updated tailscale auth keys

- nix-flatpak input; discord, telegram, qbz as Flathub flatpaks; removes
  qbz and proton-pass-cli flake inputs
- proton-pass-cli and claude-code from nixpkgs-unstable via extraSpecialArgs
- dconf color-scheme = prefer-dark replaces per-session gsettings call

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.lock

@@ -118,24 +118,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -197,6 +179,21 @@
         "type": "github"
       }
     },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1783368811,
+        "narHash": "sha256-0H8jDwR4Kegb3heaTrH1ftbgKfZVDT8JE+46uXxDy/Q=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "20d42f0ee98c9fe9f85e8d1de474f1409ed10d05",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
     "nix-vm-test": {
       "inputs": {
         "nixpkgs": [
@@ -350,42 +347,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1775888245,
-        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "13043924aaa7375ce482ebe2494338e058282925",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "proton-pass-cli": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1783676260,
-        "narHash": "sha256-J7yTLWLkhOOGT/YLyfgC3lEOCRTOXVK3h0UoKzhRels=",
-        "owner": "tomsch",
-        "repo": "proton-pass-cli-nix",
-        "rev": "1cad55698affce949d4cebacae31db448c17d9f1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tomsch",
-        "repo": "proton-pass-cli-nix",
-        "type": "github"
-      }
-    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -486,37 +447,17 @@
         "type": "github"
       }
     },
-    "qbz": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1784877312,
-        "narHash": "sha256-eQ4xvBKnQp4C5lEVukx/75umFFmWyCjbuO82qyFDw14=",
-        "owner": "vicrodh",
-        "repo": "qbz",
-        "rev": "c4cc755fd02d999084883e864c0697139a8b8648",
-        "type": "github"
-      },
-      "original": {
-        "owner": "vicrodh",
-        "repo": "qbz",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "authentik-nix": "authentik-nix",
         "disko": "disko",
         "home-manager": "home-manager",
         "mediamanager-nix": "mediamanager-nix",
+        "nix-flatpak": "nix-flatpak",
         "nixos-anywhere": "nixos-anywhere",
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "proton-pass-cli": "proton-pass-cli",
-        "qbz": "qbz",
         "sops-nix": "sops-nix"
       }
     },
@@ -555,21 +496,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -32,12 +32,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     authentik-nix.url = "github:nix-community/authentik-nix";
-    proton-pass-cli = {
-      url = "github:tomsch/proton-pass-cli-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nix-flatpak.url = "github:gmodena/nix-flatpak";
-    qbz.url = "github:vicrodh/qbz";
     # NOTE: the `tome` input (private repo git+ssh://gitea@git.mgaction.town) was
     # removed temporarily — the credential-less installer-iso can't fetch it, so
     # `install terra localhost` failed at nixos-install (post-disko). Re-add it

hosts/terra/configuration.nix

@@ -5,6 +5,12 @@
 # /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) are kept out of disko and mounted here
 # as plain filesystems so they're never wiped. The leftover ntfs disks
 # (sda, sdf, nvme0n1) are ignored entirely — not referenced anywhere.
+let
+  unstable = import inputs.nixpkgs-unstable {
+    inherit (pkgs.stdenv.hostPlatform) system;
+    config = pkgs.config;
+  };
+in
 {
   imports = [
     ./hardware-configuration.nix
@@ -28,15 +34,15 @@
     ];
   };
 
-  # Proton Pass CLI — not in nixpkgs; ./scripts/deploy uses it to autofill
+  # Proton Pass CLI — in nixpkgs-unstable (2.2.3+); scripts/deploy uses it to
-  # sudo/ssh passwords from the "HomeLab" vault. Packaged by the
+  # autofill sudo/ssh passwords from the "HomeLab" vault.
-  # proton-pass-cli flake input (github:tomsch/proton-pass-cli-nix).
+  environment.systemPackages = [ unstable.proton-pass-cli ];
-  environment.systemPackages = [ inputs.proton-pass-cli.packages.${pkgs.system}.default ];
 
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;
   home-manager.backupFileExtension = "hm-bak";
+  home-manager.extraSpecialArgs = { inherit unstable; };
   home-manager.users.darman = import ./home.nix;
 
   # ---- Boot (UEFI) ----

hosts/terra/home.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, unstable, ... }:
 
 # home-manager profile for darman on terra. The Hyprland config lives in its
 # own module (./hyprland.nix); this handles the rest of the user session
@@ -27,6 +27,14 @@
     };
   };
 
+  # GTK4 / libadwaita apps ignore gtk-theme-name; they only read the dconf
+  # color-scheme key via the portal. Writing it here persists it across reboots
+  # (the gsettings call in the Hyprland autostart only lasts the session).
+  dconf.settings."org/gnome/desktop/interface" = {
+    color-scheme = "prefer-dark";
+    gtk-theme = "Dracula";
+  };
+
   # dracula-qt5-theme ships only a qt5ct color scheme (no style plugin), so
   # Qt has to go through qt(5|6)ct rather than a direct style/platformTheme
   # name. "qtct" pulls in both qt5ct and qt6ct; qt6ct reads its own config
@@ -57,7 +65,7 @@
   home.packages = [
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
-    pkgs.claude-code
+    unstable.claude-code
     pkgs.quickshell
     pkgs.opencode
     pkgs.hyprcursor

hosts/terra/home/hyprland.nix

@@ -257,7 +257,6 @@ in
           (lua ''
             function()
               hl.exec_cmd("systemctl --user start hyprpolkitagent")
-              hl.exec_cmd("gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark'")
               hl.exec_cmd("vicinae server")
               hl.exec_cmd("quickshell")
               hl.exec_cmd("alacritty", { workspace = "special:terminal silent" })

scripts/keys

@@ -31,7 +31,6 @@ die()  { echo "error: $*" >&2; exit 1; }
 need() { command -v "$1" >/dev/null 2>&1 || die "missing required tool: $1"; }
 
 need pass-cli
-need jq
 
 # Resolve an active vault item by title → item ID, or empty string.
 # Active-only filter avoids the trashed-item-shadows-active bug (see deploy).
@@ -101,18 +100,19 @@ store_age_key() {
 # ---------------------------------------------------------------------------
 
 restore_ssh_key() {
-  local config="$1" title="ssh_host#$1" id json
+  local config="$1" title="ssh_host#$1" id private_key public_key
   id="$(resolve_item "$title")"
   if [ -z "$id" ]; then
     echo ">> $title: not in vault — skipping"
     return
   fi
   echo ">> $title: restoring"
-  json="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" --output json)"
+  private_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
-  private_key="$(jq -r '.item.content.content.SshKey.private_key' <<< "$json")"
+    --field private_key --output human 2>/dev/null)"
-  public_key="$(jq  -r '.item.content.content.SshKey.public_key'  <<< "$json")"
+  public_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
-  [ -n "$private_key" ] || die "$title: private_key missing from vault item JSON"
+    --field public_key --output human 2>/dev/null)"
-  [ -n "$public_key"  ] || die "$title: public_key missing from vault item JSON"
+  [ -n "$private_key" ] || die "$title: private_key field missing or empty in vault item"
+  [ -n "$public_key"  ] || die "$title: public_key field missing or empty in vault item"
   mkdir -p "$KEYDIR/$config"
   printf '%s' "$private_key" > "$KEYDIR/$config/ssh_host_ed25519_key"
   chmod 600 "$KEYDIR/$config/ssh_host_ed25519_key"
@@ -130,7 +130,7 @@ restore_age_key() {
   fi
   echo ">> $title: restoring"
   content="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
-    --output json | jq -r '.item.content.note')"
+    --field note --output human 2>/dev/null)"
   [ -n "$content" ] || die "$title: note field is empty in vault item"
   mkdir -p "$(dirname "$dest")"
   printf '%s\n' "$content" > "$dest"

secrets/jupiter.yaml

@@ -1,6 +1,6 @@
 samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str]
 darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:dwBoHIJNcRSLxk1rbMsrEHVoYdxdnvYpPq44utfQ8t4XkXEzto96FEctv/QuPYVGgUxdyPczmc0/97m4AAKjaBVGFXpt/XlnFQI2XgzgSJ0qhNWyfJ1F/g==,iv:1b9nMeeZwr4O8cKjxQ0f+j/yxMUBZpicmdXw7bb9hZk=,tag:FWgrKtKgqailQk+BcZNXhw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:lRoyOId9W0be8HFLjdq9zd5qGfvVTJMAiJrxms7SQNjiRSqCz5btcxYlwBKTE7L13KOvwCd+HX6/7VXxSFYg7RQC8r7wXaPPP9+eJLzZL4x3tt8YTxdx+A==,iv:rLJnoRT/HU3VOrOG5RXnFF2D/Lo9Pq6VqvZ9G6WIvRE=,tag:/iD6Vdn0JJAeEWVJThe/cg==,type:str]
 mediamanager_token_secret: ENC[AES256_GCM,data:g75vj1E6B029O076yV3DS/1z99Tq6wMhEVx+ULYDjHsplyA+vqVRvBlviC64V47IMqKd9k2eTGBJ98Ptv3UIjbr446xZinz0c7PZgHU0XOX4EUcB1ORloMFZIv1zUv8VRjUISUQnn/vRk60e7u8eXrOrgXjxfnoBKrdKZmqxhAM=,iv:2t0XBExC9RvbTomezka+99/LtJl64zNwneA7WWc4ju0=,tag:SVCYuw0n6JevnvoQOIkjPw==,type:str]
 sabnzbd_api_key: ENC[AES256_GCM,data:6UW1u2Ikmnq34t4H4k/4C44SJeFHRlaPjWwUjEfH1GQ=,iv:sGsd8Sd2pfUhTUDg6PlRzfVYejRbF69jmDTIa2fvY4M=,tag:3fOLgU1K1gKHxQ3J1+3oRQ==,type:str]
 prowlarr_api_key: ENC[AES256_GCM,data:ab1QACaagI8ACJXFUy8r9X9lgYwRo1byUmhBPSRWwKk=,iv:EcuF6EN/4mWxlXi6R1qDzv4rOw6AT+OGSNQaaBwjJHg=,tag:hixHrbQWU6QQZNMM5rNDsg==,type:str]
@@ -26,7 +26,7 @@ sops:
             CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-20T23:19:56Z"
+    lastmodified: "2026-07-24T23:31:21Z"
-    mac: ENC[AES256_GCM,data:rxpctVvQPZF5+ylUgg/5UVdI4MfkSf5W2S1aSR1y5Na1juebM0+1kPGkyZxybm/hPl42DjiOmXsJbGS/Kf3np/y3vcYGpooDqxqGciYZDLcijd0M3ErODbfLgxgtGIl5nBS6cGUnabqgXRVTJwmupE7WllcIk6QM20PhnIAHzVU=,iv:I33VvRBp8iv16pRw0PA9+WiIOITPHoziwQC24x/rDh0=,tag:0gMQlEd5CzoAeDlUx99lBg==,type:str]
+    mac: ENC[AES256_GCM,data:u9n7XVFXX7Ujlz2UrHVqFTNl8OyVdmcIkAQM3khEotdfGRqlIU+L9exvhoPHTacQlPWKm8CkmrMbkDyURG/I4plQZATumw2aVawaB5R8NDnuL8+sya64jsISNPkCWYU9kqSHbvFsGuCIkHYvBXannqpkKxTtGaleV6BLbUfykFs=,iv:x1qg+qfeqTie2Dy4xmF/MZ6jBrVEgU7DSXOp6z3/5lc=,tag:O1GVWEtliEGrb+W+FEgfiw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2

secrets/mercury.yaml

@@ -1,6 +1,6 @@
 darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
 pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:Ogm5RTcbJl5lsL19qgTcqXLWK7ypxXrAHNYgriduQQSSRoRWvsnJ3A2Lbynb+r756WxJyFSFqY3WGr9pHaCYo8LAf5oD1MJE26I7JtsAVcHY0QS29b2MnQ==,iv:3H0YMk6llOBapqtMkxsdlY8wQhzIXa+6W4ZrWD0iq2M=,tag:3rPQS7FX8ODLAQK5gOL7lw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:t/GuqomGLOXnGOOw2fNdbzfBMloz3WoJV+WBEvnFmxYpIBLdJwas4aJD6Jpc+SW+gsb1njb4JPxl11UMxuzBbno8DCIZv21DOc1vVbl4VcDI7kvrw3EkEg==,iv:0I/0sR/Uvbhcq2eqGPQEs1jCFhTkJrtQ/Op2Uvj2LPk=,tag:mrWn/yvy8GhvuqrScR7vrQ==,type:str]
 sops:
     age:
         - enc: |
@@ -21,7 +21,7 @@ sops:
             x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
-    lastmodified: "2026-07-20T18:41:59Z"
+    lastmodified: "2026-07-24T23:31:02Z"
-    mac: ENC[AES256_GCM,data:Ay3JLVmJu9S5wlxyL5mrACgLv+jbAsKB5/5r8/z5m4fPjfaYnBQbn1b2s8G764yI0+L3JVWyAdvdy2Gqplrds87lWqlf+gpJKGOoargsiIZAfJmJEzZOYZLPT8YanvGMHniAJszeZ9CnL7Uf9fn0RpT4ObeT7didSqIds6xVeRs=,iv:whZ9L1+tMTkTZaVUdshghIsS9Gmde4RozMDe3XN1ek8=,tag:015mccmr9A/YW+7E+1CsGg==,type:str]
+    mac: ENC[AES256_GCM,data:I3RHwPnGHFXAeRJ4ic2plfhHMz91488KvzN6V15evutEN++affTqJIvI/Hh5Q5LAn8Q8hNkCS9l5Jl/snz+qtlwsSscckcs7jpWSI9cgSYjgEX6DjKpS+95qJo+SabzLdkiY3BlTjzcFZg7CG/lB5MunWgENY/Ad4GGlmUFnMeo=,iv:bWRltxSAd+fiIfQIp+ieqmpob6Fzbrmk1wRJDz3CjSI=,tag:r6BViobJD3MsvLw7Yyj4Rg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2

secrets/neptun.yaml

@@ -2,7 +2,7 @@ darman_password: ENC[AES256_GCM,data:7G2Hgh13TxI6ugw2ebp9UtLTQ7HRC/hrCga0FmZo8h8
 authentik_secret_key: ENC[AES256_GCM,data:qLrAWBywlMqT6D3FYDqE9I/5Ep+zDVu9ns9TA4UVOBSQ1uFGEj01TU9norqPf12pi9/Qs32mVzm5BqDG259DxdGT9DZVQc03QVwiIQYtmWo=,iv:OVCIxIP1Xv+nHmYsrxaPgYWQiwzVPUe8pnbyMBVAuoI=,tag:+ywkwPqkY1Dkx1R5cUJ7PA==,type:str]
 authentik_bootstrap_email: ENC[AES256_GCM,data:OmqpKAiiFyS/rytnHYRZ,iv:VXiPV5VfduC/IW+E3gDlNAeE+hr+IZ9W7Ty6Npuu59Y=,tag:rjvTHnBxN/pMvpQC5W9S6Q==,type:str]
 authentik_bootstrap_password: ENC[AES256_GCM,data:QPCY0ni3jBQY5HyK+vRlyT4YTEo=,iv:41u1Jf+WYksPUY4pvKdHQA1RHW21GAfdVDRuQ7XtdYc=,tag:SYmzv26GbE1kwleXyKLG4Q==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:0Rkz9igafuEwHFDNqCaT6bVgL4pF7uyW4PKqimONMfZy4zrrHBO9SFedyrOjmByZxQjmHsb9VmBiHsrStPVnPmMRqZJG5lyuiWjorHcyoG+NxpAo6Az87Q==,iv:UnSWVQOFc/nEbJs5s4rF+F9XYRY0VVpIxoMp+VqKh/o=,tag:Gv6f+s+zwY2jU7NZUx0rrA==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:1uxBqERZ7U+Fr5vBaGGKajN5KsRzRpdxGBULQ6b5hSgpt2MIC3/Th4zHGNdOl5xYmH2STYv8IOOQrb5p8Xr/55laWQbOLPlfIpCNUbiVWk7uEX9+ctTSiw==,iv:Lm8vx3Oku+isW2WqSNGrkf8aqGoAwVsJQwqH3jOv06Y=,tag:opZeSMyf3bdrLnPM+yES5g==,type:str]
 headplane_cookie_secret: ENC[AES256_GCM,data:oXYRG4z16u6HS7zXoWrV2q/HL2o24n4UwVXnQvqBmbY=,iv:itAiy/w6ue4VzqO5xYnvSYN3uCLLmu52dvAAxZ2pCGc=,tag:MEFP171GpSQpAqUFsWY+VA==,type:str]
 headplane_oidc_client_secret: ENC[AES256_GCM,data:RiEESz1WHYH/smlJKmKFpPoF5HRYp8gHJoKqc49xRRuU9WnQCnmETie/68u37sSVniQmQZSOmXxdmvuuJgP5LMcPdkrQmQE+QX80RQhtTVvg2AhqRaK4V+qfQleD/aJjoIHojeM3UBUi4kYOhDJF0FFTP+qR4oitH6W8/2jxRsc=,iv:hXquOglPhRv+QTVRw5fkY7BWuwLtJxK5tNERGBOOmt8=,tag:2KczveRWoq7iTOdwjO+AUw==,type:str]
 headplane_headscale_api_key: ENC[AES256_GCM,data:KcwcprV100wfAkn+YM4+1oTfXkmyeAMAbXNpQKf2iIq0VxwqVep+fORrKmHiwDViciDoyxdMiT4scGlmd4vQRsWEHdDpkuH7MRHYu0hQepE3rSSQAMbK,iv:NEhmi2hiOE+uSIRZ4uXOK1UGpN+FQx/NpooWzTgwik8=,tag:KcPsD4gp51ERaFwgfA0BrQ==,type:str]
@@ -28,7 +28,7 @@ sops:
             Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
-    lastmodified: "2026-07-20T18:41:45Z"
+    lastmodified: "2026-07-24T23:31:37Z"
-    mac: ENC[AES256_GCM,data:Ie+xvOMKI4ARsYEvKc9iKuCahNQWWmjHQ56NpGsPbYF7XMv2HoOor/Nj7VJNhUD8DnoSq5A67qglfmTSk+KB65yMVSeDYJam5hwUzuo+IB9fHC1sWPNiWCVuG1iKh7ruiTaW/r3uA59+vQ2Ww5fFM/tTIuR1wtYtzVJ+5GKB/fA=,iv:5oYnhxlRfUDaxgR0FXPwE1eBrpqh/1eRWKTG8B+BgmQ=,tag:28Kxp4lp6F/mxTNXCCW8ZQ==,type:str]
+    mac: ENC[AES256_GCM,data:eYiDMFoicUBJbkJ0d5QCwq+YxaslrQDrSCUufzvZ9PkJJ7wWLgq/9ZwMYZfuTR0iWAQCHyhwOEStuLSUT1p51uLS2cSOQtWZfkBOEdUq9HPzzlOMFxyEh052Dw0fkBNswB9oYBdqOfMX8X4z320JlQNUaR/UQ977dkaLaDCMDt8=,iv:kW2D47/VaOPpbITaGnIwpX3Xrv/4JuDfL7QpQFT3OE8=,tag:v6eUKtQ1lfzDmdxQpMWwrw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2

secrets/terra.yaml

@@ -1,4 +1,4 @@
-tailscale_authkey: ENC[AES256_GCM,data:5ZaIjgl4d380JGUC+GjhGUeoAkkrS8ky,iv:oRh/7v/od+Mxj+i3z2ouZ0H2NrUYujEiFR+fEODlaNU=,tag:xUbVxCoYqa1eGx2zvVRAnw==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:DgxbMrKTxC//cWd+ZckCbwZ9j/FgjYwNwadU5cWnnPz+nPEFhXLla2TuUE0pJKpcx9pKZCQmxcGtzQvIB+mbgxjgB0X2CRTp4Yy3WR+PBYMghKx36F8KBg==,iv:hJr6O41OTdMa4wkBXEsRUXgV4zWt21h1kx/CWArLU7o=,tag:IEpMIwKBHakvVYEFdEUe7A==,type:str]
 darman_password: ENC[AES256_GCM,data:G3ZM+NMxvKq5twblcBvyC+MiUX+X7nz+s1GqBHBkJQy1YgW4KN6rpbdj10F9jWxHph5dJ9j9fG6L7UlEg5W5zUYeLFdEx2xJGE1fxksch+6BB9FT6LKkhJ7MmbJmhNHYwJOZO3LM1f/oRw==,iv:abQTRe9kRyYj+TL0rtoxM6JFBaIBmxu7y77qt1h4eME=,tag:OgKrB3SUgSNJjmtJyrmh/Q==,type:str]
 sops:
     age:
@@ -20,7 +20,7 @@ sops:
             sHjKfw8VrrmAR4pQf1dsY+wcyh4FsZxhP3Q+QIVq3eCIXS9PeJkGAg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
-    lastmodified: "2026-07-23T22:39:49Z"
+    lastmodified: "2026-07-24T23:30:39Z"
-    mac: ENC[AES256_GCM,data:7FbZ2XNckByCdmpXmiAjm7nQzf0DOFNSXrrkEw30aAF4A1h//Gv7o/BsszZyT8wRDX456j9g60QfAQnJlewo22Xb63R8OiYPt0nF3I3pWTxSyF66LBrJQbtAnu+c8UGW3d2AWVtNnl/HEIsVCSqCmvBAYR7XzHWW5lXMQUfEM28=,iv:b6ZZY3sCsG64E6h5qj2p72+zfPJv+H+/X7wT05H6ACE=,tag:Z74jzD3Gpxnp0aRhiUdALQ==,type:str]
+    mac: ENC[AES256_GCM,data:JaBDewUFFEiGnigXsUjAaIEiz1FI6N17pMQT/7qBpA6rtrUoatzjEkl2rpENXuSh0cGI2p328u8tvqDkgel7pGFLY+fYuYgOv6tOSbCgeZM939FrT1P3T4evTcyCUDyAS0NFYEvge83zjW6mula0HY2AsKN1PHaj4XeKLETNvH8=,iv:pBct6RALFuYRUe2EqCSpUPxJ9/7dMt4O2VMZUUjrJks=,tag:UsGTnEbQzp1v8pVb0j2itw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

services/desktop/desktop-apps.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, inputs, ... }:
+{ pkgs, lib, ... }:
 
 let
   rishot = pkgs.callPackage ../../pkgs/rishot.nix { };
@@ -16,6 +16,7 @@ in
       "steam-unwrapped"
       "steam-run"
       "claude-code"
+      "proton-pass-cli"
       "vivaldi"
     ];
 
@@ -35,6 +36,7 @@ in
     kdePackages.dolphin
     vivaldi
     rishot
+    jq
     dotnetCorePackages.sdk_10_0
     nodejs
   ];