flake.lock: Update

Flake lock file updates:

• Updated input 'firefox-addons':
    'gitlab:rycee/nur-expressions/0581568?dir=pkgs/firefox-addons' (2026-04-17)
  → 'gitlab:rycee/nur-expressions/4d89e8e?dir=pkgs/firefox-addons' (2026-04-29)
• Updated input 'home-manager':
    'github:nix-community/home-manager/565e534' (2026-04-17)
  → 'github:nix-community/home-manager/d3b4e4b' (2026-04-29)
• Updated input 'nixos-hardware':
    'github:nixos/nixos-hardware/c775c27' (2026-04-06)
  → 'github:nixos/nixos-hardware/2096f3f' (2026-04-23)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/4bd9165' (2026-04-14)
  → 'github:nixos/nixpkgs/1c3fe55' (2026-04-27)
• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/025c852' (2026-04-17)
  → 'github:nixos/nixpkgs/1e1459d' (2026-04-29)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/d4971dd' (2026-04-13)
  → 'github:Mic92/sops-nix/8eaee5c' (2026-04-28)

.gitignore

@@ -169,3 +169,6 @@ test.*
 # Frontend build output
 frontend/dist/
 frontend/node_modules/
+
+# data from testing llms
+data/*

.vscode/settings.json

@@ -203,6 +203,7 @@
     "peerconnection",
     "PESKYFOX",
     "PGID",
+    "pgvector",
     "pipewire",
     "pkgs",
     "plugdev",

flake.lock

@@ -8,11 +8,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1776398575,
+        "lastModified": 1777435375,
-        "narHash": "sha256-WArU6WOdWxzbzGqYk4w1Mucg+bw/SCl6MoSp+/cZMio=",
+        "narHash": "sha256-2WRfJbipnTz+EY3rHRnCoG4kWkzPczb/cLcWwhy/0QA=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "05815686caf4e3678f5aeb5fd36e567886ab0d30",
+        "rev": "4d89e8e2c50711ee3fea3a25e662cfa5c6628e07",
         "type": "gitlab"
       },
       "original": {
@@ -29,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776454077,
+        "lastModified": 1777434174,
-        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
+        "narHash": "sha256-KwTyQ5g2qDhWIs/O6vH8HeF8n4JCzZIT/VYE7nYnukQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
+        "rev": "d3b4e4b1bd59aedd3d4eb0a8df7162edb6da4607",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1775490113,
+        "lastModified": 1776983936,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
         "type": "github"
       },
       "original": {
@@ -60,11 +60,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776169885,
+        "lastModified": 1777268161,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1776469842,
+        "lastModified": 1777437048,
-        "narHash": "sha256-sqzM6PKMQoGk8Sl+uv2sbP1qiS2SPQhA2yn5zgZINMc=",
+        "narHash": "sha256-Ca4jKXJuYp1D+DqiuQ/vGHRYKPlAZTn1vq7XDU9t18w=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "025c852a89be820b3117f604c8ace42e9b4caa08",
+        "rev": "1e1459dda883651ef85e23c7c6e2224cba195065",
         "type": "github"
       },
       "original": {
@@ -125,11 +125,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776119890,
+        "lastModified": 1777338324,
-        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
+        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
+        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
         "type": "github"
       },
       "original": {

overlays/default.nix

@@ -42,6 +42,7 @@
         sqlalchemy
         tenacity
         textual
+        tiktoken
         tinytuya
         typer
         websockets

systems/bob/llms.nix

@@ -42,12 +42,13 @@
       "qwen3:8b"
       "qwen3.5:27b"
       "qwen3.5:35b"
+      "qwen3.6:35b"
       "translategemma:12b"
       "translategemma:27b"
       "translategemma:4b"
       "rinex20/translategemma3:12b"
     ];
-    models = "/zfs/models";
+    models = "/zfs/storage/models";
     openFirewall = true;
   };
 }

systems/jeeves/default.nix

@@ -37,5 +37,10 @@ in
     zerotierone.joinNetworks = [ "a09acf02330d37b9" ];
   };
 
+  users.groups = {
+    nornsight = { };
+    nornsight-admin = { };
+  };
+
   system.stateVersion = "24.05";
 }

systems/jeeves/scripts/zfs.sh

@@ -41,3 +41,4 @@ sudo zfs create storage/secure/plex -o recordsize=1M -o compression=zstd-19
 sudo zfs create storage/secure/secrets -o compression=zstd-19 -o copies=3
 sudo zfs create storage/secure/syncthing -o compression=zstd-19
 sudo zfs create storage/secure/transmission -o recordsize=1M -o compression=zstd-9 -o exec=off -o sync=disabled
+sudo zfs create storage/secure/important -o compression=zstd-19 -o copies=2 -o mountpoint=/zfs/storage/important

systems/jeeves/services/postgress.nix

@@ -12,6 +12,7 @@ in
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_17_jit;
+    extensions = ps: with ps; [ pgvector ];
     enableTCPIP = true;
     enableJIT = true;
     dataDir = "${vars.database}/postgres";

systems/jeeves/web_services/acme.nix

@@ -5,7 +5,9 @@ let
     "gitea"
     "jellyfin"
     "share"
+    "verilux"
   ];
+  extraDomains = [ "www.norn-sight.com" ];
 
   makeCert = name: {
     name = "${name}.tmmworkshop.com";
@@ -16,7 +18,18 @@ let
     };
   };
 
-  acmeServices = map (domain: "acme-${domain}.tmmworkshop.com.service") domains;
+  makeExtraCert = name: {
+    inherit name;
+    value = {
+      webroot = "/var/lib/acme/.challenges";
+      group = "acme";
+      reloadServices = [ "haproxy.service" ];
+    };
+  };
+
+  acmeServices =
+    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
+    ++ map (domain: "acme-${domain}.service") extraDomains;
 in
 {
   users.users.haproxy.extraGroups = [ "acme" ];
@@ -24,7 +37,7 @@ in
   security.acme = {
     acceptTerms = true;
     defaults.email = "Richie@tmmworkshop.com";
-    certs = builtins.listToAttrs (map makeCert domains);
+    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
   };
 
   # Minimal nginx to serve ACME HTTP-01 challenge files for HAProxy

systems/jeeves/web_services/haproxy.cfg

@@ -23,7 +23,7 @@ defaults
 #Application Setup
 frontend ContentSwitching
   bind *:80 v4v6
-  bind *:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem
+  bind *:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem crt /var/lib/acme/www.norn-sight.com/full.pem
   mode  http
 
   # ACME challenge routing (must be first)
@@ -36,6 +36,7 @@ frontend ContentSwitching
   acl host_jellyfin  hdr(host) -i jellyfin.tmmworkshop.com
   acl host_share  hdr(host) -i share.tmmworkshop.com
   acl host_gitea  hdr(host) -i gitea.tmmworkshop.com
+  acl host_norn_sight  hdr(host) -i www.norn-sight.com
 
   # Hosts allowed to serve plain HTTP (add entries to skip the HTTPS redirect)
   acl allow_http hdr(host) -i __none__
@@ -49,6 +50,7 @@ frontend ContentSwitching
   use_backend jellyfin if host_jellyfin
   use_backend share_nodes  if host_share
   use_backend gitea  if host_gitea
+  use_backend norn_sight  if host_norn_sight
 
 backend acme_challenge
   mode http
@@ -76,3 +78,7 @@ backend share_nodes
 backend gitea
   mode http
   server server 127.0.0.1:6443
+
+backend norn_sight
+  mode http
+  server server 192.168.90.49:8000

systems/rhapsody-in-green/agent_logger.nix

@@ -0,0 +1,35 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  systemd.services.agent-logger = {
+    description = "Unified agent logger";
+    after = [ "local-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    environment = {
+      AGENT_LOG_DB = "/var/lib/agent-logger/agent_log.sqlite";
+      HOME = "/home/richie";
+      PYTHONPATH = "${inputs.self}";
+    };
+
+    serviceConfig = {
+      Type = "simple";
+      User = "richie";
+      WorkingDirectory = "/home/richie";
+      ExecStart = "${pkgs.my_python}/bin/python -m python.agent_logger.main";
+      StateDirectory = "agent-logger";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      StandardOutput = "journal";
+      StandardError = "journal";
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = "read-only";
+      PrivateTmp = true;
+      ReadOnlyPaths = [ "${inputs.self}" ];
+    };
+  };
+}

systems/rhapsody-in-green/open_webui.nix

@@ -1,6 +1,7 @@
 {
   services.open-webui = {
     enable = true;
+    host = "0.0.0.0";
     environment = {
       ANONYMIZED_TELEMETRY = "False";
       DO_NOT_TRACK = "True";

users/math/default.nix

@@ -36,6 +36,8 @@ in
         "hass"
         "libvirtd"
         "networkmanager"
+        "nornsight"
+        "nornsight-admin"
         "plugdev"
         "scanner"
         "transmission"

users/richie/default.nix

@@ -36,6 +36,8 @@ in
         "hass"
         "libvirtd"
         "networkmanager"
+        "nornsight"
+        "nornsight-admin"
         "ollama"
         "plugdev"
         "scanner"

users/richie/home/gui/kitty.nix

@@ -6,6 +6,7 @@
     settings = {
       allow_remote_control = "yes";
       shell = "${pkgs.zsh}/bin/zsh";
+      scrollback_lines = 50000;
       wayland_titlebar_color = "background";
       background_opacity = "0.75";
       tab_bar_edge = "top";

users/richie/home/gui/vscode/settings.json

@@ -14,7 +14,7 @@
   "git.pruneOnFetch": true,
   "terminal.integrated.scrollback": 10000,
   "update.mode": "none",
-  "workbench.colorTheme": "Default Dark+",
+  "workbench.colorTheme": "Dark+",
   "workbench.secondarySideBar.showLabels": false,
 
   // turns off all sounds and announcements
@@ -98,4 +98,5 @@
   "hediet.vscode-drawio.resizeImages": null,
   "hediet.vscode-drawio.appearance": "automatic",
   "claudeCode.preferredLocation": "panel",
+  "docker.extension.enableComposeLanguageServer": false,
 }