feat: add WireGuard Waybar custom module

- Added scripts/wireguard-status.sh — JSON output with lock/unlock icons,
  human-readable TX/RX stats, tooltip with peer/endpoint/IP details
- Added custom/wireguard module to Waybar modules.json (10s interval, JSON
  return type, click left/right for up/down)
- Added custom/wireguard to modules-right bar config
- Added CSS for #custom-wireguard (connected/disconnected classes)
- Added openresolv install and Waybar refresh instructions to README.org

Makefile

@@ -1,15 +1,10 @@
 # Define list of directories you want to stow
 CONFIG_DIRS := btop doom hypr kitty local nvim rclone starship tmux wallpapers waybar wireplumber wofi yazi zsh
 
-# Local stow package directory (installed to ~/.local)
-STOW_LOCAL_DIR := local
-
 all: stow_all
 	wal -i ~/.config/wallpapers/green_yellow_forest.jpg -o ~/.config/waybar/launch.sh
 	neofetch
 
-.PHONY: all stow_all stow_local stow_rclone post_install_rclone clean
-
 # Main target to handle stowing for all directories except rclone
 stow_all: $(filter-out rclone, $(CONFIG_DIRS))
 	@echo "Cleaning broken symlinks in ~/.config..."
@@ -26,13 +21,6 @@ stow_%:
 	@echo "Stowing $*"
 	stow -v -t $(HOME) $*
 
-# Special target for the local stow package
-stow_local:
-	@echo "Cleaning broken symlinks in ~/.local/share/applications..."
-	find ~/.local/share/applications -xtype l -delete -print
-	@echo "Stowing local package"
-	stow -v -t $(HOME) $(STOW_LOCAL_DIR)
-
 # Post-installation script for rclone (executed after stowing)
 post_install_rclone:
 	@echo "Running post-installation script for rclone"
@@ -47,11 +35,3 @@ stow_rclone:
 	@echo "Stowing rclone"
 	stow -v -t $(HOME) rclone
 	@$(MAKE) post_install_rclone
-
-# Unstow all packages
-clean:
-	@echo "Unstowing all packages..."
-	@for dir in $(CONFIG_DIRS); do \
-		echo "Unstowing $$dir..."; \
-		stow -v -D -t $(HOME) $$dir 2>/dev/null || true; \
-	done

README.org

@@ -17,6 +17,42 @@ I use stow to deploy all this to where it need to go (mostly ~/.confg).
 ** starship
 ** tmux
 ** waybar
+*** WireGuard Module
+The Waybar includes a custom WireGuard VPN status module that shows connection status, TX/RX stats, and peer info.
+
+Setup:
+
+1. Install openresolv (needed by wg-quick for DNS):
+   #+begin_src bash :tangle no
+   sudo pacman -S openresolv
+   #+end_src
+
+2. Configure sudo for wg-quick (required for click-to-toggle binds):
+   #+begin_src bash :tangle no
+   echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/wg-quick" | sudo tee /etc/sudoers.d/wireguard
+   #+end_src
+
+3. Create a WireGuard config (if not exists):
+   #+begin_src bash :tangle no
+   sudo cp /etc/wireguard/work-laptop.conf /etc/wireguard/
+   sudo chmod 600 /etc/wireguard/work-laptop.conf
+   #+end_src
+
+4. Refresh Waybar to pick up new config:
+   #+begin_src bash :tangle no
+   killall -q waybar && waybar -c ~/.config/waybar/config.jsonc & -s ~/.config/waybar/style.css &
+   #+end_src
+
+Or use the launch script:
+   #+begin_src bash :tangle no
+   ~/.config/waybar/launch.sh
+   #+end_src
+
+Keybinds:
+- ~$mainMod+Ctrl+V~ — Connect WireGuard (work-laptop)
+- ~$mainMod+Ctrl+Shift+V~ — Disconnect WireGuard
+
+The module polls /usr/bin/wg every 10 seconds. It shows a lock icon with TX/RX when connected, or an unlock icon when disconnected.
 ** Wireplumber
 ** wofi
 ** yazi

doom/.config/doom/README.org

@@ -496,19 +496,6 @@ change ~org-directory~. It must be set before org loads!
 
            ((org-agenda-tag-filter-preset '("+BA_ON_SITE")))
            )
-          ("wA" "Projet Airbus Vision"
-           ((agenda ""
-                    ((org-agenda-span 150)
-                     (org-agenda-start-day "2026-05-01")
-                     (org-agenda-overriding-header "📅 Projet Airbus Vision")
-                     (org-agenda-prefix-format " %12t") ;; reserve time space
-                     (org-agenda-todo-keyword-format "    %-5s") ;; fixed-width TODO
-                     (org-agenda-tags-column -100) ;; right-align tags
-                     (org-agenda-time-grid nil)
-                     )))
-
-           ((org-agenda-tag-filter-preset '("+airbus")))
-           )
           )
         )
   )

doom/.config/doom/config.el

@@ -367,19 +367,6 @@
 
            ((org-agenda-tag-filter-preset '("+BA_ON_SITE")))
            )
-          ("wA" "Projet Airbus Vision"
-           ((agenda ""
-                    ((org-agenda-span 150)
-                     (org-agenda-start-day "2026-05-01")
-                     (org-agenda-overriding-header "📅 Projet Airbus Vision")
-                     (org-agenda-prefix-format " %12t") ;; reserve time space
-                     (org-agenda-todo-keyword-format "    %-5s") ;; fixed-width TODO
-                     (org-agenda-tags-column -100) ;; right-align tags
-                     (org-agenda-time-grid nil)
-                     )))
-
-           ((org-agenda-tag-filter-preset '("+airbus")))
-           )
           )
         )
   )

hypr/.config/hypr/hyprland.conf

@@ -8,7 +8,6 @@
 # You can split this configuration into multiple files
 # Create your files separately and then link them to this file like this:
 # source = ~/.config/hypr/myColors.conf
-source = mocha.conf
 source = ~/.cache/wal/colors-hyprland.conf
 
 ################
@@ -231,6 +230,10 @@ bind = $mainMod, B, exec, python /home/tpouplier/ExoKortex/4-Automata/recordntra
 bind = $mainMod, A, exec, $music
 bind = $mainMod, C, exec, emacsclient -n -c -e '(gortium/hermes-vterm)'
 
+# WireGuard VPN toggle (uses config file: /etc/wireguard/work-laptop.conf)
+bind = $mainMod CTRL, V, exec, sudo wg-quick up work-laptop
+bind = $mainMod CTRL SHIFT, V, exec, sudo wg-quick down work-laptop
+
 # Full screen
 bind = SUPER, F, fullscreen 
 

hypr/.config/hypr/mocha.conf

@@ -76,11 +76,3 @@ $mantleAlpha = 181825
 
 $crust = rgb(11111b)
 $crustAlpha = 11111b
-
-# Fallback colors for when pywal hasn't generated colors-hyprland.conf
-# (sourced by hyprland.conf — $color1/$color2 for active border gradients,
-#  $background for inactive border and general bg usage)
-$color1 = rgb(cba6f7)
-$color2 = rgb(f5c2e7)
-$color3 = rgb(89b4fa)
-$background = rgb(1e1e2e)

scripts/scrot-ocr.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-scrot-ocr: Select screen region → OCR → clipboard
-Deps: grim, slurp, tesseract, wl-clipboard, libnotify
-set -euo pipefail
-
-LANG="${1:-eng}"
-IMG="/tmp/scrot-ocr-$(date +%s).png"
-
-grim -g "$(slurp -d)" "$IMG"
-TEXT=$(tesseract "$IMG" stdout -l "$LANG" 2>/dev/null | sed '/^[[:space:]]*$/d')
-
-echo -n "$TEXT" | wl-copy --paste-once
-echo "$TEXT"
-
-notify-send "scrot-ocr" "$(echo "$TEXT" | wc -l) lines copied to clipboard" -t 3000
-rm -f "$IMG"

scripts/wireguard-status.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# wireguard-status.sh -- JSON status for Waybar
+# Outputs: {"text":"...","class":"connected|disconnected","tooltip":"..."}
+#
+# Waybar config example (in ~/.config/waybar/config.jsonc):
+#   "custom/wireguard": {
+#       "exec": "$HOME/.config/waybar/scripts/wireguard-status.sh",
+#       "interval": 10,
+#       "return-type": "json"
+#   }
+
+set -euo pipefail
+
+# --- Config -------------------------------------------------------
+ICON_LOCKED="\uf023"       # nf-fa-lock (FontAwesome)
+ICON_UNLOCKED="\uf09e"     # nf-fa-unlock
+# Override with environment variables if set:
+ICON_LOCKED="${WG_ICON_LOCKED:-$ICON_LOCKED}"
+ICON_UNLOCKED="${WG_ICON_UNLOCKED:-$ICON_UNLOCKED}"
+
+# --- Helpers ------------------------------------------------------
+die() { echo "$*" >&2; exit 1; }
+
+# Find the wg binary — works on NixOS, standard Linux, etc.
+find_wg() {
+    if command -v wg &>/dev/null; then
+        echo "wg"
+    elif [ -x /run/current-system/sw/bin/wg ]; then
+        echo "/run/current-system/sw/bin/wg"
+    elif [ -x /usr/bin/wg ]; then
+        echo "/usr/bin/wg"
+    else
+        return 1
+    fi
+}
+
+# Find the ip binary
+find_ip() {
+    if command -v ip &>/dev/null; then
+        echo "ip"
+    elif [ -x /run/current-system/sw/bin/ip ]; then
+        echo "/run/current-system/sw/bin/ip"
+    elif [ -x /usr/sbin/ip ]; then
+        echo "/usr/sbin/ip"
+    elif [ -x /sbin/ip ]; then
+        echo "/sbin/ip"
+    else
+        return 1
+    fi
+}
+
+format_bytes() {
+    local bytes=$1
+    if [ "$bytes" -lt 1024 ]; then
+        echo "${bytes}B"
+    elif [ "$bytes" -lt $((1024 * 1024)) ]; then
+        echo "$(awk "BEGIN { printf \"%.1f KiB\", $bytes / 1024 }")"
+    elif [ "$bytes" -lt $((1024 * 1024 * 1024)) ]; then
+        echo "$(awk "BEGIN { printf \"%.1f MiB\", $bytes / (1024 * 1024) }")"
+    else
+        echo "$(awk "BEGIN { printf \"%.2f GiB\", $bytes / (1024 * 1024 * 1024) }")"
+    fi
+}
+
+# --- Main ---------------------------------------------------------
+
+WG_BIN=$(find_wg 2>/dev/null) || {
+    # wg not installed — report as disconnected
+    printf '{"text":"%s","class":"disconnected","tooltip":"WireGuard not installed"}\n' "$ICON_UNLOCKED"
+    exit 0
+}
+
+IP_BIN=$(find_ip 2>/dev/null) || true
+
+# Find all WireGuard interfaces
+INTERFACES=$("$WG_BIN" show interfaces 2>/dev/null) || {
+    # No WireGuard interfaces exist (wg module not loaded?)
+    printf '{"text":"%s","class":"disconnected","tooltip":"No WireGuard interfaces"}\n' "$ICON_UNLOCKED"
+    exit 0
+}
+
+# Parse into array, handling possible single-line space-separated output
+IFS=' ' read -ra ifaces <<< "$INTERFACES"
+if [ ${#ifaces[@]} -eq 0 ]; then
+    printf '{"text":"%s","class":"disconnected","tooltip":"No WireGuard interfaces"}\n' "$ICON_UNLOCKED"
+    exit 0
+fi
+
+# Just use the first interface (most setups have one)
+IFACE="${ifaces[0]}"
+
+# Get transfer stats
+TRANSFER=$("$WG_BIN" show "$IFACE" transfer 2>/dev/null) || {
+    printf '{"text":"%s","class":"disconnected","tooltip":"Cannot read stats for %s"}\n' "$ICON_UNLOCKED" "$IFACE"
+    exit 0
+}
+
+# Parse: "rx_bytes tx_bytes"
+RX_BYTES=$(echo "$TRANSFER" | awk '{print $1}')
+TX_BYTES=$(echo "$TRANSFER" | awk '{print $2}')
+
+RX_HUMAN=$(format_bytes "${RX_BYTES:-0}")
+TX_HUMAN=$(format_bytes "${TX_BYTES:-0}")
+
+# Get endpoint info for tooltip
+ENDPOINT=$("$WG_BIN" show "$IFACE" endpoints 2>/dev/null | head -1 | awk '{print $2}') || ENDPOINT=""
+PEER=$("$WG_BIN" show "$IFACE" peers 2>/dev/null | head -1) || PEER=""
+
+# Build status line
+STATUS_TEXT="${ICON_LOCKED} \u2193${RX_HUMAN} \u2191${TX_HUMAN}"
+
+# Build tooltip
+TOOLTIP="${IFACE}"
+if [ -n "$PEER" ]; then
+    TOOLTIP="${TOOLTIP}\nPeer: ${PEER}"
+fi
+if [ -n "$ENDPOINT" ]; then
+    TOOLTIP="${TOOLTIP}\nEndpoint: ${ENDPOINT}"
+fi
+# Add IP info if ip is available
+if [ -n "$IP_BIN" ]; then
+    IFACE_IP=$("$IP_BIN" -4 addr show dev "$IFACE" 2>/dev/null | awk '/inet / {print $2}') || IFACE_IP=""
+    if [ -n "$IFACE_IP" ]; then
+        TOOLTIP="${TOOLTIP}\nIP: ${IFACE_IP}"
+    fi
+fi
+TOOLTIP="${TOOLTIP}\nRX: ${RX_HUMAN}\nTX: ${TX_HUMAN}"
+
+printf '{"text":"%s","class":"connected","tooltip":"%s"}\n' "$STATUS_TEXT" "$TOOLTIP"

waybar/.config/waybar/config.jsonc

@@ -28,6 +28,7 @@
            "pulseaudio",
            "bluetooth",
            "network",
+           "custom/wireguard",
            "battery", 
            "custom/exit"
         ]

waybar/.config/waybar/modules.json

@@ -138,6 +138,15 @@
 		//"on-click": "~/dotfiles/.settings/networkmanager.sh"
 	},
 	
+	// wireguard
+	"custom/wireguard": {
+		"exec": "$HOME/.config/waybar/scripts/wireguard-status.sh",
+		"interval": 10,
+		"return-type": "json",
+		"on-click": "kitty sudo wg-quick up work-laptop",
+		"on-click-right": "kitty sudo wg-quick down work-laptop"
+	},
+
 	// battery
 	"battery": {
 		"states": {

waybar/.config/waybar/style.css

@@ -213,6 +213,21 @@ tooltip label {
 }
 
 /* custom modules */
+#custom-wireguard {
+    margin: 0px 0px 0px 5px;
+    padding: 1px 8px 0px 8px;
+    font-size: 16px;
+    color: @text;
+    border-radius: 5px;
+    background-color: @set;
+}
+#custom-wireguard.connected {
+    background-color: @color5;
+}
+#custom-wireguard.disconnected {
+    background-color: @set;
+}
+
 #custom-exit {
     margin: 0px 18px 0px 5px;
     padding: 0px;

yazi/.config/yazi/yazi.toml

@@ -1,5 +1,6 @@
 # A TOML linter such as https://taplo.tamasfe.dev/ can use this schema to validate your config.
 # If you encounter any issues, please make an issue at https://github.com/yazi-rs/schemas.
+"$schema" = "https://yazi-rs.github.io/schemas/yazi.json"
 
 [mgr]
 ratio          = [ 1, 4, 3 ]

zsh/.zshrc

@@ -20,17 +20,7 @@ alias emacs="emacsclient -c -a emacs"
 alias oc="opencode"
 
 # Hermes Agent - SSH directly to remote server
-hermes() {
-  if [[ -n "$1" ]]; then
-    ssh -t lazyworkhorse \
-      "docker exec -e HERMES_HONCHO_PEER_NAME=$1 -it hermes \
-      /opt/hermes/.venv/bin/hermes --profile $1"
-  else
-    ssh -t lazyworkhorse \
-      "docker exec -e HERMES_HONCHO_PEER_NAME=thierry -it hermes \
-      /opt/hermes/.venv/bin/hermes"
-  fi
-}
+alias hermes="ssh -t lazyworkhorse 'docker exec -it hermes /opt/hermes/.venv/bin/hermes'"
 
 hermes-cp() { 
   if [ $# -eq 0 ]; then