services.tailscale.openFirewall defaults to false while the NixOS
firewall is enabled, so argon, krypton and neon dropped unsolicited
inbound 41641/udp. Direct connections then only succeed if the other
peer accepts inbound; between two of these hosts (or a host and a
phone) traffic can fall back to a DERP relay.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- increase security by restricting /boot to root only
- add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd
Reviewed-on: #87
Co-authored-by: aaron <aaron@0x29a.ch>
- idle: 300s screen-off, 600s lock, 5s fade, and explicit actions (without them the behaviours do nothing once settings.toml is gone)
- font without Mono, launcher without categories or global emoji, control-center logo from syncthing
- drop shell.ui_scale and shell.panel.launcher_compact, which v5 ignores
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drops the root daemon and the root-equivalent docker group; the daemon settings now apply to the rootless daemon. compose ships with the docker package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Non-obvious context sits in a brief header at the top of a module, everything else uses single-line comments. niri binds use spawn-sh strings, so neon only overrides the command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- argon owns its gpu settings, calibre and the luks drives, now generated from one table
- claudecode.nix is gone, claude-code lives in packages.nix
- home-manager options live next to the home-manager wiring in flake.nix
- settings.nix: one nix block, extra-substituters instead of repeating the cache.nixos.org defaults
- README: current layout
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- packages.nix is the baseline: drop neovim (nixvim), nvd, sof-firmware (enableAllFirmware), qtmultimedia (v4 leftover); vial moves to vial.nix, wl-clipboard to noctalia.nix, claude-code becomes a plain package here
- drop packages and options already provided elsewhere: noctalia (home-manager), gnupg/pinentry-qt (agent), gtk/qt themes, sddm Theme.Current, zsh plugins (home-manager), group = users, empty firewall lists
- single-package lists without `with pkgs;`, steam package inside its block
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It isn't imported by any host and doesn't build reliably on unstable; gnuradio moves to a devenv in the projects that need it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>