hyprland LUA config

CONTEXT.md

@@ -0,0 +1,47 @@
+# AZ-NIX-CLIENTS
+
+A NixOS flake that manages AzIntec client hosts. Two host species live in this
+repo: developer workstations (e.g. `AZ-LT-NIX`) and the thin-client fleet
+(`AZ-TC-NN`).
+
+## Language
+
+**Thin Client**:
+A NixOS client host in the `AZ-TC-NN` fleet — a mini-PC running KDE Plasma that
+authenticates against Active Directory, provides a pre-configured RDP shortcut
+to a terminal server, and runs a pinned browser for one web app. Replaces a
+Windows 11 workstation.
+_Avoid_: kiosk, terminal, workstation
+
+**Workstation**:
+A NixOS host used for interactive development work (e.g. `AZ-LT-NIX`). Not a
+Thin Client — these hosts use the m3ta-home profile system and are not in the
+production fleet.
+_Avoid_: desktop, laptop, client
+
+**Terminal Server**:
+The remote Windows RDS host (or farm) that Thin Clients connect to via RDP.
+Kerberos SSO is expected to flow from the client login to this server.
+_Avoid_: RDP server, remote desktop, RD server
+
+**Web App**:
+The single browser-based application that Thin Clients open at session start.
+Kerberos SSO is expected for this app.
+_Avoid_: portal, intranet, app
+
+**Domain User**:
+An identity provided by Active Directory via `sssd`. Logs into the Thin Client
+at the SDDM login screen; credentials flow to RDP and the web app via Kerberos.
+_Avoid_: AD user, network user, SSO user
+
+**Hardware Class**:
+One of the 2–3 mini-PC SKUs the fleet is composed of (e.g. Dell OptiPlex Micro,
+Lenovo ThinkCentre Tiny). Each class has its own hardware module under the
+thin-client role.
+_Avoid_: SKU, model, hardware type
+
+**Fleet Host**:
+A single physical Thin Client, identified by `AZ-TC-NN` (two-digit number).
+Each fleet host has a tiny `default.nix` that imports the thin-client role and
+declares its hardware class and hostname.
+_Avoid_: node, device, machine

flake.lock

@@ -56,11 +56,11 @@
         "rev": "75a2ed2533b4d6d8e4a34acd37e83d98d81a5fb0",
         "revCount": 30,
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       },
       "original": {
         "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy"
       }
     },
     "agents": {
@@ -102,11 +102,11 @@
     "agents_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1780133320,
+        "lastModified": 1783016143,
-        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
+        "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=",
         "ref": "refs/heads/master",
-        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a",
-        "revCount": 88,
+        "revCount": 98,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -118,11 +118,11 @@
     "agents_4": {
       "flake": false,
       "locked": {
-        "lastModified": 1780133320,
+        "lastModified": 1783016143,
-        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
+        "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=",
         "ref": "refs/heads/master",
-        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a",
-        "revCount": 88,
+        "revCount": 98,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -172,16 +172,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785348116,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.8.0-rc.1",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -194,16 +194,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785348116,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.8.0-rc.1",
         "repo": "basecamp-cli",
         "type": "github"
       }
@@ -228,11 +228,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782772816,
+        "lastModified": 1784665499,
-        "narHash": "sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM=",
+        "narHash": "sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep+wpUzquA29VU=",
         "owner": "nix-community",
         "repo": "bun2nix",
-        "rev": "5a39d717029e94163ac223aee8d5c9946cafed1c",
+        "rev": "0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783529634,
+        "lastModified": 1785111455,
-        "narHash": "sha256-zdHsPGPE5MVi/y+uIt548XScTfZjQzdF21dME7ISEJM=",
+        "narHash": "sha256-aTNuC9NDBnYAeEtFsleeUwmGX3AZlKOutbl+LQRPkmQ=",
         "owner": "AvengeMedia",
         "repo": "DankMaterialShell",
-        "rev": "bdfd565b72cbb416441a9ab828efcac4fd516c70",
+        "rev": "069ddab041c738236a8910e4c39b65d9628d3018",
         "type": "github"
       },
       "original": {
@@ -359,11 +359,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783591397,
+        "lastModified": 1785375021,
-        "narHash": "sha256-e4DDmVAas6IPwwY+gfSDKh3PMzW/FXLCbjyWXOnnnbM=",
+        "narHash": "sha256-SV24PP3ctDSAuQjg0LdYAvzN7GEustIrtZfciiSrgRI=",
         "owner": "AvengeMedia",
         "repo": "dms-plugin-registry",
-        "rev": "8b61e8fca730986e673737529fa56802dc9326bb",
+        "rev": "672e213a1e20b980708d81bd82df9bf85c15a590",
         "type": "github"
       },
       "original": {
@@ -396,11 +396,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -529,11 +529,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784129366,
+        "lastModified": 1785531816,
-        "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=",
+        "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "165228b0efefc3e635e5174020c40ea64271dc25",
+        "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
         "type": "github"
       },
       "original": {
@@ -572,11 +572,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783550008,
+        "lastModified": 1785306346,
-        "narHash": "sha256-qbbZUk9IG9dLNwCPwdPBs6I5clxwugRpP+1YU+GPK20=",
+        "narHash": "sha256-DScBkW0fOgpGPK2trNoX3ryLTlaC14+gglFo/BhGJ4g=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f4d01c1d87c7c2ec909549165d5a8338f1bd3315",
+        "rev": "e705714e918c3b11affcdd15db2cbe3a070420a0",
         "type": "github"
       },
       "original": {
@@ -594,11 +594,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1784258713,
+        "lastModified": 1785726199,
-        "narHash": "sha256-Fxltsmg9SHOTRJuc4x8J/MB6/cEIjKcMGN/9GyKYQcY=",
+        "narHash": "sha256-crxbm7LsuRiUqriEBRMazOrw+HlfsUufXOKrVKeXfTw=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "31405cadaf364d17d2d736e9002efb91558bf07d",
+        "rev": "7b99fc4bbb8a7c2fff82c2708d8636c1cbc65661",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nur": "nur"
       },
       "locked": {
-        "lastModified": 1784265695,
+        "lastModified": 1785731515,
-        "narHash": "sha256-75SSM3j5wCxmQ4Zv2IVufpdpBcdR+yPQGydtIvtiEfw=",
+        "narHash": "sha256-uFLNOscQy/jQe3HMePEWD/65SnXNlxR15nkehr5l0Cw=",
         "ref": "refs/heads/master",
-        "rev": "5e26e13aa70fb079d665f9a64bc4e8eea4c1328f",
+        "rev": "b01084482f04657e78313a43d9f39dec3957ade0",
-        "revCount": 91,
+        "revCount": 107,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
       },
@@ -646,14 +646,15 @@
           "nixpkgs"
         ],
         "nixpkgs-master": "nixpkgs-master",
+        "opencode": "opencode",
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1783269665,
+        "lastModified": 1785670526,
-        "narHash": "sha256-bA4PooGV1x3vtmhs6NEprZbWErwaEJdgxoKfAWaH0do=",
+        "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=",
         "ref": "refs/heads/master",
-        "rev": "f279ae9c89d59f3e0deb0fd6307800f4cb993815",
+        "rev": "69fce234a8607cd3e71233831564b8ceeba70626",
-        "revCount": 356,
+        "revCount": 374,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -666,16 +667,17 @@
       "inputs": {
         "agents": "agents_4",
         "basecamp": "basecamp_2",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_8",
         "nixpkgs-master": "nixpkgs-master_2",
+        "opencode": "opencode_2",
         "openspec": "openspec_2"
       },
       "locked": {
-        "lastModified": 1784214341,
+        "lastModified": 1785670526,
-        "narHash": "sha256-Wd/0CxfT7G1pJwh+pb9BQUGxYdbyOQ+ADl7QM3KtHNw=",
+        "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=",
         "ref": "refs/heads/master",
-        "rev": "d932db10c49d85e2f58c65f0cacaa678eec16452",
+        "rev": "69fce234a8607cd3e71233831564b8ceeba70626",
-        "revCount": 359,
+        "revCount": 374,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -755,11 +757,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1784099966,
+        "lastModified": 1785356851,
-        "narHash": "sha256-h+q9j0ivHhll0sXIPCuJJ+Ivcqh7QDL8eulVUl+CqTQ=",
+        "narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=",
         "owner": "nix-community",
         "repo": "nixos-anywhere",
-        "rev": "7239104f1a38546b999cd817658407d80f56e7db",
+        "rev": "5887f1c72fbf0e88000716237194de414d2299ee",
         "type": "github"
       },
       "original": {
@@ -780,11 +782,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783593136,
+        "lastModified": 1784802994,
-        "narHash": "sha256-zy5an02BdZ65OgVKdRkz2TpbdBrsW+uQD7AA2wLuiTM=",
+        "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=",
         "owner": "nix-community",
         "repo": "nixos-images",
-        "rev": "803f28511c7d5f39f2537c342122fd94b8e1d519",
+        "rev": "6ece16b0c97986fe085122e796044add4cc3ff64",
         "type": "github"
       },
       "original": {
@@ -795,11 +797,11 @@
     },
     "nixos-stable": {
       "locked": {
-        "lastModified": 1784011430,
+        "lastModified": 1785133411,
-        "narHash": "sha256-lDebytrYdd47IBLwvNOD+6AGeoqZ78CIKlp70hzW280=",
+        "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8eeec934ae0dbeca3d7868c059568a65c08b2fc3",
+        "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3",
         "type": "github"
       },
       "original": {
@@ -857,11 +859,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1782540244,
+        "lastModified": 1785386845,
-        "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=",
+        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a65184fc373636356fcaf460dc09655a919c66ea",
+        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
         "type": "github"
       },
       "original": {
@@ -873,11 +875,11 @@
     },
     "nixpkgs-master_2": {
       "locked": {
-        "lastModified": 1782540244,
+        "lastModified": 1785386845,
-        "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=",
+        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a65184fc373636356fcaf460dc09655a919c66ea",
+        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
         "type": "github"
       },
       "original": {
@@ -903,6 +905,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_10": {
+      "locked": {
+        "lastModified": 1785602060,
+        "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1772479524,
@@ -921,11 +939,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1784176690,
+        "lastModified": 1785542685,
-        "narHash": "sha256-RUXu+GHGkY+eShsqx8hp0BIIo51K3V1Q8AY4pPAUcDw=",
+        "narHash": "sha256-sjfvXMbG5pCFgpvw2OZAFcZiTvrppCWvnB6cuGrSY08=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6368bc923cec55a5f78960ade0cb4dd99580e087",
+        "rev": "f8e81fc7eb063db454f563cdd596fb96a5ad1497",
         "type": "github"
       },
       "original": {
@@ -969,31 +987,31 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1783224372,
+        "lastModified": 1776683584,
-        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "narHash": "sha256-NuTLMrr10Tng72hurYG8jYQ4XKK8wnpJmOGcPiis96g=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "rev": "9dd5558b06dbdacbf635a3dd36dce1b1a7ee3a89",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_7": {
       "locked": {
-        "lastModified": 1782467914,
+        "lastModified": 1785318670,
-        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -1001,15 +1019,31 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1784115452,
+        "lastModified": 1785318670,
-        "narHash": "sha256-BoYPdqk6jlKXy+DyUzyGV/CtRGfAhk2MmIgBhsemTGI=",
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "35d3407a3816f3b341d8cf1d60abaf2b7b8166ac",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_9": {
+      "locked": {
+        "lastModified": 1776683584,
+        "narHash": "sha256-NuTLMrr10Tng72hurYG8jYQ4XKK8wnpJmOGcPiis96g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9dd5558b06dbdacbf635a3dd36dce1b1a7ee3a89",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
         "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -1040,14 +1074,14 @@
     "nur": {
       "inputs": {
         "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1783593872,
+        "lastModified": 1785395064,
-        "narHash": "sha256-KvFRxsi81gBoK7JOTHD2LoR1y2sWobHkrHGPhM3v/NY=",
+        "narHash": "sha256-ZZoXKpTETeIU93xQOxleE27JWT1FcpF9pe1nSPrFbuw=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "73078fa6f0d34686ad26808f90cc74e81039ba9f",
+        "rev": "cce2408845d0298ae0dcc42582c1d8b390de105c",
         "type": "github"
       },
       "original": {
@@ -1064,11 +1098,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784213785,
+        "lastModified": 1785733230,
-        "narHash": "sha256-VAR4eIzcnkOcJ/pt6RFw7Vp4rcF8nyZr4cMMVQrJG7o=",
+        "narHash": "sha256-o4mTy4z8VFrcGO2DazzfnmhvYHEMAqyqONsxL1S9EKg=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "bc59262a699f013fed75a6c6affc903ff755edfa",
+        "rev": "8d57d3ae4895f825a5c8a995d619987befa4a005",
         "type": "github"
       },
       "original": {
@@ -1077,6 +1111,44 @@
         "type": "github"
       }
     },
+    "opencode": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_6"
+      },
+      "locked": {
+        "lastModified": 1785386452,
+        "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=",
+        "owner": "anomalyco",
+        "repo": "opencode",
+        "rev": "f7204902192624481e526b1852cdedaadb914e24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "anomalyco",
+        "ref": "dev",
+        "repo": "opencode",
+        "type": "github"
+      }
+    },
+    "opencode_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_9"
+      },
+      "locked": {
+        "lastModified": 1785386452,
+        "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=",
+        "owner": "anomalyco",
+        "repo": "opencode",
+        "rev": "f7204902192624481e526b1852cdedaadb914e24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "anomalyco",
+        "ref": "dev",
+        "repo": "opencode",
+        "type": "github"
+      }
+    },
     "openspec": {
       "inputs": {
         "nixpkgs": [
@@ -1086,11 +1158,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782291243,
+        "lastModified": 1785371113,
-        "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=",
+        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6",
+        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
         "type": "github"
       },
       "original": {
@@ -1107,11 +1179,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782291243,
+        "lastModified": 1785371113,
-        "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=",
+        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6",
+        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
         "type": "github"
       },
       "original": {
@@ -1223,7 +1295,7 @@
         "m3ta-nixpkgs": "m3ta-nixpkgs_2",
         "nix-colors": "nix-colors_2",
         "nixos-anywhere": "nixos-anywhere",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_10",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur_2"
       }
@@ -1281,11 +1353,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1785360170,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
         "type": "github"
       },
       "original": {
@@ -1302,11 +1374,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
+        "lastModified": 1784369104,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {

hosts/AZ-LT-NIX/home.nix

@@ -7,7 +7,16 @@
   lib,
   ...
 }:
-with lib; {
+with lib; let
+  mkEnvVar = name: value: {
+    _args = [
+      name
+      value
+    ];
+  };
+in {
+  imports = [
+  ];
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
@@ -35,16 +44,6 @@ with lib; {
           };
         };
       };
-
-      services.hyprpaper.settings = {
-        ipc = "on";
-        preload = ["/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png"];
-        wallpaper = [
-          "eDP-1,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png"
-          "DP-8,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png"
-          "DP-10,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png"
-        ];
-      };
     }
 
     # ── Hyprland monitor layout ──
@@ -52,37 +51,89 @@ with lib; {
       wayland.windowManager.hyprland = {
         enable = true;
         settings = {
-          workspace = [
+          workspace_rule = [
-            "1, monitor:eDP-1, default:true"
-            "2, monitor:eDP-1"
-            "3, monitor:DP-8"
-            "4, monitor:DP-8"
-            "5, monitor:DP-10"
-            "6, monitor:DP-10"
-          ];
-          windowrule = [
-            "match:class com.obsproject.Studio, workspace 1"
-            "match:class dev.zed.Zed, workspace 3"
-            "match:class vivaldi-stable, workspace 4, opacity 1.0"
-            "match:initial_title 3.basecamp.com_/5996442/, workspace 5, opacity 1.0"
-            "match:initial_title 3.basecamp.com_/5996442/, tile on"
-            "match:initial_title teams.microsoft.com_/, workspace 6, opacity 1.0"
-            "match:initial_title teams.microsoft.com_/, tile on"
-            "match:initial_title outlook.office.com_/mail/, workspace 6, opacity 1.0"
-            "match:initial_title outlook.office.com_/mail/, tile on"
-          ];
-          device = lib.mkForce [
             {
-              name = "keychron-keychron-k7";
+              workspace = "1";
-              kb_layout = "us";
+              monitor = "eDP-1";
+              default = true;
             }
             {
-              name = "keychron-keychron-k7-1";
+              workspace = "2";
-              kb_layout = "us";
+              monitor = "eDP-1";
             }
             {
-              name = "keychron-keychron-k7-2";
+              workspace = "3";
-              kb_layout = "us";
+              monitor = "DP-8";
+            }
+            {
+              workspace = "4";
+              monitor = "DP-8";
+            }
+            {
+              workspace = "5";
+              monitor = "DP-10";
+            }
+            {
+              workspace = "6";
+              monitor = "DP-10";
+            }
+            {
+              workspace = "7";
+              monitor = "DP-10";
+            }
+          ];
+          # m3ta-home sets QT_QPA_PLATFORMTHEME to gtk3 globally for Hyprland.
+          # ksnip crashes with duplicate GDK type registration under that Qt GTK
+          # platform theme, so use qtct for Qt apps on this host instead.
+          "env" = mkForce [
+            (mkEnvVar "XCURSOR_SIZE" "32")
+            (mkEnvVar "HYPRCURSOR_THEME" "Bibata-Modern-Ice")
+            (mkEnvVar "WLR_NO_HARDWARE_CURSORS" "1")
+            (mkEnvVar "XDG_CURRENT_DESKTOP" "Hyprland")
+            (mkEnvVar "XDG_SESSION_TYPE" "wayland")
+            (mkEnvVar "XDG_SESSION_DESKTOP" "Hyprland")
+            (mkEnvVar "XKB_DEFAULT_LAYOUT" "de")
+            (mkEnvVar "NIXOS_OZONE_WL" "1")
+            (mkEnvVar "QT_QPA_PLATFORM" "wayland;xcb")
+            (mkEnvVar "QT_QPA_PLATFORMTHEME" "qt5ct")
+            (mkEnvVar "QT_QPA_PLATFORMTHEME_QT6" "qt6ct")
+          ];
+          window_rule = [
+            {
+              match.class = "dev.zed.Zed";
+              workspace = "3";
+            }
+            {
+              match.class = "^(com.obsproject.Studio)$";
+              workspace = "1";
+            }
+            {
+              match.class = "^(brave-browse)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.class = "^(vivaldi-stable)$";
+              workspace = "4";
+              opacity = "1.0";
+            }
+            {
+              match.initial_title = "3.basecamp.com_/5996442/";
+              workspace = "5";
+              opacity = "1.0";
+              tile = true;
+            }
+            {
+              match.initial_title = "teams.microsoft.com_/";
+              workspace = "6";
+              opacity = "1.0";
+              tile = true;
+            }
+            {
+              match.initial_title = "outlook.office.com_/mail/";
+              workspace = "6";
+              opacity = "1.0";
+              tile = true;
             }
           ];
         };

hosts/AZ-TC-01/default.nix

@@ -20,7 +20,7 @@
 
   # Disk device override for this specific box (Dell OptiPlex 3040 Micro
   # with a 256GB SATA SSD).
-  az.tc.deployment.diskDevice = "/dev/sda";
+  az.tc.deployment.diskDevice = "/dev/nvme0n1";
 
   system.stateVersion = "25.05";
 }

overlays/default.nix

@@ -25,7 +25,24 @@
       config.allowUnfree = true;
     };
   };
-  # Flatten llm-agents packages into top-level pkgs namespace.
   mkLlmAgentsOverlay = system: _final: _prev:
-    inputs.llm-agents.packages.${system} or {};
+    removeAttrs (inputs.llm-agents.packages.${system} or {}) [
+      # Internal helpers from packages/* marked hideFromDocs upstream:
+      "antigravity"
+      "auto-claude"
+      "buildNpmPackage" # ← the culprit; breaks webcord's `buildNpmPackage.override { nodejs = ...; }`
+      "bun2nix"
+      "darwinOpenptyHook"
+      "default" # fzf launcher; collides with nothing in nixpkgs but kept out for hygiene
+      "dolt" # collides with nixpkgs.dolt (Dolt database); not used in this config
+      "flake-inputs"
+      "forge"
+      "formatelf"
+      "formatter" # collides conceptually with pkgs.formatter; not used here
+      "go-bin"
+      "unpinCargoMsrvHook"
+      "unpinGoModVersionHook"
+      "versionCheckHomeHook"
+      "wrapBuddy"
+    ];
 }

secrets.nix

@@ -9,9 +9,9 @@ let
   # After first boot, retrieve via: ssh-keyscan -t ed25519 AZ-TC-NN.netbird
   # and paste the public key here. Until then, the corresponding .age
   # secrets can't be decrypted by the host.
-  AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-01";
+  AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHfDCRFvGkduqaxKMQkCN0hiJ+096WBBSvJBf5TprNgE";
-  AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02";
+  # AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02";
-  AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03";
+  # AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03";
 
   #USERS
   sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
@@ -19,7 +19,7 @@ let
 
   users = [sascha.koenig jannik.mueller];
   systems = [AZ-CLD-1 AZ-LT-NIX AZ-PRM-1];
-  thinClients = [AZ-TC-01 AZ-TC-02 AZ-TC-03];
+  thinClients = [AZ-TC-01];
 in {
   "secrets/elevenlabs-key.age".publicKeys = systems ++ users;
   "secrets/exa-key.age".publicKeys = systems ++ users;
@@ -52,13 +52,13 @@ in {
   "secrets/AZ-TC-01-wifi-client-cert.age".publicKeys = [AZ-TC-01] ++ users;
   "secrets/AZ-TC-01-rustdesk-password.age".publicKeys = [AZ-TC-01] ++ users;
 
-  "secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users;
+  # "secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users;
-  "secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users;
+  # "secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users;
-  "secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users;
+  # "secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users;
-  "secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users;
+  # "secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users;
 
-  "secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users;
+  # "secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users;
-  "secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users;
+  # "secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users;
-  "secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users;
+  # "secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users;
-  "secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users;
+  # "secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users;
 }

secrets/AZ-TC-01-krb5-keytab.age

@@ -0,0 +1,42 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZWN05LdyBpSGs5
+amgyV0tCZkEyUHd3MUNEVzc4SERiTWdpMDM4amtsMEl5VXNOZUQ4CklXMmJNWEw3
+V2ovc1JPaktPdWs2NDlFYWxJelZnZk9PV0FtNUJOMG8yYmMKLT4gc3NoLWVkMjU1
+MTkgQ1NNeWhnIHIvelYvaFF5TXVoaTRHSVg5ZTNmb1pZMTNON1RPOUlGZ0I4TlBt
+SjJ1ZzAKREp5dnZmVEdoSmpJTVNOb2RhWFR1MlVSbTNOOE5XZFNyWjlFdkcwTVE3
+NAotPiBzc2gtZWQyNTUxOSBvWUxjRncgbzZiaDFmOXZKNkp2Snd3eGRDS1ZKdk8r
+aDhvUVhMSU9odFBpUXpYNDF6YwpjTmJjYkJna0tIdkRsdHFNaThYaU9XQ0RyVjJD
+RGFTM3hVMEFQU0V2azFvCi0+IC1+MEB8LFM5LWdyZWFzZSBQRlN8bSBfcCBbWiB2
+UwpiY05OcE5jaE93bThwTGxraXFRaW1RdUUrQTd2Ymgyd3NxMU9IamxiWUlFSWMx
+MGZLNEVzZDBrMEVmanlzSVR5CkNWQlFlZjlGL2N2ZHFJSVNQZHNpR05CT3pDTG5D
+TEEKLS0tIDRZSVVKRWVqUG1uUHpXUUV6ZWpTbWpZNVF5MWF4dFR5OEliWm9KSnpQ
+WTQKWklnQ9B/Ig4adbUCM+oE7kIVH5MBoiZjdiXmNj4FukIRpDmgEvzddINntdG8
+B/GUs7wWVIh1j9u4DL1/8Vok7Vp7nKKDrGVcwONVdPusIn0z1pR+0MXRy4puDthr
+SnI79KN/rZotMTM60zfPbPKmw51rGsA1WofsudXhNo3HgCLgM1n9DZCeuXTOWWzr
+vULWJRuFkbEL5XLwDBUz0xI7QFJmGOnMvHh7HLjyQX7akuPOSzqN8R1FIm+Ol5uY
+4BL3t7Xfj9Iun3Jzb7phahFHZADs4oA+YguoP4yF99+TOwBVw7eV16sNjM/caEyt
+3Rul28jP6VhoglLYUkYrDYRPNpQsQU7ZkB9MuW/96RIoA7XL6YqlM/YuhfGlA8VO
+CvKcfaYNMMyZT8r8gR40MEK15JpComGOvhJu8JHSvvinpqvwbeYOAU7f/gj4oorQ
+IFEGfEewBRe94vhHnkR9GJqznHRVTQiOENiBJi33cz3ZWXCZGwF1zsziMLy8/HaQ
+/wCyDeRbAUo+zaUeESPIV3k346cmrn90tMA7ChU5Amgh0Dr34ry4jqW9m99p9viY
+KlgAD1Fe3nQ+LRR3lyQOdSe2HiHN4zq3JP/zu6Kvb3FoNMpCrRVJ7ZkjHog+8lAA
+fauw7cRK1ebUKvEVJU3FHqqRLSLre8eEgYoG1jOlee2Et2Oa9euHxwUJuMV9MaiP
+hT0g1eLyW5TDllKSVYYDt4yv3Hd+p33nhHi6wz8gVBpgNTaqPtl76MvrpuWDzSeZ
+VZSXj4mTT2hos8JIwnlqmM5wTm/U1RzEEcT1FoqOzDYzya9Cq8O5dG1AjomzOKpv
+bmfBV+uLqtUTO80sTPPtUeOd7t7AUekXk25Hh8wk7k8Vbjx1PlW9rT1w4KziGvqb
+ni2VxzhawmujsY/EFxu7pDYRJ1bDBv4Lus4aM2ZEIGDbIKcvatgaKvtdLmPYq0dC
+UkLmiNoulEQmF38GMZ1UgVW67RPUFMRMAp5ZfIl+5KrorcmKqmxmmIClftIgwBkR
+nV1BQgdMFr5tnLSLqQePahRyEormv7TRUIrHnGWMoTjHEsZNT5Oc/vn66UnmIY5D
+S+YO1ayEmWCRaZ63+ITnc1aKLEQR9BRS6qIN7ZG4EB1X61D4v2M5lFvo/dCHFclC
+EWWE0ncVBsHXqDedxDnWK+7ceybo8KbLl+uAZDX+RLDtJVibc/CSdhfcaqSAIleI
+Ss+D2amcqp37s5SScI7sPqhmilWmJSHRP7y0sGMkRu9qyoRrA31H1pXCk/9yWyXT
+iakjlXd3Dz1YLsAx3VLkvsD4m5zShIiprBA1nuiHSOBPcmQoS5ZljhpKKZT2OPG+
+zcWObJso5ndjoW/Qnkr1FGxIjFPkXDt0buVZ6B7Q3JbJvBg66TzA5iSIkX78Fad2
+zB3OtVBfpq81V6XZLe825/3osV0HQBQ84xTDMU2wXlaaV6IKUBcqQBcBeDyZL6xH
+299Wg5E1z/HXTG3uYfbe3vV+HAzgzPvB5qI1usMPj0Bvud8iSjflEMSPLAZOkufl
+dRcKp6wKLDT6+8S8Wpty0n0pNL43cl3RSVzxD4PaLiss72HlmjUmGjPK3bdxm0rz
+6/WpB9VEzbv8WcRJSZl7FE1vP2h32qCh3+0w4dUqIa/A1am7RMgilbi/EvEdREVc
+gsL4sOj/gPi6hqkYJxhBsZ7RrIuhyQvXEfcUj/57NlOrWTiFaTM4JqkIAIxmACCK
+S8VNIjQEN9QADNOGxjxXXzkUKmp0GmMn53vzO02zRBdX3Lrqzgt4N7TNePH/XIb7
+ncy2WsNR41UUXiJByEKlHUZzvdhSaQb7cY3WtabfyGF3MF4=
+-----END AGE ENCRYPTED FILE-----