WIP

hosts/terra/configuration.nix

@@ -43,6 +43,51 @@ in
   # https://nix.dev/permalink/stub-ld ----
   programs.nix-ld.enable = true;
 
+  # The default set above is deliberately minimal and carries no X11,
+  # freetype, wayland or xkbcommon, so a prebuilt *graphical* binary dies
+  # before it draws anything. JetBrains IDEs installed through Toolbox are the
+  # case that surfaced this: their bundled JBR aborts with `libX11.so.6:
+  # cannot open shared object file` unless the Toolbox GUI — itself an FHS
+  # wrapper — is what launches them, which makes them unusable from a terminal
+  # or from a per-repo devShell. These are the libraries `ldd` reports missing
+  # across a JBR's own .so files, plus the three it resolves by dlopen rather
+  # than DT_NEEDED: fontconfig for font discovery, libGL, and libsecret for
+  # the credential store. Definitions merge, so this adds to the module's base
+  # list rather than replacing it (zlib is already there).
+  programs.nix-ld.libraries = with pkgs; [
+    freetype
+    fontconfig
+    libGL
+    libxkbcommon
+    wayland
+    libsecret
+    libx11
+    libxext
+    libxi
+    libxrender
+    libxtst
+    libxcursor
+    libxrandr
+    libxinerama
+    libxcb
+
+    # CLion Nova's C++ backend (the clion-radler plugin) is a .NET 10
+    # application bundling its own runtime, and .NET refuses to start
+    # without ICU: libSystem.Globalization.Native.so dlopens libicuuc.so
+    # and libicui18n.so, and failing that the IDE reports "Couldn't find a
+    # valid ICU package installed on the system" and comes up degraded.
+    icu
+  ];
+
+  # ---- envfs: serves /bin and /usr/bin from the calling process's PATH ----
+  # NixOS ships only /bin/sh, but plenty of third-party tooling writes scripts
+  # with a hardcoded interpreter. JetBrains Toolbox is the standing example:
+  # it generates ~/.local/share/JetBrains/Toolbox/scripts/{clion,rider,...}
+  # with `#!/bin/bash`, so every one of those shims fails with `bad
+  # interpreter` in any shell. envfs resolves such shebangs against PATH,
+  # which fixes them all at once instead of per-IDE wrappers.
+  services.envfs.enable = true;
+
   # ---- home-manager (user-level config for darman) ----
   # Base settings (useGlobalPkgs/useUserPackages/backupFileExtension) and the
   # shared zsh baseline now live in common.nix + home/common.nix, applied to
@@ -96,7 +141,15 @@ in
     # in VRAM alone, so ollama offloads the inactive experts to CPU RAM.
     # Sparse activation makes that far less painful than it'd be for a dense
     # model this size, but still expect it to run slower than the two above.
-    loadModels = [ "gemma4:12b" "qwen3.6:35b-a3b" ];
+    # VladimirGav/qwen3.8-27B-14GB-IQ4: dense 27B at IQ4, ~14GB of weights —
+    # nominally fits the 6800 XT's 16G, but that leaves only ~2G for the KV
+    # cache and the compositor, so expect partial CPU offload as context grows
+    # (OLLAMA_CONTEXT_LENGTH below applies to every model on this server).
+    loadModels = [
+      "gemma4:12b"
+      "qwen3.6:35b-a3b"
+      "VladimirGav/qwen3.8-27B-14GB-IQ4"
+    ];
     # Ollama truncates context far below the model's real window unless
     # told otherwise (the OpenAI-compat /v1 route it's reached through has
     # no way to set this per-request). 131072 chosen as the practical

hosts/terra/home.nix

@@ -1,6 +1,53 @@
 { pkgs, unstable, inputs, ... }:
 let
   tome = pkgs.callPackage ../../pkgs/tome.nix { src = inputs.tome; };
+
+  # SUDO_ASKPASS helper: renders sudo's password prompt in the quickshell
+  # shell (HyprChrome/Widgets/Askpass) instead of on the terminal.
+  #
+  # sudo does NOT speak polkit — it is setuid + PAM reading the tty, and no
+  # sudoers option bridges the two — so this is the askpass mechanism, a
+  # separate path that happens to reuse the polkit dialog's look. `run0` is the
+  # polkit-native alternative if you want the agent itself.
+  #
+  # A package rather than a file in dotfiles/quickshell because SUDO_ASKPASS
+  # must point at something EXECUTABLE, and xdg.configFile copies keep their
+  # store mode — which is why open_launcher.sh has to be invoked as
+  # `bash <path>` rather than run directly.
+  #
+  # The secret comes back over a 0600 fifo, never in argv or the environment,
+  # so it is not visible in /proc to anything. Cancelling closes the fifo
+  # without writing: `cat` reads nothing, this exits non-zero, and sudo aborts
+  # instead of burning a retry on an empty password.
+  qs-askpass = pkgs.writeShellApplication {
+    name = "qs-askpass";
+    runtimeInputs = [ pkgs.quickshell pkgs.coreutils ];
+    text = ''
+      runtime="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+      fifo="$(mktemp -u "$runtime/qs-askpass.XXXXXXXX")"
+      mkfifo -m 600 "$fifo"
+      trap 'rm -f "$fifo"' EXIT
+
+      # Returns immediately; the dialog is asynchronous and we block on the
+      # fifo, not on the IPC call.
+      if ! qs ipc call askpass prompt "''${1:-Password:}" "$fifo" >/dev/null 2>&1; then
+        echo "qs-askpass: quickshell is not running or has no askpass handler" >&2
+        exit 1
+      fi
+
+      # Bounded, so a prompt nobody answers fails instead of wedging sudo for
+      # good. On timeout take the dialog down too, or it would sit there with
+      # nothing listening.
+      if ! secret="$(timeout 120 cat "$fifo")"; then
+        qs ipc call askpass cancel >/dev/null 2>&1 || true
+        echo "qs-askpass: timed out waiting for the prompt" >&2
+        exit 1
+      fi
+
+      [ -n "$secret" ] || exit 1
+      printf '%s\n' "$secret"
+    '';
+  };
 in
 {
   # home.stateVersion, programs.home-manager.enable, programs.zsh.enable all
@@ -34,6 +81,12 @@ in
   # it instead of the root /var/run/docker.sock.
   home.sessionVariables.DOCKER_HOST = "unix:///run/user/1000/podman/podman.sock";
 
+  # Only sets WHICH helper sudo uses; it still only calls it when asked with
+  # `sudo -A` (or when there is no tty at all). Plain `sudo` keeps prompting on
+  # the terminal, deliberately: aliasing it wholesale would break every sudo in
+  # a TTY or over ssh, where there is no shell to draw the dialog.
+  home.sessionVariables.SUDO_ASKPASS = "${qs-askpass}/bin/qs-askpass";
+
   xdg.userDirs = {
     enable = true;
   };
@@ -46,13 +99,14 @@ in
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     unstable.claude-code
+    unstable.codex
     pkgs.opencode
     pkgs.quickshell
+    qs-askpass
     pkgs.github-cli
     pkgs.tea
     pkgs.docker-compose
     pkgs.hyprcursor
-    pkgs.bibata-cursors
     pkgs.papirus-icon-theme
   ];
 

hosts/terra/home/hyprland.nix

@@ -31,12 +31,19 @@
 let
   lua = lib.generators.mkLuaInline;
 
+  # Cursor theme+size live in home.pointerCursor (theme.nix) so the name is
+  # in one place; hyprland.lua is what actually gets them into the graphical
+  # session's environment (hm-session-vars.sh is only sourced by login shells).
+  cursorName = config.home.pointerCursor.name;
+  cursorSize = toString config.home.pointerCursor.size;
+
   # Wallpaper images aren't checked into this repo (binary blobs) — pulled
   # from the existing Wallhaven library on /mnt/hdd_01 instead. Picked once
   # here rather than at runtime, since hyprpaper has no built-in "random"
   # mode; re-pick and rebuild (or swap in real per-monitor selection) when
   # this stops being a placeholder.
-  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png";
+  # wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-ym81rl.png";
+  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-mlwz78.png";
 
   # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland
   # 0.55's src/config/lua/bindings/LuaBindingsDispatchers.cpp).
@@ -94,7 +101,7 @@ in
     settings = {
       # ---- colours (from colors.conf) ----
       fg_color  = { _var = "rgba(eeeeeeff)"; };
-      fg_accent = { _var = "rgba(ffd063ff)"; };
+      fg_accent = { _var = "rgba(e8722aff)"; };
       fg_accent_alt = { _var = "rgba(ff9d42ff)"; };
       bg_color  = { _var = "rgba(0f1012ff)"; };
       bg_accent = { _var = "rgba(963c38ff)"; };
@@ -117,7 +124,7 @@ in
         debug.disable_logs = false;
 
         general = {
-          border_size = 0;
+          border_size = 2;
           col = {
             inactive_border = lua "bg_accent";
             active_border = {
@@ -182,10 +189,10 @@ in
 
       # ---- environment (environment.conf) ----
       env = [
-        { _args = [ "HYPRCURSOR_THEME" "Bibata-Modern-Classic" ]; }
-        { _args = [ "HYPRCURSOR_SIZE" "24" ]; }
-        { _args = [ "XCURSOR_THEME" "Bibata-Modern-Classic" ]; }
-        { _args = [ "XCURSOR_SIZE" "24" ]; }
+        { _args = [ "HYPRCURSOR_THEME" cursorName ]; }
+        { _args = [ "HYPRCURSOR_SIZE" cursorSize ]; }
+        { _args = [ "XCURSOR_THEME" cursorName ]; }
+        { _args = [ "XCURSOR_SIZE" cursorSize ]; }
         { _args = [ "GDK_BACKEND" "wayland,x11" ]; }
         { _args = [ "SDL_VIDEODRIVER" "wayland" ]; }
         { _args = [ "CLUTTER_BACKEND" "wayland" ]; }

hosts/terra/home/theme.nix

@@ -23,6 +23,22 @@ in
     };
   };
 
+  # The cursor theme. XCURSOR_THEME alone is not enough for Steam: the client
+  # UI (steamwebhelper) runs inside a pressure-vessel container that rebuilds
+  # /etc, so the /etc/profiles/per-user/darman/share/icons entry of
+  # XCURSOR_PATH does not exist in there and libXcursor finds no theme by
+  # that name — it falls back to the built-in core X11 cursor. $HOME and
+  # /nix are bind-mounted into the container, so the ~/.icons symlink that
+  # `dotIcons` (on by default) drops does resolve. Same class of problem as
+  # the ~/.themes/~/.icons flatpak workaround above.
+  home.pointerCursor = {
+    name = "Bibata-Modern-Classic";
+    package = pkgs.bibata-cursors;
+    size = 24;
+    gtk.enable = true;
+    hyprcursor.enable = true;
+  };
+
   # Flatpak apps are sandboxed and can't see XDG_DATA_DIRS/nix-store theme
   # paths, so the portal-reported GTK theme / icon theme names resolve to
   # nothing inside the sandbox and they fall back to Adwaita. Flatpak