fix: update compose submodule for Matrix bridge deps + persistent venv

Updates assets/compose submodule to 8adbbf0 (compose fix/matrix-bridge-deps).

Compose commit adds:
- uv pip install openai mautrix[encryption] to hermes entrypoint
- Persistent venv volume at /opt/hermes/.venv
- Empty-volume first-boot handling (venv recreation)

This ensures Matrix bridge dependencies survive container recreation.

flake.nix

@@ -17,7 +17,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260517.0";
+      url = "github:nvmd/nixos-raspberrypi/v1.20260317.0";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     self.submodules = true;
@@ -65,7 +65,6 @@
               ./hosts/lazyworkhorse/configuration.nix
               ./hosts/lazyworkhorse/hardware-configuration.nix
               ./modules/nixos/filesystem/hoardingcow-mount.nix
-              ./modules/nixos/filesystem/poup-16t-disk.nix
               ./modules/nixos/services/docker_manager.nix
               ./modules/nixos/services/open_code_server.nix
               ./modules/nixos/services/ollama_init_custom_models.nix

hosts/lazyworkhorse/configuration.nix

@@ -8,21 +8,9 @@
   # NAS Mounting
   hoardingcow-mount.enable = true;
 
-  # 16TB btrfs storage disk (WD Red Pro — Poup_16T — LUKS2 + btrfs + btrbk snapshots)
-  # ⚠ SETUP REQUIRED: Connect the disk, get the LUKS UUID with 'blkid /dev/sdb',
-  #   then set gortium.poup16t.luksUuid here and deploy.
-  # gortium.poup16t = {
-  #   enable = true;
-  #   luksUuid = "REPLACE_ME_WITH_REAL_UUID";
-  # };
-
   # Flakesss
   nix.settings.experimental-features = [ "nix-command" "flakes" "flake-self-attrs" ];
   nix.settings.trusted-users = [ "root" "gortium" ];
-  nix.settings.extra-platforms = [ "aarch64-linux" ];
-
-  # QEMU binfmt for cross-building aarch64 NixOS targets
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   # Garbage collection
   nix.gc = {

hosts/uConsole/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, paths, self, keys, ... }:
+{ config, lib, pkgs, paths, self, ... }:
 
 {
   # Basic Host Info
@@ -9,17 +9,15 @@
   # System State
   system.stateVersion = "25.05";
 
-  # Boot & Hardware (migrated to kernel bootloader per nixos-raspberrypi deprecation notice)
+  # Boot & Hardware (uconsole-cm5 module handles boot.loader)
-  boot.loader.raspberry-pi.bootloader = "kernel";
+  boot.kernelPackages = pkgs.linuxPackages_latest;
-  # kernel managed by nixos-raspberrypi module — don't override, patches are version-specific
-  # boot.kernelPackages = pkgs.linuxPackages_latest;
 
   # Networking
   networking.networkmanager.enable = true;
   services.openssh = {
     enable = true;
-    settings.PermitRootLogin = lib.mkForce "prohibit-password";
+    settings.PermitRootLogin = "prohibit-password";
-    settings.PasswordAuthentication = lib.mkForce false;
+    settings.PasswordAuthentication = false;
   };
 
   # User
@@ -108,7 +106,6 @@
   # ============================================================
   systemd.services.rnsd = {
     description = "Reticulum Network Stack Daemon";
-    wants = [ "network-online.target" ];
     after = [ "network-online.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
@@ -126,7 +123,6 @@
   # ============================================================
   systemd.services.kismet = {
     description = "Kismet Wi-Fi Monitor & IDS";
-    wants = [ "network-online.target" ];
     after = [ "network-online.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {

modules/nixos/filesystem/poup-16t-disk.nix

@@ -1,121 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.gortium.poup16t;
-  luksName = cfg.luksName;
-in
-with lib;
-
-{
-  options.gortium.poup16t = {
-    enable = mkEnableOption "Poup_16T storage disk (btrfs + LUKS + btrbk snapshots)";
-
-    luksUuid = mkOption {
-      type = types.str;
-      description = ''
-        UUID of the LUKS partition on the 16TB disk (WD Red Pro).
-
-        Find this by running as root when the disk is connected:
-          blkid /dev/sdb   # or wherever the disk appears
-          lsblk -o NAME,SIZE,FSTYPE,UUID
-
-        Since btrfs is inside LUKS, the FS UUID is hidden — use the
-        LUKS partition UUID from blkid (it'll show TYPE=\"crypto_LUKS\").
-      '';
-      example = "00000000-0000-0000-0000-000000000000";
-    };
-
-    luksName = mkOption {
-      type = types.str;
-      default = "poup_16t";
-      description = "Name for the LUKS /dev/mapper/ mapping";
-    };
-
-    mountPoint = mkOption {
-      type = types.str;
-      default = "/mnt/Poup_16T";
-      description = "Mount point for the 16TB data disk";
-    };
-
-    btrfsOptions = mkOption {
-      type = types.listOf types.str;
-      default = [ "defaults" "noatime" "compress=zstd:3" "nofail" ];
-      description = "Mount options for the btrfs filesystem. 'nofail' ensures boot succeeds when disk is disconnected.";
-    };
-
-    btrbk = {
-      enable = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Enable btrbk snapshot management on this volume";
-      };
-
-      schedule = mkOption {
-        type = types.str;
-        default = "daily";
-        description = "systemd calendar event for btrbk (e.g. 'daily', 'hourly', '*-*-* 00:00:00')";
-      };
-
-      preserveMin = mkOption {
-        type = types.str;
-        default = "2d";
-        description = "btrbk snapshot_preserve_min — minimum age before pruning";
-      };
-
-      preserve = mkOption {
-        type = types.str;
-        default = "14d 4w 3m";
-        description = "btrbk snapshot_preserve — retention policy (daily, weekly, monthly)";
-      };
-
-      snapshotDir = mkOption {
-        type = types.str;
-        default = ".snapshots";
-        description = "Directory name for snapshots relative to volume root";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # Enable btrfs kernel support (no DKMS needed — it's in-tree)
-    boot.supportedFilesystems = [ "btrfs" ];
-
-    # Install btrfs administration tools
-    environment.systemPackages = with pkgs; [
-      btrfs-progs       # mkfs.btrfs, btrfs, fsck, balance, scrub
-      btrbk             # Snapshot management + rotation
-    ];
-
-    # LUKS2 unlock at boot (uses keyfile or prompts if unavailable)
-    # Since the disk may be disconnected, initrd times out gracefully (~30s)
-    boot.initrd.luks.devices.${luksName} = {
-      device = "/dev/disk/by-uuid/${cfg.luksUuid}";
-      preLVM = false;
-      allowDiscards = true;
-    };
-
-    # Mount the unlocked mapper device as btrfs
-    fileSystems.${cfg.mountPoint} = {
-      device = "/dev/mapper/${luksName}";
-      fsType = "btrfs";
-      options = cfg.btrfsOptions;
-    };
-
-    # btrbk — automated snapshot creation and rotation
-    services.btrbk = mkIf cfg.btrbk.enable {
-      instances.poup16t = {
-        onCalendar = cfg.btrbk.schedule;
-        settings = {
-          snapshot_preserve_min = cfg.btrbk.preserveMin;
-          snapshot_preserve = cfg.btrbk.preserve;
-
-          volume.${cfg.mountPoint} = {
-            snapshot_create = "always";
-            snapshot_dir = cfg.btrbk.snapshotDir;
-            subvolume = ".";
-          };
-        };
-      };
-    };
-  };
-}

overlays/reticulum.nix

@@ -5,7 +5,6 @@ in {
   reticulumStack = python3.pkgs.buildPythonApplication rec {
     pname = "reticulum";
     version = "1.2.9";
-    format = "setuptools";
     src = pyPkgs.fetchPypi {
       pname = "rns";
       inherit version;
@@ -25,7 +24,6 @@ in {
   lxmf = python3.pkgs.buildPythonApplication rec {
     pname = "lxmf";
     version = "0.9.8";
-    format = "setuptools";
     src = pyPkgs.fetchPypi {
       inherit pname version;
       sha256 = "30f39f3a975a049c12ee2cfceb3261d24cb5adec881c6821f7354464b3f3650c";
@@ -44,7 +42,6 @@ in {
   nomadnet = python3.pkgs.buildPythonApplication rec {
     pname = "nomadnet";
     version = "1.1.1";
-    format = "setuptools";
     src = pyPkgs.fetchPypi {
       inherit pname version;
       sha256 = "fa13b64a10e75b705a58024815ab72451700aa726af96d415ba99dec28dfc40a";
@@ -63,7 +60,6 @@ in {
   rnsh = python3.pkgs.buildPythonApplication rec {
     pname = "rnsh";
     version = "0.1.7";
-    format = "setuptools";
     src = pyPkgs.fetchPypi {
       inherit pname version;
       sha256 = "9cb72f25abb1c6d300f8014b264184ff78f592fe88e36094938012990b797c93";