feat: add encrypted APOD greeter setup

home-modules/core.nix

@@ -34,6 +34,11 @@
       name = "Adwaita-dark";
       package = pkgs.gnome-themes-extra;
     };
+    font = {
+      name = "Atkinson Hyperlegible Next";
+      package = pkgs.atkinson-hyperlegible-next;
+      size = 11;
+    };
     gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
     gtk4 = {
       theme = config.gtk.theme;

home-modules/desktop.nix

@@ -8,7 +8,10 @@
       color-scheme = "prefer-dark";
       cursor-size = 28;
       cursor-theme = "Adwaita";
+      document-font-name = "Atkinson Hyperlegible Next 11";
       enable-animations = false;
+      font-name = "Atkinson Hyperlegible Next 11";
+      monospace-font-name = "CommitMono Nerd Font 11";
     };
     "org/gtk/gtk4/settings/file-chooser" = {
       show-hidden = true;

home-modules/lib.nix

@@ -6,13 +6,10 @@
 }:
 
 let
+  sshPublicKeys = (import ../ssh-public-keys.nix).jet;
   name = "Jet";
   email = "jet@extremist.software";
   sshSigningKey = "~/.ssh/id_ed25519";
-  sshPublicKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu jet@extremist.software"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPyic30I+SaDw0Lz/EFpMNeHCwxpwPfkgfR6uz3g7io7 jet@corp.primitive.dev"
-  ];
   wrappedOpencode = pkgs.symlinkJoin {
     name = "opencode-wrapped";
     paths = [ pkgs.opencode ];
@@ -157,16 +154,48 @@ let
       state_dir="${config.home.homeDirectory}/.local/state/nasa-apod"
       current_link="$state_dir/current"
       mkdir -p "$state_dir"
-      curl_args=(
+
+      read_api_key_file() {
+        local key_file="$1"
+
+        if [ -r "$key_file" ]; then
+          while IFS= read -r line; do
+            case "$line" in
+              NASA_API_KEY=*)
+                api_key="''${line#NASA_API_KEY=}"
+                ;;
+            esac
+          done < "$key_file"
+        fi
+      }
+
+      api_key="''${NASA_API_KEY:-}"
+      if [ -z "$api_key" ]; then
+        read_api_key_file "''${NASA_API_KEY_FILE:-${config.home.homeDirectory}/.config/nasa-api.env}"
+      fi
+      if [ -z "$api_key" ]; then
+        api_key="DEMO_KEY"
+      fi
+
+      api_curl_args=(
         --fail
         --silent
         --show-error
         --location
-        --retry 30
-        --retry-all-errors
-        --retry-delay 2
+        --connect-timeout 5
+        --max-time 20
+      )
+
+      image_curl_args=(
+        --fail
+        --silent
+        --show-error
+        --location
+        --retry 2
+        --retry-delay 5
+        --retry-max-time 120
         --connect-timeout 10
-        --max-time 300
+        --max-time 60
       )
 
       set_wallpaper() {
@@ -181,18 +210,42 @@ let
         set_wallpaper "$current_link"
       fi
 
-      json="$(curl "''${curl_args[@]}" 'https://api.nasa.gov/planetary/apod?api_key=DEMO_KEY' || true)"
+      today="$(date +%F)"
+      for cached in "$state_dir/apod-$today".*; do
+        if [ -s "$cached" ]; then
+          ln -sfn "$cached" "$current_link"
+          set_wallpaper "$current_link"
+          exit 0
+        fi
+      done
+
+      api_request="$(mktemp)"
+      trap 'rm -f "$api_request"' EXIT
+      {
+        printf '%s\n' 'url = "https://api.nasa.gov/planetary/apod"'
+        printf '%s\n' 'get'
+        printf 'data-urlencode = "api_key=%s"\n' "$api_key"
+        printf '%s\n' 'data-urlencode = "thumbs=True"'
+      } > "$api_request"
+      chmod 0600 "$api_request"
+
+      json="$(curl "''${api_curl_args[@]}" --config "$api_request" || true)"
       if [ -z "$json" ]; then
         exit 0
       fi
 
       media_type="$(printf '%s' "$json" | jq -r '.media_type // empty')"
-
-      if [ "$media_type" != "image" ]; then
-        exit 0
-      fi
-
-      image_url="$(printf '%s' "$json" | jq -r '.hdurl // .url // empty')"
+      case "$media_type" in
+        image)
+          image_url="$(printf '%s' "$json" | jq -r '.hdurl // .url // empty')"
+          ;;
+        video)
+          image_url="$(printf '%s' "$json" | jq -r '.thumbnail_url // empty')"
+          ;;
+        *)
+          exit 0
+          ;;
+      esac
       if [ -z "$image_url" ]; then
         exit 0
       fi
@@ -211,14 +264,16 @@ let
       target="$state_dir/apod-$date_stamp.$ext"
       tmp="$target.tmp"
 
-      if curl "''${curl_args[@]}" "$image_url" -o "$tmp" && [ -s "$tmp" ]; then
-        mv "$tmp" "$target"
-        ln -sfn "$target" "$current_link"
-      else
-        rm -f "$tmp"
+      if [ ! -s "$target" ]; then
+        if curl "''${image_curl_args[@]}" "$image_url" -o "$tmp" && [ -s "$tmp" ]; then
+          mv "$tmp" "$target"
+        else
+          rm -f "$tmp"
+        fi
       fi
 
-      if [ -e "$current_link" ]; then
+      if [ -e "$target" ]; then
+        ln -sfn "$target" "$current_link"
         set_wallpaper "$current_link"
       fi
     '';

home-modules/sway.nix

@@ -3,10 +3,21 @@
   pkgs,
   homeLib,
   hostname,
+  osConfig ? null,
   ...
 }:
 
 let
+  apodSecretEnvironmentFile =
+    if
+      osConfig != null
+      && osConfig ? age
+      && osConfig.age ? secrets
+      && builtins.hasAttr "nasa-api-env" osConfig.age.secrets
+    then
+      "-${osConfig.age.secrets."nasa-api-env".path}"
+    else
+      "-%h/.config/nasa-api.env";
   apodCurrent = "${config.home.homeDirectory}/.local/state/nasa-apod/current";
   swayOutputs = "${config.home.homeDirectory}/.config/sway/outputs";
   lockCommand = pkgs.writeShellScript "sway-lock-apod" ''
@@ -285,6 +296,8 @@ in
     Service = {
       Type = "oneshot";
       ExecStart = "${homeLib.nasaApodWallpaper}/bin/nasa-apod-wallpaper";
+      EnvironmentFile = apodSecretEnvironmentFile;
+      TimeoutStartSec = "3min";
     };
   };