Mirrors the azos-core change: drops the now-fully-migrated
features/{git-config,encryption,printing}, rewrites features/homey-alert
down to just the azos-homey-ntfy-alert overlay package (the ntfy-specific
remote-notification command plugged into azos.send-alert.remoteCommand),
and sets every real personal value (name/email/signing key, GPG key id,
YubiKey/browserpass/gpg-ssh toggles and keygrip/pubkey, printing username)
directly in home-manager/home.nix and nixos/configuration.nix, same place
the other personal values (azos.name, azos.headphones.devices) already
live.
Mirrors the azos-core change -- nixos.desktop already imported in
nixos/configuration.nix, so no new import line needed, just drops the
old homeManager.hfsprogs import.
Mirrors the azos-core change: removes the now-relocated standalone
features from azos/features, and updates both import lists
(home-manager/home.nix, nixos/configuration.nix) to pull the nixos.desktop
and nixos.dev suite modules instead of the old per-feature ones.
Mirrors the azos-core change: station is renamed desktop (its apps are
generically useful on any machine, work included), discord moves to its
own standalone azos/features/discord (personal-only, so it lives in the
azos project rather than azos-core), and azos-emacs-station becomes
azos-emacs-desktop in lauretta's emacs config to match.
- homey-alert: add a global PreToolUse hook that transparently times every
Bash command Claude runs and fires a notification once a command crosses
the configured threshold (default 5 min), without needing the skill to
be invoked manually. Also makes homey-alert always fire a local
notify-send alongside the ntfy push, since the ntfy server isn't always
reachable.
- nextcloud: fix sleep crash-loop under the restricted systemd PATH
(bin/sleep -> coreutils store path).
- azos-core bump (adds ncdu to the base suite).
pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.
Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A failed pass/gpg fetch (e.g. YubiKey not plugged in yet) used to pass
process output straight to string-trim, which signals instead of
returning nil on empty output, aborting the sentinel before
elfeed-feeds or elfeed-protocol-enable ran. That left elfeed-feeds nil
for the rest of the session with no visible error beyond a *Messages*
line, and every later elfeed-update silently had nothing to fetch.
Wrap the fetch in azos/elfeed-protocol-init-feeds so a failed attempt
can be retried interactively instead of requiring a full reload of the
elfeed-protocol feature.
lieer was declared (programs/services.lieer.enable) but had zero real
footprint — mu4e actually fetches via mbsync (mu4e-get-mail-command is
literally "mbsync -a") and sends via msmtp; lieer never had an auth/sync
state file anywhere. Drop it to stop the config suggesting a sync path
that isn't actually in use.
Add a systemd user timer that runs mbsync every 5 minutes. mbsync's
PassCmd shells out to `pass`, which needs the GPG smartcard; on a blind
timer a missing card would otherwise surface as a pinentry "please
insert card" prompt every run. The wrapper script gates the sync behind
`gpg --card-status`, which only queries the reader without invoking
pinentry either way, so a missing card is now a silent no-op instead of
a nag.
Bump azos-core for EDNC popup notifications.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The gpg-agent systemd Environment=INSIDE_EMACS=1 hack never worked:
gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on itself at startup by
design, expecting the variable per-connection from the client instead.
Move it to home.sessionVariables so git/gpg invocations themselves carry
it and forward it to gpg-agent via "OPTION putenv=...", which is what
actually routes a pinentry request to Emacs instead of failing on
curses with no tty.
Bump azos-core for the project-brain-aligned todo/workplate/work-history
skills and the global org-roam Read/Edit permission rules.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gpg-agent may not have a cached passphrase yet when the top-level setq
runs at Emacs startup, so a cold agent makes 'pass' fail silently
(stderr redirected) and leaves lichess-token permanently empty for the
session. Retry the fetch right before each use instead of only once
at startup.
aner