Update DeterminateSystems/flake-checker-action action to v14

.gitea/workflows/build.yml

@@ -19,7 +19,7 @@ jobs:
 
     #  - uses: DeterminateSystems/nix-installer-action@v4
       - uses: DeterminateSystems/magic-nix-cache-action@v13
-      - uses: DeterminateSystems/flake-checker-action@v12
+      - uses: DeterminateSystems/flake-checker-action@v14
 
       - name: "Install Cachix ❄️"
         uses: cachix/cachix-action@v17

flake.lock

@@ -23,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779036909,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "lastModified": 1786845137,
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -55,17 +55,14 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
-          "nur",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
@@ -74,34 +71,16 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "hardware": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1780065812,
-        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "lastModified": 1788335262,
+        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
+        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
         "type": "github"
       },
       "original": {
@@ -117,11 +96,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779726825,
-        "narHash": "sha256-RUkMrREjKDQrA+dA9+xZviGAxM5W1aVdyOr/bSYpHrE=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b179bde238977f7d4454fc770b1a727eaf55111c",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
@@ -152,11 +131,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1780030872,
-        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
+        "lastModified": 1788372231,
+        "narHash": "sha256-7aqErvrAEz/5OcPA5p3M+tVOqeYc4oJXkNIPXfCqxAw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
+        "rev": "9387b3fcc0c23c86661636da63faabad4235a0a6",
         "type": "github"
       },
       "original": {
@@ -174,11 +153,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780169171,
-        "narHash": "sha256-3HBYDfBgZ+ph52HS6Ks/bMMwuh2uONIT72sZ1CtLE/s=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "nixos-wsl",
-        "rev": "998b2821c30b2938637230916904ceb8757c79e8",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {
@@ -215,13 +194,28 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1780203844,
-        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
+        "lastModified": 1788297115,
+        "narHash": "sha256-Z+vUNbfd2FIKkWOTkcT7RYlh3oFCnig/d2eXD1SWf2E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
+        "rev": "a3116115851d68b8952a2a4221cc25a84e56b532",
         "type": "github"
       },
       "original": {
@@ -231,27 +225,6 @@
         "type": "github"
       }
     },
-    "nur": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780265777,
-        "narHash": "sha256-t/KORFHEv8Jn2vFmVfv4Zffekv+MUogI2KgtxuCcEmQ=",
-        "owner": "nix-community",
-        "repo": "nur",
-        "rev": "39917b7f68263188707925ffe26c9df6ef4e7d64",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nur",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "darwin": "darwin",
@@ -261,7 +234,6 @@
         "nixUnstable": "nixUnstable",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
-        "nur": "nur",
         "sops-nix": "sops-nix",
         "vscode-server": "vscode-server"
       }
@@ -273,11 +245,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1788337237,
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
         "type": "github"
       },
       "original": {
@@ -286,34 +258,16 @@
         "type": "github"
       }
     },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "vscode-server": {
       "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "flake-parts": "flake-parts"
       },
       "locked": {
-        "lastModified": 1770124655,
-        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "lastModified": 1784312229,
+        "narHash": "sha256-2uHCSUw341o3my1R0U0YCfbnMEazylxb58evWsjGL50=",
         "owner": "nix-community",
         "repo": "nixos-vscode-server",
-        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "rev": "2f984dfbe7e5271b5c413d3e734374cc1306c921",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,11 +5,6 @@
     nixUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
     hardware.url = "github:nixos/nixos-hardware";
-    nur = {
-      url = "github:nix-community/nur";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     home-manager = {
       url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -32,32 +27,42 @@
 
     vscode-server = {
       url = "github:nix-community/nixos-vscode-server";
-      inputs.nixpkgs.follows = "nixpkgs";
+      # inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
   outputs = inputs:
     let
       lib = inputs.nixpkgs.lib;
-      gen = import ./generator.nix { inherit inputs; };
+      linuxSystems = [ "x86_64-linux" "aarch64-linux" ];
+      supportedSystems = linuxSystems ++ [ "x86_64-darwin" "aarch64-darwin" ];
+      overlays = import ./overlays { inherit inputs; };
+      mkPkgs = system:
+        import inputs.nixpkgs {
+          inherit system;
+          inherit overlays;
+          config.allowUnfree = true;
+        };
+      gen = import ./generator.nix { inherit inputs mkPkgs supportedSystems; };
       systemsDir = ./systems;
       isIgnoredSystemDir = name: lib.hasPrefix "_" name || lib.hasPrefix "." name;
-      systemNames = lib.attrNames (lib.filterAttrs
-        (name: type:
+      systemNames = lib.attrNames (
+        lib.filterAttrs (
+          name: type:
           type == "directory"
           && !isIgnoredSystemDir name
-          && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
-        (builtins.readDir systemsDir));
+          && builtins.pathExists (systemsDir + "/${name}/cfg.nix")
+        ) (builtins.readDir systemsDir)
+      );
       hostsByType = systemType:
-        lib.filter
-          (host: (import (systemsDir + "/${host}/cfg.nix")).syscfg.type == systemType)
-          systemNames;
+        lib.filter (host: ((import (systemsDir + "/${host}/cfg.nix")).syscfg.type or "nixos") == systemType) systemNames;
       generateHosts = systemType:
-        lib.genAttrs
-          (hostsByType systemType)
-          (host: gen.generate { inherit host; });
+        lib.genAttrs (hostsByType systemType) (host: gen.generate { inherit host; });
     in {
-      devShells = import ./shells { inherit inputs; };
+      devShells = import ./shells {
+        inherit inputs mkPkgs;
+        systems = linuxSystems;
+      };
 
       nixosConfigurations = generateHosts "nixos";
       darwinConfigurations = generateHosts "macos";

generator.nix

@@ -1,70 +1,90 @@
-{ inputs, ... }: {
+{ inputs, mkPkgs, supportedSystems, ... }:
+{
   generate = { host }:
     let
       syscfg = import ./systems/${host}/cfg.nix;
       nameValuePair = name: value: { inherit name value; };
-    in ({
-      "nixos" = inputs.nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        specialArgs = { inherit inputs; };
-        modules = [
+      systemType = syscfg.syscfg.type or "nixos";
+      defaultSystem =
+        {
+          nixos = "x86_64-linux";
+          macos = "x86_64-darwin";
+          home = "x86_64-linux";
+        }
+        .${systemType} or (throw "Unsupported system type: ${systemType}");
+      requestedSystem = syscfg.syscfg.system or defaultSystem;
+      system =
+        if builtins.elem requestedSystem supportedSystems then
+          requestedSystem
+        else
+          throw "Unsupported system '${requestedSystem}' for host '${host}'";
+      users = syscfg.syscfg.users or [ ];
+      mkLinuxHomeImports =
+        userConfig:
+        [
           ./modules/shared/syscfg
-          ./modules/shared/sops
-          ./modules/nixos
+          ./modules/shared/colors
+          ./modules/home
           syscfg
-          ./systems/${host}
-          inputs.sops-nix.nixosModules.sops
-          inputs.home-manager.nixosModules.home-manager
-
-          inputs.nixos-wsl.nixosModules.wsl
-          inputs.vscode-server.nixosModules.default
-
-          {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.extraSpecialArgs = { inherit inputs; };
-            home-manager.users = builtins.listToAttrs (map (userConfig:
-              nameValuePair userConfig.username {
-                imports = [
-                  ./modules/shared/syscfg
-                  ./modules/shared/colors
-                  ./modules/home
-                  syscfg
-                  { usercfg = userConfig; }
-                  inputs.nix-colors.homeManagerModule
-                  inputs.sops-nix.homeManagerModules.sops
-                ];
-              }) syscfg.syscfg.users);
-          }
+          { usercfg = userConfig; }
+          inputs.nix-colors.homeManagerModule
+          inputs.sops-nix.homeManagerModules.sops
         ];
+      mkDarwinHomeImports = [ inputs.nix-colors.homeManagerModule inputs.sops-nix.homeManagerModules.sops ];
+      mkHomeUsers = importsForUser:
+        builtins.listToAttrs (
+          map (userConfig: nameValuePair userConfig.username { imports = importsForUser userConfig; }) users
+        );
+      mkHomeManager = importsForUser: {
+        home-manager.useGlobalPkgs = true;
+        home-manager.useUserPackages = true;
+        home-manager.extraSpecialArgs = { inherit inputs; };
+        home-manager.users = mkHomeUsers importsForUser;
       };
+      sharedModules = [
+        ./modules/shared/syscfg
+        ./modules/shared/sops
+        syscfg
+        ./systems/${host}
+      ];
+      defaultUser =
+        builtins.head (
+          builtins.filter (user: user.username == syscfg.syscfg.defaultUser) users
+          ++ [ { username = syscfg.syscfg.defaultUser; } ]
+        );
+    in
+    (
+      {
+        "nixos" = inputs.nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs; };
+          modules = sharedModules ++ [
+            ./modules/nixos
+            inputs.sops-nix.nixosModules.sops
+            inputs.home-manager.nixosModules.home-manager
 
-      "macos" = inputs.darwin.lib.darwinSystem {
-        system = "x86_64-darwin";
-        modules = [
-          ./modules/shared/syscfg
-          ./modules/shared/sops
-          syscfg
-          ./systems/${host}
-          inputs.sops-nix.nixosModules.sops
-          inputs.home-manager.darwinModules.home-manager
-          {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.extraSpecialArgs = { inherit inputs; };
-            home-manager.users = builtins.listToAttrs (map (userConfig:
-              nameValuePair userConfig.username {
-                imports = [
-                  inputs.nix-colors.homeManagerModule
-                  inputs.sops-nix.homeManagerModules.sops
-                ];
-              }) syscfg.syscfg.users);
-          }
-        ];
-      };
-      "home" = inputs.home-manager.lib.homeManagerConfiguration {
-        modules = [ ./modules/home ];
-      };
-      _ = throw "Unsupported system";
-    }.${syscfg.syscfg.type});
+            inputs.nixos-wsl.nixosModules.wsl
+            inputs.vscode-server.nixosModules.default
+
+            (mkHomeManager mkLinuxHomeImports)
+          ];
+        };
+
+        "macos" = inputs.darwin.lib.darwinSystem {
+          inherit system;
+          modules = sharedModules ++ [
+            inputs.sops-nix.darwinModules.sops
+            inputs.home-manager.darwinModules.home-manager
+            (mkHomeManager (_: mkDarwinHomeImports))
+          ];
+        };
+        "home" = inputs.home-manager.lib.homeManagerConfiguration {
+          pkgs = mkPkgs system;
+          extraSpecialArgs = { inherit inputs; };
+          modules = mkLinuxHomeImports defaultUser;
+        };
+        _ = throw "Unsupported system";
+      }
+      .${systemType}
+    );
 }

modules/home/base/default.nix

@@ -1,12 +1,16 @@
-{ lib, config, ... }: {
+{ lib, config, pkgs, ... }: {
 
   #environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;
-  systemd.user.startServices = "sd-switch";
+  systemd.user.startServices = lib.mkIf pkgs.stdenv.isLinux "sd-switch";
   programs.home-manager.enable = true;
 
   home = {
     username = "${config.usercfg.username}";
-    homeDirectory = "/home/${config.usercfg.username}";
+    homeDirectory =
+      if pkgs.stdenv.isDarwin then
+        "/Users/${config.usercfg.username}"
+      else
+        "/home/${config.usercfg.username}";
 
     stateVersion = "26.05";
   };

modules/home/cli/fastfetch/default.nix

@@ -28,7 +28,7 @@ let
   logoColor1 = p.base07;
   logoColor2 = p.base07;
   # ─────────────────────────────────────────────────────────────────────────
-in {
+in lib.mkIf config.syscfg.make.gui {
   home.packages = with pkgs; [ fastfetch ];
   xdg.configFile."neofetch/config.conf".source = ./config.conf;
   xdg.configFile."fastfetch/logo.txt".source = ./logo.txt;

modules/home/cli/kitty/default.nix

@@ -1,5 +1,5 @@
-{ config, ... }: {
-  programs.kitty = {
+{ config, lib, ... }: {
+  programs.kitty = lib.mkIf config.syscfg.make.gui {
     enable = true;
     settings = {
       foreground = "#${config.colorScheme.palette.base07}";

modules/home/cli/other/default.nix

@@ -1,16 +1,16 @@
-{ pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   home.packages = with pkgs; [
     ripgrep
     unzip
 
     socat
 
-    appimage-run
-
     cbonsai
     pipes-rs
     cmatrix
     #cava
     sl
+  ] ++ lib.optionals (config.syscfg.make.gui || config.syscfg.make.develop) [
+    pkgs.appimage-run
   ];
 }

modules/home/gui/apps/develop/vscodium/default.nix

@@ -1,18 +1,22 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }: 
+let
+  exts = with pkgs.vscode-extensions; [
+    bbenoist.nix
+    esbenp.prettier-vscode
+
+    anthropic.claude-code
+    # openai.codex
+  ];
+in {
 
   config = lib.mkIf (config.syscfg.make.develop) {
     programs.vscodium = {
       enable = true;
-      #profiles.default = {
-        profiles.default.extensions = with pkgs.vscode-extensions; [
-          bbenoist.nix
-          esbenp.prettier-vscode
-          golang.go
-          ms-python.vscode-pylance
-          ms-vscode.cpptools
-          dbaeumer.vscode-eslint
-        ];
-      #};
+      profiles.default.extensions = exts;
+    };
+    programs.antigravity = {
+      enable = true;
+      profiles.default.extensions = exts;
     };
   };
 }

modules/home/gui/apps/images/default.nix

@@ -4,8 +4,9 @@
     programs.imv.enable = true;
 
     programs.obs-studio.enable = true;
+    services.jellyfin-mpv-shim.enable = true;
 
-    home.packages = with pkgs; [ jellyfin-mpv-shim krita gimp darktable ];
+    home.packages = with pkgs; [ krita gimp darktable ];
   };
 
 }

modules/home/gui/apps/mpv/default.nix

@@ -1,18 +1,17 @@
 { lib, config, pkgs, ... }:
 let
   configuredMpv = config.programs.mpv.finalPackage;
+  shimWatchdog = pkgs.custom.jellyfin-mpv-shim-watchdog;
 in{
 
   config = lib.mkIf (config.syscfg.make.gui) {
     programs.mpv = {
       enable = true;
-      scripts = with pkgs.mpvScripts; [ mpris modernz ];
+      scripts = with pkgs.mpvScripts; [ mpris ];
       config = {
         hwdec ="auto";
         profile ="high-quality";
         ytdl-format = "bestvideo+bestaudio";
-        osc ="no";
-
       };
 
       bindings =
@@ -83,5 +82,37 @@ in{
     };
 
     programs.yt-dlp.enable = true;
+
+    # The upstream jellyfin-mpv-shim service has no Restart and no network
+    # ordering: it happily starts while offline (silently dead) and never
+    # recovers a connection dropped by a network blip. Gate its start on the
+    # network being up, and let a watchdog notice the "up but not connected"
+    # state that systemd can't see. See pkgs.custom.jellyfin-mpv-shim-watchdog.
+    systemd.user.services.jellyfin-mpv-shim.Service = {
+      ExecStartPre = "${shimWatchdog}/bin/jellyfin-mpv-shim-watchdog wait-online";
+      TimeoutStartSec = "infinity";  # stay in start-pre until the network is back
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+
+    systemd.user.services.jellyfin-mpv-shim-watchdog = {
+      Unit = {
+        Description = "Restart jellyfin-mpv-shim when it is up but not connected";
+        After = [ "jellyfin-mpv-shim.service" ];
+      };
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${shimWatchdog}/bin/jellyfin-mpv-shim-watchdog check";
+      };
+    };
+
+    systemd.user.timers.jellyfin-mpv-shim-watchdog = {
+      Unit.Description = "Periodic health check for jellyfin-mpv-shim";
+      Timer = {
+        OnActiveSec = "60s";
+        OnUnitActiveSec = "60s";
+      };
+      Install.WantedBy = [ "timers.target" ];
+    };
   };
 }

modules/home/gui/games/wow.nix

@@ -5,7 +5,7 @@
     home.packages = with pkgs;
       [
         # custom.simc
-        unstable.instawow
+        instawow
       ];
 
     # templates buggy currently

modules/home/wayland/apps/dunst/default.nix

@@ -8,14 +8,11 @@
       settings = {
         global = {
           follow = "mouse";
-          height = "200";
+          height = "(0, 200)";
           width = "350";
           scale = "0";
-          origin = "top-right";
-          offset = "${
-              toString ((lib.strings.toInt config.colorScheme.palette.gaps-bar)
-                + (lib.strings.toInt config.colorScheme.palette.gaps-screen))
-            }x${config.colorScheme.palette.gaps-screen}";
+          origin = "bottom-right";
+          offset = "(${config.colorScheme.palette.gaps-screen},${config.colorScheme.palette.gaps-screen})";
           notification_limit = "0";
           progress_bar = "true";
           progress_bar_height = "10";
@@ -62,8 +59,8 @@
           corner_radius = "${config.colorScheme.palette.border-radius}";
           ignore_dbusclose = "false";
           layer = "top";
-          force_xwayland = "true";
-          force_xinerama = "false";
+          # force_xwayland = "true";
+          # force_xinerama = "false";
 
           mouse_left_click = "close_current";
           mouse_middle_click = "context";
@@ -91,6 +88,9 @@
           timeout = "10";
           highlight = "#${config.colorScheme.palette.base0E}";
         };
+        experimental = {
+          per_monitor_dpi = true;
+        };
       };
     };
   };

modules/home/wayland/apps/eww/bar/css/_clock.scss

@@ -61,8 +61,8 @@ calendar {
 }
 
 .quick-btn-active {
-  .quick-icon  { @include color-accent; }
-  .quick-label { @include color-accent; }
+  .quick-icon  { color: $base0E; }
+  .quick-label { color: $base0E; }
 }
 
 .quick-icon  { font-size: 1.5em; @include color-body; }

modules/home/wayland/apps/eww/bar/css/_net.scss

@@ -34,3 +34,10 @@
 .bt-device-btn:hover  { @include background-active; }
 .net-toggle-on, .bt-btn-on   { @include color-base; }
 .net-toggle-off, .bt-btn-off { @include color-inactive; }
+
+// WireGuard
+.wg-accent { background-color: $base0E; }
+.wg-row    { margin-bottom: $popup-scale * 4pt; }
+.wg-name   { font-size: 0.78em; font-weight: bold; }
+.wg-up     { @include color-base; }
+.wg-down   { @include color-inactive; }

modules/home/wayland/apps/eww/bar/css/_sys.scss

@@ -3,7 +3,7 @@
 .cpubar { color: $base0C; }
 .gpubar { color: $base0E; }
 .membar { color: $base08; }
-.batbar { color: $base0B; }
+.batbar { color: $base0B; } // overridden by .bat-<state> below
 .cpubar, .gpubar, .membar, .batbar { @include background-base2; margin: $gaps-window 0; }
 
 // Window chrome
@@ -91,3 +91,8 @@
   background-color: transparent;
   margin: $popup-scale * 4pt;
 }
+
+// Battery colour by state (scripts/sys/battery → .bat-<state>)
+.batbar, .bat-ring        { color: $base0B; }
+.bat-charging             { color: $base0C; }
+.bat-low                  { color: $base08; }

modules/home/wayland/apps/eww/bar/modules/clock.yuck

@@ -1,12 +1,13 @@
 (defvar date_rev false)
 
+; EWW_TIME ticks every second inside the daemon, so no shell poll is needed.
 (defwidget clock-mod []
   (module
     (eventbox
-      :onhover "${EWW_CMD} update date_rev=true"
-      :onhoverlost "${EWW_CMD} update date_rev=false"
-      :onclick "(sleep 0.1 && scripts/panel-toggle clock)"
-      :onrightclick "(sleep 0.1 && scripts/powermenu-toggle)"
+      :onhover "${EWW_CMD} --no-daemonize update date_rev=true"
+      :onhoverlost "${EWW_CMD} --no-daemonize update date_rev=false"
+      :onclick "scripts/panel-toggle clock"
+      :onrightclick "scripts/powermenu-toggle"
       (box
         :class "datetime"
         (overlay
@@ -14,27 +15,24 @@
             :orientation "v"
             (label :show-truncated false
               :class "hour"
-              :text {time.hour})
+              :text {formattime(EWW_TIME, "%H")})
             (label :show-truncated false
-            :class "minute"
-              :text {time.minute}))
+              :class "minute"
+              :text {formattime(EWW_TIME, "%M")}))
           (revealer
             :reveal date_rev
             (box
               :class "date"
               :orientation "v"
-              (label :show-truncated "false"
+              (label :show-truncated false
                 :class "day"
-                :text {time.day})
-              (label :show-truncated "false"
+                :text {formattime(EWW_TIME, "%d")})
+              (label :show-truncated false
                 :class "month"
-                :text {time.month}))
+                :text {formattime(EWW_TIME, "%m")}))
           )
         )
       )
     )
   )
 )
-
-(defpoll time :interval "15s" "date '+{\"hour\":\"%H\",\"minute\":\"%M\",\"day\":\"%d\",\"month\":\"%m\"}'")
-

modules/home/wayland/apps/eww/bar/modules/net.yuck

@@ -1,15 +1,15 @@
 (deflisten net
-  :initial '{"wifi":{"connected":false,"enabled":false,"icon":"󰤮","ssid":""},"ethernet":{"connected":false},"usb":{"connected":false}}'
+  :initial '{"wifi":{"connected":false,"enabled":false,"icon":"󰤮","ssid":"","ip":"","freq":0,"band":"","gen":"","signal":0},"ethernet":{"connected":false,"interface":"","ip":"","speed":""},"usb":{"connected":false,"interface":"","ip":""},"wireguard":[],"vpn":{"up":false,"name":""}}'
   "scripts/net/net")
 
-(deflisten bluetooth
-  :initial '{"powered":false,"connected":false,"device":""}'
-  "scripts/net/bluetooth")
+(deflisten bt
+  :initial '{"powered":false,"connected":false,"device":"","devices":[]}'
+  "scripts/net/bt")
 
 (defwidget net-mod []
   (module
     (eventbox
-      :onclick "(sleep 0.1 && scripts/panel-toggle net)"
+      :onclick "scripts/panel-toggle net"
     (box :orientation "v"
       (label
         :class "net-icon ${net.ethernet.connected ? 'net-active' : 'net-dim'}"
@@ -20,11 +20,16 @@
         :class "net-icon net-active"
         :tooltip "USB: Connected"
         :text "󰌷")
+      (label
+        :visible {net.vpn.up}
+        :class "net-icon net-active"
+        :tooltip "VPN: ${net.vpn.name}"
+        :text "󰖂")
       (label
         :class "net-icon ${net.wifi.connected ? 'net-active' : 'net-dim'}"
         :tooltip {net.wifi.connected ? "WiFi: ${net.wifi.ssid}" : "WiFi: Disconnected"}
         :text {net.wifi.icon})
       (label
-        :class "net-icon ${bluetooth.connected ? 'blt-connected' : bluetooth.powered ? 'blt-on' : 'net-dim'}"
-        :tooltip {bluetooth.connected ? "Bluetooth: ${bluetooth.device}" : bluetooth.powered ? "Bluetooth: On" : "Bluetooth: Off"}
-        :text {bluetooth.connected ? "󰂱" : bluetooth.powered ? "󰂯" : "󰂲"})))))
+        :class "net-icon ${bt.connected ? 'blt-connected' : bt.powered ? 'blt-on' : 'net-dim'}"
+        :tooltip {bt.connected ? "Bluetooth: ${bt.device}" : bt.powered ? "Bluetooth: On" : "Bluetooth: Off"}
+        :text {bt.connected ? "󰂱" : bt.powered ? "󰂯" : "󰂲"})))))

modules/home/wayland/apps/eww/bar/modules/sys.yuck

@@ -1,12 +1,13 @@
 (deflisten gpu :initial '{"gfx_pct":0,"mem_pct":0,"media_pct":0,"sclk":0,"mclk":0,"sclk_pct":0,"mclk_pct":0,"vclk":0,"vclk_pct":0,"temp":0,"power":0,"vram_used":0,"vram_total":1}' "scripts/sys/gpu")
-(deflisten memory :initial '{"human":{"used":"0G","total":"0G","cached":"0G"},"used":0.0,"total":1.0,"cached":0.0}' "scripts/sys/memory")
+(deflisten memory :initial '{"total":1,"used":0,"cached":0,"human":{"total":"0G","used":"0G","cached":"0G"},"swap":{"total":0,"used":0,"human":{"total":"0G","used":"0G"}}}' "scripts/sys/memory")
 
-(deflisten battery :initial '{"visible":false,"percentage":0.0,"color":"#FFFFFF"}' "scripts/sys/battery")
+; state: charging | discharging | low | full | idle | none — styled via .bat-<state>
+(deflisten battery :initial '{"visible":false,"percentage":0,"wattage":"","status":"","state":"none"}' "scripts/sys/battery")
 
 (defwidget sys-mod []
   (module
     (eventbox
-      :onclick "(sleep 0.1 && scripts/panel-toggle sys)"
+      :onclick "scripts/panel-toggle sys"
       (box :orientation "v"
         (circular-progress
           :value {EWW_CPU.avg}
@@ -25,8 +26,7 @@
           :tooltip "RAM ${memory.human.used} / ${memory.human.total}")
         (circular-progress
           :value {battery.percentage}
-          :class "batbar"
+          :class "batbar bat-${battery.state}"
           :visible {battery.visible}
-          :style "color: ${battery.color};"
           :width 28 :height 28 :thickness 6
           :tooltip "Bat ${round(battery.percentage, 0)}% · ${battery.status} @ ${battery.wattage}")))))

modules/home/wayland/apps/eww/bar/scripts/_lib.sh

@@ -0,0 +1,87 @@
+# ---------------------------------------------------------------------------
+# Shared helpers for the bar scripts.  default.nix inlines this file at the
+# top of every wrapped script, right after setting PATH.
+# ---------------------------------------------------------------------------
+
+# Every eww client call goes through this wrapper.  A client waits only 100 ms
+# for the daemon's reply; a slower command (opening the popup) would otherwise
+# make a plain `eww open` fork a second daemon that takes over the socket —
+# the "two bars" bug.  With --no-daemonize it is just an error, and the daemon
+# still carries out the command.
+eww() { command eww --no-daemonize "$@"; }
+
+# Print the payload only when it differs from the previous one.
+emit() {
+  [[ $1 == "${EMIT_LAST-}" ]] && return 0
+  EMIT_LAST=$1
+  printf '%s\n' "$1"
+}
+
+# Escape a value for use inside a JSON string literal.
+jstr() {
+  local s=$1
+  s=${s//\\/\\\\}
+  s=${s//\"/\\\"}
+  s=${s//$'\n'/\\n}
+  s=${s//$'\t'/\\t}
+  printf '%s' "$s"
+}
+
+# Run a command outside eww's cgroup so a daemon restart cannot kill it
+# (hyprlock, wlsunset, mpv, satty…).  With -u NAME the transient unit gets a
+# fixed name that `systemctl --user stop NAME` can address later.
+#   detach [-u NAME] CMD ARGS...
+detach() {
+  local unit=() cmd
+  if [[ $1 == -u ]]; then unit=(--unit "$2"); shift 2; fi
+  cmd=$(command -v "$1") || { echo "detach: $1 not found" >&2; return 1; }
+  shift
+  systemd-run --user --collect --quiet "${unit[@]}" -- "$cmd" "$@"
+}
+
+# Event multiplexer for listener scripts.  Producers run in the background
+# and write one line per event into a fifo; the main loop re-evaluates the
+# state on every event, coalescing bursts into a single refresh.
+#
+#   mux_init
+#   mux_add  FUNC [ARGS]     run FUNC in the background, stdout → fifo
+#   mux_tick SECONDS         periodic wake-up
+#   mux_loop HANDLER         HANDLER LINE... for every burst (never returns)
+#
+# eww terminates a listener by sending SIGTERM to its whole process group, so
+# the producers die together with the script.  The EXIT trap only removes the
+# fifo — it must never `kill 0`: that signals the shell itself, which
+# re-enters the trap recursively until bash overflows its stack (the
+# bash/volume coredumps in the journal of the previous version).
+mux_init() {
+  MUX_DIR=$(mktemp -d "${XDG_RUNTIME_DIR:-/tmp}/eww-mux.XXXXXX")
+  MUX_FIFO=$MUX_DIR/events
+  MUX_PIDS=()
+  mkfifo "$MUX_FIFO"
+  # Open read+write once: never blocks, and readers never see EOF.
+  exec {MUX_FD}<>"$MUX_FIFO"
+  trap 'mux_cleanup' EXIT
+}
+
+mux_cleanup() {
+  trap - EXIT
+  ((${#MUX_PIDS[@]})) && kill "${MUX_PIDS[@]}" 2>/dev/null
+  rm -rf "$MUX_DIR"
+}
+
+mux_add() {
+  "$@" >&"$MUX_FD" 2>/dev/null &
+  MUX_PIDS+=("$!")
+}
+
+_mux_ticker() { while sleep "$1"; do echo tick; done; }
+mux_tick() { mux_add _mux_ticker "$1"; }
+
+mux_loop() {
+  local handler=$1 line lines
+  while IFS= read -r -u "$MUX_FD" line; do
+    lines=("$line")
+    while IFS= read -r -t 0.15 -u "$MUX_FD" line; do lines+=("$line"); done
+    "$handler" "${lines[@]}"
+  done
+}

modules/home/wayland/apps/eww/bar/scripts/airplane-mode

@@ -1,19 +1,18 @@
 #!/usr/bin/env bash
-is_active() {
-  rfkill list wifi 2>/dev/null | grep -q "Soft blocked: yes"
-}
+# rfkill everything (wifi + bluetooth); "active" means the wifi is soft-blocked.
+active() { rfkill list wifi 2>/dev/null | grep -q "Soft blocked: yes"; }
 
-case "$1" in
-  status)
-    is_active && echo true || echo false
-    ;;
+case ${1:-} in
+  status) active && echo true || echo false ;;
   *)
-    if is_active; then
+    if active; then
       rfkill unblock all
-      echo false
+      state=false
     else
       rfkill block all
-      echo true
+      state=true
     fi
+    eww update airplane-mode="$state" 2>/dev/null
+    echo "$state"
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/brightness

@@ -1,29 +1,34 @@
 #!/usr/bin/env bash
+# Backlight brightness (first device under /sys/class/backlight).  Refreshes
+# on backlight udev events, which also fire for the hardware keys.
+#
+#   brightness              status loop (deflisten)
+#   brightness set PERCENT
 
-BACKLIGHT="/sys/class/backlight"
-DEV=$(ls "$BACKLIGHT" 2>/dev/null | head -n1)
+dev=""
+for d in /sys/class/backlight/*; do
+  [[ -e $d ]] && { dev=${d##*/}; break; }
+done
 
-gen_output() {
-  if [ -z "$DEV" ]; then
-    echo '{"percent":0,"available":false}'
-    return
-  fi
-  max=$(cat "$BACKLIGHT/$DEV/max_brightness")
-  cur=$(cat "$BACKLIGHT/$DEV/actual_brightness" 2>/dev/null || cat "$BACKLIGHT/$DEV/brightness")
-  percent=$(awk -v c="$cur" -v m="$max" 'BEGIN{print int(c/m*100+0.5)}')
-  printf '{"percent":%d,"available":true}\n' "$percent"
+state() {
+  [[ -n $dev ]] || { printf '{"percent":0,"available":false}'; return; }
+  local max cur
+  max=$(<"/sys/class/backlight/$dev/max_brightness")
+  cur=$(cat "/sys/class/backlight/$dev/actual_brightness" 2>/dev/null \
+    || cat "/sys/class/backlight/$dev/brightness")
+  printf '{"percent":%d,"available":true}' "$(((cur * 100 + max / 2) / max))"
 }
 
-case "$1" in
-  set)
-    [ -z "$DEV" ] && exit 0
-    brightnessctl -d "$DEV" set "${2}%" -q 2>/dev/null
-    ;;
+refresh() { emit "$(state)"; }
+_bl_events() { exec udevadm monitor --udev --subsystem-match=backlight; }
+
+case ${1:-} in
+  set) [[ -n $dev ]] && brightnessctl -q -d "$dev" set "${2%.*}%" ;;
   *)
-    gen_output
-    [ -z "$DEV" ] && exit 0
-    udevadm monitor --udev --subsystem-match=backlight 2>/dev/null | while read -r _; do
-      gen_output
-    done
+    refresh
+    [[ -n $dev ]] || exit 0
+    mux_init
+    mux_add _bl_events
+    mux_loop refresh
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/color-pick

@@ -1,3 +1,5 @@
 #!/usr/bin/env bash
+# Pick a colour from the screen into the clipboard, detached from eww.
 eww close popup 2>/dev/null
-hyprpicker -a
+eww update active-panel= 2>/dev/null
+detach hyprpicker -a

modules/home/wayland/apps/eww/bar/scripts/do-not-disturb

@@ -1,15 +1,11 @@
 #!/usr/bin/env bash
-case "$1" in
-  status)
-    dunstctl is-paused
-    ;;
+# Pause / resume dunst notifications.
+case ${1:-} in
+  status) dunstctl is-paused ;;
   *)
-    if dunstctl is-paused | grep -q true; then
-      dunstctl set-paused false
-      echo false
-    else
-      dunstctl set-paused true
-      echo true
-    fi
+    dunstctl set-paused toggle
+    state=$(dunstctl is-paused)
+    eww update do-not-disturb="$state" 2>/dev/null
+    echo "$state"
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/lock

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
+# Lock the session.  hyprlock runs as its own transient unit so that an eww
+# restart can never take the lock screen down with it.
+unit=eww-lock
 eww close popup 2>/dev/null
 eww close powermenu 2>/dev/null
-# swaylock #swaylock-effects
-hyprlock
-# gtklock
+eww update active-panel= 2>/dev/null
+systemctl --user is-active --quiet "$unit" && exit 0
+detach -u "$unit" hyprlock

modules/home/wayland/apps/eww/bar/scripts/media

@@ -1,2 +1,3 @@
 #!/usr/bin/env bash
-playerctl "$@"
+# playerctl pass-through for the media panel buttons.
+exec playerctl "$@"

modules/home/wayland/apps/eww/bar/scripts/net/bluetooth

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-emit() {
-  local powered=false connected=false device=""
-
-  if bluetoothctl show 2>/dev/null | grep -q "Powered: yes"; then
-    powered=true
-    while IFS= read -r line; do
-      local mac info
-      mac=$(echo "$line" | awk '{ print $2 }')
-      info=$(bluetoothctl info "$mac" 2>/dev/null)
-      if echo "$info" | grep -q "Connected: yes"; then
-        device=$(echo "$info" | awk -F': ' '/^\tName:/ { print $2; exit }')
-        connected=true
-        break
-      fi
-    done < <(bluetoothctl devices 2>/dev/null)
-  fi
-
-  printf '{"powered":%s,"connected":%s,"device":"%s"}\n' "$powered" "$connected" "$device"
-}
-
-emit
-
-tmp=$(mktemp -d)
-pipe="$tmp/bt-events"
-mkfifo "$pipe"
-trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
-
-# Poll every 10s as reliable fallback for missed events
-(while true; do sleep 10; echo poll; done) > "$pipe" &
-
-# bluetoothctl monitor for reactive device connect/disconnect events
-(bluetoothctl monitor 2>/dev/null | grep --line-buffered -E "Powered|Connected|Device") > "$pipe" &
-
-while IFS= read -r _ < "$pipe"; do
-  emit
-done

modules/home/wayland/apps/eww/bar/scripts/net/bt

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Bluetooth state — adapter power, connected device and the paired/trusted
+# device list — from one ObjectManager call on the system bus.  Refreshes on
+# every org.bluez signal (property changes, devices added/removed) and every
+# 60 s.
+
+fallback='{"powered":false,"connected":false,"device":"","devices":[]}'
+
+query() {
+  busctl --system --json=short call org.bluez / org.freedesktop.DBus.ObjectManager GetManagedObjects 2>/dev/null \
+    | jq -c '
+      .data[0] as $o
+      | ($o | to_entries | map(.value["org.bluez.Adapter1"] | select(.) | .Powered.data) | any) as $powered
+      | ($o | to_entries
+          | map(.value["org.bluez.Device1"] | select(.))
+          | map(select(.Paired.data or .Trusted.data or .Connected.data))
+          | map({ mac: .Address.data,
+                  name: (.Alias.data // .Name.data // .Address.data),
+                  connected: (.Connected.data // false),
+                  paired: (.Paired.data // false) })
+          | sort_by((.connected | not), (.paired | not), .name)) as $devices
+      | { powered: $powered,
+          connected: ($devices | any(.connected)),
+          device: ($devices | map(select(.connected)) | .[0].name // ""),
+          devices: $devices }' 2>/dev/null
+}
+
+refresh() {
+  local out
+  out=$(query)
+  emit "${out:-$fallback}"
+}
+
+_bt_events() { exec gdbus monitor --system --dest org.bluez; }
+
+refresh
+mux_init
+mux_add _bt_events
+mux_tick 60
+mux_loop refresh

modules/home/wayland/apps/eww/bar/scripts/net/bt-devices

@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-emit() {
-  local first=true arr=""
-  while IFS= read -r line; do
-    local mac name connected
-    mac=$(echo "$line" | awk '{ print $2 }')
-    name=$(echo "$line" | awk '{ $1=$2=""; sub(/^ +/, ""); print }')
-    info=$(bluetoothctl info "$mac" 2>/dev/null)
-    connected=$(echo "$info" | grep -q "Connected: yes" && echo true || echo false)
-    $first || arr="${arr},"
-    arr="${arr}{\"mac\":\"${mac}\",\"name\":\"${name}\",\"connected\":${connected}}"
-    first=false
-  done < <(bluetoothctl devices 2>/dev/null)
-  echo "[${arr}]"
-}
-
-emit
-
-tmp=$(mktemp -d)
-pipe="$tmp/bt-dev-events"
-mkfifo "$pipe"
-trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
-
-# Poll every 10s as fallback for missed events
-(while true; do sleep 10; echo poll; done) > "$pipe" &
-
-# Reactive updates from D-Bus
-(bluetoothctl monitor 2>/dev/null | grep --line-buffered -E "Connected|Device|Powered") > "$pipe" &
-
-while IFS= read -r _ < "$pipe"; do
-  emit
-done

modules/home/wayland/apps/eww/bar/scripts/net/bt-toggle

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-mac="$1"
+# Connect or disconnect the bluetooth device with MAC $1.
+mac=$1
 if bluetoothctl info "$mac" 2>/dev/null | grep -q "Connected: yes"; then
   bluetoothctl disconnect "$mac"
 else

modules/home/wayland/apps/eww/bar/scripts/net/net

@@ -1,64 +1,136 @@
 #!/usr/bin/env bash
+# Network state for the bar icons and the net panel: wifi, ethernet and USB
+# tethering.  Refreshes on link/address changes and every 30 s (signal level).
 
-get_wifi_iface() {
-  awk 'NR > 2 { gsub(":", "", $1); print $1; exit }' /proc/net/wireless
-}
-
-get_usb_iface() {
-  ip link 2>/dev/null | awk '
-    /^[0-9]+: usb[0-9]/ { gsub(":", "", $2); print $2; exit }
-    /^[0-9]+: enx/      { gsub(":", "", $2); print $2; exit }
-  '
-}
+wifi_iface() { awk 'NR > 2 { sub(":", "", $1); print $1; exit }' /proc/net/wireless; }
+eth_iface() { ip -o link 2>/dev/null | awk '$2 ~ /^en[op]/ { sub(":", "", $2); print $2; exit }'; }
+usb_iface() { ip -o link 2>/dev/null | awk '$2 ~ /^(usb[0-9]|enx)/ { sub(":", "", $2); print $2; exit }'; }
+ipv4() { ip -4 -o addr show "$1" 2>/dev/null | awk '{ print $4; exit }'; }
 
 signal_icon() {
-  local dbm="$1"
-  if [ -z "$dbm" ]; then echo "󰤮"; return; fi
-  if   [ "$dbm" -ge -50 ]; then echo "󰤨"
-  elif [ "$dbm" -ge -60 ]; then echo "󰤥"
-  elif [ "$dbm" -ge -70 ]; then echo "󰤢"
-  elif [ "$dbm" -ge -80 ]; then echo "󰤟"
+  local dbm=${1:-}
+  [[ -z $dbm ]] && { echo "󰤮"; return; }
+  if ((dbm >= -50)); then echo "󰤨"
+  elif ((dbm >= -60)); then echo "󰤥"
+  elif ((dbm >= -70)); then echo "󰤢"
+  elif ((dbm >= -80)); then echo "󰤟"
   else echo "󰤯"; fi
 }
 
-make_content() {
-  local wifi_iface eth_iface
-
-  wifi_iface=$(get_wifi_iface)
-  eth_iface=$(ip link | awk '/^[0-9]+: en[po]/ { gsub(":",""); print $2; exit }')
-
-  # Ethernet
-  local eth_connected=false
-  if [ -n "$eth_iface" ]; then
-    eth_state=$(ip link show "$eth_iface" 2>/dev/null | awk '/state/ { print $9 }')
-    [ "$eth_state" = "UP" ] && eth_connected=true
-  fi
-
-  # USB tethering
-  local usb_iface usb_connected=false
-  usb_iface=$(get_usb_iface)
-  if [ -n "$usb_iface" ] && ip -4 addr show "$usb_iface" 2>/dev/null | grep -q "inet "; then
-    usb_connected=true
-  fi
-
-  # WiFi - use IP presence as connection indicator (more reliable than wpa_cli)
-  local wifi_connected=false wifi_enabled=false wifi_icon="󰤮" wifi_ssid=""
-  if ! rfkill list wlan 2>/dev/null | grep -q "Soft blocked: yes"; then
-    wifi_enabled=true
-  fi
-  if [ -n "$wifi_iface" ] && ip -4 addr show "$wifi_iface" 2>/dev/null | grep -q "inet "; then
-    wifi_connected=true
-    wifi_ssid=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status 2>/dev/null \
-      | awk -F= '/^ssid=/ { print $2 }')
-    signal=$(awk -v iface="$wifi_iface" '$1 == iface ":" { gsub(/\./, "", $4); print $4; exit }' /proc/net/wireless)
-    wifi_icon=$(signal_icon "$signal")
-  fi
-
-  printf '{"wifi":{"connected":%s,"enabled":%s,"icon":"%s","ssid":"%s"},"ethernet":{"connected":%s},"usb":{"connected":%s}}\n' \
-    "$wifi_connected" "$wifi_enabled" "$wifi_icon" "$wifi_ssid" "$eth_connected" "$usb_connected"
+band() {
+  local f=${1:-0}
+  if ((f >= 5925)); then echo "6 GHz"
+  elif ((f >= 4900)); then echo "5 GHz"
+  elif ((f >= 2400)); then echo "2.4 GHz"
+  else echo ""; fi
 }
 
-make_content
-ip monitor | while read -r _; do
-  make_content
-done
+generation() {
+  case ${1:-} in
+    7) echo "Wi-Fi 7" ;; 6) echo "Wi-Fi 6" ;; 5) echo "Wi-Fi 5" ;; 4) echo "Wi-Fi 4" ;; *) echo "" ;;
+  esac
+}
+
+state() {
+  local wifi eth usb
+  wifi=$(wifi_iface)
+  eth=$(eth_iface)
+  usb=$(usb_iface)
+
+  local w_enabled=false w_connected=false w_icon="󰤮" w_ssid="" w_ip="" w_freq=0 w_gen="" w_signal=0 wpa
+  rfkill list wlan 2>/dev/null | grep -q "Soft blocked: yes" || w_enabled=true
+  if [[ -n $wifi ]]; then
+    w_ip=$(ipv4 "$wifi")
+    if [[ -n $w_ip ]]; then
+      w_connected=true
+      wpa=$(wpa_cli -g "/run/wpa_supplicant/$wifi" status 2>/dev/null)
+      w_ssid=$(awk -F= '/^ssid=/ { print $2; exit }' <<<"$wpa")
+      w_freq=$(awk -F= '/^freq=/ { print $2; exit }' <<<"$wpa")
+      w_gen=$(generation "$(awk -F= '/^wifi_generation=/ { print $2; exit }' <<<"$wpa")")
+      w_signal=$(awk -v i="$wifi:" '$1 == i { sub(/\./, "", $4); print $4; exit }' /proc/net/wireless)
+      w_icon=$(signal_icon "$w_signal")
+    fi
+  fi
+
+  local e_connected=false e_ip="" e_speed="" spd
+  if [[ -n $eth ]] && ip -o link show "$eth" 2>/dev/null | grep -q "state UP"; then
+    e_connected=true
+    e_ip=$(ipv4 "$eth")
+    spd=$(cat "/sys/class/net/$eth/speed" 2>/dev/null)
+    [[ ${spd:-0} -gt 0 ]] 2>/dev/null && e_speed="${spd} Mbps"
+  fi
+
+  local u_connected=false u_ip=""
+  if [[ -n $usb ]]; then
+    u_ip=$(ipv4 "$usb")
+    [[ -n $u_ip ]] && u_connected=true
+  fi
+
+  printf '{"wifi":{"connected":%s,"enabled":%s,"icon":"%s","ssid":"%s","ip":"%s","freq":%s,"band":"%s","gen":"%s","signal":%s},' \
+    "$w_connected" "$w_enabled" "$w_icon" "$(jstr "$w_ssid")" "$w_ip" "${w_freq:-0}" "$(band "$w_freq")" "$w_gen" "${w_signal:-0}"
+  printf '"ethernet":{"connected":%s,"interface":"%s","ip":"%s","speed":"%s"},' \
+    "$e_connected" "$eth" "$e_ip" "$e_speed"
+  printf '"usb":{"connected":%s,"interface":"%s","ip":"%s"},' \
+    "$u_connected" "$usb" "$u_ip"
+  wg_json
+  printf '}'
+}
+
+# --- WireGuard: interfaces from the wireguard-<name>.service units (so a
+# tunnel that is down still shows up) plus any live wireguard-type link.
+# `wg show` needs root, so peer names and the endpoint come from the peer
+# units instead.
+
+wg_ifaces() {
+  {
+    systemctl list-units --all --plain --no-legend 'wireguard-*.service' 2>/dev/null \
+      | awk '$1 !~ /-peer-/ { sub(/^wireguard-/, "", $1); sub(/\.service$/, "", $1); print $1 }'
+    ip -d -o link 2>/dev/null | awk '/ wireguard / { sub(":", "", $2); print $2 }'
+  } | sort -u
+}
+
+human_bytes() {
+  awk -v b="${1:-0}" 'BEGIN {
+    split("B KiB MiB GiB TiB", u, " "); i = 1
+    while (b >= 1024 && i < 5) { b /= 1024; i++ }
+    printf (i == 1 ? "%d %s" : "%.1f %s"), b, u[i] }'
+}
+
+wg_json() { # prints the "wireguard" array and the "vpn" summary
+  local name up ip rx tx peers endpoint peer_unit peer_script sep="" out="[" vpn_up=false vpn_name=""
+  while read -r name; do
+    [[ -n $name ]] || continue
+    up=false ip="" rx=0 tx=0 endpoint=""
+    if [[ -d /sys/class/net/$name ]]; then
+      ip -o link show "$name" 2>/dev/null | grep -q '<[^>]*UP' && up=true
+      ip=$(ipv4 "$name")
+      rx=$(<"/sys/class/net/$name/statistics/rx_bytes")
+      tx=$(<"/sys/class/net/$name/statistics/tx_bytes")
+    fi
+    peers=$(systemctl list-units --all --plain --no-legend "wireguard-$name-peer-*.service" 2>/dev/null \
+      | awk '{ print $1 }' | sed "s/^wireguard-$name-peer-//; s/\.service\$//" | paste -sd, -)
+    peer_unit=$(systemctl list-units --all --plain --no-legend "wireguard-$name-peer-*.service" 2>/dev/null \
+      | awk 'NR == 1 { print $1 }')
+    # NixOS puts `wg set … endpoint "host:port"` in the peer unit's start script
+    if [[ -n $peer_unit ]]; then
+      peer_script=$(systemctl show -p ExecStart --value "$peer_unit" 2>/dev/null \
+        | sed -n 's/.*path=\([^ ;]*\).*/\1/p' | awk 'NR == 1')
+      [[ -r $peer_script ]] && endpoint=$(grep -o 'endpoint "[^"]*"' "$peer_script" 2>/dev/null \
+        | awk -F'"' 'NR == 1 { print $2 }')
+    fi
+    if [[ $up == true && $vpn_up == false ]]; then vpn_up=true vpn_name=$name; fi
+    [[ -z $vpn_name ]] && vpn_name=$name
+    out+="$sep{\"name\":\"$(jstr "$name")\",\"up\":$up,\"ip\":\"$ip\",\"rx\":\"$(human_bytes "$rx")\",\"tx\":\"$(human_bytes "$tx")\",\"peers\":\"$(jstr "$peers")\",\"endpoint\":\"$(jstr "$endpoint")\"}"
+    sep=,
+  done < <(wg_ifaces)
+  printf '"wireguard":%s],"vpn":{"up":%s,"name":"%s"}' "$out" "$vpn_up" "$(jstr "$vpn_name")"
+}
+
+refresh() { emit "$(state)"; }
+_link_events() { exec ip monitor link address; }
+
+refresh
+mux_init
+mux_add _link_events
+mux_tick 30
+mux_loop refresh

modules/home/wayland/apps/eww/bar/scripts/net/netinfo

@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-get_wifi_iface() {
-  awk 'NR > 2 { gsub(":", "", $1); print $1; exit }' /proc/net/wireless
-}
-
-get_usb_iface() {
-  ip link 2>/dev/null | awk '
-    /^[0-9]+: usb[0-9]/ { gsub(":", "", $2); print $2; exit }
-    /^[0-9]+: enx/      { gsub(":", "", $2); print $2; exit }
-  '
-}
-
-freq_band() {
-  local f="$1"
-  if   [ "$f" -ge 6000 ] 2>/dev/null; then echo "6 GHz"
-  elif [ "$f" -ge 5000 ] 2>/dev/null; then echo "5 GHz"
-  elif [ "$f" -ge 2400 ] 2>/dev/null; then echo "2.4 GHz"
-  else echo ""; fi
-}
-
-wifi_gen_label() {
-  case "$1" in
-    7) echo "Wi-Fi 7" ;; 6) echo "Wi-Fi 6" ;;
-    5) echo "Wi-Fi 5" ;; 4) echo "Wi-Fi 4" ;;
-    *) echo "" ;;
-  esac
-}
-
-make_content() {
-  local wifi_iface eth_iface
-  wifi_iface=$(get_wifi_iface)
-  eth_iface=$(ip link | awk '/^[0-9]+: en[po]/ { gsub(":",""); print $2; exit }')
-
-  local wifi_ssid="" wifi_ip="" wifi_freq=0 wifi_band="" wifi_gen="" wifi_signal=0
-  if [ -n "$wifi_iface" ] && ip -4 addr show "$wifi_iface" 2>/dev/null | grep -q "inet "; then
-    local wpa
-    wpa=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status 2>/dev/null)
-    wifi_ssid=$(echo "$wpa"    | awk -F= '/^ssid=/            { print $2 }')
-    wifi_ip=$(ip -4 addr show "$wifi_iface" | awk '/inet / { print $2 }')
-    wifi_freq=$(echo "$wpa"   | awk -F= '/^freq=/             { print $2 }')
-    local gen
-    gen=$(echo "$wpa"         | awk -F= '/^wifi_generation=/  { print $2 }')
-    wifi_band=$(freq_band "$wifi_freq")
-    wifi_gen=$(wifi_gen_label "$gen")
-    wifi_signal=$(awk -v iface="$wifi_iface" \
-      '$1 == iface ":" { gsub(/\./, "", $4); print $4; exit }' /proc/net/wireless)
-  fi
-
-  local eth_ip="" eth_speed="" eth_state="down"
-  if [ -n "$eth_iface" ]; then
-    eth_state=$(ip link show "$eth_iface" 2>/dev/null | awk '/state/ { print tolower($9) }')
-    if [ "$eth_state" = "up" ]; then
-      eth_ip=$(ip -4 addr show "$eth_iface" | awk '/inet / { print $2 }')
-      local spd
-      spd=$(cat /sys/class/net/"$eth_iface"/speed 2>/dev/null)
-      [ "${spd:-0}" -gt 0 ] 2>/dev/null && eth_speed="${spd} Mbps"
-    fi
-  fi
-
-  local usb_iface usb_ip=""
-  usb_iface=$(get_usb_iface)
-  if [ -n "$usb_iface" ] && ip -4 addr show "$usb_iface" 2>/dev/null | grep -q "inet "; then
-    usb_ip=$(ip -4 addr show "$usb_iface" | awk '/inet / { print $2 }')
-  fi
-
-  # shellcheck disable=SC2059
-  printf '{"wifi":{"ssid":"%s","ip":"%s","freq":%s,"band":"%s","gen":"%s","signal":%s},' \
-    "$wifi_ssid" "$wifi_ip" "${wifi_freq:-0}" "$wifi_band" "$wifi_gen" "${wifi_signal:-0}"
-  printf '"ethernet":{"state":"%s","ip":"%s","speed":"%s","interface":"%s"},' \
-    "$eth_state" "$eth_ip" "$eth_speed" "${eth_iface:-}"
-  printf '"usb":{"interface":"%s","ip":"%s"}}\n' \
-    "${usb_iface:-}" "$usb_ip"
-}
-
-make_content
-ip monitor | while read -r _; do
-  make_content
-done

modules/home/wayland/apps/eww/bar/scripts/net/wg-toggle

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Bring the WireGuard tunnel $1 down (stop its service, which takes the peer
+# units with it) or up (start its target, which pulls service and peers).
+# Needs the polkit rule from modules/nixos/system/network/wireguard.
+name=$1
+[[ -n $name ]] || exit 64
+if [[ -d /sys/class/net/$name ]]; then
+  systemctl stop "wireguard-$name.service"
+else
+  systemctl start "wireguard-$name.target"
+fi

modules/home/wayland/apps/eww/bar/scripts/nightlight

@@ -1,13 +1,22 @@
 #!/usr/bin/env bash
-case "$1" in
-  status)
-    pgrep -x wlsunset >/dev/null 2>&1 && echo true || echo false
-    ;;
+# Toggle wlsunset.  It runs as the transient user unit eww-nightlight, so it
+# survives eww restarts and can be stopped by name.
+unit=eww-nightlight
+
+active() { systemctl --user is-active --quiet "$unit" || pgrep -x wlsunset >/dev/null; }
+
+case ${1:-} in
+  status) active && echo true || echo false ;;
   *)
-    if pgrep -x wlsunset >/dev/null 2>&1; then
-      pkill -x wlsunset && echo false
+    if active; then
+      systemctl --user stop "$unit" 2>/dev/null
+      pkill -x wlsunset
+      state=false
     else
-      wlsunset -T 4500 -t 3200 & echo true
+      detach -u "$unit" wlsunset -T 4500 -t 3200
+      state=true
     fi
+    eww update night-light="$state" 2>/dev/null
+    echo "$state"
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/panel-toggle

@@ -1,18 +1,41 @@
 #!/usr/bin/env bash
-PANEL="$1"
+# Toggle a panel of the popup window on the focused monitor.
+#
+# The popup hosts every panel behind revealers, so switching panels while it
+# is open is just a variable update (animated, no scripts restarted).  It is
+# only closed and re-opened when it has to move to another monitor.
+#
+# `eww open popup` takes longer than the client's 100 ms reply deadline, so
+# its exit status and error output are meaningless and ignored (the daemon
+# carries the command out anyway; the lib's eww wrapper makes sure a slow
+# reply can never spawn a second daemon).
+panel=$1
+[[ -n $panel ]] || exit 64
 
-# Atomic lock: flock acquires exclusively or exits immediately.
-# Released automatically when the process exits (no trap needed).
-exec 9>"/tmp/eww_panel_toggle.lock"
+# One toggle at a time; the lock dies with this process.  fd 9 is closed for
+# every eww call so nothing can inherit it.
+exec 9>"${XDG_RUNTIME_DIR:-/tmp}/eww-panel-toggle.lock"
 flock -n 9 || exit 0
 
-CURRENT=$(eww get active-panel 2>/dev/null | tr -d '"')
+ew() { eww "$@" 9>&-; }
 
-if [ "$CURRENT" = "$PANEL" ]; then
-  eww update active-panel=""
-  eww close popup 2>/dev/null
+current=$(ew get active-panel 2>/dev/null | tr -d '"')
+popup_screen=$(ew get popup-screen 2>/dev/null | tr -d '"')
+screen=$(eww-bar focused)
+if ew active-windows 2>/dev/null | grep -qx 'popup: popup'; then open=1; else open=0; fi
+
+if ((open)) && [[ $current == "$panel" ]]; then
+  ew update active-panel=
+  ew close popup 2>/dev/null
+elif ((open)) && [[ -n $screen && $popup_screen == "$screen" ]]; then
+  ew update active-panel="$panel"
 else
-  eww update active-panel="$PANEL"
-  eww close popup 2>/dev/null
-  eww-open-on-current-screen popup
+  ((open)) && ew close popup 2>/dev/null
+  ew update active-panel="$panel" popup-screen="$screen"
+  if [[ -n $screen ]]; then
+    ew open popup --screen "$screen" >/dev/null 2>&1
+  else
+    ew open popup >/dev/null 2>&1
+  fi
 fi
+exit 0

modules/home/wayland/apps/eww/bar/scripts/power-save

@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
-case "$1" in
-  status)
-    powerprofilesctl get | grep -q power-saver && echo true || echo false
-    ;;
+# Toggle the power-saver profile (power-profiles-daemon).
+active() { [[ $(powerprofilesctl get 2>/dev/null) == power-saver ]]; }
+
+case ${1:-} in
+  status) active && echo true || echo false ;;
   *)
-    if powerprofilesctl get | grep -q power-saver; then
-      powerprofilesctl set balanced 2>/dev/null || true
-      echo false
+    if active; then
+      powerprofilesctl set balanced 2>/dev/null
+      state=false
     else
-      powerprofilesctl set power-saver 2>/dev/null || true
-      echo true
+      powerprofilesctl set power-saver 2>/dev/null
+      state=true
     fi
+    eww update power-save="$state" 2>/dev/null
+    echo "$state"
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/powermenu-toggle

@@ -1,4 +1,12 @@
 #!/usr/bin/env bash
+# Toggle the full-screen power menu on the focused monitor.  The open's exit
+# status is ignored: it exceeds the client's 100 ms reply deadline.
 eww close popup 2>/dev/null
-eww update active-panel=""
-eww-open-on-current-screen powermenu --toggle
+eww update active-panel= 2>/dev/null
+screen=$(eww-bar focused)
+if [[ -n $screen ]]; then
+  eww open powermenu --toggle --screen "$screen" >/dev/null 2>&1
+else
+  eww open powermenu --toggle >/dev/null 2>&1
+fi
+exit 0

modules/home/wayland/apps/eww/bar/scripts/radio

@@ -1,229 +1,225 @@
 #!/usr/bin/env bash
+# Internet radio (radiorecord.ru) and MPRIS "now playing" for the media panel.
+#
+#   radio                 status loop (deflisten)
+#   radio start ID        tune to station ID
+#   radio toggle          play / stop the last station
+#   radio stop
+#   radio vol PERCENT     volume of the radio stream, else of the external player
+#   radio mute            mute toggle, same target as vol
+#
+# mpv runs as the transient user unit eww-radio: independent of the eww
+# daemon, and `systemctl --user stop eww-radio` always works.
 
-URL_BASE="https://www.radiorecord.ru/api"
-MPV_PID_FILE="/tmp/mpv_radio_pid"
-RADIO_ID_FILE="/tmp/radio_id"
+api="https://www.radiorecord.ru/api"
+unit=eww-radio
+state_dir=${XDG_STATE_HOME:-$HOME/.local/state}/eww
+cache_dir=${XDG_CACHE_HOME:-$HOME/.cache}/eww
+id_file=$state_dir/radio-station
+mkdir -p "$state_dir" "$cache_dir"
 
-STATION_IDS='[507,522,523,536,537,42532,42602]'
+station_ids='[507,522,523,536,537,42532,42602]'
+# Extra stations: {id (unique integer >= 1000000), title, stream_hls, icon_fill_white ("" for none)}
+custom_stations='[]'
 
-# Custom (non-radiorecord) stations
-# id must be a unique integer >= 1000000 to avoid collision with radiorecord IDs.
-# icon_fill_white: URL to station icon image, or "" for none.
-CUSTOM_STATIONS='[
-]'
+default_song='{"artist":"","song":"","image600":""}'
+default_media='{"player":"","status":"Stopped","artist":"","title":"","art":""}'
+stations_cache="$cache_dir/radio-stations-$(cksum <<<"$station_ids$custom_stations" | cut -d' ' -f1).json"
 
-STATIONS="[]"
-DEFAULT_INFO='{"artist":"","song":"","image600":""}'
-DEFAULT_MEDIA='{"player":"","status":"Stopped","artist":"","title":"","art":""}'
+# --- stations --------------------------------------------------------------
 
-PID=$([ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0)
-RADIO_ID=$([ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0)
-PAUSED=$(( PID == 0 ? 1 : 0 ))
-INFO="$DEFAULT_INFO"
-MEDIA="$DEFAULT_MEDIA"
-STATUS="{}"
-
-get_stations() {
-  local rr
-  rr=$(curl -s --compressed "$URL_BASE/stations/" 2>/dev/null \
-    | jq --argjson ids "$STATION_IDS" \
-        '.result.stations | map(select(.id | IN($ids[]))) | map({id, title, stream_hls, icon_fill_white, "radiorecord": true})' 2>/dev/null)
-  jq -n \
-    --argjson rr "${rr:-[]}" \
-    --argjson custom "$CUSTOM_STATIONS" \
-    '$rr + ($custom | map(. + {"radiorecord": false}))'
-}
-
-get_song() {
-  curl -s --compressed "$URL_BASE/station/history/?id=$RADIO_ID" \
-    | jq '.result.history[0] | {artist, song, image600}'
-}
-
-get_stream_url() {
-  echo "$STATIONS" | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].stream_hls // empty'
-}
-
-get_player_info() {
-  local player status artist title art
-  # exclude mpv (radio) so it never appears as "external player"
-  player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
-  if [ -z "$player" ]; then
-    echo '{"player":"","status":"Stopped","artist":"","title":"","art":""}'
+# Station list, cached for a day (it only changes with station_ids).
+stations() {
+  if [[ -s $stations_cache && -n $(find "$stations_cache" -mmin -1440 2>/dev/null) ]]; then
+    cat "$stations_cache"
     return
   fi
-  status=$(playerctl -p "$player" status 2>/dev/null || echo "Stopped")
-  artist=$(playerctl -p "$player" metadata artist 2>/dev/null || echo "")
-  title=$(playerctl -p "$player" metadata title 2>/dev/null || echo "")
-  art=$(playerctl -p "$player" metadata mpris:artUrl 2>/dev/null || echo "")
-  jq -cnr --arg player "$player" --arg status "$status" \
-    --arg artist "$artist" --arg title "$title" --arg art "$art" \
-    '{player:$player, status:$status, artist:$artist, title:$title, art:$art}'
-}
-
-update_state() {
-  PID=$([ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0)
-  RADIO_ID=$([ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0)
-  if [ "$PID" -gt 0 ] && ! kill -0 "$PID" 2>/dev/null; then
-    PID=0
-    rm -f "$MPV_PID_FILE"
+  local rr out
+  rr=$(curl -sf --compressed --max-time 8 "$api/stations/" 2>/dev/null \
+    | jq -c --argjson ids "$station_ids" \
+      '.result.stations | map(select(.id | IN($ids[]))) | map({id, title, stream_hls, icon_fill_white, radiorecord: true})' 2>/dev/null)
+  if [[ -z $rr || $rr == null ]]; then
+    [[ -s $stations_cache ]] && { cat "$stations_cache"; return; }
+    rr='[]'
   fi
-  PAUSED=$(( PID == 0 ? 1 : 0 ))
+  out=$(jq -cn --argjson rr "$rr" --argjson custom "$custom_stations" '$rr + ($custom | map(. + {radiorecord: false}))')
+  [[ $rr != '[]' ]] && printf '%s\n' "$out" >"$stations_cache"
+  printf '%s\n' "$out"
 }
 
-emit_status() {
-  jq -cnr \
-    --argjson stations "${STATIONS:-[]}" \
-    --argjson radio_id "${RADIO_ID:-0}" \
-    --argjson is_paused "${PAUSED:-1}" \
-    --argjson info "${INFO:-$DEFAULT_INFO}" \
-    --argjson media "${MEDIA:-$DEFAULT_MEDIA}" \
-    '{"is_paused": $is_paused, "song": $info, "radio": $radio_id, "stations": $stations, "media": $media}'
+station() { # ID FIELD
+  jq -r --argjson id "${1:-0}" --arg f "$2" 'first(.[] | select(.id == $id) | .[$f]) // empty' <<<"$STATIONS"
 }
 
-get_stream_node() {
-  local name="$1"
-  wpctl status 2>/dev/null | awk -v pat="$name" '
-    /Streams:/ { in_s = 1 }
-    /Sinks:|Sources:|Clients:/ { in_s = 0 }
-    in_s && /[0-9]+\./ && tolower($0) ~ tolower(pat) {
-      match($0, /[0-9]+/); print substr($0, RSTART, RLENGTH); exit
-    }
-  '
+current_id() {
+  local id
+  id=$(cat "$id_file" 2>/dev/null)
+  [[ $id =~ ^[0-9]+$ ]] && echo "$id" || echo 0
 }
 
-get_mpv_node() {
-  get_stream_node "mpv"
+playing() { systemctl --user is-active --quiet "$unit"; }
+
+# --- playback --------------------------------------------------------------
+
+start() {
+  local id=${1:-0} url
+  ((id > 0)) || return 1
+  STATIONS=$(stations)
+  url=$(station "$id" stream_hls)
+  [[ -n $url && $url != null ]] || return 1
+  systemctl --user stop "$unit" 2>/dev/null
+  detach -u "$unit" mpv --no-video --really-quiet --audio-client-name="$unit" "$url" || return 1
+  printf '%s\n' "$id" >"$id_file"
+}
+
+stop() { systemctl --user stop "$unit" 2>/dev/null; }
+
+# --- volume ----------------------------------------------------------------
+
+# PipeWire node id of the first stream whose line matches $1 (case-insensitive).
+stream_node() {
+  wpctl status 2>/dev/null | awk -v pat="$1" '
+    /Streams:/ { s = 1; next }
+    /Sinks:|Sources:|Filters:|Clients:/ { s = 0 }
+    s && tolower($0) ~ tolower(pat) && match($0, /[0-9]+\./) { print substr($0, RSTART, RLENGTH - 1); exit }'
+}
+
+external_player() { playerctl -l 2>/dev/null | grep -v '^mpv' | head -n1; }
+
+# "pw NODE" while the radio plays, else "mpris PLAYER" for an external player.
+volume_target() {
+  local n p
+  if playing; then
+    n=$(stream_node "$unit")
+    [[ -n $n ]] && { echo "pw $n"; return; }
+  fi
+  p=$(external_player)
+  [[ -n $p ]] && echo "mpris $p"
 }
 
 get_volume() {
-  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
-    local node_id; node_id=$(get_mpv_node)
-    [ -n "$node_id" ] && wpctl get-volume "$node_id" 2>/dev/null \
-      | awk '{printf "%d", $2 * 100}'
+  local kind target
+  read -r kind target < <(volume_target)
+  case $kind in
+    pw) wpctl get-volume "$target" 2>/dev/null | awk '{ printf "%d", $2 * 100 + 0.5 }' ;;
+    mpris) playerctl -p "$target" volume 2>/dev/null | awk '{ printf "%d", $1 * 100 + 0.5 }' ;;
+  esac
+}
+
+set_volume() {
+  local vol=${1%.*} kind target
+  read -r kind target < <(volume_target)
+  case $kind in
+    pw) wpctl set-volume -l 1.0 "$target" "${vol}%" ;;
+    mpris) playerctl -p "$target" volume "$(awk -v v="$vol" 'BEGIN { printf "%.2f", v / 100 }')" 2>/dev/null ;;
+  esac
+  eww update radio-vol="$vol" 2>/dev/null
+}
+
+toggle_mute() {
+  local kind target n=""
+  read -r kind target < <(volume_target)
+  case $kind in
+    pw) n=$target ;;
+    mpris) n=$(stream_node "${target%%.*}") ;;
+  esac
+  [[ -n $n ]] || return
+  wpctl set-mute "$n" toggle
+  if wpctl get-volume "$n" 2>/dev/null | grep -q MUTED; then muted=true; else muted=false; fi
+  eww update radio-muted="$muted" 2>/dev/null
+}
+
+# --- status loop -----------------------------------------------------------
+
+media_json() { # PLAYER STATUS ARTIST TITLE ART
+  jq -cn --arg player "$1" --arg status "${2:-Stopped}" --arg artist "$3" --arg title "$4" --arg art "$5" \
+    '{player: $player, status: $status, artist: $artist, title: $title, art: $art}'
+}
+
+song_playing() { # ID → SONG from the station history (radiorecord) or the title
+  local id=$1 fetched
+  if [[ $(station "$id" radiorecord) == true ]]; then
+    fetched=$(curl -sf --compressed --max-time 8 "$api/station/history/?id=$id" 2>/dev/null \
+      | jq -c '.result.history[0] | {artist: (.artist // ""), song: (.song // ""), image600: (.image600 // "")}' 2>/dev/null)
+    [[ -n $fetched && $fetched != null ]] && SONG=$fetched
   else
-    local player; player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
-    [ -n "$player" ] && playerctl -p "$player" volume 2>/dev/null \
-      | awk '{printf "%d", $1 * 100}'
+    SONG=$(jq -cn --arg t "$(station "$id" title)" '{artist: "", song: $t, image600: ""}')
   fi
 }
 
-do_vol() {
-  local vol="${1%.*}"
-  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
-    local node_id; node_id=$(get_mpv_node)
-    [ -n "$node_id" ] && wpctl set-volume "$node_id" "${vol}%"
-  else
-    playerctl volume "$(awk -v v="$vol" 'BEGIN{printf "%.2f", v/100}')" 2>/dev/null
-  fi
-  eww update radio-vol="$vol"
+song_idle() { # ID → placeholder with the station's name and logo
+  SONG=$(jq -cn --arg t "$(station "$1" title)" --arg i "$(station "$1" icon_fill_white)" \
+    '{artist: "", song: $t, image600: $i}')
 }
 
-do_mute() {
-  local node_id
-  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
-    node_id=$(get_mpv_node)
-  else
-    local player; player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
-    [ -n "$player" ] && node_id=$(get_stream_node "${player%%.*}")
-  fi
-  [ -z "$node_id" ] && return
-  wpctl set-mute "$node_id" toggle
-  if wpctl get-volume "$node_id" 2>/dev/null | grep -q MUTED; then
-    eww update radio-muted=true
-  else
-    eww update radio-muted=false
+# playerctl --follow line: media\tPLAYER\tSTATUS\tARTIST\tTITLE\tART
+media_event() {
+  local player status artist title art
+  IFS=$'\t' read -r player status artist title art <<<"$1"
+  if [[ -z $player ]]; then
+    MEDIA=$default_media MEDIA_PLAYER=""
+  elif [[ $player != mpv* ]]; then # the radio and jellyfin are mpv, not "external"
+    MEDIA=$(media_json "$player" "$status" "$artist" "$title" "$art")
+    MEDIA_PLAYER=$player
   fi
 }
 
-do_start() {
-  [ "$RADIO_ID" -le 0 ] && return
-  STATIONS=$(get_stations)
-  RADIO_URL=$(get_stream_url)
-  [ -z "$RADIO_URL" ] || [ "$RADIO_URL" = "null" ] && return
-  [ "$PID" -gt 0 ] && kill "$PID" 2>/dev/null
-  nohup mpv --no-video --quiet "$RADIO_URL" >/dev/null 2>&1 &
-  echo $! > "$MPV_PID_FILE"
-  echo "$RADIO_ID" > "$RADIO_ID_FILE"
+_media_events() {
+  exec playerctl -a --follow metadata \
+    --format $'media\t{{playerName}}\t{{status}}\t{{artist}}\t{{title}}\t{{mpris:artUrl}}'
+}
+
+refresh() {
+  local line id now
+  for line in "$@"; do
+    [[ $line == media$'\t'* ]] && media_event "${line#media$'\t'}"
+  done
+  # a player that quit without a final metadata line
+  if [[ -n $MEDIA_PLAYER ]] && ! playerctl -l 2>/dev/null | grep -qx "$MEDIA_PLAYER"; then
+    MEDIA=$default_media MEDIA_PLAYER=""
+  fi
+
+  id=$(current_id)
+  now=$SECONDS
+  if playing; then
+    if [[ $PLAYING != true ]] || ((now - LAST_SONG >= 15)); then
+      PLAYING=true
+      song_playing "$id"
+      LAST_SONG=$now
+    fi
+  elif [[ $PLAYING != false ]]; then
+    PLAYING=false
+    song_idle "$id"
+  fi
+
+  emit "$(jq -cn --argjson stations "$STATIONS" --argjson radio "$id" \
+    --argjson paused "$([[ $PLAYING == true ]] && echo 0 || echo 1)" \
+    --argjson song "$SONG" --argjson media "$MEDIA" \
+    '{is_paused: $paused, song: $song, radio: $radio, stations: $stations, media: $media}')"
+
+  local v
+  v=$(get_volume)
+  if [[ -n $v && $v != "$LAST_VOL" ]]; then
+    LAST_VOL=$v
+    eww update radio-vol="$v" 2>/dev/null
+  fi
 }
 
 status_loop() {
-  STATIONS=$(get_stations)
-  echo "$(emit_status)"
-
-  last_pid_check=0
-  last_song_fetch=0
-  last_media_fetch=0
-
-  while true; do
-    now=$(date -u +%s%3N)
-
-    if (( now - last_pid_check > 1000 )); then
-      update_state
-      NEW_STATUS=$(emit_status)
-      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
-      last_pid_check=$now
-    fi
-
-    if (( now - last_song_fetch > 15000 )); then
-      if [ "$PAUSED" = 0 ]; then
-        IS_RR=$(echo "$STATIONS" | jq --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].radiorecord // true')
-        if [ "$IS_RR" = "true" ]; then
-          FETCHED=$(get_song)
-          INFO=$(echo "$INFO" "$FETCHED" | jq -s '
-            reduce .[] as $x ({}; . + ($x | with_entries(select(.value != null))))')
-        else
-          STATION_TITLE=$(echo "$STATIONS" | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].title // ""')
-          INFO=$(jq -cnr --arg title "$STATION_TITLE" '{artist:"",song:$title,image600:""}')
-        fi
-      else
-        STATION_IMG=$(echo "$STATIONS" \
-          | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].icon_fill_white // ""')
-        STATION_TITLE=$(echo "$STATIONS" \
-          | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].title // ""')
-        INFO=$(jq -cnr --arg img "$STATION_IMG" --arg title "$STATION_TITLE" \
-          '{artist:"",song:$title,image600:$img}')
-      fi
-      NEW_STATUS=$(emit_status)
-      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
-      last_song_fetch=$now
-    fi
-
-    if (( now - last_media_fetch > 3000 )); then
-      MEDIA=$(get_player_info)
-      NEW_STATUS=$(emit_status)
-      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
-      VOL=$(get_volume)
-      [ -n "$VOL" ] && eww update radio-vol="$VOL" 2>/dev/null
-      last_media_fetch=$now
-    fi
-
-    sleep 0.5
-  done
+  STATIONS=$(stations)
+  SONG=$default_song MEDIA=$default_media MEDIA_PLAYER="" PLAYING="" LAST_SONG=0 LAST_VOL=""
+  refresh
+  mux_init
+  mux_add _media_events
+  mux_tick 2
+  mux_loop refresh
 }
 
-case "$1" in
-  start)
-    RADIO_ID="$2"
-    echo "$RADIO_ID" > "$RADIO_ID_FILE"
-    do_start
-    ;;
-  vol)
-    do_vol "$2"
-    ;;
-  mute)
-    update_state
-    do_mute
-    ;;
-  toggle)
-    update_state
-    if [ "$PAUSED" = 1 ]; then
-      [ "$RADIO_ID" -gt 0 ] && do_start
-    else
-      [ "$PID" -gt 0 ] && kill "$PID" 2>/dev/null
-      rm -f "$MPV_PID_FILE"
-    fi
-    ;;
-  *)
-    status_loop
-    ;;
+case ${1:-} in
+  start) start "$2" ;;
+  stop) stop ;;
+  toggle) if playing; then stop; else start "$(current_id)"; fi ;;
+  vol) set_volume "$2" ;;
+  mute) toggle_mute ;;
+  *) status_loop ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/read-mode

@@ -1,23 +1,23 @@
 #!/usr/bin/env bash
-SHADER="$HOME/.config/eww/shaders/read-mode.glsl"
+# Toggle the warm/low-contrast screen shader.  fp16 rendering is switched off
+# with it: the shader is written for 8-bit output.
+shader="$HOME/.config/eww/shaders/read-mode.glsl"
 
-is_active() {
-  hyprctl getoption decoration:screen_shader | grep -qF "$SHADER"
-}
+active() { hyprctl getoption decoration:screen_shader 2>/dev/null | grep -qF "$shader"; }
 
-case "$1" in
-  status)
-    is_active && echo true || echo false
-    ;;
+case ${1:-} in
+  status) active && echo true || echo false ;;
   *)
-    if is_active; then
-      hyprctl eval 'hl.config({ decoration = { screen_shader = "" } })'
-      hyprctl eval 'hl.config({ render = { use_fp16 = 2 } })'
-      echo false
+    if active; then
+      hyprctl eval 'hl.config({ decoration = { screen_shader = "" } })' >/dev/null
+      hyprctl eval 'hl.config({ render = { use_fp16 = 2 } })' >/dev/null
+      state=false
     else
-      hyprctl eval 'hl.config({ render = { use_fp16 = 0 } })'
-      hyprctl eval "hl.config({ decoration = { screen_shader = \"$SHADER\" } })"
-      echo true
+      hyprctl eval 'hl.config({ render = { use_fp16 = 0 } })' >/dev/null
+      hyprctl eval "hl.config({ decoration = { screen_shader = \"$shader\" } })" >/dev/null
+      state=true
     fi
+    eww update read-mode="$state" 2>/dev/null
+    echo "$state"
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/screenshot

@@ -1,4 +1,9 @@
 #!/usr/bin/env bash
+# Region screenshot → satty (annotate, copy to clipboard), detached from eww.
 eww close popup 2>/dev/null
-sleep 0.15
-hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command wl-copy
+eww update active-panel= 2>/dev/null
+hyprshot=$(command -v hyprshot)
+satty=$(command -v satty)
+wl_copy=$(command -v wl-copy)
+detach "$BASH" -c 'sleep 0.15; "$1" -m region --raw | "$2" --filename - --early-exit --action-on-enter save-to-clipboard --copy-command "$3"' \
+  screenshot "$hyprshot" "$satty" "$wl_copy"

modules/home/wayland/apps/eww/bar/scripts/sys/battery

@@ -1,61 +1,67 @@
-#!/usr/bin/env zsh
+#!/usr/bin/env bash
+# Battery state from sysfs; refreshes on power_supply udev events and every
+# 30 s.  Emits a `state` (charging / discharging / low / full / idle) that the
+# CSS maps to a colour, instead of hard-coding one here.
 
-icons=("󰂎" "󰁺" "󰁻" "󰁼" "󰁽" "󰁾" "󰁿" "󰂀" "󰂁" "󰂂" "󰁹")
-num_icons=$(awk -v n="${#icons[@]}" 'BEGIN{print 100 / n}')
-BATTERY="/sys/class/power_supply/BAT0"
-
-geticon() {
-  level=$(awk -v n="$CAPACITY" -v c="$num_icons" 'BEGIN{print int(n/c-1)}')
-  echo "${icons[$level]}"
-}
-
-status() {
-  if [ "$STATE" = "Charging" ]; then
-    echo -n "Charging"
-
-    if [ "$RATE" -gt 0 ]; then
-      echo ", $(gettime) left"
-    else
-      echo ""
-    fi
-  elif [ "$STATE" = "Discharging" ]; then
-    echo "$(gettime)h left"
-  else
-    echo "Fully Charged"
-  fi
-}
-
-color() {
-  [ "$CAPACITY" -le 20 ] && echo '#f38ba8' || echo '#a6e3a1'
-}
-
-wattage() {
-  awk -v rate="$RATE" -v uw="1000000" 'BEGIN{print sprintf("%.1f W", rate/uw)}'
-}
-
-gettime() {
-  FULL=$(cat $BATTERY/energy_full)
-  NOW=$(cat $BATTERY/energy_now)
-
-  if [ "$RATE" -gt 0 ]; then
-    if [ "$STATE" = "Discharging" ]; then
-      EX=$(( ($NOW*1.0) / $RATE))
-    else
-      EX=$(( (($FULL - $NOW)*1.0) / $RATE))
-    fi
-    date -u -d@"$(awk -v ex="$EX" 'BEGIN{print ex * 3600}')" +%H:%M
-  fi
-}
-
-if [ -d "$BATTERY" ]; then
-  while true; do
-    RATE=$(cat $BATTERY/power_now)
-    CAPACITY=$(cat $BATTERY/capacity)
-    STATE=$(cat $BATTERY/status)
-
-    echo '{ "visible": true, "icon": "'$(geticon)'", "percentage": '$CAPACITY', "wattage": "'$(wattage)'", "status": "'$(status)'", "color": "'$(color)'" }'
-    sleep 15
-  done
-else
-  echo '{ "visible": false,  "icon": "", "percentage": 0, "wattage": "", "status": "", "color": "#a6e3a1" }'
+bat=""
+for d in /sys/class/power_supply/*; do
+  [[ -r $d/type && $(<"$d/type") == Battery ]] && { bat=$d; break; }
+done
+if [[ -z $bat ]]; then
+  echo '{"visible":false,"percentage":0,"wattage":"","status":"","state":"none"}'
+  exit 0
 fi
+
+attr() { # first readable, non-empty attribute of the list, else 0
+  local a v
+  for a in "$@"; do
+    v=$(cat "$bat/$a" 2>/dev/null) && [[ -n $v ]] && { echo "$v"; return; }
+  done
+  echo 0
+}
+
+hours_to_clock() { awk -v h="$1" 'BEGIN { printf "%d:%02d", int(h), int((h - int(h)) * 60 + 0.5) }'; }
+
+state() {
+  local cap status rate now full power time="" wattage state
+  cap=$(attr capacity)
+  status=$(attr status)
+  rate=$(attr power_now current_now) # µW or µA
+  now=$(attr energy_now charge_now)  # µWh or µAh — same unit as rate, so now/rate = hours
+  full=$(attr energy_full charge_full)
+  if [[ -r $bat/power_now ]]; then power=$rate; else power=$((rate * $(attr voltage_now) / 1000000)); fi
+  wattage=$(awk -v p="$power" 'BEGIN { printf "%.1f W", p / 1000000 }')
+  if ((rate > 0)); then
+    case $status in
+      Discharging) time=$(hours_to_clock "$(awk -v n="$now" -v r="$rate" 'BEGIN { print n / r }')") ;;
+      Charging) time=$(hours_to_clock "$(awk -v n="$now" -v f="$full" -v r="$rate" 'BEGIN { print (f - n) / r }')") ;;
+    esac
+  fi
+  case $status in
+    Charging)
+      state=charging
+      status="Charging${time:+, $time left}"
+      ;;
+    Discharging)
+      state=discharging
+      ((cap <= 20)) && state=low
+      status=${time:+$time left}
+      ;;
+    Full)
+      state=full
+      status="Fully charged"
+      ;;
+    *) state=idle ;;
+  esac
+  printf '{"visible":true,"percentage":%s,"wattage":"%s","status":"%s","state":"%s"}' \
+    "$cap" "$wattage" "$(jstr "$status")" "$state"
+}
+
+refresh() { emit "$(state)"; }
+_ps_events() { exec udevadm monitor --udev --subsystem-match=power_supply; }
+
+refresh
+mux_init
+mux_add _ps_events
+mux_tick 30
+mux_loop refresh

modules/home/wayland/apps/eww/bar/scripts/sys/cpugrid

@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-COLS=4
-declare -A prev_idle prev_total
-
-emit_grid() {
-  local rows=() row_items=()
-  while IFS= read -r line; do
-    [[ $line =~ ^cpu([0-9]+) ]] || continue
-    local core="${BASH_REMATCH[1]}"
-    read -ra f <<< "$line"
-    local idle=$(( f[4] + f[5] ))
-    local total=0
-    for x in "${f[@]:1}"; do (( total += x )); done
-
-    local usage="0.0"
-    if [[ -n "${prev_total[$core]+x}" ]]; then
-      local dt=$(( total - prev_total[$core] ))
-      local di=$(( idle  - prev_idle[$core]  ))
-      (( dt > 0 )) && usage=$(awk "BEGIN{printf \"%.1f\", 100*(1-$di/$dt)}")
-    fi
-    prev_idle[$core]=$idle
-    prev_total[$core]=$total
-
-    local freq=0
-    local fpath="/sys/devices/system/cpu/cpu${core}/cpufreq/scaling_cur_freq"
-    [[ -r $fpath ]] && freq=$(( $(< "$fpath") / 1000 ))
-
-    row_items+=("{\"core\":$core,\"usage\":$usage,\"freq\":$freq}")
-
-    if (( ${#row_items[@]} == COLS )); then
-      local row; printf -v row '%s,' "${row_items[@]}"; row="${row%,}"
-      rows+=("[$row]")
-      row_items=()
-    fi
-  done < /proc/stat
-
-  if (( ${#row_items[@]} > 0 )); then
-    local row; printf -v row '%s,' "${row_items[@]}"; row="${row%,}"
-    rows+=("[$row]")
-  fi
-
-  local out; printf -v out '%s,' "${rows[@]}"; out="${out%,}"
-  echo "[$out]"
-}
-
-while true; do
-  emit_grid
-  sleep 2
-done

modules/home/wayland/apps/eww/bar/scripts/sys/cputemp

@@ -1,3 +1,10 @@
 #!/usr/bin/env bash
-dir=$(grep -rl k10temp /sys/class/hwmon/*/name 2>/dev/null | head -1 | xargs dirname)
-awk '{printf "%.0f\n", $1/1000}' "$dir/temp1_input"
+# CPU package temperature in °C from the first known hwmon driver.
+for name in k10temp zenpower coretemp cpu_thermal acpitz; do
+  for d in /sys/class/hwmon/hwmon*; do
+    [[ -r $d/name && $(<"$d/name") == "$name" && -r $d/temp1_input ]] || continue
+    awk '{ printf "%d\n", $1 / 1000 }' "$d/temp1_input"
+    exit 0
+  done
+done
+echo 0

modules/home/wayland/apps/eww/bar/scripts/sys/gpu

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-amdgpu_top -J -s 5000 | jq -c --unbuffered '.devices[0] | {
+# AMD GPU activity, clocks, temperature, power and VRAM via amdgpu_top's JSON
+# stream, flattened to what the widgets need.
+exec amdgpu_top -J -s 5000 | jq -c --unbuffered '.devices[0] | {
   gfx_pct:   (.gpu_activity.GFX.value // 0),
   mem_pct:   (.gpu_activity.Memory.value // 0),
   media_pct: (.gpu_activity.MediaEngine.value // 0),

modules/home/wayland/apps/eww/bar/scripts/sys/memory

@@ -1,13 +1,18 @@
-#!/usr/bin/env zsh
-
-total="$(free --si | rg Mem | awk '{print $2}')"
-
-human() {
-  awk -v mem="$1" 'BEGIN{print sprintf("%.1f%s", mem/1000/(mem > 1000000 ? 1000 : 1), mem > 1000000 ? "G" : "M")}'
-}
-
-free --si -s 3 | rg --line-buffered Mem | while read -r line; do
-  used=$(echo "$line" | awk '{print $3}')
-  cached=$(echo "$line" | awk '{print $6}')
-  echo '{"human": {"total": "'$(human "$total")'", "used": "'$(human "$used")'", "cached": "'$(human "$cached")'"}, "total": "'$total'", "used": "'$used'", "cached": "'$cached'"}'
+#!/usr/bin/env bash
+# RAM and swap from /proc/meminfo every 3 s.  "used" follows `free`
+# (total - available); "cached" is buffers + page cache + reclaimable slab.
+# Human values use SI units like the previous `free --si`.
+while :; do
+  awk '
+    /^MemTotal:/     { t = $2 }   /^MemAvailable:/ { a = $2 }
+    /^Buffers:/      { b = $2 }   /^Cached:/       { c = $2 }
+    /^SReclaimable:/ { s = $2 }   /^SwapTotal:/    { st = $2 }
+    /^SwapFree:/     { sf = $2 }
+    function h(kb) { return kb >= 1000000 ? sprintf("%.1fG", kb / 1000000) : sprintf("%.0fM", kb / 1000) }
+    END {
+      used = t - a; cached = b + c + s; su = st - sf
+      printf "{\"total\":%d,\"used\":%d,\"cached\":%d,\"human\":{\"total\":\"%s\",\"used\":\"%s\",\"cached\":\"%s\"},", t, used, cached, h(t), h(used), h(cached)
+      printf "\"swap\":{\"total\":%d,\"used\":%d,\"human\":{\"total\":\"%s\",\"used\":\"%s\"}}}\n", st, su, h(st), h(su)
+    }' /proc/meminfo
+  sleep 3
 done

modules/home/wayland/apps/eww/bar/scripts/sys/swap

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-free --si | awk '/Swap/ {
-  used=$3; total=$2
-  u = sprintf("%.1fG", used/1000000)
-  t = sprintf("%.1fG", total/1000000)
-  printf "{\"used\":%d,\"total\":%d,\"human\":{\"used\":\"%s\",\"total\":\"%s\"}}\n", used, total, u, t
-}'

modules/home/wayland/apps/eww/bar/scripts/volume

@@ -1,45 +1,46 @@
 #!/usr/bin/env bash
+# Default sink / source volume for the popup.  Refreshes on PipeWire events
+# (pactl subscribe on the pipewire-pulse socket) and every 30 s.
+#
+#   volume                 status loop (deflisten)
+#   volume setvol SINK|SOURCE PERCENT
+#   volume mute   SINK|SOURCE
 
-volicons=("󰕿" "󰖀" "󰕾")
+icons=("󰕿" "󰖀" "󰕾")
 
-vol()     { wpctl get-volume @DEFAULT_AUDIO_"$1"@ | awk '{print int($2*100)}'; }
-ismuted() { wpctl get-volume @DEFAULT_AUDIO_"$1"@ | rg -qi muted; echo -n $?; }
-setvol()  { wpctl set-volume @DEFAULT_AUDIO_"$1"@ "$(awk -v n="$2" 'BEGIN{print n/100}')"; }
-setmute() { wpctl set-mute @DEFAULT_AUDIO_"$1"@ toggle; }
-
-gen_output() {
-  percent=$(vol "SINK")
-  lvl=$(awk -v n="$percent" 'BEGIN{print int(n/34)}')
-  sink_muted=$(ismuted "SINK")
-  source_muted=$(ismuted "SOURCE")
-  sink=$(wpctl inspect @DEFAULT_AUDIO_SINK@ 2>/dev/null | grep -m1 'node\.nick' | sed 's/.*= "\(.*\)"/\1/')
-
-  [ "$sink_muted"   = 0 ] && icon="󰝟"   || icon="${volicons[$lvl]}"
-  [ "$source_muted" = 0 ] && mic_icon="󰍭" || mic_icon="󰍬"
-
-  printf '{"icon":"%s","percent":%s,"sink_muted":%s,"mic_icon":"%s","microphone":%s,"source_muted":%s,"sink":"%s"}\n' \
-    "$icon" "$percent" "$([ "$sink_muted" = 0 ] && echo true || echo false)" \
-    "$mic_icon" "$(vol SOURCE)" "$([ "$source_muted" = 0 ] && echo true || echo false)" "$sink"
+level() { # prints "<percent> <muted>"
+  wpctl get-volume "@DEFAULT_AUDIO_$1@" 2>/dev/null \
+    | awk '{ printf "%d %s\n", $2 * 100 + 0.5, ($0 ~ /MUTED/) ? "true" : "false" }'
 }
 
-case "$1" in
-  mute)   setmute "$2" ;;
-  setvol) setvol  "$2" "$3" ;;
+sink_name() {
+  wpctl inspect @DEFAULT_AUDIO_SINK@ 2>/dev/null \
+    | awk -F'"' '/node\.nick/ { n = $2 } /node\.description/ { d = $2 } END { print (n != "" ? n : d) }'
+}
+
+state() {
+  local vol muted mic mic_muted icon mic_icon lvl
+  read -r vol muted < <(level SINK)
+  read -r mic mic_muted < <(level SOURCE)
+  vol=${vol:-0} muted=${muted:-false} mic=${mic:-0} mic_muted=${mic_muted:-false}
+  lvl=$((vol >= 67 ? 2 : vol >= 34 ? 1 : 0))
+  if [[ $muted == true ]]; then icon="󰝟"; else icon=${icons[$lvl]}; fi
+  if [[ $mic_muted == true ]]; then mic_icon="󰍭"; else mic_icon="󰍬"; fi
+  printf '{"icon":"%s","percent":%d,"sink_muted":%s,"mic_icon":"%s","microphone":%d,"source_muted":%s,"sink":"%s"}' \
+    "$icon" "$vol" "$muted" "$mic_icon" "$mic" "$mic_muted" "$(jstr "$(sink_name)")"
+}
+
+refresh() { emit "$(state)"; }
+_pw_events() { pactl subscribe 2>/dev/null | grep --line-buffered -E "on (sink|source|server) "; }
+
+case ${1:-} in
+  mute) wpctl set-mute "@DEFAULT_AUDIO_$2@" toggle ;;
+  setvol) wpctl set-volume -l 1.0 "@DEFAULT_AUDIO_$2@" "${3%.*}%" ;;
   *)
-    gen_output
-
-    tmp=$(mktemp -d)
-    pipe="$tmp/vol-events"
-    mkfifo "$pipe"
-    trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
-
-    # 2s polling fallback
-    (while true; do sleep 2; echo poll; done) > "$pipe" &
-    # PipeWire property-change events (fires on mute/volume change)
-    (pw-cli -m 2>/dev/null | grep --line-buffered "changed") > "$pipe" &
-
-    while IFS= read -r _ < "$pipe"; do
-      gen_output
-    done
+    refresh
+    mux_init
+    mux_add _pw_events
+    mux_tick 30
+    mux_loop refresh
     ;;
 esac

modules/home/wayland/apps/eww/bar/scripts/wallpaper

@@ -1,2 +1,5 @@
 #!/usr/bin/env bash
-nohup bash "$HOME/.config/script/wallpaper.sh" >/dev/null 2>&1 &
+# Wallpaper chooser (wofi + awww), detached from eww.
+eww close popup 2>/dev/null
+eww update active-panel= 2>/dev/null
+detach "$BASH" "$HOME/.config/script/wallpaper.sh"

modules/home/wayland/apps/eww/bar/scripts/weather

@@ -1,100 +1,106 @@
 #!/usr/bin/env bash
+# Weather from met.no for the IP-geolocated position.  The last result is
+# cached on disk, so re-opening the panel is instant and offline-safe; the
+# network is hit at most every 10 minutes.
 
-FALLBACK='{"temp":0,"feelslike":0,"humidity":0,"wind":0,"desc":"Unavailable","icon":"󰖐","city":""}'
-CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/eww"
-LOC_CACHE="$CACHE_DIR/weather-location"
-UA="eww-bar/1.0 cedric.hoelzl@gmail.com"
+fallback='{"temp":0,"feelslike":0,"humidity":0,"wind":0,"desc":"Unavailable","icon":"󰖐","city":""}'
+cache_dir=${XDG_CACHE_HOME:-$HOME/.cache}/eww
+loc_cache=$cache_dir/weather-location.json
+wx_cache=$cache_dir/weather.json
+interval=600
+ua="eww-bar/1.0 cedric.hoelzl@gmail.com"
+mkdir -p "$cache_dir"
 
-mkdir -p "$CACHE_DIR"
+fresh() { [[ -s $1 ]] && [[ -n $(find "$1" -mmin "-$2" 2>/dev/null) ]]; } # FILE MINUTES
 
-get_location() {
-  # Cache location for 1 hour; IP rarely changes
-  if [ -f "$LOC_CACHE" ] && [ -n "$(find "$LOC_CACHE" -mmin -60 2>/dev/null)" ]; then
-    cat "$LOC_CACHE"
-    return 0
+location() {
+  fresh "$loc_cache" 60 && { cat "$loc_cache"; return; }
+  local data
+  if data=$(curl -sf --max-time 5 "http://ip-api.com/json?fields=lat,lon,city"); then
+    printf '%s' "$data" | tee "$loc_cache"
+  elif [[ -s $loc_cache ]]; then
+    cat "$loc_cache"
+  else
+    return 1
   fi
-  data=$(curl -sf --max-time 5 "http://ip-api.com/json?fields=lat,lon,city") || return 1
-  echo "$data" | tee "$LOC_CACHE"
 }
 
 icon_for() {
-  case "$1" in
-    *thunder*)                     echo "󰖔" ;;
-    *snow*|*sleet*)                echo "󰖘" ;;
-    heavyrain*|*heavyrainshowers*) echo "󰖖" ;;
-    *rain*|*shower*)               echo "󰖗" ;;
-    fog*)                          echo "󰖑" ;;
-    cloudy*)                       echo "󰖐" ;;
-    partlycloudy*)                 echo "󰖕" ;;
-    fair*|clearsky*)               echo "󰖙" ;;
-    *)                             echo "󰖐" ;;
+  case $1 in
+    *thunder*) echo "󰖔" ;;
+    *snow* | *sleet*) echo "󰖘" ;;
+    heavyrain*) echo "󰖖" ;;
+    *rain* | *shower*) echo "󰖗" ;;
+    fog*) echo "󰖑" ;;
+    cloudy*) echo "󰖐" ;;
+    partlycloudy*) echo "󰖕" ;;
+    fair* | clearsky*) echo "󰖙" ;;
+    *) echo "󰖐" ;;
   esac
 }
 
 desc_for() {
-  case "$(echo "$1" | sed 's/_day//;s/_night//;s/_polartwilight//')" in
-    clearsky)                      echo "Clear sky" ;;
-    fair)                          echo "Fair" ;;
-    partlycloudy)                  echo "Partly cloudy" ;;
-    cloudy)                        echo "Cloudy" ;;
-    fog)                           echo "Foggy" ;;
-    lightrain)                     echo "Light rain" ;;
-    rain)                          echo "Rain" ;;
-    heavyrain)                     echo "Heavy rain" ;;
-    lightrainshowers)              echo "Light showers" ;;
-    rainshowers)                   echo "Rain showers" ;;
-    heavyrainshowers)              echo "Heavy showers" ;;
-    lightrainandthunder)           echo "Light rain & thunder" ;;
-    rainandthunder)                echo "Rain & thunder" ;;
-    heavyrainandthunder)           echo "Heavy rain & thunder" ;;
-    *showersandthunder)            echo "Showers & thunder" ;;
-    lightsleet|lightsleetshowers)  echo "Light sleet" ;;
-    sleet|sleetshowers)            echo "Sleet" ;;
-    heavysleet|heavysleetshowers)  echo "Heavy sleet" ;;
-    *sleetandthunder)              echo "Sleet & thunder" ;;
-    lightsnow|lightsnowshowers)    echo "Light snow" ;;
-    snow|snowshowers)              echo "Snow" ;;
-    heavysnow|heavysnowshowers)    echo "Heavy snow" ;;
-    *snowandthunder)               echo "Snow & thunder" ;;
-    *)                             echo "$1" ;;
+  local c=$1
+  c=${c%_day}; c=${c%_night}; c=${c%_polartwilight}
+  case $c in
+    clearsky) echo "Clear sky" ;;
+    fair) echo "Fair" ;;
+    partlycloudy) echo "Partly cloudy" ;;
+    cloudy) echo "Cloudy" ;;
+    fog) echo "Foggy" ;;
+    lightrain) echo "Light rain" ;;
+    rain) echo "Rain" ;;
+    heavyrain) echo "Heavy rain" ;;
+    lightrainshowers) echo "Light showers" ;;
+    rainshowers) echo "Rain showers" ;;
+    heavyrainshowers) echo "Heavy showers" ;;
+    lightrainandthunder) echo "Light rain & thunder" ;;
+    rainandthunder) echo "Rain & thunder" ;;
+    heavyrainandthunder) echo "Heavy rain & thunder" ;;
+    *showersandthunder) echo "Showers & thunder" ;;
+    lightsleet | lightsleetshowers) echo "Light sleet" ;;
+    sleet | sleetshowers) echo "Sleet" ;;
+    heavysleet | heavysleetshowers) echo "Heavy sleet" ;;
+    *sleetandthunder) echo "Sleet & thunder" ;;
+    lightsnow | lightsnowshowers) echo "Light snow" ;;
+    snow | snowshowers) echo "Snow" ;;
+    heavysnow | heavysnowshowers) echo "Heavy snow" ;;
+    *snowandthunder) echo "Snow & thunder" ;;
+    *) echo "$c" ;;
   esac
 }
 
 fetch() {
-  loc=$(get_location) || { echo "$FALLBACK"; return; }
-  lat=$(echo "$loc" | jq -r '.lat')
-  lon=$(echo "$loc" | jq -r '.lon')
-  city=$(echo "$loc" | jq -r '.city')
-
-  data=$(curl -sf --max-time 8 \
-    -H "User-Agent: $UA" \
-    -H "Accept: application/json" \
-    "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=$lat&lon=$lon") \
-    || { echo "$FALLBACK"; return; }
-
-  d='.properties.timeseries[0].data'
-  temp=$(    echo "$data" | jq -r "${d}.instant.details.air_temperature | round")
-  humidity=$(echo "$data" | jq -r "${d}.instant.details.relative_humidity | round")
-  wind_ms=$( echo "$data" | jq -r "${d}.instant.details.wind_speed")
-  wind=$(    echo "$wind_ms" | awk '{printf "%d", $1 * 3.6}')
-  code=$(    echo "$data" | jq -r \
-    "(${d}.next_1_hours.summary.symbol_code) // (${d}.next_6_hours.summary.symbol_code) // \"cloudy\"")
-
-  # Simplified apparent temperature: wind chill below 10°C, else = temp
-  feelslike=$(echo "$temp $wind" | awk '{
-    t=$1; v=$2
-    if (v > 4.8 && t < 10)
-      printf "%d", 13.12 + 0.6215*t - 11.37*(v^0.16) + 0.3965*t*(v^0.16)
-    else
-      printf "%d", t
-  }')
-
-  icon=$(icon_for "$code")
-  desc=$(desc_for "$code")
-
-  printf '{"temp":%s,"feelslike":%s,"humidity":%s,"wind":%s,"desc":"%s","icon":"%s","city":"%s"}\n' \
-    "$temp" "$feelslike" "$humidity" "$wind" "$desc" "$icon" "$city"
+  local loc lat lon city data temp humidity wind code feelslike
+  loc=$(location) || return 1
+  read -r lat lon city < <(jq -r '"\(.lat) \(.lon) \(.city)"' <<<"$loc")
+  data=$(curl -sf --max-time 8 -H "User-Agent: $ua" -H "Accept: application/json" \
+    "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=$lat&lon=$lon") || return 1
+  read -r temp humidity wind code < <(jq -r '
+    .properties.timeseries[0].data
+    | "\(.instant.details.air_temperature | round) \(.instant.details.relative_humidity | round) \(.instant.details.wind_speed * 3.6 | floor) \(.next_1_hours.summary.symbol_code // .next_6_hours.summary.symbol_code // "cloudy")"' <<<"$data")
+  [[ -n $temp ]] || return 1
+  # Apparent temperature: wind chill below 10 °C, otherwise the air temperature.
+  feelslike=$(awk -v t="$temp" -v v="$wind" 'BEGIN {
+    if (v > 4.8 && t < 10) printf "%d", 13.12 + 0.6215 * t - 11.37 * (v ^ 0.16) + 0.3965 * t * (v ^ 0.16)
+    else printf "%d", t }')
+  printf '{"temp":%s,"feelslike":%s,"humidity":%s,"wind":%s,"desc":"%s","icon":"%s","city":"%s"}' \
+    "$temp" "$feelslike" "$humidity" "$wind" "$(desc_for "$code")" "$(icon_for "$code")" "$(jstr "$city")"
 }
 
-fetch
-while true; do sleep 600; fetch; done
+refresh() {
+  local out
+  if fresh "$wx_cache" $((interval / 60)); then
+    emit "$(cat "$wx_cache")"
+  elif out=$(fetch); then
+    printf '%s\n' "$out" >"$wx_cache"
+    emit "$out"
+  elif [[ -s $wx_cache ]]; then
+    emit "$(cat "$wx_cache")"
+  else
+    emit "$fallback"
+  fi
+}
+
+refresh
+while sleep "$interval"; do refresh; done

modules/home/wayland/apps/eww/bar/scripts/workspaces

@@ -1,120 +1,97 @@
 #!/usr/bin/env bash
+# Workspace indicator: numbered workspaces 1-9, preceded by named (special)
+# workspaces except the scratchpad.  Keeps a local model of Hyprland's state
+# from socket2 events and only calls hyprctl on structural changes.
+#
+# Entry: {id, name, target, state: focused|active|running|empty,
+#         color: blue|red|grey, sep}
 
-declare -A ws_windows=()
-declare -A ws_name=()
-declare -A ws_urgent=()
-declare -A mon_active=()
-focused_ws=""
-focused_monitor=""
-_state=""
-_color=""
+declare -A ws_windows=() ws_name=() ws_urgent=() mon_active=()
+focused_ws="" focused_monitor=""
+
+hypr_json() { hyprctl -j "$1" 2>/dev/null; }
 
 load_workspaces() {
-  local raw
-  raw=$(hyprctl -j workspaces 2>/dev/null) || return
+  local raw id windows name
+  raw=$(hypr_json workspaces) || return
   ws_windows=()
   ws_name=()
   while read -r id windows name; do
     ws_windows[$id]=$windows
     ws_name[$id]=$name
-  done < <(printf '%s' "$raw" | jaq -jr '.[] | (.id | tostring), " ", (.windows | tostring), " ", .name, "\n"' 2>/dev/null)
+  done < <(jaq -r '.[] | "\(.id) \(.windows) \(.name)"' <<<"$raw")
 }
 
 load_monitors() {
-  local raw
-  raw=$(hyprctl -j monitors 2>/dev/null) || return
+  local raw name active focused
+  raw=$(hypr_json monitors) || return
   mon_active=()
-  focused_ws=""
-  focused_monitor=""
-  while read -r name active_id is_focused; do
-    mon_active[$name]=$active_id
-    if [ "$is_focused" = "true" ]; then
-      focused_ws=$active_id
+  while read -r name active focused; do
+    mon_active[$name]=$active
+    if [[ $focused == true ]]; then
+      focused_ws=$active
       focused_monitor=$name
     fi
-  done < <(printf '%s' "$raw" | jaq -jr '.[] | .name, " ", (.activeWorkspace.id | tostring), " ", (.focused | tostring), "\n"' 2>/dev/null)
+  done < <(jaq -r '.[] | "\(.name) \(.activeWorkspace.id) \(.focused)"' <<<"$raw")
 }
 
 load_urgent() {
-  local raw
-  raw=$(hyprctl -j clients 2>/dev/null) || return
+  local raw id
+  raw=$(hypr_json clients) || return
   ws_urgent=()
-  while read -r wsid; do
-    ws_urgent[$wsid]=1
-  done < <(printf '%s' "$raw" | jaq -r '.[] | select(.urgent == true) | (.workspace.id | tostring)' 2>/dev/null)
+  while read -r id; do ws_urgent[$id]=1; done \
+    < <(jaq -r '.[] | select(.urgent) | .workspace.id' <<<"$raw")
 }
 
-ws_state_color() {
-  local id=$1
-  _state="empty"
-  _color="grey"
+# Window address → workspace id.  Events carry the address without the 0x
+# prefix that hyprctl uses, which is why urgency never showed up before.
+window_workspace() {
+  hypr_json clients | jaq -r --arg a "0x$1" 'first(.[] | select(.address == $a) | .workspace.id) // empty'
+}
 
-  if [ "$id" = "$focused_ws" ]; then
-    _state="focused"
+ws_state() { # sets _state / _color for workspace $1
+  local id=$1 mon
+  _state=empty
+  _color=grey
+  if [[ $id == "$focused_ws" ]]; then
+    _state=focused
   else
-    local mon
     for mon in "${!mon_active[@]}"; do
-      if [ "${mon_active[$mon]}" = "$id" ]; then
-        _state="active"
-        break
-      fi
+      [[ ${mon_active[$mon]} == "$id" ]] && { _state=active; break; }
     done
-    if [ "$_state" = "empty" ] && [ "${ws_windows[$id]:-0}" -gt 0 ]; then
-      _state="running"
-    fi
+    [[ $_state == empty && ${ws_windows[$id]:-0} -gt 0 ]] && _state=running
   fi
-
-  if [ "$_state" != "empty" ]; then
-    if [ "${ws_urgent[$id]:-0}" -eq 1 ]; then
-      _color="red"
-    else
-      _color="blue"
-    fi
+  if [[ $_state != empty ]]; then
+    if [[ ${ws_urgent[$id]:-0} == 1 ]]; then _color=red; else _color=blue; fi
   fi
 }
 
-ws_entry() {
-  local id=$1 name=$2 target=$3 sep=${4:-false}
-  ws_state_color "$id"
+entry() { # id name target [sep]
+  ws_state "$1"
   printf '{"id":%s,"name":"%s","target":"%s","state":"%s","color":"%s","sep":%s}' \
-    "$id" "$name" "$target" "$_state" "$_color" "$sep"
+    "$1" "$(jstr "$2")" "$(jstr "$3")" "$_state" "$_color" "${4:-false}"
 }
 
 generate() {
-  printf '['
-  local first=true
-
-  local neg_ids=() id
+  local out='[' sep='' id i named=()
   for id in "${!ws_name[@]}"; do
-    if [[ "$id" == -* ]] && [ "${ws_name[$id]}" != "special:magic" ]; then
-      neg_ids+=("$id")
-    fi
+    [[ $id == -* && ${ws_name[$id]} != "special:magic" ]] && named+=("$id")
   done
-
-  local has_neg=false
-  if [ ${#neg_ids[@]} -gt 0 ]; then
-    has_neg=true
-    IFS=$'\n' sorted_neg=($(printf '%s\n' "${neg_ids[@]}" | sort -n)); unset IFS
-    for id in "${sorted_neg[@]}"; do
-      $first || printf ','
-      first=false
-      ws_entry "$id" "${ws_name[$id]}" "name:${ws_name[$id]}"
-    done
+  if ((${#named[@]})); then
+    while read -r id; do
+      out+="$sep$(entry "$id" "${ws_name[$id]}" "name:${ws_name[$id]}")"
+      sep=,
+    done < <(printf '%s\n' "${named[@]}" | sort -n)
   fi
-
-  local first_pos=true
   for i in {1..9}; do
-    $first || printf ','
-    first=false
-    if $first_pos && $has_neg; then
-      ws_entry "$i" "$i" "$i" true
+    if ((i == 1 && ${#named[@]})); then
+      out+="$sep$(entry "$i" "$i" "$i" true)"
     else
-      ws_entry "$i" "$i" "$i"
+      out+="$sep$(entry "$i" "$i" "$i")"
     fi
-    first_pos=false
+    sep=,
   done
-
-  printf ']\n'
+  emit "$out]"
 }
 
 load_workspaces
@@ -122,53 +99,37 @@ load_monitors
 load_urgent
 generate
 
-while read -r line; do
-  event="${line%>>*}"
-  data="${line#*>>}"
-  case "$event" in
-  "workspace")
-    # data is the workspace name, not id — resolve to id for named workspaces
-    focused_ws="$data"
-    for _k in "${!ws_name[@]}"; do
-      [ "${ws_name[$_k]}" = "$data" ] && { focused_ws="$_k"; break; }
-    done
-    unset "ws_urgent[$focused_ws]"
-    [ -n "$focused_monitor" ] && mon_active[$focused_monitor]="$focused_ws"
-    ;;
-  "workspacev2")
-    focused_ws="${data%%,*}"
-    unset "ws_urgent[$focused_ws]"
-    [ -n "$focused_monitor" ] && mon_active[$focused_monitor]="$focused_ws"
-    ;;
-  "focusedmon")
-    focused_monitor="${data%%,*}"
-    _wsname="${data#*,}"
-    focused_ws="$_wsname"
-    for _k in "${!ws_name[@]}"; do
-      [ "${ws_name[$_k]}" = "$_wsname" ] && { focused_ws="$_k"; break; }
-    done
-    unset "ws_urgent[$focused_ws]"
-    mon_active[$focused_monitor]="$focused_ws"
-    ;;
-  "urgent")
-    wsid=$(hyprctl -j clients 2>/dev/null | jaq -r --arg addr "$data" '.[] | select(.address == $addr) | (.workspace.id | tostring)' 2>/dev/null)
-    [ -n "$wsid" ] && ws_urgent[$wsid]=1
-    ;;
-  "createworkspace"*|"destroyworkspace"*|"moveworkspace"*)
-    load_workspaces
-    load_monitors
-    ;;
-  "openwindow"|"movewindow"*)
-    load_workspaces
-    ;;
-  "closewindow")
-    load_workspaces
-    load_urgent
-    ;;
-  "monitor"*)
-    load_monitors
-    ;;
+hypr_socket="$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock"
+events='^(workspacev2|focusedmonv2|urgent|openwindow|closewindow|movewindowv2|createworkspacev2|destroyworkspacev2|moveworkspacev2|renameworkspace|monitoraddedv2|monitorremovedv2)>>'
+
+while IFS= read -r line; do
+  event=${line%%>>*}
+  data=${line#*>>}
+  case $event in
+    workspacev2) # WORKSPACEID,WORKSPACENAME
+      focused_ws=${data%%,*}
+      unset "ws_urgent[$focused_ws]"
+      [[ -n $focused_monitor ]] && mon_active[$focused_monitor]=$focused_ws
+      ;;
+    focusedmonv2) # MONNAME,WORKSPACEID
+      focused_monitor=${data%%,*}
+      focused_ws=${data#*,}
+      unset "ws_urgent[$focused_ws]"
+      mon_active[$focused_monitor]=$focused_ws
+      ;;
+    urgent) # WINDOWADDRESS
+      id=$(window_workspace "$data")
+      [[ -n $id && $id != "$focused_ws" ]] && ws_urgent[$id]=1
+      ;;
+    openwindow | movewindowv2) load_workspaces ;;
+    closewindow)
+      load_workspaces
+      load_urgent
+      ;;
+    *)
+      load_workspaces
+      load_monitors
+      ;;
   esac
   generate
-done < <(socat -u UNIX-CONNECT:"$XDG_RUNTIME_DIR/hypr/$HYPRLAND_INSTANCE_SIGNATURE/.socket2.sock" - | \
-  rg --line-buffered "^(workspace|focusedmon|createworkspace|destroyworkspace|openwindow|closewindow|movewindow|moveworkspace|monitor|urgent)")
+done < <(socat -u UNIX-CONNECT:"$hypr_socket" - | rg --line-buffered "$events")

modules/home/wayland/apps/eww/bar/windows/net.yuck

@@ -1,12 +1,4 @@
 
-(deflisten netinfo
-  :initial '{"wifi":{"ssid":"","ip":"","freq":0,"band":"","gen":"","signal":0},"ethernet":{"state":"down","ip":"","speed":"","interface":""},"usb":{"interface":"","ip":""}}'
-  "scripts/net/netinfo")
-
-(deflisten bt-devices
-  :initial "[]"
-  "scripts/net/bt-devices")
-
 ; --- Shared widgets ---
 
 (defwidget netinfo-row [label value]
@@ -34,10 +26,10 @@
       :icon-on "󰤨" :icon-off "󰖪")
     (box :orientation "v" :space-evenly false
       :visible {net.wifi.connected}
-      (netinfo-row :label "SSID"   :value {netinfo.wifi.ssid})
-      (netinfo-row :label "IP"     :value {netinfo.wifi.ip})
-      (netinfo-row :label "Signal" :value "${net.wifi.icon}  ${netinfo.wifi.signal} dBm")
-      (netinfo-row :label "Freq"   :value "${netinfo.wifi.freq} MHz · ${netinfo.wifi.band} · ${netinfo.wifi.gen}"))
+      (netinfo-row :label "SSID"   :value {net.wifi.ssid})
+      (netinfo-row :label "IP"     :value {net.wifi.ip})
+      (netinfo-row :label "Signal" :value "${net.wifi.icon}  ${net.wifi.signal} dBm")
+      (netinfo-row :label "Freq"   :value "${net.wifi.freq} MHz · ${net.wifi.band} · ${net.wifi.gen}"))
     (label :class "netinfo-dim" :halign "start"
       :visible {!net.wifi.connected}
       :text {net.wifi.enabled ? "Not connected" : "Disabled"})))
@@ -47,8 +39,8 @@
 (defwidget usb-net-section []
   (box :orientation "v" :space-evenly false :class "sys-section"
     (section-header :title "USB" :accent "usb-accent")
-    (netinfo-row :label "Interface" :value {netinfo.usb.interface})
-    (netinfo-row :label "IP"        :value {netinfo.usb.ip})))
+    (netinfo-row :label "Interface" :value {net.usb.interface})
+    (netinfo-row :label "IP"        :value {net.usb.ip})))
 
 ; --- Ethernet ---
 
@@ -57,9 +49,9 @@
     (section-header :title "Ethernet" :accent "eth-accent")
     (box :orientation "v" :space-evenly false
       :visible {net.ethernet.connected}
-      (netinfo-row :label "Interface" :value {netinfo.ethernet.interface})
-      (netinfo-row :label "IP"        :value {netinfo.ethernet.ip})
-      (netinfo-row :label "Speed"     :value {netinfo.ethernet.speed}))
+      (netinfo-row :label "Interface" :value {net.ethernet.interface})
+      (netinfo-row :label "IP"        :value {net.ethernet.ip})
+      (netinfo-row :label "Speed"     :value {net.ethernet.speed}))
     (label :class "netinfo-dim" :halign "start"
       :visible {!net.ethernet.connected}
       :text "No carrier")))
@@ -79,18 +71,41 @@
   (box :orientation "v" :space-evenly false :class "sys-section"
     (section-header-toggle
       :title "Bluetooth" :accent "blt-accent"
-      :enabled {bluetooth.powered}
-      :onclick {bluetooth.powered ? "bluetoothctl power off" : "bluetoothctl power on"}
+      :enabled {bt.powered}
+      :onclick {bt.powered ? "bluetoothctl power off" : "bluetoothctl power on"}
       :icon-on "󰂯" :icon-off "󰂲")
     (scroll :vscroll true :hscroll false :height 90
-      :visible {bluetooth.powered}
+      :visible {bt.powered}
       (box :orientation "v" :space-evenly false
-        (for device in {bt-devices}
+        (for device in {bt.devices}
           (bt-device-row :device {device}))))
     (label :class "netinfo-dim" :halign "start"
-      :visible {!bluetooth.powered}
+      :visible {!bt.powered}
       :text "Disabled")))
 
+; --- WireGuard ---
+
+(defwidget wg-row [wg]
+  (box :orientation "v" :space-evenly false :class "wg-row"
+    (box :orientation "h" :space-evenly false :valign "center"
+      (label :class "wg-name ${wg.up ? 'wg-up' : 'wg-down'}" :halign "start" :hexpand true :text {wg.name})
+      (button
+        :class "net-toggle-btn ${wg.up ? 'net-toggle-on' : 'net-toggle-off'}"
+        :onclick "scripts/net/wg-toggle ${wg.name}"
+        :tooltip {wg.up ? "Disconnect" : "Connect"}
+        (label :text {wg.up ? "󰖂" : "󰦞"})))
+    (box :orientation "v" :space-evenly false :visible {wg.up}
+      (netinfo-row :label "IP"      :value {wg.ip})
+      (netinfo-row :label "Peer"    :value {wg.endpoint != "" ? "${wg.peers} · ${wg.endpoint}" : wg.peers})
+      (netinfo-row :label "Traffic" :value "󰇚 ${wg.rx}   󰕒 ${wg.tx}"))
+    (label :class "netinfo-dim" :halign "start" :visible {!wg.up} :text "Down")))
+
+(defwidget wireguard-net-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header :title "WireGuard" :accent "wg-accent")
+    (for wg in {net.wireguard}
+      (wg-row :wg {wg}))))
+
 ; --- Root ---
 
 (defwidget net-win []
@@ -102,4 +117,7 @@
     (box :class "section-sep")
     (wifi-net-section)
     (box :class "section-sep")
+    (box :visible {arraylength(net.wireguard) > 0} :space-evenly false :orientation "v"
+      (wireguard-net-section)
+      (box :class "section-sep"))
     (bluetooth-net-section)))

modules/home/wayland/apps/eww/bar/windows/popup.yuck

@@ -1,4 +1,8 @@
 
+; Monitor the popup is currently open on (set by scripts/panel-toggle), so a
+; panel switch on the same monitor is an in-place revealer transition.
+(defvar popup-screen "")
+
 (defwidget popup-win []
   (box :space-evenly false :orientation "v"
     (revealer :reveal {active-panel == "sys"} :transition "slidedown" :duration 120

modules/home/wayland/apps/eww/bar/windows/powermenu.yuck

@@ -18,11 +18,11 @@
             (pm-btn :icon "󰍁" :label "Lock"
                     :onclick "scripts/lock")
             (pm-btn :icon "󰤄" :label "Suspend"
-                    :onclick "scripts/lock & systemctl suspend")
+                    :onclick "scripts/lock; systemctl suspend")
             (pm-btn :icon "󰗼" :label "Sign out"
                     :onclick "hyprctl eval \"hl.dispatch(hl.dsp.exit())\"")
             (pm-btn :icon "󰅖" :label "Cancel"
-                    :onclick "eww close powermenu")))))))
+                    :onclick "${EWW_CMD} --no-daemonize close powermenu")))))))
 
 (defwindow powermenu
   :monitor 0

modules/home/wayland/apps/eww/bar/windows/radio.yuck

@@ -77,6 +77,6 @@
 (defwidget radio-mod []
   (module
     (eventbox
-      :onclick "(sleep 0.1 && scripts/panel-toggle radio)"
+      :onclick "scripts/panel-toggle radio"
       (box :orientation "v"
         (label :show-truncated false :class "icon-text" :text "󰝚")))))

modules/home/wayland/apps/eww/bar/windows/sys.yuck

@@ -1,17 +1,15 @@
 
-(defpoll swap :interval "30s" "scripts/sys/swap")
-
-(defpoll cpu-freq-min :interval "60s"
+(defpoll cpu-freq-min :interval "60s" :initial "0"
   "awk '{print $1/1000}' /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq")
-(defpoll cpu-freq-max :interval "60s"
+(defpoll cpu-freq-max :interval "60s" :initial "1"
   "awk '{print $1/1000}' /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq")
-(defpoll cpu-temp :interval "4s"
+(defpoll cpu-temp :interval "4s" :initial "0"
   "scripts/sys/cputemp")
-(defpoll cpu-freq-avg :interval "2s"
+(defpoll cpu-freq-avg :interval "2s" :initial "0"
   "awk '{sum+=$1; count++} END {printf \"%.1f\", sum/count/1000000}' /sys/devices/system/cpu/cpu*/cpufreq/scaling_cur_freq")
 
-(deflisten cpu-grid :initial '[[{"core":0,"usage":0,"freq":0}]]'
-  "bash scripts/sys/cpugrid")
+; The CPU grid is fed by the EWW_CPU magic variable (2 s); jq() reshapes the
+; core list into rows of four.
 
 ; --- Shared ---
 
@@ -46,7 +44,7 @@
   (box :orientation "v" :space-evenly false :class "sys-section"
     (section-header :title "CPU" :accent "cpu-accent")
     (box :orientation "v" :space-evenly false :halign "center"
-      (for row in {cpu-grid}
+      (for row in {jq(EWW_CPU.cores, '[.[] | .core |= ltrimstr("cpu")] | [range(0; length; 4) as $i | .[$i:$i + 4]]')}
         (box :orientation "h" :space-evenly false
           (for core in {row}
             (cpu-core-cell :core {core})))))
@@ -162,13 +160,13 @@
         (overlay
           (circular-progress
             :width 72 :height 72
-            :value {100*swap.used/swap.total}
+            :value {memory.swap.total > 0 ? 100 * memory.swap.used / memory.swap.total : 0}
             :start-at 0 :clockwise true :thickness 7
             :class "swap-ring"
-            :tooltip "Swap\n${swap.human.used} / ${swap.human.total}")
+            :tooltip "Swap\n${memory.swap.human.used} / ${memory.swap.human.total}")
           (box :orientation "v" :valign "center" :halign "center" :space-evenly false
-            (label :class "ram-used-label" :text "${swap.human.used}")
-            (label :class "ram-total-label" :text "${swap.human.total}"))))
+            (label :class "ram-used-label" :text "${memory.swap.human.used}")
+            (label :class "ram-total-label" :text "${memory.swap.human.total}"))))
     )
   )
 )
@@ -185,8 +183,7 @@
         :start-at 0
         :clockwise true
         :thickness 6
-        :class "bat-ring"
-        :style "color: ${battery.color};"
+        :class "bat-ring bat-${battery.state}"
         :tooltip "Battery  ${round(battery.percentage, 0)}%\n${battery.status} @ ${battery.wattage}")
       (label :class "bat-ring-label"
         :text "${round(battery.percentage, 0)}%"))

modules/home/wayland/apps/eww/default.nix

@@ -1,61 +1,121 @@
 { lib, config, pkgs, ... }:
 let
-  openOnCurrentScreen = pkgs.writeShellScriptBin "eww-open-on-current-screen" ''
-    window="$1"
-    shift
+  ewwBar = "${pkgs.custom.eww-bar}/bin/eww-bar";
 
-    screen="$(hyprctl monitors -j | ${lib.getExe pkgs.jq} -r '.[] | select(.focused == true) | .name' | head -n1)"
-
-    if [ -n "$screen" ]; then
-      exec ${lib.getExe pkgs.eww} open "$window" --screen "$screen" "$@"
-    fi
-
-    exec ${lib.getExe pkgs.eww} open "$window" "$@"
-  '';
-
-  # Wraps a static script file with a bash launcher that prepends Nix store
-  # bin dirs to PATH — keeps the source files unchanged.
+  # Every script ships as a bash wrapper that pins PATH to its dependencies
+  # and inlines the shared helpers, so the sources under bar/scripts stay
+  # plain shell files.
+  baseInputs = with pkgs; [ coreutils findutils gawk gnugrep gnused systemd util-linux ];
   mkScript = name: src: inputs: pkgs.writeShellScriptBin name ''
-    export PATH="${lib.makeBinPath inputs}:$PATH"
+    export PATH="${lib.makeBinPath (baseInputs ++ inputs)}:$PATH"
+    ${builtins.readFile ./bar/scripts/_lib.sh}
     ${builtins.readFile src}
   '';
 
-  scripts = {
-    "scripts/brightness"   = mkScript "brightness"   ./bar/scripts/brightness   [ pkgs.brightnessctl ];
-    "scripts/nightlight"   = mkScript "nightlight"   ./bar/scripts/nightlight   [ pkgs.wlsunset ];
-    "scripts/read-mode"    = mkScript "read-mode"    ./bar/scripts/read-mode    [ pkgs.hyprland ];
-    "scripts/airplane-mode"  = mkScript "airplane-mode"  ./bar/scripts/airplane-mode  [ pkgs.util-linux ];
-    "scripts/do-not-disturb" = mkScript "do-not-disturb" ./bar/scripts/do-not-disturb [ pkgs.dunst ];
-    "scripts/panel-toggle"      = mkScript "panel-toggle"      ./bar/scripts/panel-toggle      [ pkgs.eww pkgs.util-linux openOnCurrentScreen ];
-    "scripts/powermenu-toggle"  = mkScript "powermenu-toggle"  ./bar/scripts/powermenu-toggle  [ pkgs.eww openOnCurrentScreen ];
-    "scripts/power-save"   = mkScript "power-save"   ./bar/scripts/power-save   [ pkgs.eww ];
-    "scripts/radio"        = mkScript "radio"        ./bar/scripts/radio        [ pkgs.eww pkgs.jq pkgs.curl pkgs.mpv pkgs.playerctl ];
-    "scripts/color-pick"   = mkScript "color-pick"   ./bar/scripts/color-pick   [ pkgs.eww pkgs.hyprpicker ];
-    "scripts/media"        = mkScript "media"        ./bar/scripts/media        [ pkgs.playerctl ];
-    "scripts/lock"         = mkScript "lock"         ./bar/scripts/lock         [ pkgs.eww pkgs.hyprlock ];
-    "scripts/screenshot"   = mkScript "screenshot"   ./bar/scripts/screenshot   [ pkgs.eww pkgs.hyprshot pkgs.satty pkgs.wl-clipboard ];
-    "scripts/sys/gpu"      = mkScript "gpu"          ./bar/scripts/sys/gpu      [ pkgs.custom.amdgpu_top pkgs.jq ];
-    "scripts/sys/memory"   = mkScript "memory"       ./bar/scripts/sys/memory   [ pkgs.ripgrep ];
-    "scripts/volume"       = mkScript "volume"       ./bar/scripts/volume       [ pkgs.ripgrep ];
-    "scripts/weather"      = mkScript "weather"      ./bar/scripts/weather      [ pkgs.jq pkgs.curl ];
-    "scripts/workspaces"   = mkScript "workspaces"   ./bar/scripts/workspaces   [ pkgs.jaq pkgs.socat pkgs.ripgrep ];
+  scripts = with pkgs; {
+    # bar
+    "scripts/workspaces"       = mkScript "workspaces"       ./bar/scripts/workspaces       [ hyprland jaq socat ripgrep ];
+    "scripts/panel-toggle"     = mkScript "panel-toggle"     ./bar/scripts/panel-toggle     [ eww custom.eww-bar ];
+    "scripts/powermenu-toggle" = mkScript "powermenu-toggle" ./bar/scripts/powermenu-toggle [ eww custom.eww-bar ];
+    "scripts/net/net"          = mkScript "net"              ./bar/scripts/net/net          [ iproute2 wpa_supplicant ];
+    "scripts/net/bt"           = mkScript "bt"               ./bar/scripts/net/bt           [ jq glib ];
+    "scripts/net/bt-toggle"    = mkScript "bt-toggle"        ./bar/scripts/net/bt-toggle    [ bluez ];
+    "scripts/net/wg-toggle"    = mkScript "wg-toggle"        ./bar/scripts/net/wg-toggle    [ ];
+    "scripts/sys/gpu"          = mkScript "gpu"              ./bar/scripts/sys/gpu          [ custom.amdgpu_top jq ];
+    "scripts/sys/memory"       = mkScript "memory"           ./bar/scripts/sys/memory       [ ];
+    "scripts/sys/battery"      = mkScript "battery"          ./bar/scripts/sys/battery      [ ];
+    "scripts/sys/cputemp"      = mkScript "cputemp"          ./bar/scripts/sys/cputemp      [ ];
+    # popup panels
+    "scripts/volume"           = mkScript "volume"           ./bar/scripts/volume           [ wireplumber pulseaudio ];
+    "scripts/brightness"       = mkScript "brightness"       ./bar/scripts/brightness       [ brightnessctl ];
+    "scripts/weather"          = mkScript "weather"          ./bar/scripts/weather          [ jq curl ];
+    "scripts/radio"            = mkScript "radio"            ./bar/scripts/radio            [ eww jq curl mpv playerctl wireplumber ];
+    "scripts/media"            = mkScript "media"            ./bar/scripts/media            [ playerctl ];
+    # quick actions (long-running ones are detached via systemd-run)
+    "scripts/nightlight"       = mkScript "nightlight"       ./bar/scripts/nightlight       [ eww wlsunset procps ];
+    "scripts/read-mode"        = mkScript "read-mode"        ./bar/scripts/read-mode        [ eww hyprland ];
+    "scripts/airplane-mode"    = mkScript "airplane-mode"    ./bar/scripts/airplane-mode    [ eww ];
+    "scripts/do-not-disturb"   = mkScript "do-not-disturb"   ./bar/scripts/do-not-disturb   [ eww dunst ];
+    "scripts/power-save"       = mkScript "power-save"       ./bar/scripts/power-save       [ eww power-profiles-daemon ];
+    "scripts/lock"             = mkScript "lock"             ./bar/scripts/lock             [ eww hyprlock ];
+    "scripts/screenshot"       = mkScript "screenshot"       ./bar/scripts/screenshot       [ eww hyprshot satty wl-clipboard ];
+    "scripts/color-pick"       = mkScript "color-pick"       ./bar/scripts/color-pick       [ eww hyprpicker ];
+    "scripts/wallpaper"        = mkScript "wallpaper"        ./bar/scripts/wallpaper        [ eww ];
   };
 in {
 
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
-    home.packages = [ pkgs.eww openOnCurrentScreen ];
+    home.packages = [ pkgs.eww pkgs.custom.eww-bar ];
+
+    # The daemon and the bar are one unit: it starts and stops with the
+    # graphical session, opens the bar once the daemon answers, and is
+    # restarted on crash.  `eww-bar` (packages/eww-bar) does the heavy
+    # lifting; kanshi calls `eww-bar place` to move the bar between outputs.
+    systemd.user.services.eww = {
+      Unit = {
+        Description = "eww daemon and bar";
+        Documentation = "https://elkowar.github.io/eww/";
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session.target" ];
+        ConditionEnvironment = "WAYLAND_DISPLAY";
+        # Cap crash loops (e.g. a broken config) without giving up for good:
+        # the watchdog resets the counter and tries again later.
+        StartLimitIntervalSec = 60;
+        StartLimitBurst = 5;
+      };
+      Service = {
+        Type = "simple";
+        ExecStartPre = "${ewwBar} clean";
+        ExecStart = "${lib.getExe pkgs.eww} daemon --no-daemonize";
+        ExecStartPost = "${ewwBar} open";
+        ExecReload = "${ewwBar} reload";
+        Restart = "always";
+        RestartSec = 2;
+        TimeoutStartSec = 30;
+        TimeoutStopSec = 5;
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+
+    # Liveness check: `eww ping` only proves the socket is up, so the check
+    # also lists the windows through the GTK main loop.  Two consecutive
+    # failures (≈40 s) restart the daemon; a missing bar is simply reopened.
+    systemd.user.services.eww-watchdog = {
+      Unit = {
+        Description = "eww health check";
+        After = [ "eww.service" ];
+      };
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${ewwBar} check";
+      };
+    };
+    systemd.user.timers.eww-watchdog = {
+      Unit = {
+        Description = "Periodic eww health check";
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session.target" ];
+      };
+      Timer = {
+        OnActiveSec = "30s";
+        OnUnitActiveSec = "20s";
+        AccuracySec = "5s";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
 
     xdg.configFile = lib.mkMerge [
       {
         "eww" = {
           source = lib.cleanSourceWith {
+            # scripts/ is shipped through the wrappers below, never verbatim
             filter = name: _type:
               let
                 baseName = baseNameOf (toString name);
                 relPath = lib.removePrefix (toString ./bar + "/") (toString name);
               in !(lib.hasSuffix ".nix" baseName)
               && (baseName != "_colors.scss")
-              && !(builtins.elem relPath (builtins.attrNames scripts));
+              && !(lib.hasPrefix "scripts/" relPath);
             src = lib.cleanSource ./bar/.;
           };
           recursive = true;

modules/home/wayland/apps/kanshi/default.nix

@@ -1,24 +1,22 @@
 { config, lib, pkgs, ... }:
 let
-  # Close the bar if it's already open (wrong screen), then open on the target screen.
-  moveOrOpenBar = screen: "${pkgs.writeShellScript "kanshi-eww-bar-${toString screen}" ''
-    if ${pkgs.eww}/bin/eww active-windows 2>/dev/null | grep -qx "bar"; then
-      ${pkgs.eww}/bin/eww close bar
-    fi
-    ${pkgs.eww}/bin/eww open bar --screen ${toString screen}
-  ''}";
+  # Re-place the bar on the profile's main output.  eww-bar waits for the
+  # daemon (kanshi and eww.service start together at login), and resolves the
+  # monitor by description on every hotplug, so the bar follows the profile
+  # instead of a GDK monitor index that changes as outputs come and go.
+  placeBar = screen: "${pkgs.custom.eww-bar}/bin/eww-bar place '${screen}'";
 
   baseOutput = {
     position = "0,0";
     scale = 1.0;
     adaptiveSync = true;
     status = "enable";
-      transform = "normal"; 
+    transform = "normal";
   };
   aocT = "AOC 24E1W1 GNSKCHA086899";
   aocB = "AOC 24E1W1 GNSKBHA080346";
   lgM = "LG Electronics LG ULTRAGEAR+ 511NTDVGC194";
-
+  valinorM = "Lenovo Group Limited *";
 in {
 
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
@@ -31,6 +29,7 @@ in {
           # mode = "2560x1440@480.168";
           mode = "2560x1440@240.083";
           # mode = "1920x1080x240.084";
+          adaptiveSync = false;
         };}
         {output = baseOutput//{
           criteria = "AOC 24E1W1 GNSKCHA086899";
@@ -42,17 +41,9 @@ in {
           mode = "1920x1080@60.000";
         };}
         {output = baseOutput//{
-          criteria = "LG UNKNOWN_TBD";
-          mode = "1920x1080@144.000";
-        };}
-        {output = baseOutput//{
-          criteria = "LG Display 0x060A Unknown";
+          criteria = "Lenovo Group Limited *";
           mode = "1920x1080@60.020";
         };}
-        {output = baseOutput//{
-          criteria = "CEX CX133 0x00000001";
-          mode = "2560x1600@59.972";
-        };}
         {output = baseOutput//{
           criteria = "AOC 16G3 1DDP7HA000348";
           mode = "1920x1080@144.000";
@@ -74,7 +65,7 @@ in {
             }
           ];
           exec = [
-            (moveOrOpenBar 0)
+            (placeBar "desc:${aocB}")
             "${pkgs.writeShellScript "kanshi-hyprland-init" ''
               #!/usr/bin/env bash
               ${pkgs.hyprland}/bin/hyprctl eval '
@@ -99,7 +90,7 @@ in {
           ];
         };}
         {profile = {
-          name = "tower_0";
+          name = "tower_01";
           outputs = [
             {
               criteria = "AOC 24E1W1 GNSKCHA086899";
@@ -130,57 +121,36 @@ in {
           
             ''}"
             "${pkgs.awww}/bin/awww restore"
-            (moveOrOpenBar 0)
-           ];
-        };}
-        {profile = {
-          name = "tower_1";
-          outputs = [
-            {
-              criteria = "AOC 24E1W1 GNSKCHA086899";
-              position = "0,0";
-            }
-            {
-              criteria = "AOC 24E1W1 GNSKBHA080346";
-              position = "0,0";
-            }
-            {
-              criteria = "LG UNKNOWN_TBD";
-              position = "0,0";
-            }
+            (placeBar "desc:${aocB}")
           ];
         };}
         {profile = {
-          name = "laptop_0";
-          outputs = [{
-            criteria = "LG Display 0x060A Unknown";
-            position = "0,0";
-          }];
-        };}
-        {profile = {
-          name = "laptop_1";
+          name = "valinor00";
           outputs = [
             {
-              criteria = "CEX CX133 0x00000001";
+              criteria = "Lenovo Group Limited *";
               position = "0,0";
             }
-            {
-              criteria = "LG Display 0x060A Unknown";
-              position = "2560,0";
-            }
           ];
-        };}
-        {profile = {
-          name = "laptop_2";
-          outputs = [
-            {
-              criteria = "AOC 16G3 1DDP7HA000348";
-              position = "0,0";
-            }
-            {
-              criteria = "LG Display 0x060A Unknown";
-              position = "1920,0";
-            }
+          exec = [
+            "${pkgs.writeShellScript "kanshi-hyprland-init" ''
+              #!/usr/bin/env bash
+              ${pkgs.hyprland}/bin/hyprctl eval '
+                hl.workspace_rule({ workspace = "1", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "2", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "3", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "4", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "5", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "6", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "7", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "8", monitor = "eDP-1", default = true })
+                hl.workspace_rule({ workspace = "9", monitor = "eDP-1", default = true })
+              '
+              ${pkgs.hyprland}/bin/hyprctl eval 'hl.dispatch(hl.dsp.focus({ monitor = "eDP-1" })); hl.dispatch(hl.dsp.focus({ workspace = "1" }));'
+          
+            ''}"
+            "${pkgs.awww}/bin/awww restore"
+            (placeBar "desc:Lenovo Group Limited")
           ];
         };}
       ];

modules/home/wayland/base/default.nix

@@ -1,4 +1,17 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }: 
+let
+  #Bookmark: javascript:(function(){window.location.href='mpv://'+encodeURIComponent(window.location.href);})();
+  mpvHandler = pkgs.writeShellScriptBin "mpv-handler" ''
+    #!/bin/bash
+    exec 2>> /tmp/mpv-handler-debug.log
+    set -x
+    RAW_URL="$1"
+    STRIPPED_URL="''${RAW_URL:6}"
+    URL=$(printf '%b' "''${STRIPPED_URL//%/\\x}")
+    exec ${config.programs.mpv.finalPackage}/bin/mpv "$URL"
+  '';
+in
+{
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
 
     home.packages = with pkgs; [
@@ -14,17 +27,23 @@
       glib
     ];
 
+
+    xdg.desktopEntries."mpv-handler" = {
+      name = "MPV Scheme Handler";
+      exec = "${mpvHandler}/bin/mpv-handler %u";
+      terminal = false;
+      mimeType = [ "x-scheme-handler/mpv" ];
+    };
+
     xdg.mimeApps = {
       enable = true;
       defaultApplications = {
-        "x-scheme-handler/discord-409416265891971072" =
-          [ "discord-409416265891971072.desktop" ];
-        "x-scheme-handler/discord-402572971681644545" =
-          [ "discord-402572971681644545.desktop" ];
-        "x-scheme-handler/discord-696343075731144724" =
-          [ "discord-696343075731144724.desktop" ];
-        "x-scheme-handler/tg" = [ "org.telegram.desktop.desktop" ];
-        "x-scheme-handler/tonsite" = [ "org.telegram.desktop.desktop" ];
+        # --- System & Directories ---
+        "inode/directory" = [ "thunar.desktop" ];
+        "x-scheme-handler/file" = [ "thunar.desktop" ];
+
+        # --- Web & Browsing ---
+        "x-scheme-handler/unknown" = [ "firefox.desktop" ];
         "x-scheme-handler/http" = [ "firefox.desktop" ];
         "x-scheme-handler/https" = [ "firefox.desktop" ];
         "x-scheme-handler/chrome" = [ "firefox.desktop" ];
@@ -36,16 +55,77 @@
         "application/x-extension-xhtml" = [ "firefox.desktop" ];
         "application/x-extension-xht" = [ "firefox.desktop" ];
 
+        # --- Chat & Social Protocol Schemes ---
+        "x-scheme-handler/tg" = [ "org.telegram.desktop.desktop" ];
+        "x-scheme-handler/tonsite" = [ "org.telegram.desktop.desktop" ];
+        "x-scheme-handler/discord-409416265891971072" = [ "discord-409416265891971072.desktop" ];
+        "x-scheme-handler/discord-402572971681644545" = [ "discord-402572971681644545.desktop" ];
+        "x-scheme-handler/discord-696343075731144724" = [ "discord-696343075731144724.desktop" ];
+
+        # --- Documents & Source Code (VSCodium) ---
         "application/pdf" = [ "org.pwmt.zathura-pdf-mupdf.desktop" ];
         "text/plain" = [ "vscodium.desktop" ];
+        "text/markdown" = [ "vscodium.desktop" ];
+        "text/xml" = [ "vscodium.desktop" ];
+        "text/csv" = [ "vscodium.desktop" ];
+        "text/css" = [ "vscodium.desktop" ];
+        "application/xml" = [ "vscodium.desktop" ];
+        "application/json" = [ "vscodium.desktop" ];
+        "application/toml" = [ "vscodium.desktop" ];
+        "application/yaml" = [ "vscodium.desktop" ];
+        "application/javascript" = [ "vscodium.desktop" ];
+        "application/x-shellscript" = [ "vscodium.desktop" ];
 
+        # --- Video & Audio (MPV) ---
+        "x-scheme-handler/mpv" = [ "mpv-handler.desktop" ];
         "video/mp4" = [ "mpv.desktop" ];
+        "video/mkv" = [ "mpv.desktop" ];
+        "video/webm" = [ "mpv.desktop" ];
+        "video/x-matroska" = [ "mpv.desktop" ];
+        "video/quicktime" = [ "mpv.desktop" ];
+        "video/x-msvideo" = [ "mpv.desktop" ];
+        "video/x-flv" = [ "mpv.desktop" ];
+        "video/3gpp" = [ "mpv.desktop" ];
+        "audio/mp3" = [ "mpv.desktop" ];
+        "audio/mpeg" = [ "mpv.desktop" ];
+        "audio/ogg" = [ "mpv.desktop" ];
+        "audio/wav" = [ "mpv.desktop" ];
+        "audio/x-wav" = [ "mpv.desktop" ];
+        "audio/flac" = [ "mpv.desktop" ];
+        "audio/x-flac" = [ "mpv.desktop" ];
+        "audio/mp4" = [ "mpv.desktop" ];
+        "audio/aac" = [ "mpv.desktop" ];
+        "audio/x-matroska-audio" = [ "mpv.desktop" ];
+        "audio/x-mpegurl" = [ "mpv.desktop" ];
+        "audio/mpegurl" = [ "mpv.desktop" ];
 
+        # --- Images (IMV) ---
         "image/png" = [ "imv-dir.desktop" ];
         "image/jpg" = [ "imv-dir.desktop" ];
+        "image/jpeg" = [ "imv-dir.desktop" ];
+        "image/webp" = [ "imv-dir.desktop" ];
+        "image/gif" = [ "imv-dir.desktop" ];
+        "image/svg+xml" = [ "imv-dir.desktop" ];
+        "image/x-canon-cr2" = [ "imv-dir.desktop" ];
+        "image/bmp" = [ "imv-dir.desktop" ];
+        "image/tiff" = [ "imv-dir.desktop" ];
+        "image/heic" = [ "imv-dir.desktop" ];
+        "image/avif" = [ "imv-dir.desktop" ];
+
+        # --- Archives (Engrampa) ---
+        "application/zip" = [ "engrampa.desktop" ];
+        "application/x-tar" = [ "engrampa.desktop" ];
+        "application/x-gzip" = [ "engrampa.desktop" ];
+        "application/x-bzip2" = [ "engrampa.desktop" ];
+        "application/x-7z-compressed" = [ "engrampa.desktop" ];
+        "application/x-rar" = [ "engrampa.desktop" ];
       };
+
       associations = {
-        removed = { "application/pdf" = [ "krita_pdf.desktop" ]; };
+        removed = {
+          "application/pdf" = [ "krita_pdf.desktop" ];
+          "application/zip" = [ "org.prismlauncher.PrismLauncher.desktop" ];
+        };
       };
     };
   };

modules/home/wayland/hyprland/config.nix

@@ -24,14 +24,14 @@
   
 
   startupScript = pkgs.writeShellScriptBin "hyprland-start" ''
-    ${pkgs.eww}/bin/eww open bar &
+    # The eww bar is not started here: eww.service opens it with the
+    # graphical session and kanshi places it per profile (see apps/eww).
     ${pkgs.awww}/bin/awww-daemon &
     ${pkgs.awww}/bin/awww restore &
 
     sleep 2
     keepassxc &
     firefox &
-    jellyfin-mpv-shim &
     easyeffects --gapplication-service &
 
     sleep 2
@@ -103,7 +103,6 @@ in {
             disable_splash_rendering = true;
             animate_mouse_windowdragging = false;
             animate_manual_resizes = false;
-            vrr = 0; #vrr=2;
           };
           debug = {
             vfr = false;
@@ -304,9 +303,10 @@ in {
           (bind "XF86AudioPlay" (dsp.exec "${lib.getExe pkgs.playerctl} play-pause"))
           (bind "XF86AudioPrev" (dsp.exec "${lib.getExe pkgs.playerctl} previous"))
           (bind "XF86AudioNext" (dsp.exec "${lib.getExe pkgs.playerctl} next"))
-          (bindOpts "XF86AudioRaiseVolume" (dsp.exec "amixer -q sset 'Master' 5%+") { locked = true; repeating = true; })
-          (bindOpts "XF86AudioLowerVolume" (dsp.exec "amixer -q sset 'Master' 5%-") { locked = true; repeating = true; })
-          (bindOpts "XF86AudioMute" (dsp.exec "amixer -q sset 'Master' toggle") { locked = true; })
+          (bindOpts "XF86AudioRaiseVolume" (dsp.exec "${pkgs.wireplumber}/bin/wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%+") { locked = true; repeating = true; })
+          (bindOpts "XF86AudioLowerVolume" (dsp.exec "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-") { locked = true; repeating = true; })
+          (bindOpts "XF86AudioMute" (dsp.exec "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle") { locked = true; })
+          (bindOpts "XF86AudioMicMute" (dsp.exec "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle") { locked = true; })
           (bindOpts "XF86MonBrightnessUp" (dsp.exec "${lib.getExe pkgs.brightnessctl} s 5%+") { locked = true; repeating = true; })
           (bindOpts "XF86MonBrightnessDown" (dsp.exec "${lib.getExe pkgs.brightnessctl} s 5%-") { locked = true; repeating = true; })
           (bindOpts "SUPER + mouse:272" dsp.drag { mouse = true; })

modules/home/xorg/bspwm/config.nix

@@ -109,7 +109,6 @@
 
       telegram-desktop &
       nextcloud &
-      jellyfin-mpv-shim &
       #flameshot &
 
       sleep 2

modules/nixos/system/default.nix

@@ -1,5 +1,5 @@
 { config, lib, ... }: {
-  imports = [ ./dbus ./fonts ./hw ./locale ./network ./nix ./security ./xdg ];
+  imports = [ ./dbus ./docs ./fonts ./hw ./locale ./network ./nix ./security ./xdg ];
 
   services.journald.extraConfig = ''
     SystemMaxUse=512M

modules/nixos/system/docs/default.nix

@@ -0,0 +1,14 @@
+{ config, lib, ... }:
+let
+  cfg = config.syscfg.make;
+  withDocs = cfg.gui || cfg.develop || cfg.serverExtras;
+in
+{
+  documentation = lib.mkIf (!withDocs) {
+    enable = false;
+    man.enable = false;
+    info.enable = false;
+    doc.enable = false;
+    nixos.enable = false;
+  };
+}

modules/nixos/system/fonts/default.nix

@@ -1,6 +1,6 @@
-{ pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
 
-  fonts = {
+  fonts = lib.mkIf (config.syscfg.make.gui || config.syscfg.make.serverExtras) {
     enableDefaultPackages = false;
     fontDir.enable = true;
 

modules/nixos/system/hw/base/default.nix

@@ -1,5 +1,5 @@
-{ lib, ... }: {
-  services.fwupd.enable = true;
+{ config, lib, ... }: {
+  services.fwupd.enable = lib.mkDefault (config.syscfg.make.gui || config.syscfg.make.power);
   hardware.enableAllFirmware = false;
-  services.power-profiles-daemon.enable = lib.mkDefault true;
+  services.power-profiles-daemon.enable = lib.mkDefault config.syscfg.make.gui;
 }

modules/nixos/system/hw/fs/default.nix

@@ -1,6 +1,9 @@
-{ pkgs, ... }: {
+{ config, lib, pkgs, ... }:
+let
+  hasNfsFileSystems = lib.any (fs: fs.fsType == "nfs" || fs.fsType == "nfs4") (lib.attrValues config.fileSystems);
+in {
   services.fstrim.enable = true; # Improves SSD life
-  services.gvfs.enable = true; # User Mounted FS
+  services.gvfs.enable = config.syscfg.make.gui; # User Mounted FS
 
-  environment.systemPackages = with pkgs; [ nfs-utils ];
+  environment.systemPackages = lib.optionals hasNfsFileSystems [ pkgs.nfs-utils ];
 }

modules/nixos/system/hw/graphics/default.nix

@@ -1,4 +1,4 @@
-{ ... }: {
-  hardware.graphics.enable = true;
-  hardware.graphics.enable32Bit = true;
+{ config, ... }: {
+  hardware.graphics.enable = config.syscfg.make.gui || config.syscfg.make.serverExtras || config.syscfg.make.game;
+  hardware.graphics.enable32Bit = config.syscfg.make.game;
 }

modules/nixos/system/network/wireguard/default.nix

@@ -36,6 +36,20 @@ in
       };
     };
 
+    # Let the desktop (eww network panel, scripts/net/wg-toggle) bring the
+    # tunnel up and down.  eww runs as a user service outside the login
+    # session, where polkit cannot ask for a password, so wheel users may
+    # start/stop wireguard-* units without one.
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.freedesktop.systemd1.manage-units" &&
+            subject.isInGroup("wheel") &&
+            /^wireguard-/.test(action.lookup("unit") || "")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+
     systemd.services."wireguard-wg0-peer-vpn-helcel" = {
       after = [ "network-online.target" "nss-lookup.target" ];
       bindsTo = [ "network-online.target" ];

modules/nixos/system/nix/default.nix

@@ -1,14 +1,10 @@
-{ inputs, pkgs, ... }: {
+{ config, inputs, lib, pkgs, ... }: {
   nixpkgs.config = {
     permittedInsecurePackages = [ ];
     allowUnfree = true;
     android_sdk.accept_license = true;
-    packageOverrides = pkgs: rec {
-      custom = import ../../../../packages { inherit pkgs; };
-    };
-
   };
-  nixpkgs.overlays = import ../../../../overlays { inherit inputs pkgs; };
+  nixpkgs.overlays = import ../../../../overlays { inherit inputs; };
   nix = {
     package = pkgs.nixVersions.stable;
     extraOptions = ''
@@ -37,7 +33,9 @@
       ];
     };
   };
-  programs.nix-ld = {
+  programs.nix-ld = lib.mkIf (
+    config.syscfg.make.gui || config.syscfg.make.develop || config.syscfg.make.serverExtras
+  ) {
     enable = true;
     libraries = with pkgs; [
       libx11 libxcb libxi libxext libxkbfile xcbutilcursor

modules/nixos/system/security/polkit/default.nix

@@ -1,10 +1,12 @@
-{ pkgs, ... }: {
-  security.polkit.enable = true;
-  security.pam.services.hyprlock = { #swaylock
-    text = ''
-      auth include login
-    '';
-  };
+{ config, lib, pkgs, ... }: {
+  config = lib.mkIf config.syscfg.make.gui {
+    security.polkit.enable = true;
+    security.pam.services.hyprlock = { #swaylock
+      text = ''
+        auth include login
+      '';
+    };
 
-  environment.systemPackages = with pkgs; [ polkit_gnome ];
+    environment.systemPackages = [ pkgs.polkit_gnome ];
+  };
 }

modules/nixos/tools/debug/default.nix

@@ -3,6 +3,7 @@
   config = lib.mkIf (config.syscfg.make.develop) {
 
     programs.wireshark.enable = true;
+    programs.dconf.enable = true;
 
     environment.systemPackages = with pkgs; [ wget dconf wireshark mtr android-tools ];
   };

modules/nixos/tools/default.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   imports = [ ./debug ./develop ./telegraf ];
 
+  environment.systemPackages = lib.optionals config.syscfg.make.gui [ pkgs.engrampa ];
 }

modules/server/containers/apps/miniflux.nix

@@ -0,0 +1,2 @@
+{ name, ... }:
+throw "Container app `${name}` is not implemented yet."

modules/server/containers/apps/trmnl.nix

@@ -1,3 +1,2 @@
-{...}:{
-    
-}
+{ name, ... }:
+throw "Container app `${name}` is not implemented yet."

modules/server/containers/builder.nix

@@ -37,7 +37,9 @@ let
       environment = {
         TZ = config.time.timeZone;
       } // extraEnv;
-
+      autoRemoveOnStop = false;
+      autoStart = true;
+      pull = "newer";
       labels = (if subdomain!=null then ({
         "traefik.enable" = "true";
         "traefik.http.routers.${routerName}.entrypoints" = "web-secure";
@@ -61,7 +63,7 @@ let
     };
     in lib.recursiveUpdate base overrides;
   vmBuilder = { name, vm }: ((import "${pkgs.path}/nixos/lib/eval-config.nix" {
-      system = "x86_64-linux";
+      system = pkgs.stdenv.hostPlatform.system;
       modules = [ vm.cfg
         ({ config, lib, modulesPath, ... }: {
         imports = [

modules/server/containers/default.nix

@@ -16,7 +16,9 @@ let
   basePathConfigs =
     lib.mapAttrsToList (_: cfg: cfg) (lib.filterAttrs (name: _: name != "config" && name != "data") serverCfg.path);
   runtimePathConfigs = concatRuntimeLists "paths";
-  allSetupConfigs = map (app: ({ name = app.name; envFile = ""; } // app.runtime.setup)) appsList;
+  allSetupConfigs = builtins.filter
+    (setup: setup.script != null)
+    (map (app: ({ name = app.name; envFile = [ ]; } // app.runtime.setup)) appsList);
   allCronsConfigs = concatRuntimeLists "cron";
   allVMConfigs = builtins.filter (app: app.runtime.vm != null) appsList;
   mkPathSetup = cfg:
@@ -88,7 +90,7 @@ in {
         value = {
           description = "Run ${e.name} setup";
           after = [ "podman-${e.name}-${e.trigger}.service" ];
-          wants = [ "podman-${e.name}-${e.trigger}.service" ];
+          # wants = [ "podman-${e.name}-${e.trigger}.service" ];
           partOf = [ "podman-${e.name}-${e.trigger}.service" ];
           wantedBy = [ "multi-user.target" ];
           restartTriggers = [ e.script ];
@@ -96,7 +98,8 @@ in {
             Type = "simple";
             Restart = "on-failure";
             RestartSec = "15s";
-            TimeoutStartSec = "360s";
+            # TimeoutStartSec = "360s";
+            TimeoutStartSec = "30s"; 
             EnvironmentFile = e.envFile;
             ExecStart = e.script;
             RemainAfterExit = true;

modules/server/sops/default.nix

@@ -3,7 +3,9 @@ let
   listNames = config.syscfg.server.db;
   containerNames = lib.concatMap (app: app.requires.secrets) (builtins.attrValues config.syscfg.server.loadedContainers);
   allApps = lib.unique (listNames ++ containerNames);
+  needsServerSops = config.syscfg.server.loadedContainers != {} || allApps != [];
 in{
+  config = lib.mkIf needsServerSops {
     sops.secrets = {
       CUSTOM = { 
         mode = "0444";
@@ -13,4 +15,5 @@ in{
       mode = "0444";
       sopsFile = ./server.yaml;
     }));
+  };
 }

modules/shared/sops/default.nix

@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 let
   isCI = builtins.elem config.syscfg.hostname [ "ci" "sandbox" ];
+  defaultUser = config.users.users.${config.syscfg.defaultUser} or { };
+  defaultGroup = if pkgs.stdenv.isDarwin then "staff" else "users";
   keyFilePath = (if isCI then
     "/var/lib/sops-nix/mock-key.txt"
   else
@@ -8,7 +10,7 @@ let
   sopsFilePath = (if isCI then ./mock.yaml else ./common.yaml);
 in {
   environment.systemPackages = with pkgs; [ sops ];
-  environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;
+  environment.variables.SOPS_AGE_KEY_FILE = keyFilePath;
 
   sops.defaultSopsFile = sopsFilePath;
   sops.age.keyFile = keyFilePath;
@@ -19,8 +21,8 @@ in {
   {
     "${config.syscfg.hostname}_ssh_priv" = {
       mode = "0400";
-      owner = config.users.users.${config.syscfg.defaultUser}.name;
-      group = config.users.users.${config.syscfg.defaultUser}.group;
+      owner = defaultUser.name or config.syscfg.defaultUser;
+      group = defaultUser.group or defaultGroup;
     };
   }
   (lib.mkIf config.syscfg.net.wlp.enable {

modules/shared/syscfg/default.nix

@@ -1,11 +1,15 @@
-{ inputs, lib, ... }:
+{ lib, ... }:
 let
   systemsDir = ../../../systems;
-  systemNames = lib.attrNames (lib.filterAttrs 
-    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
-    (builtins.readDir systemsDir));
-
-
+  isIgnoredSystemDir = name: lib.hasPrefix "_" name || lib.hasPrefix "." name;
+  systemNames = lib.attrNames (
+    lib.filterAttrs
+      (name: type:
+        type == "directory"
+        && !isIgnoredSystemDir name
+        && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
+      (builtins.readDir systemsDir)
+  );
 in with lib; {
   options.usercfg = import ./user.nix  {inherit lib;};
   options.syscfg = {
@@ -14,6 +18,11 @@ in with lib; {
       type = types.enum [ "nixos" "macos" "home" ];
       default = "nixos";
     };
+    system = mkOption {
+      type = types.enum [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      default = "x86_64-linux";
+      description = "Nix platform used to evaluate this host.";
+    };
     defaultUser = mkOption { type = types.str; };
     make = import ./make.nix {inherit lib;};
     net = import ./net.nix {inherit lib;};

modules/shared/syscfg/extra.nix

@@ -6,6 +6,6 @@ with lib; {
         domain = mkOption { type = types.str; default = ""; };
         port = mkOption { type = types.str; default = ""; };
         noProxy = mkOption { type = types.str; default = ""; };
-        cert = mkOption { type = types.path; default = null; };
+        cert = mkOption { type = types.nullOr types.path; default = null; };
     };
 }

modules/shared/syscfg/make.nix

@@ -2,6 +2,7 @@
 with lib; {
     cli = mkOption { type = types.bool; default = true; };
     gui = mkOption { type = types.bool; default = false; };
+    serverExtras = mkOption { type = types.bool; default = false; };
     virt = mkOption { type = types.bool; default = false; };
     power = mkOption { type = types.bool; default = false; };
     game = mkOption { type = types.bool; default = false; };

overlays/default.nix

@@ -1,15 +1,14 @@
-{ inputs, pkgs, ... }:
+{ inputs, ... }:
 [
   (final: prev: {
     #openttd-jgrpp = import ./openttd-jgrpp { inherit final prev; };
     #yarn-berry = import ./yarn-berry { inherit final prev; };
     #eww = import ./eww { inherit final prev; };
     # ags =  import ./ags { inherit final prev; };
+    custom = import ../packages { pkgs = final; };
     wine = final.unstable.wineWow64Packages.unstableFull;
     unstable = import inputs.nixUnstable {
-      
       system = final.stdenv.hostPlatform.system;
-      stdenv.hostPlatform.system = final.stdenv.hostPlatform.system;
       config.allowUnfree = true;
     };
   })

packages/default.nix

@@ -1,15 +1,12 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   amdgpu_top = pkgs.callPackage ./amdgpu_top { };
   simc = pkgs.qt6.callPackage ./simc { };
   repalette = pkgs.callPackage ./repalette { };
 
   vosk = pkgs.callPackage ./vosk { };
 
-  pythonPackages = {
+  eww-bar = pkgs.callPackage ./eww-bar { };
 
-  };
-
-  nodePackages = {
-
-  };
+  jellyfin-mpv-shim-watchdog = pkgs.callPackage ./jellyfin-mpv-shim-watchdog { };
 }

packages/eww-bar/default.nix

@@ -0,0 +1,21 @@
+{ writeShellApplication
+, coreutils
+, eww
+, gnugrep
+, gnused
+, hyprland
+, iproute2
+, jq
+, procps
+, systemd
+, util-linux
+}:
+
+# Lifecycle manager for the eww daemon and the bar window.  Used by
+# eww.service (ExecStartPre/Post, ExecReload), eww-watchdog.timer, the kanshi
+# profiles and the user (`eww-bar status`, `eww-bar reset`).
+writeShellApplication {
+  name = "eww-bar";
+  runtimeInputs = [ coreutils eww gnugrep gnused hyprland iproute2 jq procps systemd util-linux ];
+  text = builtins.readFile ./eww-bar.sh;
+}

packages/eww-bar/eww-bar.sh

@@ -0,0 +1,342 @@
+# eww-bar — lifecycle manager for the eww daemon and the bar window.
+#
+# The daemon is owned by the user unit eww.service.  Two eww facts shape this
+# script:
+#
+#  * A client waits only 100 ms for the daemon's reply.  Any slower command
+#    (opening the popup, reload) fails on the client side, and a plain
+#    `eww open` then forks a SECOND daemon that takes over the socket path and
+#    orphans the first one's surfaces ("two bars", "a popup I can't close").
+#    Every client call here passes --no-daemonize, which turns that into a
+#    harmless error; outcomes are verified with `active-windows`, never with
+#    the exit status.
+#  * `eww ping` is answered by the IPC thread; `eww active-windows` by the GTK
+#    main loop.  Only the latter proves the UI is alive.
+#
+# SCREEN is a GDK monitor index (0), a connector name (DP-1) or
+# desc:<prefix of the description shown by `hyprctl monitors`>.  Descriptions
+# survive re-plugging and profile changes; indices do not.
+
+usage() {
+  cat <<'USAGE'
+usage: eww-bar COMMAND [ARGS]
+
+  ensure           make sure a healthy, service-owned daemon is running
+  open  [SCREEN]   open the bar (no-op if already open there), remember SCREEN
+  place [SCREEN]   force re-open of the bar on SCREEN (used by kanshi)
+  close            close the bar and the popups
+  reload           reload the eww config and re-place the bar
+  restart          restart eww.service (the bar comes back with it)
+  reset            kill every eww process, wipe the sockets, start fresh
+  check            health check run by eww-watchdog.timer
+  clean            ExecStartPre: kill stray daemons, wipe stale sockets
+  focused          print the name of the focused Hyprland monitor
+  status           show unit state, socket owner, open windows and screen
+USAGE
+}
+
+uid=$(id -u)
+runtime_dir=${XDG_RUNTIME_DIR:-/run/user/$uid}
+state_dir=$runtime_dir/eww-bar
+lock_file=$state_dir/lock
+screen_file=$state_dir/screen     # requested screen spec, re-resolved on restart
+current_file=$state_dir/current   # resolved screen the bar is currently on
+fail_file=$state_dir/strikes
+unit=eww.service
+default_screen=0
+max_strikes=2
+
+mkdir -p "$state_dir"
+
+log() { printf 'eww-bar: %s\n' "$*" >&2; }
+
+# ---------------------------------------------------------------- client ---
+
+# fd 9 (the lock) is closed for every client call so nothing can inherit it.
+ewwc() { timeout 5 eww --no-daemonize "$@" 9>&-; }
+
+ping_daemon() { ewwc ping >/dev/null 2>&1; }
+list_windows() { ewwc active-windows 2>/dev/null || true; }
+bar_open() { list_windows | grep -qx 'bar: bar'; }
+
+# wait_for_window NAME [SECONDS]
+wait_for_window() {
+  local i n=$((${2:-5} * 5))
+  for ((i = 0; i < n; i++)); do
+    list_windows | grep -qx "$1: $1" && return 0
+    sleep 0.2
+  done
+  return 1
+}
+
+# ---------------------------------------------------------------- daemon ---
+
+# nixpkgs wraps eww (wrapGAppsHook), so the running process is `.eww-wrapped`;
+# `pkill -x eww` never matched it.  Exact match, this user only.
+kill_stray_daemons() {
+  pkill -TERM -x -u "$uid" '(\.eww-wrapped|eww)' 2>/dev/null || true
+  sleep 0.3
+  pkill -KILL -x -u "$uid" '(\.eww-wrapped|eww)' 2>/dev/null || true
+  rm -f "$runtime_dir"/eww-server_*
+}
+
+unit_state() { systemctl --user show -p ActiveState --value "$unit" 2>/dev/null || echo unknown; }
+unit_running() {
+  case $(unit_state) in
+    active | activating | reloading) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+main_pid() { systemctl --user show -p MainPID --value "$unit" 2>/dev/null || echo 0; }
+
+# pids listening on an eww socket path.  After a rival rebinds the path, ss
+# lists BOTH sockets under the same name (the old one is merely unlinked), so
+# every pid matters, not just the first.
+socket_owners() {
+  ss -xlp 2>/dev/null | grep -F "$runtime_dir/eww-server_" \
+    | sed -n 's/.*pid=\([0-9]*\).*/\1/p' | sort -u | tr '\n' ' '
+}
+
+# The socket file is gone while the daemon lives on: a rival that crashed at
+# startup unlinked it, and no client can reach the daemon any more.
+socket_missing() { ! ls "$runtime_dir"/eww-server_* >/dev/null 2>&1; }
+daemon_age() { ps -o etimes= -p "$(main_pid)" 2>/dev/null | tr -d " " || echo 0; }
+
+# pids of daemons other than the service's main process listening on the socket
+rival_pids() {
+  local main pid
+  main=$(main_pid)
+  for pid in $(socket_owners); do
+    [[ $pid != "$main" ]] && printf '%s ' "$pid"
+  done
+  return 0
+}
+rival_daemon() { [[ -n $(rival_pids) ]]; }
+
+healthy() { unit_running && ping_daemon && ! rival_daemon; }
+
+wait_for_daemon() {
+  local i
+  for ((i = 0; i < 100; i++)); do
+    ping_daemon && return 0
+    sleep 0.1
+  done
+  return 1
+}
+
+start_unit() {
+  systemctl --user reset-failed "$unit" >/dev/null 2>&1 || true
+  systemctl --user start "$unit"
+}
+
+restart_unit() {
+  log "restarting $unit"
+  systemctl --user reset-failed "$unit" >/dev/null 2>&1 || true
+  systemctl --user restart "$unit"
+}
+
+ensure() {
+  healthy && return 0
+  (
+    flock -x 9
+    healthy && exit 0
+    if rival_daemon; then
+      log "a second eww daemon (pid $(rival_pids)) owns the socket"
+    elif unit_running && wait_for_daemon && ! rival_daemon; then
+      # The unit was (re)starting — possibly running us from ExecStartPost.
+      exit 0
+    fi
+    log "daemon unhealthy, restarting $unit"
+    systemctl --user stop "$unit" >/dev/null 2>&1 || true
+    kill_stray_daemons
+    start_unit
+    wait_for_daemon
+  ) 9>"$lock_file"
+}
+
+# --------------------------------------------------------------- screens ---
+
+focused_monitor() {
+  hyprctl -j monitors 2>/dev/null | jq -r 'first(.[] | select(.focused) | .name) // empty'
+}
+
+# desc:<prefix> → connector name via hyprctl; anything else is passed to eww.
+resolve_screen() {
+  local spec=$1 name
+  case $spec in
+    desc:*)
+      name=$(hyprctl -j monitors 2>/dev/null \
+        | jq -r --arg p "${spec#desc:}" '[.[] | select(.description | startswith($p))][0].name // empty')
+      if [[ -n $name ]]; then
+        printf '%s\n' "$name"
+      else
+        log "no monitor matches '$spec', using screen $default_screen"
+        printf '%s\n' "$default_screen"
+      fi
+      ;;
+    '') printf '%s\n' "$default_screen" ;;
+    *) printf '%s\n' "$spec" ;;
+  esac
+}
+
+saved_screen() { cat "$screen_file" 2>/dev/null || true; }
+current_screen() { cat "$current_file" 2>/dev/null || true; }
+
+# ------------------------------------------------------------------- bar ---
+
+close_popups() {
+  local w
+  for w in popup powermenu; do
+    list_windows | grep -qx "$w: $w" && { ewwc close "$w" >/dev/null 2>&1 || true; }
+  done
+  ewwc update active-panel= >/dev/null 2>&1 || true
+}
+
+# open_bar [--force] [SPEC]
+open_bar() {
+  local force=0 spec screen
+  if [[ ${1:-} == --force ]]; then force=1; shift; fi
+  spec=${1:-$(saved_screen)}
+  spec=${spec:-$default_screen}
+  ensure || { log "no daemon, cannot open the bar"; return 1; }
+  screen=$(resolve_screen "$spec")
+  (
+    flock -x 9
+    if ((force == 0)) && [[ $(current_screen) == "$screen" ]] && bar_open; then
+      exit 0
+    fi
+    # Popups may sit on an output that just vanished; `eww open` itself
+    # replaces an already-open bar.  The exit status is meaningless (100 ms
+    # client deadline), so the result is verified instead.
+    close_popups
+    ewwc open bar --screen "$screen" >/dev/null 2>&1 || true
+    if ! wait_for_window bar 5; then
+      if [[ $screen != "$default_screen" ]]; then
+        log "cannot open the bar on '$screen', using screen $default_screen"
+        screen=$default_screen
+        ewwc open bar --screen "$screen" >/dev/null 2>&1 || true
+      fi
+      if ! wait_for_window bar 5; then
+        log "the bar does not come up, restarting $unit"
+        restart_unit
+        exit 1
+      fi
+    fi
+    printf '%s\n' "$spec" >"$screen_file"
+    printf '%s\n' "$screen" >"$current_file"
+    log "bar opened on screen $screen"
+  ) 9>"$lock_file"
+}
+
+close_bar() {
+  close_popups
+  ewwc close bar >/dev/null 2>&1 || true
+  rm -f "$current_file"
+}
+
+reload() {
+  ensure || return 1
+  # Slow: the client always hits its deadline, so ignore the status and
+  # verify that the daemon is still with us afterwards.
+  ewwc reload >/dev/null 2>&1 || true
+  sleep 1
+  if ! wait_for_daemon; then
+    log "daemon lost during reload, restarting $unit"
+    restart_unit
+    return 0
+  fi
+  open_bar --force
+}
+
+reset() {
+  log "full reset"
+  systemctl --user stop "$unit" >/dev/null 2>&1 || true
+  kill_stray_daemons
+  rm -f "$current_file" "$fail_file"
+  start_unit # ExecStartPost re-opens the bar
+}
+
+# ExecStartPre
+clean() {
+  kill_stray_daemons
+  rm -f "$current_file" "$fail_file"
+}
+
+# -------------------------------------------------------------- watchdog ---
+
+# One bad check is tolerated (a busy daemon can miss eww's 100 ms IPC reply
+# deadline); the second consecutive one restarts the unit.
+strike() {
+  local n
+  n=$(($(cat "$fail_file" 2>/dev/null || echo 0) + 1))
+  if ((n >= max_strikes)); then
+    log "$1 ($n/$max_strikes) — restarting $unit"
+    rm -f "$fail_file"
+    restart_unit
+  else
+    log "$1 ($n/$max_strikes)"
+    printf '%s\n' "$n" >"$fail_file"
+  fi
+}
+
+check() {
+  systemctl --user is-active --quiet graphical-session.target || return 0
+  if ! unit_running; then
+    log "$unit is not running, starting it"
+    start_unit || true
+    return 0
+  fi
+  [[ $(unit_state) == active ]] || return 0 # still starting; ExecStartPost handles it
+  if rival_daemon; then
+    log "a second eww daemon (pid $(rival_pids)) owns the socket, restarting $unit"
+    restart_unit
+    return 0
+  fi
+  if socket_missing && (($(daemon_age) > 15)); then
+    log "socket file is gone, restarting $unit"
+    restart_unit
+    return 0
+  fi
+  if ! ping_daemon; then
+    strike "daemon does not answer"
+    return 0
+  fi
+  if wait_for_window bar 3; then
+    rm -f "$fail_file"
+    return 0
+  fi
+  # Either nothing is open or the main loop is frozen (empty reply).  Try to
+  # open the bar: a frozen daemon still won't list it afterwards.
+  open_bar || true
+  if wait_for_window bar 3; then
+    rm -f "$fail_file"
+    log "bar was missing, reopened"
+  else
+    strike "UI unresponsive"
+  fi
+}
+
+status() {
+  systemctl --user --no-pager status "$unit" 2>&1 | head -n 12 || true
+  printf '\nsocket listeners: %s(service main pid %s)\n' "$(socket_owners)" "$(main_pid)"
+  printf 'windows:\n'
+  list_windows | sed 's/^/  /'
+  printf 'screen:  %s (requested: %s)\n' "$(current_screen)" "$(saved_screen)"
+  printf 'strikes: %s\n' "$(cat "$fail_file" 2>/dev/null || echo 0)"
+}
+
+case ${1:-} in
+  ensure) ensure ;;
+  open) shift; open_bar "$@" ;;
+  place) shift; open_bar --force "$@" ;;
+  close) close_bar ;;
+  reload) reload ;;
+  restart) restart_unit ;;
+  reset) reset ;;
+  check) check ;;
+  clean) clean ;;
+  focused) focused_monitor ;;
+  status) status ;;
+  -h | --help | help) usage ;;
+  *) usage >&2; exit 64 ;;
+esac

packages/jellyfin-mpv-shim-watchdog/default.nix

@@ -0,0 +1,51 @@
+{ writeShellScriptBin
+, coreutils
+, findutils
+, gnugrep
+, iproute2
+, systemd
+}:
+
+# jellyfin-mpv-shim keeps a persistent socket to the Jellyfin server. When the
+# machine drops off the network that socket dies, but the process stays alive
+# and the unit stays "active" — running yet deaf to cast requests, the "up but
+# not working, restart it by hand" case. systemd can't see this: nothing
+# crashes and the shim speaks no health protocol, so we probe the real thing —
+# is its MainPID still holding a live (established, non-loopback) connection?
+#
+#   check       (default) one tick, run by a 60s timer: restart if online but
+#               not connected, rate-limited to one restart per 5 min
+#   wait-online block until a real address exists; used as ExecStartPre so the
+#               unit only starts once online
+
+writeShellScriptBin "jellyfin-mpv-shim-watchdog" ''
+  set -u
+  service="jellyfin-mpv-shim.service"
+  stamp="''${XDG_RUNTIME_DIR:-/run/user/$(${coreutils}/bin/id -u)}/jellyfin-mpv-shim-watchdog.stamp"
+
+  # A global-scope address on a non-loopback interface — true for a LAN IP too,
+  # so this needs no server URL and works whether Jellyfin is local or remote.
+  network_up() { ${iproute2}/bin/ip -o addr show scope global up 2>/dev/null | ${gnugrep}/bin/grep -q .; }
+
+  if [ "''${1:-check}" = wait-online ]; then
+    while ! network_up; do ${coreutils}/bin/sleep 5; done
+    exit 0
+  fi
+
+  # Healthy: MainPID owns an established socket to something other than loopback.
+  pid="$(${systemd}/bin/systemctl --user show -p MainPID --value "$service" 2>/dev/null)"
+  if [ "''${pid:-0}" != 0 ] && ${iproute2}/bin/ss -tnpH state established 2>/dev/null \
+      | ${gnugrep}/bin/grep "pid=$pid," \
+      | ${gnugrep}/bin/grep -qv -e '127\.0\.0\.1' -e '\[::1\]'; then
+    exit 0
+  fi
+
+  # Not connected: only worth restarting once the network is actually back...
+  network_up || exit 0
+  # ...and not if we already restarted within the last 5 minutes.
+  [ -e "$stamp" ] && [ -n "$(${findutils}/bin/find "$stamp" -mmin -5 2>/dev/null)" ] && exit 0
+
+  : > "$stamp"
+  echo "jellyfin-mpv-shim-watchdog: online but no live connection -> restarting $service"
+  ${systemd}/bin/systemctl --user restart "$service"
+''

shells/default.nix

@@ -1,13 +1,9 @@
-{ inputs, ... }:
-let
-  forEachSystem =
-    inputs.nixpkgs.lib.genAttrs [ "aarch64-linux" "x86_64-linux" ];
-in forEachSystem (system:
-  let
-    overlays = import ../overlays { inherit inputs pkgs; };
-    overrides = { custom = import ../packages { inherit pkgs; }; };
-    pkgs = import inputs.nixpkgs { inherit system overlays; } // overrides;
+{ inputs, mkPkgs, systems, ... }:
+inputs.nixpkgs.lib.genAttrs systems (
+  system:
+  let pkgs = mkPkgs system;
   in {
     default = import ./devsh { inherit pkgs; };
     devsh = import ./devsh { inherit pkgs; };
-  })
+  }
+)

shells/devsh/default.nix

@@ -38,7 +38,7 @@ pkgs.mkShell {
     #CUSTOM (custom...)
   ]) ++ (with pkgs.llvmPackages; [ 
     libcxxClang 
-  ]) ++ (with pkgs.python313Packages; [
+  ]) ++ (with pkgs.python3Packages; [
     pip pandas numpy matplotlib typer pillow reportlab python-barcode pypdf markdown requests 
   ])
   ;

systems/asgard/cfg.nix

@@ -3,5 +3,6 @@
     hostname = "asgard";
     defaultUser = "sora";
     type = "macos";
+    system = "x86_64-darwin";
   };
 }

systems/asgard/default.nix

@@ -12,8 +12,7 @@
   };
 
   fonts = {
-    fontDir.enable = true;
-    fonts = with pkgs; [ ibm-plex openmoji-color material-design-icons ];
+    packages = with pkgs; [ ibm-plex openmoji-color material-design-icons ];
   };
 
   environment = {
@@ -33,8 +32,6 @@
 
   programs = { zsh.enable = true; };
 
-  services = { nix-daemon.enable = true; };
-
   homebrew = {
     enable = true;
     onActivation = {
@@ -54,7 +51,11 @@
     '';
     gc = {
       automatic = true;
-      dates = "weekly";
+      interval = {
+        Weekday = 0;
+        Hour = 3;
+        Minute = 0;
+      };
       options = "--delete-older-than 7d";
     };
     settings = {
@@ -67,6 +68,7 @@
   };
 
   system = {
+    primaryUser = "sora";
     defaults = {
       NSGlobalDomain = {
         KeyRepeat = 1;

systems/avalon/cfg.nix

@@ -7,7 +7,7 @@
       {
         username = "sora";
         git = {
-          email = "soraefir+git@helcel";
+          email = "github@helcel.net";
           username = "soraefir";
           key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
         };

systems/gateway/cfg.nix

@@ -8,7 +8,7 @@
       pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
       wm = "-";
       git = {
-        email = "soraefir+git@helcel";
+        email = "github@helcel.net";
         username = "soraefir";
         key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
       };

systems/gateway/default.nix

@@ -17,4 +17,9 @@
     10.10.1.2     avalon.helcel.net
   '';
 
+  swapDevices = [ {
+    device = "/swapfile";
+    size = 2 * 1024; # Size in megabytes (4 GB)
+  } ];
+
 }

systems/gateway/hardware.nix

@@ -5,10 +5,12 @@
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
   boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
   boot.loader.grub = {
     enable = true;
     device = "/dev/sda";
     efiSupport = true;
+    efiInstallAsRemovable = true;
   };
 
   boot.initrd.availableKernelModules =

systems/iriy/cfg.nix

@@ -8,7 +8,7 @@
       pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGtotfQkclilrhEOzY3QUpOwYF+eOjHvqN6Of3NVg4x8NQLjx/X/gxC+GAllQxy9Zkz/N5wY0Fa4/6HoGheCRvWaN/nofz95VgtX8a1A/flrT8CGdBfRqXlcd4OEXhpFcbEm9VRXmxSKnsD4zySZr/151S+1PlQr8pJ1yyzxsIQx+RNo9P4gzpoJgkfZ3JIqLWb6B4aXallAg9Ha1WX0lx24voWNgg9AQt6/lccfmeoWAzBGUNq5a/mH59O+UCIM2y19ksEweY6URHpk6Ss597zp+0j2NYg8MS4rToYUb0Y7giNNBdKAzqNd+Wp6gjqBthuDIOfsXM082O5IarPKPJNVbx/Xpf3m1hYtxfL+LhEkdoE94iue601WqTltC0btS63LeZuoAZYji/GG/D8U7V77Lh3MV5/hJm5sK6wM6r7fCoenehgiy49z00NqtgM33rWNrpL9eXNKb//5Lxe7U58jPyteWpsL8+fJFcs/2uh4D5zN3d/I+yLZ1OMgUN6LM= sora@iriy";
       wm = "Wayland";
       git = {
-        email = "soraefir+git@helcel";
+        email = "github@helcel.net";
         username = "soraefir";
         key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
       };

systems/sandbox/cfg.nix

@@ -8,7 +8,7 @@
       pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
       wm = "-";
       git = {
-        email = "soraefir+git@helcel";
+        email = "github@helcel.net";
         username = "soraefir";
         key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
       };
@@ -32,6 +32,7 @@
         # ===== BASE =====
         traefik.subdomain = "traefik";
         traefik.extra={provider="infomaniak";};
+        robotstxt.extra = {};
         umami.subdomain = "umami";
         authentik.subdomain = "sso";
         searxng.subdomain = "searx";
@@ -42,14 +43,19 @@
         collabora.subdomain = "office";
         etherpad.subdomain = "pad";
         # ethercalc.subdomain = "calc";
+        drawio.subdomain = "draw";
         immich.subdomain = "pic";
         # ===== FLIX =====
         # invidious.subdomain = "yt";
         # jellyfin.subdomain = "flix";
+        # suwayomi.subdomain = "manga";
+        # calibre.subdomain = "books";
+        # ===== ARR =====
         # servarr.subdomain = "arr";
         # servarr.extra.modules = ["prowlarr" "sonarr" "radarr" "flaresolverr" ];
         # transmission = { subdomain = "arr"; subpath = "transmission"; };
         # handbrake = { subdomain = "arr"; subpath = "hb"; };
+        # selfmark = { subdomain = "arr"; subpath = "selfmark"; };
         # ===== DEV =====
         gitea.subdomain = "git";
         # ===== HOME =====
@@ -58,9 +64,6 @@
         influx.subdomain = "metrum";
 
         freshrss.subdomain = "rss";
-        suwayomi.subdomain = "manga";
-        calibre.subdomain = "books";
-        selfmark = { subdomain = "arr"; subpath = "selfmark"; };
 
         favicon.extra = {
           mappings = {

systems/valinor/cfg.nix

@@ -8,7 +8,7 @@
       pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCZibVYTvS4Dd+ZhGCpRpKfxs1fQeepNTzfzYk9I12Hyez25pQCeH+6ArrVhf6yX5Na1ffkvqTrNIDYJ1V2GHhemX0ruYp2B3xt229JszI7DeRC7YeG7v5uvsfTgicADCstGPSNorKXuNnHuBebSHpmWWbuKrYZdmcA/Az7H8uwF5+VQrnyASgZgwGV94MHinFVWsisB7o6iq4qxqpsUdtuZGbU0stDE5f9DLMDYuUxtx+jASRt+X60Bzjv3OFjU/b/YYzojTtuujkYXunNNTceCB4DTue5YMKQOlmd/IezL5nPAK9IsonPqojX9LPk2RvTCr4qalQ6AD92nq+xMW6FY1uJaKT81S8TvZcaqTm4FhEDkChuFq77biSUDhQkpcdNVOjUn5OtKpYl+0VkCaAx/8uyoylBacrn1XXLLg+gjwGCFHa2eeNu/BKIUa+5EK/FRwLpnEoPDkAHQ95JXQewChcUKG8A+Bz29XRKr9J64kbbGmwa+yjlVTPLSE6ZZE= sora@valinor";
       wm = "Wayland";
       git = {
-        email = "soraefir+git@helcel";
+        email = "github@helcel.net";
         username = "soraefir";
         key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
       };