wip

chore: run formatter
temp: workaround for nixpkgs#514705
2026-05-20 22:55:27 +02:00 · 2026-05-12 10:36:25 +02:00 · 2026-05-12 10:35:53 +02:00 · 2026-05-10 00:08:17 +02:00 · 2026-05-09 23:38:56 +02:00 · 2026-05-09 23:38:51 +02:00
37 changed files with 1158 additions and 660 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -1,6 +1,8 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+2204b12fadf27886058e6945806ce93a547f5278
+77236af5896524218605badcd3cdfc2267b213da

 # host rename
 cfe4c43887a41e52be4e6472474c0fc3788f86e8
--- a/features/bootloader.nix
+++ b/features/bootloader.nix
@@ -1,8 +1,25 @@
 {
  nixos =
-    { config, lib, inputs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
    let
      cfg = config.features.bootloader;
+      keyDir = "/etc/secrets/initrd";
+
+      mkIpString =
+        {
+          address,
+          gateway,
+          netmask,
+          interface,
+          ...
+        }:
+        "${address}::${gateway}:${netmask}::${interface}:none";
    in
    {
      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
@@ -17,24 +34,140 @@
          ];
          default = "systemd-boot";
        };
+
+        configurationLimit = lib.mkOption {
+          type = lib.types.int;
+          default = 10;
+        };
+
+        consoleFont = lib.mkOption {
+          type = lib.types.str;
+          default = "ter-v32n";
+        };
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        initrdSsh = {
+          enable = lib.mkEnableOption "remote LUKS unlock via ssh in initrd";
+
+          networkModule = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          ip = {
+            enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+
+            address = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            gateway = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            netmask = lib.mkOption {
+              type = lib.types.str;
+              default = "255.255.255.0";
+            };
+
+            interface = lib.mkOption {
+              type = lib.types.str;
+            };
+          };
+
+          authorizedKeys = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        {
-          boot.loader.efi.canTouchEfiVariables = true;
-        }
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            boot.loader.efi.canTouchEfiVariables = true;

-        (lib.mkIf (cfg.mode == "systemd-boot") {
-          boot.loader.systemd-boot.enable = true;
-        })
+            # lanzaboote inherits editor + configurationLimit from systemd-boot.*
+            boot.loader.systemd-boot = {
+              editor = false;
+              inherit (cfg) configurationLimit;
+            };

-        (lib.mkIf (cfg.mode == "lanzaboote") {
-          boot.loader.systemd-boot.enable = lib.mkForce false;
-          boot.lanzaboote = {
-            enable = true;
-            pkiBundle = "/var/lib/sbctl";
-          };
-        })
-      ]);
+            boot.initrd.systemd.enable = true;
+
+            # block simpledrm so fbcon defers until the gpu driver binds; avoids
+            # the simpledrm -> real-driver fbcon transition that mangles console
+            # text and leaves the luks prompt typing offset from the visible
+            # surface. hosts must put the gpu driver in initrd (nixos-hardware
+            # does this for amd; manual hardware.amdgpu.initrd.enable on others)
+            boot.kernelParams = [ "initcall_blacklist=simpledrm_platform_driver_init" ];
+
+            # verbose boot: kernel messages and systemd unit lines visible end
+            # to end. trade-off: the luks prompt will be interleaved with the
+            # last few "Starting/Started ..." lines (no upstream fix exists
+            # without plymouth). boot.initrd.verbose is a no-op under
+            # systemd-initrd, so not set here.
+
+            # readable luks prompt at panel-native dpi
+            console = {
+              earlySetup = true;
+              font = cfg.consoleFont;
+              packages = [ pkgs.terminus_font ];
+            };
+          }
+
+          (lib.mkIf (cfg.mode == "systemd-boot") {
+            boot.loader.systemd-boot.enable = true;
+          })
+
+          (lib.mkIf (cfg.mode == "lanzaboote") {
+            boot.loader.systemd-boot.enable = lib.mkForce false;
+            boot.lanzaboote = {
+              enable = true;
+              pkiBundle = "/var/lib/sbctl";
+            };
+          })
+
+          (lib.mkIf (cfg.resumeDevice != null) {
+            boot.resumeDevice = cfg.resumeDevice;
+          })
+
+          (lib.mkIf cfg.initrdSsh.enable {
+            boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
+
+            boot.initrd.availableKernelModules = [ cfg.initrdSsh.networkModule ];
+
+            boot.kernelParams = lib.mkIf cfg.initrdSsh.ip.enable [
+              "ip=${mkIpString cfg.initrdSsh.ip}"
+            ];
+
+            boot.initrd.network = {
+              enable = true;
+              ssh = {
+                enable = true;
+                port = 22;
+                hostKeys = [
+                  "${keyDir}/ssh_host_rsa_key"
+                  "${keyDir}/ssh_host_ed25519_key"
+                ];
+                inherit (cfg.initrdSsh) authorizedKeys;
+              };
+            };
+
+            # forward LUKS password prompt to the ssh session (systemd-initrd idiom)
+            boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
+
+            boot.initrd.systemd.network.networks = lib.mkIf (!cfg.initrdSsh.ip.enable) {
+              "10-initrd" = {
+                matchConfig.Driver = cfg.initrdSsh.networkModule;
+                networkConfig.DHCP = "yes";
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/claude.nix
+++ b/features/claude.nix
@@ -6,14 +6,21 @@
    };

  home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.claude;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
    in
    {
      config = lib.mkIf cfg.enable {
        home.packages = [
-          pkgs.claude-code
+          packages.claude-code
          pkgs.mcp-nixos
        ];
      };
--- a/features/desktop.nix
+++ b/features/desktop.nix
@@ -1,6 +1,12 @@
 {
  nixos =
-    { config, lib, pkgs, inputs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
    let
      cfg = config.features.desktop;
    in
@@ -49,104 +55,223 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        # base desktop
-        {
-          security.polkit.enable = true;
-          services.dbus.enable = true;
-          services.playerctld.enable = true;
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          # base desktop
+          {
+            security.polkit.enable = true;
+            services.dbus.enable = true;
+            services.playerctld.enable = true;

-          xdg.portal = {
-            enable = true;
-            xdgOpenUsePortal = true;
-            extraPortals = with pkgs; [
-              xdg-desktop-portal-wlr
-              xdg-desktop-portal-gtk
+            xdg.portal = {
+              enable = true;
+              extraPortals = with pkgs; [
+                xdg-desktop-portal-wlr
+                xdg-desktop-portal-gtk
+              ];
+            };
+
+            # honor persist_mode so electron apps don't re-prompt for screencast every login
+            systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";
+
+            # enable ozone/wayland for electron apps so idle detection works
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+            fonts.packages = with pkgs; [
+              font-awesome
+              nerd-fonts.jetbrains-mono
            ];
-          };

-          fonts.packages = with pkgs; [
-            font-awesome
-            nerd-fonts.jetbrains-mono
-          ];
+            stylix = {
+              enable = true;
+              inherit (cfg.theme) polarity;
+              image = cfg.theme.wallpaper;
+              base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
+            };
+          }

-          stylix = {
-            enable = true;
-            polarity = cfg.theme.polarity;
-            image = cfg.theme.wallpaper;
-            base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
-          };
-        }
+          # audio
+          (lib.mkIf cfg.audio.enable {
+            services.pipewire = {
+              enable = true;
+              pulse.enable = true;
+            };
+            environment.systemPackages = with pkgs; [
+              pavucontrol
+              easyeffects
+            ];
+          })

-        # audio
-        (lib.mkIf cfg.audio.enable {
-          services.pipewire = {
-            enable = true;
-            pulse.enable = true;
-          };
-          environment.systemPackages = with pkgs; [
-            pavucontrol
-            easyeffects
-          ];
-        })
+          # bluetooth
+          (lib.mkIf cfg.bluetooth.enable {
+            hardware.bluetooth.enable = true;
+            services.blueman = {
+              enable = true;
+              # TEMP:(@janezicmatej) workaround for nixpkgs#514705, fix in nixpkgs#517250
+              withApplet = false;
+            };
+          })

-        # bluetooth
-        (lib.mkIf cfg.bluetooth.enable {
-          hardware.bluetooth.enable = true;
-          services.blueman.enable = true;
-        })
+          # apps
+          (lib.mkIf cfg.apps.enable {
+            programs.thunderbird.enable = true;

-        # apps
-        (lib.mkIf cfg.apps.enable {
-          programs.thunderbird.enable = true;
+            environment.systemPackages = with pkgs; [
+              ghostty
+              google-chrome
+              zathura
+              calibre
+              bolt-launcher
+              libnotify
+              bibata-cursors
+              discord
+              rocketchat-desktop
+              telegram-desktop
+              slack
+              jellyfin-media-player
+              cider-2
+              mpv
+              ffmpeg
+              wf-recorder
+              wl-mirror
+              protonmail-bridge
+              ledger-live-desktop
+              imv
+              yazi
+              nemo
+              file-roller
+              libreoffice-still
+            ];

-          environment.systemPackages = with pkgs; [
-            ghostty
-            google-chrome
-            zathura
-            calibre
-            bolt-launcher
-            libnotify
-            bibata-cursors
-            vesktop
-            rocketchat-desktop
-            telegram-desktop
-            slack
-            jellyfin-media-player
-            cider-2
-            mpv
-            ffmpeg
-            wf-recorder
-            wl-mirror
-            protonmail-bridge
-            ledger-live-desktop
-          ];
+            # kindle udev rules for calibre
+            features.udev.kindle.enable = lib.mkDefault true;
+          })

-          xdg.mime.defaultApplications = {
-            "application/pdf" = "org.pwmt.zathura.desktop";
-          };
-
-          # kindle udev rules for calibre
-          features.udev.kindle.enable = lib.mkDefault true;
-        })
-
-        # internal CA
-        (lib.mkIf cfg.internalCA.enable {
-          security.pki.certificateFiles = [
-            inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
-          ];
-        })
-      ]);
+          # internal CA
+          (lib.mkIf cfg.internalCA.enable {
+            security.pki.certificateFiles = [
+              inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+            ];
+          })
+        ]
+      );
    };

  home =
-    { lib, inputs, osConfig, ... }:
+    {
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.desktop;
    in
    {
-      config = lib.mkIf cfg.enable {
-        home.file.".assets".source = inputs.assets;
-      };
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            home.file.".assets".source = inputs.assets;
+          }
+
+          (lib.mkIf cfg.apps.enable {
+            # TODO:(@janezicmatej) consider moving nvim desktop entry to neovim feature
+            xdg.desktopEntries.nvim = {
+              name = "Neovim";
+              exec = "ghostty -e nvim %F";
+              terminal = false;
+              mimeType = [
+                "text/plain"
+                "application/json"
+                "text/markdown"
+              ];
+            };
+
+            xdg.mimeApps = {
+              enable = true;
+              defaultApplications = {
+                # text
+                "text/plain" = "nvim.desktop";
+                "application/json" = "nvim.desktop";
+                "text/markdown" = "nvim.desktop";
+
+                # web
+                "text/html" = "google-chrome.desktop";
+                "application/xhtml+xml" = "google-chrome.desktop";
+                "x-scheme-handler/http" = "google-chrome.desktop";
+                "x-scheme-handler/https" = "google-chrome.desktop";
+                "x-scheme-handler/ftp" = "google-chrome.desktop";
+                "x-scheme-handler/about" = "google-chrome.desktop";
+                "x-scheme-handler/unknown" = "google-chrome.desktop";
+
+                # mail and calendar
+                "x-scheme-handler/mailto" = "thunderbird.desktop";
+                "message/rfc822" = "thunderbird.desktop";
+                "text/calendar" = "thunderbird.desktop";
+
+                # documents
+                "application/pdf" = "org.pwmt.zathura.desktop";
+                "application/postscript" = "org.pwmt.zathura.desktop";
+                "image/vnd.djvu" = "org.pwmt.zathura.desktop";
+                "application/epub+zip" = "org.pwmt.zathura.desktop";
+
+                # office
+                "application/msword" = "libreoffice-writer.desktop";
+                "application/vnd.ms-excel" = "libreoffice-calc.desktop";
+                "application/vnd.ms-powerpoint" = "libreoffice-impress.desktop";
+                "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
+                  "libreoffice-writer.desktop";
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = "libreoffice-calc.desktop";
+                "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
+                  "libreoffice-impress.desktop";
+                "application/vnd.oasis.opendocument.text" = "libreoffice-writer.desktop";
+                "application/vnd.oasis.opendocument.spreadsheet" = "libreoffice-calc.desktop";
+                "application/vnd.oasis.opendocument.presentation" = "libreoffice-impress.desktop";
+                "text/csv" = "libreoffice-calc.desktop";
+
+                # images
+                "image/png" = "imv-dir.desktop";
+                "image/jpeg" = "imv-dir.desktop";
+                "image/gif" = "imv-dir.desktop";
+                "image/webp" = "imv-dir.desktop";
+                "image/tiff" = "imv-dir.desktop";
+                "image/bmp" = "imv-dir.desktop";
+                "image/svg+xml" = "google-chrome.desktop";
+
+                # video
+                "video/mp4" = "mpv.desktop";
+                "video/x-matroska" = "mpv.desktop";
+                "video/webm" = "mpv.desktop";
+                "video/quicktime" = "mpv.desktop";
+                "video/x-msvideo" = "mpv.desktop";
+
+                # audio
+                "audio/mpeg" = "mpv.desktop";
+                "audio/flac" = "mpv.desktop";
+                "audio/ogg" = "mpv.desktop";
+                "audio/wav" = "mpv.desktop";
+                "audio/aac" = "mpv.desktop";
+
+                # archives
+                "application/zip" = "org.gnome.FileRoller.desktop";
+                "application/x-tar" = "org.gnome.FileRoller.desktop";
+                "application/gzip" = "org.gnome.FileRoller.desktop";
+                "application/x-rar-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-bzip2" = "org.gnome.FileRoller.desktop";
+                "application/x-xz" = "org.gnome.FileRoller.desktop";
+
+                # file manager
+                "inode/directory" = "nemo.desktop";
+
+                # app deep links
+                "x-scheme-handler/tg" = "org.telegram.desktop.desktop";
+                "x-scheme-handler/discord" = "discord.desktop";
+                "x-scheme-handler/slack" = "slack.desktop";
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/dev.nix
+++ b/features/dev.nix
@@ -6,7 +6,13 @@
    };

  home =
-    { pkgs, lib, inputs, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.dev;
      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
@@ -23,6 +29,7 @@
          packages.ahab
          pkgs.just
          pkgs.presenterm
+          pkgs.qemu
        ];
      };
    };
--- a/features/direnv/default.nix
+++ b/features/direnv/default.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, inputs, ... }:
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
    let
      cfg = config.features.direnv;
    in
--- a/features/docker.nix
+++ b/features/docker.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
    let
      cfg = config.features.docker;
    in
--- a/features/filedrop.nix
+++ b/features/filedrop.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, userKeys, ... }:
+    {
+      config,
+      lib,
+      userKeys,
+      ...
+    }:
    let
      cfg = config.features.filedrop;
    in
--- a/features/gaming.nix
+++ b/features/gaming.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
    let
      cfg = config.features.gaming;
    in
--- a/features/git.nix
+++ b/features/git.nix
@@ -6,7 +6,13 @@
    };

  home =
-    { pkgs, lib, inputs, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.git;
      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
--- a/features/gnupg.nix
+++ b/features/gnupg.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
    let
      cfg = config.features.gnupg;
    in
@@ -14,23 +19,25 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        {
-          programs.gnupg.agent = {
-            enable = true;
-            enableSSHSupport = true;
-            enableExtraSocket = true;
-          };
-        }
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.gnupg.agent = {
+              enable = true;
+              enableSSHSupport = true;
+              enableExtraSocket = true;
+            };
+          }

-        (lib.mkIf cfg.yubikey.enable {
-          environment.systemPackages = with pkgs; [
-            yubikey-personalization
-            yubikey-manager
-          ];
+          (lib.mkIf cfg.yubikey.enable {
+            environment.systemPackages = with pkgs; [
+              yubikey-personalization
+              yubikey-manager
+            ];

-          services.pcscd.enable = true;
-        })
-      ]);
+            services.pcscd.enable = true;
+          })
+        ]
+      );
    };
 }
--- a/features/harmonia/default.nix
+++ b/features/harmonia/default.nix
@@ -43,15 +43,10 @@
          path = [ config.nix.package ];
        };

-        systemd.timers.cache-builder = {
-          description = "Periodically build all host closures";
-          wantedBy = [ "timers.target" ];
-          timerConfig = {
-            OnUnitActiveSec = "15min";
-            OnBootSec = "5min";
-            Persistent = true;
-          };
-        };
+        # restart cache-builder after every nixos switch (non-blocking)
+        system.activationScripts.cache-builder = lib.stringAfter [ "specialfs" ] ''
+          ${config.systemd.package}/bin/systemctl restart --no-block cache-builder.service || true
+        '';
      };
    };
 }
--- a/features/initrd-ssh.nix
+++ b/features/initrd-ssh.nix
@@ -1,78 +0,0 @@
-{
-  nixos =
-    { lib, config, ... }:
-    let
-      cfg = config.features.initrd-ssh;
-      keyDir = "/etc/secrets/initrd";
-
-      mkIpString =
-        {
-          address,
-          gateway,
-          netmask,
-          interface,
-          ...
-        }:
-        "${address}::${gateway}:${netmask}::${interface}:none";
-    in
-    {
-      options.features.initrd-ssh = {
-        enable = lib.mkEnableOption "initrd ssh";
-
-        ip = {
-          enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-          address = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          gateway = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          netmask = lib.mkOption {
-            type = lib.types.str;
-            default = "255.255.255.0";
-          };
-
-          interface = lib.mkOption {
-            type = lib.types.str;
-          };
-        };
-
-        authorizedKeys = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-        };
-
-        networkModule = lib.mkOption {
-          type = lib.types.str;
-        };
-      };
-
-      config = lib.mkIf cfg.enable {
-        boot.initrd.availableKernelModules = [ cfg.networkModule ];
-        boot.initrd.kernelModules = [ cfg.networkModule ];
-        boot.kernelParams = lib.mkIf cfg.ip.enable [
-          "ip=${mkIpString cfg.ip}"
-        ];
-
-        boot.initrd.network = {
-          enable = true;
-          udhcpc.enable = !cfg.ip.enable;
-          ssh = {
-            enable = true;
-            port = 22;
-            hostKeys = [
-              "${keyDir}/ssh_host_rsa_key"
-              "${keyDir}/ssh_host_ed25519_key"
-            ];
-            inherit (cfg) authorizedKeys;
-          };
-          postCommands = ''
-            echo 'cryptsetup-askpass' >> /root/.profile
-          '';
-        };
-      };
-    };
-}
--- a/features/neovim.nix
+++ b/features/neovim.nix
@@ -26,54 +26,57 @@
      cfg = osConfig.features.neovim;
    in
    {
-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        (lib.optionalAttrs (options ? stylix) {
-          # disable stylix neovim target when stylix is present
-          stylix.targets.neovim.enable = false;
-        })
-        {
-          xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
-            source = cfg.dotfiles;
-          };
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.optionalAttrs (options ? stylix) {
+            # disable stylix neovim target when stylix is present
+            stylix.targets.neovim.enable = false;
+          })
+          {
+            xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
+              source = cfg.dotfiles;
+            };

-          programs.neovim = {
-            enable = true;
-            vimAlias = true;
-            defaultEditor = true;
-            package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
+            programs.neovim = {
+              enable = true;
+              sideloadInitLua = true;
+              vimAlias = true;
+              defaultEditor = true;
+              package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;

-            extraPackages = with pkgs; [
-              gcc
-              luajit
-              nodejs_22
-              tree-sitter
-              gnumake
-              osc
+              extraPackages = with pkgs; [
+                gcc
+                luajit
+                nodejs_22
+                tree-sitter
+                gnumake
+                osc

-              fd
-              ripgrep
-              bat
-              delta
+                fd
+                ripgrep
+                bat
+                delta

-              pyright
-              typescript-language-server
-              lua-language-server
-              gopls
-              nil
-              nixd
+                pyright
+                typescript-language-server
+                lua-language-server
+                gopls
+                nil
+                nixd

-              nixpkgs-fmt
-              stylua
-            ];
+                nixpkgs-fmt
+                stylua
+              ];

-            extraWrapperArgs = [
-              "--suffix"
-              "LD_LIBRARY_PATH"
-              ":"
-              "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
-            ];
-          };
-        }
-      ]);
+              extraWrapperArgs = [
+                "--suffix"
+                "LD_LIBRARY_PATH"
+                ":"
+                "${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
+              ];
+            };
+          }
+        ]
+      );
    };
 }
--- a/features/nix-settings.nix
+++ b/features/nix-settings.nix
@@ -40,30 +40,30 @@
              "flakes"
            ];
            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            download-attempts = 3;
+            fallback = true;
            warn-dirty = false;
-            substituters =
-              [
-                "https://cache.nixos.org"
-                "https://nix-community.cachix.org?priority=45"
-              ]
-              ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
-            trusted-public-keys =
-              [
-                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-                "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-              ]
-              ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+            substituters = [
+              "https://cache.nixos.org"
+              "https://nix-community.cachix.org?priority=45"
+            ]
+            ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys = [
+              "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+              "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+            ]
+            ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
          };

          gc = {
            automatic = true;
-            dates = cfg.gc.dates;
+            inherit (cfg.gc) dates;
            options = "--delete-older-than ${cfg.gc.olderThan}";
          };

          optimise = {
            automatic = true;
-            dates = cfg.optimise.dates;
+            inherit (cfg.optimise) dates;
          };
        };
      };
--- a/features/onepassword.nix
+++ b/features/onepassword.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
    let
      cfg = config.features.onepassword;
    in
--- a/features/power.nix
+++ b/features/power.nix
@@ -8,11 +8,6 @@
      options.features.power = {
        enable = lib.mkEnableOption "laptop power management";

-        resumeDevice = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-        };
-
        lidSwitch = lib.mkOption {
          type = lib.types.str;
          default = "suspend-then-hibernate";
@@ -40,8 +35,6 @@
      };

      config = lib.mkIf cfg.enable {
-        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
-
        services.logind.settings.Login = {
          HandleLidSwitch = cfg.lidSwitch;
          HandlePowerKey = cfg.powerKey;
--- a/features/remote-base.nix
+++ b/features/remote-base.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
    let
      cfg = config.features.remote-base;
    in
--- a/features/shell.nix
+++ b/features/shell.nix
@@ -6,7 +6,12 @@
    };

  home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.shell;
    in
--- a/features/sway.nix
+++ b/features/sway.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
    let
      cfg = config.features.sway;
      desktopCfg = config.features.desktop;
@@ -15,77 +20,81 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        {
-          # soft dependency
-          features.desktop.enable = lib.mkDefault true;
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            # soft dependency
+            features.desktop.enable = lib.mkDefault true;

-          # hard dependency
-          assertions = [
-            {
-              assertion = desktopCfg.enable;
-              message = "features.sway requires features.desktop";
-            }
-          ];
-
-          programs.sway = {
-            enable = true;
-            package = pkgs.swayfx;
-            wrapperFeatures.gtk = true;
-            extraSessionCommands = ''
-              # fix for java awt apps not rendering
-              export _JAVA_AWT_WM_NONREPARENTING=1
-            '';
-          };
-
-          environment.systemPackages = with pkgs; [
-            waybar
-            mako
-            wob
-            playerctl
-            brightnessctl
-            foot
-            grim
-            pulseaudio
-            swayidle
-            swaylock-effects
-            jq
-            slurp
-            wl-clipboard
-            pamixer
-            wlsunset
-            satty
-            wayland-pipewire-idle-inhibit
-            fuzzel
-            cliphist
-            zenity
-          ];
-        }
-
-        # greeter
-        (lib.mkIf cfg.greeter.enable {
-          programs.regreet = {
-            enable = true;
-            cageArgs = [
-              "-s"
-              "-m"
-              "last"
+            # hard dependency
+            assertions = [
+              {
+                assertion = desktopCfg.enable;
+                message = "features.sway requires features.desktop";
+              }
            ];
-            font = {
-              name = lib.mkForce "JetBrainsMono Nerd Font";
-              size = lib.mkForce 14;
+
+            programs.sway = {
+              enable = true;
+              package = pkgs.swayfx;
+              wrapperFeatures.gtk = true;
+              extraSessionCommands = ''
+                # fix for java awt apps not rendering
+                export _JAVA_AWT_WM_NONREPARENTING=1
+                # propagate XDG_DATA_DIRS to dbus/systemd for d-bus activated apps
+                dbus-update-activation-environment --systemd XDG_DATA_DIRS
+              '';
            };
-            settings = {
-              background = {
-                path = lib.mkForce (toString desktopCfg.theme.wallpaper);
-                fit = lib.mkForce "Cover";
+
+            environment.systemPackages = with pkgs; [
+              waybar
+              mako
+              wob
+              playerctl
+              brightnessctl
+              foot
+              grim
+              pulseaudio
+              swayidle
+              swaylock-effects
+              jq
+              slurp
+              wl-clipboard
+              pamixer
+              wlsunset
+              satty
+              wayland-pipewire-idle-inhibit
+              fuzzel
+              cliphist
+              zenity
+            ];
+          }
+
+          # greeter
+          (lib.mkIf cfg.greeter.enable {
+            programs.regreet = {
+              enable = true;
+              cageArgs = [
+                "-s"
+                "-m"
+                "last"
+              ];
+              font = {
+                name = lib.mkForce "JetBrainsMono Nerd Font";
+                size = lib.mkForce 14;
              };
-              GTK = {
-                application_prefer_dark_theme = lib.mkForce true;
+              settings = {
+                background = {
+                  path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                  fit = lib.mkForce "Cover";
+                };
+                GTK = {
+                  application_prefer_dark_theme = lib.mkForce true;
+                };
              };
            };
-          };
-        })
-      ]);
+          })
+        ]
+      );
    };
 }
--- a/features/udev.nix
+++ b/features/udev.nix
@@ -1,6 +1,11 @@
 {
  nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
    let
      cfg = config.features.udev;
    in
@@ -24,29 +29,31 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        (lib.mkIf cfg.kindle.enable {
-          # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
-          # because extraRules writes to 99-local.rules which is too late for uaccess
-          services.udev.packages = [
-            pkgs.libmtp
-            (pkgs.writeTextFile {
-              name = "kindle-udev-rules";
-              text = ''
-                ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
-              '';
-              destination = "/etc/udev/rules.d/70-kindle.rules";
-            })
-          ];
-        })
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          (lib.mkIf cfg.kindle.enable {
+            # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+            # because extraRules writes to 99-local.rules which is too late for uaccess
+            services.udev.packages = [
+              pkgs.libmtp
+              (pkgs.writeTextFile {
+                name = "kindle-udev-rules";
+                text = ''
+                  ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+                '';
+                destination = "/etc/udev/rules.d/70-kindle.rules";
+              })
+            ];
+          })

-        (lib.mkIf cfg.ledger.enable {
-          hardware.ledger.enable = true;
-        })
+          (lib.mkIf cfg.ledger.enable {
+            hardware.ledger.enable = true;
+          })

-        (lib.mkIf cfg.keyboard-zsa.enable {
-          hardware.keyboard.zsa.enable = true;
-        })
-      ]);
+          (lib.mkIf cfg.keyboard-zsa.enable {
+            hardware.keyboard.zsa.enable = true;
+          })
+        ]
+      );
    };
 }
--- a/features/user-matej.nix
+++ b/features/user-matej.nix
@@ -9,23 +9,21 @@ in
    sshAuthorizedKeys = sshKeys;
  };

-  nixos =
-    { ... }:
-    {
-      users.users.matej = {
-        uid = 1000;
-        isNormalUser = true;
-        home = "/home/matej";
-        extraGroups = [ "wheel" ];
-        openssh.authorizedKeys.keys = sshKeys;
-      };
-
-      users.groups.matej = {
-        gid = 1000;
-        members = [ "matej" ];
-      };
+  nixos = _: {
+    users.users.matej = {
+      uid = 1000;
+      isNormalUser = true;
+      home = "/home/matej";
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = sshKeys;
    };

+    users.groups.matej = {
+      gid = 1000;
+      members = [ "matej" ];
+    };
+  };
+
  home = _: {
    home.stateVersion = "26.05";
  };
--- a/features/vm-guest.nix
+++ b/features/vm-guest.nix
@@ -40,76 +40,73 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        {
-          services.qemuGuest.enable = true;
-          services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;

-          boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
+            boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];

-          boot.initrd.availableKernelModules = [
-            "9p"
-            "9pnet_virtio"
-          ];
-          boot.kernelModules = [
-            "9p"
-            "9pnet_virtio"
-          ];
-
-          networking = {
-            useDHCP = true;
-            firewall.allowedTCPPorts = [ 22 ];
-          };
-
-          security.sudo.wheelNeedsPassword = false;
-
-          environment.systemPackages = with pkgs; [
-            curl
-            wget
-            htop
-            sshfs
-          ];
-        }
-
-        (lib.mkIf cfg.automount.enable {
-          systemd.services.vm-9p-automount = {
-            description = "Auto-discover and mount 9p shares";
-            after = [
-              "local-fs.target"
-              "nss-user-lookup.target"
-              "systemd-modules-load.service"
+            # 9p autoloads on first mount
+            boot.initrd.availableKernelModules = [
+              "9p"
+              "9pnet_virtio"
            ];
-            wants = [ "systemd-modules-load.service" ];
-            wantedBy = [ "multi-user.target" ];
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-              ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-                BASE="${cfg.automount.basePath}"
-                PREFIX="${cfg.automount.prefix}"
-                mkdir -p "$BASE"
-                chown ${autoUser}:${autoGroup} "$BASE"

-                for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                  [ -f "$tagfile" ] || continue
-                  tag=$(tr -d '\0' < "$tagfile")
-
-                  case "$tag" in
-                    "$PREFIX"*) ;;
-                    *) continue ;;
-                  esac
-
-                  name="''${tag#"$PREFIX"}"
-                  target="$BASE/$name"
-
-                  mkdir -p "$target"
-                  ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                    -o trans=virtio,version=9p2000.L || continue
-                done
-              '';
+            networking = {
+              useDHCP = true;
+              firewall.allowedTCPPorts = [ 22 ];
            };
-          };
-        })
-      ]);
+
+            security.sudo.wheelNeedsPassword = false;
+
+            environment.systemPackages = with pkgs; [
+              curl
+              wget
+              htop
+            ];
+          }
+
+          (lib.mkIf cfg.automount.enable {
+            systemd.services.vm-9p-automount = {
+              description = "Auto-discover and mount 9p shares";
+              after = [
+                "local-fs.target"
+                "nss-user-lookup.target"
+                "systemd-modules-load.service"
+              ];
+              wants = [ "systemd-modules-load.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+                ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                  BASE="${cfg.automount.basePath}"
+                  PREFIX="${cfg.automount.prefix}"
+                  mkdir -p "$BASE"
+                  chown ${autoUser}:${autoGroup} "$BASE"
+
+                  for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                    [ -f "$tagfile" ] || continue
+                    tag=$(tr -d '\0' < "$tagfile")
+
+                    case "$tag" in
+                      "$PREFIX"*) ;;
+                      *) continue ;;
+                    esac
+
+                    name="''${tag#"$PREFIX"}"
+                    target="$BASE/$name"
+
+                    mkdir -p "$target"
+                    ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                      -o trans=virtio,version=9p2000.L || continue
+                  done
+                '';
+              };
+            };
+          })
+        ]
+      );
    };
 }
--- a/features/zsh.nix
+++ b/features/zsh.nix
@@ -1,6 +1,12 @@
 {
  nixos =
-    { config, lib, pkgs, user, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      user,
+      ...
+    }:
    let
      cfg = config.features.zsh;
    in
@@ -15,22 +21,29 @@
        };
      };

-      config = lib.mkIf cfg.enable (lib.mkMerge [
-        {
-          programs.zsh.enable = true;
-          environment.etc."zshenv".text = ''
-            export ZDOTDIR=$HOME/.config/zsh
-          '';
-        }
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
+            programs.zsh.enable = true;
+            environment.etc."zshenv".text = ''
+              export ZDOTDIR=$HOME/.config/zsh
+            '';
+          }

-        (lib.mkIf cfg.loginShell.enable {
-          users.users.${user}.shell = pkgs.zsh;
-        })
-      ]);
+          (lib.mkIf cfg.loginShell.enable {
+            users.users.${user}.shell = pkgs.zsh;
+          })
+        ]
+      );
    };

  home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
    let
      cfg = osConfig.features.zsh;
    in
--- a/flake.lock
+++ b/flake.lock
@@ -54,11 +54,11 @@
    "base16-helix": {
      "flake": false,
      "locked": {
-        "lastModified": 1760703920,
-        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
        "owner": "tinted-theming",
        "repo": "base16-helix",
-        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
        "type": "github"
      },
      "original": {
@@ -106,11 +106,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773889306,
-        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
+        "lastModified": 1777713215,
+        "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
+        "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
        "type": "github"
      },
      "original": {
@@ -122,11 +122,11 @@
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1775176642,
-        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
+        "lastModified": 1776136500,
+        "narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "179704030c5286c729b5b0522037d1d51341022c",
+        "rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
        "type": "github"
      },
      "original": {
@@ -156,11 +156,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1777988971,
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
        "type": "github"
      },
      "original": {
@@ -177,11 +177,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1777988971,
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
        "type": "github"
      },
      "original": {
@@ -273,11 +273,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776030105,
-        "narHash": "sha256-b4cNpWPDSH+/CTTiw8++yGh1UYG2kQNrbIehV2iGoeo=",
+        "lastModified": 1778248595,
+        "narHash": "sha256-dhFgEjoeJMYN/7OY6xfxS799YB4IjbbYXTjyGIJyLpc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "49088dc2e7a876e338e510c5f5f60f659819c650",
+        "rev": "fdb2ccba9d5e1238d32e0c4a3ec1a277efa80c1d",
        "type": "github"
      },
      "original": {
@@ -317,11 +317,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1775952282,
-        "narHash": "sha256-iJcGy0pW0wX7q6HAQuKx8sskTyu8an0l0gI3TBgzk3E=",
+        "lastModified": 1778285091,
+        "narHash": "sha256-4YwkGkjvLD0EB7rQGCRA9J/zgwrnTL20dJd7Wmnicj0=",
        "owner": "nix-community",
        "repo": "neovim-nightly-overlay",
-        "rev": "f719e136a8e0cd91e70515e590385356abce1341",
+        "rev": "cca2a2d1c03f763fdcd7066791363d792313c641",
        "type": "github"
      },
      "original": {
@@ -333,11 +333,11 @@
    "neovim-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1775949028,
-        "narHash": "sha256-JXrr9lxKfTIm/VW4jvaB1RU9r+7pAoaXeDsy24TGPiw=",
+        "lastModified": 1778266020,
+        "narHash": "sha256-qoydKalrn/QGsGYVRicz0Hzb7bfGmV7Z9CnVONXN/Lc=",
        "owner": "neovim",
        "repo": "neovim",
-        "rev": "4a289bfce3e71bf00d1eced168a6a7bbb270b95b",
+        "rev": "b7d8a41d91dcfebe9a5f3d0cf2f0bb0b8d59e32e",
        "type": "github"
      },
      "original": {
@@ -348,11 +348,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1778143761,
+        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
        "type": "github"
      },
      "original": {
@@ -364,11 +364,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775888245,
-        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
+        "lastModified": 1778124196,
+        "narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "13043924aaa7375ce482ebe2494338e058282925",
+        "rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
        "type": "github"
      },
      "original": {
@@ -380,11 +380,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
@@ -395,11 +395,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1776031281,
-        "narHash": "sha256-MCXhNHfTvsvbdkn9WV3Rv5Z0tUig1CtINZV+jaWh04k=",
+        "lastModified": 1778360830,
+        "narHash": "sha256-tD44tgf123UcERx3cC91rwefFmGmlTd2M1QdL6d5iLc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4ee46f65286df51761a238bb0f024f8d696ac683",
+        "rev": "82cbc979e10cf2b893566a0f259daf5e1f26c887",
        "type": "github"
      },
      "original": {
@@ -411,11 +411,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1775811116,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
+        "lastModified": 1778003029,
+        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
+        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
        "type": "github"
      },
      "original": {
@@ -427,11 +427,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
        "type": "github"
      },
      "original": {
@@ -453,11 +453,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775228139,
-        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
+        "lastModified": 1777598946,
+        "narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
+        "rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
        "type": "github"
      },
      "original": {
@@ -550,11 +550,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775971308,
-        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
        "type": "github"
      },
      "original": {
@@ -583,11 +583,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1775936757,
-        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
+        "lastModified": 1778104276,
+        "narHash": "sha256-/DSSnU0LLmOTG/OCgGwYpxP6+5YvxRx2g/GhI4x6aCU=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
+        "rev": "18ed8d270231e067fe2739998479ed5d7c659c2c",
        "type": "github"
      },
      "original": {
@@ -630,11 +630,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1772661346,
-        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
+        "lastModified": 1777041405,
+        "narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
+        "rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
        "type": "github"
      },
      "original": {
@@ -646,11 +646,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1772934010,
-        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
+        "lastModified": 1777169200,
+        "narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
+        "rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
        "type": "github"
      },
      "original": {
@@ -662,11 +662,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1772909925,
-        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
+        "lastModified": 1777463218,
+        "narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
+        "rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
        "type": "github"
      },
      "original": {
--- a/flake/hosts.nix
+++ b/flake/hosts.nix
@@ -55,7 +55,6 @@ in
        "git"
        "gnupg"
        "harmonia"
-        "initrd-ssh"
        "localisation"
        "neovim"
        "networkmanager"
@@ -124,6 +123,7 @@ in
        "localisation"
        "networkmanager"
        "nix-settings"
+        "onepassword"
        "sway"
        "udev"
        "zsh"
--- a/flake/overlays.nix
+++ b/flake/overlays.nix
@@ -1,19 +1,7 @@
 { inputs, ... }:

 {
-  flake.overlays.default =
-    _: prev:
-    let
-      pkgs-stable = import inputs.nixpkgs-stable {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-      pkgs-master = import inputs.nixpkgs-master {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-    in
-    {
-      inherit (pkgs-master) claude-code;
-    };
+  flake.overlays.default = final: _prev: {
+    inherit (inputs.nixpkgs-stable.legacyPackages.${final.stdenv.hostPlatform.system}) mcp-nixos;
+  };
 }
--- a/hosts/ephvm/configuration.nix
+++ b/hosts/ephvm/configuration.nix
@@ -13,22 +13,74 @@
  documentation.enable = false;
  environment.defaultPackages = [ ];

-  # compressed qcow2, no channel copy
+  # qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
+  # (~half the size of zlib v2, faster decompress)
  image.modules.qemu =
    { config, modulesPath, ... }:
    {
      system.build.image = lib.mkForce (
-        import (modulesPath + "/../lib/make-disk-image.nix") {
-          inherit lib config pkgs;
-          inherit (config.virtualisation) diskSize;
+        let
+          rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
+            inherit lib config pkgs;
+            inherit (config.virtualisation) diskSize;
+            inherit (config.image) baseName;
+            format = "qcow2";
+            copyChannel = false;
+            partitionTableType = "legacy";
+          };
          inherit (config.image) baseName;
-          format = "qcow2-compressed";
-          copyChannel = false;
-          partitionTableType = "legacy";
-        }
+        in
+        pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
+          mkdir -p $out
+          # qemu-img caps -m at 16
+          cores="''${NIX_BUILD_CORES:-4}"
+          [ "$cores" -gt 0 ] || cores=4
+          [ "$cores" -gt 16 ] && cores=16
+          qemu-img convert \
+            -f qcow2 \
+            -O qcow2 \
+            -c \
+            -o compression_type=zstd \
+            -m "$cores" \
+            ${rawImage}/${baseName}.qcow2 \
+            $out/${baseName}.qcow2
+        ''
      );
    };

+  # auto-login on serial console
+  services.getty.autologinUser = "matej";
+
+  # enable zsh in home-manager so starship init gets wired up
+  home-manager.users.matej.programs.zsh = {
+    enable = true;
+    dotDir = "/home/matej/.config/zsh";
+    shellAliases.dsp = "claude --dangerously-skip-permissions";
+  };
+
+  home-manager.users.matej.programs.starship = {
+    enable = true;
+    settings = {
+      add_newline = false;
+      format = "$username$hostname$directory$character";
+      hostname = {
+        ssh_only = false;
+        style = "bold blue";
+        format = "[@$hostname]($style)";
+      };
+      username = {
+        show_always = true;
+        style_user = "bold blue";
+        format = "[$user]($style)";
+      };
+      directory.format = " [$path]($style) ";
+      character = {
+        success_symbol = "[>](bold green)";
+        error_symbol = "[>](bold red)";
+      };
+    };
+  };
+
  features.vm-guest.headless = true;
  features.vm-guest.automount = {
    enable = true;
@@ -37,7 +89,17 @@
  features.neovim.dotfiles = inputs.nvim;

  # ensure .config exists with correct ownership before automount
-  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
+
+  # TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
+  # https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
+  # accept any ssh key (ephemeral localhost-only vm)
+  services.openssh.settings.AuthorizedKeysCommand =
+    let
+      acceptKey = pkgs.writeShellScript "ephvm-accept-key" ''echo "$1 $2"'';
+    in
+    "${acceptKey} %t %k";
+  services.openssh.settings.AuthorizedKeysCommandUser = "nobody";

  # writable claude config via 9p
  fileSystems."/home/matej/.config/claude" = {
--- a/hosts/fw16/configuration.nix
+++ b/hosts/fw16/configuration.nix
@@ -10,15 +10,13 @@
    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
  ];

+  features.bootloader.resumeDevice = "/dev/mapper/vg0-swap";
  features.desktop.bluetooth.enable = true;
  features.gnupg.yubikey.enable = true;
  features.udev = {
    ledger.enable = true;
    keyboard-zsa.enable = true;
  };
-  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];

  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;

--- a/hosts/fw16/hardware-configuration.nix
+++ b/hosts/fw16/hardware-configuration.nix
@@ -37,10 +37,7 @@
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/42D9-FAFD";
    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+    options = [ "umask=0077" ];
  };

  swapDevices = [
--- a/hosts/tower/configuration.nix
+++ b/hosts/tower/configuration.nix
@@ -6,23 +6,29 @@

 {
  features.nix-settings.towerCache.enable = false;
-  features.bootloader.mode = "lanzaboote";
+  features.bootloader = {
+    mode = "lanzaboote";
+    initrdSsh = {
+      enable = true;
+      networkModule = "r8169";
+      authorizedKeys = userKeys.sshAuthorizedKeys;
+    };
+  };
  features.desktop.bluetooth.enable = true;
  features.gnupg.yubikey.enable = true;
  features.udev = {
    ledger.enable = true;
    keyboard-zsa.enable = true;
  };
-  features.initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };

  # nix store signing
  sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];

  boot.kernelParams = [ "btusb.reset=1" ];
+  # pairs with bootloader's simpledrm initcall blacklist: amdgpu owns fbcon
+  # from the start, no driver-swap mode-set
+  hardware.amdgpu.initrd.enable = true;

  services.udisks2.enable = true;

--- a/33
+++ b/33
@@ -2,31 +2,20 @@
 default:
    @just --list

-# rebuild and switch
-switch config="":
-    nixos-rebuild switch --flake .{{ if config != "" { "#" + config } else { "" } }} --sudo
-
-# fetch flake inputs
-sync:
-    nix flake prefetch-inputs
+# rebuild the system
+rebuild op="switch" host=`hostname`:
+    nixos-rebuild {{op}} --flake .#{{host}} --sudo

 # update flake inputs
 update:
    nix flake update

-# update flake inputs, rebuild and switch
-bump: update switch
-
-# update a package to latest version
-update-package pkg:
-    bash packages/{{pkg}}/update.sh
-
 # update all packages with update scripts
-update-package-all:
+update-package:
    @for script in packages/*/update.sh; do bash "$script"; done

 # build all packages and hosts
-build:
+check:
    nix flake check

 # build installation iso
@@ -37,10 +26,6 @@ iso:
 ephvm *ARGS:
    bash scripts/ephvm-run.sh {{ARGS}}

-# ssh into running ephemeral VM
-ephvm-ssh port="2222":
-    ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost
-
 # provision a host with nixos-anywhere
 provision host ip:
    #!/usr/bin/env bash
@@ -59,9 +44,9 @@ provision host ip:
    ssh root@{{ip}} reboot

 # deploy config to a remote host
-deploy host remote=host:
-    nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
+deploy op="switch" host=`hostname` remote=host:
+    nixos-rebuild {{op}} --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password

 # garbage collect old generations
-clean:
-    sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
+clean host=`hostname`:
+    sudo nix-collect-garbage $(nix eval --raw .#nixosConfigurations.{{host}}.config.nix.gc.options)
--- a/lib/mkHost.nix
+++ b/lib/mkHost.nix
@@ -79,30 +79,40 @@ let
 in
 nixpkgs.lib.nixosSystem {
  inherit system;
-  modules =
-    [
-      inputs.sops-nix.nixosModules.sops
-      inputs.stylix.nixosModules.stylix
+  modules = [
+    inputs.sops-nix.nixosModules.sops
+    inputs.stylix.nixosModules.stylix

-      { nixpkgs.overlays = overlays; }
-      { nixpkgs.config.allowUnfree = true; }
-      { networking.hostName = name; }
+    { nixpkgs.overlays = overlays; }
+    { nixpkgs.config.allowUnfree = true; }
+    { networking.hostName = name; }

-      featureEnableModule
-      hostConfig
-    ]
-    ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
-    ++ nixosMods
-    ++ lib.optionals hasUser [
-      inputs.home-manager.nixosModules.home-manager
-      {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.backupFileExtension = "backup";
-        home-manager.users.${user}.imports = homeMods;
-        home-manager.extraSpecialArgs = { inherit inputs; };
-      }
-    ];
+    # TEMP:(@janezicmatej) temporary mitigation for dirty frag
+    # blocks esp4/esp6 (CVE-2026-43284) and rxrpc (CVE-2026-43500)
+    # remove once nixpkgs ships a kernel with f4c50a4034e6 and the rxrpc fix
+    {
+      boot.blacklistedKernelModules = [
+        "esp4"
+        "esp6"
+        "rxrpc"
+      ];
+    }
+
+    featureEnableModule
+    hostConfig
+  ]
+  ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
+  ++ nixosMods
+  ++ lib.optionals hasUser [
+    inputs.home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
+      home-manager.users.${user}.imports = homeMods;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+    }
+  ];
  specialArgs = {
    inherit inputs userKeys user;
  };
--- a/nix.nix
+++ b/nix.nix
@@ -1,33 +0,0 @@
-{
-  nix = {
-    settings = {
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-      download-buffer-size = 2 * 1024 * 1024 * 1024;
-      warn-dirty = false;
-      substituters = [
-        "https://cache.nixos.org"
-        "https://nix-community.cachix.org?priority=45"
-        "http://tower:5000?priority=50"
-      ];
-      trusted-public-keys = [
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE="
-      ];
-    };
-
-    gc = {
-      automatic = true;
-      dates = "monthly";
-      options = "--delete-older-than 30d";
-    };
-
-    optimise = {
-      automatic = true;
-      dates = [ "monthly" ];
-    };
-  };
-}
--- a/packages/claude-code/package.nix
+++ b/packages/claude-code/package.nix
@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) stdenv lib;
+  version = "2.1.138";
+
+  # upstream ships platform-native binaries as separate npm packages under
+  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
+  # postinstall shim that copies the matching one into place
+  sources = {
+    "x86_64-linux" = {
+      slug = "linux-x64";
+      hash = "sha256-MGYEPPO4O84Egb5Ym/9f56l+TzPqogpSabosvHTIJZg=";
+    };
+    "aarch64-linux" = {
+      slug = "linux-arm64";
+      hash = "sha256-LWBtOAjPDFtLP93TNrsd8bPHJd7VKK6J90CRxUp1/XQ=";
+    };
+    "x86_64-darwin" = {
+      slug = "darwin-x64";
+      hash = "sha256-tkupKzb+XAPmdCRNoT90cfVLKUar3FCTRgufiMVuVPc=";
+    };
+    "aarch64-darwin" = {
+      slug = "darwin-arm64";
+      hash = "sha256-jmB4t11BI1LKanuuXRJv5IBe8a9gSrFvTMP3KarsioU=";
+    };
+  };
+
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "claude-code: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "claude-code";
+  inherit version;
+
+  src = pkgs.fetchzip {
+    url = "https://registry.npmjs.org/@anthropic-ai/claude-code-${source.slug}/-/claude-code-${source.slug}-${version}.tgz";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.patchelf ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 claude $out/bin/claude
+    runHook postInstall
+  '';
+
+  # NOTE:(@janezicmatej) upstream is a bun single-file-executable; the
+  # embedded script payload sits at the tail of the ELF, so autoPatchelfHook's
+  # section-layout changes corrupt it — only the interpreter can be rewritten
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} $out/bin/claude
+    ''
+    + ''
+      wrapProgram $out/bin/claude \
+        --set DISABLE_AUTOUPDATER 1 \
+        --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+        --set DISABLE_INSTALLATION_CHECKS 1 \
+        --unset DEV \
+        --prefix PATH : ${
+          lib.makeBinPath (
+            [
+              pkgs.procps
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isLinux [
+              pkgs.bubblewrap
+              pkgs.socat
+            ]
+          )
+        }
+    '';
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://www.npmjs.com/package/@anthropic-ai/claude-code";
+    license = lib.licenses.unfree;
+    mainProgram = "claude";
+    platforms = lib.attrNames sources;
+  };
+}
--- a/packages/claude-code/update.sh
+++ b/packages/claude-code/update.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+# keep in sync with the `sources` attrset in package.nix
+PLATFORMS=(linux-x64 linux-arm64 darwin-x64 darwin-arm64)
+
+prefetch() {
+	local url="$1"
+	nix --extra-experimental-features 'nix-command flakes' \
+		store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r '.hash'
+}
+
+main() {
+	echo "fetching latest version from npm..."
+	local latest current
+	latest=$(curl -sf "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" | jq -r '.version')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "claude-code already at $latest"
+		return 0
+	fi
+
+	echo "updating claude-code: $current -> $latest"
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+
+	local slug url new_hash old_hash
+	for slug in "${PLATFORMS[@]}"; do
+		url="https://registry.npmjs.org/@anthropic-ai/claude-code-${slug}/-/claude-code-${slug}-${latest}.tgz"
+		echo "  prefetching $slug..."
+		new_hash=$(prefetch "$url")
+		old_hash=$(awk -v slug="$slug" '
+			$0 ~ "slug = \"" slug "\";" { found=1; next }
+			found && /hash = "sha256-/ {
+				match($0, /sha256-[A-Za-z0-9+\/]+=*/)
+				print substr($0, RSTART, RLENGTH)
+				exit
+			}
+		' "$PKG_FILE")
+		sed -i "s|$old_hash|$new_hash|" "$PKG_FILE"
+		echo "    $new_hash"
+	done
+
+	echo "claude-code updated to $latest"
+}
+
+main "$@"
--- a/scripts/ephvm-run.sh
+++ b/scripts/ephvm-run.sh
@@ -27,23 +27,44 @@ info() {

 # globals for cleanup trap
 CLEANUP_OVERLAY=""
+CLEANUP_TMPDIR=""
+QEMU_PID=""
+VM_READY=false
 cleanup() {
+	[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
 	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	# preserve tmpdir on abnormal exit so the qemu log survives for inspection
+	if [ -n "$CLEANUP_TMPDIR" ]; then
+		if [ "$VM_READY" = true ]; then
+			rm -rf "$CLEANUP_TMPDIR"
+		else
+			echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
+		fi
+	fi
 	return 0
 }
 trap cleanup EXIT

+# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
+awaiting_ssh_banner() {
+	local port="$1"
+	local banner
+	banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
+	[ "$banner" = "SSH-" ]
+}
+
 usage() {
 	cat <<EOF
 Usage: ephvm-run.sh [options]

 Options:
  --mount <path>       Mount host directory into VM (repeatable)
-  --claude             Mount claude config dir (requires CLAUDE_CONFIG_DIR)
+  --no-claude          Skip mounting claude config dir
  --disk-size <size>   Resize guest disk (e.g. 50G)
-  --memory <size>      VM memory (default: 8G)
-  --cpus <n>           VM CPUs (default: 4)
-  --ssh-port <port>    SSH port forward (default: 2222)
+  --memory <size>      VM memory (default: 4G)
+  --cpus <n>           VM CPUs (default: 2)
+  --ssh-port <port>    Use specific SSH port (default: auto)
+  --serial             Attach to serial console instead of SSH
  -h, --help           Show usage
 EOF
 	exit "${1:-0}"
@@ -52,7 +73,9 @@ EOF
 main() {
 	setup_colors

-	local ssh_port=2222 memory=8G cpus=4 claude=false disk_size=""
+	[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
+
+	local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
 	local -a mounts=()

 	while [ $# -gt 0 ]; do
@@ -61,8 +84,8 @@ main() {
 			mounts+=("$2")
 			shift 2
 			;;
-		--claude)
-			claude=true
+		--no-claude)
+			claude=false
 			shift
 			;;
 		--disk-size)
@@ -81,6 +104,10 @@ main() {
 			ssh_port="$2"
 			shift 2
 			;;
+		--serial)
+			serial=true
+			shift
+			;;
 		-h | --help) usage ;;
 		*)
 			echo "${red}error:${reset} unknown option: $1" >&2
@@ -91,7 +118,9 @@ main() {

 	info "building ephvm image..."
 	local image_dir image
-	image_dir=$(nix build --no-link --print-out-paths .#nixosConfigurations.ephvm.config.system.build.images.qemu)
+	[ -n "${EPHVM_FLAKE:-}" ] || die "EPHVM_FLAKE must be set to the flake directory"
+	local flake="$EPHVM_FLAKE"
+	image_dir=$(nix build --no-link --print-out-paths "${flake}#nixosConfigurations.ephvm.config.system.build.images.qemu")
 	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
 	[ -n "$image" ] || die "no qcow2 image found in $image_dir"

@@ -101,31 +130,49 @@ main() {
 		CLEANUP_OVERLAY=$(mktemp -d)
 		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
 		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
-		drive_arg="file=$overlay,format=qcow2"
+		drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	else
-		drive_arg="file=$image,format=qcow2,snapshot=on"
+		drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	fi

-	local accel="tcg"
-	[ -r /dev/kvm ] && accel="kvm"
+	command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
+	[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
+
+	# auto-allocate ssh port unless serial mode
+	if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
+		ssh_port=10022
+		while ss -tln | grep -q ":${ssh_port}\b"; do
+			ssh_port=$((ssh_port + 1))
+		done
+	fi
+
+	local nic_arg="user,model=virtio-net-pci"
+	if [ -n "$ssh_port" ]; then
+		nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
+	fi

 	local -a qemu_args=(
 		qemu-system-x86_64
-		-accel "$accel"
+		-accel kvm
+		-cpu host
 		-m "$memory"
 		-smp "$cpus"
 		-drive "$drive_arg"
-		-nic "user,hostfwd=tcp::${ssh_port}-:22"
+		-device "virtio-blk-pci,drive=hd0"
+		-device virtio-rng-pci
+		-nic "$nic_arg"
 		-nographic
+		-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
 	)

-	if [ "$accel" != "tcg" ]; then
-		qemu_args+=(-cpu host)
-	fi
-
 	local fs_id=0 mount_path name tag
 	for mount_path in "${mounts[@]}"; do
+		[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
 		mount_path=$(realpath "$mount_path")
+		# qemu parses -virtfs as csv, a comma in the path would inject options
+		case "$mount_path" in
+		*,*) die "--mount path may not contain commas: $mount_path" ;;
+		esac
 		name=$(basename "$mount_path")
 		tag="m_${name:0:29}"
 		qemu_args+=(
@@ -135,10 +182,13 @@ main() {
 	done

 	if [ "$claude" = true ]; then
-		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "--claude requires CLAUDE_CONFIG_DIR to be set"
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "CLAUDE_CONFIG_DIR must be set (use --no-claude to skip)"
 		mkdir -p "$CLAUDE_CONFIG_DIR"
 		local claude_dir
 		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+		case "$claude_dir" in
+		*,*) die "claude config dir may not contain commas: $claude_dir" ;;
+		esac

 		qemu_args+=(
 			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
@@ -147,10 +197,42 @@ main() {
 	fi

 	info "---"
-	info "Accel: $accel | SSH: ssh -p $ssh_port matej@localhost"
+	[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
 	info "---"

-	exec "${qemu_args[@]}"
+	if [ "$serial" = true ]; then
+		exec "${qemu_args[@]}"
+	fi
+
+	CLEANUP_TMPDIR=$(mktemp -d)
+	local qemu_log="$CLEANUP_TMPDIR/qemu.log"
+
+	# start qemu in background and auto-ssh
+	"${qemu_args[@]}" &>"$qemu_log" &
+	QEMU_PID=$!
+
+	# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
+	local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
+	ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
+
+	info "waiting for vm (port $ssh_port)..."
+	local attempts=0
+	# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
+	# accepts host-side the moment qemu starts, well before guest sshd is up
+	while ! awaiting_ssh_banner "$ssh_port"; do
+		attempts=$((attempts + 1))
+		[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
+		kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
+		sleep 0.5
+	done
+	VM_READY=true
+
+	ssh -p "$ssh_port" -t \
+		-i "$ssh_key" \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o LogLevel=ERROR \
+		matej@localhost
 }

 main "$@"
Author	SHA1	Message	Date
Matej Janežič	524dafd513	wip	2026-05-20 22:55:27 +02:00
Matej Janežič	db1e9c15ac	chore: run formatter	2026-05-12 10:36:25 +02:00
Matej Janežič	f4b9eff715	temp: workaround for nixpkgs#514705	2026-05-12 10:35:53 +02:00
Matej Janežič	325b863238	feat: justfile recipe improvements	2026-05-10 00:08:17 +02:00
Matej Janežič	79a67284af	chore: bump lockfile - bump flake inputs - bump claude-code to 2.1.138	2026-05-09 23:38:56 +02:00
Matej Janežič	fae6b25137	temp: dirty-frag (CVE-2026-43284, CVE-2026-43500)	2026-05-09 23:38:51 +02:00
Matej Janežič	4a59f6b57c	feat: enable one password on fortress	2026-05-06 15:07:01 +02:00
Matej Janežič	4771d8c7d6	chore: run linter	2026-05-06 15:03:16 +02:00
Matej Janežič	2fc05cdfd0	chore: remove deprecated nix.nix	2026-05-04 11:13:39 +02:00
Matej Janežič	ac0958db60	chore: bump lockfile	2026-05-04 09:35:10 +02:00
Matej Janežič	5f8f1ee138	chore: update claude-code to v2.1.126	2026-05-04 09:33:19 +02:00
Matej Janežič	9f38c2a25b	chore: bump lockfile	2026-04-30 11:07:57 +02:00
Matej Janežič	b42c838957	chore: bump claude-code to v2.1.121	2026-04-28 13:19:51 +02:00
Matej Janežič	089f6e8b86	chore: bump lockfile	2026-04-28 13:19:25 +02:00
Matej Janežič	6772afb845	merge: harden ephvm	2026-04-24 14:14:29 +02:00
Matej Janežič	e9755d41c6	feat: tighten ephvm perms, zstd compress qcow2	2026-04-24 14:13:01 +02:00
Matej Janežič	68411d9459	feat: prune vm-guest module	2026-04-24 14:12:57 +02:00
Matej Janežič	7fd5b790ff	feat: ephvm-run.sh virtio devices, require kvm	2026-04-24 14:12:52 +02:00
Matej Janežič	37bca1fdd1	feat: ephvm-run.sh resilience	2026-04-24 14:12:48 +02:00
Matej Janežič	75ca09949c	feat: harden ephvm-run.sh	2026-04-24 14:12:42 +02:00
Matej Janežič	2fcdee5d81	feat: set XDPW_PERSIST_MODE="permanent"	2026-04-23 23:14:45 +02:00
Matej Janežič	c01f797e79	chore: bump lockfile	2026-04-22 00:10:04 +02:00
Matej Janežič	59a2bfa126	chore: update claude-code to v2.1.116	2026-04-22 00:08:31 +02:00
Matej Janežič	e486bb28b0	feat: enable hM.neovim.sidloadInitLua	2026-04-22 00:06:16 +02:00
Matej Janežič	d33fd60ce4	feat: switch from vesktop to discord	2026-04-21 23:39:57 +02:00
Matej Janežič	37428d922b	feat: add plymouth option to bootloader	2026-04-21 22:43:13 +02:00
Matej Janežič	b1cfe1e31b	feat: initrd infinite default device timeout	2026-04-21 22:42:33 +02:00
Matej Janežič	df2bc27f54	chore: blame ignore `77236af589`	2026-04-21 22:11:33 +02:00
Matej Janežič	77236af589	chore: run format	2026-04-21 22:09:39 +02:00
Matej Janežič	f71d156ea8	feat: enable cache fallback	2026-04-21 10:08:08 +02:00
Matej Janežič	0c517e0957	chore: bump lockfile	2026-04-20 07:33:32 +02:00
Matej Janežič	37620c76fe	chore: bump claude-code to v2.1.114	2026-04-20 07:32:02 +02:00
Matej Janežič	ac76b8c842	feat: systemd-networkd during initrd	2026-04-16 23:36:10 +02:00
Matej Janežič	df7c4cec83	feat: bump claude-code to v2.1.112	2026-04-16 23:10:00 +02:00
Matej Janežič	5b52e41496	feat: self-package claude-code	2026-04-16 22:59:01 +02:00
Matej Janežič	a60b40eeac	feat: propagate XDG_DATA_DIRS to dbus/systemd	2026-04-15 09:45:21 +02:00
Matej Janežič	b341f7f4fc	feat: setup mime apps	2026-04-15 00:25:07 +02:00
Matej Janežič	571fb2ff99	chore: blame ignore `2204b12fad`	2026-04-13 23:04:46 +02:00
Matej Janežič	2204b12fad	chore: run lint & format	2026-04-13 23:04:16 +02:00
Matej Janežič	df2ee459a1	feat: improve cache-builder service trigger	2026-04-13 11:53:41 +02:00
Matej Janežič	f7d86e7718	feat: improve ephvm ux	2026-04-13 11:48:18 +02:00