Nix-Vibe Config Improvements

Prioritized from the package/service review (most important first).

Review status (2026-09-01): All 20 items committed to main. nix flake check ✅ — all 8 hosts dry-build ✅. Reviewed against commits f6d68b6…628f1b2.

🔴 Critical — Security & Data Integrity

OpenSSH hardening — verified in f6d68b6 (key-only auth, PermitRootLogin=no).
Samba share security — verified in 0f5065e (authenticated, valid users = petere).
Paperless to Tailscale only — verified in 444705d (firewall on tailscale0 interface).
Immich accelerationDevices — verified in dd15aa2 (explicit /dev/nvidia* nodes).
Jellyfin SSO plugin bind-mount — verified in b8ba00c, improved by 1f712f7. ⚠️ Needs manual Pocket ID config.

🟠 High — Resource Waste / Performance

Jellyfin NVENC acceleration — verified in a4bd8bd.
Nix GC + optimise — verified in dde980e.
Caddy cleanup — verified in df588e7 (unused module deleted).
Formatter dedup — verified in 1ae761a (nixfmt only).
Antigravity dedup — verified in 4e72c58 (removed entirely).

🟡 Medium — Misconfigurations / Robustness

homeserver-1 firewall scoping — verified in bc68837 (Immich→Tailscale).
Laptop hardware module — verified in 83ab88f + fe63013.
borgbackup → Backrest — verified in 75b3c75.
Immich DB peer-auth — ✅ socket auth, no secret needed.
ntfy listen — reverted in 628f1b2 (Docker nginx can't reach host localhost).
Firefox sync pref — verified in 005e421 (removed).
Jellyfin group — explicit jellyfin group (no nobody hack).

🟢 Low — Housekeeping

Flatpak GC — verified in 6d7effd.
VSCode extension pinned — verified in dd7deba.
OnlyOffice fonts — kept activation approach (documented).
Zsh secrets initContent — kept interactive-only (documented).

Remaining manual steps

Jellyfin: configure Pocket ID SSO manually in admin UI.
Firefox Sync: sign in once via browser UI.

Hyprland / QuickShell — bigger projects (deferred from QoL pass)

From the research list (2026 session). The basics (media keys, animations, scratchpad, OSD, clipboard, MPRIS, battery toast, night light, wofi icons/actions) are done. These are the larger items parked for later:

Notification center — replaced mako with QuickShell native NotificationServer (toasts, history, DND, clear, actions/buttons). mako config + autostart fully removed. v2 options: per-app rules, inline replies.
Workspace overview — QuickShell-native "mission control" (no plugin): fullscreen scrim, one card per workspace with window titles + active/focused highlight, click or keyboard jump (arrows/enter, 1-9 direct), SUPER+W → qs ipc call ws toggle. Implemented in quickshell-shell.qml (titles via root Hyprland.toplevels filtered by workspace id — HyprlandWorkspace .toplevels doesn't exist in this build). ⚠️ hyprspace (live thumbnails) parked: hyprlandPlugins.hyprspace at the pinned nixpkgs FAILS TO BUILD (src/Globals.hpp:15: AnimationManager.hpp: no such file — hyprland source moved the header; nixpkgs package lags) and is not in the binary cache. Revisit after a nixpkgs bump. (hyprbars/hyprtrails also parked — hyprtrails isn't packaged.)
Calendar + weather popup on clock click (SUPER+CTRL+C) — month-grid + Nextcloud CalDAV events + 3-day Open-Meteo forecast in a single QuickShell PanelWindow. Implemented in quickshell-shell.qml (header with month navigation, 6×7 GridView calendar, agenda list, weather row with location editor). Data pipeline: HM user service qs-cal-sync → vdirsyncer (CalDAV) + khal (--json) + Open-Meteo API → caches in ~/.cache/quickshell-cal/. Script: quickshell-cal.py (stdlib only), module: quickshell-cal.nix. Secrets: hp-laptop/nextcloud-cal-env in SOPS (NEXTCLOUD_CALDAV_URL/USERNAME/PASSWORD — user must fill via sops edit secrets.yaml). IPC: qs ipc call cal toggle/refresh/state.
Wallpaper picker widget — thumbnail grid from ~/Pictures/wallpapers, click → hyprctl swap, persist choice to state file. ~half day.
QuickShell lock screen replacing hyprlock — WlSessionLock + PAM. Decision (2026-09-11): NOT implementing — keep hyprlock. Its PAM service, fingerprint support and the hypridle/lid loginctl lock-session chain are battle-tested and already themed to match the shell; a QuickShell lock would rebuild the auth stack for visual gain only. Reopen only if hyprlock is ever dropped as a dependency.
Lid close: lock then suspend (always, resume needs password) — fixed in modules/desktop/hyprland.nix: HandleLidSwitchExternalPower was ignore so a plugged-in lid close did nothing. Now suspend on battery and external power; hypridle's before_sleep_cmd = loginctl lock-session locks (hyprlock) before logind sleeps, so reopening the lid resumes to a locked screen. Docked keeps logind's ignore default. 5-min idle lock + 15-min suspend unchanged.
Bluetooth management — QuickShell bluetooth popup mirroring the wifi netPopup pattern: status-bar BT icon, power toggle, paired/known device list, connect/disconnect/pair/trust. Backend: enable hardware.bluetooth (desktops — currently disabled on ALL hosts) + a qs-bt helper over bluetoothctl/bluez D-Bus (same pattern as qs-wall/qs-cal.py), IPC qs ipc call bt toggle. Implemented: hardware.bluetooth + bluez polkit rule in modules/desktop/gui.nix, backend qs-bt (home-manager/modules/quickshell-bt.py), QML popup (PanelWindow qs-bt layer, FocusGrab), bt status icon, IPC qs ipc call bt {toggle,state,power,scan}.

Rice backlog — Hyprland/QuickShell improvement list (#1–#10)

Recovered from the 2026 rice session (persisted here after being lost twice).

#1 Wallpaper-driven palette + theme switcher — matugen-based shared palette unifying QML theme, wvkbd, wofi, hyprlock, kitty; wallpaper-picker PALETTE button regenerates the theme (qs-theme).
#2 Hyprland blur/shadow/animated borders — gradient active_border, shadow, borderangle animation loop in hyprland.nix.
#3 System-stats chip + flake badge — qs-stats probe (lm_sensors), CPU/RAM/swap/disk/temps/load popup, flake.lock rev/date badge injected at build time, copy command.
#4 Dynamic island bar — floating centered island pill, tucked-up when hidden, peek on hover, event reveal (workspace/notification/media) + 10s auto-retract.
#5 Now-playing + battery info in hyprlock — show MPRIS track + battery percentage on the lock screen.
#6 Visual monitor manager — ARandR-style hyprctl front-end (rotate/scale/arrange monitors from a GUI). ⏸️ On hold until the laptop is connected to multiple monitors so it can be tested properly.
#7 OSD scroll-wheel on bar chips — scroll the volume chip to nudge PipeWire volume (5% steps, OSD tracks it); new brightness chip scrolls brightnessctl (5% steps) with the neon OSD, click opens quick settings. Shell-scope shellBrightProbe/shellBrightSet (throttled, 30s refresh) keep chip/OSD/slider in sync. ⚠️ Partially tested on x1carbon — two-finger touchpad scroll works; still needs verification with a real scroll wheel before fully relying on it.
#8 Caffeine/idle-inhibit toggle — already implemented as the keep-awake IdleInhibitor badge (Hyprland) + Caffeine extension (GNOME).
#9 Emoji picker + calculator in launcher — qs-launch wofi modes: SUPER+SHIFT+E emoji picker (curated 295-emoji list, copies to clipboard), SUPER+SHIFT+C calculator (qalc eval, copies result + toast), SUPER+SHIFT+D DuckDuckGo search (opens in browser).
#10 Screenshot → bar toast with copy — qs-shot (Print opens a wofi area/full-screen chooser, SUPER+SHIFT+S/SUPER+SHIFT+R capture directly): grimblast copysave → toast with image thumbnail + OPEN/COPY action buttons (intercepted in calNotifAction by shot-open:/shot-copy: identifiers; also shown in the notification center history).

Edit / delete events — click an agenda entry to edit title/time/location or delete it; syncs back to Nextcloud like add does. Backend edit/delete modes rewrite the .ics (summary/location/alarms/RRULE) and push via vdirsyncer; shell form gains EDIT EVENT mode with a DELETE button. Mutations rescan local stores immediately (refresh_local_cache) so the popup reflects them without waiting for the next timed sync.
Recurring events on creation — "repeat daily/weekly/monthly" (RRULE options) in the NEW EVENT form. Backend add takes repeat; edit preserves and can change an existing RRULE. Recurring events also scan/expand natively (no khal) via icalendar + recurring_ical_events.
Clickable + snoozeable reminders — click a reminder toast to jump to the event popup; add a snooze action on the notification. The remind notifier encodes payloads in the action identifiers (cal-open:<date> opens the popup at that day, cal-snooze:<key> delays the reminder 10 min via snoozes.json); both toasts and the notification center route action clicks through calNotifAction. Notifications are now -t 0 (persist in center).
Sync failure indicator — subtle badge in the calendar header when the last sync or event add fails. Backend writes sync.json (ok/lastOk/ lastEffort/error) on every sync/push; the shell shows a danger "!" badge with a hover tooltip of the error and click-to-refresh.
Weather upgrade — hourly temps, precipitation chance, wind, more forecast days. Backend Open-Meteo fetch now pulls 24 hourly rows (temp/code/ precip%/wind) and a 7-day daily forecast (plus precip% + max wind); the shell renders a today-hourly strip and a compact 7-day grid (was 3).

10 KiB Raw Blame History Unescape Escape