fix(waybar): restore workspace clicks

configs/nixos/guests/actualbudget.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.guests.actualbudget; # NOLINT(let_order)
+  dataDir = "/data";
+in
+{
+  options.guests.actualbudget = {
+    dataPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/actualbudget";
+      description = "Host path bind-mounted as Actual Budget's data directory.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dataPath != null;
+        message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
+      }
+    ];
+
+    registry.homepage.${config.networking.hostName}.actualbudget = {
+      tab = "Apps";
+      section = "Other";
+      name = "Actual Budget";
+      description = "Finance";
+      icon = "actual-budget.png";
+    };
+
+    guests.actualbudget = {
+      interior = {
+        modules.services.actualbudget = {
+          enable = true;
+          inherit dataDir;
+        };
+      };
+      mounts.${dataDir}.directory = cfg.dataPath;
+      limits = {
+        memory = lib.mkDefault "2G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+  };
+}

configs/nixos/guests/copyparty.nix

@@ -5,13 +5,57 @@
 }:
 let
   cfg = config.guests.copyparty; # NOLINT(let_order)
+
+  volumeType = lib.types.submodule {
+    options = {
+      hostPath = lib.mkOption {
+        type = lib.types.str;
+        description = "Host path bind-mounted into the Copyparty guest for this volume.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Guest path served by this Copyparty volume.";
+      };
+
+      access = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+        description = "Copyparty access map from permission string to account names.";
+      };
+
+      readOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Serve this Copyparty volume read-only.";
+      };
+
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Copyparty volume flags.";
+      };
+    };
+  };
 in
 {
   options.guests.copyparty = {
+    accountName = lib.mkOption {
+      type = lib.types.str;
+      default = "alexion";
+      description = "Copyparty account name configured for password authentication.";
+    };
+
     passwordSecret = lib.mkOption {
       type = lib.types.str;
-      default = "services/copyparty/users/${config.user.name}/password";
-      description = "SOPS secret name that contains the Copyparty account password.";
+      default = "services/copyparty/users/alexion/password";
+      description = "SOPS secret name containing the Copyparty account password.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Guest path where Copyparty stores service state.";
     };
 
     statePath = lib.mkOption {
@@ -28,39 +72,7 @@ in
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf (
-        lib.types.submodule {
-          options = {
-            hostPath = lib.mkOption {
-              type = lib.types.str;
-              description = "Host path bind-mounted into the Copyparty guest for this volume.";
-            };
-
-            path = lib.mkOption {
-              type = lib.types.str;
-              description = "Guest path served by this Copyparty volume.";
-            };
-
-            access = lib.mkOption {
-              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-              default = { };
-              description = "Copyparty access map from permission string to account names.";
-            };
-
-            readOnly = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-              description = "Serve this Copyparty volume read-only.";
-            };
-
-            flags = lib.mkOption {
-              type = lib.types.attrs;
-              default = { };
-              description = "Copyparty volume flags.";
-            };
-          };
-        }
-      );
+      type = lib.types.attrsOf volumeType;
       default = { };
       description = "Copyparty volumes keyed by their URL path.";
     };
@@ -90,26 +102,24 @@ in
     guests.copyparty = {
       interior.modules.services.copyparty = {
         enable = true;
+        inherit (cfg) accountName stateDir;
         passwordFile = "/run/secrets/${cfg.passwordSecret}";
         reverseProxy = {
           enable = cfg.reverseProxy.enable;
           inherit (cfg.reverseProxy) trustedSources;
         };
-        volumes = lib.mapAttrs (
-          _urlPath: volume:
-          {
-            inherit (volume)
-              path
-              readOnly
-              ;
-          }
-          // lib.optionalAttrs (volume.access != { }) { inherit (volume) access; }
-          // lib.optionalAttrs (volume.flags != { }) { inherit (volume) flags; }
-        ) cfg.volumes;
+        volumes = lib.mapAttrs (_urlPath: volume: {
+          inherit (volume)
+            path
+            access
+            flags
+            readOnly
+            ;
+        }) cfg.volumes;
       };
 
       mounts = {
-        "/var/lib/copyparty" = {
+        ${cfg.stateDir} = {
           directory = cfg.statePath;
           owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
           group = "storage";

configs/nixos/hosts/pikachu/default.nix

@@ -71,6 +71,22 @@
     };
   };
 
+  guests.actualbudget = {
+    enable = true;
+    vlan = 20;
+    mac = "BC:24:11:C1:CD:28";
+    dataPath = "/pikachu/data/actualbudget";
+    address = "10.23.20.42";
+    reverseProxy = {
+      enable = true;
+      route = {
+        domain = "budget.alexion.dev";
+        protocol = "https";
+        port = 5006;
+      };
+    };
+  };
+
   guests.navidrome = {
     enable = true;
     vlan = 20;
@@ -129,21 +145,35 @@
       "/" = {
         hostPath = "/pikachu/data/copyparty/root";
         path = "/srv";
+        access.r = [ "alexion" ];
         readOnly = true;
       };
       "/inbox" = {
         hostPath = "/pikachu/__inbox";
         path = "/pikachu/__inbox";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
       };
       "/media" = {
         hostPath = "/pikachu/media";
         path = "/pikachu/media";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
       };
       "/opds" = {
         hostPath = "/pikachu/data/opds";
         path = "/pikachu/data/opds";
+        access.r = [ "alexion" ];
         readOnly = true;
-        flags.opds = true;
+        flags = [ "opds" ];
       };
     };
   };

configs/nixos/modules/desktop/session/waybar.nix

@@ -30,7 +30,6 @@ in
 
     home-manager.users.${config.user.name}.programs.waybar = {
       enable = true;
-      package = pkgs.alexion.waybar;
 
       # A user service bound to graphical-session.target, which uwsm activates,
       # so the bar comes up with the session and no compositor exec-once.

configs/nixos/modules/desktop/utilities/audio.nix

@@ -7,15 +7,6 @@
 }:
 # PipeWire as the desktop audio server.
 let
-  volumeKey = keys: command: {
-    inherit keys;
-    repeating = true;
-    action = {
-      kind = "exec";
-      command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --output-volume ${command}";
-    };
-  };
-
   mediaKey = keys: command: {
     inherit keys;
     locked = true;
@@ -39,17 +30,6 @@ in
     };
 
     registry.keybind.${config.networking.hostName} = {
-      volume-up = volumeKey "XF86AudioRaiseVolume" "raise --max-volume 100";
-      volume-down = volumeKey "XF86AudioLowerVolume" "lower";
-      mute = {
-        keys = "XF86AudioMute";
-        locked = true;
-        action = {
-          kind = "exec";
-          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --output-volume mute-toggle";
-        };
-      };
-
       media-play = mediaKey "XF86AudioPlay" "play-pause";
       media-next = mediaKey "XF86AudioNext" "next";
       media-previous = mediaKey "XF86AudioPrev" "previous";

configs/nixos/modules/desktop/utilities/osd.nix

@@ -5,41 +5,39 @@
   ...
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
+let
+  user = config.user.name;
+in
 {
   options.modules.desktop.utilities.osd.enable =
     lib.mkEnableOption "the SwayOSD volume and brightness popup";
 
   config = lib.mkIf config.modules.desktop.utilities.osd.enable {
-    environment.systemPackages = [ pkgs.swayosd ];
-
-    # The udev rule chgrps each backlight's brightness node to `video` and adds
-    # group write, so the server dims the panel without root.
-    # Membership below grants the running session that access.
-    services.udev.packages = [ pkgs.swayosd ];
-    users.users.${config.user.name}.extraGroups = [ "video" ];
-
-    # The server draws the popups, so it runs for the whole graphical session.
-    # It binds to the target uwsm activates.
-    home-manager.users.${config.user.name}.systemd.user.services.swayosd = {
-      Unit = {
-        Description = "SwayOSD on-screen display server";
-        PartOf = [ "graphical-session.target" ];
-        After = [ "graphical-session.target" ];
-      };
-      Service = {
-        ExecStart = lib.getExe' pkgs.swayosd "swayosd-server";
-        Restart = "on-failure";
-      };
-      Install.WantedBy = [ "graphical-session.target" ];
-    };
-
     registry.keybind.${config.networking.hostName} = {
+      volume-up = {
+        keys = "XF86AudioRaiseVolume";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume raise --max-volume 100";
+        };
+      };
+
+      volume-down = {
+        keys = "XF86AudioLowerVolume";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume lower";
+        };
+      };
+
       brightness-up = {
         keys = "XF86MonBrightnessUp";
         repeating = true;
         action = {
           kind = "exec";
-          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --brightness raise";
+          command = "${pkgs.swayosd}/bin/swayosd-client --brightness raise";
         };
       };
 
@@ -48,9 +46,41 @@
         repeating = true;
         action = {
           kind = "exec";
-          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --brightness lower";
+          command = "${pkgs.swayosd}/bin/swayosd-client --brightness lower";
+        };
+      };
+
+      mute = {
+        keys = "XF86AudioMute";
+        locked = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume mute-toggle";
         };
       };
     };
+
+    environment.systemPackages = [ pkgs.swayosd ];
+
+    # The udev rule chgrps each backlight's brightness node to `video` and adds
+    # group write, so the server dims the panel without root.
+    # Membership below grants the running session that access.
+    services.udev.packages = [ pkgs.swayosd ];
+    users.users.${user}.extraGroups = [ "video" ];
+
+    # The server draws the popups, so it runs for the whole graphical session.
+    # It binds to the target uwsm activates.
+    home-manager.users.${user}.systemd.user.services.swayosd = {
+      Unit = {
+        Description = "SwayOSD on-screen display server";
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session.target" ];
+      };
+      Service = {
+        ExecStart = "${pkgs.swayosd}/bin/swayosd-server";
+        Restart = "on-failure";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
   };
 }

configs/nixos/modules/desktop/utilities/recording.nix

@@ -7,13 +7,13 @@
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  # A single key starts and stops recording.
-  # Waybar refreshes on state changes instead of polling.
-  recordingToggle = pkgs.writeShellScript "screen-record-toggle" ''
-    refresh_waybar() {
-      ${lib.getExe' pkgs.procps "pkill"} -RTMIN+10 waybar >/dev/null 2>&1 || true
-    }
-
+  # A single key both starts and stops.
+  # A running wf-recorder is stopped with SIGINT so it finalises the file.
+  # Otherwise slurp picks a region and wf-recorder runs in the foreground until
+  # that stop arrives, so this instance lives for the whole recording and then
+  # reports it saved.
+  # No -a means no audio is captured.
+  toggle = pkgs.writeShellScript "screen-record-toggle" ''
     if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
       ${lib.getExe' pkgs.procps "pkill"} -INT -x wf-recorder
       exit 0
@@ -25,15 +25,12 @@ let
     file="$dir/recording-$(${lib.getExe' pkgs.coreutils "date"} +%Y%m%d-%H%M%S).mp4"
 
     ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording started" "Region capture, no audio."
-    ${lib.getExe pkgs.wf-recorder} -g "$region" -f "$file" &
-    recorder=$!
-    refresh_waybar
-    wait "$recorder" || true
-    refresh_waybar
+    ${lib.getExe pkgs.wf-recorder} -g "$region" -f "$file"
     ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording saved" "$file"
   '';
 
-  # Empty text collapses the widget when recording is idle.
+  # Lit while a wf-recorder capture is running.
+  # Empty text collapses the widget when idle, so it shows nothing until then.
   recordingStatus = pkgs.writeShellScript "waybar-recording-status" ''
     if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
       printf '{"text":"${util.glyph "f03d"}","tooltip":"Recording","class":"recording"}\n'
@@ -51,7 +48,7 @@ in
       keys = "SUPER + SHIFT + R";
       action = {
         kind = "exec";
-        command = "${recordingToggle}";
+        command = "${toggle}";
       };
     };
 
@@ -60,8 +57,7 @@ in
       settings = {
         return-type = "json";
         exec = "${recordingStatus}";
-        interval = "once";
-        signal = 10;
+        interval = 1;
       };
     };
   };

configs/nixos/modules/desktop/utilities/screenshot.nix

@@ -7,26 +7,26 @@
 # Keyboard-driven screenshots copy to the clipboard before Satty opens for
 # annotation. Satty copies annotated screenshots when it saves them.
 let
-  screenshotKey = keys: target: {
-    inherit keys;
-    action = {
-      kind = "exec";
-      command = "${capture target}";
-    };
-  };
+  user = config.user.name;
+
+  grimblast = "${pkgs.grimblast}/bin/grimblast";
+  satty = "${pkgs.satty}/bin/satty";
+  tee = "${pkgs.coreutils}/bin/tee";
+  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
+  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
 
   # Copy the original screenshot before Satty opens.
   # Satty copies and saves annotated screenshots when the user presses Enter.
   capture =
     target:
     pkgs.writeShellScript "screenshot-${target}" ''
-      dir="$(${lib.getExe' pkgs.xdg-user-dirs "xdg-user-dir"} PICTURES)/Screenshots"
-      ${lib.getExe' pkgs.coreutils "mkdir"} -p "$dir"
-      ${lib.getExe pkgs.grimblast} save ${target} - \
-        | ${lib.getExe' pkgs.coreutils "tee"} >(${lib.getExe' pkgs.wl-clipboard "wl-copy"}) \
-        | ${lib.getExe pkgs.satty} --filename - \
+      dir="$(${xdgUserDir} PICTURES)/Screenshots"
+      mkdir -p "$dir"
+      ${grimblast} save ${target} - \
+        | ${tee} >(${wl-copy}) \
+        | ${satty} --filename - \
           --output-filename "$dir/screenshot-%Y%m%d-%H%M%S.png" \
-          --copy-command ${lib.getExe' pkgs.wl-clipboard "wl-copy"} \
+          --copy-command ${wl-copy} \
           --save-after-copy \
           --early-exit \
           --actions-on-enter save-to-clipboard
@@ -37,7 +37,33 @@ in
     lib.mkEnableOption "screenshots via grimblast and satty";
 
   config = lib.mkIf config.modules.desktop.utilities.screenshot.enable {
-    home-manager.users.${config.user.name} = {
+    registry.keybind.${config.networking.hostName} = {
+      screenshot-area = {
+        keys = "Print";
+        action = {
+          kind = "exec";
+          command = "${capture "area"}";
+        };
+      };
+
+      screenshot-active = {
+        keys = "SHIFT + Print";
+        action = {
+          kind = "exec";
+          command = "${capture "active"}";
+        };
+      };
+
+      screenshot-screen = {
+        keys = "CTRL + Print";
+        action = {
+          kind = "exec";
+          command = "${capture "screen"}";
+        };
+      };
+    };
+
+    home-manager.users.${user} = {
       # satty is a one-shot annotation surface, so float it rather than letting
       # it claim a tile in the layout.
       wayland.windowManager.hyprland.settings.window_rule = [
@@ -46,12 +72,7 @@ in
           float = true;
         }
       ];
-    };
 
-    registry.keybind.${config.networking.hostName} = {
-      screenshot-area = screenshotKey "Print" "area";
-      screenshot-active = screenshotKey "SHIFT + Print" "active";
-      screenshot-screen = screenshotKey "CTRL + Print" "screen";
     };
   };
 }

configs/nixos/modules/desktop/utilities/theming.nix

@@ -6,13 +6,15 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
+
   # A single static Nord wallpaper, drawn as a vertical gradient across the
   # Polar Night shades so it needs no committed binary and no network fetch.
   wallpaper = pkgs.runCommand "nord-wallpaper.png" { } ''
-    ${lib.getExe pkgs.imagemagick} \
+    ${pkgs.imagemagick}/bin/magick \
       -size 2560x1440 gradient:'#2E3440'-'#3B4252' \
       "$out"
   '';
+  user = config.user.name;
 in
 {
   options.modules.desktop.utilities.theming.enable =
@@ -56,8 +58,12 @@ in
         };
       };
     };
+    registry.env.${config.networking.hostName} = {
+      HYPRCURSOR_THEME = config.stylix.cursor.name;
+      HYPRCURSOR_SIZE = toString config.stylix.cursor.size;
+    };
 
-    home-manager.users.${config.user.name} = {
+    home-manager.users.${user} = {
       # Stylix drives the cursor through home-manager's pointer-cursor config,
       # whose generation must be switched on explicitly.
       home.pointerCursor.enable = true;
@@ -66,10 +72,5 @@ in
       # base16 mapping Stylix would apply, so its target stays off.
       stylix.targets.nixvim.enable = false;
     };
-
-    registry.env.${config.networking.hostName} = {
-      HYPRCURSOR_THEME = config.stylix.cursor.name;
-      HYPRCURSOR_SIZE = toString config.stylix.cursor.size;
-    };
   };
 }

configs/nixos/modules/desktop/utilities/userdirs.nix

@@ -1,27 +1,14 @@
 { config, lib, ... }:
-# Declares XDG user directories, so tools that query them use predictable
-# folders a host can relocate from one place.
+# Declares the XDG user directories, so a tool that queries them lands in a
+# well-known folder a host can relocate from one place.
 let
-  homeDirectory = "/home/${config.user.name}";
+  user = config.user.name;
 in
 {
   options.modules.desktop.utilities.userdirs.enable = lib.mkEnableOption "XDG user directories";
 
   config = lib.mkIf config.modules.desktop.utilities.userdirs.enable {
-    home-manager.users.${config.user.name}.xdg.userDirs = {
-      enable = true;
-      createDirectories = true;
-      setSessionVariables = true;
-
-      desktop = "${homeDirectory}/.ignoreme";
-      documents = "${homeDirectory}/docs";
-      download = "${homeDirectory}/dwn";
-      music = "${homeDirectory}/mus";
-      pictures = "${homeDirectory}/pic";
-      publicShare = "${homeDirectory}/.ignoreme";
-      templates = "${homeDirectory}/.ignoreme";
-      videos = "${homeDirectory}/vid";
-      projects = "${homeDirectory}/.ignoreme";
-    };
+    # Write ~/.config/user-dirs.dirs from the option defaults.
+    home-manager.users.${user}.xdg.userDirs.enable = true;
   };
 }

configs/nixos/modules/services/actualbudget.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
+in
+{
+  options.modules.services.actualbudget = {
+    enable = lib.mkEnableOption "Actual Budget";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5006;
+      description = "Port Actual Budget listens on.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/data";
+      description = "Directory where Actual Budget stores server and user files.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "actual";
+      description = "User account that runs Actual Budget.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "storage";
+      description = "Group account that owns Actual Budget's writable state.";
+    };
+
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName}.actualbudget = 20001;
+    }
+
+    (lib.mkIf cfg.enable {
+      users.users.${cfg.user} = {
+        isSystemUser = true;
+        uid = config.registry."stable-uid".${config.networking.hostName}.actualbudget;
+        inherit (cfg) group;
+      };
+
+      services.actual = {
+        enable = true;
+        openFirewall = true;
+        inherit (cfg) user;
+        inherit (cfg) group;
+        settings = {
+          inherit (cfg) port dataDir;
+        };
+      };
+    })
+  ];
+}

configs/nixos/modules/services/copyparty.nix

@@ -2,135 +2,147 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 let
   cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
-  accountName = config.user.name;
+  volumeType = lib.types.submodule {
+    options = {
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Filesystem path served by this volume.";
+      };
 
-  serviceGroup = "storage";
+      access = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+        example = {
+          A = [ "alexion" ];
+        };
+        description = "Copyparty access map from permission string to account names.";
+      };
 
-  serviceStateDir = "/var/lib/copyparty";
+      readOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Serve this volume read-only.";
+      };
 
-  serviceUser = "copyparty";
-
-  writableVolumes = lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes);
-
-  port = 3923;
-  defaultAccess = {
-    A = [ accountName ];
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "dthumb" ];
+        description = "Copyparty volume flags.";
+      };
+    };
   };
 
-  defaultWritableFlags = {
-    d2d = true;
-    d2t = true;
-    dthumb = true;
-  };
+  configScript = pkgs.writeShellScript "copyparty-config" ''
+    set -eu
 
-  credentialHash = builtins.substring 0 16 (builtins.hashString "sha256" accountName);
+    umask 077
+    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
 
-  credentialName = "password-${credentialHash}";
+    cat > /run/copyparty/copyparty.conf <<EOF
+    [global]
+      p: ${toString cfg.port}
+      usernames
+      http-only
+      no-crt
+      no-thumb
+      no-snap
+      no-rescan
+      ses-db: ${cfg.stateDir}/sessions.db
+      chpw-db: ${cfg.stateDir}/chpw.json
+      shr-db: ${cfg.stateDir}/shares.db
+    ${renderedReverseProxy}
+    [accounts]
+      ${cfg.accountName}: $password
 
-  passwordPlaceholder = "@COPYPARTY_PASSWORD_${credentialHash}@";
-
-  globalSettings = {
-    i = "0.0.0.0";
-    usernames = true;
-    "http-only" = true;
-    "no-crt" = true;
-    "no-thumb" = true;
-    "no-snap" = true;
-    "no-rescan" = true;
-    "ses-db" = "${serviceStateDir}/sessions.db";
-    "chpw-db" = "${serviceStateDir}/chpw.json";
-    "shr-db" = "${serviceStateDir}/shares.db";
-  }
-  // lib.optionalAttrs cfg.reverseProxy.enable {
-    rproxy = 1;
-    "xff-hdr" = "x-forwarded-for";
-  };
-
-  globalExtraConfig = lib.optionalString cfg.reverseProxy.enable (
-    lib.concatMapStringsSep "\n" (source: "xff-src: ${source}") cfg.reverseProxy.trustedSources
-  );
-
-  volumeFlags =
-    flags:
-    lib.optionalAttrs (flags != { }) (
-      {
-        chmod_d = "2770";
-        chmod_f = "660";
-      }
-      // flags
-    );
-
-  renderedVolumes = lib.mapAttrs (_urlPath: volume: {
-    inherit (volume) path;
-    access = if volume.readOnly then { r = [ accountName ]; } else defaultAccess // volume.access;
-    flags = volumeFlags (lib.optionalAttrs (!volume.readOnly) defaultWritableFlags // volume.flags);
-  }) cfg.volumes;
-
-  configText = util.formats.copyparty.render {
-    inherit globalExtraConfig;
-    accounts.${accountName} = passwordPlaceholder;
-    global = globalSettings;
-    volumes = renderedVolumes;
-  };
-
-  configFile = pkgs.writeText "copyparty.conf" configText;
-
-  replacePassword = ''
-    ${lib.getExe pkgs.replace-secret} ${lib.escapeShellArg passwordPlaceholder} "$CREDENTIALS_DIRECTORY/${credentialName}" /run/copyparty/copyparty.conf
+    ${renderedVolumes}
+    EOF
   '';
+  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
+
+  hasFlag =
+    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+
+  defaultPermissionFlags =
+    flags:
+    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
+    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+
+  renderFlags =
+    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
+
+  renderVolume = urlPath: volume: ''
+    [${urlPath}]
+      ${volume.path}
+      accs:
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
+    ${lib.optionalString (volume.flags != [ ]) ''
+        flags:
+      ${renderFlags volume.flags}
+    ''}
+  '';
+
+  renderTrustedSource = source: "  xff-src: ${source}";
+
+  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
+      rproxy: 1
+      xff-hdr: x-forwarded-for
+    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
+  '';
+
+  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
+
 in
 {
   options.modules.services.copyparty = {
     enable = lib.mkEnableOption "Copyparty";
 
-    passwordFile = lib.mkOption {
+    package = lib.mkPackageOption pkgs "copyparty-min" { };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3923;
+      description = "Port Copyparty listens on.";
+    };
+
+    user = lib.mkOption {
       type = lib.types.str;
-      description = "Sets the runtime file that contains the Copyparty account password.";
+      default = "copyparty";
+      description = "User account that runs Copyparty.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "storage";
+      description = "Group account that owns Copyparty's writable state and served files.";
+    };
+
+    accountName = lib.mkOption {
+      type = lib.types.str;
+      default = "alexion";
+      description = "Copyparty account name configured for password authentication.";
+    };
+
+    passwordFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Copyparty account password.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Directory where Copyparty stores service state.";
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf (
-        lib.types.submodule {
-          options = {
-            path = lib.mkOption {
-              type = lib.types.externalPath;
-              description = "Sets the filesystem path served by this volume.";
-            };
-
-            access = lib.mkOption {
-              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-              default = { };
-              example = {
-                A = [ "alexion" ];
-              };
-              description = "Maps Copyparty permission strings to account names.";
-            };
-
-            readOnly = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-              description = "Serves this volume read-only.";
-            };
-
-            flags = lib.mkOption {
-              type = lib.types.attrs;
-              default = { };
-              example = {
-                dthumb = true;
-              };
-              description = "Sets Copyparty volume flags.";
-            };
-          };
-        }
-      );
+      type = lib.types.attrsOf volumeType;
       default = { };
-      description = "Defines Copyparty volumes by URL path.";
+      description = "Copyparty volumes keyed by their URL path.";
     };
 
     reverseProxy = {
@@ -139,7 +151,7 @@ in
       trustedSources = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
-        description = "Lists proxy sources that can set Copyparty's forwarded client IP header.";
+        description = "IP ranges that may supply Copyparty's forwarded client IP header.";
       };
     };
   };
@@ -161,49 +173,46 @@ in
         }
       ];
 
-      users.users.${serviceUser} = {
+      users.users.${cfg.user} = {
         isSystemUser = true;
         uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-        group = serviceGroup;
-        home = serviceStateDir;
+        inherit (cfg) group;
+        home = cfg.stateDir;
       };
 
       systemd.services.copyparty = {
         description = "Copyparty file server";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        preStart = ''
-          ${lib.getExe' pkgs.coreutils "install"} -m 600 ${configFile} /run/copyparty/copyparty.conf
-          ${replacePassword}
-        '';
         serviceConfig = {
           ReloadSignal = "SIGUSR1";
           Type = "simple";
-          User = serviceUser;
-          Group = serviceGroup;
-          WorkingDirectory = serviceStateDir;
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = cfg.stateDir;
           Environment = [
-            "HOME=${serviceStateDir}"
-            "XDG_CONFIG_HOME=${serviceStateDir}"
+            "HOME=${cfg.stateDir}"
+            "XDG_CONFIG_HOME=${cfg.stateDir}"
           ];
           StateDirectory = "copyparty";
           RuntimeDirectory = "copyparty";
           RuntimeDirectoryMode = "0700";
-          LoadCredential = [ "${credentialName}:${cfg.passwordFile}" ];
-          ExecStart = "${lib.getExe pkgs.copyparty-min} -c /run/copyparty/copyparty.conf";
+          LoadCredential = [ "password:${cfg.passwordFile}" ];
+          ExecStartPre = configScript;
+          ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
           Restart = "on-failure";
           NoNewPrivileges = true;
           PrivateTmp = true;
           ProtectSystem = "strict";
           ProtectHome = true;
           ReadWritePaths = [
-            serviceStateDir
+            cfg.stateDir
           ]
-          ++ map (volume: volume.path) writableVolumes;
+          ++ map (volume: volume.path) (lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes));
         };
       };
 
-      networking.firewall.allowedTCPPorts = [ port ];
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
     })
   ];
 }

configs/nixos/modules/services/homepage.nix

@@ -111,8 +111,7 @@ let
     let
       sectionOrder = sectionOrderByTab.${tab} or [ ];
     in
-    lib.filter (section: lib.hasAttr section sections) sectionOrder
-    ++ lib.filter (section: !lib.elem section sectionOrder) (lib.attrNames sections);
+    sectionOrder ++ lib.filter (section: !lib.elem section sectionOrder) (lib.attrNames sections);
 
 in
 {

configs/nixos/modules/shell/pi/default.nix

@@ -12,14 +12,18 @@ let
   piDir = "${config.users.users.${user}.home}/.pi/agent";
 in
 {
-  options.modules.shell.pi.enable =
-    lib.mkEnableOption "Pi, a terminal coding agent, configured through home-manager";
+  options.modules.shell.pi = {
+    enable = lib.mkEnableOption "Pi, a terminal coding agent, configured through home-manager";
+  };
 
   config = lib.mkIf config.modules.shell.pi.enable {
     home-manager.users.${user} = {
       programs.pi-coding-agent = {
         enable = true;
-        package = pkgs.alexion.pi-coding-agent;
+        package = pkgs.pi-coding-agent.overrideAttrs {
+          src = ../../../../../third_party/pi;
+          patches = [ ];
+        };
 
         settings = {
           defaultProvider = "openai-codex";

src/dotfiles/default.nix

@@ -14,7 +14,7 @@ let
     registry = registry.collected;
   };
 
-  util = import ./util { inherit lib; };
+  util = import ./util.nix { inherit lib; };
 
   registry = import ./registry.nix {
     inherit lib util;
@@ -33,12 +33,7 @@ let
     repositoryModules = modules;
     root = root + "/guests";
   };
-  modules.imports = [
-    {
-      nixpkgs.overlays = [ self.overlays.custom ];
-    }
-  ]
-  ++ util.collectNixFiles (root + "/modules");
+  modules.imports = util.collectNixFiles (root + "/modules");
 
 in
 import ./hosts.nix {

src/dotfiles/util.nix

@@ -21,9 +21,8 @@ let
     value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
 in
 {
-  formats.copyparty = import ./format-copyparty.nix { inherit lib; };
-
   inherit collectNixFiles;
+
   removeNixSuffix = path: lib.removeSuffix ".nix" (builtins.baseNameOf path);
 
   glyph =

src/dotfiles/util/format-copyparty.nix

@@ -1,58 +0,0 @@
-{ lib }:
-let
-  renderLine =
-    indent: name: value:
-    if value == true then
-      "${indent}${name}"
-    else if value == false then
-      null
-    else if lib.isList value then
-      "${indent}${name}: ${lib.concatStringsSep ", " (map toString value)}"
-    else
-      "${indent}${name}: ${toString value}";
-
-  renderAttrs =
-    indent: attrs:
-    lib.pipe attrs [
-      lib.attrsToList
-      (map ({ name, value }: renderLine indent name value))
-      (lib.filter (line: line != null))
-      (lib.concatStringsSep "\n")
-    ];
-
-  renderSectionName = name: "[${lib.escape [ "[" "]" ] name}]";
-
-  renderSection = name: attrs: ''
-    ${renderSectionName name}
-    ${renderAttrs "" attrs}
-  '';
-
-  renderSubsection =
-    name: attrs:
-    lib.optionalString (attrs != { }) ''
-      ${name}:
-      ${renderAttrs "  " attrs}
-    '';
-
-  renderVolume = urlPath: volume: ''
-    ${renderSectionName urlPath}
-    ${volume.path}
-    ${renderSubsection "accs" volume.access}
-    ${renderSubsection "flags" volume.flags}
-  '';
-in
-{
-  render =
-    {
-      accounts,
-      global,
-      volumes,
-      globalExtraConfig ? "",
-    }:
-    ''
-      ${renderSection "global" global}
-      ${globalExtraConfig}
-      ${renderSection "accounts" accounts}
-      ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume volumes)}
-    '';
-}

src/flake/default.nix

@@ -6,19 +6,6 @@
   system,
 }:
 {
-  overlays.custom = final: _prev: {
-    alexion = import ./packages {
-      pkgs = final;
-      inherit root;
-    };
-  };
-
-  packages.${system} =
-    (import inputs.nixpkgs {
-      inherit system;
-      overlays = [ self.overlays.custom ];
-    }).alexion;
-
   nixosConfigurations = import ../dotfiles {
     inherit
       inputs

src/flake/packages/default.nix

@@ -1,8 +0,0 @@
-{ pkgs, root }:
-{
-  pi-coding-agent = pkgs.callPackage ./pi-coding-agent.nix {
-    inherit root;
-  };
-
-  waybar = pkgs.callPackage ./waybar.nix { };
-}

src/flake/packages/pi-coding-agent.nix

@@ -1,8 +0,0 @@
-{
-  pi-coding-agent,
-  root,
-}:
-pi-coding-agent.overrideAttrs {
-  src = root + "/third_party/pi";
-  patches = [ ];
-}

src/flake/packages/waybar.nix

@@ -1,28 +0,0 @@
-{
-  fetchFromGitHub,
-  waybar,
-}:
-waybar.overrideAttrs {
-  src = fetchFromGitHub {
-    owner = "Alexays";
-    repo = "Waybar";
-    rev = "05945748dccce28bf96d26d8f64a9e69a8dd49ba";
-    hash = "sha256-51R3mIt8cLNvh/X5qe9vOqeJCj0U9KRyemVE5y+OhiU=";
-  };
-
-  postUnpack =
-    let
-      libcava = fetchFromGitHub {
-        owner = "LukashonakV";
-        repo = "cava";
-        tag = "0.10.7";
-        hash = "sha256-zkyj1vBzHtoypX4Bxdh1Vmwh967DKKxN751v79hzmgQ=";
-      };
-    in
-    ''
-      pushd "$sourceRoot"
-      cp -R --no-preserve=mode,ownership ${libcava} subprojects/cava-0.10.7
-      patchShebangs .
-      popd
-    '';
-}