Move global tools to home config

Initial opencode config
Fix vscode-server
2026-07-19 17:10:45 +00:00 · 2026-07-19 17:10:20 +00:00 · 2026-07-16 21:40:27 +00:00 · 2026-07-16 21:06:00 +00:00 · 2026-07-12 13:39:59 +02:00 · 2026-07-12 13:14:04 +02:00
23 changed files with 687 additions and 348 deletions
@@ -0,0 +1,19 @@
+name: Nix Flake Check
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Run nix flake check
+        run: nix flake check
@@ -6,3 +6,6 @@ result

 # nix pre-commit autogenerated by devShell
 /.pre-commit-config.yaml
+
+# agy sessions
+.antigravitycli
@@ -3,16 +3,16 @@
    "brew-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1778146321,
-        "narHash": "sha256-HeBwuJmuBioZHyZqDOcf7W/xsMFupSD583v6I5Cl7a8=",
+        "lastModified": 1781226006,
+        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
        "owner": "Homebrew",
        "repo": "brew",
-        "rev": "af835384ac574f76025adb38b292b04cecee1f1f",
+        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
        "type": "github"
      },
      "original": {
        "owner": "Homebrew",
-        "ref": "5.1.10",
+        "ref": "6.0.1",
        "repo": "brew",
        "type": "github"
      }
@@ -20,19 +20,20 @@
    "darwin": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-mars"
        ]
      },
      "locked": {
-        "lastModified": 1777780666,
-        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
+        "lastModified": 1783744694,
+        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
+        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
        "type": "github"
      },
      "original": {
        "owner": "nix-darwin",
+        "ref": "nix-darwin-26.05",
        "repo": "nix-darwin",
        "type": "github"
      }
@@ -96,11 +97,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1778705491,
-        "narHash": "sha256-LOZbixhLsv2QbUbqH+I06eRMAI7FBDDkGoMWH523OkE=",
+        "lastModified": 1783713126,
+        "narHash": "sha256-Q36Du9Ed1YwnQO1Mm9CHix/IcqAMkvSg34zExEfe8RI=",
        "ref": "refs/heads/main",
-        "rev": "b6fb4221bd5f54bc427de84230e0c95952399c21",
-        "revCount": 25,
+        "rev": "56d3b6dfdd46efcfb0a6f4643116a8f54cf2f89e",
+        "revCount": 45,
        "type": "git",
        "url": "https://github.com/futureware-tech/nix.git"
      },
@@ -112,18 +113,17 @@
    "git-hooks": {
      "inputs": {
        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
        "nixpkgs": [
          "fw_nix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
        "type": "github"
      },
      "original": {
@@ -135,17 +135,16 @@
    "git-hooks_2": {
      "inputs": {
        "flake-compat": "flake-compat_2",
-        "gitignore": "gitignore_2",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
        "type": "github"
      },
      "original": {
@@ -154,49 +153,6 @@
        "type": "github"
      }
    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "fw_nix",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gitignore_2": {
-      "inputs": {
-        "nixpkgs": [
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -204,11 +160,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1778503501,
-        "narHash": "sha256-08L/X4/do7nET4rzidJ76eV/1r+mB7DchVpdPypsghc=",
+        "lastModified": 1783823409,
+        "narHash": "sha256-OI4IkRjRXa1e7hYmCGJDPDq5H/kPwhsyoS80cNUF9fI=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "85ba629c79449badf4338117c27f0ee92b4b9f1a",
+        "rev": "7566825d4652a1b885bd4ce65bd9e8def432fec9",
        "type": "github"
      },
      "original": {
@@ -217,13 +173,34 @@
        "type": "github"
      }
    },
+    "home-manager-mars": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-mars"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783740085,
+        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-26.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "jail-nix": {
      "locked": {
-        "lastModified": 1772137954,
-        "narHash": "sha256-h4MGNbOo7L3RHi4uNFmsg5g17/DHXEfnv/xiG6BrNFQ=",
+        "lastModified": 1776230864,
+        "narHash": "sha256-YsEjjdOsGEzTeD+iT7ONh071BqWAOQWpzYVei3okAXE=",
        "owner": "~alexdavid",
        "repo": "jail.nix",
-        "rev": "42b355c38ca63dab4904acc5c0d95f17954a8c9b",
+        "rev": "404e7da9da5ab9aa643666682b2ba1312fa5fbe8",
        "type": "sourcehut"
      },
      "original": {
@@ -237,11 +214,11 @@
        "brew-src": "brew-src"
      },
      "locked": {
-        "lastModified": 1778332591,
-        "narHash": "sha256-ctJ3ADtugrnbMfMBobA645gCqXVIyHnsCNMkVaIuSiM=",
+        "lastModified": 1781389246,
+        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
        "owner": "zhaofengli",
        "repo": "nix-homebrew",
-        "rev": "7d0038b5bb60568ec41f5f4ef5067cd221ca7c0d",
+        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
        "type": "github"
      },
      "original": {
@@ -252,11 +229,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1777954456,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
        "type": "github"
      },
      "original": {
@@ -266,15 +243,49 @@
        "type": "github"
      }
    },
+    "nixpkgs-mars": {
+      "locked": {
+        "lastModified": 1783788001,
+        "narHash": "sha256-ldd//kQFtHfGWLQd6deNXB6GnN6uLmwjPG6GGx/2vTA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "572a2c2b6faebd71246e3162e4217d7ca63a9300",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1784182977,
+        "narHash": "sha256-Hy8zg2HEcsk4WqowQK3UKRXz1fdQM7Z2un3nSyLbJaQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "29c22b7761070f37c4c2b0dd6a8777f0bd43e268",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "darwin": "darwin",
        "fw_nix": "fw_nix",
        "git-hooks": "git-hooks_2",
        "home-manager": "home-manager",
+        "home-manager-mars": "home-manager-mars",
        "jail-nix": "jail-nix",
        "nix-homebrew": "nix-homebrew",
        "nixpkgs": "nixpkgs",
+        "nixpkgs-mars": "nixpkgs-mars",
        "systems": "systems_2",
        "vscode-server": "vscode-server"
      }
@@ -327,9 +338,7 @@
    "vscode-server": {
      "inputs": {
        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
        "lastModified": 1770124655,
@@ -3,22 +3,27 @@

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-mars.url = "github:nixos/nixpkgs/nixpkgs-26.05-darwin";
    systems.url = "github:nix-systems/default";
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    home-manager-mars = {
+      url = "github:nix-community/home-manager/release-26.05";
+      inputs.nixpkgs.follows = "nixpkgs-mars";
+    };
    vscode-server = {
      url = "github:nix-community/nixos-vscode-server";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-26.05-darwin";
    };
    fw_nix = {
      url = "git+https://github.com/futureware-tech/nix.git";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    darwin = {
-      url = "github:nix-darwin/nix-darwin";
-      inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
+      inputs.nixpkgs.follows = "nixpkgs-mars";
    };
    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
    git-hooks = {
@@ -39,20 +44,30 @@
      ...
    }@inputs:
    let
-      trustedSSHKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxRBsFGa8OFbviYDGSAKLgfm/K2XUxvCo+31FW37yab artem"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPAtIXXHm58julnr7S0xzBTM1jN5JkKxOL4JpuWDOa2jAAAABHNzaDo= office-dock-usb-a"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHY1xx0huqV6Mcc2WngYDabITeNUbGamJ8//206MxxVTAAAABHNzaDo= keychain-usb-c"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHzY2eOz+JdaKOpIgZbF5FsZzQy0l8vPJjAQdTpBFGsoAAAABHNzaDo= safe"
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJg7zQ4H0LQeQcILZBwCzQ+MYKtCgKm7HPe9oFeoyprKZXAvpm+HDHtaYdU39JF9f+nvRztzXuMhgETAQMAQCkc= fingerprint@macbook"
-      ];
+      homeManagerUser = "artem";
      eachSystem = nixpkgs.lib.genAttrs (import systems);
+      nixpkgsFor = system: if system == "x86_64-darwin" then inputs.nixpkgs-mars else nixpkgs;
    in
    {
      checks = eachSystem (system: {
-        pre-commit-check = inputs.git-hooks.lib.${system}.run (
+        pre-commit-check =
+          let
+            # Once x86_64-darwin is removed and we are back to a single nixpkgs
+            # version, this can be simplified to:
+            #   gitHooksLib = inputs.git-hooks.lib.${system}
+            gitHooksLib = import "${inputs.git-hooks}/nix" {
+              nixpkgs = nixpkgsFor system;
+              inherit system;
+              isFlakes = true;
+            };
+          in
+          gitHooksLib.run (
            {
              src = ./.;
+              excludes = [
+                "^migrated/"
+                "^legacy/"
+              ];
            }
            // inputs.fw_nix.lib.pre-commit
          );
@@ -68,25 +83,34 @@
      nixosModules = {
        linux-headless = import ./modules/nixos/linux-headless.nix;
        linux-lxc = import ./modules/nixos/linux-lxc.nix;
+        jailed-agy = import ./modules/nixos/jailed-agy.nix;
      };

-      homeConfigurations."artem@deimos" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
-        extraSpecialArgs.primaryUser = "artem";
+      homeConfigurations."${homeManagerUser}@deimos" = home-manager.lib.homeManagerConfiguration {
+        pkgs = import nixpkgs {
+          system = "x86_64-linux";
+        };
+        extraSpecialArgs.primaryUser = homeManagerUser;
        modules = [
+          inputs.fw_nix.nixosModules.identities
          vscode-server.homeModules.default
          self.homeModules.linux-headless
          ./hosts/deimos/home.nix
        ];
      };

-      homeConfigurations."artem@mars" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-darwin;
+      homeConfigurations."${homeManagerUser}@mars" =
+        inputs.home-manager-mars.lib.homeManagerConfiguration
+          {
+            pkgs = import inputs.nixpkgs-mars {
+              system = "x86_64-darwin";
+              config.allowDeprecatedx86_64Darwin = true;
+            };
            extraSpecialArgs = {
-          primaryUser = "artem";
-          inherit trustedSSHKeys;
+              primaryUser = homeManagerUser;
            };
            modules = [
+              inputs.fw_nix.nixosModules.identities
              self.homeModules.mac-portable
              ./hosts/mars/home.nix
            ];
@@ -94,30 +118,33 @@

      darwinConfigurations.mars = darwin.lib.darwinSystem {
        system = "x86_64-darwin";
-        specialArgs.primaryUser = "artem";
+        specialArgs.primaryUser = homeManagerUser;
        modules = [
+          inputs.fw_nix.nixosModules.identities
          self.darwinModules.mac-portable
-          inputs.fw_nix.nixosModules.tools
+          inputs.fw_nix.nixosModules.nix-gc
          inputs.fw_nix.nixosModules.nix-settings
+          inputs.fw_nix.nixosModules.tools
          inputs.fw_nix.nixosModules.futureware
          inputs.nix-homebrew.darwinModules.nix-homebrew
          ./hosts/mars/darwin.nix
+          {
+            nixpkgs.config.allowDeprecatedx86_64Darwin = true;
+          }
        ];
      };

-      nixosConfigurations.deimos =
-        let
+      nixosConfigurations.deimos = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
-        in
-        nixpkgs.lib.nixosSystem {
-          inherit system;
        specialArgs = {
-            inherit trustedSSHKeys;
+          primaryUser = homeManagerUser;
          inherit (inputs) jail-nix;
        };
        modules = [
+          inputs.fw_nix.nixosModules.identities
          self.nixosModules.linux-headless
          self.nixosModules.linux-lxc
+          self.nixosModules.jailed-agy
          inputs.fw_nix.nixosModules.nix-gc
          inputs.fw_nix.nixosModules.nix-settings
          inputs.fw_nix.nixosModules.tools
@@ -130,7 +157,10 @@
      devShells = eachSystem (
        system:
        let
-          pkgs = import nixpkgs { inherit system; };
+          pkgs = import (nixpkgsFor system) {
+            inherit system;
+            config.allowDeprecatedx86_64Darwin = true;
+          };
          inherit (self.checks.${system}.pre-commit-check) shellHook enabledPackages;
        in
        {
@@ -0,0 +1,22 @@
+{
+  identities,
+  primaryUser,
+  ...
+}:
+let
+  user = identities.users.${primaryUser};
+in
+{
+  programs.git = {
+    signing = {
+      # Will be available on remote machines via SSH agent (Secretive).
+      key = "key::" + user.sign."sign@mars".publicKey;
+      signByDefault = true;
+    };
+
+    settings.user = {
+      name = "Artem Sheremet";
+      inherit (user) email;
+    };
+  };
+}
@@ -1,5 +1,18 @@
-_: {
-  home.homeDirectory = "/home/artem";
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  utils = import "${pkgs.path}/nixos/lib/utils.nix" { inherit lib pkgs config; };
+  haremote-path = "${config.home.homeDirectory}/src/haremote";
+  haremote-unit = utils.escapeSystemdPath haremote-path;
+in
+{
+  imports = [
+    ../common/home.nix
+  ];

  services.vscode-server.enable = true;
  services.vscode-server.installPath = [
@@ -7,17 +20,26 @@ _: {
    "$HOME/.antigravity-server"
  ];

-  systemd.user.mounts.home-artem-src-haremote = {
+  home.packages = with pkgs; [
+    sshfs
+    nixd
+    home-assistant-cli
+    yt-dlp
+    attic-client
+    opencode
+  ];
+
+  systemd.user.mounts."${haremote-unit}" = {
    Unit = {
-      Description = "Mount ~/src/haremote";
+      Description = "Mount ${haremote-path}";
      After = [ "network-online.target" ];
      Wants = [ "network-online.target" ];
    };
    Mount = {
      What = "root@homeassistant.home.arpa:/homeassistant";
-      Where = "/home/artem/src/haremote";
+      Where = haremote-path;
      Type = "fuse.sshfs";
-      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=/home/artem/.ssh/ssh_auth_sock";
+      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=${config.home.homeDirectory}/.ssh/ssh_auth_sock";
    };
    Install = {
      WantedBy = [ "default.target" ];
@@ -26,8 +48,8 @@ _: {

  programs.zsh.loginExtra = ''
    if [ -n "$SSH_AUTH_SOCK" ]; then
-      mkdir -p ~/src/haremote
-      [ -z "$(ls -A ~/src/haremote 2>/dev/null)" ] && systemctl --user restart home-artem-src-haremote.mount
+      mkdir -p ${haremote-path}
+      [ -z "$(ls -A ${haremote-path} 2>/dev/null)" ] && systemctl --user restart ${haremote-unit}.mount
    fi
  '';
 }
@@ -1,78 +1,28 @@
 {
  pkgs,
-  trustedSSHKeys,
-  jail-nix,
+  identities,
+  primaryUser,
  ...
 }:
-let
-  jail = jail-nix.lib.init pkgs;
-in
 {
-  users.users.artem = {
+  users.users.${primaryUser} = {
    uid = 1000;
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "docker"
+      "kvm"
    ];
-    openssh.authorizedKeys.keys = trustedSSHKeys;
+    openssh.authorizedKeys.keys = identities.getAccessKeys { user = primaryUser; };
    shell = pkgs.zsh;
    linger = true; # Keep sshfs mounted even on logout.
  };

  virtualisation.docker.enable = true;

-  environment.systemPackages = with pkgs; [
-    # TODO: move below into hosts/deimos/home.nix
-    sshfs
-    nixd
-    home-assistant-cli
-    yt-dlp
+  nixpkgs.config.allowUnfree = true;

-    # jailed-gemini --yolo
-    (jail "jailed-gemini" pkgs.gemini-cli (
-      with jail.combinators;
-      [
-        network
-        time-zone
-        no-new-session
-        mount-cwd
-
-        (readwrite (noescape "~/.gemini"))
-        # The above is a stow-controlled symlink to the following.
-        (readwrite (noescape "~/dotfiles/legacy/.gemini"))
-
-        (add-pkg-deps (
-          with pkgs;
-          [
-            bashInteractive
-            curl
-            wget
-            jq
-            git
-            which
-            ripgrep
-            gnugrep
-            gnused
-            gawkInteractive
-            ps
-            findutils
-            gzip
-            unzip
-            gnutar
-            diffutils
-            coreutils
-            procps
-
-            python3
-            esphome
-
-            nix
-          ]
-        ))
-      ]
-    ))
-  ];
+  programs.fuse.enable = true; # for ~/src/haremote mount

  # For building RPi configs. Extra steps are handled by the host (nas).
  # https://discuss.linuxcontainers.org/t/systemd-binfmt-service-is-masked/21566/4
@@ -1,5 +1,12 @@
 _: {
  homebrew.casks = [
    "bambu-studio"
+
+    # Not available in nixpkgs-26.05, and latest doesn't support x86_64-darwin
+    "antigravity-cli"
+  ];
+  homebrew.brews = [
+    "libimobiledevice"
+    "ideviceinstaller"
  ];
 }
@@ -2,10 +2,15 @@
  pkgs,
  lib,
  config,
-  trustedSSHKeys,
+  identities,
+  primaryUser,
  ...
 }:
 {
+  imports = [
+    ../common/home.nix
+  ];
+
  home.packages = with pkgs; [
    dosbox-staging # dosbox appears broken on darwin

@@ -19,7 +24,11 @@

  home.activation.setupAuthorizedKeys = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
    run install -m 0600 -D \
-      ${pkgs.writeText "keys" (builtins.concatStringsSep "\n" trustedSSHKeys)} \
+      ${
+        pkgs.writeText "keys" (
+          builtins.concatStringsSep "\n" (identities.getAccessKeys { user = primaryUser; })
+        )
+      } \
      ${config.home.homeDirectory}/.ssh/ephemeral_sshd/authorized_keys
  '';

@@ -27,27 +36,4 @@
  # https://nest.pijul.com/yonkeltron/macOS-nix-config:main/ZLDSMIXK5XFW6.EIAAA
  # and
  # https://github.com/bgub/nix-macos-starter/tree/main
-
-  launchd.agents.keyboard-remap = {
-    # Remap top-left key (paragraph) to backquote and backslash like
-    # proper ISO keyboard does, and the key right to the LShift to
-    # Shift.
-    enable = true;
-    config = {
-      Label = "com.user.keyboard-remap";
-      ProgramArguments = [
-        "/usr/bin/hidutil"
-        "property"
-        "--set"
-        ''
-          {"UserKeyMapping":
-            [
-              {"HIDKeyboardModifierMappingSrc":0x700000035, "HIDKeyboardModifierMappingDst":0x7000000e1},
-              {"HIDKeyboardModifierMappingSrc":0x700000064, "HIDKeyboardModifierMappingDst":0x700000035},
-            ]
-          }''
-      ];
-      RunAtLoad = true;
-    };
-  };
 }
@@ -0,0 +1,75 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "provider": {
+    "local-ollama": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Ollama",
+      "options": {
+        "baseURL": "http://ollama.home.arpa:11434/v1",
+        "apiKey": "ollama"
+      },
+      "models": {
+        "gemma4:26b": {
+          "limit": {
+            "context": 48000,
+            "output": 8192
+          },
+          "tools": true
+        }
+      }
+    }
+  },
+  "model": "local-ollama/gemma4:26b",
+  "compaction": {
+    "auto": true,
+    "prune": true,
+    "threshold": 0.75,
+    "preserve_recent_tokens": 16384,
+    "reserved": 8192
+  },
+  "tool_output": {
+    "max_bytes": 16384,
+    "max_lines": 200
+  },
+  "mcp": {
+    "nix": {
+      "type": "local",
+      "command": [
+        "nix",
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ],
+      "enabled": true
+    },
+    "gitea": {
+      "type": "local",
+      "command": [
+        "nix",
+        "run",
+        "nixpkgs#gitea-mcp-server",
+        "--"
+      ],
+      "enabled": true
+    },
+    "ha": {
+      "type": "local",
+      "command": [
+        "nix",
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "environment": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      },
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "mcpServers": {
+    "nix": {
+      "command": "nix",
+      "args": [
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ]
+    },
+    "gitea": {
+      "command": "nix",
+      "args": [
+        "run",
+        "nixpkgs#gitea-mcp-server",
+        "--"
+      ]
+    },
+    "ha": {
+      "command": "nix",
+      "args": [
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "env": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      }
+    }
+  }
+}
@@ -1,35 +0,0 @@
-{
-  "mcpServers": {
-    "nix": {
-      "command": "nix",
-      "args": [
-        "run",
-        "github:utensils/mcp-nixos",
-        "--"
-      ]
-    },
-    "ha": {
-      "url": "${HASS_SERVER}/mcp_server/sse",
-      "headers": {
-        "Authorization": "Bearer ${HASS_TOKEN}"
-      },
-      "timeout": 5000
-    }
-  },
-  "security": {
-    "auth": {
-      "selectedType": "oauth-personal"
-    }
-  },
-  "general": {
-    "sessionRetention": {
-      "warningAcknowledged": true,
-      "enabled": true,
-      "maxAge": "30d"
-    },
-    "preferredEditor": "vim"
-  },
-  "model": {
-    "name": "auto-gemini-3"
-  }
-}
@@ -1,45 +0,0 @@
-[color]
-	ui = auto
-[alias]
-	co = checkout
-	st = status
-	di = diff -w --no-prefix
-	df = diff
-	dc = diff --cached
-	ci = commit
-	br = branch
-	lg = log -p --decorate=full --show-signature
-	lol = log --graph --decorate=full --pretty=oneline --abbrev-commit
-	lola = log --graph --decorate=full --pretty=oneline --abbrev-commit --all
-	ls = ls-files
-	# Show files ignored by git:
-	ign = ls-files -o -i --exclude-standard
-[apply]
-	whitespace = nowarn
-[push]
-	default = tracking
-[rebase]
-	stat = yes
-[format]
-	pretty = fuller
-[fetch]
-	prune = yes
-[credential "https://source.developers.google.com"]
-	helper = gcloud.sh
-[core]
-	autocrlf = input
-[branch]
-	# 0 times I wanted this when doing "git checkout".
-	autoSetupMerge = false
-	# Set up new branches in a way that "git pull" does a rebase by default.
-	autoSetupRebase = always
-
-# Commit signing, currently using ssh@mars -- to be switched to sign@mars after 2026-05-15
-[gpg]
-	format = ssh
-[commit]
-	gpgsign = true
-[user]
-	signingkey = key::ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNwSX/Ib6kNzgRKqWfcb3HsAQQo++Gt9KeXSvP6NDk6YQPjDsi+//IiBovgLjQ34El+x8l8y3aYhfIGlCyX7aOM= sign@mars
-	name = Artem Sheremet
-	email = dot.doom@gmail.com
@@ -1,25 +0,0 @@
-Host *
-	# Share SSH connection.
-	# If disabling, consider impact on ssh agent forwarding in screen
-	# sessions (see .ssh/rc file).
-	ControlMaster auto
-	ControlPath ~/.ssh/ctl/%r@%h:%p
-	ControlPersist 10m
-	# When a shared connection is broken (remote reboot), detect it faster.
-	ServerAliveInterval 11
-	ServerAliveCountMax 2
-
-	ConnectTimeout 10
-	AddKeysToAgent yes
-
-#Host custom-host-with-xorg
-#	HostName custom-hostname
-#	User crate
-#	ForwardX11 yes
-#	ForwardX11Trusted yes
-
-#Host always-changing-keys-dont-care
-#	StrictHostKeyChecking no
-#	UserKnownHostsFile=/dev/null
-
-Include config.d/*
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-# When SSH-ing with agent forwarding enabled, this variable is set by sshd
-# itself. However, an existing screen session that we attach to will not have
-# its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
-# .screenrc and create a symlink to keep it alive.
-#
-# It WILL break if two sessions are opened to a machine, and a newer one is
-# terminated. ControlMaster in .ssh/config solves this problem by sharing the
-# connection (and as a result, sharing SSH agent socket).
-[ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
@@ -35,6 +35,9 @@ if exists("+undofile")
 	" Enable the persistent undo file(s)
 	set undodir=~/.vim/undo
 	set undofile
+	if !isdirectory(expand(&undodir))
+		call mkdir(expand(&undodir), "p")
+	endif
 endif

 set switchbuf+=usetab " Switch to existing tab; open a new tab for the new buf
@@ -62,7 +62,6 @@ alias grep='grep --line-buffered --color=auto'
 alias ipt='iptables -nvL --line-numbers'
 alias ip6t='ip6tables -nvL --line-numbers'
 alias tcpdump='tcpdump -l'
-alias ag='ag -C 2 --noaffinity --pager="$PAGER" --smart-case'
 alias mysql='mysql --select_limit=1000'
 alias logcat='adb logcat -v "color printable usec year zone" -T 10'
 alias readelf='readelf -W'
@@ -81,6 +80,10 @@ starttransfer: %{time_starttransfer} | \
 total: %{time_total} | \
 size: %{size_download}\n"'

+rg() {
+	command rg -C 2 --smart-case --pretty "$@" | pager
+}
+
 # nix-deploy # current host
 # nix-deploy nas # deploy nas
 # nix-deploy test secondary # deploy secondary but do not add to boot
@@ -125,7 +128,22 @@ nix-deploy() {
 	cmd=(nixos-rebuild)
 	command -v nixos-rebuild >/dev/null 2>&1 || cmd=(nix run "nixpkgs#nixos-rebuild" --)

-	"${cmd[@]}" "$action" --flake ".#$config" --target-host "$target" --sudo "$@" |& nom
+	nix build ".#nixosConfigurations.$config.config.system.build.toplevel" \
+		--out-link "result.$config" "$@" |& nom
+	local build_status=$pipestatus[1]
+	if (( build_status != 0 )); then
+		return $build_status
+	fi
+
+	if [[ "$action" != "build" ]]; then
+		# Bypass nixos-rebuild self-update check which errors in
+		# flake-only setups when --store-path is used.
+		_NIXOS_REBUILD_REEXEC=1 "${cmd[@]}" "$action" \
+			--store-path "$(readlink -f "result.$config")" \
+			--target-host "$target" \
+			--sudo \
+			"$@"
+	fi
 }

 myip() {
@@ -148,6 +166,15 @@ colordiff() {
 	cat "$file2" | git diff --no-prefix $gitarg --no-index "$file1" -
 }

+osh() {
+	local DEST="$1"
+	# TODO: loop to re-establish connection in case of network drop.
+	#       Kill the loop after mosh (below) finishes.
+	ssh -O check "$DEST" 2>/dev/null || ssh -A -f -o ControlPersist=yes "$DEST" "sleep 2592000"
+	# Disable agent forwarding on the bootstrap connection to prevent it from overwriting the symlink in .ssh/rc
+	mosh --ssh="ssh -a" "$@"
+}
+
 alias backup-home-explore='eval "ncdu $(grep -A1 -- --exclude $HOME/bin/backup-home | tr -d \|)"'

 # stderr redirect for if direnv is missing
@@ -1,24 +1,77 @@
 {
  pkgs,
  lib,
+  identities,
  primaryUser,
  ...
 }:
 {
  home.username = primaryUser;
-  home.packages = with pkgs; [
+
+  nixpkgs.config.allowUnfree = true;
+  home.packages =
+    with pkgs;
+    [
      stow
      wget
-    gemini-cli
-    silver-searcher
      yubikey-manager
-  ];
+    ]
+    ++ lib.optional (pkgs ? antigravity-cli) antigravity-cli;
+
  home.activation.stowLegacy = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
    if [ -d "$HOME/dotfiles/legacy" ]; then
      run ${pkgs.stow}/bin/stow -d $HOME/dotfiles -t $HOME legacy
    fi
  '';

+  home.activation.report-changes = lib.hm.dag.entryAnywhere ''
+    # oldGenPath can be undefined with home-manager used as part of NixOS config
+    if [ -n "''${oldGenPath+x}" ]; then
+      ${pkgs.nvd}/bin/nvd diff $oldGenPath $newGenPath
+    fi
+  '';
+
+  programs.git = {
+    enable = true;
+
+    settings = {
+      alias = {
+        co = "checkout";
+        st = "status";
+        di = "diff -w --no-prefix";
+        df = "diff";
+        dc = "diff --cached";
+        ci = "commit";
+        br = "branch";
+        lg = "log -p --decorate=full --show-signature";
+        lol = "log --graph --decorate=full --pretty=oneline --abbrev-commit";
+        lola = "log --graph --decorate=full --pretty=oneline --abbrev-commit --all";
+        ls = "ls-files";
+        # Show files ignored by git:
+        ign = "ls-files -o -i --exclude-standard";
+      };
+
+      color.ui = "auto";
+      apply.whitespace = "nowarn";
+      push.default = "tracking";
+      rebase.stat = "yes";
+      format.pretty = "fuller";
+      fetch.prune = "yes";
+      core.autocrlf = "input";
+      branch = {
+        # 0 times I wanted this when doing "git checkout".
+        autoSetupMerge = false;
+        # Set up new branches in a way that "git pull" does a rebase by default.
+        autoSetupRebase = "always";
+      };
+      gpg.format = "ssh";
+      gpg.ssh.allowedSignersFile = "${pkgs.writeText "allowed_signers" (
+        lib.concatStringsSep "\n" (identities.getSigningEntries { })
+      )}";
+      credential."https://source.developers.google.com".helper = "gcloud.sh";
+    };
+  };
+
  programs.zsh = {
    enable = true;
    initContent = ''
@@ -137,5 +190,49 @@
    '';
  };

+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    includes = [ "config.d/*" ];
+
+    settings = {
+      "*" = {
+        # Share SSH connection.
+        # If disabling, consider impact on ssh agent forwarding in screen
+        # sessions (see .ssh/rc file).
+        ControlMaster = "auto";
+        ControlPath = "~/.ssh/ctl/%r@%h:%p";
+        ControlPersist = "10m";
+
+        # When a shared connection is broken (remote reboot), detect it faster.
+        ServerAliveInterval = 11;
+        ServerAliveCountMax = 2;
+
+        ConnectTimeout = 10;
+        AddKeysToAgent = "yes";
+      };
+    };
+  };
+
+  home.file = {
+    ".ssh/rc" = {
+      executable = true;
+      text = ''
+        #!/bin/sh
+
+        # When SSH-ing with agent forwarding enabled, this variable is set by sshd
+        # itself. However, an existing screen session that we attach to will not have
+        # its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
+        # .screenrc and create a symlink to keep it alive.
+        #
+        # It WILL break if two sessions are opened to a machine, and a newer one is
+        # terminated. ControlMaster in .ssh/config solves this problem by sharing the
+        # connection (and as a result, sharing SSH agent socket).
+        [ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
+      '';
+    };
+    ".ssh/ctl/.keep".text = "";
+  };
+
  home.stateVersion = "25.11"; # never modify
 }
@@ -35,6 +35,10 @@
    TripleClickSelectsFullWrappedLines = true;
    WordChars = "/-._~";
    PromptOnQuit = false;
+
+    # Use system browser to open links.
+    NoSyncBrowserUpsell = 1;
+    NoSyncBrowserUpsell_selection = 1;
  };
  home.file."Library/Application Support/iTerm2/DynamicProfiles/nix-profile.json".text =
    builtins.toJSON
@@ -47,6 +51,7 @@

            Columns = 160;
            Rows = 45;
+            "Scrollback Lines" = 1000000;

            # For tmux selection and moving borders.
            "Mouse Reporting" = true;
@@ -73,6 +78,10 @@
    export SSH_AUTH_SOCK=~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
  '';

-  nixpkgs.config.allowUnfree = true;
+  # TODO: defaults read NSGlobalDomain
+  #       https://nix-darwin.github.io/nix-darwin/manual/index.html
+  #       -> set system.defaults.NSGlobalDomain
+  #          or  system.defaults.CustomSystemPreferences
+
  programs.vscode.enable = true;
 }
@@ -0,0 +1,154 @@
+{
+  config,
+  lib,
+  pkgs,
+  jail-nix,
+  primaryUser,
+  ...
+}:
+let
+  jail = jail-nix.lib.init pkgs;
+  allPackages =
+    with pkgs;
+    [
+      bashInteractive
+      curl
+      wget
+      jq
+      git
+      which
+      ripgrep
+      gnugrep
+      gnused
+      gawkInteractive
+      ps
+      findutils
+      gzip
+      unzip
+      gnutar
+      diffutils
+      coreutils
+      procps
+
+      python3
+      python3Packages.pip
+      esphome
+
+      ruby
+      go
+      gcc
+      gnumake
+      pkg-config
+
+      nix
+    ]
+    ++ config.programs.jailed-agy.extraPackages;
+in
+{
+  options.programs.jailed-agy = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to enable the jailed-agy wrapper.";
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = "Extra packages to append to the jailed-agy environment.";
+    };
+  };
+
+  config = lib.mkIf config.programs.jailed-agy.enable {
+    environment.systemPackages = [
+      (jail "jailed-agy" pkgs.antigravity-cli (
+        with jail.combinators;
+        [
+          network
+          time-zone
+          no-new-session
+          mount-cwd
+
+          # Enforce that the wrapper is not run as root/privileged user
+          (add-runtime ''
+            if [ "$(id -u)" -eq 0 ]; then
+              echo "Error: jailed-agy must not be run as root/privileged user!" >&2
+              exit 1
+            fi
+          '')
+
+          # Automatically append --dangerously-skip-permissions to agy invocation
+          (set-argv [
+            "--dangerously-skip-permissions"
+            (noescape "\"$@\"")
+          ])
+
+          (readwrite (noescape "~/.gemini"))
+          # The above is a stow-controlled symlink to the following.
+          (readwrite (noescape "~/dotfiles/legacy/.gemini"))
+
+          # Enable easy installation of pip packages in the current directory.
+          (set-env "PYTHONPATH" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_TARGET" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_CACHE_DIR" (noescape "\"$PWD/.pip-cache\""))
+          (set-env "PIP_BREAK_SYSTEM_PACKAGES" "1")
+
+          # Enable easy installation and persistence of RubyGems in the current directory.
+          (set-env "GEM_HOME" (noescape "\"$PWD/.gem\""))
+
+          # Enable easy installation and persistence of Go modules and caches in the current directory.
+          (set-env "GOPATH" (noescape "\"$PWD/.go\""))
+          (set-env "GOCACHE" (noescape "\"$PWD/.go-cache\""))
+
+          # Preconfigure compiler and linker flags dynamically for all jail packages.
+          # This allows compiling Ruby gems (e.g. ffi, which requires libffi) and Go packages
+          # (e.g. YubiKey plugins, which require pcsclite) out-of-the-box.
+          (set-env "PKG_CONFIG_PATH" (
+            lib.concatStringsSep ":" (map (pkg: "${pkg.dev or pkg}/lib/pkgconfig") allPackages)
+          ))
+          (set-env "NIX_CFLAGS_COMPILE" (
+            lib.concatStringsSep " " (map (pkg: "-isystem ${pkg.dev or pkg}/include") allPackages)
+          ))
+          (set-env "NIX_LDFLAGS" (
+            lib.concatStringsSep " " (map (pkg: "-L${pkg.out or pkg}/lib") allPackages)
+          ))
+
+          # Mount system and user profiles so their packages are automatically available at runtime
+          (try-ro-bind "/run/current-system/sw" "/run/current-system/sw")
+          (try-ro-bind "/etc/profiles/per-user/${primaryUser}" "/etc/profiles/per-user/${primaryUser}")
+
+          # Mount Nix files and directories to support nix-shell and Nix operations in jail
+          (try-ro-bind "/nix/store" "/nix/store")
+          (try-ro-bind "/nix/var/nix/daemon-socket" "/nix/var/nix/daemon-socket")
+          (try-ro-bind "/nix/var/nix/profiles" "/nix/var/nix/profiles")
+          (try-ro-bind "/etc/nix" "/etc/nix")
+          (try-ro-bind "/etc/static" "/etc/static")
+
+          # Forward Nix environment variables
+          (try-fwd-env "NIX_REMOTE")
+          (try-fwd-env "NIX_PATH")
+          (try-fwd-env "NIX_SSL_CERT_FILE")
+
+          (add-pkg-deps allPackages)
+
+          # Prepend local project binary directories, system, and user bin paths to the jail's PATH.
+          # Note: We place this after `add-pkg-deps` so that local paths take highest precedence.
+          # We use explicit double quotes to allow bash to expand $PWD at runtime and handle spaces.
+          (
+            state:
+            state
+            // {
+              env = state.env // {
+                PATH =
+                  if state.env ? PATH && state.env.PATH != "" then
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin:${state.env.PATH}\""
+                  else
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin\"";
+              };
+            }
+          )
+        ]
+      ))
+    ];
+  };
+}
@@ -3,7 +3,7 @@
  ...
 }:
 {
-  # Create /etc/zshrc that loads the nix-darwin environment.
+  # Create /etc/zshrc that loads the nix environment.
  programs.zsh.enable = true;
  security.sudo.wheelNeedsPassword = false;

@@ -1,6 +1,7 @@
 {
  modulesPath,
  pkgs,
+  lib,
  ...
 }:
 {
@@ -48,6 +49,7 @@
      for item in \
          "mkdir -p:/var/lib/nixos" \
          "mkdir -p:/var/lib/systemd" \
+          "mkdir -p:/var/lib/docker" \
          "touch:/etc/machine-id" \
          "touch:/etc/ssh/ssh_host_ed25519_key" \
      ; do
@@ -72,4 +74,7 @@
    capabilities = "cap_net_raw+p";
    source = "${pkgs.iputils.out}/bin/ping";
  };
+
+  # Our VMs usually have sufficient RAM, prefer to extend SSD lifetime.
+  boot.tmp.useTmpfs = lib.mkDefault true;
 }
Author	SHA1	Message	Date
artem	d74de8b58c	Move global tools to home config Nix Flake Check / check (push) Successful in 54s Details	2026-07-19 17:10:45 +00:00
artem	12adcfed1c	Initial opencode config	2026-07-19 17:10:20 +00:00
artem	e325cff1be	Fix vscode-server Nix Flake Check / check (push) Successful in 49s Details	2026-07-16 21:40:27 +00:00
artem	24c8eef831	Fix haremote mount	2026-07-16 21:06:00 +00:00
artem	91507f173d	Bring agy back, remove annoying remap Nix Flake Check / check (push) Successful in 49s Details	2026-07-12 13:39:59 +02:00
artem	354443653f	Comment how to simplify after x86_64-darwin Nix Flake Check / check (push) Successful in 48s Details	2026-07-12 13:14:04 +02:00
artem	745547bd2a	Fix mars build Nix Flake Check / check (push) Successful in 49s Details unstable/26.11 broken for x86_64-darwin	2026-07-12 13:09:27 +02:00
artem	c41912da8f	Add attic-client to deimos and use attic cache Nix Flake Check / check (push) Successful in 2m3s Details	2026-07-09 20:13:04 +00:00
artem	134385bc53	Allow passing paramters to nix build Nix Flake Check / check (push) Successful in 58s Details nix-deploy switch root@nas.home.arpa --override-input fw_nix ../fw_nix	2026-07-09 19:27:36 +00:00
artem	263faa78c4	nix flake update Nix Flake Check / check (push) Successful in 1m6s Details	2026-07-09 18:23:58 +00:00
artem	5db0125c8a	Exclude non-nix config files Nix Flake Check / check (push) Successful in 1m19s Details	2026-07-08 21:39:48 +00:00
artem	f8b57a1708	Add GitHub action for flake check Nix Flake Check / check (push) Failing after 53s Details	2026-07-08 21:23:37 +00:00
artem	9224f30970	nix flake update	2026-07-08 15:15:48 +00:00
artem	397a5c8fc3	Fix agent forwarding for mosh	2026-07-08 17:10:40 +02:00
artem	eabc84c914	Make jailed-agy enabled by default Unfortunately most hosts need it.	2026-07-06 17:08:24 +00:00
artem	51f1b9ea7d	nix flake update	2026-07-06 17:06:43 +00:00
artem	d47b6f7d7d	Make antigravity-cli optional Missing from nixos-26.05	2026-07-06 17:05:43 +00:00
artem	7debc16e21	Add gitea MCP server	2026-07-06 17:05:43 +00:00
artem	d29c5b67d4	A couple tools to control iPhone	2026-07-04 13:35:59 +02:00
artem	3018e057d7	"osh" for ssh+mosh	2026-07-04 13:35:42 +02:00
artem	50898e30aa	Mount /tmp from RAM	2026-06-29 10:55:31 +00:00
artem	ce9475e001	Mount docker from persistence	2026-06-21 21:13:21 +00:00
artem	a37e25329a	Improve jailed-agy Add python, ruby, go, custom paths.	2026-06-19 13:37:00 +00:00
artem	3975092d67	nix flake update	2026-06-19 12:03:08 +00:00
artem	a2c2b2a2e5	Fix unfree and PATH for jailed-agy	2026-06-12 13:35:31 +00:00
artem	0c0c94e4bf	Extract jailed-agy into reusable module	2026-06-11 19:27:46 +00:00
artem	a659a07637	Move ssh config into nix	2026-06-09 19:19:27 +00:00
artem	60531ed270	Auto-create undodir if it doesn't exist This is required for undo to work across restarts	2026-06-09 18:57:16 +00:00
artem	e6e62a375c	Remove master overlay agy is now available in unstable	2026-06-09 18:08:07 +00:00
artem	58ade9d886	Finish migrating from ag to rg	2026-06-09 17:38:48 +00:00
artem	eb2bdc2d33	nix flake update	2026-06-09 10:20:05 +00:00
artem	c4fb365814	Remove ag (dropped from nix)	2026-06-08 18:42:01 +00:00
artem	b4383e0d19	Use system browser in iTerm2	2026-06-07 20:23:32 +02:00
artem	e57b3e6937	Avoid warning about darwin-x86_64 expiring	2026-06-05 06:21:39 +00:00
artem	0938c76f1b	Extract "artem" into a variable	2026-06-05 06:21:05 +00:00
artem	2e02f82ae2	Leave symlink to latest nix-deploy'ed version This will keep gc root on the linked derivation and prevent nix-collect-garbage from removing it.	2026-05-26 17:02:09 +00:00
artem	2c380eaf10	Move mcp server settings to antigravity-cli	2026-05-25 08:59:19 +00:00
artem	76061f4919	gemini-cli -> antigravity-cli	2026-05-25 08:20:48 +00:00
artem	159daf0630	Move from legacyPackages to proper import	2026-05-25 08:17:19 +00:00
artem	82419c57ad	Move allowUnfree to all of homes Eventually for antigravity-cli	2026-05-25 08:10:12 +00:00
artem	6df89b4b06	Allow access to KVM	2026-05-25 07:52:24 +00:00
artem	3fabad4344	nix flake update	2026-05-23 17:58:29 +00:00
artem	616a81d29d	nix flake update ``` Version changes: [U.] #1 gemini-cli 0.40.1 -> 0.41.2 [U.] #2 libgit2 1.9.2-lib -> 1.9.3-lib [U.] #3 nodejs 22.22.2 -> 22.22.3 [U.] #4 nodejs-slim 22.22.2, 22.22.2-corepack, 22.22.2-npm -> 22.22.3, 22.22.3-corepack, 22.22.3-npm [U.] #5 vscode 1.116.0 -> 1.119.0 ```	2026-05-17 16:31:54 +02:00
artem	5a1da34702	iTerm scrollback 1k -> 1M	2026-05-17 16:14:35 +02:00
artem	8b813e6345	Periodic nix-collect-garbage on darwin	2026-05-17 11:06:48 +02:00
artem	080cd5b1cc	Fix undefined variable when deployed in NixOS	2026-05-15 19:55:18 +00:00
artem	28a2a91d93	Remove redundant variable	2026-05-15 15:39:00 +00:00
artem	f878110e49	Move common into imports This follows the same pattern as modules	2026-05-15 15:36:11 +00:00
artem	a57b0f2fef	Sprinkle a bit of standard library in home config	2026-05-15 15:25:52 +00:00
artem	0160a8aa80	Add nvd (version diff)	2026-05-15 15:15:27 +00:00
artem	3b688fd5a2	Mark all known signers as allowed	2026-05-15 13:31:40 +00:00
artem	0ee7266b3d	Populate allowedSignersFile	2026-05-15 13:05:41 +00:00
artem	ecb0dc092e	Migrate .gitconfig to home-manager	2026-05-15 12:55:42 +00:00
artem	97248c0da3	Use identities from fw_nix	2026-05-15 12:24:03 +00:00
artem	7819928be2	Hint for where to look up system setting values	2026-05-14 19:25:32 +02:00