upstream changes

first pass turning headscale on w1
add new bash alias
2026-06-18 12:18:13 -05:00 · 2026-06-18 12:18:08 -05:00 · 2026-06-17 19:13:08 -05:00 · 2026-06-17 19:12:45 -05:00 · 2026-06-17 19:12:00 -05:00 · 2026-06-17 19:11:31 -05:00
47 changed files with 485 additions and 348 deletions
--- a/.gitignore
+++ b/.gitignore
@ -19,3 +19,5 @@
 result
 *.qcow2
 nixos-switch.log
+*.org
+*.orig
--- a/flake.lock
+++ b/flake.lock
@ -25,11 +25,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1779125773,
-        "narHash": "sha256-F34zmAgMQXHwvFb9SpCilX4cAIfF4+KvpzrJqnkNLJE=",
+        "lastModified": 1781180057,
+        "narHash": "sha256-sh5cl74+o7PBUp5igMeqGoofiyUguudIS8Cw6jXlKjw=",
        "owner": "catppuccin",
        "repo": "nix",
-        "rev": "86996e2c4ee6a091fddb10de56dd21a1a5972bcb",
+        "rev": "c3623ae5172427612749154de46455d97e1a66ad",
        "type": "github"
      },
      "original": {
@ -97,11 +97,11 @@
    "flake-compat_3": {
      "flake": false,
      "locked": {
-        "lastModified": 1751685974,
-        "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
+        "lastModified": 1777699697,
+        "narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=",
        "ref": "refs/heads/main",
-        "rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
-        "revCount": 92,
+        "rev": "382052b74656a369c5408822af3f2501e9b1af81",
+        "revCount": 94,
        "type": "git",
        "url": "https://git.lix.systems/lix-project/flake-compat.git"
      },
@ -160,11 +160,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@ -276,11 +276,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1779157263,
-        "narHash": "sha256-VbiyZkRf8/qr7ObmlyfOHJsNAW5tyZ4MB1+cUwAwdrw=",
+        "lastModified": 1781189114,
+        "narHash": "sha256-5inaamLgUMWy+MOBE9ChF9QAF1o/74LFuHkI0W/9rqc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "866412a19866b4a8e32d2306a118040afa2b840c",
+        "rev": "486595d2cf49cfcd649b58a284fa11ac0e34da22",
        "type": "github"
      },
      "original": {
@ -319,11 +319,11 @@
    },
    "mnw": {
      "locked": {
-        "lastModified": 1777828893,
-        "narHash": "sha256-gVWVnmyNr74BVKfhMMZDWkhx2699dhmZ2g0W8TTHtkk=",
+        "lastModified": 1780772958,
+        "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=",
        "owner": "Gerg-L",
        "repo": "mnw",
-        "rev": "c1c0b544bfabe6669b5a6a0383ccb475fe60258b",
+        "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160",
        "type": "github"
      },
      "original": {
@ -359,16 +359,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1776882296,
-        "narHash": "sha256-DWZozXwMsgvUqfVlL1mQ8dOxW7GJ/8CdyaDN+1niZRg=",
+        "lastModified": 1779233504,
+        "narHash": "sha256-YIKEyzh0NFQlD0O92LQQNMoVCDwV8yw1Xz0Iu+4ZC5U=",
        "owner": "feel-co",
        "repo": "ndg",
-        "rev": "ab7d78d4884b3a34968cf9fa3d16c0c1246d5c6e",
+        "rev": "86f6644411a64d5413711895b7cf6e0e1be465b6",
        "type": "github"
      },
      "original": {
        "owner": "feel-co",
-        "ref": "refs/tags/v2.6.0",
+        "ref": "refs/tags/v2.8.0",
        "repo": "ndg",
        "type": "github"
      }
@ -383,11 +383,11 @@
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1779121299,
-        "narHash": "sha256-jOG6snvWYtFaAmxyJF60ELISmXSJ0e/B5HULkS9RCPE=",
+        "lastModified": 1781190364,
+        "narHash": "sha256-uP1AYpXYHdzmuz+a4AcScRIHa1uy7l9ObZovS0OqN70=",
        "owner": "NixOS",
        "repo": "nix",
-        "rev": "e7fd44ad299ac1cf1b37bc558e1e0e0fb9884748",
+        "rev": "ce9fda43e5cb8d2f6c57c7240d05d10ad0415799",
        "type": "github"
      },
      "original": {
@ -417,12 +417,15 @@
      }
    },
    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_6"
+      },
      "locked": {
-        "lastModified": 1779099457,
-        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
+        "lastModified": 1781168557,
+        "narHash": "sha256-LOnLQ2tpYF9gqIDDr3+j3DbpJJr/QCH6zPRT2GzEUOE=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
+        "rev": "6358ff76821101c178e3ab4919a62799bfe3652e",
        "type": "github"
      },
      "original": {
@ -482,11 +485,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1778737229,
-        "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
+        "lastModified": 1780952837,
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
        "type": "github"
      },
      "original": {
@ -514,18 +517,15 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1778443072,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
-        "type": "github"
+        "lastModified": 1780365719,
+        "narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=",
+        "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
      }
    },
    "nixpkgs_4": {
@ -546,24 +546,37 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1778003029,
-        "narHash": "sha256-amc4Y3GF3+anUi7IJeLVzf7hVqLb3ZqCGzYtkVyp7Qw=",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
+        "lastModified": 1780902259,
+        "narHash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY=",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.10470.0c88e1f2bdb9/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
      }
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
        "type": "github"
      },
      "original": {
@ -573,7 +586,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
+    "nixpkgs_8": {
      "locked": {
        "lastModified": 1768323494,
        "narHash": "sha256-yBXJLE6WCtrGo7LKiB6NOt6nisBEEkguC/lq/rP3zRQ=",
@ -589,7 +602,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_8": {
+    "nixpkgs_9": {
      "locked": {
        "lastModified": 1775888245,
        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
@ -608,16 +621,16 @@
    "nixvim": {
      "inputs": {
        "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_8",
        "nuschtosSearch": "nuschtosSearch",
        "systems": "systems_4"
      },
      "locked": {
-        "lastModified": 1769049374,
-        "narHash": "sha256-h0Os2qqNyycDY1FyZgtbn28VF1ySP74/n0f+LDd8j+w=",
+        "lastModified": 1780865908,
+        "narHash": "sha256-UMwL+pE2I49q6qOV8w6pnuF3utb1qQuofmprBAhOU6A=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "b8f76bf5751835647538ef8784e4e6ee8deb8f95",
+        "rev": "68e314303bc60b8a58cdd2f361013809620b2473",
        "type": "github"
      },
      "original": {
@ -662,11 +675,11 @@
        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1779018518,
-        "narHash": "sha256-RUmjcuxbaa8UKsd5rUO5bqDe9YxGBDLXd4tFFBi351E=",
+        "lastModified": 1781204315,
+        "narHash": "sha256-0mEWVih7Aq2tdyZwHL91tZMsIitFIocGMvtfaenOSPc=",
        "owner": "notashelf",
        "repo": "nvf",
-        "rev": "cd45295f9c65ca81f323155660ba83d427bd0154",
+        "rev": "5727a5b9a76f6540d93a26cfc96c6ec2b47fa4f3",
        "type": "github"
      },
      "original": {
@ -684,7 +697,7 @@
        "naviterm": "naviterm",
        "nix": "nix",
        "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_7",
        "nixpkgs-stable": "nixpkgs-stable",
        "nixvim": "nixvim",
        "nvf": "nvf",
@ -711,14 +724,14 @@
    },
    "sops-nix": {
      "inputs": {
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": "nixpkgs_9"
      },
      "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -43,6 +43,7 @@
      system = "x86_64-linux";
      config = {
        allowUnfree = true;
+        overlays = [ (import ./overlays/default.nix { inherit inputs; }) ];
      };
    };
    lib = inputs.nixpkgs.lib // home-manager.lib;
@ -70,12 +71,12 @@
      };
      # ace = import ./hosts/ace/colmena.nix;          # Acer C720
      book = import ./hosts/book/colmena.nix; # Google Pixelbook 2017 w/ nvme.
-      display = import ./hosts/display/colmena.nix; # Pi4
+      # display = import ./hosts/display/colmena.nix; # Pi4
      # eve = import ./hosts/eve/colmena.nix; # Google Pixelbook 2017 w/ eMMC.
      fred = import ./hosts/fred/colmena.nix; # acer server
      loki = import ./hosts/loki/colmena.nix; # Dell XPS 13
      # pi1 = import ./hosts/pi1/colmena.nix;
-      pocket2 = import ./hosts/pocket2/colmena.nix;
+      # pocket2 = import ./hosts/pocket2/colmena.nix;
      smaug = import ./hosts/smaug/colmena.nix; # Thinkpad x260
      w1 = import ./hosts/w1/colmena.nix; # Hetzner VPS
      # w2 = import ./hosts/w2/colmena.nix;
--- a/home/common/catppuccin.nix
+++ b/home/common/catppuccin.nix
@ -3,6 +3,7 @@
  qt = { style = { }; };
  catppuccin = {
    enable = true;
+    autoEnable = true;
    flavor = "mocha";
    aerc = { enable = false; };
    alacritty = {
--- a/home/common/default.nix
+++ b/home/common/default.nix
@ -17,6 +17,7 @@
    ./newsboat.nix
    ./nixvim.nix
    # ./nvf.nix
+    ./pass.nix
    ./ssh.nix
    ./taskwarrior.nix
    ./topgrade.nix
@ -32,10 +33,12 @@
    bluetui
    bottom
    cargo
+    catimg
+    chafa
    clock-rs
    compose2nix
    diff-so-fancy
-    # elinks  # FIXME - does not build 2026-05-06
+    elinks
    espeak-ng
    exiftool
    fastfetch
@ -43,6 +46,7 @@
    ffmpeg
    figlet
    file
+    fresh-editor
    fzf
    gdu
    gh
@ -74,11 +78,21 @@
    ncdu
    nchat
    neomutt
+    nil
    nmap
    notmuch
    pandoc
    pinentry-curses
-    pipx
+    # pipx  # FIXME - not building 2026-05-26
+    # See https://github.com/NixOS/nixpkgs/issues/522307
+    (pipx.overridePythonAttrs (old: {
+      disabledTests =
+        (old.disabledTests or [])
+        ++ [
+          "test_fix_package_name"
+          "test_parse_specifier_for_metadata"
+        ];
+    }))
    ps_mem
    psmisc
    ranger
@ -119,7 +133,9 @@
    };
    gpg-agent = {
      enable = true;
-      defaultCacheTtl = 1800;
+      maxCacheTtl = 604800;
+      defaultCacheTtl = 604800;
+      defaultCacheTtlSsh = 604800;
      enableSshSupport = true;
    };
  };
--- a/home/common/files/bash/bash_aliases
+++ b/home/common/files/bash/bash_aliases
@ -9,6 +9,7 @@ alias neofetch="fastfetch"
 alias vi="${EDITOR}"
 alias ip='COLORFGBG=";0" ip -c '
 alias lg="lazygit"
+alias pkhal="ikhal -d work"

 # Taskwarrior
 alias t=task
--- a/home/common/files/bash/myapps
+++ b/home/common/files/bash/myapps
@ -1,5 +1,5 @@
 MAILTERMPROG=ghostty
-TERMPROG=ghostty
+TERMPROG=kitty
 MUSIC=sublime-music
 hostname=`hostname`
 WEB=qutebrowser
--- a/home/common/files/neomutt/neomuttrc
+++ b/home/common/files/neomutt/neomuttrc
@ -11,37 +11,24 @@ auto_view text/html
 bind attach,compose Q exit
 bind attach,pager i exit
 bind editor <Tab> complete-query
+bind index <f1> sidebar-next
+bind index <f2> sidebar-open
+bind index <f3> sidebar-prev
 bind index x sync-mailbox
-bind index,pager / vfolder-from-query
 bind index,pager * flag-message
+bind index,pager / vfolder-from-query
+bind index,pager R group-reply
 bind index,pager Y print-message
 bind index,pager c mail
 bind index,pager g change-folder
 bind index,pager n next-entry
 bind index,pager p previous-entry
-bind index,pager R group-reply
 bind pager <down> next-line
 bind pager <up> previous-line
 bind pager C copy-message
 color indicator underline default default
 hdr_order                 Subject: From: Date: Reply-To: To: Cc: Bcc: X-Scan-Grey: X-Bugzilla-Watch-Reason: X-Label: List-Id:
 ignore                    *
-macro attach K "<enter-command>unset wait_key<enter><shell-escape>rm -f /tmp/events.ics<enter><save-entry><kill-line>/tmp/events.ics<enter><shell-escape> vkhal -k /tmp/events.ics<enter>"
-macro attach,index,pager <f9> "!/home/don/bin/mbsync gmail-fast\n" "sync imap"
-macro compose y "<ispell><send-message>" 'Send message w/spell check'
-macro generic \em ":source ~/.config/neomutt/neomuttrc\n" "reload ~/.muttrc"
-macro index i "g!\n" "Goto Inbox"
-macro index B             '<enter-command>toggle sidebar_visible<enter><refresh>'
-macro index \t "g\r"
-macro index,pager @ "<save-message>=Inbox<enter>" "Ham it!"
-macro index,pager A "<pipe-message>khard add-email<return>"  "add the sender email address to khard"
-# macro index,pager F "<pipe-message>mutt2task<enter><save-message>=Followup<enter>" "Follow up"
-macro index,pager O <pipe-message>mail2obsidian<enter>
-macro index,pager Q ":set quit=yes\nq" "Quit mutt without asking"
-macro index,pager S "<save-message>=SPAM<enter>" "Spam it!"
-macro index,pager W <pipe-message>mail2onenote<enter>
-macro index,pager w <pipe-message>emailtask<enter>
-macro index,pager y "<save-message><enter>" "Archive"
 # macro index,pager <f1> "<save-message>=snooze/1<enter>"
 # macro index,pager <f2> "<save-message>=snooze/2<enter>"
 # macro index,pager <f3> "<save-message>=snooze/3<enter>"
@ -49,12 +36,58 @@ macro index,pager y "<save-message><enter>" "Archive"
 # macro index,pager <f5> "<save-message>=snooze/5<enter>"
 # macro index,pager <f6> "<save-message>=snooze/6<enter>"
 # macro index,pager <f7> "<save-message>=snooze/7<enter>"
-macro pager B             '<enter-command>toggle sidebar_visible<enter><redraw-screen>'
+# macro index,pager F "<pipe-message>mutt2task<enter><save-message>=Followup<enter>" "Follow up"
+# macro index,pager O <pipe-message>mail2obsidian<enter>
+# macro index,pager W <pipe-message>mail2onenote<enter>
+macro attach K "<enter-command>unset wait_key<enter><shell-escape>rm -f /tmp/events.ics<enter><save-entry><kill-line>/tmp/events.ics<enter><shell-escape> vkhal -k /tmp/events.ics<enter>"
+macro attach,index,pager <f9> "!/home/don/bin/mbsync gmail-fast\n" "sync imap"
+macro compose y "<ispell><send-message>" 'Send message w/spell check'
+macro generic \em ":source ~/.config/neomutt/neomuttrc\n" "reload ~/.muttrc"
+macro index B             '<enter-command>toggle sidebar_visible<enter><refresh>'
+macro index \t "g\r"
+macro index i "g!\n" "Goto Inbox"
+macro index,pager A "<pipe-message>khard add-email<return>"  "add the sender email address to khard"
+macro index,pager Q ":set quit=yes\nq" "Quit mutt without asking"
+macro index,pager w <pipe-message>emailtask<enter>
+macro pager B '<enter-command>toggle sidebar_visible<enter><redraw-screen>'
 macro pager l "ql" "Goto index and limit"
 macro pager o ":set pipe_decode\n|urlscan --run-safe myweb --pipe -c -d\n:unset pipe_decode\n" "call urlscan to extract URLs out of a message"
 macro pager x "ix" "exit pager and sync mailbox"
+################################################################################
+# mdir config
+macro index,pager @ "<save-message>=Inbox<enter>" "Ham it!"
+macro index,pager S "<save-message>=SPAM<enter>" "Spam it!"
+macro index,pager y "<save-message><enter>" "Archive"
 mailboxes =Inbox =news =pen =mailing-lists =development =SPAM
-# =Followup
+set spoolfile=+Inbox
+set trash="+Trash"
+set index_format="%2C %Z %[%m/%d %l:%M %P] %-20.20F | %s"
+
+################################################################################
+# notmuch config
+# macro index,pager @ "<modify-labels>-spam -new -unread +inbox<enter><sync-mailbox>" "Ham it!"
+# macro index,pager N "<modify-labels>-new -unread<enter><sync-mailbox>"
+# macro index,pager S "<modify-labels>+spam -new -unread -inbox<enter><sync-mailbox><save-message>=SPAM<enter>" "Spam it!"
+# macro index,pager y "<modify-labels>+archive -new -unread -inbox<enter><sync-mailbox>"
+# macro index,pager d "<modify-labels>-new -unread -inbox +deleted<enter><previous-entry><delete-message>"
+# bind index,pager \et modify-tags
+# bind index,pager <TAB> change-vfolder
+# set nm_default_uri="notmuch:///home/don/Mail" # path to the maildir
+# set virtual_spoolfile=yes                          # enable virtual folders
+# set spoolfile=Inbox
+# virtual-mailboxes   "Inbox"          "notmuch://?query=tag:inbox and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "news"           "notmuch://?query=tag:news and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "pen"            "notmuch://?query=tag:pen and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "mailing-lists"  "notmuch://?query=tag:mailing-lists and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "development"    "notmuch://?query=tag:development and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "SPAM"           "notmuch://?query=tag:SPAM and NOT tag:archive and NOT tag:deleted"
+# virtual-mailboxes   "Unread"         "notmuch://?query=tag:unread"
+# virtual-mailboxes   "Starred"        "notmuch://?query=tag:*"
+# virtual-mailboxes   "Sent"           "notmuch://?query=tag:sent"
+# sidebar_pin     "Inbox" "news" "pen" "mailing-lists" "development" "SPAM" "Unread" "Starred" "Sent"
+# set index_format="%2C %Z %[%m/%d %l:%M %P] %-20.20F (%g) | %s"
+# ################################################################################
+
 reply-hook  '~C don@donaldharper.com' 'my_hdr From: "Don Harper" <don@donaldharper.com>; my_hdr Reply-To: "Don Harper" <don@donaldharper.com>;set from="don@donaldharper.com"'
 reply-hook  '~C don@donharper.org' 'my_hdr From: "Don Harper" <don@donharper.org>; my_hdr Reply-To: "Don Harper" <don@donharper.org>;set from="don@donharper.org"'
 reply-hook  '~C donald.m.harper@gmail.com' 'my_hdr From: "Don Harper" <donald.m.harper@gmail.com>; my_hdr Reply-To: "Don Harper" <donald.m.harper@gmail.com>;set from="donald.m.harper@gmail.com"'
@ -98,7 +131,6 @@ set hidden_host
 set hostname="duckland.org"
 set implicit_autoview=yes
 set include=yes
-set index_format="%2C %Z %[%m/%d %l:%M %P] %-20.20F | %s"
 set ispell="aspell -e -c"
 set mailcap_path=~/.config/neomutt/mailcap
 #set maildir_trash
@ -122,16 +154,14 @@ set reverse_name=yes
 set sendmail="/run/wrappers/bin/sendmail"
 set sendmail_wait=3
 set sidebar_short_path
-set sidebar_format        = "%B %n %!"
+set sidebar_format        = "%D %n %!"
 set sidebar_new_mail_only
 set sort=threads
 set sort_aux=last-date-sent
-set spoolfile=+Inbox
 set status_format="---Mutt:  %f   [Msgs:%?M?%M/?%m%?n? New:%n?%?o? Post:%p?%?b? Inc:%b? ]-%>-(%P)---"
 set status_on_top
 set timeout=10
 set tmpdir="/var/tmp"
-set trash="+Trash"
 set use_envelope_from=yes
 set wrap=-10
 set write_inc=25
--- a/home/common/files/notmuch/post-new
+++ b/home/common/files/notmuch/post-new
@ -1,5 +1,7 @@
 #!/usr/bin/env bash

+afew --tag --all >> /dev/null 2>&1
+exit
 addtag() {
  tags="${1}"
  field="${2}"
@ -33,12 +35,13 @@ movetag() {
 }
 addtag aurora from "collegeboard@noreply.collegeboard.org"
 addtag kisd from "noreply@sportsyou.com bbstheatre@gmail.com do-not-reply@seesaw.me katyisd.org mail.remind.com no-reply@schoolnutritionandfitness.com noreply@mailer.sportsengine.com notifications@instructure.com webstores@revtrak.net"
+addtag kisd List "100002107.xt.local"
 addtag uh from "donotreply@studentaid.gov hello@earnest.com hello@hello.earnest.com parents@uh.campusespmail.com reply@info.myfedloan.org uh.edu"
-movetag development from "notifications@github.com outgoing@sr.ht"
-movetag mailing-lists from "noreply@bandcamp.com tom@newsletter.tomscott.com info@repebble.com news@shop.kobo.com hello@determinate.systems james@jamespopsys.com designthinkingcomic@substack.com info@zmp.techtarget.com newsletter@popey.com noreply@mail.selfh.st parker.higgins@tailscale.com hello@redecentralize.org noreply@selfh.st no-reply@drivethrurpg.com no-reply@hello.charlestyrwhitt.com marketing@gc2b.info newsletters@bookshop.org contact@kickstargogo.com email@em.myaccountaccess.com do-not-reply@thangs.com TurboTax@em1.turbotax.intuit.com cincoconnect@engage.goenumerate.com all3dp.com amazon.com aur.archlinux.org drivethrucomics.com e.crm.lego.com e.honeywellhome.com emac.usaa.com email.tripit.com email1.roku.com freebirdsworldburrito.com gnty.com h1.hilton.com ianworthphotography.co.uk linkedin.com mailer.netflix.com me.kickstarter.com meetup.com mp1.tripadvisor.com nathan@nathanlowell.com nature.com penzeys.com photoephemeris.com planetary.org promotions.sprouts.com redditmail.com sherwoodforestfaire.com thanx.com townsq.io travel2.hiltongrandvacations.com tripit.com ttias.be uh.campusespmail.com xpsship.com ymcahouston.org youtube.com"
+movetag development from "github.com outgoing@sr.ht gohugo.io"
+movetag development List "59644032.naviterm.detoxify92.gitlab.com discourse.gohugo.io support.discourse.gohugo.io"
+movetag mailing-lists from "keychron.com substack.com qutebrowser.org nabucasa.com noreply@bandcamp.com tom@newsletter.tomscott.com info@repebble.com news@shop.kobo.com hello@determinate.systems james@jamespopsys.com info@zmp.techtarget.com newsletter@popey.com noreply@mail.selfh.st parker.higgins@tailscale.com hello@redecentralize.org noreply@selfh.st no-reply@drivethrurpg.com no-reply@hello.charlestyrwhitt.com marketing@gc2b.info newsletters@bookshop.org contact@kickstargogo.com email@em.myaccountaccess.com do-not-reply@thangs.com TurboTax@em1.turbotax.intuit.com cincoconnect@engage.goenumerate.com all3dp.com amazon.com aur.archlinux.org drivethrucomics.com e.crm.lego.com e.honeywellhome.com emac.usaa.com email.tripit.com email1.roku.com freebirdsworldburrito.com gnty.com h1.hilton.com ianworthphotography.co.uk linkedin.com mailer.netflix.com me.kickstarter.com meetup.com mp1.tripadvisor.com nathan@nathanlowell.com nature.com penzeys.com photoephemeris.com planetary.org promotions.sprouts.com redditmail.com sherwoodforestfaire.com thanx.com townsq.io travel2.hiltongrandvacations.com tripit.com ttias.be uh.campusespmail.com xpsship.com ymcahouston.org youtube.com"
 movetag mailing-lists to "~rjarry/aerc-discuss@lists.sr.ht"
-movetag news from "email@washingtonpost.com email@nl.npr.org bbcnewsdaily@bbc.co.uk newsletters.cnn.com mailer.chron.com mailer.houstonchronicle.com"
-# query:"list:((281c839c990f42b374467ae5f.38179.list-id.mcsv.net 6424888.xt.local 7219534.xt.local NTg1OTQxNC00NzgtNA== a2e22d7f24f6d1e3464d05be4.330790.list-id.mcsv.net news.theregister.co.uk))" tag:[ "news" ]
-# query:"list:((a1d0492028bd019fd37c01eb6.77408.list-id.mcsv.net 1021275.xt.local f452ec3bdbd6b3981f19e668amc e2bfda4c698819ae31aed58a4mc 4caf0a639e8acd8cf045f7bf9.972716.list-id.mcsv.net 72a12beb88773f8d735b1ef60.728193.list-id.mcsv.net 100019430.xt.local arch-announce.lists.archlinux.org arch-general.lists.archlinux.org arch-security.lists.archlinux.org capone.1.0.sparkpostmail.com docker.general.discourse.linuxserver.io micaelwidell.buttondown.email qutebrowser.lists.qutebrowser.org))" tag:[ "mailing-lists" ]
-# query:"list:((discourse.gohugo.io support.discourse.gohugo.io OR 59644032.naviterm.detoxify92.gitlab.com))" tag:[ "development" ]
-# query:"list:(100002107.xt.local)" tag:[ "kisd" ]
+movetag mailing-lists List "019709108c5a5a76b2d015dd3d4db4262827bf3f.google.com 051b683089a9961268c16c3b8.186717.list-id.mcsv.net 100019430.xt.local 1021275.xt.local 4caf0a639e8acd8cf045f7bf9.972716.list-id.mcsv.net 50874e856d63dbc9da48f17f6.661209.list-id.mcsv.net 72a12beb88773f8d735b1ef60.728193.list-id.mcsv.net 78867590-91ca-400c-8788-54215beef097@mail.nabucasa.com a1d0492028bd019fd37c01eb6.77408.list-id.mcsv.net bc856e62a9254399365d0277b.444809.list-id.mcsv.net capone.1.0.sparkpostmail.com disneyplus.com docker.general.discourse.linuxserver.io e2bfda4c698819ae31aed58a4mc f452ec3bdbd6b3981f19e668amc micaelwidell.buttondown.email no-reply.ee111a3d.toast-restaurants.com.s1r1r-596yt.mj platformengineeringmonthly.substack.com qutebrowser.org"
+movetag pen from "spacecitypenclub@gmail.com goldspot.com gouletpens.com penaddict.com inkjournal.com penchalet.com store+14054876@t.shopifyemail.com jetpens.com fprevolutionusa.com penrealm.com fountainpennetwork.com"
+movetag news from "bbc.com theregister.co.uk email@washingtonpost.com email@nl.npr.org bbcnewsdaily@bbc.co.uk newsletters.cnn.com mailer.chron.com mailer.houstonchronicle.com"
+movetag news List "281c839c990f42b374467ae5f.38179.list-id.mcsv.net 6424888.xt.local 7219534.xt.local NTg1OTQxNC00NzgtNA== a2e22d7f24f6d1e3464d05be4.330790.list-id.mcsv.net news.theregister.co.uk"
--- a/home/common/mail.nix
+++ b/home/common/mail.nix
@ -24,28 +24,53 @@
    };
  };

-  programs.notmuch = {
-    enable = true;
-    new = {
-      tags = ["new" "unread" "inbox"];
-      ignore = [
-        ".mbsyncstate"
-        ".uidvalidity"
-        ".mbsyncstate.journal"
-        ".mbsyncstate.new"
-        ".mbsyncstate.lock"
-      ];
+  programs = {
+    afew = {
+      enable = true;
+      extraConfig =
+        ''
+          [FolderNameFilter]
+          # folder_explicit_list = aurora development kisd mailing-lists news pen Sent-Mail uh
+          # folder_blacklist = Inbox All-Mail Drafts Trash 
+          folder_blacklist = All-Mail Trash 
+          [SpamFilter]
+          [KillThreadsFilter]
+          [ListMailsFilter]
+          [ArchiveSentMailsFilter]
+          [InboxFilter]
+        '';
    };
-    maildir.synchronizeFlags = true;
-    extraConfig = {
-      database = {
-        path = "/home/don/Mail";
-        hook_dir = "/home/don/.config/notmuch/hooks";
+    notmuch = {
+      enable = true;
+      new = {
+        tags = ["new" "unread"];
+        ignore = [
+          ".mbsyncstate"
+          ".uidvalidity"
+          ".mbsyncstate.journal"
+          ".mbsyncstate.new"
+          ".mbsyncstate.lock"
+        ];
+      };
+      maildir = {
+        synchronizeFlags = true;
+      };
+      extraConfig = {
+        index = {
+          "header.List" = "List-Id";
+        };
+        database = {
+          path = "/home/don/Mail";
+          hook_dir = "/home/don/.config/notmuch/hooks";
+        };
      };
    };
  };

  xdg.configFile."notmuch/hooks/post-new".source = ./files/notmuch/post-new;
+  # xdg.configFile."notmuch/hooks/post-new".text = ''
+  #   ${pkgs.afew}/bin/afew --tag --all
+  # '';
  xdg.configFile."neomutt/neomuttrc".source = ./files/neomutt/neomuttrc;
  xdg.configFile."neomutt/mailcap".source = ./files/neomutt/mailcap;

--- a/home/common/pass.nix
+++ b/home/common/pass.nix
@ -0,0 +1,41 @@
+{
+  osConfig,
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf;
+  inherit (osConfig) modules;
+
+  sys = modules.system;
+in {
+  config = {
+    programs = {
+      # password-store pass
+      password-store = {
+        enable = true;
+        package = pkgs.pass.withExtensions (exts: [exts.pass-otp exts.pass-audit exts.pass-update exts.pass-import]);
+        settings = {
+          PASSWORD_STORE_KEY = "CCD8E76F07EA701B";
+          PASSWORD_STORE_CLIP_TIME = "30";
+          PASSWORD_STORE_GENERATED_LENGTH = "120";
+          PASSWORD_STORE_CHARACTER_SET = "A-Za-z0-9!@#$%";
+          PASSWORD_STORE_CHARACTER_SET_NO_SYMBOLS = "A-Za-z0-9";
+          PASSWORD_STORE_ENABLE_EXTENSIONS = "true";
+        };
+      };
+    };
+
+    # services = {
+    #   # Enable pass to integrate with the libsecret D-Bus API for password management
+    #   pass-secret-service = {
+    #     enable = true;
+    #   };
+    # };
+
+    #  home.file.".config/pass-git-helper" = {
+    #    source = ./git-pass-mapping;
+    #    recursive = true;
+    #  };
+  };
+}
--- a/home/common/pi-server.nix
+++ b/home/common/pi-server.nix
@ -35,7 +35,16 @@
    ncdu
    nmap
    pinentry-curses
-    pipx
+    # pipx  # FIXME - not building 2026-05-26
+    # See https://github.com/NixOS/nixpkgs/issues/522307
+    (pipx.overridePythonAttrs (old: {
+      disabledTests =
+        (old.disabledTests or [])
+        ++ [
+          "test_fix_package_name"
+          "test_parse_specifier_for_metadata"
+        ];
+    }))
    ps_mem
    psmisc
    tmux
--- a/home/common/topgrade.nix
+++ b/home/common/topgrade.nix
@ -36,6 +36,7 @@
        repos = [
          "~/bin"
          "~/nixos"
+          "~/.password-store"
          "~/src/WWW/sites/donaldharper.com"
          "~/src/WWW/sites/duckland.org"
          "~/.journalot"
--- a/home/gui/default.nix
+++ b/home/gui/default.nix
@ -40,10 +40,11 @@ with lib;
        ibm-plex
        imv
        jellyfin-media-player
+        # kdePackages.kwallet
+        # kdePackages.kwallet-pam
        libappindicator
        libnotify
        libreoffice-fresh
-        # libsForQt5.kwallet # FIXME - issues 2026-05-18
        neovim-qt
        networkmanagerapplet
        nextcloud-client
--- a/home/gui/librewolf.nix
+++ b/home/gui/librewolf.nix
@ -3,9 +3,22 @@
  pkgs,
  ...
 }: {
+
+  # password-store extensions for browsers
+  # you need to install the browser extension for this to work
+  # https://github.com/browserpass/browserpass-extension
+  programs.browserpass = {
+    enable = true;
+    browsers = [
+      # "chrome"
+      # "chromium"
+      "firefox"
+    ];
+  };
  programs.firefox = {
    enable = true;
    # package = pkgs.librewolf;
+    configPath = "${config.xdg.configHome}/mozilla/firefox";
    package = pkgs.firefox.override {
      nativeMessagingHosts = [
        pkgs.tridactyl-native
--- a/home/gui/qutebrowser.nix
+++ b/home/gui/qutebrowser.nix
@ -13,7 +13,9 @@
        ",M" = "spawn --userscript mealie";
        ",N" = "spawn --userscript saveurl";
        ",O" = "spawn --userscript obsidian-import-lite";
+        ",P" = "spawn --userscript qute-pass --password-only";
        ",R" = "spawn --userscript obsidian-import -r";
+        ",T" = "spawn --userscript qute-bitwarden --totp-only";
        ",U" = "spawn --userscript sendurl";
        ",V" = "hint links spawn myweb {hint-url}";
        ",d" = "spawn --userscript open_download";
@ -22,7 +24,7 @@
        ",n" = ''config-cycle content.user_stylesheets /home/don/src/solarized-everything-css/css/mine.css ""'';
        ",o" = "spawn --userscript obsidian-import";
        ",r" = "spawn --userscript recipe";
-        ",t" = "spawn --userscript qute-bitwarden --totp-only";
+        ",t" = "spawn --userscript qute-pass --otp-only";
        ",u" = "spawn --userscript sendphone";
        ",v" = "spawn /home/don/bin/myweb {url}";
        ",w" = "cmd-set-text -s :spawn --userscript taskadd";
@ -107,7 +109,6 @@
      nebula = "https://watchnebula.com/featured";
      netalert = "http://harper:20211/devices.php";
      netflix = "https://www.netflix.com/browse";
-      newrecipe = "https://mealie.trex-halfbeak.ts.net/g/home/r/create/url";
      newrss = "https://rss.trex-halfbeak.ts.net/i/?c=subscription&a=add";
      nix-config = "https://nixos.org/manual/nixos/stable/options.html";
      nix-dev = "https://nix.dev/";
@ -123,8 +124,11 @@
      octoprint = "http://octopi/?#temp";
      orders = "https://www.amazon.com/gp/css/order-history?ref_=nav_orders_first";
      penchalet = "https://www.penchalet.com/";
+      pencultpens = "https://cultpens.com/";
      pendromgooles = "https://www.dromgooles.com/";
      pengoulet = "https://www.gouletpens.com/";
+      penjetpens = "https://www.jetpens.com";
+      penstationerywiki = "https://stationery.wiki/Main_Page";
      photos = "https://photos.trex-halfbeak.ts.net/";
      pi = "http://pihole/admin/";
      pinchflat = "http://harper:8945/";
--- a/home/gui/sway.nix
+++ b/home/gui/sway.nix
@ -5,9 +5,12 @@
  outputs,
  config,
  ...
-} @args: {
+} @args: let
+  _osConfig = if args ? osConfig then args.osConfig else args.config;
+  swayScale = if _osConfig.variables ? swayScale then _osConfig.variables.swayScale else 1;
+in {
  xdg.configFile."sway/config".text = ''
-    # For ${(if args ? osConfig then args.osConfig else args.config).networking.hostName}
+    # For ${_osConfig.networking.hostName}
    set $mod Mod1
    set $terminal_path /home/don/bin/mynewterm
    set $snd_sink alsa_output.usb-Corsair_CORSAIR_VOID_ELITE_Wireless_Gaming_Dongle-00.iec958-stereo
@ -29,7 +32,7 @@
    workspace_auto_back_and_forth yes

    set $laptop eDP-1
-    output $laptop scale ${(if args ? osConfig then args.osConfig else args.config).variables.swayScale}
+    output $laptop scale ${toString swayScale}
    output * bg /home/don/nixos/hosts/fan-table-device-box-wallpaper.jpg fill
    bindswitch --reload --locked lid:on output $laptop disable
    bindswitch --reload --locked lid:off output $laptop enable
@ -307,8 +310,8 @@
    exec_always ${pkgs.shikane}/bin/shikanectl reload
    exec ${pkgs.foot}/bin/foot -W 36x22 -T ttmenu -f "Courier New:size=12" -e ttmenu-loop
    seat * hide_cursor 8000
-    exec ${pkgs.systemd}/bin/systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK
-    exec ${pkgs.dbus}/bin/dbus-update-activation-environment --all 2>/dev/null && dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK
+    # exec ${pkgs.systemd}/bin/systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK
+    # exec ${pkgs.dbus}/bin/dbus-update-activation-environment --all 2>/dev/null && dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK
    exec ${pkgs.udiskie}/bin/udiskie
    exec ${pkgs.wl-clipboard}/bin/wl-paste -t text --watch clipman store
    exec ~/bin/auto-start
@ -321,6 +324,7 @@
    exec ${pkgs.headset-charge-indicator}/bin/headset-charge-indicator.py
    exec ${pkgs.wlsunset}/bin/wlsunset -l 29.7 -L -95.8
    # exec ${pkgs.blueman}/bin/blueman-applet
+    include /etc/sway/config.d/*
  '';

  programs = {
--- a/hosts/ace/default.nix
+++ b/hosts/ace/default.nix
@ -1,17 +1,10 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
+    ../templates/workstation.nix
    inputs.sops-nix.nixosModules.sops
    ./hardware-configuration.nix
-    # ../disko/mmcblk.nix
-    ../workstation
  ];
+
  networking.hostName = "ace";
  variables.swayScale = "0.75";

@ -19,5 +12,5 @@
    gui.enable = true;
    kmscon.enable = true;
  };
-  wm = {sway.enable = true;};
+  wm.sway.enable = true;
 }
--- a/hosts/book/default.nix
+++ b/hosts/book/default.nix
@ -5,12 +5,10 @@
    ./hardware-configuration.nix
  ];

-  # Host-specific configuration
  networking.hostName = "book";
  variables.address = "100.72.121.75";
  variables.swayScale = "1.5";

-  # Enable roles for this host
  roles = {
    gui.enable = true;
    kmscon.enable = true;
--- a/hosts/display/default.nix
+++ b/hosts/display/default.nix
@ -6,7 +6,6 @@
    ./kiosk.nix
  ];

-  # Host-specific configuration
  networking.hostName = "display";
  variables.address = "100.72.208.107";

--- a/hosts/dragon/default.nix
+++ b/hosts/dragon/default.nix
@ -1,17 +1,11 @@
-{
-  inputs,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.framework-amd-ai-300-series
    inputs.nixos-hardware.nixosModules.common-cpu-intel
    inputs.nixos-hardware.nixosModules.common-gpu-intel
    inputs.nixos-hardware.nixosModules.common-pc-laptop
    inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
-    ../workstation
+    ./hardware-configuration.nix
  ];
  networking.hostName = "dragon";
  variables.swayScale = "1.0";
@ -21,5 +15,5 @@
    kmscon.enable = true;
    auto-cpufreq.enable = true;
  };
-  wm = {sway.enable = true;};
+  wm.sway.enable = true;
 }
--- a/hosts/eve/default.nix
+++ b/hosts/eve/default.nix
@ -1,18 +1,11 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
+    ../templates/workstation.nix
    inputs.nixos-hardware.nixosModules.google-pixelbook
    inputs.sops-nix.nixosModules.sops
    ./hardware-configuration.nix
-    # ../disko/mmcblk.nix
-    ../workstation
  ];
+
  networking.hostName = "eve";
  variables.swayScale = "1.5";

@ -22,5 +15,5 @@
    kmscon.enable = true;
    auto-cpufreq.enable = true;
  };
-  wm = {sway.enable = true;};
+  wm.sway.enable = true;
 }
--- a/hosts/fred/default.nix
+++ b/hosts/fred/default.nix
@ -1,31 +1,22 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ../server
    ./docker.nix
-    # ./podman.nix
-    # ../server/unifi.nix
  ];
+
  networking.hostName = "fred";
  variables.address = "100.72.236.170";
-  boot = {
-    binfmt.emulatedSystems = lib.optionals (pkgs.stdenv.hostPlatform.system != "aarch64-linux") [ "aarch64-linux" ];
-    loader = {
-      systemd-boot = {enable = true;};
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot";
-      };
-    };
-  };
+  # boot = {
+  #   binfmt.emulatedSystems = lib.optionals (pkgs.stdenv.hostPlatform.system != "aarch64-linux") [ "aarch64-linux" ];
+  #   loader = {
+  #     systemd-boot = {enable = true;};
+  #     efi = {
+  #       canTouchEfiVariables = true;
+  #       efiSysMountPoint = "/boot";
+  #     };
+  #   };
+  # };

  primary.enable = true;
 }
--- a/hosts/harper/default.nix
+++ b/hosts/harper/default.nix
@ -1,15 +1,7 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ../server
  ];
  networking.hostName = "harper";
  variables.address = "100.72.0.3";
--- a/hosts/harper2/default.nix
+++ b/hosts/harper2/default.nix
@ -1,15 +1,7 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ../server
  ];
  networking.hostName = "harper2";
  variables.address = "100.72.0.4";
--- a/hosts/loki/default.nix
+++ b/hosts/loki/default.nix
@ -5,12 +5,10 @@
    ./hardware-configuration.nix
  ];

-  # Host-specific configuration
  networking.hostName = "loki";
  variables.address = "100.72.0.1";
  variables.swayScale = "1.2";

-  # Enable roles for this host
  roles = {
    citrix.enable = true;
    zoom.enable = true;
--- a/hosts/nuwww/default.nix
+++ b/hosts/nuwww/default.nix
@ -1,15 +1,7 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ../server
  ];
  networking.hostName = "nuwww";
  variables.address = "100.72.2.1";
--- a/hosts/pi1/default.nix
+++ b/hosts/pi1/default.nix
@ -1,13 +1,6 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
    ../pi-server
    ./kiosk.nix
--- a/hosts/pihole/default.nix
+++ b/hosts/pihole/default.nix
@ -1,15 +1,7 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ../server
  ];
  networking.hostName = "pihole";
 }
--- a/hosts/pocket2/default.nix
+++ b/hosts/pocket2/default.nix
@ -1,32 +1,21 @@
-{
-  inputs,
-  outputs,
-  libs,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, libs, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
-    ./hardware-configuration.nix
+    ../templates/workstation.nix
    inputs.nixos-hardware.nixosModules.common-cpu-intel
    inputs.nixos-hardware.nixosModules.common-gpu-intel
    inputs.nixos-hardware.nixosModules.common-pc-laptop
    inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
-    ../workstation
+    ./hardware-configuration.nix
  ];
+
  networking.hostName = "pocket2";
  variables.address = "192.168.1.12";
  variables.swayScale = "1.7";

  roles = {
-    citrix.enable = false;
-    zoom.enable = false;
    gui.enable = true;
    kmscon.enable = true;
-    games.enable = false;
-    auto-cpufreq.enable = false;
    gnome-calendar.enable = true;
  };
-  wm = {sway.enable = true;};
+  wm.sway.enable = true;
 }
--- a/hosts/server/default.nix
+++ b/hosts/server/default.nix
@ -79,6 +79,9 @@ in {
  };

  services = {
+    netbird = {
+      enable = true;
+    };
    pcscd = {enable = true;};
    beszel-agent = {enable = true;};
    avahi = {
--- a/hosts/smaug/default.nix
+++ b/hosts/smaug/default.nix
@ -1,20 +1,13 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
+    ../templates/workstation.nix
    inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x260
    inputs.nixos-hardware.nixosModules.common-pc-laptop
    inputs.nixos-hardware.nixosModules.common-pc-ssd
    inputs.sops-nix.nixosModules.sops
    ./hardware-configuration.nix
-    # ../disko/sda.nix
-    ../workstation
  ];
+
  networking.hostName = "smaug";
  variables.address = "100.72.248.81";
  variables.swayScale = "0.75";
@ -22,8 +15,7 @@
  roles = {
    gui.enable = true;
    kmscon.enable = true;
-    auto-cpufreq.enable = true;
    gnome-calendar.enable = true;
  };
-  wm = {sway.enable = true;};
+  wm.sway.enable = true;
 }
--- a/hosts/templates/pi-server.nix
+++ b/hosts/templates/pi-server.nix
@ -0,0 +1,24 @@
+{ inputs, outputs, lib, config, pkgs, ... }: {
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+    ../server
+    ../systemd-primary.nix
+    ../common/boot.nix
+    ../common/networking.nix
+    ../common/tailscale.nix
+    ../../home/pi-server.nix
+    ../../modules/beszel-agent.nix
+  ];
+
+  config = {
+    # Common server setup
+    nix.settings.trusted-users = ["root" "don"];
+
+    # Server-specific Nix settings
+    nix.gc = {
+      automatic = true;
+      dates = "daily";
+      options = "--delete-older-than 7d";
+    };
+  };
+}
--- a/hosts/templates/server.nix
+++ b/hosts/templates/server.nix
@ -2,10 +2,11 @@
  imports = [
    inputs.sops-nix.nixosModules.sops
    ../server
+    ../systemd-primary.nix
    ../common/boot.nix
    ../common/networking.nix
    ../common/tailscale.nix
-    ../../home/pi-server.nix
+    ../../home
    ../../modules/beszel-agent.nix
  ];

@ -20,4 +21,4 @@
      options = "--delete-older-than 7d";
    };
  };
-}
+}
--- a/hosts/templates/workstation.nix
+++ b/hosts/templates/workstation.nix
@ -3,6 +3,7 @@
    inputs.sops-nix.nixosModules.sops
    ../roles
    ../../modules
+    ../systemd-primary.nix
    ../workstation
    ../common
    ../wm/sway
--- a/hosts/w1/default.nix
+++ b/hosts/w1/default.nix
@ -1,32 +1,25 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ./network.nix
-    ../server
-    ./podman.nix
-    # ../server/searxng.nix
+    ../../modules/headscale.nix
+    # ../../modules/netbird.nix
+    # ./podman.nix
  ];
+
  networking.hostName = "w1";
  variables.address = "100.72.16.240";
-  boot = {
-    initrd = {
-      availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-      kernelModules = ["nvme"];
-    };
-    loader = {
-      grub = {
-        enable = true;
-        device = "/dev/sda";
-        efiSupport = false;
-      };
-    };
-  };
+  # boot = {
+  #   initrd = {
+  #     availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
+  #     kernelModules = ["nvme"];
+  #   };
+  #   loader = {
+  #     grub = {
+  #       enable = true;
+  #       device = "/dev/sda";
+  #       efiSupport = false;
+  #     };
+  #   };
+  # };
 }
--- a/hosts/w2/default.nix
+++ b/hosts/w2/default.nix
@ -1,30 +1,20 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
+{ inputs, outputs, lib, config, pkgs, ... }: {
  imports = [
-    inputs.sops-nix.nixosModules.sops
+    ../templates/server.nix
    ./hardware-configuration.nix
-    ./network.nix
-    ../server
-    # ../server/searxng.nix
  ];
  networking.hostName = "w1";
-  boot = {
-    initrd = {
-      availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-      kernelModules = ["nvme"];
-    };
-    loader = {
-      grub = {
-        enable = true;
-        device = "/dev/sda";
-        efiSupport = false;
-      };
-    };
-  };
+  # boot = {
+  #   initrd = {
+  #     availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
+  #     kernelModules = ["nvme"];
+  #   };
+  #   loader = {
+  #     grub = {
+  #       enable = true;
+  #       device = "/dev/sda";
+  #       efiSupport = false;
+  #     };
+  #   };
+  # };
 }
--- a/hosts/wm/sway/default.nix
+++ b/hosts/wm/sway/default.nix
@ -54,6 +54,10 @@ in {
      wofi
    ];
    services.dbus.enable = true;
+    security.pam.services = {
+      greetd.enableGnomeKeyring = true;
+      swaylock.enableGnomeKeyring = true;
+    };
    programs = {
      sway = {
        enable = true;
--- a/hosts/workstation/default.nix
+++ b/hosts/workstation/default.nix
@ -43,7 +43,6 @@ in {
    ../themes.nix
    ./detect-reboot-needed.nix
    ./kmscon.nix
-    # ./ollama.nix # FIXME
    ./lmstudio.nix
    ./systemd.nix
    ../systemd-primary.nix
@ -160,6 +159,9 @@ in {
  powerManagement.powertop.enable = true;

  services = {
+    netbird = {
+      enable = true;
+    };
    power-profiles-daemon.enable = false;
    avahi = {
      enable = true;
@ -207,7 +209,8 @@ in {
    };
    printing = {
      enable = true;
-      drivers = [pkgs.hplipWithPlugin];
+      # drivers = [pkgs.hplipWithPlugin];
+      drivers = with pkgs; [ gutenprint hplip splix ];
    };
    pulseaudio = {enable = false;};
    tailscale = {enable = true;};
@ -344,6 +347,9 @@ in {
        enable = true;
        pinentryPackage = pkgs.pinentry-curses;
        enableSSHSupport = true;
+        settings = {
+          default-cache-ttl = 604800;
+        };
      };
    };
  };
--- a/hosts/workstation/kmscon.nix
+++ b/hosts/workstation/kmscon.nix
@ -7,27 +7,23 @@ in {
    services = {
      kmscon = {
        enable = true;
-        fonts = [{
-          # name = "Source Code Pro";
-          name = "FiraCode Nerd Font Mono";
-          package = pkgs.nerd-fonts.fira-code;
-        }];
-        extraConfig = ''
-          font-size=18
-          palette=custom
-          palette-black=33, 34, 44
-          palette-cyan=128, 255, 234
-          palette-dark-grey=182, 185, 201
-          palette-green=138, 255, 128
-          palette-dark-grey=65, 69, 88
-          palette-light-grey=98, 103, 132
-          palette-light-green=208, 255, 204
-          palette-light-red=255, 212, 204
-          palette-light-yellow=255, 255, 204
-          palette-red=255, 149, 128
-          palette-white=248, 248, 242
-          palette-yellow=255, 255, 128
-        '';
+        config = {
+        font-name = "FiraCode Nerd Font Mono";
+        font-size=18;
+          # palette=custom
+          # palette-black=33, 34, 44
+          # palette-cyan=128, 255, 234
+          # palette-dark-grey=182, 185, 201
+          # palette-green=138, 255, 128
+          # palette-dark-grey=65, 69, 88
+          # palette-light-grey=98, 103, 132
+          # palette-light-green=208, 255, 204
+          # palette-light-red=255, 212, 204
+          # palette-light-yellow=255, 255, 204
+          # palette-red=255, 149, 128
+          # palette-white=248, 248, 242
+          # palette-yellow=255, 255, 128
+        };
      };
    };
  };
--- a/hosts/www2/default.nix
+++ b/hosts/www2/default.nix
@ -1,11 +1,8 @@
-{
-  inputs,
-  outputs,
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
-  imports = [inputs.sops-nix.nixosModules.sops ./hardware-configuration.nix ../server];
+{ inputs, outputs, lib, config, pkgs, ... }: {
+  imports = [
+    ../templates/server.nix
+    ./hardware-configuration.nix
+  ];
+
  networking.hostName = "www2";
 }
--- a/modules/headscale.nix
+++ b/modules/headscale.nix
@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: with lib; let
+  domain = "head.nb.duckland.net";
+in {
+  services = {
+    headscale = {
+      enable = true;
+      settings = {
+        server_url = "http://head.nb.duckland.net";
+        dns = {
+          base_domain = "nb.duckland.net";
+          nameservers = {
+            global = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
+          };
+        };
+      };
+    };
+  };
+}
--- a/modules/netbird.nix
+++ b/modules/netbird.nix
@ -0,0 +1,28 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  services.netbird.server = {
+    enable = true;
+    domain = "nb.duckland.net";
+    enableNginx = true;
+    dashboard = {
+      enable = false;
+      domain = "nb.duckland.net";
+      enableNginx = true;
+    };
+    management = {
+      enable = true;
+      domain = "nb.duckland.net";
+      enableNginx = true;
+      dnsDomain = "duckland";
+    };
+    signal = {
+      enable = true;
+      domain = "nb.duckland.net";
+      enableNginx = true;
+    };
+  };
+}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -3,10 +3,8 @@ final: prev: {
  zoom-us = prev.zoom-us.overrideAttrs (old: {
    versions.x86_64-linux = "6.3.1.5673";
    src.x86_64-linux = fetchurl {
-      url =
-        "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash =
-        "sha256-e3b31bba6a540ee58d056cccd8107a00f193dec1a327d6a019e22fdda33649cf=";
+      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
+      hash = "sha256-e3b31bba6a540ee58d056cccd8107a00f193dec1a327d6a019e22fdda33649cf=";
    };
  });
 }
--- a/src/linuxx64-25.03.0.66.tar.gz
+++ b/src/linuxx64-25.03.0.66.tar.gz
--- a/src/linuxx64-25.05.0.44.tar.gz
+++ b/src/linuxx64-25.05.0.44.tar.gz
--- a/src/linuxx64-25.08.0.88.tar.gz
+++ b/src/linuxx64-25.08.0.88.tar.gz
Author	SHA1	Message	Date
Don Harper	313b2b4368	upstream changes	2026-06-18 12:18:13 -05:00
Don Harper	564139518b	first pass turning headscale on w1	2026-06-18 12:18:08 -05:00
Don Harper	ea514705e5	add new bash alias	2026-06-17 19:13:08 -05:00
Don Harper	ffbd3b47ae	qutebrowser \| remove quicklink to newrecipe	2026-06-17 19:12:45 -05:00
Don Harper	a462ab691d	added afew for mail tagging	2026-06-17 19:12:00 -05:00
Don Harper	a473ee7fd4	added fresh-editor and nil (Nix LSP)	2026-06-17 19:11:31 -05:00
Don Harper	92be6df8e9	task \| fall back to maildir for neomutt..need more time to figure out notmuch tags	2026-06-14 19:31:08 -05:00
Don Harper	acf478e399	task \| neomutt full with notmuch, back to default mua	2026-06-13 21:09:14 -05:00
Don Harper	b2cdb2f99e	chore \| Update flake.lock	2026-06-12 19:50:25 -05:00
Don Harper	ff0627b327	task \| add template for pi-server.nix	2026-06-12 19:49:20 -05:00
Don Harper	89480b8e75	task \| server - remove call to pi-server	2026-06-12 19:47:12 -05:00
Don Harper	7129cc1fe1	task \| fix pass-store timeout, and re-enable gnome-keyring	2026-06-12 19:46:40 -05:00
Don Harper	882a95d6a7	chore \| kmscon - upstream changes	2026-06-09 23:25:23 -05:00
Don Harper	dbf155e64c	task \| fix cups(?), increase gpg-agent cache timeout	2026-06-09 22:22:26 -05:00
Don Harper	bc0743521f	task \| topgrade - add ~/.password-store to git repos	2026-06-09 22:20:38 -05:00
Don Harper	a30b2d961b	task \| add back systemd-primary	2026-06-08 07:18:28 -05:00
Don Harper	5837e848d2	task \| change gpg/ssh key cache ttl	2026-06-08 07:17:54 -05:00
Don Harper	bd6f6468ee	chore \| rm old citrix	2026-06-02 06:29:03 -05:00
Don Harper	20cad57d2e	task \| add more pen links	2026-06-01 15:22:11 -05:00
Don Harper	075957584b	task \| add password-store	2026-05-30 21:58:11 -05:00
Don Harper	b77aa018ce	task \| add password-store	2026-05-30 21:57:27 -05:00
Don Harper	d7868e166e	task \| add password-store	2026-05-30 21:57:08 -05:00
Don Harper	956c4cd619	task \| add password-store	2026-05-30 21:56:59 -05:00
Don Harper	79c46d8106	task \| format	2026-05-29 14:48:56 -05:00
Don Harper	fabfd31bdf	task \| clean up vars	2026-05-29 14:47:47 -05:00
Don Harper	e97f4e4073	chore \| upstream changes	2026-05-29 14:47:29 -05:00
Don Harper	5499a2add1	chore \| work-around pipx build error	2026-05-29 14:47:08 -05:00
Don Harper	ad980b4938	task \| fixes, comment out pi servers	2026-05-29 14:46:49 -05:00
Don Harper	9f0f4f89c2	task \| update .gitignore	2026-05-28 18:56:34 -05:00
Don Harper	99e8132cac	task \| switch term back to kitty	2026-05-28 18:55:01 -05:00
Don Harper	5ea28f5295	chore \| Update flake.lock	2026-05-28 06:54:41 -05:00
Don Harper	86db24ce8e	chore \| work-around pipx build error	2026-05-28 06:54:25 -05:00
Don Harper	95a234d9b2	tasks \| enable netbird	2026-05-28 06:54:02 -05:00
Don Harper	990c906017	task \| upstream changes	2026-05-26 09:40:09 -05:00
Don Harper	08b78ec881	task \| upstream changes	2026-05-26 09:40:00 -05:00
Don Harper	04350de165	loki \| switch back to aerc	2026-05-26 09:39:40 -05:00
Don Harper	776625028c	task \| cleanup	2026-05-21 07:59:43 -05:00
Don Harper	ce867ad332	task \| reenable elinks as it is good again	2026-05-21 07:59:35 -05:00
Don Harper	cfad023962	chore \| Update flake.lock	2026-05-20 18:36:16 -05:00
Don Harper	4364fb17f1	task sync changes to all <host>/default.nix	2026-05-20 08:04:16 -05:00