Changelog

Changelog

All notable changes to this project will be documented in this file.

[3.2.0] - 2026-06-18

Added

  • mpv Samillion config: Replaced entire mpv configuration with Samillion/mpv-conf, adapted for Linux + NVIDIA Pascal. Includes ModernZ OSC (fluent icons, right-click context menu), custom scripts (boxtowide, pause_indicator_lite, pip_lite, ytdlautoformat), complete input.conf keybindings, and auto-profiles for media/streams/images/PiP.
  • mpv jellyfin external mode: system.userActivationScripts patches conf.json to force mpv_ext=true + mpv_ext_no_ovr=true so jellyfin-mpv-shim spawns mpv-with-scripts instead of bare libmpv. Full config tree mirrored into jellyfin-mpv-shim config dir.
  • fcitx5 mellow-sakura-dark theme: Added fcitx5-mellow-themes to addons, switched from default-dark to mellow-sakura-dark (cherry blossom pink accents, rounded SVG design).
  • docs/media.md: Comprehensive mpv reference covering architecture, hardware config, auto-profiles, keybindings, jellyfin integration, fonts, and Linux adaptations.

Changed

  • mpv scripts: uosc → modernz, sponsorblock → sponsorblock-minimal, removed quality-menu. Added fonts.packages = [pkgs.roboto] for ModernZ OSC text. Persisted ~/.cache/mpv for watch-later resume and thumbfast thumbnails.
  • fcitx5: Disabled KDE Input Method Panel (kimpanel) to fix theme inconsistency — Qt apps used classicui while Wayland text-input-v3 apps rendered via kimpanel (different themes).
  • Browser migration: Replaced LibreWolf with Firefox across all hosts, modules, themes, scripts, and docs. LibreWolf marked insecure in nixpkgs (151.0.2-1). All extensions, profiles, Betterfox hardening, and CSS themes preserved. Profile dir: ~/.local/user/.mozilla/firefox/ (fakeHome) or ~/.config/firefox/ (native).

Fixed

  • bootspec: Removed deprecated boot.bootspec.enable from workstation.nix and portable.nix — bootspec is now always generated.
  • agent-of-empires: Dropped the agent-of-empires flake input and replaced aoe package with pkgs.aider-chat-full.

[3.1.0] - 2026-06-12

Added

  • Restic backups: Added a reusable Restic backup service configuration supporting QNAP NAS mounts with optimized performance flags (actimeo=60, etc.) and systemd unit ordering.
  • Declarative Zotero and Calibre integration: Added declarative Zotero profile configuration, hybrid sync integration, and systemd path watchers to dynamically reload calibre-server on Syncthing library updates.
  • CI Secret provisioning: Integrated restic-password.age, wireless.pskFile.age for bio-smart, and restructured CI secrets.
  • Nix access-token Agenix support: Integrated optional !include path loading for decrypted access-tokens.conf secrets in default.nix, protecting private GitHub personal access tokens from public git repositories while bypassing GitHub API rate limits.
  • Modular App Themes: Split modules/themes/apps.nix into specialized files under modules/themes/apps/ (browsers.nix, terminals.nix, shell.nix, desktop.nix, editors.nix, media.nix), automatically autoloaded and cleanly structured as standard NixOS modules.

Changed

  • Pristine Theme Presets: Moved loose theme presets (alucard, autumnal, catppuccin) from boilerplate subfolders to unified single Nix files under modules/themes/presets/, fully autoloaded by the root loader.
  • Autoloaded Desktop Themes: Converted window manager theme modules (bspwm.nix, hyprland.nix, niri.nix) into standard autoloaded NixOS modules, removing the manual import logic and deleting the .noload file entirely.

Fixed

  • SSH Client config: Fixed system-wide SSH config omission by removing invalid pathExists guards from git.nix and agenix.nix that failed under pure flake evaluation.
  • Nix Cache build: Resolved PATH and SSH key credential dependencies for the nix-cache-build service so it can fetch the private nix-secrets repository.
  • R Package compilation: Excluded arrow from R packages list to fix R 4.6.0 compile failure.
  • Rofi Powermenu Iteration Bug: Resolved a Zsh array iteration bug and off-by-one indexing error in config/rofi/bin/powermenu.zsh.
  • Window Manager Hook Dispatchers: Implemented robust Zsh-native compositor hook dispatchers for bspwm, hypr, and niri.
  • System Builder Circular Dependency: Refactored lib/nixos.nix with lib.evalModules using a pre-evaluated static hey configuration, safely resolving eager circular dependencies and imports evaluation errors.

Docs

  • CHANGELOG version restructuring: Replaced all [Unreleased] headers with proper semver tags mapped from git tag dates. Cleaned duplicate content in web-services.md. Pruned refactor-plan.md to remaining TODOs only. Added all 18 missing doc entries to AGENTS.md Key Subsystems table.

[3.0.0] - 2026-06-10

Changed

  • Flake inputs: Updated nixpkgs-unstable, home-manager, srvos, lanzaboote, microvm, llm-agents, emacs-overlay, nix-vscode-extensions, and other inputs to latest revisions.

[2.0.0] - 2026-06-02

Added

  • Neovim AstroNvim v6: Replaced inline Lua config with AstroNvim v6 + lazy.nvim (63 plugins). catppuccin-mocha theme, 17 LSP servers via astrolsp, blink.cmp completion, 14 astrocommunity language packs. All tools provided by Nix (Mason disabled).
  • VS Code Extensions: Added 30+ extensions across all VS Code family editors (VS Code, Cursor, Kiro, Antigravity) covering Go, Java, Kotlin, Ruby, PHP, Lua, Zig, Julia, Haskell, OCaml, Scala, Clojure, Elixir, Dart/Flutter, C#, PowerShell, Kubernetes, Helm, Terraform, Docker, SQL, and bioinformatics.
  • Neovim LSP/DAP/Formatters: Added kotlin_language_server, ruby_lsp, zls, lua_ls, jdtls, ruff, nvim-dap-go + delve, google-java-format, ktfmt, rubocop, sql-formatter.
  • Bubblewrap Sandbox: Added mkBwrapWrapper helper in lib/pkgs.nix for sandboxing GUI applications with bubblewrap (filesystem isolation, /proc hiding, namespace unsharing).
  • Rockchip Kernel: Upgraded vendor kernel from Linux 6.14 to Linux 7.0 with Armbian rockchip64-edge patches.
  • Documentation: Added docs/editors.md, docs/neovim.md, docs/sbc-opi5p.md, docs/security-hardening.md.

Changed

  • Telegram: Switched from telegram-desktop to ayugram-desktop (ghost mode, message scheduling, enhanced proxy).
  • Sandboxing: Applied mkBwrapWrapper to WeChat, QQ, WeMeet, Zoom, Discord, and AyuGram Telegram.
  • VS Code Family Refactor: Extracted duplicated extension lists into shared commonExtensions in default.nix.
  • AI Tools: Replaced GitHub Copilot, Codeium, and Continue with Qwen Code IDE companion.

Fixed

  • CI Workflow: Removed eval check from GitHub Actions CI (fails due to missing agenix secrets, unfree packages, aarch64 platform mismatch).
  • C# Dev Kit: Removed ms-dotnettools.csdevkit (nixpkgs patchPhase regex mismatch).

Removed

  • Neovim R Support: Moved to modules/dev/r.nix, modules/editors/positron.nix.
  • Swift Extension: Removed swiftlang.swift-vscode from shared extensions.

[1.4.0] - 2026-06-02

Changed

  • VS Code Family: Consolidated extensions; moved GitLens to shared commonExtensions.

[1.3.0] - 2026-06-02

Added

  • Neovim Filetype Detection: Snakemake (.smk) and Nextflow (.nf) files get proper syntax highlighting.
  • File Associations: Added .smk/.snakefile → Python, .nf → Groovy, .csv/.tsv, .proto, .graphql, .hcl/.tf, .toml.
  • Markdown Preview: Added bierner.markdown-preview-github-styles for VS Code family.

[1.2.0] - 2026-06-02

Added

  • Neovim Plugin Ecosystem: 14 astrocommunity language packs + custom Snakemake/Nextflow/Zsh support.

[1.0.1] - 2026-05-29

Added

  • Security future improvements: Added “Future Improvements” section to docs/security-hardening.md covering: Fail2Ban jail expansion, aide intrusion detection, gatus service health dashboard, service network isolation, backup encryption, idm_admin hardening.

[1.0.0] - 2026-05-24

Added

  • 7 new services on lab-matrix: Enabled paperless (28981), onlyoffice (8000), litellm (4000), hedgedoc (7002), grocy (8001), mealie (9000), gotify (9071) — all with OAuth2 SSO.
  • Startpage refreshed: All homelab links switched http:// → https://, 7 new service links added. Reorganized into 6 rows of 4.
  • Regular person account creation in Kanidm bootstrap: Documented idm_admin as system admin; regular person account required for OAuth2/SSO login. Added available_scopes: {} and NotAuthenticated troubleshooting.
  • Email requirement for OAuth2-Proxy: Documented that person accounts MUST have an email address set (kanidm person update --mail).

Fixed

  • HedgeDoc environmentFile type error: Split SMTP credentials into systemd.services.hedgedoc.serviceConfig.EnvironmentFile.
  • OnlyOffice securityNonceFile: Generated set $secure_link_secret via deterministic hash. Switched to genNginxVhostBase.
  • Stalwart fallback admin: Added authentication.fallback-admin.secret (bcrypt hash) for initial admin login.
  • PDF cross-reference fix: Added {#...} heading anchors to docs/toolchain.md for pandoc→typst cross-references. Fixed three failed GitHub Releases (v0.9.0, v0.9.1, v1.0.0).
  • Port conflicts: Linkwarden 3000→3001, Stirling-PDF 8080→8081, Headscale 8080→8082.
  • Vaultwarden DATABASE_URL: Added explicit PostgreSQL connection string to prevent SQLite fallback.
  • Affine OCI container: Added systemd.tmpfiles.rules to create required directories.
  • L1 proxy WebSocket passthrough: Added WebSocket upgrade headers to vps-pacman’s proxyTo for Immich/Vaultwarden.

Docs

  • Troubleshooting entries (homelab-bootstrap.md): Added crash-loop detection, CPU overheat diagnosis, IPv6-only service binding, Prisma ORM URL format, NixOS systemd unit name reference.
  • Service access audit (sso-identity.md): Full audit table of 18 services with auth model and risk assessment.

[0.9.1] - 2026-05-24

Fixed

  • Kanidm 1.8.x SSO bootstrap workflow: Updated docs for Kanidm 1.8.x CLI changes (kanidm system oauth2 create), documented localhost bypass, cookie_secret byte-length constraint, and ACME architecture rationale.

[0.9.0] - 2026-05-24

Added

  • OAuth2 option rollout: All 28 web service modules now expose oauth2 = { enable = mkBoolOpt false; }. Enabled oauth2 for 9 services on lab-matrix: forgejo, vaultwarden, freshrss, affine, stirling-pdf, linkwarden, immich, calibre, atuin.
  • genNginxVhost helper (lib/nginx.nix): Single function call replaces ~15 lines of repetitive vhost boilerplate (forceSSL, useACMEWildcardHost, quic, http3, kTLS, real_ip, Alt-Svc).
  • Per-vhost OAuth2 submodule (oauth2-proxy.nix): Extends services.nginx.virtualHosts with oauth2.enable and oauth2.allowedGroups. Ported from oddlama’s nix-config.
  • dnsPropagationCheck = true in ACME defaults.
  • acmeRoot = null propagated to all vhosts via useACMEWildcardHost.

Changed

  • Kanidm SSO options renamed: All service modules migrated from kanidm.enable to oauth2.enable.
  • Location naming: /internal-auth/oauth2/auth → /oauth2/auth.

Fixed

  • ACME HTTP-01 failures on lab-matrix: Switched all vhosts to useACMEWildcardHost — DNS-01 cert sharing avoids HTTP-01 resolution to wrong host IP.
  • ACME webroot/dnsProvider conflict on nixpkgs 25.11+: Added webroot = null to wildcard cert definition.

[0.8.0] - 2026-05-21

Added

  • docs/path.md: Comprehensive reference covering complete PATH construction, mechanism breakdown, process-type visibility matrix, desktop file discovery, and debugging.
  • docs/sing-box.md: New comprehensive operations guide covering config lifecycle, DNS architecture, route rule priority tables, debugging procedures.
  • docs/toolchain.md §5-7: Two-tier build system, Janet (dyn :syspath) behavior, exec-path resolution algorithm, matugen theme pipeline verification.
  • docs/ai-language-idioms.md: Added Janet (dyn :syspath) trap, os/realpath crash-on-missing, matugen 4.0.0 template filter safety rules.

Fixed

  • System hey not on PATH: Added heyPackage to environment.systemPackages for non-shell process visibility (Niri spawn, systemd services).
  • System hey crash on hosts without local build: Fixed exec-path to iterate all JANET_PATH entries via some + path/directory?.
  • matugen 4.0.0 template crash: Migrated rofi.rasi filter syntax from | set_alpha: 0.85 | format: "rgba" to .hex_alpha | set_alpha: N.
  • docs/networking-proxy.md: Condensed verification section to quick daily checks.

[0.7.0] - 2026-05-20

Added

  • justfile: High-level task-oriented interface for the entire fleet.
  • bin/start-usb-test.zsh: Generalized script for testing live USB setups in QEMU.

Changed

  • hey sync: Now prefers nh and nvd for better visuals and generational diffing.
  • Script Modernization: Renamed legacy .sh scripts to .zsh, moved fleet management scripts from scripts/ to bin/ (analyze-librewolf, checklist-email, fleet-check, setup-kanidm).

Removed

  • Legacy Scripts: Deleted 30+ host-specific shell scripts in scripts/, migrating logic to hey toolchain.

[0.6.0] - 2026-05-18

Added

  • Integrated hey subcommands: hey disko (disk management), hey install (system installation), hey build (iso, disko-image, raw-efi).

Changed

  • Documentation Refactor: Overhauled README.md with “HeyOS” ecosystem overview, consolidated docs/toolchain.md and docs/hey-integration.md.

[0.5.0] - 2026-05-10

Added

  • user.signing.allowedSignersSource: New option decoupling the git allowed_signers file source from hey.configDir.

Changed

  • Identity fields moved to config.identity.*: email, fullName, github, website, vaultwarden, signing.*, ssh.* now in separate namespace.
  • Deleted modules/user.nix: Identity option declarations were redundant.
  • useGlobalPkgs = true in home-manager: Eliminates duplicate package versions in the closure.
  • vdirsyncer: Config secret deployed to /etc/agenix/vdirsyncer_gmail.conf.
  • nh flake path: sync.janet passes flake as positional arg (.) for nh compatibility.
  • removed NH_FLAKE env var: rebuild alias uses explicit . path.
  • flake.lock updated: emacs-overlay, home-manager, llm-agents, microvm bumped.

Fixed

  • user.packages bridge broken by narrow inherit: Restored mkAliasDefinitions options.user — closure dropped from 105 GiB to 39 GiB.

[0.4.0] - 2026-05-09

Added

  • docs/ssh.md: Comprehensive SSH architecture doc covering config layers, agent vs IdentityFile, MaxAuthTries pitfall, and agenix host key interaction.

Fixed

  • hey ops deploy wrong hostname: Fixed HEYENV host override for remote deployment.
  • networking.hostName now uses flake attr: Flake attribute name is the single source of truth.
  • SSH MaxAuthTries exhaustion: Added IdentitiesOnly yes to Host * in ~/.ssh/config.

[0.3.0] - 2026-05-07

Added

  • user.signing.allowedSignersSource: New option for git allowed_signers.

Changed

  • User options refactor: Simplified modules/user.nix to pure option declarations with mkOpt.
  • Git SSH host config: Moved into modules/shell/git.nix via modules.shell.git.sshGitHosts.
  • default.nix user bridge: Replaced blanket mkAliasDefinitions with explicit per-attribute aliases.
  • yubikeyPrefix removed: Inlined as local let binding.

[0.2.0] - 2026-05-04

Fixed

  • Plymouth: Suppress systemd-ask-password-console in initrd to prevent YubiKey/FIDO2 PIN from being echoed in plaintext during boot.

[0.1.0] - 2026-05-02

Added

  • Neovim AstroNvim v6 + lazy.nvim: Framework-based config with catppuccin-mocha, 17 LSP servers, blink.cmp, 63 plugins.
  • 30+ VS Code Extensions: Language support, AI tools (Qwen Code), DevOps, databases, bioinformatics.
  • Neovim LSP/DAP/Formatters: kotlin, ruby, zig, lua, java, go debug, formatter integrations.
  • Bubblewrap Sandbox: mkBwrapWrapper for GUI app hardening.
  • Centralized Desktop Mode (modules.desktop.mode): Global diy/dms setting for all WMs.
  • Dedicated Shell Modules: diy.nix and dms.nix for shell-specific components.
  • Unified Greeter Service (greetd.nix): Supports dms-greeter, tuigreet, and mini (LightDM).
  • Standalone hyprlock and picom Services: Extracted lock screen and X11 compositor logic.
  • Centralized Theme Shell: Unified theming for notifications, lockscreens, terminals, compositors.
  • Modular Zsh Prompts: matrix and p10k prompt configurations.
  • Modular Tmux Themes: matrix and gemini configurations.
  • boostgreeter: Pseudo-login greeter for Hyprland/Niri testing.
  • Terminal Singleton Behavior: Mod + Return focuses existing workmux terminal.
  • Rofi Tmux Session Picker: Integrated singleton logic.
  • hey .focus-window: Cross-WM window focusing by title or class.
  • mkDesktopInfo in lib/pkgs.nix: Shared helper for standardized hey.info desktop structures.
  • Modernized Agent Guides: AGENTS.md, CLAUDE.md, GEMINI.md with comprehensive rules.
  • Agenix per-host secret scoping: nodes = ["host1" "host2"] to limit decryption.
  • hey info closure: Calculate total Nix closure size of a host.
  • Rockchip Kernel: Upgraded to Linux 7.0 with Armbian rockchip64-edge patches.
  • Documentation: docs/editors.md, docs/neovim.md, docs/sbc-opi5p.md, docs/security-hardening.md.

Changed

  • Telegram: telegram-desktop → ayugram-desktop.
  • Sandboxing: mkBwrapWrapper applied to WeChat, QQ, WeMeet, Zoom, Discord, AyuGram.
  • VS Code Family Refactor: Extracted duplicated extensions into shared commonExtensions.
  • Modernized Neovim: Native 0.11 vim.lsp.config API, LspAttach autocommands.
  • Refactored Desktop Modules: hyprland.nix, niri.nix, bspwm.nix delegate to centralized services.
  • hey .open-term: Added focusing logic, -n/--new flag, app-id for foot.
  • hey .clone-term: Always uses hey .open-term -n.
  • Zsh Prompt Management: Dynamically selected via modules.theme.apps.zsh.prompt.
  • Tmux Configuration Refactor: Dynamic theme switching via modules.theme.apps.tmux.theme.
  • Browser Option Naming: Renamed modules.themes.apps.firefox to librewolf for consistency.
  • Desktop Startup Logic: Refined greeter/session startup rules.

Fixed

  • kmscon: Disabled hardware rendering by default (SEGV crash on NVIDIA GPUs).
  • Desktop Identity Resolution: hey.info.desktop.wm early evaluation fix.
  • Niri DMS Greeter Startup: Exported X11 fallback library path for greetd.
  • dms-greeter Permission Crash: Icon themes available in system-wide paths.
  • DMS Service Path Error: quickshell present in service environment path.
  • Niri Reload Command: Fixed to niri msg action load-config-file.
  • Redundant Persistence: Pruned .npm and .positron from persistence modules.
  • CI Workflow: Removed eval check from CI (syntax check only).
  • C# Dev Kit: Removed ms-dotnettools.csdevkit (nixpkgs packaging bug).

Removed

  • HELLO.md: Replaced by individual agent guides.
  • Legacy Scripts: 30+ host-specific shell scripts migrated to hey toolchain.
  • Duplicate hey.info construction: ~15 lines removed from WM modules.