fix(certificates): temporarily distrust emSign ECC Root CA - G3

Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hosts/argon/configuration.nix

@@ -10,12 +10,13 @@
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/data-drives.nix
+    ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/greetd.nix
     ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia-greeter.nix
     ../../modules/nixos/noctalia.nix
     ../../modules/nixos/openssh.nix
     ../../modules/nixos/packages.nix

modules/home-manager/git.nix

@@ -24,6 +24,7 @@ in
 
   programs.git = {
     enable = true;
+    lfs.enable = true;
     settings = {
       push.autoSetupRemote = true;
       user = {

modules/home-manager/niri.nix

@@ -42,6 +42,7 @@ in
       input = {
         keyboard = {
           xkb.layout = "ch";
+          xkb.variant = "de_nodeadkeys";
           numlock = { };
         };
         mouse = {

modules/home-manager/noctalia.nix

@@ -70,6 +70,8 @@
           radius = 0;
           scale = 1.2;
           widget_spacing = 20;
+          # no dark gradient on the seam between the bar and attached panels (e.g. control center)
+          contact_shadow = false;
           start = [
             "control-center"
             "cpu"

modules/home-manager/programs.nix

@@ -8,6 +8,7 @@
     fastfetch
     keepassxc
     signal-desktop
+    tea
     teamspeak6-client
     typst
     zathura

modules/home-manager/stylix.nix

@@ -33,6 +33,9 @@
       # the hand-built status line in tmux.nix uses ANSI color names, which
       # already follow the terminal palette
       tmux.enable = false;
+      # rofi isn't used, and the target still sets the renamed
+      # programs.rofi.font, which warns on every evaluation
+      rofi.enable = false;
     };
   };
 }

modules/nixos/certificates.nix

@@ -17,4 +17,9 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }

modules/nixos/docker.nix

@@ -8,7 +8,7 @@
         "1.1.1.1"
         "8.8.8.8"
       ];
-      log-driver = "journald";
+      log-driver = "local";
       registry-mirrors = [ "https://mirror.gcr.io" ];
     };
   };

modules/nixos/noctalia-greeter.nix

@@ -0,0 +1,22 @@
+{
+  # greetd display manager with the graphical noctalia greeter, replaces greetd.nix.
+  # The nixpkgs module enables greetd, accountsservice (avatars) and polkit, and
+  # launches noctalia-greeter-session. Sessions (niri) are discovered from
+  # wayland-sessions, the last one picked is remembered.
+  # See https://docs.noctalia.dev/greeter/
+  services.displayManager.noctalia-greeter = {
+    enable = true;
+
+    # lets the shell's "Sync Now" / auto-sync copy wallpaper, palette and monitor
+    # layout to the greeter without an admin prompt (appearance only)
+    passwordlessSyncUsers = [ "aaron" ];
+
+    # rendered to /var/lib/noctalia-greeter/greeter.toml, wins over synced values
+    settings = {
+      user.default = "aaron";
+      # same layout as niri, otherwise the password is typed on a us keymap
+      keyboard.layout = "ch";
+      keyboard.variant = "de_nodeadkeys";
+    };
+  };
+}

modules/nixos/services.nix

@@ -4,6 +4,10 @@
     tuned.enable = true;
     upower.enable = true;
     fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
   };
 }