Mount docker from persistence

Improve jailed-agy
Add python, ruby, go, custom paths.
2026-06-21 21:13:21 +00:00 · 2026-06-19 13:37:00 +00:00 · 2026-06-19 12:03:08 +00:00 · 2026-06-12 13:35:31 +00:00 · 2026-06-11 19:27:46 +00:00 · 2026-06-09 19:19:27 +00:00
49 changed files with 986 additions and 719 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@ result

 # nix pre-commit autogenerated by devShell
 /.pre-commit-config.yaml
+
+# agy sessions
+.antigravitycli
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,39 +0,0 @@
-[submodule "legacy/.vim/bundle/ctrlp.vim"]
-	path = legacy/.vim/bundle/ctrlp.vim
-	url = https://github.com/kien/ctrlp.vim
-[submodule "legacy/.vim/bundle/vim-startify"]
-	path = legacy/.vim/bundle/vim-startify
-	url = https://github.com/mhinz/vim-startify
-[submodule "legacy/.vim/bundle/nerdcommenter"]
-	path = legacy/.vim/bundle/nerdcommenter
-	url = https://github.com/scrooloose/nerdcommenter
-[submodule "legacy/.vim/bundle/vim-showmarks"]
-	path = legacy/.vim/bundle/vim-showmarks
-	url = https://github.com/jacquesbh/vim-showmarks
-[submodule "legacy/.vim/bundle/vim-coffee-script"]
-	path = legacy/.vim/bundle/vim-coffee-script
-	url = https://github.com/kchmck/vim-coffee-script
-[submodule "legacy/.vim/bundle/nginx.vim"]
-	path = legacy/.vim/bundle/nginx.vim
-	url = https://github.com/vim-scripts/nginx.vim
-[submodule "legacy/.vim/bundle/supertab"]
-	path = legacy/.vim/bundle/supertab
-	url = https://github.com/ervandew/supertab
-[submodule "legacy/.vim/bundle/vim-pathogen"]
-	path = legacy/.vim/bundle/vim-pathogen
-	url = https://github.com/tpope/vim-pathogen.git
-[submodule "legacy/.vim/bundle/vim-sensible"]
-	path = legacy/.vim/bundle/vim-sensible
-	url = https://github.com/tpope/vim-sensible.git
-[submodule "legacy/.vim/bundle/auto-pairs"]
-	path = legacy/.vim/bundle/auto-pairs
-	url = https://github.com/jiangmiao/auto-pairs
-[submodule "legacy/.vim/bundle/vim-javascript"]
-	path = legacy/.vim/bundle/vim-javascript
-	url = https://github.com/pangloss/vim-javascript.git
-[submodule "legacy/.vim/bundle/vim-lastplace"]
-	path = legacy/.vim/bundle/vim-lastplace
-	url = https://github.com/farmergreg/vim-lastplace.git
-[submodule "legacy/.vim/bundle/dart-vim-plugin"]
-	path = legacy/.vim/bundle/dart-vim-plugin
-	url = https://github.com/dart-lang/dart-vim-plugin.git
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -0,0 +1,7 @@
+Copyright (c) 2026 dotdoom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/README.md
+++ b/README.md
@@ -1,10 +1,13 @@
+# User and machine configs
+
+## Installation
+
 Step 1.

 ```
 cd
 git clone git@github.com:dotdoom/dotfiles.git
 cd dotfiles
-git submodule update --init
 ```

 Step 2 - stow.
@@ -23,5 +26,150 @@ nix run \
    switch \
      --extra-experimental-features 'nix-command flakes' \
      --flake .#artem@deimos
-stow legacy
 ```
+
+## Layout
+
+- `migrated`: files which are assets for home-manager, but can still be used to
+  stow
+- `legacy`: files to be placed under `$HOME` which are still under stow
+- `hosts/*/{darwin,nixos,home}.nix`: personal machine nix configs
+- `modules/{darwin,nixos,home}/*.nix`: exported nix configs
+
+TODO: rename `migrated` to `assets` and create `exported` which would be the
+exact mirror of nix-built configuration, but without nix (for machines where nix
+can not be installed). That `exported` will then be used by stow.
+
+## Security
+
+Risks taken (disclaimer):
+
+- hardware attestation (this documentation and some code lists almost precisely
+  the hardware I use, and the way I use it)
+- privacy (committing public keys technically allows verifying which servers I
+  have access to).
+
+### SSH client
+
+- `.ssh/id_XXXXX`
+
+  Static keys (stored in bitwarden). These have to be passphrase-protected when
+  stored on a disk; use `ssh-keygen -p -f .ssh/id_XXXXX`.
+
+  The use of these keys is expected to be low, but SSH may always fall back to
+  it, in which case you have to remember and type the passphrase. Use
+  `ssh-add -D` to remove unencrypted identity from memory afterwards. Saving a
+  passphrase in keychain is possible, but using Security Enclave is recommended
+  instead.
+
+- Apple Security Enclave
+
+  This is the most used but also most ephemeral key, because it's bound to a
+  machine. It's provided by Secretive app acting as an SSH agent and the private
+  key is stored in Apple Security Enclave on a MacBook, requiring a fingerprint
+  touch on SSH.
+
+- Yubikey
+
+  Yubikey PIV can be used as Smart Card, requiring a daemon and PGP
+  infrastructure. It's useful when a root entity is signing certificates from
+  multiple Yubikey owners, i.e. in large enterprise.
+
+  Another obstacle is that we already use Secretive as our SSH agent, and it
+  doesn't mux well with Yubikey agent, see `mac-portable.nix` for details.
+
+  Instead of PIV, we use FIDO2 slots on Yubikey to generate resident (i.e.
+  stored solely on Yubikey itself) SSH keys using modern OpenSSH client built-in
+  FIDO2 support. This doesn't need an agent or a background daemon. The lack of
+  agent however means that these keys can not be forwarded to remote host for
+  further SSH, Git signing or push.
+
+  To generate a new key:
+
+  ```
+  ssh-keygen -t ed25519-sk -O resident -O verify-required
+  # Omit "-O verify-required" to skip PIN; only if key is physically safe.
+  # Add "-O no-touch-required" to skip touch.
+  ```
+
+  To restore "private key" files (remove `_rk` and drop them into `.ssh`):
+
+  ```
+  ssh-keygen -K
+  ```
+
+  To list or delete FIDO2 (and WebAuthn) credentials:
+
+  ```
+  ykman fido credentials list
+  ykman fido credentials delete abcdef123
+  ```
+
+### SSH from VM
+
+For trusted VMs, ssh-agent forwarding is configured in `.ssh/config.d/local`:
+
+```
+Host deimos
+  ForwardAgent yes
+```
+
+### Commit signing
+
+Use SSH keys (from Apple SE and Yubikey) to sign commits. Make sure to generate
+a different set of keys for signing than the one you use for authentication, to
+decouple authentication from authorization and reduce key leakage blast radius.
+Add `-O application=ssh:git-signature` to mark the key for signing (personal
+convention).
+
+### AGE encryption
+
+All files are encrypted using some sort of hardware. Using an on-disk key alone
+is not sufficient.
+
+Each of the AGE plugins generates and subsequently during decryption uses a
+(usually not sensitive) identity, which contains metadata about how to access
+the specific cryptography on underlying hardware. Use the plugin directly to
+initialize the hardware:
+
+- `age-plugin-se keygen --access-control any-biometry-or-passcode`
+- `age-plugin-yubikey --generate`
+
+The identities which can be used to decrypt the secrets for editing (i.e.
+Yubikey PIV, Apple SE) are concatenated into a single file:
+
+- MacOS: `~/Library/Application Support/sops/age/keys.txt`
+- Linux: `~/.config/sops/age/keys.txt`
+
+which is not secret. You can only decrypt the data on the device where Yubikey
+is plugged into, or one that has Apple SE or a TPM.
+
+For Yubikey, you can also retrieve the identity using `age-plugin-yubikey -i`,
+feeding the output directly into the identities file. To manage a Yubikey:
+
+```
+# Disable unused features
+$ ykman config nfc --disable OTP
+$ ykman config usb --disable OTP
+
+# Check what's already there; slot 9A can be used by `O=yubikey-agent`; we don't
+# rely on that key at the moment, see SSH above
+$ ykman piv info
+
+# To delete a key (age-plugin-yubikey uses 82 for slot 1, 83 for slot 2 etc).
+$ ykman piv certificates delete 82
+
+# Fully reset (initialize).
+$ ykman piv reset
+
+# See Bitwarden for keys
+$ ykman piv access change-pin
+$ ykman piv access change-puk
+```
+
+### Remote decryption
+
+There's an ephemeral SSH server configured in `.ssh/ephemeral_sshd` which will
+listen on localhost. If you port-forward it to remote machine, it can be
+configured to run certain binaries (age plugins) through a reverse SSH
+connection, which enables the use of local hardware to decrypt remote secrets.
--- a/flake.lock
+++ b/flake.lock
@@ -3,16 +3,16 @@
    "brew-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1774235677,
-        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
+        "lastModified": 1781226006,
+        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
        "owner": "Homebrew",
        "repo": "brew",
-        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
+        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
        "type": "github"
      },
      "original": {
        "owner": "Homebrew",
-        "ref": "5.1.1",
+        "ref": "6.0.1",
        "repo": "brew",
        "type": "github"
      }
@@ -24,11 +24,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773000227,
-        "narHash": "sha256-zm3ftUQw0MPumYi91HovoGhgyZBlM4o3Zy0LhPNwzXE=",
+        "lastModified": 1781761792,
+        "narHash": "sha256-rCPytmKNjctLloB6UgK5CRrHSwV4b0ygxtJLPPp8R14=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "da529ac9e46f25ed5616fd634079a5f3c579135f",
+        "rev": "a1fa429e945becaf60468600daf649be4ba0350c",
        "type": "github"
      },
      "original": {
@@ -96,11 +96,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1774806429,
-        "narHash": "sha256-/JmCLKvEiywENQNGmB1VHIQDmBBWIHhBG+b32opRVZM=",
+        "lastModified": 1781866110,
+        "narHash": "sha256-eysWGLqD/9ZshEAg1bj1O8QpJZ6UoDEpjWzBJaR6ono=",
        "ref": "refs/heads/main",
-        "rev": "ab9d93a3462b4efbb3fc81fea4ad709ae1bf5fda",
-        "revCount": 16,
+        "rev": "7fdd373d58137cdcddd8ba6f00ee06186affe5a5",
+        "revCount": 36,
        "type": "git",
        "url": "https://github.com/futureware-tech/nix.git"
      },
@@ -119,11 +119,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774104215,
-        "narHash": "sha256-EAtviqz0sEAxdHS4crqu7JGR5oI3BwaqG0mw7CmXkO8=",
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f799ae951fde0627157f40aec28dec27b22076d0",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
        "type": "github"
      },
      "original": {
@@ -141,11 +141,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774104215,
-        "narHash": "sha256-EAtviqz0sEAxdHS4crqu7JGR5oI3BwaqG0mw7CmXkO8=",
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f799ae951fde0627157f40aec28dec27b22076d0",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
        "type": "github"
      },
      "original": {
@@ -204,11 +204,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774007980,
-        "narHash": "sha256-FOnZjElEI8pqqCvB6K/1JRHTE8o4rer8driivTpq2uo=",
+        "lastModified": 1781844424,
+        "narHash": "sha256-sWBr0D6eu6UhmtM87NOd4oOYilIclFXGDd/s7tVvO10=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "9670de2921812bc4e0452f6e3efd8c859696c183",
+        "rev": "c804fab681f03ec772390af4421bcc9bce80c1d9",
        "type": "github"
      },
      "original": {
@@ -219,11 +219,11 @@
    },
    "jail-nix": {
      "locked": {
-        "lastModified": 1770418571,
-        "narHash": "sha256-EzQUbe1gwW/xpJoMuMeblWcjAEF+F92cz/enz0Mz/qo=",
+        "lastModified": 1776230864,
+        "narHash": "sha256-YsEjjdOsGEzTeD+iT7ONh071BqWAOQWpzYVei3okAXE=",
        "owner": "~alexdavid",
        "repo": "jail.nix",
-        "rev": "c141cf8cc68617625b4a28a7d8ce0a35904815d5",
+        "rev": "404e7da9da5ab9aa643666682b2ba1312fa5fbe8",
        "type": "sourcehut"
      },
      "original": {
@@ -237,11 +237,11 @@
        "brew-src": "brew-src"
      },
      "locked": {
-        "lastModified": 1774720267,
-        "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
+        "lastModified": 1781389246,
+        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
        "owner": "zhaofengli",
        "repo": "nix-homebrew",
-        "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
+        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
        "type": "github"
      },
      "original": {
@@ -252,11 +252,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1773821835,
-        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
        "type": "github"
      },
      "original": {
@@ -266,22 +266,6 @@
        "type": "github"
      }
    },
-    "nixpkgs-screen": {
-      "locked": {
-        "lastModified": 1737753705,
-        "narHash": "sha256-fQeXAeNQrsEUH3fd6RTjN/W+8flJiAFHo7Eya2RT87M=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e518d4ad2bcad74f98fec028cf21ce5b1e5020dd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e518d4ad2bcad74f98fec028cf21ce5b1e5020dd",
-        "type": "github"
-      }
-    },
    "root": {
      "inputs": {
        "darwin": "darwin",
@@ -291,7 +275,6 @@
        "jail-nix": "jail-nix",
        "nix-homebrew": "nix-homebrew",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-screen": "nixpkgs-screen",
        "systems": "systems_2",
        "vscode-server": "vscode-server"
      }
--- a/flake.nix
+++ b/flake.nix
@@ -3,11 +3,6 @@

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    # too many issues with screen 5.0
-    # - load average in status broken
-    # - background colors in programs (eg less) not showing
-    # - caption and hardstatus color lacks intensity
-    nixpkgs-screen.url = "github:NixOS/nixpkgs/e518d4ad2bcad74f98fec028cf21ce5b1e5020dd";
    systems.url = "github:nix-systems/default";
    home-manager = {
      url = "github:nix-community/home-manager";
@@ -44,11 +39,7 @@
      ...
    }@inputs:
    let
-      trustedSSHKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxRBsFGa8OFbviYDGSAKLgfm/K2XUxvCo+31FW37yab artem"
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJhQjxeLZUWdEPMqPNS8wTTrg4lbzBAOLKvdsJd0fSBcW5ILuEbKQjgEIwmYuR/iGhnqIp7rQK48xL/4CauQUyg= office-dock-usb-a"
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJg7zQ4H0LQeQcILZBwCzQ+MYKtCgKm7HPe9oFeoyprKZXAvpm+HDHtaYdU39JF9f+nvRztzXuMhgETAQMAQCkc= fingerprint@macbook"
-      ];
+      homeManagerUser = "artem";
      eachSystem = nixpkgs.lib.genAttrs (import systems);
    in
    {
@@ -68,21 +59,35 @@
      darwinModules = {
        mac-portable = import ./modules/darwin/mac-portable.nix;
      };
+      nixosModules = {
+        linux-headless = import ./modules/nixos/linux-headless.nix;
+        linux-lxc = import ./modules/nixos/linux-lxc.nix;
+        jailed-agy = import ./modules/nixos/jailed-agy.nix;
+      };

-      homeConfigurations."artem@deimos" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs.primaryUser = "artem";
+      homeConfigurations."${homeManagerUser}@deimos" = home-manager.lib.homeManagerConfiguration {
+        pkgs = import nixpkgs {
+          system = "x86_64-linux";
+        };
+        extraSpecialArgs.primaryUser = homeManagerUser;
        modules = [
+          inputs.fw_nix.nixosModules.identities
          vscode-server.homeModules.default
          self.homeModules.linux-headless
          ./hosts/deimos/home.nix
        ];
      };

-      homeConfigurations."artem@mars" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-darwin;
-        extraSpecialArgs.primaryUser = "artem";
+      homeConfigurations."${homeManagerUser}@mars" = home-manager.lib.homeManagerConfiguration {
+        pkgs = import nixpkgs {
+          system = "x86_64-darwin";
+          config.allowDeprecatedx86_64Darwin = true;
+        };
+        extraSpecialArgs = {
+          primaryUser = homeManagerUser;
+        };
        modules = [
+          inputs.fw_nix.nixosModules.identities
          self.homeModules.mac-portable
          ./hosts/mars/home.nix
        ];
@@ -90,39 +95,41 @@

      darwinConfigurations.mars = darwin.lib.darwinSystem {
        system = "x86_64-darwin";
-        specialArgs.primaryUser = "artem";
+        specialArgs.primaryUser = homeManagerUser;
        modules = [
+          inputs.fw_nix.nixosModules.identities
          self.darwinModules.mac-portable
-          inputs.fw_nix.nixosModules.tools
+          inputs.fw_nix.nixosModules.nix-gc
          inputs.fw_nix.nixosModules.nix-settings
+          inputs.fw_nix.nixosModules.tools
          inputs.fw_nix.nixosModules.futureware
          inputs.nix-homebrew.darwinModules.nix-homebrew
          ./hosts/mars/darwin.nix
+          {
+            nixpkgs.config.allowDeprecatedx86_64Darwin = true;
+          }
        ];
      };

-      nixosConfigurations.deimos =
-        let
-          system = "x86_64-linux";
-        in
-        nixpkgs.lib.nixosSystem {
-          inherit system;
-          specialArgs = {
-            inherit trustedSSHKeys;
-            inherit (inputs) jail-nix;
-            pkgs-screen = import inputs.nixpkgs-screen {
-              inherit system;
-            };
-          };
-          modules = [
-            inputs.fw_nix.nixosModules.nix-gc
-            inputs.fw_nix.nixosModules.nix-settings
-            inputs.fw_nix.nixosModules.tools
-            inputs.fw_nix.nixosModules.sshd
-            inputs.fw_nix.nixosModules.futureware
-            ./hosts/deimos/nixos.nix
-          ];
+      nixosConfigurations.deimos = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = {
+          primaryUser = homeManagerUser;
+          inherit (inputs) jail-nix;
        };
+        modules = [
+          inputs.fw_nix.nixosModules.identities
+          self.nixosModules.linux-headless
+          self.nixosModules.linux-lxc
+          self.nixosModules.jailed-agy
+          inputs.fw_nix.nixosModules.nix-gc
+          inputs.fw_nix.nixosModules.nix-settings
+          inputs.fw_nix.nixosModules.tools
+          inputs.fw_nix.nixosModules.sshd
+          inputs.fw_nix.nixosModules.futureware
+          ./hosts/deimos/nixos.nix
+        ];
+      };

      devShells = eachSystem (
        system:
--- a/hosts/common/home.nix
+++ b/hosts/common/home.nix
@@ -0,0 +1,22 @@
+{
+  identities,
+  primaryUser,
+  ...
+}:
+let
+  user = identities.users.${primaryUser};
+in
+{
+  programs.git = {
+    signing = {
+      # Will be available on remote machines via SSH agent (Secretive).
+      key = "key::" + user.sign."sign@mars".publicKey;
+      signByDefault = true;
+    };
+
+    settings.user = {
+      name = "Artem Sheremet";
+      inherit (user) email;
+    };
+  };
+}
--- a/hosts/deimos/home.nix
+++ b/hosts/deimos/home.nix
@@ -1,5 +1,18 @@
-_: {
-  home.homeDirectory = "/home/artem";
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  utils = import "${pkgs.path}/nixos/lib/utils.nix" { inherit lib pkgs config; };
+  haremote-path = "${config.home.homeDirectory}/src/haremote";
+  haremote-unit = utils.escapeSystemdPath haremote-path;
+in
+{
+  imports = [
+    ../common/home.nix
+  ];

  services.vscode-server.enable = true;
  services.vscode-server.installPath = [
@@ -7,17 +20,17 @@ _: {
    "$HOME/.antigravity-server"
  ];

-  systemd.user.mounts.home-artem-src-haremote = {
+  systemd.user.mounts."${haremote-unit}" = {
    Unit = {
-      Description = "Mount ~/src/haremote";
+      Description = "Mount ${haremote-path}";
      After = [ "network-online.target" ];
      Wants = [ "network-online.target" ];
    };
    Mount = {
      What = "root@homeassistant.home.arpa:/homeassistant";
-      Where = "/home/artem/src/haremote";
+      Where = haremote-path;
      Type = "fuse.sshfs";
-      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=/home/artem/.ssh/ssh_auth_sock";
+      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=${config.home.homeDirectory}/.ssh/ssh_auth_sock";
    };
    Install = {
      WantedBy = [ "default.target" ];
@@ -26,8 +39,8 @@ _: {

  programs.zsh.loginExtra = ''
    if [ -n "$SSH_AUTH_SOCK" ]; then
-      mkdir -p ~/src/haremote
-      [ -z "$(ls -A ~/src/haremote 2>/dev/null)" ] && systemctl --user restart home-artem-src-haremote.mount
+      mkdir -p ${haremote-path}
+      [ -z "$(ls -A ${haremote-path} 2>/dev/null)" ] && systemctl --user restart ${haremote-unit}.mount
    fi
  '';
 }
--- a/hosts/deimos/nixos.nix
+++ b/hosts/deimos/nixos.nix
@@ -1,177 +1,35 @@
 {
-  modulesPath,
  pkgs,
-  pkgs-screen,
-  trustedSSHKeys,
-  jail-nix,
+  identities,
+  primaryUser,
  ...
 }:
-let
-  jail = jail-nix.lib.init pkgs;
-in
 {
-  imports = [
-    "${modulesPath}/virtualisation/lxc-container.nix"
-  ];
-  # Disable legacy channel behavior that lxc-container brings in via installer/cd-dvd/channel.nix.
-  system.installer.channel.enable = false;
-
-  # Impermanence setup:
-  # 1. There's no initrd/stage 1 in LXC container; /sbin/init is invoked after
-  #    LXC finishes setting up special and user-configured filesystems. Any
-  #    options in boot.initrd, as well as neededForBoot fileSystems won't be
-  #    respected.
-  # 2. Non-boot fileSystems (aka systemd) mount too late for systemd or nixos
-  #    persistence to be instantiated, so we have to create this script below.
-  # 3. The expectation from host is to mount /home and /nix. Root filesystem
-  #    will also be a disk, as that's Incus requirement; the host should clean
-  #    it up periodically using: "incus rebuild --empty <vm>".
-  # 4. Since rootfs will be empty after rebuild, you have to point LXC at the
-  #    current init (instead of /sbin/init), by adding to the "config:" section
-  #    in "incus config edit <vm>":
-  #      raw.lxc: lxc.init.cmd = /nix/var/nix/profiles/system/init
-  system.activationScripts.persistence = {
-    deps = [ "specialfs" ];
-    text = ''
-      persist() {
-        local item="$1"
-        local constructor="''${item%%:*}"
-        local target="''${item#*:}"
-
-        mkdir -p "$(dirname "$target")"
-        $constructor "$target"
-
-        if ! mountpoint -q "$target"; then
-          local source="/home/persistent/$target"
-
-          mkdir -p "$(dirname "$source")"
-          $constructor "$source"
-
-          mount --bind "$source" "$target"
-        fi
-      }
-
-      for item in \
-          "mkdir -p:/var/lib/nixos" \
-          "mkdir -p:/var/lib/systemd" \
-          "touch:/etc/machine-id" \
-          "touch:/etc/ssh/ssh_host_ed25519_key" \
-      ; do
-        persist "$item"
-      done
-
-      chmod 0600 /etc/ssh/ssh_host_ed25519_key
-
-      # lxc-container.nix installBootloader/installInitScript will attempt to
-      # symlink /sbin/init, so we have to create the parent directory.
-      mkdir -p /sbin
-    '';
-  };
-  system.activationScripts.users.deps = [ "persistence" ];
-
-  users.users.artem = {
+  users.users.${primaryUser} = {
    uid = 1000;
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "docker"
+      "kvm"
    ];
-    openssh.authorizedKeys.keys = trustedSSHKeys;
+    openssh.authorizedKeys.keys = identities.getAccessKeys { user = primaryUser; };
    shell = pkgs.zsh;
+    linger = true; # Keep sshfs mounted even on logout.
  };
-  # Create /etc/zshrc that loads the nix-darwin environment.
-  programs.zsh.enable = true;
-  security.sudo.wheelNeedsPassword = false;

  virtualisation.docker.enable = true;

-  documentation.man.enable = true;
+  nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
-    # TODO: clean this up against artem@deimos
-    git
-    pkgs-screen.screen
+    # TODO: move below into hosts/deimos/home.nix
    sshfs
-
-    # https://unix.stackexchange.com/questions/651165/using-systemd-to-mount-remote-filesystems-in-user-bus
-    # Have to run the wrapper due to SUID.
-    (pkgs.writeShellScriptBin "umount.fuse.sshfs" ''
-      exec /run/wrappers/bin/fusermount -u "$1"
-    '')
-
-    file
-    nixfmt
    nixd
    home-assistant-cli
-    gemini-cli
    yt-dlp
-
-    # From hosts/common/tools.nix:
-    # Software debug
-    iotop
-    dool # dool --time --disk -D /dev/sde,/dev/sdf --top-bio --top-cpu --zfs-arc
-    strace
-    ltrace
-    smem # smem -tkP nginx
-
-    # Hardware info and tunables
-    parted
-    hdparm
-    efivar
-    efibootmgr
-    sg3_utils # sg_unmap
-    lm_sensors # sensors
-    nvme-cli
-    dmidecode
-    ethtool
-
-    # jailed-gemini --yolo
-    (jail "jailed-gemini" pkgs.gemini-cli (
-      with jail.combinators;
-      [
-        network
-        time-zone
-        no-new-session
-        mount-cwd
-
-        (readwrite (noescape "~/.gemini"))
-
-        (add-pkg-deps (
-          with pkgs;
-          [
-            bashInteractive
-            curl
-            wget
-            jq
-            git
-            which
-            ripgrep
-            gnugrep
-            gnused
-            gawkInteractive
-            ps
-            findutils
-            gzip
-            unzip
-            gnutar
-            diffutils
-            coreutils
-
-            python3
-          ]
-        ))
-      ]
-    ))
  ];

-  # unprivileged LXCs can't set net.ipv4.ping_group_range
-  security.wrappers.ping = {
-    owner = "root";
-    group = "root";
-    capabilities = "cap_net_raw+p";
-    source = "${pkgs.iputils.out}/bin/ping";
-  };
-
  # For building RPi configs. Extra steps are handled by the host (nas).
  # https://discuss.linuxcontainers.org/t/systemd-binfmt-service-is-masked/21566/4
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
@@ -180,6 +38,4 @@ in
    hostName = "deimos";
    domain = "home.arpa";
  };
-
-  system.stateVersion = "25.11"; # Never change this.
 }
--- a/hosts/mars/home.nix
+++ b/hosts/mars/home.nix
@@ -1,5 +1,16 @@
-{ pkgs, ... }:
 {
+  pkgs,
+  lib,
+  config,
+  identities,
+  primaryUser,
+  ...
+}:
+{
+  imports = [
+    ../common/home.nix
+  ];
+
  home.packages = with pkgs; [
    dosbox-staging # dosbox appears broken on darwin

@@ -11,6 +22,16 @@
    antigravity
  ];

+  home.activation.setupAuthorizedKeys = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    run install -m 0600 -D \
+      ${
+        pkgs.writeText "keys" (
+          builtins.concatStringsSep "\n" (identities.getAccessKeys { user = primaryUser; })
+        )
+      } \
+      ${config.home.homeDirectory}/.ssh/ephemeral_sshd/authorized_keys
+  '';
+
  # TODO: consider
  # https://nest.pijul.com/yonkeltron/macOS-nix-config:main/ZLDSMIXK5XFW6.EIAAA
  # and
--- a/legacy/.config/Code/User/settings.json
+++ b/legacy/.config/Code/User/settings.json
@@ -9,7 +9,7 @@
    "**/.svn": true,
    "**/.vscode": true,
    "**/*.g.dart": true,
-    "**/CVS": true
+    "**/CVS": true,
  },
  "files.autoSave": "onFocusChange",
  "terminal.integrated.fontSize": 13,
@@ -24,7 +24,7 @@
  // Disable [confusing] file icons in Explorer
  "workbench.iconTheme": null,
  "editor.codeActionsOnSave": {
-    "source.organizeImports": "explicit"
+    "source.organizeImports": "explicit",
  },
  "debug.toolBarLocation": "docked",
  "debug.openDebug": "openOnDebugBreak",
@@ -39,7 +39,7 @@
    "Pluginfile": "ruby",
    "Matchfile": "ruby",
    "Gymfile": "ruby",
-    "Appfile": "ruby"
+    "Appfile": "ruby",
  },
  "git.decorations.enabled": false,
  "git.detectSubmodules": false,
@@ -51,11 +51,11 @@
  "workbench.colorTheme": "Default Dark+",

  "[javascript]": {
-    "editor.formatOnSave": false
+    "editor.formatOnSave": false,
  },

  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
  },

  "[dart]": {
@@ -66,16 +66,16 @@
    "editor.tabCompletion": "onlySnippets",

    // No suggestions when plugin does not provide them (comments, strings).
-    "editor.wordBasedSuggestions": "off"
+    "editor.wordBasedSuggestions": "off",
  },
  "search.exclude": {
-    "**/.flutter": true
+    "**/.flutter": true,
  },
  "editor.defaultFormatter": "esbenp.prettier-vscode",

  "nix.enableLanguageServer": true,
  "nix.serverPath": "nixd",
  "[nix]": {
-    "editor.defaultFormatter": "jnoortheen.nix-ide"
+    "editor.defaultFormatter": "jnoortheen.nix-ide",
  },
 }
--- a/legacy/.gemini/config/mcp_config.json
+++ b/legacy/.gemini/config/mcp_config.json
@@ -0,0 +1,29 @@
+{
+  "mcpServers": {
+    "nix": {
+      "command": "nix",
+      "args": [
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ]
+    },
+    "ha": {
+      "command": "nix",
+      "args": [
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "env": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      }
+    }
+  }
+}
--- a/legacy/.gemini/policies/coding.toml
+++ b/legacy/.gemini/policies/coding.toml
@@ -34,6 +34,24 @@ commandPrefix = "git show"
 decision = "allow"
 priority = 100

+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "git log"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "git diff"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "diff"
+decision = "allow"
+priority = 100
+
 [[rule]]
 toolName = "run_shell_command"
 commandPrefix = "mkdir"
@@ -82,3 +100,27 @@ toolName = "run_shell_command"
 commandPrefix = "ls"
 decision = "allow"
 priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "find"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "head"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "echo"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "sha256sum"
+decision = "allow"
+priority = 100
--- a/legacy/.gemini/policies/nix-build.toml
+++ b/legacy/.gemini/policies/nix-build.toml
@@ -18,5 +18,24 @@ priority = 100

 [[rule]]
 mcpName = "nix"
+toolName = "*"
 decision = "allow"
-priority = 500
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "nix-hash"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "nix-diff"
+decision = "allow"
+priority = 100
+
+[[rule]]
+toolName = "run_shell_command"
+commandPrefix = "nix flake check"
+decision = "allow"
+priority = 100
--- a/legacy/.gemini/settings.json
+++ b/legacy/.gemini/settings.json
@@ -1,32 +0,0 @@
-{
-  "mcpServers": {
-    "nix": {
-      "command": "nix",
-      "args": [
-        "run",
-        "github:utensils/mcp-nixos",
-        "--"
-      ]
-    },
-    "ha": {
-      "url": "${HASS_SERVER}/mcp_server/sse",
-      "headers": {
-        "Authorization": "Bearer ${HASS_TOKEN}"
-      },
-      "timeout": 5000
-    }
-  },
-  "security": {
-    "auth": {
-      "selectedType": "oauth-personal"
-    }
-  },
-  "general": {
-    "sessionRetention": {
-      "warningAcknowledged": true,
-      "enabled": true,
-      "maxAge": "30d"
-    },
-    "preferredEditor": "vim"
-  }
-}
--- a/legacy/.gitconfig
+++ b/legacy/.gitconfig
@@ -1,44 +0,0 @@
-[color]
-	ui = auto
-[alias]
-	co = checkout
-	st = status
-	di = diff -w --no-prefix
-	df = diff
-	dc = diff --cached
-	ci = commit
-	br = branch
-	lg = log -p --decorate=full --show-signature
-	lol = log --graph --decorate=full --pretty=oneline --abbrev-commit
-	lola = log --graph --decorate=full --pretty=oneline --abbrev-commit --all
-	ls = ls-files
-	# Show files ignored by git:
-	ign = ls-files -o -i --exclude-standard
-[apply]
-	whitespace = nowarn
-[push]
-	default = tracking
-[rebase]
-	stat = yes
-[format]
-	pretty = fuller
-[fetch]
-	prune = yes
-[credential "https://source.developers.google.com"]
-	helper = gcloud.sh
-[core]
-	autocrlf = input
-[branch]
-	# 0 times I wanted this when doing "git checkout".
-	autoSetupMerge = false
-	# Set up new branches in a way that "git pull" does a rebase by default.
-	autoSetupRebase = always
-[gpg]
-	format = ssh
-[commit]
-	gpgsign = true
-
-
-# Must always go last, to be able to override the settings above.
-[include]
-	path = ~/.config/gitconfig_local
--- a/legacy/.screenrc
+++ b/legacy/.screenrc
@@ -1,34 +0,0 @@
-# http://aperiodic.net/screen/commands:start
-
-# see accompanying file ~/.ssh/rc
-setenv SSH_AUTH_SOCK $HOME/.ssh/ssh_auth_sock
-
-# no screen blinking on bell
-vbell off
-startup_message off
-# disable "New screen..." message
-msgwait 0
-defscrollback 10240
-# hostname, timestamp, LA in status bar
-caption always "%{+b}%H | %c %d.%m.%Y | Load: %l"
-# colored window list
-hardstatus alwayslastline "%-Lw%{= BW}%50>%n%f* %t%{-}%+Lw%<"
-# Launch login shells
-shell -${SHELL}
-# 256color support
-#termcapinfo xterm 'Co#256:AB=\E[48;5;%dm:AF=\E[38;5;%dm'
-term screen-256color
-#defbce "on"
-# beep on activity monitor alert (C-a M)
-# ex.: 12:37 activity -> 7$ zsh
-activity "%c activity -> %n%f %t^G"
-
-# Alt Left/Right = switch windows
-bindkey "^[[1;3D" prev
-bindkey "^[[1;3C" next
-bindkey "^[b" prev
-bindkey "^[f" next
-# Alt N = new window
-bindkey "^[n" screen
-
-shelltitle '% |zsh'
--- a/legacy/.ssh/config
+++ b/legacy/.ssh/config
@@ -1,25 +0,0 @@
-Host *
-	# Share SSH connection.
-	# If disabling, consider impact on ssh agent forwarding in screen
-	# sessions (see .ssh/rc file).
-	ControlMaster auto
-	ControlPath ~/.ssh/ctl/%r@%h:%p
-	ControlPersist 10m
-	# When a shared connection is broken (remote reboot), detect it faster.
-	ServerAliveInterval 11
-	ServerAliveCountMax 2
-
-	ConnectTimeout 10
-	AddKeysToAgent yes
-
-#Host custom-host-with-xorg
-#	HostName custom-hostname
-#	User crate
-#	ForwardX11 yes
-#	ForwardX11Trusted yes
-
-#Host always-changing-keys-dont-care
-#	StrictHostKeyChecking no
-#	UserKnownHostsFile=/dev/null
-
-Include config.d/*
--- a/legacy/.ssh/ctl/.gitkeep
+++ b/legacy/.ssh/ctl/.gitkeep
--- a/legacy/.ssh/rc
+++ b/legacy/.ssh/rc
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-# When SSH-ing with agent forwarding enabled, this variable is set by sshd
-# itself. However, an existing screen session that we attach to will not have
-# its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
-# .screenrc and create a symlink to keep it alive.
-#
-# It WILL break if two sessions are opened to a machine, and a newer one is
-# terminated. ControlMaster in .ssh/config solves this problem by sharing the
-# connection (and as a result, sharing SSH agent socket).
-[ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
--- a/legacy/.vim/after/ftplugin/groovy.vim
+++ b/legacy/.vim/after/ftplugin/groovy.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=4
-setlocal expandtab
--- a/legacy/.vim/after/ftplugin/java.vim
+++ b/legacy/.vim/after/ftplugin/java.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=4
-setlocal expandtab
--- a/legacy/.vim/after/ftplugin/javascript.vim
+++ b/legacy/.vim/after/ftplugin/javascript.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=2
-setlocal expandtab
--- a/legacy/.vim/after/ftplugin/json.vim
+++ b/legacy/.vim/after/ftplugin/json.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=2
-setlocal expandtab
--- a/legacy/.vim/after/ftplugin/python.vim
+++ b/legacy/.vim/after/ftplugin/python.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=2
-setlocal expandtab
--- a/legacy/.vim/after/ftplugin/ruby.vim
+++ b/legacy/.vim/after/ftplugin/ruby.vim
@@ -1,2 +0,0 @@
-setlocal shiftwidth=2
-setlocal expandtab
--- a/legacy/.vim/bundle/auto-pairs
+++ b/legacy/.vim/bundle/auto-pairs
--- a/legacy/.vim/bundle/ctrlp.vim
+++ b/legacy/.vim/bundle/ctrlp.vim
--- a/legacy/.vim/bundle/dart-vim-plugin
+++ b/legacy/.vim/bundle/dart-vim-plugin
--- a/legacy/.vim/bundle/nerdcommenter
+++ b/legacy/.vim/bundle/nerdcommenter
--- a/legacy/.vim/bundle/nginx.vim
+++ b/legacy/.vim/bundle/nginx.vim
--- a/legacy/.vim/bundle/supertab
+++ b/legacy/.vim/bundle/supertab
--- a/legacy/.vim/bundle/vim-javascript
+++ b/legacy/.vim/bundle/vim-javascript
--- a/legacy/.vim/bundle/vim-lastplace
+++ b/legacy/.vim/bundle/vim-lastplace
--- a/legacy/.vim/bundle/vim-pathogen
+++ b/legacy/.vim/bundle/vim-pathogen
--- a/legacy/.vim/bundle/vim-sensible
+++ b/legacy/.vim/bundle/vim-sensible
--- a/legacy/.vim/bundle/vim-showmarks
+++ b/legacy/.vim/bundle/vim-showmarks
--- a/legacy/.vim/bundle/vim-startify
+++ b/legacy/.vim/bundle/vim-startify
--- a/legacy/.vim/colors/mydark.vim
+++ b/legacy/.vim/colors/mydark.vim
@@ -1,61 +0,0 @@
-" My Dark GUI Theme
-set background=dark
-highlight clear
-if version > 580
-	hi clear
-	if exists("syntax_on")
-		syntax reset
-	endif
-endif
-let g:colors_name = "mydark"
-
-hi Normal guifg=grey  guibg=#000010 gui=none ctermfg=grey  ctermbg=none    cterm=none
-hi Cursor             guibg=#FF00FF gui=none               ctermbg=magenta
-hi Visual guifg=white guibg=#101099 gui=none ctermfg=white ctermbg=blue    cterm=none
-
-hi Comment guifg=#12AA12 gui=none ctermfg=darkgreen cterm=none
-
-hi Constant  guifg=red     gui=none ctermfg=red        cterm=none
-hi String    guifg=red     gui=none ctermfg=red        cterm=none
-hi Character guifg=red     gui=none ctermfg=red        cterm=none
-hi Number    guifg=yellow  gui=none ctermfg=yellow     cterm=none
-hi Boolean   guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Float     guifg=yellow  gui=none ctermfg=yellow     cterm=none
-
-hi Identifier guifg=grey gui=none ctermfg=grey cterm=none
-hi Function   guifg=grey gui=none ctermfg=grey cterm=none
-
-hi Statement   guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Conditional guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Repeat      guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Label       guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Operator    guifg=#00FFFF gui=none ctermfg=cyan       cterm=none
-hi Keyword     guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Exception   guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-
-hi PreProc   guifg=#008080 gui=none ctermfg=darkcyan cterm=none
-hi Include   guifg=#008080 gui=none ctermfg=darkcyan cterm=none
-hi Define    guifg=#008080 gui=none ctermfg=darkcyan cterm=none
-hi Macro     guifg=#008080 gui=none ctermfg=darkcyan cterm=none
-hi PreCondit guifg=#008080 gui=none ctermfg=darkcyan cterm=none
-
-hi Type         guifg=white   gui=none ctermfg=white      cterm=none
-hi StorageClass guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Structure    guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-hi Typedef      guifg=#FF8000 gui=none ctermfg=darkyellow cterm=none
-
-hi Pmenu      ctermfg=black   ctermbg=blue cterm=none guifg=black  guibg=darkblue
-hi PmenuSel   ctermfg=white   ctermbg=blue cterm=none guifg=white  guibg=darkblue gui=none
-hi PmenuSbar                  ctermbg=cyan            guibg=cyan
-hi PmenuThumb ctermfg=white                           guifg=white
-
-hi DiffAdd    cterm=none ctermbg=darkgreen   ctermfg=black
-hi DiffChange cterm=none ctermbg=darkmagenta ctermfg=black
-hi DiffText   cterm=none ctermbg=cyan        ctermfg=black
-hi DiffDelete cterm=none ctermbg=darkred     ctermfg=black
-
-hi NearColLimit    gui=none guibg=yellow guifg=darkblue cterm=none ctermbg=yellow ctermfg=darkblue cterm=none cterm=none cterm=none cterm=none
-hi OverColLimit    gui=none guibg=red    guifg=darkblue cterm=none ctermbg=red    ctermfg=darkblue
-hi ExtraWhitespace          guibg=red                              ctermbg=red
-
-hi ColorColumn ctermbg=darkyellow
--- a/legacy/.vim/syntax/fasm.vim
+++ b/legacy/.vim/syntax/fasm.vim
@@ -1,145 +0,0 @@
-" Vim syntax file
-" Language:	Flat Assembler (FASM)
-" Maintainer:	Ron Aaron <ron@ronware.org>
-" Last Change:	2004 May 16
-" Vim URL:	http://www.vim.org/lang.html
-" FASM Home:	http://flatassembler.net/
-" FASM Version: 1.52
-
-if version < 600
-  syntax clear
-elseif exists("b:current_syntax")
-  finish
-endif
-
-setlocal iskeyword=a-z,A-Z,48-57,.,_
-setlocal isident=a-z,A-Z,48-57,.,_
-syn case ignore
-
-syn keyword fasmRegister	ah al ax bh bl bp bx ch cl cr0 cr1 cr2 cr3 cr4 cr5 cr6
-syn keyword fasmRegister	cr7 cs cx dh di dl dr0 dr1 dr2 dr3 dr4 dr5 dr6 dr7 ds dx
-syn keyword fasmRegister	eax ebp ebx ecx edi edx es esi esp fs gs mm0 mm1 mm2 mm3
-syn keyword fasmRegister	mm4 mm5 mm6 mm7 si sp ss st st0 st1 st2 st3 st4 st5 st6
-syn keyword fasmRegister	st7 tr0 tr1 tr2 tr3 tr4 tr5 tr6 tr7 xmm0 xmm1 xmm2 xmm3
-syn keyword fasmRegister	xmm4 xmm5 xmm6 xmm7
-syn keyword fasmAddressSizes 	byte dqword dword fword pword qword tword word
-syn keyword fasmDataDirectives 	db dd df dp dq dt du dw file rb rd rf rp rq rt rw
-syn keyword fasmInstr 	aaa aad aam aas adc add addpd addps addsd addss addsubpd
-syn keyword fasmInstr	addsubps and andnpd andnps andpd andps arpl bound bsf bsr
-syn keyword fasmInstr	bswap bt btc btr bts call cbw cdq clc cld clflush cli clts
-syn keyword fasmInstr	cmc cmova cmovae cmovb cmovbe cmovc cmove cmovg cmovge cmovl
-syn keyword fasmInstr	cmovle cmovna cmovnae cmovnb cmovnbe cmovnc cmovne cmovng
-syn keyword fasmInstr	cmovnge cmovnl cmovnle cmovno cmovnp cmovns cmovnz cmovo cmovp
-syn keyword fasmInstr	cmovpe cmovpo cmovs cmovz cmp cmpeqpd cmpeqps cmpeqsd cmpeqss
-syn keyword fasmInstr	cmplepd cmpleps cmplesd cmpless cmpltpd cmpltps cmpltsd cmpltss
-syn keyword fasmInstr	cmpneqpd cmpneqps cmpneqsd cmpneqss cmpnlepd cmpnleps cmpnlesd
-syn keyword fasmInstr	cmpnless cmpnltpd cmpnltps cmpnltsd cmpnltss cmpordpd cmpordps
-syn keyword fasmInstr	cmpordsd cmpordss cmppd cmpps cmps cmpsb cmpsd cmpss cmpsw
-syn keyword fasmInstr	cmpunordpd cmpunordps cmpunordsd cmpunordss cmpxchg cmpxchg8b
-syn keyword fasmInstr	comisd comiss cpuid cvtdq2pd cvtdq2ps cvtpd2dq cvtpd2pi cvtpd2ps
-syn keyword fasmInstr	cvtpi2pd cvtpi2ps cvtps2dq cvtps2pd cvtps2pi cvtsd2si cvtsd2ss
-syn keyword fasmInstr	cvtsi2sd cvtsi2ss cvtss2sd cvtss2si cvttpd2dq cvttpd2pi cvttps2dq
-syn keyword fasmInstr	cvttps2pi cvttsd2si cvttss2si cwd cwde daa das data dec div
-syn keyword fasmInstr	divpd divps divsd divss else emms end enter extrn f2xm1 fabs
-syn keyword fasmInstr	fadd faddp fbld fbstp fchs fclex fcmovb fcmovbe fcmove fcmovnb
-syn keyword fasmInstr	fcmovnbe fcmovne fcmovnu fcmovu fcom fcomi fcomip fcomp fcompp
-syn keyword fasmInstr	fcos fdecstp fdisi fdiv fdivp fdivr fdivrp femms feni ffree
-syn keyword fasmInstr	ffreep fiadd ficom ficomp fidiv fidivr fild fimul fincstp
-syn keyword fasmInstr	finit fist fistp fisttp fisub fisubr fld fld1 fldcw fldenv
-syn keyword fasmInstr	fldl2e fldl2t fldlg2 fldln2 fldpi fldz fmul fmulp fnclex fndisi
-syn keyword fasmInstr	fneni fninit fnop fnsave fnstcw fnstenv fnstsw fpatan fprem
-syn keyword fasmInstr	fprem1 fptan frndint frstor frstpm fsave fscale fsetpm fsin
-syn keyword fasmInstr	fsincos fsqrt fst fstcw fstenv fstp fstsw fsub fsubp fsubr
-syn keyword fasmInstr	fsubrp ftst fucom fucomi fucomip fucomp fucompp fwait fxam
-syn keyword fasmInstr	fxch fxrstor fxsave fxtract fyl2x fyl2xp1 haddpd haddps heap
-syn keyword fasmInstr	hlt hsubpd hsubps idiv if imul in inc ins insb insd insw int
-syn keyword fasmInstr	int3 into invd invlpg iret iretd iretw ja jae jb jbe jc jcxz
-syn keyword fasmInstr	je jecxz jg jge jl jle jmp jna jnae jnb jnbe jnc jne jng jnge
-syn keyword fasmInstr	jnl jnle jno jnp jns jnz jo jp jpe jpo js jz lahf lar lddqu
-syn keyword fasmInstr	ldmxcsr lds lea leave les lfence lfs lgdt lgs lidt lldt lmsw
-syn keyword fasmInstr	load loadall286 loadall386 lock lods lodsb lodsd lodsw loop
-syn keyword fasmInstr	loopd loope looped loopew loopne loopned loopnew loopnz loopnzd
-syn keyword fasmInstr	loopnzw loopw loopz loopzd loopzw lsl lss ltr maskmovdqu maskmovq
-syn keyword fasmInstr	maxpd maxps maxsd maxss mfence minpd minps minsd minss monitor
-syn keyword fasmInstr	mov movapd movaps movd movddup movdq2q movdqa movdqu movhlps
-syn keyword fasmInstr	movhpd movhps movlhps movlpd movlps movmskpd movmskps movntdq
-syn keyword fasmInstr	movnti movntpd movntps movntq movq movq2dq movs movsb movsd
-syn keyword fasmInstr	movshdup movsldup movss movsw movsx movupd movups movzx mul
-syn keyword fasmInstr	mulpd mulps mulsd mulss mwait neg nop not or org orpd orps
-syn keyword fasmInstr	out outs outsb outsd outsw packssdw packsswb packuswb paddb
-syn keyword fasmInstr	paddd paddq paddsb paddsw paddusb paddusw paddw pand pandn
-syn keyword fasmInstr	pause pavgb pavgusb pavgw pcmpeqb pcmpeqd pcmpeqw pcmpgtb
-syn keyword fasmInstr	pcmpgtd pcmpgtw pextrw pf2id pf2iw pfacc pfadd pfcmpeq pfcmpge
-syn keyword fasmInstr	pfcmpgt pfmax pfmin pfmul pfnacc pfpnacc pfrcp pfrcpit1 pfrcpit2
-syn keyword fasmInstr	pfrsqit1 pfrsqrt pfsub pfsubr pi2fd pi2fw pinsrw pmaddwd pmaxsw
-syn keyword fasmInstr	pmaxub pminsw pminub pmovmskb pmulhrw pmulhuw pmulhw pmullw
-syn keyword fasmInstr	pmuludq pop popa popad popaw popd popf popfd popfw popw por
-syn keyword fasmInstr	prefetch prefetchnta prefetcht0 prefetcht1 prefetcht2 prefetchw
-syn keyword fasmInstr	psadbw pshufd pshufhw pshuflw pshufw pslld pslldq psllq psllw
-syn keyword fasmInstr	psrad psraw psrld psrldq psrlq psrlw psubb psubd psubq psubsb
-syn keyword fasmInstr	psubsw psubusb psubusw psubw pswapd punpckhbw punpckhdq punpckhqdq
-syn keyword fasmInstr	punpckhwd punpcklbw punpckldq punpcklqdq punpcklwd push pusha
-syn keyword fasmInstr	pushad pushaw pushd pushf pushfd pushfw pushw pxor rcl rcpps
-syn keyword fasmInstr	rcpss rcr rdmsr rdpmc rdtsc rep repe repne repnz repz ret
-syn keyword fasmInstr	retd retf retfd retfw retn retnd retnw retw rol ror rsm rsqrtps
-syn keyword fasmInstr	rsqrtss sahf sal salc sar sbb scas scasb scasd scasw seta
-syn keyword fasmInstr	setae setalc setb setbe setc sete setg setge setl setle setna
-syn keyword fasmInstr	setnae setnb setnbe setnc setne setng setnge setnl setnle
-syn keyword fasmInstr	setno setnp setns setnz seto setp setpe setpo sets setz sfence
-syn keyword fasmInstr	sgdt shl shld shr shrd shufpd shufps sidt sldt smsw sqrtpd
-syn keyword fasmInstr	sqrtps sqrtsd sqrtss stc std sti stmxcsr store stos stosb
-syn keyword fasmInstr	stosd stosw str sub subpd subps subsd subss sysenter sysexit
-syn keyword fasmInstr	test ucomisd ucomiss ud2 unpckhpd unpckhps unpcklpd unpcklps
-syn keyword fasmInstr	verr verw wait wbinvd wrmsr xadd xchg xlat xlatb xor xorpd
-syn keyword fasmPreprocess 	common equ fix forward include local macro purge restore
-syn keyword fasmPreprocess	reverse struc
-syn keyword fasmDirective 	align binary code coff console discardable display dll
-syn keyword fasmDirective	elf entry executable export extern far fixups format gui
-syn keyword fasmDirective	import label ms mz native near notpageable pe public readable
-syn keyword fasmDirective	repeat resource section segment shareable stack times
-syn keyword fasmDirective	use16 use32 virtual wdm writeable
-syn keyword fasmOperator 	as at defined eq eqtype from mod on ptr rva used
-
-syn match	fasmNumericOperator	"[+-/*]"
-syn match	fasmLogicalOperator	"[=|&~<>]\|<=\|>=\|<>"
-" numbers
-syn match	fasmBinaryNumber	"\<[01]\+b\>"
-syn match	fasmHexNumber		"\<\d\x*h\>"
-syn match	fasmHexNumber		"\<\(0x\|$\)\x*\>"
-syn match	fasmFPUNumber		"\<\d\+\(\.\d*\)\=\(e[-+]\=\d*\)\=\>"
-syn match	fasmOctalNumber		"\<\(0\o\+o\=\|\o\+o\)\>"
-syn match	fasmDecimalNumber	"\<\(0\|[1-9]\d*\)\>"
-syn region	fasmComment		start=";" end="$"
-syn region	fasmString		start="\"" end="\"\|$"
-syn region	fasmString		start="'" end="'\|$"
-syn match	fasmSymbol		"[()|\[\]:]"
-syn match	fasmSpecial		"[#?%$,]"
-syn match	fasmLabel		"^\s*[^; \t]\+:"
-
-hi def link	fasmAddressSizes	type
-hi def link	fasmNumericOperator	fasmOperator
-hi def link	fasmLogicalOperator	fasmOperator
-
-hi def link	fasmBinaryNumber	fasmNumber
-hi def link	fasmHexNumber		fasmNumber
-hi def link	fasmFPUNumber		fasmNumber
-hi def link	fasmOctalNumber		fasmNumber
-hi def link	fasmDecimalNumber	fasmNumber
-
-hi def link	fasmSymbols		fasmRegister
-hi def link	fasmPreprocess		fasmDirective
-
-"  link to standard syn groups so the 'colorschemes' work:
-hi def link	fasmOperator operator
-hi def link	fasmComment  comment
-hi def link	fasmDirective	preproc
-hi def link	fasmRegister  type
-hi def link	fasmNumber   constant
-hi def link	fasmSymbol structure
-hi def link	fasmString  String
-hi def link	fasmSpecial	special
-hi def link	fasmInstr keyword
-hi def link	fasmLabel label
-hi def link	fasmPrefix preproc
-let b:current_syntax = "fasm"
-" vim: ts=8 sw=8 :
--- a/legacy/.vim/undo/.gitkeep
+++ b/legacy/.vim/undo/.gitkeep
--- a/migrated/.vimrc
+++ b/migrated/.vimrc
@@ -35,19 +35,17 @@ if exists("+undofile")
 	" Enable the persistent undo file(s)
 	set undodir=~/.vim/undo
 	set undofile
+	if !isdirectory(expand(&undodir))
+		call mkdir(expand(&undodir), "p")
+	endif
 endif

 set switchbuf+=usetab " Switch to existing tab; open a new tab for the new buf

 let mapleader=","

-filetype off
-
-runtime bundle/vim-pathogen/autoload/pathogen.vim
-execute pathogen#infect()
-
 set background=dark
-colorscheme mydark
+colorscheme torte

 " Configure plugins.

@@ -71,22 +69,24 @@ let dart_format_on_save = 1
 set viminfo='10,\"100,:100,n~/.viminfo

 " Line width limit hint.
+set colorcolumn=81
 augroup EditorWidth
-	" colorcolumn breaks copy from terminal, so we use this instead.
 	au!
-	au BufEnter * highlight OverLength ctermbg=darkred
-	au BufEnter * match OverLength /\%81v./
-
-	au BufEnter *.go match OverLength /\%101v./
-	au BufEnter *.java match OverLength /\%101v./
-
-	au BufEnter *.data match OverLength /$$/
-	au BufEnter .vimrc match OverLength /$$/
+	au BufEnter *.go setlocal colorcolumn=101
+	au BufEnter *.java setlocal colorcolumn=101
+	au BufEnter *.data setlocal colorcolumn=0
+	au BufEnter .vimrc setlocal colorcolumn=0
 augroup END

 " Custom filetypes.
 au BufNewFile,BufRead *.pi setf python

+augroup FileTypeSettings
+	au!
+	au FileType groovy,java setlocal shiftwidth=4 expandtab
+	au FileType javascript,json,python,ruby setlocal shiftwidth=2 expandtab
+augroup END
+
 filetype indent off

 " Automatically insert the current comment leader after hitting <Enter> in Insert mode.
--- a/migrated/.zshrc
+++ b/migrated/.zshrc
@@ -8,9 +8,9 @@ export PATH="${HOME}/bin:${PATH}"
 # Since we exec right afterwards, there's no point in setting this shell up.
 if [[ -o login ]]; then
 	[ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ] && \
-		[ -z "$STY" ] && \
-		which screen 2>/dev/null && \
-		exec screen -URR
+		[ -z "$TMUX" ] && \
+		command -v tmux >/dev/null && \
+		exec tmux new -A -D -s main
 fi

 HISTFILE=~/.zsh_history
@@ -62,7 +62,6 @@ alias grep='grep --line-buffered --color=auto'
 alias ipt='iptables -nvL --line-numbers'
 alias ip6t='ip6tables -nvL --line-numbers'
 alias tcpdump='tcpdump -l'
-alias ag='ag -C 2 --pager="$PAGER" --smart-case'
 alias mysql='mysql --select_limit=1000'
 alias logcat='adb logcat -v "color printable usec year zone" -T 10'
 alias readelf='readelf -W'
@@ -81,32 +80,69 @@ starttransfer: %{time_starttransfer} | \
 total: %{time_total} | \
 size: %{size_download}\n"'

+rg() {
+	command rg -C 2 --smart-case --pretty "$@" | pager
+}
+
 # nix-deploy # current host
 # nix-deploy nas # deploy nas
 # nix-deploy test secondary # deploy secondary but do not add to boot
 nix-deploy() {
-	ACTION=switch
-	if [ $# -gt 1 ]; then
-		ACTION=$1
-		shift
+	local action=switch target config cmd r_flake
+
+	if (( $# == 0 )); then
+		# Local deployment.
+		if [[ "$OSTYPE" == darwin* ]]; then
+			cmd=darwin-rebuild
+			r_flake="darwin#darwin-rebuild"
+		else
+			cmd=nixos-rebuild
+			r_flake="nixpkgs#nixos-rebuild"
+		fi
+
+		local run_cmd=($cmd)
+		command -v "$cmd" >/dev/null 2>&1 || run_cmd=(nix run "$r_flake" --)
+		sudo "${run_cmd[@]}" switch --flake . |& nom
+
+		# home-manager switch if exists.
+		local hm_conf="$(whoami)@$(hostname -s)"
+		if [[ "$(nix eval --json ".#homeConfigurations" --apply "x: x ? \"$hm_conf\"" 2>/dev/null)" == "true" ]]; then
+			local hm_run=(home-manager)
+			command -v home-manager >/dev/null 2>&1 || hm_run=(nix run "home-manager#home-manager" --)
+			"${hm_run[@]}" switch --flake .
+		fi
+		return
 	fi
-	if which nixos-rebuild &>/dev/null; then
-		COMMAND=(nixos-rebuild)
+
+	# Remote deployment (always NixOS).
+	if (( $# == 1 )); then
+		target=$1
+		shift
 	else
-		COMMAND=(nix run nixpkgs#nixos-rebuild --)
+		action=$1
+		target=$2
+		shift 2
 	fi
-	if [ $# -gt 0 ]; then
-		TARGET_HOST=$1 # user@host.domain
-		TARGET_WITH_DOMAIN=${TARGET_HOST#*@} # host.domain
-		TARGET=${TARGET_WITH_DOMAIN%%.*} # host
-		shift
-		"${COMMAND[@]}" "${ACTION?}" \
-			--flake ".#${TARGET?}" \
-			--target-host "${TARGET_HOST?}" \
+
+	config=${${target#*@}%%.*}
+	cmd=(nixos-rebuild)
+	command -v nixos-rebuild >/dev/null 2>&1 || cmd=(nix run "nixpkgs#nixos-rebuild" --)
+
+	nix build ".#nixosConfigurations.$config.config.system.build.toplevel" \
+		--out-link "result.$config" |& nom
+	local build_status=$pipestatus[1]
+	if (( build_status != 0 )); then
+		return $build_status
+	fi
+
+	if [[ "$action" != "build" ]]; then
+		# Bypass nixos-rebuild self-update check which errors in
+		# flake-only setups when --store-path is used.
+		_NIXOS_REBUILD_REEXEC=1 "${cmd[@]}" "$action" \
+			--store-path "$(readlink -f "result.$config")" \
+			--target-host "$target" \
 			--sudo \
-			"$@" |& nom
-	else
-		sudo "${COMMAND[@]}" switch --flake . |& nom
+			"$@"
 	fi
 }

--- a/modules/home/common.nix
+++ b/modules/home/common.nix
@@ -1,13 +1,75 @@
-{ pkgs, primaryUser, ... }:
+{
+  pkgs,
+  lib,
+  identities,
+  primaryUser,
+  ...
+}:
 {
  home.username = primaryUser;
+
+  nixpkgs.config.allowUnfree = true;
  home.packages = with pkgs; [
    stow
    wget
-    gemini-cli
-    silver-searcher
+    antigravity-cli
+    yubikey-manager
  ];

+  home.activation.stowLegacy = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    if [ -d "$HOME/dotfiles/legacy" ]; then
+      run ${pkgs.stow}/bin/stow -d $HOME/dotfiles -t $HOME legacy
+    fi
+  '';
+
+  home.activation.report-changes = lib.hm.dag.entryAnywhere ''
+    # oldGenPath can be undefined with home-manager used as part of NixOS config
+    if [ -n "''${oldGenPath+x}" ]; then
+      ${pkgs.nvd}/bin/nvd diff $oldGenPath $newGenPath
+    fi
+  '';
+
+  programs.git = {
+    enable = true;
+
+    settings = {
+      alias = {
+        co = "checkout";
+        st = "status";
+        di = "diff -w --no-prefix";
+        df = "diff";
+        dc = "diff --cached";
+        ci = "commit";
+        br = "branch";
+        lg = "log -p --decorate=full --show-signature";
+        lol = "log --graph --decorate=full --pretty=oneline --abbrev-commit";
+        lola = "log --graph --decorate=full --pretty=oneline --abbrev-commit --all";
+        ls = "ls-files";
+        # Show files ignored by git:
+        ign = "ls-files -o -i --exclude-standard";
+      };
+
+      color.ui = "auto";
+      apply.whitespace = "nowarn";
+      push.default = "tracking";
+      rebase.stat = "yes";
+      format.pretty = "fuller";
+      fetch.prune = "yes";
+      core.autocrlf = "input";
+      branch = {
+        # 0 times I wanted this when doing "git checkout".
+        autoSetupMerge = false;
+        # Set up new branches in a way that "git pull" does a rebase by default.
+        autoSetupRebase = "always";
+      };
+      gpg.format = "ssh";
+      gpg.ssh.allowedSignersFile = "${pkgs.writeText "allowed_signers" (
+        lib.concatStringsSep "\n" (identities.getSigningEntries { })
+      )}";
+      credential."https://source.developers.google.com".helper = "gcloud.sh";
+    };
+  };
+
  programs.zsh = {
    enable = true;
    initContent = ''
@@ -18,9 +80,9 @@
      fi

      if [ -r ~/dotfiles/migrated/.zshrc ]; then
+        # Hack for faster iterations
        . ~/dotfiles/migrated/.zshrc
      else
-        # If no custom override is available, use the one bundled with flake.
        . ${../../migrated/.zshrc}
      fi
    '';
@@ -35,6 +97,29 @@
    '';
  };

+  programs.vim = {
+    enable = true;
+    plugins = with pkgs.vimPlugins; [
+      auto-pairs
+      ctrlp-vim
+      dart-vim-plugin
+      nerdcommenter
+      nginx-vim
+      supertab
+      vim-javascript
+      vim-lastplace
+      vim-sensible
+      vim-startify
+    ];
+    extraConfig = ''
+      if filereadable(expand("~/dotfiles/migrated/.vimrc"))
+        source ~/dotfiles/migrated/.vimrc
+      else
+        source ${../../migrated/.vimrc}
+      endif
+    '';
+  };
+
  programs.home-manager.enable = true;

  programs.direnv = {
@@ -48,5 +133,104 @@
    };
  };

+  programs.tmux = {
+    enable = true;
+    shortcut = "a"; # ^a
+    escapeTime = 0;
+    historyLimit = 10240;
+
+    # hjkl HJKL and mouse to switch between and resize panels.
+    mouse = true;
+    keyMode = "vi";
+    customPaneNavigationAndResize = true;
+
+    extraConfig = ''
+      set-environment -g SSH_AUTH_SOCK $HOME/.ssh/ssh_auth_sock
+      set-option -g update-environment "DISPLAY SSH_ASKPASS SSH_AGENT_PID SSH_CONNECTION"
+
+      # Instead of flashing or beeping, blink the window in status.
+      set -g visual-bell off
+      set -g monitor-activity on
+      set -g bell-action none
+      set -g window-status-activity-style "fg=yellow,blink"
+
+      # Requires support from terminal (e.g. iTerm2).
+      set -s set-clipboard on
+
+      # For scrolling through logs.
+      bind y set-window-option synchronize-panes
+
+      # Panel configuration.
+      bind | split-window -h -c "#{pane_current_path}"
+      bind - split-window -v -c "#{pane_current_path}"
+      bind Enter resize-pane -Z
+
+      # Navigation.
+      bind -n M-Up new-window -c "#{pane_current_path}"
+      bind -n M-Down confirm-before -p "kill-window #W? (y/n)" kill-window
+      bind -n M-Left previous-window
+      bind -n M-Right next-window
+
+      # Status bar.
+      set -g status-interval 5
+      set -g status-position bottom
+      set -g status-style "bg=default,fg=white"
+
+      set -g status-left-length 20
+      set -g status-left "#[fg=green,bold]#H #[fg=white]| "
+
+      set -g status-right-length 60
+      set -g status-right "#[fg=cyan]%H:%M%Z %d.%m.%Y #[fg=white]| #[fg=yellow]Load: #(cut -d ' ' -f 1-3 /proc/loadavg)"
+
+      set -g status-justify left
+      set -g window-status-format "#[fg=white,dim]#I:#W#F"
+      set -g window-status-current-format "#[fg=white,bold,bg=blue] #I:#W#F "
+    '';
+  };
+
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    includes = [ "config.d/*" ];
+
+    settings = {
+      "*" = {
+        # Share SSH connection.
+        # If disabling, consider impact on ssh agent forwarding in screen
+        # sessions (see .ssh/rc file).
+        ControlMaster = "auto";
+        ControlPath = "~/.ssh/ctl/%r@%h:%p";
+        ControlPersist = "10m";
+
+        # When a shared connection is broken (remote reboot), detect it faster.
+        ServerAliveInterval = 11;
+        ServerAliveCountMax = 2;
+
+        ConnectTimeout = 10;
+        AddKeysToAgent = "yes";
+      };
+    };
+  };
+
+  home.file = {
+    ".ssh/rc" = {
+      executable = true;
+      text = ''
+        #!/bin/sh
+
+        # When SSH-ing with agent forwarding enabled, this variable is set by sshd
+        # itself. However, an existing screen session that we attach to will not have
+        # its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
+        # .screenrc and create a symlink to keep it alive.
+        #
+        # It WILL break if two sessions are opened to a machine, and a newer one is
+        # terminated. ControlMaster in .ssh/config solves this problem by sharing the
+        # connection (and as a result, sharing SSH agent socket).
+        [ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
+      '';
+    };
+    ".ssh/ctl/.keep".text = "";
+  };
+
  home.stateVersion = "25.11"; # never modify
 }
--- a/modules/home/linux-headless.nix
+++ b/modules/home/linux-headless.nix
@@ -1,8 +1,8 @@
-{ primaryUser, ... }:
+{ lib, primaryUser, ... }:
 {
  imports = [
    ./common.nix
  ];

-  home.homeDirectory = "/home/${primaryUser}";
+  home.homeDirectory = lib.mkDefault "/home/${primaryUser}";
 }
--- a/modules/home/mac-portable.nix
+++ b/modules/home/mac-portable.nix
@@ -1,22 +1,87 @@
-{ pkgs, primaryUser, ... }:
+{
+  pkgs,
+  lib,
+  primaryUser,
+  ...
+}:
 {
  imports = [
    ./common.nix
  ];

-  home.homeDirectory = "/Users/${primaryUser}";
+  home.homeDirectory = lib.mkDefault "/Users/${primaryUser}";

  home.packages = with pkgs; [
    secretive
    vlc-bin
+
+    # Faster and more feature-rich than Terminal.
+    # TODO: https://iterm2.com/shell_integration/zsh
+    iterm2
+
+    # Newer OpenSSH client to support FIDO2 keys.
+    openssh
+    libfido2
  ];

+  targets.darwin.defaults."com.googlecode.iterm2" = {
+    # $ defaults read ~/Library/Preferences/com.googlecode.iterm2.plist
+
+    # Allow tmux (and others) to use OSC 52 to set clipboard.
+    AllowClipboardAccess = true;
+    # Allow programs to clear scrollback.
+    PreventEscapeSequenceFromClearingHistory = false;
+
+    TripleClickSelectsFullWrappedLines = true;
+    WordChars = "/-._~";
+    PromptOnQuit = false;
+
+    # Use system browser to open links.
+    NoSyncBrowserUpsell = 1;
+    NoSyncBrowserUpsell_selection = 1;
+  };
+  home.file."Library/Application Support/iTerm2/DynamicProfiles/nix-profile.json".text =
+    builtins.toJSON
+      {
+        Profiles = [
+          {
+            Name = "Nix-Managed";
+            Guid = "17DF2CCB-C7CD-4BCC-AC28-666DD6C8AF4A";
+            "Normal Font" = "Menlo-Regular 13";
+
+            Columns = 160;
+            Rows = 45;
+            "Scrollback Lines" = 1000000;
+
+            # For tmux selection and moving borders.
+            "Mouse Reporting" = true;
+          }
+        ];
+      };
+
  programs.zsh.envExtra = ''
-    # Blocked on https://github.com/overhacked/ssh-agent-mux/issues/56
+    # Can't use ssh-agent-mux to mux Secretive and yubikey-agent:
+    # https://github.com/overhacked/ssh-agent-mux/issues/56
    # export SSH_AUTH_SOCK=~/.ssh/ssh-agent-mux.sock
+
+    # Can't use Secretive to SSH using PIV from Yubikey:
+    # https://github.com/maxgoedjen/secretive/issues/330
+    #
+    # If PIV entry was generated by yubikey-agent, Secretive may not see it at
+    # all. Running 'ykman piv objects generate chuid' should fix that.
+    # https://github.com/maxgoedjen/secretive/issues/333
+
+    # See README.md "Security" section to learn how we create keys.
+
+    # Setting IdentityAgent in SSH config achieves a similar result, but doesn't
+    # work with commit signing.
    export SSH_AUTH_SOCK=~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
  '';

-  nixpkgs.config.allowUnfree = true;
+  # TODO: defaults read NSGlobalDomain
+  #       https://nix-darwin.github.io/nix-darwin/manual/index.html
+  #       -> set system.defaults.NSGlobalDomain
+  #          or  system.defaults.CustomSystemPreferences
+
  programs.vscode.enable = true;
 }
--- a/modules/nixos/jailed-agy.nix
+++ b/modules/nixos/jailed-agy.nix
@@ -0,0 +1,148 @@
+{
+  config,
+  lib,
+  pkgs,
+  jail-nix,
+  primaryUser,
+  ...
+}:
+let
+  jail = jail-nix.lib.init pkgs;
+  allPackages =
+    with pkgs;
+    [
+      bashInteractive
+      curl
+      wget
+      jq
+      git
+      which
+      ripgrep
+      gnugrep
+      gnused
+      gawkInteractive
+      ps
+      findutils
+      gzip
+      unzip
+      gnutar
+      diffutils
+      coreutils
+      procps
+
+      python3
+      python3Packages.pip
+      esphome
+
+      ruby
+      go
+      gcc
+      gnumake
+      pkg-config
+
+      nix
+    ]
+    ++ config.programs.jailed-agy.extraPackages;
+in
+{
+  options.programs.jailed-agy = {
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = "Extra packages to append to the jailed-agy environment.";
+    };
+  };
+
+  config = {
+    environment.systemPackages = [
+      (jail "jailed-agy" pkgs.antigravity-cli (
+        with jail.combinators;
+        [
+          network
+          time-zone
+          no-new-session
+          mount-cwd
+
+          # Enforce that the wrapper is not run as root/privileged user
+          (add-runtime ''
+            if [ "$(id -u)" -eq 0 ]; then
+              echo "Error: jailed-agy must not be run as root/privileged user!" >&2
+              exit 1
+            fi
+          '')
+
+          # Automatically append --dangerously-skip-permissions to agy invocation
+          (set-argv [
+            "--dangerously-skip-permissions"
+            (noescape "\"$@\"")
+          ])
+
+          (readwrite (noescape "~/.gemini"))
+          # The above is a stow-controlled symlink to the following.
+          (readwrite (noescape "~/dotfiles/legacy/.gemini"))
+
+          # Enable easy installation of pip packages in the current directory.
+          (set-env "PYTHONPATH" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_TARGET" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_CACHE_DIR" (noescape "\"$PWD/.pip-cache\""))
+          (set-env "PIP_BREAK_SYSTEM_PACKAGES" "1")
+
+          # Enable easy installation and persistence of RubyGems in the current directory.
+          (set-env "GEM_HOME" (noescape "\"$PWD/.gem\""))
+
+          # Enable easy installation and persistence of Go modules and caches in the current directory.
+          (set-env "GOPATH" (noescape "\"$PWD/.go\""))
+          (set-env "GOCACHE" (noescape "\"$PWD/.go-cache\""))
+
+          # Preconfigure compiler and linker flags dynamically for all jail packages.
+          # This allows compiling Ruby gems (e.g. ffi, which requires libffi) and Go packages
+          # (e.g. YubiKey plugins, which require pcsclite) out-of-the-box.
+          (set-env "PKG_CONFIG_PATH" (
+            lib.concatStringsSep ":" (map (pkg: "${pkg.dev or pkg}/lib/pkgconfig") allPackages)
+          ))
+          (set-env "NIX_CFLAGS_COMPILE" (
+            lib.concatStringsSep " " (map (pkg: "-isystem ${pkg.dev or pkg}/include") allPackages)
+          ))
+          (set-env "NIX_LDFLAGS" (
+            lib.concatStringsSep " " (map (pkg: "-L${pkg.out or pkg}/lib") allPackages)
+          ))
+
+          # Mount system and user profiles so their packages are automatically available at runtime
+          (try-ro-bind "/run/current-system/sw" "/run/current-system/sw")
+          (try-ro-bind "/etc/profiles/per-user/${primaryUser}" "/etc/profiles/per-user/${primaryUser}")
+
+          # Mount Nix files and directories to support nix-shell and Nix operations in jail
+          (try-ro-bind "/nix/store" "/nix/store")
+          (try-ro-bind "/nix/var/nix/daemon-socket" "/nix/var/nix/daemon-socket")
+          (try-ro-bind "/nix/var/nix/profiles" "/nix/var/nix/profiles")
+          (try-ro-bind "/etc/nix" "/etc/nix")
+          (try-ro-bind "/etc/static" "/etc/static")
+
+          # Forward Nix environment variables
+          (try-fwd-env "NIX_REMOTE")
+          (try-fwd-env "NIX_PATH")
+          (try-fwd-env "NIX_SSL_CERT_FILE")
+
+          (add-pkg-deps allPackages)
+
+          # Prepend local project binary directories, system, and user bin paths to the jail's PATH.
+          # Note: We place this after `add-pkg-deps` so that local paths take highest precedence.
+          # We use explicit double quotes to allow bash to expand $PWD at runtime and handle spaces.
+          (
+            state:
+            state
+            // {
+              env = state.env // {
+                PATH =
+                  if state.env ? PATH && state.env.PATH != "" then
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin:${state.env.PATH}\""
+                  else
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin\"";
+              };
+            }
+          )
+        ]
+      ))
+    ];
+  };
+}
--- a/modules/nixos/linux-headless.nix
+++ b/modules/nixos/linux-headless.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  ...
+}:
+{
+  # Create /etc/zshrc that loads the nix-darwin environment.
+  programs.zsh.enable = true;
+  security.sudo.wheelNeedsPassword = false;
+
+  programs.mosh.enable = true;
+
+  documentation.man.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    # https://unix.stackexchange.com/questions/651165/using-systemd-to-mount-remote-filesystems-in-user-bus
+    # Have to run the wrapper due to SUID.
+    (pkgs.writeShellScriptBin "umount.fuse.sshfs" ''
+      exec /run/wrappers/bin/fusermount -u "$1"
+    '')
+  ];
+
+  system.stateVersion = "25.11"; # Never change this.
+}
--- a/modules/nixos/linux-lxc.nix
+++ b/modules/nixos/linux-lxc.nix
@@ -0,0 +1,76 @@
+{
+  modulesPath,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    "${modulesPath}/virtualisation/lxc-container.nix"
+  ];
+  # Disable legacy channel behavior that lxc-container brings in via installer/cd-dvd/channel.nix.
+  system.installer.channel.enable = false;
+
+  # Impermanence setup:
+  # 1. There's no initrd/stage 1 in LXC container; /sbin/init is invoked after
+  #    LXC finishes setting up special and user-configured filesystems. Any
+  #    options in boot.initrd, as well as neededForBoot fileSystems won't be
+  #    respected.
+  # 2. Non-boot fileSystems (aka systemd) mount too late for systemd or nixos
+  #    persistence to be instantiated, so we have to create this script below.
+  # 3. The expectation from host is to mount /home and /nix. Root filesystem
+  #    will also be a disk, as that's Incus requirement; the host should clean
+  #    it up periodically using: "incus rebuild --empty <vm>".
+  # 4. Since rootfs will be empty after rebuild, you have to point LXC at the
+  #    current init (instead of /sbin/init), by adding to the "config:" section
+  #    in "incus config edit <vm>":
+  #      raw.lxc: lxc.init.cmd = /nix/var/nix/profiles/system/init
+  system.activationScripts.persistence = {
+    deps = [ "specialfs" ];
+    text = ''
+      persist() {
+        local item="$1"
+        local constructor="''${item%%:*}"
+        local target="''${item#*:}"
+
+        mkdir -p "$(dirname "$target")"
+        $constructor "$target"
+
+        if ! mountpoint -q "$target"; then
+          local source="/home/persistent/$target"
+
+          mkdir -p "$(dirname "$source")"
+          $constructor "$source"
+
+          mount --bind "$source" "$target"
+        fi
+      }
+
+      for item in \
+          "mkdir -p:/var/lib/nixos" \
+          "mkdir -p:/var/lib/systemd" \
+          "mkdir -p:/var/lib/docker" \
+          "touch:/etc/machine-id" \
+          "touch:/etc/ssh/ssh_host_ed25519_key" \
+      ; do
+        persist "$item"
+      done
+
+      chmod 0600 /etc/ssh/ssh_host_ed25519_key
+
+      # lxc-container.nix installBootloader/installInitScript will attempt to
+      # symlink /sbin/init, so we have to create the parent directory.
+      mkdir -p /sbin
+    '';
+  };
+  system.activationScripts.users.deps = [ "persistence" ];
+  # This is supposed to persist machine-id, but fails.
+  systemd.services.systemd-machine-id-commit.enable = false;
+
+  # unprivileged LXCs can't set net.ipv4.ping_group_range
+  security.wrappers.ping = {
+    owner = "root";
+    group = "root";
+    capabilities = "cap_net_raw+p";
+    source = "${pkgs.iputils.out}/bin/ping";
+  };
+}
Author	SHA1	Message	Date
Artem Sheremet	ce9475e001	Mount docker from persistence	2026-06-21 21:13:21 +00:00
Artem Sheremet	a37e25329a	Improve jailed-agy Add python, ruby, go, custom paths.	2026-06-19 13:37:00 +00:00
Artem Sheremet	3975092d67	nix flake update	2026-06-19 12:03:08 +00:00
Artem Sheremet	a2c2b2a2e5	Fix unfree and PATH for jailed-agy	2026-06-12 13:35:31 +00:00
Artem Sheremet	0c0c94e4bf	Extract jailed-agy into reusable module	2026-06-11 19:27:46 +00:00
Artem Sheremet	a659a07637	Move ssh config into nix	2026-06-09 19:19:27 +00:00
Artem Sheremet	60531ed270	Auto-create undodir if it doesn't exist This is required for undo to work across restarts	2026-06-09 18:57:16 +00:00
Artem Sheremet	e6e62a375c	Remove master overlay agy is now available in unstable	2026-06-09 18:08:07 +00:00
Artem Sheremet	58ade9d886	Finish migrating from ag to rg	2026-06-09 17:38:48 +00:00
Artem Sheremet	eb2bdc2d33	nix flake update	2026-06-09 10:20:05 +00:00
Artem Sheremet	c4fb365814	Remove ag (dropped from nix)	2026-06-08 18:42:01 +00:00
Artem Sheremet	b4383e0d19	Use system browser in iTerm2	2026-06-07 20:23:32 +02:00
Artem Sheremet	e57b3e6937	Avoid warning about darwin-x86_64 expiring	2026-06-05 06:21:39 +00:00
Artem Sheremet	0938c76f1b	Extract "artem" into a variable	2026-06-05 06:21:05 +00:00
Artem Sheremet	2e02f82ae2	Leave symlink to latest nix-deploy'ed version This will keep gc root on the linked derivation and prevent nix-collect-garbage from removing it.	2026-05-26 17:02:09 +00:00
Artem Sheremet	2c380eaf10	Move mcp server settings to antigravity-cli	2026-05-25 08:59:19 +00:00
Artem Sheremet	76061f4919	gemini-cli -> antigravity-cli	2026-05-25 08:20:48 +00:00
Artem Sheremet	159daf0630	Move from legacyPackages to proper import	2026-05-25 08:17:19 +00:00
Artem Sheremet	82419c57ad	Move allowUnfree to all of homes Eventually for antigravity-cli	2026-05-25 08:10:12 +00:00
Artem Sheremet	6df89b4b06	Allow access to KVM	2026-05-25 07:52:24 +00:00
Artem Sheremet	3fabad4344	nix flake update	2026-05-23 17:58:29 +00:00
Artem Sheremet	616a81d29d	nix flake update ``` Version changes: [U.] #1 gemini-cli 0.40.1 -> 0.41.2 [U.] #2 libgit2 1.9.2-lib -> 1.9.3-lib [U.] #3 nodejs 22.22.2 -> 22.22.3 [U.] #4 nodejs-slim 22.22.2, 22.22.2-corepack, 22.22.2-npm -> 22.22.3, 22.22.3-corepack, 22.22.3-npm [U.] #5 vscode 1.116.0 -> 1.119.0 ```	2026-05-17 16:31:54 +02:00
Artem Sheremet	5a1da34702	iTerm scrollback 1k -> 1M	2026-05-17 16:14:35 +02:00
Artem Sheremet	8b813e6345	Periodic nix-collect-garbage on darwin	2026-05-17 11:06:48 +02:00
Artem Sheremet	080cd5b1cc	Fix undefined variable when deployed in NixOS	2026-05-15 19:55:18 +00:00
Artem Sheremet	28a2a91d93	Remove redundant variable	2026-05-15 15:39:00 +00:00
Artem Sheremet	f878110e49	Move common into imports This follows the same pattern as modules	2026-05-15 15:36:11 +00:00
Artem Sheremet	a57b0f2fef	Sprinkle a bit of standard library in home config	2026-05-15 15:25:52 +00:00
Artem Sheremet	0160a8aa80	Add nvd (version diff)	2026-05-15 15:15:27 +00:00
Artem Sheremet	3b688fd5a2	Mark all known signers as allowed	2026-05-15 13:31:40 +00:00
Artem Sheremet	0ee7266b3d	Populate allowedSignersFile	2026-05-15 13:05:41 +00:00
Artem Sheremet	ecb0dc092e	Migrate .gitconfig to home-manager	2026-05-15 12:55:42 +00:00
Artem Sheremet	97248c0da3	Use identities from fw_nix	2026-05-15 12:24:03 +00:00
Artem Sheremet	7819928be2	Hint for where to look up system setting values	2026-05-14 19:25:32 +02:00
Artem Sheremet	6e1631d77b	Describe layout	2026-05-14 15:38:40 +02:00
Artem Sheremet	ac28afc5eb	Update signing key	2026-05-14 15:22:08 +02:00
Artem Sheremet	ac3712aec5	Correct path to test legacy presence	2026-05-14 15:20:23 +02:00
Artem Sheremet	a453390013	Clarify "migrated" .zshrc	2026-05-14 15:19:41 +02:00
Artem Sheremet	00049f5255	Make homeDirectory setting a default Some hosts may have different home path	2026-05-14 15:17:23 +02:00
Artem Sheremet	6f260619a7	Add git signingkey and name/email to personal file	2026-05-14 14:38:06 +02:00
Artem Sheremet	031eab1b27	Clarify FIDO2 key limitations	2026-05-14 14:04:34 +02:00
Artem Sheremet	231a769de5	Update fw_nix to pick up new cache paths	2026-05-13 20:53:04 +00:00
Artem Sheremet	6df6976cd2	nix flake update	2026-05-11 19:14:38 +00:00
Artem Sheremet	9f5e9b00e8	Enable mosh on linux-headless	2026-05-11 19:10:04 +00:00
Artem Sheremet	7b85d3b585	Give gemini esphome	2026-05-11 19:09:52 +00:00
Artem Sheremet	ce75ee4024	Show timezone next to timestamp in tmux	2026-05-08 15:41:02 +00:00
Artem Sheremet	94800586f6	Add MIT license	2026-05-04 09:27:04 +00:00
Artem Sheremet	efbcd546f9	TODO for better integration between zsh and iTerm2	2026-05-03 16:20:53 +02:00
Artem Sheremet	f75a9f1ccb	Finish migrating to tmux fix environment variable being reset to most recent value in new panels	2026-05-01 19:49:21 +00:00
Artem Sheremet	e38f96eedb	Move linux-lxc away from linux-headless Not every linux-headless is LXC; e.g. venus	2026-04-30 13:12:34 +02:00
Artem Sheremet	d7be1664ae	nix flake update	2026-04-29 20:48:39 +00:00
Artem Sheremet	24055ddfe7	Extract linux bits into a new module	2026-04-29 22:44:15 +02:00
Artem Sheremet	7bde25ebec	Avoid affinity warnings for ag	2026-04-29 19:57:14 +00:00
Artem Sheremet	930d951625	Migrate from GNU screen to tmux	2026-04-29 19:56:58 +00:00
Artem Sheremet	4261c3e605	Add safe key	2026-04-29 17:13:05 +00:00
Artem Sheremet	612ffea3ad	Note on application setting	2026-04-29 19:12:32 +02:00
Artem Sheremet	5ef6f5e636	Reformat settings.json (again...)	2026-04-29 17:53:42 +02:00
Artem Sheremet	84f4a855cf	Swap for FIDO2 keys	2026-04-29 15:31:08 +00:00
Artem Sheremet	757602449b	Definitively switch PIV->FIDO2 for SSH And move Security section from home/home	2026-04-29 17:14:24 +02:00
Artem Sheremet	090889f324	Move to iTerm2 Mostly for tmux integration	2026-04-29 17:12:08 +02:00
Artem Sheremet	20af840d34	Update vim plugin name	2026-04-29 17:11:34 +02:00
Artem Sheremet	7c4a46bd53	Allow reverse SSH via regular trusted keys	2026-04-29 17:10:49 +02:00
Artem Sheremet	2bf2f60bde	Use sudo with darwin-rebuild, too	2026-04-28 21:07:53 +02:00
Artem Sheremet	dbc6551b0c	Allow diff	2026-04-28 17:47:21 +00:00
Artem Sheremet	e733c3d86d	Migrate to Secretive fully	2026-04-28 16:30:48 +02:00
Artem Sheremet	57144414f1	Support darwin and HM in local nix-deploy	2026-04-28 07:19:31 +00:00
Artem Sheremet	a7c1cc3bd7	Keep sshfs on deimos also during logout	2026-04-28 06:24:55 +00:00
Artem Sheremet	8e6f9a3fde	Fix Gemini policy config for new syntax	2026-04-28 06:24:37 +00:00
Artem Sheremet	fb274bb6f1	Fix colorcolumn	2026-04-20 15:49:59 +00:00
Artem Sheremet	3111ac4dce	Use a standard color scheme and move ftplugin	2026-04-20 15:28:51 +00:00
Artem Sheremet	5212277efe	Allow a couple more commands for gemini	2026-04-20 14:51:37 +00:00
Artem Sheremet	4d9399290c	Migrate vim plugins to nixos modules	2026-04-20 14:51:12 +00:00
Artem Sheremet	87569883a3	Allow nix flake check	2026-04-16 09:28:22 +02:00
Artem Sheremet	eeadf2c382	nix flake update	2026-04-16 09:26:57 +02:00
Artem Sheremet	c8689d21e8	Allow nix-hash	2026-04-16 07:26:17 +00:00
Artem Sheremet	4a614e1c66	Add nix to the list of available jailed packages This will allow agent to run python/esphome/etc without attempting to download and install them	2026-04-13 16:38:46 +00:00
Artem Sheremet	d521f95a67	Prefer gemini3 models	2026-04-05 20:10:10 +00:00
Artem Sheremet	3da7b843fb	Do not install systemwide gemini-cli	2026-04-05 20:09:46 +00:00
Artem Sheremet	6d4d4393ed	nix flake update for newest packages	2026-04-05 20:02:52 +00:00
Artem Sheremet	eeded33577	Move stow under home-manager activation	2026-04-05 17:41:18 +00:00
Artem Sheremet	dee90c84a7	Allow gemini a few more commands	2026-04-05 17:38:47 +00:00
Artem Sheremet	7b0c69ec60	Workaround for broken nix-deploy	2026-04-03 20:04:47 +00:00
Artem Sheremet	9d3cca1395	Add procps for pgrep	2026-04-03 19:57:09 +00:00