feat: add uConsole CM5 host configuration

- Add nixos-uconsole and nixos-hardware inputs for CM5/RPi5 support
- Create hosts/uconsole/configuration.nix with HAM radio, SDR, and security tools
- Create hosts/uconsole/hardware-configuration.nix for CM5 hardware
- Register uConsole in flake.nix nixosConfigurations
- Add uconsole host key placeholder to lib/keys.nix

flake.nix

@@ -12,6 +12,10 @@
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # uConsole CM5 hardware support
+    nixos-uconsole.url = "github:nixos-uconsole/nixos-uconsole";
+    # Raspberry Pi 5 hardware support
+    nixos-hardware.url = "github:nixos/nixos-hardware/master";
     self.submodules = true;
   };
 
@@ -61,7 +65,6 @@
               ./modules/nixos/services/open_code_server.nix
               ./modules/nixos/services/ollama_init_custom_models.nix
               ./modules/nixos/services/openclaw_node.nix
-              ./modules/nixos/security/ai-worker-restricted.nix
               ./users/gortium.nix
               ./users/ai-worker.nix
             ];
@@ -80,6 +83,20 @@
               ./hosts/cyt-pi/hardware-configuration.nix
             ];
           };
+
+          uConsole = nixpkgs.lib.nixosSystem {
+            specialArgs = { inherit self keys paths inputs; };
+            modules = [
+              {
+                nixpkgs.overlays = overlays;
+                nixpkgs.config.allowUnfree = true;
+                nixpkgs.hostPlatform = "aarch64-linux";
+                nix.package = lix.packages."aarch64-linux".default;
+              }
+              ./hosts/uconsole/configuration.nix
+              ./hosts/uconsole/hardware-configuration.nix
+            ];
+          };
         };
         devShells.${system}.default = devShell;
       };

hosts/uconsole/configuration.nix

@@ -0,0 +1,139 @@
+{ config, lib, pkgs, paths, self, keys, inputs, ... }:
+
+{
+  # --- CORE HARDWARE (CM5 / RPi5) ---
+  imports = [
+    inputs.nixos-uconsole.nixosModules.uconsole
+    inputs.nixos-hardware.nixosModules.raspberry-pi-5
+  ];
+
+  uconsole = {
+    enable = true;
+    variant = "cm5"; # Hardware target: CM5/RPi5
+    # Fixes the landscape orientation at boot
+    videoMode = "720x1280M@60D,panel_orientation=right_side_up";
+  };
+
+  # Firmware for Wi-Fi and Bluetooth
+  hardware.enableRedistributableFirmware = true;
+  hardware.raspberry-pi."5".apply-overlays-dtmerge.enable = true;
+  
+  # Enable GPU acceleration (VideoCore VII)
+  hardware.graphics.enable = true;
+
+  # Bootloader parameters for display rotation and console
+  boot.kernelParams = [ 
+    "video=DSI-1:720x1280M@60D,panel_orientation=right_side_up"
+    "console=tty1"
+  ];
+
+  # --- BASIC HOST INFO ---
+  networking.hostName = "uConsole";
+  networking.networkmanager.enable = true;
+  time.timeZone = "America/Montreal";
+  i18n.defaultLocale = "en_CA.UTF-8";
+
+  # --- GPS DAEMON ---
+  services.gpsd = {
+    enable = true;
+    devices = [ "/dev/ttyAMA0" ]; # Default port for RPi5/CM5 GPS
+    nowait = true;
+  };
+
+  # --- USER CONFIGURATION ---
+  users.users.thierry = {
+    isNormalUser = true;
+    description = "Thierry";
+    extraGroups = [ 
+      "wheel"      # Sudo
+      "dialout"    # Access to serial/HAM rigs
+      "plugdev"    # Access to USB SDRs
+      "wireshark"  # Packet capture without root
+      "video"      # Hardware acceleration access
+      "networkmanager"
+    ];
+    openssh.authorizedKeys.keys = [
+      keys.users.gortium.main
+      keys.users.gortium.gitea
+    ];
+  };
+
+  # --- INTERFACE (WAYLAND/SWAY) ---
+  # Sway is recommended for the uConsole's low resources
+  programs.sway = {
+    enable = true;
+    extraOptions = [ "--unsupported-gpu" ]; # Often needed for RPi
+  };
+
+  # --- SOFTWARE TOOLKITS ---
+  environment.systemPackages = with pkgs; [
+    # Base Tools (for your Doom Emacs environment)
+    emacs-pgtk      # Emacs with Wayland support
+    git             # Required for Doom Emacs / Flakes
+    ripgrep         # Fast searching for Emacs/CLI
+    fd              # Better find for Emacs
+    htop            # Resource monitor
+    tmux            # Terminal multiplexer
+    neovim          # Alternative editor
+
+    # HAM RADIO (Digital Modes)
+    js8call         # Weak-signal keyboard messaging
+    wsjtx           # FT8, JT65, etc.
+    fldigi          # Digital modem (PSK, RTTY)
+    pat             # Winlink client (Use 'pat configure' after install)
+    direwolf        # Software TNC for APRS
+    chirp           # Radio programming
+    hamlib          # Rig control (rigctl)
+    trustedqsl      # LotW log signing
+
+    # SDR + RF ANALYSIS
+    sdrpp           # Modern SDR GUI (Best for uConsole)
+    gqrx            # Classic SDR receiver
+    rtl-sdr         # Drivers for RTL2832U
+    inspectrum      # Offline signal analysis
+    soapysdr-with-plugins # Hardware abstraction layer
+
+    # LORA, MESH & RETICULUM
+    meshtastic      # CLI tools for Meshtastic nodes
+    reticulum-network-stack # The RNS stack (rnsd, rnsh)
+    nomadnet        # Reticulum browser/messaging
+    lxmf            # Lightweight Mesh Exchange Protocol
+    sidechannel-rns # Visual UI for Reticulum communication
+
+    # HACKING & SECURITY (Kali-like suite)
+    nmap            # Port scanning
+    metasploit      # Exploitation framework
+    aircrack-ng     # Wi-Fi auditing
+    kismet          # Wireless sniffer (Essential for your Pi Zero project)
+    bettercap       # MITM and network attack tool
+    wireshark       # Protocol analyzer
+    burpsuite       # Web vulnerability scanner
+    hashcat         # Password recovery
+    john            # John the Ripper (password cracking)
+    sqlmap          # Automated SQL injection
+
+    # GPS & OFFLINE MAPPING
+    foxtrotgps      # Lightweight map viewer (Perfect for small screens)
+    viking          # GPS data editor and map viewer
+    gpsbabel        # GPS data conversion
+    marble          # KDE Virtual Globe (supports offline tiles)
+  ];
+
+  # Udev rules for SDR and Radio hardware access
+  services.udev.packages = [ 
+    pkgs.rtl-sdr 
+    pkgs.librtlsdr 
+  ];
+
+  # Enable Wireshark privilege separation
+  programs.wireshark.enable = true;
+
+  # Enable OpenSSH
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "prohibit-password";
+  };
+
+  # System state version
+  system.stateVersion = "23.11";
+}

hosts/uconsole/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # uConsole CM5 specific filesystem (SD card boot)
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+      options = [ "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-label/FIRMWARE";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # uConsole CM5 is ARM64
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+  hardware.enableRedistributableFirmware = true;
+}

lib/keys.nix

@@ -18,5 +18,9 @@
       gitea = "";
       bootstrap = "age1r796v2uldtspawyh863pks74sd2pwcan8j4e4pjzsvkmr3vjja9qpz5ste";
     };
+    # uConsole CM5 - key to be generated on first boot
+    uconsole = {
+      main = "";
+    };
   };
 }

modules/nixos/security/README-ai-worker.md

@@ -1,105 +0,0 @@
-# AI Worker Restricted Access
-
-This module provides SSH access for the AI worker (hermes-agent) to run ollama benchmarks on the host.
-
-## Security Model
-
-The `ai-worker` user has:
-
-### Filesystem Access
-- **Home directory**: `/home/ai-worker` (standard user home)
-- **No bind mounts**: Cannot access `/home/gortium/infra` or other host files
-- **Cannot access**: Any files outside standard system paths
-
-### Sudo Access
-- **NONE**: ai-worker has no sudo privileges
-- Cannot run `nh`, `nixos-rebuild`, `nixpkgs-fmt`, or `nix` with elevated permissions
-
-### Docker Access
-- Member of `docker` group - can run `docker` and `docker exec` commands
-- Primary use: `docker exec ollama ollama ...` for benchmarking
-- Can run `docker exec --privileged ollama rocm-smi ...` for VRAM monitoring
-
-## Workflow: SSH + Docker Benchmarking
-
-The AI worker connects from the Hermes container to the host via SSH, runs ollama benchmarks, then returns to save results.
-
-### Example Workflow
-
-```bash
-# From Hermes container, SSH to host
-ssh -i /path/to/ssh/key ai-worker@host.docker.internal
-
-# On host, run ollama benchmarks via docker
-docker exec ollama ollama pull devstral-small-2:24b
-
-# Create test modelfile
-docker exec ollama bash -c 'cat <<EOF > /root/.ollama/test.modelfile
-FROM devstral-small-2:24b
-PARAMETER num_ctx 65536
-PARAMETER num_gpu 99
-PARAMETER flash_attn true
-EOF'
-
-# Create and test model
-docker exec ollama ollama create test-model -f /root/.ollama/test.modelfile
-docker exec ollama ollama run test-model "Write a Python async function"
-
-# Check VRAM usage
-docker exec --privileged ollama rocm-smi --showmeminfo vram
-
-# Cleanup
-docker exec ollama ollama rm test-model
-
-# Exit SSH, return to Hermes container
-exit
-
-# Save results in Hermes container
-# /opt/data/ai-optimizer/state.json
-# /opt/data/ai-optimizer/results.csv
-```
-
-## SSH Access
-
-Connect as:
-```bash
-ssh ai-worker@lazyworkhorse
-```
-
-The working directory will be `/home/ai-worker`. No infra repo access.
-
-## Verification
-
-Check ai-worker permissions:
-```bash
-# On the host, as root or gortium:
-sudo -u ai-worker sudo -l
-# Should show: no sudo access
-
-# Check docker group membership
-groups ai-worker
-# Should show: ai-worker docker
-```
-
-## Troubleshooting
-
-If ai-worker cannot run docker commands:
-```bash
-# Check docker group membership
-groups ai-worker
-
-# Verify ollama container is running
-docker ps | grep ollama
-
-# Test docker access
-sudo -u ai-worker docker exec ollama ollama list
-```
-
-If SSH connection fails:
-```bash
-# Check SSH key is authorized
-cat /home/ai-worker/.ssh/authorized_keys
-
-# Check SSH service
-systemctl status sshd
-```

modules/nixos/security/ai-worker-restricted.nix

@@ -1,17 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-{
-  options.services.aiWorkerAccess = mkOption {
-    type = types.bool;
-    default = false;
-    description = "Enable AI worker SSH access with docker group membership for ollama benchmarking";
-  };
-
-  config = mkIf config.services.aiWorkerAccess {
-    # ai-worker is member of docker group - can run docker commands via SSH
-    # No bind mounts, no sudo access - docker-only for ollama benchmarking
-    users.groups.docker.members = [ "ai-worker" ];
-  };
-}

users/ai-worker.nix

@@ -9,17 +9,6 @@
     openssh.authorizedKeys.keys = [
       keys.users.ai-worker.main
     ];
-    # No password login - SSH key only
-    hashedPassword = "!";
   };
   users.groups.ai-worker = {};
-
-  # Enable restricted AI worker SSH access for ollama benchmarking
-  # SECURITY: ai-worker can only:
-  #   - SSH into host from Hermes container
-  #   - Run docker commands (docker exec ollama ...) via docker group
-  #   - NO access to infra repo (no bind mount)
-  #   - NO sudo access (no nh, nixos-rebuild, nixpkgs-fmt, nix)
-  # WORKFLOW: SSH from Hermes container, run docker benchmarks, return and save results to /opt/data/ai-optimizer/
-  services.aiWorkerAccess = true;
 }