Removed comments & mercury tailscale key

hosts/terra/configuration.nix

@@ -63,9 +63,6 @@ in
     libxrandr
     libxinerama
     libxcb
-
-    # CLion Nova's C++ backend is a .NET 10 app that needs ICU or reports
-    # "Couldn't find a valid ICU package installed on the system".
     icu
   ];
 
@@ -97,38 +94,6 @@ in
   # rootless podman GPU containers (Vulkan whisper.cpp/llama.cpp).
   users.users.darman.extraGroups = [ "render" "video" ];
 
-  # ---- ollama (local LLM server, ROCm on the 6800 XT) ----
-  # Navi 21 (gfx1030) is officially ROCm-supported, so no
-  # HSA_OVERRIDE_GFX_VERSION needed. Upstream module already runs under
-  # DynamicUser with render/kfd/drm access wired, unlike jellyfin's static user.
-  services.ollama = {
-    enable = true;
-    package = pkgs.ollama-rocm;
-    # keep default model in sync with services/desktop/librechat.nix's
-    # endpoints.custom default (its schema needs a non-empty value even
-    # though fetch=true overrides it).
-    # gemma4:12b: daily-driver chat/coding model, fits fully in 16G VRAM; also
-    # doubles as LibreChat's memory-extraction agent (librechat.nix) since a
-    # smaller model confused the user's stated facts with its own boilerplate.
-    # qwen3.6:35b-a3b: MoE (3B active/36B total, ~24GB Q4_K_M) — doesn't fit
-    # in VRAM alone, so ollama offloads inactive experts to CPU RAM; sparsity
-    # makes that less painful than for a dense model this size, but still slower.
-    # VladimirGav/qwen3.8-27B-14GB-IQ4: dense 27B at IQ4 (~14GB) — nominally
-    # fits the 16G card but leaves little headroom, so expect partial CPU
-    # offload as context grows.
-    loadModels = [
-      "gemma4:12b"
-      "qwen3.6:35b-a3b"
-      "VladimirGav/qwen3.8-27B-14GB-IQ4"
-    ];
-    # Ollama truncates context far below a model's real window unless told
-    # otherwise. 131072 is the practical ceiling from load-testing: VRAM stays
-    # 100% GPU with no CPU spillover up to here, but headroom and prefill
-    # throughput both degrade near the top — going higher risks CPU spillover
-    # under concurrent GPU load (compositor, jellyfin transcode) for little gain.
-    environmentVariables.OLLAMA_CONTEXT_LENGTH = "131072";
-  };
-
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";

hosts/terra/home/hyprland.nix

@@ -1,17 +1,5 @@
 { lib, pkgs, config, inputs, ... }:
 
-# Hyprland config migrated from github.com/darman96/hyprland-dotfiles into
-# home-manager's lua-style `settings` (each attr becomes an `hl.<name>(...)`
-# call in hyprland.lua). Imported by home.nix; system-level enable lives in
-# ../../services/desktop/desktop-hyprland.nix.
-#
-# Not migrated: hyprbars (unpackaged plugin; its successor hypr-chrome is
-# wired in below instead), hyprqt6engine (conflicts with home.nix's qtct/
-# Dracula Qt theming), hyprlock (use programs.hyprlock), the old wob volume
-# overlay (kept only wpctl/playerctl), and Arch-specific env vars. Several
-# binds reference apps not yet packaged here (vivaldi-stable, dolphin,
-# vicinae, grimblast, waypaper, discord, gitkraken, qbz).
-
 let
   lua = lib.generators.mkLuaInline;
 
@@ -24,7 +12,6 @@ let
   # Wallpapers aren't checked into this repo (binaries) — pulled from the
   # Wallhaven library on /mnt/hdd_01. Picked once here since hyprpaper has
   # no built-in "random" mode.
-  # wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png";
   wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-mlwz78.png";
 
   # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland
@@ -106,7 +93,7 @@ in
         debug.disable_logs = false;
 
         general = {
-          border_size = 2;
+          border_size = 1;
           col = {
             inactive_border = lua "bg_accent";
             active_border = {

secrets/mercury.yaml

@@ -1,6 +1,6 @@
 darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
 pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:swWBS6icqidKMBC6Fo8IyOWIswWzGpRJGhFfA1JPlZsvqEo46J/kLjC6wfU4eOhSBsWTYiiqtHDaX05SKr8gwSxA/ERwj/Swf8bNHST4rbKrI4Cq5QDfzA==,iv:UUdVgkFATla6pmErn2oT06PuQ/kv9L8g0nX2CCPaJhI=,tag:97gAUSfxHzemVljl8FTULw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:h3jbN9SrPZwUlYJPEbydvcf9tP/qGQPegnY87AYKOj9AsqAgxeEKfLYwtNeksLgcNBvCoJ1ALk7gqfrMw6sCrW7S7IFlDYhSJDAPfFkR6iczInBDpSfISg==,iv:ML+l4nmPfmSoTGQnNWpdxGZkdaq5HKEHaUxKcblmR8w=,tag:BCAbJ6Iy5ziBNLiOuI/5PA==,type:str]
 sops:
     age:
         - enc: |
@@ -21,7 +21,7 @@ sops:
             x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
-    lastmodified: "2026-08-21T23:14:15Z"
+    lastmodified: "2026-09-18T19:44:32Z"
-    mac: ENC[AES256_GCM,data:zxV+szKjxb+7EV/hSyFeHUs/V2wZgIz8NO78/RDZeGoGtCjwDGiSIFsO1VQI5LZPW+O+pTnT2s4W5P0QuEjYrkPU5LRunW+Tv87XrDBqoR62vPvhRmt0wZXOQZu4oAn7LGpn24xo5QYKc2JowJWIVlyQs03UL3jQtgwfkG9u8k4=,iv:IZpZlUVqaKjO0aokwtF2hFAqC2D9H5bVMO6HezmYQ+Y=,tag:ij6pu3b6CQzctrJ87ifp5Q==,type:str]
+    mac: ENC[AES256_GCM,data:PYNiUnDjBTgTAvTOAMk+XQEgcFSXLXgkw/vQCw0GhZsVHfkvd7jzkpk33ER64JqU4aPw+PRWo937mVKVEGDKkYVY2pP6hl2EJeOtfgjOuL9QpTNh+BKxDhYige5KsxPeMTEvtL7Y6dSsgAneaNPBEeLfZ0wiTVq1v2RJNgdNAGU=,iv:WYbyNn3/0QWXR7X8CHBKPPdVf0tYv8E4F4CYLjnuhVo=,tag:7ABexc8r6WZfskABUsquHg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.2
+    version: 3.13.3

services/vpn/headscale.nix

@@ -28,7 +28,7 @@
         # single point of failure for tailnet DNS.
         # ⚠️ Hardcoded tailnet address — check `headscale nodes list` if it
         # changes (mercury re-enrolled) and DNS dies tailnet-wide.
-        nameservers.global = [ "100.64.0.7" ];
+        nameservers.global = [ "100.64.0.4" ];
 
         # Must be set here, not via the module's `dns.split` option — nixpkgs
         # renders that one level too high, but headscale (and headplane) read