terra: cosmic portals, jupiter smb mount, tea CLI, launcher/theme polish

- swap gtk portal/apps for cosmic (xdg-desktop-portal-cosmic, cosmic-files,
  cosmic-settings) and drop dolphin/protonplus/bambu-studio (bambu-studio
  moved to flatpak alongside the other comms/gaming flatpaks)
- mount jupiter's samba share at /mnt/jupiter (automount, credentials from
  the same samba_password secret jupiter itself uses)
- add tea (gitea's remote API CLI) for talking to git.mgaction.town from
  terra without SSHing into jupiter
- new dark icon themes (Amy, Azure Glassy, Slot Beauty) vendored from
  gnome-look.org tarballs, packaged since pling download links expire
- rishot: fix Qt5Compat.GraphicalEffects QML import (was missing qt6.qt5compat
  on QML_IMPORT_PATH, so quickshell failed at config-load)
- launcher widgets: stop LauncherConsole/LauncherDock from reserving
  compositor space (ExclusionMode.Ignore, they're overlays not real docks);
  bump LauncherCorner app icon size 28->34
- comms script: launch telegram/discord via flatpak, not native binaries
- nix-ld + boot.binfmt aarch64 emulation (for building/flashing mercury
  from terra)

common.nix

@@ -9,14 +9,17 @@
     extraGroups = [ "wheel" "networkmanager" ];
     shell = pkgs.zsh;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
     ];
   };
-  # Costs a password prompt on every `./scripts/deploy switch` (nixos-rebuild
+
-  # --use-remote-sudo). Worth it: darman's key is the only thing between the
+  security.sudo = {
-  # public internet and root on neptun. The password is darman_password from
+    enable = true;
-  # each host's sops file.
+    wheelNeedsPassword = true;
-  security.sudo.wheelNeedsPassword = true;
+    extraConfig = ''
+      Defaults timestamp_timeout=20
+    '';
+  };
 
   # ---- SSH (key-only) ----
   services.openssh = {
@@ -48,7 +51,7 @@
     options = "--delete-older-than 30d";
   };
 
-  environment.systemPackages = with pkgs; [ vim git htop tmux curl wget zsh-powerlevel10k ];
+  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
 
   # ---- zsh / oh-my-zsh / powerlevel10k ----
   programs.zsh = {
@@ -57,15 +60,36 @@
       enable = true;
       theme = "robbyrussell"; # prompt itself replaced by p10k below
     };
+    shellAliases = {
+      ls = "lsd";
+    };
     interactiveShellInit = ''
       source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
       source ${./dotfiles/p10k.zsh}
     '';
   };
 
+  # ---- Boot generations ----
+  # Cap every host at 5 generations so none of them can quietly repeat
+  # jupiter's 34-generations-on-a-29G-eMMC incident. Both loader options are
+  # set unconditionally since only one is ever enabled per host (systemd-boot
+  # everywhere except mercury's generic-extlinux-compatible RPi image) — the
+  # other one is simply inert.
+  boot.loader.systemd-boot.configurationLimit = 5;
+  boot.loader.generic-extlinux-compatible.configurationLimit = 5;
+
+  # Stock journald defaults to ~10% of the filesystem (up to 4G) before it
+  # rotates — no scheduled vacuum, just a ceiling it grows into. On jupiter's
+  # 29G eMMC that's ~2.9G it could silently accumulate. Cap it well below that
+  # everywhere instead of only noticing when a disk fills up again.
+  services.journald.extraConfig = ''
+    SystemMaxUse=200M
+  '';
+
   # ---- Locale / firewall base ----
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
+  console.keyMap = "de";
 
   # Firewall on, ssh always allowed. Service modules add their own ports
   # (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).

dotfiles/quickshell/widgets/launcher/LauncherConsole.qml

@@ -37,6 +37,12 @@ Scope {
         WlrLayershell.layer: WlrLayer.Overlay
         WlrLayershell.keyboardFocus: root.active ? WlrKeyboardFocus.Exclusive : WlrKeyboardFocus.None
 
+        // Overlay, not a real dock: don't reserve compositor space (default
+        // ExclusionMode.Auto would claim a strip the full height of the deck
+        // along the top edge, shrinking every other window's usable area
+        // even while closed).
+        exclusionMode: ExclusionMode.Ignore
+
         color: "transparent"
 
         anchors {

dotfiles/quickshell/widgets/launcher/LauncherCorner.qml

@@ -649,7 +649,7 @@ Scope {
                             spacing: 12
 
                             IconImage {
-                                implicitSize: 28
+                                implicitSize: 34
                                 source: Quickshell.iconPath(appRow.modelData.icon, "application-x-executable")
                             }
 

dotfiles/quickshell/widgets/launcher/LauncherDock.qml

@@ -35,6 +35,12 @@ Scope {
         WlrLayershell.layer: WlrLayer.Overlay
         WlrLayershell.keyboardFocus: root.active ? WlrKeyboardFocus.Exclusive : WlrKeyboardFocus.None
 
+        // Overlay, not a real dock: don't reserve compositor space (default
+        // ExclusionMode.Auto would claim a strip the full height of the deck
+        // along the bottom edge, shrinking every other window's usable area
+        // even while closed).
+        exclusionMode: ExclusionMode.Ignore
+
         color: "transparent"
 
         anchors {

dotfiles/scripts/start-communications.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Start both comms apps; Hyprland window rules move them to special:communications.
-telegram-desktop &
+flatpak run org.telegram.desktop &
-discord &
+flatpak run com.discordapp.Discord &

flake.lock

@@ -13,11 +13,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1784059115,
+        "lastModified": 1785159467,
-        "narHash": "sha256-HDox7X6IKv0tgURi1DoWX9NYjY/ngTOfMvlOJsEl0oI=",
+        "narHash": "sha256-1LwjkVJK5pst6Atm3uOiZW3eBMY3gs0ICO14eFGlpGw=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "1a0767799b4be2fc6d0dcf8b77d86f5838eafbc6",
+        "rev": "a492deb563cf54cb8fe134e94a7ba3b01820ca5e",
         "type": "github"
       },
       "original": {
@@ -29,16 +29,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1783473460,
+        "lastModified": 1784731584,
-        "narHash": "sha256-pGOd9+Una59JUgOcPC3PoqOqY08GkJtY+jgtk13rJ1Y=",
+        "narHash": "sha256-/HdXzjjvuSW7zjbCNJKm3Fj8gvIwfrDf8mOYev0yuIg=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "c2942671a5b98dfa596de7bf247accb48a5c71ee",
+        "rev": "0c67ea476be6319f1b2a41cb0f5ed128af37b99b",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2026.5.4",
+        "ref": "version/2026.5.6",
         "repo": "authentik",
         "type": "github"
       }
@@ -125,11 +125,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784350909,
+        "lastModified": 1785119570,
-        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -139,6 +139,26 @@
         "type": "github"
       }
     },
+    "hypr-chrome": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785267577,
+        "narHash": "sha256-PoNXV5H5BbncwyO0C6Dar6C49GSf3UGDRRMpuArX8y4=",
+        "ref": "refs/heads/develop",
+        "rev": "73ce9ddbdf27d21c87322bcd638c1efe08be6827",
+        "revCount": 4,
+        "type": "git",
+        "url": "https://git.mgaction.town/darman/hypr-chrome.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.mgaction.town/darman/hypr-chrome.git"
+      }
+    },
     "media-manager": {
       "flake": false,
       "locked": {
@@ -254,11 +274,11 @@
         "nixos-unstable": "nixos-unstable"
       },
       "locked": {
-        "lastModified": 1783593136,
+        "lastModified": 1784802994,
-        "narHash": "sha256-zy5an02BdZ65OgVKdRkz2TpbdBrsW+uQD7AA2wLuiTM=",
+        "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=",
         "owner": "nix-community",
         "repo": "nixos-images",
-        "rev": "803f28511c7d5f39f2537c342122fd94b8e1d519",
+        "rev": "6ece16b0c97986fe085122e796044add4cc3ff64",
         "type": "github"
       },
       "original": {
@@ -286,11 +306,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783776592,
+        "lastModified": 1785090369,
-        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
+        "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
+        "rev": "624af665418d3c65d544145b4d34ad696439570e",
         "type": "github"
       },
       "original": {
@@ -317,11 +337,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1784555310,
+        "lastModified": 1785141334,
-        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
+        "narHash": "sha256-kh35kIx7el4Jk8Ki3BH9/Pn1eZYSYLJ6LMALos0zOy0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+        "rev": "38a4887411571457d700c51c64a6e49ead2ed5ab",
         "type": "github"
       },
       "original": {
@@ -333,11 +353,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1784280462,
+        "lastModified": 1785133411,
-        "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=",
+        "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f",
+        "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3",
         "type": "github"
       },
       "original": {
@@ -413,11 +433,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782905613,
+        "lastModified": 1784591072,
-        "narHash": "sha256-SvXJcAemihifkTn4BGvyE5K1FJX9bl4U8DQ5pqKvD0s=",
+        "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
         "owner": "pyproject-nix",
         "repo": "pyproject.nix",
-        "rev": "7af23cfe91064865ecf2e835da28b45b3c6f49fd",
+        "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
         "type": "github"
       },
       "original": {
@@ -452,6 +472,7 @@
         "authentik-nix": "authentik-nix",
         "disko": "disko",
         "home-manager": "home-manager",
+        "hypr-chrome": "hypr-chrome",
         "mediamanager-nix": "mediamanager-nix",
         "nix-flatpak": "nix-flatpak",
         "nixos-anywhere": "nixos-anywhere",
@@ -529,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783511944,
+        "lastModified": 1785147819,
-        "narHash": "sha256-Z/Ss9rWw9QYcRK+Qqkmty7PB1pIik5XGbrtit+ad2qs=",
+        "narHash": "sha256-udwe836AZe8BYU+YqVc51QLuOeWKoGEmPIMF0ImUfTQ=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "83995ef5e4ece3c9c704aa645bbff439e15a0ac3",
+        "rev": "0983f54345137c2dd528ce2c28cb56c2cbdceb2a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -33,6 +33,16 @@
     };
     authentik-nix.url = "github:nix-community/authentik-nix";
     nix-flatpak.url = "github:gmodena/nix-flatpak";
+    # Own Hyprland plugin (border + title bar), public repo, fetched over
+    # https (no credentials needed, unlike tome below). `nixpkgs.follows` is
+    # what makes its packaged build ABI-correct — Hyprland plugins are
+    # ABI-locked to the exact Hyprland build they load into, so it has to be
+    # built against THIS flake's own nixpkgs, not whatever hypr-chrome's own
+    # flake.lock happens to pin standalone.
+    hypr-chrome = {
+      url = "git+https://git.mgaction.town/darman/hypr-chrome.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     # NOTE: the `tome` input (private repo git+ssh://gitea@git.mgaction.town) was
     # removed temporarily — the credential-less installer-iso can't fetch it, so
     # `install terra localhost` failed at nixos-install (post-disko). Re-add it

hosts/jupiter/configuration.nix

@@ -37,6 +37,9 @@
   # systemd-boot for UEFI. If ZimaBlade boots legacy/BIOS, switch to grub.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+  # common.nix's cap of 5 comes from this box's own 34-generation incident,
+  # but at ~5G free on a 29G eMMC even 5 is too many — override down to 2.
+  boot.loader.systemd-boot.configurationLimit = lib.mkForce 2;
 
   # Root lives on the ZimaBlade eMMC (mmcblk0). nixos-generate-config runs in
   # the RAM installer and does NOT detect these, so pin them here (merged with

hosts/jupiter/secrets.nix

@@ -34,4 +34,12 @@
   # sops default of root:root 0400 is correct — do NOT set `owner`.
   sops.secrets.immich_oauth_client_secret = { };
 
+  # Gitea Actions runner registration token (services/dev/gitea.nix). Gitea
+  # generates this itself once Actions is enabled — it is not a password
+  # chosen up front. Rendered into a `TOKEN=...` env file because
+  # gitea-actions-runner takes an EnvironmentFile, not a raw secret path.
+  sops.secrets.gitea_runner_token = { };
+  sops.templates."gitea-runner.env".content =
+    "TOKEN=${config.sops.placeholder.gitea_runner_token}";
+
 }

hosts/neptun/configuration.nix

@@ -42,6 +42,12 @@
   #   default via fe80::1 dev eth0 metric 1024 onlink
   networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
   networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
+  # Addressing is fully static above, but netcup's router still sends periodic
+  # RAs on this segment; the kernel then tries (and fails, since the static
+  # route already exists) to install its own default route from them, spamming
+  # "ndisc_router_discovery failed to add default route" on the console. Stop
+  # it from processing RAs on eth0 at all rather than just live with the noise.
+  boot.kernel.sysctl."net.ipv6.conf.eth0.accept_ra" = 0;
 
   # ---- Local split-DNS stub ----
   # neptun must NOT take the tailnet's DNS: headscale points every node at

hosts/terra/configuration.nix

@@ -1,10 +1,6 @@
+# ---- TERRA ----
 { config, pkgs, lib, inputs, ... }:
 
-# terra — Ryzen 9 5900X / Radeon RX 6800 XT desktop (MSI MS-7A32). Replaces
-# CachyOS on the OS SSD (Kingston SA400, sdb). Dev-data disks (sdc ext4
-# /mnt/hdd_01, LVM vg_ssd /mnt/ssd_01) are kept out of disko and mounted here
-# as plain filesystems so they're never wiped. The leftover ntfs disks
-# (sda, sdf, nvme0n1) are ignored entirely — not referenced anywhere.
 let
   unstable = import inputs.nixpkgs-unstable {
     inherit (pkgs.stdenv.hostPlatform) system;
@@ -14,9 +10,9 @@ in
 {
   imports = [
     ./hardware-configuration.nix
-    ./disk-config.nix          # disko: OS-disk (sdb) partitions + filesystems
+    ./disk-config.nix
-    ./secrets.nix               # sops-nix: darman password, tailscale key
+    ./secrets.nix
-    ../../common.nix               # shared base: user / ssh / nix / firewall
+    ../../common.nix
     ../../services/vpn/tailscale.nix
     ../../services/desktop/desktop-hyprland.nix
     ../../services/desktop/desktop-apps.nix
@@ -28,21 +24,27 @@ in
     enable = true;
     remotes = [{ name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo"; }];
     packages = [
+      { appId = "com.github.tchx84.Flatseal"; origin = "flathub"; }
       { appId = "com.blitzfc.qbz";        origin = "flathub"; }
       { appId = "com.discordapp.Discord";  origin = "flathub"; }
       { appId = "org.telegram.desktop";   origin = "flathub"; }
+      { appId = "com.bambulab.BambuStudio"; origin = "flathub"; }
     ];
   };
 
-  # Proton Pass CLI — in nixpkgs-unstable (2.2.3+); scripts/deploy uses it to
-  # autofill sudo/ssh passwords from the "HomeLab" vault.
   environment.systemPackages = [ unstable.proton-pass-cli ];
 
+  # ---- nix-ld: lets generic dynamically-linked Linux binaries run as-is —
+  # needed for editor extensions (Zed/VSCode LSPs, debuggers, etc.) that
+  # download prebuilt binaries not built for NixOS. See
+  # https://nix.dev/permalink/stub-ld ----
+  programs.nix-ld.enable = true;
+
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;
   home-manager.backupFileExtension = "hm-bak";
-  home-manager.extraSpecialArgs = { inherit unstable; };
+  home-manager.extraSpecialArgs = { inherit unstable inputs; };
   home-manager.users.darman = import ./home.nix;
 
   # ---- Boot (UEFI) ----
@@ -50,20 +52,17 @@ in
   boot.loader.efi.canTouchEfiVariables = true;
   hardware.cpu.amd.updateMicrocode = true;
 
+  # mercury (aarch64) is built/flashed from here. Without this, `nix build`
+  # for it dies with "platform mismatch" — no qemu binfmt handler registered
+  # and aarch64-linux missing from nix.settings.extra-platforms. This module
+  # sets up both (see CLAUDE.md's aarch64 gotcha).
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
   # ---- GPU (Radeon RX 6800 XT / Navi 21) ----
-  # amdgpu needs the redistributable navi21 firmware blobs to bind the card.
-  # Without them the module loads but never initialises the GPU: there's no
-  # DRM card for it, the display falls back to the 1024x768 EFI
-  # simple-framebuffer as "Unknown-1", and the real DP-2/HDMI-A-1 outputs
-  # never appear — so hyprland's monitor rules match nothing.
   hardware.enableRedistributableFirmware = true;
-  # Early KMS: bind amdgpu in the initrd so it drives the console + greeter
-  # from boot instead of handing over from simple-framebuffer later.
   boot.initrd.kernelModules = [ "amdgpu" ];
 
   # ---- Dev-data disks — NOT in disko, mounted read-write, never wiped ----
-  # UUIDs captured from the running CachyOS box; verify after install
-  # (`lsblk -o NAME,UUID,MOUNTPOINT`) in case disko/kernel enumerates differently.
   fileSystems."/mnt/hdd_01" = {
     device = "/dev/disk/by-uuid/b8445126-ec6d-4f88-818a-d9e13031d9a4";
     fsType = "ext4";
@@ -75,5 +74,22 @@ in
     options = [ "nofail" ];
   };
 
+  # jupiter's samba share (services/network/samba.nix) — mounted on demand so
+  # terra doesn't stall boot/login when jupiter is off or unreachable.
+  fileSystems."/mnt/jupiter" = {
+    device = "//jupiter/data";
+    fsType = "cifs";
+    options = [
+      "credentials=${config.sops.templates."jupiter-smb.credentials".path}"
+      "uid=1000"
+      "gid=100"
+      "nofail"
+      "x-systemd.automount"
+      "x-systemd.idle-timeout=60"
+      "x-systemd.mount-timeout=10s"
+      "_netdev"
+    ];
+  };
+
   system.stateVersion = "26.05";
 }

hosts/terra/home.nix

@@ -1,83 +1,56 @@
 { pkgs, unstable, ... }:
 
-# home-manager profile for darman on terra. The Hyprland config lives in its
-# own module (./hyprland.nix); this handles the rest of the user session
-# (theming, terminal, packages).
 {
-  imports = [ ./home/hyprland.nix ];
+  imports = [ ./home/hyprland.nix ./home/theme.nix ];
 
   home.stateVersion = "26.05";
   home.keyboard.layout = "de";
 
-  programs.git.enable = true;
+  programs.git = {
+    enable = true;
+    settings = {
+      user.name = "Erik Simon";
+      user.email = "mail@erik-s.dev";
+    };
+  };
   programs.home-manager.enable = true;
 
-  # Give darman a managed ~/.zshrc. Without any zsh dotfile, zsh runs its
-  # first-run `zsh-newuser-install` prompt on every new terminal. oh-my-zsh +
-  # powerlevel10k still come from the system /etc/zshrc (common.nix), which
-  # always loads for interactive shells before this ~/.zshrc.
   programs.zsh.enable = true;
 
-  # ---- Dracula theming (GTK + Qt) ----
+  xdg.userDirs = {
-  gtk = {
     enable = true;
-    theme = {
-      name = "Dracula";
-      package = pkgs.dracula-theme;
-    };
   };
 
-  # GTK4 / libadwaita apps ignore gtk-theme-name; they only read the dconf
-  # color-scheme key via the portal. Writing it here persists it across reboots
-  # (the gsettings call in the Hyprland autostart only lasts the session).
-  dconf.settings."org/gnome/desktop/interface" = {
-    color-scheme = "prefer-dark";
-    gtk-theme = "Dracula";
-  };
-
-  # dracula-qt5-theme ships only a qt5ct color scheme (no style plugin), so
-  # Qt has to go through qt(5|6)ct rather than a direct style/platformTheme
-  # name. "qtct" pulls in both qt5ct and qt6ct; qt6ct reads its own config
-  # but understands the same scheme file format, so both point at it.
-  qt = {
-    enable = true;
-    platformTheme.name = "qtct";
-  };
-  xdg.configFile."qt5ct/qt5ct.conf".text = ''
-    [Appearance]
-    color_scheme_path=${pkgs.dracula-qt5-theme}/share/qt5ct/colors/Dracula.conf
-    custom_palette=true
-    style=Fusion
-  '';
-  xdg.configFile."qt6ct/qt6ct.conf".text = ''
-    [Appearance]
-    color_scheme_path=${pkgs.dracula-qt5-theme}/share/qt5ct/colors/Dracula.conf
-    custom_palette=true
-    style=Fusion
-  '';
-
-  # Custom mime-info defs (sln/slnx). xdg.mime's update-mime-database only
-  # indexes share/mime/packages inside the hm profile itself, so this has to
-  # be a package in home.packages, not a plain xdg.dataFile.
   xdg.mime.enable = true;
   xdg.configFile."quickshell".source = ../../dotfiles/quickshell;
   xdg.configFile."scripts".source = ../../dotfiles/scripts;
+
   home.packages = [
     (pkgs.writeTextDir "share/mime/packages/application-x-ms-sln.xml"
       (builtins.readFile ../../dotfiles/mime/application-x-ms-sln.xml))
     unstable.claude-code
-    pkgs.quickshell
     pkgs.opencode
+    pkgs.quickshell
+    pkgs.github-cli
+    pkgs.tea
     pkgs.hyprcursor
     pkgs.bibata-cursors
+    pkgs.papirus-icon-theme
   ];
 
+  xdg.desktopEntries.btop = {
+    name = "btop++";
+    genericName = "System Monitor";
+    exec = "btop";
+    icon = "btop";
+    terminal = true;
+    categories = [ "System" "Monitor" ];
+    noDisplay = true;
+  };
+
   programs.alacritty = {
     enable = true;
     settings = {
-      # NixOS has no /bin/zsh (only /bin/sh); point at the real store path or
-      # alacritty exits instantly trying to exec a missing shell — which looked
-      # like "the SUPER+Return keybind doesn't work".
       env.SHELL = "${pkgs.zsh}/bin/zsh";
       terminal.shell = {
         program = "${pkgs.zsh}/bin/zsh";
@@ -92,7 +65,7 @@
         style = "Regular";
       };
       colors.primary = {
-        background = "#222831";
+        background = "#0F1012";
         foreground = "#ffd369";
       };
  #     hints.enabled = [

hosts/terra/home/hyprland.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, config, inputs, ... }:
 
 # Hyprland config migrated from github.com/darman96/hyprland-dotfiles (the
 # hyprlang `hypr/*.conf` files) into the home-manager lua-style `settings`
@@ -12,10 +12,12 @@
 # own hyprland.lua.
 #
 # Deliberately NOT migrated:
-#   - hyprbars.conf / hyprredsquare.conf: config for the third-party plugins
+#   - hyprbars.conf: config for the third-party `hyprbevelbars` plugin, which
-#     `hyprbevelbars` + `hyprredsquare`, which aren't packaged in nixpkgs. Load
+#     isn't packaged in nixpkgs. Load it via
-#     the plugins via `wayland.windowManager.hyprland.plugins` and re-add their
+#     `wayland.windowManager.hyprland.plugins` and re-add its config once
-#     config once they're available.
+#     available. (hyprredsquare.conf's plugin was renamed hypr-chrome and
+#     rewritten since - it's wired in below via the `hypr-chrome` flake
+#     input instead, with its own `plugin.hyprchrome` config.)
 #   - hyprqt6engine.conf + `QT_QPA_PLATFORMTHEME=hyprqt6engine`: terra themes Qt
 #     through qtct/Dracula in home.nix, so that env var is left off to avoid a conflict.
 #   - hyprlock.conf: a separate program (use `programs.hyprlock` if wanted).
@@ -29,6 +31,13 @@
 let
   lua = lib.generators.mkLuaInline;
 
+  # Wallpaper images aren't checked into this repo (binary blobs) — pulled
+  # from the existing Wallhaven library on /mnt/hdd_01 instead. Picked once
+  # here rather than at runtime, since hyprpaper has no built-in "random"
+  # mode; re-pick and rebuild (or swap in real per-monitor selection) when
+  # this stops being a placeholder.
+  wallpaper = "/mnt/hdd_01/data/Pictures/Wallhaven/wallhaven-g7jg63.png";
+
   # Dispatchers → the new hl.dsp.* API (signatures verified against hyprland
   # 0.55's src/config/lua/bindings/LuaBindingsDispatchers.cpp).
   dsp = {
@@ -65,14 +74,28 @@ let
   ];
 in
 {
+  services.hyprpaper = {
+    enable = true;
+    settings = {
+      ipc = "on";
+      splash = false;
+      preload = [ wallpaper ];
+      wallpaper = [
+        { monitor = "DP-2";     path = wallpaper; }
+        { monitor = "HDMI-A-1"; path = wallpaper; }
+      ];
+    };
+  };
+
   wayland.windowManager.hyprland = {
     enable = true;
+    plugins = [ inputs.hypr-chrome.packages.${pkgs.stdenv.hostPlatform.system}.default ];
     settings = {
       # ---- colours (from colors.conf) ----
       fg_color  = { _var = "rgba(eeeeeeff)"; };
       fg_accent = { _var = "rgba(FFD063ff)"; };
       bg_color  = { _var = "rgba(0F1012ff)"; };
-      bg_accent = { _var = "rgba(292C30ff)"; };
+      bg_accent = { _var = "rgba(40382fff)"; };
 
       # ---- monitors ----
       monitor = [
@@ -95,7 +118,15 @@ in
           border_size = 1;
           col = {
             inactive_border = lua "bg_accent";
-            active_border   = lua "fg_accent";
+            # Gradient: hyprland's lua gradient type (CLuaConfigGradient::parse)
+            # takes either a plain colour string or a table with a `colors`
+            # array (1+ entries) and an optional `angle` in DEGREES. The list
+            # entries may be literal "rgba(...)" strings or, as here, the
+            # `_var` locals declared above rendered raw via mkLuaInline.
+            active_border = {
+              colors = [ (lua "fg_accent") (lua "bg_accent") ];
+              angle = 45;
+            };
           };
           layout = "dwindle";
           gaps_in = 4;
@@ -130,6 +161,8 @@ in
           workspace_back_and_forth = true;
           allow_workspace_cycles = true;
         };
+
+        plugin.hyprchrome.enabled = true;
       };
 
       # ---- animations ----
@@ -150,6 +183,7 @@ in
         { _args = [ "XDG_CURRENT_DESKTOP" "Hyprland" ]; }
         { _args = [ "XDG_SESSION_DESKTOP" "Hyprland" ]; }
         { _args = [ "XDG_SESSION_TYPE" "wayland" ]; }
+        { _args = [ "QT_QPA_PLATFORMTHEME" "qt6ct" ]; }
       ];
 
       # ---- keybinds (keybinds.conf) ----
@@ -167,10 +201,11 @@ in
         (bind "SUPER + CTRL + S" (dsp.global "quickshell:sidebar"))
 
         (bind "SUPER + B" (dsp.exec "vivaldi"))
-        (bind "SUPER + E" (dsp.exec "dolphin"))
+        (bind "SUPER + E" (dsp.exec "cosmic-files"))
         (bind "SUPER + SHIFT + G" (dsp.workspaceRef "game"))
         (bind "SUPER + S" (dsp.exec "grim -o DP-2 ~/screenshot.png"))
         (bind "SUPER + SHIFT + S" (dsp.exec "grimblast copy area --freeze"))
+        (bind "Print" (dsp.exec "rishot"))
         (bind "SUPER + L" (dsp.exec "hyprlock"))
         (bind "SUPER + W" (dsp.exec "waypaper --random"))
 
@@ -245,7 +280,7 @@ in
       workspace_rule = [
         { workspace = "name:game"; monitor = "DP-2"; decorate = false; }
         { workspace = "special:terminal"; on_created_empty = "alacritty"; gaps_out = 256; }
-        { workspace = "special:communications"; on_created_empty = "$HOME/.config/scripts/start-communications.sh"; gaps_out = 128; }
+        { workspace = "special:communications"; on_created_empty = "${config.home.homeDirectory}/.config/scripts/start-communications.sh"; gaps_out = 128; }
         { workspace = "special:music"; on_created_empty = "com.blitzfc.qbz"; gaps_out = 128; }
         { workspace = "special:version_control"; on_created_empty = "com.axosoft.GitKraken"; gaps_out = 128; }
       ];
@@ -257,7 +292,7 @@ in
           (lua ''
             function()
               hl.exec_cmd("systemctl --user start hyprpolkitagent")
-              hl.exec_cmd("vicinae server")
+              hl.exec_cmd("cosmic-settings-daemon")
               hl.exec_cmd("quickshell")
               hl.exec_cmd("alacritty", { workspace = "special:terminal silent" })
               hl.exec_cmd("kbuildsycoca6 --noincremental")
@@ -266,4 +301,6 @@ in
       };
     };
   };
+
+  xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-cosmic ];
 }

hosts/terra/home/theme.nix

@@ -0,0 +1,70 @@
+{ pkgs, ... }:
+
+# Global Dracula theming (GTK + Qt)
+let
+  azureGlassyDarkIcons = pkgs.callPackage ../../../pkgs/azure-glassy-dark-icons.nix { };
+  amyDarkIcons = pkgs.callPackage ../../../pkgs/amy-dark-icons.nix { };
+  slotBeautyDarkIcons = pkgs.callPackage ../../../pkgs/slot-beauty-dark-icons.nix { };
+
+  iconTheme = "Amy-Dark-Icons";
+  iconThemePackage = amyDarkIcons;
+  iconThemeFolder = "${iconThemePackage}/share/icons/${iconTheme}";
+in
+{
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Dracula";
+      package = pkgs.dracula-theme;
+    };
+    iconTheme = {
+      name = iconTheme;
+      package = iconThemePackage;
+    };
+  };
+
+  # Flatpak apps are sandboxed and can't see XDG_DATA_DIRS/nix-store theme
+  # paths, so the portal-reported GTK theme / icon theme names resolve to
+  # nothing inside the sandbox and they fall back to Adwaita. Flatpak
+  # auto-exposes ~/.themes and ~/.icons read-only to every sandboxed app
+  # specifically for this case.
+  home.file.".themes/Dracula".source =
+    "${pkgs.dracula-theme}/share/themes/Dracula";
+  home.file.".icons/${iconTheme}".source = iconThemeFolder;
+
+  dconf.settings."org/gnome/desktop/interface" = {
+    color-scheme = "prefer-dark";
+    gtk-theme = "Dracula";
+    icon-theme = iconTheme;
+  };
+
+  # "qtct" (qt5ct/qt6ct) instead of "kde" avoids pulling in
+  # kdePackages.systemsettings just for the platform-theme plugin — kvantum
+  # itself carries the Dracula colors, qt5ct/qt6ct just need to be told to
+  # use it as the style.
+  qt = {
+    enable = true;
+    platformTheme.name = "qtct";
+    style.name = "kvantum";
+  };
+  xdg.configFile."Kvantum/kvantum.kvconfig".text = ''
+    [General]
+    theme=Dracula
+  '';
+  xdg.configFile."Kvantum/Dracula".source =
+    "${pkgs.dracula-theme}/share/Kvantum/Dracula";
+
+  # Quickshell's IconImage/Quickshell.iconPath() resolves icons through the
+  # Qt platform theme, not GTK — so the app-launcher grid needs the icon
+  # theme set HERE (qt5ct/qt6ct), separately from the GTK dconf key above.
+  xdg.configFile."qt5ct/qt5ct.conf".text = ''
+    [Appearance]
+    style=kvantum
+    icon_theme=${iconTheme}
+  '';
+  xdg.configFile."qt6ct/qt6ct.conf".text = ''
+    [Appearance]
+    style=kvantum
+    icon_theme=${iconTheme}
+  '';
+}

hosts/terra/secrets.nix

@@ -12,4 +12,13 @@
 
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+
+  # Credentials file for the //jupiter/data cifs mount (see configuration.nix).
+  # samba_password mirrors jupiter's own samba_password secret (services/network/samba.nix) —
+  # same value, just also encrypted to terra so it can authenticate as the same smb user.
+  sops.secrets.samba_password = { };
+  sops.templates."jupiter-smb.credentials".content = ''
+    username=darman
+    password=${config.sops.placeholder.samba_password}
+  '';
 }

pkgs/amy-dark-icons.nix

@@ -0,0 +1,43 @@
+{ lib, stdenvNoCC, gtk3 }:
+
+# Amy-Dark-Icons (gnome-look.org/p/2011598), not packaged in nixpkgs.
+# gnome-look/pling download links are signed JWTs that expire in ~2 days, so
+# fetchurl against one would work today and fail on the next rebuild after
+# that window — the tarball is vendored into the repo instead, as verified
+# (md5 51bae6972100a36151edd660ba7bf3fa against the gnome-look API's
+# reported checksum) at dotfiles/icons/Amy-Dark-Icons.tar.xz.
+stdenvNoCC.mkDerivation {
+  pname = "amy-dark-icons";
+  version = "unstable-2026-07-12";
+
+  src = ../dotfiles/icons/Amy-Dark-Icons.tar.xz;
+
+  nativeBuildInputs = [ gtk3 ];
+
+  dontBuild = true;
+
+  # Upstream ships dozens of dangling symlinks (icons aliased across sizes
+  # that don't all exist) — same class of minor packaging bug as
+  # azure-glassy-dark-icons. Harmless: GTK/Qt icon lookup falls through to
+  # the theme's own Inherits= chain (breeze, hicolor, Adwaita) for those.
+  dontCheckForBrokenSymlinks = true;
+
+  # gtk3's setup hook strips icon-theme.cache from $out by default
+  # (postFixup); opt back out, matching nixpkgs' papirus-icon-theme.
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/icons"
+    cp -r . "$out/share/icons/Amy-Dark-Icons"
+    gtk-update-icon-cache --force "$out/share/icons/Amy-Dark-Icons"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Amy dark icon theme, vendored from gnome-look.org (not packaged in nixpkgs)";
+    homepage = "https://www.gnome-look.org/p/2011598";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}

pkgs/azure-glassy-dark-icons.nix

@@ -0,0 +1,48 @@
+{ lib, stdenvNoCC, gtk3 }:
+
+# Azure-Glassy-Dark-Icons (gnome-look.org/p/2154036), not packaged in
+# nixpkgs. gnome-look/pling download links are signed JWTs that expire in
+# ~2 days (`exp` claim on the URL was ~48h out from issuance) — fetchurl
+# against one would work today and fail on the next rebuild after that
+# window with no warning. The tarball is vendored into the repo instead, as
+# verified (md5 d218b358086ee7f68cb5e98c53e9efaf against the gnome-look API's
+# reported checksum) at dotfiles/icons/Azure-Glassy-Dark-Icons.tar.xz.
+stdenvNoCC.mkDerivation {
+  pname = "azure-glassy-dark-icons";
+  version = "unstable-2026-07-12";
+
+  src = ../dotfiles/icons/Azure-Glassy-Dark-Icons.tar.xz;
+
+  nativeBuildInputs = [ gtk3 ];
+
+  dontBuild = true;
+
+  # Upstream ships a handful of dangling symlinks under mimetypes/16 (e.g.
+  # libreoffice-spreadsheet.svg -> libreoffice-oasis-spreadsheet.svg, which
+  # doesn't exist in that size dir) — a minor packaging bug in the theme
+  # itself. Harmless: GTK's icon lookup just falls through to the theme's
+  # own Inherits= chain (breeze-dark, breeze, Adwaita, hicolor) for those few
+  # mimetypes. Nixpkgs' default noBrokenSymlinks fixup check would otherwise
+  # fail the whole build over it.
+  dontCheckForBrokenSymlinks = true;
+
+  # gtk3's setup hook strips icon-theme.cache from $out by default
+  # (postFixup); papirus-icon-theme opts back out the same way rather than
+  # let the freshly regenerated cache get thrown away.
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/icons"
+    cp -r . "$out/share/icons/Azure-Glassy-Dark-Icons"
+    gtk-update-icon-cache --force "$out/share/icons/Azure-Glassy-Dark-Icons"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Azure-Glassy dark icon theme, vendored from gnome-look.org (not packaged in nixpkgs)";
+    homepage = "https://www.gnome-look.org/p/2154036";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}

pkgs/rishot.nix

@@ -9,6 +9,7 @@
 , curl
 , kdePackages
 , libnotify
+, qt6
 }:
 
 # Wayland screenshot + annotation overlay, driven entirely by quickshell (qs -p
@@ -16,6 +17,11 @@
 # plus src/*.qml, no nixpkgs package exists. bin/rishot resolves its QML dir at
 # $self/../src by default, which breaks once wrapProgram rewrites argv0; setting
 # RISHOT_CONFIG_DIR sidesteps that self-lookup entirely (see bin/rishot upstream).
+#
+# Overlay.qml imports Qt5Compat.GraphicalEffects, which quickshell's own Qt
+# runtime doesn't ship — without qt5compat on the QML import path, `qs`
+# fails at config-load with "module Qt5Compat.GraphicalEffects is not
+# installed" and rishot exits 255 before ever drawing anything.
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rishot";
   version = "0-unstable-2026-07-10";
@@ -52,7 +58,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         curl
         kdePackages.kdialog
         libnotify
-      ]}
+      ]} \
+      --prefix QML_IMPORT_PATH : "${qt6.qt5compat}/lib/qt-6/qml" \
+      --prefix QML2_IMPORT_PATH : "${qt6.qt5compat}/lib/qt-6/qml"
 
     runHook postInstall
   '';

pkgs/slot-beauty-dark-icons.nix

@@ -0,0 +1,46 @@
+{ lib, stdenvNoCC }:
+
+# Slot Beauty Dark Icons (gnome-look.org/p/2346341), not packaged in
+# nixpkgs. gnome-look/pling download links are signed JWTs that expire in
+# ~2 days, so fetchurl against one would work today and fail on the next
+# rebuild after that window — the tarball is vendored into the repo instead,
+# as verified (md5 8b3e3e1e03c667b7f988b78ad2bc18a6 against the gnome-look
+# API's reported checksum) at
+# dotfiles/icons/Slot-Beauty-Dark-Icons-V-2.tar.xz.
+stdenvNoCC.mkDerivation {
+  pname = "slot-beauty-dark-icons";
+  version = "unstable-2026-07-24";
+
+  src = ../dotfiles/icons/Slot-Beauty-Dark-Icons-V-2.tar.xz;
+
+  dontBuild = true;
+
+  # Upstream ships dozens of dangling symlinks (icons aliased across sizes
+  # that don't all exist) — same class of minor packaging bug as
+  # azure-glassy-dark-icons. Harmless: GTK/Qt icon lookup falls through to
+  # the theme's own Inherits= chain (breeze-dark, Adwaita, hicolor) for those.
+  dontCheckForBrokenSymlinks = true;
+
+  # index.theme's Directories= lists panel/16@2, panel/22@2, panel/24@2 (with
+  # Scale=2), but the actual on-disk dirs are named 16@2x/22@2x/24@2x (the
+  # correct freedesktop-spec suffix) — an upstream index.theme typo. That
+  # mismatch makes `gtk-update-icon-cache` refuse to emit ANY cache at all
+  # (exits 1, "The generated cache was invalid"), so unlike the other vendored
+  # themes here, this one ships with no icon-theme.cache and relies on GTK's
+  # live directory-scan lookup instead — functionally fine, just not
+  # cache-accelerated. gtk3's default postFixup hook (dropIconThemeCache)
+  # would strip a cache anyway, so there's nothing to opt out of.
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/icons"
+    cp -r . "$out/share/icons/Slot-Beauty-Dark-Icons-V-2"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Slot Beauty dark icon theme, vendored from gnome-look.org (not packaged in nixpkgs)";
+    homepage = "https://www.gnome-look.org/p/2346341";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+  };
+}

scripts/deploy

@@ -838,6 +838,26 @@ case "$cmd" in
     else
       "${rebuild[@]}"
     fi
+
+    # jupiter's 29G eMMC has no room to just let generations pile up between
+    # gc.dates=weekly runs (common.nix) — that's exactly how it filled up
+    # once already. configurationLimit=5 (also common.nix) makes
+    # switch-to-configuration prune generations beyond 5 as part of the
+    # switch above, but pruning a generation only drops it as a GC root —
+    # the store paths themselves still need an actual collect to free the
+    # disk. So do that here, right after every switch, rather than waiting
+    # up to a week for it to matter again.
+    if [ "$cmd" = switch ] && [ "$config" = jupiter ]; then
+      echo ">> jupiter: collecting garbage post-switch (keeps the eMMC under the 5-generation cap)"
+      need ssh
+      if [ -n "$pw" ]; then
+        printf '%s\n' "$pw" | ssh "darman@$host" 'sudo -S nix-collect-garbage -d' \
+          || echo ">> warning: post-switch gc on jupiter failed — check disk space by hand" >&2
+      else
+        ssh -t "darman@$host" 'sudo nix-collect-garbage -d' \
+          || echo ">> warning: post-switch gc on jupiter failed — check disk space by hand" >&2
+      fi
+    fi
     unset pw
     ;;
 

secrets/jupiter.yaml

@@ -6,6 +6,7 @@ sabnzbd_api_key: ENC[AES256_GCM,data:6UW1u2Ikmnq34t4H4k/4C44SJeFHRlaPjWwUjEfH1GQ
 prowlarr_api_key: ENC[AES256_GCM,data:ab1QACaagI8ACJXFUy8r9X9lgYwRo1byUmhBPSRWwKk=,iv:EcuF6EN/4mWxlXi6R1qDzv4rOw6AT+OGSNQaaBwjJHg=,tag:hixHrbQWU6QQZNMM5rNDsg==,type:str]
 cinephage_better_auth_secret: ENC[AES256_GCM,data:S1ilcQeC2HmXe/4xdLi6wm5RNz954SL3qVur6JCn5ekBVCbXMd1DGCafjhU=,iv:9rS5gDuazMOAq/hWp0onvHZPzKJgQM3oWIrtplJN/9I=,tag:xNqf/unY2v/98p4v52vUqw==,type:str]
 immich_oauth_client_secret: ENC[AES256_GCM,data:+NbUnwImwFTYNjz3luzczpCf7oMetzYBkj5ZnuG2QQf0Wpm6OtYS3amTC8dwoh9F/DAos5224etncfEgEu2k2iMUACLADnlCGppIx0F7Gl1Ve7UF2VzKJ3xQpgCDrXklU+o5NxfU/YBn1Vfa3580wT3tr2++SCSrcKq1XGtfhv4=,iv:tjaPDQbrA6TxsDebgNOtO/ITfXzU5wTKU9SkfC0TQcY=,tag:AnlJR0tLExkB7Aeo/ZVTng==,type:str]
+gitea_runner_token: ENC[AES256_GCM,data:8ji4Nia7GMCBBsemUeGZRqzhlk1RnzzOLLdo7+to85KIC5Kz4AtDsQ==,iv:2wotlB1B/Co/NrZVcIVB4AlwL7DF9KnEVKe32FJNErU=,tag:zLzKPgGmXCkGfK7P/74pyw==,type:str]
 sops:
     age:
         - enc: |
@@ -26,7 +27,7 @@ sops:
             CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-24T23:31:21Z"
+    lastmodified: "2026-07-29T19:00:26Z"
-    mac: ENC[AES256_GCM,data:u9n7XVFXX7Ujlz2UrHVqFTNl8OyVdmcIkAQM3khEotdfGRqlIU+L9exvhoPHTacQlPWKm8CkmrMbkDyURG/I4plQZATumw2aVawaB5R8NDnuL8+sya64jsISNPkCWYU9kqSHbvFsGuCIkHYvBXannqpkKxTtGaleV6BLbUfykFs=,iv:x1qg+qfeqTie2Dy4xmF/MZ6jBrVEgU7DSXOp6z3/5lc=,tag:O1GVWEtliEGrb+W+FEgfiw==,type:str]
+    mac: ENC[AES256_GCM,data:D5FLrembFUqs5yC2bHuhw2w8XUhF46LWpN5LF/VJKtLOo3A3KUdGV0HhA9k6gaTWyn5Zd7O9YSuJLknI62fbOtJkqOhMVUgj/VZXgrcQg4hlU53gDppryYNGi/7Vc9lxLfsJU4Yvk6yQfh7Gt19U+Mj6s7ETn6lJxC5FBnIkS3I=,iv:EJAM1cCD4rTq0XjIbo66di73hnOoklx5UoTrpdyKHq0=,tag:wEhFnwlXiYKyu/k/ED75TA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

secrets/terra.yaml

@@ -1,5 +1,6 @@
 tailscale_authkey: ENC[AES256_GCM,data:DgxbMrKTxC//cWd+ZckCbwZ9j/FgjYwNwadU5cWnnPz+nPEFhXLla2TuUE0pJKpcx9pKZCQmxcGtzQvIB+mbgxjgB0X2CRTp4Yy3WR+PBYMghKx36F8KBg==,iv:hJr6O41OTdMa4wkBXEsRUXgV4zWt21h1kx/CWArLU7o=,tag:IEpMIwKBHakvVYEFdEUe7A==,type:str]
 darman_password: ENC[AES256_GCM,data:G3ZM+NMxvKq5twblcBvyC+MiUX+X7nz+s1GqBHBkJQy1YgW4KN6rpbdj10F9jWxHph5dJ9j9fG6L7UlEg5W5zUYeLFdEx2xJGE1fxksch+6BB9FT6LKkhJ7MmbJmhNHYwJOZO3LM1f/oRw==,iv:abQTRe9kRyYj+TL0rtoxM6JFBaIBmxu7y77qt1h4eME=,tag:OgKrB3SUgSNJjmtJyrmh/Q==,type:str]
+samba_password: ENC[AES256_GCM,data:UkJLUa2hW1iZ++sfJAcg6G1RJMM=,iv:/HbZ9F+GxCydUP50PNBtJknPlmDWh1DAE26N9FJUyb0=,tag:z1cbwUaVdyfwEIU8LINEcw==,type:str]
 sops:
     age:
         - enc: |
@@ -20,7 +21,7 @@ sops:
             sHjKfw8VrrmAR4pQf1dsY+wcyh4FsZxhP3Q+QIVq3eCIXS9PeJkGAg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
-    lastmodified: "2026-07-24T23:30:39Z"
+    lastmodified: "2026-07-28T20:18:44Z"
-    mac: ENC[AES256_GCM,data:JaBDewUFFEiGnigXsUjAaIEiz1FI6N17pMQT/7qBpA6rtrUoatzjEkl2rpENXuSh0cGI2p328u8tvqDkgel7pGFLY+fYuYgOv6tOSbCgeZM939FrT1P3T4evTcyCUDyAS0NFYEvge83zjW6mula0HY2AsKN1PHaj4XeKLETNvH8=,iv:pBct6RALFuYRUe2EqCSpUPxJ9/7dMt4O2VMZUUjrJks=,tag:UsGTnEbQzp1v8pVb0j2itw==,type:str]
+    mac: ENC[AES256_GCM,data:TRh/Idd8MEq/5QRb7r+g6msdaObtVzsX5hK5gacJI6seZ5BLW5tcBO/E2m8ya4t50lTofxkwObWskMbCOucLDYt+lnYwHSqDvAeQRvswxaCZgiFOn0upqCi8H4OomvIK475SIH6bniyN9bCQ2gaSS0D9aecyCSmdUARkmcZEYLc=,iv:PBoEUZG0QNyj4B0c6zuWr6Y39EdL1CoAsVExU86P6Tw=,tag:NPxsWkxdojXNsoxVVMb5TQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

services/desktop/desktop-apps.nix

@@ -24,16 +24,20 @@ in
     enable = true;
     remotePlay.openFirewall = true;
     dedicatedServer.openFirewall = false;
+    gamescopeSession.enable = true;
+    extraCompatPackages = [ pkgs.proton-ge-bin ];
   };
   hardware.graphics.enable32Bit = true;
 
   environment.systemPackages = with pkgs; [
     alacritty
     zed-editor
-    protonplus
     gitkraken
     jetbrains-toolbox
-    kdePackages.dolphin
+    cosmic-settings-daemon
+    cosmic-settings
+    cosmic-icons
+    cosmic-files
     vivaldi
     rishot
     jq

services/desktop/desktop-hyprland.nix

@@ -1,7 +1,6 @@
 { pkgs, ... }:
 
 # Hyprland (wayland) desktop: compositor, login manager, audio, portals.
-# Reusable for any host that wants a local GUI session (currently: terra).
 {
   programs.hyprland.enable = true;
 
@@ -23,10 +22,10 @@
     pulse.enable = true;
   };
 
-  # Screen-share / file-picker portals for wayland apps.
   xdg.portal = {
     enable = true;
-    extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
+    extraPortals = [ pkgs.xdg-desktop-portal-hyprland pkgs.xdg-desktop-portal-cosmic ];
+    config.common.default = [ "hyprland" "cosmic" ];
   };
 
   hardware.graphics.enable = true;   # OpenGL/Vulkan for the compositor + apps

services/dev/gitea.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 # Gitea — self-hosted git. stateDir/repositories were migrated from the old
 # ZimaOS docker instance straight into stateDir's default layout, so no
@@ -34,10 +34,36 @@
       service = {
         DISABLE_REGISTRATION = true;
       };
+      actions = {
+        ENABLED = true;
+      };
     };
   };
 
   networking.firewall.allowedTCPPorts = [ 2222 ];
 
   users.users.gitea.extraGroups = [ "users" ];
+
+  # Runner instance registered against this same gitea. Jobs run in containers
+  # (podman, via services/containers.nix — already enabled on jupiter), one
+  # image per requested `runs-on` label using the catthehacker act-compatible
+  # images (same ones upstream `act`/Forgejo docs recommend).
+  #
+  # tokenFile points at an env file rendered by sops (TOKEN=<registration
+  # token>, see hosts/jupiter/secrets.nix) rather than a plain `token`, so the
+  # secret never lands in the Nix store. The registration token itself is NOT
+  # generated by this module — it comes from gitea once Actions is enabled:
+  #   su gitea -s /bin/sh -c \
+  #     'GITEA_WORK_DIR=/mnt/data/AppData/gitea gitea actions generate-runner-token'
+  # then written into secrets/jupiter.yaml as gitea_runner_token.
+  services.gitea-actions-runner.instances.jupiter = {
+    enable = true;
+    name = "jupiter";
+    url = "https://git.mgaction.town/";
+    tokenFile = config.sops.templates."gitea-runner.env".path;
+    labels = [
+      "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+      "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+    ];
+  };
 }

services/vpn/tailscale.nix

@@ -5,6 +5,19 @@
 # to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
 # Not for the VM (no sops).
 {
+  # TEMPORARY: nixpkgs bumped tailscale 1.98.8->1.98.9 without updating
+  # vendorHash (NixOS/nixpkgs#545860, fixed on the `release-26.05` branch
+  # 2026-07-26 but not yet promoted to the `nixos-26.05` channel branch this
+  # flake tracks). Remove this override once `nix flake lock --update-input
+  # nixpkgs` picks up a nixos-26.05 rev at/after that fix.
+  nixpkgs.overlays = [
+    (final: prev: {
+      tailscale = prev.tailscale.overrideAttrs (old: {
+        vendorHash = "sha256-Sd2iLJ7eDfDYdIRuW4xuiKgzhQWJWGAnz97FJWrVRlE=";
+      });
+    })
+  ];
+
   services.tailscale = {
     enable = true;
     openFirewall = true;                       # UDP 41641 for direct connections