terra: cosmic portals, jupiter smb mount, tea CLI, launcher/theme polish

- swap gtk portal/apps for cosmic (xdg-desktop-portal-cosmic, cosmic-files,
  cosmic-settings) and drop dolphin/protonplus/bambu-studio (bambu-studio
  moved to flatpak alongside the other comms/gaming flatpaks)
- mount jupiter's samba share at /mnt/jupiter (automount, credentials from
  the same samba_password secret jupiter itself uses)
- add tea (gitea's remote API CLI) for talking to git.mgaction.town from
  terra without SSHing into jupiter
- new dark icon themes (Amy, Azure Glassy, Slot Beauty) vendored from
  gnome-look.org tarballs, packaged since pling download links expire
- rishot: fix Qt5Compat.GraphicalEffects QML import (was missing qt6.qt5compat
  on QML_IMPORT_PATH, so quickshell failed at config-load)
- launcher widgets: stop LauncherConsole/LauncherDock from reserving
  compositor space (ExclusionMode.Ignore, they're overlays not real docks);
  bump LauncherCorner app icon size 28->34
- comms script: launch telegram/discord via flatpak, not native binaries
- nix-ld + boot.binfmt aarch64 emulation (for building/flashing mercury
  from terra)

hosts/terra/configuration.nix

@@ -1,10 +1,6 @@
+# ---- TERRA ----
 { config, pkgs, lib, inputs, ... }:
 
-# terra — Ryzen 9 5900X / Radeon RX 6800 XT desktop (MSI MS-7A32). Replaces
-# CachyOS on the OS SSD (Kingston SA400, sdb). Dev-data disks (sdc ext4
-# /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) are kept out of disko and mounted here
-# as plain filesystems so they're never wiped. The leftover ntfs disks
-# (sda, sdf, nvme0n1) are ignored entirely — not referenced anywhere.
 let
   unstable = import inputs.nixpkgs-unstable {
     inherit (pkgs.stdenv.hostPlatform) system;
@@ -14,9 +10,9 @@ in
 {
   imports = [
     ./hardware-configuration.nix
-    ./disk-config.nix          # disko: OS-disk (sdb) partitions + filesystems
-    ./secrets.nix               # sops-nix: darman password, tailscale key
-    ../../common.nix               # shared base: user / ssh / nix / firewall
+    ./disk-config.nix
+    ./secrets.nix
+    ../../common.nix
     ../../services/vpn/tailscale.nix
     ../../services/desktop/desktop-hyprland.nix
     ../../services/desktop/desktop-apps.nix
@@ -28,21 +24,27 @@ in
     enable = true;
     remotes = [{ name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo"; }];
     packages = [
+      { appId = "com.github.tchx84.Flatseal"; origin = "flathub"; }
       { appId = "com.blitzfc.qbz";        origin = "flathub"; }
       { appId = "com.discordapp.Discord";  origin = "flathub"; }
       { appId = "org.telegram.desktop";   origin = "flathub"; }
+      { appId = "com.bambulab.BambuStudio"; origin = "flathub"; }
     ];
   };
 
-  # Proton Pass CLI — in nixpkgs-unstable (2.2.3+); scripts/deploy uses it to
-  # autofill sudo/ssh passwords from the "HomeLab" vault.
   environment.systemPackages = [ unstable.proton-pass-cli ];
 
+  # ---- nix-ld: lets generic dynamically-linked Linux binaries run as-is —
+  # needed for editor extensions (Zed/VSCode LSPs, debuggers, etc.) that
+  # download prebuilt binaries not built for NixOS. See
+  # https://nix.dev/permalink/stub-ld ----
+  programs.nix-ld.enable = true;
+
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;
   home-manager.backupFileExtension = "hm-bak";
-  home-manager.extraSpecialArgs = { inherit unstable; };
+  home-manager.extraSpecialArgs = { inherit unstable inputs; };
   home-manager.users.darman = import ./home.nix;
 
   # ---- Boot (UEFI) ----
@@ -50,20 +52,17 @@ in
   boot.loader.efi.canTouchEfiVariables = true;
   hardware.cpu.amd.updateMicrocode = true;
 
+  # mercury (aarch64) is built/flashed from here. Without this, `nix build`
+  # for it dies with "platform mismatch" — no qemu binfmt handler registered
+  # and aarch64-linux missing from nix.settings.extra-platforms. This module
+  # sets up both (see CLAUDE.md's aarch64 gotcha).
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
   # ---- GPU (Radeon RX 6800 XT / Navi 21) ----
-  # amdgpu needs the redistributable navi21 firmware blobs to bind the card.
-  # Without them the module loads but never initialises the GPU: there's no
-  # DRM card for it, the display falls back to the 1024x768 EFI
-  # simple-framebuffer as "Unknown-1", and the real DP-2/HDMI-A-1 outputs
-  # never appear — so hyprland's monitor rules match nothing.
   hardware.enableRedistributableFirmware = true;
-  # Early KMS: bind amdgpu in the initrd so it drives the console + greeter
-  # from boot instead of handing over from simple-framebuffer later.
   boot.initrd.kernelModules = [ "amdgpu" ];
 
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
-  # UUIDs captured from the running CachyOS box; verify after install
-  # (`lsblk -o NAME,UUID,MOUNTPOINT`) in case disko/kernel enumerates differently.
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";
     fsType = "ext4";
@@ -75,5 +74,22 @@ in
     options = [ "nofail" ];
   };
 
+  # jupiter's samba share (services/network/samba.nix) — mounted on demand so
+  # terra doesn't stall boot/login when jupiter is off or unreachable.
+  fileSystems."/mnt/jupiter" = {
+    device = "//jupiter/data";
+    fsType = "cifs";
+    options = [
+      "credentials=${config.sops.templates."jupiter-smb.credentials".path}"
+      "uid=1000"
+      "gid=100"
+      "nofail"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=60"
+      "x-systemd.mount-timeout=10s"
+      "_netdev"
+    ];
+  };
+
   system.stateVersion = "26.05";
 }

hosts/terra/home.nix

@@ -1,83 +1,56 @@
 { pkgs, unstable, ... }:
 
-# home-manager profile for darman on terra. The Hyprland config lives in its
-# own module (./hyprland.nix); this handles the rest of the user session
-# (theming, terminal, packages).
 {
-  imports = [ ./home/hyprland.nix ];
+  imports = [ ./home/hyprland.nix ./home/theme.nix ];
 
   home.stateVersion = "26.05";
   home.keyboard.layout = "de";
 
-  programs.git.enable = true;
-  programs.home-manager.enable = true;
-
-  # Give darman a managed ~/.zshrc. Without any zsh dotfile, zsh runs its
-  # first-run `zsh-newuser-install` prompt on every new terminal. oh-my-zsh +
-  # powerlevel10k still come from the system /etc/zshrc (common.nix), which
-  # always loads for interactive shells before this ~/.zshrc.
-  programs.zsh.enable = true;
-
-  # ---- Dracula theming (GTK + Qt) ----
-  gtk = {
+  programs.git = {
     enable = true;
-    theme = {
-      name = "Dracula";
-      package = pkgs.dracula-theme;
+    settings = {
+      user.name = "Erik Simon";
+      user.email = "mail@erik-s.dev";
     };
   };
+  programs.home-manager.enable = true;
 
-  # GTK4 / libadwaita apps ignore gtk-theme-name; they only read the dconf
-  # color-scheme key via the portal. Writing it here persists it across reboots
-  # (the gsettings call in the Hyprland autostart only lasts the session).
-  dconf.settings."org/gnome/desktop/interface" = {
-    color-scheme = "prefer-dark";
-    gtk-theme = "Dracula";
-  };
+  programs.zsh.enable = true;
 
-  # dracula-qt5-theme ships only a qt5ct color scheme (no style plugin), so
-  # Qt has to go through qt(5|6)ct rather than a direct style/platformTheme
-  # name. "qtct" pulls in both qt5ct and qt6ct; qt6ct reads its own config
-  # but understands the same scheme file format, so both point at it.
-  qt = {
+  xdg.userDirs = {
     enable = true;
-    platformTheme.name = "qtct";
   };
-  xdg.configFile."qt5ct/qt5ct.conf".text = ''
-    [Appearance]
-    color_scheme_path=${pkgs.dracula-qt5-theme}/share/qt5ct/colors/Dracula.conf
-    custom_palette=true
-    style=Fusion
-  '';
-  xdg.configFile."qt6ct/qt6ct.conf".text = ''
-    [Appearance]
-    color_scheme_path=${pkgs.dracula-qt5-theme}/share/qt5ct/colors/Dracula.conf
-    custom_palette=true
-    style=Fusion
-  '';
 
-  # Custom mime-info defs (sln/slnx). xdg.mime's update-mime-database only
-  # indexes share/mime/packages inside the hm profile itself, so this has to
-  # be a package in home.packages, not a plain xdg.dataFile.
   xdg.mime.enable = true;
   xdg.configFile."quickshell".source = ../../dotfiles/quickshell;
   xdg.configFile."scripts".source = ../../dotfiles/scripts;
+
   home.packages = [
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     unstable.claude-code
-    pkgs.quickshell
     pkgs.opencode
+    pkgs.quickshell
+    pkgs.github-cli
+    pkgs.tea
     pkgs.hyprcursor
     pkgs.bibata-cursors
+    pkgs.papirus-icon-theme
   ];
 
+  xdg.desktopEntries.btop = {
+    name = "btop++";
+    genericName = "System Monitor";
+    exec = "btop";
+    icon = "btop";
+    terminal = true;
+    categories = [ "System" "Monitor" ];
+    noDisplay = true;
+  };
+
   programs.alacritty = {
     enable = true;
     settings = {
-      # NixOS has no /bin/zsh (only /bin/sh); point at the real store path or
-      # alacritty exits instantly trying to exec a missing shell — which looked
-      # like "the SUPER+Return keybind doesn't work".
       env.SHELL = "${pkgs.zsh}/bin/zsh";
       terminal.shell = {
         program = "${pkgs.zsh}/bin/zsh";
@@ -92,7 +65,7 @@
         style = "Regular";
       };
       colors.primary = {
-        background = "#222831";
+        background = "#0F1012";
         foreground = "#ffd369";
       };
  #     hints.enabled = [

hosts/terra/home/hyprland.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, config, inputs, ... }:
 
 # Hyprland config migrated from github.com/darman96/hyprland-dotfiles (the
 # hyprlang `hypr/*.conf` files) into the home-manager lua-style `settings`
@@ -12,10 +12,12 @@
 # own hyprland.lua.
 #
 # Deliberately NOT migrated:
-#   - hyprbars.conf / hyprredsquare.conf: config for the third-party plugins
-#     `hyprbevelbars` + `hyprredsquare`, which aren't packaged in nixpkgs. Load
-#     the plugins via `wayland.windowManager.hyprland.plugins` and re-add their
-#     config once they're available.
+#   - hyprbars.conf: config for the third-party `hyprbevelbars` plugin, which
+#     isn't packaged in nixpkgs. Load it via
+#     `wayland.windowManager.hyprland.plugins` and re-add its config once
+#     available. (hyprredsquare.conf's plugin was renamed hypr-chrome and
+#     rewritten since - it's wired in below via the `hypr-chrome` flake
+#     input instead, with its own `plugin.hyprchrome` config.)
 #   - hyprqt6engine.conf + `QT_QPA_PLATFORMTHEME=hyprqt6engine`: terra themes Qt
 #     through qtct/Dracula in home.nix, so that env var is left off to avoid a conflict.
 #   - hyprlock.conf: a separate program (use `programs.hyprlock` if wanted).
@@ -29,28 +31,35 @@
 let
   lua = lib.generators.mkLuaInline;
 
+  # Wallpaper images aren't checked into this repo (binary blobs) — pulled
+  # from the existing Wallhaven library on /mnt/hdd_01 instead. Picked once
+  # here rather than at runtime, since hyprpaper has no built-in "random"
+  # mode; re-pick and rebuild (or swap in real per-monitor selection) when
+  # this stops being a placeholder.
+  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-g7jg63.png";
+
   # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland
   # 0.55's src/config/lua/bindings/LuaBindingsDispatchers.cpp).
   dsp = {
-    exec           = cmd: lua ''hl.dsp.exec_cmd("${cmd}")'';
-    global         = name: lua ''hl.dsp.global("${name}")'';
-    exit           = lua "hl.dsp.exit()";
-    killactive     = lua "hl.dsp.window.close()";
-    togglefloating = lua ''hl.dsp.window.float({ action = "toggle" })'';
-    fullscreen     = lua "hl.dsp.window.fullscreen()";                    # mode 0
-    maximize       = lua ''hl.dsp.window.fullscreen({ mode = "maximized" })''; # mode 1
+    exec              = cmd: lua ''hl.dsp.exec_cmd("${cmd}")'';
+    global            = name: lua ''hl.dsp.global("${name}")'';
+    exit              = lua "hl.dsp.exit()";
+    killactive        = lua "hl.dsp.window.close()";
+    togglefloating    = lua ''hl.dsp.window.float({ action = "toggle" })'';
+    fullscreen        = lua "hl.dsp.window.fullscreen()";                    # mode 0
+    maximize          = lua ''hl.dsp.window.fullscreen({ mode = "maximized" })''; # mode 1
     togglegroup       = lua "hl.dsp.group.toggle()";
     changegroupactive = lua "hl.dsp.group.next()";
-    drag        = lua "hl.dsp.window.drag()";
-    resizemouse = lua "hl.dsp.window.resize()";
-    movefocus   = dir: lua ''hl.dsp.focus({ direction = "${dir}" })'';
-    movewindow  = dir: lua ''hl.dsp.window.move({ direction = "${dir}" })'';
-    resizeactive = x: y:
+    drag              = lua "hl.dsp.window.drag()";
+    resizemouse       = lua "hl.dsp.window.resize()";
+    movefocus         = dir: lua ''hl.dsp.focus({ direction = "${dir}" })'';
+    movewindow        = dir: lua ''hl.dsp.window.move({ direction = "${dir}" })'';
+    resizeactive      = x: y:
       lua ''hl.dsp.window.resize({ x = ${toString x}, y = ${toString y}, relative = true })'';
-    workspace       = n: lua ''hl.dsp.focus({ workspace = ${toString n} })'';
-    workspaceRef    = s: lua ''hl.dsp.focus({ workspace = "${s}" })'';
-    movetoworkspace = n: lua ''hl.dsp.window.move({ workspace = ${toString n} })'';
-    togglespecial   = name: lua ''hl.dsp.workspace.toggle_special("${name}")'';
+    workspace         = n: lua ''hl.dsp.focus({ workspace = ${toString n} })'';
+    workspaceRef      = s: lua ''hl.dsp.focus({ workspace = "${s}" })'';
+    movetoworkspace   = n: lua ''hl.dsp.window.move({ workspace = ${toString n} })'';
+    togglespecial     = name: lua ''hl.dsp.workspace.toggle_special("${name}")'';
   };
 
   bind  = keys: dispatcher: { _args = [ keys dispatcher ]; };
@@ -65,14 +74,28 @@ let
   ];
 in
 {
+  services.hyprpaper = {
+    enable = true;
+    settings = {
+      ipc = "on";
+      splash = false;
+      preload = [ wallpaper ];
+      wallpaper = [
+        { monitor = "DP-2";     path = wallpaper; }
+        { monitor = "HDMI-A-1"; path = wallpaper; }
+      ];
+    };
+  };
+
   wayland.windowManager.hyprland = {
     enable = true;
+    plugins = [ inputs.hypr-chrome.packages.${pkgs.stdenv.hostPlatform.system}.default ];
     settings = {
       # ---- colours (from colors.conf) ----
       fg_color  = { _var = "rgba(eeeeeeff)"; };
       fg_accent = { _var = "rgba(FFD063ff)"; };
       bg_color  = { _var = "rgba(0F1012ff)"; };
-      bg_accent = { _var = "rgba(292C30ff)"; };
+      bg_accent = { _var = "rgba(40382fff)"; };
 
       # ---- monitors ----
       monitor = [
@@ -95,7 +118,15 @@ in
           border_size = 1;
           col = {
             inactive_border = lua "bg_accent";
-            active_border   = lua "fg_accent";
+            # Gradient: hyprland's lua gradient type (CLuaConfigGradient::parse)
+            # takes either a plain colour string or a table with a `colors`
+            # array (1+ entries) and an optional `angle` in DEGREES. The list
+            # entries may be literal "rgba(...)" strings or, as here, the
+            # `_var` locals declared above rendered raw via mkLuaInline.
+            active_border = {
+              colors = [ (lua "fg_accent") (lua "bg_accent") ];
+              angle = 45;
+            };
           };
           layout = "dwindle";
           gaps_in = 4;
@@ -130,6 +161,8 @@ in
           workspace_back_and_forth = true;
           allow_workspace_cycles = true;
         };
+
+        plugin.hyprchrome.enabled = true;
       };
 
       # ---- animations ----
@@ -150,6 +183,7 @@ in
         { _args = [ "XDG_CURRENT_DESKTOP" "Hyprland" ]; }
         { _args = [ "XDG_SESSION_DESKTOP" "Hyprland" ]; }
         { _args = [ "XDG_SESSION_TYPE" "wayland" ]; }
+        { _args = [ "QT_QPA_PLATFORMTHEME" "qt6ct" ]; }
       ];
 
       # ---- keybinds (keybinds.conf) ----
@@ -167,10 +201,11 @@ in
         (bind "SUPER + CTRL + S" (dsp.global "quickshell:sidebar"))
 
         (bind "SUPER + B" (dsp.exec "vivaldi"))
-        (bind "SUPER + E" (dsp.exec "dolphin"))
+        (bind "SUPER + E" (dsp.exec "cosmic-files"))
         (bind "SUPER + SHIFT + G" (dsp.workspaceRef "game"))
         (bind "SUPER + S" (dsp.exec "grim -o DP-2 ~/screenshot.png"))
         (bind "SUPER + SHIFT + S" (dsp.exec "grimblast copy area --freeze"))
+        (bind "Print" (dsp.exec "rishot"))
         (bind "SUPER + L" (dsp.exec "hyprlock"))
         (bind "SUPER + W" (dsp.exec "waypaper --random"))
 
@@ -245,7 +280,7 @@ in
       workspace_rule = [
         { workspace = "name:game"; monitor = "DP-2"; decorate = false; }
         { workspace = "special:terminal"; on_created_empty = "alacritty"; gaps_out = 256; }
-        { workspace = "special:communications"; on_created_empty = "$HOME/.config/scripts/start-communications.sh"; gaps_out = 128; }
+        { workspace = "special:communications"; on_created_empty = "${config.home.homeDirectory}/.config/scripts/start-communications.sh"; gaps_out = 128; }
         { workspace = "special:music"; on_created_empty = "com.blitzfc.qbz"; gaps_out = 128; }
         { workspace = "special:version_control"; on_created_empty = "com.axosoft.GitKraken"; gaps_out = 128; }
       ];
@@ -257,7 +292,7 @@ in
           (lua ''
             function()
               hl.exec_cmd("systemctl --user start hyprpolkitagent")
-              hl.exec_cmd("vicinae server")
+              hl.exec_cmd("cosmic-settings-daemon")
               hl.exec_cmd("quickshell")
               hl.exec_cmd("alacritty", { workspace = "special:terminal silent" })
               hl.exec_cmd("kbuildsycoca6 --noincremental")
@@ -266,4 +301,6 @@ in
       };
     };
   };
+
+  xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-cosmic ];
 }

hosts/terra/home/theme.nix

@@ -0,0 +1,70 @@
+{ pkgs, ... }:
+
+# Global Dracula theming (GTK + Qt)
+let
+  azureGlassyDarkIcons = pkgs.callPackage ../../../pkgs/azure-glassy-dark-icons.nix { };
+  amyDarkIcons = pkgs.callPackage ../../../pkgs/amy-dark-icons.nix { };
+  slotBeautyDarkIcons = pkgs.callPackage ../../../pkgs/slot-beauty-dark-icons.nix { };
+
+  iconTheme = "Amy-Dark-Icons";
+  iconThemePackage = amyDarkIcons;
+  iconThemeFolder = "${iconThemePackage}/share/icons/${iconTheme}";
+in
+{
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Dracula";
+      package = pkgs.dracula-theme;
+    };
+    iconTheme = {
+      name = iconTheme;
+      package = iconThemePackage;
+    };
+  };
+
+  # Flatpak apps are sandboxed and can't see XDG_DATA_DIRS/nix-store theme
+  # paths, so the portal-reported GTK theme / icon theme names resolve to
+  # nothing inside the sandbox and they fall back to Adwaita. Flatpak
+  # auto-exposes ~/.themes and ~/.icons read-only to every sandboxed app
+  # specifically for this case.
+  home.file.".themes/Dracula".source =
+    "${pkgs.dracula-theme}/share/themes/Dracula";
+  home.file.".icons/${iconTheme}".source = iconThemeFolder;
+
+  dconf.settings."org/gnome/desktop/interface" = {
+    color-scheme = "prefer-dark";
+    gtk-theme = "Dracula";
+    icon-theme = iconTheme;
+  };
+
+  # "qtct" (qt5ct/qt6ct) instead of "kde" avoids pulling in
+  # kdePackages.systemsettings just for the platform-theme plugin — kvantum
+  # itself carries the Dracula colors, qt5ct/qt6ct just need to be told to
+  # use it as the style.
+  qt = {
+    enable = true;
+    platformTheme.name = "qtct";
+    style.name = "kvantum";
+  };
+  xdg.configFile."Kvantum/kvantum.kvconfig".text = ''
+    [General]
+    theme=Dracula
+  '';
+  xdg.configFile."Kvantum/Dracula".source =
+    "${pkgs.dracula-theme}/share/Kvantum/Dracula";
+
+  # Quickshell's IconImage/Quickshell.iconPath() resolves icons through the
+  # Qt platform theme, not GTK — so the app-launcher grid needs the icon
+  # theme set HERE (qt5ct/qt6ct), separately from the GTK dconf key above.
+  xdg.configFile."qt5ct/qt5ct.conf".text = ''
+    [Appearance]
+    style=kvantum
+    icon_theme=${iconTheme}
+  '';
+  xdg.configFile."qt6ct/qt6ct.conf".text = ''
+    [Appearance]
+    style=kvantum
+    icon_theme=${iconTheme}
+  '';
+}

hosts/terra/secrets.nix

@@ -12,4 +12,13 @@
 
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+
+  # Credentials file for the //jupiter/data cifs mount (see configuration.nix).
+  # samba_password mirrors jupiter's own samba_password secret (services/network/samba.nix) —
+  # same value, just also encrypted to terra so it can authenticate as the same smb user.
+  sops.secrets.samba_password = { };
+  sops.templates."jupiter-smb.credentials".content = ''
+    username=darman
+    password=${config.sops.placeholder.samba_password}
+  '';
 }