feat(kanidm): add Kanidm service configuration and documentation

feat(nornsight): remove Norn Sight service and related configurations
feat(secrets): add system tokens for all systems
2026-10-16 21:16:29 -04:00 · 2026-10-16 10:29:06 -04:00 · 2026-10-13 22:11:19 -04:00 · 2026-10-13 21:45:53 -04:00 · 2026-10-13 20:19:41 -04:00 · 2026-10-13 11:50:30 -04:00
94 changed files with 3039 additions and 1173 deletions
@@ -8,8 +8,23 @@ on:
    - cron: "0 22 * * *"

 jobs:
+  prebuild-common:
+    name: prebuild-common-x86-64-v3
+    runs-on: nix-cache-builder
+    steps:
+      - uses: actions/checkout@v4
+      # portal-1 is the smallest system closure: 95% of its derivations are
+      # shared by all five systems, so it is a maintainable common cache seed.
+      # Keep going so one failing package does not stop unrelated cache entries
+      # from being built.
+      - name: Build common packages
+        run: nixos-rebuild build --keep-going --accept-flake-config --flake ./#portal-1
+      - name: Copy common packages to nix-cache
+        run: nix copy --accept-flake-config --to unix:///host-nix/var/nix/daemon-socket/socket .#nixosConfigurations.portal-1.config.system.build.toplevel
+
  build:
    name: build-${{ matrix.system }}
+    needs: prebuild-common
    runs-on: self-hosted
    strategy:
      matrix:
@@ -11,7 +11,7 @@ keys:
  - &system_brain age1jhf7vm0005j60mjq63696frrmjhpy8kpc2d66mw044lqap5mjv4snmwvwm # cspell:disable-line
  - &system_jeeves age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv # cspell:disable-line
  - &system_rhapsody age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4 # cspell:disable-line
-  - &system_portal_1 age1vyav6kxtvt3z4vtnkkjj38eu8hlts5m7ygyckhskvalg2gpjk52su53d0a # cspell:disable-line
+  - &system_portal_1 age1cm7ujz4t9cyc3nyy0w30l2addggk0gy8h3shd9yq47jg845tndnsa3utfl # cspell:disable-line

 creation_rules:
  - path_regex: users/secrets\.yaml$
@@ -23,3 +23,33 @@ creation_rules:
          - *system_jeeves
          - *system_rhapsody
          - *system_portal_1
+
+  - path_regex: systems/bob/secrets\.yaml$
+    key_groups:
+      - age:
+          - *admin_richie
+          - *system_bob
+
+  - path_regex: systems/brain/secrets\.yaml$
+    key_groups:
+      - age:
+          - *admin_richie
+          - *system_brain
+
+  - path_regex: systems/jeeves/secrets\.yaml$
+    key_groups:
+      - age:
+          - *admin_richie
+          - *system_jeeves
+
+  - path_regex: systems/rhapsody-in-green/secrets\.yaml$
+    key_groups:
+      - age:
+          - *admin_richie
+          - *system_rhapsody
+
+  - path_regex: systems/portal-1/secrets\.yaml$
+    key_groups:
+      - age:
+          - *admin_richie
+          - *system_portal_1
@@ -290,6 +290,28 @@ dependencies = [
 "log",
 ]

+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.11"
@@ -381,6 +403,12 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -613,6 +641,16 @@ dependencies = [
 "icu_properties",
 ]

+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.1"
@@ -684,6 +722,12 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
 version = "0.8.3"
@@ -971,6 +1015,19 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"

+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.43"
@@ -1061,6 +1118,15 @@ dependencies = [
 "zmij",
 ]

+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -1079,6 +1145,15 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

+[[package]]
+name = "signal"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "libc",
+ "serde_json",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1091,6 +1166,22 @@ version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"

+[[package]]
+name = "snapshot-manager"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "env_logger",
+ "log",
+ "serde",
+ "signal",
+ "tempfile",
+ "toml",
+ "zfs",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.5"
@@ -1161,6 +1252,19 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.20"
@@ -1230,6 +1334,45 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -1345,6 +1488,7 @@ dependencies = [
 "clap",
 "env_logger",
 "log",
+ "num-traits",
 "reqwest",
 "serde",
 "serde_json",
@@ -1590,6 +1734,18 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
@@ -1679,6 +1835,13 @@ dependencies = [
 "syn 3.0.3",
 ]

+[[package]]
+name = "zfs"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+]
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
@@ -2,3 +2,33 @@
 resolver = "2"

 members = ["rust/*"]
+
+[workspace.dependencies]
+anyhow = "1.0"
+chrono = "0.4"
+clap = "4.5"
+env_logger = "0.11"
+log = "0.4"
+serde = "1.0"
+serde_json = "1.0"
+signal = { path = "rust/signal" }
+zfs = { path = "rust/zfs" }
+
+[workspace.lints.clippy]
+all = { level = "deny", priority = -1 }
+pedantic = { level = "deny", priority = -1 } # UM, ACTUALLY
+nursery = { level = "deny", priority = -1 }  # BETA LINTS
+# DENY PANICS
+unwrap_used = "deny"
+expect_used = "deny"
+indexing_slicing = "deny"
+arithmetic_side_effects = "deny"
+unreachable = "deny"
+unimplemented = "deny"
+unchecked_time_subtraction = "deny"
+todo = "deny"
+string_slice = "deny"
+panic_in_result_fn = "deny"
+panic = "deny"
+exit = "deny"
+as_conversions = "deny"
@@ -0,0 +1,4 @@
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true
+allow-indexing-slicing-in-tests = true
@@ -21,7 +21,7 @@

  boot = {
    tmp.useTmpfs = lib.mkDefault true;
-    kernelPackages = lib.mkDefault pkgs.linuxPackages_6_12;
+    kernelPackages = lib.mkDefault pkgs.linuxPackages_6_18;
  };

  hardware.enableRedistributableFirmware = true;
@@ -1,42 +0,0 @@
-{ pkgs, ... }:
-{
-  boot = {
-    kernelPackages = pkgs.linuxPackages_6_18;
-    zfs.package = pkgs.zfs_2_4;
-  };
-
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-
-  # rtkit is optional but recommended for pipewire
-  security.rtkit.enable = true;
-
-  services = {
-    displayManager.sddm = {
-      enable = true;
-      wayland.enable = true;
-    };
-
-    desktopManager.plasma6.enable = true;
-
-    xserver = {
-      enable = true;
-      xkb = {
-        layout = "us";
-        variant = "";
-      };
-    };
-
-    pulseaudio.enable = false;
-
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      wireplumber.enable = true;
-    };
-  };
-}
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./kde.nix
+    ./pipewire.nix
+  ];
+
+  boot = {
+    kernelPackages = pkgs.linuxPackages_6_18;
+    zfs.package = pkgs.zfs_2_4;
+  };
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+}
@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  environment.plasma6.excludePackages = with pkgs.kdePackages; [
+    aurorae # theme
+    elisa # music player
+    kate # text editor
+    kconfig # config editor
+    khelpcenter # help center
+    kinfocenter # system info
+    konsole # terminal
+    krdp # remote desktop
+    ktexteditor # thing for kate
+    okular # pdf reader
+    plasma-keyboard # used by plasma-keyboard KCM
+    plasma-sdk # plasma development tools
+    plasma-workspace-wallpapers # wallpapers
+    qrca # qr code scanner
+    qtvirtualkeyboard # virtual keyboard
+    union # theme
+  ];
+
+  # disable KDE PIM (Personal Information Management) applications
+  programs.kde-pim.enable = false;
+
+  services = {
+    # removes screen reader and speech dispatcher from the system
+    orca.enable = false;
+    speechd.enable = false;
+
+    displayManager.sddm = {
+      enable = true;
+      wayland.enable = true;
+    };
+
+    desktopManager.plasma6.enable = true;
+
+    xserver = {
+      enable = true;
+      xkb = {
+        layout = "us";
+        variant = "";
+      };
+    };
+  };
+}
@@ -0,0 +1,16 @@
+{
+  # rtkit is optional but recommended for pipewire
+  security.rtkit.enable = true;
+
+  services = {
+    pulseaudio.enable = false;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      wireplumber.enable = true;
+    };
+  };
+}
@@ -1,7 +1,6 @@
 { pkgs, ... }:
 {
  environment.systemPackages = with pkgs; [
-    mangohud
    steam-run
  ];
  hardware.steam-hardware.enable = true;
@@ -1,9 +0,0 @@
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-    gcc = {
-      arch = "x86-64-v3";
-      tune = "generic";
-    };
-  };
-}
@@ -0,0 +1,15 @@
+{
+  nixpkgs = {
+    hostPlatform = {
+      system = "x86_64-linux";
+      gcc = {
+        arch = "x86-64-v3";
+        tune = "generic";
+      };
+    };
+
+    # These patches repair tests and bundled dependencies that are sensitive
+    # to the compiler flags used by the x86-64-v3 package set.
+    overlays = [ (import ./patches) ];
+  };
+}
@@ -0,0 +1,20 @@
+Subject: [PATCH] abseil: include BMI2 intrinsics through the public header
+
+GCC and Clang reject direct inclusion of bmi2intrin.h. Include immintrin.h
+instead so that the compiler supplies the required intrinsic setup when
+BMI2 is enabled, including builds targeting x86-64-v3.
+
+This patch is shared by the vendored Abseil copies in Electron, rusty_v8
+(Deno), and Signal's WebRTC build.
+
+--- a/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
+++ b/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
+@@ -226,7 +226,7 @@
+ #endif
+ 
+ #ifdef __BMI2__
+-#include <bmi2intrin.h>
+#include <immintrin.h>
+ #endif  // __BMI2__
+ 
+ namespace absl {
@@ -0,0 +1,38 @@
+# Abseil accepted the upstream fix: https://github.com/abseil/abseil-cpp/pull/2071
+# Keep this workaround until Electron, Deno's rusty_v8, and Signal's WebRTC
+# update their bundled Abseil copies to include it.
+{ prev }:
+let
+  patchAbseilBmi2Include =
+    package:
+    package.overrideAttrs (old: {
+      # GCC and Clang require the public umbrella header for BMI2 intrinsics.
+      patches = (old.patches or [ ]) ++ [ ./bmi2-public-header.patch ];
+    });
+
+  electron43Unwrapped = patchAbseilBmi2Include prev.electron_43.unwrapped;
+  electron43 = prev.electron_43.override {
+    electron-unwrapped = electron43Unwrapped;
+  };
+
+  signalCallPackage =
+    path: args:
+    let
+      package = prev.callPackage path args;
+    in
+    if builtins.baseNameOf path == "webrtc.nix" then patchAbseilBmi2Include package else package;
+in
+prev.lib.optionalAttrs ((prev.stdenv.hostPlatform.gcc.arch or null) == "x86-64-v3") {
+  deno =
+    let
+      librusty_v8 = patchAbseilBmi2Include prev.deno.passthru.librusty_v8;
+    in
+    prev.deno.override { inherit librusty_v8; };
+
+  electron_43 = electron43;
+
+  signal-desktop = prev.signal-desktop.override {
+    electron_43 = electron43;
+    callPackage = signalCallPackage;
+  };
+}
@@ -0,0 +1,19 @@
+Subject: [PATCH] Compare font content in the overlap-removal regression
+
+PFA_SKIP ends with a separator, producing an empty prefix that matches every
+line. Remove the empty prefix for this test so glyph differences are checked,
+and assert that tx exits successfully before inspecting the output.
+
+--- a/tests/tx_test.py
+++ b/tests/tx_test.py
+@@ -1064,6 +1064,8 @@
+     output_path = get_temp_file_path()
+     args = [TOOL, '-t1', '+V', '-o', output_path, input_path]
+-    subprocess.call(args)
+-    assert differ([expected_path, output_path, '-s', PFA_SKIP[0]])
+    subprocess.check_call(args)
+    # An empty skip prefix matches every line and hides font differences.
+    skip_headers = SPLIT_MARKER.join(filter(None, PFA_SKIP[0].split(SPLIT_MARKER)))
+    assert differ([expected_path, output_path, '-s', skip_headers])
+ 
+ 
@@ -0,0 +1,10 @@
+{ afdko }:
+afdko.overridePythonAttrs (old: {
+  # FMA changes overlap-removal coordinates by 0.01 units on x86-64-v3.
+  # Separate multiply/add rounding reproduces the reference Type 1 font exactly.
+  env = (old.env or { }) // {
+    NIX_CFLAGS_COMPILE = (old.env.NIX_CFLAGS_COMPILE or "") + " -ffp-contract=off";
+  };
+
+  patches = (old.patches or [ ]) ++ [ ./check-overlap-font-content.patch ];
+})
@@ -0,0 +1,16 @@
+_final: prev:
+(import ./abseil { inherit prev; })
+// {
+  gnutls = import ./gnutls { inherit (prev) gnutls; };
+  prometheus = import ./prometheus { inherit (prev) prometheus; };
+  zopfli = import ./zopfli { inherit (prev) zopfli; };
+
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pythonFinal: pythonPrev: {
+      afdko = import ./afdko { inherit (pythonPrev) afdko; };
+      psutil = import ./psutil { inherit (pythonPrev) psutil; };
+      pytest-xdist = import ./pytest-xdist { inherit (pythonPrev) pytest-xdist; };
+      scipy = import ./scipy { inherit (pythonPrev) scipy; };
+    })
+  ];
+}
@@ -0,0 +1,6 @@
+{ gnutls }:
+gnutls.overrideAttrs (old: {
+  # Keep the UDP handshake test enabled on loaded builders by waiting for
+  # the server to bind its socket. Kept as a standalone patch for upstream.
+  patches = (old.patches or [ ]) ++ [ ./udp-server-readiness.patch ];
+})
@@ -0,0 +1,70 @@
+Subject: [PATCH] tests: wait for the UDP server socket before connecting
+
+A fixed four-second sleep does not guarantee that gnutls-serv has bound
+its UDP socket on a busy builder. Poll the local IPv4 UDP endpoint using
+the existing ss/netstat discovery, with the same retry budget as the TCP
+helper. Fail early if the server exits, and retain the original handshake
+checks in serv-udp.sh.
+
+Use flags common to ss and BSD/Linux netstat. Match the local endpoint
+and complete port number, excluding TCP, IPv6-only and peer endpoints.
+
+--- a/tests/scripts/common.sh
+++ b/tests/scripts/common.sh
+@@ -185,10 +185,55 @@
+ 	fi
+ }
+ 
+check_if_udp_port_bound() {
+	local PORT=$1
+	have_port_finder
+	# Use only -an, which is shared by ss and BSD/Linux netstat. UDP has
+	# no LISTEN state. Match the local IPv4 endpoint, not a peer port or
+	# a longer port number. serv-udp.sh connects to 127.0.0.1;
+	# listen_socket() in serv.c binds IPv4 separately and requests
+	# IPV6_V6ONLY=1 for its IPv6 socket.
+	$PFCMD -an | awk -v port="$PORT" '
+		$1 == "udp" || $1 == "udp4" {
+			# ss includes a state column; netstat does not.
+			address = ($2 == "UNCONN" || $2 == "ESTAB") ? $5 : $4
+			if (address ~ ("^[0-9.]+[.:]" port "$") ||
+			    address == "*." port)
+				found = 1
+		}
+		END { exit !found }
+	'
+}
+
+ wait_udp_server() {
+ 	local PID=$1
+	local ret
+ 	trap "test -n \"${PID}\" && kill ${PID};exit 1" 1 15 2
+-	sleep 4
+	local i=0
+	# Use the same retry budget as wait_for_port(), but also stop if the
+	# server exits before binding its socket.
+	while test $i -lt 90; do
+		if ! kill -0 "$PID" 2>/dev/null; then
+			fail "" "UDP server $PID exited before binding port $PORT"
+		fi
+		# Contain have_port_finder's exit so a skip also stops the server.
+		if (check_if_udp_port_bound "$PORT"); then
+			return 0
+		else
+			ret=$?
+			if test "$ret" = 77; then
+				kill "$PID" 2>/dev/null || :
+				wait "$PID" 2>/dev/null || :
+				exit 77
+			fi
+		fi
+		i=$((i + 1))
+		if test $i -lt 90; then
+			echo "try $i: waiting for UDP port $PORT"
+			sleep 2
+		fi
+	done
+	fail "$PID" "UDP server $PORT did not come up"
+ }
+ 
+ create_testdir() {
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Exercise patched common.sh without building GnuTLS (Python standard library only).
+
+Usage: python3 verify-readiness.py /path/to/patched/tests/scripts/common.sh
+Set SHELL to test another shell, and NETSTAT to test a netstat outside PATH.
+"""
+
+# Use unittest so this upstream companion tool needs no pytest installation.
+# ruff: noqa: PT009
+
+import os
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+
+COMMON = str(Path(sys.argv.pop(1)).resolve())
+SHELL = os.environ.get("SHELL", "/bin/sh")
+
+
+class ReadinessTests(unittest.TestCase):
+    """Check endpoint parsing and the server startup lifecycle."""
+
+    def setUp(self) -> None:
+        """Create a socket-listing fixture for each check."""
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.fixture = self.root / "sockets"
+        self.fixture.write_text("")
+        self.finder = self.root / "port-finder"
+        self.finder.write_text('#!/bin/sh\ncat "$SOCKET_FIXTURE"\n')
+        self.finder.chmod(0o755)
+
+    def run_shell(self, body: str, **env: str) -> subprocess.CompletedProcess[str]:
+        """Source the actual helper and run a shell scenario."""
+        return subprocess.run(
+            [SHELL, "-c", '. "$COMMON"\n' + body],
+            env={
+                **os.environ,
+                "COMMON": COMMON,
+                "SOCKET_FIXTURE": str(self.fixture),
+                "PFCMD": str(self.finder),
+                "PORT": "12345",
+                **env,
+            },
+            capture_output=True,
+            text=True,
+            timeout=20,
+            check=False,
+        )
+
+    def test_socket_formats_and_false_matches(self) -> None:
+        """Accept IPv4 UDP local endpoints and reject unrelated sockets."""
+        cases = [
+            ("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*", True),
+            ("udp UNCONN 0 0 127.0.0.1:12345 0.0.0.0:*", True),
+            ("udp 0 0 0.0.0.0:12345 0.0.0.0:*", True),
+            ("udp4 0 0 *.12345 *.*", True),
+            ("udp 0 0 127.0.0.1.12345 *.*", True),
+            ("udp 0 0 *.12345 *.*", True),
+            ("udp UNCONN 0 0 0.0.0.0:123456 0.0.0.0:*", False),
+            ("udp 0 0 0.0.0.0:123456 0.0.0.0:*", False),
+            ("udp ESTAB 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
+            ("udp 0 0 127.0.0.1:54321 127.0.0.1:12345", False),
+            ("tcp LISTEN 0 128 0.0.0.0:12345 0.0.0.0:*", False),
+            ("tcp 0 0 0.0.0.0:12345 0.0.0.0:* LISTEN", False),
+            ("udp UNCONN 0 0 [::]:12345 [::]:*", False),
+            ("udp UNCONN 0 0 *:12345 *:*", False),
+            ("udp6 0 0 :::12345 :::*", False),
+            ("udp6 0 0 *.12345 *.*", False),
+            ("", False),
+        ]
+        for row, ready in cases:
+            with self.subTest(row=row):
+                self.fixture.write_text(row + "\n")
+                result = self.run_shell('check_if_udp_port_bound "$PORT"')
+                self.assertEqual(result.returncode, 0 if ready else 1, result.stderr)
+
+    def test_exited_server_fails_immediately(self) -> None:
+        """Fail without sleeping when the server has already exited."""
+        result = self.run_shell(
+            'true &\npid=$!\nwait "$pid"\nsleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$pid"'
+        )
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("exited before binding", result.stderr)
+        self.assertNotIn("unexpected sleep", result.stderr)
+
+    def test_ready_socket_does_not_sleep(self) -> None:
+        """Check readiness before the first sleep."""
+        self.fixture.write_text("udp UNCONN 0 0 0.0.0.0:12345 0.0.0.0:*\n")
+        result = self.run_shell('sleep() { echo "unexpected sleep" >&2; }\nwait_udp_server "$$"')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertNotIn("unexpected sleep", result.stderr)
+
+    def test_missing_port_finders_skip(self) -> None:
+        """Skip and stop the live server when no finder is available."""
+        # have_port_finder also tries these paths independently of PATH.
+        if any(os.access(f"{directory}/ss", os.X_OK) for directory in ("/sbin", "/usr/sbin", "/usr/local/sbin")):
+            self.skipTest("an absolute ss path cannot be hidden by this PATH-only fixture")
+        with subprocess.Popen(["sleep", "60"]) as server:
+            try:
+                result = self.run_shell(
+                    'unset PFCMD\nPATH=/nonexistent\nwait_udp_server "$SERVER_PID"',
+                    SERVER_PID=str(server.pid),
+                )
+                self.assertEqual(result.returncode, 77)
+                self.assertIn("neither ss nor netstat found", result.stderr)
+                server.wait(timeout=3)
+                self.assertLess(server.returncode, 0)
+            finally:
+                if server.poll() is None:
+                    server.kill()
+
+    def test_timeout_is_bounded_and_cleans_up(self) -> None:
+        """Stop polling after the retry budget and terminate the server."""
+        # Only accelerate the polling delay; keep a real live server process.
+        self.finder.write_text('#!/bin/sh\necho probe >&2\ncat "$SOCKET_FIXTURE"\n')
+        with subprocess.Popen(["sleep", "60"]) as server:
+            try:
+                result = self.run_shell(
+                    'sleep() { echo polling-sleep; }\nwait_udp_server "$SERVER_PID"',
+                    SERVER_PID=str(server.pid),
+                )
+                self.assertEqual(result.returncode, 1)
+                self.assertIn("did not come up", result.stderr)
+                self.assertEqual(result.stderr.count("probe\n"), 90)
+                self.assertEqual(result.stdout.count("polling-sleep"), 89)
+                server.wait(timeout=3)
+                self.assertLess(server.returncode, 0)
+            finally:
+                if server.poll() is None:
+                    server.kill()
+
+    def test_server_exits_while_waiting(self) -> None:
+        """Detect a startup failure that happens after polling begins."""
+        result = self.run_shell('sleep 1 &\npid=$!\nwait_udp_server "$pid"')
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("exited before binding", result.stderr)
+        self.assertIn("waiting for UDP port", result.stdout)
+
+    def test_real_socket_delayed_beyond_four_seconds(self) -> None:
+        """Wait for a real delayed bind with each installed port finder."""
+        finders = [shutil.which("ss"), os.environ.get("NETSTAT") or shutil.which("netstat")]
+        finders = [finder for finder in finders if finder]
+        if not finders:
+            self.skipTest("neither ss nor netstat available")
+        for finder in finders:
+            with self.subTest(finder=finder):
+                with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+                    sock.bind(("127.0.0.1", 0))
+                    port = sock.getsockname()[1]
+                code = (
+                    "import socket,time,sys; time.sleep(6); "
+                    "s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); "
+                    "s.bind(('127.0.0.1',int(sys.argv[1]))); time.sleep(30)"
+                )
+                with subprocess.Popen([sys.executable, "-c", code, str(port)]) as server:
+                    try:
+                        started = time.monotonic()
+                        result = self.run_shell(
+                            'wait_udp_server "$SERVER_PID"',
+                            SERVER_PID=str(server.pid),
+                            PORT=str(port),
+                            PFCMD=finder,
+                        )
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertGreaterEqual(time.monotonic() - started, 6)
+                        self.assertIsNone(server.poll())
+                    finally:
+                        server.terminate()
+                        server.wait(timeout=3)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,36 @@
+Subject: [PATCH] tests: finish parsing before inspecting editor state
+
+EditorState creation has a 20 ms parsing budget. A descheduled test can
+therefore observe an incomplete tree. Finish these small test documents
+without an interactive deadline and publish the result with a transaction.
+Keep the original completion and vector-matching assertions enabled.
+
+--- a/module/codemirror-promql/src/test/utils-test.ts
+++ b/module/codemirror-promql/src/test/utils-test.ts
+@@ -13,7 +13,7 @@
+ 
+ import { parser } from '@prometheus-io/lezer-promql';
+ import { EditorState } from '@codemirror/state';
+-import { LRLanguage } from '@codemirror/language';
+import { ensureSyntaxTree, LRLanguage } from '@codemirror/language';
+ import nock from 'nock';
+ import path from 'path';
+ import { fileURLToPath } from 'url';
+@@ -23,10 +23,16 @@
+ const __dirname = path.dirname(fileURLToPath(import.meta.url));
+ 
+ export function createEditorState(expr: string): EditorState {
+-  return EditorState.create({
+  const state = EditorState.create({
+     doc: expr,
+     extensions: lightPromQLSyntax,
+   });
+  // These tests need a complete tree, independent of the editor's time budget.
+  if (!ensureSyntaxTree(state, state.doc.length, Infinity)) {
+    throw new Error('Unable to parse the test expression');
+  }
+  // Publish the completed parse so syntaxTree(state) sees it too.
+  return state.update({}).state;
+ }
+ 
+ export function mockPrometheusServer(): void {
@@ -0,0 +1,17 @@
+{ prometheus }:
+prometheus.overrideAttrs (
+  old:
+  let
+    assets = old.passthru.assets.overrideAttrs (assetsOld: {
+      patches = (assetsOld.patches or [ ]) ++ [ ./complete-test-parsing.patch ];
+    });
+  in
+  {
+    postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
+      builtins.unsafeDiscardStringContext old.postPatch
+    );
+    passthru = old.passthru // {
+      inherit assets;
+    };
+  }
+)
@@ -0,0 +1,4 @@
+{ psutil }:
+psutil.overridePythonAttrs (old: {
+  patches = (old.patches or [ ]) ++ [ ./heap-info-zero-mmap.patch ];
+})
@@ -0,0 +1,17 @@
+Subject: [PATCH] Allow an empty mmap allocation total in heap_info
+
+The allocator may satisfy all live allocations from the heap. A zero
+mmap_used value is valid and depends on the worker allocation history.
+Keep the heap and platform checks without requiring an mmap allocation.
+
+--- a/tests/test_system.py
+++ b/tests/test_system.py
+@@ -267,6 +267,7 @@
+         if MACOS:
+             assert m.mmap_used == 0  # not supported
+         else:
+-            assert m.mmap_used > 0
+            # A process can have no live mmap-backed malloc allocations.
+            assert m.mmap_used >= 0
+         if WINDOWS:
+             assert m.heap_count >= 0
@@ -0,0 +1,29 @@
+Subject: [PATCH] tests: count replacements when checking the worker restart limit
+
+With two workers, another in-flight test may crash after the fourth
+crash requests shutdown. Either four or five failed tests is valid.
+Require exactly three replacements and the failed-tests exit status,
+while preserving the queued-work and no-internal-error assertions.
+
+--- a/testing/acceptance_test.py
+++ b/testing/acceptance_test.py
+@@ -1011,9 +1011,18 @@
+                 "worker*crashed while running*",
+                 "worker*crashed while running*",
+                 "* xdist: maximum crashed workers reached: 3 *",
+-                "* 4 failed in *",
+             ]
+         )
+        # A second in-flight test may crash after shutdown is requested.
+        # The restart limit constrains replacements, not concurrent failures.
+        replacements = sum(
+            line.startswith("replacing crashed worker ") for line in res.stdout.lines
+        )
+        assert replacements == 3
+        failed = res.parseoutcomes()["failed"]
+        assert failed in (4, 5)
+        res.assert_outcomes(failed=failed)
+        assert res.ret == pytest.ExitCode.TESTS_FAILED
+         assert "INTERNALERROR" not in res.stdout.str()
+ 
+     def test_max_worker_restart_die(self, pytester: pytest.Pytester) -> None:
@@ -0,0 +1,12 @@
+{ pytest-xdist }:
+pytest-xdist.overridePythonAttrs (old: {
+  patches = (old.patches or [ ]) ++ [
+    ./concurrent-worker-crashes.patch
+    ./worker-startup-timeout.patch
+  ];
+
+  # The suite exercises its own worker pools. Limit the outer suite to one worker.
+  preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
+    old.preCheck or ""
+  );
+})
@@ -0,0 +1,19 @@
+Subject: [PATCH] tests: allow more time for remote worker events
+
+Worker startup can exceed ten seconds on heavily loaded builders. Allow
+the remote-test helper to wait up to sixty seconds for worker events.
+The wait still returns as soon as an event arrives and remains bounded.
+Production worker timeouts and test assertions are unchanged.
+
+--- a/testing/test_remote.py
+++ b/testing/test_remote.py
+@@ -17,7 +17,8 @@
+ from xdist.workermanage import WorkerController
+ 
+ 
+-WAIT_TIMEOUT = 10.0
+# Allow worker events extra time on heavily loaded builders.
+WAIT_TIMEOUT = 60.0
+ 
+ 
+ def check_marshallable(d: object) -> None:
@@ -0,0 +1,5 @@
+{ scipy }:
+scipy.overridePythonAttrs (old: {
+  # Keep the STFT tests enabled with tolerances for x86-64-v3 rounding.
+  patches = (old.patches or [ ]) ++ [ ./stft-test-tolerances.patch ];
+})
@@ -0,0 +1,51 @@
+Subject: [PATCH] signal: allow floating-point rounding in STFT tests
+
+Keep the STFT tests enabled for x86-64-v3 builds. Allow two float32
+epsilons of relative error when comparing inverse-STFT implementations;
+float64 and the existing i686 override remain unchanged. Allow one
+float64 epsilon of absolute error in all three scaling round trips,
+which otherwise require exact zeros (observed residual: 4e-17 for a
+signal with amplitude 2).
+
+Upstream issue: https://github.com/scipy/scipy/issues/25488
+
+--- a/scipy/signal/tests/_scipy_spectral_test_shim.py
+++ b/scipy/signal/tests/_scipy_spectral_test_shim.py
+@@ -294,7 +294,7 @@
+ 
+     # Adapted tolerances to account for resolution loss:
+     atol = np.finfo(x.dtype).resolution*2  # instead of default atol = 0
+-    rtol = 1e-7  # default for np.allclose()
+    rtol = max(1e-7, 2 * np.finfo(x.dtype).eps)
+ 
+     # Relax atol on 32-Bit platforms a bit to pass CI tests.
+     #  - Not clear why there are discrepancies (in the FFT maybe?)
+--- a/scipy/signal/tests/test_spectral.py
+++ b/scipy/signal/tests/test_spectral.py
+@@ -2044,7 +2044,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zs, boundary=True, scaling='spectrum')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+         # For a Hann-windowed 256 sample length FFT, we expect a peak at
+         # frequency 64 (since it is 1/4 the length of X) with a height of 1
+@@ -2074,7 +2074,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zp, input_onesided=False, boundary=True, scaling='psd')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+         # The power of the one-sided psd-scaled STFT can be determined
+         # analogously (note that the two sides are not of equal shape):
+@@ -2094,7 +2094,7 @@
+ 
+         # Test round trip:
+         x1 = istft(Zp0, input_onesided=True, boundary=True, scaling='psd')[1]
+-        assert_allclose(x1, x)
+        assert_allclose(x1, x, atol=np.finfo(x.dtype).eps)
+ 
+ 
+ class TestSampledSpectralRepresentations:
@@ -0,0 +1,4 @@
+{ zopfli }:
+zopfli.overrideAttrs (old: {
+  patches = (old.patches or [ ]) ++ [ ./unaligned-match-loads.patch ];
+})
@@ -0,0 +1,32 @@
+Subject: [PATCH] Read unaligned match buffers with memcpy
+
+Byte buffers need not satisfy integer alignment or aliasing requirements.
+GCC 16 with x86-64-v3 vectorizes the cast loads using aligned AVX reads,
+causing a segmentation fault. Copy into local integers instead.
+
+--- a/src/zopfli/lz77.c
+++ b/src/zopfli/lz77.c
+@@ -302,13 +302,20 @@
+   if (sizeof(size_t) == 8) {
+     /* 8 checks at once per array bounds check (size_t is 64-bit). */
+-    while (scan < safe_end && *((size_t*)scan) == *((size_t*)match)) {
+    while (scan < safe_end) {
+      size_t scan_word, match_word;
+      memcpy(&scan_word, scan, sizeof(scan_word));
+      memcpy(&match_word, match, sizeof(match_word));
+      if (scan_word != match_word) break;
+       scan += 8;
+       match += 8;
+     }
+   } else if (sizeof(unsigned int) == 4) {
+     /* 4 checks at once per array bounds check (unsigned int is 32-bit). */
+-    while (scan < safe_end
+-        && *((unsigned int*)scan) == *((unsigned int*)match)) {
+    while (scan < safe_end) {
+      unsigned int scan_word, match_word;
+      memcpy(&scan_word, scan, sizeof(scan_word));
+      memcpy(&match_word, match, sizeof(match_word));
+      if (scan_word != match_word) break;
+       scan += 4;
+       match += 4;
+     }
@@ -1,5 +1,4 @@
 {
-  inputs,
  lib,
  pkgs,
  ...
@@ -15,7 +14,6 @@
  services = {
    snapshot_manager = {
      enable = lib.mkDefault true;
-      PYTHONPATH = "${inputs.self}/";
    };

    zfs = {
@@ -1,5 +1,4 @@
 {
-  inputs,
  pkgs,
  lib,
  config,
@@ -7,23 +6,18 @@
 }:
 let
  cfg = config.services.snapshot_manager;
-  snapshotManagerPackages = ps: with ps; [ typer ];
+  snapshotManager = pkgs.callPackage ../../../rust/snapshot_manager/package.nix { };
 in
 {
  options = {
    services.snapshot_manager = {
      enable = lib.mkEnableOption "ZFS snapshot manager";
+      signalAlerts = lib.mkEnableOption "Signal failure alerts for the snapshot manager";
      path = lib.mkOption {
        type = lib.types.path;
        default = ./snapshot_config.toml;
        description = "Path to the snapshot_manager TOML config.";
      };
-      PYTHONPATH = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          the PYTHONPATH to use for the snapshot_manager service.
-        '';
-      };
      EnvironmentFile = lib.mkOption {
        type = lib.types.nullOr (lib.types.coercedTo lib.types.path toString lib.types.str);
        default = null;
@@ -36,40 +30,7 @@ in
  };

  config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [
-      (final: _prev: {
-        snapshot_manager_python = final.python314.withPackages snapshotManagerPackages;
-        snapshot_manager_test_python = final.python314.withPackages (
-          ps:
-          snapshotManagerPackages ps
-          ++ (with ps; [
-            pyfakefs
-            pytest
-            pytest-asyncio
-            pytest-mock
-            pytest-xdist
-          ])
-        );
-        snapshot_manager_tests =
-          final.runCommand "snapshot-manager-tests"
-            {
-              nativeBuildInputs = [ final.snapshot_manager_test_python ];
-            }
-            ''
-              export HOME="$TMPDIR"
-              cd ${inputs.self}
-              pytest \
-                -o cache_dir="$TMPDIR/pytest-cache" \
-                tests/test_common.py \
-                tests/test_signal_alert.py \
-                tests/test_snapshot_manager.py \
-                tests/test_zfs.py
-              touch "$out"
-            '';
-      })
-    ];
-
-    system.checks = [ pkgs.snapshot_manager_tests ];
+    system.checks = [ snapshotManager ];

    systemd = {
      services.snapshot_manager = {
@@ -77,12 +38,9 @@ in
        requires = [ "zfs-import.target" ];
        after = [ "zfs-import.target" ];
        path = [ pkgs.zfs ];
-        environment = {
-          PYTHONPATH = cfg.PYTHONPATH;
-        };
        serviceConfig = {
          Type = "oneshot";
-          ExecStart = "${pkgs.snapshot_manager_python}/bin/python -m python.tools.snapshot_manager ${lib.escapeShellArg cfg.path}";
+          ExecStart = "${snapshotManager}/bin/snapshot-manager ${lib.escapeShellArg cfg.path} --signal-alerts ${lib.boolToString cfg.signalAlerts}";
        }
        // lib.optionalAttrs (cfg.EnvironmentFile != null) {
          EnvironmentFile = cfg.EnvironmentFile;
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1789770686,
+        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
        "type": "github"
      },
      "original": {
@@ -20,6 +20,24 @@
        "type": "github"
      }
    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -27,11 +45,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788651960,
-        "narHash": "sha256-v9wJd32eZ2bvhBzVOd7TIjLQd011P7nwOhjKtWlci5I=",
+        "lastModified": 1791293500,
+        "narHash": "sha256-3hwJd2/vG/VYV1P/g7oDgdbNsWODhN5F//Od+hPMm2k=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2c0350c759688177331b8f5242311fae8877bdb3",
+        "rev": "0e11b7bcba1d74ef8ea10bfdfb1e1a5811a21087",
        "type": "github"
      },
      "original": {
@@ -40,16 +58,38 @@
        "type": "github"
      }
    },
+    "jellyswarrm": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1791127101,
+        "narHash": "sha256-SmrBBhcv9iNHA2vlafi7Zpe8bkcsMjVNSmCCVf5/jrQ=",
+        "owner": "LLukas22",
+        "repo": "Jellyswarrm",
+        "rev": "0b4301c6c74efff9c3634296913032579c98faf6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LLukas22",
+        "repo": "Jellyswarrm",
+        "type": "github"
+      }
+    },
    "nixos-hardware": {
      "inputs": {
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1788860136,
-        "narHash": "sha256-MhPMOFV4pVkygWEbQ8t1De/uQ9cWF1u++tRe2L5tG48=",
+        "lastModified": 1791128201,
+        "narHash": "sha256-rlsYY/Dg/LhbIj51Aa6TLvRpZeb3KZgUTd7llQ5XcJE=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "62173785b9a18c78b4a15aca2623d02bceb9d077",
+        "rev": "31cc5f4d9b9ba601071e8b8504601b9b176e2756",
        "type": "github"
      },
      "original": {
@@ -61,11 +101,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -74,11 +114,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1788892992,
-        "narHash": "sha256-cIMFh9gyU4/aLeB3JCcsWM3tTAvD9pAq9Smr1Wa8aIU=",
+        "lastModified": 1791296764,
+        "narHash": "sha256-N2b6Uxdr1MFhscEPqDyntTTtGZASgq3XYE0ujRzfeNI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "dff6994123e257ec9901c271bc2b52e64d7c8f05",
+        "rev": "a15afac8691bd24f746255ffbd76306693e4cf7a",
        "type": "github"
      },
      "original": {
@@ -106,11 +146,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1788752844,
-        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
+        "lastModified": 1791260994,
+        "narHash": "sha256-Miqqk/ammqnTUxaoCyvtwoPeLbI1ksFyLxi/CazZpWY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
+        "rev": "151fa4e8ddfdd8dd25d945ad94ed54a13de9f6e4",
        "type": "github"
      },
      "original": {
@@ -124,12 +164,34 @@
      "inputs": {
        "disko": "disko",
        "home-manager": "home-manager",
+        "jellyswarrm": "jellyswarrm",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-master": "nixpkgs-master",
        "nixpkgs-stable": "nixpkgs-stable",
        "sops-nix": "sops-nix",
-        "systems": "systems"
+        "systems": "systems_2"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "jellyswarrm",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779419951,
+        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    },
    "sops-nix": {
@@ -139,11 +201,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788337237,
-        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
+        "lastModified": 1791103873,
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
        "type": "github"
      },
      "original": {
@@ -153,6 +215,21 @@
      }
    },
    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
      "locked": {
        "lastModified": 1689347949,
        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -21,6 +21,11 @@

    nixos-hardware.url = "github:nixos/nixos-hardware/master";

+    jellyswarrm = {
+      url = "github:LLukas22/Jellyswarrm";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -1,13 +1,13 @@
 { inputs, ... }:
 {
-  # When applied, the stable nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.stable'
+  # Additional package sets are accessible through `pkgs.<name>`.
  stable = final: _prev: {
    stable = import inputs.nixpkgs-stable {
      system = final.stdenv.hostPlatform.system;
      config.allowUnfree = true;
    };
  };
-  # When applied, the master nixpkgs set (declared in the flake inputs) will be accessible through 'pkgs.master'
+
  master = final: _prev: {
    master = import inputs.nixpkgs-master {
      system = final.stdenv.hostPlatform.system;
@@ -15,6 +15,12 @@
    };
  };

-  test-exclusions = import ./test-exclusions.nix;
-  x86-64-v3-workarounds = import ./x86-64-v3-workarounds.nix;
+  # Baseline x86-64 (v1) packages for prebuilt applications that should not
+  # inherit an x86-64-v3 host platform.
+  x86-v1 = final: _prev: {
+    x86-v1 = import inputs.nixpkgs {
+      system = final.stdenv.hostPlatform.system;
+      config.allowUnfree = true;
+    };
+  };
 }
@@ -1,133 +0,0 @@
-# Test exclusions for the locally rebuilt x86-64-v3 package set.
-#
-# Selecting x86-64-v3 changes every affected derivation, so the normal
-# nixpkgs binary cache cannot be used and upstream test suites run locally.
-# The jeeves builder uses /tmp/nix-builds so filesystem tests run on tmpfs
-# instead of ZFS with normalization=formD and utf8only=on; those tests remain
-# enabled. The remaining workarounds cover UDP readiness, resource-sensitive
-# parser and nested-worker races, and mismatched timeout clocks, plus
-# architecture-dependent floating-point differences whose risk we accept for
-# our workloads. Keep these exceptions visible until their causes are fixed.
-_final: prev: {
-  gnutls = prev.gnutls.overrideAttrs (old: {
-    # This test uses a fixed four-second sleep instead of checking UDP
-    # readiness; the client saw no listener in the x86-64-v3 build.
-    postPatch = (old.postPatch or "") + ''
-      sed '2iexit 77' -i tests/serv-udp.sh
-    '';
-  });
-
-  prometheus = prev.prometheus.overrideAttrs (
-    old:
-    let
-      assets = old.passthru.assets.overrideAttrs (assetsOld: {
-        # CodeMirror's bounded synchronous parser can return an incomplete tree
-        # when these cases run on a heavily loaded builder.
-        postPatch = (assetsOld.postPatch or "") + ''
-          substituteInPlace module/codemirror-promql/src/complete/hybrid.test.ts \
-            --replace-fail "it(value.title, () => {" \
-            "(value.title === 'autocomplete topk params 2' ? it.skip : it)(value.title, () => {"
-          substituteInPlace module/codemirror-promql/src/parser/vector.test.ts \
-            --replace-fail "it(value.binaryExpr, () => {" \
-            "(value.binaryExpr === 'foo * on(test,blub) bar' ? it.skip : it)(value.binaryExpr, () => {"
-        '';
-      });
-    in
-    {
-      postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
-        builtins.unsafeDiscardStringContext old.postPatch
-      );
-      passthru = old.passthru // {
-        inherit assets;
-      };
-    }
-  );
-
-  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-    (_pythonFinal: pythonPrev: {
-      backrefs = pythonPrev.backrefs.overridePythonAttrs (old: {
-        # regex measures its timeout in process CPU time, while this test used
-        # wall time and could miss the timeout when a busy builder descheduled it.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace tests/test_bregex.py \
-            --replace-fail "time.time()" "time.process_time()"
-        '';
-      });
-
-      pytest-xdist = pythonPrev.pytest-xdist.overridePythonAttrs (old: {
-        # The suite exercises its own worker pools. Run the outer suite with one
-        # worker and allow inner workers more time on heavily loaded builders.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace testing/test_remote.py \
-            --replace-fail "WAIT_TIMEOUT = 10.0" "WAIT_TIMEOUT = 60.0"
-        '';
-        preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
-          old.preCheck or ""
-        );
-        # This test deliberately crashes workers past the restart limit and
-        # races while checking which replacement message was emitted.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_max_worker_restart_tests_queued"
-        ];
-      });
-
-      jupyter-server = pythonPrev.jupyter-server.overridePythonAttrs (old: {
-        # The kernel reply arrived after the one-second outer deadline when the
-        # builder was heavily loaded. Keep the regression test but allow it the
-        # same margin as the other resource-sensitive tests.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace tests/services/kernels/test_connection.py \
-            --replace-fail \
-            "await asyncio.wait_for(asyncio.wrap_future(conn2.request_kernel_info()), timeout=1.0)" \
-            "await asyncio.wait_for(asyncio.wrap_future(conn2.request_kernel_info()), timeout=10.0)"
-        '';
-      });
-
-      scipy = pythonPrev.scipy.overridePythonAttrs (old: {
-        # x86-64-v3 FFT implementations produce rounding differences outside
-        # these tests' strict tolerances. We accept the numerical-precision
-        # risk for our workloads.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_roundtrip_float32"
-          "test_roundtrip_scaling"
-        ];
-      });
-
-      sentry-sdk = pythonPrev.sentry-sdk.overridePythonAttrs (old: {
-        # This test globally mocks threading.current_thread while another
-        # thread is running. On Python 3.14, Thread.join can race with that
-        # mock and exhaust its single side effect before the worker removes it.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_get_current_thread_meta_main_thread"
-        ];
-      });
-
-      torchaudio = pythonPrev.torchaudio.overridePythonAttrs (old: {
-        # x86-64-v3 pitch shifting produces batch-versus-single-item numerical
-        # differences up to 2.9e-6. We accept that audio-precision risk for our
-        # workloads.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_batch_pitch_shift"
-        ];
-      });
-
-      torchcodec = pythonPrev.torchcodec.overridePythonAttrs (old: {
-        # For these 8 kHz MP3 cases, the x86-64-v3 API and CLI codec paths
-        # differ in 0.8% of decoded samples. Retain the original tolerance for
-        # 99% of samples and accept the localized audio-precision risk.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace test/test_encoders.py \
-            --replace-fail \
-            'if sys.platform == "darwin":' \
-            'if sys.platform == "darwin" or (
-                format == "mp3"
-                and sample_rate == 8_000
-                and asset is SINE_MONO_S32
-                and bit_rate in (None, 0)
-                and num_channels in (None, 1)
-            ):'
-        '';
-      });
-    })
-  ];
-}
@@ -1,60 +0,0 @@
-# Compatibility fixes for packages rebuilt with x86-64-v3.
-#
-# The v3 baseline enables instructions that expose source assumptions hidden
-# by the generic x86-64 build. Keep compile fixes here, separate from test
-# exclusions, until upstream or nixpkgs incorporates them.
-_final: prev:
-let
-  patchAbseilBmi2Include =
-    package:
-    package.overrideAttrs (old: {
-      # GCC and Clang prohibit including their internal BMI2 header directly.
-      # The public umbrella provides the same intrinsics with the required
-      # compiler setup.
-      postPatch = (old.postPatch or "") + ''
-        substituteInPlace third_party/abseil-cpp/absl/container/internal/raw_hash_set.h \
-          --replace-fail "#include <bmi2intrin.h>" "#include <immintrin.h>"
-      '';
-    });
-
-  removeSiblingOutputChecks =
-    package:
-    package.overrideAttrs (old: {
-      # Nix 2.34 can validate a partial multi-output rebuild against only the
-      # outputs still being realised. PostgreSQL's checks then reject valid
-      # sibling names such as "out" and "lib". Keep the test suite and
-      # disallowed-requisite checks; accept the loss of cross-output checks.
-      outputChecks = builtins.mapAttrs (
-        _output: checks: builtins.removeAttrs checks [ "disallowedReferences" ]
-      ) (old.outputChecks or { });
-    });
-
-  electron43Unwrapped = patchAbseilBmi2Include prev.electron_43.unwrapped;
-  electron43 = prev.electron_43.override {
-    electron-unwrapped = electron43Unwrapped;
-  };
-
-  signalCallPackage =
-    path: args:
-    let
-      package = prev.callPackage path args;
-    in
-    if builtins.baseNameOf path == "webrtc.nix" then patchAbseilBmi2Include package else package;
-in
-prev.lib.optionalAttrs ((prev.stdenv.hostPlatform.gcc.arch or null) == "x86-64-v3") {
-  deno =
-    let
-      librusty_v8 = patchAbseilBmi2Include prev.deno.passthru.librusty_v8;
-    in
-    prev.deno.override { inherit librusty_v8; };
-
-  electron_43 = electron43;
-
-  postgresql = removeSiblingOutputChecks prev.postgresql;
-  postgresql_18 = removeSiblingOutputChecks prev.postgresql_18;
-
-  signal-desktop = prev.signal-desktop.override {
-    electron_43 = electron43;
-    callPackage = signalCallPackage;
-  };
-}
@@ -1,77 +0,0 @@
-# Ebook Search Docker
-
-Run the EPUB search app against the existing Postgres database on `jeeves`:
-
-```sh
-python -m python.ebook_search.docker.containers start --library-path /path/to/epubs --build
-```
-
-All ebook-search Docker files live in this directory:
-
- `Dockerfile` — multi-stage: `test` (runs pytest) and `runtime` (default target, the app image)
- `docker-compose.yml`
- `containers.py` — Typer lifecycle CLI
- `pyproject.toml` / `uv.lock` — the container's uv-locked dependencies
-
-The app listens on `http://localhost:8070`.
-
-Useful lifecycle commands:
-
-```sh
-python -m python.ebook_search.docker.containers build
-python -m python.ebook_search.docker.containers start --library-path /path/to/epubs
-python -m python.ebook_search.docker.containers test
-python -m python.ebook_search.docker.containers logs
-python -m python.ebook_search.docker.containers ps
-python -m python.ebook_search.docker.containers stop
-```
-
-Direct compose usage from the repo root:
-
-```sh
-docker compose -f python/ebook_search/docker/docker-compose.yml ps
-```
-
-## Dependencies
-
-The image builds its environment with uv from `pyproject.toml` + `uv.lock` in this
-directory — this is the source of truth for the container's dependencies. To add or
-update a dependency, edit `pyproject.toml` here and regenerate the lock (uv is
-available in the `ebook-search` dev shell):
-
-```sh
-nix develop .#ebook-search -c uv lock --project python/ebook_search/docker
-```
-
-## Tests
-
-The main pytest suite excludes `tests/ebook_search` (its dependencies are no longer
-in the nix dev shell). The `test ebook search` CI workflow runs them in a uv env
-built from the lockfile in this directory — same commands work locally from the
-repo root (the `--override-ini` drops the main suite's ignore):
-
-```sh
-uv sync --locked --project python/ebook_search/docker
-uv run --project python/ebook_search/docker --no-sync pytest tests/ebook_search --override-ini addopts="-n auto -ra"
-```
-
-They can also run inside the Docker `test` image, which validates the image itself:
-
-```sh
-python -m python.ebook_search.docker.containers test
-```
-
-or the raw docker equivalent:
-
-```sh
-docker build --file python/ebook_search/docker/Dockerfile --target test --tag ebook-search:test .
-docker run --rm ebook-search:test
-```
-
-## Configuration
-
-The compose service loads the repo root `.env` into the container via `env_file`.
-
-Mount your EPUB directory by setting `EBOOK_LIBRARY_HOST_PATH` in an env file or on the command line. The container sees it as `/library`, and `EBOOK_SEARCH_LIBRARY_PATHS` is set to `/library` inside the container.
-
-Database connection settings are controlled by `RICHIE_DB`, `RICHIE_HOST`, `RICHIE_PORT`, `RICHIE_USER`, and `RICHIE_PASSWORD`. The default host is `jeeves`.
@@ -1,54 +0,0 @@
-# Gems
-
-Gems is a server-rendered, turn-based resource-engine game for one to four human or AI players. It uses FastAPI,
-Jinja, HTMX, server-sent events, and SQLite.
-
-The application deliberately contains no playable card deck, patron/governor set, objective set, official artwork,
-or copied rulebook text. A room host must upload a content pack they are entitled to use before starting a game.
-
-## Run locally
-
-```shell
-uv run gems --host 127.0.0.1 --port 8082
-```
-
-The default database and installation key are created under `.gems/`. The following environment variables override
-runtime behavior:
-
- `GEMS_DATABASE_PATH`
- `GEMS_KEY_PATH`
- `GEMS_PUBLIC_ORIGIN`
- `GEMS_SECURE_COOKIES`
- `GEMS_HOST`
- `GEMS_PORT`
-
-## Content packs
-
-The current schema is available from a running server at `/schemas/content-pack-v1.json`. A pack defines exactly
-five normal resources, one wild resource, cards, and optional patrons, objectives, and outposts. `patrons` is the
-canonical field name; `governors` is accepted as an input alias.
-
-Cards may use only the built-in, bounded effect vocabulary:
-
- `none`
- `virtual_wild`
- `copy_bonus`
- `copy_and_claim`
- `multi_bonus`
- `claim_free`
- an optional discard-cards alternate cost
-
-Unknown fields, resource references, executable expressions, HTML, artwork URLs, and files larger than 512 KiB are
-rejected. The normalized pack is private to its room and becomes immutable when play starts.
-
-## Neutral module mapping
-
-Gems calls the four optional mechanics Objectives, Outposts, Eastern Decks, and Fortifications. Lobby presets combine
-these mechanics into the familiar base, objective-race, objective-plus-outpost, eastern-plus-fortification, and
-all-module configurations. Component identities and values always come from the uploaded pack.
-
-## Jeeves
-
-The NixOS module runs one Uvicorn worker on `127.0.0.1:8002`, stores state in
-`/zfs/media/services/gems`, and publishes it through HAProxy at `https://gems.tmmworkshop.com`. The DNS record must
-point to Jeeves before ACME can issue the certificate.
@@ -5,23 +5,28 @@ from __future__ import annotations
 import json
 import logging
 import socket
-from os import getenv

 logger = logging.getLogger(__name__)


-def signal_alert(body: str) -> None:
-    """Send a signal alert.
+class SignalRPCError(RuntimeError):
+    """signal-cli returned an error or closed without responding."""
+
+
+def signal_alert(body: str, from_phone: str, to_phone: str, *, timeout: float = 4.0) -> None:
+    """Send a Signal alert through the local signal-cli daemon.

    Args:
-        body (str): The body of the alert.
-    """
-    from_phone = getenv("SIGNAL_ALERT_FROM_PHONE")
-    to_phone = getenv("SIGNAL_ALERT_TO_PHONE")
-    if not from_phone or not to_phone:
-        logger.info("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
-        return
+        body: The body of the alert.
+        from_phone: The Signal account sending the alert.
+        to_phone: The Signal account receiving the alert.
+        timeout: Seconds to wait on each socket operation.

+    Raises:
+        SignalRPCError: If signal-cli returns an error or closes the
+            connection before responding.
+        OSError: If the socket is unreachable or an operation times out.
+    """
    signal_rpc_id = "signal-alert"
    request = {
        "jsonrpc": "2.0",
@@ -36,7 +41,7 @@ def signal_alert(body: str) -> None:

    try:
        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-            client.settimeout(4.0)
+            client.settimeout(timeout)
            client.connect("/run/signal-cli/socket")
            client.sendall(json.dumps(request).encode() + b"\n")

@@ -46,11 +51,14 @@ def signal_alert(body: str) -> None:
                while b"\n" in buffer:
                    line, buffer = buffer.split(b"\n", maxsplit=1)
                    response = json.loads(line)
-                    if response.get("id") == signal_rpc_id:
-                        if error := response.get("error"):
-                            logger.error("Signal RPC returned an error: %s", error)
-                        return
-
-            logger.error("Signal RPC socket closed before returning a response")
-    except OSError, json.JSONDecodeError:
-        logger.exception("Unable to communicate with signal-cli")
+                    if response.get("id") != signal_rpc_id:
+                        continue
+                    if rpc_error := response.get("error"):
+                        error = f"Signal RPC returned an error: {rpc_error}"
+                        raise SignalRPCError(error)
+                    return
+            error = "Signal RPC socket closed before returning a response"
+            raise SignalRPCError(error)
+    except (OSError, json.JSONDecodeError) as exc:
+        error = f"Signal RPC failed: {exc!r}"
+        raise SignalRPCError(error) from exc
@@ -1,147 +0,0 @@
-"""snapshot_manager."""
-
-from __future__ import annotations
-
-import logging
-import sys
-import tomllib
-from functools import cache
-from pathlib import Path  # noqa: TC003 This is required for the typer CLI
-from re import compile as re_compile
-from re import search
-
-import typer
-
-from python.common import configure_logger, utcnow
-from python.signal_alert import signal_alert
-from python.zfs import Dataset, get_datasets
-
-logger = logging.getLogger(__name__)
-
-
-def main(config_file: Path) -> None:
-    """Main."""
-    configure_logger(level="DEBUG")
-    logger.info("Starting snapshot_manager")
-
-    try:
-        time_stamp = get_time_stamp()
-
-        for dataset in get_datasets():
-            status = dataset.create_snapshot(time_stamp)
-            logger.debug(f"{status=}")
-            if status != "snapshot created":
-                msg = f"{dataset.name} failed to create snapshot {time_stamp}"
-                logger.error(msg)
-                signal_alert(msg)
-                continue
-            count_lookup = get_count_lookup(config_file, dataset.name)
-            logger.info(f"using {count_lookup} for {dataset.name}")
-            get_snapshots_to_delete(dataset, count_lookup)
-    except Exception:
-        logger.exception("snapshot_manager failed")
-        signal_alert("snapshot_manager failed")
-        sys.exit(1)
-    else:
-        logger.info("snapshot_manager completed")
-
-
-def get_count_lookup(config_file: Path, dataset_name: str) -> dict[str, int]:
-    """Get the count lookup.
-
-    Args:
-        config_file (Path): The path to the configuration file.
-        dataset_name (str): The name of the dataset.
-
-    Returns:
-        dict[str, int]: The count lookup.
-    """
-    config_data = load_config_data(config_file)
-
-    return config_data.get(dataset_name, get_default_config(config_data))
-
-
-def get_default_config(config_data: dict[str, dict[str, int]]) -> dict[str, int]:
-    """Get the default configuration.
-
-    Args:
-        config_data (dict[str, dict[str, int]]): The configuration data.
-
-    Returns:
-        dict[str, int]: The default configuration.
-    """
-    return config_data.get(
-        "default",
-        {"15_min": 4, "hourly": 12, "daily": 0, "monthly": 0},
-    )
-
-
-@cache
-def load_config_data(config_file: Path) -> dict[str, dict[str, int]]:
-    """Load a TOML configuration file.
-
-    Args:
-        config_file (Path): The path to the configuration file.
-
-    Returns:
-        dict: The configuration data.
-    """
-    return tomllib.loads(config_file.read_text())
-
-
-def get_snapshots_to_delete(
-    dataset: Dataset,
-    count_lookup: dict[str, int],
-) -> None:
-    """Get snapshots to delete.
-
-    Args:
-        dataset (Dataset): the dataset
-        count_lookup (dict[str, int]): the count lookup
-    """
-    snapshots = dataset.get_snapshots()
-
-    logger.info(f"calculating snapshots for {dataset.name} to be deleted")
-    if not snapshots:
-        logger.info(f"{dataset.name} has no snapshots")
-        return
-
-    filters = (
-        ("15_min", re_compile(r"auto_\d{10}(?:15|30|45)")),
-        ("hourly", re_compile(r"auto_\d{8}(?!00)\d{2}00")),
-        ("daily", re_compile(r"auto_\d{6}(?!01)\d{2}0000")),
-        ("monthly", re_compile(r"auto_\d{6}010000")),
-    )
-
-    for filter_name, snapshot_filter in filters:
-        logger.debug(f"{filter_name=}\n{snapshot_filter=}")
-
-        filtered_snapshots = sorted(snapshot.name for snapshot in snapshots if search(snapshot_filter, snapshot.name))
-
-        logger.debug(f"{filtered_snapshots=}")
-
-        snapshots_wanted = count_lookup[filter_name]
-        snapshots_being_deleted = filtered_snapshots[:-snapshots_wanted] if snapshots_wanted > 0 else filtered_snapshots
-
-        logger.info(f"{snapshots_being_deleted} are being deleted")
-        for snapshot in snapshots_being_deleted:
-            if error := dataset.delete_snapshot(snapshot):
-                error_message = f"{dataset.name}@{snapshot} failed to delete: {error}"
-                signal_alert(error_message)
-                logger.error(error_message)
-
-
-def get_time_stamp() -> str:
-    """Get the time stamp."""
-    now = utcnow()
-    nearest_15_min = now.replace(minute=(now.minute - (now.minute % 15)))
-    return nearest_15_min.strftime("auto_%Y%m%d%H%M")
-
-
-def cli() -> None:
-    """CLI."""
-    typer.run(main)
-
-
-if __name__ == "__main__":
-    cli()
@@ -0,0 +1,10 @@
+{ lib }:
+lib.fileset.toSource {
+  root = ../.;
+  fileset = lib.fileset.unions [
+    ../Cargo.toml
+    ../Cargo.lock
+    ../clippy.toml
+    ./.
+  ];
+}
@@ -0,0 +1,17 @@
+[package]
+name = "signal"
+version = "0.1.0"
+edition = "2024"
+description = "Send Signal alerts through the local signal-cli JSON-RPC daemon"
+license = "MIT"
+publish = false
+
+[dependencies]
+anyhow.workspace = true
+serde_json.workspace = true
+
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+libc = "0.2"
+
+[lints]
+workspace = true
@@ -0,0 +1,78 @@
+//! Send alerts through the local signal-cli daemon on Unix systems.
+//!
+//! ```no_run
+//! use signal::Signal;
+//!
+//! let client = Signal {
+//!     from_phone: "+15555550100".into(),
+//! };
+//! client.send("+15555550101", "Service failed")?;
+//! client.send("+15555550102", "Service recovered")?;
+//! # Ok::<(), anyhow::Error>(())
+//! ```
+
+use std::{
+    io::{BufRead, BufReader, Write},
+    os::unix::net::UnixStream,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail};
+use serde_json::{Value, json};
+
+/// A sending account for alerts through `/run/signal-cli/socket`.
+pub struct Signal {
+    /// The phone number of an account registered with the local daemon.
+    pub from_phone: String,
+}
+
+impl Signal {
+    /// Send a message to `to_phone` and wait for the corresponding JSON-RPC response.
+    ///
+    /// Socket reads and writes use a four-second timeout.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if connecting, writing, or reading fails, the daemon
+    /// returns invalid JSON or an RPC error, or it closes before responding.
+    pub fn send(&self, to_phone: &str, body: &str) -> Result<()> {
+        let mut stream = UnixStream::connect("/run/signal-cli/socket")
+            .context("Failed to connect to Signal RPC socket")?;
+        let timeout = Duration::from_secs(4);
+        stream.set_read_timeout(Some(timeout))?;
+        stream.set_write_timeout(Some(timeout))?;
+        let request = json!({
+            "jsonrpc": "2.0",
+            "method": "send",
+            "params": {
+                "account": self.from_phone,
+                "recipient": [to_phone],
+                "message": body,
+            },
+            "id": "signal-alert",
+        });
+        writeln!(stream, "{request}").context("Failed to send Signal RPC request")?;
+        let mut reader = BufReader::new(stream);
+        let mut line = String::new();
+        loop {
+            line.clear();
+            if reader
+                .read_line(&mut line)
+                .context("Failed to read Signal RPC response")?
+                == 0
+                || !line.ends_with('\n')
+            {
+                bail!("Signal RPC socket closed before returning a response");
+            }
+            let response: Value =
+                serde_json::from_str(&line).context("Invalid Signal RPC response")?;
+            if response.get("id").and_then(Value::as_str) != Some("signal-alert") {
+                continue;
+            }
+            if let Some(error) = response.get("error").filter(|value| !value.is_null()) {
+                bail!("Signal RPC returned an error: {error}");
+            }
+            return Ok(());
+        }
+    }
+}
@@ -0,0 +1,147 @@
+#![cfg(test)]
+#![cfg(target_os = "linux")]
+
+use std::{
+    cell::RefCell,
+    io::{self, BufRead, BufReader, Write},
+    os::{fd::AsRawFd, unix::net::UnixStream},
+    thread,
+    time::{Duration, Instant},
+};
+
+use serde_json::{Value, json};
+use signal::Signal;
+
+thread_local! {
+    static CONNECTION: RefCell<Option<UnixStream>> = const { RefCell::new(None) };
+}
+
+// Patch libc's connect only in this integration-test executable. Each test
+// supplies its own socket pair; no call can reach the real Signal daemon.
+// SAFETY: This symbol uses libc's connect ABI and preserves its return/errno
+// convention. It never delegates to a real connection attempt.
+#[unsafe(no_mangle)]
+unsafe extern "C" fn connect(
+    socket: libc::c_int,
+    address: *const libc::sockaddr,
+    length: libc::socklen_t,
+) -> libc::c_int {
+    let path_offset = std::mem::offset_of!(libc::sockaddr_un, sun_path);
+    let expected = b"/run/signal-cli/socket\0";
+    if !address.is_null()
+        && let Some(path_end) = path_offset.checked_add(expected.len())
+        && usize::try_from(length).is_ok_and(|length| length >= path_end)
+    {
+        // SAFETY: connect's caller supplies an address valid for length bytes.
+        // The bounds check above covers the entire pathname slice.
+        let path = unsafe {
+            std::slice::from_raw_parts(address.cast::<u8>().add(path_offset), expected.len())
+        };
+        if path == expected
+            && let Some(stream) = CONNECTION.with_borrow_mut(Option::take)
+        {
+            // SAFETY: Both descriptors are live and owned by this thread.
+            // dup2 replaces the unconnected socket with the test endpoint.
+            return if unsafe { libc::dup2(stream.as_raw_fd(), socket) } < 0 {
+                -1
+            } else {
+                0
+            };
+        }
+    }
+    // SAFETY: __errno_location returns this thread's valid errno pointer.
+    unsafe { *libc::__errno_location() = libc::ECONNREFUSED };
+    -1
+}
+
+fn test_connection() -> UnixStream {
+    let (client, server) = UnixStream::pair().unwrap();
+    CONNECTION.with_borrow_mut(|connection| assert!(connection.replace(client).is_none()));
+    server
+}
+
+fn signal() -> Signal {
+    Signal {
+        from_phone: "1234567890".into(),
+    }
+}
+
+#[test]
+fn reuses_sender_for_different_recipients_and_ignores_unrelated_responses() {
+    let client = signal();
+    for (to_phone, body) in [
+        ("0987654321", "failure\nwith details"),
+        ("+15555550102", "another failure"),
+    ] {
+        let server = test_connection();
+        let task = thread::spawn(move || {
+            let mut reader = BufReader::new(server);
+            let mut line = String::new();
+            reader.read_line(&mut line).unwrap();
+            let request: Value = serde_json::from_str(&line).unwrap();
+            assert_eq!(
+                request,
+                json!({
+                    "jsonrpc": "2.0", "method": "send", "id": "signal-alert",
+                    "params": { "account": "1234567890", "recipient": [to_phone], "message": body },
+                })
+            );
+            reader
+                .get_mut()
+                .write_all(b"{\"method\":\"receive\"}\n{\"id\":\"other\"}\n{\"id\":\"signal-")
+                .unwrap();
+            reader
+                .get_mut()
+                .write_all(b"alert\",\"result\":{}}\n")
+                .unwrap();
+        });
+        client.send(to_phone, body).unwrap();
+        task.join().unwrap();
+    }
+}
+
+#[test]
+fn rejects_rpc_errors_invalid_json_and_premature_close() {
+    for (reply, expected) in [
+        (
+            "{\"id\":\"signal-alert\",\"error\":{\"code\":-1}}\n",
+            "Signal RPC returned an error",
+        ),
+        ("invalid\n", "Invalid Signal RPC response"),
+        ("", "socket closed"),
+        ("{\"id\":\"signal-alert\"}", "socket closed"),
+    ] {
+        let server = test_connection();
+        let task = thread::spawn(move || {
+            let mut reader = BufReader::new(server);
+            reader.read_line(&mut String::new()).unwrap();
+            reader.get_mut().write_all(reply.as_bytes()).unwrap();
+        });
+        let error = signal().send("0987654321", "failure").unwrap_err();
+        assert!(format!("{error:#}").contains(expected), "{error:#}");
+        task.join().unwrap();
+    }
+}
+
+#[test]
+fn reports_connection_failure() {
+    let error = signal().send("0987654321", "failure").unwrap_err();
+    assert_eq!(error.to_string(), "Failed to connect to Signal RPC socket");
+    assert_eq!(
+        error.downcast_ref::<io::Error>().unwrap().kind(),
+        io::ErrorKind::ConnectionRefused
+    );
+}
+
+#[test]
+fn unresponsive_server_times_out() {
+    let _server = test_connection();
+    let start = Instant::now();
+    let error = signal().send("0987654321", "failure").unwrap_err();
+    assert_eq!(error.to_string(), "Failed to read Signal RPC response");
+    assert!(matches!(
+        error.downcast_ref::<io::Error>().unwrap().kind(),
+        io::ErrorKind::TimedOut | io::ErrorKind::WouldBlock
+    ));
+    assert!(start.elapsed() >= Duration::from_secs(4));
+}
@@ -0,0 +1,23 @@
+[package]
+name = "snapshot-manager"
+version = "0.1.0"
+edition = "2024"
+description = "Create and rotate ZFS snapshots with Signal failure alerts"
+license = "MIT"
+
+[dependencies]
+anyhow.workspace = true
+chrono.workspace = true
+clap = { workspace = true, features = ["derive", "env"] }
+env_logger.workspace = true
+log.workspace = true
+serde = { workspace = true, features = ["derive"] }
+signal.workspace = true
+toml = "0.9"
+zfs.workspace = true
+
+[dev-dependencies]
+tempfile = "3"
+
+[lints]
+workspace = true
@@ -0,0 +1,25 @@
+{ lib, rustPlatform }:
+rustPlatform.buildRustPackage {
+  pname = "snapshot-manager";
+  version = "0.1.0";
+  src = import ../rust-source.nix { inherit lib; };
+
+  cargoLock.lockFile = ../../Cargo.lock;
+  cargoBuildFlags = [
+    "-p"
+    "snapshot-manager"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "snapshot-manager"
+    "-p"
+    "signal"
+    "-p"
+    "zfs"
+  ];
+
+  meta = {
+    description = "ZFS snapshot manager with Signal failure alerts";
+    mainProgram = "snapshot-manager";
+  };
+}
@@ -0,0 +1,383 @@
+use std::{
+    collections::HashMap,
+    fs,
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{Context, Result};
+use chrono::{DateTime, Datelike, NaiveDate, NaiveTime, Timelike, Utc};
+use clap::Parser;
+use log::{error, info};
+use serde::Deserialize;
+use signal::Signal;
+
+#[derive(Parser)]
+#[command(version, about)]
+struct Args {
+    /// TOML file containing default and per-dataset snapshot retention counts.
+    config_file: PathBuf,
+
+    /// Send Signal failure alerts (requires both phone numbers).
+    #[arg(long, env = "SIGNAL_ALERTS", default_value_t = false, action = clap::ArgAction::Set)]
+    signal_alerts: bool,
+
+    /// Signal account sending failure alerts.
+    #[arg(
+        long,
+        env = "SIGNAL_ALERT_FROM_PHONE",
+        hide_env_values = true,
+        required_if_eq("signal_alerts", "true"),
+        value_parser = clap::builder::NonEmptyStringValueParser::new()
+    )]
+    signal_alert_from_phone: Option<String>,
+
+    /// Signal recipient for failure alerts.
+    #[arg(
+        long,
+        env = "SIGNAL_ALERT_TO_PHONE",
+        hide_env_values = true,
+        required_if_eq("signal_alerts", "true"),
+        value_parser = clap::builder::NonEmptyStringValueParser::new()
+    )]
+    signal_alert_to_phone: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+struct Retention {
+    #[serde(rename = "15_min")]
+    quarter_hourly: usize,
+    hourly: usize,
+    daily: usize,
+    monthly: usize,
+}
+
+impl Default for Retention {
+    fn default() -> Self {
+        Self {
+            quarter_hourly: 4,
+            hourly: 12,
+            daily: 0,
+            monthly: 0,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(transparent)]
+struct Config(HashMap<String, Retention>);
+
+impl Config {
+    fn load(path: &Path) -> Result<Self> {
+        let contents = fs::read_to_string(path)
+            .with_context(|| format!("Failed to read configuration {}", path.display()))?;
+        toml::from_str(&contents)
+            .with_context(|| format!("Invalid configuration {}", path.display()))
+    }
+
+    fn retention_for(&self, dataset: &str) -> Retention {
+        self.0
+            .get(dataset)
+            .or_else(|| self.0.get("default"))
+            .copied()
+            .unwrap_or_default()
+    }
+}
+
+fn main() -> ExitCode {
+    let args = Args::parse();
+    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
+    info!("Starting snapshot_manager");
+    let signal = if args.signal_alerts {
+        args.signal_alert_from_phone
+            .map(|from_phone| Signal { from_phone })
+    } else {
+        None
+    };
+    let alerts = signal.as_ref().zip(args.signal_alert_to_phone.as_deref());
+    match run(&args.config_file, alerts) {
+        Ok(()) => {
+            info!("snapshot_manager completed");
+            ExitCode::SUCCESS
+        }
+        Err(error) => {
+            error!("{error:#}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(config_file: &Path, alerts: Option<(&Signal, &str)>) -> Result<()> {
+    let result = (|| {
+        // Validate all retention settings before making any changes to ZFS.
+        let config = Config::load(config_file)?;
+        let snapshot_time = timestamp(Utc::now());
+        for dataset_name in zfs::list_datasets()? {
+            if let Err(error) = zfs::create_snapshot(&dataset_name, &snapshot_time) {
+                let message = format!("{dataset_name} failed to create snapshot {snapshot_time}");
+                error!("{message}: {error:#}");
+                send_alert(alerts, &message)?;
+                continue;
+            }
+            remove_old_snapshots(&config, alerts, &dataset_name)
+                .context("Failed to remove old snapshots")?;
+        }
+        Ok(())
+    })();
+    if let Err(error) = &result {
+        error!("snapshot_manager failed: {error:#}");
+        if let Err(alert_error) = send_alert(alerts, "snapshot_manager failed") {
+            error!("Failed to send failure alert: {alert_error:#}");
+        }
+    }
+    result
+}
+
+fn timestamp(now: DateTime<Utc>) -> String {
+    let minute = now.minute().saturating_sub(now.minute() % 15);
+    format!("auto_{}{minute:02}", now.format("%Y%m%d%H"))
+}
+
+fn remove_old_snapshots(
+    config: &Config,
+    alerts: Option<(&Signal, &str)>,
+    dataset_name: &str,
+) -> Result<()> {
+    let retention = config.retention_for(dataset_name);
+    info!("Using {retention:?} for {dataset_name}");
+    let snapshots = zfs::list_snapshots(dataset_name)?;
+    for snapshot in snapshots_to_delete(&snapshots, retention) {
+        info!("Deleting {dataset_name}@{snapshot}");
+        if let Some(error) = zfs::delete_snapshot(dataset_name, snapshot)? {
+            let message = format!("{dataset_name}@{snapshot} failed to delete: {error}");
+            error!("{message}");
+            send_alert(alerts, &message)?;
+        }
+    }
+    Ok(())
+}
+
+fn snapshots_to_delete(snapshots: &[String], retention: Retention) -> Vec<&str> {
+    let mut tiers: [Vec<&str>; 4] = Default::default();
+    for snapshot in snapshots {
+        if let Some(index) = bucket(snapshot)
+            && let Some(tier) = tiers.get_mut(index)
+        {
+            tier.push(snapshot);
+        }
+    }
+
+    let counts = [
+        retention.quarter_hourly,
+        retention.hourly,
+        retention.daily,
+        retention.monthly,
+    ];
+    let mut deletions = Vec::new();
+    for (mut tier, count) in tiers.into_iter().zip(counts) {
+        tier.sort_unstable();
+        let delete_count = tier.len().saturating_sub(count);
+        deletions.extend(tier.into_iter().take(delete_count));
+    }
+    deletions
+}
+
+fn bucket(name: &str) -> Option<usize> {
+    let digits = name.strip_prefix("auto_")?;
+    if digits.len() != 12 || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return None;
+    }
+    let date = NaiveDate::from_ymd_opt(
+        digits.get(..4)?.parse().ok()?,
+        digits.get(4..6)?.parse().ok()?,
+        digits.get(6..8)?.parse().ok()?,
+    )?;
+    let time = NaiveTime::from_hms_opt(
+        digits.get(8..10)?.parse().ok()?,
+        digits.get(10..)?.parse().ok()?,
+        0,
+    )?;
+
+    // The tiers are disjoint: midnight belongs to daily, except on the first
+    // of the month, when it belongs to monthly.
+    match (time.minute(), time.hour(), date.day()) {
+        (15 | 30 | 45, _, _) => Some(0),
+        (0, 1..=23, _) => Some(1),
+        (0, 0, 2..=31) => Some(2),
+        (0, 0, 1) => Some(3),
+        _ => None,
+    }
+}
+
+fn send_alert(alerts: Option<(&Signal, &str)>, body: &str) -> Result<()> {
+    if let Some((signal, to_phone)) = alerts {
+        signal.send(to_phone, body)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::TimeZone;
+
+    use super::*;
+
+    #[test]
+    fn dataset_overrides_default_and_other_datasets_fall_back() {
+        let config: Config = toml::from_str(
+            r#"
+            [default]
+            15_min = 8
+            hourly = 24
+            daily = 0
+            monthly = 0
+
+            ["pool/home"]
+            15_min = 2
+            hourly = 3
+            daily = 4
+            monthly = 5
+            "#,
+        )
+        .unwrap();
+        assert_eq!(
+            config.retention_for("pool/home"),
+            Retention {
+                quarter_hourly: 2,
+                hourly: 3,
+                daily: 4,
+                monthly: 5,
+            }
+        );
+        assert_eq!(config.retention_for("pool/other").hourly, 24);
+        assert_eq!(config.retention_for("pool/home/child").quarter_hourly, 8);
+    }
+
+    #[test]
+    fn absent_default_uses_original_builtin_counts() {
+        let config: Config = toml::from_str("").unwrap();
+        assert_eq!(config.retention_for("pool/home"), Retention::default());
+    }
+
+    #[test]
+    fn rejects_incomplete_negative_and_unknown_retention_settings() {
+        for settings in [
+            "15_min = 1\nhourly = 2\ndaily = 3",
+            "15_min = -1\nhourly = 2\ndaily = 3\nmonthly = 4",
+            "15_min = 1\nhourly = 2\ndaily = 3\nmonthly = 4\nweekly = 5",
+            "15_min = 1.5\nhourly = 2\ndaily = 3\nmonthly = 4",
+        ] {
+            assert!(toml::from_str::<Config>(&format!("[default]\n{settings}")).is_err());
+        }
+    }
+
+    #[test]
+    fn timestamps_round_down_at_quarter_hour_boundaries() {
+        for (minute, expected) in [
+            (0, "00"),
+            (14, "00"),
+            (15, "15"),
+            (29, "15"),
+            (30, "30"),
+            (44, "30"),
+            (45, "45"),
+            (59, "45"),
+        ] {
+            let now = Utc.with_ymd_and_hms(2026, 1, 1, 0, minute, 59).unwrap();
+            assert_eq!(timestamp(now), format!("auto_2026010100{expected}"));
+        }
+    }
+
+    #[test]
+    fn tiers_are_disjoint_at_day_and_month_boundaries() {
+        for (name, expected) in [
+            ("auto_202602010015", 0),
+            ("auto_202602010030", 0),
+            ("auto_202602010045", 0),
+            ("auto_202602010100", 1),
+            ("auto_202602012300", 1),
+            ("auto_202602020000", 2),
+            ("auto_202402290000", 2),
+            ("auto_202602010000", 3),
+            ("auto_202601010000", 3),
+        ] {
+            assert_eq!(bucket(name), Some(expected), "{name}");
+        }
+    }
+
+    #[test]
+    fn only_exact_valid_manager_names_are_eligible() {
+        for name in [
+            "manual",
+            "manual_auto_202602010015",
+            "auto_202602010015_backup",
+            "auto_20260201001",
+            "auto_202602300000",
+            "auto_202602012400",
+            "auto_202602010060",
+            "auto_202602010005",
+            "auto_２０２６02010015",
+        ] {
+            assert_eq!(bucket(name), None, "{name}");
+        }
+    }
+
+    #[test]
+    fn keeps_newest_in_each_tier_regardless_of_input_order() {
+        let snapshots = [
+            "auto_202601010000",
+            "auto_202602020000",
+            "auto_202602020115",
+            "auto_202602020215",
+            "auto_202602020200",
+            "auto_202602020100",
+            "auto_202602030000",
+            "auto_202602010000",
+            "manual",
+        ]
+        .map(String::from);
+        let retention = Retention {
+            quarter_hourly: 1,
+            hourly: 1,
+            daily: 1,
+            monthly: 1,
+        };
+        assert_eq!(
+            snapshots_to_delete(&snapshots, retention),
+            [
+                "auto_202602020115",
+                "auto_202602020100",
+                "auto_202602020000",
+                "auto_202601010000",
+            ]
+        );
+    }
+
+    #[test]
+    fn zero_counts_delete_all_managed_snapshots_and_large_counts_keep_them() {
+        let snapshots = [
+            "auto_202601010015",
+            "auto_202601010100",
+            "auto_202601020000",
+            "auto_202601010000",
+            "manual",
+        ]
+        .map(String::from);
+        let none = Retention {
+            quarter_hourly: 0,
+            hourly: 0,
+            daily: 0,
+            monthly: 0,
+        };
+        assert_eq!(snapshots_to_delete(&snapshots, none).len(), 4);
+        let all = Retention {
+            quarter_hourly: 100,
+            hourly: 100,
+            daily: 100,
+            monthly: 100,
+        };
+        assert!(snapshots_to_delete(&snapshots, all).is_empty());
+        assert!(snapshots_to_delete(&[], none).is_empty());
+    }
+}
@@ -0,0 +1,202 @@
+#![cfg(test)]
+
+use std::{fs, os::unix::fs::symlink, path::Path, process::Command};
+
+use tempfile::tempdir;
+
+fn command() -> Command {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_snapshot-manager"));
+    command
+        .env_remove("SIGNAL_ALERTS")
+        .env_remove("SIGNAL_ALERT_FROM_PHONE")
+        .env_remove("SIGNAL_ALERT_TO_PHONE")
+        .env_remove("SNAPSHOT_TEST_SCRIPT")
+        .env_remove("RUST_LOG");
+    command
+}
+
+#[test]
+fn help_works_without_phone_numbers() {
+    let output = command().arg("--help").output().unwrap();
+    assert!(output.status.success());
+    assert!(
+        String::from_utf8(output.stdout)
+            .unwrap()
+            .contains("<CONFIG_FILE>")
+    );
+}
+
+#[test]
+fn help_documents_environment_variables_without_exposing_phone_numbers() {
+    let output = command()
+        .env("SIGNAL_ALERT_FROM_PHONE", "+15555550101")
+        .env("SIGNAL_ALERT_TO_PHONE", "+15555550102")
+        .arg("--help")
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    for name in [
+        "SIGNAL_ALERTS",
+        "SIGNAL_ALERT_FROM_PHONE",
+        "SIGNAL_ALERT_TO_PHONE",
+    ] {
+        assert!(stdout.contains(name), "{stdout}");
+    }
+    assert!(!stdout.contains("+15555550101"), "{stdout}");
+    assert!(!stdout.contains("+15555550102"), "{stdout}");
+}
+
+#[test]
+fn config_argument_is_required() {
+    let output = command().output().unwrap();
+    assert_eq!(output.status.code(), Some(2));
+}
+
+#[test]
+fn enabled_alerts_require_phone_numbers_before_running() {
+    for use_env in [false, true] {
+        for (from, to, expected) in [
+            (None, None, "--signal-alert-from-phone"),
+            (Some(""), None, "--signal-alert-from-phone"),
+            (Some("+15555550101"), None, "--signal-alert-to-phone"),
+            (Some("+15555550101"), Some(""), "--signal-alert-to-phone"),
+            (None, Some("+15555550102"), "--signal-alert-from-phone"),
+        ] {
+            let mut command = command();
+            if use_env {
+                command.env("SIGNAL_ALERTS", "true");
+            } else {
+                command.args(["--signal-alerts", "true"]);
+            }
+            if let Some(from) = from {
+                command.env("SIGNAL_ALERT_FROM_PHONE", from);
+            }
+            if let Some(to) = to {
+                command.env("SIGNAL_ALERT_TO_PHONE", to);
+            }
+            let output = command.arg("unused.toml").output().unwrap();
+            let stderr = String::from_utf8(output.stderr).unwrap();
+            assert_eq!(output.status.code(), Some(2), "{stderr}");
+            assert!(stderr.contains(expected), "{stderr}");
+            assert!(!stderr.contains("Starting snapshot_manager"), "{stderr}");
+        }
+    }
+}
+
+#[test]
+fn enabled_alerts_accept_environment_variables_and_cli_overrides() {
+    let dir = tempdir().unwrap();
+    let config = dir.path().join("config.toml");
+    let scenario = dir.path().join("scenario");
+    fs::write(&config, "").unwrap();
+    // An empty dataset list completes successfully without sending an alert.
+    fs::write(&scenario, "").unwrap();
+    symlink(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+        dir.path().join("zfs"),
+    )
+    .unwrap();
+
+    for use_cli in [false, true] {
+        let mut command = command();
+        if use_cli {
+            command
+                .env("SIGNAL_ALERTS", "invalid")
+                .env("SIGNAL_ALERT_FROM_PHONE", "")
+                .env("SIGNAL_ALERT_TO_PHONE", "")
+                .args([
+                    "--signal-alerts",
+                    "true",
+                    "--signal-alert-from-phone",
+                    "+15555550101",
+                    "--signal-alert-to-phone",
+                    "+15555550102",
+                ]);
+        } else {
+            command
+                .env("SIGNAL_ALERTS", "true")
+                .env("SIGNAL_ALERT_FROM_PHONE", "+15555550101")
+                .env("SIGNAL_ALERT_TO_PHONE", "+15555550102");
+        }
+        let output = command
+            .current_dir(dir.path())
+            .env("PATH", dir.path())
+            .env("SNAPSHOT_TEST_SCRIPT", &scenario)
+            .arg(&config)
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert!(output.status.success(), "{stderr}");
+        assert!(stderr.contains("snapshot_manager completed"), "{stderr}");
+    }
+}
+
+#[test]
+fn disabled_alerts_allow_snapshot_failures_without_phone_numbers() {
+    let dir = tempdir().unwrap();
+    let config = dir.path().join("config.toml");
+    fs::write(&config, "").unwrap();
+    symlink(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+        dir.path().join("zfs"),
+    )
+    .unwrap();
+
+    for (env_value, args) in [
+        (None, vec![]),
+        (Some("false"), vec![]),
+        (None, vec!["--signal-alerts", "false"]),
+        (Some("true"), vec!["--signal-alerts", "false"]),
+    ] {
+        let mut command = command();
+        if let Some(value) = env_value {
+            command.env("SIGNAL_ALERTS", value);
+        }
+        let output = command
+            .env("PATH", dir.path())
+            .args(args)
+            .arg(&config)
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert!(output.status.success(), "{stderr}");
+        assert!(
+            stderr.contains("pool/home failed to create snapshot"),
+            "{stderr}"
+        );
+        assert!(stderr.contains("snapshot_manager completed"), "{stderr}");
+        assert!(!stderr.contains("Signal"), "{stderr}");
+    }
+}
+
+#[test]
+fn disabled_alerts_preserve_fatal_errors_without_phone_numbers() {
+    let dir = tempdir().unwrap();
+    for args in [vec![], vec!["--signal-alerts", "false"]] {
+        let output = command()
+            .args(args)
+            .arg(dir.path().join("missing.toml"))
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert_eq!(output.status.code(), Some(1), "{stderr}");
+        assert!(stderr.contains("Failed to read configuration"), "{stderr}");
+        assert!(!stderr.contains("SIGNAL_ALERT_"), "{stderr}");
+        assert!(!stderr.contains("Failed to send failure alert"), "{stderr}");
+    }
+}
+
+#[test]
+fn signal_alerts_requires_a_boolean_value() {
+    for use_env in [false, true] {
+        let mut command = command();
+        if use_env {
+            command.env("SIGNAL_ALERTS", "invalid");
+        } else {
+            command.args(["--signal-alerts", "invalid"]);
+        }
+        let output = command.arg("unused.toml").output().unwrap();
+        assert_eq!(output.status.code(), Some(2));
+    }
+}
@@ -0,0 +1,12 @@
+#!/bin/sh
+if [ -n "${SNAPSHOT_TEST_SCRIPT:-}" ]; then
+  printf '%s\n' "$*" >> calls
+  . "$SNAPSHOT_TEST_SCRIPT"
+  exit
+fi
+
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@'*) printf '%s\n' 'permission denied' >&2; exit 1 ;;
+  *) exit 99 ;;
+esac
@@ -0,0 +1,290 @@
+#![cfg(test)]
+
+use std::{
+    fs,
+    os::unix::fs::symlink,
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use tempfile::{TempDir, tempdir};
+
+struct Fixture {
+    dir: TempDir,
+    config: PathBuf,
+}
+
+impl Fixture {
+    fn new(script: &str) -> Self {
+        let dir = tempdir().unwrap();
+        // Only the child process sees this PATH. The real zfs cannot be found.
+        symlink(
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+            dir.path().join("zfs"),
+        )
+        .unwrap();
+        // The executable is a checked-in fixture; scenario files are read by
+        // its shell, so parallel tests never execute a file being written.
+        fs::write(dir.path().join("scenario"), script).unwrap();
+        let config = dir.path().join("config.toml");
+        fs::write(
+            &config,
+            "[default]\n15_min = 1\nhourly = 0\ndaily = 0\nmonthly = 0\n",
+        )
+        .unwrap();
+        Self { dir, config }
+    }
+
+    fn calls(&self) -> Vec<String> {
+        fs::read_to_string(self.dir.path().join("calls"))
+            .unwrap_or_default()
+            .lines()
+            .map(String::from)
+            .collect()
+    }
+
+    fn normalized_calls(&self) -> Vec<String> {
+        self.calls()
+            .into_iter()
+            .map(|call| {
+                if call.starts_with("snapshot ") {
+                    let (dataset, name) = call.split_once('@').unwrap();
+                    assert!(name.starts_with("auto_"), "{call}");
+                    format!("{dataset}@<timestamp>")
+                } else {
+                    call
+                }
+            })
+            .collect()
+    }
+
+    fn run(&self) -> Output {
+        Command::new(env!("CARGO_BIN_EXE_snapshot-manager"))
+            .current_dir(self.dir.path())
+            .env("PATH", self.dir.path())
+            .env("SNAPSHOT_TEST_SCRIPT", self.dir.path().join("scenario"))
+            .env_remove("SIGNAL_ALERTS")
+            .env_remove("SIGNAL_ALERT_FROM_PHONE")
+            .env_remove("SIGNAL_ALERT_TO_PHONE")
+            .env_remove("RUST_LOG")
+            .arg(&self.config)
+            .output()
+            .unwrap()
+    }
+}
+
+fn stderr(output: &Output) -> &str {
+    std::str::from_utf8(&output.stderr).unwrap()
+}
+
+#[test]
+fn creates_then_prunes_only_this_datasets_managed_snapshots() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name')
+    printf '%s\n' pool pool/home
+    printf '%s\n' 'warning on stderr' >&2 ;;
+  'snapshot pool/home@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/home')
+    printf '%s\n' pool/home@auto_200002020145 pool/home@auto_200002020115 pool/home@manual pool/home@manual_auto_200001010015 pool/home/child@auto_200001010015 pool/other@auto_200001010015 ;;
+  'destroy pool/home@auto_200002020115') ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert_eq!(
+        fixture.normalized_calls(),
+        [
+            "list -Hp -t filesystem -o name",
+            "snapshot pool/home@<timestamp>",
+            "list -Hp -t snapshot -o name -d 1 pool/home",
+            "destroy pool/home@auto_200002020115",
+        ]
+    );
+}
+
+#[test]
+fn failed_or_duplicate_creation_skips_pruning_but_continues() {
+    for error in ["snapshot already exists", "permission denied"] {
+        let fixture = Fixture::new(&format!(
+            r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home pool/other ;;
+  'snapshot pool/home@auto_'*) printf '%s\n' '{error}' >&2; exit 1 ;;
+  'snapshot pool/other@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/other') ;;
+  *) exit 99 ;;
+esac
+"#
+        ));
+        let output = fixture.run();
+        assert!(output.status.success(), "{}", stderr(&output));
+        assert!(stderr(&output).contains("pool/home failed to create snapshot auto_"));
+        assert!(stderr(&output).contains(error));
+        assert_eq!(
+            fixture.normalized_calls(),
+            [
+                "list -Hp -t filesystem -o name",
+                "snapshot pool/home@<timestamp>",
+                "snapshot pool/other@<timestamp>",
+                "list -Hp -t snapshot -o name -d 1 pool/other",
+            ]
+        );
+        let calls = fixture.calls();
+        assert_eq!(
+            calls[1].split_once('@').unwrap().1,
+            calls[2].split_once('@').unwrap().1
+        );
+    }
+}
+
+#[test]
+fn dependent_clone_failure_is_reported_and_remaining_deletions_continue() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/home')
+    printf '%s\n' pool/home@auto_200002020115 pool/home@auto_200002020130 pool/home@auto_200002020145 ;;
+  'destroy pool/home@auto_200002020115')
+    printf '%s\n' "cannot destroy 'pool/home@auto_200002020115': snapshot has dependent clones" >&2; exit 1 ;;
+  'destroy pool/home@auto_200002020130') ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert!(
+        stderr(&output).contains(
+            "pool/home@auto_200002020115 failed to delete: snapshot has dependent clones"
+        )
+    );
+    assert_eq!(
+        fixture.calls().last().unwrap(),
+        "destroy pool/home@auto_200002020130"
+    );
+}
+
+#[test]
+fn unexpected_destroy_failure_aborts_and_reports_the_error() {
+    let fixture = Fixture::new(
+        r#"
+case "$1" in
+  list)
+    if [ "$4" = filesystem ]; then
+      printf '%s\n' pool/home
+    else
+      printf '%s\n' pool/home@auto_200002020115 pool/home@auto_200002020130 pool/home@auto_200002020145
+    fi ;;
+  snapshot) ;;
+  destroy) printf '%s\n' 'permission denied' >&2; exit 1 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("permission denied"));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert_eq!(
+        fixture.calls().last().unwrap(),
+        "destroy pool/home@auto_200002020115"
+    );
+}
+
+#[test]
+fn failed_list_never_uses_partial_output() {
+    for stream in ["", " >&2"] {
+        let fixture = Fixture::new(&format!(
+            "printf '%s\\n' pool/home\nprintf '%s\\n' 'cannot list datasets'{stream}\nexit 1"
+        ));
+        let output = fixture.run();
+        assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+        assert!(stderr(&output).contains("cannot list datasets"));
+        assert!(stderr(&output).contains("snapshot_manager failed"));
+        assert_eq!(fixture.calls(), ["list -Hp -t filesystem -o name"]);
+    }
+}
+
+#[test]
+fn failed_snapshot_listing_aborts_without_destroying_anything() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@auto_'*) ;;
+  *) printf '%s\n' pool/home@auto_200002020115; exit 1 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert_eq!(fixture.calls().len(), 3);
+}
+
+#[test]
+fn invalid_config_stops_before_any_zfs_commands() {
+    let fixture = Fixture::new("exit 99");
+    fs::write(
+        &fixture.config,
+        "[default]\n15_min = -1\nhourly = 1\ndaily = 0\nmonthly = 0",
+    )
+    .unwrap();
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("Invalid configuration"));
+    assert!(fixture.calls().is_empty());
+}
+
+#[test]
+fn missing_zfs_executable_fails_and_reports_the_error() {
+    let fixture = Fixture::new("exit 99");
+    fs::remove_file(fixture.dir.path().join("zfs")).unwrap();
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("Failed to execute zfs"));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert!(fixture.calls().is_empty());
+}
+
+#[test]
+fn dataset_names_are_passed_as_one_argument_without_a_shell() {
+    let fixture = Fixture::new(
+        r#"
+case "$1" in
+  list)
+    [ "$*" = 'list -Hp -t filesystem -o name' ] || exit 98
+    printf '%s\n' 'pool/two words;touch injected' ;;
+  snapshot)
+    [ "$#" -eq 2 ] || exit 97
+    case "$2" in
+      'pool/two words;touch injected@auto_'*) printf '%s\n' 'argument preserved' >&2; exit 1 ;;
+      *) exit 96 ;;
+    esac ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert!(stderr(&output).contains("argument preserved"));
+    assert_eq!(
+        fixture.normalized_calls(),
+        [
+            "list -Hp -t filesystem -o name",
+            "snapshot pool/two words;touch injected@<timestamp>"
+        ]
+    );
+    assert!(fs::read_dir(fixture.dir.path()).unwrap().all(|entry| {
+        !entry
+            .unwrap()
+            .file_name()
+            .to_string_lossy()
+            .starts_with("injected")
+    }));
+}
@@ -6,16 +6,15 @@ description = "Fetch privacy-masked weather for a van and publish it to Home Ass
 license = "MIT"

 [dependencies]
-anyhow = "1.0"
-chrono = "0.4"
-clap = { version = "4.5", features = ["derive", "env"] }
-env_logger = "0.11"
-log = "0.4"
+anyhow.workspace = true
+chrono.workspace = true
+clap = { workspace = true, features = ["derive", "env"] }
+env_logger.workspace = true
+log.workspace = true
+num-traits = "0.2"
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
-
-[lints.clippy]
-all = "deny"
-pedantic = "deny"
+serde = { workspace = true, features = ["derive"] }
+serde_json.workspace = true

+[lints]
+workspace = true
@@ -1,10 +1,18 @@
-{ rustPlatform }:
+{ lib, rustPlatform }:
 rustPlatform.buildRustPackage {
  pname = "van-weather";
  version = "0.1.0";
-  src = ./.;
+  src = import ../rust-source.nix { inherit lib; };

-  cargoLock.lockFile = ./Cargo.lock;
+  cargoLock.lockFile = ../../Cargo.lock;
+  cargoBuildFlags = [
+    "-p"
+    "van-weather"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "van-weather"
+  ];

  meta = {
    description = "Privacy-masked van weather publisher for Home Assistant";
@@ -4,6 +4,7 @@ use anyhow::{Context, Result, bail};
 use chrono::{DateTime, Utc};
 use clap::Parser;
 use log::{error, info};
+use num_traits::ToPrimitive;
 use reqwest::{
    StatusCode, Url,
    blocking::{Client, ClientBuilder},
@@ -25,7 +26,7 @@ const fn decimal_factor(decimals: u32) -> f64 {
    let mut remaining = decimals;
    while remaining > 0 {
        factor *= 10.0;
-        remaining -= 1;
+        remaining = remaining.saturating_sub(1);
    }
    factor
 }
@@ -468,18 +469,25 @@ fn weather_updates(weather: &Weather) -> Vec<(String, Value)> {
 }

 fn sensor(entity_id: &str, state: Option<Value>, attributes: Value) -> Option<(String, Value)> {
-    state.map(|state| {
-        let mut payload = serde_json::Map::new();
-        payload.insert("state".to_owned(), state);
-        payload.insert("attributes".to_owned(), attributes);
-        (entity_id.to_owned(), Value::Object(payload))
-    })
+    let state = state?;
+    let mut payload = serde_json::Map::new();
+    payload.insert("state".to_owned(), state);
+    payload.insert("attributes".to_owned(), attributes);
+    Some((entity_id.to_owned(), Value::Object(payload)))
 }

-#[allow(clippy::cast_possible_truncation)]
 fn percent(value: Option<f64>) -> i64 {
    // Preserve Python's int(probability * 100) behavior for Home Assistant.
-    (value.unwrap_or_default() * 100.0) as i64
+    let value = value.unwrap_or_default() * 100.0;
+    value.to_i64().unwrap_or_else(|| {
+        if value.is_nan() {
+            0
+        } else if value.is_sign_negative() {
+            i64::MIN
+        } else {
+            i64::MAX
+        }
+    })
 }

 #[cfg(test)]
@@ -562,4 +570,21 @@ mod tests {
        assert!((mask_coordinate(37.7749) - 37.8).abs() < f64::EPSILON);
        assert!((mask_coordinate(-122.4194) - (-122.4)).abs() < f64::EPSILON);
    }
+
+    #[test]
+    fn percentages_truncate_and_preserve_saturation_for_extreme_values() {
+        for (value, expected) in [
+            (None, 0),
+            (Some(0.129), 12),
+            (Some(-0.129), -12),
+            (Some(1.0), 100),
+            (Some(f64::NAN), 0),
+            (Some(f64::MAX), i64::MAX),
+            (Some(f64::MIN), i64::MIN),
+            (Some(f64::INFINITY), i64::MAX),
+            (Some(f64::NEG_INFINITY), i64::MIN),
+        ] {
+            assert_eq!(percent(value), expected);
+        }
+    }
 }
@@ -0,0 +1,13 @@
+[package]
+name = "zfs"
+version = "0.1.0"
+edition = "2024"
+description = "List ZFS datasets and manage snapshots through the zfs executable"
+license = "MIT"
+publish = false
+
+[dependencies]
+anyhow.workspace = true
+
+[lints]
+workspace = true
@@ -0,0 +1,100 @@
+//! Manage ZFS datasets and snapshots using the `zfs` executable on `PATH`.
+//!
+//! ```no_run
+//! for snapshot in zfs::list_snapshots("pool/home")? {
+//!     println!("{snapshot}");
+//! }
+//! # Ok::<(), anyhow::Error>(())
+//! ```
+
+use std::process::Command;
+
+use anyhow::{Context, Result, bail};
+
+const ZFS_EXECUTABLE: &str = "zfs";
+
+fn zfs_command(args: &[&str]) -> Result<String> {
+    let output = Command::new(ZFS_EXECUTABLE)
+        .args(args)
+        .env("LC_ALL", "C")
+        .output()
+        .context("Failed to execute zfs")?;
+    if !output.status.success() {
+        let message = if output.stderr.is_empty() {
+            &output.stdout
+        } else {
+            &output.stderr
+        };
+        bail!(
+            "zfs {} failed ({}): {}",
+            args.join(" "),
+            output.status,
+            String::from_utf8_lossy(message).trim()
+        );
+    }
+    String::from_utf8(output.stdout).context("zfs returned invalid UTF-8")
+}
+
+/// List filesystem datasets, excluding pool roots.
+///
+/// # Errors
+///
+/// Returns an error if executing ZFS or decoding its output fails.
+pub fn list_datasets() -> Result<Vec<String>> {
+    let output = zfs_command(&["list", "-Hp", "-t", "filesystem", "-o", "name"])?;
+    Ok(output
+        .lines()
+        .filter(|name| name.contains('/'))
+        .map(String::from)
+        .collect())
+}
+
+/// List snapshot names belonging directly to `dataset`, excluding child datasets.
+///
+/// Returned names omit the `dataset@` prefix.
+///
+/// # Errors
+///
+/// Returns an error if executing ZFS or decoding its output fails.
+pub fn list_snapshots(dataset: &str) -> Result<Vec<String>> {
+    let output = zfs_command(&[
+        "list", "-Hp", "-t", "snapshot", "-o", "name", "-d", "1", dataset,
+    ])?;
+    Ok(output
+        .lines()
+        .filter_map(|name| {
+            let (owner, snapshot) = name.split_once('@')?;
+            (owner == dataset).then(|| snapshot.to_owned())
+        })
+        .collect())
+}
+
+/// Create `dataset@snapshot`.
+///
+/// # Errors
+///
+/// Returns an error if executing ZFS or decoding its output fails.
+pub fn create_snapshot(dataset: &str, snapshot: &str) -> Result<()> {
+    zfs_command(&["snapshot", &format!("{dataset}@{snapshot}")])?;
+    Ok(())
+}
+
+/// Delete `dataset@snapshot`.
+///
+/// Returns `None` on success, or `Some("snapshot has dependent clones")` when
+/// dependent clones prevent deletion.
+///
+/// # Errors
+///
+/// Returns an error for other ZFS failures, execution failures, or invalid UTF-8 output.
+pub fn delete_snapshot(dataset: &str, snapshot: &str) -> Result<Option<&'static str>> {
+    if let Err(error) = zfs_command(&["destroy", &format!("{dataset}@{snapshot}")]) {
+        if error.to_string().contains(&format!(
+            "cannot destroy '{dataset}@{snapshot}': snapshot has dependent clones"
+        )) {
+            return Ok(Some("snapshot has dependent clones"));
+        }
+        return Err(error);
+    }
+    Ok(None)
+}
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+if [[ "$(hostname)" != "jeeves" ]]; then
+  echo "Signal device authorization must run on jeeves." >&2
+  exit 1
+fi
+if [[ "$EUID" -ne 0 ]]; then
+  echo "Signal device authorization must run as root." >&2
+  exit 1
+fi
+if [[ "$#" -ne 1 ]]; then
+  echo "Usage: signal_authorize.sh DEVICE_URI" >&2
+  exit 2
+fi
+if [[ "$1" != sgnl://linkdevice\?* ]]; then
+  echo "Invalid Signal device link URI." >&2
+  exit 2
+fi
+
+service_name="signal-cli"
+data_dir="/var/lib/signal-cli"
+device_uri="$1"
+restart_service=false
+
+cleanup() {
+  if [[ "$restart_service" == true ]]; then
+    systemctl start "$service_name"
+  fi
+}
+trap cleanup EXIT
+
+restart_service=true
+systemctl stop "$service_name"
+runuser -u signal-cli -- \
+  signal-cli --data-dir "$data_dir" -a +12016554378 addDevice --uri "$device_uri"
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+host_name="$(hostname)"
+if [[ "$#" -ne 0 ]]; then
+  echo "Usage: signal_link.sh" >&2
+  exit 2
+fi
+
+service_name="signal-cli"
+data_dir="/var/lib/signal-cli"
+link_pid=""
+temp_dir=""
+restart_service=false
+
+cleanup() {
+  if [[ -n "$link_pid" ]] && kill -0 "$link_pid" 2>/dev/null; then
+    kill "$link_pid" 2>/dev/null || true
+    wait "$link_pid" 2>/dev/null || true
+  fi
+
+  if [[ -n "$temp_dir" ]]; then
+    rm -f -- "$temp_dir/link-uri"
+    rmdir -- "$temp_dir"
+  fi
+
+  if [[ "$restart_service" == true ]]; then
+    sudo systemctl start "$service_name"
+  fi
+}
+trap cleanup EXIT
+
+restart_service=true
+sudo systemctl stop "$service_name"
+
+temp_dir="$(mktemp -d)"
+link_fifo="$temp_dir/link-uri"
+mkfifo "$link_fifo"
+
+sudo -u signal-cli \
+  signal-cli --data-dir "$data_dir" link --name "$host_name" >"$link_fifo" &
+link_pid="$!"
+
+if ! IFS= read -r device_uri <"$link_fifo"; then
+  wait "$link_pid"
+  exit 1
+fi
+if [[ "$device_uri" != sgnl://linkdevice\?* ]]; then
+  echo "signal-cli returned an invalid device link URI." >&2
+  exit 1
+fi
+
+echo "Run this command manually on jeeves in another dotfiles dir:"
+printf "sudo ./scripts/signal/authorize.sh %q\n" "$device_uri"
+echo "Waiting for jeeves to authorize this device..."
+
+wait "$link_pid"
+link_pid=""
+echo "$host_name is now linked to the Signal account on jeeves."
@@ -8,12 +8,12 @@
    "${inputs.self}/common/optional/monitoring-agent.nix"
    "${inputs.self}/common/optional/nvidia.nix"
    "${inputs.self}/common/optional/scanner.nix"
-    "${inputs.self}/common/optional/steam.nix"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./hardware.nix
    ./syncthing.nix
@@ -0,0 +1,25 @@
+system_token: ENC[AES256_GCM,data:zpyosU2oJTljDBbjeQs79gpzPtfL6Y41nZ3X1d+IgdI1fczx/F6MUOaBN6xVkVGYNHhaaCKaPmS/X7J8TDJHQGWPxM0ZsPluGGCnxhQjsqyY4oc3jyBkye7IbnnWmj1yhisq2V1ti5W7uewCQBioGqJYCNo4PfEjp6ipcgaI5no=,iv:Ee6nw88SUL8+80RR0YA4vAAGilGf7bY6EPhE81jD1Ic=,tag:NtRwWqCntdQN9BlakxvslQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdjNXQ2VpUlBYMjZJbmRT
+            ajk2WEY5VndyU0o0aWdYbXRUSnE0QWxGNlYwCnBkOVd1VkMweTdIZHZBTmp5akMv
+            TE5SRStHYndXWm0wOG82TDlRa2dHV1kKLS0tIEwveXkxMkpULzhBZWQ5WXJQOGFm
+            TjVmQUkzQmJHYXgwSjF1T1dqMlNUVUEKCz8bv8tdtNPRLSXCNoyEY9yTdpFBg1uG
+            EpZ/VgsBV0LktJkqkv6ZSRWp2HiEC61305GEFxrE3u4w7ha6FLJMrQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrLzVQSFZQWTZ2ZnVLdEta
+            S0tkMElVMzZJQ2xSeElQL3N3dy9hQWxzVld3ClcySjhvT0RyUUk4SlNPd2Jpdzhv
+            QU5samVSQnFEdk80M3diazVEVUVFT1UKLS0tIEpLdE82dUFuT0t2NGxqYmxSbis1
+            MFAxN3BtRHVKMWxTeVBpblJDTUcvK0UKZTfYCDTAijn0UPK+Z7UjWOoODPf746Q9
+            ya085jHs39Z1597tgJzWIgydkHl6x9VYUkDu+1Yq4LOeyHFscELnJQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1q47vup0tjhulkg7d6xwmdsgrw64h4ax3la3evzqpxyy4adsmk9fs56qz3y
+    lastmodified: "2026-10-14T02:07:23Z"
+    mac: ENC[AES256_GCM,data:o21tNt4Cs5DpCMcWCFjCQ3DRZZBCftFgm2P80y849sFF8rfFVZy99Rda0fiPpohRs45GsvDxPaDAxcCJl2N31pQ3Zg8VCKNS1LbBoDI3iqhuUtmKeudGfOUY6Gd1+j/E4ML29Cfrzm6r3WiXNPa7q8Jmq/kspwoubpQF2q9xp3o=,iv:6hbw+cRlEAdSaPvfh1sMoORI1uhQkqmpOK0aIhL+f+c=,tag:wTa/39ToJSOmn7b31+m34Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -4,12 +4,13 @@
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
    "${inputs.self}/common/optional/docker.nix"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/ssh_decrypt.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./docker
    ./hardware.nix
@@ -1,3 +0,0 @@
-# docker_networks
-
-docker network create -d bridge web
@@ -0,0 +1,25 @@
+system_token: ENC[AES256_GCM,data:qub1LgQ89K1EmKk8y/sE1OcPdEB5Zu/S/iZENBA+5d3NQUxJwhX3f3xTo4syBsYFk3b4X1AVx8X0JK27fyr36f9QKPc8IR3Kt4foNp+96gJs9wzskJ188yGFGn1Tle9BLkF1/l5Pzt8Xwe4VCOGuT9uh74q2sCUgcC52u+aez6E=,iv:AbAunuRTY9lhcnd2MwOyVv4in0MfyxwH+LsNK0DoMbQ=,tag:VAmVTSpPh734cZt5Vy0mTg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWGNFR01XRXBJUDZ0cFd6
+            dzdWVUlHT1NQU2VrV3VRSlF2bThYdWRtTERJClI1cFFTZzRNSlc1QmlnQUNxSHZB
+            dVhqejBMcDZVVXdIeU0yM3NxelBhMTgKLS0tIFJWRHdqTW5UY3ZOZUZ5dXJKRity
+            YXhHOWl0Y0dQOS9uN0VCSmJHWkxXd0EKV5LbdNZ5oujX+rey8i/XUxoOKw99JKJJ
+            N1sIIc4LmXrqeqRRhXAakQYoWEqQa12Vu3OZrPXkvoQ0KQHKcKbPPA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhVkNnUkZEbk8rcm90dFAy
+            Ty9vYWN4YkIxdVUyTlJCak4yMmx2dkZXUFFRCmZTRkJReGRwTXB1ZThYSjVmUC9D
+            L1JkVEhHUjRjenpBS0hkQWRiVXY1dEEKLS0tIGM1S2VYbHBjbDU2RG5MUC9HcDNW
+            VEFCR3ZXVzNOMVY3Q0VEM0Y4dnROZUEKKpULO8QALBkItUgkT7IQgPsC/3gQKfid
+            1dgv+CpFGLXDtS8Ocm/r0y6WL2ds1E5rwoQ4UphnxWJGLIAo8cs36g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jhf7vm0005j60mjq63696frrmjhpy8kpc2d66mw044lqap5mjv4snmwvwm
+    lastmodified: "2026-10-14T02:08:28Z"
+    mac: ENC[AES256_GCM,data:fBhvyzmnzQtLZ7QNELrJvFfnfymLjfzb7Bi61+6dCqNNgrMnYI4gU+9xDSepHskWQ+9ZS3fHZ8ZQCMC+xjhEvI8PWVe4nQYFKHkNOOrfZSBb8osWyzChbQCQXJtK1zalfo/Yk9gvOzeGhqM+XOqMt15Wr56eETSPpPNwVdG2QPY=,iv:TRCrl90dFGJiP0RsYpEIuvknCh8tslIVWTu+Loeklbw=,tag:LkyzzSEnytMkz40IPeBM6g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -13,6 +13,10 @@
  services = {
    home-assistant = {
      enable = true;
+      # Keep Home Assistant's Python dependencies on baseline x86-64.
+      package = pkgs.x86-v1.home-assistant.overrideAttrs (_: {
+        doInstallCheck = false;
+      });
      config = {
        homeassistant = {
          time_zone = "America/New_York";
@@ -79,7 +83,7 @@
        "isal"
        "modbus" # for victron modbus integration
      ];
-      customComponents = with pkgs.home-assistant-custom-components; [
+      customComponents = with pkgs.x86-v1.home-assistant-custom-components; [
        garmin_connect
      ];

@@ -9,12 +9,12 @@ in
    "${inputs.self}/common/global"
    "${inputs.self}/common/optional/docker.nix"
    "${inputs.self}/common/optional/monitoring-agent.nix"
-    "${inputs.self}/common/optional/ssh_decrypt.nix"
    "${inputs.self}/common/optional/signal-cli.nix"
+    "${inputs.self}/common/optional/ssh_decrypt.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/tailscale.nix"
    "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    "${inputs.self}/common/optional/zfs"
    ./monitoring
    ./docker
@@ -38,10 +38,5 @@ in
    };
  };

-  users.groups = {
-    nornsight = { };
-    nornsight-admin = { };
-  };
-
  system.stateVersion = "24.05";
 }
@@ -0,0 +1,96 @@
+# Kanidm on Jeeves
+
+Kanidm is served at **https://auth.tmmworkshop.com**. Portal terminates public
+HTTPS and forwards requests over Tailscale to Jeeves on port 8443, verifying
+Jeeves's TLS certificate. Only the Tailscale interface exposes that backend port.
+
+The service module is automatically imported by `services/default.nix`.
+`services/kanidm.nix` pins Kanidm to the 1.11 release series; review the
+[upgrade guide](https://kanidm.github.io/kanidm/stable/server_updates.html)
+before changing that series. The flake lock determines the patch release.
+
+## Before deployment
+
+1. Point `auth.tmmworkshop.com` at Portal's public address, using the same DNS
+   arrangement as `gitea.tmmworkshop.com`. Port 80 must reach Portal for ACME.
+2. Enable [HTTPS certificates in Tailscale](https://tailscale.com/kb/1153/enabling-https).
+   Jeeves must be able to obtain a certificate for `jeeves.taile39c31.ts.net`.
+3. Allow Portal to reach Jeeves on TCP 8443 in your Tailscale policy.
+
+The trusted proxy address in `services/kanidm.nix` is Portal's current Tailscale
+IPv4 address, `100.80.102.33`. Update it if Portal is re-enrolled with a new address.
+HAProxy connects over IPv4 and replaces incoming `X-Forwarded-For` headers.
+
+## Deploy
+
+Ensure the new Nix file is tracked by Git before using this Git-backed flake.
+From this repository, using the existing SSH aliases:
+
+```sh
+nixos-rebuild switch --flake .#jeeves --target-host jeeves --sudo
+nixos-rebuild switch --flake .#portal-1 --target-host portal-1 --sudo
+```
+
+Deploy Jeeves first, then Portal. Portal manages the public Let's Encrypt
+certificate. `kanidm-tls.service` on Jeeves obtains the backend certificate and
+checks for renewal daily, restarting Kanidm only when the certificate changes.
+Private keys are generated at runtime and never stored in this repository or
+the Nix store.
+
+On Jeeves, check startup:
+
+```sh
+sudo systemctl status kanidm-tls.service kanidm.service
+sudo journalctl -u kanidm-tls.service -u kanidm.service -n 100
+```
+
+If the initial certificate request fails, fix the Tailscale HTTPS configuration
+and run `sudo systemctl restart kanidm.service`; its dependency retries the
+certificate request. A successful oneshot certificate service normally appears
+as inactive after finishing.
+
+After both hosts are deployed:
+
+```sh
+curl --fail https://auth.tmmworkshop.com/status
+```
+
+## First login
+
+On Jeeves, recover the initial administrator passwords interactively:
+
+```sh
+sudo kanidmd recover-account admin
+sudo kanidmd recover-account idm_admin
+kanidm login --name idm_admin
+kanidm person create richie "Richie"
+kanidm person credential create-reset-token richie
+```
+
+Store the recovered passwords securely. Follow the reset URL to enroll your
+personal account's passkey. `admin` manages the Kanidm server; `idm_admin`
+manages people, groups, and application integrations. Creating `richie` does
+not automatically grant administrator rights. The client is installed and
+configured to use `https://auth.tmmworkshop.com`.
+
+Register each website as its own OAuth2/OIDC client and each backend identity
+as a service account, then grant application scopes through groups. This
+deployment does not create application clients or change existing sites' login
+settings. See the [OAuth2 guide](https://kanidm.github.io/kanidm/stable/integrations/oauth2.html)
+and [service-account guide](https://kanidm.github.io/kanidm/stable/accounts/service_accounts.html).
+
+## Storage and recovery
+
+- Database: `/var/lib/kanidm/kanidm.db` on Jeeves's existing ZFS `/var` filesystem.
+- Online backups: `/var/lib/kanidm/backups`, daily at 02:30, retaining 14.
+- Backend certificate and key: `/var/lib/kanidm-tls`, readable by Kanidm.
+- Server configuration: `/etc/kanidm/server.toml`.
+
+The existing `root_pool/var` snapshot policy covers the database and backups.
+Copy backups off Jeeves as part of disaster recovery; local snapshots do not
+protect against loss of the host. Follow Kanidm's
+[backup and restore instructions](https://kanidm.github.io/kanidm/stable/backup_and_restore.html).
+
+The configured identity domain and origin are both `auth.tmmworkshop.com`.
+Changing them after enrollment can affect passkeys and application integrations;
+follow the [domain rename guide](https://kanidm.github.io/kanidm/stable/domain_rename.html).
@@ -1,33 +0,0 @@
-# Monitoring
-
-## Vultr API metrics
-
-The `vultr-exporter` service reads its API token from:
-
-```text
-/zfs/storage/secrets/services/vultr-exporter
-```
-
-Create the file on Jeeves as root with the following contents:
-
-```text
-API_KEY=<Vultr API token>
-```
-
-The token needs read access to the Vultr Account and Billing APIs. Unrelated
-resource collectors are disabled in the packaged exporter.
-
-Restrict the file to root and ensure the public egress IP used by Jeeves is
-allowed for the token in the Vultr API settings:
-
-```console
-sudo chown root:root /zfs/storage/secrets/services/vultr-exporter
-sudo chmod 600 /zfs/storage/secrets/services/vultr-exporter
-```
-
-The exporter listens on `127.0.0.1:9188`; it is scraped by the local
-`prometheus-main` service every five minutes and is not exposed through the
-host firewall.
-
-Portal-1 exposes its node exporter only through `tailscale0` on port `9100`.
-Jeeves reaches it using the Portal-1 Tailscale hostname.
@@ -7,8 +7,9 @@ let
    gitea_ssh = 2223;
    grafana = 3000;
    jellyfin_http = 8096;
+    jellyswarrm = 3100;
+    kanidm = 8443;
    nix_binary_cache = 5000;
-    nornsight = 8001;
    ollama = 11434;
    open_webui = 8080;
    postgresql = 5432;
@@ -27,8 +28,9 @@ in
      ports.audiobookshelf
      ports.gems
      ports.jellyfin_http
+      ports.jellyswarrm
+      ports.kanidm
      ports.nix_binary_cache
-      ports.nornsight
      ports.share
    ];
    allowedTCPPorts = [
@@ -21,5 +21,16 @@
    nix-builder-12.enable = true;
    nix-builder-13.enable = true;
    nix-builder-14.enable = true;
+
+    # Warm the shared x86-64-v3 cache before the smaller per-system runners
+    # start. Eight jobs with eight cores each can use Jeeves' 64 logical CPUs,
+    # while the 6000% quota leaves some capacity for its normal services.
+    nix-cache-builder = {
+      enable = true;
+      labels = [ "nix-cache-builder:host" ];
+      cores = 8;
+      maxJobs = 8;
+      cpuQuota = "6000%";
+    };
  };
 }
@@ -11,11 +11,8 @@ let
  cfg = config.services.nix_builder;
  runnerUsername = "gitea-runner";
  runnerUserid = 601;
-  runnerLabels = [
-    "self-hosted:host"
-    "nixos:host"
-  ];
  containerConfig =
+    containerCfg:
    {
      config,
      pkgs,
@@ -50,8 +47,8 @@ let
        useHostResolvConf = false;
      };
      nix.settings = {
-        cores = 8;
-        max-jobs = 2;
+        inherit (containerCfg) cores;
+        max-jobs = containerCfg.maxJobs;
        system-features = lib.mkAfter [
          "gccarch-x86-64-v2"
          "gccarch-x86-64-v3"
@@ -94,7 +91,7 @@ let
        enable = true;
        name = "jeeves-nix-builder";
        url = "http://192.168.99.14:6443/";
-        labels = runnerLabels;
+        labels = containerCfg.labels;
        tokenFile = "/run/secrets/gitea-runners/registration-token";
        settings.runner.timeout = "12h";
        hostPackages = with pkgs; [
@@ -110,6 +107,7 @@ let
          nixos-rebuild
          nodejs
          ruff
+          rustfmt
          treefmt
          wget
        ];
@@ -120,20 +118,21 @@ let
          User = mkForce runnerUsername;
          Group = mkForce runnerUsername;
          ExecStartPre = mkForce [
-            "${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs runnerLabels}"
+            "${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs containerCfg.labels}"
          ];
        };
      };
      system.stateVersion = "24.05";
    };
-  sharedContainerPath =
+  mkContainerPath =
+    containerCfg:
    (import "${pkgs.path}/nixos/lib/eval-config.nix" {
      modules = [
        {
          boot.isNspawnContainer = true;
          nixpkgs.pkgs = pkgs;
        }
-        containerConfig
+        (containerConfig containerCfg)
      ];
      system = null;
    }).config.system.build.toplevel;
@@ -151,7 +150,36 @@ in
        types.submodule (
          { name, ... }:
          {
-            options.enable = mkEnableOption "Gitea runner container";
+            options = {
+              enable = mkEnableOption "Gitea runner container";
+
+              labels = mkOption {
+                type = types.listOf types.str;
+                default = [
+                  "self-hosted:host"
+                  "nixos:host"
+                ];
+                description = "Gitea Actions labels advertised by this runner.";
+              };
+
+              cores = mkOption {
+                type = types.ints.positive;
+                default = 8;
+                description = "Number of cores made available to each Nix build job.";
+              };
+
+              maxJobs = mkOption {
+                type = types.ints.positive;
+                default = 2;
+                description = "Maximum number of Nix build jobs run in parallel.";
+              };
+
+              cpuQuota = mkOption {
+                type = types.str;
+                default = "800%";
+                description = "systemd CPU quota for the runner container.";
+              };
+            };
          }
        )
      );
@@ -173,7 +201,7 @@ in
    containers = mapAttrs (
      name: containerCfg:
      mkIf containerCfg.enable {
-        path = sharedContainerPath;
+        path = mkContainerPath containerCfg;
        autoStart = true;
        privateNetwork = true;
        hostBridge = cfg.bridgeName;
@@ -199,16 +227,14 @@ in
    ) cfg.containers;

    systemd = {
-      services = builtins.listToAttrs (
-        map (name: {
-          name = "container@${name}";
-          value = {
-            requires = [ "gitea.service" ];
-            after = [ "gitea.service" ];
-            serviceConfig.CPUQuota = "800%";
-          };
-        }) (builtins.attrNames (filterAttrs (_: c: c.enable) cfg.containers))
-      );
+      services = mapAttrs' (
+        name: containerCfg:
+        nameValuePair "container@${name}" {
+          requires = [ "gitea.service" ];
+          after = [ "gitea.service" ];
+          serviceConfig.CPUQuota = containerCfg.cpuQuota;
+        }
+      ) (filterAttrs (_: c: c.enable) cfg.containers);

      tmpfiles.rules = [
        "d ${vars.uv_cache} 0755 ${runnerUsername} ${runnerUsername} - -"
@@ -0,0 +1,25 @@
+system_token: ENC[AES256_GCM,data:aDNBcQuFE3ImFMOs83cmyeWcANavFoYFy564zSq8XcgFL2VUho2D8UtW/e+hTdJBEjeNTd7gSrtFd/Ved6QgZHgPCyxUmNkPcr6XqTe6a+AFWCx7tVSWYSweKt7BI5GcZ4oA7oeOJ+/9Tefbo5Yg0QI1HgKcS3D7BHEdr5iQi4E=,iv:lvBbttBqzIMvsFobUZQfbaYCyDrjztB/cb3r2P1TtwA=,tag:AEI1Rj6/A6f0K9MBx9Ai0w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJQnVqUkxRUm5PQ21lV01o
+            OEJuMWtSWlE1Z09RaUxNeHpycU1DcnM1dGlVCmEvUUlmcmxnWHRYS016U3RhYkw1
+            enZQcnJrSUwybGpKWkx4bm9ra2lVWGcKLS0tIDRDKzl0bEp6YnhweTN4YW9LU2hI
+            alF5V3BIQ0R5MXZFSmt6dnRXanp0Ym8KQhrtXzQLEG2pXzKs1Z8i9DPigWKpiovZ
+            dfAw2Tzp4B8kTHuo4PuYU/S37HoYYhf5ZV5vRiUoNYhrr6Q8wwu1Iw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBod2dvaVhxNW1tWld0eW1x
+            TWZuNFJWWndQSDVKWU9WdjlTWW13RU9RZ2gwCjJPb0VUTmlMWGFJTEFFdE1jbHRT
+            YllSQXBNeUFFSk9JYmdJSGVKQVhSU0EKLS0tIG16T2R6MzJKVTE3ZDhCVU93WXlB
+            QW13QVc5dUpVTFFMZ0l3dFlPY2NOYXcK1IdjpBBhT2l5FvFNwLR+XH3AqbUivYNd
+            pQwOr6T7ysB70h12EKZ5V4Ti4BT8ETeQUgFC2JbX2OZe0cTrxtacQw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv
+    lastmodified: "2026-10-14T02:08:46Z"
+    mac: ENC[AES256_GCM,data:4eVms5du2CbLqdY+kQYo6kcDRIZD+h950tInjESug9kjkSBQhWCpJLrIM1Ud9FYtqPE59rsd4s9wlDRY1+hpvBg3YgdcKjSBR9sNXL6D5cCE+2aYfTrkVgkcEwWeFc2OauXjkrqR2QXpq5ltq/3He6Hxdr08kC37GunvZEfJwzg=,iv:3qkVvRPUP/C3s5+a7dpOmoqaXbnWKxgM7OF8noxxMpw=,tag:jUJsLpLr8rxii0Hh6E9bXw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -23,7 +23,6 @@ in
      };
      service.DISABLE_REGISTRATION = true;
      server = {
-        DOMAIN = "gitea.tmmworkshop.com";
        ROOT_URL = "https://gitea.tmmworkshop.com/";
        HTTP_PORT = 6443;
        BUILTIN_SSH_SERVER_USER = "gitea";
@@ -0,0 +1,16 @@
+{ inputs, ... }:
+let
+  vars = import ../vars.nix;
+in
+{
+  imports = [ inputs.jellyswarrm.nixosModules.default ];
+
+  services.jellyswarrm = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 3100;
+    dataDir = "${vars.services}/jellyswarrm";
+    username = "admin";
+    passwordFile = "${vars.secrets}/services/jellyswarrm-password";
+  };
+}
@@ -0,0 +1,101 @@
+{ config, pkgs, ... }:
+let
+  certificateDir = "/var/lib/kanidm-tls";
+in
+{
+  services.kanidm = {
+    # Pin the minor release: Kanidm upgrades require following its upgrade guide.
+    package = pkgs.kanidm_1_11;
+    server = {
+      enable = true;
+      settings = {
+        domain = "auth.tmmworkshop.com";
+        origin = "https://auth.tmmworkshop.com";
+        bindaddress = "0.0.0.0:8443";
+        db_fs_type = "zfs";
+        tls_chain = "${certificateDir}/certificate.pem";
+        tls_key = "${certificateDir}/private-key.pem";
+
+        # Only Portal may supply the original client address. HAProxy replaces
+        # X-Forwarded-For, so clients cannot supply a forged address themselves.
+        http_client_address_info.x-forward-for = [ "100.80.102.33" ];
+
+        # /var/lib/kanidm is on root_pool/var, which is already snapshotted.
+        online_backup = {
+          schedule = "30 2 * * *";
+          versions = 14;
+        };
+      };
+    };
+    client = {
+      enable = true;
+      settings.uri = "https://auth.tmmworkshop.com";
+    };
+  };
+
+  systemd = {
+    services = {
+      kanidm = {
+        requires = [ "kanidm-tls.service" ];
+        after = [ "kanidm-tls.service" ];
+      };
+
+      # Kanidm requires TLS even behind HAProxy. Use Jeeves's Tailscale
+      # certificate so Portal can verify both the CA and the backend hostname.
+      # HTTPS certificates must be enabled in the Tailscale admin console.
+      kanidm-tls = {
+        description = "Obtain and renew Kanidm's backend TLS certificate";
+        requires = [ "tailscaled.service" ];
+        wants = [ "tailscaled-autoconnect.service" ];
+        after = [
+          "tailscaled.service"
+          "tailscaled-autoconnect.service"
+        ];
+        path = [
+          config.services.tailscale.package
+          pkgs.coreutils
+          pkgs.systemd
+        ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "kanidm";
+          StateDirectory = "kanidm-tls";
+          StateDirectoryMode = "0750";
+          RuntimeDirectory = "kanidm-tls";
+          RuntimeDirectoryMode = "0700";
+          UMask = "0077";
+          TimeoutStartSec = "2min";
+        };
+        script = ''
+          set -euo pipefail
+          tailscale cert --min-validity 720h \
+            --cert-file /run/kanidm-tls/certificate.pem \
+            --key-file /run/kanidm-tls/private-key.pem \
+            jeeves.taile39c31.ts.net
+
+          if ! cmp -s /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem \
+            || ! cmp -s /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem; then
+            install -m 0640 -o root -g kanidm /run/kanidm-tls/certificate.pem ${certificateDir}/certificate.pem
+            install -m 0640 -o root -g kanidm /run/kanidm-tls/private-key.pem ${certificateDir}/private-key.pem
+
+            # The NixOS service bind-mounts the certificate files, so restart to
+            # pick up renewals. Do not wait on a service that depends on this one.
+            if systemctl is-active --quiet kanidm.service; then
+              systemctl --no-block try-restart kanidm.service
+            fi
+          fi
+        '';
+      };
+    };
+
+    timers.kanidm-tls = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        RandomizedDelaySec = "1h";
+      };
+    };
+  };
+}
@@ -1,107 +0,0 @@
-{ pkgs, ... }:
-let
-  vars = import ../vars.nix;
-  stateDir = "${vars.services}/nornsight";
-  appDir = "${stateDir}/app";
-  binPath = pkgs.lib.makeBinPath [
-    pkgs.binutils
-    pkgs.libpq
-    pkgs.postgresql
-    pkgs.stdenv.cc
-  ];
-  libraryPath = pkgs.lib.makeLibraryPath [
-    pkgs.libpq
-    pkgs.postgresql.lib
-  ];
-in
-{
-  systemd.tmpfiles.rules = [
-    "d ${stateDir} 0750 nornsight nornsight - -"
-  ];
-
-  users.users.nornsight = {
-    isSystemUser = true;
-    group = "nornsight";
-    home = stateDir;
-  };
-
-  systemd.services.nornsight = {
-    description = "Norn Sight";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    environment = {
-      HOME = stateDir;
-      UV_CACHE_DIR = "${stateDir}/.cache/uv";
-      UV_PROJECT_ENVIRONMENT = "${appDir}/.venv";
-      UV_PYTHON = "${pkgs.python313}/bin/python3.13";
-      UV_PYTHON_DOWNLOADS = "never";
-      LD_LIBRARY_PATH = libraryPath;
-      LIBRARY_PATH = libraryPath;
-      PSYCOPG_IMPL = "python";
-    };
-
-    path = with pkgs; [
-      bash
-      coreutils
-      git
-      uv
-    ];
-
-    serviceConfig = {
-      Type = "simple";
-      User = "nornsight";
-      Group = "nornsight";
-      EnvironmentFile = "-${vars.secrets}/services/nornsight";
-      WorkingDirectory = stateDir;
-      Restart = "on-failure";
-      RestartSec = "5s";
-      StandardOutput = "journal";
-      StandardError = "journal";
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectHome = true;
-      ProtectSystem = "strict";
-      ReadWritePaths = [ stateDir ];
-    };
-
-    script = ''
-      set -eu
-      export PATH="${binPath}:$PATH"
-      export LD_LIBRARY_PATH="${libraryPath}:''${LD_LIBRARY_PATH:-}"
-      export LIBRARY_PATH="${libraryPath}:''${LIBRARY_PATH:-}"
-
-      : "''${NORN_SIGHT_REPO_URL:?NORN_SIGHT_REPO_URL is required}"
-      branch="''${NORN_SIGHT_BRANCH:-main}"
-
-      if [ -d "${appDir}/.git" ]; then
-        current_origin="$(git -C "${appDir}" remote get-url origin)"
-        if [ "$current_origin" != "$NORN_SIGHT_REPO_URL" ]; then
-          rm -rf "${appDir}"
-        fi
-      fi
-
-      if [ ! -d "${appDir}/.git" ]; then
-        git clone --branch "$branch" "$NORN_SIGHT_REPO_URL" "${appDir}"
-      else
-        cd "${appDir}"
-        git fetch origin "$branch"
-        git checkout "$branch"
-        git pull --ff-only origin "$branch"
-      fi
-
-      cd "${appDir}"
-      uv sync --upgrade
-      uv run python - <<'PY'
-      import ctypes.util
-      import os
-
-      print(f"LD_LIBRARY_PATH={os.environ.get('LD_LIBRARY_PATH')}")
-      print(f"LIBRARY_PATH={os.environ.get('LIBRARY_PATH')}")
-      print(f"libpq={ctypes.util.find_library('pq')}")
-      PY
-      exec uv run uvicorn pipelines.web.main:app --host 0.0.0.0 --port 8001
-    '';
-  };
-}
@@ -1,83 +0,0 @@
-# portal_1
-
-Minimal NixOS target for a Vultr VM, installed with nixos-anywhere. The Nix
-flake target is `portal_1`; the machine hostname is `portal-1` because DNS
-hostnames cannot contain underscores.
-
-## Before deploying
-
-1. Confirm the VM's system disk is `/dev/vda`. If it is not, update both
-   references in `disk-config.nix`.
-2. Confirm the SSH public key in `default.nix` is the key that should have
-   administrator access.
-3. Boot the VM into a NixOS installer or another nixos-anywhere-compatible
-   Linux rescue environment with root SSH access. Keep this environment
-   running while completing the SOPS bootstrap below.
-
-## Bootstrap SOPS
-
-Use the rescue environment's SSH host key as the permanent portal identity.
-Replace `VM_IP` below:
-
-```console
-ssh root@VM_IP 'cat /etc/ssh/ssh_host_ed25519_key.pub' | \
-  nix shell nixpkgs#ssh-to-age --command ssh-to-age
-```
-
-This prints an `age1...` recipient; it does not copy the private key. Add the
-recipient to `.sops.yaml`:
-
-```yaml
- &system_portal_1 age1...
-```
-
-Then add `*system_portal_1` to the age recipients for
-`users/secrets.yaml`. Re-encrypt the existing file for the new recipient and
-add the Tailscale key:
-
-```console
-nix shell nixpkgs#sops --command sops updatekeys users/secrets.yaml
-nix shell nixpkgs#sops --command sops users/secrets.yaml
-```
-
-Add the OAuth client secret from the `Auth Keys: Write` credential in the SOPS
-editor and save it:
-
-```yaml
-tailscale_auth_key: tskey-client-...
-```
-
-## Deploy
-
-From the repository root, replace `VM_IP` with the VM's public IP:
-
-```console
-nix run github:nix-community/nixos-anywhere -- \
-  --copy-host-keys --flake .#portal_1 root@VM_IP
-```
-
-This repartitions `/dev/vda`, so anything already on that disk is erased. The
-layout reserves 8 GiB for swap and assigns the remaining space to the root
-filesystem.
-
-`--copy-host-keys` preserves the same private SSH host key at
-`/etc/ssh/ssh_host_ed25519_key` on the installed system. SOPS-Nix converts that
-key to an age identity during activation. After the reboot, connect as
-`richie` and verify that automatic Tailscale enrollment succeeded:
-
-```console
-ssh -p 278 richie@VM_IP
-sudo tailscale status
-```
-
-The installed OpenSSH service listens on port 278. Port 22 is served by
-Endlessh and will not provide an SSH login.
-
-HAProxy uses the same frontend, routing, and rate-limiting configuration as
-Jeeves. Portal manages the ACME certificates for the existing public domains;
-their DNS records must resolve to Portal for HTTP-01 issuance and renewal.
-
-The application backends still use Jeeves' original `127.0.0.1` addresses.
-Replace them with the corresponding Tailscale addresses before directing
-application traffic through Portal. Ports 80 and 443 are allowed through the
-firewall.
@@ -9,8 +9,9 @@
    inputs.disko.nixosModules.disko
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
+    "${inputs.self}/common/optional/signal-cli.nix"
    "${inputs.self}/common/optional/tailscale.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
+    "${inputs.self}/common/optional/x86-64-v3"
    ./disk-config.nix
    ./haproxy
    ./monitoring.nix
@@ -7,8 +7,6 @@ let
    "jellyfin"
    "share"
  ];
-  extraDomains = [ "www.norn-sight.com" ];
-
  makeCert = name: {
    name = "${name}.tmmworkshop.com";
    value = {
@@ -18,18 +16,7 @@ let
    };
  };

-  makeExtraCert = name: {
-    inherit name;
-    value = {
-      webroot = "/var/lib/acme/.challenges";
-      group = "acme";
-      reloadServices = [ "haproxy.service" ];
-    };
-  };
-
-  acmeServices =
-    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
-    ++ map (domain: "acme-${domain}.service") extraDomains;
+  acmeServices = map (domain: "acme-${domain}.tmmworkshop.com.service") domains;
 in
 {
  networking.firewall.allowedTCPPorts = [
@@ -65,7 +52,7 @@ in
  security.acme = {
    acceptTerms = true;
    defaults.email = "Richie@tmmworkshop.com";
-    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
+    certs = builtins.listToAttrs ((map makeCert domains));
  };

  systemd = {
@@ -1,12 +1,21 @@
 global
  log stdout format raw local0
+  # Structured HTTP log fields, grouped so the format remains editable here.
+  setenv HAPROXY_JSON_CLIENT "%(client_ip)ci %(client_port)cp"
+  setenv HAPROXY_JSON_ROUTING "%(frontend_name)ft %(backend_name)b %(server_name)s"
+  setenv HAPROXY_JSON_HTTP "%(http_method)HM %(request_path)HP %(http_version)HV %(status_code)ST %(bytes_sent)B"
+  setenv HAPROXY_JSON_TIMINGS "%(time_request_ms)TR %(time_wait_ms)Tw %(time_connect_ms)Tc %(time_response_ms)Tr %(time_total_ms)Ta"
+  setenv HAPROXY_JSON_RESULT "%(termination_state)tsc %(retries)rc"
+  setenv HAPROXY_JSON_CONNECTIONS "%(active_connections)ac %(frontend_connections)fc %(backend_connections)bc %(server_connections)sc %(server_queue)sq %(backend_queue)bq"
+  setenv HAPROXY_JSON_TLS "%(tls_sni)[ssl_fc_sni] %(tls_version)sslv %(tls_cipher)sslc %(tls_resumed)[ssl_fc_is_resumed]"
+  setenv HAPROXY_JSON_LOG "${HAPROXY_JSON_CLIENT} ${HAPROXY_JSON_ROUTING} ${HAPROXY_JSON_HTTP} ${HAPROXY_JSON_TIMINGS} ${HAPROXY_JSON_RESULT} ${HAPROXY_JSON_CONNECTIONS} ${HAPROXY_JSON_TLS}"
  # stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats timeout 30s

 defaults
  log global
  mode http
-  option httplog
+  log-format "%{+json}o ${HAPROXY_JSON_LOG}"
  retries 3
  maxconn 2000
  timeout connect 5s
@@ -23,7 +32,7 @@ defaults
 #Application Setup
 frontend ContentSwitching
  bind [::]:80 v4v6
-  bind [::]:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt /var/lib/acme/www.norn-sight.com/full.pem
+  bind [::]:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/auth.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/gems.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem
  mode  http

  # ACME challenge routing (must be first)
@@ -31,12 +40,12 @@ frontend ContentSwitching

  # Host ACLs (defined early so rate-limiting can scope to a single vhost)
  acl host_audiobookshelf  hdr(host) -i audiobookshelf.tmmworkshop.com
+  acl host_auth  hdr(host) -i auth.tmmworkshop.com
  acl host_cache  hdr(host) -i cache.tmmworkshop.com
  acl host_jellyfin  hdr(host) -i jellyfin.tmmworkshop.com
  acl host_share  hdr(host) -i share.tmmworkshop.com
  acl host_gitea  hdr(host) -i gitea.tmmworkshop.com
  acl host_gems  hdr(host) -i gems.tmmworkshop.com
-  acl host_norn_sight  hdr(host) -i www.norn-sight.com

  # --- Request logging ---
  # Capture the Host header and User-Agent so the httplog shows who is
@@ -103,12 +112,12 @@ frontend ContentSwitching

  use_backend acme_challenge if is_acme
  use_backend audiobookshelf_nodes if host_audiobookshelf
+  use_backend kanidm if host_auth
  use_backend cache_nodes  if host_cache
  use_backend jellyfin if host_jellyfin
  use_backend share_nodes  if host_share
  use_backend gitea  if host_gitea
  use_backend gems  if host_gems
-  use_backend norn_sight  if host_norn_sight

 # Proxy Gitea's built-in SSH server over Tailscale to Jeeves. Port 22 remains
 # available to Endlessh on Portal.
@@ -134,6 +143,15 @@ backend audiobookshelf_nodes
  mode http
  server server jeeves:8000

+backend kanidm
+  mode http
+  http-request set-header X-Forwarded-For %[src]
+  http-request set-header X-Forwarded-Proto https
+  option httpchk
+  http-check send meth GET uri /status ver HTTP/1.1 hdr Host auth.tmmworkshop.com
+  http-check expect status 200
+  server kanidm jeeves.taile39c31.ts.net:8443 ssl verify required ca-file /etc/ssl/certs/ca-certificates.crt verifyhost jeeves.taile39c31.ts.net sni str(jeeves.taile39c31.ts.net) check check-sni jeeves.taile39c31.ts.net resolve-prefer ipv4
+
 backend cache_nodes
  mode http
  server server jeeves:5000
@@ -160,7 +178,3 @@ backend gems
  option forwardfor
  timeout server 1h
  server gems jeeves:8002
-
-backend norn_sight
-  mode http
-  server server jeeves:8001
@@ -0,0 +1,29 @@
+# install
+
+## preinstall steps
+
+remove old tailscale entry
+
+## commands
+
+```sh
+scp root@149.28.55.47:/etc/ssh/ssh_host_ed25519_key.pub ./temp.pub
+nix-shell -p ssh-to-age --run 'cat temp.pub | ssh-to-age'
+rm temp.pub
+nix-shell -p sops --run "sops updatekeys users/secrets.yaml"
+nix run github:nix-community/nixos-anywhere -- --ssh-port 22 --copy-host-keys --build-on local --flake .#portal-1 root@149.28.55.47
+ssh richie@149.28.55.47 -p 278
+kitty +kitten ssh richie@149.28.55.47 -p 278
+```
+
+## Small VM
+
+This was required for a 2gb vm
+
+```sh
+sudo tee /etc/default/grub.d/99-nixos-anywhere-disable-kho.cfg >/dev/null <<'EOF'
+GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} kho=off"
+EOF
+
+sudo update-grub && sudo reboot
+```
@@ -0,0 +1,25 @@
+system_token: ENC[AES256_GCM,data:Yc6m0q2xX3n+dcMZ7NMn4c4UPBmGK0EjL6E4fMdxnNHcELpc+BEywCLOECJQUNw1jgMb35P6uuyEXrT+CsW9WKzbXE07T9clWo4sMkaxLugb/AklXCvMt7Ci0ObIaUZuoeKOs685rMUZLS6/er8dS0kWoBvuWfCq6pzfmC61wOQ=,iv:YfdJ1bvLsqzFloDyHG6+Epcf6jRMv6FAJSZRSHfAG6k=,tag:BlGBjxCXGZUd/+XKQ1mAkA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaXFMVDBDV1lCYThDY1dh
+            U1VWbDFvd2huc04yQXF3RDl5TkE4UTR2RjFJCkJDbkdoWFJDVVlubWZTQVpGK09W
+            WkRJL0F3cjdNUmVQSlZiSE5QUmMzRk0KLS0tIFBST1JxdHpRSjlTU3c2UGNUNzJO
+            YlpJbENvV21GeEJtSm1PMVExK0JlV28KGMo+3gMjtR7722AWZpT8YuEJT0cxdQXR
+            Jf9ZCzmY54mBolyUeh6iBfNqdP6Ao3TeOGQcKFO1d0mLAWfAqdaCVw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaOTlxZjdHdnZwVGlRY2FW
+            WlU5R09LaW1rbzNmRUFWSkhtcHoyQWpJdGh3CkdFTUNBZFZJY0FjTVcxV0QvYWc2
+            SjI5Mkwwa3lTQTRTOWtXNXpaWHRITEEKLS0tIDlOS0tKNVRZOXdKRTNKa1pOZ2d3
+            MlEyZTZ0MXNkWXlSN2JlUHpKanpETkkKzWULPeeI6VH1GjKm/V/kEAc7DL5TzDbM
+            M700P1MqiCAyki6gO5BhmjdPspQFrc24z+hXL1WXJgKny7EmT9hUhw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cm7ujz4t9cyc3nyy0w30l2addggk0gy8h3shd9yq47jg845tndnsa3utfl
+    lastmodified: "2026-10-14T02:09:14Z"
+    mac: ENC[AES256_GCM,data:s6KwNHefexYx1kFBOIg1fA8gMFkZFPDAS2ElvjEMM1Yfv6Sf8E3+opq5TWxAzm5i9+wR7/0QjmGVxHmtHqUxhO+TWke4te4HPf3etgGFHOZtVApc3DBGywO+g78XbyjbvoOALQmCTNrm7hHkhPbHFJWap/4DhChK4GEDUJHi8Zs=,iv:eCNA1ZWoLHWVeQi2o3maILQgoc18OrGnOHJDvPHUrfA=,tag:1YNztKsLAFtn5pkGMLueHA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -3,18 +3,15 @@
  imports = [
    "${inputs.self}/users/richie"
    "${inputs.self}/common/global"
-    "${inputs.self}/common/optional/desktop.nix"
+    "${inputs.self}/common/optional/desktop"
    "${inputs.self}/common/optional/docker.nix"
    "${inputs.self}/common/optional/steam.nix"
    "${inputs.self}/common/optional/syncthing_base.nix"
    "${inputs.self}/common/optional/systemd-boot.nix"
    "${inputs.self}/common/optional/tailscale.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
-    "${inputs.self}/common/optional/yubikey.nix"
    "${inputs.self}/common/optional/zfs"
    ./hardware.nix
    ./programs.nix
-    ./qmk.nix
    ./syncthing.nix
    inputs.nixos-hardware.nixosModules.framework-13-7040-amd
  ];
@@ -0,0 +1,25 @@
+system_token: ENC[AES256_GCM,data:785g7cl+2IOLFnx0b4m+Eh2OyjPoKMDOHc4L9bI7t1JdRZgyeeGPuEvwI8Pd8NCpZV7vlibxT3RE5+7fjmUakRn6lTbTQ/U1rKIvKxPSS5ocPC6WXZLx4QRBvKzD6I8FFO45CkZ7GeVJ69j3wXWkyteHcCF0R+8r/VAAPTfBZG4=,iv:iO8oCSPEKMvLMRMNrGfgpwCBuMKx/cffksEGjoAlh4g=,tag:y8j4MPK0tjVcUkH0xJxEzQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIMmdsaWhPeHBTUWRqVWMz
+            aVB4RmRJRWFqSTdIYTMxc0hpeFV6UlFvM2dNCjdkTEhXeVFhcERxd2x0OUZTZTQz
+            QitzMjJ1UHFPMmlqUGdNd2FYRWEvWFUKLS0tIDVicThCam9hM0tSOE5hc1JlVEtZ
+            Wis4TTlqV1hiWXpuNjNnQ0w5aWVOOEUKzYOt27fcJ1OcdJNGMHnbHfhNd5KhCWsm
+            Bc3o9js8QxZYHGgiyq9RFenwpT1HSQp7Oj4clwLv9JtCCrTXpJXq5g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTTI5aTZQaTlqVzBWNjc1
+            dmFXV3VyanFvVjh3cmpDVEFrTFUvNmxPcXgwCmhtSmE3bHJLWTNHNVQyQlBBUTVG
+            TzdveVNYSWFMZ3k2NjdVQ1VqcjFCajQKLS0tIG11VnNlVElUN3RjNmtsZjRIL1h5
+            MGgwbHZnWWVkSEFyYWd6ajgyWVVVM1EKd0SlmGctAWcxYn03cqM752vzmZdeg63O
+            N8kb1I+QaeTeUrYrCCfTl2iEspyJx1G9QPEfdvbHYKpgNfdJBDUyHQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4
+    lastmodified: "2026-10-14T02:09:45Z"
+    mac: ENC[AES256_GCM,data:NHkNpGH1b3srra8cc4WAq+npFIMuXi+2JNMquYNVoOS9VTyDXfOxSeMVAHjpWErRnDo+wPU26RHQXapsNa+MdrVYzCbhSib5tRNZCMysnl7l8nTGpeNAITCF+45++AaWhC9iljVkB8zQaFFZak8KHH4EXih8yHuojadVMwZZuEs=,iv:wG+H+s+vbN+l4ojrw/+aU6o9tS6UMIE674OHOI2e5eM=,tag:XRUi0fqlCWMaJmiLFheKDA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
@@ -4,25 +4,23 @@ from __future__ import annotations

 import json
 import socket
-from os import environ
 from typing import TYPE_CHECKING

-from python.signal_alert import signal_alert
+import pytest
+
+from python.signal_alert import SignalRPCError, signal_alert

 if TYPE_CHECKING:
    from pytest_mock import MockerFixture


 def test_signal_alert(mocker: MockerFixture) -> None:
-    environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
-    environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
-
    mock_logger = mocker.patch("python.signal_alert.logger")
    mock_socket = mocker.patch("python.signal_alert.socket.socket")
    client = mock_socket.return_value.__enter__.return_value
    client.recv.side_effect = [b'{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n']

-    signal_alert("test")
+    assert signal_alert("test", "1234567890", "0987654321") is None

    mock_logger.info.assert_not_called()
    mock_socket.assert_called_once_with(socket.AF_UNIX, socket.SOCK_STREAM)
@@ -41,55 +39,31 @@ def test_signal_alert(mocker: MockerFixture) -> None:
    }


-def test_signal_alert_no_phones(mocker: MockerFixture) -> None:
-    environ.pop("SIGNAL_ALERT_FROM_PHONE", None)
-    environ.pop("SIGNAL_ALERT_TO_PHONE", None)
-    mock_logger = mocker.patch("python.signal_alert.logger")
-
-    signal_alert("test")
-
-    mock_logger.info.assert_called_once_with("SIGNAL_ALERT_FROM_PHONE or SIGNAL_ALERT_TO_PHONE not set")
-
-
 def test_signal_alert_socket_error(mocker: MockerFixture) -> None:
-    environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
-    environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
-
-    mock_logger = mocker.patch("python.signal_alert.logger")
    mocker.patch("python.signal_alert.socket.socket", side_effect=ConnectionError("connection failed"))

-    signal_alert("test")
+    with pytest.raises(SignalRPCError, match="Signal RPC failed") as exc_info:
+        signal_alert("test", "1234567890", "0987654321")

-    mock_logger.exception.assert_called_once_with("Unable to communicate with signal-cli")
+    assert isinstance(exc_info.value.__cause__, ConnectionError)


 def test_signal_alert_rpc_error(mocker: MockerFixture) -> None:
-    environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
-    environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
-
-    mock_logger = mocker.patch("python.signal_alert.logger")
    mock_socket = mocker.patch("python.signal_alert.socket.socket")
    client = mock_socket.return_value.__enter__.return_value
    client.recv.side_effect = [b'{"jsonrpc":"2.0","error":{"code":-1,"message":"failed"},"id":"signal-alert"}\n']

-    signal_alert("test")
-
-    mock_logger.error.assert_called_once_with(
-        "Signal RPC returned an error: %s",
-        {"code": -1, "message": "failed"},
-    )
+    with pytest.raises(SignalRPCError, match=r"Signal RPC returned an error:.*failed"):
+        signal_alert("test", "1234567890", "0987654321")


 def test_signal_alert_ignores_notifications(mocker: MockerFixture) -> None:
-    environ["SIGNAL_ALERT_FROM_PHONE"] = "1234567890"
-    environ["SIGNAL_ALERT_TO_PHONE"] = "0987654321"
-
    mock_socket = mocker.patch("python.signal_alert.socket.socket")
    client = mock_socket.return_value.__enter__.return_value
    client.recv.side_effect = [
        b'{"jsonrpc":"2.0","method":"receive"}\n{"jsonrpc":"2.0","result":{},"id":"signal-alert"}\n'
    ]

-    signal_alert("test")
+    assert signal_alert("test", "1234567890", "0987654321") is None

    assert client.recv.call_count == 1
@@ -1,167 +0,0 @@
-"""test_snapshot_manager."""
-
-from __future__ import annotations
-
-from datetime import UTC, datetime
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-import pytest
-
-from python.tools.snapshot_manager import get_snapshots_to_delete, get_time_stamp, load_config_data, main
-from python.zfs.dataset import Dataset, Snapshot
-
-if TYPE_CHECKING:
-    from pyfakefs.fake_filesystem import FakeFilesystem
-    from pytest_mock import MockerFixture
-
-SNAPSHOT_MANAGER = "python.tools.snapshot_manager"
-
-
-def patch_utcnow(mocker: MockerFixture, datetime_value: datetime) -> None:
-    """patch_utcnow."""
-    mocker.patch("python.tools.snapshot_manager.utcnow", return_value=datetime_value)
-
-
-def create_mock_snapshot(mocker: MockerFixture, name: str) -> Snapshot:
-    """create_mock_snapshot."""
-    mock_snapshot = mocker.MagicMock(spec=Snapshot)
-    mock_snapshot.name = name
-
-    return mock_snapshot
-
-
-def test_main(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """Test main."""
-    load_config_data.cache_clear()
-
-    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
-
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.create_snapshot.return_value = "snapshot created"
-    mock_get_datasets = mocker.patch(f"{SNAPSHOT_MANAGER}.get_datasets", return_value=(mock_dataset,))
-
-    mock_get_snapshots_to_delete = mocker.patch(f"{SNAPSHOT_MANAGER}.get_snapshots_to_delete")
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-    mock_snapshot_config_toml = '["default"]\n15_min = 8\nhourly = 24\ndaily = 0\nmonthly = 0\n'
-    fs.create_file("/mock_snapshot_config.toml", contents=mock_snapshot_config_toml)
-    main(Path("/mock_snapshot_config.toml"))
-
-    mock_signal_alert.assert_not_called()
-    mock_get_datasets.assert_called_once()
-    mock_get_snapshots_to_delete.assert_called_once_with(
-        mock_dataset,
-        {
-            "15_min": 8,
-            "hourly": 24,
-            "daily": 0,
-            "monthly": 0,
-        },
-    )
-
-
-def test_main_create_snapshot_failure(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """Test main."""
-    load_config_data.cache_clear()
-
-    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
-
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.create_snapshot.return_value = "snapshot not created"
-    mock_get_datasets = mocker.patch(f"{SNAPSHOT_MANAGER}.get_datasets", return_value=(mock_dataset,))
-
-    mock_get_snapshots_to_delete = mocker.patch(f"{SNAPSHOT_MANAGER}.get_snapshots_to_delete")
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-    mock_snapshot_config_toml = '["default"]\n15_min = 8\nhourly = 24\ndaily = 0\nmonthly = 0\n'
-    fs.create_file("/mock_snapshot_config.toml", contents=mock_snapshot_config_toml)
-    main(Path("/mock_snapshot_config.toml"))
-
-    mock_signal_alert.assert_called_once_with("test_dataset failed to create snapshot 2023-01-01T00:00:00")
-    mock_get_datasets.assert_called_once()
-    mock_get_snapshots_to_delete.assert_not_called()
-
-
-def test_main_exception(mocker: MockerFixture, fs: FakeFilesystem) -> None:
-    """Test main."""
-    load_config_data.cache_clear()
-
-    mocker.patch(f"{SNAPSHOT_MANAGER}.get_time_stamp", return_value="2023-01-01T00:00:00")
-
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.create_snapshot.return_value = "snapshot created"
-    mock_get_datasets = mocker.patch(f"{SNAPSHOT_MANAGER}.get_datasets", side_effect=Exception("test"))
-
-    mock_get_snapshots_to_delete = mocker.patch(f"{SNAPSHOT_MANAGER}.get_snapshots_to_delete")
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-    mock_snapshot_config_toml = '["default"]\n15_min = 8\nhourly = 24\ndaily = 0\nmonthly = 0\n'
-    fs.create_file("/mock_snapshot_config.toml", contents=mock_snapshot_config_toml)
-    with pytest.raises(SystemExit) as pytest_wrapped_e:
-        main(Path("/mock_snapshot_config.toml"))
-
-    assert isinstance(pytest_wrapped_e.value, SystemExit)
-    assert pytest_wrapped_e.value.code == 1
-    mock_signal_alert.assert_called_once_with("snapshot_manager failed")
-    mock_get_datasets.assert_called_once()
-    mock_get_snapshots_to_delete.assert_not_called()
-
-
-def test_get_snapshots_to_delete(mocker: MockerFixture) -> None:
-    """test_get_snapshots_to_delete."""
-    mock_snapshot_0 = create_mock_snapshot(mocker, "auto_202509150415")
-    mock_snapshot_1 = create_mock_snapshot(mocker, "auto_202509150415")
-
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.get_snapshots.return_value = (mock_snapshot_0, mock_snapshot_1)
-    mock_dataset.delete_snapshot.return_value = None
-
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-
-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
-
-    mock_signal_alert.assert_not_called()
-    mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")
-
-
-def test_get_snapshots_to_delete_no_snapshot(mocker: MockerFixture) -> None:
-    """test_get_snapshots_to_delete_no_snapshot."""
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.get_snapshots.return_value = ()
-    mock_dataset.delete_snapshot.return_value = None
-
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-
-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
-
-    mock_signal_alert.assert_not_called()
-    mock_dataset.delete_snapshot.assert_not_called()
-
-
-def test_get_snapshots_to_delete_errored(mocker: MockerFixture) -> None:
-    """test_get_snapshots_to_delete_errored."""
-    mock_snapshot_0 = create_mock_snapshot(mocker, "auto_202509150415")
-    mock_snapshot_1 = create_mock_snapshot(mocker, "auto_202509150415")
-
-    mock_dataset = mocker.MagicMock(spec=Dataset)
-    mock_dataset.name = "test_dataset"
-    mock_dataset.get_snapshots.return_value = (mock_snapshot_0, mock_snapshot_1)
-    mock_dataset.delete_snapshot.return_value = "snapshot has dependent clones"
-
-    mock_signal_alert = mocker.patch(f"{SNAPSHOT_MANAGER}.signal_alert")
-
-    get_snapshots_to_delete(mock_dataset, {"15_min": 1, "hourly": 0, "daily": 0, "monthly": 0})
-
-    mock_signal_alert.assert_called_once_with(
-        "test_dataset@auto_202509150415 failed to delete: snapshot has dependent clones"
-    )
-    mock_dataset.delete_snapshot.assert_called_once_with("auto_202509150415")
-
-
-def test_get_time_stamp(mocker: MockerFixture) -> None:
-    """Test get_time_stamp."""
-    patch_utcnow(mocker, datetime(2023, 1, 1, 0, 0, 0, tzinfo=UTC))
-    assert get_time_stamp() == "auto_202301010000"
@@ -13,6 +13,11 @@ command = "nixfmt"
 # Glob pattern of files to include
 includes = ["*.nix"]

+[formatter.rustfmt]
+command = "rustfmt"
+options = ["--edition", "2024"]
+includes = ["*.rs"]
+
 [formatter.ruff-format]
 command = "ruff"
 options = ["format"]
@@ -36,8 +36,6 @@ in
        "hass"
        "libvirtd"
        "networkmanager"
-        "nornsight"
-        "nornsight-admin"
        "plugdev"
        "scanner"
        "transmission"
@@ -36,11 +36,10 @@ in
        "hass"
        "libvirtd"
        "networkmanager"
-        "nornsight"
-        "nornsight-admin"
        "ollama"
        "plugdev"
        "scanner"
+        "signal-cli"
        "transmission"
        "uaccess"
        "uucp"
@@ -21,7 +21,7 @@
    vlc
    # browser
    brave
-    chromium
+    firefox
    # dev tools
    gparted
    jetbrains.datagrip
@@ -1,9 +1,7 @@
 { pkgs, ... }:
 {
  home.packages = [
-    pkgs.master.claude-code
    pkgs.master.codex
    pkgs.master.opencode
-    pkgs.master.pi-coding-agent
  ];
 }
@@ -42,6 +42,9 @@
    rustfmt
    trunk
    wasm-pack
+    # protobuf
+    protobuf
+    buf
    # nix
    nix-init
    nix-output-monitor
@@ -6,58 +6,58 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMjQvSzZSY08vRlI0dzBP
-            YytpVlpPSGFHaTI5b2xzUkFFdEY0bVhQdGgwClM3UmM1OElpcEZTcTB0NHpSZ2d6
-            aVBpcjVIaDk3Tko1cm4xYjdkYVQ1L1EKLS0tIE1aQW95U0JIVGc4MGloSXRXc3ZS
-            a3EvU1dJdmxOeVBIS28yT3dHd2ZEYWcKv5TIqRRQs3AXER1WHEx8wotyXr2Ktxsu
-            dwldwEHyDNqwf7UgGOZu7JueeZ7y2KC8KZ7ixIdrhVaoxuLEvCg7VA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArMVJ6Rm1QQlAvR2FKRmFu
+            dlBianhsU051dnh4Y3Zqdkt2RHVQTy9KVVZFClVCMXZmR3pSR0hxNzB2RnFuS2Fs
+            OGZCQjdJTmhTa1NDZ1B4L2tJSnFmdmcKLS0tIEhTQTRNZUdlNy9XcC9EbnVrcmZQ
+            Tzh5SUt0K3hUVll2dDZNR1ZnbzVPRFUKxTLOmsr5zMKCuH7KDqs1itkPLn+2kzSh
+            0s5C5XOIsMwUrkA/uIFrOWaP57YBVWPM2Ry+GAp4Bbf+y8C1en5HUw==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1u8zj599elqqvcmhxn8zuwrufsz8w8w366d3ayrljjejljt2q45kq8mxw9c
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByaE5jb3p3VzZ1dE05Wmlx
-            c1ZoWGhTcTRHRE9oMWtkaCtBY1l1a2QyWWlvCk9MM2FmcEZubXR1REpOcHZ6aHVE
-            UEkzbllZdkxPYzlTMHNod3VWNnhoaTgKLS0tIGVCdEpqUzhFM0swRjVjb0Z6ckFN
-            UzlYb1U4UGJqWE9oczdlNVh1S1lqL3cKSKxaJFhun2ee45I1jC55YKNdfYB8MsS+
-            dgFOFCvn/4uEcUyKZbUf0STjbIZ5eMHl8NVRTupI4tftGiE559M5Wg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaTd1dU0zUGZVSkJJOUQw
+            OThIMDVSM1FKdVptaDNsMlFOYThpVmFnN1JvCmpqZlBrY2hVQ2grWkJOZTJkay9T
+            Q0VBVzRVYk5vU1BGMFhOckl3TDJDNjQKLS0tIDVqQTlJaHBuY0tHLzEwKzh6QStZ
+            a0ZqZmdOTnNEdEp6Nk5sN0NyT05MWmMKgP43hrlXzBpp+hELBaOJdYdsU3AmDvPf
+            FOh89Fn9Zp+Lm1shQTF6GcACTAr04+7MPfLveyUFt4vbHxr9ISYaOg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1q47vup0tjhulkg7d6xwmdsgrw64h4ax3la3evzqpxyy4adsmk9fs56qz3y
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2U01jTVZQT1RRRU1nQmVv
-            Z0lnOGJLN1c0UkNLbnJjV29na3Rub0xzbXhNCjY0aFNuUnFDUnZheDRHT3R5L3Fv
-            ZkJ3QkF2RENKRVdUYjRzRXMrNklvN2cKLS0tIFJzK2o1MmVTWHZMWmVDWlgzeGY5
-            VDg4OGl0NGFYY2VNZGY5UkR1cVdWY0UK1qa3swdfgUw1tnnThRf1sl9f2zTP/d/d
-            iwcenOEryXatVMJjZVWrLC5C7MwtKz+pIBXa98yaSpCDLqjAMwOCPg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWUZRME43WmxLd1BHaHFm
+            dXBib3NLcnI2K3M0cnl3NHJxSXU4Q253cW1ZCmlva2RReGcyTFN0TURCbkJFcHRW
+            Skd6aVVhcFlOYXkvTVVBRzZaYUpSUHcKLS0tIHlxMHQ1d21TSDBHMmtraUM3S0F2
+            VUUwOFJtSkM3V2tESnExR1hUSCt0TjgKOnhAVyikMjsc/lTKJrkbhQCw/EgiKuUg
+            DmzoBvVYmBfAJR74VVOdex2t0Ieg9SuHtCO7dQ7h82woY9Z8UudWDQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1jhf7vm0005j60mjq63696frrmjhpy8kpc2d66mw044lqap5mjv4snmwvwm
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTREI2UEZwS0Y0SmEvK1F4
-            Y1hZZjRVWWxMT29mc3ZXcHFDclRUYi96LzA4CkIwZ2h4T2JQRW1OL2hmRTFHWkFY
-            RHZqQUFqU3hvNlRBZHRiSThPVUE3TG8KLS0tIHh0Z2tlNXREczJsa1g2ekZyZjBt
-            dW41aVA3VEVqa1NDMHM0T3FKZFNTN0kKGQPRUMSRtibFVFRZR/igsjgxgDo4ogga
-            dUHBRU65r41er+Wk3lKdtbXJX1g83K8ay7540hNXheOhxFi57trrzA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMazg0K1o0WkU0ZHRZdWpV
+            UGxMV0cwaW9ZOG5PWVI4ZXZrSldIc2xuMDNzCmlhYjUwMXF5U1g0ODlMZmVVVXdj
+            K3hOM1Arc3VNTHNKMkozRXpYSG5RQWcKLS0tIEhrZFF6K1ZpYjNiMEFyYUpGejNM
+            Q3Q2cFhaVHhoOTZzM3pKeDBFam9PUVEK4XPeeoMYFWCr/LBTA+ZrnMqz+mE3IaKo
+            OQNVGW84fk7SZ4lWWU8l6jZmmX1Sf9aqyFad1hoI9N3AEZmhiiyhlA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age13lmqgc3jvkyah5e3vcwmj4s5wsc2akctcga0lpc0x8v8du3fxprqp4ldkv
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrV1Z2MGNPK28wTStRSUZW
-            dmFMaUt5MENHeUpVcDVxQnZhd1o5RmJwOWwwCittaGNrcW1hV25VaGJaTEhZRFBJ
-            Y2toWEpFWFZYT0plb2lkTlJCS2Mwb3MKLS0tIHlkVjVESWFsbWlVQ0xVQ0llclF2
-            L1FMbC91YjJsR3BGRjJ0QVQ1MDdBbEUKNnOI9+H1LJcvVcwl9uQMmFp35y5RB+Zl
-            Mo3z3unweQtS+jiUn7RyVs5daG1E2tfihu2CQDWaktuCuunMpt3Wew==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRHF5R2lWYWF1dUM3a3ZJ
+            RWZDVFBjRVhRaE5PRGtlbmROZm5IOWdNQkYwCldSWisvaVZDLzdwRDFCRkprM1Vo
+            NnFXUU1FWWIwZ3Nja3Mya2l3U1lROGcKLS0tIGRlZmhFQlBCZEJxYnRTUkcrSlVq
+            RC9jY0NINCtKTHRmMGRmd0N1WUVHWWcKrBjys6OKDuAELbpFpLOvV5GOXuVW9STX
+            ndHNw1rI14QJ7lZ54gAfdAtNFl1NzHDsaUuv/HIW9i2jhkv+APKtuA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ufnewppysaq2wwcl4ugngjz8pfzc5a35yg7luq0qmuqvctajcycs5lf6k4
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqR0hUT3hxTzRwTVhuTm9E
-            TUFtNFFCYWNUNUNVbHNaNXQ0aEVBa04vSEU0CkRPVzhuYUsrM0wxZjRDdkxvTVA2
-            UW9CSjlIQW5yenhaUi9mbEdLYlhWYk0KLS0tIGRXMm9Wa3l4UWxqcGl6ZlBZV3E0
-            Z3YrbUYrSmV0NHNTeTdhMkJEdytwSmMKGLpe5+p4FGJNHy6SVgnsDbEsiP0J8lW/
-            0+3X3LQoL0f1S2L5DjexF/H0NGvWjAPaGzDNB6V50VxGDabEIVqjvQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Ti9laG9aTlpSSFR5Vmk0
+            MEVFY2pJdDJaK0RZQ1dUd2dRMDBSOVNNWEhBCmdsSDl3a1RPTE9xSlRSZTBhNFVB
+            bzFoVlZzQjQ3QWJoZkwrUWFucTlRN1kKLS0tIEozRUwwTnlpMHg4eGdLa2h5U3hF
+            ekEwYTBKWmRiK29JMXVqbU1DWVVWNGcKY6kkh7poDQHDdZdFdqzEI12P9UMq2saQ
+            gQXljjqcamqZ96KwFmuZm9RB/6OJJAPY8MBSqlrPTSjcnAqikXWpEA==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1vyav6kxtvt3z4vtnkkjj38eu8hlts5m7ygyckhskvalg2gpjk52su53d0a
+          recipient: age1cm7ujz4t9cyc3nyy0w30l2addggk0gy8h3shd9yq47jg845tndnsa3utfl
    lastmodified: "2026-08-25T15:35:53Z"
    mac: ENC[AES256_GCM,data:4/WuSmUb2ONlB56dgbwwekZ8h7E1vvPzPxYCvNM8N68nt1nb9JxoMeAX9PktmljAarYLQJd1O5+49ZEph3Gzx9LrwvWnm9asq0UeeJi08x7wdQDcawNFlBFzXF2qlgxU1JssNHZZOB+5nYH4t8vFzPTq/9BqoifPR2+pLBYhUQI=,iv:N/gVgeWT2/1bfHuR6TanyDBijWmXAqyACXpnwfwDuVA=,tag:pQ4ct4G7SARz2wyjOc7AKQ==,type:str]
    unencrypted_suffix: _unencrypted