026-09-14T21:08:40Z"
+    mac: ENC[AES256_GCM,data:tfkmsJfWYV11ruw8fCUkJ2gWQAvQJ4Gmsz72LnmiCdlvzeo4x9iM268ZJnuaPRuv6BXLp2XGGA4CbqhfZbO6cRxAawVfbxY2IRSo1JWITIY8qxKLb07jDMpQu/JjJz7J5T556UEvOsW6HrK3d0xvNlJ4yQIuVCBjttKTdRu5g9Y=,iv:mV5i0xJGu6fnSNPLm9J3NDDgN+sB6iadue917UjR+oU=,tag:h/vaeQ02wK/qKANerWIywQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3