feat: add encrypted APOD greeter setup

feat: new graphical greeter
fix: remove broken fullscreen setting
2026-05-06 10:46:11 -07:00 · 2026-05-06 09:40:37 -07:00 · 2026-05-06 09:35:17 -07:00 · 2026-05-06 09:15:09 -07:00 · 2026-05-06 09:15:03 -07:00 · 2026-05-05 16:52:37 -07:00
14 changed files with 1077 additions and 192 deletions
--- a/configuration.nix
+++ b/configuration.nix
@ -1,5 +1,180 @@
 { config, pkgs, ... }:

+let
+  greetdApodDir = "/var/lib/greetd/apod";
+  greetdApodCurrent = "${greetdApodDir}/current";
+  swaySession = pkgs.writeTextDir "share/wayland-sessions/sway.desktop" ''
+    [Desktop Entry]
+    Name=Sway
+    Comment=An i3-compatible Wayland compositor
+    Exec=${config.programs.sway.package}/bin/sway
+    Type=Application
+    DesktopNames=sway
+  '';
+  regreetPasswordPrompt = pkgs.regreet.overrideAttrs (oldAttrs: {
+    postPatch = (oldAttrs.postPatch or "") + ''
+      substituteInPlace src/gui/model.rs \
+        --replace-fail $'        } else {\n            let username = if let Some(username) = self.get_current_username() {' \
+                       $'        } else if self.sys_util.get_sessions().len() == 1 {\n            let (session, sess_info) = self.sys_util.get_sessions().iter().next().expect("one session");\n            info!("No session selected; using only available session: {session}");\n            (Some(session.to_string()), Some(sess_info.clone()))\n        } else {\n            let username = if let Some(username) = self.get_current_username() {'
+
+      substituteInPlace src/gui/component.rs \
+        --replace-fail $'        // Set the default behaviour of pressing the Return key to act like the login button.\n        root.set_default_widget(Some(&widgets.ui.login_button));\n\n        AsyncComponentParts { model, widgets }' \
+                       $'        // Set the default behaviour of pressing the Return key to act like the login button.\n        root.set_default_widget(Some(&widgets.ui.login_button));\n\n        // Immediately start authentication so the password entry appears and receives focus.\n        sender.input(Self::Input::Login {\n            input: String::new(),\n            info: UserSessInfo::extract(\n                &widgets.ui.usernames_box,\n                &widgets.ui.username_entry,\n                &widgets.ui.sessions_box,\n                &widgets.ui.session_entry,\n            ),\n        });\n\n        AsyncComponentParts { model, widgets }'
+    '';
+  });
+  regreetState = pkgs.writeText "regreet-state.toml" ''
+    last_user = "jet"
+
+    [user_to_last_sess]
+    jet = "Sway"
+  '';
+  fetchGreetdApod = pkgs.writeShellApplication {
+    name = "greetd-apod-wallpaper";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.curl
+      pkgs.jq
+    ];
+    text = ''
+      set -euo pipefail
+
+      state_dir="${greetdApodDir}"
+      current_link="${greetdApodCurrent}"
+      user_current="/home/jet/.local/state/nasa-apod/current"
+      mkdir -p "$state_dir"
+      chmod 0755 "$state_dir"
+
+      install_current() {
+        local source="$1"
+        local target="$2"
+
+        if [ -s "$source" ]; then
+          cp --dereference --force "$source" "$target"
+          chmod 0644 "$target"
+          ln -sfn "$target" "$current_link"
+        fi
+      }
+
+      if [ ! -e "$current_link" ] && [ -e "$user_current" ]; then
+        install_current "$user_current" "$state_dir/bootstrap"
+      fi
+
+      read_api_key_file() {
+        local key_file="$1"
+
+        if [ -r "$key_file" ]; then
+          while IFS= read -r line; do
+            case "$line" in
+              NASA_API_KEY=*)
+                api_key="''${line#NASA_API_KEY=}"
+                ;;
+            esac
+          done < "$key_file"
+        fi
+      }
+
+      api_key="''${NASA_API_KEY:-}"
+      if [ -z "$api_key" ]; then
+        read_api_key_file "''${NASA_API_KEY_FILE:-/home/jet/.config/nasa-api.env}"
+      fi
+      if [ -z "$api_key" ]; then
+        read_api_key_file /etc/nasa-api.env
+      fi
+      if [ -z "$api_key" ]; then
+        api_key="DEMO_KEY"
+      fi
+
+      today="$(date +%F)"
+      for cached in "$state_dir/apod-$today".*; do
+        if [ -s "$cached" ]; then
+          ln -sfn "$cached" "$current_link"
+          exit 0
+        fi
+      done
+
+      api_curl_args=(
+        --fail
+        --silent
+        --show-error
+        --location
+        --connect-timeout 5
+        --max-time 20
+      )
+
+      image_curl_args=(
+        --fail
+        --silent
+        --show-error
+        --location
+        --retry 2
+        --retry-delay 5
+        --retry-max-time 120
+        --connect-timeout 10
+        --max-time 60
+      )
+
+      api_request="$(mktemp)"
+      trap 'rm -f "$api_request"' EXIT
+      {
+        printf '%s\n' 'url = "https://api.nasa.gov/planetary/apod"'
+        printf '%s\n' 'get'
+        printf 'data-urlencode = "api_key=%s"\n' "$api_key"
+        printf '%s\n' 'data-urlencode = "thumbs=True"'
+      } > "$api_request"
+      chmod 0600 "$api_request"
+
+      json="$(curl "''${api_curl_args[@]}" --config "$api_request" || true)"
+      if [ -z "$json" ]; then
+        exit 0
+      fi
+
+      media_type="$(printf '%s' "$json" | jq -r '.media_type // empty')"
+      case "$media_type" in
+        image)
+          image_url="$(printf '%s' "$json" | jq -r '.hdurl // .url // empty')"
+          ;;
+        video)
+          image_url="$(printf '%s' "$json" | jq -r '.thumbnail_url // empty')"
+          ;;
+        *)
+          exit 0
+          ;;
+      esac
+      if [ -z "$image_url" ]; then
+        exit 0
+      fi
+
+      ext="''${image_url##*.}"
+      ext="''${ext%%\?*}"
+      case "$ext" in
+        jpg|jpeg|png|webp) ;;
+        *) ext="jpg" ;;
+      esac
+
+      date_stamp="$(printf '%s' "$json" | jq -r '.date // empty')"
+      if [ -z "$date_stamp" ]; then
+        date_stamp="$(date +%F)"
+      fi
+
+      target="$state_dir/apod-$date_stamp.$ext"
+      tmp="$target.tmp"
+
+      if [ ! -s "$target" ]; then
+        if curl "''${image_curl_args[@]}" "$image_url" -o "$tmp" && [ -s "$tmp" ]; then
+          mv "$tmp" "$target"
+          chmod 0644 "$target"
+        else
+          rm -f "$tmp"
+        fi
+      fi
+
+      if [ -e "$target" ]; then
+        ln -sfn "$target" "$current_link"
+      fi
+    '';
+  };
+in
+
 {
  boot.loader.systemd-boot.enable = true;
  boot.loader.systemd-boot.configurationLimit = 3;
@ -20,6 +195,7 @@
      };
    };
  };
+  services.blueman.enable = true;

  networking.networkmanager.enable = true;
  networking.networkmanager.settings = {
@ -141,13 +317,14 @@
  # Codex currently probes the conventional FHS bubblewrap path.
  systemd.tmpfiles.rules = [
    "L+ /usr/bin/bwrap - - - - ${pkgs.bubblewrap}/bin/bwrap"
+    "d ${greetdApodDir} 0755 root root -"
  ];

  # Set Ghostty as default terminal
  xdg.terminal-exec = {
    enable = true;
    settings = {
-      default = [ "ghostty.desktop" ];
+      default = [ "com.mitchellh.ghostty.desktop" ];
    };
  };

@ -155,32 +332,107 @@

  virtualisation.docker.enable = true;

-  services.displayManager.gdm.enable = true;
-  services.desktopManager.gnome.enable = true;
-  services.gnome.sushi.enable = true;
+  programs.sway = {
+    enable = true;
+    wrapperFeatures.gtk = true;
+  };

-  # Remove default GNOME apps (keeping loupe and file-roller)
-  environment.gnome.excludePackages = with pkgs; [
-    epiphany # GNOME Web
-    gnome-calculator
-    gnome-calendar
-    gnome-characters
-    gnome-clocks
-    gnome-connections
-    gnome-console
-    gnome-contacts
-    gnome-maps
-    gnome-music
-    gnome-weather
-    gnome-text-editor
-    simple-scan
-    totem # Videos (have VLC)
-    yelp # Help docs
-    evince # PDF viewer (using Zen Browser)
-    geary # Email
-    gnome-tour
-    gnome-font-viewer # Have font-manager
+  services.greetd = {
+    enable = true;
+    settings.default_session = {
+      command = "env GTK_USE_PORTAL=0 GDK_DEBUG=no-portals SESSION_DIRS=/run/current-system/sw/share/wayland-sessions XDG_DATA_DIRS=/run/current-system/sw/share ${pkgs.dbus}/bin/dbus-run-session ${pkgs.cage}/bin/cage -s -d -- ${config.programs.regreet.package}/bin/regreet";
+      user = "greeter";
+    };
+  };
+
+  programs.regreet = {
+    enable = true;
+    package = regreetPasswordPrompt;
+    font = {
+      package = pkgs.atkinson-hyperlegible-next;
+      name = "Atkinson Hyperlegible Next";
+      size = 16;
+    };
+    settings = {
+      background = {
+        path = greetdApodCurrent;
+        fit = "Cover";
+      };
+      GTK.application_prefer_dark_theme = true;
+      appearance.greeting_msg = "Welcome back";
+      widget.clock = {
+        format = "%a %b %d  %I:%M %p";
+        resolution = "1s";
+      };
+    };
+  };
+
+  services.accounts-daemon.enable = true;
+
+  age = {
+    identityPaths = [ "/home/jet/.ssh/id_ed25519" ];
+    secrets.nasa-api-env = {
+      file = ./secrets/nasa-api.env.age;
+      owner = "jet";
+      group = "users";
+      mode = "0400";
+    };
+  };
+
+  system.activationScripts.regreetDefaultSession.text = ''
+    ${pkgs.coreutils}/bin/install -D -m 0644 ${regreetState} /var/lib/regreet/state.toml
+    chown greeter:greeter /var/lib/regreet/state.toml
+  '';
+
+  fonts = {
+    packages = [
+      pkgs.atkinson-hyperlegible-next
+      pkgs.nerd-fonts.commit-mono
    ];
+    fontconfig.defaultFonts = {
+      sansSerif = [ "Atkinson Hyperlegible Next" ];
+      serif = [ "Atkinson Hyperlegible Next" ];
+      monospace = [ "CommitMono Nerd Font" ];
+    };
+  };
+
+  systemd.services.greetd-apod-wallpaper = {
+    description = "Fetch NASA APOD wallpaper for greetd";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${fetchGreetdApod}/bin/greetd-apod-wallpaper";
+      EnvironmentFile = "-${config.age.secrets.nasa-api-env.path}";
+      TimeoutStartSec = "3min";
+    };
+  };
+
+  systemd.timers.greetd-apod-wallpaper = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "30s";
+      OnCalendar = "hourly";
+      Persistent = true;
+      Unit = "greetd-apod-wallpaper.service";
+    };
+  };
+
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    config.common.default = [
+      "wlr"
+      "gtk"
+    ];
+    extraPortals = with pkgs; [ xdg-desktop-portal-gtk ];
+  };
+
+  programs.dconf.enable = true;
+  services.gvfs.enable = true;
+  services.udisks2.enable = true;
+  security.polkit.enable = true;
+  security.pam.services.swaylock = { };

  services.printing.enable = true;

@ -288,9 +540,11 @@
    docker
    docker-compose
    flatpak
+    swaySession
    wget
    nh
  ];
+  environment.pathsToLink = [ "/share/wayland-sessions" ];

  programs.steam.enable = true;
  programs.nix-index-database.comma.enable = true;
--- a/flake.lock
+++ b/flake.lock
@ -1,5 +1,50 @@
 {
  "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
    "flake-compat": {
      "flake": false,
      "locked": {
@ -16,6 +61,21 @@
        "type": "github"
      }
    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@ -40,18 +100,18 @@
    "ghostty": {
      "inputs": {
        "flake-compat": "flake-compat",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
        "nixpkgs": "nixpkgs",
-        "systems": "systems",
+        "systems": "systems_2",
        "zig": "zig",
        "zon2nix": "zon2nix"
      },
      "locked": {
-        "lastModified": 1777322026,
-        "narHash": "sha256-HHHgWuBssEBMfV5hOFdFxp0WUXiwfl20NfkjU/ZNuC8=",
+        "lastModified": 1777971579,
+        "narHash": "sha256-9XQugqNfZ/s1CIbws5WL5vHuEAd9ZaOaEmWVXPWUs3A=",
        "owner": "ghostty-org",
        "repo": "ghostty",
-        "rev": "6590196661f769dd8f2b3e85d6c98262c4ec5b3b",
+        "rev": "f9a9d33b3a40a95ba01cfbc0f89586567932a22b",
        "type": "github"
      },
      "original": {
@ -67,11 +127,11 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1776999445,
-        "narHash": "sha256-vu2S5gnSTS4aDz25mr4yCrKh9sspPVlgD5KQQVHA4AM=",
+        "lastModified": 1777776915,
+        "narHash": "sha256-okg6j5wIwTZmdrNhB1TOxpyLtJN9/fV6qXobWGpp+Y8=",
        "owner": "helix-editor",
        "repo": "helix",
-        "rev": "3beb268068d23294a26b47eab43b0a13a2a3a951",
+        "rev": "87d5c05c4432a079d3b7aaa10cda1cfe1803c18c",
        "type": "github"
      },
      "original": {
@ -82,6 +142,27 @@
      }
    },
    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
      "inputs": {
        "nixpkgs": [
          "ghostty",
@ -102,18 +183,18 @@
        "type": "github"
      }
    },
-    "home-manager_2": {
+    "home-manager_3": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1777476904,
-        "narHash": "sha256-EeLoE8n4+QCbteyAsYXxhfr97RFfWL1ga0xwfL6lpKw=",
+        "lastModified": 1778009629,
+        "narHash": "sha256-nUoQtf4Zq7DRYJrfv904hjrxjAlWVP6a1pNNFKx3FCg=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "8c8e5389e75a36bee53920de8ee24f017b3ae03e",
+        "rev": "00ed86e58bb6979a7921859fd1615d19382eac5c",
        "type": "github"
      },
      "original": {
@ -122,7 +203,7 @@
        "type": "github"
      }
    },
-    "home-manager_3": {
+    "home-manager_4": {
      "inputs": {
        "nixpkgs": [
          "zen-browser",
@ -150,11 +231,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777181277,
-        "narHash": "sha256-yVJbd07ortDRAttDFmDV5p220aOLTHgVAx//0nW/xW8=",
+        "lastModified": 1777787189,
+        "narHash": "sha256-2KUbS/HhzWW3kkkY1+RiWj9mJ76VEXw8lBJzcCFKzfY=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "b8eb7acee0f7604fe1bf6a5b3dcf5254369180fa",
+        "rev": "2dea2b920e7127b3afa8506713f23536651de312",
        "type": "github"
      },
      "original": {
@ -165,11 +246,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1776983936,
-        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
+        "lastModified": 1777917524,
+        "narHash": "sha256-k+LVe9YaO2BEPB9AaCtTtOMCeGi4dxDo6gt4Un3qoPY=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
+        "rev": "df7783100babf59001340a7a874ba3824e441ecb",
        "type": "github"
      },
      "original": {
@ -209,11 +290,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
        "type": "github"
      },
      "original": {
@ -239,6 +320,22 @@
        "type": "github"
      }
    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nur": {
      "inputs": {
        "flake-parts": "flake-parts",
@ -247,11 +344,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777487505,
-        "narHash": "sha256-yQHSwgvchnCOadkqfHfhWjVydkrEygelnepvP290jSw=",
+        "lastModified": 1778079488,
+        "narHash": "sha256-U1PhEC22cJVLFnBjkQWhEqIYhSOWDeOogdxZHQrMpbo=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "7d72ac6ab71033702f8d607a25a8dcbf59e9a6d0",
+        "rev": "2f38e20a84d12e411e699583d263cffc9d8d8563",
        "type": "github"
      },
      "original": {
@ -265,11 +362,11 @@
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1777489904,
-        "narHash": "sha256-B9OPOkakuwJyMrN3rx/E5Kq1yEIKyS4vpiSot/EGhvg=",
+        "lastModified": 1778080414,
+        "narHash": "sha256-I3tfq8Rh+RUwnmGMypnkFoprlB1E6rm/y9yEiqsNF4c=",
        "owner": "anomalyco",
        "repo": "opencode",
-        "rev": "293877cb7e60610b4b0c25992dbab2169c6f614e",
+        "rev": "b9b854bf9f206e5c1c85cfd15d128bb3d0966e58",
        "type": "github"
      },
      "original": {
@ -281,14 +378,16 @@
    },
    "root": {
      "inputs": {
+        "agenix": "agenix",
        "ghostty": "ghostty",
        "helix": "helix",
-        "home-manager": "home-manager_2",
+        "home-manager": "home-manager_3",
        "nix-index-database": "nix-index-database",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_3",
        "nur": "nur",
        "opencode": "opencode",
+        "t3code": "t3code",
        "zen-browser": "zen-browser"
      }
    },
@ -314,6 +413,21 @@
      }
    },
    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
      "flake": false,
      "locked": {
        "lastModified": 1681028828,
@ -329,19 +443,38 @@
        "type": "github"
      }
    },
+    "t3code": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1777991278,
+        "narHash": "sha256-tM0JFurV6BwOdmBcGi96th/dzgN9KQbkK7FKmdsM5Zo=",
+        "owner": "jetpham",
+        "repo": "nix-t3code",
+        "rev": "47257aeb62d037a0550294ec17698f59c4297444",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jetpham",
+        "repo": "nix-t3code",
+        "type": "github"
+      }
+    },
    "zen-browser": {
      "inputs": {
-        "home-manager": "home-manager_3",
+        "home-manager": "home-manager_4",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1777484394,
-        "narHash": "sha256-03QK/lM/m4f1FjC4ldYtp8NobTGRdwGC24XBY6Vcdqo=",
+        "lastModified": 1778047595,
+        "narHash": "sha256-RquiPUl5fViU+hHRjilVcy+5XUowINmvMfk2lNdIAg8=",
        "owner": "0xc000022070",
        "repo": "zen-browser-flake",
-        "rev": "274e039947393bc90f45b8fc6d1af23e45937af0",
+        "rev": "e361aeff090333c005bc12b3bcf3c8b44d867a4f",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -10,6 +10,7 @@
    opencode = {
      url = "github:anomalyco/opencode/dev";
    };
+    t3code.url = "github:jetpham/nix-t3code";
    nixos-hardware.url = "github:NixOS/nixos-hardware";
    zen-browser = {
      url = "github:0xc000022070/zen-browser-flake";
@ -19,6 +20,10 @@
      url = "github:nix-community/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    nur = {
      url = "github:nix-community/NUR";
      inputs.nixpkgs.follows = "nixpkgs";
@ -43,6 +48,7 @@
            nixos-hardware.nixosModules.framework-amd-ai-300-series
            home-manager.nixosModules.home-manager
            inputs.nix-index-database.nixosModules.default
+            inputs.agenix.nixosModules.default
            {
              home-manager.useGlobalPkgs = true;
              home-manager.useUserPackages = true;
@ -83,6 +89,7 @@
        pkgs.mkShell {
          packages = [
            pkgs.nh
+            inputs.agenix.packages.x86_64-linux.default
            nhs
          ];
        };
--- a/home-modules/browser.nix
+++ b/home-modules/browser.nix
@ -36,8 +36,47 @@
      isDefault = true;
      settings = {
        "identity.fxaccounts.enabled" = false;
+        "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
        "ui.prefersReducedMotion" = 1;
+        "zen.theme.border-radius" = 0;
+        "zen.theme.content-element-separation" = 0;
+        "zen.view.compact.show-sidebar-and-toolbar-on-hover" = true;
      };
+      userChrome = ''
+        @-moz-document url("chrome://browser/content/browser.xhtml") {
+          @media -moz-pref("zen.view.compact.hide-toolbar") {
+            :root[zen-compact-mode="true"]:not([customizing]):not([inDOMFullscreen="true"]):not([zen-single-toolbar="true"])
+              #zen-appcontent-navbar-wrapper:not([has-popup-menu]):not([zen-compact-mode-active]) {
+              pointer-events: none !important;
+            }
+
+            :root[zen-compact-mode="true"]:not([customizing]):not([inDOMFullscreen="true"]):not([zen-single-toolbar="true"])
+              #zen-appcontent-navbar-wrapper[zen-has-hover]:not([has-popup-menu]):not([zen-compact-mode-active]) {
+              height: var(--zen-element-separation) !important;
+              overflow: clip !important;
+            }
+
+            :root[zen-compact-mode="true"]:not([customizing]):not([inDOMFullscreen="true"]):not([zen-single-toolbar="true"])
+              #zen-appcontent-navbar-wrapper[zen-has-hover]:not([has-popup-menu]):not([zen-compact-mode-active])
+              #urlbar:not([breakout-extend="true"]) {
+              opacity: 0 !important;
+              pointer-events: none !important;
+            }
+
+            :root[zen-compact-mode="true"]:not([customizing]):not([inDOMFullscreen="true"]):not([zen-single-toolbar="true"])
+              #zen-appcontent-navbar-wrapper[zen-has-hover]:not([has-popup-menu]):not([zen-compact-mode-active])
+              #zen-appcontent-navbar-container {
+              opacity: 0 !important;
+            }
+
+            :root[zen-compact-mode="true"]:not([customizing]):not([inDOMFullscreen="true"]):not([zen-single-toolbar="true"])
+              #zen-appcontent-navbar-wrapper[zen-has-hover]:not([has-popup-menu]):not([zen-compact-mode-active])
+              .titlebar-buttonbox-container {
+              max-height: 0 !important;
+            }
+          }
+        }
+      '';
      extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
        ublock-origin
        onepassword-password-manager
@ -50,6 +89,7 @@
        pay-by-privacy
        translate-web-pages
        user-agent-string-switcher
+        wappalyzer
        copy-selected-tabs-to-clipboard
        dearrow
        violentmonkey
--- a/home-modules/core.nix
+++ b/home-modules/core.nix
@ -1,4 +1,9 @@
-{ config, inputs, ... }:
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:

 {
  imports = [ inputs.zen-browser.homeModules.default ];
@ -8,8 +13,14 @@
  home.stateVersion = "25.05";

  home.sessionVariables = {
-    BROWSER = "zen";
+    BROWSER = "${pkgs.xdg-utils}/bin/xdg-open";
+    GH_BROWSER = "${pkgs.xdg-utils}/bin/xdg-open";
+    GIT_BROWSER = "${pkgs.xdg-utils}/bin/xdg-open";
+    MOZ_ENABLE_WAYLAND = "1";
+    NIXOS_OZONE_WL = "1";
    TERMINAL = "ghostty";
+    XCURSOR_SIZE = "28";
+    XCURSOR_THEME = "Adwaita";
  };

  xdg.userDirs = {
@ -19,7 +30,27 @@

  gtk = {
    enable = true;
-    gtk4.theme = config.gtk.theme;
+    theme = {
+      name = "Adwaita-dark";
+      package = pkgs.gnome-themes-extra;
+    };
+    font = {
+      name = "Atkinson Hyperlegible Next";
+      package = pkgs.atkinson-hyperlegible-next;
+      size = 11;
+    };
    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
+    gtk4 = {
+      theme = config.gtk.theme;
+      extraConfig.gtk-application-prefer-dark-theme = 1;
+    };
+  };
+
+  home.pointerCursor = {
+    gtk.enable = true;
+    x11.enable = true;
+    name = "Adwaita";
+    package = pkgs.adwaita-icon-theme;
+    size = 28;
  };
 }
--- a/home-modules/default.nix
+++ b/home-modules/default.nix
@ -10,6 +10,7 @@
    ./terminal.nix
    ./browser.nix
    ./desktop.nix
+    ./sway.nix
    ./opencode.nix
  ];
 }
--- a/home-modules/desktop.nix
+++ b/home-modules/desktop.nix
@ -1,30 +1,4 @@
-{
-  pkgs,
-  homeLib,
-  hostname,
-  ...
-}:
-
-let
-  autostartEntries =
-    if hostname == "framework-work" then
-      [
-        "${homeLib.zenStartup}/share/applications/zen-startup.desktop"
-        "${homeLib.ghosttyZellijStartup}/share/applications/ghostty-zellij-startup.desktop"
-        "${pkgs.slack}/share/applications/slack.desktop"
-        "${homeLib.betterbirdStartup}/share/applications/betterbird-startup.desktop"
-      ]
-    else
-      [
-        "${homeLib.zenStartup}/share/applications/zen-startup.desktop"
-        "${homeLib.ghosttyZellijStartup}/share/applications/ghostty-zellij-startup.desktop"
-        "${homeLib.signalStartup}/share/applications/signal-startup.desktop"
-        "${pkgs.slack}/share/applications/slack.desktop"
-        "${homeLib.betterbirdStartup}/share/applications/betterbird-startup.desktop"
-        "${homeLib.vesktopStartup}/share/applications/vesktop-startup.desktop"
-        "${homeLib.zulipStartup}/share/applications/zulip-startup.desktop"
-      ];
-in
+{ homeLib, ... }:

 {
  dconf.settings = {
@ -32,14 +6,12 @@ in
      clock-format = "12h";
      clock-show-weekday = true;
      color-scheme = "prefer-dark";
+      cursor-size = 28;
+      cursor-theme = "Adwaita";
+      document-font-name = "Atkinson Hyperlegible Next 11";
      enable-animations = false;
-      enable-hot-corners = false;
-    };
-    "org/gnome/system/location" = {
-      enabled = true;
-    };
-    "org/gnome/settings-daemon/plugins/power" = {
-      sleep-inactive-ac-type = "nothing";
+      font-name = "Atkinson Hyperlegible Next 11";
+      monospace-font-name = "CommitMono Nerd Font 11";
    };
    "org/gtk/gtk4/settings/file-chooser" = {
      show-hidden = true;
@ -48,20 +20,6 @@ in
      clock-format = "12h";
      show-hidden = true;
    };
-    "org/gnome/desktop/peripherals/touchpad" = {
-      disable-while-typing = false;
-    };
-    "org/gnome/shell" = {
-      disable-user-extensions = false;
-      enabled-extensions = [
-        "hidetopbar@mathieu.bidon.ca"
-        "wifiqrcode@glerro.pm.me"
-        "system-monitor@paradoxxx.zero.gmail.com"
-        "clipboard-indicator@tudmotu.com"
-        "emoji-copy@felipeftn"
-        "tailscale-gnome-qs@tailscale-qs.github.io"
-      ];
-    };
  };

  xdg.desktopEntries.extract-here = {
@ -85,37 +43,27 @@ in
    noDisplay = true;
  };

-  xdg.autostart = {
-    enable = true;
-    entries = autostartEntries;
+  xdg.desktopEntries.betterbird = {
+    name = "Betterbird";
+    comment = "Mail, RSS and newsgroups client";
+    exec = "${homeLib.betterbirdLauncher}/bin/betterbird-profile %u";
+    icon = "betterbird";
+    terminal = false;
+    type = "Application";
+    categories = [
+      "Network"
+      "Email"
+    ];
+    mimeType = [
+      "x-scheme-handler/mailto"
+      "message/rfc822"
+      "x-scheme-handler/webcal"
+      "x-scheme-handler/webcals"
+    ];
+    settings = {
+      StartupNotify = "false";
+      StartupWMClass = "eu.betterbird.Betterbird";
    };
-
-  home.file.".local/share/gnome-shell/extensions/tailscale-gnome-qs@tailscale-qs.github.io" = {
-    source = "${homeLib.tailscaleQsExtension}/share/gnome-shell/extensions/tailscale-gnome-qs@tailscale-qs.github.io";
-    recursive = true;
-  };
-
-  systemd.user.services.nasa-apod-wallpaper = {
-    Unit = {
-      Description = "Fetch NASA APOD wallpaper";
-      After = [ "graphical-session.target" ];
-      PartOf = [ "graphical-session.target" ];
-    };
-    Service = {
-      Type = "oneshot";
-      ExecStart = "${homeLib.nasaApodWallpaper}/bin/nasa-apod-wallpaper";
-    };
-  };
-
-  systemd.user.timers.nasa-apod-wallpaper = {
-    Unit.Description = "Refresh NASA APOD wallpaper regularly";
-    Timer = {
-      OnStartupSec = "2m";
-      OnCalendar = "hourly";
-      Persistent = true;
-      Unit = "nasa-apod-wallpaper.service";
-    };
-    Install.WantedBy = [ "timers.target" ];
  };

  xdg.mimeApps = {
--- a/home-modules/lib.nix
+++ b/home-modules/lib.nix
@ -6,27 +6,10 @@
 }:

 let
+  sshPublicKeys = (import ../ssh-public-keys.nix).jet;
  name = "Jet";
  email = "jet@extremist.software";
  sshSigningKey = "~/.ssh/id_ed25519";
-  sshPublicKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu jet@extremist.software"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPyic30I+SaDw0Lz/EFpMNeHCwxpwPfkgfR6uz3g7io7 jet@corp.primitive.dev"
-  ];
-  tailscaleQsExtension = pkgs.stdenvNoCC.mkDerivation {
-    pname = "tailscale-gnome-qs";
-    version = "5";
-    src = pkgs.fetchzip {
-      url = "https://github.com/tailscale-qs/tailscale-gnome-qs/archive/refs/tags/v5.tar.gz";
-      sha256 = "0b9jy8pyxvpkxf3adlwq42kii14jn5g7xyxggjzg87pb5jg4zfg2";
-    };
-    dontBuild = true;
-    installPhase = ''
-      mkdir -p "$out/share/gnome-shell/extensions"
-      cp -r "$src/tailscale-gnome-qs@tailscale-qs.github.io" \
-        "$out/share/gnome-shell/extensions/tailscale-gnome-qs@tailscale-qs.github.io"
-    '';
-  };
  wrappedOpencode = pkgs.symlinkJoin {
    name = "opencode-wrapped";
    paths = [ pkgs.opencode ];
@ -42,7 +25,7 @@ let
    rev = "4ae5198fb82fe28d7b452796152f2b1745051c77";
    hash = "sha256-NvDd3BSVeS10kYupLxo27VlKeeHPHrxyTb8EdVqrtQw=";
  };
-  betterbird = pkgs.stdenvNoCC.mkDerivation rec {
+  betterbird = pkgs.stdenv.mkDerivation rec {
    pname = "betterbird";
    version = "140.10.0esr-bb21";

@ -51,7 +34,52 @@ let
      hash = "sha256-Uh55xWn/cjoIutX2xdM/jUWw9c2As8P4fefK5KQtbQo=";
    };

-    nativeBuildInputs = [ pkgs.makeWrapper ];
+    nativeBuildInputs = [
+      pkgs.autoPatchelfHook
+      pkgs.makeWrapper
+      pkgs.patchelfUnstable
+      pkgs.wrapGAppsHook3
+    ];
+
+    # Mozilla binaries use relrhack, which breaks if patchelf clobbers sections.
+    patchelfFlags = [ "--no-clobber-old-sections" ];
+
+    buildInputs = with pkgs; [
+      alsa-lib
+      atk
+      cairo
+      cups
+      dbus-glib
+      gdk-pixbuf
+      glib
+      gtk3
+      libGL
+      libdrm
+      libnotify
+      libpulseaudio
+      libstartup_notification
+      libva
+      libxkbcommon
+      mesa
+      nspr
+      nss
+      pango
+      pciutils
+      udev
+      libice
+      libsm
+      libx11
+      libxcomposite
+      libxcursor
+      libxdamage
+      libxext
+      libxfixes
+      libxi
+      libxrandr
+      libxrender
+      libxt
+      libxtst
+    ];

    sourceRoot = ".";

@ -63,6 +91,9 @@ let

      ln -s "$out/lib/betterbird/betterbird" "$out/bin/betterbird"

+      gappsWrapperArgs+=(--argv0 "$out/bin/.betterbird-wrapped")
+      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${pkgs.lib.makeLibraryPath buildInputs}")
+
      if [ -d "$out/lib/betterbird/chrome/icons/default" ]; then
        mkdir -p "$out/share/icons/hicolor/128x128/apps"
        cp "$out/lib/betterbird/chrome/icons/default/default128.png" "$out/share/icons/hicolor/128x128/apps/betterbird.png"
@ -79,7 +110,8 @@ let
      Icon=betterbird
      Categories=Network;Email;
      MimeType=x-scheme-handler/mailto;message/rfc822;x-scheme-handler/webcal;x-scheme-handler/webcals;
-      StartupNotify=true
+      StartupNotify=false
+      StartupWMClass=eu.betterbird.Betterbird
      EOF

      runHook postInstall
@ -93,13 +125,28 @@ let
      platforms = [ "x86_64-linux" ];
    };
  };
+  betterbirdLauncher = pkgs.writeShellApplication {
+    name = "betterbird-profile";
+    text = ''
+      set -euo pipefail
+
+      profile_root="''${HOME:-${config.home.homeDirectory}}/.thunderbird"
+      profile="$profile_root/betterbird-current"
+
+      if [ -d "$profile" ]; then
+        exec ${betterbird}/bin/betterbird --profile "$profile" "$@"
+      fi
+
+      exec ${betterbird}/bin/betterbird "$@"
+    '';
+  };
  nasaApodWallpaper = pkgs.writeShellApplication {
    name = "nasa-apod-wallpaper";
    runtimeInputs = [
      pkgs.coreutils
      pkgs.curl
-      pkgs.glib
      pkgs.jq
+      pkgs.sway
    ];
    text = ''
      set -euo pipefail
@ -107,38 +154,98 @@ let
      state_dir="${config.home.homeDirectory}/.local/state/nasa-apod"
      current_link="$state_dir/current"
      mkdir -p "$state_dir"
-      curl_args=(
+
+      read_api_key_file() {
+        local key_file="$1"
+
+        if [ -r "$key_file" ]; then
+          while IFS= read -r line; do
+            case "$line" in
+              NASA_API_KEY=*)
+                api_key="''${line#NASA_API_KEY=}"
+                ;;
+            esac
+          done < "$key_file"
+        fi
+      }
+
+      api_key="''${NASA_API_KEY:-}"
+      if [ -z "$api_key" ]; then
+        read_api_key_file "''${NASA_API_KEY_FILE:-${config.home.homeDirectory}/.config/nasa-api.env}"
+      fi
+      if [ -z "$api_key" ]; then
+        api_key="DEMO_KEY"
+      fi
+
+      api_curl_args=(
        --fail
        --silent
        --show-error
        --location
-        --retry 30
-        --retry-all-errors
-        --retry-delay 2
+        --connect-timeout 5
+        --max-time 20
+      )
+
+      image_curl_args=(
+        --fail
+        --silent
+        --show-error
+        --location
+        --retry 2
+        --retry-delay 5
+        --retry-max-time 120
        --connect-timeout 10
-        --max-time 300
+        --max-time 60
      )

      set_wallpaper() {
        local target="$1"

-        gsettings set org.gnome.desktop.background picture-uri "file://$target"
-        gsettings set org.gnome.desktop.background picture-uri-dark "file://$target"
-        gsettings set org.gnome.desktop.background picture-options 'zoom'
+        if [ -n "''${SWAYSOCK:-}" ] && [ -n "''${WAYLAND_DISPLAY:-}" ]; then
+          swaymsg output "*" bg "$target" fill >/dev/null
+        fi
      }

-      json="$(curl "''${curl_args[@]}" 'https://api.nasa.gov/planetary/apod?api_key=DEMO_KEY' || true)"
+      if [ -e "$current_link" ]; then
+        set_wallpaper "$current_link"
+      fi
+
+      today="$(date +%F)"
+      for cached in "$state_dir/apod-$today".*; do
+        if [ -s "$cached" ]; then
+          ln -sfn "$cached" "$current_link"
+          set_wallpaper "$current_link"
+          exit 0
+        fi
+      done
+
+      api_request="$(mktemp)"
+      trap 'rm -f "$api_request"' EXIT
+      {
+        printf '%s\n' 'url = "https://api.nasa.gov/planetary/apod"'
+        printf '%s\n' 'get'
+        printf 'data-urlencode = "api_key=%s"\n' "$api_key"
+        printf '%s\n' 'data-urlencode = "thumbs=True"'
+      } > "$api_request"
+      chmod 0600 "$api_request"
+
+      json="$(curl "''${api_curl_args[@]}" --config "$api_request" || true)"
      if [ -z "$json" ]; then
        exit 0
      fi

      media_type="$(printf '%s' "$json" | jq -r '.media_type // empty')"
-
-      if [ "$media_type" != "image" ]; then
-        exit 0
-      fi
-
+      case "$media_type" in
+        image)
          image_url="$(printf '%s' "$json" | jq -r '.hdurl // .url // empty')"
+          ;;
+        video)
+          image_url="$(printf '%s' "$json" | jq -r '.thumbnail_url // empty')"
+          ;;
+        *)
+          exit 0
+          ;;
+      esac
      if [ -z "$image_url" ]; then
        exit 0
      fi
@ -157,13 +264,18 @@ let
      target="$state_dir/apod-$date_stamp.$ext"
      tmp="$target.tmp"

-      if curl "''${curl_args[@]}" "$image_url" -o "$tmp" && [ -s "$tmp" ]; then
+      if [ ! -s "$target" ]; then
+        if curl "''${image_curl_args[@]}" "$image_url" -o "$tmp" && [ -s "$tmp" ]; then
          mv "$tmp" "$target"
-        ln -sfn "$target" "$current_link"
-        set_wallpaper "$target"
        else
          rm -f "$tmp"
        fi
+      fi
+
+      if [ -e "$target" ]; then
+        ln -sfn "$target" "$current_link"
+        set_wallpaper "$current_link"
+      fi
    '';
  };
  zellijNewTabZoxide = pkgs.writeShellApplication {
@ -343,7 +455,7 @@ let
    name = "betterbird-startup";
    desktopName = "Betterbird Startup";
    comment = "Launch Betterbird in fullscreen";
-    exec = "${betterbird}/bin/betterbird";
+    exec = "${betterbirdLauncher}/bin/betterbird-profile";
    terminal = false;
    noDisplay = true;
    categories = [ "Network" ];
@ -363,6 +475,7 @@ in
    inherit
      betterbirdStartup
      betterbird
+      betterbirdLauncher
      email
      ghosttyZellijStartup
      greptileSkills
@ -371,7 +484,6 @@ in
      signalStartup
      sshPublicKeys
      sshSigningKey
-      tailscaleQsExtension
      wrappedOpencode
      zenStartup
      zellijNewTabZoxide
--- a/home-modules/packages.nix
+++ b/home-modules/packages.nix
@ -1,4 +1,9 @@
-{ pkgs, homeLib, ... }:
+{
+  inputs,
+  pkgs,
+  homeLib,
+  ...
+}:

 {
  home.packages = with pkgs; [
@ -8,6 +13,7 @@
    codex
    ffmpeg-full
    homeLib.wrappedOpencode
+    inputs.t3code.packages.${pkgs.stdenv.hostPlatform.system}.t3code-nightly
    skills
    homeLib.zellijNewTabZoxide
    homeLib.zellijSyncTabName
@ -55,13 +61,25 @@
    linphone
    lmstudio
    homeLib.betterbird
+    blueman
+    brightnessctl
+    cliphist
+    fuzzel
+    grim
+    mako
+    nautilus
+    networkmanagerapplet
+    nwg-displays
+    playerctl
+    polkit_gnome
+    slurp
+    swaybg
+    swayidle
+    swaylock
+    waybar
+    wl-clipboard
+    xdg-utils

    nerd-fonts.commit-mono
-
-    gnomeExtensions.clipboard-indicator
-    gnomeExtensions.emoji-copy
-    gnomeExtensions.hide-top-bar
-    gnomeExtensions.system-monitor-next
-    gnomeExtensions.wifi-qrcode
  ];
 }
--- a/home-modules/sway.nix
+++ b/home-modules/sway.nix
@ -0,0 +1,321 @@
+{
+  config,
+  pkgs,
+  homeLib,
+  hostname,
+  osConfig ? null,
+  ...
+}:
+
+let
+  apodSecretEnvironmentFile =
+    if
+      osConfig != null
+      && osConfig ? age
+      && osConfig.age ? secrets
+      && builtins.hasAttr "nasa-api-env" osConfig.age.secrets
+    then
+      "-${osConfig.age.secrets."nasa-api-env".path}"
+    else
+      "-%h/.config/nasa-api.env";
+  apodCurrent = "${config.home.homeDirectory}/.local/state/nasa-apod/current";
+  swayOutputs = "${config.home.homeDirectory}/.config/sway/outputs";
+  lockCommand = pkgs.writeShellScript "sway-lock-apod" ''
+    set -euo pipefail
+
+    if [ -e "${apodCurrent}" ]; then
+      exec ${pkgs.swaylock}/bin/swaylock -f -i "${apodCurrent}" -s fill --color 000000
+    fi
+
+    exec ${pkgs.swaylock}/bin/swaylock -f --color 000000
+  '';
+  screenshotCommand = pkgs.writeShellScript "sway-screenshot" ''
+    set -euo pipefail
+
+    dir="$HOME/Pictures/Screenshots"
+    ${pkgs.coreutils}/bin/mkdir -p "$dir"
+    file="$dir/screenshot-$(${pkgs.coreutils}/bin/date +%Y%m%d-%H%M%S).png"
+
+    if geometry="$(${pkgs.slurp}/bin/slurp)"; then
+      ${pkgs.grim}/bin/grim -g "$geometry" "$file"
+      ${pkgs.wl-clipboard}/bin/wl-copy < "$file"
+    fi
+  '';
+  cliphistCommand = pkgs.writeShellScript "cliphist-fuzzel" ''
+    set -euo pipefail
+
+    ${pkgs.cliphist}/bin/cliphist list | ${pkgs.fuzzel}/bin/fuzzel --dmenu | ${pkgs.cliphist}/bin/cliphist decode | ${pkgs.wl-clipboard}/bin/wl-copy
+  '';
+  commonStartup = [
+    "${homeLib.nasaApodWallpaper}/bin/nasa-apod-wallpaper"
+    "${pkgs.waybar}/bin/waybar"
+    "${pkgs.mako}/bin/mako"
+    "${pkgs.networkmanagerapplet}/bin/nm-applet --indicator"
+    "${pkgs.blueman}/bin/blueman-applet"
+    "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"
+    "${pkgs.wl-clipboard}/bin/wl-paste --type text --watch ${pkgs.cliphist}/bin/cliphist store"
+    "${pkgs.wl-clipboard}/bin/wl-paste --type image --watch ${pkgs.cliphist}/bin/cliphist store"
+    "${pkgs.swayidle}/bin/swayidle -w timeout 300 '${lockCommand}' before-sleep '${lockCommand}'"
+  ];
+  workStartup = [
+    "${config.programs.zen-browser.package}/bin/zen-beta"
+    "${pkgs.ghostty}/bin/ghostty --fullscreen=true -e ${homeLib.zellijPersistentSession}/bin/zellij-persistent-session"
+    "${pkgs.slack}/bin/slack"
+    "${homeLib.betterbirdLauncher}/bin/betterbird-profile"
+  ];
+  personalStartup = [
+    "${config.programs.zen-browser.package}/bin/zen-beta"
+    "${pkgs.ghostty}/bin/ghostty --fullscreen=true -e ${homeLib.zellijPersistentSession}/bin/zellij-persistent-session"
+    "${pkgs.vesktop}/bin/vesktop --start-fullscreen"
+    "${homeLib.betterbirdLauncher}/bin/betterbird-profile"
+    "${pkgs.signal-desktop}/bin/signal-desktop --start-fullscreen"
+    "${pkgs.zulip}/bin/zulip --start-fullscreen"
+  ];
+  appStartup = if hostname == "framework-work" then workStartup else personalStartup;
+in
+
+{
+  wayland.windowManager.sway = {
+    enable = true;
+    systemd.enable = true;
+    wrapperFeatures.gtk = true;
+    config = null;
+    extraConfig = ''
+      set $mod Mod4
+
+      exec ${pkgs.dbus}/bin/dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway SWAYSOCK
+      exec ${pkgs.systemd}/bin/systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK
+
+      default_border none
+      default_floating_border none
+      hide_edge_borders both
+      gaps inner 0
+      gaps outer 0
+      smart_gaps off
+      focus_follows_mouse no
+      seat seat0 xcursor_theme Adwaita 28
+
+      input type:touchpad {
+        tap enabled
+        natural_scroll enabled
+        dwt disabled
+      }
+
+      include ${swayOutputs}
+      output * bg #000000 solid_color
+
+      bindsym $mod+d exec ${pkgs.fuzzel}/bin/fuzzel
+      bindsym $mod+p exec ${pkgs.nwg-displays}/bin/nwg-displays
+      bindsym $mod+b exec ${pkgs.procps}/bin/pkill -SIGUSR1 waybar
+      bindsym $mod+l exec ${lockCommand}
+      bindsym $mod+Shift+e exec ${pkgs.sway}/bin/swaymsg exit
+      bindsym $mod+Shift+r reload
+      bindsym $mod+Shift+q kill
+      bindsym $mod+f fullscreen toggle
+      bindsym $mod+c exec ${cliphistCommand}
+      bindsym Print exec ${screenshotCommand}
+      bindsym Sys_Req exec ${screenshotCommand}
+      bindsym $mod+Print exec ${screenshotCommand}
+
+      bindsym $mod+h focus left
+      bindsym $mod+j focus down
+      bindsym $mod+k focus up
+      bindsym $mod+Left focus left
+      bindsym $mod+Down focus down
+      bindsym $mod+Up focus up
+      bindsym $mod+Right focus right
+
+      bindsym XF86AudioMute exec ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
+      bindsym XF86AudioLowerVolume exec ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-
+      bindsym XF86AudioRaiseVolume exec ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+
+      bindsym XF86AudioPlay exec ${pkgs.playerctl}/bin/playerctl play-pause
+      bindsym XF86MonBrightnessDown exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-
+      bindsym XF86MonBrightnessUp exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%+
+
+      bindsym $mod+1 workspace number 1
+      bindsym $mod+2 workspace number 2
+      bindsym $mod+3 workspace number 3
+      bindsym $mod+4 workspace number 4
+      bindsym $mod+5 workspace number 5
+      bindsym $mod+6 workspace number 6
+      bindsym $mod+7 workspace number 7
+      bindsym $mod+8 workspace number 8
+      bindsym $mod+9 workspace number 9
+      bindsym $mod+0 workspace number 10
+
+      bindsym $mod+Shift+1 move container to workspace number 1
+      bindsym $mod+Shift+2 move container to workspace number 2
+      bindsym $mod+Shift+3 move container to workspace number 3
+      bindsym $mod+Shift+4 move container to workspace number 4
+      bindsym $mod+Shift+5 move container to workspace number 5
+      bindsym $mod+Shift+6 move container to workspace number 6
+      bindsym $mod+Shift+7 move container to workspace number 7
+      bindsym $mod+Shift+8 move container to workspace number 8
+      bindsym $mod+Shift+9 move container to workspace number 9
+      bindsym $mod+Shift+0 move container to workspace number 10
+
+      for_window [app_id="zen"] move to workspace number 1, fullscreen enable
+      for_window [app_id="zen-beta"] move to workspace number 1, fullscreen enable
+      for_window [class="zen-beta"] move to workspace number 1, fullscreen enable
+      for_window [app_id="com.mitchellh.ghostty"] move to workspace number 2, fullscreen enable
+      for_window [class="Slack"] move to workspace number 3, fullscreen enable
+      for_window [app_id="slack"] move to workspace number 3, fullscreen enable
+      for_window [app_id="Slack"] move to workspace number 3, fullscreen enable
+      for_window [app_id="dev.vencord.Vesktop"] move to workspace number 3, fullscreen enable
+      for_window [app_id="vesktop"] move to workspace number 3, fullscreen enable
+      for_window [class="Betterbird"] move to workspace number 4, fullscreen enable
+      for_window [class="eu.betterbird.Betterbird"] move to workspace number 4, fullscreen enable
+      for_window [app_id="betterbird"] move to workspace number 4, fullscreen enable
+      for_window [app_id="Betterbird"] move to workspace number 4, fullscreen enable
+      for_window [class="Signal"] move to workspace number 5, fullscreen enable
+      for_window [app_id="signal"] move to workspace number 5, fullscreen enable
+      for_window [app_id="signal-desktop"] move to workspace number 5, fullscreen enable
+      for_window [class="Zulip"] move to workspace number 6, fullscreen enable
+      for_window [app_id="org.zulip.Zulip"] move to workspace number 6, fullscreen enable
+
+      ${pkgs.lib.concatMapStringsSep "\n" (command: "exec ${command}") commonStartup}
+      ${pkgs.lib.concatMapStringsSep "\n" (command: "exec ${command}") appStartup}
+    '';
+  };
+
+  programs.waybar = {
+    enable = true;
+    settings.mainBar = {
+      layer = "top";
+      position = "top";
+      mode = "hide";
+      start_hidden = true;
+      modules-left = [ ];
+      modules-center = [ "clock" ];
+      modules-right = [
+        "tray"
+        "network"
+        "bluetooth"
+        "wireplumber"
+        "battery"
+      ];
+      clock = {
+        format = "{:%a %b %d  %I:%M %p}";
+        tooltip-format = "{:%Y-%m-%d}";
+      };
+      network = {
+        format-wifi = "wifi {essid}";
+        format-disconnected = "wifi disconnected";
+        tooltip-format-wifi = "{ifname}: {ipaddr}";
+      };
+      bluetooth = {
+        format = "bt on";
+        format-disabled = "bt off";
+        format-off = "bt off";
+        format-connected = "bt {device_alias}";
+      };
+      wireplumber = {
+        format = "vol {volume}%";
+        format-muted = "muted";
+      };
+      battery = {
+        format = "bat {capacity}%";
+        format-charging = "chg {capacity}%";
+        format-plugged = "ac {capacity}%";
+        states.warning = 25;
+        states.critical = 10;
+      };
+      tray.spacing = 8;
+    };
+    style = ''
+      * {
+        border: none;
+        border-radius: 0;
+        font-family: "CommitMono Nerd Font", monospace;
+        font-size: 12px;
+        min-height: 0;
+      }
+
+      window#waybar {
+        background: #0d1117;
+        color: #f0f6fc;
+      }
+
+      #clock,
+      #tray,
+      #network,
+      #bluetooth,
+      #wireplumber,
+      #battery {
+        padding: 2px 8px;
+      }
+
+      #battery.warning {
+        color: #d29922;
+      }
+
+      #battery.critical,
+      #network.disconnected,
+      #wireplumber.muted {
+        color: #f85149;
+      }
+    '';
+  };
+
+  services.mako = {
+    enable = true;
+    settings = {
+      background-color = "#0d1117";
+      text-color = "#f0f6fc";
+      border-color = "#30363d";
+      border-radius = 0;
+      default-timeout = 5000;
+    };
+  };
+
+  programs.fuzzel = {
+    enable = true;
+    settings = {
+      main = {
+        font = "CommitMono Nerd Font:size=12";
+        terminal = "ghostty";
+      };
+      colors = {
+        background = "0d1117ff";
+        text = "f0f6fcff";
+        match = "3fb950ff";
+        selection = "238636ff";
+        selection-text = "ffffffff";
+        border = "30363dff";
+      };
+      border.radius = 0;
+    };
+  };
+
+  systemd.user.services.nasa-apod-wallpaper = {
+    Unit = {
+      Description = "Fetch NASA APOD wallpaper";
+      After = [ "graphical-session.target" ];
+      PartOf = [ "graphical-session.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = "${homeLib.nasaApodWallpaper}/bin/nasa-apod-wallpaper";
+      EnvironmentFile = apodSecretEnvironmentFile;
+      TimeoutStartSec = "3min";
+    };
+  };
+
+  systemd.user.timers.nasa-apod-wallpaper = {
+    Unit.Description = "Refresh NASA APOD wallpaper regularly";
+    Timer = {
+      OnStartupSec = "2m";
+      OnCalendar = "hourly";
+      Persistent = true;
+      Unit = "nasa-apod-wallpaper.service";
+    };
+    Install.WantedBy = [ "timers.target" ];
+  };
+
+  home.activation.ensureSwayOutputs = config.lib.dag.entryAfter [ "writeBoundary" ] ''
+    $DRY_RUN_CMD mkdir -p ${config.home.homeDirectory}/.config/sway
+    if [ ! -e ${swayOutputs} ]; then
+      $DRY_RUN_CMD touch ${swayOutputs}
+    fi
+  '';
+}
--- a/home-modules/terminal.nix
+++ b/home-modules/terminal.nix
@ -76,7 +76,7 @@
    };
  };

-  xdg.desktopEntries.ghostty = {
+  xdg.desktopEntries."com.mitchellh.ghostty" = {
    name = "Ghostty";
    genericName = "Terminal Emulator";
    exec = "${pkgs.ghostty}/bin/ghostty --fullscreen=true -e ${homeLib.zellijPersistentSession}/bin/zellij-persistent-session";
--- a/secrets/nasa-api.env.age
+++ b/secrets/nasa-api.env.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ziw7aw +DWaSJE/UkXo6jnXZMElPreAbfHtMdzd2kxTlPUMPTc
+2I0jH1tG73LcRLO6UvxSOMD3T0XKKfXjuZCXhKGypFc
+-> ssh-ed25519 LB5l3A qNcgWT2QN4NSpehI2ku+2+NKLS0Q93/D3Taqjd4+mFQ
+rEKPREqfGWXoZAuYeEkR1pMtc+/0JTqaTDL+My7jnWM
+--- 1dVemchD/oaHJR0aeje1CTps9NahLLivBSfvQhqPJWQ
+¹#<EFBFBD>«>h9–qð’Ás¯Ëç¿ÎwiM—îùüÅnûz0›o÷UMžÚÙRŠ 4dùVp°ÙúPÌkÔx_
åû<EFBFBD>gß"±WãÍNu„º¿
TA½ân
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -0,0 +1,7 @@
+let
+  sshPublicKeys = import ../ssh-public-keys.nix;
+in
+
+{
+  "secrets/nasa-api.env.age".publicKeys = sshPublicKeys.jet;
+}
--- a/ssh-public-keys.nix
+++ b/ssh-public-keys.nix
@ -0,0 +1,6 @@
+{
+  jet = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu jet@extremist.software"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPyic30I+SaDw0Lz/EFpMNeHCwxpwPfkgfR6uz3g7io7 jet@corp.primitive.dev"
+  ];
+}
Author	SHA1	Message	Date
Jet	767677a7e8	feat: add encrypted APOD greeter setup	2026-05-06 10:46:11 -07:00
Jet	49b64efd9e	feat: new graphical greeter	2026-05-06 09:40:37 -07:00
Jet	c14e84e5a1	fix: remove broken fullscreen setting	2026-05-06 09:35:17 -07:00
Jet	00462e4d0c	feat: disable top bar in zen	2026-05-06 09:15:09 -07:00
Jet	ea31a17879	update: nfu	2026-05-06 09:15:03 -07:00
Jet	66f6356ea9	update: nfu	2026-05-05 16:52:37 -07:00
Jet	d47b060ffd	feat: make zen fullscreen	2026-05-05 16:51:28 -07:00
Jet	e8bdd48716	feat: add t3 code properly	2026-05-04 15:20:44 -07:00
Jet	5322b4f924	feat: use mouse mode	2026-05-04 12:24:10 -07:00
Jet	7ded7216a1	update: nfu	2026-05-04 11:45:58 -07:00
Jet	7da82701df	fix: reuse betterbird profile	2026-05-03 18:33:42 -07:00
Jet	8e225f5d82	fix: resize sway cursor	2026-05-03 18:10:20 -07:00
Jet	867287b2c2	fix: tune sway cursor and touchpad	2026-05-03 18:03:45 -07:00
Jet	2c8ff25308	fix: improve sway browser integration	2026-05-03 17:59:58 -07:00
Jet	18f4e3e3b3	fix: restore dark mode in sway	2026-05-03 17:15:49 -07:00
Jet	1423db9ed7	feat: replace gnome with sway	2026-05-03 16:24:50 -07:00
Jet	aa340efc79	update: nfu	2026-05-03 14:29:44 -07:00
Jet	bd159f52ad	update: nfu	2026-05-02 16:28:24 -07:00
Jet	6b42a4c38a	fix: betterbird	2026-05-01 19:18:22 -07:00
Jet	a2e3c2ca5a	feat: add wapalizer	2026-05-01 16:41:58 -07:00
Jet	d428675961	fix: betterbird	2026-05-01 16:41:41 -07:00
Jet	e4cc6323b4	update: nfu	2026-05-01 13:04:56 -07:00
Jet	3a1fb8271b	update: nfu	2026-04-30 18:58:41 -07:00
Jet	f862cd93f2	update: nfu	2026-04-30 14:09:42 -07:00
Jet	dc54cd64c2	feat: use raw ghostty launcher	2026-04-30 14:09:11 -07:00
Jet	8b45b61f1c	update: nfu teJJ: Change ID: zwlwtqkp	2026-04-30 09:51:12 -07:00