WIP

hosts/mars/configuration.nix

@@ -1,13 +1,15 @@
 { config, pkgs, ... }:
 
-# mars — on-site x86_64 box, single-purpose: runs Hermes Agent only.
-# See hermes-agent.nix for what that is and why it moved here from jupiter.
+# mars — on-site x86_64 box for Hermes Agent (luna), plus the web apps she
+# hosts herself. See hermes-agent.nix for what Hermes is and why it moved here
+# from jupiter, and luna-sites.nix for the app hosting.
 {
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix          # disko: OS-disk partitions + filesystems
     ./secrets.nix              # sops-nix: samba/tailscale/hermes secrets
     ./hermes-agent.nix
+    ./luna-sites.nix           # luna's LAN web apps: http://mars.sol/<name>/
     ../../common.nix              # shared base: user / ssh / nix / firewall
     ../../services/containers.nix
     ../../services/vpn/tailscale.nix

hosts/mars/hermes-agent.nix

@@ -49,8 +49,8 @@
 # (no networking.firewall.allowedTCPPorts entry; tailscale0 is already a
 # trustedInterface, services/vpn/tailscale.nix). Public route: neptun's
 # hermes.mgaction.town vhost (hosts/neptun/configuration.nix) proxies to this
-# over the tailnet. mars runs no Caddy of its own (single-purpose box), so
-# there is no LAN vhost — reach the dashboard directly via mars's tailnet
+# over the tailnet. mars's own Caddy (luna-sites.nix) only serves luna's apps
+# and has no vhost for this — reach the dashboard directly via mars's tailnet
 # name (mars.orbit.sol:9119) or LAN IP:9119 for local debugging.
 #
 # Uses upstream's generic self-hosted OIDC plugin, same Authentik
@@ -196,13 +196,31 @@ in
   # directly against the real instance during the first version of this
   # setup). Delete-then-add is idempotent either way and picks up a rotated
   # token for free.
+  #
+  # `tea logins add` is the ONLY step in here that touches the network, and
+  # ordering is what makes it survivable. switch-to-configuration restarts
+  # NetworkManager and starts this unit in the SAME pass: on 2026-09-11 the
+  # two landed in the same second, tea's connect went out over an interface
+  # that was still coming back, and the kernel spent 2m48s on SYN retries
+  # before reporting "connection timed out". That failed this unit, which
+  # podman-hermes-agent Requires=, so a five-second network blip took the
+  # whole container down and returned 4 from the deploy. Hence
+  # network-online.target below, the bounded reachability probe in the script,
+  # and TimeoutStartSec as the backstop — no single blocking call in here may
+  # outlive the deploy that started it.
   systemd.services.hermes-agent-prepare-dirs = {
     description = "Create Hermes state dirs + luna's git/tea access before the container starts";
     before = [ "podman-hermes-agent.service" ];
     wantedBy = [ "podman-hermes-agent.service" ];
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
     unitConfig.RequiresMountsFor = [ "/mnt/jupiter" ];
-    path = [ pkgs.git pkgs.tea ];
+    path = [ pkgs.git pkgs.tea pkgs.curl pkgs.coreutils ];
     serviceConfig.Type = "oneshot";
+    # Everything here is either local or bounded to ~30s by the probe loop, so
+    # anything past two minutes is a hang, not slowness. Failing at that point
+    # is strictly better than holding the deploy open.
+    serviceConfig.TimeoutStartSec = "120";
     script = ''
       mkdir -p ${hermesHome}
       mkdir -p ${dropboxDir}
@@ -231,9 +249,43 @@ in
       git config --global user.name "luna"
       git config --global user.email "luna@${giteaHost}"
 
-      tea logins delete luna 2>/dev/null || true
-      GITEA_SERVER_TOKEN="$(cat "$token_file")" tea logins add \
-        --name luna --url "https://${giteaHost}" --no-version-check
+      # Probe before touching the login, with a hard per-attempt timeout: a
+      # bare TCP connect to an interface that is still coming up hangs for
+      # ~3 minutes on kernel SYN retries, and tea has no timeout flag of its
+      # own. /api/v1/version is unauthenticated, so this says "is gitea
+      # reachable", never "is the token good" — the token is the add's job.
+      #
+      # Probing FIRST (rather than retrying the add) is what protects the
+      # login that is already there. delete-then-add is not atomic: an add
+      # that fails because the network is down leaves luna with no login at
+      # all, strictly worse than the stale-but-working one we started with.
+      # Unreachable therefore means skip the refresh entirely and warn.
+      gitea_up=0
+      for attempt in 1 2 3; do
+        if curl -fsS --max-time 5 -o /dev/null "https://${giteaHost}/api/v1/version"; then
+          gitea_up=1
+          break
+        fi
+        echo "${giteaHost} unreachable (attempt $attempt/3); retrying in 5s" >&2
+        sleep 5
+      done
+
+      if [ "$gitea_up" = 1 ]; then
+        # Reachable but the add still fails == a real problem (revoked or
+        # under-scoped token, gitea rejecting the login), and that stays
+        # fatal: it is a config error, it will not fix itself on the next
+        # boot, and it should be loud.
+        tea logins delete luna 2>/dev/null || true
+        GITEA_SERVER_TOKEN="$(cat "$token_file")" timeout 60 tea logins add \
+          --name luna --url "https://${giteaHost}" --no-version-check
+      else
+        # Deliberately not fatal. Every other thing this unit does is local,
+        # and podman-hermes-agent Requires= it — failing here would take
+        # Telegram and the dashboard down over a transient blip. luna keeps
+        # git (the credential helper above needs no network to be written)
+        # and loses only the tea CLI until the next start re-runs this.
+        echo "WARNING: ${giteaHost} unreachable; left luna's tea login untouched." >&2
+      fi
 
       # Hand everything written above to the container's uid/gid. This does
       # NOT happen by itself: the image's cont-init only chowns hermesHome's

hosts/mars/luna-sites-README.md

@@ -0,0 +1,94 @@
+# Hosting your web apps on mars
+
+You can run web apps as containers and publish them on the home network at
+`http://mars.sol/<name>/`, without anyone changing mars's configuration.
+Everything below takes effect immediately — no restart, no redeploy.
+
+This file is mounted read-only and is rewritten on every restart. Save what
+you need from it to your memory.
+
+## How it fits together
+
+- `podman` in your shell does not run containers next to you. It talks,
+  through `$CONTAINER_HOST`, to a separate unprivileged account on mars
+  (`luna-apps`). Containers there keep running when you restart, and come
+  back after mars reboots if they were started with `--restart=always`.
+- Caddy on mars routes `http://mars.sol/<name>/` to the port you name in
+  `/opt/data/sites/<name>.json`. A service on mars checks that file and
+  writes the outcome to `/opt/data/sites-status.txt`.
+
+## Publish an app
+
+1. Put the source under `/opt/data/apps/<name>/` with a `Containerfile` (or
+   `Dockerfile`), and build it. The directory is uploaded, so this works from
+   where you are:
+
+       podman build -t localhost/<name> /opt/data/apps/<name>
+
+2. Run it. Publish its port on `127.0.0.1` only, using a host port between
+   @portMin@ and @portMax@ that no other app uses (`podman ps` shows the
+   taken ones):
+
+       podman run -d --name <name> --restart=always \
+         -p 127.0.0.1:20001:8080 localhost/<name>
+
+3. Register it:
+
+       echo '{"port": 20001}' > /opt/data/sites/<name>.json
+
+4. Check that it took, then fetch it:
+
+       cat /opt/data/sites-status.txt
+       curl -si http://127.0.0.1/<name>/
+
+   It is now at `http://mars.sol/<name>/` for anyone on the home network.
+
+## Rules the registry enforces
+
+- `<name>` is lowercase letters, digits and `-`, starts with a letter or
+  digit, at most 32 characters. The file is `/opt/data/sites/<name>.json`.
+- The file holds exactly one JSON object, and only `port` is read.
+- `port` is an integer from @portMin@ to @portMax@. Anything else is rejected
+  (that includes everything else already running on mars).
+- A rejected entry never affects the others. `sites-status.txt` says why.
+- If `sites-status.txt` starts with `ERROR`, that is a fault on mars's side,
+  not in your entry — tell darman.
+
+## Writing apps that work under /<name>/
+
+Caddy strips `/<name>` before the request reaches your app, so the app itself
+sees `/`, `/style.css`, `/api/items`. The browser, however, is at
+`http://mars.sol/<name>/`, so every link, asset URL and fetch() in the page must
+keep that prefix:
+
+- Prefer relative URLs: `style.css`, `./api/items` — not `/style.css`.
+- Or set the framework's public base URL to `/<name>/` (e.g. Vite's `base`).
+  Avoid settings that ALSO expect the prefix on incoming requests (Next.js
+  `basePath`); the prefix has already been removed by then.
+- The original prefix arrives in the `X-Forwarded-Prefix` header.
+- `http://mars.sol/<name>` redirects to `http://mars.sol/<name>/`.
+
+## Files and data
+
+- `-v /opt/data/...:/somewhere` does not work: those paths exist only inside
+  your container, and `luna-apps` cannot see your files. Copy code into the
+  image in the `Containerfile`.
+- Keep an app's state in a named volume: `-v <name>-data:/data`.
+- Pulling public images works (`podman pull docker.io/library/nginx`).
+- Do not copy tokens or anything else from `/opt/data` into an app. The apps
+  cannot read your files; keep it that way.
+
+## Update, inspect, remove
+
+- Update: rebuild, `podman rm -f <name>`, run it again on the same port. The
+  JSON file stays as it is.
+- Inspect: `podman ps -a`, `podman logs <name>`, `cat /opt/data/sites-status.txt`.
+- Remove: `rm /opt/data/sites/<name>.json`, then `podman rm -f <name>`, and
+  optionally `podman rmi localhost/<name>` and `podman volume rm <name>-data`.
+
+## Limits
+
+- Home network only: plain `http://`, not reachable from the internet, not on
+  mgaction.town.
+- There is no login in front of these apps. Anyone on the home network can
+  use them, so do not publish anything that would be a problem to expose there.

hosts/mars/luna-sites-test.nix

@@ -0,0 +1,186 @@
+# VM test for luna-sites.nix. Run:
+#   nix build .#checks.x86_64-linux.luna-sites -L
+#
+# mars has no VM target, and nearly everything luna-sites does only exists at
+# runtime: a rootless podman socket reached through a proxy from another
+# container's uid, a path unit, a caddy reload, linger + podman-restart after
+# a reboot. So this drives it the way luna does — every podman and registry
+# command runs inside a stand-in for the Hermes container, as uid 986 — and
+# checks that bad entries are refused without taking good ones down.
+{ pkgs }:
+let
+  # `contents` is symlinked into the image root and its closure ships as
+  # layers, so the app image is self-contained under luna-apps. The stand-in
+  # is NOT: hermes-agent mounts the host's /nix/store over the image's own,
+  # which is why the node adds busybox to the VM's store below.
+  busyboxImage = { name, extraCommands ? "", cmd }: pkgs.dockerTools.buildLayeredImage {
+    inherit name;
+    tag = "latest";
+    contents = [ pkgs.busybox ];
+    extraCommands = "mkdir -p tmp && chmod 1777 tmp\n" + extraCommands;
+    config.Cmd = cmd;
+  };
+
+  # Stand-in for docker.io/nousresearch/hermes-agent: a shell and nothing else.
+  # The podman client comes from the store, mounted by luna-sites.nix exactly
+  # as on mars.
+  standin = busyboxImage {
+    name = "hermes-standin";
+    cmd = [ "/bin/sleep" "infinity" ];
+  };
+
+  # The "app" luna builds on top of. No network in the VM, so it is loaded
+  # from the store instead of pulled. Runs under luna-apps, which has no
+  # /nix/store mount — hence the closure inside the image.
+  app = busyboxImage {
+    name = "testapp";
+    extraCommands = "mkdir -p www && echo hello > www/index.html";
+    cmd = [ "/bin/httpd" "-f" "-p" "8080" "-h" "/www" ];
+  };
+in
+pkgs.testers.runNixOSTest {
+  name = "luna-sites";
+
+  nodes.mars = {
+    imports = [ ./luna-sites.nix ];
+
+    virtualisation.memorySize = 2048;
+    virtualisation.diskSize = 4096;
+    environment.systemPackages = [ pkgs.curl ];
+    # The stand-in's /bin symlinks point into /nix/store, and the /nix/store
+    # mount below replaces the image's copy with the VM's, which only holds
+    # the system closure. Without this: "executable file `/bin/sleep` not
+    # found". (The real Hermes image is not nix-built, so mars never hits it.)
+    system.extraDependencies = [ pkgs.busybox ];
+
+    # What hermes-agent.nix provides, minus Hermes itself: same uid/gid, host
+    # networking, hermesHome at /opt/data, /nix/store read-only.
+    users.groups.hermes.gid = 983;
+    systemd.tmpfiles.rules = [
+      "d /var/lib/hermes 0750 root hermes -"
+      "d /var/lib/hermes/.hermes 0750 986 983 -"
+    ];
+    virtualisation.oci-containers.containers.hermes-agent = {
+      image = "hermes-standin:latest";
+      imageFile = standin;
+      extraOptions = [ "--network=host" "--user=986:983" ];
+      volumes = [
+        "/var/lib/hermes/.hermes:/opt/data"
+        "/nix/store:/nix/store:ro"
+      ];
+      environment = {
+        HERMES_UID = "986";
+        HERMES_GID = "983";
+        HOME = "/opt/data";
+      };
+    };
+  };
+
+  testScript = /* python */ ''
+    import shlex
+
+    status_file = "/var/lib/hermes/.hermes/sites-status.txt"
+
+    def luna(cmd):
+        """Run cmd the way luna would: inside her container, as uid 986."""
+        return mars.succeed("podman exec hermes-agent sh -c " + shlex.quote(cmd))
+
+    def code(path):
+        return mars.succeed(
+            f"curl -s -o /dev/null -w '%{{http_code}}' http://127.0.0.1{path}"
+        ).strip()
+
+    def status_line(entry):
+        lines = mars.succeed(f"cat {status_file}").splitlines()
+        found = [l for l in lines if l.split(" ", 1)[0] == entry]
+        assert len(found) == 1, f"no single status line for {entry}:\n" + "\n".join(lines)
+        return found[0]
+
+    start_all()
+    mars.wait_for_unit("caddy.service")
+    mars.wait_for_unit("podman-hermes-agent.service")
+
+    with subtest("caddy starts with nothing registered"):
+        # The import glob matches no file on a fresh box; caddy must still run.
+        assert code("/") == "404"
+
+    with subtest("luna's podman is luna-apps's rootless podman"):
+        assert luna("id -u").strip() == "986"
+        assert luna("podman info --format '{{.Host.Security.Rootless}}'").strip() == "true"
+        readme = luna("cat /opt/data/sites-README.md")
+        assert "20000" in readme and "@port" not in readme, "README placeholders not substituted"
+
+    with subtest("build and run an app, as luna would"):
+        luna("podman load -i ${app}")
+        luna(
+            "mkdir -p /opt/data/apps/notes && "
+            "printf 'FROM localhost/testapp:latest\\nRUN echo built > /www/built.txt\\n' "
+            "> /opt/data/apps/notes/Containerfile"
+        )
+        luna("podman build -t localhost/notes /opt/data/apps/notes")
+        luna("podman run -d --name notes --restart=always -p 127.0.0.1:20001:8080 localhost/notes")
+        mars.wait_until_succeeds("curl -sf http://127.0.0.1:20001/built.txt")
+        # Container root maps to luna-apps on the host: not root, not uid 986.
+        mars.succeed("pgrep -u luna-apps -f 'httpd -f -p 8080'")
+
+    with subtest("registering routes /notes/ to it"):
+        luna("""echo '{"port": 20001}' > /opt/data/sites/notes.json""")
+        mars.wait_until_succeeds("curl -sf http://127.0.0.1/notes/built.txt | grep -qx built")
+        # httpd has no /www/notes/, so the 200 above also proves the prefix is stripped.
+        assert " ok " in status_line("notes.json")
+        out = mars.succeed(
+            "curl -s -o /dev/null -w '%{http_code} %{redirect_url}' http://127.0.0.1/notes"
+        )
+        assert out.startswith("308 ") and out.endswith("/notes/"), out
+        mars.succeed("stat -c %U:%a /var/lib/luna-sites/live/notes.caddy | grep -qx root:644")
+
+    with subtest("bad entries are rejected one by one"):
+        luna("""echo '{"port": 9119}' > /opt/data/sites/dash.json""")
+        luna("echo nope > /opt/data/sites/broken.json")
+        luna(": > /opt/data/sites/empty.json")
+        luna("""echo '{"port": 20002}{"port": 20003}' > /opt/data/sites/two.json""")
+        luna("""echo '{"port": 20003.5}' > /opt/data/sites/frac.json""")
+        luna("""echo '{"port": "20004"}' > /opt/data/sites/str.json""")
+        luna("""echo '{"port": 20005}' > /opt/data/sites/Bad_Name.json""")
+        luna("ln -s /etc/shadow /opt/data/sites/link.json")
+        mars.wait_until_succeeds(f"grep -q '^link.json ' {status_file}")
+        for entry, why in [
+            ("dash.json", "port 9119 is outside 20000-20999"),
+            ("broken.json", "not valid JSON"),
+            ("empty.json", "expected exactly one JSON object"),
+            ("two.json", "expected exactly one JSON object"),
+            ("frac.json", "port must be an integer"),
+            ("str.json", "port must be an integer"),
+            ("Bad_Name.json", "name must match"),
+            ("link.json", "not a regular file"),
+        ]:
+            line = status_line(entry)
+            assert " rejected " in line and why in line, line
+        assert " ok " in status_line("notes.json")
+        # A burst like the one above used to trip systemd's start limit, which
+        # fails the path unit for good and silently ignores every later entry.
+        mars.succeed("systemctl is-active luna-sites.path")
+        assert code("/notes/built.txt") == "200"
+        assert code("/dash/") == "404"
+        mars.succeed("test \"$(ls /var/lib/luna-sites/live)\" = notes.caddy")
+        # The status file is hers, and nothing root-written is left in her tree
+        # (bar the README's mountpoint, which podman itself creates).
+        mars.succeed(f"stat -c %u {status_file} | grep -qx 986")
+        mars.fail("find /var/lib/hermes/.hermes -user root ! -name sites-README.md | grep .")
+
+    with subtest("removing the entry removes the route"):
+        luna("rm /opt/data/sites/notes.json")
+        mars.wait_until_succeeds("test \"$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/notes/built.txt)\" = 404")
+
+    with subtest("apps and routes come back after a reboot"):
+        luna("""echo '{"port": 20001}' > /opt/data/sites/notes.json""")
+        mars.wait_until_succeeds("curl -sf http://127.0.0.1/notes/built.txt")
+        mars.shutdown()
+        mars.start()
+        mars.wait_for_unit("caddy.service")
+        # Nobody logs in: linger starts luna-apps's manager, podman-restart the container.
+        mars.wait_until_succeeds("curl -sf http://127.0.0.1/notes/built.txt | grep -qx built", timeout=180)
+        mars.wait_for_unit("podman-hermes-agent.service")
+        assert luna("podman ps --format '{{.Names}}'").split() == ["notes"]
+  '';
+}

hosts/mars/luna-sites.nix

@@ -0,0 +1,334 @@
+{ config, pkgs, ... }:
+
+# luna-sites — luna (the Hermes agent, hermes-agent.nix) hosts her own web apps
+# on mars, LAN-only, at http://mars.sol/<name>/, with no nix edit per app.
+#
+#   luna, inside hermes-agent (uid 986)
+#     │  podman … → $CONTAINER_HOST = /run/luna-podman/podman.sock (luna-apps:hermes 0660)
+#     ▼  systemd-socket-proxyd, running AS luna-apps
+#   luna-apps's rootless podman (its linger'd user manager) — her app containers
+#
+#   /opt/data/sites/<name>.json  {"port": N}     hermesHome/sites, hers to write
+#     ▼  luna-sites.path → luna-sites.service (root): validate, caddy validate, reload
+#   /var/lib/luna-sites/live/<name>.caddy         root-owned, imported by caddy
+#   /opt/data/sites-status.txt                    what was accepted, and why not
+#
+# Why a registry of {name, port} instead of letting her drop Caddyfile
+# snippets: a snippet can proxy to anything on this box (the dashboard on
+# 9119, the webhook listener on 8644, node-exporter) or file_server anything
+# caddy can read, and one syntax error keeps caddy from coming up on the next
+# boot. The generator only ever emits one fixed shape from a validated name
+# and a port inside portMin..portMax, so none of that is expressible.
+#
+# Why paths, not <name>.mars.sol: mars has no fixed DHCP lease, and a wildcard
+# needs one. `address=/…/` takes an IP, and pihole-FTL's dnsmasq skips
+# wildcard --cname entries outside authoritative zones (cache_reload():
+# `if (a->alias[1] != '*' …)`). Moving to subdomains later only changes the
+# fragment the generator writes; the registry format stays.
+#
+# Why a podman socket instead of ssh: what she needs is long-running processes
+# OUTSIDE her own container (anything started inside it dies with the
+# container, and sits next to her Telegram/gitea tokens). The socket gives
+# exactly that and no host shell. It is not a strong boundary on its own —
+# rootless podman socket access is code execution as luna-apps, which can read
+# whatever that user can — but luna-apps owns nothing and cannot enter
+# /var/lib/hermes (0750 root:hermes), so the apps cannot reach her tokens.
+#
+# She learns all this from a read-only README mounted at
+# /opt/data/sites-README.md (luna-sites-README.md). She self-manages her
+# memories, so nothing in this file reaches her otherwise — see the dropped
+# repo clone in hermes-agent.nix's header for what happens when it doesn't.
+#
+# VM test: nix build .#checks.x86_64-linux.luna-sites -L (luna-sites-test.nix)
+let
+  user = "luna-apps";
+  # Pinned so the user manager's socket path below is known at build time.
+  uid = 1001;
+  userSocket = "/run/user/${toString uid}/podman/podman.sock";
+
+  hermes = config.virtualisation.oci-containers.containers.hermes-agent;
+  hermesUid = hermes.environment.HERMES_UID;
+  hermesGid = hermes.environment.HERMES_GID;
+  # hermes-agent.nix's hermesHome — the container sees it as /opt/data.
+  hermesHome = "/var/lib/hermes/.hermes";
+  sitesDir = "${hermesHome}/sites";
+  statusFile = "${hermesHome}/sites-status.txt";
+
+  stateDir = "/var/lib/luna-sites";
+  liveDir = "${stateDir}/live";
+  socketDir = "/run/luna-podman";
+
+  portMin = 20000;
+  portMax = 20999;
+
+  readme = pkgs.replaceVars ./luna-sites-README.md {
+    portMin = toString portMin;
+    portMax = toString portMax;
+  };
+in
+{
+  imports = [
+    ../../services/containers.nix
+    ../../services/network/caddy.nix
+  ];
+
+  # ---- luna-apps: the account her apps run as ----
+  users.users.${user} = {
+    isNormalUser = true;
+    inherit uid;
+    description = "luna's hosted web apps (rootless podman)";
+    # Nothing ever logs in as this user. Only its systemd user manager runs,
+    # kept up without a session by linger, which is what brings the podman
+    # socket and podman-restart back after a reboot.
+    linger = true;
+    autoSubUidGidRange = true; # rootless podman's user namespace
+    hashedPassword = "!";
+    shell = "${pkgs.shadow}/bin/nologin";
+  };
+
+  # `--restart=always` containers only come back after a reboot through this
+  # unit — rootless podman has no daemon to remember them. The podman module
+  # already enables podman.socket for every user's manager; this one is
+  # scoped to luna-apps.
+  systemd.user.services.podman-restart = {
+    wantedBy = [ "default.target" ];
+    unitConfig.ConditionUser = user;
+  };
+
+  # ---- the socket luna's container talks to ----
+  # luna-apps's own socket lives under /run/user/1001 (0700), which the
+  # container's uid cannot enter. This re-exposes it to group hermes, and the
+  # proxy behind it runs as luna-apps, so it holds no access beyond the socket
+  # it forwards to.
+  systemd.sockets.luna-apps-podman = {
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "${socketDir}/podman.sock" ];
+    socketConfig = {
+      SocketUser = user;
+      SocketGroup = "hermes";
+      SocketMode = "0660";
+      DirectoryMode = "0755";
+    };
+  };
+  systemd.services.luna-apps-podman = {
+    description = "Forward luna's podman socket to luna-apps's rootless podman";
+    requires = [ "user@${toString uid}.service" ];
+    after = [ "user@${toString uid}.service" ];
+    serviceConfig = {
+      User = user;
+      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${userSocket}";
+    };
+  };
+
+  # ---- luna's side ----
+  # Merges into hermes-agent.nix's container definition.
+  virtualisation.oci-containers.containers.hermes-agent = {
+    volumes = [
+      # The directory, not the socket file: the socket is created by systemd
+      # at boot, and a file bind mount would pin whatever inode was there when
+      # the container started. Read-only still permits connect().
+      "${socketDir}:${socketDir}:ro"
+      "${config.virtualisation.podman.package}/bin/podman:/usr/local/bin/podman:ro"
+      "${readme}:/opt/data/sites-README.md:ro"
+    ];
+    # Every podman command in there goes to luna-apps, never to the rootful
+    # podman the container itself runs under.
+    environment.CONTAINER_HOST = "unix://${socketDir}/podman.sock";
+  };
+  systemd.services.podman-hermes-agent = {
+    wants = [ "luna-apps-podman.socket" ];
+    after = [ "luna-apps-podman.socket" ];
+  };
+
+  # ---- caddy ----
+  # `:80` rather than http://mars.sol, so it answers whatever name the LAN
+  # used to get here (mars, mars.sol, the IP). Until the generator's first run
+  # the import glob matches nothing, which caddy only warns about.
+  services.caddy.virtualHosts.":80".extraConfig = ''
+    import ${liveDir}/*.caddy
+    handle {
+      respond "No app registered here. luna's apps live at /<name>/." 404
+    }
+  '';
+
+  # ---- registry → caddy ----
+  # Fires on create/delete/rename/close-after-write of entries in sitesDir.
+  # While sitesDir does not exist yet, systemd watches its parents instead.
+  systemd.paths.luna-sites = {
+    wantedBy = [ "multi-user.target" ];
+    pathConfig.PathChanged = sitesDir;
+  };
+
+  systemd.services.luna-sites = {
+    description = "Turn luna's site registry into caddy routes";
+    # Also runs once at boot, for edits made while nothing was watching.
+    wantedBy = [ "multi-user.target" ];
+    # After caddy, so the reload below never races caddy's own start. Nothing
+    # orders caddy after THIS unit, which is what keeps the blocking
+    # `systemctl reload caddy` from waiting on its own start job.
+    after = [ "caddy.service" ];
+    # No start rate limit. The default (5 starts in 10s) is hit by nothing
+    # more than a handful of quick writes — the VM test does exactly that —
+    # and when it is, systemd also fails luna-sites.path for good
+    # (unit-start-limit-hit): every later registration is silently ignored
+    # until someone runs reset-failed. Bursts are absorbed by the debounce at
+    # the top of the script instead.
+    startLimitIntervalSec = 0;
+    path = [ pkgs.jq pkgs.util-linux pkgs.diffutils config.services.caddy.package ];
+    # caddy validate wants somewhere to write its data/config dirs.
+    environment = {
+      HOME = "/tmp";
+      XDG_DATA_HOME = "/tmp";
+      XDG_CONFIG_HOME = "/tmp";
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      StateDirectory = "luna-sites";
+      StateDirectoryMode = "0755"; # caddy (User=caddy) reads live/
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      # "-": hermesHome does not exist on a box Hermes has never started on;
+      # the script checks for that itself.
+      ReadWritePaths = [ "-${hermesHome}" ];
+    };
+    script = ''
+      set -euo pipefail
+
+      # Everything that touches luna's tree runs as the container's uid, never
+      # as root: she controls every path under it, including swapping one for
+      # a symlink into /etc between a check here and its use.
+      as_luna() { setpriv --reuid=${hermesUid} --regid=${hermesGid} --clear-groups -- "$@"; }
+
+      if [ ! -d ${hermesHome} ]; then
+        echo "${hermesHome} does not exist yet; nothing to do"
+        exit 0
+      fi
+      # mkdir -p leaves an existing dir untouched, so this does not re-fire
+      # the path unit on every run.
+      as_luna mkdir -p ${sitesDir}
+      rm -rf ${stateDir}/stage.*
+
+      report=$(mktemp)
+
+      reject() { printf '%-24s rejected  %s\n' "$f" "$1" >> "$report"; }
+
+      # Written as her uid next to the target, then renamed into place, so
+      # she never reads a half-written file.
+      publish_report() {
+        local tmp
+        tmp=$(as_luna mktemp ${hermesHome}/.sites-status.XXXXXX)
+        {
+          printf '# luna-sites, %s. How this works: /opt/data/sites-README.md\n' "$(date -Is)"
+          if [ -n "''${1:-}" ]; then printf '%s\n' "$1"; fi
+          if [ -s "$report" ]; then cat "$report"; else echo "(no sites registered)"; fi
+        } | as_luna tee "$tmp" >/dev/null
+        as_luna mv -f "$tmp" ${statusFile}
+      }
+
+      entries() {
+        as_luna find ${sitesDir} -mindepth 1 -maxdepth 1 -name '*.json' -printf '%y %f %s %T@\n' | sort
+      }
+
+      generate() {
+        local stage entry type f name verdict port
+        : > "$report"
+        stage=$(mktemp -d ${stateDir}/stage.XXXXXX)
+        chmod 0755 "$stage"
+
+        while IFS= read -r -d "" entry; do
+          type=''${entry%% *}
+          f=''${entry#* }
+          name=''${f%.json}
+
+          if ! [[ $name =~ ^[a-z0-9][a-z0-9-]{0,31}$ ]]; then
+            reject "name must match [a-z0-9][a-z0-9-]{0,31}"
+            continue
+          fi
+          # Refused rather than followed. The read below happens as her uid
+          # either way, so this is about clear feedback, not safety.
+          if [ "$type" != f ]; then
+            reject "not a regular file"
+            continue
+          fi
+
+          verdict=$(as_luna head -c 4096 -- ${sitesDir}/"$f" | jq -rs \
+            --argjson min ${toString portMin} --argjson max ${toString portMax} '
+              if length != 1 or (.[0] | type) != "object" then "expected exactly one JSON object"
+              else .[0].port as $p
+                | if ($p | type) != "number" or $p != ($p | floor) then "port must be an integer"
+                  elif $p < $min or $p > $max then "port \($p) is outside \($min)-\($max)"
+                  else "ok \($p | floor)" end
+              end
+            ' 2>/dev/null) || verdict="not valid JSON"
+
+          case $verdict in
+            "ok "*) port=''${verdict#ok } ;;
+            *) reject "$verdict"; continue ;;
+          esac
+          if ! [[ $port =~ ^[0-9]+$ ]]; then
+            reject "port must be an integer"
+            continue
+          fi
+
+          # The only shape that is ever generated. Stripping the prefix means
+          # the app sees `/`; X-Forwarded-Prefix tells it where it really is.
+          {
+            printf '# %s\n' "${sitesDir}/$f"
+            printf 'redir /%s /%s/ 308\n' "$name" "$name"
+            printf 'handle_path /%s/* {\n' "$name"
+            printf '\treverse_proxy 127.0.0.1:%s {\n' "$port"
+            printf '\t\theader_up X-Forwarded-Prefix /%s\n' "$name"
+            printf '\t}\n}\n'
+          } > "$stage/$name.caddy"
+          printf '%-24s ok        http://mars.sol/%s/ -> 127.0.0.1:%s\n' "$f" "$name" "$port" >> "$report"
+        done < <(as_luna find ${sitesDir} -mindepth 1 -maxdepth 1 -name '*.json' -printf '%y %f\0' | sort -z)
+
+        # Nothing she controls reaches these files except a validated name and
+        # an integer, so a failure here is a bug in this unit, not her entry.
+        printf ':80 {\n\timport %s/*.caddy\n}\n' "$stage" > "$stage.Caddyfile"
+        if ! caddy validate --adapter caddyfile --config "$stage.Caddyfile"; then
+          rm -rf "$stage" "$stage.Caddyfile"
+          publish_report "ERROR: the generated routes failed caddy validate, so nothing changed. This is a bug in luna-sites, not in your entries - tell darman (journalctl -u luna-sites)."
+          exit 1
+        fi
+        rm -f "$stage.Caddyfile"
+
+        if [ -d ${liveDir} ] && diff -r ${liveDir} "$stage" >/dev/null; then
+          rm -rf "$stage"
+        else
+          rm -rf ${stateDir}/previous
+          if [ -d ${liveDir} ]; then mv ${liveDir} ${stateDir}/previous; fi
+          mv "$stage" ${liveDir}
+          # caddy's reload is all-or-nothing: on failure it keeps serving the
+          # old routes, so put the old files back to match what is live.
+          if systemctl is-active --quiet caddy.service && ! systemctl reload caddy.service; then
+            rm -rf ${liveDir}
+            if [ -d ${stateDir}/previous ]; then mv ${stateDir}/previous ${liveDir}; fi
+            publish_report "ERROR: caddy refused the new routes, so the previous ones are still live. This is a bug in luna-sites, not in your entries - tell darman (journalctl -u luna-sites)."
+            exit 1
+          fi
+          rm -rf ${stateDir}/previous
+        fi
+        publish_report
+      }
+
+      # Debounce: writes usually come in bursts (several files, or an editor's
+      # write-then-rename), and every trigger that lands while this oneshot
+      # is still activating merges into this same start job instead of
+      # queuing another. One second collapses a burst into one run.
+      sleep 1
+
+      # That merging also means an entry written mid-run would otherwise wait
+      # for the next unrelated change. Compare the registry before and after,
+      # and go again. Bounded, so a writer in a loop cannot pin the unit.
+      for attempt in 1 2 3 4 5; do
+        before=$(entries)
+        generate
+        if [ "$before" = "$(entries)" ]; then exit 0; fi
+        echo "registry changed during run $attempt; regenerating"
+      done
+      echo "registry still changing after 5 runs; leaving the rest to the next trigger" >&2
+    '';
+  };
+}

hosts/terra/configuration.nix

@@ -43,6 +43,51 @@ in
   # https://nix.dev/permalink/stub-ld ----
   programs.nix-ld.enable = true;
 
+  # The default set above is deliberately minimal and carries no X11,
+  # freetype, wayland or xkbcommon, so a prebuilt *graphical* binary dies
+  # before it draws anything. JetBrains IDEs installed through Toolbox are the
+  # case that surfaced this: their bundled JBR aborts with `libX11.so.6:
+  # cannot open shared object file` unless the Toolbox GUI — itself an FHS
+  # wrapper — is what launches them, which makes them unusable from a terminal
+  # or from a per-repo devShell. These are the libraries `ldd` reports missing
+  # across a JBR's own .so files, plus the three it resolves by dlopen rather
+  # than DT_NEEDED: fontconfig for font discovery, libGL, and libsecret for
+  # the credential store. Definitions merge, so this adds to the module's base
+  # list rather than replacing it (zlib is already there).
+  programs.nix-ld.libraries = with pkgs; [
+    freetype
+    fontconfig
+    libGL
+    libxkbcommon
+    wayland
+    libsecret
+    libx11
+    libxext
+    libxi
+    libxrender
+    libxtst
+    libxcursor
+    libxrandr
+    libxinerama
+    libxcb
+
+    # CLion Nova's C++ backend (the clion-radler plugin) is a .NET 10
+    # application bundling its own runtime, and .NET refuses to start
+    # without ICU: libSystem.Globalization.Native.so dlopens libicuuc.so
+    # and libicui18n.so, and failing that the IDE reports "Couldn't find a
+    # valid ICU package installed on the system" and comes up degraded.
+    icu
+  ];
+
+  # ---- envfs: serves /bin and /usr/bin from the calling process's PATH ----
+  # NixOS ships only /bin/sh, but plenty of third-party tooling writes scripts
+  # with a hardcoded interpreter. JetBrains Toolbox is the standing example:
+  # it generates ~/.local/share/JetBrains/Toolbox/scripts/{clion,rider,...}
+  # with `#!/bin/bash`, so every one of those shims fails with `bad
+  # interpreter` in any shell. envfs resolves such shebangs against PATH,
+  # which fixes them all at once instead of per-IDE wrappers.
+  services.envfs.enable = true;
+
   # ---- home-manager (user-level config for darman) ----
   # Base settings (useGlobalPkgs/useUserPackages/backupFileExtension) and the
   # shared zsh baseline now live in common.nix + home/common.nix, applied to
@@ -96,7 +141,15 @@ in
     # in VRAM alone, so ollama offloads the inactive experts to CPU RAM.
     # Sparse activation makes that far less painful than it'd be for a dense
     # model this size, but still expect it to run slower than the two above.
-    loadModels = [ "gemma4:12b" "qwen3.6:35b-a3b" ];
+    # VladimirGav/qwen3.8-27B-14GB-IQ4: dense 27B at IQ4, ~14GB of weights —
+    # nominally fits the 6800 XT's 16G, but that leaves only ~2G for the KV
+    # cache and the compositor, so expect partial CPU offload as context grows
+    # (OLLAMA_CONTEXT_LENGTH below applies to every model on this server).
+    loadModels = [
+      "gemma4:12b"
+      "qwen3.6:35b-a3b"
+      "VladimirGav/qwen3.8-27B-14GB-IQ4"
+    ];
     # Ollama truncates context far below the model's real window unless
     # told otherwise (the OpenAI-compat /v1 route it's reached through has
     # no way to set this per-request). 131072 chosen as the practical

hosts/terra/home.nix

@@ -1,6 +1,53 @@
 { pkgs, unstable, inputs, ... }:
 let
   tome = pkgs.callPackage ../../pkgs/tome.nix { src = inputs.tome; };
+
+  # SUDO_ASKPASS helper: renders sudo's password prompt in the quickshell
+  # shell (HyprChrome/Widgets/Askpass) instead of on the terminal.
+  #
+  # sudo does NOT speak polkit — it is setuid + PAM reading the tty, and no
+  # sudoers option bridges the two — so this is the askpass mechanism, a
+  # separate path that happens to reuse the polkit dialog's look. `run0` is the
+  # polkit-native alternative if you want the agent itself.
+  #
+  # A package rather than a file in dotfiles/quickshell because SUDO_ASKPASS
+  # must point at something EXECUTABLE, and xdg.configFile copies keep their
+  # store mode — which is why open_launcher.sh has to be invoked as
+  # `bash <path>` rather than run directly.
+  #
+  # The secret comes back over a 0600 fifo, never in argv or the environment,
+  # so it is not visible in /proc to anything. Cancelling closes the fifo
+  # without writing: `cat` reads nothing, this exits non-zero, and sudo aborts
+  # instead of burning a retry on an empty password.
+  qs-askpass = pkgs.writeShellApplication {
+    name = "qs-askpass";
+    runtimeInputs = [ pkgs.quickshell pkgs.coreutils ];
+    text = ''
+      runtime="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+      fifo="$(mktemp -u "$runtime/qs-askpass.XXXXXXXX")"
+      mkfifo -m 600 "$fifo"
+      trap 'rm -f "$fifo"' EXIT
+
+      # Returns immediately; the dialog is asynchronous and we block on the
+      # fifo, not on the IPC call.
+      if ! qs ipc call askpass prompt "''${1:-Password:}" "$fifo" >/dev/null 2>&1; then
+        echo "qs-askpass: quickshell is not running or has no askpass handler" >&2
+        exit 1
+      fi
+
+      # Bounded, so a prompt nobody answers fails instead of wedging sudo for
+      # good. On timeout take the dialog down too, or it would sit there with
+      # nothing listening.
+      if ! secret="$(timeout 120 cat "$fifo")"; then
+        qs ipc call askpass cancel >/dev/null 2>&1 || true
+        echo "qs-askpass: timed out waiting for the prompt" >&2
+        exit 1
+      fi
+
+      [ -n "$secret" ] || exit 1
+      printf '%s\n' "$secret"
+    '';
+  };
 in
 {
   # home.stateVersion, programs.home-manager.enable, programs.zsh.enable all
@@ -34,6 +81,12 @@ in
   # it instead of the root /var/run/docker.sock.
   home.sessionVariables.DOCKER_HOST = "unix:///run/user/1000/podman/podman.sock";
 
+  # Only sets WHICH helper sudo uses; it still only calls it when asked with
+  # `sudo -A` (or when there is no tty at all). Plain `sudo` keeps prompting on
+  # the terminal, deliberately: aliasing it wholesale would break every sudo in
+  # a TTY or over ssh, where there is no shell to draw the dialog.
+  home.sessionVariables.SUDO_ASKPASS = "${qs-askpass}/bin/qs-askpass";
+
   xdg.userDirs = {
     enable = true;
   };
@@ -46,13 +99,14 @@ in
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     unstable.claude-code
+    unstable.codex
     pkgs.opencode
     pkgs.quickshell
+    qs-askpass
     pkgs.github-cli
     pkgs.tea
     pkgs.docker-compose
     pkgs.hyprcursor
-    pkgs.bibata-cursors
     pkgs.papirus-icon-theme
   ];
 

hosts/terra/home/hyprland.nix

@@ -31,12 +31,19 @@
 let
   lua = lib.generators.mkLuaInline;
 
+  # Cursor theme+size live in home.pointerCursor (theme.nix) so the name is
+  # in one place; hyprland.lua is what actually gets them into the graphical
+  # session's environment (hm-session-vars.sh is only sourced by login shells).
+  cursorName = config.home.pointerCursor.name;
+  cursorSize = toString config.home.pointerCursor.size;
+
   # Wallpaper images aren't checked into this repo (binary blobs) — pulled
   # from the existing Wallhaven library on /mnt/hdd_01 instead. Picked once
   # here rather than at runtime, since hyprpaper has no built-in "random"
   # mode; re-pick and rebuild (or swap in real per-monitor selection) when
   # this stops being a placeholder.
-  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png";
+  # wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png";
+  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-mlwz78.png";
 
   # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland
   # 0.55's src/config/lua/bindings/LuaBindingsDispatchers.cpp).
@@ -94,7 +101,7 @@ in
     settings = {
       # ---- colours (from colors.conf) ----
       fg_color  = { _var = "rgba(eeeeeeff)"; };
-      fg_accent = { _var = "rgba(ffd063ff)"; };
+      fg_accent = { _var = "rgba(e8722aff)"; };
       fg_accent_alt = { _var = "rgba(ff9d42ff)"; };
       bg_color  = { _var = "rgba(0f1012ff)"; };
       bg_accent = { _var = "rgba(963c38ff)"; };
@@ -117,7 +124,7 @@ in
         debug.disable_logs = false;
 
         general = {
-          border_size = 0;
+          border_size = 2;
           col = {
             inactive_border = lua "bg_accent";
             active_border = {
@@ -182,10 +189,10 @@ in
 
       # ---- environment (environment.conf) ----
       env = [
-        { _args = [ "HYPRCURSOR_THEME" "Bibata-Modern-Classic" ]; }
-        { _args = [ "HYPRCURSOR_SIZE" "24" ]; }
-        { _args = [ "XCURSOR_THEME" "Bibata-Modern-Classic" ]; }
-        { _args = [ "XCURSOR_SIZE" "24" ]; }
+        { _args = [ "HYPRCURSOR_THEME" cursorName ]; }
+        { _args = [ "HYPRCURSOR_SIZE" cursorSize ]; }
+        { _args = [ "XCURSOR_THEME" cursorName ]; }
+        { _args = [ "XCURSOR_SIZE" cursorSize ]; }
         { _args = [ "GDK_BACKEND" "wayland,x11" ]; }
         { _args = [ "SDL_VIDEODRIVER" "wayland" ]; }
         { _args = [ "CLUTTER_BACKEND" "wayland" ]; }

hosts/terra/home/theme.nix

@@ -23,6 +23,22 @@ in
     };
   };
 
+  # The cursor theme. XCURSOR_THEME alone is not enough for Steam: the client
+  # UI (steamwebhelper) runs inside a pressure-vessel container that rebuilds
+  # /etc, so the /etc/profiles/per-user/darman/share/icons entry of
+  # XCURSOR_PATH does not exist in there and libXcursor finds no theme by
+  # that name — it falls back to the built-in core X11 cursor. $HOME and
+  # /nix are bind-mounted into the container, so the ~/.icons symlink that
+  # `dotIcons` (on by default) drops does resolve. Same class of problem as
+  # the ~/.themes/~/.icons flatpak workaround above.
+  home.pointerCursor = {
+    name = "Bibata-Modern-Classic";
+    package = pkgs.bibata-cursors;
+    size = 24;
+    gtk.enable = true;
+    hyprcursor.enable = true;
+  };
+
   # Flatpak apps are sandboxed and can't see XDG_DATA_DIRS/nix-store theme
   # paths, so the portal-reported GTK theme / icon theme names resolve to
   # nothing inside the sandbox and they fall back to Adwaita. Flatpak