migrate remaining git.t-juice.club references to code.t-juice.club

Update flake inputs, MCP server URLs, and remove old GitHub Actions
workflows (will be replaced with new CI on Forgejo).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/actions-check.yaml

@@ -1,33 +0,0 @@
-name: Check actions
-on:
-  push:
-    paths:
-      - .github/workflows/*.yaml
-      - .github/workflows/*.yml
-  pull_request:
-    paths:
-      - .github/workflows/*.yaml
-      - .github/workflows/*.yml
-
-jobs:
-  check-actions-actionlint:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-      - run: |
-          go install github.com/rhysd/actionlint/cmd/actionlint@latest
-          actionlint .github/workflows/*.yaml
-  check-actions-yamllint:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v5
-      - run: |
-          pipx run yamllint .github/workflows/*.yaml

.github/workflows/flake-check.yaml

@@ -1,14 +0,0 @@
-name: Run nix flake check
-on:
-  push:
-  pull_request:
-
-jobs:
-  flake-check:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v27
-      - run: nix flake check

.github/workflows/flake-update.yaml

@@ -1,36 +0,0 @@
----
-name: Periodic flake update
-on:  # yamllint disable-line rule:truthy
-  schedule:
-    - cron: "0 */2 * * *"
-
-permissions:
-  contents: write
-
-jobs:
-  flake-update:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/catthehacker/ubuntu:runner-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: master
-      - uses: cachix/install-nix-action@v27
-      - name: configure git
-        env:
-          SSH_PRIVKEY: ${{ secrets.BOT_SSH_PRIVKEY }}
-          SSH_PUBKEY: ${{ secrets.BOT_SSH_PUBKEY }}
-        run: |
-          echo "$SSH_PRIVKEY" > "$RUNNER_TEMP/id_ed25519"
-          echo "$SSH_PUBKEY" > "$RUNNER_TEMP/id_ed25519.pub"
-          chmod -R 0600 "$RUNNER_TEMP/id_ed25519.pub" "$RUNNER_TEMP/id_ed25519"
-          git config --global user.name 'torjus-bot'
-          git config --global user.email 'torjus-bot@git.t-juice.club'
-          git config --global user.signingKey "$RUNNER_TEMP/id_ed25519.pub"
-          git config --global gpg.format ssh
-          git config --global commit.gpgsign true
-      - name: flake update
-        run: nix flake update --commit-lock-file
-      - name: push
-        run: git push

.mcp.json

@@ -2,28 +2,28 @@
   "mcpServers": {
     "nixpkgs-options": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "options", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "nixpkgs-packages": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#nixpkgs-search", "--", "packages", "serve"],
       "env": {
         "NIXPKGS_SEARCH_DATABASE": "sqlite:///run/user/1000/labmcp/nixpkgs-search.db"
       }
     },
     "hm-options": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#hm-options", "--", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#hm-options", "--", "serve"],
       "env": {
         "HM_OPTIONS_DATABASE": "sqlite:///run/user/1000/labmcp/hm-options.db"
       }
     },
     "git-explorer": {
       "command": "nix",
-      "args": ["run", "git+https://git.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
+      "args": ["run", "git+https://code.t-juice.club/torjus/labmcp#git-explorer", "--", "serve"],
       "env": {
         "GIT_REPO_PATH": "/home/torjus/git/nixos-servers"
       }

.sops.yaml

@@ -23,3 +23,4 @@ creation_rules:
       - age:
         - *admin_torjus
         - *server_magicman
+        - *server_gunter

docs/magicman-keyboard-luks.md

@@ -0,0 +1,156 @@
+# Magicman: PS/2 Keyboard Broken at LUKS Prompt After BIOS Update
+
+## Issue
+
+After updating the ThinkPad L14 Gen 4 (21H2S3US00) BIOS to version R24ET51W (1.34)
+via `fwupdmgr`, the built-in laptop keyboard no longer works during the LUKS disk
+encryption password prompt. An external USB keyboard must be used to unlock the disk.
+The laptop keyboard works normally after boot.
+
+## Machine Details
+
+- **Model**: Lenovo ThinkPad L14 Gen 4 (21H2S3US00)
+- **BIOS**: R24ET51W (1.34), dated 2025-10-31
+- **EC**: R24HT33W
+- **Date**: 2026-03-06
+
+### What fwupdmgr Installed
+
+- System Firmware: 0.1.12 → 0.1.34
+- UEFI dbx: 20230301 → 20250902
+- KEK CA: 2011 → 2023
+
+## Symptoms
+
+- Laptop keyboard does not respond at the LUKS password prompt (neither systemd nor scripted initrd)
+- USB keyboard works fine at the LUKS prompt
+- Laptop keyboard works immediately after boot (at greetd login)
+- Text typed on the laptop keyboard during LUKS prompt sometimes partially appears
+  at the greetd username field after boot, indicating the keyboard hardware IS generating
+  scancodes that get buffered and flushed later
+
+## Kernel Errors
+
+Every boot shows these errors from the atkbd driver:
+
+```
+atkbd serio0: Failed to deactivate keyboard on isa0060/serio0
+atkbd serio0: Failed to enable keyboard on isa0060/serio0
+input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input0
+atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly.
+```
+
+The keyboard device IS registered despite the errors, and the `kbd` input handler
+binds to it (`Handlers=sysrq kbd leds event6`).
+
+## Root Cause Analysis
+
+The BIOS update changed the PS/2 controller (i8042) initialization behavior. The atkbd
+driver sends a deactivate command (0xF5) during init, which likely succeeds at disabling
+the keyboard even though the ACK times out. The subsequent enable command (0xF4) also
+times out without re-enabling it. The keyboard stays disabled at the hardware level —
+it queues keypresses in its small internal buffer (~16 keys) but doesn't send scancodes
+to the host until something re-enables it during full boot. This is NOT a timing issue —
+leaving the system at the LUKS prompt for several minutes does not fix the keyboard.
+Something specific that happens later in the boot process (likely during switch-root
+when udev re-processes devices) re-enables the keyboard.
+
+## What Was Tried
+
+### Kernel Parameters (none helped)
+
+- `i8042.dumbkbd` — skip keyboard reset during i8042 probe
+- `i8042.nopnp` — don't use PNP to discover controllers
+- `i8042.reset` — force i8042 controller reset
+- `i8042.nomux` — don't probe for MUX
+- `atkbd.reset` — reset keyboard during atkbd init
+- `console=tty1` — explicitly route console I/O to tty1
+- Various combinations of the above
+
+### Initrd Module Loading
+
+- Added `i8042`, `atkbd`, `thinkpad_acpi` to `boot.initrd.kernelModules`
+- `thinkpad_acpi` loads the EC driver early, but didn't help
+
+### Initrd Services
+
+- Created `keyboard-reconnect` systemd service that runs before `systemd-cryptsetup@root.service`
+- Tried `echo reconnect > /sys/bus/serio/devices/serio0/drvctl` — reconnect also fails
+- Tried full module reload: `rmmod atkbd; rmmod i8042; sleep N; modprobe i8042; modprobe atkbd`
+  - Tested with sleep 2 and sleep 8
+  - The reload creates a new serio device (serio2) but initialization fails identically
+
+### Plymouth
+
+- Disabled Plymouth (`boot.plymouth.enable = false`) — no effect
+- Tested `plymouth.enable=0` on kernel command line — no effect
+- Confirmed password agent falls back to `systemd-tty-ask-password-agent` on `/dev/tty1`
+
+### Scripted Initrd
+
+- Switched from systemd initrd to scripted initrd (`boot.initrd.systemd.enable = false`)
+- Uses a completely different password prompt mechanism (shell `read`)
+- Same result — keyboard still doesn't work
+
+### BIOS
+
+- Checked BIOS settings — no relevant keyboard/PS/2 options available
+- `fwupdmgr get-updates` shows no newer BIOS version available
+
+## Planned Fix: TPM + Secure Boot Auto-Unlock
+
+### Approach
+
+Use TPM2-based LUKS unlock with Secure Boot to bypass the keyboard requirement entirely.
+
+- **lanzaboote** — replaces systemd-boot, produces signed Unified Kernel Images (UKIs)
+  that bundle kernel + initrd + cmdline into a single signed EFI binary
+- **Secure Boot** — ensures only signed code can boot, prevents tampering with boot chain
+- **TPM2 unlock** — `systemd-cryptenroll` binds LUKS key to TPM PCR 7 (Secure Boot policy)
+- **Passphrase kept as fallback** — if TPM/Secure Boot state changes, unlock with USB keyboard + password
+
+### Why PCR 7 Only
+
+Binding to PCR 7 alone means kernel/initrd updates (frequent on nixos-unstable) do NOT
+require re-enrollment. PCR 7 only changes when Secure Boot keys or policy change.
+
+Cmdline tampering is prevented by lanzaboote's UKI approach — the cmdline is embedded in
+the signed binary and cannot be edited at the bootloader.
+
+### Setup Steps
+
+1. Install `sbctl` and create Secure Boot signing keys
+2. Put BIOS into Secure Boot "Setup Mode" and enroll custom keys (include Microsoft keys for fwupd)
+3. Enable lanzaboote in NixOS config (replaces systemd-boot)
+4. Rebuild, verify Secure Boot works
+5. Enroll TPM with `systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7`
+
+After setup, `nixos-rebuild switch/boot` works as usual — lanzaboote automatically signs
+each new generation.
+
+### Security Considerations
+
+**Protected against:**
+- Offline disk read (pull SSD, boot USB)
+- Boot chain tampering (unsigned code won't boot)
+- Cmdline editing (locked into signed UKI)
+
+**Remaining attack surface:**
+- Stolen while suspended — disk is decrypted in RAM, only screen lock protects.
+  Consider hibernate instead of suspend (hibernate locks LUKS since RAM is powered off).
+- Network services — system is fully running after boot, exposed services are reachable
+- DMA attacks via Thunderbolt/PCIe — mitigated by IOMMU (should be on by default)
+- Cold boot attacks — exotic, requires freezing RAM
+
+For a stolen-laptop scenario this is solid. The biggest practical risk is theft while
+the laptop is suspended.
+
+### Other Considered Alternatives
+
+- **BIOS update from Lenovo** fixing the PS/2 controller init sequence
+- **Kernel patch** to handle the failed enable more gracefully
+- **TPM + PIN** — not viable due to the same PS/2 keyboard issue at the PIN prompt
+
+## Current Workaround
+
+Use an external USB keyboard to enter the LUKS password at boot.

flake.lock

@@ -1,5 +1,23 @@
 {
   "nodes": {
+    "catppuccin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1772983749,
+        "narHash": "sha256-IRC/YpTVMDr/lMmWMEc+JU4d+L9z3v38jZuj0jSLaW0=",
+        "owner": "catppuccin",
+        "repo": "nix",
+        "rev": "3594e4c94994515e0e32884dad20ca70ae88fc49",
+        "type": "github"
+      },
+      "original": {
+        "owner": "catppuccin",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
     "ghettoptt": {
       "inputs": {
         "nixpkgs": [
@@ -7,18 +25,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1728602333,
-        "narHash": "sha256-sKbnng/g4ijuKcjShBi7oPxyUrCnMJDDy17U9W/TuMg=",
+        "lastModified": 1773164481,
+        "narHash": "sha256-pAHExVIUqQdnaKniNTdlxheQ/IOU3nTeEV/DRrCc8wg=",
         "ref": "master",
-        "rev": "84fcfdde62de9888d3af8bcb0d7134137b276b55",
-        "revCount": 23,
+        "rev": "bb7f415c08d6189514dce8c43d69eea6372f0528",
+        "revCount": 24,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/ghettoptt"
+        "url": "https://code.t-juice.club/torjus/ghettoptt"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/ghettoptt"
+        "url": "https://code.t-juice.club/torjus/ghettoptt"
       }
     },
     "home-manager": {
@@ -28,11 +46,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772569491,
-        "narHash": "sha256-bdr6ueeXO1Xg91sFkuvaysYF0mVdwHBpdyhTjBEWv+s=",
+        "lastModified": 1772985285,
+        "narHash": "sha256-wEEmvfqJcl9J0wyMgMrj1TixOgInBW/6tLPhWGoZE3s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "924e61f5c2aeab38504028078d7091077744ab17",
+        "rev": "5be5d8245cbc7bc0c09fbb5f38f23f223c543f85",
         "type": "github"
       },
       "original": {
@@ -51,18 +69,18 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1757974387,
-        "narHash": "sha256-vVFZTB3NxJCH91aaAtop3MEZcilPQ273epV1gcnQE4s=",
+        "lastModified": 1773164725,
+        "narHash": "sha256-FNW+hOB6NCEpZt73FPiafLBPfwnSdTJeaGNCN3r+zEQ=",
         "ref": "master",
-        "rev": "b341e613337b87cef7a0f4ea05d677288cafa3fb",
-        "revCount": 33,
+        "rev": "e5226d3e32180eb59edae6c29053854dda82750c",
+        "revCount": 34,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/huecli"
+        "url": "https://code.t-juice.club/torjus/huecli"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/huecli"
+        "url": "https://code.t-juice.club/torjus/huecli"
       }
     },
     "natstonotify": {
@@ -72,18 +90,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1739302828,
-        "narHash": "sha256-D6l5tAh1FDpdz9/tQC7kYhFPQzqI1HICwNh7fRejfrw=",
+        "lastModified": 1773164311,
+        "narHash": "sha256-HRR4TBCGp5okWW2eV6vUTYAhUR7I+MNADtlOaIe8fec=",
         "ref": "master",
-        "rev": "bfcf518fe0b2fe19075667f7b22227376d102509",
-        "revCount": 7,
+        "rev": "7e784076242f4bbcf63a35c14ea752bf7a285d8a",
+        "revCount": 8,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/natstonotify"
+        "url": "https://code.t-juice.club/torjus/natstonotify"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/natstonotify"
+        "url": "https://code.t-juice.club/torjus/natstonotify"
       }
     },
     "nix-packages": {
@@ -93,31 +111,31 @@
         ]
       },
       "locked": {
-        "lastModified": 1757017925,
-        "narHash": "sha256-QC1SkvyU5nQ32lju2GYK9ozuh/JYWXfWK/T7OC6dVls=",
+        "lastModified": 1773106737,
+        "narHash": "sha256-/XL6Dn+SehMGlXvuKubNMcTk4iq2J75Z5cVO+HkIfDY=",
         "ref": "master",
-        "rev": "7723cb45020e1f561f527779540faa5901d34e4d",
-        "revCount": 31,
+        "rev": "295b0bf12ec1849564bdaa8fc2cd0f19af1a2715",
+        "revCount": 47,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nix-packages"
+        "url": "https://code.t-juice.club/torjus/nix-packages"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nix-packages"
+        "url": "https://code.t-juice.club/torjus/nix-packages"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772542754,
-        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
-        "owner": "nixos",
+        "lastModified": 1772773019,
+        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -139,6 +157,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1772773019,
+        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixprstatus": {
       "inputs": {
         "nixpkgs": [
@@ -149,18 +183,18 @@
         "uv2nix": "uv2nix_2"
       },
       "locked": {
-        "lastModified": 1767871861,
-        "narHash": "sha256-Oh0Y9bTvvMm3JQH/C/8XLCeemgvMDbIgFh1NSYFyINY=",
+        "lastModified": 1773164966,
+        "narHash": "sha256-uwkLjHH6BmNzcF791y9ceUcfZtRu/v0+61d4/TbGLxY=",
         "ref": "master",
-        "rev": "b4e3e6de659bf8c96b84dd47249c71b357dd50c2",
-        "revCount": 62,
+        "rev": "61c04a87f944cfc93b9f3f2904991c41664e28c5",
+        "revCount": 63,
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nixprstatus"
+        "url": "https://code.t-juice.club/torjus/nixprstatus"
       },
       "original": {
         "ref": "master",
         "type": "git",
-        "url": "https://git.t-juice.club/torjus/nixprstatus"
+        "url": "https://code.t-juice.club/torjus/nixprstatus"
       }
     },
     "pyproject-build-systems": {
@@ -265,12 +299,13 @@
     },
     "root": {
       "inputs": {
+        "catppuccin": "catppuccin",
         "ghettoptt": "ghettoptt",
         "home-manager": "home-manager",
         "huecli": "huecli",
         "natstonotify": "natstonotify",
         "nix-packages": "nix-packages",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-stable": "nixpkgs-stable",
         "nixprstatus": "nixprstatus",
         "sops-nix": "sops-nix"
@@ -283,11 +318,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772495394,
-        "narHash": "sha256-hmIvE/slLKEFKNEJz27IZ8BKlAaZDcjIHmkZ7GCEjfw=",
+        "lastModified": 1772944399,
+        "narHash": "sha256-xTzsSd3r5HBeufSZ3fszAn0ldfKctvsYG7tT2YJg5gY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "1d9b98a29a45abe9c4d3174bd36de9f28755e3ff",
+        "rev": "c8e69670b316d6788e435a3aa0bda74eb1b82cc0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -13,25 +13,28 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     ghettoptt = {
-      url = "git+https://git.t-juice.club/torjus/ghettoptt?ref=master";
+      url = "git+https://code.t-juice.club/torjus/ghettoptt?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     huecli = {
-      url = "git+https://git.t-juice.club/torjus/huecli?ref=master";
+      url = "git+https://code.t-juice.club/torjus/huecli?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-packages = {
-      url = "git+https://git.t-juice.club/torjus/nix-packages?ref=master";
+      url = "git+https://code.t-juice.club/torjus/nix-packages?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixprstatus = {
-      url = "git+https://git.t-juice.club/torjus/nixprstatus?ref=master";
+      url = "git+https://code.t-juice.club/torjus/nixprstatus?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     natstonotify = {
-      url = "git+https://git.t-juice.club/torjus/natstonotify?ref=master";
+      url = "git+https://code.t-juice.club/torjus/natstonotify?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    catppuccin = {
+      url = "github:catppuccin/nix";
+    };
   };
 
   outputs =
@@ -45,6 +48,7 @@
       huecli,
       natstonotify,
       nix-packages,
+      catppuccin,
       ...
     }@inputs:
     let

home/hosts/gunter/default.nix

@@ -17,11 +17,13 @@
       {
         imports = [
           inputs.sops-nix.homeManagerModules.sops
+          inputs.catppuccin.homeModules.catppuccin
           ../../editor/neovim
           ../../hyprland
           ../../packages
           ../../programs/dunst
           ../../programs/git
+          ../../programs/gtk
           ../../programs/firefox
           ../../programs/kitty
           ../../programs/obs-studio
@@ -108,6 +110,8 @@
         };
         programs.home-manager.enable = true;
 
+        services.dunst.settings.global.monitor = "DP-1";
+
         # Custom options
         torjus.home.obs = {
           enable = true;

home/hosts/magicman/default.nix

@@ -17,6 +17,7 @@
       {
         imports = [
           inputs.sops-nix.homeManagerModules.sops
+          inputs.catppuccin.homeModules.catppuccin
           ../../sops
           ../../services/labmcp.nix
           ../../editor/neovim
@@ -25,10 +26,10 @@
           ../../programs/tmux
           ../../programs/dunst
           ../../programs/kitty
+          ../../programs/gtk
           ../../programs/rofi
           ../../programs/obs-studio
           ../../programs/vscode
-          ../../programs/pywal
           ../../scripts
           ../../scripts/batlvl.nix
           ../../zsh
@@ -40,6 +41,11 @@
         tmux.enable = true;
         hyprland.enable = true;
         hyprland.monitors = [ "eDP-1,1920x1080@60,0x0,1" ];
+        wayland.windowManager.hyprland.settings = {
+          input.touchpad = {
+            natural_scroll = false;
+          };
+        };
         hyprland.extraKeybinds = [
           # Workspace keybinds
           "$mainMod,1,workspace,1"
@@ -60,6 +66,7 @@
           homeDirectory = "/home/${user}";
           stateVersion = "23.11";
         };
+        services.dunst.settings.global.monitor = "eDP-1";
         torjus.home.obs.enable = true;
         programs.home-manager.enable = true;
       };

home/hyprland/cursor.nix

@@ -9,5 +9,4 @@
     size = 32;
   };
 
-  gtk.enable = true;
 }

home/hyprland/default.nix

@@ -73,7 +73,6 @@ in
       [
         dunst
         hyprpaper
-        rofi
         slurp
         swww
         waybar
@@ -183,7 +182,10 @@ in
           name = "wacom-one-by-wacom-m-pen";
         };
 
-        cursor = optionalAttrs cfg.cursorNoHardware {
+        cursor = {
+          hide_on_key_press = true;
+        }
+        // optionalAttrs cfg.cursorNoHardware {
           no_hardware_cursors = true;
         };
 
@@ -204,6 +206,7 @@ in
           gaps_out = 10;
           border_size = 2;
           layout = "dwindle";
+          resize_on_border = true;
         };
 
         animations = {
@@ -233,10 +236,14 @@ in
         misc = {
           force_default_wallpaper = 0;
           disable_hyprland_logo = true;
+          disable_splash_rendering = true;
+          key_press_enables_dpms = true;
+          mouse_move_enables_dpms = true;
         };
 
         ecosystem = {
           no_update_news = true;
+          no_donation_nag = true;
         };
 
         windowrule = [
@@ -261,8 +268,9 @@ in
           # term
           "$mainMod,Return,exec,$term"
           # rofi
-          "$mainMod,D,exec,rofi-launcher"
+          "$mainMod,D,exec,rofi -show drun"
           "$mainMod,P,exec,rofi-rbw"
+          "$mainMod,E,exec,rofi -show emoji"
           # hyprlock
           "$shiftMainMod,l,exec,${pkgs.hyprlock}/bin/hyprlock"
           # hyprland

home/hyprland/waybar/default.nix

@@ -24,15 +24,9 @@ in
   sops.secrets."radarr_base_url" = { };
   sops.secrets."radarr_api_key" = { };
 
-  xdg.configFile."waybar/macchiato.css" = {
-    source =
-      pkgs.fetchFromGitHub {
-        owner = "catppuccin";
-        repo = "waybar";
-        rev = "f74ab1eecf2dcaf22569b396eed53b2b2fbe8aff";
-        sha256 = "WLJMA2X20E5PCPg0ZPtSop0bfmu+pLImP9t8A8V4QK8=";
-      }
-      + "/themes/macchiato.css";
+  catppuccin.waybar = {
+    enable = true;
+    flavor = "macchiato";
   };
 
   programs.waybar = {
@@ -42,7 +36,6 @@ in
       target = "graphical-session.target";
     };
     style = ''
-      @import "macchiato.css";
       * {
         border: none;
         font-family: "JetbrainsMono Nerd Font";
@@ -137,6 +130,7 @@ in
       #pulseaudio,
       #network,
       #battery,
+      #disk,
       #custom-powermenu,
       #custom-arrhist {
         padding-left: 12px;
@@ -164,6 +158,7 @@ in
             (lib.mkIf (withArrhist) "custom/arrhist")
             "pulseaudio"
             "pulseaudio#microphone"
+            "disk"
             "memory"
             "cpu"
             (lib.mkIf (withBattery) "battery")
@@ -217,6 +212,15 @@ in
             "interval" = 3;
             "format" = " {usage}%";
           };
+          "disk" = {
+            "interval" = 30;
+            "format" = "󰋊 {percentage_used}%";
+            "path" = "/";
+            "tooltip-format" = "{used} / {total}";
+            "states" = {
+              "warning" = 85;
+            };
+          };
           "tray" = {
             "icon-size" = 15;
             "spacing" = 6;

home/packages/default.nix

@@ -98,6 +98,7 @@ in
     rust-analyzer
 
     # Homemade shit
+    forgejo-mcp
     ghettoptt
     huecli
     nixprstatus

home/programs/claude-code/default.nix

@@ -1,5 +1,13 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
+let
+  forgejo-mcp-wrapper = pkgs.writeShellScript "forgejo-mcp-wrapper" ''
+    export FORGEJO_ACCESS_TOKEN="$(cat ${config.sops.secrets.forgejo_access_token.path})"
+    exec forgejo-mcp --transport stdio --url https://code.t-juice.club
+  '';
+in
 {
+  sops.secrets."forgejo_access_token" = { };
+
   programs.claude-code = {
     enable = true;
     package = pkgs.claude-code-bin;
@@ -13,6 +21,13 @@
       pr = ./skills/pr;
     };
 
+    mcpServers = {
+      forgejo = {
+        type = "stdio";
+        command = "${forgejo-mcp-wrapper}";
+      };
+    };
+
     settings = {
       model = "opus";
       enabledPlugins = {
@@ -41,11 +56,22 @@
           "Read(**/*.tfvars)"
           "Read(.env)"
           "Read(**/.env)"
-          "Read(./secrets/**)"
-          "Read(.sops.yaml)"
           "Read(~/.ssh/*)"
         ];
       };
+      hooks = {
+        PostToolUse = [
+          {
+            matcher = "EnterPlanMode";
+            hooks = [
+              {
+                type = "command";
+                command = "echo 'A plan is being created. If this session has not been renamed yet, suggest a concise, descriptive session name based on the conversation so far and ask the user to run /rename <suggested-name>.'";
+              }
+            ];
+          }
+        ];
+      };
       statusLine = {
         type = "command";
         command = ''input=$(cat); echo "$(basename "$(echo "$input" | jq -r '.workspace.current_dir')") | $(echo "$input" | jq -r '.model.display_name')"'';

home/programs/dunst/default.nix

@@ -4,6 +4,11 @@
 }:
 
 {
+  catppuccin.dunst = {
+    enable = true;
+    flavor = "macchiato";
+  };
+
   services.dunst = {
     enable = true;
     iconTheme = {
@@ -13,7 +18,7 @@
     settings = {
       global = {
         origin = "top-right";
-        monitor = "4";
+        follow = "none";
         alignment = "left";
         vertical_alignment = "center";
         width = "(0, 400)";
@@ -36,10 +41,8 @@
         history_length = 20;
         always_run_script = true;
         corner_radius = 10;
-        # follow = "mouse";
-        font = "Source Sans Pro 10";
-        format = "<b>%s</b>\\n%b"; # format = "<span foreground='#f3f4f5'><b>%s %p</b></span>\n%b"
-        frame_color = "#232323";
+        font = "JetBrainsMono Nerd Font 10";
+        format = "<b>%s</b>\\n%b";
         frame_width = 1;
         offset = "(15, 15)";
         horizontal_padding = 10;
@@ -61,19 +64,6 @@
       fullscreen_delay_everything = {
         fullscreen = "delay";
       };
-
-      urgency_critical = {
-        background = "#d64e4e";
-        foreground = "#f0e0e0";
-      };
-      urgency_low = {
-        background = "#232323";
-        foreground = "#2596be";
-      };
-      urgency_normal = {
-        background = "#1e1e2a";
-        foreground = "#2596be";
-      };
     };
   };
 }

home/programs/gtk/default.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  gtk = {
+    enable = true;
+    theme = {
+      name = "catppuccin-macchiato-blue-standard";
+      package = pkgs.catppuccin-gtk.override {
+        variant = "macchiato";
+        accents = [ "blue" ];
+      };
+    };
+  };
+}

home/programs/rofi/config.rasi

@@ -1,17 +0,0 @@
-configuration{
-    modi: "run,drun,window";
-    icon-theme: "Oranchelo";
-    show-icons: true;
-    terminal: "alacritty";
-    drun-display-format: "{icon} {name}";
-    location: 0;
-    disable-history: false;
-    hide-scrollbar: true;
-    display-drun: "   Apps ";
-    display-run: "   Run ";
-    display-window: " 﩯  Window";
-    display-Network: " 󰤨  Network";
-    sidebar-mode: true;
-}
-
-@theme "latte"

home/programs/rofi/default.nix

@@ -1,27 +1,33 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 {
-  xdg.configFile."rofi/config.rasi" = {
-    source = ./config.rasi;
+  catppuccin.rofi = {
+    enable = true;
+    flavor = "macchiato";
   };
 
-  xdg.configFile."rofi/macchiato.rasi" = {
-    source =
-      pkgs.fetchFromGitHub {
-        owner = "catppuccin";
-        repo = "rofi";
-        rev = "5350da41a11814f950c3354f090b90d4674a95ce";
-        sha256 = "DNorfyl3C4RBclF2KDgwvQQwixpTwSRu7fIvihPN8JY=";
-      }
-      + "/basic/.local/share/rofi/themes/catppuccin-macchiato.rasi";
-  };
-  xdg.configFile."rofi/latte.rasi" = {
-    source =
-      pkgs.fetchFromGitHub {
-        owner = "catppuccin";
-        repo = "rofi";
-        rev = "5350da41a11814f950c3354f090b90d4674a95ce";
-        sha256 = "DNorfyl3C4RBclF2KDgwvQQwixpTwSRu7fIvihPN8JY=";
-      }
-      + "/basic/.local/share/rofi/themes/catppuccin-latte.rasi";
+  programs.rofi = {
+    enable = true;
+    terminal = "kitty";
+    location = "center";
+    font = "JetBrains Mono Nerd Font 12";
+    plugins = [
+      pkgs.rofi-emoji
+      pkgs.rofi-calc
+    ];
+    extraConfig = {
+      modi = "drun,ssh,window,calc,emoji";
+      matching = "fuzzy";
+      show-icons = true;
+      icon-theme = "Oranchelo";
+      drun-display-format = "{icon} {name}";
+      hide-scrollbar = true;
+      disable-history = false;
+      display-drun = "Apps";
+      display-ssh = "SSH";
+      display-window = "Window";
+      display-calc = "Calc";
+      display-emoji = "Emoji";
+      sidebar-mode = true;
+    };
   };
 }

home/scripts/default.nix

@@ -7,10 +7,6 @@
     source = ./hl-no-opacity.sh;
     executable = true;
   };
-  home.file.".local/bin/rofi-launcher" = {
-    source = ./rofi-launcher.sh;
-    executable = true;
-  };
   home.file.".local/bin/randomwp" = {
     source = ./randomwp.sh;
     executable = true;

home/scripts/rofi-launcher.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-rofi \
-    -show drun \
-    -modi run,drun,ssh \
-    -scroll-method 0 \
-    -drun-match-fields all \
-    -drun-display-format "{name}" \
-    -terminal kitty

hosts/magicman/configuration.nix

@@ -14,6 +14,10 @@
     "rd.udev.log_level=3"
   ];
 
+  boot.extraModprobeConfig = ''
+    options v4l2loopback exclusive_caps=1 card_label="Virtual Camera"
+  '';
+
   boot.loader.systemd-boot.configurationLimit = 3;
 
   boot.initrd.systemd.enable = true;
@@ -85,6 +89,7 @@
     wget
     curl
     git
+    v4l-utils
   ];
 
   # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,

hosts/magicman/hardware-configuration.nix

@@ -21,8 +21,11 @@
     "sdhci_pci"
   ];
   boot.initrd.kernelModules = [ "i915" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+  boot.kernelModules = [
+    "kvm-intel"
+    "v4l2loopback"
+  ];
+  boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/31b20f4c-24bb-4fd1-9a3e-8ccc19fe3d64";

secrets/torjus/secret.yaml

@@ -4,32 +4,37 @@ sonarr_base_url: ENC[AES256_GCM,data:0HiHIX4KcPEE62Ti1fLH230rC1A7xYg=,iv:mkAnl6t
 radarr_api_key: ENC[AES256_GCM,data:Db1ISKTF+m2H1on55/4vdGticfqBdxfIzKHBxC9LAx4=,iv:NhiG4SmsRYIunW1ljFbxeHvRoi9fOVE+9DJn6kmZ6oI=,tag:DoJzo56CW3kJlySYmB8NYQ==,type:str]
 radarr_base_url: ENC[AES256_GCM,data:3UgOPQMblYhm0ysRB6VVosvZToIM5IA=,iv:o/s0bVBrjrma2Df2LlCCFL5Ks80063/4mABc6vzDrYg=,tag:eHKntLPM9yRRkMfIWSpIdg==,type:str]
 nats_nkey: ENC[AES256_GCM,data:TcIDFkFXB1+qfTqLylDI46w4/+Cy9XdXyXS26qCbwDaDoQNaRUsC6dw94mbT37352IWOCypTY0hweA==,iv:DC5GQyIXbNSx/mOLAOWTf5AyeFeViLxbKTMgZEfTEXE=,tag:krxk/dnZ58a8dcuWb7zhnA==,type:str]
+forgejo_access_token: ENC[AES256_GCM,data:5+AXgz03G9AEqhHlX87qdV8o1J2f/v/o59QPe5R8N06A7n4rt1A5eQ==,iv:ns/3F7+yr+bA4cqj6ghNLYyEuT+w+D+ILrKqMGbNQN4=,tag:rYI/497XuYkRmeLjxWaCIg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1lznyk4ee7e7x8n92cq2n87kz9920473ks5u9jlhd3dczfzq4wamqept56u
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaUlVOWtoRTFvMHljV0Fu
-            TFp2Ym1jcThqbWRjUjdNSnhxRUsrOWl6S3dBCmh0L0YzaXNlRTFHMXFHTGc1T3I2
-            WE03WjJCSlJSV2lmSExTWDBQRnlOcDAKLS0tIFJoeEM5b0IrdWxTRWhvNnd0c3NG
-            dENGdjJteFFaQTNFaDgvSGV2UEtyT0EKbdg4atS91rB99l7zKKkfPzKk4T5Mq2x5
-            bX825DPrxauAhvrT7ca/A2OwA4kaFuxPrQGd3VOPAXTVhlbcFgIAdw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUzQ0Q3dyZzVUMTJUUFhV
+            djg5WVNqNVRjeEsxM2lvOGZ4U25OR0VjNFNJCk11bTdVMzdsVyswQWc3enpwWVEz
+            bC9GbHV2dnhCTm44RWNNZzNXcjE5MDgKLS0tIHJRZmUwMDU2Si8waWVYS29BZFFJ
+            VDlubEtVOEJabTNWRFVHQ2hiNXJPUTQKdmBIlI4JvAssYHeRzbjp7CbPDsDX1JZ5
+            TIw79h28sArmRkP5fDlM0D1rALLlbTBsn3KA2D3RZgsUcelFlckIJg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1stlqqspmt5fepyz35udrwr5avf9zuju79f787p26pu2d2j08yqps2q2t2c
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSEZJWldRcmJ3c1BjbUpT
-            bmZXSmlHU0hVRTV3SG91bXpiTXhZd1RkY0Y4ClBxc0RabWJmMi8reHZYWnlmK3pC
-            bUw5V2FEV0pZdkZEMTJ5ZDZXWDM2NjgKLS0tIGZ6dEZ4dERYQXFRQTVkRHhycndz
-            dkgwQlRrdEp6b2FIVnowaDlUMEZpeHcK2icvVv+UpbcdVErRjjQhlQb6PuluC/K7
-            Vy8Rh7dTn++bSEdGidDNGYeUQBrVy2qooq04lQqbeOOrdmXVhTamdA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VkpsWTF6cmlIdEROSmcw
+            UTE1MzUwZlEwZGoyTUM0M2dQRlF1NExYTFNrCkFBNFFIZ1AyNTlRR2NZaXB3Y1Vj
+            Wk9xVmVoM1MweERpUWh1R0FDeFdWT1UKLS0tIHJOQWRZY3NHWmpEL1djY3lnTTZB
+            S2xsR3NESklzNEN5U3RUTElmbnQzSWcKaDJnCgQUjpz6gAVtWJPKykfuflQOyMLq
+            cmb5ZfKhvrgthByGtS1nN4dhwA8ndUJ31UqiU0xWDdak59ehczoquQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-11T19:22:47Z"
-    mac: ENC[AES256_GCM,data:vd8O5y1GNDTDrlundbNZcGRAQzKLDly4qyxTqRO2JrnDYOqD/vQ8TqRQYiUgGY+5AcgjoLMER8keE8OUmcngN16cbGx1zKTpdqyHb7B2KR7ZfWOjW5kTk5KWM1gLDA4hA2GBEjHFBPGKdcrjURek9MrT+iM+qArbizSjWlKuehc=,iv:cicEnvWynZizJqrUzPIzbJWl6O8uL65Vs7fAYsuqSNA=,tag:l5jBXQfFedVE/VccZh+1qQ==,type:str]
-    pgp: []
+        - recipient: age1whxf34vjdndqzwgm7yyaexdm46gdnv9sf3nal7qqyjr0nyhhndlsrmc0g3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRU2R0cU1JcGFRRkV2SE1E
+            RFBRWkdESTcveGsvMStZR0Q3bWo3L0FQcENzCjdsOEpCNGk2NjdPMXVUWnhFS3NE
+            WlR0bWxZTGdnakplS0M3S3F0Nm9hQ00KLS0tIFR3amxPWEhiWDZQU2xjUGRHb0xS
+            U2V0bjZ2TUVmS2F3S1dTSnBYTmZsMG8KJTT0r6PYJ/g/J0E/CxyxRfUhtq8KMEJi
+            w5WrsdHrEkukY0OGRG1i8ZeDDV5mR2KejjKoGWQU6cLYa/v+XHevhg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-10T01:57:15Z"
+    mac: ENC[AES256_GCM,data:BK1vTAg7I16ztjqlkeXk7fMLGd7cvIzxogVufsRGamA5PpZgZ8PmvFcQH5JSLbEl/cAKPRD5jr9X1fx9Yr4uAwnVBPpkfu4LUb1fOihWgq7W4YqrTLKB2KGJZaTIP/I800bHHqEsyUcgo2DZ4gEDP2X84tR81xGhwkpGyeH0nlY=,iv:9Sj12aEHkYTrkoZ33SxiHhpDiZrXmPKN6972B+NV14Y=,tag:qDZvGgEpELktFRPuL2J98g==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.12.1