nix flake update

We don't have bastion setup for mosh hosts, so figuring out IP from
$SSH_CONNECTION is valid.

AGENTS.md

@@ -0,0 +1,86 @@
+# AGENTS.md
+
+Repository of personal dotfiles managed via Nix (home-manager, nix-darwin, NixOS) + GNU Stow for legacy config files.
+
+## Project Structure
+
+```
+flake.nix                    — Flake entrypoint: home/darwin/nixos configurations
+hosts/                       — Per-machine config files
+  deimos/                    — Linux server (NixOS machine + home-manager user)
+  mars/                      — macOS laptop (nix-darwin machine + home-manager user)
+  common/home.nix            — Per-user git config shared across hosts
+modules/                     — Reusable exported modules
+  home/*.nix                 — Shared home-manager modules (common, linux-headless, mac-portable)
+  nixos/*.nix                — NixOS modules (linux-headless, linux-lxc, jailed-agy)
+  darwin/*.nix               — nix-darwin modules (mac-portable)
+migrated/                    — Raw dotfiles (.zshrc, .vimrc) managed by BOTH stow and home-manager
+legacy/                      — Non-Nix config files managed purely via `stow legacy`
+```
+
+## Key Conventions
+
+### Flake inputs span multiple Nix versions
+
+The flake uses two nixpkgs sources: `nixpkgs` (nixos-unstable) for Linux, and `nixpkgs-mars` (nixpkgs-26.05-darwin) for macOS. The `darwin`, `home-manager-mars`, and `nix-homebrew` inputs all follow `-mars`. When the darwin-specific inputs are eventually dropped, the flake can be simplified (see comment at `flake.nix:52`).
+
+### Dual-dotfile management
+
+The `migrated/` and `legacy/` directories use GNU Stow to symlink files into `$HOME`. Home-manager also sources `migrated/.zshrc` and `migrated/.vimrc` at runtime via path detection — it checks for a local checkout first (`~/dotfiles/migrated/...`) before falling back to the Nix-built path. This allows live editing without rebuilding.
+
+### Module resolution
+
+Host-level files import shared modules in a chain rather than flat-merging:
+
+- `hosts/<name>/home.nix` → imports `hosts/common/home.nix` at minimum
+- `modules/home/linux-headless.nix` and `mac-portable.nix` both import `modules/home/common.nix`
+
+### Secrets via `identities` input
+
+The `fw_nix` input (`futureware-tech/nix`) provides an `identities` module used across all configurations. It exposes:
+
+- `identities.users.${user}.sign.<keyname>.publicKey` — SSH signing keys
+- `identities.getAccessKeys { user = ...; }` — authorized_keys for login
+- `identities.getSigningEntries {}` — git signers file entries
+
+These are passed via `specialArgs.primaryUser` and the `fw_nix.nixosModules.identities` import. Any host config that touches SSH keys or git signing depends on this.
+
+### SOPS / AGE encryption
+
+Secrets are encrypted with AGE using hardware-backed identities (Apple Secure Enclave, Yubikey). The identities file lives at `~/.config/sops/age/keys.txt` (Linux) or `~/Library/Application Support/sops/age/keys.txt` (macOS). Decryption only works on the hardware device; the identity files themselves are not sensitive.
+
+### Jailed AGY wrapper
+
+The `jailed-agy.nix` module wraps `antigravity-cli` in a sandbox via `jail.nix`. It's highly custom: sets up local pip/ruby/gem paths, forwards Nix vars, bind-mounts Nix store for `nix-shell`, and blocks root. If you need to add tools or adjust the jail, modify the combinator list there.
+
+### macOS SSH agent is Secretive
+
+On Mars (macOS), `SSH_AUTH_SOCK` points to the Secretive app socket manually (not a generic ssh-agent). This was a deliberate tradeoff: `ssh-agent-mux` doesn't work well with Secretive + YubiKey agent together. Commit signing keys use the `key::` SSH URI format (`gpg.format = "ssh"`).
+
+### stateVersion immutability
+
+Both `modules/nixos/linux-headless.nix` and `modules/darwin/mac-portable.nix` have `"Never change"` comments next to `system.stateVersion`. Do not modify these.
+
+## Essential Commands
+
+| Command                                      | Description                                                       |
+| -------------------------------------------- | ----------------------------------------------------------------- |
+| `nix flake check`                            | Run pre-commit hooks (nixfmt, dead code checks via git-hooks.nix) |
+| `nix develop`                                | Enter dev shell with pre-commit hook packages available           |
+| `home-manager switch --flake .#artem@deimos` | Apply home-manager config for deimos (Linux)                      |
+| `home-manager switch --flake .#artem@mars`   | Apply home-manager config for mars (macOS)                        |
+| `darwin-rebuild switch --flake .#mars`       | Apply nix-darwin config for mars                                  |
+| `nixos-rebuild switch --flake .#deimos`      | Apply NixOS config for deimos                                     |
+| `stow legacy`                                | Symlink non-Nix configs from `legacy/` into `$HOME`               |
+
+### Pre-commit exclusions
+
+The git-hooks.nix pre-commit check explicitly excludes `migrated/` and `legacy/` paths. Formatting tools only run on `.nix` files in `hosts/`, `modules/`, `flake.nix`, etc.
+
+## Gotchas
+
+- **Unused `with pkgs`** — `modules/nixos/linux-headless.nix:14` has an unnecessary `with pkgs; [...]` that nixd warns about but is left as-is since the `[` immediately after it makes the block valid. Consider removing when editing that file.
+- **SSH_AUTH_SOCK in tmux** — The tmux config hardcodes `SSH_AUTH_SOCK=$HOME/.ssh/ssh_auth_sock`. On Linux this is a socket symlinked by home-manager; on macOS Secretive provides it. Changing this path breaks SSH inside tmux.
+- **Home-assistant sshfs mount** — The deimos home config mounts a remote Home Assistant directory via sshfs. The `umount.fuse.sshfs` wrapper script in `linux-headless.nix` is required because of SUID restrictions on fusermount.
+- **Direnv + nix-direnv** — Enabled globally; `.envrc` files use `use flake` to enter dev shells automatically.
+- **Zsh loads from file, not Nix attrSet** — The `.zshrc` is sourced as a raw file path (not via `programs.zsh.initExtra`). Modifications to zsh behavior may need to go in either the Nix config (`initContent`) or the raw `migrated/.zshrc` depending on whether you want persistence outside Nix.

flake.lock

@@ -3,16 +3,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1781226006,
-        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
+        "lastModified": 1786348930,
+        "narHash": "sha256-bCQJkbgsAMDp5HQystZLCq11UHiyEuoWbxKulAPYrh8=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
+        "rev": "3ecc9eff23feebf1bc73846d74e14a122c93b66f",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "6.0.1",
+        "ref": "6.0.16",
         "repo": "brew",
         "type": "github"
       }
@@ -70,21 +70,21 @@
         "type": "github"
       }
     },
-    "flake-utils": {
+    "flake-parts": {
       "inputs": {
-        "systems": "systems_3"
+        "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
         "type": "github"
       }
     },
@@ -97,11 +97,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1783713126,
-        "narHash": "sha256-Q36Du9Ed1YwnQO1Mm9CHix/IcqAMkvSg34zExEfe8RI=",
+        "lastModified": 1783867522,
+        "narHash": "sha256-rJUjsQbVFWWFQ7Xwt69Ad76v7OIpDXbqzW25d+I2BBs=",
         "ref": "refs/heads/main",
-        "rev": "56d3b6dfdd46efcfb0a6f4643116a8f54cf2f89e",
-        "revCount": 45,
+        "rev": "e132e29c641ee55aba9ad08507ace53e19cf2b3e",
+        "revCount": 47,
         "type": "git",
         "url": "https://github.com/futureware-tech/nix.git"
       },
@@ -140,11 +140,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783008725,
-        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "lastModified": 1784288435,
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
         "type": "github"
       },
       "original": {
@@ -160,11 +160,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783823409,
-        "narHash": "sha256-OI4IkRjRXa1e7hYmCGJDPDq5H/kPwhsyoS80cNUF9fI=",
+        "lastModified": 1786887553,
+        "narHash": "sha256-0J8EwNSJ/2OeyuvXgfG+k5uBT1gkg0ww7VEo+14xl50=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7566825d4652a1b885bd4ce65bd9e8def432fec9",
+        "rev": "5bd505963717a894b02a57cdbcc00db28d9b029f",
         "type": "github"
       },
       "original": {
@@ -180,11 +180,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783740085,
-        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "lastModified": 1785119570,
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1781389246,
-        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
+        "lastModified": 1786686423,
+        "narHash": "sha256-8q3WdB8o3VUI7rOz1OXfioXIaaWbFTAxRJAkWLlfc0s=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
+        "rev": "ccabf79a6b9845eb72b51ea1d9c7ce3446350df3",
         "type": "github"
       },
       "original": {
@@ -229,11 +229,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783776592,
-        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
+        "lastModified": 1786862985,
+        "narHash": "sha256-FBJRXmbGXiSUDvYEbfLYRkckayyZ6SK1UEqhCrIZ2Cs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
+        "rev": "e5bdc4a41d4c072fe1e3787eaa0320a384741d44",
         "type": "github"
       },
       "original": {
@@ -243,13 +243,28 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-mars": {
       "locked": {
-        "lastModified": 1783788001,
-        "narHash": "sha256-ldd//kQFtHfGWLQd6deNXB6GnN6uLmwjPG6GGx/2vTA=",
+        "lastModified": 1786527240,
+        "narHash": "sha256-OLtJPnSXcRy79Rf7BhYaMeXAVF625FpLcd3+Svq641Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "572a2c2b6faebd71246e3162e4217d7ca63a9300",
+        "rev": "e0c84f9d0ad137f076dc957494f5b39885597d4f",
         "type": "github"
       },
       "original": {
@@ -304,34 +319,16 @@
         "type": "github"
       }
     },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "vscode-server": {
       "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "flake-parts": "flake-parts"
       },
       "locked": {
-        "lastModified": 1770124655,
-        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "lastModified": 1784312229,
+        "narHash": "sha256-2uHCSUw341o3my1R0U0YCfbnMEazylxb58evWsjGL50=",
         "owner": "nix-community",
         "repo": "nixos-vscode-server",
-        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "rev": "2f984dfbe7e5271b5c413d3e734374cc1306c921",
         "type": "github"
       },
       "original": {

flake.nix

@@ -13,10 +13,7 @@
       url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs-mars";
     };
-    vscode-server = {
-      url = "github:nix-community/nixos-vscode-server";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    vscode-server.url = "github:nix-community/nixos-vscode-server";
     fw_nix = {
       url = "git+https://github.com/futureware-tech/nix.git";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/deimos/home.nix

@@ -20,6 +20,16 @@ in
     "$HOME/.antigravity-server"
   ];
 
+  home.packages = with pkgs; [
+    sshfs
+    nixd
+    home-assistant-cli
+    yt-dlp
+    attic-client
+    opencode
+    crush
+  ];
+
   systemd.user.mounts."${haremote-unit}" = {
     Unit = {
       Description = "Mount ${haremote-path}";

hosts/deimos/nixos.nix

@@ -22,14 +22,7 @@
 
   nixpkgs.config.allowUnfree = true;
 
-  environment.systemPackages = with pkgs; [
-    # TODO: move below into hosts/deimos/home.nix
-    sshfs
-    nixd
-    home-assistant-cli
-    yt-dlp
-    attic-client
-  ];
+  programs.fuse.enable = true; # for ~/src/haremote mount
 
   # For building RPi configs. Extra steps are handled by the host (nas).
   # https://discuss.linuxcontainers.org/t/systemd-binfmt-service-is-masked/21566/4

hosts/mars/home.nix

@@ -36,4 +36,27 @@
   # https://nest.pijul.com/yonkeltron/macOS-nix-config:main/ZLDSMIXK5XFW6.EIAAA
   # and
   # https://github.com/bgub/nix-macos-starter/tree/main
+
+  launchd.agents.keyboard-remap = {
+    # Remap top-left key (paragraph) to backquote and backslash like
+    # proper ISO keyboard does, and the key right to the LShift to
+    # Shift.
+    enable = true;
+    config = {
+      Label = "com.user.keyboard-remap";
+      ProgramArguments = [
+        "/usr/bin/hidutil"
+        "property"
+        "--set"
+        ''
+          {"UserKeyMapping":
+            [
+              {"HIDKeyboardModifierMappingSrc":0x700000035, "HIDKeyboardModifierMappingDst":0x7000000e1},
+              {"HIDKeyboardModifierMappingSrc":0x700000064, "HIDKeyboardModifierMappingDst":0x700000035},
+            ]
+          }''
+      ];
+      RunAtLoad = true;
+    };
+  };
 }

legacy/.config/crush/crush.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://charm.land/crush.json",
+  "options": {
+    "disable_metrics": true
+  },
+  "providers": {
+    "crush": {
+      "disable": true
+    },
+    "exa": {
+      "disable": true
+    },
+    "local-ollama": {
+      "type": "openai-compat",
+      "base_url": "http://ollama.home.arpa:11434/v1",
+      "api_key": "ollama",
+      "models": [
+        {
+          "id": "gemma4-1gpu",
+          "name": "gemma4-1gpu",
+          "context_window": 48000,
+          "cost_per_1m_in": 0,
+          "cost_per_1m_out": 0,
+          "cost_per_1m_in_cached": 0,
+          "cost_per_1m_out_cached": 0,
+          "default_max_tokens": 8192,
+          "can_reason": true,
+          "supports_attachments": true
+        },
+        {
+          "id": "qwen3.6-1gpu",
+          "name": "qwen3.6-1gpu",
+          "context_window": 128000,
+          "cost_per_1m_in": 0,
+          "cost_per_1m_out": 0,
+          "cost_per_1m_in_cached": 0,
+          "cost_per_1m_out_cached": 0,
+          "default_max_tokens": 8192,
+          "can_reason": true,
+          "supports_attachments": true
+        }
+      ]
+    }
+  },
+  "models": {
+    "default": {
+      "provider": "local-ollama",
+      "model": "qwen3.6-1gpu",
+      "think": true
+    }
+  },
+  "mcp": {
+    "nix": {
+      "type": "stdio",
+      "command": "nix",
+      "args": [
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ]
+    },
+    "gitea": {
+      "type": "stdio",
+      "command": "nix",
+      "args": [
+        "run",
+        "nixpkgs#gitea-mcp-server",
+        "--"
+      ]
+    },
+    "ha": {
+      "type": "stdio",
+      "command": "nix",
+      "args": [
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "env": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      }
+    }
+  }
+}

legacy/.config/opencode/opencode.jsonc

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+
+  // "take me offline" block
+  "experimental": { "openTelemetry": false },
+  "share": "disabled",
+  "autoupdate": false,
+  "disabled_providers": ["opencode", "exa"],
+
+  "provider": {
+    "local-ollama": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Ollama",
+      "options": {
+        "baseURL": "http://ollama.home.arpa:11434/v1",
+        "apiKey": "ollama"
+      },
+      "models": {
+        "gemma4-1gpu": {
+          "limit": {
+            "context": 48000,
+            "output": 8192
+          },
+          "tools": true
+        },
+        "qwen3.6-1gpu": {
+          "limit": {
+            "context": 128000,
+            "output": 8192
+          },
+          "tools": true
+        }
+      }
+    }
+  },
+  // "model": "local-ollama/qwen2.5-coder:14b",
+  "model": "local-ollama/qwen3.6-200k",
+  "compaction": {
+    "auto": true,
+    "prune": true,
+    "threshold": 0.75,
+    "preserve_recent_tokens": 8192,
+    "reserved": 16384
+  },
+  "tool_output": {
+    "max_bytes": 16384,
+    "max_lines": 200
+  },
+  "agent": {
+    "build": {
+      "steps": 1000
+    }
+  },
+  "mcp": {
+    "nix": {
+      "type": "local",
+      "command": [
+        "nix",
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ],
+      "enabled": true
+    },
+    "gitea": {
+      "type": "local",
+      "command": [
+        "nix",
+        "run",
+        "nixpkgs#gitea-mcp-server",
+        "--"
+      ],
+      "enabled": false
+    },
+    "ha": {
+      "type": "local",
+      "command": [
+        "nix",
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "environment": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      },
+      "enabled": false
+    }
+  }
+}

migrated/.zshrc

@@ -168,11 +168,28 @@ colordiff() {
 
 osh() {
 	local DEST="$1"
-	# TODO: loop to re-establish connection in case of network drop.
-	#       Kill the loop after mosh (below) finishes.
-	ssh -O check "$DEST" 2>/dev/null || ssh -A -f -o ControlPersist=yes "$DEST" "sleep 2592000"
-	# Disable agent forwarding on the bootstrap connection to prevent it from overwriting the symlink in .ssh/rc
-	mosh --ssh="ssh -a" "$@"
+	local PARENT_PID=$$
+
+	_osh_ensure_ssh() {
+		ssh -A -o ServerAliveInterval=2 -o ServerAliveCountMax=3 -o ControlPersist=yes "$@"
+	}
+
+	# Authenticate in foreground first to ensure Touch ID doesn't conflict with mosh
+	_osh_ensure_ssh "$DEST" true
+
+	(
+		while kill -0 $PARENT_PID 2>/dev/null; do
+			# Avoid using TTY as that will instantly suspend the loop
+			_osh_ensure_ssh -n -q -o BatchMode=yes "$DEST" "sleep 2592000"
+			sleep 1
+		done
+	) &
+	local loop_pid=$!
+
+	# Allow mosh reuse of our master session.
+	mosh --experimental-remote-ip=remote "$@"
+
+	kill $loop_pid 2>/dev/null
 }
 
 alias backup-home-explore='eval "ncdu $(grep -A1 -- --exclude $HOME/bin/backup-home | tr -d \|)"'