chore: update flake.lock

update default kernel version to 6.18
moved home_assistant to x86v1
2026-10-09 20:02:22 -04:00 · 2026-10-06 19:04:37 -04:00 · 2026-10-06 16:43:19 -04:00 · 2026-10-06 13:51:23 -04:00 · 2026-10-06 13:51:23 -04:00 · 2026-10-06 13:51:23 -04:00
97 changed files with 1309 additions and 1663 deletions
@@ -8,8 +8,23 @@ on:
    - cron: "0 22 * * *"

 jobs:
+  prebuild-common:
+    name: prebuild-common-x86-64-v3
+    runs-on: nix-cache-builder
+    steps:
+      - uses: actions/checkout@v4
+      # portal-1 is the smallest system closure: 95% of its derivations are
+      # shared by all five systems, so it is a maintainable common cache seed.
+      # Keep going so one failing package does not stop unrelated cache entries
+      # from being built.
+      - name: Build common packages
+        run: nixos-rebuild build --keep-going --accept-flake-config --flake ./#portal-1
+      - name: Copy common packages to nix-cache
+        run: nix copy --accept-flake-config --to unix:///host-nix/var/nix/daemon-socket/socket .#nixosConfigurations.portal-1.config.system.build.toplevel
+
  build:
    name: build-${{ matrix.system }}
+    needs: prebuild-common
    runs-on: self-hosted
    strategy:
      matrix:
@@ -15,7 +15,6 @@ jobs:
    steps:
      - name: merge_flake_lock_update
        run: >-
-          nix develop .#devShells.x86_64-linux.default -c
          python -m python.gitea_flake_lock merge
          --repo "${{ github.repository }}"
        env:
@@ -1,19 +0,0 @@
-name: pytest
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  pytest:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Run tests
-        run: nix develop .#devShells.x86_64-linux.default -c pytest tests
@@ -21,6 +21,5 @@ jobs:
          JEEVES_BOT_TOKEN: ${{ secrets.JEEVES_BOT_TOKEN }}
          GITEA_URL: https://gitea.tmmworkshop.com
        run: >-
-          nix develop .#devShells.x86_64-linux.default -c
          python -m python.gitea_flake_lock update
          --repo "${{ github.repository }}"
@@ -21,7 +21,7 @@

  boot = {
    tmp.useTmpfs = lib.mkDefault true;
-    kernelPackages = lib.mkDefault pkgs.linuxPackages_6_12;
+    kernelPackages = lib.mkDefault pkgs.linuxPackages_6_18;
  };

  hardware.enableRedistributableFirmware = true;
@@ -2,6 +2,5 @@
 {
  environment.systemPackages = with pkgs; [
    git
-    my_python
  ];
 }
@@ -1,42 +0,0 @@
-{ pkgs, ... }:
-{
-  boot = {
-    kernelPackages = pkgs.linuxPackages_6_18;
-    zfs.package = pkgs.zfs_2_4;
-  };
-
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-
-  # rtkit is optional but recommended for pipewire
-  security.rtkit.enable = true;
-
-  services = {
-    displayManager.sddm = {
-      enable = true;
-      wayland.enable = true;
-    };
-
-    desktopManager.plasma6.enable = true;
-
-    xserver = {
-      enable = true;
-      xkb = {
-        layout = "us";
-        variant = "";
-      };
-    };
-
-    pulseaudio.enable = false;
-
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      wireplumber.enable = true;
-    };
-  };
-}
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./kde.nix
+    ./pipewire.nix
+  ];
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_6_18;
+    zfs.package = pkgs.zfs_2_4;
+  };
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+}
@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [
+    aurorae # theme
+    elisa # music player
+    kate # text editor
+    kconfig # config editor
+    khelpcenter # help center
+    kinfocenter # system info
+    konsole # terminal
+    krdp # remote desktop
+    ktexteditor # thing for kate
+    okular # pdf reader
+    plasma-keyboard # used by plasma-keyboard KCM
+    plasma-sdk # plasma development tools
+    plasma-workspace-wallpapers # wallpapers
+    qrca # qr code scanner
+    qtvirtualkeyboard # virtual keyboard
+    union # theme
+  ];
+
+  # disable KDE PIM (Personal Information Management) applications
+  programs.kde-pim.enable = false;
+
+  services = {
+    # removes screen reader and speech dispatcher from the system
+    orca.enable = false;
+    speechd.enable = false;
+
+    displayManager.sddm = {
+      enable = true;
+      wayland.enable = true;
+    };
+
+    desktopManager.plasma6.enable = true;
+
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "us";
+        variant = "";
+      };
+    };
+  };
+}
@@ -0,0 +1,16 @@
+{
+  # rtkit is optional but recommended for pipewire
+  security.rtkit.enable = true;
+
+  services = {
+    pulseaudio.enable = false;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      wireplumber.enable = true;
+    };
+  };
+}
@@ -0,0 +1,46 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.signal-cli
+  ];
+
+  users = {
+    groups.signal-cli = { };
+    users.signal-cli = {
+      isSystemUser = true;
+      group = "signal-cli";
+      home = "/var/lib/signal-cli";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/signal-cli 0700 signal-cli signal-cli - -"
+    "Z /var/lib/signal-cli - signal-cli signal-cli - -"
+  ];
+
+  systemd.services.signal-cli = {
+    description = "Signal CLI JSON-RPC service";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.RequiresMountsFor = [ "/var/lib/signal-cli" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "signal-cli";
+      Group = "signal-cli";
+      ExecStart = "${pkgs.signal-cli}/bin/signal-cli --data-dir /var/lib/signal-cli daemon --socket /run/signal-cli/socket";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      SuccessExitStatus = 143;
+      RuntimeDirectory = "signal-cli";
+      RuntimeDirectoryMode = "0750";
+      UMask = "0007";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectSystem = "strict";
+      ReadWritePaths = [ "/var/lib/signal-cli" ];
+    };
+  };
+}
@@ -1,7 +1,6 @@
 { pkgs, ... }:
 {
  environment.systemPackages = with pkgs; [
-    mangohud
    steam-run
  ];
  hardware.steam-hardware.enable = true;
@@ -0,0 +1,15 @@
+{
+  nixpkgs = {
+    hostPlatform = {
+      system = "x86_64-linux";
+      gcc = {
+        arch = "x86-64-v3";
+        tune = "generic";
+      };
+    };
+
+    # These patches repair tests and bundled dependencies that are sensitive
+    # to the compiler flags used by the x86-64-v3 package set.
+    overlays = [ (import ./patches) ];
+  };
+}
@@ -0,0 +1,20 @@
+Subject: [PATCH] abseil: include BMI2 intrinsics through the public header
+
+GCC and Clang reject direct inclusion of bmi2intrin.h. Include immintrin.h
+instead so that the compiler supplies the required intrinsic setup when
+BMI2 is enabled, including builds targeting x86-64-v3.
+
+This patch is shared by the vendored Abseil copies in Electron, rusty_v8
+(Deno), and Signal's WebRTC build.
+
+--- a/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
+++ b/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
+@@ -226,7 +226,7 @@
+ #endif
+ 
+ #ifdef __BMI2__
+-#include <bmi2intrin.h>
+#include <immintrin.h>
+ #endif  // __BMI2__
+ 
+ namespace absl {
@@ -0,0 +1,38 @@
+# Abseil accepted the upstream fix: https://github.com/abseil/abseil-cpp/pull/2071
+# Keep this workaround until Electron, Deno's rusty_v8, and Signal's WebRTC
+# update their bundled Abseil copies to include it.
+{ prev }:
+let
+  patchAbseilBmi2Include =
+    package:
+    package.overrideAttrs (old: {
+      # GCC and Clang require the public umbrella header for BMI2 intrinsics.
+      patches = (old.patches or [ ]) ++ [ ./bmi2-public-header.patch ];
+    });
+
+  electron43Unwrapped = patchAbseilBmi2Include prev.electron_43.unwrapped;
+  electron43 = prev.electron_43.override {
+    electron-unwrapped = electron43Unwrapped;
+  };
+
+  signalCallPackage =
+    path: args:
+    let
+      package = prev.callPackage path args;
+    in
+    if builtins.baseNameOf path == "webrtc.nix" then patchAbseilBmi2Include package else package;
+in
+prev.lib.optionalAttrs ((prev.stdenv.hostPlatform.gcc.arch or null) == "x86-64-v3") {
+  deno =
+    let
+      librusty_v8 = patchAbseilBmi2Include prev.deno.passthru.librusty_v8;
+    in
+    prev.deno.override { inherit librusty_v8; };
+
+  electron_43 = electron43;
+
+  signal-desktop = prev.signal-desktop.override {
+    electron_43 = electron43;
+    callPackage = signalCallPackage;
+  };
+}
@@ -0,0 +1,19 @@
+Subject: [PATCH] Compare font content in the overlap-removal regression
+
+PFA_SKIP ends with a separator, producing an empty prefix that matches every
+line. Remove the empty prefix for this test so glyph differences are checked,
+and assert that tx exits successfully before inspecting the output.
+
+--- a/tests/tx_test.py
+++ b/tests/tx_test.py
+@@ -1064,6 +1064,8 @@
+     output_path = get_temp_file_path()
+     args = [TOOL, '-t1', '+V', '-o', output_path, input_path]
+-    subprocess.call(args)
+-    assert differ([expected_path, output_path, '-s', PFA_SKIP[0]])
+    subprocess.check_call(args)
+    # An empty skip prefix matches every line and hides font differences.
+    skip_headers = SPLIT_MARKER.join(filter(None, PFA_SKIP[0].split(SPLIT_MARKER)))
+    assert differ([expected_path, output_path, '-s', skip_headers])
+ 
+ 
@@ -0,0 +1,10 @@
+{ afdko }:
+afdko.overridePythonAttrs (old: {
+  # FMA changes overlap-removal coordinates by 0.01 units on x86-64-v3.
+  # Separate multiply/add rounding reproduces the reference Type 1 font exactly.
+  env = (old.env or { }) // {
+    NIX_CFLAGS_COMPILE = (old.env.NIX_CFLAGS_COMPILE or "") + " -ffp-contract=off";
+  };
+
+  patches = (old.patches or [ ]) ++ [ ./check-overlap-font-content.patch ];
+})
@@ -0,0 +1,16 @@
+_final: prev:
+(import ./abseil { inherit prev; })
+// {
+  gnutls = import ./gnutls { inherit (prev) gnutls; };
+  prometheus = import ./prometheus { inherit (prev) prometheus; };
+  zopfli = import ./zopfli { inherit (prev) zopfli; };
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pythonFinal: pythonPrev: {
+      afdko = import ./afdko { inherit (pythonPrev) afdko; };
+      psutil = import ./psutil { inherit (pythonPrev) psutil; };
+      pytest-xdist = import ./pytest-xdist { inherit (pythonPrev) pytest-xdist; };
+      scipy = import ./scipy { inherit (pythonPrev) scipy; };
+    })
+  ];
+}
@@ -0,0 +1,6 @@
+{ gnutls }:
+gnutls.overrideAttrs (old: {
+  # Keep the UDP handshake test enabled on loaded builders by waiting for
+  # the server to bind its socket. Kept as a standalone patch for upstream.
+  patches = (old.patches or [ ]) ++ [ ./udp-server-readiness.patch ];
+})
@@ -0,0 +1,70 @@
+Subject: [PATCH] tests: wait for the UDP server socket before connecting
+
+A fixed four-second sleep does not guarantee that gnutls-serv has bound
+its UDP socket on a busy builder. Poll the local IPv4 UDP endpoint using
+the existing ss/netstat discovery, with the same retry budget as the TCP
+helper. Fail early if the server exits, and retain the original handshake
+checks in serv-udp.sh.
+
+Use flags common to ss and BSD/Linux netstat. Match the local endpoint
+and complete port number, excluding TCP, IPv6-only and peer endpoints.
+
+--- a/tests/scripts/common.sh
+++ b/tests/scripts/common.sh
+@@ -185,10 +185,55 @@
+ 	fi
+ }
+ 
+check_if_udp_port_bound() {
+	local PORT=$1
+	have_port_finder
+	# Use only -an, which is shared by ss and BSD/Linux netstat. UDP has
+	# no LISTEN state. Match the local IPv4 endpoint, not a peer port or
+	# a longer port number. serv-udp.sh connects to 127.0.0.1;
+	# listen_socket() in serv.c binds IPv4 separately and requests
+	# IPV6_V6ONLY=1 for its IPv6 socket.
+	$PFCMD -an | awk -v port="$PORT" '
+		$1 == "udp" || $1 == "udp4" {
+			# ss includes a state column; netstat does not.
+			address = ($2 == "UNCONN" || $2 == "ESTAB") ? $5 : $4
+			if (address ~ ("^[0-9.]+[.:]" port "$") ||
+			    address == "*." port)
+				found = 1
+		}
+		END { exit !found }
+	'
+}
+
+ wait_udp_server() {
+ 	local PID=$1
+	local ret
+ 	trap "test -n \"${PID}\" && kill ${PID};exit 1" 1 15 2
+-	sleep 4
+	local i=0
+	# Use the same retry budget as wait_for_port(), but also stop if the
+	# server exits before binding its socket.
+	while test $i -lt 90; do
+		if ! kill -0 "$PID" 2>/dev/null; then
+			fail "" "UDP server $PID exited before binding port $PORT"
+		fi
+		# Contain have_port_finder's exit so a skip also stops the server.
+		if (check_if_udp_port_bound "$PORT"); then
+			return 0
+		else
+			ret=$?
+			if test "$ret" = 77; then
+				kill "$PID" 2>/dev/null || :
+				wait "$PID" 2>/dev/null || :
+				exit 77
+			fi
+		fi
+		i=$((i + 1))
+		if test $i -lt 90; then
+			echo "try $i: waiting for UDP port $PORT"
+			sleep 2
+		fi
+	done
+	fail "$PID" "UDP server $PORT did not come up"
+ }
+ 
+ create_testdir() {
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Exercise patched common.sh without building GnuTLS (Python standard library only).
+
+Usage: python3 verify-readiness.py /path/to/patched/tests/scripts/common.sh
+Set SHELL to test another shell, and NETSTAT to test a netstat outside PATH.
+"""
+
+# Use unittest so this upstream companion tool needs no pytest installation.
+# ruff: noqa: PT009
+
+import os
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+
+COMMON = str(Path(sys.argv.pop(1)).resolve())
+SHELL = os.environ.get("SHELL", "/bin/sh")
+
+
+class ReadinessTests(unittest.TestCase):
+    """Check endpoint parsing and the server startup lifecycle."""
+
+    def setUp(self) -> None:
+        """Create a socket-listing fixture for each check."""
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.fixture = self.root / "sockets"
+        self.fixture.write_text("")
+        self.finder = self.root / "port-finder"
+        self.finder.write_text('#!/bin/sh\ncat "$SOCKET_FIXTURE"\n')
+        self.finder.chmod(0o755)
+
+    def run_shell(self, body: str, **env: str) -> subprocess.CompletedProcess[str]:
+        """Source the actual helper and run a shell scenario."""
+        return subprocess.run(
+            [SHELL, "-c", '. "$COMMON"\n' + body],
+            env={
+                **os.environ,
+                "COMMON": COMMON,
+                "SOCKET_FIXTURE": str(self.fixture),
+                "PFCMD": str(self.finder),
+                "PORT": "12345",
+                **env,
+            },
+            capture_output=True,
+            text=True,
+            timeout=20,
+            check=False,
+        )
+
+    def test_socket_formats_and_false_matches(self) -> None:
+        """Accept IPv4 UDP local endpoints and reject unrelated sockets."""
+        cases = [
+            ("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*", True),
+            ("udp UNCONN 0 0 127.0.0.1:12345 0.0.0.0:*", True),
+            ("udp 0 0 0.0.0.0:12345 0.0.0.0:*", True),
+            ("udp4 0 0 *.12345 *.*", True),
+            ("udp 0 0 127.0.0.1.12345 *.*", True),
+            ("udp 0 0 *.12345 *.*", True),
+            ("udp UNCONN 0 0 0.0.0.0:123456 0.0.0.0:*", False),
+            ("udp 0 0 0.0.0.0:123456 0.0.0.0:*", False),
+            ("udp ESTAB 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
+            ("udp 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
+            ("tcp LISTEN 0 128 0.0.0.0:12345 0.0.0.0:*", False),
+            ("tcp 0 0 0.0.0.0:12345 0.0.0.0:* LISTEN", False),
+            ("udp UNCONN 0 0 [::]:12345 [::]:*", False),
+            ("udp UNCONN 0 0 *:12345 *:*", False),
+            ("udp6 0 0 :::12345 :::*", False),
+            ("udp6 0 0 *.12345 *.*", False),
+            ("", False),
+        ]
+        for row, ready in cases:
+            with self.subTest(row=row):
+                self.fixture.write_text(row + "\n")
+                result = self.run_shell('check_if_udp_port_bound "$PORT"')
+                self.assertEqual(result.returncode, 0 if ready else 1, result.stderr)
+
+    def test_exited_server_fails_immediately(self) -> None:
+        """Fail without sleeping when the server has already exited."""
+        result = self.run_shell(
+            'true &\npid=$!\nwait "$pid"\nsleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$pid"'
+        )
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("exited before binding", result.stderr)
+        self.assertNotIn("unexpected sleep", result.stderr)
+
+    def test_ready_socket_does_not_sleep(self) -> None:
+        """Check readiness before the first sleep."""
+        self.fixture.write_text("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*\n")
+        result = self.run_shell('sleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$$"')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertNotIn("unexpected sleep", result.stderr)
+
+    def test_missing_port_finders_skip(self) -> None:
+        """Skip and stop the live server when no finder is available."""
+        # have_port_finder also tries these paths independently of PATH.
+        if any(os.access(f"{directory}/ss", os.X_OK) for directory in ("/sbin", "/usr/sbin", "/usr/local/sbin")):
+            self.skipTest("an absolute ss path cannot be hidden by this PATH-only fixture")
+        with subprocess.Popen(["sleep", "60"]) as server:
+            try:
+                result = self.run_shell(
+                    'unset PFCMD\nPATH=/nonexistent\nwait_udp_server "$SERVER_PID"',
+                    SERVER_PID=str(server.pid),
+                )
+                self.assertEqual(result.returncode, 77)
+                self.assertIn("neither ss nor netstat found", result.stderr)
+                server.wait(timeout=3)
+                self.assertLess(server.returncode, 0)
+            finally:
+                if server.poll() is None:
+                    server.kill()
+
+    def test_timeout_is_bounded_and_cleans_up(self) -> None:
+        """Stop polling after the retry budget and terminate the server."""
+        # Only accelerate the polling delay; keep a real live server process.
+        self.finder.write_text('#!/bin/sh\necho probe >&2\ncat "$SOCKET_FIXTURE"\n')
+        with subprocess.Popen(["sleep", "60"]) as server:
+            try:
+                result = self.run_shell(
+                    'sleep() { echo polling-sleep; }\nwait_udp_server "$SERVER_PID"',
+                    SERVER_PID=str(server.pid),
+                )
+                self.assertEqual(result.returncode, 1)
+                self.assertIn("did not come up", result.stderr)
+                self.assertEqual(result.stderr.count("probe\n"), 90)
+                self.assertEqual(result.stdout.count("polling-sleep"), 89)
+                server.wait(timeout=3)
+                self.assertLess(server.returncode, 0)
+            finally:
+                if server.poll() is None:
+                    server.kill()
+
+    def test_server_exits_while_waiting(self) -> None:
+        """Detect a startup failure that happens after polling begins."""
+        result = self.run_shell('sleep 1 &\npid=$!\nwait_udp_server "$pid"')
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("exited before binding", result.stderr)
+        self.assertIn("waiting for UDP port", result.stdout)
+
+    def test_real_socket_delayed_beyond_four_seconds(self) -> None:
+        """Wait for a real delayed bind with each installed port finder."""
+        finders = [shutil.which("ss"), os.environ.get("NETSTAT") or shutil.which("netstat")]
+        finders = [finder for finder in finders if finder]
+        if not finders:
+            self.skipTest("neither ss nor netstat available")
+        for finder in finders:
+            with self.subTest(finder=finder):
+                with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+                    sock.bind(("127.0.0.1", 0))
+                    port = sock.getsockname()[1]
+                code = (
+                    "import socket,time,sys; time.sleep(6); "
+                    "s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); "
+                    "s.bind(('127.0.0.1',int(sys.argv[1]))); time.sleep(30)"
+                )
+                with subprocess.Popen([sys.executable, "-c", code, str(port)]) as server:
+                    try:
+                        started = time.monotonic()
+                        result = self.run_shell(
+                            'wait_udp_server "$SERVER_PID"',
+                            SERVER_PID=str(server.pid),
+                            PORT=str(port),
+                            PFCMD=finder,
+                        )
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertGreaterEqual(time.monotonic() - started, 6)
+                        self.assertIsNone(server.poll())
+                    finally:
+                        server.terminate()
+                        server.wait(timeout=3)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,36 @@
+Subject: [PATCH] tests: finish parsing before inspecting editor state
+
+EditorState creation has a 20 ms parsing budget. A descheduled test can
+therefore observe an incomplete tree. Finish these small test documents
+without an interactive deadline and publish the result with a transaction.
+Keep the original completion and vector-matching assertions enabled.
+
+--- a/module/codemirror-promql/src/test/utils-test.ts
+++ b/module/codemirror-promql/src/test/utils-test.ts
+@@ -13,7 +13,7 @@
+ 
+ import { parser } from '@prometheus-io/lezer-promql';
+ import { EditorState } from '@codemirror/state';
+-import { LRLanguage } from '@codemirror/language';
+import { ensureSyntaxTree, LRLanguage } from '@codemirror/language';
+ import nock from 'nock';
+ import path from 'path';
+ import { fileURLToPath } from 'url';
+@@ -23,10 +23,16 @@
+ const __dirname = path.dirname(fileURLToPath(import.meta.url));
+ 
+ export function createEditorState(expr: string): EditorState {
+-  return EditorState.create({
+  const state = EditorState.create({
+     doc: expr,
+     extensions: lightPromQLSyntax,
+   });
+  // These tests need a complete tree, independent of the editor's time budget.
+  if (!ensureSyntaxTree(state, state.doc.length, Infinity)) {
+    throw new Error('Unable to parse the test expression');
+  }
+  // Publish the completed parse so syntaxTree(state) sees it too.
+  return state.update({}).state;
+ }
+ 
+ export function mockPrometheusServer(): void {
@@ -0,0 +1,17 @@
+{ prometheus }:
+prometheus.overrideAttrs (
+  old:
+  let
+    assets = old.passthru.assets.overrideAttrs (assetsOld: {
+      patches = (assetsOld.patches or [ ]) ++ [ ./complete-test-parsing.patch ];
+    });
+  in
+  {
+    postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
+      builtins.unsafeDiscardStringContext old.postPatch
+    );
+    passthru = old.passthru // {
+      inherit assets;
+    };
+  }
+)
@@ -0,0 +1,4 @@
+{ psutil }:
+psutil.overridePythonAttrs (old: {
+  patches = (old.patches or [ ]) ++ [ ./heap-info-zero-mmap.patch ];
+})
@@ -0,0 +1,17 @@
+Subject: [PATCH] Allow an empty mmap allocation total in heap_info
+
+The allocator may satisfy all live allocations from the heap. A zero
+mmap_used value is valid and depends on the worker allocation history.
+Keep the heap and platform checks without requiring an mmap allocation.
+
+--- a/tests/test_system.py
+++ b/tests/test_system.py
+@@ -267,6 +267,7 @@
+         if MACOS:
+             assert m.mmap_used == 0  # not supported
+         else:
+-            assert m.mmap_used > 0
+            # A process can have no live mmap-backed malloc allocations.
+            assert m.mmap_used >= 0
+         if WINDOWS:
+             assert m.heap_count >= 0
@@ -0,0 +1,29 @@
+Subject: [PATCH] tests: count replacements when checking the worker restart limit
+
+With two workers, another in-flight test may crash after the fourth
+crash requests shutdown. Either four or five failed tests is valid.
+Require exactly three replacements and the failed-tests exit status,
+while preserving the queued-work and no-internal-error assertions.
+
+--- a/testing/acceptance_test.py
+++ b/testing/acceptance_test.py
+@@ -1011,9 +1011,18 @@
+                 "worker*crashed while running*",
+                 "worker*crashed while running*",
+                 "* xdist: maximum crashed workers reached: 3 *",
+-                "* 4 failed in *",
+             ]
+         )
+        # A second in-flight test may crash after shutdown is requested.
+        # The restart limit constrains replacements, not concurrent failures.
+        replacements = sum(
+            line.startswith("replacing crashed worker ") for line in res.stdout.lines
+        )
+        assert replacements == 3
+        failed = res.parseoutcomes()["failed"]
+        assert failed in (4, 5)
+        res.assert_outcomes(failed=failed)
+        assert res.ret == pytest.ExitCode.TESTS_FAILED
+         assert "INTERNALERROR" not in res.stdout.str()
+ 
+     def test_max_worker_restart_die(self, pytester: pytest.Pytester) -> None:
@@ -0,0 +1,12 @@
+{ pytest-xdist }:
+pytest-xdist.overridePythonAttrs (old: {
+  patches = (old.patches or [ ]) ++ [
+    ./concurrent-worker-crashes.patch
+    ./worker-startup-timeout.patch
+  ];
+
+  # The suite exercises its own worker pools. Limit the outer suite to one worker.
+  preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
+    old.preCheck or ""
+  );
+})
@@ -0,0 +1,19 @@
+Subject: [PATCH] tests: allow more time for remote worker events
+
+Worker startup can exceed ten seconds on heavily loaded builders. Allow
+the remote-test helper to wait up to sixty seconds for worker events.
+The wait still returns as soon as an event arrives and remains bounded.
+Production worker timeouts and test assertions are unchanged.
+
+--- a/testing/test_remote.py
+++ b/testing/test_remote.py
+@@ -17,7 +17,8 @@
+ from xdist.workermanage import WorkerController
+ 
+ 
+-WAIT_TIMEOUT = 10.0
+# Allow worker events extra time on heavily loaded builders.
+WAIT_TIMEOUT = 60.0
+ 
+ 
+ def check_marshallable(d: object) -> None:
@@ -0,0 +1,5 @@
+{ scipy }:
+scipy.overridePythonAttrs (old: {
+  # Keep the STFT tests enabled with tolerances for x86-64-v3 rounding.
+  patches = (old.patches or [ ]) ++ [ ./stft-test-tolerances.patch ];
+})
@@ -0,0 +1,51 @@
+Subject: [PATCH] signal: allow floating-point rounding in STFT tests
+
+Keep the STFT tests enabled for x86-64-v3 builds. Allow two float32
+epsilons of relative error when comparing inverse-STFT implementations;
+float64 and the existing i686 override remain unchanged. Allow one
+float64 epsilon of absolute error in all three scaling round trips,
+which otherwise require exact zeros (observed residual: 4e-17 for a
+signal with amplitude 2).
+
+Upstream issue: https://github.com/scipy/scipy/issues/25488
+
+--- a/scipy/signal/tests/_scipy_spectral_test_shim.py
+++ b/scipy/signal/tests/_scipy_spectral_test_shim.py
+@@ -294,7 +294,7 @@
+ 
+     # Adapted tolerances to account for resolution loss:
+     atol = np.finfo(x.dtype).resolution*2  # instead of default atol = 0
+-    rtol = 1e-7  # default for np.allclose()
+    rtol = max(1e-7, 2 * np.finfo(x.dtype).eps)
+ 
+     # Relax atol on 32-Bit platforms a bit to pass CI tests.
+     #  - Not clear why there are discrepancies (in the FFT maybe?)
+--- a/scipy/signal/tests/test_spectral.py
+++ b/scipy/signal/tests/test_spectral.py
+@@ -2044,7 +2044,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zs, boundary=True, scaling='spectrum')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+         # For a Hann-windowed 256 sample length FFT, we expect a peak at
+         # frequency 64 (since it is 1/4 the length of X) with a height of 1
+@@ -2074,7 +2074,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zp, input_onesided=False, boundary=True, scaling='psd')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+         # The power of the one-sided psd-scaled STFT can be determined
+         # analogously (note that the two sides are not of equal shape):
+@@ -2094,7 +2094,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zp0, input_onesided=True, boundary=True, scaling='psd')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+ 
+ class TestSampledSpectralRepresentations:
@@ -0,0 +1,4 @@
+{ zopfli }:
+zopfli.overrideAttrs (old: {
+  patches = (old.patches or [ ]) ++ [ ./unaligned-match-loads.patch ];
+})
@@ -0,0 +1,32 @@
+Subject: [PATCH] Read unaligned match buffers with memcpy
+
+Byte buffers need not satisfy integer alignment or aliasing requirements.
+GCC 16 with x86-64-v3 vectorizes the cast loads using aligned AVX reads,
+causing a segmentation fault. Copy into local integers instead.
+
+--- a/src/zopfli/lz77.c
+++ b/src/zopfli/lz77.c
+@@ -302,13 +302,20 @@
+   if (sizeof(size_t) == 8) {
+     /* 8 checks at once per array bounds check (size_t is 64-bit). */
+-    while (scan < safe_end && *((size_t*)scan) == *((size_t*)match)) {
+    while (scan < safe_end) {
+      size_t scan_word, match_word;
+      memcpy(&scan_word, scan, sizeof(scan_word));
+      memcpy(&match_word, match, sizeof(match_word));
+      if (scan_word != match_word) break;
+       scan += 8;
+       match += 8;
+     }
+   } else if (sizeof(unsigned int) == 4) {
+     /* 4 checks at once per array bounds check (unsigned int is 32-bit). */
+-    while (scan < safe_end
+-        && *((unsigned int*)scan) == *((unsigned int*)match)) {
+    while (scan < safe_end) {
+      unsigned int scan_word, match_word;
+      memcpy(&scan_word, scan, sizeof(scan_word));
+      memcpy(&match_word, match, sizeof(match_word));
+      if (scan_word != match_word) break;
+       scan += 4;
+       match += 4;
+     }
@@ -1,4 +1,5 @@
 {
+  inputs,
  pkgs,
  lib,
  config,
@@ -6,6 +7,7 @@
 }:
 let
  cfg = config.services.snapshot_manager;
+  snapshotManagerPackages = ps: with ps; [ typer ];
 in
 {
  options = {
@@ -34,6 +36,41 @@ in
  };

  config = lib.mkIf cfg.enable {
+    nixpkgs.overlays = [
+      (final: _prev: {
+        snapshot_manager_python = final.python314.withPackages snapshotManagerPackages;
+        snapshot_manager_test_python = final.python314.withPackages (
+          ps:
+          snapshotManagerPackages ps
+          ++ (with ps; [
+            pyfakefs
+            pytest
+            pytest-asyncio
+            pytest-mock
+            pytest-xdist
+          ])
+        );
+        snapshot_manager_tests =
+          final.runCommand "snapshot-manager-tests"
+            {
+              nativeBuildInputs = [ final.snapshot_manager_test_python ];
+            }
+            ''
+              export HOME="$TMPDIR"
+              cd ${inputs.self}
+              pytest \
+                -o cache_dir="$TMPDIR/pytest-cache" \
+                tests/test_common.py \
+                tests/test_signal_alert.py \
+                tests/test_snapshot_manager.py \
+                tests/test_zfs.py
+              touch "$out"
+            '';
+      })
+    ];
+
+    system.checks = [ pkgs.snapshot_manager_tests ];
+
    systemd = {
      services.snapshot_manager = {
        description = "ZFS Snapshot Manager";
@@ -45,7 +82,7 @@ in
        };
        serviceConfig = {
          Type = "oneshot";
-          ExecStart = "${pkgs.my_python}/bin/python -m python.tools.snapshot_manager ${lib.escapeShellArg cfg.path}";
+          ExecStart = "${pkgs.snapshot_manager_python}/bin/python -m python.tools.snapshot_manager ${lib.escapeShellArg cfg.path}";
        }
        // lib.optionalAttrs (cfg.EnvironmentFile != null) {
          EnvironmentFile = cfg.EnvironmentFile;
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1789770686,
+        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
        "type": "github"
      },
      "original": {
@@ -20,26 +20,22 @@
        "type": "github"
      }
    },
-    "firefox-addons": {
+    "flake-utils": {
      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "systems": "systems"
      },
      "locked": {
-        "dir": "pkgs/firefox-addons",
-        "lastModified": 1788840136,
-        "narHash": "sha256-ej5jnQIfjbw4wwPzy8Y4ntG9F3asdF6YBkLqpYeGUxc=",
-        "owner": "rycee",
-        "repo": "nur-expressions",
-        "rev": "555b23e68256c5abfb8a85a385231830d1d7ad1f",
-        "type": "gitlab"
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
      },
      "original": {
-        "dir": "pkgs/firefox-addons",
-        "owner": "rycee",
-        "repo": "nur-expressions",
-        "type": "gitlab"
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
      }
    },
    "home-manager": {
@@ -49,11 +45,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788651960,
-        "narHash": "sha256-v9wJd32eZ2bvhBzVOd7TIjLQd011P7nwOhjKtWlci5I=",
+        "lastModified": 1791569574,
+        "narHash": "sha256-5sViLmjhTCtBTvhjSXXvd5LDrAFMydFFKZQisjE8Vds=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2c0350c759688177331b8f5242311fae8877bdb3",
+        "rev": "6b88c12cc6d234de4888f5d21076fb11199d0844",
        "type": "github"
      },
      "original": {
@@ -62,16 +58,38 @@
        "type": "github"
      }
    },
+    "jellyswarrm": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1791408935,
+        "narHash": "sha256-KBTqa8MARN8rBUaEAmcfWos4vEtJhG5l/Zy+FvvLkMY=",
+        "owner": "LLukas22",
+        "repo": "Jellyswarrm",
+        "rev": "c38a7da6ee8bbbdc9e8a4fa994435ca967387c86",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LLukas22",
+        "repo": "Jellyswarrm",
+        "type": "github"
+      }
+    },
    "nixos-hardware": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1788860136,
-        "narHash": "sha256-MhPMOFV4pVkygWEbQ8t1De/uQ9cWF1u++tRe2L5tG48=",
+        "lastModified": 1791373788,
+        "narHash": "sha256-c3oMt0QoE+4yiRk6u1m2L9ogjaUw0uTGn9yk808KkgE=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "62173785b9a18c78b4a15aca2623d02bceb9d077",
+        "rev": "4bc63156b109ee7b4103e3ec30565c8c92bde435",
        "type": "github"
      },
      "original": {
@@ -83,11 +101,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -96,11 +114,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1788892992,
-        "narHash": "sha256-cIMFh9gyU4/aLeB3JCcsWM3tTAvD9pAq9Smr1Wa8aIU=",
+        "lastModified": 1791589578,
+        "narHash": "sha256-1QTfBXQpu9+xvwr9ljd0RShNmImFDGzgfFPxlnuXtS0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "dff6994123e257ec9901c271bc2b52e64d7c8f05",
+        "rev": "d4d44dc89bfa01e1f837eff0ca1d04255742273c",
        "type": "github"
      },
      "original": {
@@ -128,11 +146,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1788752844,
-        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
+        "lastModified": 1791456040,
+        "narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
+        "rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
        "type": "github"
      },
      "original": {
@@ -145,14 +163,35 @@
    "root": {
      "inputs": {
        "disko": "disko",
-        "firefox-addons": "firefox-addons",
        "home-manager": "home-manager",
+        "jellyswarrm": "jellyswarrm",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-master": "nixpkgs-master",
        "nixpkgs-stable": "nixpkgs-stable",
        "sops-nix": "sops-nix",
-        "systems": "systems"
+        "systems": "systems_2"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "jellyswarrm",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779419951,
+        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    },
    "sops-nix": {
@@ -162,11 +201,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788337237,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "lastModified": 1791103873,
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
        "type": "github"
      },
      "original": {
@@ -176,6 +215,21 @@
      }
    },
    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
      "locked": {
        "lastModified": 1689347949,
        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -21,13 +21,13 @@

    nixos-hardware.url = "github:nixos/nixos-hardware/master";

-    home-manager = {
-      url = "github:nix-community/home-manager";
+    jellyswarrm = {
+      url = "github:LLukas22/Jellyswarrm";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    firefox-addons = {
-      url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
+    home-manager = {
+      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -1,13 +1,13 @@
 { inputs, ... }:
 {
-  # When applied, the stable nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.stable'
+  # Additional package sets are accessible through `pkgs.<name>`.
  stable = final: _prev: {
    stable = import inputs.nixpkgs-stable {
      system = final.stdenv.hostPlatform.system;
      config.allowUnfree = true;
    };
  };
-  # When applied, the master nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.master'
+
  master = final: _prev: {
    master = import inputs.nixpkgs-master {
      system = final.stdenv.hostPlatform.system;
@@ -15,34 +15,12 @@
    };
  };

-  python-env = final: _prev: {
-    my_python = final.python314.withPackages (
-      ps: with ps; [
-        alembic
-        apprise
-        fastapi
-        fastapi-cli
-        httpx
-        jinja2
-        mypy
-        pgvector
-        psycopg
-        pydantic
-        pyfakefs
-        pytest
-        pytest-cov
-        pytest-mock
-        pytest-xdist
-        python-multipart
-        pydantic-settings
-        ruff
-        sqlalchemy
-        tenacity
-        tinytuya
-        typer
-        uvicorn
-        websockets
-      ]
-    );
+  # Baseline x86-64 (v1) packages for prebuilt applications that should not
+  # inherit an x86-64-v3 host platform.
+  x86-v1 = final: _prev: {
+    x86-v1 = import inputs.nixpkgs {
+      system = final.stdenv.hostPlatform.system;
+      config.allowUnfree = true;
+    };
  };
 }
@@ -6,49 +6,6 @@ authors = [{ name = "Richie Cahill", email = "richie@tmmworkshop.com" }]
 requires-python = "~=3.14.0"
 readme = "README.md"
 license = "MIT"
-# these dependencies are a best effort and aren't guaranteed to work
-# for up-to-date dependencies, see overlays/default.nix
-dependencies = [
-    "alembic",
-    "apprise",
-    "beautifulsoup4",
-    "bm25s",
-    "ebooklib",
-    "fastapi",
-    "fastapi-cli",
-    "httpx",
-    "jinja2",
-    "pgvector",
-    "psycopg[binary]",
-    "pydantic",
-    "pydantic-settings",
-    "python-multipart",
-    "sqlalchemy[asyncio]",
-    "tenacity",
-    "tiktoken",
-    "tinytuya",
-    "typer",
-    "uvicorn",
-    "websockets",
-    "yake",
-]
-
-[project.scripts]
-database = "python.database_cli:app"
-whisper-transcribe = "python.tools.whisper.transcribe:main"
-
-[dependency-groups]
-dev = [
-    "aiosqlite",
-    "mypy",
-    "pyfakefs",
-    "pytest-asyncio",
-    "pytest-cov",
-    "pytest-mock",
-    "pytest-xdist",
-    "pytest",
-    "ruff",
-]

 [tool.ruff]

@@ -1,77 +0,0 @@
-# Ebook Search Docker
-
-Run the EPUB search app against the existing Postgres database on `jeeves`:
-
-```sh
-python -m python.ebook_search.docker.containers start --library-path /path/to/epubs --build
-```
-
-All ebook-search Docker files live in this directory:
-
- `Dockerfile` — multi-stage: `test` (runs pytest) and `runtime` (default target, the app image)
- `docker-compose.yml`
- `containers.py` — Typer lifecycle CLI
- `pyproject.toml` / `uv.lock` — the container's uv-locked dependencies
-
-The app listens on `http://localhost:8070`.
-
-Useful lifecycle commands:
-
-```sh
-python -m python.ebook_search.docker.containers build
-python -m python.ebook_search.docker.containers start --library-path /path/to/epubs
-python -m python.ebook_search.docker.containers test
-python -m python.ebook_search.docker.containers logs
-python -m python.ebook_search.docker.containers ps
-python -m python.ebook_search.docker.containers stop
-```
-
-Direct compose usage from the repo root:
-
-```sh
-docker compose -f python/ebook_search/docker/docker-compose.yml ps
-```
-
-## Dependencies
-
-The image builds its environment with uv from `pyproject.toml` + `uv.lock` in this
-directory — this is the source of truth for the container's dependencies. To add or
-update a dependency, edit `pyproject.toml` here and regenerate the lock (uv is
-available in the `ebook-search` dev shell):
-
-```sh
-nix develop .#ebook-search -c uv lock --project python/ebook_search/docker
-```
-
-## Tests
-
-The main pytest suite excludes `tests/ebook_search` (its dependencies are no longer
-in the nix dev shell). The `test ebook search` CI workflow runs them in a uv env
-built from the lockfile in this directory — same commands work locally from the
-repo root (the `--override-ini` drops the main suite's ignore):
-
-```sh
-uv sync --locked --project python/ebook_search/docker
-uv run --project python/ebook_search/docker --no-sync pytest tests/ebook_search --override-ini addopts="-n auto -ra"
-```
-
-They can also run inside the Docker `test` image, which validates the image itself:
-
-```sh
-python -m python.ebook_search.docker.containers test
-```
-
-or the raw docker equivalent:
-
-```sh
-docker build --file python/ebook_search/docker/Dockerfile --target test --tag ebook-search:test .
-docker run --rm ebook-search:test
-```
-
-## Configuration
-
-The compose service loads the repo root `.env` into the container via `env_file`.
-
-Mount your EPUB directory by setting `EBOOK_LIBRARY_HOST_PATH` in an env file or on the command line. The container sees it as `/library`, and `EBOOK_SEARCH_LIBRARY_PATHS` is set to `/library` inside the container.
-
-Database connection settings are controlled by `RICHIE_DB`, `RICHIE_HOST`, `RICHIE_PORT`, `RICHIE_USER`, and `RICHIE_PASSWORD`. The default host is `jeeves`.
@@ -1,54 +0,0 @@
-# Gems
-
-Gems is a server-rendered, turn-based resource-engine game for one to four human or AI players. It uses FastAPI,
-Jinja, HTMX, server-sent events, and SQLite.
-
-The application deliberately contains no playable card deck, patron/governor set, objective set, official artwork,
-or copied rulebook text. A room host must upload a content pack they are entitled to use before starting a game.
-
-## Run locally
-
-```shell
-uv run gems --host 127.0.0.1 --port 8082
-```
-
-The default database and installation key are created under `.gems/`. The following environment variables override
-runtime behavior:
-
- `GEMS_DATABASE_PATH`
- `GEMS_KEY_PATH`
- `GEMS_PUBLIC_ORIGIN`
- `GEMS_SECURE_COOKIES`
- `GEMS_HOST`
- `GEMS_PORT`
-
-## Content packs
-
-The current schema is available from a running server at `/schemas/content-pack-v1.json`. A pack defines exactly
-five normal resources, one wild resource, cards, and optional patrons, objectives, and outposts. `patrons` is the
-canonical field name; `governors` is accepted as an input alias.
-
-Cards may use only the built-in, bounded effect vocabulary:
-
- `none`
- `virtual_wild`
- `copy_bonus`
- `copy_and_claim`
- `multi_bonus`
- `claim_free`
- an optional discard-cards alternate cost
-
-Unknown fields, resource references, executable expressions, HTML, artwork URLs, and files larger than 512 KiB are
-rejected. The normalized pack is private to its room and becomes immutable when play starts.
-
-## Neutral module mapping
-
-Gems calls the four optional mechanics Objectives, Outposts, Eastern Decks, and Fortifications. Lobby presets combine
-these mechanics into the familiar base, objective-race, objective-plus-outpost, eastern-plus-fortification, and
-all-module configurations. Component identities and values always come from the uploaded pack.
-
-## Jeeves
-
-The NixOS module runs one Uvicorn worker on `127.0.0.1:8002`, stores state in
-`/zfs/media/services/gems`, and publishes it through HAProxy at `https://gems.tmmworkshop.com`. The DNS record must
-point to Jeeves before ACME can issue the certificate.
@@ -14,7 +14,7 @@ DEFAULT_BASE_BRANCH = "main"
 DEFAULT_BRANCH = "automation/update-flake-lock"
 DEFAULT_GITEA_URL = "https://gitea.tmmworkshop.com"
 PR_LABELS = ["dependencies", "automated", "flake_lock_update"]
-PR_CHECK_WORKFLOWS = ["build_systems.yml", "treefmt.yml", "pytest.yml"]
+PR_CHECK_WORKFLOWS = ["build_systems.yml", "treefmt.yml"]
 PR_TITLE = "Update flake.lock"
 PR_BODY = "Automated flake.lock update."

@@ -2,29 +2,63 @@

 from __future__ import annotations

+import json
 import logging
-from os import getenv
-
-from apprise import Apprise
+import socket

 logger = logging.getLogger(__name__)


-def signal_alert(body: str, title: str = "") -> None:
-    """Send a signal alert.
+class SignalRPCError(RuntimeError):
+    """signal-cli returned an error or closed without responding."""
+
+
+def signal_alert(body: str, from_phone: str, to_phone: str, *, timeout: float = 4.0) -> None:
+    """Send a Signal alert through the local signal-cli daemon.

    Args:
-        body (str): The body of the alert.
-        title (str, optional): The title of the alert. Defaults to "".
+        body: The body of the alert.
+        from_phone: The Signal account sending the alert.
+        to_phone: The Signal account receiving the alert.
+        timeout: Seconds to wait on each socket operation.
+
+    Raises:
+        SignalRPCError: If signal-cli returns an error or closes the
+            connection before responding.
+        OSError: If the socket is unreachable or an operation times out.
    """
-    apprise_client = Apprise()
+    signal_rpc_id = "signal-alert"
+    request = {
+        "jsonrpc": "2.0",
+        "method": "send",
+        "params": {
+            "account": from_phone,
+            "recipient": [to_phone],
+            "message": body,
+        },
+        "id": signal_rpc_id,
+    }

-    from_phone = getenv("SIGNAL_ALERT_FROM_PHONE")
-    to_phone = getenv("SIGNAL_ALERT_TO_PHONE")
-    if not from_phone or not to_phone:
-        logger.info("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
-        return
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(timeout)
+            client.connect("/run/signal-cli/socket")
+            client.sendall(json.dumps(request).encode() + b"\n")

-    apprise_client.add(f"signal://localhost:8989/{from_phone}/{to_phone}")
-
-    apprise_client.notify(title=title, body=body)
+            buffer = b""
+            while chunk := client.recv(65536):
+                buffer += chunk
+                while b"\n" in buffer:
+                    line, buffer = buffer.split(b"\n", maxsplit=1)
+                    response = json.loads(line)
+                    if response.get("id") != signal_rpc_id:
+                        continue
+                    if rpc_error := response.get("error"):
+                        error = f"Signal RPC returned an error: {rpc_error}"
+                        raise SignalRPCError(error)
+                    return
+            error = "Signal RPC socket closed before returning a response"
+            raise SignalRPCError(error)
+    except (OSError, json.JSONDecodeError) as exc:
+        error = f"Signal RPC failed: {exc!r}"
+        raise SignalRPCError(error) from exc
@@ -1 +0,0 @@
-"""system_tests."""
@@ -1,99 +0,0 @@
-"""Validate Jeeves."""
-
-from __future__ import annotations
-
-import logging
-from copy import copy
-from re import search
-from time import sleep
-from typing import TYPE_CHECKING
-
-from python.common import bash_wrapper
-from python.zfs import Zpool
-
-if TYPE_CHECKING:
-    from collections.abc import Sequence
-
-logger = logging.getLogger(__name__)
-
-
-def zpool_tests(pool_names: Sequence[str], zpool_capacity_threshold: int = 90) -> list[str] | None:
-    """Check the zpool health and capacity.
-
-    Args:
-        pool_names (Sequence[str]): A list of pool names to test.
-        zpool_capacity_threshold (int, optional): The threshold for the zpool capacity. Defaults to 90.
-
-    Returns:
-        list[str] | None: A list of errors if any.
-    """
-    logger.info("Testing zpool")
-
-    errors: list[str] = []
-    for pool_name in pool_names:
-        pool = Zpool(pool_name)
-        if pool.health != "ONLINE":
-            errors.append(f"{pool.name} is {pool.health}")
-        if pool.capacity >= zpool_capacity_threshold:
-            errors.append(f"{pool.name} is low on space")
-
-    upgrade_status, _ = bash_wrapper("zpool upgrade")
-    if not search(r"Every feature flags pool has all supported and requested features enabled.", upgrade_status):
-        errors.append("ZPool out of date run `sudo zpool upgrade -a`")
-
-    return errors
-
-
-def systemd_tests(
-    service_names: Sequence[str],
-    max_retries: int = 30,
-    retry_delay_secs: int = 1,
-    retryable_statuses: Sequence[str] | None = None,
-    valid_statuses: Sequence[str] | None = None,
-) -> list[str] | None:
-    """Tests a systemd services.
-
-    Args:
-        service_names (Sequence[str]): A list of service names to test.
-        max_retries (int, optional): The maximum number of retries. Defaults to 30.
-            minimum value is 1.
-        retry_delay_secs (int, optional): The delay between retries in seconds. Defaults to 1.
-            minimum value is 1.
-        retryable_statuses (Sequence[str] | None, optional): A list of retryable statuses. Defaults to None.
-        valid_statuses (Sequence[str] | None, optional): A list of valid statuses. Defaults to None.
-
-    Returns:
-        list[str] | None: A list of errors if any.
-    """
-    logger.info("Testing systemd service")
-
-    max_retries = max(max_retries, 1)
-    retry_delay_secs = max(retry_delay_secs, 1)
-    last_try = max_retries - 1
-
-    if retryable_statuses is None:
-        retryable_statuses = ("inactive\n", "activating\n")
-
-    if valid_statuses is None:
-        valid_statuses = ("active\n",)
-
-    service_names_set = set(service_names)
-
-    errors: set[str] = set()
-    for retry in range(max_retries):
-        if not service_names_set:
-            break
-        logger.info(f"Testing systemd service in {retry + 1} of {max_retries}")
-        service_names_to_test = copy(service_names_set)
-        for service_name in service_names_to_test:
-            service_status, _ = bash_wrapper(f"systemctl is-active {service_name}")
-            if service_status in valid_statuses:
-                service_names_set.remove(service_name)
-                continue
-            if service_status in retryable_statuses and retry < last_try:
-                continue
-            errors.add(f"{service_name} is {service_status.strip()}")
-
-        sleep(retry_delay_secs)
-
-    return list(errors)
@@ -1,67 +0,0 @@
-"""Validate {server_name}."""
-
-import logging
-import sys
-import tomllib
-from os import environ
-from pathlib import Path  # noqa: TC003 This is required for the typer CLI
-from socket import gethostname
-
-import typer
-
-from python.common import configure_logger
-from python.signal_alert import signal_alert
-from python.system_tests.components import systemd_tests, zpool_tests
-
-logger = logging.getLogger(__name__)
-
-
-def load_config_data(config_file: Path) -> dict[str, list[str]]:
-    """Load a TOML configuration file.
-
-    Args:
-        config_file (Path): The path to the configuration file.
-
-    Returns:
-        dict: The configuration data.
-    """
-    return tomllib.loads(config_file.read_text())
-
-
-def main(config_file: Path) -> None:
-    """Main."""
-    configure_logger(level=environ.get("LOG_LEVEL", "INFO"))
-
-    server_name = gethostname()
-    logger.info(f"Starting {server_name} validation")
-
-    config_data = load_config_data(config_file)
-
-    errors: list[str] = []
-    try:
-        if config_data.get("zpools") and (zpool_errors := zpool_tests(config_data["zpools"])):
-            errors.extend(zpool_errors)
-
-        if config_data.get("services") and (systemd_errors := systemd_tests(config_data["services"])):
-            errors.extend(systemd_errors)
-
-    except Exception as error:
-        logger.exception(f"{server_name} validation failed")
-        errors.append(f"{server_name} validation failed: {error}")
-
-    if errors:
-        logger.error(f"{server_name} validation failed: \n{'\n'.join(errors)}")
-        signal_alert(f"{server_name} validation failed {errors}")
-
-        sys.exit(1)
-
-    logger.info(f"{server_name} validation passed")
-
-
-def cli() -> None:
-    """CLI."""
-    typer.run(main)
-
-
-if __name__ == "__main__":
-    cli()
@@ -6,6 +6,7 @@ import logging
 import sys
 import tomllib
 from functools import cache
+from os import getenv
 from pathlib import Path  # noqa: TC003 This is required for the typer CLI
 from re import compile as re_compile
 from re import search
@@ -24,6 +25,15 @@ def main(config_file: Path) -> None:
    configure_logger(level="DEBUG")
    logger.info("Starting snapshot_manager")

+    from_phone = getenv("SIGNAL_ALERT_FROM_PHONE")
+    to_phone = getenv("SIGNAL_ALERT_TO_PHONE")
+    if not from_phone:
+        error = "SIGNAL_ALERT_FROM_PHONE environment variable is not set"
+        raise ValueError(error)
+    if not to_phone:
+        error = "SIGNAL_ALERT_TO_PHONE environment variable is not set"
+        raise ValueError(error)
+
    try:
        time_stamp = get_time_stamp()

@@ -33,14 +43,14 @@ def main(config_file: Path) -> None:
            if status != "snapshot created":
                msg = f"{dataset.name} failed to create snapshot {time_stamp}"
                logger.error(msg)
-                signal_alert(msg)
+                signal_alert(msg, from_phone, to_phone)
                continue
            count_lookup = get_count_lookup(config_file, dataset.name)
            logger.info(f"using {count_lookup} for {dataset.name}")
-            get_snapshots_to_delete(dataset, count_lookup)
+            get_snapshots_to_delete(dataset, count_lookup, from_phone, to_phone)
    except Exception:
        logger.exception("snapshot_manager failed")
-        signal_alert("snapshot_manager failed")
+        signal_alert("snapshot_manager failed", from_phone, to_phone)
        sys.exit(1)
    else:
        logger.info("snapshot_manager completed")
@@ -92,12 +102,16 @@ def load_config_data(config_file: Path) -> dict[str, dict[str, int]]:
 def get_snapshots_to_delete(
    dataset: Dataset,
    count_lookup: dict[str, int],
+    from_phone: str,
+    to_phone: str,
 ) -> None:
    """Get snapshots to delete.

    Args:
        dataset (Dataset): the dataset
        count_lookup (dict[str, int]): the count lookup
+        from_phone (str): The Signal account sending alerts.
+        to_phone (str): The Signal account receiving alerts.
    """
    snapshots = dataset.get_snapshots()

@@ -127,7 +141,7 @@ def get_snapshots_to_delete(
        for snapshot in snapshots_being_deleted:
            if error := dataset.delete_snapshot(snapshot):
                error_message = f"{dataset.name}@{snapshot} failed to delete: {error}"
-                signal_alert(error_message)
+                signal_alert(error_message, from_phone, to_phone)
                logger.error(error_message)


@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+if [[ "$(hostname)" != "jeeves" ]]; then
+  echo "Signal device authorization must run on jeeves." >&2
+  exit 1
+fi
+if [[ "$EUID" -ne 0 ]]; then
+  echo "Signal device authorization must run as root." >&2
+  exit 1
+fi
+if [[ "$#" -ne 1 ]]; then
+  echo "Usage: signal_authorize.sh DEVICE_URI" >&2
+  exit 2
+fi
+if [[ "$1" != sgnl://linkdevice\?* ]]; then
+  echo "Invalid Signal device link URI." >&2
+  exit 2
+fi
+
+service_name="signal-cli"
+data_dir="/var/lib/signal-cli"
+device_uri="$1"
+restart_service=false
+
+cleanup() {
+  if [[ "$restart_service" == true ]]; then
+    systemctl start "$service_name"
+  fi
+}
+trap cleanup EXIT
+
+restart_service=true
+systemctl stop "$service_name"
+runuser -u signal-cli -- \
+  signal-cli --data-dir "$data_dir" -a +12016554378 addDevice --uri "$device_uri"
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+host_name="$(hostname)"
+if [[ "$#" -ne 0 ]]; then
+  echo "Usage: signal_link.sh" >&2
+  exit 2
+fi
+
+service_name="signal-cli"
+data_dir="/var/lib/signal-cli"
+link_pid=""
+temp_dir=""
+restart_service=false
+
+cleanup() {
+  if [[ -n "$link_pid" ]] && kill -0 "$link_pid" 2>/dev/null; then
+    kill "$link_pid" 2>/dev/null || true
+    wait "$link_pid" 2>/dev/null || true
+  fi
+
+  if [[ -n "$temp_dir" ]]; then
+    rm -f -- "$temp_dir/link-uri"
+    rmdir -- "$temp_dir"
+  fi
+
+  if [[ "$restart_service" == true ]]; then
+    sudo systemctl start "$service_name"
+  fi
+}
+trap cleanup EXIT
+
+restart_service=true
+sudo systemctl stop "$service_name"
+
+temp_dir="$(mktemp -d)"
+link_fifo="$temp_dir/link-uri"
+mkfifo "$link_fifo"
+
+sudo -u signal-cli \
+  signal-cli --data-dir "$data_dir" link --name "$host_name" >"$link_fifo" &
+link_pid="$!"
+
+if ! IFS= read -r device_uri <"$link_fifo"; then
+  wait "$link_pid"
+  exit 1
+fi
+if [[ "$device_uri" != sgnl://linkdevice\?* ]]; then
+  echo "signal-cli returned an invalid device link URI." >&2
+  exit 1
+fi
+
+echo "Run this command manually on jeeves in another dotfiles dir:"
+printf "sudo ./scripts/signal/authorize.sh %q\n" "$device_uri"
+echo "Waiting for jeeves to authorize this device..."
+
+wait "$link_pid"
+link_pid=""
+echo "$host_name is now linked to the Signal account on jeeves."
@@ -8,7 +8,7 @@
  # loader path, which NixOS does not provide globally.
  ebook-search = pkgs.mkShell {
    nativeBuildInputs = with pkgs; [
-      my_python
+      python314
      uv
    ];
    LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
@@ -23,7 +23,6 @@
      nix
      home-manager
      git
-      my_python

      ssh-to-age
      gnupg
@@ -3,18 +3,17 @@
  imports = [
    "${inputs.self}/users/math"
    "${inputs.self}/users/richie"
-    "${inputs.self}/users/steve"
    "${inputs.self}/common/global"
    "${inputs.self}/common/optional/docker.nix"
    "${inputs.self}/common/optional/monitoring-agent.nix"
    "${inputs.self}/common/optional/nvidia.nix"
    "${inputs.self}/common/optional/scanner.nix"
-    "${inputs.self}/common/optional/steam.nix"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/yubikey.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./hardware.nix
    ./syncthing.nix
@@ -4,11 +4,13 @@
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
    "${inputs.self}/common/optional/docker.nix"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/ssh_decrypt.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./docker
    ./hardware.nix
@@ -1,3 +0,0 @@
-# docker_networks
-
-docker network create -d bridge web
@@ -4,6 +4,20 @@
  ...
 }:
 {
+  nixpkgs.overlays = [
+    (final: _prev: {
+      heater_python = final.python314.withPackages (
+        ps: with ps; [
+          fastapi
+          pydantic
+          tinytuya
+          typer
+          uvicorn
+        ]
+      );
+    })
+  ];
+
  networking.firewall.allowedTCPPorts = [ 8124 ];

  systemd.services.heater-api = {
@@ -17,7 +31,7 @@

    serviceConfig = {
      Type = "simple";
-      ExecStart = "${pkgs.my_python}/bin/python -m python.heater.main --host 0.0.0.0 --port 8124";
+      ExecStart = "${pkgs.heater_python}/bin/python -m python.heater.main --host 0.0.0.0 --port 8124";
      EnvironmentFile = "/etc/heater.env";
      Restart = "on-failure";
      RestartSec = "5s";
@@ -13,6 +13,10 @@
  services = {
    home-assistant = {
      enable = true;
+      # Keep Home Assistant's Python dependencies on baseline x86-64.
+      package = pkgs.x86-v1.home-assistant.overrideAttrs (_: {
+        doInstallCheck = false;
+      });
      config = {
        homeassistant = {
          time_zone = "America/New_York";
@@ -68,7 +72,6 @@
          paho-mqtt # for mqtt
          psycopg2 # for postgresql
          py-improv-ble-client # for esphome
-          pymodbus # for modbus
          pyopenweathermap # for weather
          pymetno # for met.no weather
          uiprotect # for ubiquiti integration
@@ -76,8 +79,11 @@
          jsonpath # for rest sensors
          monarchmoneycommunity # for monarch
        ];
-      extraComponents = [ "isal" ];
-      customComponents = with pkgs.home-assistant-custom-components; [
+      extraComponents = [
+        "isal"
+        "modbus" # for victron modbus integration
+      ];
+      customComponents = with pkgs.x86-v1.home-assistant-custom-components; [
        garmin_connect
      ];

@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ inputs, ... }:
 let
  vars = import ./vars.nix;
 in
@@ -6,14 +6,15 @@ in
  imports = [
    "${inputs.self}/users/math"
    "${inputs.self}/users/richie"
-    "${inputs.self}/users/steve"
    "${inputs.self}/common/global"
    "${inputs.self}/common/optional/docker.nix"
    "${inputs.self}/common/optional/monitoring-agent.nix"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/ssh_decrypt.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./monitoring
    ./docker
@@ -1,18 +0,0 @@
-let
-  vars = import ../vars.nix;
-in
-{
-  virtualisation.oci-containers.containers.signal_cli_rest_api = {
-    image = "bbernhard/signal-cli-rest-api:0.199-dev";
-    ports = [
-      "8989:8080"
-    ];
-    volumes = [
-      "${vars.docker_configs}/signal-cli-config:/home/.local/share/signal-cli"
-    ];
-    environment = {
-      MODE = "json-rpc";
-    };
-    autoStart = true;
-  };
-}
@@ -1,33 +0,0 @@
-# Monitoring
-
-## Vultr API metrics
-
-The `vultr-exporter` service reads its API token from:
-
-```text
-/zfs/storage/secrets/services/vultr-exporter
-```
-
-Create the file on Jeeves as root with the following contents:
-
-```text
-API_KEY=<Vultr API token>
-```
-
-The token needs read access to the Vultr Account and Billing APIs. Unrelated
-resource collectors are disabled in the packaged exporter.
-
-Restrict the file to root and ensure the public egress IP used by Jeeves is
-allowed for the token in the Vultr API settings:
-
-```console
-sudo chown root:root /zfs/storage/secrets/services/vultr-exporter
-sudo chmod 600 /zfs/storage/secrets/services/vultr-exporter
-```
-
-The exporter listens on `127.0.0.1:9188`; it is scraped by the local
-`prometheus-main` service every five minutes and is not exposed through the
-host firewall.
-
-Portal-1 exposes its node exporter only through `tailscale0` on port `9100`.
-Jeeves reaches it using the Portal-1 Tailscale hostname.
@@ -7,13 +7,13 @@ let
    gitea_ssh = 2223;
    grafana = 3000;
    jellyfin_http = 8096;
+    jellyswarrm = 3100;
    nix_binary_cache = 5000;
    nornsight = 8001;
    ollama = 11434;
    open_webui = 8080;
    postgresql = 5432;
    share = 8091;
-    signal_cli = 8989;
    syncthing = 8384;
  };
 in
@@ -28,6 +28,7 @@ in
      ports.audiobookshelf
      ports.gems
      ports.jellyfin_http
+      ports.jellyswarrm
      ports.nix_binary_cache
      ports.nornsight
      ports.share
@@ -40,7 +41,6 @@ in
      ports.ollama
      ports.open_webui
      ports.postgresql
-      ports.signal_cli
      ports.syncthing
    ];
  };
@@ -21,5 +21,16 @@
    nix-builder-12.enable = true;
    nix-builder-13.enable = true;
    nix-builder-14.enable = true;
+
+    # Warm the shared x86-64-v3 cache before the smaller per-system runners
+    # start. Eight jobs with eight cores each can use Jeeves' 64 logical CPUs,
+    # while the 6000% quota leaves some capacity for its normal services.
+    nix-cache-builder = {
+      enable = true;
+      labels = [ "nix-cache-builder:host" ];
+      cores = 8;
+      maxJobs = 8;
+      cpuQuota = "6000%";
+    };
  };
 }
@@ -11,11 +11,8 @@ let
  cfg = config.services.nix_builder;
  runnerUsername = "gitea-runner";
  runnerUserid = 601;
-  runnerLabels = [
-    "self-hosted:host"
-    "nixos:host"
-  ];
  containerConfig =
+    containerCfg:
    {
      config,
      pkgs,
@@ -23,6 +20,13 @@ let
      ...
    }:
    let
+      giteaAutomationPython = pkgs.python314.withPackages (
+        ps: with ps; [
+          httpx
+          pydantic
+          typer
+        ]
+      );
      runnerConfigFile = (pkgs.formats.yaml { }).generate "gitea-runner.yaml" { };
      registerRunner = pkgs.writeShellApplication {
        name = "register-gitea-runner";
@@ -43,6 +47,8 @@ let
        useHostResolvConf = false;
      };
      nix.settings = {
+        inherit (containerCfg) cores;
+        max-jobs = containerCfg.maxJobs;
        system-features = lib.mkAfter [
          "gccarch-x86-64-v2"
          "gccarch-x86-64-v3"
@@ -85,7 +91,7 @@ let
        enable = true;
        name = "jeeves-nix-builder";
        url = "http://192.168.99.14:6443/";
-        labels = runnerLabels;
+        labels = containerCfg.labels;
        tokenFile = "/run/secrets/gitea-runners/registration-token";
        settings.runner.timeout = "12h";
        hostPackages = with pkgs; [
@@ -94,12 +100,13 @@ let
          curl
          gawk
          gitMinimal
+          giteaAutomationPython
          gnused
-          my_python
          nix
          nixfmt
          nixos-rebuild
          nodejs
+          ruff
          treefmt
          wget
        ];
@@ -110,20 +117,21 @@ let
          User = mkForce runnerUsername;
          Group = mkForce runnerUsername;
          ExecStartPre = mkForce [
-            "${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs runnerLabels}"
+            "${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs containerCfg.labels}"
          ];
        };
      };
      system.stateVersion = "24.05";
    };
-  sharedContainerPath =
+  mkContainerPath =
+    containerCfg:
    (import "${pkgs.path}/nixos/lib/eval-config.nix" {
      modules = [
        {
          boot.isNspawnContainer = true;
          nixpkgs.pkgs = pkgs;
        }
-        containerConfig
+        (containerConfig containerCfg)
      ];
      system = null;
    }).config.system.build.toplevel;
@@ -141,7 +149,36 @@ in
        types.submodule (
          { name, ... }:
          {
-            options.enable = mkEnableOption "Gitea runner container";
+            options = {
+              enable = mkEnableOption "Gitea runner container";
+
+              labels = mkOption {
+                type = types.listOf types.str;
+                default = [
+                  "self-hosted:host"
+                  "nixos:host"
+                ];
+                description = "Gitea Actions labels advertised by this runner.";
+              };
+
+              cores = mkOption {
+                type = types.ints.positive;
+                default = 8;
+                description = "Number of cores made available to each Nix build job.";
+              };
+
+              maxJobs = mkOption {
+                type = types.ints.positive;
+                default = 2;
+                description = "Maximum number of Nix build jobs run in parallel.";
+              };
+
+              cpuQuota = mkOption {
+                type = types.str;
+                default = "800%";
+                description = "systemd CPU quota for the runner container.";
+              };
+            };
          }
        )
      );
@@ -163,7 +200,7 @@ in
    containers = mapAttrs (
      name: containerCfg:
      mkIf containerCfg.enable {
-        path = sharedContainerPath;
+        path = mkContainerPath containerCfg;
        autoStart = true;
        privateNetwork = true;
        hostBridge = cfg.bridgeName;
@@ -189,15 +226,14 @@ in
    ) cfg.containers;

    systemd = {
-      services = builtins.listToAttrs (
-        map (name: {
-          name = "container@${name}";
-          value = {
-            requires = [ "gitea.service" ];
-            after = [ "gitea.service" ];
-          };
-        }) (builtins.attrNames (filterAttrs (_: c: c.enable) cfg.containers))
-      );
+      services = mapAttrs' (
+        name: containerCfg:
+        nameValuePair "container@${name}" {
+          requires = [ "gitea.service" ];
+          after = [ "gitea.service" ];
+          serviceConfig.CPUQuota = containerCfg.cpuQuota;
+        }
+      ) (filterAttrs (_: c: c.enable) cfg.containers);

      tmpfiles.rules = [
        "d ${vars.uv_cache} 0755 ${runnerUsername} ${runnerUsername} - -"
@@ -1,80 +0,0 @@
-{
-  ...
-}:
-let
-  vars = import ../vars.nix;
-in
-{
-  systemd.tmpfiles.rules = [
-    "d ${vars.docker_configs}/camofox-browser 0750 root root - -"
-  ];
-
-  containers.camofox-browser = {
-    autoStart = true;
-    privateNetwork = false;
-    bindMounts = {
-      camofox-browser = {
-        hostPath = "${vars.docker_configs}/camofox-browser";
-        mountPoint = "/var/lib/camofox-browser";
-        isReadOnly = false;
-      };
-    };
-    config =
-      {
-        pkgs,
-        lib,
-        ...
-      }:
-      {
-        networking.hostName = "camofox-browser";
-
-        environment.systemPackages = with pkgs; [
-          ffmpeg
-          git
-          nodejs
-          python3Packages.yt-dlp
-        ];
-
-        systemd.services.camofox-browser = {
-          description = "Camofox browser server";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network.target" ];
-          environment = {
-            CAMOFOX_HOST = "127.0.0.1";
-            CAMOFOX_PORT = "9377";
-            HOME = "/var/lib/camofox-browser";
-          };
-          path = with pkgs; [
-            bash
-            coreutils
-            git
-            nodejs
-          ];
-          serviceConfig = {
-            Restart = "always";
-            RestartSec = "5s";
-            WorkingDirectory = "/var/lib/camofox-browser";
-          };
-          script = ''
-            set -eu
-
-            app_dir=/var/lib/camofox-browser/app
-
-            if [ ! -d "$app_dir/.git" ]; then
-              git clone --depth 1 https://github.com/jo-inc/camofox-browser "$app_dir"
-            fi
-
-            cd "$app_dir"
-
-            if [ ! -d node_modules ]; then
-              npm install
-            fi
-
-            exec npm start
-          '';
-        };
-
-        system.stateVersion = lib.mkDefault "24.05";
-      };
-  };
-}
@@ -6,8 +6,47 @@
 let
  vars = import ../vars.nix;
  stateDir = "${vars.services}/gems";
+  gemsPackages =
+    ps: with ps; [
+      fastapi
+      jinja2
+      pydantic
+      pydantic-settings
+      python-multipart
+      typer
+      uvicorn
+    ];
 in
 {
+  nixpkgs.overlays = [
+    (final: _prev: {
+      gems_python = final.python314.withPackages gemsPackages;
+      gems_test_python = final.python314.withPackages (
+        ps:
+        gemsPackages ps
+        ++ (with ps; [
+          httpx
+          pytest
+          pytest-asyncio
+          pytest-xdist
+        ])
+      );
+      gems_tests =
+        final.runCommand "gems-tests"
+          {
+            nativeBuildInputs = [ final.gems_test_python ];
+          }
+          ''
+            export HOME="$TMPDIR"
+            cd ${inputs.self}
+            pytest -o cache_dir="$TMPDIR/pytest-cache" tests/gems
+            touch "$out"
+          '';
+    })
+  ];
+
+  system.checks = [ pkgs.gems_tests ];
+
  users.groups.gems = { };
  users.users.gems = {
    isSystemUser = true;
@@ -36,7 +75,7 @@ in
      Type = "simple";
      User = "gems";
      Group = "gems";
-      ExecStart = "${pkgs.my_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
+      ExecStart = "${pkgs.gems_python}/bin/python -m python.gems.main --host 0.0.0.0 --port 8002";
      Restart = "on-failure";
      RestartSec = "5s";
      StandardOutput = "journal";
@@ -23,7 +23,6 @@ in
      };
      service.DISABLE_REGISTRATION = true;
      server = {
-        DOMAIN = "gitea.tmmworkshop.com";
        ROOT_URL = "https://gitea.tmmworkshop.com/";
        HTTP_PORT = 6443;
        BUILTIN_SSH_SERVER_USER = "gitea";
@@ -0,0 +1,16 @@
+{ inputs, ... }:
+let
+  vars = import ../vars.nix;
+in
+{
+  imports = [ inputs.jellyswarrm.nixosModules.default ];
+
+  services.jellyswarrm = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 3100;
+    dataDir = "${vars.services}/jellyswarrm";
+    username = "admin";
+    passwordFile = "${vars.secrets}/services/jellyswarrm-password";
+  };
+}
@@ -1,12 +0,0 @@
-{
-  services.open-webui = {
-    enable = true;
-    host = "0.0.0.0";
-    environment = {
-      ANONYMIZED_TELEMETRY = "False";
-      DO_NOT_TRACK = "True";
-      SCARF_NO_ANALYTICS = "True";
-      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
-    };
-  };
-}
@@ -1,11 +1,7 @@
 {
  pkgs,
-  inputs,
  ...
 }:
-let
-  vars = import ../vars.nix;
-in
 {
  systemd = {
    services = {
@@ -30,21 +26,6 @@ in
          ExecStart = "${pkgs.bash}/bin/bash -c 'echo 1 > /sys/bus/pci/devices/0000:61:00.0/remove'";
        };
      };
-      startup_validation = {
-        requires = [ "network-online.target" ];
-        after = [ "network-online.target" ];
-        wantedBy = [ "multi-user.target" ];
-        description = "validates startup";
-        path = [ pkgs.zfs ];
-        environment = {
-          PYTHONPATH = "${inputs.self}/";
-        };
-        serviceConfig = {
-          EnvironmentFile = "${vars.secrets}/services/server-validation";
-          Type = "oneshot";
-          ExecStart = "${pkgs.my_python}/bin/python -m python.system_tests.validate_system '${./validate_system.toml}'";
-        };
-      };
    };
    timers = {
      plex_permission = {
@@ -55,13 +36,6 @@ in
          Unit = "plex_permission.service";
        };
      };
-      startup_validation = {
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnBootSec = "10min";
-          Unit = "startup_validation.service";
-        };
-      };
    };
  };
 }
@@ -1,6 +0,0 @@
-zpool = ["root_pool", "storage", "media"]
-services = [
-    "audiobookshelf",
-    "docker",
-    "jellyfin",
-]
@@ -1,83 +0,0 @@
-# portal_1
-
-Minimal NixOS target for a Vultr VM, installed with nixos-anywhere. The Nix
-flake target is `portal_1`; the machine hostname is `portal-1` because DNS
-hostnames cannot contain underscores.
-
-## Before deploying
-
-1. Confirm the VM's system disk is `/dev/vda`. If it is not, update both
-   references in `disk-config.nix`.
-2. Confirm the SSH public key in `default.nix` is the key that should have
-   administrator access.
-3. Boot the VM into a NixOS installer or another nixos-anywhere-compatible
-   Linux rescue environment with root SSH access. Keep this environment
-   running while completing the SOPS bootstrap below.
-
-## Bootstrap SOPS
-
-Use the rescue environment's SSH host key as the permanent portal identity.
-Replace `VM_IP` below:
-
-```console
-ssh root@VM_IP 'cat /etc/ssh/ssh_host_ed25519_key.pub' | \
-  nix shell nixpkgs#ssh-to-age --command ssh-to-age
-```
-
-This prints an `age1...` recipient; it does not copy the private key. Add the
-recipient to `.sops.yaml`:
-
-```yaml
- &system_portal_1 age1...
-```
-
-Then add `*system_portal_1` to the age recipients for
-`users/secrets.yaml`. Re-encrypt the existing file for the new recipient and
-add the Tailscale key:
-
-```console
-nix shell nixpkgs#sops --command sops updatekeys users/secrets.yaml
-nix shell nixpkgs#sops --command sops users/secrets.yaml
-```
-
-Add the OAuth client secret from the `Auth Keys: Write` credential in the SOPS
-editor and save it:
-
-```yaml
-tailscale_auth_key: tskey-client-...
-```
-
-## Deploy
-
-From the repository root, replace `VM_IP` with the VM's public IP:
-
-```console
-nix run github:nix-community/nixos-anywhere -- \
-  --copy-host-keys --flake .#portal_1 root@VM_IP
-```
-
-This repartitions `/dev/vda`, so anything already on that disk is erased. The
-layout reserves 8 GiB for swap and assigns the remaining space to the root
-filesystem.
-
-`--copy-host-keys` preserves the same private SSH host key at
-`/etc/ssh/ssh_host_ed25519_key` on the installed system. SOPS-Nix converts that
-key to an age identity during activation. After the reboot, connect as
-`richie` and verify that automatic Tailscale enrollment succeeded:
-
-```console
-ssh -p 278 richie@VM_IP
-sudo tailscale status
-```
-
-The installed OpenSSH service listens on port 278. Port 22 is served by
-Endlessh and will not provide an SSH login.
-
-HAProxy uses the same frontend, routing, and rate-limiting configuration as
-Jeeves. Portal manages the ACME certificates for the existing public domains;
-their DNS records must resolve to Portal for HTTP-01 issuance and renewal.
-
-The application backends still use Jeeves' original `127.0.0.1` addresses.
-Replace them with the corresponding Tailscale addresses before directing
-application traffic through Portal. Ports 80 and 443 are allowed through the
-firewall.
@@ -9,14 +9,14 @@
    inputs.disko.nixosModules.disko
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/tailscale.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    ./disk-config.nix
    ./haproxy
    ./monitoring.nix
  ];

-  nixpkgs.hostPlatform = "x86_64-linux";
-
  boot = {
    # Avoid consuming the VM's limited memory for /tmp.
    tmp.useTmpfs = false;
@@ -1,35 +0,0 @@
-{
-  pkgs,
-  inputs,
-  ...
-}:
-{
-  systemd.services.agent-logger = {
-    description = "Unified agent logger";
-    after = [ "local-fs.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    environment = {
-      AGENT_LOG_DB = "/var/lib/agent-logger/agent_log.sqlite";
-      HOME = "/home/richie";
-      PYTHONPATH = "${inputs.self}";
-    };
-
-    serviceConfig = {
-      Type = "simple";
-      User = "richie";
-      WorkingDirectory = "/home/richie";
-      ExecStart = "${pkgs.my_python}/bin/python -m python.agent_logger.main";
-      StateDirectory = "agent-logger";
-      Restart = "on-failure";
-      RestartSec = "5s";
-      StandardOutput = "journal";
-      StandardError = "journal";
-      NoNewPrivileges = true;
-      ProtectSystem = "strict";
-      ProtectHome = "read-only";
-      PrivateTmp = true;
-      ReadOnlyPaths = [ "${inputs.self}" ];
-    };
-  };
-}
@@ -3,18 +3,15 @@
  imports = [
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
-    "${inputs.self}/common/optional/desktop.nix"
+    "${inputs.self}/common/optional/desktop"
    "${inputs.self}/common/optional/docker.nix"
    "${inputs.self}/common/optional/steam.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
-    "${inputs.self}/common/optional/yubikey.nix"
    "${inputs.self}/common/optional/zfs"
    ./hardware.nix
-    ./open_webui.nix
    ./programs.nix
-    ./qmk.nix
    ./syncthing.nix
    inputs.nixos-hardware.nixosModules.framework-13-7040-amd
  ];
@@ -1,13 +0,0 @@
-{
-  services.open-webui = {
-    enable = true;
-    host = "0.0.0.0";
-    environment = {
-      ANONYMIZED_TELEMETRY = "False";
-      DO_NOT_TRACK = "True";
-      SCARF_NO_ANALYTICS = "True";
-      OLLAMA_API_BASE_URL = "https://ollama.com";
-      WEBUI_AUTH = "False";
-    };
-  };
-}
@@ -1,104 +0,0 @@
-"""test_components."""
-
-from pytest_mock import MockerFixture
-
-from python.system_tests.components import systemd_tests, zpool_tests
-from python.zfs import Zpool
-
-temp = "Every feature flags pool has all supported and requested features enabled.\n"
-
-SYSTEM_TESTS_COMPONENTS = "python.system_tests.components"
-
-
-def test_zpool_tests(mocker: MockerFixture) -> None:
-    """test_zpool_tests."""
-    mock_zpool = mocker.MagicMock(spec=Zpool)
-    mock_zpool.health = "ONLINE"
-    mock_zpool.capacity = 70
-    mock_zpool.name = "Main"
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
-    errors = zpool_tests(("Main",))
-    assert errors == []
-
-
-def test_zpool_tests_out_of_date(mocker: MockerFixture) -> None:
-    """test_zpool_tests_out_of_date."""
-    mock_zpool = mocker.MagicMock(spec=Zpool)
-    mock_zpool.health = "ONLINE"
-    mock_zpool.capacity = 70
-    mock_zpool.name = "Main"
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("", ""))
-    errors = zpool_tests(("Main",))
-    assert errors == ["ZPool out of date run `sudo zpool upgrade -a`"]
-
-
-def test_zpool_tests_out_of_space(mocker: MockerFixture) -> None:
-    """test_zpool_tests_out_of_space."""
-    mock_zpool = mocker.MagicMock(spec=Zpool)
-    mock_zpool.health = "ONLINE"
-    mock_zpool.capacity = 100
-    mock_zpool.name = "Main"
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
-    errors = zpool_tests(("Main",))
-    assert errors == ["Main is low on space"]
-
-
-def test_zpool_tests_offline(mocker: MockerFixture) -> None:
-    """test_zpool_tests_offline."""
-    mock_zpool = mocker.MagicMock(spec=Zpool)
-    mock_zpool.health = "OFFLINE"
-    mock_zpool.capacity = 70
-    mock_zpool.name = "Main"
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.Zpool", return_value=mock_zpool)
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=(temp, ""))
-    errors = zpool_tests(("Main",))
-    assert errors == ["Main is OFFLINE"]
-
-
-def test_systemd_tests(mocker: MockerFixture) -> None:
-    """test_systemd_tests."""
-    mocker.patch(
-        f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper",
-        side_effect=[
-            ("inactive\n", ""),
-            ("active\n", ""),
-        ],
-    )
-    errors = systemd_tests(("docker",))
-    assert errors == []
-    """test_systemd_tests."""
-
-
-def test_systemd_tests_multiple_negative_retries(mocker: MockerFixture) -> None:
-    """test_systemd_tests_fail."""
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("active\n", ""))
-    errors = systemd_tests(("docker",), max_retries=-1, retry_delay_secs=-1)
-    assert errors == []
-
-
-def test_systemd_tests_multiple_pass(mocker: MockerFixture) -> None:
-    """test_systemd_tests_fail."""
-    mocker.patch(
-        f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper",
-        side_effect=[
-            ("inactive\n", ""),
-            ("activating\n", ""),
-            ("active\n", ""),
-        ],
-    )
-    errors = systemd_tests(
-        ("docker",),
-        retryable_statuses=("inactive\n", "activating\n"),
-        valid_statuses=("active\n",),
-    )
-    assert errors == []
-
-
-def test_systemd_tests_fail(mocker: MockerFixture) -> None:
-    """test_systemd_tests_fail."""
-    mocker.patch(f"{SYSTEM_TESTS_COMPONENTS}.bash_wrapper", return_value=("inactive\n", ""))
-    errors = systemd_tests(("docker",), max_retries=5)
-    assert errors == ["docker is inactive"]
@@ -1,63 +0,0 @@
-"""test_server_validate_scripts."""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-import pytest
-from pytest_mock import MockerFixture
-
-from python.system_tests.validate_system import main
-
-if TYPE_CHECKING:
-    from pyfakefs.fake_filesystem import FakeFilesystem
-    from pytest_mock import MockerFixture
-
-VALIDATE_SYSTEM = "python.system_tests.validate_system"
-
-
-def test_validate_system(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """test_validate_system."""
-    fs.create_file(
-        "/mock_snapshot_config.toml",
-        contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
-    )
-
-    mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=None)
-    mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", return_value=None)
-    main(Path("/mock_snapshot_config.toml"))
-
-
-def test_validate_system_errors(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """test_validate_system_errors."""
-    fs.create_file(
-        "/mock_snapshot_config.toml",
-        contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
-    )
-
-    mocker.patch(f"{VALIDATE_SYSTEM}.signal_alert")
-    mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=["systemd_tests error"])
-    mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", return_value=["zpool_tests error"])
-
-    with pytest.raises(SystemExit) as exception_info:
-        main(Path("/mock_snapshot_config.toml"))
-
-    assert exception_info.value.code == 1
-
-
-def test_validate_system_execution(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """test_validate_system_execution."""
-    fs.create_file(
-        "/mock_snapshot_config.toml",
-        contents='zpools = ["root_pool", "storage", "media"]\nservices = ["docker"]\n',
-    )
-
-    mocker.patch(f"{VALIDATE_SYSTEM}.signal_alert")
-    mocker.patch(f"{VALIDATE_SYSTEM}.systemd_tests", return_value=None)
-    mocker.patch(f"{VALIDATE_SYSTEM}.zpool_tests", side_effect=RuntimeError("zpool_tests error"))
-
-    with pytest.raises(SystemExit) as exception_info:
-        main(Path("/mock_snapshot_config.toml"))
-
-    assert exception_info.value.code == 1
@@ -2,40 +2,68 @@

 from __future__ import annotations

-from os import environ
+import json
+import socket
 from typing import TYPE_CHECKING

-from apprise import Apprise
+import pytest

-from python.signal_alert import signal_alert
+from python.signal_alert import SignalRPCError, signal_alert

 if TYPE_CHECKING:
    from pytest_mock import MockerFixture


 def test_signal_alert(mocker: MockerFixture) -> None:
-    """test_signal_alert."""
-    environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
-    environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
-
    mock_logger = mocker.patch("python.signal_alert.logger")
-    mock_apprise_client = mocker.MagicMock(spec=Apprise)
-    mocker.patch("python.signal_alert.Apprise", return_value=mock_apprise_client)
+    mock_socket = mocker.patch("python.signal_alert.socket.socket")
+    client = mock_socket.return_value.__enter__.return_value
+    client.recv.side_effect = [b'{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n']

-    signal_alert("test")
+    assert signal_alert("test", "1234567890", "0987654321") is None

    mock_logger.info.assert_not_called()
-    mock_apprise_client.add.assert_called_once_with("signal://localhost:8989/1234567890/0987654321")
-    mock_apprise_client.notify.assert_called_once_with(title="", body="test")
+    mock_socket.assert_called_once_with(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.settimeout.assert_called_once_with(4.0)
+    client.connect.assert_called_once_with("/run/signal-cli/socket")
+    request = json.loads(client.sendall.call_args.args[0])
+    assert request == {
+        "jsonrpc": "2.0",
+        "method": "send",
+        "params": {
+            "account": "1234567890",
+            "recipient": ["0987654321"],
+            "message": "test",
+        },
+        "id": "signal-alert",
+    }


-def test_signal_alert_no_phones(mocker: MockerFixture) -> None:
-    """test_signal_alert_no_phones."""
-    if "SIGNAL_ALERT_FROM_PHONE" in environ:
-        del environ["SIGNAL_ALERT_FROM_PHONE"]
-    if "SIGNAL_ALERT_TO_PHONE" in environ:
-        del environ["SIGNAL_ALERT_TO_PHONE"]
-    mock_logger = mocker.patch("python.signal_alert.logger")
-    signal_alert("test")
+def test_signal_alert_socket_error(mocker: MockerFixture) -> None:
+    mocker.patch("python.signal_alert.socket.socket", side_effect=ConnectionError("connection failed"))

-    mock_logger.info.assert_called_once_with("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
+    with pytest.raises(SignalRPCError, match="Signal RPC failed") as exc_info:
+        signal_alert("test", "1234567890", "0987654321")
+
+    assert isinstance(exc_info.value.__cause__, ConnectionError)
+
+
+def test_signal_alert_rpc_error(mocker: MockerFixture) -> None:
+    mock_socket = mocker.patch("python.signal_alert.socket.socket")
+    client = mock_socket.return_value.__enter__.return_value
+    client.recv.side_effect = [b'{"jsonrpc":"2.0","error":{"code":-1,"message":"failed"},"id":"signal-alert"}\n']
+
+    with pytest.raises(SignalRPCError, match=r"Signal RPC returned an error:.*failed"):
+        signal_alert("test", "1234567890", "0987654321")
+
+
+def test_signal_alert_ignores_notifications(mocker: MockerFixture) -> None:
+    mock_socket = mocker.patch("python.signal_alert.socket.socket")
+    client = mock_socket.return_value.__enter__.return_value
+    client.recv.side_effect = [
+        b'{"jsonrpc":"2.0","method":"receive"}\n{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n'
+    ]
+
+    assert signal_alert("test", "1234567890", "0987654321") is None
+
+    assert client.recv.call_count == 1
@@ -16,6 +16,17 @@ if TYPE_CHECKING:
    from pytest_mock import MockerFixture

 SNAPSHOT_MANAGER = "python.tools.snapshot_manager"
+FROM_PHONE = "1234567890"
+TO_PHONE = "0987654321"
+
+
+def patch_phone_numbers(mocker: MockerFixture) -> None:
+    """Patch the Signal phone number environment variables."""
+    phone_numbers = {
+        "SIGNAL_ALERT_FROM_PHONE": FROM_PHONE,
+        "SIGNAL_ALERT_TO_PHONE": TO_PHONE,
+    }
+    mocker.patch(f"{SNAPSHOT_MANAGER}.getenv", side_effect=phone_numbers.get)


 def patch_utcnow(mocker: MockerFixture, datetime_value: datetime) -> None:
@@ -34,6 +45,7 @@ def create_mock_snapshot(mocker: MockerFixture, name: str) -> Snapshot:
 def test_main(mocker: MockerFixture, fs: FakeFilesystem) -> None:
    """Test main."""
    load_config_data.cache_clear()
+    patch_phone_numbers(mocker)

    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")

@@ -58,12 +70,15 @@ def test_main(mocker: MockerFixture, fs: FakeFilesystem) -> None:
            "daily": 0,
            "monthly": 0,
        },
+        FROM_PHONE,
+        TO_PHONE,
    )


 def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem) -> None:
    """Test main."""
    load_config_data.cache_clear()
+    patch_phone_numbers(mocker)

    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")

@@ -78,7 +93,11 @@ def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem)
    fs.create_file("/mock_snapshot_config.toml", contents=mock_snapshot_config_toml)
    main(Path("/mock_snapshot_config.toml"))

-    mock_signal_alert.assert_called_once_with("test_dataset failed to create snapshot 2023-01-01T00:00:00")
+    mock_signal_alert.assert_called_once_with(
+        "test_dataset failed to create snapshot 2023-01-01T00:00:00",
+        FROM_PHONE,
+        TO_PHONE,
+    )
    mock_get_datasets.assert_called_once()
    mock_get_snapshots_to_delete.assert_not_called()

@@ -86,6 +105,7 @@ def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem)
 def test_main_exception(mocker: MockerFixture, fs: FakeFilesystem) -> None:
    """Test main."""
    load_config_data.cache_clear()
+    patch_phone_numbers(mocker)

    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")

@@ -103,7 +123,7 @@ def test_main_exception(mocker: MockerFixture, fs: FakeFilesystem) -> None:

    assert isinstance(pytest_wrapped_e.value, SystemExit)
    assert pytest_wrapped_e.value.code == 1
-    mock_signal_alert.assert_called_once_with("snapshot_manager failed")
+    mock_signal_alert.assert_called_once_with("snapshot_manager failed", FROM_PHONE, TO_PHONE)
    mock_get_datasets.assert_called_once()
    mock_get_snapshots_to_delete.assert_not_called()

@@ -120,7 +140,12 @@ def test_get_snapshots_to_delete(mocker: MockerFixture) -> None:

    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")

-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
+    get_snapshots_to_delete(
+        mock_dataset,
+        {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
+        FROM_PHONE,
+        TO_PHONE,
+    )

    mock_signal_alert.assert_not_called()
    mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")
@@ -135,7 +160,12 @@ def test_get_snapshots_to_delete_no_snapshot(mocker: MockerFixture) -> None:

    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")

-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
+    get_snapshots_to_delete(
+        mock_dataset,
+        {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
+        FROM_PHONE,
+        TO_PHONE,
+    )

    mock_signal_alert.assert_not_called()
    mock_dataset.delete_snapshot.assert_not_called()
@@ -153,10 +183,17 @@ def test_get_snapshots_to_delete_errored(mocker: MockerFixture) -> None:

    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")

-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
+    get_snapshots_to_delete(
+        mock_dataset,
+        {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0},
+        FROM_PHONE,
+        TO_PHONE,
+    )

    mock_signal_alert.assert_called_once_with(
-        "test_dataset@auto_202509150415 failed to delete: snapshot has dependent clones"
+        "test_dataset@auto_202509150415 failed to delete: snapshot has dependent clones",
+        FROM_PHONE,
+        TO_PHONE,
    )
    mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")

@@ -3,54 +3,17 @@
  home.packages = with pkgs; [
    # cli
    bat
-    btop
-    eza
-    fd
-    ffmpegthumbnailer
    fzf
    git
-    gnupg
-    imagemagick
    jq
    ncdu
-    ouch
+    fastfetch
    p7zip
-    poppler
    rar
-    ripgrep
-    starship
-    tmux
    unzip
-    yazi
    zoxide
-    # system info
-    hwloc
-    lynis
-    pciutils
-    smartmontools
-    usbutils
-    # networking
-    iperf3
-    nmap
-    wget
    # python
    ruff
    uv
-    # nodejs
-    nodejs
-    # Rust packages
-    trunk
-    wasm-pack
-    cargo-watch
-    cargo-generate
-    cargo-audit
-    cargo-update
-    # nix
-    nix-init
-    nix-output-monitor
-    nix-prefetch
-    nix-tree
-    nixfmt
-    treefmt
  ];
 }
@@ -41,6 +41,7 @@ in
        "ollama"
        "plugdev"
        "scanner"
+        "signal-cli"
        "transmission"
        "uaccess"
        "uucp"
@@ -1,12 +1,11 @@
-{ inputs, pkgs, ... }:
+{ pkgs, ... }:
 {
  imports = [
-    "${inputs.self}/users/shared/comms.nix"
-    "${inputs.self}/users/shared/games.nix"
-    "${inputs.self}/users/shared/sweet.nix"
-    ./firefox
+    ./comms.nix
+    ./games.nix
    ./kitty.nix
    ./llm_tools.nix
+    ./sweet.nix
    ./t3_code
    ./vscode
  ];
@@ -22,7 +21,7 @@
    vlc
    # browser
    brave
-    chromium
+    firefox
    # dev tools
    gparted
    jetbrains.datagrip
@@ -1,257 +0,0 @@
-{ config, inputs, ... }:
-{
-  imports = [ ./search_engines.nix ];
-
-  programs.firefox = {
-    configPath = "${config.xdg.configHome}/mozilla/firefox";
-    enable = true;
-    profiles.richie = {
-      extensions.packages = with inputs.firefox-addons.packages.x86_64-linux; [
-        bitwarden
-        darkreader
-        dearrow
-        fastforwardteam
-        return-youtube-dislikes
-        sponsorblock
-        ublock-origin
-      ];
-      search = {
-        force = true;
-        default = "kagi";
-        order = [
-          "kagi"
-          "ddg"
-          "google"
-        ];
-      };
-      settings = {
-        # SECTION: FASTFOX
-        # GENERAL
-        "content.notify.interval" = 100000;
-
-        # GFX
-        "gfx.canvas.accelerated.cache-items" = 4096;
-        "gfx.canvas.accelerated.cache-size" = 512;
-        "gfx.content.skia-font-cache-size" = 20;
-
-        # DISK CACHE
-        "browser.cache.jsbc_compression_level" = 3;
-
-        # MEDIA CACHE
-        "media.memory_cache_max_size" = 65536;
-        "media.cache_readahead_limit" = 7200;
-        "media.cache_resume_threshold" = 3600;
-
-        # IMAGE CACHE
-        "image.mem.decode_bytes_at_a_time" = 32768;
-
-        # NETWORK
-        "network.buffer.cache.size" = 262144;
-        "network.buffer.cache.count" = 128;
-        "network.http.max-connections" = 1800;
-        "network.http.max-persistent-connections-per-server" = 10;
-        "network.http.max-urgent-start-excessive-connections-per-host" = 5;
-        "network.http.accept-encoding" = "gzip, deflate, br, zstd";
-        "network.http.pacing.requests.enabled" = false;
-        "network.dnsCacheExpiration" = 3600;
-        "network.dns.max_high_priority_threads" = 8;
-        "network.ssl_tokens_cache_capacity" = 10240;
-
-        # SPECULATIVE LOADING
-        "network.dns.disablePrefetch" = true;
-        "network.prefetch-next" = false;
-        "network.predictor.enabled" = false;
-
-        # EXPERIMENTAL
-        "layout.css.grid-template-masonry-value.enabled" = true;
-        "dom.enable_web_task_scheduling" = true;
-        "layout.css.has-selector.enabled" = true;
-        "dom.security.sanitizer.enabled" = true;
-
-        # SECTION: SECUREFOX
-        # TRACKING PROTECTION
-        "browser.contentblocking.category" = "strict";
-        "urlclassifier.trackingSkipURLs" = "*.reddit.com, *.twitter.com, *.twimg.com, *.tiktok.com";
-        "urlclassifier.features.socialtracking.skipURLs" = "*.instagram.com, *.twitter.com, *.twimg.com";
-        "network.cookie.sameSite.noneRequiresSecure" = true;
-        "browser.download.start_downloads_in_tmp_dir" = true;
-        "browser.helperApps.deleteTempFileOnExit" = true;
-        "browser.uitour.enabled" = false;
-        "privacy.globalprivacycontrol.enabled" = true;
-
-        # OCSP & CERTS / HPKP
-        "security.OCSP.enabled" = 0;
-        "security.remote_settings.crlite_filters.enabled" = true;
-        "security.pki.crlite_mode" = 2;
-
-        # SSL / TLS
-        "security.ssl.treat_unsafe_negotiation_as_broken" = true;
-        "browser.xul.error_pages.expert_bad_cert" = true;
-        "security.tls.enable_0rtt_data" = false;
-
-        # DISK AVOIDANCE
-        "browser.privatebrowsing.forceMediaMemoryCache" = true;
-        "browser.sessionstore.interval" = 60000;
-
-        # SHUTDOWN & SANITIZING
-        "privacy.history.custom" = true;
-
-        # SEARCH / URL BAR
-        "browser.search.separatePrivateDefault.ui.enabled" = true;
-        "browser.urlbar.update2.engineAliasRefresh" = true;
-        # PREF: restore search engine suggestions
-        "browser.search.suggest.enabled" = true;
-        "browser.urlbar.suggest.quicksuggest.sponsored" = false;
-        "browser.urlbar.suggest.quicksuggest.nonsponsored" = false;
-        "browser.formfill.enable" = false;
-        "security.insecure_connection_text.enabled" = true;
-        "security.insecure_connection_text.pbmode.enabled" = true;
-        "network.IDN_show_punycode" = true;
-
-        # HTTPS-FIRST POLICY
-        "dom.security.https_first" = true;
-        "dom.security.https_first_schemeless" = true;
-
-        # PASSWORDS
-        "signon.formlessCapture.enabled" = false;
-        "signon.rememberSignons" = false;
-        "signon.privateBrowsingCapture.enabled" = false;
-        "network.auth.subresource-http-auth-allow" = 1;
-        "editor.truncate_user_pastes" = false;
-
-        # MIXED CONTENT + CROSS-SITE
-        "security.mixed_content.block_display_content" = true;
-        "security.mixed_content.upgrade_display_content" = true;
-        "security.mixed_content.upgrade_display_content.image" = true;
-        "pdfjs.enableScripting" = false;
-        "extensions.postDownloadThirdPartyPrompt" = false;
-
-        # HEADERS / REFERERS
-        "network.http.referer.XOriginTrimmingPolicy" = 2;
-
-        # CONTAINERS
-        "privacy.userContext.ui.enabled" = true;
-
-        # WEBRTC
-        "media.peerconnection.ice.proxy_only_if_behind_proxy" = true;
-        "media.peerconnection.ice.default_address_only" = true;
-
-        # SAFE BROWSING
-        "browser.safebrowsing.downloads.remote.enabled" = false;
-
-        # MOZILLA
-        # PREF: allow websites to ask you to receive site notifications
-        "permissions.default.desktop-notification" = 0; # allow websites to ask
-        # PREF: allow websites to ask you for your location
-        "permissions.default.geo" = 0;
-        "geo.provider.network.url" =
-          "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%";
-        "permissions.manager.defaultsUrl" = "";
-        "webchannel.allowObject.urlWhitelist" = "";
-
-        # TELEMETRY
-        "datareporting.policy.dataSubmissionEnabled" = false;
-        "datareporting.healthreport.uploadEnabled" = false;
-        "toolkit.telemetry.unified" = false;
-        "toolkit.telemetry.enabled" = false;
-        "toolkit.telemetry.server" = "data:,";
-        "toolkit.telemetry.archive.enabled" = false;
-        "toolkit.telemetry.newProfilePing.enabled" = false;
-        "toolkit.telemetry.shutdownPingSender.enabled" = false;
-        "toolkit.telemetry.updatePing.enabled" = false;
-        "toolkit.telemetry.bhrPing.enabled" = false;
-        "toolkit.telemetry.firstShutdownPing.enabled" = false;
-        "toolkit.telemetry.coverage.opt-out" = true;
-        "toolkit.coverage.opt-out" = true;
-        "toolkit.coverage.endpoint.base" = "";
-        "browser.ping-centre.telemetry" = false;
-        "browser.newtabpage.activity-stream.feeds.telemetry" = false;
-        "browser.newtabpage.activity-stream.telemetry" = false;
-
-        # EXPERIMENTS
-        "app.shield.optoutstudies.enabled" = false;
-        "app.normandy.enabled" = false;
-        "app.normandy.api_url" = "";
-
-        # CRASH REPORTS
-        "breakpad.reportURL" = "";
-        "browser.tabs.crashReporting.sendReport" = false;
-        "browser.crashReports.unsubmittedCheck.autoSubmit2" = false;
-
-        # DETECTION
-        "captivedetect.canonicalURL" = "";
-        "network.captive-portal-service.enabled" = false;
-        "network.connectivity-service.enabled" = false;
-
-        # SECTION: PESKYFOX
-        # MOZILLA UI
-        "browser.privatebrowsing.vpnpromourl" = "";
-        "extensions.getAddons.showPane" = false;
-        "extensions.htmlaboutaddons.recommendations.enabled" = false;
-        "browser.discovery.enabled" = false;
-        "browser.shell.checkDefaultBrowser" = false;
-        "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons" = false;
-        "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features" = false;
-        "browser.preferences.moreFromMozilla" = false;
-        "browser.tabs.tabmanager.enabled" = false;
-        "browser.aboutConfig.showWarning" = false;
-        "browser.aboutwelcome.enabled" = false;
-
-        # THEME ADJUSTMENTS
-        "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-        "browser.compactmode.show" = true;
-        "browser.display.focus_ring_on_anything" = true;
-        "browser.display.focus_ring_style" = 0;
-        "browser.display.focus_ring_width" = 0;
-        "layout.css.prefers-color-scheme.content-override" = 2;
-
-        # COOKIE BANNER HANDLING
-        "cookiebanners.service.mode" = 1;
-        "cookiebanners.service.mode.privateBrowsing" = 1;
-
-        # FULLSCREEN NOTICE
-        "full-screen-api.transition-duration.enter" = "0 0";
-        "full-screen-api.transition-duration.leave" = "0 0";
-        "full-screen-api.warning.delay" = -1;
-        "full-screen-api.warning.timeout" = 0;
-
-        # URL BAR
-        "browser.urlbar.suggest.calculator" = true;
-        "browser.urlbar.unitConversion.enabled" = true;
-        "browser.urlbar.trending.featureGate" = false;
-
-        # NEW TAB PAGE
-        "browser.newtabpage.activity-stream.feeds.topsites" = false;
-        "browser.newtabpage.activity-stream.feeds.section.topstories" = false;
-
-        # POCKET
-        "extensions.pocket.enabled" = false;
-
-        # DOWNLOADS
-        "browser.download.always_ask_before_handling_new_types" = true;
-        "browser.download.manager.addToRecentDocs" = false;
-
-        # PDF
-        "browser.download.open_pdf_attachments_inline" = true;
-
-        # TAB BEHAVIOR
-        "browser.bookmarks.openInTabClosesMenu" = false;
-        "browser.menu.showViewImageInfo" = true;
-        "findbar.highlightAll" = true;
-        "layout.word_select.eat_space_to_next_word" = false;
-
-        # SECTION: MY OVERRIDES
-        "browser.startup.homepage" = "https://google.com";
-        "identity.fxaccounts.enabled" = false;
-
-        # SECTION SMOOTHFOX
-        # OPTION: SHARPEN SCROLLING                                                           *
-        "apz.overscroll.enabled" = true; # DEFAULT NON-LINUX
-        "mousewheel.min_line_scroll_amount" = 10; # 10-40; adjust this number to your liking; default=5
-        "general.smoothScroll.mouseWheel.durationMinMS" = 80; # default=50
-        "general.smoothScroll.currentVelocityWeighting" = "0.15"; # default=.25
-        "general.smoothScroll.stopDecelerationWeighting" = "0.6"; # default=.4
-      };
-    };
-  };
-}
@@ -1,3 +0,0 @@
-<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M16 0C7.16 0 0 7.16 0 16C0 23.08 4.58 29.06 10.94 31.18C11.74 31.32 12.04 30.84 12.04 30.42C12.04 30.04 12.02 28.78 12.02 27.44C8 28.18 6.96 26.46 6.64 25.56C6.46 25.1 5.68 23.68 5 23.3C4.44 23 3.64 22.26 4.98 22.24C6.24 22.22 7.14 23.4 7.44 23.88C8.88 26.3 11.18 25.62 12.1 25.2C12.24 24.16 12.66 23.46 13.12 23.06C9.56 22.66 5.84 21.28 5.84 15.16C5.84 13.42 6.46 11.98 7.48 10.86C7.32 10.46 6.76 8.82 7.64 6.62C7.64 6.62 8.98 6.2 12.04 8.26C13.32 7.9 14.68 7.72 16.04 7.72C17.4 7.72 18.76 7.9 20.04 8.26C23.1 6.18 24.44 6.62 24.44 6.62C25.32 8.82 24.76 10.46 24.6 10.86C25.62 11.98 26.24 13.4 26.24 15.16C26.24 21.3 22.5 22.66 18.94 23.06C19.52 23.56 20.02 24.52 20.02 26.02C20.02 28.16 20 29.88 20 30.42C20 30.84 20.3 31.34 21.1 31.18C27.42 29.06 32 23.06 32 16C32 7.16 24.84 0 16 0V0Z" fill="white"/>
-</svg>
@@ -1,99 +0,0 @@
-{ pkgs, ... }:
-{
-  programs.firefox.profiles.richie.search.engines = {
-    "Nix Options" = {
-      urls = [
-        {
-          template = "https://search.nixos.org/options";
-          params = [
-            {
-              name = "type";
-              value = "packages";
-            }
-            {
-              name = "channel";
-              value = "unstable";
-            }
-            {
-              name = "query";
-              value = "{searchTerms}";
-            }
-          ];
-        }
-      ];
-      icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
-      definedAliases = [ "@o" ];
-    };
-    "Nix Packages" = {
-      urls = [
-        {
-          template = "https://search.nixos.org/packages";
-          params = [
-            {
-              name = "type";
-              value = "packages";
-            }
-            {
-              name = "channel";
-              value = "unstable";
-            }
-            {
-              name = "query";
-              value = "{searchTerms}";
-            }
-          ];
-        }
-      ];
-      icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
-      definedAliases = [ "@n" ];
-    };
-    "Nix Packages pr-tracker" = {
-      urls = [
-        {
-          template = "https://nixpk.gs/pr-tracker.html?";
-          params = [
-            {
-              name = "pr";
-              value = "{searchTerms}";
-            }
-          ];
-        }
-      ];
-      icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
-      definedAliases = [ "@nprt" ];
-    };
-    "kagi" = {
-      urls = [
-        {
-          template = "https://kagi.com/search?";
-          params = [
-            {
-              name = "q";
-              value = "{searchTerms}";
-            }
-          ];
-        }
-      ];
-      icon = ./kagi.png;
-    };
-    github = {
-      urls = [
-        {
-          template = "https://github.com/search?";
-          params = [
-            {
-              name = "q";
-              value = "{searchTerms}";
-            }
-            {
-              name = "type";
-              value = "code";
-            }
-          ];
-        }
-      ];
-      icon = ./github.svg;
-      definedAliases = [ "@g" ];
-    };
-  };
-}
@@ -1,9 +1,7 @@
 { pkgs, ... }:
 {
  home.packages = [
-    pkgs.master.claude-code
    pkgs.master.codex
    pkgs.master.opencode
-    pkgs.master.pi-coding-agent
  ];
 }
@@ -3,21 +3,14 @@
  home.packages = with pkgs; [
    # cli
    bat
-    fd
-    ffmpegthumbnailer
    fzf
    git
-    gnupg
-    imagemagick
    jq
    ncdu
    fastfetch
-    ouch
    p7zip
-    poppler
    rar
    unzip
-    yazi
    zoxide
    # Home Assistant
    esphome
@@ -35,8 +28,6 @@
    # python
    ruff
    uv
-    # nodejs
-    nodejs
    # Rust packages
    bacon
    cargo
@@ -51,9 +42,6 @@
    rustfmt
    trunk
    wasm-pack
-    # cpp
-    clang-tools
-    clang_20
    # nix
    nix-init
    nix-output-monitor
@@ -61,6 +49,5 @@
    nix-tree
    nixfmt
    treefmt
-    codebase-memory-mcp
  ];
 }
@@ -1,44 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-in
-{
-
-  users = {
-    users.steve = {
-      isNormalUser = true;
-
-      shell = pkgs.zsh;
-      group = "steve";
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJH03VzDbUhzfhvwD+OsYh6GobODYaI9jdNdzWQoqFsp matth@Jove" # cspell:disable-line
-      ];
-      extraGroups = [
-        "audio"
-        "video"
-        "wheel"
-        "users"
-      ]
-      ++ ifTheyExist [
-        "dialout"
-        "docker"
-        "hass"
-        "libvirtd"
-        "networkmanager"
-        "plugdev"
-        "scanner"
-        "transmission"
-        "uaccess"
-        "wireshark"
-      ];
-      uid = 1005;
-    };
-
-    groups.steve.gid = 1005;
-  };
-  home-manager.users.steve = import ./systems/${config.networking.hostName}.nix;
-}
@@ -1,9 +0,0 @@
-{
-  imports = [
-    ./direnv.nix
-    ./git.nix
-    ./zsh.nix
-  ];
-
-  programs.starship.enable = true;
-}
@@ -1,8 +0,0 @@
-{
-
-  programs.direnv = {
-    enable = true;
-    enableZshIntegration = true;
-    nix-direnv.enable = true;
-  };
-}
@@ -1,15 +0,0 @@
-{
-  programs.git = {
-    enable = true;
-    signing.format = null;
-    settings = {
-      user = {
-        email = "matthew.michal11@gmail.com";
-        name = "Matthew Michal";
-      };
-      pull.rebase = true;
-      color.ui = true;
-    };
-    lfs.enable = true;
-  };
-}
@@ -1,28 +0,0 @@
-{
-  programs.zsh = {
-    enable = true;
-    syntaxHighlighting.enable = true;
-    history.size = 10000;
-    oh-my-zsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "docker"
-        "docker-compose"
-        "colored-man-pages"
-        "rust"
-        "systemd"
-        "tmux"
-        "ufw"
-        "z"
-      ];
-    };
-    shellAliases = {
-      "lrt" = "eza --icons -lsnew";
-      "ls" = "eza";
-      "ll" = "eza --long --group";
-      "la" = "eza --all";
-
-    };
-  };
-}
@@ -1,22 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ./cli
-    ./programs.nix
-    ./ssh_config.nix
-  ];
-
-  programs = {
-    home-manager.enable = true;
-    git.enable = true;
-  };
-
-  home = {
-    username = "steve";
-    homeDirectory = "/home/${config.home.username}";
-    stateVersion = "24.05";
-    sessionVariables = {
-      FLAKE = "$HOME/dotfiles";
-    };
-  };
-}
@@ -1,56 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = with pkgs; [
-    # cli
-    bat
-    btop
-    eza
-    fd
-    ffmpegthumbnailer
-    fzf
-    git
-    gnupg
-    imagemagick
-    jq
-    ncdu
-    ouch
-    p7zip
-    poppler
-    rar
-    ripgrep
-    starship
-    tmux
-    unzip
-    yazi
-    zoxide
-    # system info
-    hwloc
-    lynis
-    pciutils
-    smartmontools
-    usbutils
-    # networking
-    iperf3
-    nmap
-    wget
-    # python
-    ruff
-    uv
-    # nodejs
-    nodejs
-    # Rust packages
-    trunk
-    wasm-pack
-    cargo-watch
-    cargo-generate
-    cargo-audit
-    cargo-update
-    # nix
-    nix-init
-    nix-output-monitor
-    nix-prefetch
-    nix-tree
-    nixfmt
-    treefmt
-  ];
-}
@@ -1,6 +0,0 @@
-{
-  programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
-  };
-}
@@ -1,5 +0,0 @@
-{
-  imports = [
-    ../home/global.nix
-  ];
-}
@@ -1,5 +0,0 @@
-{
-  imports = [
-    ../home/global.nix
-  ];
-}